From fa99a3bd719643127c6d1051e3cc5f33da71c459 Mon Sep 17 00:00:00 2001
From: Chenyang Li <cl4288@cumc.columbia.edu>
Date: Mon, 13 Jul 2026 14:38:35 -0400
Subject: [PATCH] #1924 Use direct role lookups instead of broad role scans

isSecretariat, isSecretariatUUID, and isBulkDownload previously fetched
every org holding the role and compared UUIDs in a loop. Each check is
now a single findOne with the role in the query predicate.
---
 src/utils/utils.js | 65 ++++++++++++++++------------------------------
 1 file changed, 23 insertions(+), 42 deletions(-)

diff --git a/src/utils/utils.js b/src/utils/utils.js
index c1c66cc71..f03803911 100644
--- a/src/utils/utils.js
+++ b/src/utils/utils.js
@@ -57,61 +57,42 @@ function getUserFullName (user) {
 }
 
 async function isSecretariat (shortName, useRegistry = false, options = {}) {
-  let result = false
-  let orgUUID = null
-  let secretariats = []
-
   const CONSTANTS = getConstants()
-  if (useRegistry) {
-    orgUUID = await getOrgUUID(shortName, useRegistry, options) // may be null if org does not exists
-    secretariats = await BaseOrg.find({ authority: { $in: [CONSTANTS.AUTH_ROLE_ENUM.SECRETARIAT] } })
-  } else {
-    orgUUID = await getOrgUUID(shortName, false, options) // may be null if org does not exists
-    secretariats = await Org.find({ 'authority.active_roles': { $in: [CONSTANTS.AUTH_ROLE_ENUM.SECRETARIAT] } })
+  const ModelToQuery = useRegistry ? BaseOrg : Org
+  const roleField = useRegistry ? 'authority' : 'authority.active_roles'
+  const query = {
+    short_name: shortName,
+    [roleField]: CONSTANTS.AUTH_ROLE_ENUM.SECRETARIAT
   }
 
-  if (orgUUID) {
-    secretariats.forEach((obj) => {
-      if (obj.UUID === orgUUID) {
-        result = true // org is secretariat
-      }
-    })
-  }
+  const executionOptions = { ...options }
+  if (executionOptions.lean === undefined) executionOptions.lean = true
 
-  return result
+  const org = await ModelToQuery.findOne(query, 'UUID', executionOptions)
+  return !!org // org is secretariat only if a match was found
 }
 
 async function isSecretariatUUID (orgUUID) {
-  let result = false
+  if (!orgUUID) return false
   const CONSTANTS = getConstants()
-  const secretariats = await BaseOrg.find({ authority: { $in: [CONSTANTS.AUTH_ROLE_ENUM.SECRETARIAT] } })
-
-  if (orgUUID) {
-    secretariats.forEach((obj) => {
-      if (obj.UUID === orgUUID) {
-        result = true // org is secretariat
-      }
-    })
-  }
-
-  return result // org is not secretariat
+  const org = await BaseOrg.findOne(
+    { UUID: orgUUID, authority: CONSTANTS.AUTH_ROLE_ENUM.SECRETARIAT },
+    'UUID',
+    { lean: true }
+  )
+  return !!org // org is secretariat only if a match was found
 }
 
 async function isBulkDownload (shortName) {
-  let result = false
   const CONSTANTS = getConstants()
   const orgUUID = await getOrgUUID(shortName) // may be null if org does not exists
-  const bulkDownloadOrgs = await BaseOrg.find({ authority: { $in: [CONSTANTS.AUTH_ROLE_ENUM.BULK_DOWNLOAD] } })
-
-  if (orgUUID) {
-    bulkDownloadOrgs.forEach((obj) => {
-      if (obj.UUID === orgUUID) {
-        result = true // org has the bulk download role
-      }
-    })
-  }
-
-  return result // org does not have bulk download as a role
+  if (!orgUUID) return false
+  const org = await BaseOrg.findOne(
+    { UUID: orgUUID, authority: CONSTANTS.AUTH_ROLE_ENUM.BULK_DOWNLOAD },
+    'UUID',
+    { lean: true }
+  )
+  return !!org // org has bulk download as a role only if a match was found
 }
 
 async function isAdmin (requesterUsername, requesterShortName, isRegistry = false, options = {}) {