Repository: CVEProject/cve-services
Pull request #1093 (2023-07-10 14:02:29)

Updating Int with dev
Updating int from dev with changes from Sprint 31


Patch:
diff --git a/.eslintrc.js b/.eslintrc.js
index a1f7a573..12c3d870 100644
--- a/.eslintrc.js
+++ b/.eslintrc.js
@@ -15,6 +15,7 @@ module.exports = {
     'mocha'
   ],
   rules: {
-    'mocha/no-mocha-arrows': 'off'
+    'mocha/no-mocha-arrows': 'off',
+    'linebreak-style': ['error', 'unix'] // Force Linting to use unix line endings.
   }
 }
diff --git a/.gitattributes b/.gitattributes
new file mode 100644
index 00000000..6c02e91f
--- /dev/null
+++ b/.gitattributes
@@ -0,0 +1,2 @@
+# Ensure Git does not commit any crlf endings. Force LF in git.
+text eol=lf
\ No newline at end of file
diff --git a/README.md b/README.md
index 128307cb..5da89193 100644
--- a/README.md
+++ b/README.md
@@ -1,139 +1,139 @@
-# CVE-API
-
-![CodeQL](https://github.com/CVEProject/cve-services/workflows/CodeQL/badge.svg)
-
-## Table of contents
-
-* [Project](#project)
-* [Contributing](#contributing)
-   * [Security](#security)
-      * [Reporting a Vulnerability](#reporting-a-vulnerability)
-* [Development](#development)
-   * [Technologies](#technologies)
-   * [Style Guidelines](#style-guidelines)
-   * [Directory Layout](#directory-layout)
-   * [Setup](#setup)
-   * [API Documentation](#api-documentation)
-   * [Unit Testing](#unit-testing)
-
-## The CVE Services Project
-
-This repository contains services that support the [CVE Program's mission](https://www.cve.org/About/Overview) to "identify, define, and catalog publicly disclosed cybersecurity vulnerabilities."
-
-There are many ways one can assist:
-
-### OSS Contributor
-
-Developers can contribute code directly. Getting started can be as fast as choosing an issue on our [board](https://github.com/CVEProject/cve-services/issues?q=is%3Aissue+is%3Aopen).
-
-Please read our [contributor's guide](https://github.com/CVEProject/cve-services/blob/dev/CONTRIBUTING.md) for more details. We welcome all contributions!
-
-### Working Groups
-
-The CVE project operates as multiple focused working groups. Visit the CVE Website [working groups page](https://www.cve.org/ProgramOrganization/WorkingGroups) for more information.
-
-### Security
-
-#### Reporting a Vulnerability
-
->**Warning**
->Do not put vulnerability information in a GitHub issue.
-
-Please consult our [SECURITY.md](https://github.com/CVEProject/cve-services/blob/dev/SECURITY.md) for specific instructions on reporting a vulnerability that exists in the CVE Services.
-
-## Development
-
-### Technologies
-
-This project uses or depends on software from
-
-- [NodeJS](https://nodejs.org/)
-- [Express](https://github.com/expressjs)
-- [MongoDB for locally run instances](https://www.mongodb.com/)
-- [Mongoose.js](https://mongoosejs.com)
-
-### Style Guidelines
-
-This project follows the [JavaScript Standard Style](https://github.com/standard/standard).
-
-### Setup
-
-#### Docker
-
-See the Docker README found in the repo here: https://github.com/CVEProject/cve-services/blob/dev/docker/README.md
-
-#### Local Development
-
->**Warning**
->
->DO NOT use the dev configuration on a public network. The dev environment includes credentials to enable rapid development and is not secure for public deployment.
-
-1. Install required node modules
-
-This assumes `node` 16.14.2 and the latest `npm` are installed.
-
-```sh
-cd cve-services
-npm install
-```
-
-2. Setup and start MongoDB locally
-
-Install MongoDB locally
-
-- https://docs.mongodb.com/manual/administration/install-community/
-
-Download MongoDB Compass (MongoDB GUI)
-
-- https://www.mongodb.com/download-center/compass
-
-Create a `cve_dev` database in Compass. The collections will be automatically created when the API starts storing documents.
-
-You can populate the database with test data using:
-
-```sh
-npm run populate:dev
-```
-
-3. Start the node application
-
-In order to start a dev environment:
-
-```sh
-npm run start:dev
-```
-
-
-### API Documentation
-
-API documentation is generated using [swagger-autogen](https://github.com/davibaltar/swagger-autogen) which ensures that we keep the API specification up to date with any major changes to API routes. Extra information for each API route is defined as a comment in the `index.js` files under the respective controller and all request and response schemas are stored under the `schemas` folder served up by `schemas.controller`.
-
-To ensure you are using the correct API specification the following endpoints can be used:
-- [Test Instance](https://cveawg-test.mitre.org/api-docs/)
-- [Production](https://cveawg.mitre.org/api-docs/)
-
-Note: The specification file stored in GitHub will only be correct for that branch; there could be differences between branches and production.
-
-If you are developer and want to test changes to the API specification you can generate a specification in one of two ways:
-
-1. Preferred
-
-When you start your local development server using `npm run start:dev` the specification file will be generated. Subsequent changes require reloading the server.
-
-2. Manual
-
-You can use `npm run swagger-autogen` to generate a new specification file.
-
-
-### Unit Testing
-
-This project uses the following for unit testing
-
-- https://mochajs.org/
-- https://www.chaijs.com/
-
-In order to run the unit tests:
-
-```sh
-npm run start:test
-```
+# CVE-API
+
+![CodeQL](https://github.com/CVEProject/cve-services/workflows/CodeQL/badge.svg)
+
+## Table of contents
+
+* [Project](#project)
+* [Contributing](#contributing)
+   * [Security](#security)
+      * [Reporting a Vulnerability](#reporting-a-vulnerability)
+* [Development](#development)
+   * [Technologies](#technologies)
+   * [Style Guidelines](#style-guidelines)
+   * [Directory Layout](#directory-layout)
+   * [Setup](#setup)
+   * [API Documentation](#api-documentation)
+   * [Unit Testing](#unit-testing)
+
+## The CVE Services Project
+
+This repository contains services that support the [CVE Program's mission](https://www.cve.org/About/Overview) to "identify, define, and catalog publicly disclosed cybersecurity vulnerabilities."
+
+There are many ways one can assist:
+
+### OSS Contributor
+
+Developers can contribute code directly. Getting started can be as fast as choosing an issue on our [board](https://github.com/CVEProject/cve-services/issues?q=is%3Aissue+is%3Aopen).
+
+Please read our [contributor's guide](https://github.com/CVEProject/cve-services/blob/dev/CONTRIBUTING.md) for more details. We welcome all contributions!
+
+### Working Groups
+
+The CVE project operates as multiple focused working groups. Visit the CVE Website [working groups page](https://www.cve.org/ProgramOrganization/WorkingGroups) for more information.
+
+### Security
+
+#### Reporting a Vulnerability
+
+>**Warning**
+>Do not put vulnerability information in a GitHub issue.
+
+Please consult our [SECURITY.md](https://github.com/CVEProject/cve-services/blob/dev/SECURITY.md) for specific instructions on reporting a vulnerability that exists in the CVE Services.
+
+## Development
+
+### Technologies
+
+This project uses or depends on software from
+
+- [NodeJS](https://nodejs.org/)
+- [Express](https://github.com/expressjs)
+- [MongoDB for locally run instances](https://www.mongodb.com/)
+- [Mongoose.js](https://mongoosejs.com)
+
+### Style Guidelines
+
+This project follows the [JavaScript Standard Style](https://github.com/standard/standard).
+
+### Setup
+
+#### Docker
+
+See the Docker README found in the repo here: https://github.com/CVEProject/cve-services/blob/dev/docker/README.md
+
+#### Local Development
+
+>**Warning**
+>
+>DO NOT use the dev configuration on a public network. The dev environment includes credentials to enable rapid development and is not secure for public deployment.
+
+1. Install required node modules
+
+This assumes `node` 16.14.2 and the latest `npm` are installed.
+
+```sh
+cd cve-services
+npm install
+```
+
+2. Setup and start MongoDB locally
+
+Install MongoDB locally
+
+- https://docs.mongodb.com/manual/administration/install-community/
+
+Download MongoDB Compass (MongoDB GUI)
+
+- https://www.mongodb.com/download-center/compass
+
+Create a `cve_dev` database in Compass. The collections will be automatically created when the API starts storing documents.
+
+You can populate the database with test data using:
+
+```sh
+npm run populate:dev
+```
+
+3. Start the node application
+
+In order to start a dev environment:
+
+```sh
+npm run start:dev
+```
+
+
+### API Documentation
+
+API documentation is generated using [swagger-autogen](https://github.com/davibaltar/swagger-autogen) which ensures that we keep the API specification up to date with any major changes to API routes. Extra information for each API route is defined as a comment in the `index.js` files under the respective controller and all request and response schemas are stored under the `schemas` folder served up by `schemas.controller`.
+
+To ensure you are using the correct API specification the following endpoints can be used:
+- [Test Instance](https://cveawg-test.mitre.org/api-docs/)
+- [Production](https://cveawg.mitre.org/api-docs/)
+
+Note: The specification file stored in GitHub will only be correct for that branch; there could be differences between branches and production.
+
+If you are developer and want to test changes to the API specification you can generate a specification in one of two ways:
+
+1. Preferred
+
+When you start your local development server using `npm run start:dev` the specification file will be generated. Subsequent changes require reloading the server.
+
+2. Manual
+
+You can use `npm run swagger-autogen` to generate a new specification file.
+
+
+### Unit Testing
+
+This project uses the following for unit testing
+
+- https://mochajs.org/
+- https://www.chaijs.com/
+
+In order to run the unit tests:
+
+```sh
+npm run start:test
+```
diff --git a/api-docs/openapi.json b/api-docs/openapi.json
index b5d50047..e08fc81f 100644
--- a/api-docs/openapi.json
+++ b/api-docs/openapi.json
@@ -832,6 +832,12 @@
           },
           {
             "$ref": "#/components/parameters/pageQuery"
+          },
+          {
+            "$ref": "#/components/parameters/cnaModified"
+          },
+          {
+            "$ref": "#/components/parameters/adpShortName"
           }
         ],
         "responses": {
@@ -2644,6 +2650,24 @@
           "type": "boolean"
         }
       },
+      "cnaModified": {
+        "in": "query",
+        "name": "cna_modified",
+        "description": "Only get CVE records with cnaContainers that have been modified/created within the set time_modified range. Requires at least one time_modified parameter set",
+        "required": false,
+        "schema": {
+          "type": "boolean"
+        }
+      },
+      "adpShortName": {
+        "in": "query",
+        "name": "adp_short_name",
+        "description": "Only get CVE records that have an adpContainer owned by this org and that has been modified/created within the set time_modified range. Requires at least one time_modified parameter set",
+        "required": false,
+        "schema": {
+          "type": "string"
+        }
+      },
       "cveState": {
         "in": "query",
         "name": "state",
diff --git a/config/default.json b/config/default.json
index eedc163c..8fe381aa 100644
--- a/config/default.json
+++ b/config/default.json
@@ -1,33 +1,33 @@
-{
-  "test": {
-    "database": "cve_test",
-    "host": "localhost",
-    "port": 27017
-  },
-  "development": {
-    "database": "cve_dev",
-    "host": "localhost",
-    "port": 27017
-  },
-  "staging": {
-    "username": null,
-    "password": null,
-    "database": "cve_stage",
-    "host": "localhost",
-    "port": 27017
-  },
-  "integration": {
-    "username": null,
-    "password": null,
-    "database": "cve_int",
-    "host": "localhost",
-    "port": 27017
-  },
-  "production": {
-    "username": null,
-    "password": null,
-    "database": "cve_prod",
-    "host": ""
-  },
-  "port": 8081
-}
+{
+  "test": {
+    "database": "cve_test",
+    "host": "localhost",
+    "port": 27017
+  },
+  "development": {
+    "database": "cve_dev",
+    "host": "localhost",
+    "port": 27017
+  },
+  "staging": {
+    "username": null,
+    "password": null,
+    "database": "cve_stage",
+    "host": "localhost",
+    "port": 27017
+  },
+  "integration": {
+    "username": null,
+    "password": null,
+    "database": "cve_int",
+    "host": "localhost",
+    "port": 27017
+  },
+  "production": {
+    "username": null,
+    "password": null,
+    "database": "cve_prod",
+    "host": ""
+  },
+  "port": 8081
+}
diff --git a/docker/.docker-env.example b/docker/.docker-env.example
index 8b43b1c7..277b5d01 100644
--- a/docker/.docker-env.example
+++ b/docker/.docker-env.example
@@ -1,5 +1,5 @@
-LOCAL_KEY=TCF25YM-39C4H6D-KA32EGF-V5XSHN3
-MONGO_HOST=docdb
-MONGO_PORT=27017
-NODE_ENV=development
-PORT=3000
+LOCAL_KEY=TCF25YM-39C4H6D-KA32EGF-V5XSHN3
+MONGO_HOST=docdb
+MONGO_PORT=27017
+NODE_ENV=development
+PORT=3000
diff --git a/docker/default.json-docker b/docker/default.json-docker
index a64ac9de..59a89ed9 100644
--- a/docker/default.json-docker
+++ b/docker/default.json-docker
@@ -1,40 +1,40 @@
-{
-  "test": {
-    "database": "cve_test",
-    "host": "docdb",
-    "port": 27017
-  },
-  "development": {
-    "database": "cve_dev",
-    "host": "docdb",
-    "port": 27017
-  },
-  "staging": {
-    "username": null,
-    "password": null,
-    "database": "cve_stage",
-    "host": "docdb",
-    "port": 27017
-  },
-  "integration": {
-    "username": null,
-    "password": null,
-    "database": "cve_int",
-    "host": "docdb",
-    "port": 27017
-  },
-  "prod-staging": {
-    "username": null,
-    "password": null,
-    "database": "cve_prd",
-    "host": "docdb",
-    "port": 27017
-  },
-  "production": {
-    "username": null,
-    "password": null,
-    "database": "cve_prd",
-    "host": ""
-  },
-  "port": 8081
-}
+{
+  "test": {
+    "database": "cve_test",
+    "host": "docdb",
+    "port": 27017
+  },
+  "development": {
+    "database": "cve_dev",
+    "host": "docdb",
+    "port": 27017
+  },
+  "staging": {
+    "username": null,
+    "password": null,
+    "database": "cve_stage",
+    "host": "docdb",
+    "port": 27017
+  },
+  "integration": {
+    "username": null,
+    "password": null,
+    "database": "cve_int",
+    "host": "docdb",
+    "port": 27017
+  },
+  "prod-staging": {
+    "username": null,
+    "password": null,
+    "database": "cve_prd",
+    "host": "docdb",
+    "port": 27017
+  },
+  "production": {
+    "username": null,
+    "password": null,
+    "database": "cve_prd",
+    "host": ""
+  },
+  "port": 8081
+}
diff --git a/src/constants/index.js b/src/constants/index.js
index b5ef4644..4675180b 100644
--- a/src/constants/index.js
+++ b/src/constants/index.js
@@ -1,105 +1,106 @@
-const fs = require('fs')
-const cveSchemaV5 = JSON.parse(fs.readFileSync('src/middleware/5.0_bundled_schema.json'))
-
-/**
- * Return default values.
- *
- * The object is created in this function to prevent accidental
- * value re-assignment and still allow IDE type-hints and compiled regex
- *
- * @return {defaults}
- */
-function getConstants () {
-  /**
-  * @constant
-  * @default
-  * @lends defaults
-  */
-  const defaults = {
-    MONGOOSE_VALIDATION: {
-      Org_policies_id_quota_min: 0,
-      Org_policies_id_quota_min_message: 'Org.policies.id_quota cannot be a negative number.',
-      Org_policies_id_quota_max: 100000,
-      Org_policies_id_quota_max_message: 'Org.policies.id_quota cannot exceed maximum threshold.'
-    },
-    DEFAULT_ID_QUOTA: 1000,
-    DEFAULT_AVAILABLE_POOL: 100,
-    NONSEQUENTIAL_MAX_AMOUNT: 10,
-    CRYPTO_RANDOM_STRING_LENGTH: 36,
-    AUTH_ROLE_ENUM: {
-      SECRETARIAT: 'SECRETARIAT',
-      CNA: 'CNA',
-      BULK_DOWNLOAD: 'BULK_DOWNLOAD',
-      ROOT_CNA: 'ROOT_CNA',
-      ADP: 'ADP'
-    },
-    ORG_ROLES: [
-      'CNA',
-      'SECRETARIAT',
-      'BULK_DOWNLOAD',
-      'ROOT_CNA',
-      'ADP'
-    ],
-    USER_ROLES: [
-      'ADMIN'
-    ],
-    USER_ROLE_ENUM: {
-      ADMIN: 'ADMIN'
-    },
-    AUTH_HEADERS: {
-      ORG: 'CVE-API-ORG',
-      USER: 'CVE-API-USER',
-      KEY: 'CVE-API-KEY'
-    },
-    CVE_STATES: {
-      PUBLISHED: 'PUBLISHED',
-      RESERVED: 'RESERVED',
-      REJECTED: 'REJECTED',
-      AVAILABLE: 'AVAILABLE'
-    },
-    QUOTA_HEADER: 'CVE-API-REMAINING-QUOTA',
-    DEFAULT_CVE_ID_RANGE: {
-      cve_year: 2020,
-      ranges: {
-        priority: {
-          top_id: 0,
-          start: 0,
-          end: 20000
-        },
-        general: {
-          top_id: 20000,
-          start: 20000,
-          end: 50000000
-        }
-      }
-    },
-    PAGINATOR_HEADERS: {
-      PAGE: 'PAGINATOR-PAGE'
-    },
-    PAGINATOR_PAGE: 1,
-    PAGINATOR_OPTIONS: {
-      limit: 500,
-      useFacet: false,
-      customLabels: {
-        totalDocs: 'itemCount',
-        docs: 'itemsList',
-        limit: 'itemsPerPage',
-        page: 'currentPage',
-        totalPages: 'pageCount',
-        useFacet: false
-      }
-    },
-    MAX_SHORTNAME_LENGTH: 32,
-    MIN_SHORTNAME_LENGTH: 2,
-    CVE_ID_PATTERN: cveSchemaV5.definitions.cveId.pattern,
-    // Ajv's pattern validation uses the "u" (unicode) flag:
-    // https://ajv.js.org/json-schema.html#pattern
-    CVE_ID_REGEX: new RegExp(cveSchemaV5.definitions.cveId.pattern, 'u')
-  }
-
-  return defaults
-}
-
-module.exports = {
-  getConstants
-}
+const fs = require('fs')
+const cveSchemaV5 = JSON.parse(fs.readFileSync('src/middleware/5.0_bundled_schema.json'))
+
+/**
+ * Return default values.
+ *
+ * The object is created in this function to prevent accidental
+ * value re-assignment and still allow IDE type-hints and compiled regex
+ *
+ * @return {defaults}
+ */
+function getConstants () {
+  /**
+  * @constant
+  * @default
+  * @lends defaults
+  */
+  const defaults = {
+    MONGOOSE_VALIDATION: {
+      Org_policies_id_quota_min: 0,
+      Org_policies_id_quota_min_message: 'Org.policies.id_quota cannot be a negative number.',
+      Org_policies_id_quota_max: 100000,
+      Org_policies_id_quota_max_message: 'Org.policies.id_quota cannot exceed maximum threshold.'
+    },
+    DEFAULT_ID_QUOTA: 1000,
+    DEFAULT_AVAILABLE_POOL: 100,
+    NONSEQUENTIAL_MAX_AMOUNT: 10,
+    CRYPTO_RANDOM_STRING_LENGTH: 36,
+    AUTH_ROLE_ENUM: {
+      SECRETARIAT: 'SECRETARIAT',
+      CNA: 'CNA',
+      BULK_DOWNLOAD: 'BULK_DOWNLOAD',
+      ROOT_CNA: 'ROOT_CNA',
+      ADP: 'ADP'
+    },
+    ORG_ROLES: [
+      'CNA',
+      'SECRETARIAT',
+      'BULK_DOWNLOAD',
+      'ROOT_CNA',
+      'ADP'
+    ],
+    USER_ROLES: [
+      'ADMIN'
+    ],
+    USER_ROLE_ENUM: {
+      ADMIN: 'ADMIN'
+    },
+    AUTH_HEADERS: {
+      ORG: 'CVE-API-ORG',
+      USER: 'CVE-API-USER',
+      KEY: 'CVE-API-KEY'
+    },
+    CVE_STATES: {
+      PUBLISHED: 'PUBLISHED',
+      RESERVED: 'RESERVED',
+      REJECTED: 'REJECTED',
+      AVAILABLE: 'AVAILABLE'
+    },
+    QUOTA_HEADER: 'CVE-API-REMAINING-QUOTA',
+    DEFAULT_CVE_ID_RANGE: {
+      cve_year: 2020,
+      ranges: {
+        priority: {
+          top_id: 0,
+          start: 0,
+          end: 20000
+        },
+        general: {
+          top_id: 20000,
+          start: 20000,
+          end: 50000000
+        }
+      }
+    },
+    PAGINATOR_HEADERS: {
+      PAGE: 'PAGINATOR-PAGE'
+    },
+    PAGINATOR_PAGE: 1,
+    PAGINATOR_OPTIONS: {
+      limit: 500,
+      lean: true,
+      useFacet: false,
+      customLabels: {
+        totalDocs: 'itemCount',
+        docs: 'itemsList',
+        limit: 'itemsPerPage',
+        page: 'currentPage',
+        totalPages: 'pageCount',
+        useFacet: false
+      }
+    },
+    MAX_SHORTNAME_LENGTH: 32,
+    MIN_SHORTNAME_LENGTH: 2,
+    CVE_ID_PATTERN: cveSchemaV5.definitions.cveId.pattern,
+    // Ajv's pattern validation uses the "u" (unicode) flag:
+    // https://ajv.js.org/json-schema.html#pattern
+    CVE_ID_REGEX: new RegExp(cveSchemaV5.definitions.cveId.pattern, 'u')
+  }
+
+  return defaults
+}
+
+module.exports = {
+  getConstants
+}
diff --git a/src/controller/cve-id.controller/cve-id.controller.js b/src/controller/cve-id.controller/cve-id.controller.js
index 943b417a..4d13a95e 100644
--- a/src/controller/cve-id.controller/cve-id.controller.js
+++ b/src/controller/cve-id.controller/cve-id.controller.js
@@ -33,9 +33,26 @@ async function getFilteredCveId (req, res, next) {
     options.page = req.ctx.query.page ? parseInt(req.ctx.query.page) : CONSTANTS.PAGINATOR_PAGE // if 'page' query parameter is not defined, set 'page' to the default page value
     const cveIdRepo = req.ctx.repositories.getCveIdRepository()
     const orgRepo = req.ctx.repositories.getOrgRepository()
+    const userRepo = req.ctx.repositories.getUserRepository()
     const isSecretariat = await orgRepo.isSecretariat(orgShortName)
     const isBulkDownload = await orgRepo.isBulkDownload(orgShortName)
 
+    // Create map of orgUUID to shortnames and users to simplify aggregation later
+    const orgs = await orgRepo.getAllOrgs()
+    const users = await userRepo.getAllUsers()
+
+    const orgMap = {}
+    orgs.forEach(org => {
+      orgMap[org.UUID] = { shortname: org.short_name, users: {} }
+    })
+
+    users.forEach(user => {
+      if (!orgMap[user.org_UUID]) {
+        orgMap[user.org_UUID] = { shortname: `MISSING ORG ${user.org_UUID}`, users: {} }
+      }
+      orgMap[user.org_UUID].users[user.UUID] = user.username
+    })
+
     Object.keys(req.ctx.query).forEach(k => {
       const key = k.toLowerCase()
 
@@ -99,9 +116,17 @@ async function getFilteredCveId (req, res, next) {
       }
     }
 
-    const agt = setAggregateObj(query)
+    const agt = setMinAggregateObj(query)
     const pg = await cveIdRepo.aggregatePaginate(agt, options)
-    const payload = { cve_ids: pg.itemsList }
+    const payload = {
+      cve_ids: pg.itemsList.map((i) => {
+        const cnaid = i.requested_by.cna
+        i.requested_by.cna = orgMap[cnaid].shortname
+        i.requested_by.user = orgMap[cnaid].users[i.requested_by.user]
+        i.owning_cna = orgMap[i.owning_cna].shortname
+        return i
+      })
+    }
 
     if (pg.itemCount >= CONSTANTS.PAGINATOR_OPTIONS.limit) {
       payload.totalCount = pg.itemCount
@@ -876,6 +901,22 @@ function setAggregateObj (query) {
   ]
 }
 
+// Smaller aggregation used in getFilteredCveId function
+function setMinAggregateObj (query) {
+  return [
+    {
+      $match: query
+    },
+
+    {
+      $project: {
+        _id: false,
+        __v: false
+      }
+    }
+  ]
+}
+
 module.exports = {
   CVEID_GET_FILTER: getFilteredCveId,
   CVEID_RESERVE: reserveCveId,
diff --git a/src/controller/cve.controller/cve.controller.js b/src/controller/cve.controller/cve.controller.js
index 13da13dd..8b50924b 100644
--- a/src/controller/cve.controller/cve.controller.js
+++ b/src/controller/cve.controller/cve.controller.js
@@ -1,6 +1,7 @@
 const Cve = require('../../model/cve')
 const logger = require('../../middleware/logger')
 const errors = require('./error')
+const { toDate } = require('../../utils/utils')
 const getConstants = require('../../constants').getConstants
 const error = new errors.CveControllerError()
 const booleanIsTrue = require('../../utils/utils').booleanIsTrue
@@ -44,6 +45,10 @@ async function getFilteredCves (req, res, next) {
     let state = null
     let assignerShortName = null
     let assigner = null
+    let cnaModified = false
+    let timeModifiedGtDateObject = null
+    let timeModifiedLtDateObject = null
+    let adpShortName = null
     const timeModified = {
       timeStamp: [],
       dateOperator: []
@@ -64,15 +69,21 @@ async function getFilteredCves (req, res, next) {
       if (key === 'time_modified.lt') {
         timeModified.dateOperator.push('lt')
         timeModified.timeStamp.push(req.ctx.query['time_modified.lt'])
+        timeModifiedLtDateObject = req.ctx.query['time_modified.lt']
       } else if (key === 'time_modified.gt') {
         timeModified.dateOperator.push('gt')
         timeModified.timeStamp.push(req.ctx.query['time_modified.gt'])
+        timeModifiedGtDateObject = req.ctx.query['time_modified.gt']
       } else if (key === 'state') {
         state = req.ctx.query.state
       } else if (key === 'assigner_short_name') { // the key is retrieved as lowercase
         assignerShortName = req.ctx.query.assigner_short_name
       } else if (key === 'assigner') {
         assigner = req.ctx.query.assigner
+      } else if (key === 'cna_modified') {
+        cnaModified = req.ctx.query.cna_modified
+      } else if (key === 'adp_short_name') {
+        adpShortName = req.ctx.query.adp_short_name
       }
     })
 
@@ -134,7 +145,64 @@ async function getFilteredCves (req, res, next) {
     }
 
     const pg = await cveRepo.aggregatePaginate(agt, options)
-    const payload = { cveRecords: pg.itemsList.map(val => { return val.cve }) }
+    const payload = {
+      cveRecords: pg.itemsList.map(val => { return val.cve }).filter((val) => {
+        // If cnaModified AND adpShortName are false, return all values, no filtering to be done.
+        if (!cnaModified && !adpShortName) {
+          return true
+        }
+
+        // cnaModified and adpShortName are treated as an AND if they are both set
+        if (cnaModified) {
+          if (val.containers.cna.providerMetadata?.dateUpdated) {
+            // If the time modified gt flag is set, and the dateUpdated date is less than the flag
+            if ((timeModifiedGtDateObject && timeModifiedGtDateObject > toDate(val.containers.cna.providerMetadata?.dateUpdated))) {
+              return false
+            }
+            // if the time modified lt flag is set, and the dateUpdated date is greater than the flag
+            if ((timeModifiedLtDateObject && timeModifiedLtDateObject < toDate(val.containers.cna.providerMetadata?.dateUpdated))) {
+              return false
+            }
+          } else {
+            // if cnaModified was set, but there is no value
+            return false
+          }
+        }
+        if (adpShortName) {
+          // Check to make sure we want to filter ADPs and that the CVE has an ADP container
+          if (val.containers?.adp && val.containers?.adp?.length) {
+          // Check all adp containers and if ANY of them have what we are searching for, return them
+            let adpMatchFound = false
+            for (const element of val.containers.adp) {
+              // If shortname is defined AND no dates are set, only check for the short name
+              if (element.providerMetadata.shortName === adpShortName) {
+                if (!timeModifiedGtDateObject && !timeModifiedLtDateObject) {
+                  adpMatchFound = true
+                  break
+                } else {
+                // otherwise we need to check the dates for a match
+                  if ((timeModifiedGtDateObject && timeModifiedGtDateObject < toDate(element.providerMetadata?.dateUpdated))) {
+                    adpMatchFound = true
+                    break
+                  }
+                  if (timeModifiedLtDateObject && timeModifiedLtDateObject > toDate(element.providerMetadata?.dateUpdated)) {
+                    adpMatchFound = true
+                    break
+                  }
+                }
+              }
+            }
+            if (!adpMatchFound) {
+              return false
+            }
+          } else {
+            // if adpShortName was set, BUT we didn't find anything
+            return false
+          }
+        }
+        return true
+      })
+    }
 
     if (pg.itemCount >= CONSTANTS.PAGINATOR_OPTIONS.limit) {
       payload.totalCount = pg.itemCount
diff --git a/src/controller/cve.controller/cve.middleware.js b/src/controller/cve.controller/cve.middleware.js
index 937eb270..32fd1456 100644
--- a/src/controller/cve.controller/cve.middleware.js
+++ b/src/controller/cve.controller/cve.middleware.js
@@ -20,7 +20,7 @@ function parsePostParams (req, res, next) {
 }
 
 function parseGetParams (req, res, next) {
-  utils.reqCtxMapping(req, 'query', ['page', 'time_modified.lt', 'time_modified.gt', 'state', 'count_only', 'assigner_short_name', 'assigner'])
+  utils.reqCtxMapping(req, 'query', ['page', 'time_modified.lt', 'time_modified.gt', 'state', 'count_only', 'assigner_short_name', 'assigner', 'cna_modified', 'adp_short_name'])
   utils.reqCtxMapping(req, 'params', ['id'])
   next()
 }
diff --git a/src/controller/cve.controller/index.js b/src/controller/cve.controller/index.js
index f5e66921..edbe32b6 100644
--- a/src/controller/cve.controller/index.js
+++ b/src/controller/cve.controller/index.js
@@ -103,7 +103,9 @@ router.get('/cve',
     '#/components/parameters/countOnly',
     '#/components/parameters/assignerShortName',
     '#/components/parameters/assigner',
-    '#/components/parameters/pageQuery'
+    '#/components/parameters/pageQuery',
+    '#/components/parameters/cnaModified',
+    '#/components/parameters/adpShortName'
   ]
   #swagger.responses[200] = {
     description: 'A filtered list of CVE Records, along with pagination fields if results span multiple pages of data',
@@ -154,7 +156,7 @@ router.get('/cve',
   */
   mw.validateUser,
   mw.onlySecretariatOrBulkDownload,
-  query().custom((query) => { return mw.validateQueryParameterNames(query, ['page', 'time_modified.lt', 'time_modified.gt', 'state', 'count_only', 'assigner_short_name', 'assigner']) }),
+  query().custom((query) => { return mw.validateQueryParameterNames(query, ['page', 'time_modified.lt', 'time_modified.gt', 'state', 'count_only', 'assigner_short_name', 'assigner', 'cna_modified', 'adp_short_name']) }),
   query(['page']).optional().isInt({ min: CONSTANTS.PAGINATOR_PAGE }),
   query(['time_modified.lt']).optional().isString().trim().escape().customSanitizer(val => { return toDate(val) }).not().isEmpty().withMessage(errorMsgs.TIMESTAMP_FORMAT),
   query(['time_modified.gt']).optional().isString().trim().escape().customSanitizer(val => { return toDate(val) }).not().isEmpty().withMessage(errorMsgs.TIMESTAMP_FORMAT),
@@ -162,6 +164,8 @@ router.get('/cve',
   query(['count_only']).optional().isBoolean({ loose: true }).withMessage(errorMsgs.COUNT_ONLY),
   query(['assigner_short_name']).optional().isString().trim().escape().notEmpty().isLength({ min: CONSTANTS.MIN_SHORTNAME_LENGTH, max: CONSTANTS.MAX_SHORTNAME_LENGTH }),
   query(['assigner']).optional().isString().trim().escape().notEmpty(),
+  query(['cna_modified']).optional().isBoolean({ loose: true }).withMessage(errorMsgs.CNA_MODIFIED),
+  query(['adp_short_name']).optional().isString().trim().escape().notEmpty().isLength({ min: CONSTANTS.MIN_SHORTNAME_LENGTH, max: CONSTANTS.MAX_SHORTNAME_LENGTH }),
   parseError,
   parseGetParams,
   controller.CVE_GET_FILTERED)
diff --git a/src/middleware/errorMessages.js b/src/middleware/errorMessages.js
index 3ae62275..327850cf 100644
--- a/src/middleware/errorMessages.js
+++ b/src/middleware/errorMessages.js
@@ -8,5 +8,6 @@ module.exports = {
   ID_MODIFY_STATES: 'Invalid CVE ID state. Valid states are: RESERVED, REJECTED',
   CVE_FILTERED_STATES: 'Invalid record state. Valid states are: PUBLISHED, REJECTED',
   COUNT_ONLY: 'Invalid count_only value. Value should be 1, true, or yes to indicate true, or 0, false, or no to indicate false',
-  TIMESTAMP_FORMAT: "Bad date, or invalid timestamp format: valid format is yyyy-MM-ddTHH:mm:ss or yyyy-MM-ddTHH:mm:ssZZZZ (to use '+' in timezone offset, encode as '%2B)"
+  TIMESTAMP_FORMAT: "Bad date, or invalid timestamp format: valid format is yyyy-MM-ddTHH:mm:ss or yyyy-MM-ddTHH:mm:ssZZZZ (to use '+' in timezone offset, encode as '%2B)",
+  CNA_MODIFIED: 'Invalid cna_modified value. Value should be 1, true, or yes to indicate true, or 0, false, or no to indicate false'
 }
diff --git a/src/middleware/middleware.js b/src/middleware/middleware.js
index dfcc1297..babe8376 100644
--- a/src/middleware/middleware.js
+++ b/src/middleware/middleware.js
@@ -160,7 +160,7 @@ async function onlySecretariatOrBulkDownload (req, res, next) {
   }
 }
 
-// Checks that the requester belongs to an org that has the 'SECREATARIAT' role
+// Checks that the requester belongs to an org that has the 'SECRETARIAT' role
 async function onlySecretariat (req, res, next) {
   const org = req.ctx.org
   const orgRepo = req.ctx.repositories.getOrgRepository()
diff --git a/src/repositories/orgRepository.js b/src/repositories/orgRepository.js
index 57062696..84d47fb7 100644
--- a/src/repositories/orgRepository.js
+++ b/src/repositories/orgRepository.js
@@ -34,6 +34,10 @@ class OrgRepository extends BaseRepository {
   async isBulkDownload (shortName) {
     return utils.isBulkDownload(shortName)
   }
+
+  async getAllOrgs () {
+    return this.collection.find()
+  }
 }
 
 module.exports = OrgRepository
diff --git a/src/repositories/userRepository.js b/src/repositories/userRepository.js
index 3a701dec..26204d9d 100644
--- a/src/repositories/userRepository.js
+++ b/src/repositories/userRepository.js
@@ -30,6 +30,10 @@ class UserRepository extends BaseRepository {
   async updateByUserNameAndOrgUUID (username, orgUUID, user, options = {}) {
     return this.collection.findOneAndUpdate().byUserNameAndOrgUUID(username, orgUUID).updateOne(user).setOptions(options)
   }
+
+  async getAllUsers () {
+    return this.collection.find()
+  }
 }
 
 module.exports = UserRepository
diff --git a/src/swagger.js b/src/swagger.js
index 0334b30e..77e3ce4c 100644
--- a/src/swagger.js
+++ b/src/swagger.js
@@ -187,6 +187,24 @@ const doc = {
           type: 'boolean'
         }
       },
+      cnaModified: {
+        in: 'query',
+        name: 'cna_modified',
+        description: 'Only get CVE records with cnaContainers that have been modified/created within the set time_modified range. Requires at least one time_modified parameter set',
+        required: false,
+        schema: {
+          type: 'boolean'
+        }
+      },
+      adpShortName: {
+        in: 'query',
+        name: 'adp_short_name',
+        description: 'Only get CVE records that have an adpContainer owned by this org and that has been modified/created within the set time_modified range. Requires at least one time_modified parameter set',
+        required: false,
+        schema: {
+          type: 'string'
+        }
+      },
       cveState: {
         in: 'query',
         name: 'state',


Test patch:
diff --git a/test-examples/test-api-health.js b/test-examples/test-api-health.js
index 38a7f2df..eeb91f9a 100644
--- a/test-examples/test-api-health.js
+++ b/test-examples/test-api-health.js
@@ -1,24 +1,24 @@
-var chai = require('chai')
-var chaiHttp = require('chai-http')
-
-chai.use(chaiHttp)
-chai.should()
-
-describe('API Health Check: ', () => {
-  it('Api should be running', function (done) {
-    chai.request('http://localhost:3000')
-      .get('/health-check')
-      .end((err, res) => {
-        if (err) {
-          console.log(err.stack)
-        }
-
-        res.should.have.status(200)
-        res.should.be.json()
-        res.body.should.be.a('object')
-        res.body.should.have.property('isHealthy')
-        res.body.isHealthy.should.equal(true)
-        done()
-      })
-  })
-})
+var chai = require('chai')
+var chaiHttp = require('chai-http')
+
+chai.use(chaiHttp)
+chai.should()
+
+describe('API Health Check: ', () => {
+  it('Api should be running', function (done) {
+    chai.request('http://localhost:3000')
+      .get('/health-check')
+      .end((err, res) => {
+        if (err) {
+          console.log(err.stack)
+        }
+
+        res.should.have.status(200)
+        res.should.be.json()
+        res.body.should.be.a('object')
+        res.body.should.have.property('isHealthy')
+        res.body.isHealthy.should.equal(true)
+        done()
+      })
+  })
+})
diff --git a/test/README.md b/test/README.md
index 7f8fe930..797e80d3 100644
--- a/test/README.md
+++ b/test/README.md
@@ -1,27 +1,27 @@
-
-
-# CVE-API-Unit-Tests
-In order to Run Tests, make sure you configure a DB connection in the config/config.json under the `test` environment.
-
-## Dependencies
-
-This project uses or depends on software from
-
-- NodeJS https://nodejs.org/
-- Express https://github.com/expressjs
-- MYSQL
-- Sequelize http://docs.sequelizejs.com/
-- Mocha https://mochajs.org/
-- Chai https://www.chaijs.com/
-
-
-In order to run unit tests, use the following command:
-
-```sh
-npm run start:test
-```
-
-## Notes
-
-Please note, test will run on every attempted `git push` command. Pushing into a repo will only be successful if and only if tests successfully pass.
-
+
+
+# CVE-API-Unit-Tests
+In order to Run Tests, make sure you configure a DB connection in the config/config.json under the `test` environment.
+
+## Dependencies
+
+This project uses or depends on software from
+
+- NodeJS https://nodejs.org/
+- Express https://github.com/expressjs
+- MYSQL
+- Sequelize http://docs.sequelizejs.com/
+- Mocha https://mochajs.org/
+- Chai https://www.chaijs.com/
+
+
+In order to run unit tests, use the following command:
+
+```sh
+npm run start:test
+```
+
+## Notes
+
+Please note, test will run on every attempted `git push` command. Pushing into a repo will only be successful if and only if tests successfully pass.
+
diff --git a/test/integration-tests/constants.js b/test/integration-tests/constants.js
index 65663e12..1b683776 100644
--- a/test/integration-tests/constants.js
+++ b/test/integration-tests/constants.js
@@ -75,6 +75,60 @@ const testCve = {
       }
     ]
   }
+}
+
+const testCveEdited = {
+  cnaContainer: {
+    affected: [
+      {
+        vendor: 'n/a',
+        product: 'n/a',
+        versions: [
+          {
+            version: 'n/a',
+            status: 'unknown'
+          }
+        ]
+      }
+    ],
+    descriptions: [
+      {
+        lang: 'en',
+        value: 'Cross-site scripting 2 (XSS) vulnerability in Revive Adserver before 4.0.1 allows remote authenticated users to inject arbitrary web script or HTML via the user\'s email address.'
+      }
+    ],
+    problemTypes: [
+      {
+        descriptions: [
+          {
+            description: 'n/a',
+            lang: 'eng',
+            type: 'text'
+          }
+        ]
+      }
+    ],
+    providerMetadata: {
+      orgId: '9cbfeea8-dea2-4923-b772-1ab41730e742'
+    },
+    references: [
+      {
+        name: '[oss-security] 20170202 Re: CVE request: multiples vulnerabilities in Revive Adserver',
+        refsource: 'MLIST',
+        url: 'http://www.openwall.com/lists/oss-security/2017/02/02/3'
+      },
+      {
+        name: 'https://www.revive-adserver.com/security/revive-sa-2017-001/',
+        refsource: 'CONFIRM',
+        url: 'https://www.revive-adserver.com/security/revive-sa-2017-001/'
+      },
+      {
+        name: '95875',
+        refsource: 'BID',
+        url: 'http://www.securityfocus.com/bid/95875'
+      }
+    ]
+  }
 
 }
 
@@ -188,5 +242,5 @@ const testAdp2 = {
 }
 
 module.exports = {
-  headers, nonSecretariatUserHeaders, badNonSecretariatUserHeaders, nonSecretariatUserHeadersWithAdp2, testCve, testAdp, testAdp2
+  headers, nonSecretariatUserHeaders, badNonSecretariatUserHeaders, nonSecretariatUserHeadersWithAdp2, testCve, testCveEdited, testAdp, testAdp2
 }
diff --git a/test/integration-tests/cve-id/cveIdUpdateTest.js b/test/integration-tests/cve-id/cveIdUpdateTest.js
new file mode 100644
index 00000000..c274fe17
--- /dev/null
+++ b/test/integration-tests/cve-id/cveIdUpdateTest.js
@@ -0,0 +1,47 @@
+/* eslint-disable no-unused-expressions */
+
+const chai = require('chai')
+chai.use(require('chai-http'))
+const expect = chai.expect
+
+const constants = require('../constants.js')
+const app = require('../../../src/index.js')
+const helpers = require('../helpers.js')
+
+const shortName = 'win_5'
+
+describe('Text PUT CVE-ID/:id', () => {
+  let cveId
+  before(async () => {
+    cveId = await helpers.cveIdReserveHelper(1, '2023', shortName, 'non-sequential')
+  })
+  context('State parameter Tests', () => {
+    it('Endpoint should return a 400 when state org is set to published', async () => {
+      await chai.request(app)
+        .put(`/api/cve-id/${cveId}?state=PUBLISHED`)
+        .set(constants.headers)
+        .then((res, err) => {
+          expect(err).to.be.undefined
+          expect(res).to.have.status(400)
+        })
+    })
+    it('Endpoint should allow the state parameter to be set to reserved', async () => {
+      await chai.request(app)
+        .put(`/api/cve-id/${cveId}?state=REJECTED`)
+        .set(constants.headers)
+        .then((res, err) => {
+          expect(err).to.be.undefined
+          expect(res).to.have.status(200)
+        })
+    })
+    it('Endpoint should still not allow a REJECTED endpoint to be set to published', async () => {
+      await chai.request(app)
+        .put(`/api/cve-id/${cveId}?state=PUBLISHED`)
+        .set(constants.headers)
+        .then((res, err) => {
+          expect(err).to.be.undefined
+          expect(res).to.have.status(400)
+        })
+    })
+  })
+})
diff --git a/test/integration-tests/cve-id/getCveIdTest.js b/test/integration-tests/cve-id/getCveIdTest.js
new file mode 100644
index 00000000..3914f48e
--- /dev/null
+++ b/test/integration-tests/cve-id/getCveIdTest.js
@@ -0,0 +1,103 @@
+/* eslint-disable no-unused-expressions */
+
+const chai = require('chai')
+chai.use(require('chai-http'))
+const _ = require('lodash')
+
+const expect = chai.expect
+
+const constants = require('../constants.js')
+const app = require('../../../src/index.js')
+
+describe('Testing Get CVE-ID endpoint', () => {
+  const RESESRVED_COUNT = 116
+  const YEAR_COUNT = 10
+  const PUB_YEAR_COUNT = 4
+  const TIME_WINDOW_COUNT = 40
+
+  context('Positive Tests', () => {
+    it('Get CVE-ID should return everything when no parameters are specifed', async () => {
+      await chai.request(app)
+        .get('/api/cve-id')
+        .set(constants.headers)
+        .then((res, err) => {
+          expect(err).to.be.undefined
+          expect(res).to.have.status(200)
+        })
+    })
+    it('Get CVE-ID should return an empty array when time modified is set to a very far future date', async () => {
+      await chai.request(app)
+        .get('/api/cve-id?time_modified.gt=2100-01-01T00:00:00')
+        .set(constants.headers)
+        .then((res, err) => {
+          expect(err).to.be.undefined
+          expect(res).to.have.status(200)
+          expect(res.body.cve_ids).to.have.length(0)
+        })
+    })
+    // Need a better way to test each individual cve-id's time_modified
+    it('Get all CVE-IDs modified within a given timeframe', async () => {
+      await chai.request(app)
+        .get('/api/cve-id?time_modified.gt=2021-05-11T15:05:20.093Z&time_modified.lt=2021-05-11T15:07:00.093Z')
+        .set(constants.headers)
+        .then((res, err) => {
+          expect(err).to.be.undefined
+          expect(res).to.have.status(200)
+          expect(res.body.cve_ids).to.have.length(TIME_WINDOW_COUNT)
+        })
+    })
+    it('Get all CVE-IDs in the RESERVED state', async () => {
+      await chai.request(app)
+        .get('/api/cve-id?state=RESERVED')
+        .set(constants.headers)
+        .then((res, err) => {
+          expect(err).to.be.undefined
+          expect(res).to.have.status(200)
+          expect(_.every(res.body.cve_ids, { state: 'RESERVED' })).to.be.true
+          expect(res.body.cve_ids).to.have.length(RESESRVED_COUNT)
+        })
+    })
+    it('Get all CVE-IDs in the PUBLISHED state', async () => {
+      await chai.request(app)
+        .get('/api/cve-id?state=PUBLISHED')
+        .set(constants.headers)
+        .then((res, err) => {
+          expect(err).to.be.undefined
+          expect(res).to.have.status(200)
+          expect(_.every(res.body.cve_ids, { state: 'PUBLISHED' })).to.be.true
+        })
+    })
+    it('Get all CVE-IDs in the REJECTED state', async () => {
+      await chai.request(app)
+        .get('/api/cve-id?state=REJECTED')
+        .set(constants.headers)
+        .then((res, err) => {
+          expect(err).to.be.undefined
+          expect(res).to.have.status(200)
+          expect(_.every(res.body.cve_ids, { state: 'REJECTED' })).to.be.true
+        })
+    })
+    it('Get all CVE-IDs with cve_id_year 1999', async () => {
+      await chai.request(app)
+        .get('/api/cve-id?cve_id_year=1999')
+        .set(constants.headers)
+        .then((res, err) => {
+          expect(err).to.be.undefined
+          expect(res).to.have.status(200)
+          expect(_.every(res.body.cve_ids, { cve_year: '1999' })).to.be.true
+          expect(res.body.cve_ids).to.have.length(YEAR_COUNT)
+        })
+    })
+    it('Get all CVE-IDs with cve_id_year 1999 with state PUBLISHED', async () => {
+      await chai.request(app)
+        .get('/api/cve-id?cve_id_year=1999&state=PUBLISHED')
+        .set(constants.headers)
+        .then((res, err) => {
+          expect(err).to.be.undefined
+          expect(res).to.have.status(200)
+          expect(_.every(res.body.cve_ids, { cve_year: '1999', state: 'PUBLISHED' })).to.be.true
+          expect(res.body.cve_ids).to.have.length(PUB_YEAR_COUNT)
+        })
+    })
+  })
+})
diff --git a/test/integration-tests/cve/getCveAdpShortNameTest.js b/test/integration-tests/cve/getCveAdpShortNameTest.js
new file mode 100644
index 00000000..c0ef7658
--- /dev/null
+++ b/test/integration-tests/cve/getCveAdpShortNameTest.js
@@ -0,0 +1,83 @@
+/* eslint-disable no-unused-expressions */
+const chai = require('chai')
+chai.use(require('chai-http'))
+const expect = chai.expect
+
+const constants = require('../constants.js')
+const app = require('../../../src/index.js')
+const helpers = require('../helpers.js')
+const _ = require('lodash')
+
+const shortName = 'win_5'
+
+describe('Test cna_modified parameter for get CVE', () => {
+  let cveId
+  before(async () => {
+    cveId = await helpers.cveIdReserveHelper(1, '2023', shortName, 'non-sequential')
+    await helpers.cveRequestAsCnaHelper(cveId)
+    await helpers.cveUpdateAsCnaHelperWithAdpContainer(cveId, constants.testAdp)
+  })
+  context('Positive Test', () => {
+    it('CVE should not be returned with adp_short_name set to fake_org as it does not exist', async () => {
+      await chai.request(app)
+        .get('/api/cve/?adp_short_name=fake_org')
+        .set(constants.headers)
+        .then((res, err) => {
+          expect(err).to.be.undefined
+          expect(res).to.have.status(200)
+          expect(_.some(res.body.cveRecords, { cveMetadata: { cveId: cveId } })).to.be.false
+        })
+    })
+    it(`CVE should be returned with adp_short_name set to ${shortName} as it has been created`, async () => {
+      await chai.request(app)
+        .get(`/api/cve/?adp_short_name=${shortName}`)
+        .set(constants.headers)
+        .then((res, err) => {
+          expect(err).to.be.undefined
+          expect(res).to.have.status(200)
+          expect(_.some(res.body.cveRecords, { cveMetadata: { cveId: cveId } })).to.be.true
+        })
+    })
+    it(`Get CVE with adp_short_name set to ${shortName} AND date.gt should return when searched with a known earlier than date`, async () => {
+      await chai.request(app)
+        .get(`/api/cve/?time_modified.gt=2022-01-01T00:00:00&adp_short_name=${shortName}`)
+        .set(constants.headers)
+        .then((res, err) => {
+          expect(err).to.be.undefined
+          expect(res).to.have.status(200)
+          expect(_.some(res.body.cveRecords, { cveMetadata: { cveId: cveId } })).to.be.true
+        })
+    })
+    it(`Get CVE with with adp_short_name set to ${shortName} AND date.gt should return and empty list when searched with a known bad earlier than date`, async () => {
+      await chai.request(app)
+        .get(`/api/cve/?time_modified.gt=2100-01-01T00:00:00&adp_short_name=${shortName}`)
+        .set(constants.headers)
+        .then((res, err) => {
+          expect(err).to.be.undefined
+          expect(res).to.have.status(200)
+          expect(_.some(res.body.cveRecords, { cveMetadata: { cveId: cveId } })).to.be.false
+        })
+    })
+
+    it(`Get CVE with adp_short_name set to ${shortName} AND date.lt should return when searched with a known later than date`, async () => {
+      await chai.request(app)
+        .get(`/api/cve/?time_modified.lt=2100-01-01T00:00:00&adp_short_name=${shortName}`)
+        .set(constants.headers)
+        .then((res, err) => {
+          expect(err).to.be.undefined
+          expect(res).to.have.status(200)
+          expect(_.some(res.body.cveRecords, { cveMetadata: { cveId: cveId } })).to.be.true
+        })
+    })
+    it(`Get CVE with adp_short_name set to ${shortName} AND date.lt should return and empty list when searched with a known bad later than date`, async () => {
+      await chai.request(app)
+        .get(`/api/cve/?time_modified.lt=2022-01-01T00:00:00&adp_short_name=${shortName}`)
+        .set(constants.headers)
+        .then((res, err) => {
+          expect(err).to.be.undefined
+          expect(res).to.have.status(200)
+          expect(_.some(res.body.cveRecords, { cveMetadata: { cveId: cveId } })).to.be.false
+        })
+    })
+  })
+})
diff --git a/test/integration-tests/cve/getCveCnaModifiedTest.js b/test/integration-tests/cve/getCveCnaModifiedTest.js
new file mode 100644
index 00000000..f2c082d6
--- /dev/null
+++ b/test/integration-tests/cve/getCveCnaModifiedTest.js
@@ -0,0 +1,85 @@
+/* eslint-disable no-unused-expressions */
+
+const chai = require('chai')
+chai.use(require('chai-http'))
+const expect = chai.expect
+
+const constants = require('../constants.js')
+const app = require('../../../src/index.js')
+const helpers = require('../helpers.js')
+const _ = require('lodash')
+
+const shortName = 'win_5'
+
+describe('Test cna_modified parameter for get CVE', () => {
+  let cveId
+  before(async () => {
+    cveId = await helpers.cveIdReserveHelper(1, '2023', shortName, 'non-sequential')
+    await helpers.cveRequestAsCnaHelper(cveId)
+  })
+  context('Positive Test', () => {
+    it('CVE should be returned with cna_modified true as it has been created', async () => {
+      await chai.request(app)
+        .get('/api/cve/?cna_modified=true')
+        .set(constants.headers)
+        .then((res, err) => {
+          expect(err).to.be.undefined
+          expect(res).to.have.status(200)
+          expect(_.some(res.body.cveRecords, { cveMetadata: { cveId: cveId } })).to.be.true
+        })
+    })
+    it('Get CVE with cna_modified set to true should be returned after being edited', async () => {
+      // Edit the CNA container
+      await helpers.cveUpdatetAsCnaHelperWithCnaContainer(cveId, constants.testCveEdited)
+      await chai.request(app)
+        .get('/api/cve/?cna_modified=true')
+        .set(constants.headers)
+        .then((res, err) => {
+          expect(err).to.be.undefined
+          expect(res).to.have.status(200)
+          expect(_.some(res.body.cveRecords, { cveMetadata: { cveId: cveId } })).to.be.true
+        })
+    })
+    it('Get CVE with cna_modified set to true AND date.gt should return when searched with a known earlier than date', async () => {
+      await chai.request(app)
+        .get('/api/cve/?time_modified.gt=2022-01-01T00:00:00&cna_modified=true')
+        .set(constants.headers)
+        .then((res, err) => {
+          expect(err).to.be.undefined
+          expect(res).to.have.status(200)
+          expect(_.some(res.body.cveRecords, { cveMetadata: { cveId: cveId } })).to.be.true
+        })
+    })
+    it('Get CVE with cna_modified set to true AND date.gt should return and empty list when searched with a known bad earlier than date', async () => {
+      await chai.request(app)
+        .get('/api/cve/?time_modified.gt=2100-01-01T00:00:00&cna_modified=true')
+        .set(constants.headers)
+        .then((res, err) => {
+          expect(err).to.be.undefined
+          expect(res).to.have.status(200)
+          expect(_.some(res.body.cveRecords, { cveMetadata: { cveId: cveId } })).to.be.false
+        })
+    })
+
+    it('Get CVE with cna_modified set to true AND date.lt should return when searched with a known later than date', async () => {
+      await chai.request(app)
+        .get('/api/cve/?time_modified.lt=2100-01-01T00:00:00&cna_modified=true')
+        .set(constants.headers)
+        .then((res, err) => {
+          expect(err).to.be.undefined
+          expect(res).to.have.status(200)
+          expect(_.some(res.body.cveRecords, { cveMetadata: { cveId: cveId } })).to.be.true
+        })
+    })
+    it('Get CVE with cna_modified set to true AND date.lt should return and empty list when searched with a known bad later than date', async () => {
+      await chai.request(app)
+        .get('/api/cve/?time_modified.lt=2022-01-01T00:00:00&cna_modified=true')
+        .set(constants.headers)
+        .then((res, err) => {
+          expect(err).to.be.undefined
+          expect(res).to.have.status(200)
+          expect(_.some(res.body.cveRecords, { cveMetadata: { cveId: cveId } })).to.be.false
+        })
+    })
+  })
+})
diff --git a/test/integration-tests/helpers.js b/test/integration-tests/helpers.js
index 56dacac0..030509ba 100644
--- a/test/integration-tests/helpers.js
+++ b/test/integration-tests/helpers.js
@@ -29,4 +29,36 @@ async function cveRequestAsCnaHelper (cveId) {
     })
 }
 
-module.exports = { cveIdReserveHelper, cveRequestAsCnaHelper }
+async function cveRequestAsCnaHelperWithCnaContainer (cveId, cnaContainer) {
+  await chai.request(app)
+    .post(`/api/cve/${cveId}/cna`)
+    .set(constants.nonSecretariatUserHeaders)
+    .send(cnaContainer)
+    .then((res, err) => {
+      // Safety Expect
+      expect(res).to.have.status(200)
+    })
+}
+
+async function cveUpdatetAsCnaHelperWithCnaContainer (cveId, cnaContainer) {
+  await chai.request(app)
+    .put(`/api/cve/${cveId}/cna`)
+    .set(constants.nonSecretariatUserHeaders)
+    .send(cnaContainer)
+    .then((res, err) => {
+      // Safety Expect
+      expect(res).to.have.status(200)
+    })
+}
+
+async function cveUpdateAsCnaHelperWithAdpContainer (cveId, adpContainer) {
+  await chai.request(app)
+    .put(`/api/cve/${cveId}/adp`)
+    .set(constants.nonSecretariatUserHeaders)
+    .send(adpContainer)
+    .then((res, err) => {
+      expect(res).to.have.status(200)
+    })
+}
+
+module.exports = { cveIdReserveHelper, cveRequestAsCnaHelper, cveRequestAsCnaHelperWithCnaContainer, cveUpdatetAsCnaHelperWithCnaContainer, cveUpdateAsCnaHelperWithAdpContainer }
diff --git a/test/unit-tests/cve-id/cveIdGetAllTest.js b/test/unit-tests/cve-id/cveIdGetAllTest.js
index 43e06a80..e30098a7 100644
--- a/test/unit-tests/cve-id/cveIdGetAllTest.js
+++ b/test/unit-tests/cve-id/cveIdGetAllTest.js
@@ -1,882 +1,153 @@
-const express = require('express')
-const app = express()
 const chai = require('chai')
+const sinon = require('sinon')
+const { faker } = require('@faker-js/faker')
 const expect = chai.expect
-chai.use(require('chai-http'))
-
-// Body Parser Middleware
-app.use(express.json()) // Allows us to handle raw JSON data
-app.use(express.urlencoded({ extended: false })) // Allows us to handle url encoded data
-const middleware = require('../../../src/middleware/middleware')
-app.use(middleware.createCtxAndReqUUID)
-
-const cveIdFixtures = require('./mockObjects.cve-id')
-const cveIdController = require('../../../src/controller/cve-id.controller/cve-id.controller')
-const cveIdParams = require('../../../src/controller/cve-id.controller/cve-id.middleware')
-const orgController = require('../../../src/controller/org.controller/org.controller')
-const orgParams = require('../../../src/controller/org.controller/org.middleware')
-
-class OrgGetCveIdNoCveIdsWithParams {
-  async isSecretariat () {
-    return false
-  }
-
-  async isBulkDownload () {
-    return false
+const _ = require('lodash')
+
+const cveIdController = require('../../../src/controller/cve-id.controller/cve-id.controller.js')
+const OrgRepository = require('../../../src/repositories/orgRepository.js')
+const CveIdRepository = require('../../../src/repositories/cveIdRepository.js')
+const UserRepository = require('../../../src/repositories/userRepository.js')
+
+const orgUUID = faker.datatype.uuid()
+const orgUUID2 = faker.datatype.uuid()
+const userUUID = faker.datatype.uuid()
+
+const stubOrg = {
+  short_name: 'testOrg',
+  name: 'test_org',
+  UUID: orgUUID,
+  authority: {
+    active_roles: [
+      'CNA',
+      'Secretariat'
+    ]
   }
+}
 
-  async getOrgUUID () {
-    return cveIdFixtures.owningOrg.UUID
+const stubOrg2 = {
+  short_name: 'testOrg2',
+  name: 'test_org2',
+  UUID: orgUUID2,
+  authority: {
+    active_roles: [
+      'CNA'
+    ]
   }
 }
 
-describe('Testing the GET /cve-id endpoint in CveId Controller', () => {
-  context('Positive Tests', () => {
-    it('No CVEs were found for the specified query parameters', (done) => {
-      class CveIdGetCveIdNoResultsWithParams {
-        async aggregatePaginate () {
-          const res = {
-            itemsList: [],
-            itemCount: 0,
-            itemsPerPage: 1000,
-            currentPage: 1,
-            pageCount: 1,
-            pagingCounter: 1,
-            hasPrevPage: false,
-            hasNextPage: false,
-            prevPage: null,
-            nextPage: null
-          }
-          return res
-        }
-
-        async countDocuments () {
-          return 0
-        }
-      }
-
-      app.route('/cve-id-filtered-none-found')
-        .get((req, res, next) => {
-          const factory = {
-            getCveIdRepository: () => { return new CveIdGetCveIdNoResultsWithParams() },
-            getOrgRepository: () => { return new OrgGetCveIdNoCveIdsWithParams() }
-          }
-          req.ctx.repositories = factory
-          next()
-        }, cveIdParams.parseGetParams, cveIdController.CVEID_GET_FILTER)
-
-      chai.request(app)
-        .get('/cve-id-filtered-none-found?state=published&cve_id_year=2010')
-        .set(cveIdFixtures.owningOrgHeader)
-        .end((err, res) => {
-          if (err) {
-            done(err)
-          }
-
-          expect(res).to.have.status(200)
-          expect(res).to.have.property('body').and.to.be.an('object')
-          expect(res.body).to.have.property('cve_ids').and.to.be.a('array').and.to.have.lengthOf(0)
-          done()
-        })
-    })
-
-    it('The "state" query parameter is provided', (done) => {
-      class CveIdGetCveIdStateProvided {
-        constructor () {
-          this.testRes1 = JSON.parse(JSON.stringify(cveIdFixtures.cvePublished))
-          this.testRes1.owning_cna = JSON.parse(JSON.stringify(cveIdFixtures.owningOrg.short_name))
-          this.testRes1.requested_by.cna = JSON.parse(JSON.stringify(cveIdFixtures.owningOrg.short_name))
-          this.testRes1.requested_by.user = JSON.parse(JSON.stringify(cveIdFixtures.owningOrgUser.username))
-        }
-
-        async aggregatePaginate () {
-          const res = {
-            itemsList: [this.testRes1],
-            itemCount: 1,
-            itemsPerPage: 1000,
-            currentPage: 1,
-            pageCount: 1,
-            pagingCounter: 1,
-            hasPrevPage: false,
-            hasNextPage: false,
-            prevPage: null,
-            nextPage: null
-          }
-          return res
-        }
-
-        async countDocuments () {
-          return 1
-        }
-      }
-
-      app.route('/cve-id-filtered-state-provided')
-        .get((req, res, next) => {
-          const factory = {
-            getCveIdRepository: () => { return new CveIdGetCveIdStateProvided() },
-            getOrgRepository: () => { return new OrgGetCveIdNoCveIdsWithParams() }
-          }
-          req.ctx.repositories = factory
-          next()
-        }, cveIdParams.parseGetParams, cveIdController.CVEID_GET_FILTER)
-
-      chai.request(app)
-        .get('/cve-id-filtered-state-provided?state=PUBLISHED')
-        .set(cveIdFixtures.owningOrgHeader)
-        .end((err, res) => {
-          if (err) {
-            done(err)
-          }
-
-          expect(res).to.have.status(200)
-          expect(res).to.have.property('body').and.to.be.an('object')
-          expect(res.body).to.have.property('cve_ids').and.to.be.a('array').and.to.have.lengthOf(1)
-          expect(res.body.cve_ids[0]).to.have.property('cve_id').and.to.equal(cveIdFixtures.cveId)
-          expect(res.body.cve_ids[0]).to.have.property('state').and.to.equal('PUBLISHED')
-          expect(res.body.cve_ids[0]).to.have.property('owning_cna').and.to.equal(cveIdFixtures.owningOrg.short_name)
-          expect(res.body.cve_ids[0]).to.have.nested.property('requested_by.cna').and.to.equal(cveIdFixtures.owningOrg.short_name)
-          expect(res.body.cve_ids[0]).to.have.nested.property('requested_by.user').and.to.equal(cveIdFixtures.owningOrgUser.username)
-          done()
-        })
-    })
-
-    it('The "cve_id_year" query parameter is provided', (done) => {
-      class CveIdGetCveIdYearProvided {
-        constructor () {
-          this.testRes1 = JSON.parse(JSON.stringify(cveIdFixtures.cvePublished))
-          this.testRes1.owning_cna = JSON.parse(JSON.stringify(cveIdFixtures.owningOrg.short_name))
-          this.testRes1.requested_by.cna = JSON.parse(JSON.stringify(cveIdFixtures.owningOrg.short_name))
-          this.testRes1.requested_by.user = JSON.parse(JSON.stringify(cveIdFixtures.owningOrgUser.username))
-        }
-
-        async aggregatePaginate () {
-          const res = {
-            itemsList: [this.testRes1],
-            itemCount: 1,
-            itemsPerPage: 1000,
-            currentPage: 1,
-            pageCount: 1,
-            pagingCounter: 1,
-            hasPrevPage: false,
-            hasNextPage: false,
-            prevPage: null,
-            nextPage: null
-          }
-          return res
-        }
-
-        async countDocuments () {
-          return 1
-        }
-      }
-
-      app.route('/cve-id-filtered-cve-id-year-provided')
-        .get((req, res, next) => {
-          const factory = {
-            getCveIdRepository: () => { return new CveIdGetCveIdYearProvided() },
-            getOrgRepository: () => { return new OrgGetCveIdNoCveIdsWithParams() }
-          }
-          req.ctx.repositories = factory
-          next()
-        }, cveIdParams.parseGetParams, cveIdController.CVEID_GET_FILTER)
-
-      chai.request(app)
-        .get(`/cve-id-filtered-cve-id-year-provided?cve_id_year=${cveIdFixtures.cveIdYear}`)
-        .set(cveIdFixtures.owningOrgHeader)
-        .end((err, res) => {
-          if (err) {
-            done(err)
-          }
-
-          expect(res).to.have.status(200)
-          expect(res).to.have.property('body').and.to.be.an('object')
-          expect(res.body).to.have.property('cve_ids').and.to.be.a('array').and.to.have.lengthOf(1)
-          expect(res.body.cve_ids[0]).to.have.property('cve_id').and.to.equal(cveIdFixtures.cveId)
-          expect(res.body.cve_ids[0]).to.have.property('cve_year').and.to.equal(cveIdFixtures.cveIdYear)
-          expect(res.body.cve_ids[0]).to.have.property('state').and.to.equal('PUBLISHED')
-          expect(res.body.cve_ids[0]).to.have.property('owning_cna').and.to.equal(cveIdFixtures.owningOrg.short_name)
-          expect(res.body.cve_ids[0]).to.have.nested.property('requested_by.cna').and.to.equal(cveIdFixtures.owningOrg.short_name)
-          expect(res.body.cve_ids[0]).to.have.nested.property('requested_by.user').and.to.equal(cveIdFixtures.owningOrgUser.username)
-          done()
-        })
-    })
-
-    it('The requester is not the secretariat and no query parameters are provided', (done) => {
-      class CveIdGetCveIdNotSecretariatNoQuery {
-        constructor () {
-          this.testRes1 = JSON.parse(JSON.stringify(cveIdFixtures.cvePublished))
-          this.testRes1.owning_cna = JSON.parse(JSON.stringify(cveIdFixtures.owningOrg.short_name))
-          this.testRes1.requested_by.cna = JSON.parse(JSON.stringify(cveIdFixtures.owningOrg.short_name))
-          this.testRes1.requested_by.user = JSON.parse(JSON.stringify(cveIdFixtures.owningOrgUser.username))
-          this.testRes2 = JSON.parse(JSON.stringify(cveIdFixtures.cveDummy1))
-          this.testRes2.owning_cna = JSON.parse(JSON.stringify(cveIdFixtures.owningOrg.short_name))
-          this.testRes2.requested_by.cna = JSON.parse(JSON.stringify(cveIdFixtures.secretariatOrg.short_name))
-          this.testRes2.requested_by.user = JSON.parse(JSON.stringify(cveIdFixtures.secretariatUser.username))
-        }
-
-        async aggregatePaginate () {
-          const res = {
-            itemsList: [this.testRes1, this.testRes2],
-            itemCount: 2,
-            itemsPerPage: 1000,
-            currentPage: 1,
-            pageCount: 1,
-            pagingCounter: 1,
-            hasPrevPage: false,
-            hasNextPage: false,
-            prevPage: null,
-            nextPage: null
-          }
-          return res
-        }
-
-        async countDocuments () {
-          return 2
-        }
-      }
-
-      app.route('/cve-id-filtered-not-secretariat-no-query')
-        .get((req, res, next) => {
-          const factory = {
-            getCveIdRepository: () => { return new CveIdGetCveIdNotSecretariatNoQuery() },
-            getOrgRepository: () => { return new OrgGetCveIdNoCveIdsWithParams() }
-          }
-          req.ctx.repositories = factory
-          next()
-        }, cveIdParams.parseGetParams, cveIdController.CVEID_GET_FILTER)
-
-      chai.request(app)
-        .get('/cve-id-filtered-not-secretariat-no-query')
-        .set(cveIdFixtures.owningOrgHeader)
-        .end((err, res) => {
-          if (err) {
-            done(err)
-          }
-
-          expect(res).to.have.status(200)
-          expect(res).to.have.property('body').and.to.be.an('object')
-          expect(res.body).to.have.property('cve_ids').and.to.be.a('array').and.to.have.lengthOf(2)
-          expect(res.body.cve_ids[0]).to.nested.include({ cve_id: cveIdFixtures.cveId }).and.to.nested.include({ cve_year: cveIdFixtures.cveIdYear })
-          expect(res.body.cve_ids[0]).to.nested.include({ state: cveIdFixtures.cvePublished.state }).and.to.nested.include({ owning_cna: cveIdFixtures.owningOrg.short_name })
-          expect(res.body.cve_ids[0]).to.nested.include({ 'requested_by.cna': cveIdFixtures.owningOrg.short_name }).and.to.nested.include({ 'requested_by.user': cveIdFixtures.owningOrgUser.username })
-          expect(res.body.cve_ids[1]).to.nested.include({ cve_id: cveIdFixtures.cveDummy1.cve_id }).and.to.nested.include({ cve_year: cveIdFixtures.cveDummy1.cve_year })
-          expect(res.body.cve_ids[1]).to.nested.include({ state: cveIdFixtures.cveDummy1.state }).and.to.nested.include({ owning_cna: cveIdFixtures.owningOrg.short_name })
-          expect(res.body.cve_ids[1]).to.nested.include({ 'requested_by.cna': cveIdFixtures.secretariatOrg.short_name }).and.to.nested.include({ 'requested_by.user': cveIdFixtures.secretariatUser.username })
-          done()
-        })
-    })
-
-    it('Updating the org of the user who requested the cve id', (done) => {
-      class OrgUserCveIdUpdated {
-        async getOrgUUID (shortname) {
-          if (shortname === cveIdFixtures.owningOrg.short_name) {
-            return cveIdFixtures.owningOrg.UUID
-          } else if (shortname === cveIdFixtures.org.short_name) {
-            return cveIdFixtures.org.UUID
-          }
-          return null
-        }
-      }
-
-      class UserOrgCveIdUpdated {
-        async findOneByUserNameAndOrgUUID () {
-          return cveIdFixtures.owningOrgUser
-        }
-
-        async find () {
-          return []
-        }
-
-        async updateByUserNameAndOrgUUID () {
-          cveIdFixtures.owningOrgUser.org_UUID = cveIdFixtures.org.UUID
-          return { n: 1, nModified: 1, ok: 1 }
-        }
-
-        async getUserUUID () {
-          return null
-        }
-      }
-
-      class OrgGetUserCveIdUpdated {
-        constructor () {
-          cveIdFixtures.owningOrgUser.org_UUID = cveIdFixtures.org.UUID
-        }
-
-        async isSecretariat () {
-          return true
-        }
-
-        async isBulkDownload () {
-          return false
-        }
-
-        async getOrgUUID () {
-          return cveIdFixtures.org.UUID
-        }
-      }
-
-      class UserGetUserCveIdUpdated {
-        async aggregate () {
-          return [cveIdFixtures.owningOrgUser]
-        }
-      }
-
-      app.route('/cve-id-filtered-update-user-org-request-cve-id-1/:shortname/:username')
-        .put((req, res, next) => {
-          const factory = {
-            getOrgRepository: () => { return new OrgUserCveIdUpdated() },
-            getUserRepository: () => { return new UserOrgCveIdUpdated() }
-          }
-          req.ctx.repositories = factory
-          next()
-        }, orgParams.parsePostParams, orgController.USER_UPDATE_SINGLE)
-
-      app.route('/cve-id-filtered-update-user-org-request-cve-id-2/:shortname/:username')
-        .get((req, res, next) => {
-          const factory = {
-            getOrgRepository: () => { return new OrgGetUserCveIdUpdated() },
-            getUserRepository: () => { return new UserGetUserCveIdUpdated() }
-          }
-          req.ctx.repositories = factory
-          next()
-        }, orgParams.parseGetParams, orgController.USER_SINGLE)
-
-      chai.request(app)
-        .put(`/cve-id-filtered-update-user-org-request-cve-id-1/${cveIdFixtures.owningOrg.short_name}/${cveIdFixtures.owningOrgUser.username}?org_short_name=${cveIdFixtures.org.short_name}`)
-        .set(cveIdFixtures.owningOrgHeader)
-        .end((err) => {
-          if (err) {
-            done(err)
-          }
-
-          chai.request(app)
-            .get(`/cve-id-filtered-update-user-org-request-cve-id-2/${cveIdFixtures.org.short_name}/${cveIdFixtures.owningOrgUser.username}`)
-            .set(cveIdFixtures.secretariatHeader)
-            .end((err, res) => {
-              if (err) {
-                done(err)
-              }
-
-              expect(res).to.have.status(200)
-              expect(res).to.have.property('body').and.to.be.a('object')
-              expect(res.body).to.have.property('username').and.to.equal(cveIdFixtures.owningOrgUser.username)
-              expect(res.body).to.have.property('org_UUID').and.to.equal(cveIdFixtures.org.UUID)
-              done()
-            })
-        })
-    })
-
-    it('The requested_by field did not change after updating the org of the user who requested the cve id', (done) => {
-      class CveIdGetCveIdRequestedNotChanged {
-        constructor () {
-          this.testRes1 = JSON.parse(JSON.stringify(cveIdFixtures.cvePublished))
-          this.testRes1.owning_cna = JSON.parse(JSON.stringify(cveIdFixtures.owningOrg.short_name))
-          this.testRes1.requested_by.cna = JSON.parse(JSON.stringify(cveIdFixtures.owningOrg.short_name))
-          this.testRes1.requested_by.user = JSON.parse(JSON.stringify(cveIdFixtures.owningOrgUser.username))
-          this.testRes2 = JSON.parse(JSON.stringify(cveIdFixtures.cveDummy1))
-          this.testRes2.owning_cna = JSON.parse(JSON.stringify(cveIdFixtures.owningOrg.short_name))
-          this.testRes2.requested_by.cna = JSON.parse(JSON.stringify(cveIdFixtures.secretariatOrg.short_name))
-          this.testRes2.requested_by.user = JSON.parse(JSON.stringify(cveIdFixtures.secretariatUser.username))
-        }
-
-        async aggregatePaginate () {
-          const res = {
-            itemsList: [this.testRes1, this.testRes2],
-            itemCount: 2,
-            itemsPerPage: 1000,
-            currentPage: 1,
-            pageCount: 1,
-            pagingCounter: 1,
-            hasPrevPage: false,
-            hasNextPage: false,
-            prevPage: null,
-            nextPage: null
-          }
-          return res
-        }
-
-        async countDocuments () {
-          return 2
-        }
-      }
-
-      class OrgGetCveIdRequestedNotChanged {
-        async getOrgUUID () {
-          return cveIdFixtures.owningOrg.UUID
-        }
-
-        async isSecretariat () {
-          return false
-        }
-
-        async isBulkDownload () {
-          return false
-        }
-      }
-
-      app.route('/cve-id-filtered-requested-field-not-changed')
-        .get((req, res, next) => {
-          const factory = {
-            getCveIdRepository: () => { return new CveIdGetCveIdRequestedNotChanged() },
-            getOrgRepository: () => { return new OrgGetCveIdRequestedNotChanged() }
-          }
-          req.ctx.repositories = factory
-          next()
-        }, cveIdParams.parseGetParams, cveIdController.CVEID_GET_FILTER)
-
-      chai.request(app)
-        .get('/cve-id-filtered-requested-field-not-changed')
-        .set(cveIdFixtures.owningOrgHeader)
-        .end((err, res) => {
-          if (err) {
-            done(err)
-          }
-
-          expect(res).to.have.status(200)
-          expect(res).to.have.property('body').and.to.be.an('object')
-          expect(res.body).to.have.property('cve_ids').and.to.be.a('array').and.to.have.lengthOf(2)
-          expect(res.body.cve_ids[0]).to.nested.include({ cve_id: cveIdFixtures.cveId }).and.to.nested.include({ cve_year: cveIdFixtures.cveIdYear })
-          expect(res.body.cve_ids[0]).to.nested.include({ state: cveIdFixtures.cvePublished.state }).and.to.nested.include({ owning_cna: cveIdFixtures.owningOrg.short_name })
-          expect(res.body.cve_ids[0]).to.nested.include({ 'requested_by.cna': cveIdFixtures.owningOrg.short_name }).and.to.nested.include({ 'requested_by.user': cveIdFixtures.owningOrgUser.username })
-          expect(res.body.cve_ids[1]).to.nested.include({ cve_id: cveIdFixtures.cveDummy1.cve_id }).and.to.nested.include({ cve_year: cveIdFixtures.cveDummy1.cve_year })
-          expect(res.body.cve_ids[1]).to.nested.include({ state: cveIdFixtures.cveDummy1.state }).and.to.nested.include({ owning_cna: cveIdFixtures.owningOrg.short_name })
-          expect(res.body.cve_ids[1]).to.nested.include({ 'requested_by.cna': cveIdFixtures.secretariatOrg.short_name }).and.to.nested.include({ 'requested_by.user': cveIdFixtures.secretariatUser.username })
-          done()
-        })
-    })
-
-    it('The requester is the secretariat and no query parameters are provided', (done) => {
-      class CveIdGetCveIdSecretariatNoQuery {
-        constructor () {
-          this.testRes1 = JSON.parse(JSON.stringify(cveIdFixtures.cvePublished))
-          this.testRes1.owning_cna = JSON.parse(JSON.stringify(cveIdFixtures.owningOrg.short_name))
-          this.testRes1.requested_by.cna = JSON.parse(JSON.stringify(cveIdFixtures.owningOrg.short_name))
-          this.testRes1.requested_by.user = JSON.parse(JSON.stringify(cveIdFixtures.owningOrgUser.username))
-          this.testRes2 = JSON.parse(JSON.stringify(cveIdFixtures.cveDummy1))
-          this.testRes2.owning_cna = JSON.parse(JSON.stringify(cveIdFixtures.owningOrg.short_name))
-          this.testRes2.requested_by.cna = JSON.parse(JSON.stringify(cveIdFixtures.secretariatOrg.short_name))
-          this.testRes2.requested_by.user = JSON.parse(JSON.stringify(cveIdFixtures.secretariatUser.username))
-          this.testRes3 = JSON.parse(JSON.stringify(cveIdFixtures.cveDummy2))
-          this.testRes3.owning_cna = JSON.parse(JSON.stringify(cveIdFixtures.secretariatOrg.short_name))
-          this.testRes3.requested_by.cna = JSON.parse(JSON.stringify(cveIdFixtures.secretariatOrg.short_name))
-          this.testRes3.requested_by.user = JSON.parse(JSON.stringify(cveIdFixtures.secretariatUser.username))
-          this.testRes4 = JSON.parse(JSON.stringify(cveIdFixtures.cveDummy3))
-          this.testRes4.owning_cna = JSON.parse(JSON.stringify(cveIdFixtures.secretariatOrg.short_name))
-          this.testRes4.requested_by.cna = JSON.parse(JSON.stringify(cveIdFixtures.secretariatOrg.short_name))
-          this.testRes4.requested_by.user = JSON.parse(JSON.stringify(cveIdFixtures.secretariatUser.username))
-          this.testRes5 = JSON.parse(JSON.stringify(cveIdFixtures.cveDummy4))
-          this.testRes5.owning_cna = JSON.parse(JSON.stringify(cveIdFixtures.org.short_name))
-          this.testRes5.requested_by.cna = JSON.parse(JSON.stringify(cveIdFixtures.secretariatOrg.short_name))
-          this.testRes5.requested_by.user = JSON.parse(JSON.stringify(cveIdFixtures.secretariatUser.username))
-        }
-
-        async aggregatePaginate () {
-          const res = {
-            itemsList: [this.testRes1, this.testRes2, this.testRes3, this.testRes4, this.testRes5],
-            itemCount: 5,
-            itemsPerPage: 1000,
-            currentPage: 1,
-            pageCount: 1,
-            pagingCounter: 1,
-            hasPrevPage: false,
-            hasNextPage: false,
-            prevPage: null,
-            nextPage: null
-          }
-          return res
-        }
-
-        async countDocuments () {
-          return 5
-        }
-      }
-
-      class OrgGetCveIdRequestorSecretariatNoQuery {
-        async getOrgUUID () {
-          return cveIdFixtures.secretariatOrg.UUID
-        }
-
-        async findOneByUUID () {
-          return cveIdFixtures.secretariatOrg
-        }
-
-        async isSecretariat () {
-          return true
-        }
-
-        async isBulkDownload () {
-          return false
-        }
-      }
-
-      app.route('/cve-id-filtered-secretariat-no-query')
-        .get((req, res, next) => {
-          const factory = {
-            getCveIdRepository: () => { return new CveIdGetCveIdSecretariatNoQuery() },
-            getOrgRepository: () => { return new OrgGetCveIdRequestorSecretariatNoQuery() }
-          }
-          req.ctx.repositories = factory
-          next()
-        }, cveIdParams.parseGetParams, cveIdController.CVEID_GET_FILTER)
-
-      chai.request(app)
-        .get('/cve-id-filtered-secretariat-no-query')
-        .set(cveIdFixtures.secretariatHeader)
-        .end((err, res) => {
-          if (err) {
-            done(err)
-          }
-
-          expect(res).to.have.status(200)
-          expect(res).to.have.property('body').and.to.be.an('object')
-          expect(res.body).to.have.property('cve_ids').and.to.be.a('array').and.to.have.lengthOf(5)
-          expect(res.body.cve_ids[0]).to.nested.include({ cve_id: cveIdFixtures.cvePublished.cve_id }).and.to.nested.include({ cve_year: cveIdFixtures.cveIdYear })
-          expect(res.body.cve_ids[0]).to.nested.include({ state: cveIdFixtures.cvePublished.state }).and.to.nested.include({ owning_cna: cveIdFixtures.owningOrg.short_name })
-          expect(res.body.cve_ids[0]).to.nested.include({ 'requested_by.cna': cveIdFixtures.owningOrg.short_name }).and.to.nested.include({ 'requested_by.user': cveIdFixtures.owningOrgUser.username })
-          expect(res.body.cve_ids[1]).to.nested.include({ cve_id: cveIdFixtures.cveDummy1.cve_id }).and.to.nested.include({ cve_year: cveIdFixtures.cveDummy1.cve_year })
-          expect(res.body.cve_ids[1]).to.nested.include({ state: cveIdFixtures.cveDummy1.state }).and.to.nested.include({ owning_cna: cveIdFixtures.owningOrg.short_name })
-          expect(res.body.cve_ids[1]).to.nested.include({ 'requested_by.cna': cveIdFixtures.secretariatOrg.short_name }).and.to.nested.include({ 'requested_by.user': cveIdFixtures.secretariatUser.username })
-          expect(res.body.cve_ids[2]).to.nested.include({ cve_id: cveIdFixtures.cveDummy2.cve_id }).and.to.nested.include({ cve_year: cveIdFixtures.cveDummy2.cve_year })
-          expect(res.body.cve_ids[2]).to.nested.include({ state: cveIdFixtures.cveDummy2.state }).and.to.nested.include({ owning_cna: cveIdFixtures.secretariatOrg.short_name })
-          expect(res.body.cve_ids[2]).to.nested.include({ 'requested_by.cna': cveIdFixtures.secretariatOrg.short_name }).and.to.nested.include({ 'requested_by.user': cveIdFixtures.secretariatUser.username })
-          expect(res.body.cve_ids[3]).to.nested.include({ cve_id: cveIdFixtures.cveDummy3.cve_id }).and.to.nested.include({ cve_year: cveIdFixtures.cveDummy3.cve_year })
-          expect(res.body.cve_ids[3]).to.nested.include({ state: cveIdFixtures.cveDummy3.state }).and.to.nested.include({ owning_cna: cveIdFixtures.secretariatOrg.short_name })
-          expect(res.body.cve_ids[3]).to.nested.include({ 'requested_by.cna': cveIdFixtures.secretariatOrg.short_name }).and.to.nested.include({ 'requested_by.user': cveIdFixtures.secretariatUser.username })
-          expect(res.body.cve_ids[4]).to.nested.include({ cve_id: cveIdFixtures.cveDummy4.cve_id }).and.to.nested.include({ cve_year: cveIdFixtures.cveDummy4.cve_year })
-          expect(res.body.cve_ids[4]).to.nested.include({ state: cveIdFixtures.cveDummy4.state }).and.to.nested.include({ owning_cna: cveIdFixtures.org.short_name })
-          expect(res.body.cve_ids[4]).to.nested.include({ 'requested_by.cna': cveIdFixtures.secretariatOrg.short_name }).and.to.nested.include({ 'requested_by.user': cveIdFixtures.secretariatUser.username })
-          done()
-        })
-    })
-
-    it('The secretariat gets a list of non-paginated cve ids', (done) => {
-      const itemsPerPage = 3
-
-      class MyOrgRepo {
-        async getOrgUUID () {
-          return cveIdFixtures.secretariatOrg.UUID
-        }
-
-        async isSecretariat () {
-          return true
-        }
-
-        async isBulkDownload () {
-          return false
-        }
-      }
-
-      class MyCveIdRepo {
-        constructor () {
-          this.testRes1 = JSON.parse(JSON.stringify(cveIdFixtures.cvePublished))
-          this.testRes1.owning_cna = JSON.parse(JSON.stringify(cveIdFixtures.owningOrg.short_name))
-          this.testRes1.requested_by.cna = JSON.parse(JSON.stringify(cveIdFixtures.owningOrg.short_name))
-          this.testRes1.requested_by.user = JSON.parse(JSON.stringify(cveIdFixtures.owningOrgUser.username))
-          this.testRes2 = JSON.parse(JSON.stringify(cveIdFixtures.cveDummy1))
-          this.testRes2.owning_cna = JSON.parse(JSON.stringify(cveIdFixtures.owningOrg.short_name))
-          this.testRes2.requested_by.cna = JSON.parse(JSON.stringify(cveIdFixtures.secretariatOrg.short_name))
-          this.testRes2.requested_by.user = JSON.parse(JSON.stringify(cveIdFixtures.secretariatUser.username))
-        }
-
-        async aggregatePaginate () {
-          const res = {
-            itemsList: [this.testRes1, this.testRes2],
-            itemCount: 2,
-            itemsPerPage: itemsPerPage,
-            currentPage: 1,
-            pageCount: 1,
-            pagingCounter: 1,
-            hasPrevPage: false,
-            hasNextPage: false,
-            prevPage: null,
-            nextPage: null
-          }
-
-          return res
-        }
-      }
-
-      app.route('/cve-id-filtered-non-paginated')
-        .get((req, res, next) => {
-          const factory = {
-            getCveIdRepository: () => { return new MyCveIdRepo() },
-            getOrgRepository: () => { return new MyOrgRepo() }
-          }
-          req.ctx.repositories = factory
-          next()
-        }, cveIdParams.parseGetParams, cveIdController.CVEID_GET_FILTER)
-
-      const testSecretariatHeader = Object.assign({}, cveIdFixtures.secretariatHeader)
-      chai.request(app)
-        .get('/cve-id-filtered-non-paginated')
-        .set(testSecretariatHeader)
-        .end((err, res) => {
-          if (err) {
-            done(err)
-          }
-
-          expect(res).to.have.status(200)
-          expect(res).to.have.property('body').and.to.be.a('object')
-          expect(res.body).to.have.property('cve_ids').and.to.be.a('array').and.to.have.lengthOf(2)
-          expect(res.body).to.not.have.property('totalCount')
-          expect(res.body).to.not.have.property('itemsPerPage')
-          expect(res.body).to.not.have.property('pageCount')
-          expect(res.body).to.not.have.property('currentPage')
-          expect(res.body).to.not.have.property('prevPage')
-          expect(res.body).to.not.have.property('nextPage')
-          done()
-        })
-    })
-
-    it('The secretariat gets a list of paginated cve ids with "page" query param undefined', (done) => {
-      const itemsPerPage = 3
-
-      class MyOrgRepo {
-        async getOrgUUID () {
-          return cveIdFixtures.secretariatOrg.UUID
-        }
-
-        async isSecretariat () {
-          return true
-        }
-
-        async isBulkDownload () {
-          return false
-        }
-      }
-
-      class MyCveIdRepo {
-        constructor () {
-          this.testRes1 = JSON.parse(JSON.stringify(cveIdFixtures.cvePublished))
-          this.testRes1.owning_cna = JSON.parse(JSON.stringify(cveIdFixtures.owningOrg.short_name))
-          this.testRes1.requested_by.cna = JSON.parse(JSON.stringify(cveIdFixtures.owningOrg.short_name))
-          this.testRes1.requested_by.user = JSON.parse(JSON.stringify(cveIdFixtures.owningOrgUser.username))
-          this.testRes2 = JSON.parse(JSON.stringify(cveIdFixtures.cveDummy1))
-          this.testRes2.owning_cna = JSON.parse(JSON.stringify(cveIdFixtures.owningOrg.short_name))
-          this.testRes2.requested_by.cna = JSON.parse(JSON.stringify(cveIdFixtures.secretariatOrg.short_name))
-          this.testRes2.requested_by.user = JSON.parse(JSON.stringify(cveIdFixtures.secretariatUser.username))
-          this.testRes3 = JSON.parse(JSON.stringify(cveIdFixtures.cveDummy2))
-          this.testRes3.owning_cna = JSON.parse(JSON.stringify(cveIdFixtures.secretariatOrg.short_name))
-          this.testRes3.requested_by.cna = JSON.parse(JSON.stringify(cveIdFixtures.secretariatOrg.short_name))
-          this.testRes3.requested_by.user = JSON.parse(JSON.stringify(cveIdFixtures.secretariatUser.username))
-          this.testRes4 = JSON.parse(JSON.stringify(cveIdFixtures.cveDummy3))
-          this.testRes4.owning_cna = JSON.parse(JSON.stringify(cveIdFixtures.secretariatOrg.short_name))
-          this.testRes4.requested_by.cna = JSON.parse(JSON.stringify(cveIdFixtures.secretariatOrg.short_name))
-          this.testRes4.requested_by.user = JSON.parse(JSON.stringify(cveIdFixtures.secretariatUser.username))
-          this.testRes5 = JSON.parse(JSON.stringify(cveIdFixtures.cveDummy4))
-          this.testRes5.owning_cna = JSON.parse(JSON.stringify(cveIdFixtures.org.short_name))
-          this.testRes5.requested_by.cna = JSON.parse(JSON.stringify(cveIdFixtures.secretariatOrg.short_name))
-          this.testRes5.requested_by.user = JSON.parse(JSON.stringify(cveIdFixtures.secretariatUser.username))
-        }
-
-        async aggregatePaginate () {
-          const res = {
-            itemsList: [this.testRes1, this.testRes2, this.testRes3],
-            itemCount: 5,
-            itemsPerPage: itemsPerPage,
-            currentPage: 1,
-            pageCount: 2,
-            pagingCounter: 1,
-            hasPrevPage: false,
-            hasNextPage: true,
-            prevPage: null,
-            nextPage: 2
-          }
-          return res
-        }
-      }
-
-      app.route('/cve-id-filtered-paginated')
-        .get((req, res, next) => {
-          const factory = {
-            getCveIdRepository: () => { return new MyCveIdRepo() },
-            getOrgRepository: () => { return new MyOrgRepo() }
-          }
-          req.ctx.repositories = factory
-          // temporary fix for #920: force pagnation
-          req.TEST_PAGINATOR_LIMIT = itemsPerPage
-          next()
-        }, cveIdParams.parseGetParams, cveIdController.CVEID_GET_FILTER)
-
-      const testSecretariatHeader = Object.assign({}, cveIdFixtures.secretariatHeader)
-      chai.request(app)
-        .get('/cve-id-filtered-paginated')
-        .set(testSecretariatHeader)
-        .end((err, res) => {
-          if (err) {
-            done(err)
-          }
-
-          expect(res).to.have.status(200)
-          expect(res).to.have.property('body').and.to.be.a('object')
-          expect(res.body).to.have.property('cve_ids').and.to.be.a('array').and.to.have.lengthOf(3)
-          expect(res.body).to.have.property('totalCount').and.to.equal(5)
-          expect(res.body).to.have.property('itemsPerPage').and.to.equal(itemsPerPage)
-          expect(res.body).to.have.property('pageCount').and.to.equal(2)
-          expect(res.body).to.have.property('currentPage').and.to.equal(1)
-          expect(res.body).to.have.property('prevPage').and.to.equal(null)
-          expect(res.body).to.have.property('nextPage').and.to.equal(2)
-          done()
-        })
-    })
-
-    it('The secretariat gets a list of paginated cve ids with "page" query param defined', (done) => {
-      const itemsPerPage = 3
-
-      class MyOrgRepo {
-        async getOrgUUID () {
-          return cveIdFixtures.secretariatOrg.UUID
-        }
-
-        async isSecretariat () {
-          return true
-        }
-
-        async isBulkDownload () {
-          return false
-        }
-      }
-
-      class MyCveIdRepo {
-        constructor () {
-          this.testRes1 = JSON.parse(JSON.stringify(cveIdFixtures.cvePublished))
-          this.testRes1.owning_cna = JSON.parse(JSON.stringify(cveIdFixtures.owningOrg.short_name))
-          this.testRes1.requested_by.cna = JSON.parse(JSON.stringify(cveIdFixtures.owningOrg.short_name))
-          this.testRes1.requested_by.user = JSON.parse(JSON.stringify(cveIdFixtures.owningOrgUser.username))
-          this.testRes2 = JSON.parse(JSON.stringify(cveIdFixtures.cveDummy1))
-          this.testRes2.owning_cna = JSON.parse(JSON.stringify(cveIdFixtures.owningOrg.short_name))
-          this.testRes2.requested_by.cna = JSON.parse(JSON.stringify(cveIdFixtures.secretariatOrg.short_name))
-          this.testRes2.requested_by.user = JSON.parse(JSON.stringify(cveIdFixtures.secretariatUser.username))
-          this.testRes3 = JSON.parse(JSON.stringify(cveIdFixtures.cveDummy2))
-          this.testRes3.owning_cna = JSON.parse(JSON.stringify(cveIdFixtures.secretariatOrg.short_name))
-          this.testRes3.requested_by.cna = JSON.parse(JSON.stringify(cveIdFixtures.secretariatOrg.short_name))
-          this.testRes3.requested_by.user = JSON.parse(JSON.stringify(cveIdFixtures.secretariatUser.username))
-          this.testRes4 = JSON.parse(JSON.stringify(cveIdFixtures.cveDummy3))
-          this.testRes4.owning_cna = JSON.parse(JSON.stringify(cveIdFixtures.secretariatOrg.short_name))
-          this.testRes4.requested_by.cna = JSON.parse(JSON.stringify(cveIdFixtures.secretariatOrg.short_name))
-          this.testRes4.requested_by.user = JSON.parse(JSON.stringify(cveIdFixtures.secretariatUser.username))
-          this.testRes5 = JSON.parse(JSON.stringify(cveIdFixtures.cveDummy4))
-          this.testRes5.owning_cna = JSON.parse(JSON.stringify(cveIdFixtures.org.short_name))
-          this.testRes5.requested_by.cna = JSON.parse(JSON.stringify(cveIdFixtures.secretariatOrg.short_name))
-          this.testRes5.requested_by.user = JSON.parse(JSON.stringify(cveIdFixtures.secretariatUser.username))
-        }
-
-        async aggregatePaginate () {
-          const res = {
-            itemsList: [this.testRes4, this.testRes3],
-            itemCount: 5,
-            itemsPerPage: itemsPerPage,
-            currentPage: 2,
-            pageCount: 2,
-            pagingCounter: 1,
-            hasPrevPage: true,
-            hasNextPage: false,
-            prevPage: 1,
-            nextPage: null
-          }
-          return res
-        }
-      }
-
-      app.route('/cve-id-filtered-paginated-2')
-        .get((req, res, next) => {
-          const factory = {
-            getCveIdRepository: () => { return new MyCveIdRepo() },
-            getOrgRepository: () => { return new MyOrgRepo() }
-          }
-          req.ctx.repositories = factory
-          // temporary fix for #920: force pagnation
-          req.TEST_PAGINATOR_LIMIT = itemsPerPage
-          next()
-        }, cveIdParams.parseGetParams, cveIdController.CVEID_GET_FILTER)
-
-      const testSecretariatHeader = Object.assign({}, cveIdFixtures.secretariatHeader)
-      chai.request(app)
-        .get('/cve-id-filtered-paginated-2?page=2')
-        .set(testSecretariatHeader)
-        .end((err, res) => {
-          if (err) {
-            done(err)
-          }
-
-          expect(res).to.have.status(200)
-          expect(res).to.have.property('body').and.to.be.a('object')
-          expect(res.body).to.have.property('cve_ids').and.to.be.a('array').and.to.have.lengthOf(2)
-          expect(res.body).to.have.property('totalCount').and.to.equal(5)
-          expect(res.body).to.have.property('itemsPerPage').and.to.equal(itemsPerPage)
-          expect(res.body).to.have.property('pageCount').and.to.equal(2)
-          expect(res.body).to.have.property('currentPage').and.to.equal(2)
-          expect(res.body).to.have.property('prevPage').and.to.equal(1)
-          expect(res.body).to.have.property('nextPage').and.to.equal(null)
-          done()
-        })
-    })
-
-    it('The secretariat gets an empty list of cve ids because there are no cve ids in the database', (done) => {
-      const itemsPerPage = 3
-
-      class MyOrgRepo {
-        async getOrgUUID () {
-          return cveIdFixtures.secretariatOrg.UUID
-        }
-
-        async isSecretariat () {
-          return true
-        }
-
-        async isBulkDownload () {
-          return false
-        }
-      }
+const stubUser = {
+  username: 'testUser',
+  org_UUID: orgUUID,
+  UUID: userUUID
+}
 
-      class MyCveIdRepo {
-        async aggregatePaginate () {
-          const res = {
-            itemsList: [],
-            itemCount: 0,
-            itemsPerPage: itemsPerPage,
-            currentPage: 1,
-            pageCount: 1,
-            pagingCounter: 1,
-            hasPrevPage: false,
-            hasNextPage: false,
-            prevPage: null,
-            nextPage: null
-          }
-          return res
-        }
-      }
+const stubCveId = {
+  requested_by: {
+    cna: orgUUID,
+    user: userUUID
+  },
+  cve_id: 'CVE-2017-4024',
+  cve_year: '2017',
+  state: 'PUBLISHED',
+  owning_cna: orgUUID2,
+  reserved: '2023-05-17T16:57:35.698Z'
+}
 
-      app.route('/cve-id-filtered-empty')
-        .get((req, res, next) => {
-          const factory = {
-            getCveIdRepository: () => { return new MyCveIdRepo() },
-            getOrgRepository: () => { return new MyOrgRepo() }
-          }
-          req.ctx.repositories = factory
-          next()
-        }, cveIdParams.parseGetParams, cveIdController.CVEID_GET_FILTER)
+const builtQuery = {
+  cve_year: 1999,
+  state: 'RESERVED',
+  'time.modified': {
+    $gt: '2022-01-07T00:00:00.000Z',
+    $lt: '2023-01-07T00:00:00.000Z'
+  }
+}
+describe('Testing getFilteredCveId function', () => {
+  let sandbox, status, json, res, next, getOrgRepository,
+    orgRepo, getCveIdRepository, cveIdRepo,
+    getUserRepository, userRepo, req, cveIdCopy
+
+  // Stub out functions called in insertAdp and reset them for each test
+  beforeEach(() => {
+    sandbox = sinon.createSandbox()
+    status = sandbox.stub()
+    json = sandbox.spy()
+    res = { json, status }
+    next = sandbox.spy()
+    status.returns(res)
+    cveIdCopy = _.cloneDeep(stubCveId)
+
+    const aggPagResp = {
+      itemsList: [cveIdCopy],
+      itemCount: 1,
+      itemsPerPage: 1000,
+      currentPage: 1,
+      pageCount: 1,
+      pagingCounter: 1,
+      hasPrevPage: false,
+      hasNextPage: false,
+      prevPage: null,
+      nextPage: null
+    }
+
+    orgRepo = new OrgRepository()
+    getOrgRepository = sandbox.stub()
+    getOrgRepository.returns(orgRepo)
+
+    userRepo = new UserRepository()
+    getUserRepository = sandbox.stub()
+    getUserRepository.returns(userRepo)
+
+    cveIdRepo = new CveIdRepository()
+    getCveIdRepository = sandbox.stub()
+    getCveIdRepository.returns(cveIdRepo)
+
+    sandbox.stub(cveIdRepo, 'findOneByCveId').returns(cveIdCopy)
+    sandbox.stub(cveIdRepo, 'aggregatePaginate').returns(aggPagResp)
+
+    sandbox.stub(orgRepo, 'getOrgUUID').returns(stubOrg.UUID)
+    sandbox.stub(orgRepo, 'isSecretariat').returns(true)
+    sandbox.stub(orgRepo, 'isBulkDownload').returns(false)
+    sandbox.stub(orgRepo, 'getAllOrgs').returns([stubOrg, stubOrg2])
+
+    sandbox.stub(userRepo, 'getUserUUID').returns(stubUser.UUID)
+    sandbox.stub(userRepo, 'getAllUsers').returns([stubUser])
+
+    sandbox.spy(cveIdController, 'CVEID_GET_FILTER')
+
+    req = {
+      ctx: {
+        org: stubOrg.short_name,
+        uuid: stubOrg.UUID,
+        query: {
+          cve_id_year: 1999,
+          'time_modified.gt': '2022-01-07T00:00:00.000Z',
+          'time_modified.lt': '2023-01-07T00:00:00.000Z',
+          state: 'RESERVED'
+        },
+        repositories: {
+          getOrgRepository,
+          getUserRepository,
+          getCveIdRepository
+        }
+      }
+    }
+  })
 
-      const testSecretariatHeader = Object.assign({}, cveIdFixtures.secretariatHeader)
-      chai.request(app)
-        .get('/cve-id-filtered-empty')
-        .set(testSecretariatHeader)
-        .end((err, res) => {
-          if (err) {
-            done(err)
-          }
+  afterEach(() => {
+    sandbox.restore()
+  })
+  it('Should have correctly built query', async () => {
+    await cveIdController.CVEID_GET_FILTER(req, res, next)
+    expect(cveIdRepo.aggregatePaginate.calledOnce)
+    expect(cveIdRepo.aggregatePaginate.args[0][0][0].$match).to.deep.equal(builtQuery)
+  })
 
-          expect(res).to.have.status(200)
-          expect(res).to.have.property('body').and.to.be.a('object')
-          expect(res.body).to.have.property('cve_ids').and.to.be.a('array').and.to.have.lengthOf(0)
-          expect(res.body).to.not.have.property('totalCount')
-          expect(res.body).to.not.have.property('itemsPerPage')
-          expect(res.body).to.not.have.property('pageCount')
-          expect(res.body).to.not.have.property('currentPage')
-          expect(res.body).to.not.have.property('prevPage')
-          expect(res.body).to.not.have.property('nextPage')
-          done()
-        })
-    })
+  it('Should swap UUIDs for names in Cve-ids', async () => {
+    await cveIdController.CVEID_GET_FILTER(req, res, next)
+    expect(res.status.args[0][0]).to.equal(200)
+    expect(res.json.args[0][0].cve_ids[0].owning_cna).to.equal(stubOrg2.short_name)
+    expect(res.json.args[0][0].cve_ids[0].requested_by.cna).to.equal(stubOrg.short_name)
+    expect(res.json.args[0][0].cve_ids[0].requested_by.user).to.equal(stubUser.username)
   })
 })