Persist Review Objects and Enable History View

[david-rocca]

Ticket: Persist Review Objects and Enable History View

Description

Currently, Review Objects are deleted upon approval. This prevents organization admins from viewing a history of their past change requests and approvals.
Refactor the workflow to persist Review Objects after approval, marking them as 'approved', and provide an endpoint for Organization Admins to view this history.

Acceptance Criteria / TODOs

Backend Logic (Repository)

• Modify Approval Logic (src/repositories/reviewObjectRepository.js):

  • In approveReviewOrgObject:
    • Remove the call to deleteReviewObjectByUUID.
    • Instead, update the status field to 'approved'.
    • Ensure the object is saved with the new status.

• Add History Retrieval Method:

  • Add a new method (e.g., getReviewHistoryByOrgShortName) to ReviewObjectRepository.
  • Logic: Find all ReviewObjects where target_object_uuid matches the Org's UUID.
  • Support pagination if possible (using existing pagination plugins).
  • Sort by create_date (descending) by default.

Backend API (Controller & Routes)

• Create History Endpoint:
  • New Route: GET /api/registryOrg/:shortname/reviews
  • Controller Method: Implement getReviewHistory in review-object.controller.js.
  • Security Middleware:
    • mw.validateUser - User must be logged in.
    • mw.onlySameOrgOrSecretariat - Only Admins of the target Org (or Secretariat) can view the history.
    • Role Check: Ensure the user has the 'ADMIN' role (if regular users shouldn't see this) or strictly follow the "Org Admin" requirement.

Testing

• Unit Tests:
  • Verify that approveReviewOrgObject does NOT delete the document.
  • Verify that approveReviewOrgObject sets status to 'approved'.
  • Verify retrieving history returns multiple past review objects for an organization.
• Integration Tests:
  • Test the new endpoint GET /api/registryOrg/:shortname/reviews with:
    • A Secretariat user (should succeed).
    • An Org Admin of the same org (should succeed).
    • A User of a different org (should fail/403).