Merging /webSearch error fix to Test

api-docs/openapi.json

@@ -1,7 +1,7 @@
 {
   "openapi": "3.0.2",
   "info": {
-    "version": "0.5.0-beta",
+    "version": "1.0.0-beta",
     "title": "CVE Search API",
     "description": "CVE Search API to retrieve all matching CVE records after applying request inputs as filters.",
     "contact": {

controllers/searchController.js

@@ -77,18 +77,20 @@ function getWebSearchSuccessData(searchResponse) {
 
     const hits = searchResponse?.data?.hits;
     const totalValue = hits?.total?.value;
+    const notes = searchResponse.notes === undefined ? [] : searchResponse.notes;
+    const responseErrors = searchResponse.errors === undefined ? [] : searchResponse.errors;
     const hasValidMetadata =
-        typeof searchResponse.status === 'string' &&
-        Array.isArray(searchResponse.notes) &&
-        Array.isArray(searchResponse.errors);
+        typeof searchResponse.status === 'string' && Array.isArray(notes) && Array.isArray(responseErrors);
 
     if (!hasValidMetadata || !Array.isArray(hits?.hits) || !Number.isSafeInteger(totalValue) || totalValue < 0) {
         return null;
     }
 
     return {
         hits: hits.hits,
-        totalValue
+        totalValue,
+        notes,
+        errors: responseErrors
     };
 }
 
@@ -286,8 +288,8 @@ async function webSearchHandler(req, res, next) {
         if (successData) {
             status = 200;
             body.searchMetadata.searchStatus = searchResponse.status;
-            body.searchMetadata.notes = searchResponse.notes;
-            body.searchMetadata.errors = searchResponse.errors;
+            body.searchMetadata.notes = successData.notes;
+            body.searchMetadata.errors = successData.errors;
             body.resultsTotal = successData.totalValue;
             body.data = successData.hits;
         } else {

controllers/searchController.test.js

@@ -57,7 +57,7 @@ function rawResponse(totalValue, hits = []) {
     return advancedResponse(totalValue, hits).data;
 }
 
-function basicResponse({ ok = true, status = 'ok', total = 0, hits = [], notes = [], errors = [] } = {}) {
+function basicResponse({ ok = true, status = 'ok', total = 0, hits = [], notes, errors } = {}) {
     return {
         status,
         notes,
@@ -1459,8 +1459,6 @@ describe('Search controller WEB_SEARCH handler', () => {
     test('WEB_SEARCH fails closed when cve-core reports success without a complete hits response', async () => {
         mockBasicSearch.mockResolvedValue({
             status: 'ok',
-            notes: [],
-            errors: [],
             data: {},
             isOk: jest.fn(() => true)
         });
@@ -1496,6 +1494,34 @@ describe('Search controller WEB_SEARCH handler', () => {
         });
     });
 
+    test.each([
+        ['notes', 'invalid notes'],
+        ['errors', { message: 'invalid errors' }]
+    ])('WEB_SEARCH fails closed when successful cve-core metadata has invalid %s', async (field, value) => {
+        mockBasicSearch.mockResolvedValue({
+            ...basicResponse(),
+            [field]: value
+        });
+
+        await controller.WEB_SEARCH(
+            {
+                body: {
+                    query: 'apache'
+                }
+            },
+            res,
+            next
+        );
+
+        expect(res.status).toHaveBeenCalledWith(502);
+        expect(res.json.mock.calls[0][0].searchMetadata.errors).toStrictEqual([
+            {
+                error: 'UPSTREAM_SEARCH_ERROR',
+                message: 'Search backend returned an error. Please try again later.'
+            }
+        ]);
+    });
+
     test('WEB_SEARCH returns a sanitized error when BasicSearchManager throws', async () => {
         mockBasicSearch.mockRejectedValue(new Error('boom'));
 

package.json

@@ -1,6 +1,6 @@
 {
     "name": "cve-search-api",
-    "version": "0.5.0-beta",
+    "version": "1.0.0-beta",
     "scripts": {
         "dev": "node routes/swagger.js && nodemon server.js",
         "coverage": "jest --coverage",

routes/search.integration.test.js

@@ -30,8 +30,6 @@ function advancedResponse(totalValue, hits = []) {
 function basicResponse({ total = 0, hits = [] } = {}) {
     return {
         status: 'ok',
-        notes: [],
-        errors: [],
         data: {
             hits: {
                 total: {
@@ -290,6 +288,8 @@ describe('search route integration', () => {
             from: 5,
             size: 10
         });
+        expect(response.body.searchMetadata.notes).toStrictEqual([]);
+        expect(response.body.searchMetadata.errors).toStrictEqual([]);
         expect(response.body.resultsTotal).toBe(1);
         expect(response.body.data).toStrictEqual([{ _id: 'CVE-2024-0002' }]);
     });