Fixed GET APIs for FileMaker and FileReviewer getting their own files

src/request-management/request-management.service.ts

@@ -4151,15 +4151,12 @@ export class RequestManagementService {
    * Verify the current user (field expert) can access this BlameRequest (v2).
    */
   private verifyExpertAccessForBlameV2(req: any, expert: any): void {
-    // FILE_REVIEWER can access any sealed expert-initiated IN_PERSON file
-    // (status WAITING_FOR_FILE_REVIEWER or beyond) scoped to their clientKey.
+    // FILE_REVIEWER can access V4 FileMaker-sealed files.
+    // They must be the assigned reviewer (or the file is still open for taking).
     if (expert?.role === RoleEnum.FILE_REVIEWER) {
-      if (
-        !req?.expertInitiated ||
-        req?.creationMethod !== CreationMethod.IN_PERSON
-      ) {
+      if (!req?.isMadeByFileMaker || !req?.expertInitiated || req?.creationMethod !== CreationMethod.IN_PERSON) {
         throw new ForbiddenException(
-          "FileReviewer can only access expert-initiated IN_PERSON files.",
+          "FileReviewer can only access V4 FileMaker files.",
         );
       }
       if (
@@ -4171,6 +4168,15 @@ export class RequestManagementService {
           "This file has not been sealed by a FileMaker yet.",
         );
       }
+      // Enforce reviewer assignment: must be assigned to them or open (no reviewer yet)
+      const assignedId = req.assignedFileReviewerId
+        ? String(req.assignedFileReviewerId)
+        : null;
+      if (assignedId && assignedId !== String(expert.sub)) {
+        throw new ForbiddenException(
+          "This file has been taken by another FileReviewer.",
+        );
+      }
       return;
     }
     if (req?.expertInitiated && req?.initiatedByFieldExpertId) {
@@ -4441,6 +4447,7 @@ export class RequestManagementService {
       });
     }
 
+    const isFileMakerRole = (expert as any)?.role === RoleEnum.FILE_MAKER;
     const created = await this.blameRequestDbService.create({
       publicId,
       requestNo: publicId,
@@ -4460,6 +4467,7 @@ export class RequestManagementService {
         dto.creationMethod === CreationMethod.IN_PERSON
           ? FilledBy.EXPERT
           : FilledBy.CUSTOMER,
+      ...(isFileMakerRole ? { isMadeByFileMaker: true } : {}),
     });
 
     const requestId = String((created as any)._id);