Repository: CVEProject/cve-services
Pull request #431 (2021-05-24 21:31:09)

Release Update CVE Fix

NOTE: Re-made PR since checks froze up.


Patch:
diff --git a/src/controller/cve.controller/cve.controller.js b/src/controller/cve.controller/cve.controller.js
index c3e5c7d9..0534da4f 100644
--- a/src/controller/cve.controller/cve.controller.js
+++ b/src/controller/cve.controller/cve.controller.js
@@ -161,34 +161,32 @@ async function updateCve (req, res, next) {
     const cveIdRepo = req.ctx.repositories.getCveIdRepository()
     const orgRepo = req.ctx.repositories.getOrgRepository()
 
-    // cve id in body must match id in URL param
     if (cveId !== cve.CVE_data_meta.ID) {
       return res.status(400).json(error.cveIdMismatch())
     }
 
-    // check that cve does not have status 'RESERVED'
     if (newCve.cve.CVE_data_meta.STATE === CONSTANTS.CVE_STATES.RESERVED) {
       return res.status(400).json(error.cveUpdateUnsupportedState(CONSTANTS.CVE_STATES.RESERVED))
     }
 
-    // update the cve id in MongoDB
-    let result = await cveIdRepo.updateByCveId(cveId, { state: newCve.cve.CVE_data_meta.STATE })
+    let result = await cveIdRepo.findOneByCveId(cveId)
 
-    // check if cve id was found and updated
-    if (result.n === 0) {
+    if (!result) {
       logger.info(cveId + ' does not exist.')
       return res.status(403).json(error.cveDne())
     }
 
-    // update CVE record if it exists
-    result = await cveRepo.updateByCveId(cveId, newCve)
+    result = await cveRepo.findOneByCveId(cveId)
 
-    // check if CVE record was found and updated
-    if (result.n === 0) {
+    if (!result) {
       logger.info(cveId + ' does not exist.')
       return res.status(403).json(error.cveRecordDne())
     }
 
+    result = await cveRepo.updateByCveId(cveId, newCve)
+
+    result = await cveIdRepo.updateByCveId(cveId, { state: newCve.cve.CVE_data_meta.STATE })
+
     const responseMessage = {
       message: cveId + ' record was successfully updated.',
       updated: newCve.cve


Test patch:
diff --git a/test/unit-tests/cve/cveUpdateTest.js b/test/unit-tests/cve/cveUpdateTest.js
index d5a908cc..84990e38 100644
--- a/test/unit-tests/cve/cveUpdateTest.js
+++ b/test/unit-tests/cve/cveUpdateTest.js
@@ -30,11 +30,19 @@ describe('Testing the PUT /cve/:id endpoint in Cve Controller', () => {
         async updateByCveId (cveId, newCve) {
           return null
         }
+
+        async findOneByCveId () {
+          return null
+        }
       }
       class CveIdRepo {
         async updateByCveId (cveId, newCve) {
           return null
         }
+
+        async findOneByCveId () {
+          return null
+        }
       }
       class UserRepo {
         async getUserUUID () {
@@ -81,12 +89,23 @@ describe('Testing the PUT /cve/:id endpoint in Cve Controller', () => {
       }
       class CveRepo {
         async updateByCveId (cveId, newCve) {
-          return { n: 0 }
+          // test shouldn't reach here
+          expect.fail()
+          return null
+        }
+
+        async findOneByCveId () {
+          return null
         }
       }
       class CveIdRepo {
         async updateByCveId (cveId, newCve) {
-          return { n: 1 }
+          expect.fail()
+          return null
+        }
+
+        async findOneByCveId () {
+          return true
         }
       }
       class UserRepo {
@@ -134,12 +153,24 @@ describe('Testing the PUT /cve/:id endpoint in Cve Controller', () => {
       }
       class CveRepo {
         async updateByCveId (cveId, newCve) {
+          // test shouldn't reach here
+          expect.fail()
           return null
         }
+
+        async findOneByCveId () {
+          // set to anything not false to pass the check
+          return true
+        }
       }
       class CveIdRepo {
         async updateByCveId (cveId, newCve) {
-          return { n: 0 }
+          expect.fail()
+          return null
+        }
+
+        async findOneByCveId () {
+          return null
         }
       }
       class UserRepo {
@@ -240,14 +271,22 @@ describe('Testing the PUT /cve/:id endpoint in Cve Controller', () => {
         async updateByCveId (cveId, newCve) {
           expect(cveId).to.equal(cveIdPublic4)
           expect(newCve).to.have.nested.property('cve.CVE_data_meta.STATE').and.to.equal(CONSTANTS.CVE_STATES.PUBLIC)
-          return { n: 1 }
+          return null
+        }
+
+        async findOneByCveId () {
+          return true
         }
       }
       class CveIdRepo {
         async updateByCveId (cveId, newCve) {
           expect(cveId).to.equal(cveIdPublic4)
           expect(newCve).to.have.property('state')
-          return { n: 1 }
+          return null
+        }
+
+        async findOneByCveId () {
+          return true
         }
       }
       class UserRepo {
@@ -255,6 +294,7 @@ describe('Testing the PUT /cve/:id endpoint in Cve Controller', () => {
           return null
         }
       }
+
       server.route('/cve-update-record/:id')
         .put((req, res, next) => {
           const factory = {
@@ -293,12 +333,20 @@ describe('Testing the PUT /cve/:id endpoint in Cve Controller', () => {
       }
       class CveRepo {
         async updateByCveId (cveId, newCve) {
-          return { n: 1 }
+          return null
+        }
+
+        async findOneByCveId () {
+          return true
         }
       }
       class CveIdRepo {
         async updateByCveId (cveId, newCve) {
-          return { n: 1 }
+          return null
+        }
+
+        async findOneByCveId () {
+          return true
         }
       }
       class UserRepo {