Update Staging from Dev

package.json

@@ -1,7 +1,7 @@
 {
     "name": "cve-services",
     "author": "Automation Working Group",
-    "version": "2.8.1",
+    "version": "2.8.2",
     "license": "(CC0)",
     "devDependencies": {
         "@faker-js/faker": "^7.6.0",

src/constants/index.js

@@ -106,6 +106,7 @@ function getConstants () {
     },
     MAX_SHORTNAME_LENGTH: 32,
     MIN_SHORTNAME_LENGTH: 2,
+    MAX_USERNAME_LENGTH: 128,
     MAX_FIRSTNAME_LENGTH: 100,
     MAX_LASTNAME_LENGTH: 100,
     MAX_MIDDLENAME_LENGTH: 100,

src/controller/audit.controller/audit.controller.js

@@ -10,9 +10,6 @@ const validateUUID = require('uuid').validate
  */
 async function createAuditDocumentForOrg (req, res, next) {
   try {
-    const session = await mongoose.startSession()
-    const repo = req.ctx.repositories.getAuditRepository()
-    const orgRepo = req.ctx.repositories.getBaseOrgRepository()
     const body = req.ctx.body
     let returnValue
 
@@ -30,6 +27,10 @@ async function createAuditDocumentForOrg (req, res, next) {
       return res.status(400).json(error.invalidUUID('target_uuid'))
     }
 
+    const repo = req.ctx.repositories.getAuditRepository()
+    const orgRepo = req.ctx.repositories.getBaseOrgRepository()
+    const session = await mongoose.startSession()
+
     try {
       session.startTransaction()
 
@@ -117,9 +118,6 @@ async function createAuditDocumentForOrg (req, res, next) {
  */
 async function appendToAuditHistoryForOrg (req, res, next) {
   try {
-    const session = await mongoose.startSession()
-    const repo = req.ctx.repositories.getAuditRepository()
-    const orgRepo = req.ctx.repositories.getBaseOrgRepository()
     const body = req.ctx.body
     let returnValue
 
@@ -135,6 +133,15 @@ async function appendToAuditHistoryForOrg (req, res, next) {
       return res.status(400).json(error.invalidUUID('target_uuid'))
     }
 
+    if (!Array.isArray(body.history) || body.history.length === 0) {
+      logger.info({ uuid: req.ctx.uuid, message: 'Missing required field: history' })
+      return res.status(400).json(error.missingRequiredField('history'))
+    }
+
+    const repo = req.ctx.repositories.getAuditRepository()
+    const orgRepo = req.ctx.repositories.getBaseOrgRepository()
+    const session = await mongoose.startSession()
+
     try {
       session.startTransaction()
 
@@ -207,8 +214,8 @@ async function appendToAuditHistoryForOrg (req, res, next) {
  */
 async function getAllOrgAuditDocuments (req, res, next) {
   try {
-    const session = await mongoose.startSession()
     const repo = req.ctx.repositories.getAuditRepository()
+    const session = await mongoose.startSession()
     let returnValue
 
     try {
@@ -230,8 +237,6 @@ async function getAllOrgAuditDocuments (req, res, next) {
  */
 async function getOrgAuditByDocumentUUID (req, res, next) {
   try {
-    const session = await mongoose.startSession()
-    const repo = req.ctx.repositories.getAuditRepository()
     const documentUUID = req.ctx.params.document_uuid
     let returnValue
 
@@ -245,6 +250,9 @@ async function getOrgAuditByDocumentUUID (req, res, next) {
       return res.status(400).json(error.invalidUUID('document_uuid'))
     }
 
+    const session = await mongoose.startSession()
+    const repo = req.ctx.repositories.getAuditRepository()
+
     try {
       returnValue = await repo.findOneByUUID(documentUUID, { session })
 
@@ -269,17 +277,18 @@ async function getOrgAuditByDocumentUUID (req, res, next) {
  */
 async function getOrgAuditByOrgIdentifier (req, res, next) {
   try {
-    const session = await mongoose.startSession()
-    const repo = req.ctx.repositories.getAuditRepository()
-    const orgRepo = req.ctx.repositories.getBaseOrgRepository()
     const identifier = req.ctx.params.org_identifier
-    const identifierIsUUID = validateUUID(identifier)
     let returnValue
 
     if (!identifier) {
       return res.status(400).json(error.missingRequiredField('identifier'))
     }
 
+    const identifierIsUUID = validateUUID(identifier)
+    const repo = req.ctx.repositories.getAuditRepository()
+    const orgRepo = req.ctx.repositories.getBaseOrgRepository()
+    const session = await mongoose.startSession()
+
     try {
       session.startTransaction()
 
@@ -335,11 +344,7 @@ async function getOrgAuditByOrgIdentifier (req, res, next) {
  */
 async function getLastXChanges (req, res, next) {
   try {
-    const session = await mongoose.startSession()
-    const repo = req.ctx.repositories.getAuditRepository()
-    const orgRepo = req.ctx.repositories.getBaseOrgRepository()
     const identifier = req.ctx.params.org_identifier
-    const identifierIsUUID = validateUUID(identifier)
     const numberOfChanges = parseInt(req.ctx.params.number_of_changes)
     let returnValue
 
@@ -352,6 +357,11 @@ async function getLastXChanges (req, res, next) {
       return res.status(400).json(error.invalidNumberOfChanges())
     }
 
+    const identifierIsUUID = validateUUID(identifier)
+    const repo = req.ctx.repositories.getAuditRepository()
+    const orgRepo = req.ctx.repositories.getBaseOrgRepository()
+    const session = await mongoose.startSession()
+
     try {
       session.startTransaction()
 

src/controller/audit.controller/index.js

@@ -216,7 +216,7 @@ router.get('/audit/org/document/:document_uuid',
   controller.AUDIT_GET_BY_UUID
 )
 
-// Get audit by org identifier (Secretariat or Admin)
+// Get audit by org identifier (Secretariat only)
 router.get('/audit/org/:org_identifier',
   /*
   #swagger.tags = ['Audit']

src/controller/conversation.controller/conversation.controller.js

@@ -17,6 +17,7 @@ async function getAllConversations (req, res, next) {
 
   const options = CONSTANTS.PAGINATOR_OPTIONS
   options.sort = { posted_at: 'desc' }
+  options.page = req.ctx.query.page ? parseInt(req.ctx.query.page) : CONSTANTS.PAGINATOR_PAGE
 
   const response = await repo.getAll(options)
   return res.status(200).json(response)
@@ -45,6 +46,7 @@ async function createConversationForTargetUUID (req, res, next) {
     const user = await authContext.getRequesterUser(req, userRepo, orgRepo, { session })
 
     if (typeof body !== 'object' || !body.body || !repo.validateConversation(body)) {
+      await session.abortTransaction()
       return res.status(400).json(error.invalidConversationObject())
     }
 
@@ -53,6 +55,7 @@ async function createConversationForTargetUUID (req, res, next) {
     if (!isSecretariat) {
       const orgUUID = await authContext.getRequesterOrgUUID(req, orgRepo, { session })
       if (targetUUID !== orgUUID) {
+        await session.abortTransaction()
         return res.status(403).json({ error: 'UNAUTHORIZED', message: 'Unauthorized' })
       }
     }
@@ -98,12 +101,14 @@ async function updateConversationByUUID (req, res, next) {
     const conversation = await repo.findOneByUUID(conversationUUID, { session })
     if (!conversation) {
       logger.info({ uuid: req.ctx.uuid, message: `No conversation found with UUID ${conversationUUID}` })
+      await session.abortTransaction()
       return res.status(404).json(error.conversationDne(conversationUUID))
     }
 
     // Validate body
     if (typeof body !== 'object' || !(body.body || body.visibility) || !repo.validateConversation(body)) {
       logger.info({ uuid: req.ctx.uuid, message: 'The conversation could not be edited because the request body was invalid.' })
+      await session.abortTransaction()
       return res.status(400).json(error.invalidConversationEditObject())
     }
 

src/controller/conversation.controller/conversation.middleware.js

@@ -0,0 +1,37 @@
+const { validationResult } = require('express-validator')
+const utils = require('../../utils/utils')
+const errors = require('./error')
+const error = new errors.ConversationControllerError()
+
+function parseGetParams (req, res, next) {
+  utils.reqCtxMapping(req, 'query', ['page'])
+  next()
+}
+
+function parseTargetParams (req, res, next) {
+  utils.reqCtxMapping(req, 'params', ['uuid'])
+  utils.reqCtxMapping(req, 'query', ['page'])
+  next()
+}
+
+function parseUuidParams (req, res, next) {
+  utils.reqCtxMapping(req, 'params', ['uuid'])
+  next()
+}
+
+function parseError (req, res, next) {
+  const err = validationResult(req).formatWith(({ location, msg, param, value, nestedErrors }) => {
+    return { msg: msg, param: param, location: location }
+  })
+  if (!err.isEmpty()) {
+    return res.status(400).json(error.badInput(err.array()))
+  }
+  next()
+}
+
+module.exports = {
+  parseGetParams,
+  parseTargetParams,
+  parseUuidParams,
+  parseError
+}

src/controller/conversation.controller/index.js

@@ -1,6 +1,7 @@
 const router = require('express').Router()
 const { param, query } = require('express-validator')
 const controller = require('./conversation.controller')
+const { parseGetParams, parseTargetParams, parseUuidParams, parseError } = require('./conversation.middleware')
 const mw = require('../../middleware/middleware')
 const getConstants = require('../../../src/constants').getConstants
 const CONSTANTS = getConstants()
@@ -100,6 +101,8 @@ router.get('/conversation',
   query().custom((query) => { return mw.validateQueryParameterNames(query, ['page']) }),
   query(['page']).custom((val) => { return mw.containsNoInvalidCharacters(val) }),
   query(['page']).optional().isInt({ min: CONSTANTS.PAGINATOR_PAGE }),
+  parseError,
+  parseGetParams,
   controller.getAllConversations
 )
 
@@ -199,20 +202,23 @@ router.get('/conversation/target/:uuid',
   query().custom((query) => { return mw.validateQueryParameterNames(query, ['page']) }),
   query(['page']).custom((val) => { return mw.containsNoInvalidCharacters(val) }),
   query(['page']).optional().isInt({ min: CONSTANTS.PAGINATOR_PAGE }),
+  parseError,
+  parseTargetParams,
   controller.getConversationsForTargetUUID
 )
 
-// Post conversation for target UUID - SEC only
+// Post conversation for target UUID - Secretariat or target org admin
 router.post('/conversation/target/:uuid',
   /*
   #swagger.tags = ['Conversation']
   #swagger.operationId = 'createConversationForTargetUUID'
-  #swagger.summary = "Creates a conversation for a specific target UUID (accessible to Secretariat only)"
+  #swagger.summary = "Creates a conversation for a specific target UUID (accessible to Secretariat or target organization Admin)"
   #swagger.description = "
         <h2>Access Control</h2>
-        <p>User must belong to an organization with the <b>Secretariat</b> role</p>
+        <p>User must belong to an organization with the <b>Secretariat</b> role or be an <b>Admin</b> of the target organization</p>
         <h2>Expected Behavior</h2>
-        <p><b>Secretariat:</b> Creates a conversation for the specified target UUID</p>"
+        <p><b>Secretariat:</b> Creates a conversation for the specified target UUID</p>
+        <p><b>Organization Admin:</b> Creates a conversation only when the target UUID is the admin's organization UUID</p>"
   #swagger.parameters['uuid'] = { description: 'The UUID of the target entity' }
   #swagger.parameters['$ref'] = [
     '#/components/parameters/apiEntityHeader',
@@ -301,6 +307,8 @@ router.post('/conversation/target/:uuid',
   mw.validateUser,
   mw.onlySecretariatOrAdmin,
   param(['uuid']).isUUID(4),
+  parseError,
+  parseUuidParams,
   controller.createConversationForTargetUUID
 )
 
@@ -410,6 +418,8 @@ router.put('/conversation/:uuid',
   mw.validateUser,
   mw.onlySecretariat,
   param(['uuid']).isUUID(4),
+  parseError,
+  parseUuidParams,
   controller.updateConversationByUUID
 )
 

src/controller/cve-id.controller/cve-id.controller.js

@@ -341,10 +341,14 @@ async function modifyCveId (req, res, next) {
     const cveIdRepo = req.ctx.repositories.getCveIdRepository()
     const userRepo = req.ctx.repositories.getUserRepository()
     const cveRepo = req.ctx.repositories.getCveRepository()
+    if (!req.ctx.authenticated) {
+      return res.status(403).json(error.orgCannotReserveForOther())
+    }
+
     const requesterOrgUUID = await authContext.getRequesterOrgUUID(req, orgRepo)
     const org = requesterOrgUUID && typeof orgRepo.findOneByUUID === 'function'
       ? await orgRepo.findOneByUUID(requesterOrgUUID)
-      : (!req.ctx.authenticated ? await orgRepo.findOneByShortName(req.ctx.org) : null)
+      : null
     if (!org) {
       return res.status(403).json(error.orgCannotReserveForOther())
     }

src/controller/cve-id.controller/index.js

@@ -16,13 +16,14 @@ router.get('/cve-id',
   /*
   #swagger.tags = ['CVE ID']
   #swagger.operationId = 'cveIdGetFiltered'
-  #swagger.summary = "Retrieves information about CVE IDs after applying the query parameters as filters (accessible to all registered users)"
+  #swagger.summary = "Retrieves information about CVE IDs after applying the query parameters as filters (accessible to registered users, Secretariat, and Bulk Download)"
   #swagger.description = "
         <h2>Access Control</h2>
-        <p>All registered users can access this endpoint</p>
+        <p>Registered users can access this endpoint. Secretariat and Bulk Download organizations can retrieve CVE IDs across organizations; other users are limited to CVE IDs owned by their own organization.</p>
         <h2>Expected Behavior</h2>
         <p><b>Regular, CNA & Admin Users:</b> Retrieves filtered CVE IDs owned by the user's organization</p>
         <p><b>Secretariat:</b> Retrieves filtered CVE IDs owned by any organization</p>
+        <p><b>Bulk Download:</b> Retrieves filtered CVE IDs owned by any organization with owner and requester details redacted</p>
   #swagger.parameters['$ref'] = [
     '#/components/parameters/cveIdGetFilteredState',
     '#/components/parameters/cveIdGetFilteredCveIdYear',

src/controller/cve.controller/cve.controller.js

@@ -119,20 +119,22 @@ async function getFilteredCves (req, res, next) {
     const query = {}
 
     if (timeModified.timeStamp.length > 0) {
-      if (!cnaModified) { query['time.modified'] = {} }
+      if (cnaModified) {
+        query['cve.containers.cna.providerMetadata.dateUpdated'] = {}
+      } else {
+        query['time.modified'] = {}
+      }
 
       for (let i = 0; i < timeModified.timeStamp.length; i++) {
         if (timeModified.dateOperator[i] === 'lt') {
           if (cnaModified) {
-            query['cve.containers.cna.providerMetadata.dateUpdated'] = {}
             // Due to this not being the mongo created date object, we need to actually check the "ISO String" version of this _NOT_ the date object that is being created in the middleware
             query['cve.containers.cna.providerMetadata.dateUpdated'].$lt = timeModifiedLtDateObject.toISOString()
           } else {
             query['time.modified'].$lt = timeModified.timeStamp[i]
           }
         } else {
           if (cnaModified) {
-            query['cve.containers.cna.providerMetadata.dateUpdated'] = {}
             // Due to this not being the mongo created date object, we need to actually check the "ISO String" version of this _NOT_ the date object that is being created in the middleware
             query['cve.containers.cna.providerMetadata.dateUpdated'].$gt = timeModifiedGtDateObject.toISOString()
           } else {
@@ -294,20 +296,22 @@ async function getFilteredCvesCursor (req, res, next) {
     const query = {}
 
     if (timeModified.timeStamp.length > 0) {
-      if (!cnaModified) { query['time.modified'] = {} }
+      if (cnaModified) {
+        query['cve.containers.cna.providerMetadata.dateUpdated'] = {}
+      } else {
+        query['time.modified'] = {}
+      }
 
       for (let i = 0; i < timeModified.timeStamp.length; i++) {
         if (timeModified.dateOperator[i] === 'lt') {
           if (cnaModified) {
-            query['cve.containers.cna.providerMetadata.dateUpdated'] = {}
             // Due to this not being the mongo created date object, we need to actually check the "ISO String" version of this _NOT_ the date object that is being created in the middleware
             query['cve.containers.cna.providerMetadata.dateUpdated'].$lt = timeModifiedLtDateObject.toISOString()
           } else {
             query['time.modified'].$lt = timeModified.timeStamp[i]
           }
         } else {
           if (cnaModified) {
-            query['cve.containers.cna.providerMetadata.dateUpdated'] = {}
             // Due to this not being the mongo created date object, we need to actually check the "ISO String" version of this _NOT_ the date object that is being created in the middleware
             query['cve.containers.cna.providerMetadata.dateUpdated'].$gt = timeModifiedGtDateObject.toISOString()
           } else {