Resolves issue #1843, Use field projections in getFilteredCveId.

[ChenyangLi4288]

Closes Issue #1843

Summary

getFilteredCveId previously fetched the entire Org and User collections just to build UUID-to-name lookup maps, which can be slow and memory-heavy on large deployments. This PR adds optional projection parameters to OrgRepository.getAllOrgs and UserRepository.getAllUsers so callers can limit returned fields. getFilteredCveId now fetches only UUID and short_name for orgs, and UUID, username, and org_UUID for users, instead of entire documents.

Important Changes

src/repositories/orgRepository.js

• getAllOrgs now accepts optional options and projection parameters and passes them to collection.find(). Defaults preserve existing behavior.

src/repositories/userRepository.js

• getAllUsers now accepts optional options and projection parameters and passes them to collection.find(). Defaults preserve existing behavior.

src/controller/cve-id.controller/cve-id.controller.js

• getFilteredCveId passes field projections: { UUID: 1, short_name: 1, _id: 0 } for orgs and { UUID: 1, username: 1, org_UUID: 1, _id: 0 } for users.

Testing

Steps to manually test updated functionality, if possible

• 1) Run the unit test suite (npm run action:test); all 337 tests pass, including the getFilteredCveId tests covering query building and UUID-to-name swapping.
• 2) With a populated dev database, call GET /api/cve-id as a CNA user and as the secretariat, and confirm the response (including requested_by org short names and usernames) is unchanged from before this PR.

Notes

• Issue in getFilteredCveId, getAllOrgs and getAllUsers can be too slow #1843 suggested projecting only UUID and username for users, but the map-building code also reads user.org_UUID to group users under their org so org_UUID is included in the projection as well.
• No behavior change for API consumers; this is a query-efficiency improvement only.

[david-rocca]

Hey @ChenyangLi4288, thank you for your contribution. In general, this looks good, however, if you could please do the following:

Add unit coverage that asserts the projections are actually passed:
cveIdGetAllTest.js (line 140) should verify getAllOrgs and getAllUsers are called with the exact projection objects. Right now the tests would pass even if someone removed the projections later.

Thanks!

[david-rocca]

See Comment

[ChenyangLi4288]

Hey @ChenyangLi4288, thank you for your contribution. In general, this looks good, however, if you could please do the following:

Add unit coverage that asserts the projections are actually passed: cveIdGetAllTest.js (line 140) should verify getAllOrgs and getAllUsers are called with the exact projection objects. Right now the tests would pass even if someone removed the projections later.

Thanks!

Thank you for your review! @david-rocca! Added a test to ensure they got called.