forked from Yara724/api
Fixed a bug where file makers would be able to view v4 files as well as v5 ones
This commit is contained in:
@@ -4266,6 +4266,7 @@ export class ExpertClaimService {
|
|||||||
const blameIds = makerBlames.map((b) => b._id);
|
const blameIds = makerBlames.map((b) => b._id);
|
||||||
const claims = (await this.claimCaseDbService.find({
|
const claims = (await this.claimCaseDbService.find({
|
||||||
blameRequestId: { $in: blameIds },
|
blameRequestId: { $in: blameIds },
|
||||||
|
requiresFileMakerApproval: true,
|
||||||
})) as any[];
|
})) as any[];
|
||||||
|
|
||||||
const blameById = new Map<string, any>(
|
const blameById = new Map<string, any>(
|
||||||
@@ -4690,7 +4691,8 @@ export class ExpertClaimService {
|
|||||||
const isFactorValidationPending =
|
const isFactorValidationPending =
|
||||||
claimIsAwaitingExpertFactorValidationV2(claim);
|
claimIsAwaitingExpertFactorValidationV2(claim);
|
||||||
|
|
||||||
// FileMaker: can always view their own V4 files at any status.
|
// FileMaker: can only view V5 files (requiresFileMakerApproval: true) that they created.
|
||||||
|
// V4 files do not require FileMaker approval and must not appear in their panel.
|
||||||
if (actor.role === RoleEnum.FILE_MAKER) {
|
if (actor.role === RoleEnum.FILE_MAKER) {
|
||||||
const isOwn = claimCaseInitiatedByFieldExpert(claim, actor, linkedBlame);
|
const isOwn = claimCaseInitiatedByFieldExpert(claim, actor, linkedBlame);
|
||||||
if (!isOwn) {
|
if (!isOwn) {
|
||||||
@@ -4698,6 +4700,11 @@ export class ExpertClaimService {
|
|||||||
"FileMakers can only view files they created.",
|
"FileMakers can only view files they created.",
|
||||||
);
|
);
|
||||||
}
|
}
|
||||||
|
if (!(claim as any).requiresFileMakerApproval) {
|
||||||
|
throw new ForbiddenException(
|
||||||
|
"This file does not require FileMaker approval.",
|
||||||
|
);
|
||||||
|
}
|
||||||
// Fall through to the detail build below
|
// Fall through to the detail build below
|
||||||
} else if (
|
} else if (
|
||||||
// Field experts and FileReviewers can view IN_PERSON expert-initiated claims
|
// Field experts and FileReviewers can view IN_PERSON expert-initiated claims
|
||||||
|
|||||||
Reference in New Issue
Block a user