incorrect merge with retrieved BaseOrg document

[ElectricNroff]

cve-services/src/repositories/baseOrgRepository.js

Line 774 in 1df06cb

updatedRegistryOrg = _.mergeWith(registryOrg, registryObjectRaw, skipNulls)

The required behavior is that optional fields (i.e., ones not marked as required by files such as BaseOrg.json in the src/middleware/schemas directory) remain optional even if they were previously found in a stored document, such as the stored document retrieved here:

cve-services/src/repositories/baseOrgRepository.js

Line 729 in 1df06cb

const registryOrg = await this.findOneByShortName(shortName, options)

For example, there are realistic cases where an organization first identifies with a specific country, but then insists that it is no longer associated with a country because it wants to present itself (both within the CVE Program and elsewhere) as a "global company." There should not be a merge that ends up with the obsolete cna_country value solely because no other merge source has a property assignment for cna_country.

[david-rocca]

Developer Notes

Description

The root cause of this bug lies in the use of lodash's mergeWith method (_.mergeWith(registryOrg, registryObjectRaw, skipNulls)) inside the repository's update logic to apply the incoming PUT request payload.

By default, the lodash.merge algorithm performs a deep merge of properties from the source object (registryObjectRaw) into the destination object (registryOrg). Crucially, if a property is completely absent from the source object, _.merge does not delete or clear that property from the destination object; it simply leaves the existing value untouched as if the incoming payload had intended to perform a partial update (PATCH).

Because of this behavior, a PUT request (which semantically means full document replacement) is structurally incapable of clearing out optional metadata fields (like cna_country, industry, or disclosure_policy) simply by omitting them from the JSON payload. The old cached values survive the deep merge process because the merge operation interprets the absence of a field as "no change" rather than "delete this field".

Action

To achieve correct PUT semantics where omitted fields are automatically unset from the database document, the system must forcefully clear fields on the stored document if they are not present in the incoming payload before the deep merge occurs (while protecting internal fields).

Proposed Code Change: Before applying the _.mergeWith locally onto registryOrg, iterate through the properties of the incoming payload and compare them with the existing document to explicitly delete omitted optional fields. (or something similar)

[david-rocca]

Something like:

// Step 1: Define system/internal fields that should never be automatically deleted
const protectedOrgFields = ['_id', '__v', '__t', 'UUID', 'short_name', 'authority', 'created', 'last_updated'];

// Step 2: Iterate through the existing org's keys
const currentKeys = Object.keys(registryOrg.toObject());
for (const key of currentKeys) {
  if (protectedOrgFields.includes(key)) continue;

  // Step 3: If an optional field is in the DB but missing from the PUT request, manually unset it
  if (!(key in registryObjectRaw)) {
    registryOrg[key] = undefined;
  }
}

// Step 4: Proceed with the rest of the existing merge logic
updatedRegistryOrg = _.mergeWith(registryOrg, registryObjectRaw, skipNulls);