enforced matching client id for moving on with the case

src/sand-hub/sand-hub.service.ts

@@ -2,6 +2,7 @@ import { HttpService } from "@nestjs/axios";
 import {
   BadGatewayException,
   BadRequestException,
+  ForbiddenException,
   GatewayTimeoutException,
   Injectable,
   Logger,
@@ -89,6 +90,60 @@ export class SandHubService {
     return resolveFanavaranClientKey() === "parsian";
   }
 
+  /**
+   * A case may proceed only when the policy belongs to the insurer served by
+   * this deployment. Callers opt in for the guilty/first-party policy only.
+   */
+  assertInsuranceMatchesDeployment(
+    mapped: Record<string, unknown> | null | undefined,
+    insuranceLine: "THIRD_PARTY" | "CAR_BODY",
+  ): void {
+    const expectedClientCode = String(process.env.CLIENT_ID ?? "").trim();
+    if (!expectedClientCode) {
+      throw new ServiceUnavailableException(
+        "CLIENT_ID must be configured before insurance eligibility can be checked.",
+      );
+    }
+
+    const actualClientCode = String(
+      mapped?.CompanyCode ?? mapped?.companyId ?? mapped?.CompanyId ?? "",
+    ).trim();
+    if (actualClientCode === expectedClientCode) return;
+
+    throw new ForbiddenException(
+      `${insuranceLine} policy insurer does not match this deployment.`,
+    );
+  }
+
+  private enforceDeploymentClientMatch(
+    mapped: Record<string, unknown>,
+    insuranceLine: "THIRD_PARTY" | "CAR_BODY",
+    options?: SandHubInquiryOptions,
+  ): void {
+    if (options?.enforceDeploymentClientMatch) {
+      this.assertInsuranceMatchesDeployment(mapped, insuranceLine);
+    }
+  }
+
+  /**
+   * The processed Fanavaran CAR_BODY endpoint is a Parsian-only source and its
+   * response does not contain a reliable insurer company code. Treat the source
+   * itself as proof that the returned policy is Parsian.
+   */
+  private assertParsianCarBodyLookupMatchesDeployment(): void {
+    const expectedClientCode = String(process.env.CLIENT_ID ?? "").trim();
+    if (!expectedClientCode) {
+      throw new ServiceUnavailableException(
+        "CLIENT_ID must be configured before insurance eligibility can be checked.",
+      );
+    }
+    if (expectedClientCode === "8") return;
+
+    throw new ForbiddenException(
+      "CAR_BODY policy insurer does not match this deployment.",
+    );
+  }
+
   /** Fixed plate/insurance inquiry payload used everywhere we mock block-inquiry style APIs. */
   private buildMockPlateInquiryRaw(
     ctx: MockInquiryCompanyContext,
@@ -779,6 +834,11 @@ export class SandHubService {
         ir: String(userDetail.plate.ir),
       });
       if (offlineHit) {
+        this.enforceDeploymentClientMatch(
+          offlineHit.mapped,
+          "THIRD_PARTY",
+          options,
+        );
         return {
           raw: offlineHit.raw,
           mapped: offlineHit.mapped,
@@ -818,6 +878,7 @@ export class SandHubService {
         );
       }
       const mapped = this.mapEsgPolicyByPlateToOldFormat(raw);
+      this.enforceDeploymentClientMatch(mapped, "THIRD_PARTY", options);
       return { raw, mapped };
     }
 
@@ -846,6 +907,7 @@ export class SandHubService {
       );
     }
     const mapped = this.mapNewApiResponseToOldFormat(raw);
+    this.enforceDeploymentClientMatch(mapped, "THIRD_PARTY", options);
     return { raw, mapped };
   }
 
@@ -874,6 +936,7 @@ export class SandHubService {
         userDetail as SandHubDetailDto,
         options,
       );
+      this.assertInsuranceMatchesDeployment(result.mapped, "CAR_BODY");
       return {
         source:
           typeof userDetail.plate === "string"
@@ -890,6 +953,7 @@ export class SandHubService {
         userDetail as SandHubDetailDto,
         options,
       );
+      this.assertParsianCarBodyLookupMatchesDeployment();
       return {
         source:
           typeof userDetail.plate === "string"
@@ -917,6 +981,7 @@ export class SandHubService {
       "car-body",
       query,
     );
+    this.assertParsianCarBodyLookupMatchesDeployment();
 
     return {
       source:
@@ -1057,6 +1122,7 @@ export class SandHubService {
         `[MOCK] getPolicyByChassisInquiry chassisNo=${chassisNo}`,
       );
       const mapped = this.mapEsgPolicyByPlateToOldFormat(raw);
+      this.enforceDeploymentClientMatch(mapped, "THIRD_PARTY", options);
       return { raw, mapped };
     }
 
@@ -1067,6 +1133,7 @@ export class SandHubService {
       options,
     );
     const mapped = this.mapEsgPolicyByPlateToOldFormat(raw);
+    this.enforceDeploymentClientMatch(mapped, "THIRD_PARTY", options);
     return { raw, mapped };
   }
 
@@ -1297,6 +1364,7 @@ export class SandHubService {
       }
 
       const result = this.mapNewApiResponseToOldFormat(response);
+      this.enforceDeploymentClientMatch(result, "THIRD_PARTY", options);
 
       // if (result.usgCod !== "8") {
       //   throw new Error("خودرو شما شخصی / سواری نمی باشد")
@@ -1304,6 +1372,12 @@ export class SandHubService {
 
       return result;
     } catch (err) {
+      if (
+        err instanceof ForbiddenException ||
+        err instanceof ServiceUnavailableException
+      ) {
+        throw err;
+      }
       throw new Error(err);
     }
   }