2.9.0 release

.github/workflows/test-http.yml

@@ -26,7 +26,7 @@ jobs:
     - name: Sleep
       run: bash -c "while ! docker compose --file docker/docker-compose.yml logs --tail=10 cveawg | grep -q 'Serving on port'; do sleep 1; done"
     - name: Load Data into MongoDb
-      run: docker compose -f docker/docker-compose.yml exec -T cveawg npm run populate:dev y; docker compose -f docker/docker-compose.yml exec -T cveawg npm run migrate:test-black-box
+      run: docker compose -f docker/docker-compose.yml exec -T cveawg npm run populate:dev y
     - name: Run Black Box Tests
       run: |
         docker compose --file test-http/docker/docker-compose.yml exec -T demon pytest src/ | tee test-http/src/testOutput.txt

api-docs/openapi.json

@@ -1983,7 +1983,7 @@
           "Organization"
         ],
         "summary": "Creates an organization as specified in the request body (accessible to Secretariat)",
-        "description": "  <h2>Access Control</h2>  <p>User must belong to an organization with the <b>Secretariat</b> role</p>  <h2>Expected Behavior</h2>  <p><b>Secretariat:</b> Creates an organization</p>  ",
+        "description": "  <h2>Access Control</h2>  <p>User must belong to an organization with the <b>Secretariat</b> role</p>  <h2>Expected Behavior</h2>  <p><b>Secretariat:</b> Creates an organization</p>  <p>Organizations whose only role is ROOT have an ID quota of zero, even when a positive quota is supplied.</p>  ",
         "operationId": "orgCreateSingle",
         "parameters": [
           {
@@ -2168,7 +2168,7 @@
           "Organization"
         ],
         "summary": "Updates information about the organization specified by short name (accessible to Secretariat)",
-        "description": "  <h2>Access Control</h2>  <p>User must belong to an organization with the <b>Secretariat</b> role</p>  <h2>Expected Behavior</h2>  <p><b>Secretariat:</b> Updates any organization's information</p>",
+        "description": "  <h2>Access Control</h2>  <p>User must belong to an organization with the <b>Secretariat</b> role</p>  <h2>Expected Behavior</h2>  <p><b>Secretariat:</b> Updates any organization's information</p>  <p>Organizations whose only role is ROOT have an ID quota of zero. A supplied positive quota is normalized to zero, including when changing the organization's role to ROOT.</p>",
         "operationId": "orgUpdateSingle",
         "parameters": [
           {
@@ -2663,7 +2663,7 @@
           "Users"
         ],
         "summary": "Updates information about a user for the specified username and organization shortname (accessible to self, same-organization Admins, or Secretariat)",
-        "description": "  <h2>Access Control</h2>  <p>Authenticated users can update their own name fields. Organization admins can update users in their organization. Secretariat users can update users in any organization.</p>  <h2>Expected Behavior</h2>  <p><b>Regular User:</b> Updates the user's own information. Only name fields may be changed.</p>  <p><b>Admin User:</b> Updates information about a user in the Admin's organization. Allowed to change all fields except org_short_name. </p>  <p><b>Secretariat:</b> Updates information about a user in any organization. Allowed to change all fields.</p>",
+        "description": "  <h2>Access Control</h2>  <p>Authenticated users can update their own name fields. Organization admins can update users in their organization. Secretariat users can update users in any organization.</p>  <h2>Expected Behavior</h2>  <p><b>Regular User:</b> Updates the user's own information. Only name fields may be changed.</p>  <p><b>Admin User:</b> Updates information about a user in the Admin's organization. Allowed to change all fields except org_short_name. </p>  <p><b>Secretariat:</b> Updates information about a user in any organization. Allowed to change all fields.</p>  <p>Deactivation preserves assigned ADMIN membership while preventing authentication. Legacy active_roles continues to show ADMIN while inactive if the assignment remains. Reactivation restores admin access without a separate role grant. Explicit revocation or an organization move removes ADMIN.</p>  <p>Moving a user to another organization removes ADMIN in both the source and destination. ADMIN requested in the move is not granted; promotion requires a separate authorized request after the move.</p>",
         "operationId": "userUpdateSingle",
         "parameters": [
           {
@@ -3077,7 +3077,7 @@
           "Registry Organization"
         ],
         "summary": "Creates an organization (accessible to Secretariat)",
-        "description": "  <h2>Access Control</h2>  <p>User must belong to an organization with the <b>Secretariat</b> role</p>  <h2>Expected Behavior</h2>  <p><b>Secretariat:</b> Creates a new organization</p>",
+        "description": "  <h2>Access Control</h2>  <p>User must belong to an organization with the <b>Secretariat</b> role</p>  <h2>Expected Behavior</h2>  <p><b>Secretariat:</b> Creates a new organization</p>  <p>Organizations whose only role is ROOT are created with an ID quota of zero. The ROOT request schema does not accept an id_quota field.</p>",
         "operationId": "registryOrgCreateSingle",
         "parameters": [
           {
@@ -3759,7 +3759,7 @@
           "Registry User"
         ],
         "summary": "Updates information about a user for the specified username and organization shortname (accessible to self, same-organization Admins, or Secretariat)",
-        "description": "  <h2>Access Control</h2>  <p>Authenticated users can update their own name fields. Organization admins can update users in their organization. Secretariat users can update users in any organization.</p>  <h2>Expected Behavior</h2>  <p><b>Regular User:</b> Updates the user's own information. Only name fields may be changed.</p>  <p><b>Admin User:</b> Updates information about a user in the Admin's organization. Allowed to change all fields except org_short_name. </p>  <p><b>Secretariat:</b> Updates information about a user in any organization. Allowed to change all fields.</p>",
+        "description": "  <h2>Access Control</h2>  <p>Authenticated users can update their own name fields. Organization admins can update users in their organization. Secretariat users can update users in any organization.</p>  <h2>Expected Behavior</h2>  <p><b>Regular User:</b> Updates the user's own information. Only name fields may be changed.</p>  <p><b>Admin User:</b> Updates information about a user in the Admin's organization. Allowed to change all fields except org_short_name. </p>  <p><b>Secretariat:</b> Updates information about a user in any organization. Allowed to change all fields.</p>  <p>Deactivation preserves assigned ADMIN membership while preventing authentication. Reactivation retains that assignment unless ADMIN was explicitly revoked or the user moved organizations. Omitting role from a profile update does not revoke ADMIN.</p>  <p>Moving a user to another organization removes ADMIN in both the source and destination. ADMIN requested in the move is not granted; promotion requires a separate authorized request after the move.</p>",
         "operationId": "registryUserUpdateSingle",
         "parameters": [
           {
@@ -3979,7 +3979,7 @@
           "Registry Organization"
         ],
         "summary": "Updates information about the organization specified by short name (accessible to Secretariat or same-organization Admin)",
-        "description": "  <h2>Access Control</h2>  <p>User must belong to an organization with the <b>Secretariat</b> role or be an <b>Admin</b> of the requested organization.</p>  <p>With Joint Approval required for the following fields:</p>  <h2>Expected Behavior</h2>  <b>This endpoint expects a full organization object in the request body.</b>  <p><b>Secretariat:</b> Updates any organization's information</p>  <p><b>Organization Admin:</b> Requests changes to its organization's information</p>  <ul>  <li>short_name</li>  <li>long_name</li>  <li>authority</li>  <li>aliases</li>  <li>oversees</li>  <li>top_level_root</li>  <li>is_top_level_root</li>  <li>is_last_resort</li>  <li>charter_or_scope</li>  <li>product_list</li>  <li>disclosure_policy</li>  <li>contact_info.websites</li>  <li>contact_info.emails</li>  <li>partner_role_type</li>  <li>partner_country</li>  <li>advisory_locations</li>  <li>advisory_location_require_credentials</li>  <li>vulnerability_advisory_location_for_web_scraping</li>  <li>industry</li>  <li>tl_root_start_date</li>  <li>is_cna_discussion_list</li>  </ul>",
+        "description": "  <h2>Access Control</h2>  <p>User must belong to an organization with the <b>Secretariat</b> role or be an <b>Admin</b> of the requested organization.</p>  <p>With Joint Approval required for the following fields:</p>  <h2>Expected Behavior</h2>  <b>This endpoint expects a full organization object in the request body.</b>  <p><b>Secretariat:</b> Updates any organization's information</p>  <p><b>Organization Admin:</b> Requests changes to its organization's information</p>  <p>Organizations whose only role is ROOT have an ID quota of zero. An approved change to ROOT resets the quota to zero, even when the request omits it.</p>  <ul>  <li>short_name</li>  <li>long_name</li>  <li>authority</li>  <li>aliases</li>  <li>oversees</li>  <li>top_level_root</li>  <li>is_top_level_root</li>  <li>is_last_resort</li>  <li>charter_or_scope</li>  <li>product_list</li>  <li>disclosure_policy</li>  <li>contact_info.websites</li>  <li>contact_info.emails</li>  <li>partner_role_type</li>  <li>partner_country</li>  <li>advisory_locations</li>  <li>advisory_location_require_credentials</li>  <li>vulnerability_advisory_location_for_web_scraping</li>  <li>industry</li>  <li>tl_root_start_date</li>  <li>is_cna_discussion_list</li>  </ul>",
         "operationId": "registryOrgUpdateSingle",
         "parameters": [
           {