Fixed a bug where file makers would be able to view v4 files as well as v5 ones

This commit is contained in:
SepehrYahyaee
2026-07-14 10:19:30 +03:30
parent e5de99adde
commit 6387ebaed0

View File

@@ -4266,6 +4266,7 @@ export class ExpertClaimService {
const blameIds = makerBlames.map((b) => b._id); const blameIds = makerBlames.map((b) => b._id);
const claims = (await this.claimCaseDbService.find({ const claims = (await this.claimCaseDbService.find({
blameRequestId: { $in: blameIds }, blameRequestId: { $in: blameIds },
requiresFileMakerApproval: true,
})) as any[]; })) as any[];
const blameById = new Map<string, any>( const blameById = new Map<string, any>(
@@ -4690,7 +4691,8 @@ export class ExpertClaimService {
const isFactorValidationPending = const isFactorValidationPending =
claimIsAwaitingExpertFactorValidationV2(claim); claimIsAwaitingExpertFactorValidationV2(claim);
// FileMaker: can always view their own V4 files at any status. // FileMaker: can only view V5 files (requiresFileMakerApproval: true) that they created.
// V4 files do not require FileMaker approval and must not appear in their panel.
if (actor.role === RoleEnum.FILE_MAKER) { if (actor.role === RoleEnum.FILE_MAKER) {
const isOwn = claimCaseInitiatedByFieldExpert(claim, actor, linkedBlame); const isOwn = claimCaseInitiatedByFieldExpert(claim, actor, linkedBlame);
if (!isOwn) { if (!isOwn) {
@@ -4698,6 +4700,11 @@ export class ExpertClaimService {
"FileMakers can only view files they created.", "FileMakers can only view files they created.",
); );
} }
if (!(claim as any).requiresFileMakerApproval) {
throw new ForbiddenException(
"This file does not require FileMaker approval.",
);
}
// Fall through to the detail build below // Fall through to the detail build below
} else if ( } else if (
// Field experts and FileReviewers can view IN_PERSON expert-initiated claims // Field experts and FileReviewers can view IN_PERSON expert-initiated claims