Merge pull request #1859 from CVEProject/af-1856

Resolves Issue #1856 and #1857: Return authority validation errors for invalid registry org roles

Author: jdaigneau5

src/repositories/baseOrgRepository.js

@@ -1042,8 +1042,23 @@ class BaseOrgRepository extends BaseRepository {
       return { isValid: false, errors: [{ instancePath: '/authority', message: 'authority is required' }] }
     }
 
+    const validAuthorityRoles = getConstants().ORG_ROLES
+    const authorityRoleError = instancePath => ({
+      isValid: false,
+      errors: [{
+        instancePath,
+        message: 'must be equal to one of the allowed values',
+        params: { allowedValues: validAuthorityRoles }
+      }]
+    })
+
     let validateObject = {}
     if (Array.isArray(org.authority)) {
+      const invalidAuthorityIndex = org.authority.findIndex(role => !validAuthorityRoles.includes(role))
+      if (invalidAuthorityIndex !== -1) {
+        return authorityRoleError(`/authority/${invalidAuthorityIndex}`)
+      }
+
       // User passed in an array, we need to decide how we handle this.
       if (org.authority.includes('SECRETARIAT')) {
         org.authority = ['SECRETARIAT']
@@ -1068,6 +1083,10 @@ class BaseOrgRepository extends BaseRepository {
         }
       }
     } else {
+      if (!validAuthorityRoles.includes(org.authority)) {
+        return authorityRoleError('/authority')
+      }
+
       if (org.authority === 'ADP') {
         validateObject = ADPOrgModel.validateOrg(org)
       }

test/integration-tests/registry-org/registryOrgCRUDTest.js

@@ -748,6 +748,23 @@ describe('Testing /registryOrg endpoints', () => {
             expect(res.body.message).to.equal('Parameters were invalid')
           })
       })
+      it('Fails to update a registry organization with lowercase authority and returns authority errors', async () => {
+        await chai.request(app)
+          .put('/api/registry/org/registry_org_test')
+          .set(secretariatHeaders)
+          .send({
+            ...createdOrg,
+            authority: ['cna']
+          })
+          .then((res) => {
+            expect(res).to.have.status(400)
+            expect(res.body.message).to.equal('Parameters were invalid')
+            expect(res.body.errors).to.be.an('array')
+            expect(res.body.errors[0].instancePath).to.equal('/authority/0')
+            expect(res.body.errors[0].message).to.equal('must be equal to one of the allowed values')
+            expect(res.body.errors[0].params.allowedValues).to.include('CNA')
+          })
+      })
       it('Fails to update a registry organization providing an invalid partner_role_type enum value', async () => {
         await chai.request(app)
           .put('/api/registry/org/registry_org_test')