Skip to content

Commit 115e7ee

Browse files
jdaigneau5jdaigneau5
authored
Merge pull request #1477 from CVEProject/dr_cb_integrate_users
Aug 21 - Release
2 parents 89a8ad4 + b87478f commit 115e7ee

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

49 files changed

+2286
-1550
lines changed

‎api-docs/openapi.json‎

Lines changed: 14 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1448,7 +1448,7 @@
14481448
}
14491449
},
14501450
"requestBody": {
1451-
"description": "<h3>Notes:</h3> <ul> <li>**providerMetadata** is set by the server. If provided, it will be overwritten.</li> <li>**datePublished** and **assignerShortname** are optional fields in the schema, but are set by the server. </li> </ul>",
1451+
"description": "<h3>Notes:</h3> <ul> <li>**providerMetadata** is set by the server. If provided, it will be overwritten.</li> <li>**datePublished** and **assignerShortname** are optional fields in the schema, but are set by the server. </li> </ul>",
14521452
"required": true,
14531453
"content": {
14541454
"application/json": {
@@ -1560,7 +1560,7 @@
15601560
}
15611561
},
15621562
"requestBody": {
1563-
"description": "<h3>Notes:</h3> <ul> <li>When updating a rejected record to published, it is recommended to confirm that both the Cve-Id and CVE record are in the correct state after calling this endpoint. Though very unlikely, a race condition can occur causing the two states to be out of sync. </li> <li>**providerMetadata** is set by the server. If provided, it will be overwritten.</li> <li>**datePublished** and **assignerShortname** are optional fields in the schema, but are set by the server. </li> </ul>",
1563+
"description": "<h3>Notes:</h3> <ul> <li>When updating a rejected record to published, it is recommended to confirm that both the Cve-Id and CVE record are in the correct state after calling this endpoint. Though very unlikely, a race condition can occur causing the two states to be out of sync. </li> <li>**providerMetadata** is set by the server. If provided, it will be overwritten.</li> <li>**datePublished** and **assignerShortname** are optional fields in the schema, but are set by the server. </li> </ul>",
15641564
"required": true,
15651565
"content": {
15661566
"application/json": {
@@ -1671,7 +1671,7 @@
16711671
}
16721672
},
16731673
"requestBody": {
1674-
"description": "<h3>Notes:</h3> <ul> <li>**providerMetadata** is set by the server. If provided, it will be overwritten.</li> <li>**datePublished** and **assignerShortname** are optional fields in the schema, but are set by the server. </li> </ul>",
1674+
"description": "<h3>Notes:</h3> <ul> <li>**providerMetadata** is set by the server. If provided, it will be overwritten.</li> <li>**datePublished** and **assignerShortname** are optional fields in the schema, but are set by the server. </li> </ul>",
16751675
"required": true,
16761676
"content": {
16771677
"application/json": {
@@ -1772,7 +1772,7 @@
17721772
}
17731773
},
17741774
"requestBody": {
1775-
"description": "<h3>Notes:</h3> <ul> <li>It is recommended to confirm that both the Cve-Id and CVE record are in the REJECTED state after calling this endpoint. Though very unlikely, a race condition can occur causing the two states to be out of sync. </li> <li>**providerMetadata** is set by the server. If provided, it will be overwritten.</li> <li>**datePublished** and **assignerShortname** are optional fields in the schema, but are set by the server. </li> </ul>",
1775+
"description": "<h3>Notes:</h3> <ul> <li>It is recommended to confirm that both the Cve-Id and CVE record are in the REJECTED state after calling this endpoint. Though very unlikely, a race condition can occur causing the two states to be out of sync. </li> <li>**providerMetadata** is set by the server. If provided, it will be overwritten.</li> <li>**datePublished** and **assignerShortname** are optional fields in the schema, but are set by the server. </li> </ul>",
17761776
"required": true,
17771777
"content": {
17781778
"application/json": {
@@ -1887,6 +1887,16 @@
18871887
}
18881888
}
18891889
},
1890+
"/org/registry/createOrg": {
1891+
"get": {
1892+
"description": "",
1893+
"responses": {
1894+
"400": {
1895+
"description": "Bad Request"
1896+
}
1897+
}
1898+
}
1899+
},
18901900
"/org": {
18911901
"get": {
18921902
"tags": [

‎src/controller/org.controller/index.js‎

Lines changed: 123 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -4,13 +4,126 @@ const mw = require('../../middleware/middleware')
44
const errorMsgs = require('../../middleware/errorMessages')
55
const controller = require('./org.controller')
66
const { body, param, query } = require('express-validator')
7-
const { parseGetParams, parsePostParams, parseError, isUserRole, isValidUsername, validateCreateOrgParameters, validateUpdateOrgParameters, validateUserIdOrUsername } = require('./org.middleware')
7+
const { parseGetParams, parsePostParams, parseError, isUserRole, isValidUsername, isOrgRole, validateUpdateOrgParameters } = require('./org.middleware')
88
// Only God and Javascript know swhy its saying it is not used when it is.....
99
// eslint-disable-next-line no-unused-vars
1010
const { toUpperCaseArray, isFlatStringArray, handleRegistryParameter } = require('../../middleware/middleware')
1111
const getConstants = require('../../../src/constants').getConstants
1212
const CONSTANTS = getConstants()
1313

14+
router.get('/registry/org',
15+
mw.useRegistry(),
16+
mw.validateUser,
17+
mw.onlySecretariat,
18+
query().custom((query) => { return mw.validateQueryParameterNames(query, ['page']) }),
19+
query(['page']).custom((val) => { return mw.containsNoInvalidCharacters(val) }),
20+
query(['page']).optional().isInt({ min: CONSTANTS.PAGINATOR_PAGE }),
21+
parseError,
22+
parseGetParams,
23+
controller.ORG_ALL
24+
)
25+
26+
router.get('/registry/org/:shortname/users',
27+
mw.useRegistry(),
28+
mw.validateUser,
29+
param(['shortname']).isString().trim().notEmpty().isLength({ min: CONSTANTS.MIN_SHORTNAME_LENGTH, max: CONSTANTS.MAX_SHORTNAME_LENGTH }),
30+
query(['page']).optional().isInt({ min: CONSTANTS.PAGINATOR_PAGE }),
31+
parseError,
32+
parseGetParams,
33+
controller.USER_ALL)
34+
35+
router.get('/registry/org/:shortname/id_quota',
36+
mw.useRegistry(),
37+
mw.validateUser,
38+
param(['shortname']).isString().trim().notEmpty().isLength({ min: CONSTANTS.MIN_SHORTNAME_LENGTH, max: CONSTANTS.MAX_SHORTNAME_LENGTH }),
39+
parseError,
40+
parseGetParams,
41+
controller.ORG_ID_QUOTA)
42+
43+
router.get('/registry/org/:identifier',
44+
mw.useRegistry(),
45+
mw.validateUser,
46+
parseError,
47+
parseGetParams,
48+
controller.ORG_SINGLE
49+
)
50+
router.get('/registry/org/:shortname/user/:username',
51+
mw.useRegistry(),
52+
mw.validateUser,
53+
param(['shortname']).isString().trim().notEmpty().isLength({ min: CONSTANTS.MIN_SHORTNAME_LENGTH, max: CONSTANTS.MAX_SHORTNAME_LENGTH }),
54+
param(['username']).isString().trim().notEmpty().custom(isValidUsername),
55+
parseError,
56+
parseGetParams,
57+
controller.USER_SINGLE
58+
)
59+
router.post('/registry/org',
60+
mw.useRegistry(),
61+
mw.validateUser,
62+
mw.onlySecretariat,
63+
parsePostParams,
64+
parseError,
65+
controller.REGISTRY_CREATE_ORG
66+
)
67+
68+
router.put('/registry/org/:shortname',
69+
mw.useRegistry(),
70+
mw.validateUser,
71+
mw.onlySecretariat,
72+
parseError,
73+
parsePostParams,
74+
controller.REGISTRY_UPDATE_ORG
75+
)
76+
77+
router.post('/registry/org/:shortname/user',
78+
mw.useRegistry(),
79+
mw.validateUser,
80+
mw.onlySecretariatOrAdmin,
81+
mw.onlyOrgWithPartnerRole,
82+
parseError,
83+
parsePostParams,
84+
controller.USER_CREATE_SINGLE
85+
)
86+
router.put('/registry/org/:shortname/user/:username',
87+
mw.useRegistry(),
88+
mw.validateUser,
89+
mw.onlyOrgWithPartnerRole,
90+
query().custom((query) => {
91+
return mw.validateQueryParameterNames(query, ['active', 'new_username', 'org_short_name', 'name.first', 'name.last', 'name.middle',
92+
'name.suffix', 'active_roles.add', 'active_roles.remove', 'registry'])
93+
}),
94+
query(['active', 'new_username', 'org_short_name', 'name.first', 'name.last', 'name.middle',
95+
'name.suffix', 'active_roles.add', 'active_roles.remove', 'registry']).custom((val) => { return mw.containsNoInvalidCharacters(val) }),
96+
param(['shortname']).isString().trim().notEmpty().isLength({ min: CONSTANTS.MIN_SHORTNAME_LENGTH, max: CONSTANTS.MAX_SHORTNAME_LENGTH }),
97+
param(['username']).isString().trim().notEmpty().custom(isValidUsername),
98+
query(['active']).optional().isBoolean({ loose: true }),
99+
query(['new_username']).optional().isString().trim().notEmpty().custom(isValidUsername),
100+
query(['org_short_name']).optional().isString().trim().notEmpty().isLength({ min: CONSTANTS.MIN_SHORTNAME_LENGTH, max: CONSTANTS.MAX_SHORTNAME_LENGTH }),
101+
query(['name.first']).optional().isString().trim().isLength({ max: CONSTANTS.MAX_FIRSTNAME_LENGTH }).withMessage(errorMsgs.FIRSTNAME_LENGTH),
102+
query(['name.last']).optional().isString().trim().isLength({ max: CONSTANTS.MAX_LASTNAME_LENGTH }).withMessage(errorMsgs.LASTNAME_LENGTH),
103+
query(['name.middle']).optional().isString().trim().isLength({ max: CONSTANTS.MAX_MIDDLENAME_LENGTH }).withMessage(errorMsgs.MIDDLENAME_LENGTH),
104+
query(['name.suffix']).optional().isString().trim().isLength({ max: CONSTANTS.MAX_SUFFIX_LENGTH }).withMessage(errorMsgs.SUFFIX_LENGTH),
105+
query(['active_roles.add']).optional().toArray()
106+
.custom(isFlatStringArray)
107+
.bail()
108+
.customSanitizer(toUpperCaseArray)
109+
.custom(isUserRole).withMessage(errorMsgs.USER_ROLES),
110+
query(['active_roles.remove']).optional().toArray()
111+
.custom(isFlatStringArray)
112+
.customSanitizer(toUpperCaseArray)
113+
.custom(isUserRole).withMessage(errorMsgs.USER_ROLES),
114+
parseError,
115+
parsePostParams,
116+
controller.USER_UPDATE_SINGLE)
117+
118+
router.put('/registry/org/:shortname/user/:username/reset_secret',
119+
mw.useRegistry(),
120+
mw.validateUser,
121+
mw.onlyOrgWithPartnerRole,
122+
parseError,
123+
parsePostParams,
124+
controller.USER_RESET_SECRET
125+
)
126+
14127
router.get('/org',
15128
/*
16129
#swagger.tags = ['Organization']
@@ -178,11 +291,15 @@ router.post(
178291
}
179292
}
180293
*/
181-
param(['registry']).optional().isBoolean(),
182-
mw.handleRegistryParameter,
183294
mw.validateUser,
184295
mw.onlySecretariat,
185-
validateCreateOrgParameters(),
296+
body(['short_name']).isString().trim().notEmpty().isLength({ min: CONSTANTS.MIN_SHORTNAME_LENGTH, max: CONSTANTS.MAX_SHORTNAME_LENGTH }),
297+
body(['name']).isString().trim().notEmpty(),
298+
body(['authority.active_roles']).optional()
299+
.custom(isFlatStringArray)
300+
.customSanitizer(toUpperCaseArray)
301+
.custom(isOrgRole),
302+
body(['policies.id_quota']).optional().not().isArray().isInt({ min: CONSTANTS.MONGOOSE_VALIDATION.Org_policies_id_quota_min, max: CONSTANTS.MONGOOSE_VALIDATION.Org_policies_id_quota_max }).withMessage(errorMsgs.ID_QUOTA),
186303
parseError,
187304
parsePostParams,
188305
controller.ORG_CREATE_SINGLE
@@ -513,6 +630,7 @@ router.get('/org/:shortname/users',
513630
parseError,
514631
parseGetParams,
515632
controller.USER_ALL)
633+
516634
router.post('/org/:shortname/user',
517635
/*
518636
#swagger.tags = ['Users']
@@ -598,12 +716,9 @@ router.post('/org/:shortname/user',
598716
}
599717
}
600718
*/
601-
param(['registry']).optional().isBoolean(),
602-
mw.handleRegistryParameter,
603719
mw.validateUser,
604720
mw.onlySecretariatOrAdmin,
605721
mw.onlyOrgWithPartnerRole,
606-
validateUserIdOrUsername(),
607722
param(['shortname']).isString().trim().notEmpty().isLength({ min: CONSTANTS.MIN_SHORTNAME_LENGTH, max: CONSTANTS.MAX_SHORTNAME_LENGTH }),
608723
body(['org_uuid']).optional().isString().trim(),
609724
body(['uuid']).optional().isString().trim(),
@@ -692,8 +807,6 @@ router.get('/org/:shortname/user/:username',
692807
}
693808
}
694809
*/
695-
param(['registry']).optional().isBoolean(),
696-
mw.handleRegistryParameter,
697810
mw.validateUser,
698811
param(['shortname']).isString().trim().notEmpty().isLength({ min: CONSTANTS.MIN_SHORTNAME_LENGTH, max: CONSTANTS.MAX_SHORTNAME_LENGTH }),
699812
param(['username']).isString().trim().notEmpty().custom(isValidUsername),
@@ -783,8 +896,7 @@ router.put('/org/:shortname/user/:username',
783896
}
784897
}
785898
*/
786-
param(['registry']).optional().isBoolean(),
787-
mw.handleRegistryParameter,
899+
788900
mw.validateUser,
789901
mw.onlyOrgWithPartnerRole,
790902
query().custom((query) => {

0 commit comments

Comments
 (0)