YARA-1209, YARA-1214

src/request-management/file-maker-claim-approval-v5.controller.ts

@@ -104,7 +104,7 @@ export class FileMakerClaimApprovalV5Controller {
       example: {
         errorCode: "FILE_MAKER_REJECTION_LIMIT_EXCEEDED",
         message:
-          "This claim has already been rejected twice. You must approve it now — no further rejections are allowed.",
+          "این پرونده قبلاً دو بار رد شده است. امکان رد مجدد وجود ندارد — باید پرونده را تأیید کنید.",
       },
     },
   })

src/request-management/request-management.service.ts

@@ -10608,7 +10608,7 @@ export class RequestManagementService {
     if (currentRejections >= 2) {
       throw new BusinessRuleException(
         BusinessErrorCode.FILE_MAKER_REJECTION_LIMIT_EXCEEDED,
-        "This claim has already been rejected twice. You must approve it now — no further rejections are allowed.",
+        "این پرونده قبلاً دو بار رد شده است. امکان رد مجدد وجود ندارد — باید پرونده را تأیید کنید.",
       );
     }
 
@@ -10811,6 +10811,25 @@ export class RequestManagementService {
     const firstParty = req.parties[firstIdx];
 
     await this.runPartyInquiriesV3Internal(req, dto, PartyRole.FIRST, firstParty);
+
+    // V6 call-center guard: the guilty party's insurance must belong to THIS
+    // deployment's insurer company.  Reject the file early so the agent cannot
+    // initiate a blame flow for a third-party insurance holder.
+    const resolvedClientId = req.parties[firstIdx]?.person?.clientId;
+    if (resolvedClientId && process.env.CLIENT_ID) {
+      const resolvedClient = await this.clientService.findOne({
+        _id: new Types.ObjectId(String(resolvedClientId)),
+      });
+      if (
+        resolvedClient &&
+        String(resolvedClient.clientCode) !== String(process.env.CLIENT_ID)
+      ) {
+        throw new ForbiddenException(
+          "بیمه‌نامه طرف مقصر متعلق به شرکت بیمه این سامانه نیست. لینک تقصیر فقط برای بیمه‌گذاران همین شرکت قابل ارسال است.",
+        );
+      }
+    }
+
     // Do NOT call markPartyInquiriesCompleteOnBlame here: that helper is for V3/V4/V5
     // FileMaker flows and would advance the workflow to FIRST_LOCATION prematurely.
     // In V6 the workflow must stay at CREATED until send-link advances it to FIRST_VIDEO.
@@ -10891,6 +10910,29 @@ export class RequestManagementService {
 
     const firstIdx = this.getPartyIndex(req, PartyRole.FIRST);
     if (firstIdx === -1) throw new BadRequestException("First party not found on request");
+
+    // Safeguard: verify that run-inquiry was completed and that the resolved
+    // insurance company belongs to this deployment before proceeding.
+    const storedClientId = req.parties[firstIdx]?.person?.clientId;
+    if (!storedClientId) {
+      throw new BadRequestException(
+        "استعلام بیمه طرف مقصر انجام نشده است. ابتدا run-inquiry را فراخوانی کنید.",
+      );
+    }
+    if (process.env.CLIENT_ID) {
+      const storedClient = await this.clientService.findOne({
+        _id: new Types.ObjectId(String(storedClientId)),
+      });
+      if (
+        storedClient &&
+        String(storedClient.clientCode) !== String(process.env.CLIENT_ID)
+      ) {
+        throw new ForbiddenException(
+          "بیمه‌نامه طرف مقصر متعلق به شرکت بیمه این سامانه نیست. لینک تقصیر فقط برای بیمه‌گذاران همین شرکت قابل ارسال است.",
+        );
+      }
+    }
+
     const userId = await this.getOrCreateUserByPhoneNumber(phone);
     if (!req.parties[firstIdx].person) req.parties[firstIdx].person = {} as any;
     req.parties[firstIdx].person.phoneNumber = normalizeIranMobile(phone) ?? phone;