Skip to content

Commit 525b84e

Browse files
jdaigneau5jdaigneau5
authored
Merge pull request #1444 from CVEProject/dev
Update test with user registry updates from dev
2 parents 59d17dd + 89a8ad4 commit 525b84e

24 files changed

Lines changed: 2602 additions & 126 deletions

‎README.md‎

Lines changed: 24 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
*NOTE: the Test environment of CVE Services now includes the release candidate “User Registry” which adds many additional features. See the details at the end of this ReadMe doc.*
1+
*6/12/2025 NOTE: the Test environment of CVE Services now includes the release candidate “User Registry” which adds many additional features. See the details at the end of this ReadMe doc.*
22

33
# CVE-API
44

@@ -143,18 +143,33 @@ In order to run the unit tests:
143143
npm run start:test
144144
```
145145

146-
147146
### User Registry
148147

149148
The CVE Automation Working Group (on behalf of the CVE Program) is currently working on a new automation capability: the User Registry. The objective of the User Registry is to modernize how CVE Program Organizations (e.g., CNAs, Roots, Top level Roots, the Secretariat) manage/update their organizational properties and user pools. The new capability will ultimately allow CNAs, Roots, Top Level Roots to better manage their own data/user pools with more robust information. It is targeted to be implemented in a series of incremental deployments to CVE Services in the Fall/2025 through Summer/2026.
150149

151-
Current Status: The release candidate for the first User Registry increment (termed the User Registry MVP) is now available for testing/review in the CVE Program Testing Environment. (Note that this release IS NOT a PRODUCTION Release and will not be visible in the CVE Program PRODUCTION environment).
152-
This release candidate establishes a new, more robust User/Organizations databases (and associated APIs) while maintaining full backwards compatibility with the current User/Organizational management functions (meaning that current CVE Services clients will not be required to be modified with the deployment of this candidate). It was discussed at the 6/11/2025 CVE Program AWG meeting.
150+
#### Current Status:
151+
152+
The release candidate for the first User Registry increment (termed the User Registry MVP) is now available for testing/review in the CVE Program Testing Environment. (Note that this release IS NOT a PRODUCTION Release and will not be visible in the CVE Program PRODUCTION environment).
153+
This release candidate establishes a new, more robust User/Organizations databases (and associated APIs) while maintaining full backwards compatibility with the current User/Organizational management functions (meaning that current CVE Services clients will not be required to be modified with the deployment of this candidate). It was discussed at the [6/10/2025 CVE Program AWG meeting](https://github.com/CVEProject/automation-working-group/blob/master/meeting-notes/2025-06-10.md).
154+
155+
#### HowTo:
156+
157+
Credentialed users of CVE Services Test Environment will be able to use the new capabilities via the API endpoints which are described [here](https://cveawg-test.mitre.org/api-docs/) (Be sure to scroll down to the bottom of the page to review the new User Registry interfaces).
158+
159+
Credentialed users can access the APIs by
160+
161+
- installing/using common web application API testing tools such as [curl](https://curl.se/) or [postman](https://www.postman.com/) OR
162+
163+
- installing/using the [User Registry Client](https://github.com/CVEProject/cve-user-registry-client) which provides a GUI interface to exercise the basic functions of the User Registry.
164+
165+
Note that there is no support for these new endpoints in many currently available CVE Services “client” tools (e.g, Vulnogram) and hence they should not be relied upon to examine/test these interfaces.
166+
167+
#### Next Steps:
168+
169+
The AWG is taking comments/questions on this release candidate. You can provide feedback in three ways:
153170

154-
HowTo: Credentialed users of CVE Services will be able to use the new capabilities via the API endpoints. Note that support for new endpoints may not be immediately available in the “client” tools provided by the community.
171+
- Send comments/questions to AWG+owner@CVE-CWE-Programs.groups.io,
155172

156-
Next Steps: The AWG is taking comments/questions on this release candidate. You can provide feedback in three ways:
157-
Send comments/questions to AWG+owner@CVE-CWE-Programs.groups.io,
173+
- Post Issues/Questions to the CVE Services Issue Board (please attach a “user registry” label to your post).
158174

159-
Post Issues/Questions to the CVE Services Issue Board (please attach a “user registry” label to your post).
160-
Attend (virtually) an AWG meeting which meets every week on Tuesday at 4:00 PM Eastern US Time. Send a request for the link to AWG+owner@CVE-CWE-Programs.groups.io.
175+
- Attend (virtually) an AWG meeting which meets every week on Tuesday at 4:00 PM Eastern US Time. Send a request for the link to AWG+owner@CVE-CWE-Programs.groups.io.

‎api-docs/openapi.json‎

Lines changed: 34 additions & 22 deletions
Original file line numberDiff line numberDiff line change
@@ -1448,7 +1448,7 @@
14481448
}
14491449
},
14501450
"requestBody": {
1451-
"description": "<h3>Notes:</h3> <ul> <li>**providerMetadata** is set by the server. If provided, it will be overwritten.</li> <li>**datePublished** and **assignerShortname** are optional fields in the schema, but are set by the server. </li> </ul>",
1451+
"description": "<h3>Notes:</h3> <ul> <li>**providerMetadata** is set by the server. If provided, it will be overwritten.</li> <li>**datePublished** and **assignerShortname** are optional fields in the schema, but are set by the server. </li> </ul>",
14521452
"required": true,
14531453
"content": {
14541454
"application/json": {
@@ -1560,7 +1560,7 @@
15601560
}
15611561
},
15621562
"requestBody": {
1563-
"description": "<h3>Notes:</h3> <ul> <li>When updating a rejected record to published, it is recommended to confirm that both the Cve-Id and CVE record are in the correct state after calling this endpoint. Though very unlikely, a race condition can occur causing the two states to be out of sync. </li> <li>**providerMetadata** is set by the server. If provided, it will be overwritten.</li> <li>**datePublished** and **assignerShortname** are optional fields in the schema, but are set by the server. </li> </ul>",
1563+
"description": "<h3>Notes:</h3> <ul> <li>When updating a rejected record to published, it is recommended to confirm that both the Cve-Id and CVE record are in the correct state after calling this endpoint. Though very unlikely, a race condition can occur causing the two states to be out of sync. </li> <li>**providerMetadata** is set by the server. If provided, it will be overwritten.</li> <li>**datePublished** and **assignerShortname** are optional fields in the schema, but are set by the server. </li> </ul>",
15641564
"required": true,
15651565
"content": {
15661566
"application/json": {
@@ -1671,7 +1671,7 @@
16711671
}
16721672
},
16731673
"requestBody": {
1674-
"description": "<h3>Notes:</h3> <ul> <li>**providerMetadata** is set by the server. If provided, it will be overwritten.</li> <li>**datePublished** and **assignerShortname** are optional fields in the schema, but are set by the server. </li> </ul>",
1674+
"description": "<h3>Notes:</h3> <ul> <li>**providerMetadata** is set by the server. If provided, it will be overwritten.</li> <li>**datePublished** and **assignerShortname** are optional fields in the schema, but are set by the server. </li> </ul>",
16751675
"required": true,
16761676
"content": {
16771677
"application/json": {
@@ -1772,7 +1772,7 @@
17721772
}
17731773
},
17741774
"requestBody": {
1775-
"description": "<h3>Notes:</h3> <ul> <li>It is recommended to confirm that both the Cve-Id and CVE record are in the REJECTED state after calling this endpoint. Though very unlikely, a race condition can occur causing the two states to be out of sync. </li> <li>**providerMetadata** is set by the server. If provided, it will be overwritten.</li> <li>**datePublished** and **assignerShortname** are optional fields in the schema, but are set by the server. </li> </ul>",
1775+
"description": "<h3>Notes:</h3> <ul> <li>It is recommended to confirm that both the Cve-Id and CVE record are in the REJECTED state after calling this endpoint. Though very unlikely, a race condition can occur causing the two states to be out of sync. </li> <li>**providerMetadata** is set by the server. If provided, it will be overwritten.</li> <li>**datePublished** and **assignerShortname** are optional fields in the schema, but are set by the server. </li> </ul>",
17761776
"required": true,
17771777
"content": {
17781778
"application/json": {
@@ -3130,7 +3130,7 @@
31303130
"content": {
31313131
"application/json": {
31323132
"schema": {
3133-
"$ref": "../schemas/registry-org/get-registry-org-response.json"
3133+
"$ref": "../schemas/registry-org/list-registry-orgs-response.json"
31343134
}
31353135
}
31363136
}
@@ -3201,7 +3201,7 @@
32013201
"content": {
32023202
"application/json": {
32033203
"schema": {
3204-
"$ref": "../schemas/org/create-org-response.json"
3204+
"$ref": "../schemas/registry-org/create-registry-org-response.json"
32053205
}
32063206
}
32073207
}
@@ -3252,7 +3252,7 @@
32523252
"content": {
32533253
"application/json": {
32543254
"schema": {
3255-
"$ref": "#/components/schemas/CreateOrgPayload"
3255+
"$ref": "../schemas/registry-org/create-registry-org-request.json"
32563256
}
32573257
}
32583258
}
@@ -3293,7 +3293,7 @@
32933293
"content": {
32943294
"application/json": {
32953295
"schema": {
3296-
"$ref": "../schemas/org/get-org-response.json"
3296+
"$ref": "../schemas/registry-org/get-registry-org-response.json"
32973297
}
32983298
}
32993299
}
@@ -3376,7 +3376,13 @@
33763376
"content": {
33773377
"application/json": {
33783378
"schema": {
3379-
"$ref": "../schemas/org/delete-org-response.json"
3379+
"type": "object",
3380+
"properties": {
3381+
"message": {
3382+
"type": "string",
3383+
"description": "Message describing successful deletion operation"
3384+
}
3385+
}
33803386
}
33813387
}
33823388
}
@@ -3458,7 +3464,7 @@
34583464
"content": {
34593465
"application/json": {
34603466
"schema": {
3461-
"$ref": "../schemas/org/update-org-response.json"
3467+
"$ref": "../schemas/registry-org/update-registry-org-response.json"
34623468
}
34633469
}
34643470
}
@@ -3519,7 +3525,7 @@
35193525
"content": {
35203526
"application/json": {
35213527
"schema": {
3522-
"$ref": "#/components/schemas/UpdateOrgPayload"
3528+
"$ref": "../schemas/registry-org/update-registry-org-request.json"
35233529
}
35243530
}
35253531
}
@@ -3563,7 +3569,7 @@
35633569
"content": {
35643570
"application/json": {
35653571
"schema": {
3566-
"$ref": "../schemas/user/list-users-response.json"
3572+
"$ref": "../schemas/registry-user/list-registry-users-response.json"
35673573
}
35683574
}
35693575
}
@@ -3655,7 +3661,7 @@
36553661
"content": {
36563662
"application/json": {
36573663
"schema": {
3658-
"$ref": "../schemas/user/create-user-response.json"
3664+
"$ref": "../schemas/registry-user/create-registry-user-response.json"
36593665
}
36603666
}
36613667
}
@@ -3716,7 +3722,7 @@
37163722
"content": {
37173723
"application/json": {
37183724
"schema": {
3719-
"$ref": "../schemas/user/create-user-request.json"
3725+
"$ref": "../schemas/registry-user/create-registry-user-request.json"
37203726
}
37213727
}
37223728
}
@@ -3747,11 +3753,11 @@
37473753
],
37483754
"responses": {
37493755
"200": {
3750-
"description": "A list of all registry organizations, along with pagination fields if results span multiple pages of data",
3756+
"description": "A list of all registry users, along with pagination fields if results span multiple pages of data",
37513757
"content": {
37523758
"application/json": {
37533759
"schema": {
3754-
"$ref": "../schemas/registry-user/get-registry-users-response.json"
3760+
"$ref": "../schemas/registry-user/list-registry-users-response.json"
37553761
}
37563762
}
37573763
}
@@ -3822,7 +3828,7 @@
38223828
"content": {
38233829
"application/json": {
38243830
"schema": {
3825-
"$ref": "../schemas/user/create-user-response.json"
3831+
"$ref": "../schemas/registry-user/create-registry-user-response.json"
38263832
}
38273833
}
38283834
}
@@ -3873,7 +3879,7 @@
38733879
"content": {
38743880
"application/json": {
38753881
"schema": {
3876-
"$ref": "#/components/schemas/CreateUserPayload"
3882+
"$ref": "../schemas/registry-user/create-registry-user-request.json"
38773883
}
38783884
}
38793885
}
@@ -3914,7 +3920,7 @@
39143920
"content": {
39153921
"application/json": {
39163922
"schema": {
3917-
"$ref": "../schemas/user/get-user-response.json"
3923+
"$ref": "../schemas/registry-user/get-registry-user-response.json"
39183924
}
39193925
}
39203926
}
@@ -3997,7 +4003,7 @@
39974003
"content": {
39984004
"application/json": {
39994005
"schema": {
4000-
"$ref": "../schemas/user/update-user-response.json"
4006+
"$ref": "../schemas/registry-user/update-registry-user-response.json"
40014007
}
40024008
}
40034009
}
@@ -4058,7 +4064,7 @@
40584064
"content": {
40594065
"application/json": {
40604066
"schema": {
4061-
"$ref": "#/components/schemas/UpdateUserPayload"
4067+
"$ref": "../schemas/registry-user/update-registry-user-request.json"
40624068
}
40634069
}
40644070
}
@@ -4097,7 +4103,13 @@
40974103
"content": {
40984104
"application/json": {
40994105
"schema": {
4100-
"$ref": "../schemas/user/delete-user-response.json"
4106+
"type": "object",
4107+
"properties": {
4108+
"message": {
4109+
"type": "string",
4110+
"description": "Message describing successful deletion operation"
4111+
}
4112+
}
41014113
}
41024114
}
41034115
}

‎schemas/registry-org/update-registry-org-request.json‎

Lines changed: 117 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,117 @@
1+
{
2+
"$schema": "http://json-schema.org/draft-07/schema#",
3+
"$id": "https://cve.mitre.org/schema/org/organization.json",
4+
"type": "object",
5+
"title": "CVE Update Registry Org Request",
6+
"description": "JSON Schema for updating a CVE Registry organization",
7+
"properties": {
8+
"long_name": {
9+
"type": "string",
10+
"description": "Full name of the organization"
11+
},
12+
"short_name": {
13+
"type": "string",
14+
"description": "Short name or acronym of the organization"
15+
},
16+
"aliases": {
17+
"type": "array",
18+
"items": {
19+
"type": "string"
20+
},
21+
"description": "Alternative names or aliases for the organization"
22+
},
23+
"cve_program_org_function": {
24+
"type": "string",
25+
"enum": ["CNA", "ADP", "Root", "Secretariat"],
26+
"description": "The organization's function within the CVE program"
27+
},
28+
"authority": {
29+
"type": "object",
30+
"properties": {
31+
"active_roles": {
32+
"type": "array",
33+
"items": {
34+
"type": "string",
35+
"enum": ["CNA", "ADP", "Root", "Secretariat"]
36+
}
37+
}
38+
},
39+
"required": ["active_roles"]
40+
},
41+
"reports_to": {
42+
"type": ["string", "null"],
43+
"description": "UUID of the parent organization, if any"
44+
},
45+
"oversees": {
46+
"type": "array",
47+
"items": {
48+
"type": "string"
49+
},
50+
"description": "UUIDs of organizations overseen by this organization"
51+
},
52+
"root_or_tlr": {
53+
"type": "boolean",
54+
"description": "Indicates if the organization is a root or top-level root"
55+
},
56+
"users": {
57+
"type": "array",
58+
"items": {
59+
"type": "string"
60+
},
61+
"description": "UUIDs of users associated with this organization"
62+
},
63+
"charter_or_scope": {
64+
"type": "string",
65+
"description": "Description of the organization's charter or scope"
66+
},
67+
"disclosure_policy": {
68+
"type": "string",
69+
"description": "The organization's disclosure policy"
70+
},
71+
"product_list": {
72+
"type": "string",
73+
"description": "List of products associated with the organization"
74+
},
75+
"contact_info": {
76+
"type": "object",
77+
"properties": {
78+
"additional_contact_users": {
79+
"type": "array",
80+
"items": {
81+
"type": "string"
82+
}
83+
},
84+
"poc": {
85+
"type": "string",
86+
"description": "Point of contact name"
87+
},
88+
"poc_email": {
89+
"type": "string",
90+
"format": "email",
91+
"description": "Point of contact email"
92+
},
93+
"poc_phone": {
94+
"type": "string",
95+
"description": "Point of contact phone number"
96+
},
97+
"admins": {
98+
"type": "array",
99+
"items": {
100+
"type": "string"
101+
},
102+
"description": "UUIDs of admin users"
103+
},
104+
"org_email": {
105+
"type": "string",
106+
"format": "email",
107+
"description": "Organization's email address"
108+
},
109+
"website": {
110+
"type": "string",
111+
"format": "uri",
112+
"description": "Organization's website URL"
113+
}
114+
}
115+
}
116+
}
117+
}

0 commit comments

Comments
 (0)