Repository: CVEProject/cve-services
Pull request #446 (2021-06-07 21:22:43)

Issue 436
This pr address issue #436 

Changes include:
* An error message is sent to the user if either the `uuid` or `org_uuid` fields in the request body are provide when creating or updating a user or an organization. The reason is to disallow users to provide uuids in their request. Essentially, all uuids must be generated internally by the User Registry service.
* All endpoints returning user and/or organization objects are structured in a consistent manner.
* Documentation for creating and maintaining users will be addressed in a separate issue.





Patch:
diff --git a/src/controller/org.controller/error.js b/src/controller/org.controller/error.js
index 196391a4..822a4208 100644
--- a/src/controller/org.controller/error.js
+++ b/src/controller/org.controller/error.js
@@ -36,10 +36,10 @@ class OrgControllerError extends idrErr.IDRError {
     return err
   }
 
-  shortnameMismatch (shortname, shortnameBody) { // org
+  uuidProvided () { // org
     const err = {}
-    err.error = 'SHORTNAME_MISMATCH'
-    err.message = `The '${shortname}' organization designated by the shortname parameter does not match the shortname '${shortnameBody}' in the JSON body.`
+    err.error = 'UUID_PROVIDED'
+    err.message = 'Providing UUIDs for user creation or update is not allowed.'
     return err
   }
 
diff --git a/src/controller/org.controller/index.js b/src/controller/org.controller/index.js
index 4e96a622..22b7a962 100644
--- a/src/controller/org.controller/index.js
+++ b/src/controller/org.controller/index.js
@@ -18,6 +18,7 @@ router.post('/org',
   mw.validateUser,
   body(['short_name']).isString().trim().escape().notEmpty(),
   body(['name']).isString().trim().escape().notEmpty(),
+  body(['uuid']).optional().isString().trim().escape(),
   body(['authority.active_roles']).optional().customSanitizer(val => { return val.map(x => { return x.toUpperCase() }) }).custom(val => { return isOrgRole(val) }),
   body(['policies.id_quota']).optional().not().isArray().isInt({ min: CONSTANTS.MONGOOSE_VALIDATION.Org_policies_id_quota_min, max: CONSTANTS.MONGOOSE_VALIDATION.Org_policies_id_quota_max }).withMessage('The id_quota does not comply with CVE id quota limitations.'),
   parseError,
@@ -54,8 +55,8 @@ router.post('/org/:shortname/user',
   mw.validateUser,
   param(['shortname']).isString().trim().escape().notEmpty(),
   body(['username']).isString().trim().escape().notEmpty(),
-  body(['org_UUID']).optional().isString().trim().escape(),
-  body(['UUID']).optional().isString().trim().escape(),
+  body(['org_uuid']).optional().isString().trim().escape(),
+  body(['uuid']).optional().isString().trim().escape(),
   body(['name.first']).optional().isString().trim().escape(),
   body(['name.last']).optional().isString().trim().escape(),
   body(['name.middle']).optional().isString().trim().escape(),
diff --git a/src/controller/org.controller/org.controller.js b/src/controller/org.controller/org.controller.js
index 7db6ce66..a60f8533 100644
--- a/src/controller/org.controller/org.controller.js
+++ b/src/controller/org.controller/org.controller.js
@@ -5,7 +5,6 @@ const logger = require('../../middleware/logger')
 const argon2 = require('argon2')
 const CONSTANTS = require('../../constants')
 const cryptoRandomString = require('crypto-random-string')
-const utils = require('../../utils/utils')
 const uuid = require('uuid')
 const errors = require('./error')
 const error = new errors.OrgControllerError()
@@ -17,20 +16,8 @@ async function getOrgs (req, res, next) {
     options.sort = { short_name: 'asc' }
     options.page = req.ctx.query.page ? parseInt(req.ctx.query.page) : CONSTANTS.PAGINATOR_PAGE // if 'page' query parameter is not defined, set 'page' to the default page value
     const repo = req.ctx.repositories.getOrgRepository()
-    const agt = [
-      {
-        $project: {
-          _id: false,
-          UUID: true,
-          short_name: true,
-          name: true,
-          'authority.active_roles': true,
-          'policies.id_quota': true,
-          time: true
-        }
-      }
-    ]
 
+    const agt = setAggregateOrgObj({})
     const pg = await repo.aggregatePaginate(agt, options)
     const payload = { organizations: pg.itemsList }
 
@@ -63,35 +50,23 @@ async function getOrg (req, res, next) {
       return res.status(403).json(error.notSameOrgOrSecretariat())
     }
 
-    const result = await repo.aggregate([
-      {
-        $match: { short_name: shortName }
-      },
-      {
-        $project: {
-          _id: false,
-          UUID: true,
-          short_name: true,
-          name: true,
-          'authority.active_roles': true,
-          'policies.id_quota': true,
-          time: true
-        }
-      }
-    ])
+    const agt = setAggregateOrgObj({ short_name: shortName })
+    let result = await repo.aggregate(agt)
+    result = result.length > 0 ? result[0] : null
 
-    if (utils.isEmptyObject(result)) { // an empty result can only happen if the requestor is the Secretariat
+    if (!result) { // an empty result can only happen if the requestor is the Secretariat
       logger.info({ uuid: req.ctx.uuid, message: shortName + ' organization does not exist.' })
       return res.status(404).json(error.orgDneParam(shortName))
     }
 
     logger.info({ uuid: req.ctx.uuid, message: shortName + ' organization was sent to the user.', org: result })
-    return res.status(200).json(result[0])
+    return res.status(200).json(result)
   } catch (err) {
     next(err)
   }
 }
 
+// Get the details of all users from an org given the specified shortname
 async function getUsers (req, res, next) {
   try {
     options.sort = { username: 'asc' }
@@ -113,24 +88,7 @@ async function getUsers (req, res, next) {
       return res.status(403).json(error.notSameOrgOrSecretariat())
     }
 
-    const agt = [
-      {
-        $match: { org_UUID: orgUUID }
-      },
-      {
-        $project: {
-          _id: false,
-          UUID: true,
-          username: true,
-          org_UUID: true,
-          name: true,
-          'authority.active_roles': true,
-          active: true,
-          time: true
-        }
-      }
-    ]
-
+    const agt = setAggregateUserObj({ org_UUID: orgUUID })
     const pg = await userRepo.aggregatePaginate(agt, options)
     const payload = { users: pg.itemsList }
 
@@ -171,31 +129,17 @@ async function getUser (req, res, next) {
     }
 
     const userRepo = req.ctx.repositories.getUserRepository()
-    const result = await userRepo.aggregate([
-      {
-        $match: { username: username, org_UUID: orgUUID }
-      },
-      {
-        $project: {
-          _id: false,
-          UUID: true,
-          username: true,
-          org_UUID: true,
-          name: true,
-          'authority.active_roles': true,
-          active: true,
-          time: true
-        }
-      }
-    ])
+    const agt = setAggregateUserObj({ username: username, org_UUID: orgUUID })
+    let result = await userRepo.aggregate(agt)
+    result = result.length > 0 ? result[0] : null
 
-    if (utils.isEmptyObject(result)) {
+    if (!result) {
       logger.info({ uuid: req.ctx.uuid, message: username + ' does not exist.' })
       return res.status(404).json(error.userDne(username))
     }
 
     logger.info({ uuid: req.ctx.uuid, message: username + ' was sent to the user.', user: result })
-    return res.status(200).json(result[0])
+    return res.status(200).json(result)
   } catch (err) {
     next(err)
   }
@@ -248,7 +192,7 @@ async function createOrg (req, res, next) {
     const newOrg = new Org(req.ctx.body)
     const orgRepo = req.ctx.repositories.getOrgRepository()
 
-    const result = await orgRepo.findOneByShortName(newOrg.short_name) // Find org in MongoDB
+    let result = await orgRepo.findOneByShortName(newOrg.short_name) // Find org in MongoDB
     if (result) {
       logger.info({ uuid: req.ctx.uuid, message: newOrg.short_name + ' organization was not created because it already exists.' })
       return res.status(400).json(error.orgExists(newOrg.short_name))
@@ -261,19 +205,23 @@ async function createOrg (req, res, next) {
       newOrg.authority.active_roles = [CONSTANTS.AUTH_ROLE_ENUM.CNA] // default role
     }
 
-    if (newOrg.UUID === undefined || newOrg.UUID === null) {
-      newOrg.UUID = uuid.v4()
+    if (newOrg.UUID) {
+      return res.status(400).json(error.uuidProvided())
     }
+    newOrg.UUID = uuid.v4()
 
     if (newOrg.policies.id_quota === undefined || newOrg.policies.id_quota === null) {
       newOrg.policies.id_quota = CONSTANTS.DEFAULT_ID_QUOTA
     }
 
     await orgRepo.updateByOrgUUID(newOrg.UUID, newOrg, { upsert: true }) // Create org in MongoDB if it doesn't exist
+    const agt = setAggregateOrgObj({ short_name: newOrg.short_name })
+    result = await orgRepo.aggregate(agt)
+    result = result.length > 0 ? result[0] : null
 
     const responseMessage = {
       message: newOrg.short_name + ' organization was successfully created.',
-      created: newOrg
+      created: result
     }
 
     const payload = {
@@ -281,7 +229,7 @@ async function createOrg (req, res, next) {
       change: newOrg.short_name + ' organization was successfully created.',
       req_UUID: req.ctx.uuid,
       org_UUID: await orgRepo.getOrgUUID(req.ctx.org),
-      org: newOrg
+      org: result
     }
     const userRepo = req.ctx.repositories.getUserRepository()
     payload.user_UUID = await userRepo.getUserUUID(req.ctx.user, payload.org_UUID)
@@ -304,6 +252,7 @@ async function updateOrg (req, res, next) {
     const addRoles = []
     const orgRepo = req.ctx.repositories.getOrgRepository()
     const org = await orgRepo.findOneByShortName(shortName)
+    let agt = setAggregateUserObj({ short_name: shortName })
 
     // org doesn't exist
     if (!org) {
@@ -373,6 +322,7 @@ async function updateOrg (req, res, next) {
     // updating the org's shortname (the shortname field is never an empty string due to the stripping of the quotes and double quotes)
     if (shortname) {
       newOrg.short_name = shortname
+      agt = setAggregateUserObj({ short_name: newOrg.short_name })
       const result = await orgRepo.findOneByShortName(newOrg.short_name)
 
       if (result) {
@@ -381,16 +331,18 @@ async function updateOrg (req, res, next) {
     }
 
     // update org
-    const result = await orgRepo.updateByOrgUUID(org.UUID, newOrg)
-
+    let result = await orgRepo.updateByOrgUUID(org.UUID, newOrg)
     if (result.n === 0) {
       logger.info({ uuid: req.ctx.uuid, message: shortName + ' organization could not be updated in MongoDB because it does not exist.' })
       return res.status(404).json(error.orgDneParam(shortName))
     }
 
+    result = await orgRepo.aggregate(agt)
+    result = result.length > 0 ? result[0] : null
+
     const responseMessage = {
       message: shortName + ' organization was successfully updated.',
-      updated: newOrg
+      updated: result
     }
 
     const payload = {
@@ -398,7 +350,7 @@ async function updateOrg (req, res, next) {
       change: shortName + ' organization was successfully updated.',
       req_UUID: req.ctx.uuid,
       org_UUID: await orgRepo.getOrgUUID(req.ctx.org),
-      org: newOrg
+      org: result
     }
     const userRepo = req.ctx.repositories.getUserRepository()
     payload.user_UUID = await userRepo.getUserUUID(req.ctx.user, payload.org_UUID)
@@ -425,68 +377,53 @@ async function createUser (req, res, next) {
       return res.status(404).json(error.orgDneParam(orgShortName))
     }
 
-    if (newUser.org_UUID === undefined || newUser.org_UUID === null) {
-      newUser.org_UUID = orgUUID
-    }
-
-    // If org's UUID was provided in the body, it must match the org's UUID of the org provided in the URL params
-    if (newUser.org_UUID !== orgUUID) {
-      const temp = await orgRepo.findOneByUUID(newUser.org_UUID)
-      let sn
-
-      if (!temp) {
-        sn = null
-      } else {
-        sn = temp.short_name
-      }
-
-      return res.status(400).json(error.shortnameMismatch(orgShortName, sn))
+    if (newUser.org_UUID) {
+      return res.status(400).json(error.uuidProvided())
     }
+    newUser.org_UUID = orgUUID
 
     const requesterOrgUUID = await orgRepo.getOrgUUID(requesterShortName)
     const isSecretariat = await orgRepo.isSecretariatUUID(requesterOrgUUID)
     const isAdmin = await userRepo.isAdminUUID(requesterUsername, requesterOrgUUID)
     // check if user is only an Admin (not Secretatiat) and the user does not belong to the same organization as the new user
     if (!isSecretariat && isAdmin) {
-      if (requesterOrgUUID !== newUser.org_UUID) {
+      if (requesterOrgUUID !== orgUUID) {
         return res.status(403).json(error.notOrgAdminOrSecretariat()) // The Admin user must belong to the new user's organization
       }
     }
 
-    let result = await orgRepo.findOneByUUID(newUser.org_UUID) // Check the org exists
-    if (!result) {
-      logger.info({ uuid: req.ctx.uuid, message: 'The user could not be created because ' + orgShortName + ' organization does not exist.' })
-      return res.status(400).json(error.orgDneParam(orgShortName))
-    }
-
     newUser.active = true
     const randomKey = cryptoRandomString({ length: CONSTANTS.CRYPTO_RANDOM_STRING_LENGTH })
     newUser.secret = await argon2.hash(randomKey)
 
-    if (newUser.UUID === undefined || newUser.UUID === null) {
-      newUser.UUID = uuid.v4()
+    if (newUser.UUID) {
+      return res.status(400).json(error.uuidProvided())
     }
+    newUser.UUID = uuid.v4()
 
-    result = await userRepo.findOneByUserNameAndOrgUUID(newUser.username, newUser.org_UUID) // Find user in MongoDB
-
+    let result = await userRepo.findOneByUserNameAndOrgUUID(newUser.username, newUser.org_UUID) // Find user in MongoDB
     if (result) {
       logger.info({ uuid: req.ctx.uuid, message: newUser.username + ' was not created because it already exists.' })
       return res.status(400).json(error.userExists(newUser.username))
     }
+
     await userRepo.updateByUserNameAndOrgUUID(newUser.username, newUser.org_UUID, newUser, { upsert: true }) // Create user in MongoDB if it doesn't exist
+    const agt = setAggregateUserObj({ username: newUser.username, org_UUID: newUser.org_UUID })
+    result = await userRepo.aggregate(agt)
+    result = result.length > 0 ? result[0] : null
 
-    newUser.secret = randomKey
+    result.secret = randomKey
     const responseMessage = {
-      message: newUser.username + ' was successfully created.',
-      created: newUser
+      message: result.username + ' was successfully created.',
+      created: result
     }
 
     const payload = {
       action: 'create_user',
-      change: newUser.username + ' was successfully created.',
+      change: result.username + ' was successfully created.',
       req_UUID: req.ctx.uuid,
       org_UUID: await orgRepo.getOrgUUID(req.ctx.org),
-      user: newUser
+      user: result
     }
     payload.user_UUID = await userRepo.getUserUUID(req.ctx.user, payload.org_UUID)
     logger.info(JSON.stringify(payload))
@@ -629,20 +566,25 @@ async function updateUser (req, res, next) {
       }
     }
 
+    let agt = setAggregateUserObj({ username: username, org_UUID: orgUUID })
+
     // check if org has user of same username already
     if (newUsername && newOrgShortName) {
+      agt = setAggregateUserObj({ username: newUser.username, org_UUID: newUser.org_UUID })
       const duplicateUsers = await userRepo.find({ org_UUID: newUser.org_UUID, username: newUser.username })
       if (duplicateUsers.length) {
         logger.info({ uuid: req.ctx.uuid, message: 'The user could not be updated because ' + newOrgShortName + ' organization contains a user with the same username.' })
-        return res.status(403).json(error.duplicateUsername(newOrgShortName, newUsername))
+        return res.status(403).json(error.duplicateUsername(newOrgShortName, newUser.username))
       }
     } else if (newUsername) {
+      agt = setAggregateUserObj({ username: newUser.username, org_UUID: orgUUID })
       const duplicateUsers = await userRepo.find({ org_UUID: orgUUID, username: newUser.username })
       if (duplicateUsers.length) {
         logger.info({ uuid: req.ctx.uuid, message: 'The user could not be updated because ' + shortName + ' organization contains a user with the same username.' })
-        return res.status(403).json(error.duplicateUsername(shortName, newUsername))
+        return res.status(403).json(error.duplicateUsername(shortName, newUser.username))
       }
     } else if (newOrgShortName) {
+      agt = setAggregateUserObj({ username: username, org_UUID: newUser.org_UUID })
       const duplicateUsers = await userRepo.find({ org_UUID: newUser.org_UUID, username: username })
       if (duplicateUsers.length) {
         logger.info({ uuid: req.ctx.uuid, message: 'The user could not be updated because ' + newOrgShortName + ' organization contains a user with the same username.' })
@@ -670,16 +612,19 @@ async function updateUser (req, res, next) {
     })
 
     newUser.authority.active_roles = roles
-    const result = await userRepo.updateByUserNameAndOrgUUID(username, orgUUID, newUser)
+    let result = await userRepo.updateByUserNameAndOrgUUID(username, orgUUID, newUser)
 
     if (result.n === 0) {
       logger.info({ uuid: req.ctx.uuid, message: 'The user could not be updated because ' + username + ' does not exist for ' + shortName + ' organization.' })
       return res.status(404).json(error.userDne(username))
     }
 
+    result = await userRepo.aggregate(agt)
+    result = result.length > 0 ? result[0] : null
+
     const responseMessage = {
       message: username + ' was successfully updated.',
-      updated: newUser
+      updated: result
     }
 
     const payload = {
@@ -687,7 +632,7 @@ async function updateUser (req, res, next) {
       change: username + ' was successfully updated.',
       req_UUID: req.ctx.uuid,
       org_UUID: await orgRepo.getOrgUUID(req.ctx.org),
-      user: newUser
+      user: result
     }
     payload.user_UUID = await userRepo.getUserUUID(req.ctx.user, payload.org_UUID)
     logger.info(JSON.stringify(payload))
@@ -749,6 +694,45 @@ async function resetSecret (req, res, next) {
   }
 }
 
+function setAggregateOrgObj (query) {
+  return [
+    {
+      $match: query
+    },
+    {
+      $project: {
+        _id: false,
+        UUID: true,
+        short_name: true,
+        name: true,
+        'authority.active_roles': true,
+        'policies.id_quota': true,
+        time: true
+      }
+    }
+  ]
+}
+
+function setAggregateUserObj (query) {
+  return [
+    {
+      $match: query
+    },
+    {
+      $project: {
+        _id: false,
+        username: true,
+        name: true,
+        UUID: true,
+        org_UUID: true,
+        active: true,
+        'authority.active_roles': true,
+        time: true
+      }
+    }
+  ]
+}
+
 module.exports = {
   ORG_ALL: getOrgs,
   ORG_SINGLE: getOrg,
diff --git a/src/utils/utils.js b/src/utils/utils.js
index bb927f3f..9c4569a6 100644
--- a/src/utils/utils.js
+++ b/src/utils/utils.js
@@ -100,15 +100,10 @@ function reqCtxMapping (req, keyType, keys) {
   }
 }
 
-function isEmptyObject (obj) {
-  return !Object.keys(obj).length
-}
-
 module.exports = {
   isSecretariat,
   isAdmin,
   isAdminUUID,
-  isEmptyObject,
   isSecretariatUUID,
   getOrgUUID,
   getUserUUID,


Test patch:
diff --git a/test-http/src/test/org_user_tests/org.py b/test-http/src/test/org_user_tests/org.py
index b01d15ed..67deda68 100644
--- a/test-http/src/test/org_user_tests/org.py
+++ b/test-http/src/test/org_user_tests/org.py
@@ -338,7 +338,7 @@ def test_put_update_user_add_admin_role():
     )
     assert res.status_code == 200
     response_contains_json(res, 'message', f'{user} was successfully updated.')
-    response_contains_json(res, 'updated', {'authority': {'active_roles': ['ADMIN']}})
+    assert json.loads(res.content.decode())['updated']['authority'] == {'active_roles': ['ADMIN']}
 
 
 def test_put_update_user_add_empty_role():
@@ -372,7 +372,7 @@ def test_put_update_user_remove_admin_role():
     )
     assert res.status_code == 200
     response_contains_json(res, 'message', f'{user} was successfully updated.')
-    response_contains_json(res, 'updated', {'authority': {'active_roles': []}})
+    assert json.loads(res.content.decode())['updated']['authority'] == {'active_roles': []}
 
 
 def test_put_update_user_remove_admin_role():
diff --git a/test/unit-tests/org/orgCreateTest.js b/test/unit-tests/org/orgCreateTest.js
index 7b331c3e..5678fd6a 100644
--- a/test/unit-tests/org/orgCreateTest.js
+++ b/test/unit-tests/org/orgCreateTest.js
@@ -36,6 +36,16 @@ class OrgCreated {
   async getOrgUUID () {
     return null
   }
+
+  async aggregate (aggregation) {
+    if (aggregation[0].$match.short_name === orgFixtures.existentOrg.short_name) {
+      return [orgFixtures.existentOrg]
+    } else if (aggregation[0].$match.short_name === orgFixtures.nonExistentOrg.short_name) {
+      return [orgFixtures.nonExistentOrg]
+    }
+
+    return []
+  }
 }
 
 class NullUserRepo {
@@ -64,22 +74,48 @@ class OrgCreatedWhenRolesDefined {
   async getOrgUUID () {
     return null
   }
+
+  async aggregate () {
+    return [orgFixtures.existentOrg]
+  }
+}
+
+class OrgCreatedIdQuotaNullUndefined {
+  async findOneByShortName () {
+    return null
+  }
+
+  async updateByOrgUUID () {
+    return null
+  }
+
+  async getOrgUUID () {
+    return null
+  }
+
+  async aggregate () {
+    this.testRes1 = JSON.parse(JSON.stringify(orgFixtures.nonExistentOrg))
+    this.testRes1.policies.id_quota = CONSTANTS.DEFAULT_ID_QUOTA
+
+    return [this.testRes1]
+  }
 }
 
 describe('Testing the POST /org endpoint in Org Controller', () => {
   context('Negative Tests', () => {
-    it('Org is not created because it already exists', (done) => {
-      app.route('/org-not-created-already-exists')
+    it('Org is not created because the UUID is provided', (done) => {
+      app.route('/org-created-when-uuid-undefined')
         .post((req, res, next) => {
           const factory = {
-            getOrgRepository: () => { return new OrgNotCreatedAlreadyExists() }
+            getOrgRepository: () => { return new OrgCreated() },
+            getUserRepository: () => { return new NullUserRepo() }
           }
           req.ctx.repositories = factory
           next()
         }, orgParams.parsePostParams, orgController.ORG_CREATE_SINGLE)
 
       chai.request(app)
-        .post('/org-not-created-already-exists')
+        .post('/org-created-when-uuid-undefined')
         .set(orgFixtures.secretariatHeader)
         .send(orgFixtures.existentOrg)
         .end((err, res) => {
@@ -89,31 +125,28 @@ describe('Testing the POST /org endpoint in Org Controller', () => {
 
           expect(res).to.have.status(400)
           expect(res).to.have.property('body').and.to.be.a('object')
-          const errObj = error.orgExists(orgFixtures.existentOrg.short_name)
+          const errObj = error.uuidProvided()
           expect(res.body.error).to.equal(errObj.error)
           expect(res.body.message).to.equal(errObj.message)
           done()
         })
     })
-  })
 
-  context('Positive Tests', () => {
-    it('Org is created when UUID is undefined', (done) => {
-      app.route('/org-created-when-uuid-undefined')
+    it('Org is not created because it already exists', (done) => {
+      app.route('/org-not-created-already-exists')
         .post((req, res, next) => {
           const factory = {
-            getOrgRepository: () => { return new OrgCreated() },
-            getUserRepository: () => { return new NullUserRepo() }
+            getOrgRepository: () => { return new OrgNotCreatedAlreadyExists() }
           }
           req.ctx.repositories = factory
           next()
         }, orgParams.parsePostParams, orgController.ORG_CREATE_SINGLE)
 
-      const testOrg = Object.assign({}, orgFixtures.existentOrg)
+      const testOrg = JSON.parse(JSON.stringify(orgFixtures.existentOrg))
       delete testOrg.UUID
 
       chai.request(app)
-        .post('/org-created-when-uuid-undefined')
+        .post('/org-not-created-already-exists')
         .set(orgFixtures.secretariatHeader)
         .send(testOrg)
         .end((err, res) => {
@@ -121,19 +154,19 @@ describe('Testing the POST /org endpoint in Org Controller', () => {
             done(err)
           }
 
-          expect(res).to.have.status(200)
+          expect(res).to.have.status(400)
           expect(res).to.have.property('body').and.to.be.a('object')
-          expect(res.body).to.have.property('message').and.to.be.a('string')
-          expect(res.body.message).to.equal(testOrg.short_name + ' organization was successfully created.')
-          expect(res.body).to.have.property('created').and.to.be.a('object')
-          expect(res.body.created).to.have.property('short_name').to.equal(testOrg.short_name)
-          expect(res.body.created).to.have.property('UUID').and.to.be.a('string')
+          const errObj = error.orgExists(orgFixtures.existentOrg.short_name)
+          expect(res.body.error).to.equal(errObj.error)
+          expect(res.body.message).to.equal(errObj.message)
           done()
         })
     })
+  })
 
-    it('Org is created when UUID is null', async () => {
-      app.route('/org-created-when-uuid-null')
+  context('Positive Tests', () => {
+    it('Org is created', async () => {
+      app.route('/org-created-when-uuid-not-provided')
         .post((req, res, next) => {
           const factory = {
             getOrgRepository: () => { return new OrgCreated() },
@@ -143,11 +176,11 @@ describe('Testing the POST /org endpoint in Org Controller', () => {
           next()
         }, orgParams.parsePostParams, orgController.ORG_CREATE_SINGLE)
 
-      const testOrg = Object.assign({}, orgFixtures.existentOrg)
-      testOrg.UUID = null
+      const testOrg = JSON.parse(JSON.stringify(orgFixtures.existentOrg))
+      delete testOrg.UUID
 
       const res = await chai.request(app)
-        .post('/org-created-when-uuid-null')
+        .post('/org-created-when-uuid-not-provided')
         .set(orgFixtures.secretariatHeader)
         .send(testOrg)
 
@@ -157,32 +190,6 @@ describe('Testing the POST /org endpoint in Org Controller', () => {
       expect(res.body.message).to.equal(orgFixtures.existentOrg.short_name + ' organization was successfully created.')
       expect(res.body).to.have.property('created').and.to.be.a('object')
       expect(res.body.created).to.have.property('short_name').to.equal(orgFixtures.existentOrg.short_name)
-      expect(res.body.created).to.have.property('UUID').and.to.be.a('string')
-    })
-
-    it('Org is created when UUID is defined', async () => {
-      app.route('/org-created-when-uuid-defined')
-        .post((req, res, next) => {
-          const factory = {
-            getOrgRepository: () => { return new OrgCreated() },
-            getUserRepository: () => { return new NullUserRepo() }
-          }
-          req.ctx.repositories = factory
-          next()
-        }, orgParams.parsePostParams, orgController.ORG_CREATE_SINGLE)
-
-      const res = await chai.request(app)
-        .post('/org-created-when-uuid-defined')
-        .set(orgFixtures.secretariatHeader)
-        .send(orgFixtures.existentOrg)
-
-      expect(res).to.have.status(200)
-      expect(res).to.have.property('body').and.to.be.a('object')
-      expect(res.body).to.have.property('message').and.to.be.a('string')
-      expect(res.body.message).to.equal(orgFixtures.existentOrg.short_name + ' organization was successfully created.')
-      expect(res.body).to.have.property('created').and.to.be.a('object')
-      expect(res.body.created).to.have.property('short_name').to.equal(orgFixtures.existentOrg.short_name)
-      expect(res.body.created).to.have.property('UUID').to.equal(orgFixtures.existentOrg.UUID)
     })
 
     it('Org is Secretariat and is created when roles are defined', async () => {
@@ -196,10 +203,13 @@ describe('Testing the POST /org endpoint in Org Controller', () => {
           next()
         }, orgParams.parsePostParams, orgController.ORG_CREATE_SINGLE)
 
+      const testOrg = JSON.parse(JSON.stringify(orgFixtures.existentOrg))
+      delete testOrg.UUID
+
       const res = await chai.request(app)
         .post('/org-created-when-roles-defined')
         .set(orgFixtures.secretariatHeader)
-        .send(orgFixtures.existentOrg)
+        .send(testOrg)
 
       expect(res).to.have.status(200)
       expect(res).to.have.property('body').and.to.be.a('object')
@@ -223,7 +233,8 @@ describe('Testing the POST /org endpoint in Org Controller', () => {
           next()
         }, orgParams.parsePostParams, orgController.ORG_CREATE_SINGLE)
 
-      const testOrg = Object.assign({}, orgFixtures.nonExistentOrg)
+      const testOrg = JSON.parse(JSON.stringify(orgFixtures.nonExistentOrg))
+      delete testOrg.UUID
       delete testOrg.authority.active_roles
 
       chai.request(app)
@@ -252,14 +263,15 @@ describe('Testing the POST /org endpoint in Org Controller', () => {
       app.route('/org-created-when-id_quota-undefined')
         .post((req, res, next) => {
           const factory = {
-            getOrgRepository: () => { return new OrgCreated() },
+            getOrgRepository: () => { return new OrgCreatedIdQuotaNullUndefined() },
             getUserRepository: () => { return new NullUserRepo() }
           }
           req.ctx.repositories = factory
           next()
         }, orgParams.parsePostParams, orgController.ORG_CREATE_SINGLE)
 
-      const testOrg = Object.assign({}, orgFixtures.nonExistentOrg)
+      const testOrg = JSON.parse(JSON.stringify(orgFixtures.nonExistentOrg))
+      delete testOrg.UUID
       delete testOrg.policies.id_quota
 
       const res = await chai.request(app)
@@ -282,14 +294,15 @@ describe('Testing the POST /org endpoint in Org Controller', () => {
       app.route('/org-created-when-id_quota-null')
         .post((req, res, next) => {
           const factory = {
-            getOrgRepository: () => { return new OrgCreated() },
+            getOrgRepository: () => { return new OrgCreatedIdQuotaNullUndefined() },
             getUserRepository: () => { return new NullUserRepo() }
           }
           req.ctx.repositories = factory
           next()
         }, orgParams.parsePostParams, orgController.ORG_CREATE_SINGLE)
 
-      const testOrg = Object.assign({}, orgFixtures.nonExistentOrg)
+      const testOrg = JSON.parse(JSON.stringify(orgFixtures.nonExistentOrg))
+      delete testOrg.UUID
       testOrg.policies.id_quota = null
 
       const res = await chai.request(app)
diff --git a/test/unit-tests/org/orgUpdateTest.js b/test/unit-tests/org/orgUpdateTest.js
index df3e902d..e2caf385 100644
--- a/test/unit-tests/org/orgUpdateTest.js
+++ b/test/unit-tests/org/orgUpdateTest.js
@@ -52,7 +52,6 @@ describe('Testing the PUT /org/:shortname endpoint in Org Controller', () => {
       const res = await chai.request(app)
         .put(`/org-not-updated-doesnt-exists/${orgFixtures.nonExistentOrg.short_name}`)
         .set(orgFixtures.secretariatHeader)
-        .send({ shortname: orgFixtures.nonExistentOrg.short_name })
 
       expect(res).to.have.status(404)
       expect(res).to.have.property('body').and.to.be.a('object')
@@ -96,56 +95,6 @@ describe('Testing the PUT /org/:shortname endpoint in Org Controller', () => {
   })
 
   context('Positive Tests', () => {
-    it('Org id_quota is undefined', (done) => {
-      class OrgNotUpdatedIdQuotaUndefined {
-        constructor () {
-          orgFixtures.existentOrg.policies.id_quota = 1000
-        }
-
-        async findOneByShortName () {
-          return orgFixtures.existentOrg
-        }
-
-        async updateByOrgUUID () {
-          return { n: 1 }
-        }
-
-        async getOrgUUID () {
-          return null
-        }
-      }
-
-      app.route('/org-updated-id_quota-undefined/:shortname')
-        .put((req, res, next) => {
-          const factory = {
-            getOrgRepository: () => { return new OrgNotUpdatedIdQuotaUndefined() },
-            getUserRepository: () => { return new NullUserRepo() }
-          }
-          req.ctx.repositories = factory
-          next()
-        }, orgParams.parsePostParams, orgController.ORG_UPDATE_SINGLE)
-
-      const testOrg = Object.assign({}, orgFixtures.existentOrg)
-      delete testOrg.policies.id_quota
-
-      chai.request(app)
-        .put(`/org-updated-id_quota-undefined/${testOrg.short_name}`)
-        .set(orgFixtures.secretariatHeader)
-        .send(testOrg)
-        .end((err, res) => {
-          if (err) {
-            done(err)
-          }
-
-          expect(res).to.have.status(200)
-          expect(res).to.have.property('body').and.to.be.a('object')
-          expect(res.body).to.have.property('message').and.to.be.a('string')
-          expect(res.body.message).to.equal(testOrg.short_name + ' organization was successfully updated.')
-          expect(res.body.updated).to.have.nested.property('policies.id_quota').to.equal(1000)
-          done()
-        })
-    })
-
     // check that the org is unchanged
     it('No query parameters are provided', async () => {
       class OrgNotUpdatedNoQueryParameters {
@@ -160,6 +109,10 @@ describe('Testing the PUT /org/:shortname endpoint in Org Controller', () => {
         async getOrgUUID () {
           return null
         }
+
+        async aggregate () {
+          return [orgFixtures.existentOrg]
+        }
       }
 
       app.route('/org-not-updated-no-query-parameters/:shortname')
@@ -172,7 +125,6 @@ describe('Testing the PUT /org/:shortname endpoint in Org Controller', () => {
           next()
         }, orgParams.parsePostParams, orgController.ORG_UPDATE_SINGLE)
 
-      const result = orgFixtures.existentOrg
       const res = await chai.request(app)
         .put(`/org-not-updated-no-query-parameters/${orgFixtures.existentOrg.short_name}`)
         .set(orgFixtures.secretariatHeader)
@@ -185,9 +137,9 @@ describe('Testing the PUT /org/:shortname endpoint in Org Controller', () => {
       expect(res.body.updated.authority.active_roles).to.have.lengthOf(2)
       expect(res.body.updated.policies.id_quota).to.equal(orgFixtures.existentOrg.policies.id_quota)
       expect(res.body.updated.policies.id_quota).to.equal(orgFixtures.existentOrg.policies.id_quota)
-      expect(result).to.have.property('name').to.equal(orgFixtures.existentOrg.name)
-      expect(result).to.have.property('short_name').to.equal(orgFixtures.existentOrg.short_name)
-      expect(result).to.have.property('UUID').to.equal(orgFixtures.existentOrg.UUID)
+      expect(res.body.updated.name).to.equal(orgFixtures.existentOrg.name)
+      expect(res.body.updated.short_name).to.equal(orgFixtures.existentOrg.short_name)
+      expect(res.body.updated.UUID).to.equal(orgFixtures.existentOrg.UUID)
     })
   })
 })
diff --git a/test/unit-tests/user/userCreateTest.js b/test/unit-tests/user/userCreateTest.js
index fc47fa05..91080417 100644
--- a/test/unit-tests/user/userCreateTest.js
+++ b/test/unit-tests/user/userCreateTest.js
@@ -10,6 +10,7 @@ app.use(express.urlencoded({ extended: false })) // Allows us to handle url enco
 const middleware = require('../../../src/middleware/middleware')
 app.use(middleware.createCtxAndReqUUID)
 
+const CONSTANTS = require('../../../src/constants')
 const errors = require('../../../src/controller/org.controller/error')
 const error = new errors.OrgControllerError()
 
@@ -78,6 +79,11 @@ class OrgCreatedUserWithRole {
 }
 
 class UserCreatedAdminWithRole {
+  constructor () {
+    this.testRes1 = JSON.parse(JSON.stringify(userFixtures.userC))
+    this.testRes1.authority.active_roles[0] = CONSTANTS.USER_ROLE_ENUM.ADMIN
+  }
+
   async findOneByUserNameAndOrgUUID () {
     return null
   }
@@ -93,6 +99,16 @@ class UserCreatedAdminWithRole {
   async getUserUUID () {
     return null
   }
+
+  async aggregate () {
+    return [this.testRes1]
+  }
+}
+
+class OrgCantCreateUserOrgDoesNotMatch {
+  async getOrgUUID () {
+    return userFixtures.existentOrg.UUID
+  }
 }
 
 describe('Testing the POST /org/:shortname/user endpoint in Org Controller', () => {
@@ -132,18 +148,8 @@ describe('Testing the POST /org/:shortname/user endpoint in Org Controller', ()
         })
     })
 
-    it('Param org\'s UUID does not match the provided org\'s UUID', (done) => {
-      class OrgCantCreateUserOrgDoesNotMatch {
-        async getOrgUUID () {
-          return userFixtures.existentOrg.UUID
-        }
-
-        async findOneByUUID () {
-          return userFixtures.owningOrg
-        }
-      }
-
-      app.route('/user-not-created-org-does-not-match/:shortname')
+    it('Param org\'s UUID is provided', (done) => {
+      app.route('/user-not-created-org-uuid-provided/:shortname')
         .post((req, res, next) => {
           const factory = {
             getOrgRepository: () => { return new OrgCantCreateUserOrgDoesNotMatch() },
@@ -153,13 +159,39 @@ describe('Testing the POST /org/:shortname/user endpoint in Org Controller', ()
           next()
         }, orgParams.parsePostParams, orgController.USER_CREATE_SINGLE)
 
-      const testUser = Object.assign({}, userFixtures.existentUser)
-      testUser.org_UUID = userFixtures.owningOrg.UUID
+      chai.request(app)
+        .post(`/user-not-created-org-uuid-provided/${userFixtures.existentOrg.short_name}`)
+        .set(userFixtures.secretariatHeader)
+        .send(userFixtures.existentUser)
+        .end((err, res) => {
+          if (err) {
+            done(err)
+          }
+
+          expect(res).to.have.status(400)
+          expect(res).to.have.property('body').and.to.be.a('object')
+          const errObj = error.uuidProvided()
+          expect(res.body.error).to.equal(errObj.error)
+          expect(res.body.message).to.equal(errObj.message)
+          done()
+        })
+    })
+
+    it('Param user\'s UUID is provided', (done) => {
+      app.route('/user-not-created-user-uuid-provided/:shortname')
+        .post((req, res, next) => {
+          const factory = {
+            getOrgRepository: () => { return new OrgCantCreateUserOrgDoesNotMatch() },
+            getUserRepository: () => { return new UserCreatedOrgUndefined() }
+          }
+          req.ctx.repositories = factory
+          next()
+        }, orgParams.parsePostParams, orgController.USER_CREATE_SINGLE)
 
       chai.request(app)
-        .post(`/user-not-created-org-does-not-match/${userFixtures.existentOrg.short_name}`)
+        .post(`/user-not-created-user-uuid-provided/${userFixtures.existentOrg.short_name}`)
         .set(userFixtures.secretariatHeader)
-        .send(testUser)
+        .send(userFixtures.nonExistentUser)
         .end((err, res) => {
           if (err) {
             done(err)
@@ -167,7 +199,7 @@ describe('Testing the POST /org/:shortname/user endpoint in Org Controller', ()
 
           expect(res).to.have.status(400)
           expect(res).to.have.property('body').and.to.be.a('object')
-          const errObj = error.shortnameMismatch(userFixtures.existentOrg.short_name, userFixtures.owningOrg.short_name)
+          const errObj = error.uuidProvided()
           expect(res.body.error).to.equal(errObj.error)
           expect(res.body.message).to.equal(errObj.message)
           done()
@@ -195,10 +227,14 @@ describe('Testing the POST /org/:shortname/user endpoint in Org Controller', ()
           next()
         }, orgParams.parsePostParams, orgController.USER_CREATE_SINGLE)
 
+      const testUser = JSON.parse(JSON.stringify(userFixtures.existentUser))
+      delete testUser.UUID
+      delete testUser.org_UUID
+
       chai.request(app)
         .post(`/user-not-created-already-exists/${userFixtures.existentOrg.short_name}`)
         .set(userFixtures.secretariatHeader)
-        .send(userFixtures.existentUser)
+        .send(testUser)
         .end((err, res) => {
           if (err) {
             done(err)
@@ -213,7 +249,7 @@ describe('Testing the POST /org/:shortname/user endpoint in Org Controller', ()
         })
     })
 
-    it('User is not created because the requester is not an Admin user from the same org and is not the secretariat', done => {
+    it('User is not created because the requester is not an Org Admin user from the same org and is not the secretariat', done => {
       class UserNotCreated {
         async isAdminUUID () {
           return true
@@ -252,7 +288,9 @@ describe('Testing the POST /org/:shortname/user endpoint in Org Controller', ()
           next()
         }, orgParams.parsePostParams, orgController.USER_CREATE_SINGLE)
 
-      const testUser = Object.assign({}, userFixtures.userA)
+      const testUser = JSON.parse(JSON.stringify(userFixtures.userA))
+      delete testUser.UUID
+      delete testUser.org_UUID
       testUser.authority = {
         active_roles: ['ADMIN']
       }
@@ -277,178 +315,13 @@ describe('Testing the POST /org/:shortname/user endpoint in Org Controller', ()
   })
 
   context('Positive Tests', () => {
-    it('User is created when org UUID is undefined', (done) => {
-      app.route('/user-created-org-undefined/:shortname')
-        .post((req, res, next) => {
-          const factory = {
-            getOrgRepository: () => { return new OrgCreatedUserOrgUndefined() },
-            getUserRepository: () => { return new UserCreatedOrgUndefined() }
-          }
-          req.ctx.repositories = factory
-          next()
-        }, orgParams.parsePostParams, orgController.USER_CREATE_SINGLE)
-
-      const testUser = Object.assign({}, userFixtures.nonExistentUser)
-      delete testUser.org_UUID
-
-      chai.request(app)
-        .post(`/user-created-org-undefined/${userFixtures.existentOrg.short_name}`)
-        .set(userFixtures.secretariatHeader)
-        .send(testUser)
-        .end((err, res) => {
-          if (err) {
-            done(err)
-          }
-
-          expect(res).to.have.status(200)
-          expect(res).to.have.property('body').and.to.be.a('object')
-          expect(res.body).to.have.property('message').and.to.be.a('string')
-          expect(res.body.message).to.equal(testUser.username + ' was successfully created.')
-          expect(res.body).to.have.property('created').and.to.be.a('object')
-          expect(res.body.created).to.have.property('org_UUID').and.to.equal(userFixtures.existentOrg.UUID)
-          expect(res.body.created).to.have.property('username').and.to.equal(testUser.username)
-          done()
-        })
-    })
-
-    it('User is created when org UUID is null', (done) => {
-      app.route('/user-created-org-null/:shortname')
-        .post((req, res, next) => {
-          const factory = {
-            getOrgRepository: () => { return new OrgCreatedUserOrgUndefined() },
-            getUserRepository: () => { return new UserCreatedOrgUndefined() }
-          }
-          req.ctx.repositories = factory
-          next()
-        }, orgParams.parsePostParams, orgController.USER_CREATE_SINGLE)
-
-      const testUser = Object.assign({}, userFixtures.nonExistentUser)
-      testUser.org_UUID = null
-
-      chai.request(app)
-        .post(`/user-created-org-null/${userFixtures.existentOrg.short_name}`)
-        .set(userFixtures.secretariatHeader)
-        .send(testUser)
-        .end((err, res) => {
-          if (err) {
-            done(err)
-          }
-
-          expect(res).to.have.status(200)
-          expect(res).to.have.property('body').and.to.be.a('object')
-          expect(res.body).to.have.property('message').and.to.be.a('string')
-          expect(res.body.message).to.equal(testUser.username + ' was successfully created.')
-          expect(res.body).to.have.property('created').and.to.be.a('object')
-          expect(res.body.created).to.have.property('org_UUID').and.to.equal(userFixtures.existentOrg.UUID)
-          expect(res.body.created).to.have.property('username').and.to.equal(testUser.username)
-          done()
-        })
-    })
-
-    it('User is created when user UUID is undefined', (done) => {
-      app.route('/user-created-uuid-undefined/:shortname')
-        .post((req, res, next) => {
-          const factory = {
-            getOrgRepository: () => { return new OrgCreatedUserOrgUndefined() },
-            getUserRepository: () => { return new UserCreatedOrgUndefined() }
-          }
-          req.ctx.repositories = factory
-          next()
-        }, orgParams.parsePostParams, orgController.USER_CREATE_SINGLE)
-
-      const testUser = Object.assign({}, userFixtures.nonExistentUser)
-      delete testUser.UUID
-
-      chai.request(app)
-        .post(`/user-created-uuid-undefined/${userFixtures.existentOrg.short_name}`)
-        .set(userFixtures.secretariatHeader)
-        .send(testUser)
-        .end((err, res) => {
-          if (err) {
-            done(err)
-          }
-
-          expect(res).to.have.status(200)
-          expect(res).to.have.property('body').and.to.be.a('object')
-          expect(res.body).to.have.property('message').and.to.be.a('string')
-          expect(res.body.message).to.equal(testUser.username + ' was successfully created.')
-          expect(res.body).to.have.property('created').and.to.be.a('object')
-          expect(res.body.created).to.have.property('org_UUID').and.to.equal(testUser.org_UUID)
-          expect(res.body.created).to.have.property('username').and.to.equal(testUser.username)
-          expect(res.body.created).to.have.property('UUID').and.to.be.a('string')
-          done()
-        })
-    })
-
-    it('User is created when UUID is null', (done) => {
-      app.route('/user-created-uuid-null/:shortname')
-        .post((req, res, next) => {
-          const factory = {
-            getOrgRepository: () => { return new OrgCreatedUserOrgUndefined() },
-            getUserRepository: () => { return new UserCreatedOrgUndefined() }
-          }
-          req.ctx.repositories = factory
-          next()
-        }, orgParams.parsePostParams, orgController.USER_CREATE_SINGLE)
-
-      const testUser = Object.assign({}, userFixtures.nonExistentUser)
-      testUser.UUID = null
-
-      chai.request(app)
-        .post(`/user-created-uuid-null/${userFixtures.existentOrg.short_name}`)
-        .set(userFixtures.secretariatHeader)
-        .send(testUser)
-        .end((err, res) => {
-          if (err) {
-            done(err)
-          }
-
-          expect(res).to.have.status(200)
-          expect(res).to.have.property('body').and.to.be.a('object')
-          expect(res.body).to.have.property('message').and.to.be.a('string')
-          expect(res.body.message).to.equal(testUser.username + ' was successfully created.')
-          expect(res.body).to.have.property('created').and.to.be.a('object')
-          expect(res.body.created).to.have.property('org_UUID').and.to.equal(testUser.org_UUID)
-          expect(res.body.created).to.have.property('username').and.to.equal(testUser.username)
-          expect(res.body.created).to.have.property('UUID').and.to.be.a('string')
-          done()
-        })
-    })
-
-    it('User is created when UUID is defined', (done) => {
-      app.route('/user-created-uuid-defined/:shortname')
-        .post((req, res, next) => {
-          const factory = {
-            getOrgRepository: () => { return new OrgCreatedUserOrgUndefined() },
-            getUserRepository: () => { return new UserCreatedOrgUndefined() }
-          }
-          req.ctx.repositories = factory
-          next()
-        }, orgParams.parsePostParams, orgController.USER_CREATE_SINGLE)
-
-      chai.request(app)
-        .post(`/user-created-uuid-defined/${userFixtures.existentOrg.short_name}`)
-        .set(userFixtures.secretariatHeader)
-        .send(userFixtures.nonExistentUser)
-        .end((err, res) => {
-          if (err) {
-            done(err)
-          }
-
-          expect(res).to.have.status(200)
-          expect(res).to.have.property('body').and.to.be.a('object')
-          expect(res.body).to.have.property('message').and.to.be.a('string')
-          expect(res.body.message).to.equal(userFixtures.nonExistentUser.username + ' was successfully created.')
-          expect(res.body).to.have.property('created').and.to.be.a('object')
-          expect(res.body.created).to.have.property('org_UUID').and.to.equal(userFixtures.nonExistentUser.org_UUID)
-          expect(res.body.created).to.have.property('username').and.to.equal(userFixtures.nonExistentUser.username)
-          expect(res.body.created).to.have.property('UUID').and.to.equal(userFixtures.nonExistentUser.UUID)
-          done()
-        })
-    })
-
     it('Requester is secretariat and not Admin: User is created with the "ADMIN" role', done => {
       class UserCreatedWithRole {
+        constructor () {
+          this.testRes1 = JSON.parse(JSON.stringify(userFixtures.userA))
+          this.testRes1.authority.active_roles[0] = CONSTANTS.USER_ROLE_ENUM.ADMIN
+        }
+
         async findOneByUserNameAndOrgUUID () {
           return null
         }
@@ -464,6 +337,10 @@ describe('Testing the POST /org/:shortname/user endpoint in Org Controller', ()
         async getUserUUID () {
           return null
         }
+
+        async aggregate () {
+          return [this.testRes1]
+        }
       }
 
       app.route('/user-created-secretariat-not-admin/:shortname')
@@ -476,7 +353,9 @@ describe('Testing the POST /org/:shortname/user endpoint in Org Controller', ()
           next()
         }, orgParams.parsePostParams, orgController.USER_CREATE_SINGLE)
 
-      const testUser = Object.assign({}, userFixtures.userA)
+      const testUser = JSON.parse(JSON.stringify(userFixtures.userA))
+      delete testUser.UUID
+      delete testUser.org_UUID
       testUser.authority = {
         active_roles: ['ADMIN']
       }
@@ -529,7 +408,9 @@ describe('Testing the POST /org/:shortname/user endpoint in Org Controller', ()
         }, orgParams.parsePostParams, orgController.USER_CREATE_SINGLE)
 
       userFixtures.userA.authority.active_roles = ['ADMIN']
-      const testUser = Object.assign({}, userFixtures.userC)
+      const testUser = JSON.parse(JSON.stringify(userFixtures.userC))
+      delete testUser.UUID
+      delete testUser.org_UUID
       testUser.authority = {
         active_roles: ['ADMIN']
       }
@@ -558,22 +439,47 @@ describe('Testing the POST /org/:shortname/user endpoint in Org Controller', ()
     })
 
     it('Requester is secretariat and Admin: User is created without a user role', done => {
+      class UserCreatedAdminWithoutRole {
+        async findOneByUserNameAndOrgUUID () {
+          return null
+        }
+
+        async isAdminUUID () {
+          return true
+        }
+
+        async updateByUserNameAndOrgUUID () {
+          return null
+        }
+
+        async getUserUUID () {
+          return null
+        }
+
+        async aggregate () {
+          return [userFixtures.userA]
+        }
+      }
+
       app.route('/user-created-secretariat-same-org-admin/:shortname')
         .post((req, res, next) => {
           const factory = {
             getOrgRepository: () => { return new OrgCreatedUserWithRole() },
-            getUserRepository: () => { return new UserCreatedAdminWithRole() }
+            getUserRepository: () => { return new UserCreatedAdminWithoutRole() }
           }
           req.ctx.repositories = factory
           next()
         }, orgParams.parsePostParams, orgController.USER_CREATE_SINGLE)
 
       userFixtures.existentUser.authority.active_roles = ['ADMIN']
+      const testUser = JSON.parse(JSON.stringify(userFixtures.userA))
+      delete testUser.UUID
+      delete testUser.org_UUID
 
       chai.request(app)
         .post(`/user-created-secretariat-same-org-admin/${userFixtures.existentOrgDummy.short_name}`)
         .set(userFixtures.secretariatHeader)
-        .send(userFixtures.userA)
+        .send(testUser)
         .end((err, res) => {
           if (err) {
             done(err)
diff --git a/test/unit-tests/user/userUpdateTest.js b/test/unit-tests/user/userUpdateTest.js
index 4b3f0cdd..d67c6f61 100644
--- a/test/unit-tests/user/userUpdateTest.js
+++ b/test/unit-tests/user/userUpdateTest.js
@@ -54,6 +54,9 @@ class UserUpdatedAddingRole {
       },
       secret: userFixtures.existentUserDummy.secret
     }
+
+    this.testRes1 = JSON.parse(JSON.stringify(userFixtures.existentUserDummy))
+    this.testRes1.authority.active_roles = [CONSTANTS.USER_ROLE_ENUM.ADMIN]
   }
 
   getUser () {
@@ -76,6 +79,10 @@ class UserUpdatedAddingRole {
   async isAdmin () {
     return true
   }
+
+  async aggregate () {
+    return [this.testRes1]
+  }
 }
 
 describe('Testing the PUT /org/:shortname/user/:username endpoint in Org Controller', () => {
@@ -383,7 +390,6 @@ describe('Testing the PUT /org/:shortname/user/:username endpoint in Org Control
           next()
         }, orgParams.parsePostParams, orgController.USER_UPDATE_SINGLE)
 
-      const userTestRepo = new UserUpdatedAddingRole()
       const testUser = Object.assign({}, userFixtures.existentUserDummy)
       testUser.authority = {
         active_roles: [CONSTANTS.USER_ROLE_ENUM.ADMIN]
@@ -397,24 +403,21 @@ describe('Testing the PUT /org/:shortname/user/:username endpoint in Org Control
             done(err)
           }
 
-          const user = userTestRepo.getUser()
           expect(res).to.have.status(200)
           expect(res).to.have.property('body').and.to.be.a('object')
           expect(res.body).to.have.property('updated').and.to.be.a('object')
           expect(res.body.updated.authority.active_roles).to.have.lengthOf(1)
-          expect(res.body.updated.authority.active_roles[0]).to.equal(CONSTANTS.USER_ROLE_ENUM.ADMIN)
-          expect(user.authority.active_roles).to.have.lengthOf(1)
-          expect(user.authority.active_roles[0]).to.equal(testUser.authority.active_roles[0])
-          expect(user.org_UUID).to.equal(testUser.org_UUID)
-          expect(user.username).to.equal(testUser.username)
-          expect(user.UUID).to.equal(testUser.UUID)
-          expect(user.secret).to.equal(testUser.secret)
-          expect(user.active).to.equal(testUser.active)
-          expect(user.name.first).to.equal(testUser.name.first)
-          expect(user.name.last).to.equal(testUser.name.last)
-          expect(user.name.middle).to.equal(testUser.name.middle)
-          expect(user.name.suffix).to.equal(testUser.name.suffix)
-          expect(user.name.surname).to.equal(testUser.name.surname)
+          expect(res.body.updated.authority.active_roles[0]).to.equal(testUser.authority.active_roles[0])
+          expect(res.body.updated.org_UUID).to.equal(testUser.org_UUID)
+          expect(res.body.updated.username).to.equal(testUser.username)
+          expect(res.body.updated.UUID).to.equal(testUser.UUID)
+          expect(res.body.updated.secret).to.equal(testUser.secret)
+          expect(res.body.updated.active).to.equal(testUser.active)
+          expect(res.body.updated.name.first).to.equal(testUser.name.first)
+          expect(res.body.updated.name.last).to.equal(testUser.name.last)
+          expect(res.body.updated.name.middle).to.equal(testUser.name.middle)
+          expect(res.body.updated.name.suffix).to.equal(testUser.name.suffix)
+          expect(res.body.updated.name.surname).to.equal(testUser.name.surname)
           done()
         })
     })
@@ -433,6 +436,9 @@ describe('Testing the PUT /org/:shortname/user/:username endpoint in Org Control
             },
             secret: userFixtures.existentUserDummy.secret
           }
+
+          this.testRes1 = JSON.parse(JSON.stringify(userFixtures.existentUserDummy))
+          this.testRes1.authority.active_roles = [CONSTANTS.USER_ROLE_ENUM.ADMIN]
         }
 
         getUser () {
@@ -454,6 +460,10 @@ describe('Testing the PUT /org/:shortname/user/:username endpoint in Org Control
         async isAdmin () {
           return false
         }
+
+        async aggregate () {
+          return [this.testRes1]
+        }
       }
 
       app.route('/user-updated-adding-role-2/:shortname/:username')
@@ -466,7 +476,6 @@ describe('Testing the PUT /org/:shortname/user/:username endpoint in Org Control
           next()
         }, orgParams.parsePostParams, orgController.USER_UPDATE_SINGLE)
 
-      const userTestRepo = new UserUpdatedAddingRoleAlreadyExists()
       const testUser = Object.assign({}, userFixtures.existentUserDummy)
       testUser.authority = {
         active_roles: [CONSTANTS.USER_ROLE_ENUM.ADMIN]
@@ -480,24 +489,21 @@ describe('Testing the PUT /org/:shortname/user/:username endpoint in Org Control
             done(err)
           }
 
-          const user = userTestRepo.getUser()
           expect(res).to.have.status(200)
           expect(res).to.have.property('body').and.to.be.a('object')
           expect(res.body).to.have.property('updated').and.to.be.a('object')
           expect(res.body.updated.authority.active_roles).to.have.lengthOf(1)
-          expect(res.body.updated.authority.active_roles[0]).to.equal(CONSTANTS.USER_ROLE_ENUM.ADMIN)
-          expect(user.authority.active_roles).to.have.lengthOf(1)
-          expect(user.authority.active_roles[0]).to.equal(testUser.authority.active_roles[0])
-          expect(user.org_UUID).to.equal(testUser.org_UUID)
-          expect(user.username).to.equal(testUser.username)
-          expect(user.UUID).to.equal(testUser.UUID)
-          expect(user.secret).to.equal(testUser.secret)
-          expect(user.active).to.equal(testUser.active)
-          expect(user.name.first).to.equal(testUser.name.first)
-          expect(user.name.last).to.equal(testUser.name.last)
-          expect(user.name.middle).to.equal(testUser.name.middle)
-          expect(user.name.suffix).to.equal(testUser.name.suffix)
-          expect(user.name.surname).to.equal(testUser.name.surname)
+          expect(res.body.updated.authority.active_roles[0]).to.equal(testUser.authority.active_roles[0])
+          expect(res.body.updated.org_UUID).to.equal(testUser.org_UUID)
+          expect(res.body.updated.username).to.equal(testUser.username)
+          expect(res.body.updated.UUID).to.equal(testUser.UUID)
+          expect(res.body.updated.secret).to.equal(testUser.secret)
+          expect(res.body.updated.active).to.equal(testUser.active)
+          expect(res.body.updated.name.first).to.equal(testUser.name.first)
+          expect(res.body.updated.name.last).to.equal(testUser.name.last)
+          expect(res.body.updated.name.middle).to.equal(testUser.name.middle)
+          expect(res.body.updated.name.suffix).to.equal(testUser.name.suffix)
+          expect(res.body.updated.name.surname).to.equal(testUser.name.surname)
           done()
         })
     })
@@ -516,6 +522,9 @@ describe('Testing the PUT /org/:shortname/user/:username endpoint in Org Control
             },
             secret: userFixtures.existentUserDummy.secret
           }
+
+          this.testRes1 = JSON.parse(JSON.stringify(userFixtures.existentUserDummy))
+          this.testRes1.authority.active_roles = []
         }
 
         getUser () {
@@ -538,6 +547,10 @@ describe('Testing the PUT /org/:shortname/user/:username endpoint in Org Control
         async isAdmin () {
           return false
         }
+
+        async aggregate () {
+          return [this.testRes1]
+        }
       }
 
       app.route('/user-updated-removing-role-1/:shortname/:username')
@@ -550,7 +563,6 @@ describe('Testing the PUT /org/:shortname/user/:username endpoint in Org Control
           next()
         }, orgParams.parsePostParams, orgController.USER_UPDATE_SINGLE)
 
-      const userTestRepo = new UserUpdatedRemovingRole()
       const testUser = Object.assign({}, userFixtures.existentUserDummy)
       testUser.authority = {
         active_roles: [CONSTANTS.USER_ROLE_ENUM.ADMIN]
@@ -564,22 +576,20 @@ describe('Testing the PUT /org/:shortname/user/:username endpoint in Org Control
             done(err)
           }
 
-          const user = userTestRepo.getUser()
           expect(res).to.have.status(200)
           expect(res).to.have.property('body').and.to.be.a('object')
           expect(res.body).to.have.property('updated').and.to.be.a('object')
           expect(res.body.updated.authority.active_roles).to.have.lengthOf(0)
-          expect(user.authority.active_roles).to.have.lengthOf(0)
-          expect(user.org_UUID).to.equal(testUser.org_UUID)
-          expect(user.username).to.equal(testUser.username)
-          expect(user.UUID).to.equal(testUser.UUID)
-          expect(user.secret).to.equal(testUser.secret)
-          expect(user.active).to.equal(testUser.active)
-          expect(user.name.first).to.equal(testUser.name.first)
-          expect(user.name.last).to.equal(testUser.name.last)
-          expect(user.name.middle).to.equal(testUser.name.middle)
-          expect(user.name.suffix).to.equal(testUser.name.suffix)
-          expect(user.name.surname).to.equal(testUser.name.surname)
+          expect(res.body.updated.org_UUID).to.equal(testUser.org_UUID)
+          expect(res.body.updated.username).to.equal(testUser.username)
+          expect(res.body.updated.UUID).to.equal(testUser.UUID)
+          expect(res.body.updated.secret).to.equal(testUser.secret)
+          expect(res.body.updated.active).to.equal(testUser.active)
+          expect(res.body.updated.name.first).to.equal(testUser.name.first)
+          expect(res.body.updated.name.last).to.equal(testUser.name.last)
+          expect(res.body.updated.name.middle).to.equal(testUser.name.middle)
+          expect(res.body.updated.name.suffix).to.equal(testUser.name.suffix)
+          expect(res.body.updated.name.surname).to.equal(testUser.name.surname)
           done()
         })
     })
@@ -617,6 +627,10 @@ describe('Testing the PUT /org/:shortname/user/:username endpoint in Org Control
         async isAdmin () {
           return false
         }
+
+        async aggregate () {
+          return [this.user]
+        }
       }
 
       app.route('/user-updated-removing-role-2/:shortname/:username')
@@ -629,8 +643,6 @@ describe('Testing the PUT /org/:shortname/user/:username endpoint in Org Control
           next()
         }, orgParams.parsePostParams, orgController.USER_UPDATE_SINGLE)
 
-      const userTestRepo = new UserUpdatedRemovingRoleAlreadyRemoved()
-
       chai.request(app)
         .put(`/user-updated-removing-role-2/${userFixtures.owningOrg.short_name}/${userFixtures.existentUserDummy.username}?active_roles.remove=${CONSTANTS.USER_ROLE_ENUM.ADMIN}&active_roles.remove=${CONSTANTS.USER_ROLE_ENUM.ADMIN}`)
         .set(userFixtures.secretariatHeader)
@@ -639,22 +651,20 @@ describe('Testing the PUT /org/:shortname/user/:username endpoint in Org Control
             done(err)
           }
 
-          const user = userTestRepo.getUser()
           expect(res).to.have.status(200)
           expect(res).to.have.property('body').and.to.be.a('object')
           expect(res.body).to.have.property('updated').and.to.be.a('object')
           expect(res.body.updated.authority.active_roles).to.have.lengthOf(0)
-          expect(user.authority.active_roles).to.have.lengthOf(0)
-          expect(user.org_UUID).to.equal(userFixtures.existentUserDummy.org_UUID)
-          expect(user.username).to.equal(userFixtures.existentUserDummy.username)
-          expect(user.UUID).to.equal(userFixtures.existentUserDummy.UUID)
-          expect(user.secret).to.equal(userFixtures.existentUserDummy.secret)
-          expect(user.active).to.equal(userFixtures.existentUserDummy.active)
-          expect(user.name.first).to.equal(userFixtures.existentUserDummy.name.first)
-          expect(user.name.last).to.equal(userFixtures.existentUserDummy.name.last)
-          expect(user.name.middle).to.equal(userFixtures.existentUserDummy.name.middle)
-          expect(user.name.suffix).to.equal(userFixtures.existentUserDummy.name.suffix)
-          expect(user.name.surname).to.equal(userFixtures.existentUserDummy.name.surname)
+          expect(res.body.updated.org_UUID).to.equal(userFixtures.existentUserDummy.org_UUID)
+          expect(res.body.updated.username).to.equal(userFixtures.existentUserDummy.username)
+          expect(res.body.updated.UUID).to.equal(userFixtures.existentUserDummy.UUID)
+          expect(res.body.updated.secret).to.equal(userFixtures.existentUserDummy.secret)
+          expect(res.body.updated.active).to.equal(userFixtures.existentUserDummy.active)
+          expect(res.body.updated.name.first).to.equal(userFixtures.existentUserDummy.name.first)
+          expect(res.body.updated.name.last).to.equal(userFixtures.existentUserDummy.name.last)
+          expect(res.body.updated.name.middle).to.equal(userFixtures.existentUserDummy.name.middle)
+          expect(res.body.updated.name.suffix).to.equal(userFixtures.existentUserDummy.name.suffix)
+          expect(res.body.updated.name.surname).to.equal(userFixtures.existentUserDummy.name.surname)
           done()
         })
     })
@@ -671,6 +681,11 @@ describe('Testing the PUT /org/:shortname/user/:username endpoint in Org Control
       }
 
       class User {
+        constructor () {
+          this.testRes1 = JSON.parse(JSON.stringify(userFixtures.userA))
+          this.testRes1.active = false
+        }
+
         async findOneByUserNameAndOrgUUID () {
           return userFixtures.userA
         }
@@ -688,6 +703,10 @@ describe('Testing the PUT /org/:shortname/user/:username endpoint in Org Control
         async getUserUUID () {
           return userFixtures.userD.UUID
         }
+
+        async aggregate () {
+          return [this.testRes1]
+        }
       }
 
       app.route('/user-updated-requestor-admin-deactivate-user/:shortname/:username')
@@ -707,6 +726,7 @@ describe('Testing the PUT /org/:shortname/user/:username endpoint in Org Control
           if (err) {
             done(err)
           }
+
           expect(res).to.have.status(200)
           expect(res).to.have.property('body').and.to.be.a('object')
           expect(res.body).to.have.property('updated').and.to.be.a('object')
@@ -727,6 +747,11 @@ describe('Testing the PUT /org/:shortname/user/:username endpoint in Org Control
       }
 
       class User {
+        constructor () {
+          this.testRes1 = JSON.parse(JSON.stringify(userFixtures.userA))
+          this.testRes1.username = 'TESTER'
+        }
+
         async findOneByUserNameAndOrgUUID () {
           return userFixtures.userA
         }
@@ -748,6 +773,10 @@ describe('Testing the PUT /org/:shortname/user/:username endpoint in Org Control
         async find () {
           return []
         }
+
+        async aggregate () {
+          return [this.testRes1]
+        }
       }
 
       app.route('/user-updated-requestor-user-username-changed/:shortname/:username')
@@ -793,6 +822,10 @@ describe('Testing the PUT /org/:shortname/user/:username endpoint in Org Control
         async isAdmin () {
           return false
         }
+
+        async aggregate () {
+          return [userFixtures.existentUser]
+        }
       }
 
       app.route('/user-not-updated-no-parameters/:shortname/:username')
@@ -805,8 +838,6 @@ describe('Testing the PUT /org/:shortname/user/:username endpoint in Org Control
           next()
         }, orgParams.parsePostParams, orgController.USER_UPDATE_SINGLE)
 
-      const result = userFixtures.existentUser
-
       const res = await chai.request(app)
         .put(`/user-not-updated-no-parameters/${userFixtures.existentOrg.short_name}/${userFixtures.existentUser.username}`)
         .set(userFixtures.secretariatHeader)
@@ -815,16 +846,16 @@ describe('Testing the PUT /org/:shortname/user/:username endpoint in Org Control
       expect(res).to.have.property('body').and.to.be.a('object')
       expect(res.body).to.have.property('updated').and.to.be.a('object')
       expect(res.body.updated.authority.active_roles[0]).to.equal(userFixtures.existentUser.authority.active_roles[0])
-      expect(result.org_UUID).to.equal(userFixtures.existentUser.org_UUID)
-      expect(result.username).to.equal(userFixtures.existentUser.username)
-      expect(result.UUID).to.equal(userFixtures.existentUser.UUID)
-      expect(result.secret).to.equal(userFixtures.existentUser.secret)
-      expect(result.active).to.equal(userFixtures.existentUser.active)
-      expect(result.name.first).to.equal(userFixtures.existentUser.name.first)
-      expect(result.name.last).to.equal(userFixtures.existentUser.name.last)
-      expect(result.name.middle).to.equal(userFixtures.existentUser.name.middle)
-      expect(result.name.suffix).to.equal(userFixtures.existentUser.name.suffix)
-      expect(result.name.surname).to.equal(userFixtures.existentUser.name.surname)
+      expect(res.body.updated.org_UUID).to.equal(userFixtures.existentUser.org_UUID)
+      expect(res.body.updated.username).to.equal(userFixtures.existentUser.username)
+      expect(res.body.updated.UUID).to.equal(userFixtures.existentUser.UUID)
+      expect(res.body.updated.secret).to.equal(userFixtures.existentUser.secret)
+      expect(res.body.updated.active).to.equal(userFixtures.existentUser.active)
+      expect(res.body.updated.name.first).to.equal(userFixtures.existentUser.name.first)
+      expect(res.body.updated.name.last).to.equal(userFixtures.existentUser.name.last)
+      expect(res.body.updated.name.middle).to.equal(userFixtures.existentUser.name.middle)
+      expect(res.body.updated.name.suffix).to.equal(userFixtures.existentUser.name.suffix)
+      expect(res.body.updated.name.surname).to.equal(userFixtures.existentUser.name.surname)
     })
   })
 })