Add Secretariat endpoints for ROOT organization reports-to management

[jdalphond-mitre]

Resolves issue #1933, add dedicated Secretariat endpoints for managing ROOT organization reports-to relationships.

Closes Issue #1933

Summary

Adds a supported, auditable way for Secretariat users to assign and remove an organization’s ROOT reports-to relationship.

Important Changes

src/controller/registry.controller/index.js

• Adds Secretariat-only POST endpoints to add and remove oversees relationships.
• Documents both endpoints in OpenAPI.

src/controller/registry.controller/org.registry.controller.js

• Validates that the overseeing organization has ROOT authority.
• Handles relationship creation and removal in a transaction.
• Prevents standard organization PUT requests from updating oversees.

src/repositories/baseOrgRepository.js

• Adds repository methods to assign and remove relationships.
• Removes a reporting organization from any previous ROOT parent during reassignment.
• Creates audit entries for affected ROOT organizations.

src/controller/registry.controller/org.error.js

• Adds an error response for attempts to assign a non-ROOT overseeing organization.

test/integration-tests/registry-org/rootOrgTest.js

• Covers assignment, reassignment, removal, invalid ROOT authority, missing organizations, and authorization.

test/integration-tests/registry-org/registryOrgCRUDTest.js

• Verifies standard PUT requests cannot create oversees or derived reports_to relationships.

Testing

• 1) Run the registry organization integration test suite.
• 2) As a Secretariat user, assign a reporting organization to a ROOT organization and confirm reports_to is returned.
• 3) Reassign that organization to a different ROOT organization and confirm the prior relationship is removed.
• 4) Remove the relationship and confirm reports_to is no longer returned.
• 5) Verify ROOT admins cannot manage relationships or modify oversees through the standard PUT endpoint.

Notes

Relationship management is intentionally restricted to the dedicated Secretariat endpoints; standard organization updates ignore the oversees field.

[87quebad-lang]

Resolves issue #1933, add dedicated Secretariat endpoints for managing ROOT organization reports-to relationships.

Closes Issue #1933

Summary

Adds a supported, auditable way for Secretariat users to assign and remove an organization’s ROOT reports-to relationship.

Important Changes

src/controller/registry.controller/index.js

• Adds Secretariat-only POST endpoints to add and remove oversees relationships.

• Documents both endpoints in OpenAPI.

src/controller/registry.controller/org.registry.controller.js

• Validates that the overseeing organization has ROOT authority.

• Handles relationship creation and removal in a transaction.

• Prevents standard organization PUT requests from updating oversees.

src/repositories/baseOrgRepository.js

• Adds repository methods to assign and remove relationships.

• Removes a reporting organization from any previous ROOT parent during reassignment.

• Creates audit entries for affected ROOT organizations.

src/controller/registry.controller/org.error.js

• Adds an error response for attempts to assign a non-ROOT overseeing organization.

test/integration-tests/registry-org/rootOrgTest.js

• Covers assignment, reassignment, removal, invalid ROOT authority, missing organizations, and authorization.

test/integration-tests/registry-org/registryOrgCRUDTest.js

• Verifies standard PUT requests cannot create oversees or derived reports_to relationships.

Testing

• 1) Run the registry organization integration test suite.

• 2) As a Secretariat user, assign a reporting organization to a ROOT organization and confirm reports_to is returned.

• 3) Reassign that organization to a different ROOT organization and confirm the prior relationship is removed.

• 4) Remove the relationship and confirm reports_to is no longer returned.

• 5) Verify ROOT admins cannot manage relationships or modify oversees through the standard PUT endpoint.

Notes

Relationship management is intentionally restricted to the dedicated Secretariat endpoints; standard organization updates ignore the oversees field.