From 403842b12b60c944402467f8f308cd9edb373734 Mon Sep 17 00:00:00 2001 From: James Dalphond Date: Wed, 26 Aug 2026 14:51:09 -0400 Subject: [PATCH] Require joint approval for organization contact and partner fields --- src/constants/index.js | 2 +- .../registryOrgWithJointReviewTest.js | 20 +++++++++++++++---- .../review-object/reviewObjectTest.js | 2 +- 3 files changed, 18 insertions(+), 6 deletions(-) diff --git a/src/constants/index.js b/src/constants/index.js index 3bc1dff19..034b570dc 100644 --- a/src/constants/index.js +++ b/src/constants/index.js @@ -44,7 +44,7 @@ function getConstants () { USER_ROLES: [ 'ADMIN' ], - JOINT_APPROVAL_FIELDS: ['short_name', 'long_name', 'authority', 'aliases', 'oversees', 'top_level_root', 'is_top_level_root', 'is_last_resort', 'charter_or_scope', 'product_list', 'disclosure_policy', 'partner_role_type', 'partner_number', 'program_data.cve_website_update_date', 'program_data.cve_website_update_needed', 'program_data.status', 'advisory_locations', 'advisory_location_require_credentials', 'vulnerability_advisory_location_for_web_scraping', 'tl_root_start_date', 'is_cna_discussion_list', 'id_quota'], + JOINT_APPROVAL_FIELDS: ['short_name', 'long_name', 'authority', 'aliases', 'oversees', 'top_level_root', 'is_top_level_root', 'is_last_resort', 'charter_or_scope', 'product_list', 'disclosure_policy', 'contact_info', 'partner_role_type', 'partner_number', 'partner_country', 'program_data.cve_website_update_date', 'program_data.cve_website_update_needed', 'program_data.status', 'advisory_locations', 'advisory_location_require_credentials', 'vulnerability_advisory_location_for_web_scraping', 'industry', 'tl_root_start_date', 'is_cna_discussion_list', 'id_quota'], JOINT_APPROVAL_FIELDS_LEGACY: ['short_name', 'name', 'authority.active_roles', 'policies.id_quota'], ORG_EXCLUDED_FIELDS: ['__t', '__v', '_id', 'inUse', 'in_use'], ORG_RESTRICTED_FIELDS: ['program_data'], diff --git a/test/integration-tests/registry-org/registryOrgWithJointReviewTest.js b/test/integration-tests/registry-org/registryOrgWithJointReviewTest.js index 28cd37220..6ff18ccdd 100644 --- a/test/integration-tests/registry-org/registryOrgWithJointReviewTest.js +++ b/test/integration-tests/registry-org/registryOrgWithJointReviewTest.js @@ -175,7 +175,13 @@ describe('Testing Joint approval', () => { await chai.request(app) .put('/api/registry/org/non_secretariat_org') .set(nonAdminHeaders) - .send({ ...testRegistryOrgForReview, short_name: 'new_non_secretariat_org', contact_info: { websites: ['https://www.example.com'] } }) + .send({ + ...testRegistryOrgForReview, + short_name: 'new_non_secretariat_org', + contact_info: { websites: ['https://www.example.com'] }, + partner_country: 'US', + industry: 'Technology' + }) .then((res) => { expect(res).to.have.status(200) expect(res.body.message).to.contain('organization was successfully updated, but joint approval is required for some fields.') @@ -192,6 +198,9 @@ describe('Testing Joint approval', () => { expect(res.body).to.have.property('status', 'pending') expect(res.body.target_object_uuid).to.equal(orgUUID) expect(res.body.new_review_data.short_name).to.equal('new_non_secretariat_org') + expect(res.body.new_review_data.contact_info.websites).to.deep.equal(['https://www.example.com']) + expect(res.body.new_review_data.partner_country).to.equal('US') + expect(res.body.new_review_data.industry).to.equal('Technology') reviewUUID = res.body.uuid }) }) @@ -203,7 +212,9 @@ describe('Testing Joint approval', () => { expect(err).to.be.undefined expect(res).to.have.status(200) expect(res.body.short_name).to.equal('non_secretariat_org') - expect(res.body.contact_info.websites[0]).to.equal('https://www.example.com') + expect((res.body.contact_info && res.body.contact_info.websites) || []).to.not.include('https://www.example.com') + expect(res.body).to.not.haveOwnProperty('partner_country') + expect(res.body).to.not.haveOwnProperty('industry') }) }) it('Secretariat can approve the ORG review with body parameter', async function () { @@ -306,7 +317,7 @@ describe('Testing Joint approval', () => { expect(err).to.be.undefined expect(res).to.have.status(200) expect(res.body.short_name).to.equal('non_with_comments') - expect(res.body.contact_info.websites[0]).to.equal('https://www.example.com') + expect((res.body.contact_info && res.body.contact_info.websites) || []).to.not.include('https://www.example.com') }) }) it('Secretariat leaves a public comment on the org review', async () => { @@ -380,6 +391,7 @@ describe('Testing Joint approval', () => { expect(res).to.have.status(200) expect(res.body.short_name).to.equal('new_non_with_comments') expect(res.body.id_quota).to.equal(1000) + expect(res.body.contact_info.websites[0]).to.equal('https://www.example.com') }) }) }) @@ -500,7 +512,7 @@ describe('Testing Joint approval', () => { expect(res.body.message).to.contain('organization was successfully updated, but joint approval is required for some fields.') expect(res.body.updated.UUID).to.equal(orgUUID) expect(res.body.updated.short_name).to.equal(testRegistryOrgForNewShortNameReview.short_name) - expect(res.body.updated.contact_info.websites[0]).to.equal('https://www.example.com/new-short-name') + expect((res.body.updated.contact_info && res.body.updated.contact_info.websites) || []).to.not.include('https://www.example.com/new-short-name') }) }) it('Check to see if the new_short_name review was created', async () => { diff --git a/test/integration-tests/review-object/reviewObjectTest.js b/test/integration-tests/review-object/reviewObjectTest.js index a65412170..a22410f31 100644 --- a/test/integration-tests/review-object/reviewObjectTest.js +++ b/test/integration-tests/review-object/reviewObjectTest.js @@ -223,7 +223,7 @@ describe('Review Object Controller Integration Tests', () => { .set({ ...constants.nonSecretariatUserHeaders2 }) .send(updateData) expect(res).to.have.status(200) - expect(res.body.updated.contact_info.websites[0]).to.equal('https://www.example.com') + expect((res.body.updated.contact_info && res.body.updated.contact_info.websites) || []).to.not.include('https://www.example.com') const reviewRes = await chai .request(app)