YARA-1259

src/request-management/request-management.file-reviewer.spec.ts

@@ -0,0 +1,140 @@
+import { Types } from "mongoose";
+import { ExpertClaimService } from "src/expert-claim/expert-claim.service";
+import { RoleEnum } from "src/Types&Enums/role.enum";
+import { RequestManagementService } from "./request-management.service";
+
+describe("RequestManagementService FileReviewer inbox", () => {
+  const reviewerId = new Types.ObjectId();
+  const otherReviewerId = new Types.ObjectId();
+  const clientId = new Types.ObjectId();
+  const otherClientId = new Types.ObjectId();
+
+  const sealedFile = {
+    _id: new Types.ObjectId(),
+    publicId: "BLM-OPEN",
+    type: "THIRD_PARTY",
+    status: "WAITING_FOR_FILE_REVIEWER",
+    isMadeByFileMaker: true,
+    expertInitiated: true,
+    creationMethod: "IN_PERSON",
+    parties: [
+      {
+        role: "FIRST",
+        person: { clientId, userId: new Types.ObjectId() },
+      },
+    ],
+    expert: { decision: { guiltyPartyId: new Types.ObjectId() } },
+  };
+
+  function createService(files: any[]) {
+    const blameRequestDbService = {
+      find: jest.fn().mockResolvedValue(files),
+    };
+    const service = new (RequestManagementService as any)(
+      undefined,
+      blameRequestDbService,
+    ) as RequestManagementService;
+    return { service, blameRequestDbService };
+  }
+
+  it("lists a FileMaker-sealed, unassigned file for a reviewer in the same tenant", async () => {
+    const { service, blameRequestDbService } = createService([sealedFile]);
+
+    const result = await service.getMyFileReviewerFiles({
+      sub: String(reviewerId),
+      role: RoleEnum.FILE_REVIEWER,
+      clientKey: String(clientId),
+    });
+
+    expect(result).toEqual([
+      expect.objectContaining({ _id: sealedFile._id, publicId: "BLM-OPEN" }),
+    ]);
+    expect(blameRequestDbService.find).toHaveBeenCalledWith(
+      expect.objectContaining({
+        isMadeByFileMaker: true,
+        expertInitiated: true,
+        creationMethod: "IN_PERSON",
+        $or: expect.arrayContaining([
+          expect.objectContaining({ status: "WAITING_FOR_FILE_REVIEWER" }),
+          expect.objectContaining({ assignedFileReviewerId: reviewerId }),
+        ]),
+      }),
+    );
+  });
+
+  it("does not list another tenant's open file or a file assigned to another reviewer", async () => {
+    const { service } = createService([
+      {
+        ...sealedFile,
+        _id: new Types.ObjectId(),
+        parties: [{ role: "FIRST", person: { clientId: otherClientId } }],
+      },
+      {
+        ...sealedFile,
+        _id: new Types.ObjectId(),
+        assignedFileReviewerId: otherReviewerId,
+      },
+    ]);
+
+    const result = await service.getMyFileReviewerFiles({
+      sub: String(reviewerId),
+      role: RoleEnum.FILE_REVIEWER,
+      clientKey: String(clientId),
+    });
+
+    expect(result).toEqual([]);
+  });
+
+  it("does not expose an open file's details to a reviewer from another tenant", async () => {
+    const { service } = createService([]);
+    (service as any).blameRequestDbService.findById = jest.fn().mockResolvedValue({
+      ...sealedFile,
+      parties: [{ role: "FIRST", person: { clientId: otherClientId } }],
+    });
+
+    await expect(
+      service.getMyFileReviewerFileDetail(
+        {
+          sub: String(reviewerId),
+          role: RoleEnum.FILE_REVIEWER,
+          clientKey: String(clientId),
+        },
+        String(sealedFile._id),
+      ),
+    ).rejects.toThrow("does not belong to your organization");
+  });
+
+  it("does not let a reviewer claim another tenant's file through its linked claim ID", async () => {
+    const blameRequestDbService = {
+      findById: jest.fn().mockResolvedValue({
+        ...sealedFile,
+        parties: [{ role: "FIRST", person: { clientId: otherClientId } }],
+      }),
+      findOneAndUpdate: jest.fn(),
+    };
+    const expertClaimService = new (ExpertClaimService as any)(
+      undefined,
+      undefined,
+      undefined,
+      undefined,
+      undefined,
+      undefined,
+      undefined,
+      undefined,
+      blameRequestDbService,
+    ) as ExpertClaimService;
+
+    await expect(
+      (expertClaimService as any).assignFileReviewerToV4Blame(
+        String(new Types.ObjectId()),
+        { blameRequestId: sealedFile._id },
+        {
+          sub: String(reviewerId),
+          role: RoleEnum.FILE_REVIEWER,
+          clientKey: String(clientId),
+        },
+      ),
+    ).rejects.toThrow("does not belong to your organization");
+    expect(blameRequestDbService.findOneAndUpdate).not.toHaveBeenCalled();
+  });
+});