Introduce experimental new internal authz API

.eslintrc.js

@@ -8,7 +8,7 @@ module.exports = {
     'standard'
   ],
   parserOptions: {
-    ecmaVersion: 2020, // Allows for the parsing of modern ECMAScript features
+    ecmaVersion: 2024, // Allows for the parsing of modern ECMAScript features
     sourceType: 'module' // Allows for the use of imports
   },
   plugins: [

.gitignore

@@ -104,3 +104,5 @@ commit-message.txt
 # configuration) and provide an example instead
 docker/.docker-env
 
+# Generated jsdoc documentation
+jsdoc/

.jsdoc.json

@@ -0,0 +1,3 @@
+{
+    "plugins": ["plugins/markdown"]
+}

package.json

@@ -20,6 +20,7 @@
         "eslint-plugin-node": "^11.0.0",
         "eslint-plugin-promise": "^4.2.1",
         "eslint-plugin-standard": "^4.0.1",
+        "jsdoc": "^4.0.5",
         "mocha": "^10.8.2",
         "nyc": "^15.1.0",
         "sinon": "^15.0.4",
@@ -53,6 +54,7 @@
         "prompt-sync": "^4.2.0",
         "replace-in-file": "6.3.5",
         "replace-json-property": "^1.8.0",
+        "set.prototype.intersection": "^1.1.8",
         "swagger-autogen": "^2.19.0",
         "swagger-ui-express": "^4.3.0",
         "uuid": "^8.3.2",
@@ -71,21 +73,21 @@
     },
     "scripts": {
         "action:test": "node node_modules/mocha/bin/mocha test/unit-tests --recursive --exit",
-        "action:coverage": "NODE_ENV=test node node_modules/nyc/bin/nyc.js --lines=80 node_modules/mocha/bin/mocha.js src/* --recursive --exit",
+        "action:coverage": "NODE_ENV=test MONGO_CONN_STRING=mongodb://localhost:27017 MONGO_DB_NAME=cve_test node node_modules/nyc/bin/nyc.js --lines=80 npm run test",
         "action:lint-src": "node node_modules/eslint/bin/eslint.js src/",
         "action:lint-test": "node node_modules/eslint/bin/eslint.js test/",
         "action:lint-test-utils": "node node_modules/eslint/bin/eslint.js test-utils/",
         "clean": "node node_modules/depcheck/bin/depcheck.js",
         "lint:src": "node node_modules/eslint/bin/eslint.js src/ --fix",
         "lint:test": "node node_modules/eslint/bin/eslint.js test/ --fix",
         "lint:test-utils": "node node_modules/eslint/bin/eslint.js test-utils/ --fix",
-        "populate:dev": "NODE_ENV=development node-dev src/scripts/populate.js",
+        "populate:dev": "NODE_ENV=development node-dev src/scripts/populate.mjs",
         "migrate:dev": "NODE_ENV=development MONGO_CONN_STRING=mongodb://localhost:27017 MONGO_DB_NAME=cve_dev node-dev src/scripts/migrate.js",
         "migrate:test-black-box": "NODE_ENV=development MONGO_CONN_STRING=mongodb://docdb:27017 MONGO_DB_NAME=cve_dev node-dev src/scripts/migrate.js",
         "migrate:test": "NODE_ENV=test MONGO_CONN_STRING=mongodb://localhost:27017 MONGO_DB_NAME=cve_test node-dev src/scripts/migrate.js",
-        "populate:stage": "NODE_ENV=staging node src/scripts/populate.js",
-        "populate:int": "NODE_ENV=integration node src/scripts/populate.js",
-        "populate:prd": "NODE_ENV=production node src/scripts/populate.js",
+        "populate:stage": "NODE_ENV=staging node src/scripts/populate.mjs",
+        "populate:int": "NODE_ENV=integration node src/scripts/populate.mjs",
+        "populate:prd": "NODE_ENV=production node src/scripts/populate.mjs",
         "populate-cve:dev": "NODE_ENV=development node-dev src/scripts/populate-cve.js",
         "populate-cve:stage": "NODE_ENV=staging node src/scripts/populate-cve.js",
         "populate-cve:int": "NODE_ENV=integration node src/scripts/populate-cve.js",
@@ -98,10 +100,12 @@
         "start:prd": "node src/swagger.js && NODE_ENV=production node src/scripts/updateOpenapiHost.js && NODE_ENV=production node src/index.js",
         "swagger-autogen": "node src/swagger.js",
         "test": "NODE_ENV=test mocha --recursive --exit || true",
-        "test:integration": "NODE_ENV=test node-dev src/scripts/populate.js y; NODE_ENV=test MONGO_CONN_STRING=mongodb://docdb:27017 MONGO_DB_NAME=cve_test node-dev src/scripts/migrate.js; NODE_ENV=test mocha test/integration-tests --recursive --exit",
+        "test:integration": "NODE_ENV=test node-dev src/scripts/populate.mjs y; NODE_ENV=test MONGO_CONN_STRING=mongodb://docdb:27017 MONGO_DB_NAME=cve_test node-dev src/scripts/migrate.js; NODE_ENV=test mocha test/integration-tests --exclude test/integration-tests/cve/authzValidation.js --recursive --exit && NODE_ENV=test mocha test/integration-tests/cve/authzValidation.js --recursive --exit",
+        "test:integration-local": "NODE_ENV=test node-dev src/scripts/populate.mjs y; NODE_ENV=test MONGO_CONN_STRING=mongodb://localhost:27017 MONGO_DB_NAME=cve_test node-dev src/scripts/migrate.js; NODE_ENV=test mocha test/integration-tests --exclude test/integration-tests/cve/authzValidation.js --recursive --exit && NODE_ENV=test mocha test/integration-tests/cve/authzValidation.js --recursive --exit",
         "test:unit-tests": "NODE_ENV=test mocha test/unit-tests --recursive --exit || true",
         "test:coverage": "NODE_ENV=test nyc --reporter=text mocha src/* --recursive --exit || true",
         "test:coverage-html": "NODE_ENV=test nyc --reporter=html mocha src/* --recursive --exit || true",
-        "test:scripts": "NODE_ENV=development node-dev src/scripts/templateScript.js"
+        "test:scripts": "NODE_ENV=development node-dev src/scripts/templateScript.js",
+        "doc:build": "jsdoc -c .jsdoc.json -r src/ -d jsdoc/"
     }
 }

src/constants/index.js

@@ -1,3 +1,7 @@
+/**
+ * @module constants
+ */
+
 const fs = require('fs')
 const cveSchemaV5 = JSON.parse(fs.readFileSync('src/middleware/schemas/CVE_JSON_5.2.0_bundled.json'))
 
@@ -8,6 +12,7 @@ const cveSchemaV5 = JSON.parse(fs.readFileSync('src/middleware/schemas/CVE_JSON_
  * value re-assignment and still allow IDE type-hints and compiled regex
  *
  * @return {defaults}
+ * @alias module:constants.getConstants
  */
 function getConstants () {
   /**

src/controller/audit.controller/audit.controller.js

@@ -1,3 +1,7 @@
+/**
+ * @module controller/audit/controller
+ */
+
 const mongoose = require('mongoose')
 const logger = require('../../middleware/logger')
 const errors = require('./error')

src/controller/audit.controller/audit.middleware.js

@@ -1,3 +1,7 @@
+/**
+* @module controller/audit/middleware
+ */
+
 const utils = require('../../utils/utils')
 
 /**

src/controller/audit.controller/error.js

@@ -1,3 +1,7 @@
+/**
+ * @module controller/audit/error
+ */
+
 const idrErr = require('../../utils/error')
 
 class AuditControllerError extends idrErr.IDRError {

src/controller/audit.controller/index.js

@@ -1,3 +1,7 @@
+/**
+ * @module controller/audit
+ */
+
 const router = require('express').Router()
 const controller = require('./audit.controller')
 const mw = require('../../middleware/middleware')

src/controller/conversation.controller/conversation.controller.js

@@ -1,3 +1,7 @@
+/**
+ * @module controller/conversation/controller
+ */
+
 const mongoose = require('mongoose')
 const logger = require('../../middleware/logger')
 const getConstants = require('../../../src/constants').getConstants

src/controller/conversation.controller/index.js

@@ -1,3 +1,7 @@
+/**
+ * @module controller/conversation
+ */
+
 const router = require('express').Router()
 const { param, query } = require('express-validator')
 const controller = require('./conversation.controller')

src/controller/cve-id.controller/cve-id.controller.js

@@ -1,3 +1,7 @@
+/**
+ * @module controller/cve-id/controller
+ */
+
 require('dotenv').config()
 const CveId = require('../../model/cve-id')
 const logger = require('../../middleware/logger')
@@ -578,9 +582,9 @@ async function sequentialReservation (year, amount, shortName, orgShortName, req
     isFull = true
 
     if (isPriority) {
-      logger.error(JSON.stringify({ message: 'The cve id priority and sequential blocks are full for year ' + year + '. No more priority or sequential ids can be reserved at this time.' }))
+      logger.error({ message: 'The cve id priority and sequential blocks are full for year ' + year + '. No more priority or sequential ids can be reserved at this time.' })
     } else {
-      logger.error(JSON.stringify({ message: 'The cve id sequential block is full for year ' + year + '. No more sequential ids can be reserved at this time.' }))
+      logger.error({ message: 'The cve id sequential block is full for year ' + year + '. No more sequential ids can be reserved at this time.' })
     }
 
     res.header(CONSTANTS.QUOTA_HEADER, availableIds)
@@ -688,7 +692,7 @@ async function nonSequentialReservation (year, amount, shortName, orgShortName,
     isFull = result.isFull
 
     if (isFull) {
-      logger.error(JSON.stringify({ message: 'The cve id non-sequential block is full for year ' + year + '. No more sequential ids can be reserved at this time.' }))
+      logger.error({ message: 'The cve id non-sequential block is full for year ' + year + '. No more sequential ids can be reserved at this time.' })
       res.header(CONSTANTS.QUOTA_HEADER, availableIds)
       return res.status(403).json(error.yearRangeFull(year))
     }

src/controller/cve-id.controller/cve-id.middleware.js

@@ -1,3 +1,7 @@
+/**
+ * @module controller/cve-id/middleware
+ */
+
 const { validationResult } = require('express-validator')
 const errors = require('./error')
 const error = new errors.CveIdControllerError()

src/controller/cve-id.controller/error.js

@@ -1,3 +1,7 @@
+/**
+ * @module controller/cve-id/error
+ */
+
 const idrErr = require('../../utils/error')
 const getConstants = require('../../constants').getConstants
 

src/controller/cve-id.controller/index.js

@@ -1,3 +1,7 @@
+/**
+ * @module controller/cve-id
+ */
+
 const express = require('express')
 const router = express.Router()
 const mw = require('../../middleware/middleware')

src/controller/cve.controller/cve.controller.js

@@ -1,3 +1,7 @@
+/**
+ * @module controller/cve/controller
+ */
+
 const Cve = require('../../model/cve')
 const logger = require('../../middleware/logger')
 const errors = require('./error')
@@ -552,7 +556,7 @@ async function submitCna (req, res, next) {
     result = Cve.validateCveRecord(cveModel.cve)
 
     if (!result.isValid) {
-      logger.error(JSON.stringify({ uuid: req.ctx.uuid, message: 'CVE JSON schema validation FAILED.' }))
+      logger.error({ uuid: req.ctx.uuid, message: 'CVE JSON schema validation FAILED.' })
       return res.status(400).json(error.invalidCnaContainerJsonSchema(result.errors))
     }
 
@@ -658,7 +662,7 @@ async function updateCna (req, res, next) {
     result = Cve.validateCveRecord(cveModel.cve)
 
     if (!result.isValid) {
-      logger.error(JSON.stringify({ uuid: req.ctx.uuid, message: 'CVE JSON schema validation FAILED.' }))
+      logger.error({ uuid: req.ctx.uuid, message: 'CVE JSON schema validation FAILED.' })
       return res.status(400).json(error.invalidCnaContainerJsonSchema(result.errors))
     }
 
@@ -730,7 +734,7 @@ async function rejectCVE (req, res, next) {
 
     result = Cve.validateCveRecord(newCveObj.cve)
     if (!result.isValid) {
-      logger.error(JSON.stringify({ uuid: req.ctx.uuid, message: 'CVE JSON schema validation FAILED.' }))
+      logger.error({ uuid: req.ctx.uuid, message: 'CVE JSON schema validation FAILED.' })
       return res.status(400).json(error.invalidCnaContainerJsonSchema(result.errors))
     }
 
@@ -805,7 +809,7 @@ async function rejectExistingCve (req, res, next) {
 
     result = Cve.validateCveRecord(updatedCve.cve)
     if (!result.isValid) {
-      logger.error(JSON.stringify({ uuid: req.ctx.uuid, message: 'CVE JSON schema validation FAILED.' }))
+      logger.error({ uuid: req.ctx.uuid, message: 'CVE JSON schema validation FAILED.' })
       return res.status(400).json(error.invalidCnaContainerJsonSchema(result.errors))
     }
     result = await cveRepo.updateByCveId(id, updatedCve)
@@ -916,7 +920,7 @@ async function insertAdp (req, res, next) {
     const cveModel = new Cve({ cve: convertDatesToISO(cveRecord, CONSTANTS.DATE_FIELDS) })
     result = Cve.validateCveRecord(cveModel.cve)
     if (!result.isValid) {
-      logger.error(JSON.stringify({ uuid: req.ctx.uuid, message: 'CVE JSON schema validation FAILED.' }))
+      logger.error({ uuid: req.ctx.uuid, message: 'CVE JSON schema validation FAILED.' })
       return res.status(400).json(error.badAdpJson(result.errors))
     }
 

src/controller/cve.controller/cve.middleware.js

@@ -1,3 +1,7 @@
+/**
+ * @module controller/cve/middleware
+ */
+
 const { PackageURL } = require('packageurl-js')
 const { body, validationResult } = require('express-validator')
 const errors = require('./error')
@@ -134,7 +138,7 @@ function validateCveCnaContainerJsonSchema (req, res, next) {
   const cnaContainer = req.body
   const result = validateCnaContainer(cnaContainer)
   if (!result) {
-    logger.error(JSON.stringify({ uuid: req.ctx.uuid, message: 'CVE JSON schema validation FAILED.' }))
+    logger.error({ uuid: req.ctx.uuid, message: 'CVE JSON schema validation FAILED.' })
     const temp = validateCnaContainer.errors
     const errorsArray = []
     temp.forEach((error) => {
@@ -144,7 +148,7 @@ function validateCveCnaContainerJsonSchema (req, res, next) {
     })
     return res.status(400).json(error.invalidCnaContainerJsonSchema(errorsArray))
   }
-  logger.info(JSON.stringify({ uuid: req.ctx.uuid, message: 'SUCCESSFUL CVE JSON schema validation.' }))
+  logger.info({ uuid: req.ctx.uuid, message: 'SUCCESSFUL CVE JSON schema validation.' })
   next()
 }
 

src/controller/cve.controller/error.js

@@ -1,3 +1,7 @@
+/**
+ * @module controller/cve/error
+ */
+
 const idrErr = require('../../utils/error')
 
 class CveControllerError extends idrErr.IDRError {

src/controller/cve.controller/index.js

@@ -1,10 +1,27 @@
+/**
+ * @module controller/cve
+ */
+
 const express = require('express')
 const router = express.Router()
 const mw = require('../../middleware/middleware')
 const errorMsgs = require('../../middleware/errorMessages')
 const controller = require('./cve.controller')
 const { body, param, query } = require('express-validator')
-const { parseGetParams, parsePostParams, parseError, validateCveCnaContainerJsonSchema, validateCveAdpContainerJsonSchema, validateRejectBody, validateUniqueEnglishEntry, validateDescription, validateDatePublic, validateTimelineDates, validatePURL } = require('./cve.middleware')
+const {
+  parseGetParams,
+  parsePostParams,
+  parseError,
+  validateCveCnaContainerJsonSchema,
+  validateCveAdpContainerJsonSchema,
+  validateRejectBody,
+  validateUniqueEnglishEntry,
+  validateDescription,
+  validateDatePublic,
+  validateTimelineDates,
+  validatePURL
+} = require('./cve.middleware')
+const { authz, orgHasRole, OrgRoles } = require('../../middleware/authz')
 const getConstants = require('../../constants').getConstants
 const CONSTANTS = getConstants()
 const CHOICES = [CONSTANTS.CVE_STATES.REJECTED, CONSTANTS.CVE_STATES.PUBLISHED]
@@ -580,6 +597,10 @@ router.put('/cve/:id',
   }
   */
   mw.validateUser,
+  mw.authzApiSelector({
+    oldAuthz: mw.onlySecretariat,
+    newAuthz: authz(orgHasRole(OrgRoles.SECRETARIAT))
+  }),
   mw.onlySecretariat,
   mw.trimJSONWhitespace,
   mw.validateCveJsonSchema,

src/controller/org.controller/error.js

@@ -1,3 +1,7 @@
+/**
+ * @module controller/org/error
+ */
+
 const idrErr = require('../../utils/error')
 
 class OrgControllerError extends idrErr.IDRError {

src/controller/org.controller/index.js

@@ -1,3 +1,7 @@
+/**
+ * @module controller/org
+ */
+
 const express = require('express')
 const router = express.Router()
 const mw = require('../../middleware/middleware')

src/controller/org.controller/org.controller.js

@@ -1,3 +1,7 @@
+/**
+ * @module controller/org/controller
+ */
+
 require('dotenv').config()
 const mongoose = require('mongoose')
 const logger = require('../../middleware/logger')
@@ -251,7 +255,7 @@ async function createOrg (req, res, next) {
         // If we are creating an org via the registry flag, we can do a full validation.
         const result = await repo.validateOrg(body, { session })
         if (!result.isValid) {
-          logger.error(JSON.stringify({ uuid: req.ctx.uuid, message: 'CVE JSON schema validation FAILED.' }))
+          logger.error({ uuid: req.ctx.uuid, message: 'CVE JSON schema validation FAILED.' })
           await session.abortTransaction()
           if (!Array.isArray(body?.authority) || body?.authority.some(item => typeof item !== 'string')) {
             return res.status(400).json({ error: 'BAD_INPUT', message: 'Parameters were invalid', details: [{ param: 'authority', msg: 'Parameter must be a one-dimensional array of strings' }] })
@@ -420,7 +424,7 @@ async function createUser (req, res, next) {
           return res.status(400).json({ message: 'Parameters were invalid', details: [{ param: 'role', msg: `Role must be one of the following: ${constants.USER_ROLES}` }] })
         }
         if (!result.isValid) {
-          logger.error(JSON.stringify({ uuid: req.ctx.uuid, message: 'User JSON schema validation FAILED.' }))
+          logger.error({ uuid: req.ctx.uuid, message: 'User JSON schema validation FAILED.' })
           await session.abortTransaction()
           return res.status(400).json({ message: 'Parameters were invalid', errors: result.errors })
         }

src/controller/org.controller/org.middleware.js

@@ -1,3 +1,7 @@
+/**
+ * @module controller/org/middleware
+ */
+
 const getConstants = require('../../constants').getConstants
 const { validationResult } = require('express-validator')
 const errors = require('./error')

src/controller/registry-org.controller/error.js

@@ -1,3 +1,7 @@
+/**
+ * @module controller/registry-org/error
+ */
+
 const idrErr = require('../../utils/error')
 
 class RegistryOrgControllerError extends idrErr.IDRError {

src/controller/registry-org.controller/index.js

@@ -1,3 +1,7 @@
+/**
+ * @module controller/registry-org
+ */
+
 const express = require('express')
 const router = express.Router()
 const mw = require('../../middleware/middleware')