Repository: CVEProject/cve-services
Pull request #1034 (2023-02-20 14:52:11)

Update INT with Sprint 25
Updating INT from Dev with changes from Sprint 25



Patch:
diff --git a/api-docs/openapi.json b/api-docs/openapi.json
index bbea4b8f..9c25e0f9 100644
--- a/api-docs/openapi.json
+++ b/api-docs/openapi.json
@@ -1105,8 +1105,8 @@
         "tags": [
           "CVE Record"
         ],
-        "summary": "Creates a reject CVE Record for the specified ID if no record yet exists (accessible to CNAs and Secretariat)",
-        "description": "  <h2>Access Control</h2>  <p>User must belong to an organization with the <b>CNA</b> or <b>Secretariat</b> role</p>  <h2>Expected Behavior</h2>  <p><b>CNA:</b> Creates a reject CVE Record for a record owned by their organization</p>  <p><b>Secretariat:</b> Creates a reject CVE Record for a record owned by any organization</p>",
+        "summary": "Creates a rejected CVE Record for the specified ID if no record yet exists (accessible to CNAs and Secretariat)",
+        "description": "  <h2>Access Control</h2>  <p>User must belong to an organization with the <b>CNA</b> or <b>Secretariat</b> role</p>  <h2>Expected Behavior</h2>  <p><b>CNA:</b> Creates a rejected CVE Record for a record owned by their organization</p>  <p><b>Secretariat:</b> Creates a rejected CVE Record for a record owned by any organization</p>",
         "operationId": "cveCnaCreateReject",
         "parameters": [
           {
@@ -1205,8 +1205,8 @@
         "tags": [
           "CVE Record"
         ],
-        "summary": "Updates an existing CVE Record with a reject record for the specified ID (accessible to CNAs and Secretariat)",
-        "description": "  <h2>Access Control</h2>  <p>User must belong to an organization with the <b>CNA</b> or <b>Secretariat</b> role</p>  <h2>Expected Behavior</h2>  <p><b>CNA:</b> Updates a reject CVE Record for a record owned by their organization</p>  <p><b>Secretariat:</b> Updates a reject CVE Record for a record owned by any organization</p>",
+        "summary": "Updates an existing CVE Record with a rejected record for the specified ID (accessible to CNAs and Secretariat)",
+        "description": "  <h2>Access Control</h2>  <p>User must belong to an organization with the <b>CNA</b> or <b>Secretariat</b> role</p>  <h2>Expected Behavior</h2>  <p><b>CNA:</b> Updates a rejected CVE Record for a record owned by their organization</p>  <p><b>Secretariat:</b> Updates a rejected CVE Record for a record owned by any organization</p>",
         "operationId": "cveCnaUpdateReject",
         "parameters": [
           {
diff --git a/package-lock.json b/package-lock.json
index 29847c71..963c3c40 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -1,12 +1,12 @@
 {
     "name": "cve-services",
-    "version": "2.1.1",
+    "version": "2.1.2",
     "lockfileVersion": 2,
     "requires": true,
     "packages": {
         "": {
             "name": "cve-services",
-            "version": "2.1.1",
+            "version": "2.1.2",
             "license": "(CC0)",
             "dependencies": {
                 "ajv": "^8.6.2",
@@ -25,7 +25,7 @@
                 "jsonschema": "^1.4.0",
                 "JSONStream": "^1.3.5",
                 "kleur": "^4.1.4",
-                "mongoose": "^5.12.3",
+                "mongoose": "^5.13.15",
                 "mongoose-aggregate-paginate-v2": "1.0.6",
                 "morgan": "^1.9.1",
                 "node-dev": "^7.4.3",
@@ -52,7 +52,7 @@
                 "depcheck": "^0.9.2",
                 "eslint": "^8.20.0",
                 "eslint-config-standard": "^14.1.1",
-                "eslint-plugin-import": "^2.20.1",
+                "eslint-plugin-import": "^2.26.0",
                 "eslint-plugin-mocha": "^8.0.0",
                 "eslint-plugin-node": "^11.0.0",
                 "eslint-plugin-promise": "^4.2.1",
@@ -2103,9 +2103,9 @@
             "integrity": "sha1-4wOogrNCzD7oylE6eZmXNNqzriw="
         },
         "node_modules/cookiejar": {
-            "version": "2.1.2",
-            "resolved": "https://registry.npmjs.org/cookiejar/-/cookiejar-2.1.2.tgz",
-            "integrity": "sha512-Mw+adcfzPxcPeI+0WlvRrr/3lGVO0bD75SxX6811cxSh1Wbxx7xZBGK1eVtDf6si8rg2lhnUjsVLMFMfbRIuwA==",
+            "version": "2.1.4",
+            "resolved": "https://registry.npmjs.org/cookiejar/-/cookiejar-2.1.4.tgz",
+            "integrity": "sha512-LDx6oHrK+PhzLKJU9j5S7/Y3jM/mUHvD/DeI1WQmJn652iPC5Y4TBzC9l+5OMOXlyTTA+SmVUPm0HQUwpD5Jqw==",
             "dev": true
         },
         "node_modules/core-util-is": {
@@ -5349,9 +5349,9 @@
             "dev": true
         },
         "node_modules/json5": {
-            "version": "2.2.1",
-            "resolved": "https://registry.npmjs.org/json5/-/json5-2.2.1.tgz",
-            "integrity": "sha512-1hqLFMSrGHRHxav9q9gNjJ5EXznIxGVO09xQRrwplcS8qs28pZ8s8hupZAmqDwZUmVZ2Qb2jnyPOWcDH8m8dlA==",
+            "version": "2.2.3",
+            "resolved": "https://registry.npmjs.org/json5/-/json5-2.2.3.tgz",
+            "integrity": "sha512-XmOWe7eyHYH14cLdVPoyg+GOH3rYX++KpzrylJwSW98t3Nk+U8XOl8FWKOgwtzdb8lXGf6zYwDUzeHMWfxasyg==",
             "bin": {
                 "json5": "lib/cli.js"
             },
@@ -6247,9 +6247,9 @@
             }
         },
         "node_modules/mongoose": {
-            "version": "5.13.14",
-            "resolved": "https://registry.npmjs.org/mongoose/-/mongoose-5.13.14.tgz",
-            "integrity": "sha512-j+BlQjjxgZg0iWn42kLeZTB91OejcxWpY2Z50bsZTiKJ7HHcEtcY21Godw496GMkBqJMTzmW7G/kZ04mW+Cb7Q==",
+            "version": "5.13.15",
+            "resolved": "https://registry.npmjs.org/mongoose/-/mongoose-5.13.15.tgz",
+            "integrity": "sha512-cxp1Gbb8yUWkaEbajdhspSaKzAvsIvOtRlYD87GN/P2QEUhpd6bIvebi36T6M0tIVAMauNaK9SPA055N3PwF8Q==",
             "dependencies": {
                 "@types/bson": "1.x || 4.0.x",
                 "@types/mongodb": "^3.5.27",
@@ -9265,9 +9265,9 @@
             }
         },
         "node_modules/tsconfig-paths/node_modules/json5": {
-            "version": "1.0.1",
-            "resolved": "https://registry.npmjs.org/json5/-/json5-1.0.1.tgz",
-            "integrity": "sha512-aKS4WQjPenRxiQsC93MNfjx+nbF4PAdYzmd/1JIj8HYzqfbu86beTuNgXDzPknWk0n0uARlyewZo4s++ES36Ow==",
+            "version": "1.0.2",
+            "resolved": "https://registry.npmjs.org/json5/-/json5-1.0.2.tgz",
+            "integrity": "sha512-g1MWMLBiz8FKi1e4w0UyVL3w+iJceWAFBAaBnnGKOpNa5f8TLktkbre1+s6oICydWAm+HRUGTmI+//xv2hvXYA==",
             "dev": true,
             "dependencies": {
                 "minimist": "^1.2.0"
@@ -11649,9 +11649,9 @@
             "integrity": "sha1-4wOogrNCzD7oylE6eZmXNNqzriw="
         },
         "cookiejar": {
-            "version": "2.1.2",
-            "resolved": "https://registry.npmjs.org/cookiejar/-/cookiejar-2.1.2.tgz",
-            "integrity": "sha512-Mw+adcfzPxcPeI+0WlvRrr/3lGVO0bD75SxX6811cxSh1Wbxx7xZBGK1eVtDf6si8rg2lhnUjsVLMFMfbRIuwA==",
+            "version": "2.1.4",
+            "resolved": "https://registry.npmjs.org/cookiejar/-/cookiejar-2.1.4.tgz",
+            "integrity": "sha512-LDx6oHrK+PhzLKJU9j5S7/Y3jM/mUHvD/DeI1WQmJn652iPC5Y4TBzC9l+5OMOXlyTTA+SmVUPm0HQUwpD5Jqw==",
             "dev": true
         },
         "core-util-is": {
@@ -14039,9 +14039,9 @@
             "dev": true
         },
         "json5": {
-            "version": "2.2.1",
-            "resolved": "https://registry.npmjs.org/json5/-/json5-2.2.1.tgz",
-            "integrity": "sha512-1hqLFMSrGHRHxav9q9gNjJ5EXznIxGVO09xQRrwplcS8qs28pZ8s8hupZAmqDwZUmVZ2Qb2jnyPOWcDH8m8dlA=="
+            "version": "2.2.3",
+            "resolved": "https://registry.npmjs.org/json5/-/json5-2.2.3.tgz",
+            "integrity": "sha512-XmOWe7eyHYH14cLdVPoyg+GOH3rYX++KpzrylJwSW98t3Nk+U8XOl8FWKOgwtzdb8lXGf6zYwDUzeHMWfxasyg=="
         },
         "jsonfile": {
             "version": "6.1.0",
@@ -14708,9 +14708,9 @@
             }
         },
         "mongoose": {
-            "version": "5.13.14",
-            "resolved": "https://registry.npmjs.org/mongoose/-/mongoose-5.13.14.tgz",
-            "integrity": "sha512-j+BlQjjxgZg0iWn42kLeZTB91OejcxWpY2Z50bsZTiKJ7HHcEtcY21Godw496GMkBqJMTzmW7G/kZ04mW+Cb7Q==",
+            "version": "5.13.15",
+            "resolved": "https://registry.npmjs.org/mongoose/-/mongoose-5.13.15.tgz",
+            "integrity": "sha512-cxp1Gbb8yUWkaEbajdhspSaKzAvsIvOtRlYD87GN/P2QEUhpd6bIvebi36T6M0tIVAMauNaK9SPA055N3PwF8Q==",
             "requires": {
                 "@types/bson": "1.x || 4.0.x",
                 "@types/mongodb": "^3.5.27",
@@ -16948,9 +16948,9 @@
             },
             "dependencies": {
                 "json5": {
-                    "version": "1.0.1",
-                    "resolved": "https://registry.npmjs.org/json5/-/json5-1.0.1.tgz",
-                    "integrity": "sha512-aKS4WQjPenRxiQsC93MNfjx+nbF4PAdYzmd/1JIj8HYzqfbu86beTuNgXDzPknWk0n0uARlyewZo4s++ES36Ow==",
+                    "version": "1.0.2",
+                    "resolved": "https://registry.npmjs.org/json5/-/json5-1.0.2.tgz",
+                    "integrity": "sha512-g1MWMLBiz8FKi1e4w0UyVL3w+iJceWAFBAaBnnGKOpNa5f8TLktkbre1+s6oICydWAm+HRUGTmI+//xv2hvXYA==",
                     "dev": true,
                     "requires": {
                         "minimist": "^1.2.0"
@@ -17499,4 +17499,4 @@
             "dev": true
         }
     }
-}
+}
\ No newline at end of file
diff --git a/package.json b/package.json
index 9dcfdf2f..cb1ddee2 100644
--- a/package.json
+++ b/package.json
@@ -15,7 +15,7 @@
         "depcheck": "^0.9.2",
         "eslint": "^8.20.0",
         "eslint-config-standard": "^14.1.1",
-        "eslint-plugin-import": "^2.20.1",
+        "eslint-plugin-import": "^2.26.0",
         "eslint-plugin-mocha": "^8.0.0",
         "eslint-plugin-node": "^11.0.0",
         "eslint-plugin-promise": "^4.2.1",
@@ -41,7 +41,7 @@
         "jsonschema": "^1.4.0",
         "JSONStream": "^1.3.5",
         "kleur": "^4.1.4",
-        "mongoose": "^5.12.3",
+        "mongoose": "^5.13.15",
         "mongoose-aggregate-paginate-v2": "1.0.6",
         "morgan": "^1.9.1",
         "node-dev": "^7.4.3",
diff --git a/src/controller/cve-id.controller/cve-id.controller.js b/src/controller/cve-id.controller/cve-id.controller.js
index 111ba84a..943b417a 100644
--- a/src/controller/cve-id.controller/cve-id.controller.js
+++ b/src/controller/cve-id.controller/cve-id.controller.js
@@ -173,7 +173,7 @@ async function reserveCveId (req, res, next) {
     const result = await orgRepo.findOneByShortName(shortName)
     if (!result) {
       logger.info({ uuid: req.ctx.uuid, message: shortName + ' organization does not exist.' })
-      return res.status(403).json(error.orgDne(shortName))
+      return res.status(403).json(error.orgDne(shortName, 'short_name', 'query'))
     }
 
     const payload = await getPayload(req, result)
@@ -330,7 +330,7 @@ async function modifyCveId (req, res, next) {
 
       if (!orgUUID) {
         logger.info({ uuid: req.ctx.uuid, message: id + ' could not be reassigned to ' + newOrgShortName + ' in MongoDB because it does not exist.' })
-        return res.status(404).json(error.orgDne(newOrgShortName))
+        return res.status(404).json(error.orgDne(newOrgShortName, 'org', 'query'))
       }
 
       cveId.owning_cna = orgUUID
diff --git a/src/controller/cve-id.controller/error.js b/src/controller/cve-id.controller/error.js
index 7433bfb7..7f5a6d13 100644
--- a/src/controller/cve-id.controller/error.js
+++ b/src/controller/cve-id.controller/error.js
@@ -105,7 +105,7 @@ class CveIdControllerError extends idrErr.IDRError {
   overIdQuota (details) { // cve-id
     const err = {}
     err.error = 'EXCEEDED_ID_QUOTA'
-    err.message = 'The amount requested would exceed the organization\'s ID quota. No more IDs can be reserved until the number of IDs in the Reserved state goes below the ID quota or the ID quota is raised. If you feel you are receiving this message in error, please contact support.'
+    err.message = 'The amount requested would exceed the organization\'s ID quota. No more IDs can be reserved until the number of IDs in the Reserved state goes below the ID quota or the ID quota is raised. If you feel you are receiving this message in error, please contact support here: https://cveform.mitre.org/'
     err.details = details
     return err
   }
diff --git a/src/controller/cve.controller/cve.controller.js b/src/controller/cve.controller/cve.controller.js
index 430bc8d0..9518c014 100644
--- a/src/controller/cve.controller/cve.controller.js
+++ b/src/controller/cve.controller/cve.controller.js
@@ -306,7 +306,7 @@ async function submitCna (req, res, next) {
 
     // create full cve record here
     const owningCna = await orgRepo.findOneByUUID(cveId.owning_cna)
-    const assignerShortName = owningCna?.short_name
+    const assignerShortName = owningCna.short_name
     const cnaContainer = req.ctx.body.cnaContainer
     const dateUpdated = (new Date()).toISOString()
     const additionalCveMetadataFields = {
diff --git a/src/controller/cve.controller/error.js b/src/controller/cve.controller/error.js
index 83ed5ed9..2dba36d8 100644
--- a/src/controller/cve.controller/error.js
+++ b/src/controller/cve.controller/error.js
@@ -70,7 +70,7 @@ class CveControllerError extends idrErr.IDRError {
   unableToStoreCveRecord () { // cve
     const err = {}
     err.error = 'UNABLE_TO_STORE_CVE_RECORD'
-    err.message = 'A problem occurred while saving the CVE Record, ensure that x_ values do not start with $'
+    err.message = 'A problem occurred while saving the CVE Record, ensure field names in x_ objects do not start with $'
     return err
   }
 
diff --git a/src/controller/cve.controller/index.js b/src/controller/cve.controller/index.js
index e18bf3b3..f01f9392 100644
--- a/src/controller/cve.controller/index.js
+++ b/src/controller/cve.controller/index.js
@@ -504,13 +504,13 @@ router.post('/cve/:id/reject',
   /*
   #swagger.tags = ['CVE Record']
   #swagger.operationId = 'cveCnaCreateReject'
-  #swagger.summary = "Creates a reject CVE Record for the specified ID if no record yet exists (accessible to CNAs and Secretariat)"
+  #swagger.summary = "Creates a rejected CVE Record for the specified ID if no record yet exists (accessible to CNAs and Secretariat)"
   #swagger.description = "
         <h2>Access Control</h2>
         <p>User must belong to an organization with the <b>CNA</b> or <b>Secretariat</b> role</p>
         <h2>Expected Behavior</h2>
-        <p><b>CNA:</b> Creates a reject CVE Record for a record owned by their organization</p>
-        <p><b>Secretariat:</b> Creates a reject CVE Record for a record owned by any organization</p>"
+        <p><b>CNA:</b> Creates a rejected CVE Record for a record owned by their organization</p>
+        <p><b>Secretariat:</b> Creates a rejected CVE Record for a record owned by any organization</p>"
   #swagger.parameters['id'] = { description: 'The CVE ID for the record being rejected' }
   #swagger.parameters['$ref'] = [
     '#/components/parameters/apiEntityHeader',
@@ -589,13 +589,13 @@ router.put('/cve/:id/reject',
   /*
   #swagger.tags = ['CVE Record']
   #swagger.operationId = 'cveCnaUpdateReject'
-  #swagger.summary = "Updates an existing CVE Record with a reject record for the specified ID (accessible to CNAs and Secretariat)"
+  #swagger.summary = "Updates an existing CVE Record with a rejected record for the specified ID (accessible to CNAs and Secretariat)"
   #swagger.description = "
         <h2>Access Control</h2>
         <p>User must belong to an organization with the <b>CNA</b> or <b>Secretariat</b> role</p>
         <h2>Expected Behavior</h2>
-        <p><b>CNA:</b> Updates a reject CVE Record for a record owned by their organization</p>
-        <p><b>Secretariat:</b> Updates a reject CVE Record for a record owned by any organization</p>"
+        <p><b>CNA:</b> Updates a rejected CVE Record for a record owned by their organization</p>
+        <p><b>Secretariat:</b> Updates a rejected CVE Record for a record owned by any organization</p>"
   #swagger.parameters['id'] = { description: 'The CVE ID for the record being rejected' }
   #swagger.parameters['$ref'] = [
     '#/components/parameters/apiEntityHeader',
diff --git a/src/controller/org.controller/error.js b/src/controller/org.controller/error.js
index 795f8f70..bb83e2c3 100644
--- a/src/controller/org.controller/error.js
+++ b/src/controller/org.controller/error.js
@@ -1,10 +1,10 @@
 const idrErr = require('../../utils/error')
 
 class OrgControllerError extends idrErr.IDRError {
-  orgDneParam (shortname) { // org
+  orgDnePathParam (shortname) { // org
     const err = {}
     err.error = 'ORG_DNE_PARAM'
-    err.message = `The '${shortname}' organization designated by the shortname parameter does not exist.`
+    err.message = `The '${shortname}' organization designated by the shortname path parameter does not exist.`
     return err
   }
 
@@ -77,6 +77,13 @@ class OrgControllerError extends idrErr.IDRError {
     err.message = `'${param}' is not a valid parameter.`
     return err
   }
+
+  notAllowedToSelfDemote () {
+    const err = {}
+    err.error = 'NOT_ALLOWED_TO_SELF_DEMOTE'
+    err.message = 'Please have another admin user from your organization change your role.'
+    return err
+  }
 }
 
 module.exports = {
diff --git a/src/controller/org.controller/index.js b/src/controller/org.controller/index.js
index 7951cd2a..646e8434 100644
--- a/src/controller/org.controller/index.js
+++ b/src/controller/org.controller/index.js
@@ -5,6 +5,7 @@ const errorMsgs = require('../../middleware/errorMessages')
 const controller = require('./org.controller')
 const { body, param, query } = require('express-validator')
 const { parseGetParams, parsePostParams, parseError, isOrgRole, isUserRole, isValidUsername } = require('./org.middleware')
+const { toUpperCaseArray, isFlatStringArray } = require('../../middleware/middleware')
 const getConstants = require('../../../src/constants').getConstants
 const CONSTANTS = getConstants()
 
@@ -157,7 +158,10 @@ router.post('/org',
   mw.onlySecretariat,
   body(['short_name']).isString().trim().escape().notEmpty().isLength({ min: CONSTANTS.MIN_SHORTNAME_LENGTH, max: CONSTANTS.MAX_SHORTNAME_LENGTH }),
   body(['name']).isString().trim().escape().notEmpty(),
-  body(['authority.active_roles']).optional().customSanitizer(val => { return val.map(x => { return x.toUpperCase() }) }).custom(val => { return isOrgRole(val) }),
+  body(['authority.active_roles']).optional()
+    .custom(isFlatStringArray)
+    .customSanitizer(toUpperCaseArray)
+    .custom(isOrgRole),
   body(['policies.id_quota']).optional().not().isArray().isInt({ min: CONSTANTS.MONGOOSE_VALIDATION.Org_policies_id_quota_min, max: CONSTANTS.MONGOOSE_VALIDATION.Org_policies_id_quota_max }).withMessage(errorMsgs.ID_QUOTA),
   parseError,
   parsePostParams,
@@ -310,10 +314,14 @@ router.put('/org/:shortname',
   query(['new_short_name']).optional().isString().trim().escape().notEmpty().isLength({ min: CONSTANTS.MIN_SHORTNAME_LENGTH, max: CONSTANTS.MAX_SHORTNAME_LENGTH }),
   query(['id_quota']).optional().not().isArray().isInt({ min: CONSTANTS.MONGOOSE_VALIDATION.Org_policies_id_quota_min, max: CONSTANTS.MONGOOSE_VALIDATION.Org_policies_id_quota_max }).withMessage(errorMsgs.ID_QUOTA),
   query(['name']).optional().isString().trim().escape().notEmpty(),
-  query(['active_roles.add']).optional().toArray(),
-  query(['active_roles.add']).optional().customSanitizer(val => { return val.map(x => { return x.toUpperCase() }) }).custom(val => { return isOrgRole(val) }),
-  query(['active_roles.remove']).optional().toArray(),
-  query(['active_roles.remove']).optional().customSanitizer(val => { return val.map(x => { return x.toUpperCase() }) }).custom(val => { return isOrgRole(val) }),
+  query(['active_roles.add']).optional().toArray()
+    .custom(isFlatStringArray)
+    .customSanitizer(toUpperCaseArray)
+    .custom(isOrgRole),
+  query(['active_roles.remove']).optional().toArray()
+    .custom(isFlatStringArray)
+    .customSanitizer(toUpperCaseArray)
+    .custom(isOrgRole),
   parseError,
   parsePostParams,
   controller.ORG_UPDATE_SINGLE)
@@ -539,14 +547,17 @@ router.post('/org/:shortname/user',
   mw.onlySecretariatOrAdmin,
   mw.onlyOrgWithRole,
   param(['shortname']).isString().trim().escape().notEmpty().isLength({ min: CONSTANTS.MIN_SHORTNAME_LENGTH, max: CONSTANTS.MAX_SHORTNAME_LENGTH }),
-  body(['username']).isString().trim().escape().notEmpty().custom(val => { return isValidUsername(val) }),
+  body(['username']).isString().trim().escape().notEmpty().custom(isValidUsername),
   body(['org_uuid']).optional().isString().trim().escape(),
   body(['uuid']).optional().isString().trim().escape(),
   body(['name.first']).optional().isString().trim().escape(),
   body(['name.last']).optional().isString().trim().escape(),
   body(['name.middle']).optional().isString().trim().escape(),
   body(['name.suffix']).optional().isString().trim().escape(),
-  body(['authority.active_roles']).optional().customSanitizer(val => { return val.map(x => { return x.toUpperCase() }) }).custom(val => { return isUserRole(val) }),
+  body(['authority.active_roles']).optional()
+    .custom(mw.isFlatStringArray)
+    .customSanitizer(toUpperCaseArray)
+    .custom(isUserRole),
   parseError,
   parsePostParams,
   controller.USER_CREATE_SINGLE)
@@ -619,7 +630,7 @@ router.get('/org/:shortname/user/:username',
   */
   mw.validateUser,
   param(['shortname']).isString().trim().escape().notEmpty().isLength({ min: CONSTANTS.MIN_SHORTNAME_LENGTH, max: CONSTANTS.MAX_SHORTNAME_LENGTH }),
-  param(['username']).isString().trim().escape().notEmpty().custom(val => { return isValidUsername(val) }),
+  param(['username']).isString().trim().escape().notEmpty().custom(isValidUsername),
   parseError,
   parseGetParams,
   controller.USER_SINGLE)
@@ -707,18 +718,22 @@ router.put('/org/:shortname/user/:username',
       'name.suffix', 'active_roles.add', 'active_roles.remove'])
   }),
   param(['shortname']).isString().trim().escape().notEmpty().isLength({ min: CONSTANTS.MIN_SHORTNAME_LENGTH, max: CONSTANTS.MAX_SHORTNAME_LENGTH }),
-  param(['username']).isString().trim().escape().notEmpty().custom(val => { return isValidUsername(val) }),
+  param(['username']).isString().trim().escape().notEmpty().custom(isValidUsername),
   query(['active']).optional().isBoolean({ loose: true }),
-  query(['new_username']).optional().isString().trim().escape().notEmpty().custom(val => { return isValidUsername(val) }),
+  query(['new_username']).optional().isString().trim().escape().notEmpty().custom(isValidUsername),
   query(['org_short_name']).optional().isString().trim().escape().notEmpty().isLength({ min: CONSTANTS.MIN_SHORTNAME_LENGTH, max: CONSTANTS.MAX_SHORTNAME_LENGTH }),
   query(['name.first']).optional().isString().trim().escape(),
   query(['name.last']).optional().isString().trim().escape(),
   query(['name.middle']).optional().isString().trim().escape(),
   query(['name.suffix']).optional().isString().trim().escape(),
-  query(['active_roles.add']).optional().toArray(),
-  query(['active_roles.add']).optional().customSanitizer(val => { return val.map(x => { return x.toUpperCase() }) }).custom(val => { return isUserRole(val) }),
-  query(['active_roles.remove']).optional().toArray(),
-  query(['active_roles.remove']).optional().customSanitizer(val => { return val.map(x => { return x.toUpperCase() }) }).custom(val => { return isUserRole(val) }),
+  query(['active_roles.add']).optional().toArray()
+    .custom(isFlatStringArray)
+    .customSanitizer(toUpperCaseArray)
+    .custom(isUserRole),
+  query(['active_roles.remove']).optional().toArray()
+    .custom(isFlatStringArray)
+    .customSanitizer(toUpperCaseArray)
+    .custom(isUserRole),
   parseError,
   parsePostParams,
   controller.USER_UPDATE_SINGLE)
@@ -793,7 +808,7 @@ router.put('/org/:shortname/user/:username/reset_secret',
   mw.validateUser,
   mw.onlyOrgWithRole,
   param(['shortname']).isString().trim().escape().notEmpty().isLength({ min: CONSTANTS.MIN_SHORTNAME_LENGTH, max: CONSTANTS.MAX_SHORTNAME_LENGTH }),
-  param(['username']).isString().trim().escape().notEmpty().custom(val => { return isValidUsername(val) }),
+  param(['username']).isString().trim().escape().notEmpty().custom(isValidUsername),
   parseError,
   parsePostParams,
   controller.USER_RESET_SECRET)
diff --git a/src/controller/org.controller/org.controller.js b/src/controller/org.controller/org.controller.js
index 20652bb2..68ee2e94 100644
--- a/src/controller/org.controller/org.controller.js
+++ b/src/controller/org.controller/org.controller.js
@@ -81,7 +81,7 @@ async function getOrg (req, res, next) {
 
     if (!result) { // an empty result can only happen if the requestor is the Secretariat
       logger.info({ uuid: req.ctx.uuid, message: identifier + ' organization does not exist.' })
-      return res.status(404).json(error.orgDneParam(identifier))
+      return res.status(404).json(error.orgDne(identifier, 'identifier', 'path'))
     }
 
     logger.info({ uuid: req.ctx.uuid, message: identifier + ' organization was sent to the user.', org: result })
@@ -117,7 +117,7 @@ async function getUsers (req, res, next) {
 
     if (!orgUUID) {
       logger.info({ uuid: req.ctx.uuid, message: orgShortName + ' organization does not exist.' })
-      return res.status(404).json(error.orgDneParam(orgShortName))
+      return res.status(404).json(error.orgDnePathParam(orgShortName))
     }
 
     if (orgShortName !== shortName && !isSecretariat) {
@@ -165,7 +165,7 @@ async function getUser (req, res, next) {
     const orgUUID = await orgRepo.getOrgUUID(orgShortName)
     if (!orgUUID) { // the org can only be non-existent if the requestor is the Secretariat
       logger.info({ uuid: req.ctx.uuid, message: orgShortName + ' organization does not exist.' })
-      return res.status(404).json(error.orgDneParam(orgShortName))
+      return res.status(404).json(error.orgDnePathParam(orgShortName))
     }
 
     const userRepo = req.ctx.repositories.getUserRepository()
@@ -204,7 +204,7 @@ async function getOrgIdQuota (req, res, next) {
     let result = await repo.findOneByShortName(shortName)
     if (!result) { // a null result can only happen if the requestor is the Secretariat
       logger.info({ uuid: req.ctx.uuid, message: shortName + ' organization does not exist.' })
-      return res.status(404).json(error.orgDneParam(shortName))
+      return res.status(404).json(error.orgDnePathParam(shortName))
     }
 
     const returnPayload = {
@@ -331,7 +331,7 @@ async function updateOrg (req, res, next) {
     // org doesn't exist
     if (!org) {
       logger.info({ uuid: req.ctx.uuid, message: shortName + ' organization could not be updated in MongoDB because it does not exist.' })
-      return res.status(404).json(error.orgDneParam(shortName))
+      return res.status(404).json(error.orgDnePathParam(shortName))
     }
 
     Object.keys(req.ctx.query).forEach(k => {
@@ -394,7 +394,7 @@ async function updateOrg (req, res, next) {
     let result = await orgRepo.updateByOrgUUID(org.UUID, newOrg)
     if (result.n === 0) {
       logger.info({ uuid: req.ctx.uuid, message: shortName + ' organization could not be updated in MongoDB because it does not exist.' })
-      return res.status(404).json(error.orgDneParam(shortName))
+      return res.status(404).json(error.orgDnePathParam(shortName))
     }
 
     result = await orgRepo.aggregate(agt)
@@ -438,7 +438,7 @@ async function createUser (req, res, next) {
     const orgUUID = await orgRepo.getOrgUUID(orgShortName)
     if (!orgUUID) { // the org can only be non-existent if the requestor is the Secretariat
       logger.info({ uuid: req.ctx.uuid, message: 'The user could not be created because ' + orgShortName + ' organization does not exist.' })
-      return res.status(404).json(error.orgDneParam(orgShortName))
+      return res.status(404).json(error.orgDnePathParam(orgShortName))
     }
 
     Object.keys(req.ctx.body).forEach(k => {
@@ -546,7 +546,7 @@ async function updateUser (req, res, next) {
 
     if (!orgUUID) {
       logger.info({ uuid: req.ctx.uuid, message: 'The user could not be updated because ' + shortName + ' organization does not exist.' })
-      return res.status(404).json(error.orgDneParam(shortName))
+      return res.status(404).json(error.orgDnePathParam(shortName))
     }
 
     if (shortName !== requesterShortName && !isSecretariat) {
@@ -575,7 +575,7 @@ async function updateUser (req, res, next) {
     newUser.name.middle = user.name.middle
     newUser.name.suffix = user.name.suffix
 
-    Object.keys(req.ctx.query).forEach(k => {
+    for (const k in req.ctx.query) {
       const key = k.toLowerCase()
 
       if (key === 'new_username') {
@@ -608,13 +608,17 @@ async function updateUser (req, res, next) {
         }
       } else if (key === 'active_roles.remove') {
         if (Array.isArray(req.ctx.query['active_roles.remove'])) {
-          req.ctx.query['active_roles.remove'].forEach(r => {
+          for (const r of req.ctx.query['active_roles.remove']) {
+            if (r.toLowerCase() === 'admin' && requesterUsername === username && (isAdmin || isSecretariat)) {
+              logger.info({ uuid: req.ctx.uuid, message: 'The user could not be updated because ' + requesterUsername + ' is an Org Admin changing their own role.' })
+              return res.status(403).json(error.notAllowedToSelfDemote())
+            }
             removeRoles.push(r)
-          })
+          }
           changesRequirePrivilegedRole = true
         }
       }
-    })
+    }
 
     // Check for correct privileges if the requested changes require them
     if (changesRequirePrivilegedRole && !(isAdmin || isSecretariat)) {
@@ -628,7 +632,7 @@ async function updateUser (req, res, next) {
 
       if (!newUser.org_UUID) {
         logger.info({ uuid: req.ctx.uuid, message: 'The user could not be updated because ' + newOrgShortName + ' organization does not exist.' })
-        return res.status(404).json(error.orgDne(newOrgShortName))
+        return res.status(404).json(error.orgDne(newOrgShortName, 'org_short_name', 'query'))
       }
     }
 
@@ -736,7 +740,7 @@ async function resetSecret (req, res, next) {
     const orgUUID = await orgRepo.getOrgUUID(orgShortName) // userUUID may be null if user does not exist
     if (!orgUUID) {
       logger.info({ uuid: req.ctx.uuid, messsage: orgShortName + ' organization does not exist.' })
-      return res.status(404).json(error.orgDneParam(orgShortName))
+      return res.status(404).json(error.orgDnePathParam(orgShortName))
     }
 
     if (orgShortName !== requesterShortName && !isSecretariat) {
diff --git a/src/middleware/middleware.js b/src/middleware/middleware.js
index 5ddb0727..10256b15 100644
--- a/src/middleware/middleware.js
+++ b/src/middleware/middleware.js
@@ -363,6 +363,54 @@ const limiter = rateLimit({
   message: error.tooManyRequests()
 })
 
+/**
+ * Ensures value is a flat (one-dimensional) array of any length with values
+ * that are safe to cast to a string
+ *
+ * @param {Any} val
+ * @returns
+ */
+function isFlatStringArray (val) {
+  const errorMsg = 'Parameter must be a one-dimensional array of strings'
+
+  if (!Array.isArray(val)) {
+    throw new Error(errorMsg)
+  }
+
+  const validTypes = [
+    'boolean', 'number', 'bigint', 'string'
+  ]
+
+  for (const k of val) {
+    if (!validTypes.includes(typeof k)) {
+      throw new Error(errorMsg)
+    }
+  }
+
+  return true
+}
+
+/**
+ * Recursively casts to strings and upper-cases all items in array
+ *
+ * @param {Array} val
+ */
+function toUpperCaseArray (val) {
+  if (!Array.isArray(val)) {
+    return val.toString().toUpperCase()
+  }
+
+  const newArr = val.map(k => {
+    if (Array.isArray(k)) {
+      return toUpperCaseArray(k)
+    } else {
+      return k.toString().toUpperCase()
+    }
+  })
+
+  return newArr
+}
+
 module.exports = {
   setCacheControl,
   optionallyValidateUser,
@@ -378,5 +426,7 @@ module.exports = {
   validateCveJsonSchema,
   errorHandler,
   validateJsonSyntax,
-  rateLimiter: limiter
+  rateLimiter: limiter,
+  isFlatStringArray,
+  toUpperCaseArray
 }
diff --git a/src/model/cve.js b/src/model/cve.js
index ad10a7e8..93bab206 100644
--- a/src/model/cve.js
+++ b/src/model/cve.js
@@ -86,7 +86,10 @@ CveSchema.statics.newRejectedCve = function (cveIdObj, reqBody, owningCnaShortNa
   rejectedRecord.cveMetadata.dateReserved = new Date(cveIdObj.reserved).toISOString()
   rejectedRecord.cveMetadata.dateUpdated = providerMetadata.dateUpdated
   rejectedRecord.cveMetadata.dateRejected = providerMetadata.dateUpdated
-  rejectedRecord.cveMetadata.assignerShortName = owningCnaShortName || null
+
+  if (owningCnaShortName) {
+    rejectedRecord.cveMetadata.assignerShortName = owningCnaShortName
+  }
 
   const cnaRejectedContainer = createCnaRejectContainer(providerMetadata, reqBody.cnaContainer.rejectedReasons, reqBody.cnaContainer.replacedBy)
 
diff --git a/src/utils/data.js b/src/utils/data.js
index 2cbfac17..5b22f65d 100644
--- a/src/utils/data.js
+++ b/src/utils/data.js
@@ -37,7 +37,7 @@ async function preprocessUserSecrets () {
 
     // provide secret to user in development
     console.log(color.bold().black().bgWhite(
-      'Use the following API secret for all users:') + ' ' +
+      'Use the following API secret for all users added via the populate script:') + ' ' +
       color.bold().black().italic().bgGreen(secretKey)
     )
 
diff --git a/src/utils/error.js b/src/utils/error.js
index bf38db9e..983af32c 100644
--- a/src/utils/error.js
+++ b/src/utils/error.js
@@ -7,10 +7,10 @@ class IDRError {
     return err
   }
 
-  orgDne (shortname) { // super
+  orgDne (shortname, paramName, paramType) { // super
     const err = {}
     err.error = 'ORG_DNE'
-    err.message = `The organization '${shortname}' designated by the shortname query parameter does not exist.`
+    err.message = `The organization '${shortname}' designated by the ${paramName} ${paramType} parameter does not exist.`
     return err
   }
 


Test patch:
diff --git a/test-http/src/test/org_user_tests/org.py b/test-http/src/test/org_user_tests/org.py
index 5547297a..a8692211 100644
--- a/test-http/src/test/org_user_tests/org.py
+++ b/test-http/src/test/org_user_tests/org.py
@@ -7,6 +7,7 @@ import json
 import random
 import requests
 import uuid
+from urllib.parse import urlencode
 from src import env, utils
 from src.utils import (assert_contains, ok_response_contains,
                        ok_response_contains_json, response_contains,
@@ -16,6 +17,43 @@ ORG_URL = '/api/org'
 MAX_SHORTNAME_LENGTH = 32
 #### GET /org ####
 
+ROLES_BAD_VALUES = [
+    # sending an object / assoc array
+    # username=bob&authority.active_roles[a]=b
+    { 'a': 'ADMIN' },
+
+    # sending multi-dimensional arrays
+    # username=bob&authority.active_roles[][a]=b
+    [{ 'a': 'ADMIN' }],
+    [[ 'ADMIN' ]]
+]
+
+ROLES_BAD_QUERY_VALUES = [
+    # valid: single value
+    # "active_roles.add=CNA",
+    
+    # valid: ['CNA']
+    # "active_roles.add[]=CNA",
+    
+    # valid: ['CNA']
+    # "active_roles.add[][]=CNA",
+
+    # valid: ['CNA']
+    # "active_roles.add[8]=CNA"
+
+    # valid: ['CNA', 'CNA']
+    # "active_roles.add[]=CNA&active_roles.add=CNA"
+
+    # bad assoc arrays are caught by valid param checks
+    # "active_roles.add[a]=CNA",
+
+
+    # invalid: [{'a': 'CNA'}]
+    "active_roles.add[][a]=CNA"
+
+    # invalid: [{'CNA': null}]
+    "active_roles.add[][CNA]"
+]
 
 def test_get_all_orgs():
     """ secretariat users can request a list of all organizations """
@@ -71,7 +109,7 @@ def test_get_mitre_by_nonexistent_org_uuid():
         headers=utils.BASE_HEADERS,
     )
     assert res.status_code == 404
-    response_contains_json(res, 'error', 'ORG_DNE_PARAM')
+    response_contains_json(res, 'error', 'ORG_DNE')
 
 
 #### GET /org/:shortname/id_quota ####
@@ -226,6 +264,33 @@ def test_post_new_org_uuid_parameter():
     assert res.status_code == 404
 
 
+def test_post_new_org_malformed_roles():
+    """ service should return useful error message for malformed roles """
+
+    for data in ROLES_BAD_VALUES:
+        uid = str(uuid.uuid4())[:MAX_SHORTNAME_LENGTH]
+
+        res = requests.post(
+            f'{env.AWG_BASE_URL}{ORG_URL}',
+            headers=utils.BASE_HEADERS,
+            json={
+                'short_name': uid,
+                'name': uid,
+                'uuid': str(uuid.uuid4()),
+                'authority': {
+                    'active_roles': data
+                }
+            }
+        )
+
+        assert res.status_code == 400
+        response_contains_json(res, 'message', 'Parameters were invalid')
+        
+        assert res.json()['details'][0]['msg'] == 'Parameter must be a one-dimensional array of strings'
+        assert res.json()['details'][0]['param'] == 'authority.active_roles'
+        assert res.json()['details'][0]['location'] == 'body'
+
+
 #### POST /org/:shortname/user ####
 def test_post_new_org_user():
     """ secretariat user can create a new user without active roles """
@@ -250,6 +315,30 @@ def test_post_new_org_bad_role_blarg():
     response_contains_json(res, 'message', f'{uid} was successfully created.')
 
 
+def test_post_new_org_user_malformed_roles():
+    """ service should return useful error message for malformed roles """
+    uid = str(uuid.uuid4())[:MAX_SHORTNAME_LENGTH]
+
+    for data in ROLES_BAD_VALUES:
+        res = requests.post(
+            f'{env.AWG_BASE_URL}{ORG_URL}/mitre/user',
+            headers=utils.BASE_HEADERS,
+            json={
+                'username': uid,
+                'authority': {
+                    'active_roles': data
+                }
+            }
+        )
+
+        assert res.status_code == 400
+        response_contains_json(res, 'message', 'Parameters were invalid')
+        
+        assert res.json()['details'][0]['msg'] == 'Parameter must be a one-dimensional array of strings'
+        assert res.json()['details'][0]['param'] == 'authority.active_roles'
+        assert res.json()['details'][0]['location'] == 'body'
+
+
 def test_post_new_org_user_empty_body():
     """ an empty new org user body is invalid for username """
     res = requests.post(
@@ -299,8 +388,25 @@ def test_put_update_org_that_does_not_exist():
     )
     assert res.status_code == 404
     response_contains_json(res, 'error', 'ORG_DNE_PARAM')
-    assert_contains(res, 'by the shortname parameter does not exist')
-
+    assert_contains(res, 'by the shortname path parameter does not exist')
+
+
+def test_put_update_mitre_org_malformed_roles():
+    """ service should return useful error message for malformed roles """
+    
+    for data in ROLES_BAD_QUERY_VALUES:
+        res = requests.put(
+            f'{env.AWG_BASE_URL}{ORG_URL}/mitre',
+            headers=utils.BASE_HEADERS,
+            params=data
+        )
+
+        assert res.status_code == 400, str(data)
+        response_contains_json(res, 'message', 'Parameters were invalid')
+        
+        assert res.json()['details'][0]['msg'] == 'Parameter must be a one-dimensional array of strings'
+        assert res.json()['details'][0]['param'] == 'active_roles.add'
+        assert res.json()['details'][0]['location'] == 'query'
 
 def test_put_update_mitre_org_nonexistent_user():
     """ cve services api will fail requests from users that don't exist """
@@ -469,6 +575,33 @@ def test_put_update_user_remove_admin_role():
     response_contains(res, 'User role does not exist.')
 
 
+def test_put_update_user_malformed_roles():
+    """ service should return useful error message for malformed roles """
+
+    org, user = create_new_user_with_new_org_by_uuid()
+
+    res = requests.put(
+        f'{env.AWG_BASE_URL}{ORG_URL}/{org}/user/{user}',
+        headers=utils.BASE_HEADERS,
+        params={'active_roles.add': 'ADMIN'}
+    )
+    assert res.status_code == 200
+    
+    for data in ROLES_BAD_QUERY_VALUES:
+        res = requests.put(
+            f'{env.AWG_BASE_URL}{ORG_URL}/{org}/user/{user}',
+            headers=utils.BASE_HEADERS,
+            params=data
+        )
+
+        assert res.status_code == 400, str(data)
+        response_contains_json(res, 'message', 'Parameters were invalid')
+        
+        assert res.json()['details'][0]['msg'] == 'Parameter must be a one-dimensional array of strings'
+        assert res.json()['details'][0]['param'] == 'active_roles.add'
+        assert res.json()['details'][0]['location'] == 'query'
+
+
 #### PUT /org/:shortname/user/:username/reset_secret ####
 def test_put_update_user_reset_secret():
     """ services api allows the secretariat to reset user secrets """
diff --git a/test-http/src/test/org_user_tests/org_as_org_admin.py b/test-http/src/test/org_user_tests/org_as_org_admin.py
index 4a0b8473..f6ccf6f6 100644
--- a/test-http/src/test/org_user_tests/org_as_org_admin.py
+++ b/test-http/src/test/org_user_tests/org_as_org_admin.py
@@ -455,25 +455,9 @@ def test_org_admin_update_own_user_roles_name(org_admin_headers):
         f'{env.AWG_BASE_URL}{ORG_URL}/{org}/user/{user}?active_roles.remove=admin',
         headers=org_admin_headers
     )
-    assert res.status_code == 200
-    assert json.loads(res.content.decode())[
-        'updated']['authority']['active_roles'] == []
-    res = requests.put(
-        # adding role
-        f'{env.AWG_BASE_URL}{ORG_URL}/{org}/user/{user}?active_roles.add=admin',
-        headers=org_admin_headers
-    )
     assert res.status_code == 403
-    # cannot add role because org admin doesn't have "ADMIN" role anymore
-    response_contains_json(res, 'error', 'NOT_ORG_ADMIN_OR_SECRETARIAT_UPDATE')
-    res = requests.put(
-        # adding "ADMIN" role back to org admin user
-        f'{env.AWG_BASE_URL}{ORG_URL}/{org}/user/{user}?active_roles.add=admin',
-        headers=utils.BASE_HEADERS
-    )
-    assert res.status_code == 200
-    assert json.loads(res.content.decode())[
-        'updated']['authority']['active_roles'] == ["ADMIN"]
+    response_contains_json(res, 'error', 'NOT_ALLOWED_TO_SELF_DEMOTE')
+
     res = requests.put(
         # updating name
         f'{env.AWG_BASE_URL}{ORG_URL}/{org}/user/{user}?name.first=t&name.last=e&name.middle=s&name.suffix=t',
diff --git a/test/unit-tests/cve-id/cveIdUpdateTest.js b/test/unit-tests/cve-id/cveIdUpdateTest.js
index 5ac4cbfe..0330bf31 100644
--- a/test/unit-tests/cve-id/cveIdUpdateTest.js
+++ b/test/unit-tests/cve-id/cveIdUpdateTest.js
@@ -166,7 +166,7 @@ describe('Testing the PUT /cve-id/:id endpoint in CveId Controller', () => {
 
           expect(res).to.have.status(404)
           expect(res).to.have.property('body').and.to.be.a('object')
-          const errObj = error.orgDne(cveIdFixtures.nonExistentOrg.short_name)
+          const errObj = error.orgDne(cveIdFixtures.nonExistentOrg.short_name, 'org', 'query')
           expect(res.body.error).to.equal(errObj.error)
           expect(res.body.message).to.equal(errObj.message)
           done()
diff --git a/test/unit-tests/cve-id/reserveCveId/cveIdReserveGeneralLogicTest.js b/test/unit-tests/cve-id/reserveCveId/cveIdReserveGeneralLogicTest.js
index ba156fa7..bbc1d27f 100644
--- a/test/unit-tests/cve-id/reserveCveId/cveIdReserveGeneralLogicTest.js
+++ b/test/unit-tests/cve-id/reserveCveId/cveIdReserveGeneralLogicTest.js
@@ -279,7 +279,7 @@ describe('Testing the general logic of POST /cve-id endpoint in CveId Controller
 
           expect(res).to.have.status(403)
           expect(res).to.have.property('body').and.to.be.a('object')
-          const errObj = error.orgDne(cveIdFixtures.nonExistentOrg.short_name)
+          const errObj = error.orgDne(cveIdFixtures.nonExistentOrg.short_name, 'short_name', 'query')
           expect(res.body.error).to.equal(errObj.error)
           expect(res.body.message).to.equal(errObj.message)
           done()
diff --git a/test/unit-tests/org/orgGetIdQuotaTest.js b/test/unit-tests/org/orgGetIdQuotaTest.js
index cd3f8432..a2630b34 100644
--- a/test/unit-tests/org/orgGetIdQuotaTest.js
+++ b/test/unit-tests/org/orgGetIdQuotaTest.js
@@ -106,7 +106,7 @@ describe('Testing the GET /org/:shortname/id_quota endpoint in Org Controller',
 
           expect(res).to.have.status(404)
           expect(res).to.have.property('body').and.to.be.a('object')
-          const errObj = error.orgDneParam(orgFixtures.nonExistentOrg.short_name)
+          const errObj = error.orgDnePathParam(orgFixtures.nonExistentOrg.short_name)
           expect(res.body.error).to.equal(errObj.error)
           expect(res.body.message).to.equal(errObj.message)
           done()
diff --git a/test/unit-tests/org/orgGetSingleTest.js b/test/unit-tests/org/orgGetSingleTest.js
index 96885739..0a6b77d6 100644
--- a/test/unit-tests/org/orgGetSingleTest.js
+++ b/test/unit-tests/org/orgGetSingleTest.js
@@ -61,7 +61,7 @@ describe('Testing the GET /org/:identifier endpoint in Org Controller', () => {
 
       expect(res).to.have.status(404)
       expect(res).to.have.property('body').and.to.be.a('object')
-      const errObj = error.orgDneParam(orgFixtures.nonExistentOrg.short_name)
+      const errObj = error.orgDne(orgFixtures.nonExistentOrg.short_name, 'identifier', 'path')
       expect(res.body.error).to.equal(errObj.error)
       expect(res.body.message).to.equal(errObj.message)
     })
diff --git a/test/unit-tests/org/orgUpdateTest.js b/test/unit-tests/org/orgUpdateTest.js
index f723e542..f978d6f9 100644
--- a/test/unit-tests/org/orgUpdateTest.js
+++ b/test/unit-tests/org/orgUpdateTest.js
@@ -92,7 +92,7 @@ describe('Testing the PUT /org/:shortname endpoint in Org Controller', () => {
 
       expect(res).to.have.status(404)
       expect(res).to.have.property('body').and.to.be.a('object')
-      const errObj = error.orgDneParam(orgFixtures.nonExistentOrg.short_name)
+      const errObj = error.orgDnePathParam(orgFixtures.nonExistentOrg.short_name)
       expect(res.body.error).to.equal(errObj.error)
       expect(res.body.message).to.equal(errObj.message)
     })
diff --git a/test/unit-tests/user/userCreateTest.js b/test/unit-tests/user/userCreateTest.js
index ec493ae0..7c527104 100644
--- a/test/unit-tests/user/userCreateTest.js
+++ b/test/unit-tests/user/userCreateTest.js
@@ -143,7 +143,7 @@ describe('Testing the POST /org/:shortname/user endpoint in Org Controller', ()
 
           expect(res).to.have.status(404)
           expect(res).to.have.property('body').and.to.be.a('object')
-          const errObj = error.orgDneParam(userFixtures.nonExistentOrg.short_name)
+          const errObj = error.orgDnePathParam(userFixtures.nonExistentOrg.short_name)
           expect(res.body.error).to.equal(errObj.error)
           expect(res.body.message).to.equal(errObj.message)
           done()
diff --git a/test/unit-tests/user/userGetAllTest.js b/test/unit-tests/user/userGetAllTest.js
index a8d02cb2..7cabcabc 100644
--- a/test/unit-tests/user/userGetAllTest.js
+++ b/test/unit-tests/user/userGetAllTest.js
@@ -56,7 +56,7 @@ describe('Testing the GET /org/:shortname/users endpoint in Org Controller', ()
 
           expect(res).to.have.status(404)
           expect(res).to.have.property('body').and.to.be.a('object')
-          const errObj = error.orgDneParam(orgFixtures.nonExistentOrg.short_name)
+          const errObj = error.orgDnePathParam(orgFixtures.nonExistentOrg.short_name)
           expect(res.body.error).to.equal(errObj.error)
           expect(res.body.message).to.equal(errObj.message)
           done()
diff --git a/test/unit-tests/user/userGetSingleTest.js b/test/unit-tests/user/userGetSingleTest.js
index 4b2e5546..47a7cc77 100644
--- a/test/unit-tests/user/userGetSingleTest.js
+++ b/test/unit-tests/user/userGetSingleTest.js
@@ -94,7 +94,7 @@ describe('Testing the GET /org/:shortname/user/:username endpoint in Org Control
 
           expect(res).to.have.status(404)
           expect(res).to.have.property('body').and.to.be.a('object')
-          const errObj = error.orgDneParam(userFixtures.nonExistentOrg.short_name)
+          const errObj = error.orgDnePathParam(userFixtures.nonExistentOrg.short_name)
           expect(res.body.error).to.equal(errObj.error)
           expect(res.body.message).to.equal(errObj.message)
           done()
diff --git a/test/unit-tests/user/userResetSecretTest.js b/test/unit-tests/user/userResetSecretTest.js
index 27a48ef7..b2023873 100644
--- a/test/unit-tests/user/userResetSecretTest.js
+++ b/test/unit-tests/user/userResetSecretTest.js
@@ -163,7 +163,7 @@ describe('Testing the PUT /org/:shortname/user/:username/reset_secret endpoint i
 
           expect(res).to.have.status(404)
           expect(res).to.have.property('body').and.to.be.a('object')
-          const errObj = error.orgDneParam(userFixtures.nonExistentOrg.short_name)
+          const errObj = error.orgDnePathParam(userFixtures.nonExistentOrg.short_name)
           expect(res.body.error).to.equal(errObj.error)
           expect(res.body.message).to.equal(errObj.message)
           done()
diff --git a/test/unit-tests/user/userUpdateTest.js b/test/unit-tests/user/userUpdateTest.js
index 6002a4cc..54842f9e 100644
--- a/test/unit-tests/user/userUpdateTest.js
+++ b/test/unit-tests/user/userUpdateTest.js
@@ -138,7 +138,7 @@ describe('Testing the PUT /org/:shortname/user/:username endpoint in Org Control
 
           expect(res).to.have.status(404)
           expect(res).to.have.property('body').and.to.be.a('object')
-          const errObj = error.orgDneParam(userFixtures.nonExistentOrg.short_name)
+          const errObj = error.orgDnePathParam(userFixtures.nonExistentOrg.short_name)
           expect(res.body.error).to.equal(errObj.error)
           expect(res.body.message).to.equal(errObj.message)
           done()
@@ -226,7 +226,7 @@ describe('Testing the PUT /org/:shortname/user/:username endpoint in Org Control
 
           expect(res).to.have.status(404)
           expect(res).to.have.property('body').and.to.be.a('object')
-          const errObj = error.orgDne(userFixtures.nonExistentOrg.short_name)
+          const errObj = error.orgDne(userFixtures.nonExistentOrg.short_name, 'org_short_name', 'query')
           expect(res.body.error).to.equal(errObj.error)
           expect(res.body.message).to.equal(errObj.message)
           done()