Repository: CVEProject/cve-services
Pull request #258 (2021-01-14 21:48:53)

Allow the secretariat to access all non-sensitive user info for any org
Resolves issue #252. This is a rebase of branch 'cpadro/issue_240'.


Patch:
diff --git a/src/controller/org.controller/org.controller.js b/src/controller/org.controller/org.controller.js
index dcb43f9d..b88c5ea7 100644
--- a/src/controller/org.controller/org.controller.js
+++ b/src/controller/org.controller/org.controller.js
@@ -88,18 +88,19 @@ async function getUsers (req, res, next) {
     const orgRepo = req.ctx.repositories.getOrgRepository()
     const userRepo = req.ctx.repositories.getUserRepository()
     const orgUUID = await orgRepo.getOrgUUID(orgShortName)
+    const isSecretariat = await orgRepo.isSecretariat(shortName)
     let returned = false
 
     if (!orgUUID) {
       returned = true
-      logger.info({message: orgShortName + ' organization does not exist.'})
+      logger.info({ message: orgShortName + ' organization does not exist.' })
       return res.status(404).json(error.orgDneParam(orgShortName))
     }
 
-    if (orgShortName !== shortName && !returned) {
+    if (orgShortName !== shortName && !isSecretariat && !returned) {
       returned = true
-      logger.error({ message: orgShortName + ' organization can only be viewed by the users of the same organization.' })
-      return res.status(403).json({ error: 'NOT_OWNER', message: 'This information can only be viewed by the users of the same organization.' })
+      logger.info({ message: orgShortName + ' organization can only be viewed by the users of the same organization.' })
+      return res.status(403).json(error.notSameOrgOrSecretariat())
     }
 
     if (!returned) {


Test patch:
diff --git a/test/unit-tests/org/listing-usersTest.js b/test/unit-tests/org/listing-usersTest.js
index 973e1384..2b55beee 100644
--- a/test/unit-tests/org/listing-usersTest.js
+++ b/test/unit-tests/org/listing-usersTest.js
@@ -12,11 +12,15 @@ const error = new errors.OrgControllerError()
 
 describe('Testing the /org/:shortname/users endpoint in Org Controller', () => {
   context('Negative Tests', () => {
-    it('should return 404 because org does not exist', (done) => {
+    it('should return 404 not found because org does not exist', (done) => {
       class NoOrg {
         async getOrgUUID () {
           return null
         }
+
+        async isSecretariat () {
+          return false
+        }
       }
 
       class Blank {
@@ -59,6 +63,10 @@ describe('Testing the /org/:shortname/users endpoint in Org Controller', () => {
         async getOrgUUID () {
           return 'not-an-org'
         }
+
+        async isSecretariat () {
+          return false
+        }
       }
 
       class Blank {
@@ -89,21 +97,24 @@ describe('Testing the /org/:shortname/users endpoint in Org Controller', () => {
           // assert expected response
           expect(res).to.have.status(403)
           expect(res).to.have.property('body').and.to.be.a('object')
-          expect(res.body.error).to.equal('NOT_OWNER')
-          expect(res.body.message).to.equal('This information can only be viewed by the users of the same organization.')
+          const errObj = error.notSameOrgOrSecretariat()
+          expect(res.body.error).to.equal(errObj.error)
+          expect(res.body.message).to.equal(errObj.message)
           done()
         })
     })
   })
 
   context('Positive Tests', () => {
-    it('should list the users for cisco org', (done) => {
-      // setup
-
+    it('should list the users for cisco org because requester belongs to the same org', (done) => {
       class GetOrgUUID {
         async getOrgUUID () {
           return orgFixtures.owningOrg.UUID
         }
+
+        async isSecretariat () {
+          return false
+        }
       }
 
       class GetAllOrgUsers {
@@ -112,7 +123,7 @@ describe('Testing the /org/:shortname/users endpoint in Org Controller', () => {
         }
       }
 
-      server.route('/user-list-returned/:shortname/users')
+      server.route('/user-list-returned-same-org/:shortname/users')
         .get((req, res, next) => {
           const factory = {
             getOrgRepository: () => { return new GetOrgUUID() },
@@ -124,7 +135,7 @@ describe('Testing the /org/:shortname/users endpoint in Org Controller', () => {
 
       // execution
       chai.request(server)
-        .get(`/user-list-returned/${orgFixtures.owningOrg.short_name}/users`)
+        .get(`/user-list-returned-same-org/${orgFixtures.owningOrg.short_name}/users`)
         .set(orgFixtures.owningOrgHeader)
         .end((err, res) => {
           if (err) {
@@ -138,5 +149,49 @@ describe('Testing the /org/:shortname/users endpoint in Org Controller', () => {
           done()
         })
     })
+
+    it('should list the users for cisco org because requester is the secretariat', (done) => {
+      class GetOrgUUID {
+        async getOrgUUID () {
+          return orgFixtures.owningOrg.UUID
+        }
+
+        async isSecretariat () {
+          return true
+        }
+      }
+
+      class GetAllOrgUsers {
+        async aggregate () {
+          return [orgFixtures.existentUserDummy]
+        }
+      }
+
+      server.route('/user-list-returned-secretariat/:shortname/users')
+        .get((req, res, next) => {
+          const factory = {
+            getOrgRepository: () => { return new GetOrgUUID() },
+            getUserRepository: () => { return new GetAllOrgUsers() }
+          }
+          req.ctx.repositories = factory
+          next()
+        }, orgParams.parseGetParams, orgController.USER_ALL)
+
+      // execution
+      chai.request(server)
+        .get(`/user-list-returned-secretariat/${orgFixtures.owningOrg.short_name}/users`)
+        .set(orgFixtures.secretariatHeader)
+        .end((err, res) => {
+          if (err) {
+            done(err)
+          }
+
+          // assertion
+          expect(res).to.have.status(200)
+          expect(res).to.have.property('body').and.to.be.a('array').and.to.have.lengthOf(1)
+          expect(res.body[0]).to.have.property('org_UUID').and.to.equal(orgFixtures.owningOrg.UUID)
+          done()
+        })
+    })
   })
 })
diff --git a/test/unit-tests/org/userTest.js b/test/unit-tests/org/userTest.js
index 0b45ddc9..d01e415c 100644
--- a/test/unit-tests/org/userTest.js
+++ b/test/unit-tests/org/userTest.js
@@ -437,7 +437,7 @@ describe('Test user functions in Org Controller', () => {
         })
     })
 
-    it('User exists and the requester does not belong to the user\'s org', (done) => {
+    it('User exists and the requester is not secretariat and does not belong to the user\'s org', (done) => {
       // perform the request to the api
       chai.request(server)
         .get(`/user-get-user/${owningOrg.short_name}/${existentUserDummy.username}`)