[afoote-mitre]

Summary

Adds scope-aware search across base CVE data, CNA containers, and ADP containers, then exposes structured SSVC, KEV, reference URL, and disputed-tag filters through POST /search.

The response contract remains unchanged: scope controls where filters match, while successful searches continue returning complete CVE records.

Changes

Area	Changes	Primary files
Search scope	Added the case-insensitive FULL, CNA_ONLY, and ADP_ONLY scope enum. FULL is the default. Existing keyword, CWE, CVSS, rejection-state, identifier, date, and CPE filters now resolve fields according to the selected scope. CNA-only CPE applicability filters return HTTP 400 with ADP_ONLY.	utils/searchScope.js, utils/constants.js, controllers/middleware.js, routes/index.js, utils/searchQueryBuilder.js
SSVC filters	Added ssvcExploitation, ssvcAutomatable, ssvcTechnicalImpact, ssvcRole, ssvcTimestampStartDate, and ssvcTimestampEndDate. Multiple SSVC conditions must match the same structured metric entry, with case-insensitive enums/role and inclusive timestamps.	utils/ssvc.js, utils/searchContainerMetrics.js, utils/searchPostFilters.js, utils/searchQueryBuilder.js, controllers/searchController.js
KEV filters	Added strict knownExploited boolean filtering plus inclusive kevDateAddedStartDate and kevDateAddedEndDate boundaries. Date-only stored values are interpreted as midnight UTC, and date filters require knownExploited: true.	utils/kev.js, utils/searchPostFilters.js, utils/searchQueryBuilder.js, controllers/middleware.js, routes/index.js
Reference URL filter	Added one-string referenceURL matching across scope-selected container references. Matching is a case-insensitive literal substring; user wildcard metacharacters are escaped before query construction.	utils/searchScope.js, utils/searchQueryBuilder.js, controllers/middleware.js, routes/index.js
Disputed filter	Added a strict disputed boolean. true requires the exact tag in at least one selected container; false excludes records with that tag in any selected container. No general-purpose record-tag filter is introduced.	utils/searchScope.js, utils/searchQueryBuilder.js, controllers/middleware.js, routes/index.js
API contract and guidance	Updated generated OpenAPI schemas, complete request examples, parameter descriptions, validation limits, and README guidance. Added an explicit scope-to-data matrix, documented CVSS v2 score-band and vector-token semantics, and clarified that Docker packages the committed OpenAPI document while npm development/manual commands regenerate it.	routes/swagger.js, api-docs/openapi.json, README.md
Test coverage	Added unit, middleware, route, controller, query-builder, OpenAPI, and integration coverage for scope resolution, strict request contracts, same-entry semantic filtering, direct-query behavior, escaping, and positive/negative filters.	utils/*.test.js, controllers/*.test.js, routes/*.test.js, api-docs/openapi.test.js, server.test.js