Merge branch 'dev' into dr_1830

Author: afoote-mitre

package.json

@@ -90,6 +90,8 @@
         "populate-cve:stage": "NODE_ENV=staging node src/scripts/populate-cve.js",
         "populate-cve:int": "NODE_ENV=integration node src/scripts/populate-cve.js",
         "populate-cve:prd": "NODE_ENV=production node src/scripts/populate-cve.js",
+        "generate": "NODE_ENV=test node src/scripts/test_data/generate.js",
+        "reset-keys": "NODE_ENV=test node src/scripts/test_data/reset_keys.js",
         "start:dev": "node src/swagger.js && TZ=utc NODE_ENV=development node src/scripts/updateOpenapiHost.js && TZ=utc NODE_ENV=development node-dev src/index.js",
         "dev": "node src/swagger.js && TZ=utc NODE_ENV=development node src/scripts/updateOpenapiHost.js && TZ=utc NODE_ENV=development node-dev src/index.js",
         "start:stage": "node src/swagger.js && NODE_ENV=staging node src/scripts/updateOpenapiHost.js && NODE_ENV=staging node src/index.js",

src/controller/registry-org.controller/registry-org.controller.js

@@ -294,6 +294,13 @@ async function updateOrg (req, res, next) {
 
         // Eventually we should validate this, but this is a bit tricky.
         if (reviewOrg) {
+          // For review objects, verify the provided UUID matches the target review object's UUID
+          const providedUUID = body?.UUID || body?.uuid
+          if (providedUUID && providedUUID !== reviewOrg.uuid) {
+            await session.abortTransaction()
+            return res.status(400).json(error.uuidProvided('org'))
+          }
+
           const updateResult = await reviewRepo.updateReviewOrgObject(body, reviewOrg.uuid, { session })
           if (updateResult) {
             updatedOrg = reviewOrg
@@ -307,6 +314,15 @@ async function updateOrg (req, res, next) {
         }
       }
 
+      // Verify that the provided UUID matches the existing organization's immutable database UUID
+      if (org) {
+        const providedUUID = body?.UUID || body?.uuid
+        if (providedUUID && providedUUID !== org.UUID) {
+          await session.abortTransaction()
+          return res.status(400).json(error.uuidProvided('org'))
+        }
+      }
+
       // Validate org
       const result = repo.validateOrg(body, { session })
       if (!result.isValid) {

src/controller/registry-user.controller/registry-user.controller.js

@@ -295,6 +295,19 @@ async function updateUser (req, res, next) {
     }
   }
 
+  // Allow existing UUIDs to be passed, but block any attempts to mutate them
+  if (userToEdit) {
+    if (body?.UUID || body?.uuid) {
+      if (body.UUID) body.UUID = userToEdit.UUID
+      if (body.uuid) body.uuid = userToEdit.UUID
+    }
+
+    if (body?.org_UUID || body?.org_uuid) {
+      if (body.org_UUID) body.org_UUID = userToEdit.org_UUID
+      if (body.org_uuid) body.org_uuid = userToEdit.org_UUID
+    }
+  }
+
   if (body.org_short_name && !isSecretariat) {
     logger.info({ uuid: req.ctx.uuid, message: 'Only Secretariat can reassign user organization.' })
     return res.status(403).json(error.notAllowedToChangeOrganization())
@@ -387,9 +400,10 @@ async function updateUser (req, res, next) {
         }
       }
 
-      // UUID of the user will not change, lets get it before we write to avoid read after write issues.
+      // Move lookups of immutable properties BEFORE the transaction mutation writes to completely bypass read-after-write anomalies
       const requestingUserUUID = await userRepo.getUserUUID(req.ctx.user, req.ctx.org, { session })
-      updatedUserUUID = await userRepo.getUserUUID(req.ctx.user, org.UUID)
+      updatedUserUUID = await userRepo.getUserUUID(req.ctx.user, org.UUID, { session })
+
       updatedUser = await userRepo.updateUserFull(userToEdit.UUID, body, { session }, true, requestingUserUUID)
       await session.commitTransaction()
     } catch (error) {
@@ -456,7 +470,8 @@ async function deleteUser (req, res, next) {
 }
 
 async function grantRole (req, res, next) {
-  const session = await mongoose.startSession()
+  // Explicitly configuring causalConsistency flag for clear DocumentDB context documentation
+  const session = await mongoose.startSession({ causalConsistency: false })
   try {
     const orgShortName = req.ctx.params.shortname
     const username = req.ctx.params.username
@@ -519,7 +534,8 @@ async function grantRole (req, res, next) {
 }
 
 async function revokeRole (req, res, next) {
-  const session = await mongoose.startSession()
+  // Explicitly configuring causalConsistency flag for clear DocumentDB context documentation
+  const session = await mongoose.startSession({ causalConsistency: false })
   try {
     const orgShortName = req.ctx.params.shortname
     const username = req.ctx.params.username

src/repositories/baseOrgRepository.js

@@ -594,8 +594,6 @@ class BaseOrgRepository extends BaseRepository {
     // Write - use org type specific model
     if (registryObjectRaw.authority.includes('SECRETARIAT')) {
       // Write
-      // testing:
-      registryObjectRaw.authority = 'SECRETARIAT'
       const SecretariatObjectToSave = new SecretariatOrgModel(registryObjectRaw)
       if (isSecretariat) {
         registryObject = await SecretariatObjectToSave.save(options)