Make registry endpoints a first-class route module and retire hidden `/registryOrg` and `/registryUser` routers

[david-rocca]

Problem

The active registry API is split across legacy route files in a way that makes current code look stale and keeps old hidden endpoints live.

The intended public API shape is /api/registry/..., but the app still mounts the older camelCase routers:

• /api/registryOrg
• /api/registryUser

Those routes are hidden from Swagger with #swagger.ignore = true, but they are still registered and covered by tests. At the same time, the newer /api/registry/... endpoints still import and call controller modules under registry-org.controller and registry-user.controller, which makes it hard to tell what is current implementation versus legacy compatibility code.

This should be cleaned up after the separate ?registry=true removal work.

Current Behavior

src/routes.config.js still mounts the old registry routers:

app.use('/api/', RegistryUserController)
app.use('/api/', RegistryOrgController)

The old routers expose hidden endpoints:

• src/controller/registry-org.controller/index.js

  • GET /registryOrg
  • GET /registryOrg/:identifier
  • POST /registryOrg
  • PUT /registryOrg/:shortname
  • DELETE /registryOrg/:identifier
  • GET /registryOrg/:shortname/users
  • POST /registryOrg/:shortname/user

• src/controller/registry-user.controller/index.js

  • GET /registryUser
  • GET /registryUser/:identifier
  • POST /registryUser/:shortname
  • PUT /registryUser/:identifier
  • DELETE /registryUser/:identifier

The newer /api/registry/... routes are defined in non-registry route modules:

• src/controller/org.controller/index.js
• src/controller/user.controller/index.js

Those newer routes still call registry controller implementations:

• src/controller/registry-org.controller/registry-org.controller.js
• src/controller/registry-user.controller/registry-user.controller.js

This means the controller logic is still active and necessary, but the route/module structure makes it look like legacy code.

Expected Behavior

Registry API routing should be organized as a first-class registry namespace.

The public route shape should be clear:

• /api/registry/org
• /api/registry/org/:shortname
• /api/registry/org/:shortname/users
• /api/registry/org/:shortname/user/:username
• /api/registry/users

The old hidden camelCase endpoints should either be removed or explicitly migrated.

The registry controller implementation should remain separate from legacy org/user controllers, but should be named and mounted in a way that reflects that it powers the current /api/registry/... API.

Proposed Solution

Create a dedicated registry route module, for example:

• src/controller/registry.controller/index.js

or split by resource:

• src/controller/registry.controller/org.routes.js
• src/controller/registry.controller/user.routes.js

Move the active /api/registry/... route definitions out of:

• src/controller/org.controller/index.js
• src/controller/user.controller/index.js

Mount the registry routes directly in src/routes.config.js, for example:

app.use('/api/registry', RegistryController)

Then internal route paths can be defined as:

• /org
• /org/:shortname
• /org/:shortname/users
• /org/:shortname/user/:username
• /users

After the new route module is in place, remove the old router mounts:

• RegistryUserController
• RegistryOrgController

Then delete or retire the old route files if no longer needed:

• src/controller/registry-org.controller/index.js
• src/controller/registry-user.controller/index.js

Delete Endpoint Decision Needed

The old hidden routers currently expose delete behavior that does not appear to have a /api/registry/... equivalent:

• DELETE /api/registryOrg/:identifier
• DELETE /api/registryUser/:identifier

Before removing the old routers, decide whether delete behavior should be migrated or retired.

Potential replacements, if deletes are still supported:

• DELETE /api/registry/org/:shortname
• DELETE /api/registry/org/:shortname/user/:username

If deletes are retired, remove the old delete route handlers, controller exports, and tests.

Test Cleanup Scope

Update tests that still call the old hidden endpoints.

Known test files with /api/registryOrg or /api/registryUser references include:

• test/integration-tests/registry-user/registryUserCRUDTest.js
• test/integration-tests/registry-org/registryOrgCRUDTest.js
• test/integration-tests/registry-org/createUserByOrgTest.js
• test/integration-tests/registry-org/verifyDeepRemoveEmpty.js
• test/integration-tests/registry-org/registryOrgWithJointReviewTest.js
• test/integration-tests/registry-org/registryOrgDiscriminatorAuthorityTest.js
• test/integration-tests/review-object/reviewObjectTest.js

Org integration tests should use /api/registry/org, not /api/registryOrg.

Acceptance Criteria

• Active registry routes are defined under a dedicated registry route module.
• /api/registry/... endpoints continue to work with the same documented behavior.
• src/controller/org.controller/index.js no longer owns registry route definitions.
• src/controller/user.controller/index.js no longer owns registry route definitions, except for any intentionally non-registry user endpoints.
• src/routes.config.js no longer mounts hidden /api/registryOrg or /api/registryUser routers.
• The old camelCase registry endpoints are either removed or explicitly replaced by supported /api/registry/... routes.
• Delete behavior is explicitly decided and tested.
• Integration tests no longer depend on /api/registryOrg or /api/registryUser.
• Swagger/OpenAPI remains aligned with the supported public route surface.