Add database migrations, remove public org phones, and introduce disabled flag

[jdalphond-mitre]

Resolves issues #1987 and #2000, removing public phone numbers from registry organization contact information and adding a Secretariat-managed organization disabled flag.

Closes Issue #1987
Closes Issue #2000

Summary

Adds migrate-mongo support for safe, versioned database changes and updates local population to reset, seed, and migrate development/test databases. Removes public organization contact_info.phone support and migrates existing current organization and review data. Adds a public disabled flag to registry organizations without using it for authorization.

Important Changes

migrate-mongo-config.js and migrations/

• Adds versioned migration configuration, locking, and changelog tracking.
• Creates missing application collections and indexes without modifying existing documents.
• Removes contact_info.phone from BaseOrg and pending ReviewObject organization data.
• Preserves historical Audit snapshots; phone removals are intentionally irreversible.
• Defaults registry organizations to disabled: true.
• Sets disabled: false when the matching legacy organization has an active authority, using UUID to match records.

src/scripts/populate.js

• Restricts destructive population to local development and test environments.
• Drops the selected local database and resets migration history.
• Populates Org, User, BaseOrg, BaseUser, CVE, CVE-ID, CVE-ID range, and Glossary seed data.
• Runs all migrations in order after seed data is inserted.
• Waits for population and migrations to finish and reports failures.

package.json and package-lock.json

• Adds database migration commands for each environment.
• Updates integration setup to populate and migrate before running tests.
• Prevents integration tests from starting when population or migration fails.
• Adds the migrate-mongo dependency.
• Replaces remaining Artifactory package URLs with public npm registry URLs.

schemas/, src/model/baseorg.js, and API documentation

• Removes public organization phone support from schemas, validation, model definitions, migration output, documentation, fixtures, and Postman requests.
• Retains private_contacts[].phone.
• Adds the public disabled boolean with a default value of true.
• Restricts supplying or changing disabled to Secretariat callers.

src/repositories/baseOrgRepositoryHelpers.js

• Preserves the stored disabled value when omitted from non-Secretariat PUT requests.
• Continues returning 403 whenever a non-Secretariat caller supplies disabled, even when its value is unchanged.

docker/docker-compose.mongo-cluster.yml

• Uses explicit IPv4 loopback addresses for local replica-set members.
• Limits exposed MongoDB ports to the local host.
• Adds the Docker kernel compatibility setting required by affected MongoDB environments.

test/integration-tests/

• Adds migration coverage for organizations with and without legacy authority.
• Covers the default and Secretariat-managed disabled field.
• Verifies that omission preserves disabled.
• Verifies that non-Secretariat callers receive 403 when supplying disabled, including an unchanged value.
• Verifies that public contact_info.phone values are rejected.

Testing

• 1) Run bash -i -c "npm run test:integration".
• 2) On a local development database, run npm run populate:dev -- y.
• 3) Verify seed data is inserted before migrations execute.
• 4) Verify npm run db:migrate:status reports all migrations applied.
• 5) Confirm organizations with active legacy authority have disabled: false.
• 6) Confirm an organization without legacy authority has disabled: true.
• 7) Confirm non-Secretariat PUT requests preserve disabled when omitted and return 403 when it is supplied.
• 8) Confirm registry organization requests reject contact_info.phone.
• 9) Run npm run test:integration:replicas when validating the local replica-set configuration.

Notes

• Local population is destructive and limited to development and test environments.
• Production migration commands do not drop the database.
• Public phone removal does not modify existing Audit snapshots.
• The disabled flag is not currently used for authorization.