Revert "Merge pull request #1262 from CVEProject/jf-1258"

This reverts commit 3300b06, reversing
changes made to 8fc52ad.

Author: jdaigneau5

api-docs/openapi.json

@@ -2099,7 +2099,7 @@
           "Organization"
         ],
         "summary": "Updates information about the organization specified by short name (accessible to Secretariat)",
-        "description": "  <h2>Access Control</h2>  <p>User must belong to an organization with the <b>Secretariat</b> role, or user must belong to the organization specified by short name</p>  <h2>Expected Behavior</h2>  <p><b>Secretariat:</b> Updates any organization's information</p>  <p><b>Non-secretariat:</b> Updates 'last_active' timestamp to show that an org is still active</p>",
+        "description": "  <h2>Access Control</h2>  <p>User must belong to an organization with the <b>Secretariat</b> role</p>  <h2>Expected Behavior</h2>  <p><b>Secretariat:</b> Updates any organization's information</p>",
         "operationId": "orgUpdateSingle",
         "parameters": [
           {
@@ -2142,14 +2142,7 @@
             "content": {
               "application/json": {
                 "schema": {
-                  "oneOf": [
-                    {
-                      "$ref": "../schemas/org/update-org-response.json"
-                    },
-                    {
-                      "$ref": "../schemas/org/am-i-alive-response.json"
-                    }
-                  ]
+                  "$ref": "../schemas/org/update-org-response.json"
                 }
               }
             }

schemas/org/am-i-alive-response.json

@@ -245,10 +245,9 @@ router.put('/org/:shortname',
   #swagger.summary = "Updates information about the organization specified by short name (accessible to Secretariat)"
   #swagger.description = "
         <h2>Access Control</h2>
-        <p>User must belong to an organization with the <b>Secretariat</b> role, or user must belong to the organization specified by short name</p>
+        <p>User must belong to an organization with the <b>Secretariat</b> role</p>
         <h2>Expected Behavior</h2>
-        <p><b>Secretariat:</b> Updates any organization's information</p>
-        <p><b>Non-secretariat:</b> Updates 'last_active' timestamp to show that an org is still active</p>"
+        <p><b>Secretariat:</b> Updates any organization's information</p>"
   #swagger.parameters['shortname'] = { description: 'The shortname of the organization' }
   #swagger.parameters['$ref'] = [
     '#/components/parameters/id_quota',
@@ -264,12 +263,7 @@ router.put('/org/:shortname',
     description: 'Returns information about the organization updated',
     content: {
       "application/json": {
-        schema: {
-          oneOf: [
-            { $ref: '../schemas/org/update-org-response.json' },
-            { $ref: '../schemas/org/am-i-alive-response.json' }
-          ]
-        }
+        schema: { $ref: '../schemas/org/update-org-response.json' }
       }
     }
   }
@@ -315,10 +309,10 @@ router.put('/org/:shortname',
   }
   */
   mw.validateUser,
-  param(['shortname']).isString().trim().isLength({ min: CONSTANTS.MIN_SHORTNAME_LENGTH, max: CONSTANTS.MAX_SHORTNAME_LENGTH }),
-  mw.validateOrg,
+  mw.onlySecretariat,
   query().custom((query) => { return mw.validateQueryParameterNames(query, ['new_short_name', 'id_quota', 'name', 'active_roles.add', 'active_roles.remove']) }),
   query(['new_short_name', 'id_quota', 'name', 'active_roles.add', 'active_roles.remove']).custom((val) => { return mw.containsNoInvalidCharacters(val) }),
+  param(['shortname']).isString().trim().isLength({ min: CONSTANTS.MIN_SHORTNAME_LENGTH, max: CONSTANTS.MAX_SHORTNAME_LENGTH }),
   query(['new_short_name']).optional().isString().trim().notEmpty().isLength({ min: CONSTANTS.MIN_SHORTNAME_LENGTH, max: CONSTANTS.MAX_SHORTNAME_LENGTH }),
   query(['id_quota']).optional().not().isArray().isInt({ min: CONSTANTS.MONGOOSE_VALIDATION.Org_policies_id_quota_min, max: CONSTANTS.MONGOOSE_VALIDATION.Org_policies_id_quota_max }).withMessage(errorMsgs.ID_QUOTA),
   query(['name']).optional().isString().trim().notEmpty(),

src/controller/org.controller/index.js

@@ -329,7 +329,6 @@ async function updateOrg (req, res, next) {
     const addRoles = []
     const orgRepo = req.ctx.repositories.getOrgRepository()
     const org = await orgRepo.findOneByShortName(shortName)
-    const orgMakingChanges = req.ctx.org
     let agt = setAggregateOrgObj({ short_name: shortName })
 
     // org doesn't exist
@@ -338,38 +337,30 @@ async function updateOrg (req, res, next) {
       return res.status(404).json(error.orgDnePathParam(shortName))
     }
 
-    const isSec = await orgRepo.isSecretariat(orgMakingChanges)
-
-    if (isSec) {
-      Object.keys(req.ctx.query).forEach(k => {
-        const key = k.toLowerCase()
-
-        if (key === 'new_short_name') {
-          newOrg.short_name = req.ctx.query.new_short_name
-          agt = setAggregateOrgObj({ short_name: newOrg.short_name })
-        } else if (key === 'name') {
-          newOrg.name = req.ctx.query.name
-        } else if (key === 'id_quota') {
-          newOrg.policies.id_quota = req.ctx.query.id_quota
-        } else if (key === 'active_roles.add') {
-          if (Array.isArray(req.ctx.query['active_roles.add'])) {
-            req.ctx.query['active_roles.add'].forEach(r => {
-              addRoles.push(r)
-            })
-          }
-        } else if (key === 'active_roles.remove') {
-          if (Array.isArray(req.ctx.query['active_roles.remove'])) {
-            req.ctx.query['active_roles.remove'].forEach(r => {
-              removeRoles.push(r)
-            })
-          }
-        }
-      })
-    }
+    Object.keys(req.ctx.query).forEach(k => {
+      const key = k.toLowerCase()
 
-    if (shortName === orgMakingChanges) {
-      newOrg.last_active = Date.now()
-    }
+      if (key === 'new_short_name') {
+        newOrg.short_name = req.ctx.query.new_short_name
+        agt = setAggregateOrgObj({ short_name: newOrg.short_name })
+      } else if (key === 'name') {
+        newOrg.name = req.ctx.query.name
+      } else if (key === 'id_quota') {
+        newOrg.policies.id_quota = req.ctx.query.id_quota
+      } else if (key === 'active_roles.add') {
+        if (Array.isArray(req.ctx.query['active_roles.add'])) {
+          req.ctx.query['active_roles.add'].forEach(r => {
+            addRoles.push(r)
+          })
+        }
+      } else if (key === 'active_roles.remove') {
+        if (Array.isArray(req.ctx.query['active_roles.remove'])) {
+          req.ctx.query['active_roles.remove'].forEach(r => {
+            removeRoles.push(r)
+          })
+        }
+      }
+    })
 
     // updating the org's roles
     if (org) {
@@ -412,13 +403,6 @@ async function updateOrg (req, res, next) {
     result = await orgRepo.aggregate(agt)
     result = result.length > 0 ? result[0] : null
 
-    if (!isSec) {
-      if (!result || !result.last_active) {
-        return res.status(500).json(error.serverError())
-      }
-      result = { last_active: result.last_active }
-    }
-
     const responseMessage = {
       message: shortName + ' organization was successfully updated.',
       updated: result
@@ -835,8 +819,7 @@ function setAggregateOrgObj (query) {
         name: true,
         'authority.active_roles': true,
         'policies.id_quota': true,
-        time: true,
-        last_active: true
+        time: true
       }
     }
   ]

src/controller/org.controller/org.controller.js

@@ -135,32 +135,6 @@ async function validateUser (req, res, next) {
   }
 }
 
-async function validateOrg (req, res, next) {
-  const org = req.ctx.org
-  const reqOrg = req.params.shortname
-  const orgRepo = req.ctx.repositories.getOrgRepository()
-  const CONSTANTS = getConstants()
-
-  try {
-    logger.info({ uuid: req.ctx.uuid, message: 'Authenticating org: ' + org })
-
-    const isSec = await orgRepo.isSecretariat(org)
-    if (!isSec) {
-      if (org !== reqOrg) {
-        logger.info({ uuid: req.ctx.uuid, message: org + ' is not a ' + CONSTANTS.AUTH_ROLE_ENUM.SECRETARIAT + ' or the same as ' + reqOrg + ' and is not allowed to make these changes.' })
-        return res.status(403).json(error.secretariatOnly())
-      } else if (Object.keys(req.query).length > 0) {
-        return res.status(403).json(error.secretariatOnly())
-      }
-    }
-
-    logger.info({ uuid: req.ctx.uuid, message: 'Confirmed ' + org + ' has the authority to make changes to ' + reqOrg })
-    next()
-  } catch (err) {
-    next(err)
-  }
-}
-
 // Checks that the requester belongs to an org that has the 'BULK_DOWNLOAD' role
 async function onlySecretariatOrBulkDownload (req, res, next) {
   const org = req.ctx.org
@@ -509,7 +483,6 @@ module.exports = {
   setCacheControl,
   optionallyValidateUser,
   validateUser,
-  validateOrg,
   onlySecretariat,
   onlySecretariatOrBulkDownload,
   onlySecretariatOrAdmin,

src/middleware/middleware.js

@@ -24,8 +24,7 @@ const schema = {
     created: Date,
     modified: Date
   },
-  inUse: Boolean,
-  last_active: Date
+  inUse: Boolean
 }
 
 const OrgSchema = new mongoose.Schema(schema, { collection: 'Org', timestamps: { createdAt: 'time.created', updatedAt: 'time.modified' } })