Skip to content

Resolves issue 1934, Reduce Mongoose hydration for read-only queries - #1974

Open
Ewgna wants to merge 5 commits into
CVEProject:devfrom
Ewgna:issue-1934-lean-queries
Open

Resolves issue 1934, Reduce Mongoose hydration for read-only queries#1974
Ewgna wants to merge 5 commits into
CVEProject:devfrom
Ewgna:issue-1934-lean-queries

Conversation

@Ewgna

@Ewgna Ewgna commented Aug 26, 2026

Copy link
Copy Markdown
Collaborator

Closes Issue #1934

Summary

Adds .lean() to high confidence read-only Mongoose queries to reduce hydration CPU/memory overhead,Write paths that mutate documents or call Mongoose document methods unchanged(remain hydrated)

Important Changes

src/repositories/baseRepository.js

  • Updated find() so lean and limit can be applied together.
  • Preserved the existing count-query behavior.

Repository query paths:

  • Added lean CVE and CVE-ID lookups
  • Added lean projected queries for CVE-ID organization and user maps
  • Added lean reads for conversations, review objects, audits, and glossary data
  • Added lean projected reads for organization/user expansion, membership, role, collision, and existence checks
  • Kept shared organization and user lookup methods hydrated for default
  • Enabled opt-in lean organization lookups for the registry and legacy organization detail response paths
  • Preserved conversation visibility filtering and Secretariat author redaction

Registry and legacy organization responses:

  • Lean queries because of no hydration do not provide empty-arr [] defaults, so restored said arrays
  • Added separate registry and legacy normalization paths
  • Preserved legacy authority.active_roles objects without replacement
  • Did not include registry-only fields into legacy responses

Testing

Focused repository and upstream contract coverage:

  • Verified BaseRepository.find() combines limit and lean
  • Verified converted queries execute as lean queries
  • Verified write-oriented shared lookups remain hydrated by default
  • Verified non-sequential CVE-ID reservation through the endpoint
  • Verified authenticated organization CVE-ID filtering
  • Verified conversation visibility and author UUID redaction
  • Verified registry and legacy sparse organization endpoint responses
  • Verified review object, audit, glossary, CVE, CVE-ID, user, and organization query behavior

Example cmd:

docker compose exec cveawg npx mocha test/unit-tests/repository/baseRepositoryLeanTest.js test/unit-tests/repository/leanRepositoryQueriesTest.js test/unit-tests/conversation/conversationRepositoryTest.js test/unit-tests/cve-id/cveIdGetAllTest.js test/unit-tests/org/baseOrgRepositoryTest.js --exit

@Ewgna
Ewgna force-pushed the issue-1934-lean-queries branch from 200f69f to a7b46c6 Compare August 26, 2026 15:43
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant