Repository: CVEProject/cve-services
Pull request #242 (2021-01-11 23:45:42)

Opening the GET single CNA endpoint for owning CNAs.
Allow the secretariat and users of an organization (CNAs) to look up information of the organization for whom the users belong to. (Open the GET /org/:shortname endpoint for the owning CNAs).

This is the first of three issues linked to issue #130 


Patch:
diff --git a/src/constants/index.js b/src/constants/index.js
index 3ec86ef5..ce27eea6 100644
--- a/src/constants/index.js
+++ b/src/constants/index.js
@@ -15,7 +15,7 @@ module.exports = {
     ROOT_CNA: 'ROOT_CNA',
     ADP: 'ADP'
   },
-  CNA_ROLES: [
+  ORG_ROLES: [
     'CNA',
     'SECRETARIAT',
     'ROOT_CNA',
diff --git a/src/controller/cve-id.controller/cve-id.controller.js b/src/controller/cve-id.controller/cve-id.controller.js
index 0781abd1..a06b3df9 100644
--- a/src/controller/cve-id.controller/cve-id.controller.js
+++ b/src/controller/cve-id.controller/cve-id.controller.js
@@ -9,7 +9,7 @@ const error = new errors.CveIdControllerError()
 async function getCveId (req, res, next) {
   try {
     const id = req.ctx.params.id
-    const cnaShortName = req.ctx.org
+    const orgShortName = req.ctx.org
     const cveIdRepo = req.ctx.repositories.getCveIdRepository()
     const orgRepo = req.ctx.repositories.getOrgRepository()
     const userRepo = req.ctx.repositories.getUserRepository()
@@ -19,10 +19,10 @@ async function getCveId (req, res, next) {
       return res.status(404).json(error.cveIdNotFound(id))
     }
 
-    const orgUUID = await orgRepo.getOrgUUID(cnaShortName) // cnaShortname is not null
+    const orgUUID = await orgRepo.getOrgUUID(orgShortName) // orgShortName is not null
     const isSecretariat = await orgRepo.isSecretariatUUID(orgUUID)
 
-    // the requester is not the owning org or the secretariat
+    // the requester is not a user in the organization and is not the secretariat
     if (orgUUID !== result.owning_cna && !isSecretariat) {
       if (result.state === 'RESERVED') {
         const cveId = Object.assign({}, result) // clone cve id returned from the db
@@ -42,7 +42,7 @@ async function getCveId (req, res, next) {
       logger.info({ message: id + ' record was sent to the user.', cveId: cveId })
       return res.status(200).json(cveId)
     } else {
-      // the requester is the owning org or the secretariat
+      // the requester is a user in the organization or is the secretariat
       const cveId = Object.assign({}, result) // clone cve id returned from the db
       cveId.owning_cna = (await orgRepo.findOneByUUID(result.owning_cna)).short_name
       cveId.requested_by.cna = (await orgRepo.findOneByUUID(result.requested_by.cna)).short_name
@@ -63,7 +63,7 @@ async function getCveId (req, res, next) {
 
 async function getFilteredCveId (req, res, next) {
   try {
-    const cnaShortName = req.ctx.org
+    const orgShortName = req.ctx.org
     let state
     let year
     const timeReserved = {
@@ -77,7 +77,7 @@ async function getFilteredCveId (req, res, next) {
     let returned = false
     const cveIdRepo = req.ctx.repositories.getCveIdRepository()
     const orgRepo = req.ctx.repositories.getOrgRepository()
-    const isSecretariat = await orgRepo.isSecretariat(cnaShortName)
+    const isSecretariat = await orgRepo.isSecretariat(orgShortName)
 
     Object.keys(req.ctx.query).forEach(k => {
       const key = k.toLowerCase()
@@ -108,7 +108,7 @@ async function getFilteredCveId (req, res, next) {
     }
 
     if (!isSecretariat) {
-      query.owning_cna = await orgRepo.getOrgUUID(cnaShortName)
+      query.owning_cna = await orgRepo.getOrgUUID(orgShortName)
     }
 
     if (year) {
@@ -243,7 +243,7 @@ async function modifyCveId (req, res, next) {
     const id = req.ctx.params.id
     let returned = false
     let state
-    let newCnaShortname
+    let newOrgShortName
     let orgUUID
     const orgRepo = req.ctx.repositories.getOrgRepository()
     const cveIdRepo = req.ctx.repositories.getCveIdRepository()
@@ -254,7 +254,7 @@ async function modifyCveId (req, res, next) {
     }
 
     if (req.ctx.query.cna) {
-      newCnaShortname = req.ctx.query.cna
+      newOrgShortName = req.ctx.query.cna
     }
 
     if (state && !returned) {
@@ -267,13 +267,13 @@ async function modifyCveId (req, res, next) {
       }
     }
 
-    if (newCnaShortname && !returned) {
-      orgUUID = await orgRepo.getOrgUUID(newCnaShortname)
+    if (newOrgShortName && !returned) {
+      orgUUID = await orgRepo.getOrgUUID(newOrgShortName)
 
       if (!orgUUID) {
         returned = true
-        logger.info(id + ' could not be reasigned to ' + newCnaShortname + ' in MongoDB because it does not exist.')
-        return res.status(404).json(error.cnaDne(newCnaShortname))
+        logger.info({ message: id + ' could not be reasigned to ' + newOrgShortName + ' in MongoDB because it does not exist.' })
+        return res.status(404).json(error.orgDne(newOrgShortName))
       }
     }
 
@@ -291,7 +291,7 @@ async function modifyCveId (req, res, next) {
       updatedCveId.state = state
     }
 
-    if (newCnaShortname && !returned) {
+    if (newOrgShortName && !returned) {
       updatedCveId.owning_cna = orgUUID
     }
 
@@ -330,7 +330,7 @@ async function modifyCveId (req, res, next) {
 
 async function reserveCveId (req, res, next) {
   const requester = req.ctx.user
-  const cnaShortName = req.ctx.org
+  const orgShortName = req.ctx.org
   let hasLock = false
   let returned = false
   let batchType
@@ -354,15 +354,15 @@ async function reserveCveId (req, res, next) {
       }
     })
 
-    const isSecretariat = await orgRepo.isSecretariat(cnaShortName)
-    if (cnaShortName !== shortName && !isSecretariat && !returned) {
+    const isSecretariat = await orgRepo.isSecretariat(orgShortName)
+    if (orgShortName !== shortName && !isSecretariat && !returned) {
       returned = true
-      return res.status(403).json(error.cnaCannotReserveForOther())
+      return res.status(403).json(error.orgCannotReserveForOther())
     }
 
     if (!shortName && !returned) {
       returned = true
-      return res.status(400).json(error.noCnaShortName())
+      return res.status(400).json(error.noOrgShortName())
     }
 
     if (!year && !returned) {
@@ -391,8 +391,8 @@ async function reserveCveId (req, res, next) {
 
       if (!result) {
         returned = true
-        logger.info(shortName + ' CNA does not exist.')
-        return res.status(403).json(error.cnaDne(shortName))
+        logger.info({ message: shortName + ' organization does not exist.' })
+        return res.status(403).json(error.orgDne(shortName))
       }
     }
 
@@ -417,15 +417,15 @@ async function reserveCveId (req, res, next) {
 
     if (!returned) {
       if (batchType === undefined) { // priority
-        await priorityReservation(year, amount, shortName, cnaShortName, requester, payload.available, res, req)
+        await priorityReservation(year, amount, shortName, orgShortName, requester, payload.available, res, req)
       } else if (batchType === 'sequential') {
-        await sequentialReservation(year, amount, shortName, cnaShortName, requester, payload.available, false, res, req)
+        await sequentialReservation(year, amount, shortName, orgShortName, requester, payload.available, false, res, req)
       } else if (batchType === 'non-sequential' || batchType === 'nonsequential') {
         if (amount > CONSTANTS.NONSEQUENTIAL_MAX_AMOUNT) {
           returned = true
           return res.status(403).json(error.overNonSequentialMaxAmount())
         }
-        await nonSequentialReservation(year, amount, shortName, cnaShortName, requester, payload.available, res, req)
+        await nonSequentialReservation(year, amount, shortName, orgShortName, requester, payload.available, res, req)
       } else {
         return res.status(400).json(error.invalidBatchType())
       }
@@ -439,7 +439,7 @@ async function reserveCveId (req, res, next) {
   }
 }
 
-async function priorityReservation (year, amount, shortName, cnaShortName, requester, availableIds, res, req) {
+async function priorityReservation (year, amount, shortName, orgShortName, requester, availableIds, res, req) {
   const cveIdRangeRepo = req.ctx.repositories.getCveIdRangeRepository()
   const reqUUID = req.ctx.uuid
   let result = await cveIdRangeRepo.findOne({ cve_year: year })
@@ -449,7 +449,7 @@ async function priorityReservation (year, amount, shortName, cnaShortName, reque
   // Cve Id Range for 'year' does not exists
   if (!result) {
     returned = true
-    logger.info('CVE IDs for year ' + year + ' cannot be reserved at this time.')
+    logger.info({ message: 'CVE IDs for year ' + year + ' cannot be reserved at this time.' })
     res.header(CONSTANTS.QUOTA_HEADER, availableIds)
     return res.status(403).json(error.cannotReserveForYear(year))
   }
@@ -461,8 +461,8 @@ async function priorityReservation (year, amount, shortName, cnaShortName, reque
     // priority id block is full, reserve id in sequential block
     if (!result) {
       isFull = true
-      logger.info('Priority id block is full for year ' + year + ', reserving id in sequential block.')
-      await sequentialReservation(year, amount, shortName, cnaShortName, requester, availableIds, true, res, req)
+      logger.info({ message: 'Priority id block is full for year ' + year + ', reserving id in sequential block.' })
+      await sequentialReservation(year, amount, shortName, orgShortName, requester, availableIds, true, res, req)
     }
   }
 
@@ -472,7 +472,7 @@ async function priorityReservation (year, amount, shortName, cnaShortName, reque
     const cveIdRepo = req.ctx.repositories.getCveIdRepository()
     const id = generateSequentialIds(year, result.ranges.priority.top_id, amount)
     const owningOrgUUID = await orgRepo.getOrgUUID(shortName)
-    const orgUUID = await orgRepo.getOrgUUID(cnaShortName)
+    const orgUUID = await orgRepo.getOrgUUID(orgShortName)
     const requesterUUID = (await userRepo.findOneByUserNameAndOrgUUID(requester, orgUUID)).UUID
 
     let cveIdDocuments = []
@@ -491,7 +491,7 @@ async function priorityReservation (year, amount, shortName, cnaShortName, reque
       user: requesterUUID
     }
     cveId.requested_by = {
-      cna: cnaShortName, // the org who requested the CVE IDs
+      cna: orgShortName, // the org who requested the CVE IDs
       user: requester
     }
 
@@ -503,7 +503,7 @@ async function priorityReservation (year, amount, shortName, cnaShortName, reque
     cveIdDocuments = cleanOutputSequential(cveIdDocuments)
     const payload = {
       action: 'priority_reservation',
-      change: 'A priority CVE ID was reserved for \'' + shortName + '\' org on behalf of \'' + cnaShortName + '\' org.',
+      change: 'A priority CVE ID was reserved for \'' + shortName + '\' organization on behalf of \'' + orgShortName + '\' organization.',
       req_UUID: reqUUID,
       org_UUID: orgUUID,
       user_UUID: requesterUUID,
@@ -516,7 +516,7 @@ async function priorityReservation (year, amount, shortName, cnaShortName, reque
   }
 }
 
-async function sequentialReservation (year, amount, shortName, cnaShortName, requester, availableIds, isPriority, res, req) {
+async function sequentialReservation (year, amount, shortName, orgShortName, requester, availableIds, isPriority, res, req) {
   const cveIdRangeRepo = req.ctx.repositories.getCveIdRangeRepository()
   const reqUUID = req.ctx.uuid
   let result = await cveIdRangeRepo.findOne({ cve_year: year })
@@ -527,7 +527,7 @@ async function sequentialReservation (year, amount, shortName, cnaShortName, req
   // Cve Id Range for 'year' does not exists
   if (!result) {
     returned = true
-    logger.info('CVE IDs for year ' + year + ' cannot be reserved at this time.')
+    logger.info({ message: 'CVE IDs for year ' + year + ' cannot be reserved at this time.' })
     res.header(CONSTANTS.QUOTA_HEADER, availableIds)
     return res.status(403).json(error.cannotReserveForYear(year))
   }
@@ -542,9 +542,9 @@ async function sequentialReservation (year, amount, shortName, cnaShortName, req
       returned = true
 
       if (isPriority) {
-        logger.error('The cve id priority and sequential blocks are full for year ' + year + '. No more priority or sequential ids can be reserved at this time.')
+        logger.error({ message: 'The cve id priority and sequential blocks are full for year ' + year + '. No more priority or sequential ids can be reserved at this time.' })
       } else {
-        logger.error('The cve id sequential block is full for year ' + year + '. No more sequential ids can be reserved at this time.')
+        logger.error({ message: 'The cve id sequential block is full for year ' + year + '. No more sequential ids can be reserved at this time.' })
       }
 
       res.header(CONSTANTS.QUOTA_HEADER, availableIds)
@@ -558,7 +558,7 @@ async function sequentialReservation (year, amount, shortName, cnaShortName, req
     const cveIdRepo = req.ctx.repositories.getCveIdRepository()
     const ids = generateSequentialIds(year, result.ranges.general.top_id, amount)
     const owningOrgUUID = await orgRepo.getOrgUUID(shortName)
-    const orgUUID = await orgRepo.getOrgUUID(cnaShortName)
+    const orgUUID = await orgRepo.getOrgUUID(orgShortName)
     const requesterUUID = (await userRepo.findOneByUserNameAndOrgUUID(requester, orgUUID)).UUID
     let cveIdDocuments = []
     const cveIdDocumentsUUID = []
@@ -579,7 +579,7 @@ async function sequentialReservation (year, amount, shortName, cnaShortName, req
         user: requesterUUID
       }
       cveId.requested_by = {
-        cna: cnaShortName, // the org who requested the CVE IDs
+        cna: orgShortName, // the org who requested the CVE IDs
         user: requester
       }
 
@@ -599,9 +599,9 @@ async function sequentialReservation (year, amount, shortName, cnaShortName, req
     }
 
     if (isPriority) {
-      payload.change = 'The cve id priority block is full for year ' + year + '. A sequential CVE ID was reserved for \'' + shortName + '\' org on behalf of \'' + cnaShortName + '\' org.'
+      payload.change = 'The cve id priority block is full for year ' + year + '. A sequential CVE ID was reserved for \'' + shortName + '\' organization on behalf of \'' + orgShortName + '\' organization.'
     } else {
-      payload.change = 'Sequential CVE IDs were reserved for \'' + shortName + '\' org on behalf of \'' + cnaShortName + '\' org.'
+      payload.change = 'Sequential CVE IDs were reserved for \'' + shortName + '\' organization on behalf of \'' + orgShortName + '\' organization.'
     }
 
     logger.info(JSON.stringify(payload))
@@ -610,7 +610,7 @@ async function sequentialReservation (year, amount, shortName, cnaShortName, req
   }
 }
 
-async function nonSequentialReservation (year, amount, shortName, cnaShortName, requester, availableIds, res, req) {
+async function nonSequentialReservation (year, amount, shortName, orgShortName, requester, availableIds, res, req) {
   const cveIdRepo = req.ctx.repositories.getCveIdRepository()
   const cveIdRangeRepo = req.ctx.repositories.getCveIdRangeRepository()
   const reqUUID = req.ctx.uuid
@@ -624,7 +624,7 @@ async function nonSequentialReservation (year, amount, shortName, cnaShortName,
   // Cve Id Range for 'year' does not exists
   if (!result) {
     returned = true
-    logger.info('CVE IDs for year ' + year + ' cannot be reserved at this time.')
+    logger.info({ message: 'CVE IDs for year ' + year + ' cannot be reserved at this time.' })
     res.header(CONSTANTS.QUOTA_HEADER, availableIds)
     return res.status(403).json(error.cannotReserveForYear(year))
   }
@@ -639,7 +639,7 @@ async function nonSequentialReservation (year, amount, shortName, cnaShortName,
       returned = result.returned
 
       if (isFull || returned) {
-        logger.error('The cve id non-sequential block is full for year ' + year + '. No more sequential ids can be reserved at this time.')
+        logger.error({ message: 'The cve id non-sequential block is full for year ' + year + '. No more sequential ids can be reserved at this time.' })
         res.header(CONSTANTS.QUOTA_HEADER, availableIds)
         return res.status(403).json(error.yearRangeFull(year))
       }
@@ -657,15 +657,15 @@ async function nonSequentialReservation (year, amount, shortName, cnaShortName,
   const cveIdDocuments = []
   const cveIdDocumentsUUID = []
   const owningOrgUUID = await orgRepo.getOrgUUID(shortName)
-  const orgUUID = await orgRepo.getOrgUUID(cnaShortName)
+  const orgUUID = await orgRepo.getOrgUUID(orgShortName)
   const requesterUUID = (await userRepo.findOneByUserNameAndOrgUUID(requester, orgUUID)).UUID
 
   while ((counter < amount) && (!isFull && !returned)) {
     index = getRandomInt(0, available.length) // get random index in the available array
-    result = await reserveNonSequentialCveId(index, available, year, shortName, cnaShortName, requester, owningOrgUUID, orgUUID, requesterUUID, req, cveIdRepo)
+    result = await reserveNonSequentialCveId(index, available, year, shortName, orgShortName, requester, owningOrgUUID, orgUUID, requesterUUID, req)
 
     if (result.isReserved) {
-      logger.info(result.cveId.cve_id + ' was reserved')
+      logger.info({ message: result.cveId.cve_id + ' was reserved' })
       cveIdDocuments.push(result.cveId) // add reserved cve id to the array of reserved cve ids
       cveIdDocumentsUUID.push(result.cveIdUUID) // add reserved cve id UUID to the array of reserved cve ids
       available.splice(index, 1) // remove reserved cve id from the 'AVAILABLE' pool
@@ -682,7 +682,7 @@ async function nonSequentialReservation (year, amount, shortName, cnaShortName,
         returned = result.returned
 
         if (isFull || returned) {
-          logger.info({ message: 'Only ' + counter + ' cve ids were reserved because there are not enough ids in the CVE ID non-sequential block. Non-sequential CVE IDs were reserved for \'' + shortName + '\' org on behalf of \'' + cnaShortName + '\' org.', cve_ids: cveIdDocumentsUUID })
+          logger.info({ message: 'Only ' + counter + ' cve ids were reserved because there are not enough ids in the CVE ID non-sequential block. Non-sequential CVE IDs were reserved for \'' + shortName + '\' organization on behalf of \'' + orgShortName + '\' organization.', cve_ids: cveIdDocumentsUUID })
           res.header(CONSTANTS.QUOTA_HEADER, availableIds - counter)
           return res.status(206).json(error.reservedPartialAmount(counter, cveIdDocuments))
         }
@@ -696,7 +696,7 @@ async function nonSequentialReservation (year, amount, shortName, cnaShortName,
   if (!isFull && !returned) {
     const payload = {
       action: 'nonsequential_reservation',
-      change: 'Non-sequential CVE IDs were reserved for \'' + shortName + '\' org on behalf of \'' + cnaShortName + '\' org.',
+      change: 'Non-sequential CVE IDs were reserved for \'' + shortName + '\' organization on behalf of \'' + orgShortName + '\' organization.',
       req_UUID: reqUUID,
       org_UUID: orgUUID,
       user_UUID: requesterUUID,
@@ -771,15 +771,15 @@ async function allocateAvailableCveIds (ids, year, req, cveIdR) {
     })
 
     await cveIdRepo.insertMany(cveIdDocuments) // Save the 'AVAILABLE' cve ids
-    logger.info('The AVAILABLE pool was incremented by ' + cveIdDocuments.length + ' cve ids.')
+    logger.info({ message: 'The AVAILABLE pool was incremented by ' + cveIdDocuments.length + ' cve ids.' })
   }
 }
 
-async function reserveNonSequentialCveId (index, available, year, shortName, cnaShortName, requester, owningOrgUUID, orgUUID, requesterUUID, req, cveIdR) {
+async function reserveNonSequentialCveId (index, available, year, shortName, orgShortName, requester, owningOrgUUID, orgUUID, requesterUUID, req) {
   // Update available Cve Id
   const cveIdUUID = new CveId()
   const cveId = new CveId()
-  const cveIdRepo = cveIdR
+  const cveIdRepo = req.ctx.repositories.getCveIdRepository()
   cveIdUUID.cve_id = cveId.cve_id = available[index].cve_id
   cveIdUUID.cve_year = cveId.cve_year = year
   cveIdUUID.state = cveId.state = 'RESERVED'
@@ -791,7 +791,7 @@ async function reserveNonSequentialCveId (index, available, year, shortName, cna
     user: requesterUUID
   }
   cveId.requested_by = {
-    cna: cnaShortName, // the org who requested the CVE IDs
+    cna: orgShortName, // the org who requested the CVE IDs
     user: requester
   }
 
@@ -858,7 +858,7 @@ async function createCveIdRange (req, res, next) {
     const result = await cveIdRangeRepo.findOne({ cve_year: year })
 
     if (result) {
-      logger.info('CVE Id Range document for year ' + year + ' already exists.')
+      logger.info({ message: 'CVE Id Range document for year ' + year + ' already exists.' })
       return res.status(400).json(error.yearRangeExists(year))
     }
 
diff --git a/src/controller/cve-id.controller/error.js b/src/controller/cve-id.controller/error.js
index e13c76f7..43e35885 100644
--- a/src/controller/cve-id.controller/error.js
+++ b/src/controller/cve-id.controller/error.js
@@ -51,17 +51,17 @@ class CveIdControllerError extends idrErr.IDRError {
     return err
   }
 
-  noCnaShortName () { // cve-id
+  noOrgShortName () { // cve-id
     const err = {}
-    err.error = 'NO_CNA_SHORTNAME'
+    err.error = 'NO_ORG_SHORTNAME'
     err.message = 'The shortname query parameter is required to reserve CVE IDs.'
     return err
   }
 
-  cnaCannotReserveForOther () { // cve-id
+  orgCannotReserveForOther () { // cve-id
     const err = {}
-    err.error = 'CNA_CANNOT_RESERVE_FOR_OTHER'
-    err.message = 'The CNA designated by the CVE-API-CNA header is not allowed to reserve IDs for the CNA specified by the shortname query parameter.'
+    err.error = 'ORG_CANNOT_RESERVE_FOR_OTHER'
+    err.message = 'The organization designated by the ' + CONSTANTS.AUTH_HEADERS.ORG + ' header is not allowed to reserve IDs for the organization specified by the shortname query parameter.'
     return err
   }
 
@@ -96,7 +96,7 @@ class CveIdControllerError extends idrErr.IDRError {
   reservationInProgress () { // cve-id
     const err = {}
     err.error = 'RESERVATION_IN_PROGRESS'
-    err.message = 'An ID reservation request for this CNA is already in progress.'
+    err.message = 'An ID reservation request for this organization is already in progress.'
     return err
   }
 
diff --git a/src/controller/org.controller/error.js b/src/controller/org.controller/error.js
index b060a965..510e25c1 100644
--- a/src/controller/org.controller/error.js
+++ b/src/controller/org.controller/error.js
@@ -1,10 +1,10 @@
 const idrErr = require('../../utils/error')
 
 class OrgControllerError extends idrErr.IDRError {
-  cnaDneParam (shortname) { // org
+  orgDneParam (shortname) { // org
     const err = {}
-    err.error = 'CNA_DNE_PARAM'
-    err.message = `The CNA '${shortname}' designated by the shortname parameter does not exist.`
+    err.error = 'ORG_DNE_PARAM'
+    err.message = `The '${shortname}' organization designated by the shortname parameter does not exist.`
     return err
   }
 
@@ -15,17 +15,17 @@ class OrgControllerError extends idrErr.IDRError {
     return err
   }
 
-  notOwnerOrSecretariat () { // org
+  notSameOrgOrSecretariat () { // org
     const err = {}
-    err.error = 'NOT_OWNER_OR_SECRETARIAT'
-    err.message = 'This information can only be viewed by the owning CNA or the Secretariat.'
+    err.error = 'NOT_SAME_ORG_OR_SECRETARIAT'
+    err.message = 'This information can only be viewed by the users of the same organization or the Secretariat.'
     return err
   }
 
-  cnaExists (shortname) { // org
+  orgExists (shortname) { // org
     const err = {}
-    err.error = 'CNA_EXISTS'
-    err.message = `The CNA '${shortname}' already exists.`
+    err.error = 'ORG_EXISTS'
+    err.message = `The '${shortname}' organization already exists.`
     return err
   }
 
@@ -39,21 +39,21 @@ class OrgControllerError extends idrErr.IDRError {
   shortnameMismatch (shortname, shortnameBody) { // org
     const err = {}
     err.error = 'SHORTNAME_MISMATCH'
-    err.message = `The CNA '${shortname}' designated by the username parameter does not match the username '${shortnameBody}' in the JSON body.`
+    err.message = `The '${shortname}' organization designated by the username parameter does not match the username '${shortnameBody}' in the JSON body.`
     return err
   }
 
   duplicateUsername (shortname, username) { // org
     const err = {}
     err.error = 'DUPLICATE_USERNAME'
-    err.message = `The user could not be updated because CNA '${shortname}' contains another user with the username '${username}'.`
+    err.message = `The user could not be updated because the '${shortname}' organization contains another user with the username '${username}'.`
     return err
   }
 
   duplicateShortname (shortname) { // org
     const err = {}
     err.error = 'DUPLICATE_SHORTNAME'
-    err.message = `CNA can not be renamed as '${shortname}' because this shortname is used by another CNA.`
+    err.message = `The organization cannot be renamed as '${shortname}' because this shortname is used by another organization.`
     return err
   }
 }
diff --git a/src/controller/org.controller/index.js b/src/controller/org.controller/index.js
index 6e7fa8b3..ed19dff2 100644
--- a/src/controller/org.controller/index.js
+++ b/src/controller/org.controller/index.js
@@ -3,30 +3,29 @@ const router = express.Router()
 const mw = require('../../middleware/middleware')
 const controller = require('./org.controller')
 const { body, param, query } = require('express-validator')
-const { parseGetParams, parsePostParams, parseError, isCNARole } = require('./org.middleware')
+const { parseGetParams, parsePostParams, parseError, isOrgRole } = require('./org.middleware')
 const CONSTANTS = require('../../../src/constants')
 
 router.get('/org',
   mw.onlySecretariat,
   mw.validateUser,
-  controller.CNA_ALL)
+  controller.ORG_ALL)
 router.post('/org',
   mw.onlySecretariat,
   mw.validateUser,
   body(['short_name']).isString().trim().escape().notEmpty(),
   body(['name']).isString().trim().escape().notEmpty(),
-  body(['authority.active_roles']).optional().customSanitizer(val => { return val.map(x => { return x.toUpperCase() }) }).custom(val => { return isCNARole(val) }),
+  body(['authority.active_roles']).optional().customSanitizer(val => { return val.map(x => { return x.toUpperCase() }) }).custom(val => { return isOrgRole(val) }),
   body(['policies.id_quota']).optional().not().isArray().isInt({ min: CONSTANTS.MONGOOSE_VALIDATION.Org_policies_id_quota_min, max: CONSTANTS.MONGOOSE_VALIDATION.Org_policies_id_quota_max }).withMessage('The id_quota does not comply with CVE id quota limitations.'),
   parseError,
   parsePostParams,
-  controller.CNA_CREATE_SINGLE)
+  controller.ORG_CREATE_SINGLE)
 router.get('/org/:shortname',
-  mw.onlySecretariat,
   mw.validateUser,
   param(['shortname']).isString().trim().escape(),
   parseError,
   parseGetParams,
-  controller.CNA_SINGLE)
+  controller.ORG_SINGLE)
 router.post('/org/:shortname',
   mw.onlySecretariat,
   mw.validateUser,
@@ -35,12 +34,12 @@ router.post('/org/:shortname',
   query(['id_quota']).optional().not().isArray().isInt({ min: CONSTANTS.MONGOOSE_VALIDATION.Org_policies_id_quota_min, max: CONSTANTS.MONGOOSE_VALIDATION.Org_policies_id_quota_max }).withMessage('The id_quota does not comply with CVE id quota limitations.'),
   query(['name']).optional().isString().trim().escape().notEmpty(),
   query(['active_roles.add']).optional().toArray(),
-  query(['active_roles.add']).optional().customSanitizer(val => { return val.map(x => { return x.toUpperCase() }) }).custom(val => { return isCNARole(val) }),
+  query(['active_roles.add']).optional().customSanitizer(val => { return val.map(x => { return x.toUpperCase() }) }).custom(val => { return isOrgRole(val) }),
   query(['active_roles.remove']).optional().toArray(),
-  query(['active_roles.remove']).optional().customSanitizer(val => { return val.map(x => { return x.toUpperCase() }) }).custom(val => { return isCNARole(val) }),
+  query(['active_roles.remove']).optional().customSanitizer(val => { return val.map(x => { return x.toUpperCase() }) }).custom(val => { return isOrgRole(val) }),
   parseError,
   parsePostParams,
-  controller.CNA_UPDATE_SINGLE)
+  controller.ORG_UPDATE_SINGLE)
 router.post('/org/:shortname/user',
   mw.onlySecretariat,
   mw.validateUser,
diff --git a/src/controller/org.controller/org.controller.js b/src/controller/org.controller/org.controller.js
index 0208d8a4..505e1f28 100644
--- a/src/controller/org.controller/org.controller.js
+++ b/src/controller/org.controller/org.controller.js
@@ -10,8 +10,8 @@ const uuid = require('uuid')
 const errors = require('./error')
 const error = new errors.OrgControllerError()
 
-// Get the details of all cnas
-async function getCnas (req, res, next) {
+// Get the details of all orgs
+async function getOrgs (req, res, next) {
   try {
     const repo = req.ctx.repositories.getOrgRepository()
     const result = await repo.aggregate([
@@ -28,42 +28,54 @@ async function getCnas (req, res, next) {
       }
     ])
 
-    logger.info('The CNAs were sent to the user.')
+    logger.info({ message: 'The orgs were sent to the user.' })
     return res.status(200).json(result)
   } catch (err) {
     next(err)
   }
 }
 
-// Get the details of a single cna for the specified shortname
-async function getCna (req, res, next) {
+// Get the details of a single org for the specified shortname
+async function getOrg (req, res, next) {
   try {
+    const orgShortName = req.ctx.org
     const shortName = req.ctx.params.shortname
     const repo = req.ctx.repositories.getOrgRepository()
-    const result = await repo.aggregate([
-      {
-        $match: { short_name: shortName }
-      },
-      {
-        $project: {
-          _id: false,
-          UUID: true,
-          short_name: true,
-          name: true,
-          'authority.active_roles': true,
-          'policies.id_quota': true,
-          time: true
+    const isSecretariat = await repo.isSecretariat(orgShortName)
+    let returned = false
+
+    if (orgShortName !== shortName && !isSecretariat) {
+      returned = true
+      logger.info({ message: shortName + ' organization can only be viewed by the users of the same organization or the Secretariat.' })
+      return res.status(403).json(error.notSameOrgOrSecretariat())
+    }
+
+    if (!returned) {
+      const result = await repo.aggregate([
+        {
+          $match: { short_name: shortName }
+        },
+        {
+          $project: {
+            _id: false,
+            UUID: true,
+            short_name: true,
+            name: true,
+            'authority.active_roles': true,
+            'policies.id_quota': true,
+            time: true
+          }
         }
+      ])
+
+      if (utils.isEmptyObject(result)) {
+        logger.info({ message: shortName + ' organization does not exist.' })
+        return res.status(404).json(error.orgDneParam(shortName))
       }
-    ])
 
-    if (utils.isEmptyObject(result)) {
-      logger.info(shortName + ' CNA does not exist.')
-      return res.status(404).json(error.cnaDneParam(shortName))
+      logger.info({ message: shortName + ' organization was sent to the user.', org: result })
+      return res.status(200).json(result[0])
     }
-
-    logger.info({ message: shortName + ' CNA was sent to the user.', cna: result })
-    return res.status(200).json(result[0])
   } catch (err) {
     next(err)
   }
@@ -74,22 +86,22 @@ async function getUser (req, res, next) {
   try {
     const shortName = req.ctx.org
     const username = req.ctx.params.username
-    const cnaShortName = req.ctx.params.shortname
+    const orgShortName = req.ctx.params.shortname
     let returned = false
     const orgRepo = req.ctx.repositories.getOrgRepository()
     const isSecretariat = await orgRepo.isSecretariat(shortName)
 
-    if (cnaShortName !== shortName && !isSecretariat) {
+    if (orgShortName !== shortName && !isSecretariat) {
       returned = true
       logger.info({ message: shortName + ' organization can only be viewed by that organization\'s users or the Secretariat.' })
-      return res.status(403).json(error.notOwnerOrSecretariat())
+      return res.status(403).json(error.notSameOrgOrSecretariat())
     }
 
-    const orgUUID = await orgRepo.getOrgUUID(cnaShortName)
+    const orgUUID = await orgRepo.getOrgUUID(orgShortName)
     if (!orgUUID && !returned) {
       returned = true
-      logger.info(cnaShortName + ' CNA does not exist.')
-      return res.status(404).json(error.cnaDneParam(cnaShortName))
+      logger.info({ message: orgShortName + ' organization does not exist.' })
+      return res.status(404).json(error.orgDneParam(orgShortName))
     }
 
     if (!returned) {
@@ -112,7 +124,7 @@ async function getUser (req, res, next) {
       ])
 
       if (utils.isEmptyObject(result)) {
-        logger.info(username + ' does not exist.')
+        logger.info({ message: username + ' does not exist.' })
         return res.status(404).json(error.userDne(username))
       }
 
@@ -124,22 +136,22 @@ async function getUser (req, res, next) {
   }
 }
 
-// Get details on ID quota for a org with the specified org shortname
+// Get details on ID quota for an org with the specified org shortname
 async function getOrgIdQuota (req, res, next) {
   try {
-    const cnaShortName = req.ctx.org
+    const orgShortName = req.ctx.org
     const shortName = req.ctx.params.shortname
     const repo = req.ctx.repositories.getOrgRepository()
-    const isSecretariat = await repo.isSecretariat(cnaShortName)
-    if (cnaShortName !== shortName && !isSecretariat) {
-      logger.info({ message: shortName + ' CNA id quota can only be viewed by the owning CNA or the Secretariat.' })
-      return res.status(403).json(error.notOwnerOrSecretariat())
+    const isSecretariat = await repo.isSecretariat(orgShortName)
+    if (orgShortName !== shortName && !isSecretariat) {
+      logger.info({ message: shortName + ' organization id quota can only be viewed by the users of the same organization or the Secretariat.' })
+      return res.status(403).json(error.notSameOrgOrSecretariat())
     }
 
     let result = await repo.findOneByShortName(shortName)
     if (!result) {
-      logger.info(shortName + ' CNA does not exist.')
-      return res.status(404).json(error.cnaDneParam(shortName))
+      logger.info({ message: shortName + ' organization does not exist.' })
+      return res.status(404).json(error.orgDneParam(shortName))
     }
 
     const returnPayload = {
@@ -157,53 +169,53 @@ async function getOrgIdQuota (req, res, next) {
     returnPayload.total_reserved = result
     returnPayload.available = returnPayload.id_quota - returnPayload.total_reserved
 
-    logger.info({ message: 'The CVE ID quota returned to the user.', details: returnPayload })
+    logger.info({ message: 'The organization\'s id quota was returned to the user.', details: returnPayload })
     return res.status(200).json(returnPayload)
   } catch (err) {
     next(err)
   }
 }
 
-// Creates a new cna only if the cna doesn't exist for the specified shortname. If the cna exists, it does not update the cna.
-async function createCna (req, res, next) {
+// Creates a new org only if the org doesn't exist for the specified shortname. If the org exists, we do not update the org.
+async function createOrg (req, res, next) {
   try {
-    const newCna = new Org(req.ctx.body)
+    const newOrg = new Org(req.ctx.body)
     const orgRepo = req.ctx.repositories.getOrgRepository()
 
-    const result = await orgRepo.findOneByShortName(newCna.short_name) // Find cna in MongoDB
+    const result = await orgRepo.findOneByShortName(newOrg.short_name) // Find org in MongoDB
     if (result) {
-      logger.info(newCna.short_name + ' CNA was not created because it already exists.')
-      return res.status(400).json(error.cnaExists(newCna.short_name))
+      logger.info({ message: newOrg.short_name + ' organization was not created because it already exists.' })
+      return res.status(400).json(error.orgExists(newOrg.short_name))
     }
 
-    newCna.inUse = false
+    newOrg.inUse = false
 
     // policies are undefined
-    if (newCna.authority.active_roles.length === 0) {
-      newCna.authority.active_roles = [CONSTANTS.AUTH_ROLE_ENUM.CNA] // default role
+    if (newOrg.authority.active_roles.length === 0) {
+      newOrg.authority.active_roles = [CONSTANTS.AUTH_ROLE_ENUM.CNA] // default role
     }
 
-    if (newCna.UUID === undefined || newCna.UUID === null) {
-      newCna.UUID = uuid.v4()
+    if (newOrg.UUID === undefined || newOrg.UUID === null) {
+      newOrg.UUID = uuid.v4()
     }
 
-    if (newCna.policies.id_quota === undefined || newCna.policies.id_quota === null) {
-      newCna.policies.id_quota = CONSTANTS.DEFAULT_ID_QUOTA
+    if (newOrg.policies.id_quota === undefined || newOrg.policies.id_quota === null) {
+      newOrg.policies.id_quota = CONSTANTS.DEFAULT_ID_QUOTA
     }
 
-    await orgRepo.updateByOrgUUID(newCna.UUID, newCna, { upsert: true }) // Create cna in MongoDB if it doesn't exist
+    await orgRepo.updateByOrgUUID(newOrg.UUID, newOrg, { upsert: true }) // Create org in MongoDB if it doesn't exist
 
     const responseMessage = {
-      message: newCna.short_name + ' CNA was successfully created.',
-      created: newCna
+      message: newOrg.short_name + ' organization was successfully created.',
+      created: newOrg
     }
 
     const payload = {
       action: 'create_org',
-      change: newCna.short_name + ' CNA was successfully created.',
+      change: newOrg.short_name + ' organization was successfully created.',
       req_UUID: req.ctx.uuid,
       org_UUID: await orgRepo.getOrgUUID(req.ctx.org),
-      org: newCna
+      org: newOrg
     }
     const userRepo = req.ctx.repositories.getUserRepository()
     payload.user_UUID = await userRepo.getUserUUID(req.ctx.user, payload.org_UUID)
@@ -214,11 +226,11 @@ async function createCna (req, res, next) {
   }
 }
 
-// Updates a cna only if the cna exist for the specified shortname. If no cna exists, it does not create the cna.
-async function updateCna (req, res, next) {
+// Updates an org only if the org exist for the specified shortname. If no org exists, we do not create the org.
+async function updateOrg (req, res, next) {
   try {
     const shortName = req.ctx.params.shortname
-    const newCna = new Org()
+    const newOrg = new Org()
     let returned = false
     let quota
     let name
@@ -231,8 +243,8 @@ async function updateCna (req, res, next) {
     // org doesn't exist
     if (!org) {
       returned = true
-      logger.info(shortName + ' CNA could not be updated in MongoDB because it does not exist.')
-      return res.status(404).json(error.cnaDneParam(shortName))
+      logger.info({ message: shortName + ' organization could not be updated in MongoDB because it does not exist.' })
+      return res.status(404).json(error.orgDneParam(shortName))
     }
 
     // parsing query parameters
@@ -263,7 +275,7 @@ async function updateCna (req, res, next) {
     // updating the org's roles
     if (org && !returned) {
       const roles = org.authority.active_roles
-      newCna.policies.id_quota = org.policies.id_quota
+      newOrg.policies.id_quota = org.policies.id_quota
 
       // adding roles
       addRoles.forEach(role => {
@@ -281,50 +293,50 @@ async function updateCna (req, res, next) {
         }
       })
 
-      newCna.authority.active_roles = roles
+      newOrg.authority.active_roles = roles
     }
 
     // updating the org's quota
     if (quota && !returned) {
-      newCna.policies.id_quota = quota
+      newOrg.policies.id_quota = quota
     }
 
     // updating the org's name (the name field is never an empty string due to the stripping of the quotes and double quotes)
     if (name && !returned) {
-      newCna.name = name
+      newOrg.name = name
     }
 
     // updating the org's shortname (the shortname field is never an empty string due to the stripping of the quotes and double quotes)
     if (shortname && !returned) {
-      newCna.short_name = shortname
-      const result = await orgRepo.findOneByShortName(newCna.short_name)
+      newOrg.short_name = shortname
+      const result = await orgRepo.findOneByShortName(newOrg.short_name)
 
       if (result && !returned) {
         returned = true
-        return res.status(403).json(error.duplicateShortname(newCna.short_name))
+        return res.status(403).json(error.duplicateShortname(newOrg.short_name))
       }
     }
 
     // update org
     if (!returned) {
-      const result = await orgRepo.updateByOrgUUID(org.UUID, newCna)
+      const result = await orgRepo.updateByOrgUUID(org.UUID, newOrg)
 
       if (result.n === 0) {
-        logger.info(shortName + ' CNA could not be updated in MongoDB because it does not exist.')
-        return res.status(404).json(error.cnaDneParam(shortName))
+        logger.info({ message: shortName + ' organization could not be updated in MongoDB because it does not exist.' })
+        return res.status(404).json(error.orgDneParam(shortName))
       }
 
       const responseMessage = {
-        message: shortName + ' CNA was successfully updated.',
-        updated: newCna
+        message: shortName + ' organization was successfully updated.',
+        updated: newOrg
       }
 
       const payload = {
         action: 'update_org',
-        change: shortName + ' CNA was successfully updated.',
+        change: shortName + ' organization was successfully updated.',
         req_UUID: req.ctx.uuid,
         org_UUID: await orgRepo.getOrgUUID(req.ctx.org),
-        org: newCna
+        org: newOrg
       }
       const userRepo = req.ctx.repositories.getUserRepository()
       payload.user_UUID = await userRepo.getUserUUID(req.ctx.user, payload.org_UUID)
@@ -336,18 +348,18 @@ async function updateCna (req, res, next) {
   }
 }
 
-// Creates a user only if the cna exist and the user doesn't exist for the specified shortname and username respectively.
+// Creates a user only if the org exist and the user does not exist for the specified shortname and username
 async function createUser (req, res, next) {
   try {
-    const cnaShortName = req.ctx.params.shortname
+    const orgShortName = req.ctx.params.shortname
     const newUser = new User(req.ctx.body)
     const orgRepo = req.ctx.repositories.getOrgRepository()
     const userRepo = req.ctx.repositories.getUserRepository()
 
-    const orgUUID = await orgRepo.getOrgUUID(cnaShortName)
+    const orgUUID = await orgRepo.getOrgUUID(orgShortName)
     if (!orgUUID) {
-      logger.info('The user could not be created because ' + cnaShortName + ' CNA does not exist.')
-      return res.status(404).json(error.cnaDneParam(cnaShortName))
+      logger.info({ message: 'The user could not be created because ' + orgShortName + ' organization does not exist.' })
+      return res.status(404).json(error.orgDneParam(orgShortName))
     }
 
     if (newUser.org_UUID === undefined || newUser.org_UUID === null) {
@@ -365,14 +377,14 @@ async function createUser (req, res, next) {
         sn = temp.short_name
       }
 
-      return res.status(400).json(error.shortnameMismatch(cnaShortName, sn))
+      return res.status(400).json(error.shortnameMismatch(orgShortName, sn))
     }
 
-    let result = await orgRepo.findOneByUUID(newUser.org_UUID) // Check the cna exists
+    let result = await orgRepo.findOneByUUID(newUser.org_UUID) // Check the org exists
 
     if (!result) {
-      logger.info('The user could not be created because ' + cnaShortName + ' CNA does not exist.')
-      return res.status(400).json(error.cnaDneParam(cnaShortName))
+      logger.info({ message: 'The user could not be created because ' + orgShortName + ' organization does not exist.' })
+      return res.status(400).json(error.orgDneParam(orgShortName))
     }
 
     newUser.active = true
@@ -386,7 +398,7 @@ async function createUser (req, res, next) {
     result = await userRepo.findOneByUserNameAndOrgUUID(newUser.username, newUser.org_UUID) // Find user in MongoDB
 
     if (result) {
-      logger.info(newUser.username + ' was not created because it already exists.')
+      logger.info({ message: newUser.username + ' was not created because it already exists.' })
       return res.status(400).json(error.userExists(newUser.username))
     }
     await userRepo.updateByUserNameAndOrgUUID(newUser.username, newUser.org_UUID, newUser, { upsert: true }) // Create user in MongoDB if it doesn't exist
@@ -421,7 +433,7 @@ async function updateUser (req, res, next) {
     let returned = false
     let nameChanged = false
     let newUsername
-    let newCnaShortname
+    let newOrgShortName
     let active
     const name = {
       first: null,
@@ -436,14 +448,14 @@ async function updateUser (req, res, next) {
     const orgUUID = await orgRepo.getOrgUUID(shortName)
     if (!orgUUID) {
       returned = true
-      logger.info('The user could not be updated because ' + shortName + ' CNA does not exist.')
-      return res.status(404).json(error.cnaDneParam(shortName))
+      logger.info({ message: 'The user could not be updated because ' + shortName + ' organization does not exist.' })
+      return res.status(404).json(error.orgDneParam(shortName))
     }
 
     const user = await userRepo.findOneByUserNameAndOrgUUID(username, orgUUID)
     if (!user) {
       returned = true
-      logger.info('The user could not be updated because ' + username + ' does not exist for ' + shortName + ' CNA')
+      logger.info({ message: 'The user could not be updated because ' + username + ' does not exist for ' + shortName + ' organization.' })
       return res.status(404).json(error.userDne(username))
     }
 
@@ -451,7 +463,7 @@ async function updateUser (req, res, next) {
       newUsername = req.ctx.query.new_username
     }
     if ('new_cna_shortname' in req.ctx.query) {
-      newCnaShortname = req.ctx.query.new_cna_shortname
+      newOrgShortName = req.ctx.query.new_cna_shortname
     }
     if ('active' in req.ctx.query) {
       active = req.ctx.query.active
@@ -497,37 +509,37 @@ async function updateUser (req, res, next) {
     }
 
     // check if the new org exist
-    if (newCnaShortname && !returned) {
-      newUser.org_UUID = await orgRepo.getOrgUUID(newCnaShortname)
+    if (newOrgShortName && !returned) {
+      newUser.org_UUID = await orgRepo.getOrgUUID(newOrgShortName)
 
       if (!newUser.org_UUID) {
         returned = true
-        logger.info('The user could not be updated because ' + newCnaShortname + ' CNA does not exist.')
-        return res.status(404).json(error.cnaDne(newCnaShortname))
+        logger.info({ message: 'The user could not be updated because ' + newOrgShortName + ' organization does not exist.' })
+        return res.status(404).json(error.orgDne(newOrgShortName))
       }
     }
 
     // check if org has user of same username already
-    if ((newUsername && newCnaShortname) && !returned) {
+    if ((newUsername && newOrgShortName) && !returned) {
       const duplicateUsers = await userRepo.find({ org_UUID: newUser.org_UUID, username: newUser.username })
       if (duplicateUsers.length) {
         returned = true
-        logger.info('The user could not be updated because ' + newCnaShortname + ' CNA contains a user with the same name.')
-        return res.status(403).json(error.duplicateUsername(newCnaShortname, newUsername))
+        logger.info({ message: 'The user could not be updated because ' + newOrgShortName + ' organization contains a user with the same name.' })
+        return res.status(403).json(error.duplicateUsername(newOrgShortName, newUsername))
       }
     } else if (newUsername && !returned) {
       const duplicateUsers = await userRepo.find({ org_UUID: orgUUID, username: newUser.username })
       if (duplicateUsers.length) {
         returned = true
-        logger.info('The user could not be updated because ' + shortName + ' CNA contains a user with the same name.')
+        logger.info({ message: 'The user could not be updated because ' + shortName + ' organization contains a user with the same name.' })
         return res.status(403).json(error.duplicateUsername(shortName, newUsername))
       }
-    } else if (newCnaShortname && !returned) {
+    } else if (newOrgShortName && !returned) {
       const duplicateUsers = await userRepo.find({ org_UUID: newUser.org_UUID, username: username })
       if (duplicateUsers.length) {
         returned = true
-        logger.info('The user could not be updated because ' + newCnaShortname + ' CNA contains a user with the same name.')
-        return res.status(403).json(error.duplicateUsername(newCnaShortname, username))
+        logger.info({ message: 'The user could not be updated because ' + newOrgShortName + ' organization contains a user with the same name.' })
+        return res.status(403).json(error.duplicateUsername(newOrgShortName, username))
       }
     }
 
@@ -535,7 +547,7 @@ async function updateUser (req, res, next) {
       const result = await userRepo.updateByUserNameAndOrgUUID(username, orgUUID, newUser)
 
       if (result.n === 0) {
-        logger.info('The user could not be updated because ' + username + ' does not exist for ' + shortName + ' CNA')
+        logger.info({ message: 'The user could not be updated because ' + username + ' does not exist for ' + shortName + ' organization.' })
         return res.status(404).json(error.userDne(username))
       }
 
@@ -564,27 +576,27 @@ async function updateUser (req, res, next) {
 async function resetSecret (req, res, next) {
   try {
     const username = req.ctx.params.username
-    const cnaShortName = req.ctx.params.shortname
+    const orgShortName = req.ctx.params.shortname
     const newUser = new User()
     const randomKey = cryptoRandomString({ length: CONSTANTS.CRYPTO_RANDOM_STRING_LENGTH })
     newUser.secret = await argon2.hash(randomKey) // store in db
     newUser.username = username
     const userRepo = req.ctx.repositories.getUserRepository()
     const orgRepo = req.ctx.repositories.getOrgRepository()
-    const orgUUID = await orgRepo.getOrgUUID(cnaShortName) // userUUID may be null if user does not exist
+    const orgUUID = await orgRepo.getOrgUUID(orgShortName) // userUUID may be null if user does not exist
 
     if (!orgUUID) {
-      logger.info(cnaShortName + ' CNA does not exist.')
-      return res.status(404).json(error.cnaDneParam(cnaShortName))
+      logger.info({ messsage: orgShortName + ' organization does not exist.' })
+      return res.status(404).json(error.orgDneParam(orgShortName))
     }
 
     const result = await userRepo.updateByUserNameAndOrgUUID(newUser.username, orgUUID, newUser)
     if (result.n === 0) {
-      logger.info('The user could not be updated because ' + username + ' does not exist for ' + cnaShortName)
+      logger.info({ message: 'The user could not be updated because ' + username + ' does not exist for ' + orgShortName + ' organization.' })
       return res.status(404).json(error.userDne(username))
     }
 
-    logger.info(JSON.stringify(`The API secret was successfully reset and sent to ${username}`))
+    logger.info({ message: `The API secret was successfully reset and sent to ${username}` })
     const payload = {
       action: 'reset_userAPIkey',
       change: 'API secret was successfully reset.',
@@ -600,10 +612,10 @@ async function resetSecret (req, res, next) {
 }
 
 module.exports = {
-  CNA_ALL: getCnas,
-  CNA_SINGLE: getCna,
-  CNA_CREATE_SINGLE: createCna,
-  CNA_UPDATE_SINGLE: updateCna,
+  ORG_ALL: getOrgs,
+  ORG_SINGLE: getOrg,
+  ORG_CREATE_SINGLE: createOrg,
+  ORG_UPDATE_SINGLE: updateOrg,
   ORG_ID_QUOTA: getOrgIdQuota,
   USER_SINGLE: getUser,
   USER_CREATE_SINGLE: createUser,
diff --git a/src/controller/org.controller/org.middleware.js b/src/controller/org.controller/org.middleware.js
index fce9d218..65571717 100644
--- a/src/controller/org.controller/org.middleware.js
+++ b/src/controller/org.controller/org.middleware.js
@@ -5,11 +5,11 @@ const errors = require('./error')
 const error = new errors.OrgControllerError()
 const utils = require('../../utils/utils')
 
-function isCNARole (val) {
+function isOrgRole (val) {
   val.forEach(role => {
-    if (!CONSTANTS.CNA_ROLES.includes(role)) {
-      logger.info('Invalid role for CNA', role)
-      throw new Error('CNA role \'' + role + '\' does not exist.')
+    if (!CONSTANTS.ORG_ROLES.includes(role)) {
+      logger.info('Invalid role for organization', role)
+      throw new Error('The organization role \'' + role + '\' does not exist.')
     }
   })
 
@@ -45,5 +45,5 @@ module.exports = {
   parsePostParams,
   parseGetParams,
   parseError,
-  isCNARole
+  isOrgRole
 }
diff --git a/src/middleware/middleware.js b/src/middleware/middleware.js
index 661cb3d3..636f2bcf 100644
--- a/src/middleware/middleware.js
+++ b/src/middleware/middleware.js
@@ -46,31 +46,31 @@ async function validateUser (req, res, next) {
       return res.status(400).json(error.badRequest(CONSTANTS.AUTH_HEADERS.KEY))
     }
 
-    logger.info('Authenticating user: ' + user)
+    logger.info({ message: 'Authenticating user: ' + user }) // userUUID may be null if user does not exist
     const orgUUID = await orgRepo.getOrgUUID(org)
     if (!orgUUID) {
-      logger.info(org + ' CNA does not exist. User authentication FAILED for ' + user)
+      logger.info({ message: org + ' organization does not exist. User authentication FAILED for ' + user })
       return res.status(401).json(error.unauthorized())
     }
 
     const result = await userRepo.findOneByUserNameAndOrgUUID(user, orgUUID)
     if (!result) {
-      logger.warn('User not found. User authentication FAILED for ' + user)
+      logger.warn({ message: 'User not found. User authentication FAILED for ' + user })
       return res.status(401).json(error.unauthorized())
     }
 
     if (!result.active) {
-      logger.warn('User deactivated. Authentication failed for ' + user)
+      logger.warn({ message: 'User deactivated. Authentication failed for ' + user })
       return res.status(401).json(error.unauthorized())
     }
 
     const isPwd = await argon2.verify(result.secret, key)
     if (!isPwd) {
-      logger.warn('Incorrect apikey. User authentication FAILED for ' + user)
+      logger.warn({ message: 'Incorrect apikey. User authentication FAILED for ' + user })
       return res.status(401).json(error.unauthorized())
     }
 
-    logger.info('SUCCESSFUL user authentication for ' + user)
+    logger.info({ message: 'SUCCESSFUL user authentication for ' + user })
     next()
   } catch (err) {
     next(err)
@@ -173,7 +173,7 @@ function validateCveJsonSchema (req, res, next) {
 }
 
 function errorHandler (err, req, res, next) {
-  logger.error(err.stack)
+  logger.error({ error: err.stack })
   return res.status(500).json(error.serviceNotAvailable())
 }
 
diff --git a/src/utils/error.js b/src/utils/error.js
index 1a3a7385..d27af8a3 100644
--- a/src/utils/error.js
+++ b/src/utils/error.js
@@ -7,10 +7,10 @@ class IDRError {
     return err
   }
 
-  cnaDne (shortname) { // super
+  orgDne (shortname) { // super
     const err = {}
-    err.error = 'CNA_DNE'
-    err.message = `The CNA '${shortname}' designated by the shortname query parameter does not exist.`
+    err.error = 'ORG_DNE'
+    err.message = `The organization '${shortname}' designated by the shortname query parameter does not exist.`
     return err
   }
 


Test patch:
diff --git a/test-utils/index.js b/test-utils/index.js
index 4a700299..e6f3b485 100644
--- a/test-utils/index.js
+++ b/test-utils/index.js
@@ -64,7 +64,7 @@ app.route('/org-created-when-uuid-undefined')
     }
     req.ctx.repositories = factory
     next()
-  }, orgParams.parsePostParams, orgController.CNA_CREATE_SINGLE)
+  }, orgParams.parsePostParams, orgController.ORG_CREATE_SINGLE)
 
 app.route('/org-created-when-uuid-null')
   .post((req, res, next) => {
@@ -74,7 +74,7 @@ app.route('/org-created-when-uuid-null')
     }
     req.ctx.repositories = factory
     next()
-  }, orgParams.parsePostParams, orgController.CNA_CREATE_SINGLE)
+  }, orgParams.parsePostParams, orgController.ORG_CREATE_SINGLE)
 
 app.route('/org-created-when-uuid-defined')
   .post((req, res, next) => {
@@ -84,7 +84,7 @@ app.route('/org-created-when-uuid-defined')
     }
     req.ctx.repositories = factory
     next()
-  }, orgParams.parsePostParams, orgController.CNA_CREATE_SINGLE)
+  }, orgParams.parsePostParams, orgController.ORG_CREATE_SINGLE)
 
 app.route('/org-created-when-roles-defined')
   .post((req, res, next) => {
@@ -94,7 +94,7 @@ app.route('/org-created-when-roles-defined')
     }
     req.ctx.repositories = factory
     next()
-  }, orgParams.parsePostParams, orgController.CNA_CREATE_SINGLE)
+  }, orgParams.parsePostParams, orgController.ORG_CREATE_SINGLE)
 
 app.route('/org-created-when-roles-undefined-id_quota-defined')
   .post((req, res, next) => {
@@ -104,7 +104,7 @@ app.route('/org-created-when-roles-undefined-id_quota-defined')
     }
     req.ctx.repositories = factory
     next()
-  }, orgParams.parsePostParams, orgController.CNA_CREATE_SINGLE)
+  }, orgParams.parsePostParams, orgController.ORG_CREATE_SINGLE)
 
 app.route('/org-created-when-id_quota-undefined')
   .post((req, res, next) => {
@@ -114,7 +114,7 @@ app.route('/org-created-when-id_quota-undefined')
     }
     req.ctx.repositories = factory
     next()
-  }, orgParams.parsePostParams, orgController.CNA_CREATE_SINGLE)
+  }, orgParams.parsePostParams, orgController.ORG_CREATE_SINGLE)
 
 app.route('/org-created-when-id_quota-null')
   .post((req, res, next) => {
@@ -124,7 +124,7 @@ app.route('/org-created-when-id_quota-null')
     }
     req.ctx.repositories = factory
     next()
-  }, orgParams.parsePostParams, orgController.CNA_CREATE_SINGLE)
+  }, orgParams.parsePostParams, orgController.ORG_CREATE_SINGLE)
 
 app.route('/org-not-created-already-exists')
   .post((req, res, next) => {
@@ -133,7 +133,7 @@ app.route('/org-not-created-already-exists')
     }
     req.ctx.repositories = factory
     next()
-  }, orgParams.parsePostParams, orgController.CNA_CREATE_SINGLE)
+  }, orgParams.parsePostParams, orgController.ORG_CREATE_SINGLE)
 
 // --- update org --- //
 app.route('/org-not-updated-doesnt-exists/:shortname')
@@ -143,7 +143,7 @@ app.route('/org-not-updated-doesnt-exists/:shortname')
     }
     req.ctx.repositories = factory
     next()
-  }, orgParams.parsePostParams, orgController.CNA_UPDATE_SINGLE)
+  }, orgParams.parsePostParams, orgController.ORG_UPDATE_SINGLE)
 
 app.route('/org-not-updated-shortname-exists/:shortname')
   .post((req, res, next) => {
@@ -152,7 +152,7 @@ app.route('/org-not-updated-shortname-exists/:shortname')
     }
     req.ctx.repositories = factory
     next()
-  }, orgParams.parsePostParams, orgController.CNA_UPDATE_SINGLE)
+  }, orgParams.parsePostParams, orgController.ORG_UPDATE_SINGLE)
 
 app.route('/org-updated-id_quota-undefined/:shortname')
   .post((req, res, next) => {
@@ -162,7 +162,7 @@ app.route('/org-updated-id_quota-undefined/:shortname')
     }
     req.ctx.repositories = factory
     next()
-  }, orgParams.parsePostParams, orgController.CNA_UPDATE_SINGLE)
+  }, orgParams.parsePostParams, orgController.ORG_UPDATE_SINGLE)
 
 app.route('/org-not-updated-no-query-parameters/:shortname')
   .post((req, res, next) => {
@@ -172,7 +172,7 @@ app.route('/org-not-updated-no-query-parameters/:shortname')
     }
     req.ctx.repositories = factory
     next()
-  }, orgParams.parsePostParams, orgController.CNA_UPDATE_SINGLE)
+  }, orgParams.parsePostParams, orgController.ORG_UPDATE_SINGLE)
 
 // --- get org --- //
 app.route('/org-cant-get-doesnt-exist/:shortname')
@@ -182,7 +182,7 @@ app.route('/org-cant-get-doesnt-exist/:shortname')
     }
     req.ctx.repositories = factory
     next()
-  }, orgParams.parseGetParams, orgController.CNA_SINGLE)
+  }, orgParams.parseGetParams, orgController.ORG_SINGLE)
 
 app.route('/org-get-does-exist/:shortname')
   .get((req, res, next) => {
@@ -191,7 +191,25 @@ app.route('/org-get-does-exist/:shortname')
     }
     req.ctx.repositories = factory
     next()
-  }, orgParams.parseGetParams, orgController.CNA_SINGLE)
+  }, orgParams.parseGetParams, orgController.ORG_SINGLE)
+
+app.route('/org-get-does-exist-user-same-org/:shortname')
+  .get((req, res, next) => {
+    const factory = {
+      getOrgRepository: () => { return new repos.OrgGet() }
+    }
+    req.ctx.repositories = factory
+    next()
+  }, orgParams.parseGetParams, orgController.ORG_SINGLE)
+
+app.route('/org-cant-get-user-not-secretariat-or-same-org/:shortname')
+  .get((req, res, next) => {
+    const factory = {
+      getOrgRepository: () => { return new repos.OrgGet() }
+    }
+    req.ctx.repositories = factory
+    next()
+  }, orgParams.parseGetParams, orgController.ORG_SINGLE)
 
 // --- get id quota --- //
 app.route('/org-id_quota-secretariat/:shortname')
@@ -260,7 +278,7 @@ app.route('/org-all-cnas')
     }
     req.ctx.repositories = factory
     next()
-  }, orgController.CNA_ALL)
+  }, orgController.ORG_ALL)
 
 app.route('/org-no-cnas-exist')
   .get((req, res, next) => {
@@ -269,7 +287,7 @@ app.route('/org-no-cnas-exist')
     }
     req.ctx.repositories = factory
     next()
-  }, orgController.CNA_ALL)
+  }, orgController.ORG_ALL)
 
 // --- create user --- //
 app.route('/user-not-created-org-does-not-exist/:shortname')
diff --git a/test-utils/repositories.js b/test-utils/repositories.js
index 977478ce..119753ca 100644
--- a/test-utils/repositories.js
+++ b/test-utils/repositories.js
@@ -134,10 +134,20 @@ class OrgGet {
     expect(aggregation[0]).to.have.property('$match')
     if (aggregation[0].$match.short_name === orgMockObj.existentOrg.short_name) {
       return [orgMockObj.existentOrg]
+    } else if (aggregation[0].$match.short_name === orgMockObj.owningOrg.short_name) {
+      return [orgMockObj.owningOrg]
     }
 
     return []
   }
+
+  async isSecretariat (shortname) {
+    if (shortname === orgMockObj.secretariatHeader['CVE-API-ORG']) {
+      return true
+    } else {
+      return false
+    }
+  }
 }
 
 class OrgSecretariatIdQuota {
diff --git a/test-utils/reserveCaseA.non-sequential.js b/test-utils/reserveCaseA.non-sequential.js
index ee476332..86f921f4 100644
--- a/test-utils/reserveCaseA.non-sequential.js
+++ b/test-utils/reserveCaseA.non-sequential.js
@@ -41,7 +41,7 @@ async function reserveCveId (req, res) {
 
     if (!result) {
       returned = true
-      return res.status(403).json(error.cnaDne(shortName))
+      return res.status(403).json(error.orgDne(shortName))
     }
   }
 
diff --git a/test-utils/reserveCaseB.non-sequential.js b/test-utils/reserveCaseB.non-sequential.js
index 1c244470..54f6236c 100644
--- a/test-utils/reserveCaseB.non-sequential.js
+++ b/test-utils/reserveCaseB.non-sequential.js
@@ -42,7 +42,7 @@ async function reserveCveId (req, res) {
 
     if (!result) {
       returned = true
-      return res.status(403).json(error.cnaDne(shortName))
+      return res.status(403).json(error.orgDne(shortName))
     }
   }
 
diff --git a/test-utils/reserveCaseE.non-sequential.js b/test-utils/reserveCaseE.non-sequential.js
index 47ca737f..30c10ec5 100644
--- a/test-utils/reserveCaseE.non-sequential.js
+++ b/test-utils/reserveCaseE.non-sequential.js
@@ -44,7 +44,7 @@ async function reserveCveId (req, res) {
 
     if (!result) {
       returned = true
-      return res.status(403).json(error.cnaDne(shortName))
+      return res.status(403).json(error.orgDne(shortName))
     }
   }
 
diff --git a/test-utils/reserveCaseF.non-sequential.js b/test-utils/reserveCaseF.non-sequential.js
index aea75c73..b4b6c808 100644
--- a/test-utils/reserveCaseF.non-sequential.js
+++ b/test-utils/reserveCaseF.non-sequential.js
@@ -41,7 +41,7 @@ async function reserveCveId (req, res) {
 
     if (!result) {
       returned = true
-      return res.status(403).json(error.cnaDne(shortName))
+      return res.status(403).json(error.orgDne(shortName))
     }
   }
 
diff --git a/test-utils/reserveCaseG.non-sequential.js b/test-utils/reserveCaseG.non-sequential.js
index 627fb477..cb521828 100644
--- a/test-utils/reserveCaseG.non-sequential.js
+++ b/test-utils/reserveCaseG.non-sequential.js
@@ -41,7 +41,7 @@ async function reserveCveId (req, res) {
 
     if (!result) {
       returned = true
-      return res.status(403).json(error.cnaDne(shortName))
+      return res.status(403).json(error.orgDne(shortName))
     }
   }
 
diff --git a/test/unit-tests/cve-id/cveIdTest.js b/test/unit-tests/cve-id/cveIdTest.js
index c4a77db0..8da109e3 100644
--- a/test/unit-tests/cve-id/cveIdTest.js
+++ b/test/unit-tests/cve-id/cveIdTest.js
@@ -10,11 +10,8 @@ const secretariatUser = require('./mockObjects.cve-id').secretariatUser
 const owningOrg = require('./mockObjects.cve-id').owningOrg
 const owningOrgUser = require('./mockObjects.cve-id').owningOrgUser
 const org = require('./mockObjects.cve-id').org
-const orgUser = require('./mockObjects.cve-id').orgUser
 const nonExistentOrg = require('./mockObjects.cve-id').nonExistentOrg
 const cvePublic = require('./mockObjects.cve-id').cvePublic
-const cveReserved = require('./mockObjects.cve-id').cveReserved
-const cveReject = require('./mockObjects.cve-id').cveReject
 const errors = require('../../../src/controller/cve-id.controller/error')
 const error = new errors.CveIdControllerError()
 const cveIdDummy1 = require('./mockObjects.cve-id').cveDummy1
@@ -25,8 +22,6 @@ const cveIdDummy5 = require('./mockObjects.cve-id').cveDummy5
 const cveId = require('./mockObjects.cve-id').cveId
 const cveIdYear = require('./mockObjects.cve-id').cveIdYear
 const nonExistentCveId = 'CVE-2017-35437'
-const ReposFactory = require('../../../src/repositories/repositoryFactory')
-const repositories = new ReposFactory()
 
 describe('Test ID Reservator Endpoints', () => {
   context('Getting a cve id', () => {
@@ -70,7 +65,7 @@ describe('Test ID Reservator Endpoints', () => {
         })
     })
 
-    it('Requester is not the owning org or the secretariat and the cve is RESERVED', (done) => {
+    it('Requester is not a user of the same org or the secretariat and the cve is RESERVED', (done) => {
       // perform the request to the api
       chai.request(server)
         .get(`/cve-id-not-owning-org-reserved/${cveId}`)
@@ -89,7 +84,7 @@ describe('Test ID Reservator Endpoints', () => {
         })
     })
 
-    it('Requester is not the owning org or the secretariat and the cve is not RESERVED', async () => {
+    it('Requester is not a user of the same org or the secretariat and the cve is not RESERVED', async () => {
       // perform the request to the api
       const res = await chai.request(server)
         .get(`/cve-id-not-owning-org-not-reserved/${cveId}`)
@@ -102,7 +97,7 @@ describe('Test ID Reservator Endpoints', () => {
       expect(res.body).to.have.property('owning_cna').and.to.equal(owningOrg.short_name)
     })
 
-    it('Requester is the owning cna', async () => {
+    it('Requester is a user of the same org', async () => {
       // perform the request to the api
       const res = await chai.request(server)
         .get(`/cve-id-owning-org/${cveId}`)
@@ -223,7 +218,7 @@ describe('Test ID Reservator Endpoints', () => {
         })
     })
 
-    it('The requester is not the Secretariat and no query parameters are provided', (done) => {
+    it('The requester is not the secretariat and no query parameters are provided', (done) => {
       // perform the request to the api
       chai.request(server)
         .get('/cve-id-filtered-not-secretariat-no-query')
@@ -264,7 +259,6 @@ describe('Test ID Reservator Endpoints', () => {
               if (err) {
                 done(err)
               }
-
               // assert expected response
               expect(res).to.have.status(200)
               expect(res).to.have.property('body').and.to.be.a('object')
@@ -299,7 +293,7 @@ describe('Test ID Reservator Endpoints', () => {
         })
     })
 
-    it('The requester is the Secretariat and no query parameters are provided', (done) => {
+    it('The requester is the secretariat and no query parameters are provided', (done) => {
       // perform the request to the api
       chai.request(server)
         .get('/cve-id-filtered-secretariat-no-query')
@@ -367,7 +361,7 @@ describe('Test ID Reservator Endpoints', () => {
           // assert expected response
           expect(res).to.have.status(404)
           expect(res).to.have.property('body').and.to.be.a('object')
-          const errObj = error.cnaDne(nonExistentOrg.short_name)
+          const errObj = error.orgDne(nonExistentOrg.short_name)
           expect(res.body.error).to.equal(errObj.error)
           expect(res.body.message).to.equal(errObj.message)
           done()
diff --git a/test/unit-tests/cve-id/reserveCveIdTest.js b/test/unit-tests/cve-id/reserveCveIdTest.js
index 980d1b53..88c1d8c4 100644
--- a/test/unit-tests/cve-id/reserveCveIdTest.js
+++ b/test/unit-tests/cve-id/reserveCveIdTest.js
@@ -18,7 +18,7 @@ const year22 = 2022
 
 describe('Test ID Reservator', () => {
   context('Business Logic', () => {
-    it('Requester is not the owning Org or the Secretariat', (done) => {
+    it('Requester is not a user of the same org or the secretariat', (done) => {
       // perform the request to the api
       chai.request(server)
         .post(`/cve-id-reserve-not-owning-org?cve_year=${year20}&amount=1`)
@@ -31,7 +31,7 @@ describe('Test ID Reservator', () => {
           // assert expected response
           expect(res).to.have.status(403)
           expect(res).to.have.property('body').and.to.be.a('object')
-          const errObj = error.cnaCannotReserveForOther()
+          const errObj = error.orgCannotReserveForOther()
           expect(res.body.error).to.equal(errObj.error)
           expect(res.body.message).to.equal(errObj.message)
           done()
@@ -51,7 +51,7 @@ describe('Test ID Reservator', () => {
           // assert expected response
           expect(res).to.have.status(400)
           expect(res).to.have.property('body').and.to.be.a('object')
-          const errObj = error.noCnaShortName()
+          const errObj = error.noOrgShortName()
           expect(res.body.error).to.equal(errObj.error)
           expect(res.body.message).to.equal(errObj.message)
           done()
@@ -151,7 +151,7 @@ describe('Test ID Reservator', () => {
           // assert expected response
           expect(res).to.have.status(403)
           expect(res).to.have.property('body').and.to.be.a('object')
-          const errObj = error.cnaDne(nonExistentOrg.short_name)
+          const errObj = error.orgDne(nonExistentOrg.short_name)
           expect(res.body.error).to.equal(errObj.error)
           expect(res.body.message).to.equal(errObj.message)
           done()
diff --git a/test/unit-tests/middleware/middlewareTest.js b/test/unit-tests/middleware/middlewareTest.js
index 2ed812a7..724b8079 100644
--- a/test/unit-tests/middleware/middlewareTest.js
+++ b/test/unit-tests/middleware/middlewareTest.js
@@ -264,7 +264,7 @@ describe('Test for middleware', () => {
         })
     })
 
-    it('Cna is undefined', function (done) {
+    it('Org is undefined', function (done) {
       const testHeaders = Object.assign({}, secretariatHeaders)
       delete testHeaders[CONSTANTS.AUTH_HEADERS.ORG]
 
@@ -288,7 +288,7 @@ describe('Test for middleware', () => {
         })
     })
 
-    it('Submitter is undefined', function (done) {
+    it('Requester is undefined', function (done) {
       const testHeaders = Object.assign({}, secretariatHeaders)
       delete testHeaders[CONSTANTS.AUTH_HEADERS.USER]
 
@@ -312,7 +312,7 @@ describe('Test for middleware', () => {
         })
     })
 
-    it('Secret is undefined', function (done) {
+    it('Secret apikey is undefined', function (done) {
       const testHeaders = Object.assign({}, secretariatHeaders)
       delete testHeaders[CONSTANTS.AUTH_HEADERS.KEY]
 
diff --git a/test/unit-tests/middleware/onlyCnasMiddlewareTest.js b/test/unit-tests/middleware/onlyCnasMiddlewareTest.js
index 036947b1..a623a0fc 100644
--- a/test/unit-tests/middleware/onlyCnasMiddlewareTest.js
+++ b/test/unit-tests/middleware/onlyCnasMiddlewareTest.js
@@ -3,30 +3,15 @@ const chai = require('chai')
 const expect = chai.expect
 chai.use(require('chai-http'))
 const secretariatHeaders = require('./onlyCnas.fixtures').secretariatHeaders
-const secretariatOrg = require('./onlyCnas.fixtures').secretariatOrg
-const secretariatUser = require('./onlyCnas.fixtures').secretariatUser
 const secretariatAndCnaHeaders = require('./onlyCnas.fixtures').secretariatAndCnaHeaders
-const secretariatAndCnaOrg = require('./onlyCnas.fixtures').secretariatAndCnaOrg
-const secretariatAndCnaUser = require('./onlyCnas.fixtures').secretariatAndCnaUser
 const notCnaHeaders = require('./onlyCnas.fixtures').notCnaHeaders
-const notCnaOrg = require('./onlyCnas.fixtures').notCnaOrg
-const notCnaUser = require('./onlyCnas.fixtures').notCnaUser
 const cnaHeaders = require('./onlyCnas.fixtures').cnaHeaders
-const cnaOrg = require('./onlyCnas.fixtures').cnaOrg
-const cnaUser = require('./onlyCnas.fixtures').cnaUser
 const errors = require('../../../src/middleware/error')
 const error = new errors.MiddlewareError()
 
-const ReposFactory = require('../../../src/repositories/repositoryFactory')
-
-const repositories = new ReposFactory()
-
 describe('Test only CNA middleware', () => {
-  before(async () => {
-  })
-
   context('Positive Tests', function () {
-    it('Users org is a CNA and should pass checks', function (done) {
+    it('Requester is a CNA', function (done) {
       // perform the request to the api
       chai.request(server)
         .post('/only-cnas-org-cna-passes')
@@ -46,7 +31,7 @@ describe('Test only CNA middleware', () => {
         })
     })
 
-    it('Users org is a CNA and Secretariat and should pass checks', function (done) {
+    it('Requester is a CNA and a secretariat', function (done) {
       // perform the request to the api
       chai.request(server)
         .post('/only-cnas-org-cna-and-secretariat-passes')
@@ -68,7 +53,7 @@ describe('Test only CNA middleware', () => {
 
     // This test will change with the implementation of Root CNAs, as the burden of reserving IDs
     // on behalf of other organizations transfers to Roots. Secretariat will then step back.
-    it('Users org is a Secretariat but not a CNA and should pass checks', function (done) {
+    it('Requester is a secretariat but not a CNA', function (done) {
       // perform the request to the api
       chai.request(server)
         .post('/only-cnas-org-secretariat-passes')
@@ -90,7 +75,7 @@ describe('Test only CNA middleware', () => {
   })
 
   context('Negative Tests', function () {
-    it('Users org is not a CNA and should get rejected', function (done) {
+    it('Requester is not a CNA or a secretariat', function (done) {
       // perform the request to the api
       chai.request(server)
         .post('/only-cnas-org-not-cna-rejected')
@@ -111,7 +96,4 @@ describe('Test only CNA middleware', () => {
         })
     })
   })
-
-  after(async () => {
-  })
 })
diff --git a/test/unit-tests/middleware/onlySecretariatMiddlewareTest.js b/test/unit-tests/middleware/onlySecretariatMiddlewareTest.js
index 5ebc00c7..d4ee2ddb 100644
--- a/test/unit-tests/middleware/onlySecretariatMiddlewareTest.js
+++ b/test/unit-tests/middleware/onlySecretariatMiddlewareTest.js
@@ -3,8 +3,6 @@ const chai = require('chai')
 const expect = chai.expect
 chai.use(require('chai-http'))
 const secretariatHeaders = require('./onlySecretariat.fixtures').secretariatHeaders
-const secretariatOrg = require('./onlySecretariat.fixtures').secretariatOrg
-const secretariatUser = require('./onlySecretariat.fixtures').secretariatUser
 const notSecretariatOrg = require('./onlySecretariat.fixtures').notSecretariatOrg
 const notSecretariatUser = require('./onlySecretariat.fixtures').notSecretariatUser
 const CONSTANTS = require('../../../src/constants')
@@ -12,11 +10,8 @@ const errors = require('../../../src/middleware/error')
 const error = new errors.MiddlewareError()
 
 describe('Test only Secretariat middleware', () => {
-  before(async () => {
-  })
-
   context('Positive Tests', function () {
-    it('User is a secretariat user', function (done) {
+    it('User is a secretariat', function (done) {
       // perform the request to the api
       chai.request(server)
         .post('/only-secretariat-pass')
@@ -38,7 +33,7 @@ describe('Test only Secretariat middleware', () => {
   })
 
   context('Negative Tests', function () {
-    it('User is not a secretariat user', function (done) {
+    it('User is not a secretariat', function (done) {
       const testHeaders = Object.assign({}, secretariatHeaders)
       testHeaders[CONSTANTS.AUTH_HEADERS.USER] = notSecretariatUser.username
       testHeaders[CONSTANTS.AUTH_HEADERS.ORG] = notSecretariatOrg.short_name
@@ -61,7 +56,4 @@ describe('Test only Secretariat middleware', () => {
         })
     })
   })
-
-  after(async () => {
-  })
 })
diff --git a/test/unit-tests/org/orgTest.js b/test/unit-tests/org/orgTest.js
index 9a68d9f9..35005411 100644
--- a/test/unit-tests/org/orgTest.js
+++ b/test/unit-tests/org/orgTest.js
@@ -7,28 +7,15 @@ const owningOrgHeader = require('./mockObjects.org').owningOrgHeader
 const orgHeader = require('./mockObjects.org').orgHeader
 const owningOrg = require('./mockObjects.org').owningOrg
 const existentOrg = require('./mockObjects.org').existentOrg
-const existentOrgDummy = require('./mockObjects.org').existentOrgDummy
 const nonExistentOrg = require('./mockObjects.org').nonExistentOrg
-const orgWithZeroIdQuota = require('./mockObjects.org').orgWithZeroIdQuota
 const orgWithNegativeIdQuota = require('./mockObjects.org').orgWithNegativeIdQuota
 const orgExceedingMaxIdQuota = require('./mockObjects.org').orgExceedingMaxIdQuota
-const toBeDeactivatedOrg = require('./mockObjects.org').toBeDeactivatedOrg
-const toBeActivatedOrg = require('./mockObjects.org').toBeActivatedOrg
-const existentUser = require('./mockObjects.org').existentUser
-const nonExistentUser = require('./mockObjects.org').nonExistentUser
 const Org = require('../../../src/model/org')
 const CONSTANTS = require('../../../src/constants')
 const errors = require('../../../src/controller/org.controller/error')
 const error = new errors.OrgControllerError()
-const ReposFactory = require('../../../src/repositories/repositoryFactory')
-const repositories = new ReposFactory()
-const userRepo = repositories.getUserRepository()
-const orgRepo = repositories.getOrgRepository()
 
 describe('Test Org Controller', () => {
-  before(async () => {
-  })
-
   context('Creating an org', () => {
     it('Org is created when UUID is undefined', (done) => {
       const testOrg = Object.assign({}, existentOrg)
@@ -48,7 +35,7 @@ describe('Test Org Controller', () => {
           expect(res).to.have.status(200)
           expect(res).to.have.property('body').and.to.be.a('object')
           expect(res.body).to.have.property('message').and.to.be.a('string')
-          expect(res.body.message).to.equal(testOrg.short_name + ' CNA was successfully created.')
+          expect(res.body.message).to.equal(testOrg.short_name + ' organization was successfully created.')
           expect(res.body).to.have.property('created').and.to.be.a('object')
           expect(res.body.created).to.have.property('short_name').to.equal(testOrg.short_name)
           expect(res.body.created).to.have.property('UUID').and.to.be.a('string')
@@ -69,7 +56,7 @@ describe('Test Org Controller', () => {
       expect(res).to.have.status(200)
       expect(res).to.have.property('body').and.to.be.a('object')
       expect(res.body).to.have.property('message').and.to.be.a('string')
-      expect(res.body.message).to.equal(existentOrg.short_name + ' CNA was successfully created.')
+      expect(res.body.message).to.equal(existentOrg.short_name + ' organization was successfully created.')
       expect(res.body).to.have.property('created').and.to.be.a('object')
       expect(res.body.created).to.have.property('short_name').to.equal(existentOrg.short_name)
       expect(res.body.created).to.have.property('UUID').and.to.be.a('string')
@@ -85,7 +72,7 @@ describe('Test Org Controller', () => {
       expect(res).to.have.status(200)
       expect(res).to.have.property('body').and.to.be.a('object')
       expect(res.body).to.have.property('message').and.to.be.a('string')
-      expect(res.body.message).to.equal(existentOrg.short_name + ' CNA was successfully created.')
+      expect(res.body.message).to.equal(existentOrg.short_name + ' organization was successfully created.')
       expect(res.body).to.have.property('created').and.to.be.a('object')
       expect(res.body.created).to.have.property('short_name').to.equal(existentOrg.short_name)
       expect(res.body.created).to.have.property('UUID').to.equal(existentOrg.UUID)
@@ -101,7 +88,7 @@ describe('Test Org Controller', () => {
       expect(res).to.have.status(200)
       expect(res).to.have.property('body').and.to.be.a('object')
       expect(res.body).to.have.property('message').and.to.be.a('string')
-      expect(res.body.message).to.equal(existentOrg.short_name + ' CNA was successfully created.')
+      expect(res.body.message).to.equal(existentOrg.short_name + ' organization was successfully created.')
       expect(res.body).to.have.property('created').and.to.be.a('object')
       expect(res.body.created).to.have.property('short_name').to.equal(existentOrg.short_name)
       expect(res.body.created).to.have.nested.property('policies.id_quota').to.equal(existentOrg.policies.id_quota)
@@ -109,7 +96,7 @@ describe('Test Org Controller', () => {
       expect(res.body.created).to.have.nested.property('authority.active_roles').to.have.lengthOf(2)
     })
 
-    it('Org is not Secretariat and is created when roles are undefined and id_quota is defined', (done) => {
+    it('Org is not secretariat and is created when roles are undefined and id_quota is defined', (done) => {
       const testOrg = Object.assign({}, nonExistentOrg)
       delete testOrg.authority.active_roles
 
@@ -126,7 +113,7 @@ describe('Test Org Controller', () => {
           expect(res).to.have.status(200)
           expect(res).to.have.property('body').and.to.be.a('object')
           expect(res.body).to.have.property('message').and.to.be.a('string')
-          expect(res.body.message).to.equal(testOrg.short_name + ' CNA was successfully created.')
+          expect(res.body.message).to.equal(testOrg.short_name + ' organization was successfully created.')
           expect(res.body).to.have.property('created').and.to.be.a('object')
           expect(res.body.created).to.have.property('short_name').to.equal(testOrg.short_name)
           expect(res.body.created).to.have.nested.property('policies.id_quota').to.equal(testOrg.policies.id_quota)
@@ -149,7 +136,7 @@ describe('Test Org Controller', () => {
       expect(res).to.have.status(200)
       expect(res).to.have.property('body').and.to.be.a('object')
       expect(res.body).to.have.property('message').and.to.be.a('string')
-      expect(res.body.message).to.equal(testOrg.short_name + ' CNA was successfully created.')
+      expect(res.body.message).to.equal(testOrg.short_name + ' organization was successfully created.')
       expect(res.body).to.have.property('created').and.to.be.a('object')
       expect(res.body.created).to.have.property('short_name').to.equal(testOrg.short_name)
       expect(res.body.created).to.have.nested.property('policies.id_quota').to.equal(CONSTANTS.DEFAULT_ID_QUOTA)
@@ -170,7 +157,7 @@ describe('Test Org Controller', () => {
       expect(res).to.have.status(200)
       expect(res).to.have.property('body').and.to.be.a('object')
       expect(res.body).to.have.property('message').and.to.be.a('string')
-      expect(res.body.message).to.equal(testOrg.short_name + ' CNA was successfully created.')
+      expect(res.body.message).to.equal(testOrg.short_name + ' organization was successfully created.')
       expect(res.body).to.have.property('created').and.to.be.a('object')
       expect(res.body.created).to.have.property('short_name').to.equal(testOrg.short_name)
       expect(res.body.created).to.have.nested.property('policies.id_quota').to.equal(CONSTANTS.DEFAULT_ID_QUOTA)
@@ -192,7 +179,7 @@ describe('Test Org Controller', () => {
           // assert expected response
           expect(res).to.have.status(400)
           expect(res).to.have.property('body').and.to.be.a('object')
-          const errObj = error.cnaExists(existentOrg.short_name)
+          const errObj = error.orgExists(existentOrg.short_name)
           expect(res.body.error).to.equal(errObj.error)
           expect(res.body.message).to.equal(errObj.message)
           done()
@@ -210,12 +197,12 @@ describe('Test Org Controller', () => {
       // assert expected response
       expect(res).to.have.status(404)
       expect(res).to.have.property('body').and.to.be.a('object')
-      const errObj = error.cnaDneParam(nonExistentOrg.short_name)
+      const errObj = error.orgDneParam(nonExistentOrg.short_name)
       expect(res.body.error).to.equal(errObj.error)
       expect(res.body.message).to.equal(errObj.message)
     })
 
-    it('Org is not updated because CNA shortname already exists', (done) => {
+    it('Org is not updated because the shortname already exists', (done) => {
       // perform the request to the api
 
       chai.request(server)
@@ -254,7 +241,7 @@ describe('Test Org Controller', () => {
           expect(res).to.have.status(200)
           expect(res).to.have.property('body').and.to.be.a('object')
           expect(res.body).to.have.property('message').and.to.be.a('string')
-          expect(res.body.message).to.equal(testOrg.short_name + ' CNA was successfully updated.')
+          expect(res.body.message).to.equal(testOrg.short_name + ' organization was successfully updated.')
           expect(res.body.updated).to.have.nested.property('policies.id_quota').to.equal(1000)
           existentOrg.policies.id_quota = 1000
           done()
@@ -293,12 +280,12 @@ describe('Test Org Controller', () => {
       // assert expected response
       expect(res).to.have.status(404)
       expect(res).to.have.property('body').and.to.be.a('object')
-      const errObj = error.cnaDneParam(nonExistentOrg.short_name)
+      const errObj = error.orgDneParam(nonExistentOrg.short_name)
       expect(res.body.error).to.equal(errObj.error)
       expect(res.body.message).to.equal(errObj.message)
     })
 
-    it('Org exists', (done) => {
+    it('Org exists and requester is secretariat', (done) => {
       // perform the request to the api
 
       chai.request(server)
@@ -315,6 +302,43 @@ describe('Test Org Controller', () => {
           done()
         })
     })
+
+    it('Org exists and requester is a user of the same org', (done) => {
+      // perform the request to the api
+      chai.request(server)
+        .get(`/org-get-does-exist-user-same-org/${owningOrg.short_name}`)
+        .set(owningOrgHeader)
+        .end((err, res) => {
+          if (err) {
+            done(err)
+          }
+          // assert expected response
+          expect(res).to.have.status(200)
+          expect(res).to.have.property('body').and.to.be.a('object')
+          expect(res.body).to.have.property('short_name').and.to.equal(owningOrg.short_name)
+          done()
+        })
+    })
+
+    it('Org exists and requester is not a user of the same org or is secretariat', (done) => {
+      // perform the request to the api
+      chai.request(server)
+        .get(`/org-cant-get-user-not-secretariat-or-same-org/${owningOrg.short_name}`)
+        .set(orgHeader)
+        .end((err, res) => {
+          if (err) {
+            done(err)
+          }
+
+          // assert expected response
+          expect(res).to.have.status(403)
+          expect(res).to.have.property('body').and.to.be.a('object')
+          const errObj = error.notSameOrgOrSecretariat()
+          expect(res.body.error).to.equal(errObj.error)
+          expect(res.body.message).to.equal(errObj.message)
+          done()
+        })
+    })
   })
 
   context('Getting an org\'s ID quota', () => {
@@ -355,7 +379,7 @@ describe('Test Org Controller', () => {
         })
     })
 
-    it('Requestor is owning org', (done) => {
+    it('Requestor is a user of the same org', (done) => {
       chai.request(server)
         // perform the request to the api
         .get(`/org-id_quota-owning-org/${owningOrg.short_name}`)
@@ -375,7 +399,7 @@ describe('Test Org Controller', () => {
         })
     })
 
-    it('Requestor is not secretariat or owning org', (done) => {
+    it('Requestor is not secretariat or a user of the same org', (done) => {
       chai.request(server)
         // perform the request to the api
         .get(`/org-id_quota-not-owning-secretariat-org/${owningOrg.short_name}`)
@@ -388,7 +412,7 @@ describe('Test Org Controller', () => {
           // assert expected response
           expect(res).to.have.status(403)
           expect(res).to.have.property('body').and.to.be.a('object')
-          const errObj = error.notOwnerOrSecretariat()
+          const errObj = error.notSameOrgOrSecretariat()
           expect(res.body.error).to.equal(errObj.error)
           expect(res.body.message).to.equal(errObj.message)
           done()
@@ -407,7 +431,7 @@ describe('Test Org Controller', () => {
           // assert expected response
           expect(res).to.have.status(404)
           expect(res).to.have.property('body').and.to.be.a('object')
-          const errObj = error.cnaDneParam(nonExistentOrg.short_name)
+          const errObj = error.orgDneParam(nonExistentOrg.short_name)
           expect(res.body.error).to.equal(errObj.error)
           expect(res.body.message).to.equal(errObj.message)
           done()
@@ -480,7 +504,4 @@ describe('Test Org Controller', () => {
       expect(res.body).to.have.lengthOf(0)
     })
   })
-
-  after(async () => {
-  })
 })
diff --git a/test/unit-tests/org/userTest.js b/test/unit-tests/org/userTest.js
index e0a2f038..e126c299 100644
--- a/test/unit-tests/org/userTest.js
+++ b/test/unit-tests/org/userTest.js
@@ -30,7 +30,7 @@ describe('Test user functions in Org Controller', () => {
           // assert expected response
           expect(res).to.have.status(404)
           expect(res).to.have.property('body').and.to.be.a('object')
-          const errObj = error.cnaDneParam(nonExistentOrg.short_name)
+          const errObj = error.orgDneParam(nonExistentOrg.short_name)
           expect(res.body.error).to.equal(errObj.error)
           expect(res.body.message).to.equal(errObj.message)
           done()
@@ -221,7 +221,7 @@ describe('Test user functions in Org Controller', () => {
           // assert expected response
           expect(res).to.have.status(404)
           expect(res).to.have.property('body').and.to.be.a('object')
-          const errObj = error.cnaDneParam(nonExistentOrg.short_name)
+          const errObj = error.orgDneParam(nonExistentOrg.short_name)
           expect(res.body.error).to.equal(errObj.error)
           expect(res.body.message).to.equal(errObj.message)
           done()
@@ -250,7 +250,7 @@ describe('Test user functions in Org Controller', () => {
         })
     })
 
-    it('User is not updated because org query does not exist', (done) => {
+    it('User is not updated because the new shortname does not exist', (done) => {
       // perform the request to the api
       chai.request(server)
         .post(`/user-not-updated-user-doesnt-exist/${existentOrg.short_name}/${existentUser.username}?new_cna_shortname=${nonExistentOrg.short_name}`)
@@ -262,7 +262,7 @@ describe('Test user functions in Org Controller', () => {
           // assert expected response
           expect(res).to.have.status(404)
           expect(res).to.have.property('body').and.to.be.a('object')
-          const errObj = error.cnaDne(nonExistentOrg.short_name)
+          const errObj = error.orgDne(nonExistentOrg.short_name)
           expect(res.body.error).to.equal(errObj.error)
           expect(res.body.message).to.equal(errObj.message)
           done()
@@ -308,7 +308,7 @@ describe('Test user functions in Org Controller', () => {
           // assert expected response
           expect(res).to.have.status(404)
           expect(res).to.have.property('body').and.to.be.a('object')
-          const errObj = error.cnaDneParam(nonExistentOrg.short_name)
+          const errObj = error.orgDneParam(nonExistentOrg.short_name)
           expect(res.body.error).to.equal(errObj.error)
           expect(res.body.message).to.equal(errObj.message)
           done()
@@ -367,7 +367,7 @@ describe('Test user functions in Org Controller', () => {
           // assert expected response
           expect(res).to.have.status(404)
           expect(res).to.have.property('body').and.to.be.a('object')
-          const errObj = error.cnaDneParam(nonExistentOrg.short_name)
+          const errObj = error.orgDneParam(nonExistentOrg.short_name)
           expect(res.body.error).to.equal(errObj.error)
           expect(res.body.message).to.equal(errObj.message)
           done()
@@ -440,11 +440,10 @@ describe('Test user functions in Org Controller', () => {
           if (err) {
             done(err)
           }
-
           // assert expected response
           expect(res).to.have.status(403)
           expect(res).to.have.property('body').and.to.be.a('object')
-          const errObj = error.notOwnerOrSecretariat()
+          const errObj = error.notSameOrgOrSecretariat()
           expect(res.body.error).to.equal(errObj.error)
           expect(res.body.message).to.equal(errObj.message)
           done()