Repository: CVEProject/cve-services
Pull request #343 (2021-03-22 16:57:39)

Secretariat can get a CVE Record by CVE ID
This pull request addresses issue #341 and separates `cve` unit tests by endpoint and positive/negative tests to improve readability and maintenance.



Patch:
diff --git a/docs/openapi.yml b/docs/openapi.yml
index 97ee3c63..e3d44a43 100644
--- a/docs/openapi.yml
+++ b/docs/openapi.yml
@@ -288,8 +288,34 @@ paths:
   /cve/{cve-id}:
     parameters:
       - "$ref": "#/components/parameters/cve-id-path"
+    get:
+      summary: Retrieves a CVE Record by ID, only allowed by the Secretariat.
+      operationId: getCVERecordById
+      parameters:
+        - "$ref": "#/components/parameters/api-entity-header"
+        - "$ref": "#/components/parameters/api-secret-header"
+        - "$ref": "#/components/parameters/api-user-header"
+        - "$ref": "#/components/parameters/cve-id-path"
+      responses:
+        200:
+          description: The requested CVE Record is returned.
+          content:
+            application/json:
+            schema: 
+              oneOf:
+                $ref: 'https://github.com/CVEProject/cve-schema/blob/master/schema/v4.0/CVE_JSON_4.0_min_public.schema'
+                $ref: 'https://github.com/CVEProject/cve-schema/blob/master/schema/v4.0/CVE_JSON_4.0_min_reject.schema'
+        400:
+          description: Bad Request
+        403:
+          description: Forbidden
+        404:
+          description: Not Found
+        500:
+          description: Internal Server Error
     post:
-      summary: Creates a CVE ID record by ID, only allowed by the Secretariat
+      summary: Creates a CVE Record by ID, only allowed by the Secretariat.
+      operationId: createCVERecordById
       parameters:
         - "$ref": "#/components/parameters/api-entity-header"
         - "$ref": "#/components/parameters/api-secret-header"
@@ -315,7 +341,8 @@ paths:
         500:
           description: Internal Server Error
     put:
-      summary: Updates a CVE ID record by ID, only allowed by the Secretariat
+      summary: Updates a CVE Record by ID, only allowed by the Secretariat.
+      operationId: updateCVERecordById
       parameters:
         - "$ref": "#/components/parameters/api-entity-header"
         - "$ref": "#/components/parameters/api-secret-header"
diff --git a/src/controller/cve.controller/cve.controller.js b/src/controller/cve.controller/cve.controller.js
index 6328a531..90b70d89 100644
--- a/src/controller/cve.controller/cve.controller.js
+++ b/src/controller/cve.controller/cve.controller.js
@@ -4,6 +4,22 @@ const errors = require('./error')
 const error = new errors.CveControllerError()
 const CONSTANTS = require('../../constants')
 
+async function getCve (req, res, next) {
+  try {
+    const id = req.ctx.params.id
+    const cveRepo = req.ctx.repositories.getCveRepository()
+    const result = await cveRepo.findOneByCveId(id)
+
+    if (!result) {
+      return res.status(404).json(error.cveRecordDne())
+    }
+
+    return res.status(200).json(result.cve)
+  } catch (err) {
+    next(err)
+  }
+}
+
 // Creates a new CVE only if it does not exists for the specified CVE ID in the request body. If it exists, it does not update the CVE.
 async function submitCve (req, res, next) {
   try {
@@ -130,6 +146,7 @@ async function updateCve (req, res, next) {
 }
 
 module.exports = {
+  CVE_GET_SINGLE: getCve,
   CVE_SUBMIT: submitCve,
   CVE_UPDATE_SINGLE: updateCve
 }
diff --git a/src/controller/cve.controller/index.js b/src/controller/cve.controller/index.js
index 4cb15053..abc8048a 100644
--- a/src/controller/cve.controller/index.js
+++ b/src/controller/cve.controller/index.js
@@ -5,6 +5,16 @@ const controller = require('./cve.controller')
 const { param } = require('express-validator')
 const { parsePostParams, parseError } = require('./cve.middleware')
 
+router.get('/cve/:id',
+  mw.onlySecretariat,
+  mw.validateUser,
+  param(['id']).isString().matches(/^CVE-[0-9]{4}-[0-9]{4,}$/i),
+  parseError,
+  parsePostParams,
+  controller.CVE_GET_SINGLE)
+
+// router.get('/cve', mw.validateUser, controller.CVE_LIST_ALL)
+
 router.post('/cve/:id',
   mw.onlySecretariat,
   mw.validateUser,
@@ -14,8 +24,6 @@ router.post('/cve/:id',
   parsePostParams,
   controller.CVE_SUBMIT)
 
-// router.get('/cve', mw.validateUser, controller.CVE_LIST_ALL)
-// router.get('/cve/:id', mw.validateUser, controller.CVE_SINGLE)
 router.put('/cve/:id',
   mw.onlySecretariat,
   mw.validateUser,


Test patch:
diff --git a/test/unit-tests/cve/cveCreateTest.js b/test/unit-tests/cve/cveCreateTest.js
new file mode 100644
index 00000000..777f1ed4
--- /dev/null
+++ b/test/unit-tests/cve/cveCreateTest.js
@@ -0,0 +1,288 @@
+const server = require('../../../test-utils/index')
+const chai = require('chai')
+const expect = chai.expect
+chai.use(require('chai-http'))
+
+const cveFixtures = require('./mockObjects.cve')
+const cveController = require('../../../src/controller/cve.controller/cve.controller')
+const cveParams = require('../../../src/controller/cve.controller/cve.middleware')
+const CONSTANTS = require('../../../src/constants')
+const nonExistentCveId = 'CVE-2020-1425'
+const cveIdPublic4 = 'CVE-2017-5832'
+const cveIdReserved4 = 'CVE-2017-5833'
+const cveIdAvailable4 = 'CVE-2017-5834'
+const cveIdReject4 = 'CVE-2017-5835'
+const cvePublicPass4 = require('../../schemas/4.0/' + cveIdPublic4 + '_public.json')
+const cveReservedPass4 = require('../../schemas/4.0/' + cveIdReserved4 + '_reserved.json')
+const cveRejectPass4 = require('../../schemas/4.0/' + cveIdReject4 + '_reject.json')
+
+const errors = require('../../../src/controller/cve.controller/error')
+const error = new errors.CveControllerError()
+
+class MyOrg {
+  async getOrgUUID () {
+    return null
+  }
+}
+
+class MyUser {
+  async getUserUUID () {
+    return null
+  }
+}
+
+class MyCveIdNegativeTests {
+  async findOneByCveId (id) {
+    if (id === cveIdAvailable4) {
+      return cveFixtures.cveAvailable4
+    } else if (id === cveIdPublic4) {
+      return cveFixtures.cvePublic4
+    }
+
+    return null
+  }
+
+  async updateByCveId () {
+    return null
+  }
+}
+
+class MyCveNegativeTests {
+  async findOneByCveId (id) {
+    if (id === cveIdPublic4) {
+      return cvePublicPass4
+    }
+
+    return null
+  }
+
+  async updateByCveId () {
+    return null
+  }
+}
+
+class MyCveIdPositiveTests {
+  constructor () {
+    this.publicDoc = cveFixtures.cvePublic4
+    this.rejectDoc = cveFixtures.cveReject4
+  }
+
+  getCveIdPublic () {
+    return this.publicDoc
+  }
+
+  getCveIdReject () {
+    return this.rejectDoc
+  }
+
+  async findOneByCveId (id) {
+    if (id === cveIdPublic4) {
+      return cveFixtures.cvePublic4
+    }
+
+    return cveFixtures.cveReject4
+  }
+
+  async updateByCveId (id, cveId) {
+    if (id === cveIdPublic4) {
+      this.publicDoc.state = cveId.state
+    } else {
+      this.rejectDoc.state = cveId.state
+    }
+
+    return null
+  }
+}
+
+class MyCvePositiveTests {
+  async findOneByCveId () {
+    return null
+  }
+
+  async updateByCveId () {
+    return null
+  }
+}
+
+server.route('/cve-create-record-negative-tests/:id')
+  .post((req, res, next) => {
+    const factory = {
+      getCveRepository: () => { return new MyCveNegativeTests() },
+      getCveIdRepository: () => { return new MyCveIdNegativeTests() },
+      getOrgRepository: () => { return new MyOrg() },
+      getUserRepository: () => { return new MyUser() }
+    }
+    req.ctx.repositories = factory
+    next()
+  }, cveParams.parsePostParams, cveController.CVE_SUBMIT)
+
+server.route('/cve-create-record-positive-tests/:id')
+  .post((req, res, next) => {
+    const factory = {
+      getCveRepository: () => { return new MyCvePositiveTests() },
+      getCveIdRepository: () => { return new MyCveIdPositiveTests() },
+      getOrgRepository: () => { return new MyOrg() },
+      getUserRepository: () => { return new MyUser() }
+    }
+    req.ctx.repositories = factory
+    next()
+  }, cveParams.parsePostParams, cveController.CVE_SUBMIT)
+
+describe('Testing the POST /cve/:id endpoint in Cve Controller', () => {
+  context('Negative Tests', () => {
+    it('should return 400 bad request because the cve id in the parameter does not match the cve id in the JSON body', (done) => {
+      chai.request(server)
+        .post(`/cve-create-record-negative-tests/${nonExistentCveId}`)
+        .set(cveFixtures.secretariatHeader)
+        .send(cvePublicPass4)
+        .end((err, res) => {
+          if (err) {
+            done(err)
+          }
+
+          expect(res).to.have.status(400)
+          expect(res).to.have.property('body').and.to.be.a('object')
+          const errObj = error.cveIdMismatch()
+          expect(res.body.error).to.equal(errObj.error)
+          expect(res.body.message).to.equal(errObj.message)
+          done()
+        })
+    })
+
+    it('should return 400 bad request because the cve record cannot be created in the RESERVED state', (done) => {
+      chai.request(server)
+        .post(`/cve-create-record-negative-tests/${cveIdReserved4}`)
+        .set(cveFixtures.secretariatHeader)
+        .send(cveReservedPass4)
+        .end((err, res) => {
+          if (err) {
+            done(err)
+          }
+
+          expect(res).to.have.status(400)
+          expect(res).to.have.property('body').and.to.be.a('object')
+          const errObj = error.cveCreateUnsupportedState(CONSTANTS.CVE_STATES.RESERVED)
+          expect(res.body.error).to.equal(errObj.error)
+          expect(res.body.message).to.equal(errObj.message)
+          done()
+        })
+    })
+
+    it('should return 403 forbidden because the cve id does not exist', (done) => {
+      const nonExistentCve = JSON.parse(JSON.stringify(cvePublicPass4))
+      nonExistentCve.CVE_data_meta.ID = nonExistentCveId
+
+      chai.request(server)
+        .post(`/cve-create-record-negative-tests/${nonExistentCveId}`)
+        .set(cveFixtures.secretariatHeader)
+        .send(nonExistentCve)
+        .end((err, res) => {
+          if (err) {
+            done(err)
+          }
+
+          expect(res).to.have.status(403)
+          expect(res).to.have.property('body').and.to.be.a('object')
+          const errObj = error.cveDne()
+          expect(res.body.error).to.equal(errObj.error)
+          expect(res.body.message).to.equal(errObj.message)
+          done()
+        })
+    })
+
+    it('should return 403 forbidden because the cve id has state AVAILABLE', (done) => {
+      const testCve = JSON.parse(JSON.stringify(cvePublicPass4))
+      testCve.CVE_data_meta.ID = cveIdAvailable4
+
+      chai.request(server)
+        .post(`/cve-create-record-negative-tests/${cveIdAvailable4}`)
+        .set(cveFixtures.secretariatHeader)
+        .send(testCve)
+        .end((err, res) => {
+          if (err) {
+            done(err)
+          }
+
+          expect(res).to.have.status(403)
+          expect(res).to.have.property('body').and.to.be.a('object')
+          const errObj = error.cveDne()
+          expect(res.body.error).to.equal(errObj.error)
+          expect(res.body.message).to.equal(errObj.message)
+          done()
+        })
+    })
+
+    it('should return 400 bad request because the cve record already exist', (done) => {
+      chai.request(server)
+        .post(`/cve-create-record-negative-tests/${cveIdPublic4}`)
+        .set(cveFixtures.secretariatHeader)
+        .send(cvePublicPass4)
+        .end((err, res) => {
+          if (err) {
+            done(err)
+          }
+
+          expect(res).to.have.status(400)
+          expect(res).to.have.property('body').and.to.be.a('object')
+          const errObj = error.cveRecordExists()
+          expect(res.body.error).to.equal(errObj.error)
+          expect(res.body.message).to.equal(errObj.message)
+          done()
+        })
+    })
+  })
+
+  context('Positive Tests', () => {
+    it('State PUBLIC: should return the cve record because the cve record was created', (done) => {
+      const cveIdTestRepo = new MyCveIdPositiveTests()
+      const doc = cveIdTestRepo.getCveIdPublic() // get internal state of cveId document
+      expect(doc).to.have.property('cve_id').and.to.equal(cveIdPublic4)
+      expect(doc).to.have.property('state').and.to.equal(CONSTANTS.CVE_STATES.RESERVED)
+
+      chai.request(server)
+        .post(`/cve-create-record-positive-tests/${cveIdPublic4}`)
+        .set(cveFixtures.secretariatHeader)
+        .send(cvePublicPass4)
+        .end((err, res) => {
+          if (err) {
+            done(err)
+          }
+
+          expect(res).to.have.status(200)
+          expect(res).to.have.property('body').and.to.be.a('object')
+          expect(res.body).to.have.property('created').and.to.be.a('object')
+          expect(res.body.created).to.have.nested.property('CVE_data_meta.ID').and.to.equal(cveIdPublic4)
+          expect(res.body.created).to.have.nested.property('CVE_data_meta.STATE').and.to.equal(CONSTANTS.CVE_STATES.PUBLIC)
+          expect(doc).to.have.property('cve_id').and.to.equal(cveIdPublic4)
+          expect(doc).to.have.property('state').and.to.equal(CONSTANTS.CVE_STATES.PUBLIC)
+          done()
+        })
+    })
+
+    it('STATE REJECT: should return the cve record because the cve record was created', (done) => {
+      const cveIdTestRepo = new MyCveIdPositiveTests()
+      const doc = cveIdTestRepo.getCveIdReject() // get internal state of cveId document
+      expect(doc).to.have.property('cve_id').and.to.equal(cveIdReject4)
+      expect(doc).to.have.property('state').and.to.equal(CONSTANTS.CVE_STATES.RESERVED)
+
+      chai.request(server)
+        .post(`/cve-create-record-positive-tests/${cveIdReject4}`)
+        .set(cveFixtures.secretariatHeader)
+        .send(cveRejectPass4)
+        .end((err, res) => {
+          if (err) {
+            done(err)
+          }
+
+          expect(res).to.have.status(200)
+          expect(res).to.have.property('body').and.to.be.a('object')
+          expect(res.body).to.have.property('created').and.to.be.a('object')
+          expect(res.body.created).to.have.nested.property('CVE_data_meta.ID').and.to.equal(cveIdReject4)
+          expect(res.body.created).to.have.nested.property('CVE_data_meta.STATE').and.to.equal(CONSTANTS.CVE_STATES.REJECT)
+          expect(doc).to.have.property('cve_id').and.to.equal(cveIdReject4)
+          expect(doc).to.have.property('state').and.to.equal(CONSTANTS.CVE_STATES.REJECT)
+          done()
+        })
+    })
+  })
+})
diff --git a/test/unit-tests/cve/cveGetSingleTest.js b/test/unit-tests/cve/cveGetSingleTest.js
new file mode 100644
index 00000000..8aaf4db7
--- /dev/null
+++ b/test/unit-tests/cve/cveGetSingleTest.js
@@ -0,0 +1,107 @@
+const server = require('../../../test-utils/index')
+const chai = require('chai')
+const expect = chai.expect
+chai.use(require('chai-http'))
+
+const cveFixtures = require('./mockObjects.cve')
+const cveController = require('../../../src/controller/cve.controller/cve.controller')
+const cveParams = require('../../../src/controller/cve.controller/cve.middleware')
+const CONSTANTS = require('../../../src/constants')
+const nonExistentCveRecord = 'CVE-2020-1425'
+const cveIdPublic4 = 'CVE-2017-5832'
+const cveIdReject4 = 'CVE-2017-5835'
+
+const errors = require('../../../src/controller/cve.controller/error')
+const error = new errors.CveControllerError()
+
+class MyCveNegativeTests {
+  async findOneByCveId () {
+    return null
+  }
+}
+
+class MyCvePositiveTests {
+  async findOneByCveId (id) {
+    if (id === cveIdPublic4) {
+      return cveFixtures.cveRecordPublic4
+    } else if (id === cveIdReject4) {
+      return cveFixtures.cveRecordReject4
+    }
+  }
+}
+
+server.route('/cve-get-record-negative-tests/:id')
+  .get((req, res, next) => {
+    const factory = {
+      getCveRepository: () => { return new MyCveNegativeTests() }
+    }
+    req.ctx.repositories = factory
+    next()
+  }, cveParams.parsePostParams, cveController.CVE_GET_SINGLE)
+
+server.route('/cve-get-record-positive-tests/:id')
+  .get((req, res, next) => {
+    const factory = {
+      getCveRepository: () => { return new MyCvePositiveTests() }
+    }
+    req.ctx.repositories = factory
+    next()
+  }, cveParams.parsePostParams, cveController.CVE_GET_SINGLE)
+
+describe('Testing the GET /cve/:id endpoint in Cve Controller', () => {
+  context('Negative Tests', () => {
+    it('CVE_RECORD_DNE returned: The cve record does not exist for the provided cve id', (done) => {
+      chai.request(server)
+        .get(`/cve-get-record-negative-tests/${nonExistentCveRecord}`)
+        .set(cveFixtures.secretariatHeader)
+        .end((err, res) => {
+          if (err) {
+            done(err)
+          }
+
+          expect(res).to.have.status(404)
+          expect(res).to.have.property('body').and.to.be.a('object')
+          const errObj = error.cveRecordDne()
+          expect(res.body.error).to.equal(errObj.error)
+          expect(res.body.message).to.equal(errObj.message)
+          done()
+        })
+    })
+  })
+
+  context('Positive Tests', () => {
+    it('JSON schema v4.0 returned: The secretariat gets a cve record in PUBLIC state', (done) => {
+      chai.request(server)
+        .get(`/cve-get-record-positive-tests/${cveIdPublic4}`)
+        .set(cveFixtures.secretariatHeader)
+        .end((err, res) => {
+          if (err) {
+            done(err)
+          }
+
+          expect(res).to.have.status(200)
+          expect(res).to.have.property('body').and.to.be.a('object')
+          expect(res.body).to.have.nested.property('CVE_data_meta.ID').and.to.equal(cveIdPublic4)
+          expect(res.body).to.have.nested.property('CVE_data_meta.STATE').and.to.equal(CONSTANTS.CVE_STATES.PUBLIC)
+          done()
+        })
+    })
+
+    it('JSON schema v4.0 returned: The secretariat gets a cve record in REJECT state', (done) => {
+      chai.request(server)
+        .get(`/cve-get-record-positive-tests/${cveIdReject4}`)
+        .set(cveFixtures.secretariatHeader)
+        .end((err, res) => {
+          if (err) {
+            done(err)
+          }
+
+          expect(res).to.have.status(200)
+          expect(res).to.have.property('body').and.to.be.a('object')
+          expect(res.body).to.have.nested.property('CVE_data_meta.ID').and.to.equal(cveIdReject4)
+          expect(res.body).to.have.nested.property('CVE_data_meta.STATE').and.to.equal(CONSTANTS.CVE_STATES.REJECT)
+          done()
+        })
+    })
+  })
+})
diff --git a/test/unit-tests/cve/cveTest.js b/test/unit-tests/cve/cveUpdateTest.js
similarity index 56%
rename from test/unit-tests/cve/cveTest.js
rename to test/unit-tests/cve/cveUpdateTest.js
index cdd761a2..d5a908cc 100644
--- a/test/unit-tests/cve/cveTest.js
+++ b/test/unit-tests/cve/cveUpdateTest.js
@@ -10,7 +10,6 @@ const CONSTANTS = require('../../../src/constants')
 const nonExistentCveId = 'CVE-2020-1425'
 const cveIdPublic4 = 'CVE-2017-5832'
 const cveIdReserved4 = 'CVE-2017-5833'
-const cveIdAvailable4 = 'CVE-2017-5834'
 const cveIdReject4 = 'CVE-2017-5835'
 const cvePublicPass4 = require('../../schemas/4.0/' + cveIdPublic4 + '_public.json')
 const cveReservedPass4 = require('../../schemas/4.0/' + cveIdReserved4 + '_reserved.json')
@@ -19,275 +18,9 @@ const cveRejectPass4 = require('../../schemas/4.0/' + cveIdReject4 + '_reject.js
 const errors = require('../../../src/controller/cve.controller/error')
 const error = new errors.CveControllerError()
 
-class MyOrg {
-  async getOrgUUID () {
-    return null
-  }
-}
-
-class MyUser {
-  async getUserUUID () {
-    return null
-  }
-}
-
-class MyCveIdNegativeTests {
-  async findOneByCveId (id) {
-    if (id === cveIdAvailable4) {
-      return cveFixtures.cveAvailable4
-    } else if (id === cveIdPublic4) {
-      return cveFixtures.cvePublic4
-    }
-
-    return null
-  }
-
-  async updateByCveId () {
-    return null
-  }
-}
-
-class MyCveNegativeTests {
-  async findOneByCveId (id) {
-    if (id === cveIdPublic4) {
-      return cvePublicPass4
-    }
-
-    return null
-  }
-
-  async updateByCveId () {
-    return null
-  }
-}
-
-class MyCveIdPositiveTests {
-  constructor () {
-    this.publicDoc = cveFixtures.cvePublic4
-    this.rejectDoc = cveFixtures.cveReject4
-  }
-
-  getCveIdPublic () {
-    return this.publicDoc
-  }
-
-  getCveIdReject () {
-    return this.rejectDoc
-  }
-
-  async findOneByCveId (id) {
-    if (id === cveIdPublic4) {
-      return cveFixtures.cvePublic4
-    }
-
-    return cveFixtures.cveReject4
-  }
-
-  async updateByCveId (id, cveId) {
-    if (id === cveIdPublic4) {
-      this.publicDoc.state = cveId.state
-    } else {
-      this.rejectDoc.state = cveId.state
-    }
-
-    return null
-  }
-}
-
-class MyCvePositiveTests {
-  async findOneByCveId () {
-    return null
-  }
-
-  async updateByCveId () {
-    return null
-  }
-}
-
-server.route('/cve-create-record-negative-tests/:id')
-  .post((req, res, next) => {
-    const factory = {
-      getCveRepository: () => { return new MyCveNegativeTests() },
-      getCveIdRepository: () => { return new MyCveIdNegativeTests() },
-      getOrgRepository: () => { return new MyOrg() },
-      getUserRepository: () => { return new MyUser() }
-    }
-    req.ctx.repositories = factory
-    next()
-  }, cveParams.parsePostParams, cveController.CVE_SUBMIT)
-
-server.route('/cve-create-record-positive-tests/:id')
-  .post((req, res, next) => {
-    const factory = {
-      getCveRepository: () => { return new MyCvePositiveTests() },
-      getCveIdRepository: () => { return new MyCveIdPositiveTests() },
-      getOrgRepository: () => { return new MyOrg() },
-      getUserRepository: () => { return new MyUser() }
-    }
-    req.ctx.repositories = factory
-    next()
-  }, cveParams.parsePostParams, cveController.CVE_SUBMIT)
-
-describe('Testing the POST /cve/:id endpoint in Cve Controller', () => {
+describe('Testing the PUT /cve/:id endpoint in Cve Controller', () => {
   context('Negative Tests', () => {
-    it('should return 400 bad request because the cve id in the parameter does not match the cve id in the JSON body', (done) => {
-      chai.request(server)
-        .post(`/cve-create-record-negative-tests/${nonExistentCveId}`)
-        .set(cveFixtures.secretariatHeader)
-        .send(cvePublicPass4)
-        .end((err, res) => {
-          if (err) {
-            done(err)
-          }
-
-          expect(res).to.have.status(400)
-          expect(res).to.have.property('body').and.to.be.a('object')
-          const errObj = error.cveIdMismatch()
-          expect(res.body.error).to.equal(errObj.error)
-          expect(res.body.message).to.equal(errObj.message)
-          done()
-        })
-    })
-
-    it('should return 400 bad request because the cve record cannot be created in the RESERVED state', (done) => {
-      chai.request(server)
-        .post(`/cve-create-record-negative-tests/${cveIdReserved4}`)
-        .set(cveFixtures.secretariatHeader)
-        .send(cveReservedPass4)
-        .end((err, res) => {
-          if (err) {
-            done(err)
-          }
-
-          expect(res).to.have.status(400)
-          expect(res).to.have.property('body').and.to.be.a('object')
-          const errObj = error.cveCreateUnsupportedState(CONSTANTS.CVE_STATES.RESERVED)
-          expect(res.body.error).to.equal(errObj.error)
-          expect(res.body.message).to.equal(errObj.message)
-          done()
-        })
-    })
-
-    it('should return 403 forbidden because the cve id does not exist', (done) => {
-      const nonExistentCve = JSON.parse(JSON.stringify(cvePublicPass4))
-      nonExistentCve.CVE_data_meta.ID = nonExistentCveId
-
-      chai.request(server)
-        .post(`/cve-create-record-negative-tests/${nonExistentCveId}`)
-        .set(cveFixtures.secretariatHeader)
-        .send(nonExistentCve)
-        .end((err, res) => {
-          if (err) {
-            done(err)
-          }
-
-          expect(res).to.have.status(403)
-          expect(res).to.have.property('body').and.to.be.a('object')
-          const errObj = error.cveDne()
-          expect(res.body.error).to.equal(errObj.error)
-          expect(res.body.message).to.equal(errObj.message)
-          done()
-        })
-    })
-
-    it('should return 403 forbidden because the cve id has state AVAILABLE', (done) => {
-      const testCve = JSON.parse(JSON.stringify(cvePublicPass4))
-      testCve.CVE_data_meta.ID = cveIdAvailable4
-
-      chai.request(server)
-        .post(`/cve-create-record-negative-tests/${cveIdAvailable4}`)
-        .set(cveFixtures.secretariatHeader)
-        .send(testCve)
-        .end((err, res) => {
-          if (err) {
-            done(err)
-          }
-
-          expect(res).to.have.status(403)
-          expect(res).to.have.property('body').and.to.be.a('object')
-          const errObj = error.cveDne()
-          expect(res.body.error).to.equal(errObj.error)
-          expect(res.body.message).to.equal(errObj.message)
-          done()
-        })
-    })
-
-    it('should return 400 bad request because the cve record already exist', (done) => {
-      chai.request(server)
-        .post(`/cve-create-record-negative-tests/${cveIdPublic4}`)
-        .set(cveFixtures.secretariatHeader)
-        .send(cvePublicPass4)
-        .end((err, res) => {
-          if (err) {
-            done(err)
-          }
-
-          expect(res).to.have.status(400)
-          expect(res).to.have.property('body').and.to.be.a('object')
-          const errObj = error.cveRecordExists()
-          expect(res.body.error).to.equal(errObj.error)
-          expect(res.body.message).to.equal(errObj.message)
-          done()
-        })
-    })
-  })
-
-  context('Positive Tests', () => {
-    it('State PUBLIC: should return the cve record because the cve record was created', (done) => {
-      const cveIdTestRepo = new MyCveIdPositiveTests()
-      const doc = cveIdTestRepo.getCveIdPublic() // get internal state of cveId document
-      expect(doc).to.have.property('cve_id').and.to.equal(cveIdPublic4)
-      expect(doc).to.have.property('state').and.to.equal(CONSTANTS.CVE_STATES.RESERVED)
-
-      chai.request(server)
-        .post(`/cve-create-record-positive-tests/${cveIdPublic4}`)
-        .set(cveFixtures.secretariatHeader)
-        .send(cvePublicPass4)
-        .end((err, res) => {
-          if (err) {
-            done(err)
-          }
-
-          expect(res).to.have.status(200)
-          expect(res).to.have.property('body').and.to.be.a('object')
-          expect(res.body).to.have.property('created').and.to.be.a('object')
-          expect(res.body.created).to.have.nested.property('CVE_data_meta.ID').and.to.equal(cveIdPublic4)
-          expect(res.body.created).to.have.nested.property('CVE_data_meta.STATE').and.to.equal(CONSTANTS.CVE_STATES.PUBLIC)
-          expect(doc).to.have.property('cve_id').and.to.equal(cveIdPublic4)
-          expect(doc).to.have.property('state').and.to.equal(CONSTANTS.CVE_STATES.PUBLIC)
-          done()
-        })
-    })
-
-    it('STATE REJECT: should return the cve record because the cve record was created', (done) => {
-      const cveIdTestRepo = new MyCveIdPositiveTests()
-      const doc = cveIdTestRepo.getCveIdReject() // get internal state of cveId document
-      expect(doc).to.have.property('cve_id').and.to.equal(cveIdReject4)
-      expect(doc).to.have.property('state').and.to.equal(CONSTANTS.CVE_STATES.RESERVED)
-
-      chai.request(server)
-        .post(`/cve-create-record-positive-tests/${cveIdReject4}`)
-        .set(cveFixtures.secretariatHeader)
-        .send(cveRejectPass4)
-        .end((err, res) => {
-          if (err) {
-            done(err)
-          }
-
-          expect(res).to.have.status(200)
-          expect(res).to.have.property('body').and.to.be.a('object')
-          expect(res.body).to.have.property('created').and.to.be.a('object')
-          expect(res.body.created).to.have.nested.property('CVE_data_meta.ID').and.to.equal(cveIdReject4)
-          expect(res.body.created).to.have.nested.property('CVE_data_meta.STATE').and.to.equal(CONSTANTS.CVE_STATES.REJECT)
-          expect(doc).to.have.property('cve_id').and.to.equal(cveIdReject4)
-          expect(doc).to.have.property('state').and.to.equal(CONSTANTS.CVE_STATES.REJECT)
-          done()
-        })
-    })
-  })
-
-  context('Update CVE PUT Endpoint', () => {
-    it('Update CVE record when requestor is secretariat', (done) => {
+    it('CVE record not updated when cve id doesnt match record', (done) => {
       class OrgRepo {
         async getOrgUUID () {
           return null
@@ -295,16 +28,12 @@ describe('Testing the POST /cve/:id endpoint in Cve Controller', () => {
       }
       class CveRepo {
         async updateByCveId (cveId, newCve) {
-          expect(cveId).to.equal(cveIdPublic4)
-          expect(newCve).to.have.nested.property('cve.CVE_data_meta.STATE').and.to.equal(CONSTANTS.CVE_STATES.PUBLIC)
-          return { n: 1 }
+          return null
         }
       }
       class CveIdRepo {
         async updateByCveId (cveId, newCve) {
-          expect(cveId).to.equal(cveIdPublic4)
-          expect(newCve).to.have.property('state')
-          return { n: 1 }
+          return null
         }
       }
       class UserRepo {
@@ -312,7 +41,7 @@ describe('Testing the POST /cve/:id endpoint in Cve Controller', () => {
           return null
         }
       }
-      server.route('/cve-update-record/:id')
+      server.route('/cve-not-updated-id-mismatch/:id')
         .put((req, res, next) => {
           const factory = {
             getCveIdRepository: () => { return new CveIdRepo() },
@@ -325,7 +54,7 @@ describe('Testing the POST /cve/:id endpoint in Cve Controller', () => {
         }, cveParams.parsePostParams, cveController.CVE_UPDATE_SINGLE)
 
       chai.request(server)
-        .put(`/cve-update-record/${cveIdPublic4}`)
+        .put(`/cve-not-updated-id-mismatch/${nonExistentCveId}`)
         .set(cveFixtures.secretariatHeader)
         .send(cvePublicPass4)
         .end((err, res) => {
@@ -333,16 +62,18 @@ describe('Testing the POST /cve/:id endpoint in Cve Controller', () => {
             done(err)
           }
 
-          expect(res).to.have.status(200)
+          expect(res).to.have.status(400)
           expect(res).to.have.property('body').and.to.be.a('object')
-          expect(res.body).to.have.property('updated').and.to.be.a('object')
-          expect(res.body.updated).to.have.nested.property('CVE_data_meta.ID').and.to.equal(cveIdPublic4)
-          expect(res.body.updated).to.have.nested.property('CVE_data_meta.STATE').and.to.equal(CONSTANTS.CVE_STATES.PUBLIC)
+          const errObj = error.cveIdMismatch()
+          expect(res.body.error).to.equal(errObj.error)
+          expect(res.body.message).to.equal(errObj.message)
           done()
         })
     })
 
-    it('Update CVE record when requestor is secretariat and valid REJECT JSON', (done) => {
+    it('CVE record not updated when cve record doesnt exist', (done) => {
+      const nonExistentCve = JSON.parse(JSON.stringify(cvePublicPass4))
+      nonExistentCve.CVE_data_meta.ID = nonExistentCveId
       class OrgRepo {
         async getOrgUUID () {
           return null
@@ -350,7 +81,7 @@ describe('Testing the POST /cve/:id endpoint in Cve Controller', () => {
       }
       class CveRepo {
         async updateByCveId (cveId, newCve) {
-          return { n: 1 }
+          return { n: 0 }
         }
       }
       class CveIdRepo {
@@ -363,7 +94,7 @@ describe('Testing the POST /cve/:id endpoint in Cve Controller', () => {
           return null
         }
       }
-      server.route('/cve-update-record-reject/:id')
+      server.route('/cve-not-updated-cve-dne/:id')
         .put((req, res, next) => {
           const factory = {
             getCveIdRepository: () => { return new CveIdRepo() },
@@ -376,24 +107,26 @@ describe('Testing the POST /cve/:id endpoint in Cve Controller', () => {
         }, cveParams.parsePostParams, cveController.CVE_UPDATE_SINGLE)
 
       chai.request(server)
-        .put(`/cve-update-record-reject/${cveIdReject4}`)
+        .put(`/cve-not-updated-cve-dne/${nonExistentCveId}`)
         .set(cveFixtures.secretariatHeader)
-        .send(cveRejectPass4)
+        .send(nonExistentCve)
         .end((err, res) => {
           if (err) {
             done(err)
           }
 
-          expect(res).to.have.status(200)
+          expect(res).to.have.status(403)
           expect(res).to.have.property('body').and.to.be.a('object')
-          expect(res.body).to.have.property('updated').and.to.be.a('object')
-          expect(res.body.updated).to.have.nested.property('CVE_data_meta.ID').and.to.equal(cveIdReject4)
-          expect(res.body.updated).to.have.nested.property('CVE_data_meta.STATE').and.to.equal(CONSTANTS.CVE_STATES.REJECT)
+          const errObj = error.cveRecordDne()
+          expect(res.body.error).to.equal(errObj.error)
+          expect(res.body.message).to.equal(errObj.message)
           done()
         })
     })
 
-    it('CVE record not updated when cve id doesnt match record', (done) => {
+    it('CVE record not updated when cve id doesnt exist', (done) => {
+      const nonExistentCve = JSON.parse(JSON.stringify(cvePublicPass4))
+      nonExistentCve.CVE_data_meta.ID = nonExistentCveId
       class OrgRepo {
         async getOrgUUID () {
           return null
@@ -406,7 +139,7 @@ describe('Testing the POST /cve/:id endpoint in Cve Controller', () => {
       }
       class CveIdRepo {
         async updateByCveId (cveId, newCve) {
-          return null
+          return { n: 0 }
         }
       }
       class UserRepo {
@@ -414,7 +147,7 @@ describe('Testing the POST /cve/:id endpoint in Cve Controller', () => {
           return null
         }
       }
-      server.route('/cve-not-updated-id-mismatch/:id')
+      server.route('/cve-not-updated-cve-id-dne/:id')
         .put((req, res, next) => {
           const factory = {
             getCveIdRepository: () => { return new CveIdRepo() },
@@ -427,26 +160,24 @@ describe('Testing the POST /cve/:id endpoint in Cve Controller', () => {
         }, cveParams.parsePostParams, cveController.CVE_UPDATE_SINGLE)
 
       chai.request(server)
-        .put(`/cve-not-updated-id-mismatch/${nonExistentCveId}`)
+        .put(`/cve-not-updated-cve-id-dne/${nonExistentCveId}`)
         .set(cveFixtures.secretariatHeader)
-        .send(cvePublicPass4)
+        .send(nonExistentCve)
         .end((err, res) => {
           if (err) {
             done(err)
           }
 
-          expect(res).to.have.status(400)
+          expect(res).to.have.status(403)
           expect(res).to.have.property('body').and.to.be.a('object')
-          const errObj = error.cveIdMismatch()
+          const errObj = error.cveDne()
           expect(res.body.error).to.equal(errObj.error)
           expect(res.body.message).to.equal(errObj.message)
           done()
         })
     })
 
-    it('CVE record not updated when cve record doesnt exist', (done) => {
-      const nonExistentCve = JSON.parse(JSON.stringify(cvePublicPass4))
-      nonExistentCve.CVE_data_meta.ID = nonExistentCveId
+    it('CVE record not updated when cve record updated to RESERVED state', (done) => {
       class OrgRepo {
         async getOrgUUID () {
           return null
@@ -454,12 +185,12 @@ describe('Testing the POST /cve/:id endpoint in Cve Controller', () => {
       }
       class CveRepo {
         async updateByCveId (cveId, newCve) {
-          return { n: 0 }
+          return null
         }
       }
       class CveIdRepo {
         async updateByCveId (cveId, newCve) {
-          return { n: 1 }
+          return null
         }
       }
       class UserRepo {
@@ -467,7 +198,7 @@ describe('Testing the POST /cve/:id endpoint in Cve Controller', () => {
           return null
         }
       }
-      server.route('/cve-not-updated-cve-dne/:id')
+      server.route('/cve-not-updated-reserved-state/:id')
         .put((req, res, next) => {
           const factory = {
             getCveIdRepository: () => { return new CveIdRepo() },
@@ -480,26 +211,26 @@ describe('Testing the POST /cve/:id endpoint in Cve Controller', () => {
         }, cveParams.parsePostParams, cveController.CVE_UPDATE_SINGLE)
 
       chai.request(server)
-        .put(`/cve-not-updated-cve-dne/${nonExistentCveId}`)
+        .put(`/cve-not-updated-reserved-state/${cveIdReserved4}`)
         .set(cveFixtures.secretariatHeader)
-        .send(nonExistentCve)
+        .send(cveReservedPass4)
         .end((err, res) => {
           if (err) {
             done(err)
           }
 
-          expect(res).to.have.status(403)
+          expect(res).to.have.status(400)
           expect(res).to.have.property('body').and.to.be.a('object')
-          const errObj = error.cveRecordDne()
+          const errObj = error.cveUpdateUnsupportedState(CONSTANTS.CVE_STATES.RESERVED)
           expect(res.body.error).to.equal(errObj.error)
           expect(res.body.message).to.equal(errObj.message)
           done()
         })
     })
+  })
 
-    it('CVE record not updated when cve id doesnt exist', (done) => {
-      const nonExistentCve = JSON.parse(JSON.stringify(cvePublicPass4))
-      nonExistentCve.CVE_data_meta.ID = nonExistentCveId
+  context('Positive Tests', () => {
+    it('Update CVE record when requestor is secretariat', (done) => {
       class OrgRepo {
         async getOrgUUID () {
           return null
@@ -507,12 +238,16 @@ describe('Testing the POST /cve/:id endpoint in Cve Controller', () => {
       }
       class CveRepo {
         async updateByCveId (cveId, newCve) {
-          return null
+          expect(cveId).to.equal(cveIdPublic4)
+          expect(newCve).to.have.nested.property('cve.CVE_data_meta.STATE').and.to.equal(CONSTANTS.CVE_STATES.PUBLIC)
+          return { n: 1 }
         }
       }
       class CveIdRepo {
         async updateByCveId (cveId, newCve) {
-          return { n: 0 }
+          expect(cveId).to.equal(cveIdPublic4)
+          expect(newCve).to.have.property('state')
+          return { n: 1 }
         }
       }
       class UserRepo {
@@ -520,7 +255,7 @@ describe('Testing the POST /cve/:id endpoint in Cve Controller', () => {
           return null
         }
       }
-      server.route('/cve-not-updated-cve-id-dne/:id')
+      server.route('/cve-update-record/:id')
         .put((req, res, next) => {
           const factory = {
             getCveIdRepository: () => { return new CveIdRepo() },
@@ -533,24 +268,24 @@ describe('Testing the POST /cve/:id endpoint in Cve Controller', () => {
         }, cveParams.parsePostParams, cveController.CVE_UPDATE_SINGLE)
 
       chai.request(server)
-        .put(`/cve-not-updated-cve-id-dne/${nonExistentCveId}`)
+        .put(`/cve-update-record/${cveIdPublic4}`)
         .set(cveFixtures.secretariatHeader)
-        .send(nonExistentCve)
+        .send(cvePublicPass4)
         .end((err, res) => {
           if (err) {
             done(err)
           }
 
-          expect(res).to.have.status(403)
+          expect(res).to.have.status(200)
           expect(res).to.have.property('body').and.to.be.a('object')
-          const errObj = error.cveDne()
-          expect(res.body.error).to.equal(errObj.error)
-          expect(res.body.message).to.equal(errObj.message)
+          expect(res.body).to.have.property('updated').and.to.be.a('object')
+          expect(res.body.updated).to.have.nested.property('CVE_data_meta.ID').and.to.equal(cveIdPublic4)
+          expect(res.body.updated).to.have.nested.property('CVE_data_meta.STATE').and.to.equal(CONSTANTS.CVE_STATES.PUBLIC)
           done()
         })
     })
 
-    it('CVE record not updated when cve record updated to RESERVED state', (done) => {
+    it('Update CVE record when requestor is secretariat and valid REJECT JSON', (done) => {
       class OrgRepo {
         async getOrgUUID () {
           return null
@@ -558,12 +293,12 @@ describe('Testing the POST /cve/:id endpoint in Cve Controller', () => {
       }
       class CveRepo {
         async updateByCveId (cveId, newCve) {
-          return null
+          return { n: 1 }
         }
       }
       class CveIdRepo {
         async updateByCveId (cveId, newCve) {
-          return null
+          return { n: 1 }
         }
       }
       class UserRepo {
@@ -571,7 +306,7 @@ describe('Testing the POST /cve/:id endpoint in Cve Controller', () => {
           return null
         }
       }
-      server.route('/cve-not-updated-reserved-state/:id')
+      server.route('/cve-update-record-reject/:id')
         .put((req, res, next) => {
           const factory = {
             getCveIdRepository: () => { return new CveIdRepo() },
@@ -584,19 +319,19 @@ describe('Testing the POST /cve/:id endpoint in Cve Controller', () => {
         }, cveParams.parsePostParams, cveController.CVE_UPDATE_SINGLE)
 
       chai.request(server)
-        .put(`/cve-not-updated-reserved-state/${cveIdReserved4}`)
+        .put(`/cve-update-record-reject/${cveIdReject4}`)
         .set(cveFixtures.secretariatHeader)
-        .send(cveReservedPass4)
+        .send(cveRejectPass4)
         .end((err, res) => {
           if (err) {
             done(err)
           }
 
-          expect(res).to.have.status(400)
+          expect(res).to.have.status(200)
           expect(res).to.have.property('body').and.to.be.a('object')
-          const errObj = error.cveUpdateUnsupportedState(CONSTANTS.CVE_STATES.RESERVED)
-          expect(res.body.error).to.equal(errObj.error)
-          expect(res.body.message).to.equal(errObj.message)
+          expect(res.body).to.have.property('updated').and.to.be.a('object')
+          expect(res.body.updated).to.have.nested.property('CVE_data_meta.ID').and.to.equal(cveIdReject4)
+          expect(res.body.updated).to.have.nested.property('CVE_data_meta.STATE').and.to.equal(CONSTANTS.CVE_STATES.REJECT)
           done()
         })
     })
diff --git a/test/unit-tests/cve/mockObjects.cve.js b/test/unit-tests/cve/mockObjects.cve.js
index 8f0434de..afaefc8e 100644
--- a/test/unit-tests/cve/mockObjects.cve.js
+++ b/test/unit-tests/cve/mockObjects.cve.js
@@ -1,4 +1,8 @@
 const CONSTANTS = require('../../../src/constants')
+const cveIdPublic4 = 'CVE-2017-5832'
+const cveIdReject4 = 'CVE-2017-5835'
+const cvePublicPass4 = require('../../schemas/4.0/' + cveIdPublic4 + '_public.json')
+const cveRejectPass4 = require('../../schemas/4.0/' + cveIdReject4 + '_reject.json')
 
 const secretariatHeader = {
   'content-type': 'application/json',
@@ -70,11 +74,29 @@ const cveReject4 = {
   }
 }
 
+const cveRecordPublic4 = {
+  time: {
+    created: Date.now(),
+    modified: Date.now()
+  },
+  cve: cvePublicPass4
+}
+
+const cveRecordReject4 = {
+  time: {
+    created: Date.now(),
+    modified: Date.now()
+  },
+  cve: cveRejectPass4
+}
+
 module.exports = {
   secretariatHeader,
   secretariatOrg,
   secretariatUser,
   cveAvailable4,
   cvePublic4,
-  cveReject4
+  cveReject4,
+  cveRecordPublic4,
+  cveRecordReject4
 }