Merge pull request #1262 from CVEProject/jf-1258

Resolved issue #1258, adds feature to PUT /org/{shortname} to update new `last_active` field.

Author: jdaigneau5

api-docs/openapi.json

@@ -2099,7 +2099,7 @@
           "Organization"
         ],
         "summary": "Updates information about the organization specified by short name (accessible to Secretariat)",
-        "description": "  <h2>Access Control</h2>  <p>User must belong to an organization with the <b>Secretariat</b> role</p>  <h2>Expected Behavior</h2>  <p><b>Secretariat:</b> Updates any organization's information</p>",
+        "description": "  <h2>Access Control</h2>  <p>User must belong to an organization with the <b>Secretariat</b> role, or user must belong to the organization specified by short name</p>  <h2>Expected Behavior</h2>  <p><b>Secretariat:</b> Updates any organization's information</p>  <p><b>Non-secretariat:</b> Updates 'last_active' timestamp to show that an org is still active</p>",
         "operationId": "orgUpdateSingle",
         "parameters": [
           {
@@ -2142,7 +2142,14 @@
             "content": {
               "application/json": {
                 "schema": {
-                  "$ref": "../schemas/org/update-org-response.json"
+                  "oneOf": [
+                    {
+                      "$ref": "../schemas/org/update-org-response.json"
+                    },
+                    {
+                      "$ref": "../schemas/org/am-i-alive-response.json"
+                    }
+                  ]
                 }
               }
             }

schemas/org/am-i-alive-response.json

@@ -0,0 +1,20 @@
+{
+    "$schema": "http://json-schema.org/draft-04/schema",
+    "type": "object",
+    "properties": {
+      "message": {
+        "type": "string",
+        "description": "Success description"
+      },
+      "updated": {
+        "type": "object",
+        "properties": {
+          "last_active": {
+            "type": "string",
+            "format": "date-time",
+            "description": "The time the organization was last active."
+          }
+        }
+      }
+    }
+  }

src/controller/org.controller/index.js

@@ -245,9 +245,10 @@ router.put('/org/:shortname',
   #swagger.summary = "Updates information about the organization specified by short name (accessible to Secretariat)"
   #swagger.description = "
         <h2>Access Control</h2>
-        <p>User must belong to an organization with the <b>Secretariat</b> role</p>
+        <p>User must belong to an organization with the <b>Secretariat</b> role, or user must belong to the organization specified by short name</p>
         <h2>Expected Behavior</h2>
-        <p><b>Secretariat:</b> Updates any organization's information</p>"
+        <p><b>Secretariat:</b> Updates any organization's information</p>
+        <p><b>Non-secretariat:</b> Updates 'last_active' timestamp to show that an org is still active</p>"
   #swagger.parameters['shortname'] = { description: 'The shortname of the organization' }
   #swagger.parameters['$ref'] = [
     '#/components/parameters/id_quota',
@@ -263,7 +264,12 @@ router.put('/org/:shortname',
     description: 'Returns information about the organization updated',
     content: {
       "application/json": {
-        schema: { $ref: '../schemas/org/update-org-response.json' }
+        schema: {
+          oneOf: [
+            { $ref: '../schemas/org/update-org-response.json' },
+            { $ref: '../schemas/org/am-i-alive-response.json' }
+          ]
+        }
       }
     }
   }
@@ -309,10 +315,10 @@ router.put('/org/:shortname',
   }
   */
   mw.validateUser,
-  mw.onlySecretariat,
+  param(['shortname']).isString().trim().isLength({ min: CONSTANTS.MIN_SHORTNAME_LENGTH, max: CONSTANTS.MAX_SHORTNAME_LENGTH }),
+  mw.validateOrg,
   query().custom((query) => { return mw.validateQueryParameterNames(query, ['new_short_name', 'id_quota', 'name', 'active_roles.add', 'active_roles.remove']) }),
   query(['new_short_name', 'id_quota', 'name', 'active_roles.add', 'active_roles.remove']).custom((val) => { return mw.containsNoInvalidCharacters(val) }),
-  param(['shortname']).isString().trim().isLength({ min: CONSTANTS.MIN_SHORTNAME_LENGTH, max: CONSTANTS.MAX_SHORTNAME_LENGTH }),
   query(['new_short_name']).optional().isString().trim().notEmpty().isLength({ min: CONSTANTS.MIN_SHORTNAME_LENGTH, max: CONSTANTS.MAX_SHORTNAME_LENGTH }),
   query(['id_quota']).optional().not().isArray().isInt({ min: CONSTANTS.MONGOOSE_VALIDATION.Org_policies_id_quota_min, max: CONSTANTS.MONGOOSE_VALIDATION.Org_policies_id_quota_max }).withMessage(errorMsgs.ID_QUOTA),
   query(['name']).optional().isString().trim().notEmpty(),

src/controller/org.controller/org.controller.js

@@ -329,6 +329,7 @@ async function updateOrg (req, res, next) {
     const addRoles = []
     const orgRepo = req.ctx.repositories.getOrgRepository()
     const org = await orgRepo.findOneByShortName(shortName)
+    const orgMakingChanges = req.ctx.org
     let agt = setAggregateOrgObj({ short_name: shortName })
 
     // org doesn't exist
@@ -337,30 +338,38 @@ async function updateOrg (req, res, next) {
       return res.status(404).json(error.orgDnePathParam(shortName))
     }
 
-    Object.keys(req.ctx.query).forEach(k => {
-      const key = k.toLowerCase()
-
-      if (key === 'new_short_name') {
-        newOrg.short_name = req.ctx.query.new_short_name
-        agt = setAggregateOrgObj({ short_name: newOrg.short_name })
-      } else if (key === 'name') {
-        newOrg.name = req.ctx.query.name
-      } else if (key === 'id_quota') {
-        newOrg.policies.id_quota = req.ctx.query.id_quota
-      } else if (key === 'active_roles.add') {
-        if (Array.isArray(req.ctx.query['active_roles.add'])) {
-          req.ctx.query['active_roles.add'].forEach(r => {
-            addRoles.push(r)
-          })
-        }
-      } else if (key === 'active_roles.remove') {
-        if (Array.isArray(req.ctx.query['active_roles.remove'])) {
-          req.ctx.query['active_roles.remove'].forEach(r => {
-            removeRoles.push(r)
-          })
+    const isSec = await orgRepo.isSecretariat(orgMakingChanges)
+
+    if (isSec) {
+      Object.keys(req.ctx.query).forEach(k => {
+        const key = k.toLowerCase()
+
+        if (key === 'new_short_name') {
+          newOrg.short_name = req.ctx.query.new_short_name
+          agt = setAggregateOrgObj({ short_name: newOrg.short_name })
+        } else if (key === 'name') {
+          newOrg.name = req.ctx.query.name
+        } else if (key === 'id_quota') {
+          newOrg.policies.id_quota = req.ctx.query.id_quota
+        } else if (key === 'active_roles.add') {
+          if (Array.isArray(req.ctx.query['active_roles.add'])) {
+            req.ctx.query['active_roles.add'].forEach(r => {
+              addRoles.push(r)
+            })
+          }
+        } else if (key === 'active_roles.remove') {
+          if (Array.isArray(req.ctx.query['active_roles.remove'])) {
+            req.ctx.query['active_roles.remove'].forEach(r => {
+              removeRoles.push(r)
+            })
+          }
         }
-      }
-    })
+      })
+    }
+
+    if (shortName === orgMakingChanges) {
+      newOrg.last_active = Date.now()
+    }
 
     // updating the org's roles
     if (org) {
@@ -403,6 +412,13 @@ async function updateOrg (req, res, next) {
     result = await orgRepo.aggregate(agt)
     result = result.length > 0 ? result[0] : null
 
+    if (!isSec) {
+      if (!result || !result.last_active) {
+        return res.status(500).json(error.serverError())
+      }
+      result = { last_active: result.last_active }
+    }
+
     const responseMessage = {
       message: shortName + ' organization was successfully updated.',
       updated: result
@@ -819,7 +835,8 @@ function setAggregateOrgObj (query) {
         name: true,
         'authority.active_roles': true,
         'policies.id_quota': true,
-        time: true
+        time: true,
+        last_active: true
       }
     }
   ]

src/middleware/middleware.js

@@ -135,6 +135,32 @@ async function validateUser (req, res, next) {
   }
 }
 
+async function validateOrg (req, res, next) {
+  const org = req.ctx.org
+  const reqOrg = req.params.shortname
+  const orgRepo = req.ctx.repositories.getOrgRepository()
+  const CONSTANTS = getConstants()
+
+  try {
+    logger.info({ uuid: req.ctx.uuid, message: 'Authenticating org: ' + org })
+
+    const isSec = await orgRepo.isSecretariat(org)
+    if (!isSec) {
+      if (org !== reqOrg) {
+        logger.info({ uuid: req.ctx.uuid, message: org + ' is not a ' + CONSTANTS.AUTH_ROLE_ENUM.SECRETARIAT + ' or the same as ' + reqOrg + ' and is not allowed to make these changes.' })
+        return res.status(403).json(error.secretariatOnly())
+      } else if (Object.keys(req.query).length > 0) {
+        return res.status(403).json(error.secretariatOnly())
+      }
+    }
+
+    logger.info({ uuid: req.ctx.uuid, message: 'Confirmed ' + org + ' has the authority to make changes to ' + reqOrg })
+    next()
+  } catch (err) {
+    next(err)
+  }
+}
+
 // Checks that the requester belongs to an org that has the 'BULK_DOWNLOAD' role
 async function onlySecretariatOrBulkDownload (req, res, next) {
   const org = req.ctx.org
@@ -483,6 +509,7 @@ module.exports = {
   setCacheControl,
   optionallyValidateUser,
   validateUser,
+  validateOrg,
   onlySecretariat,
   onlySecretariatOrBulkDownload,
   onlySecretariatOrAdmin,

src/model/org.js

@@ -24,7 +24,8 @@ const schema = {
     created: Date,
     modified: Date
   },
-  inUse: Boolean
+  inUse: Boolean,
+  last_active: Date
 }
 
 const OrgSchema = new mongoose.Schema(schema, { collection: 'Org', timestamps: { createdAt: 'time.created', updatedAt: 'time.modified' } })