YARA-868

src/claim-request-management/claim-request-management.service.ts

@@ -2805,6 +2805,27 @@ export class ClaimRequestManagementService {
     }, 0);
   }
 
+  /** Branch ids referenced on expert-priced parts (`daghi` object with `branchId`). */
+  private collectBranchIdsFromClaimExpertReply(reply: {
+    parts?: unknown[];
+  }): Set<string> {
+    const ids = new Set<string>();
+    const parts = reply?.parts;
+    if (!Array.isArray(parts)) {
+      return ids;
+    }
+    for (const p of parts) {
+      const d = (p as { daghi?: unknown })?.daghi;
+      if (d && typeof d === "object" && d !== null && "branchId" in d) {
+        const bid = (d as { branchId?: unknown }).branchId;
+        if (bid != null && Types.ObjectId.isValid(String(bid))) {
+          ids.add(String(bid));
+        }
+      }
+    }
+    return ids;
+  }
+
   /**
    * Fanavaran Submit - Map data from claim-request-management and request-management to third-party-car-financial-claims format
    */
@@ -5139,6 +5160,7 @@ export class ClaimRequestManagementService {
   async submitOwnerInsurerApprovalSignV2(
     claimRequestId: string,
     agree: boolean,
+    branchId: string,
     signFile: Express.Multer.File,
     currentUserId: string,
     actor?: { sub: string; role?: string; fullName?: string },
@@ -5200,6 +5222,34 @@ export class ClaimRequestManagementService {
       throw new BadRequestException("No expert reply is available to sign off on yet.");
     }
 
+    const rawBranchId = (branchId ?? "").trim();
+    if (!rawBranchId || !Types.ObjectId.isValid(rawBranchId)) {
+      throw new BadRequestException(
+        "branchId is required and must be a valid MongoDB ObjectId.",
+      );
+    }
+    const branchDoc = await this.branchDbService.findById(rawBranchId);
+    if (!branchDoc) {
+      throw new NotFoundException(`Branch with ID ${rawBranchId} not found.`);
+    }
+    const ownerClientId = claimCase.owner?.clientId;
+    if (!ownerClientId || String(branchDoc.clientKey) !== String(ownerClientId)) {
+      throw new ForbiddenException(
+        "This branch does not belong to the insurer for this claim.",
+      );
+    }
+    const branchIdsOnPricing = this.collectBranchIdsFromClaimExpertReply(
+      activeReply as { parts?: unknown[] },
+    );
+    if (
+      branchIdsOnPricing.size > 0 &&
+      !branchIdsOnPricing.has(String(rawBranchId))
+    ) {
+      throw new BadRequestException(
+        "branchId must match a branch used in the expert pricing for this claim.",
+      );
+    }
+
     const signDoc = await this.claimSignDbService.create({
       fileName: signFile.filename,
       userId: effectiveUserId,
@@ -5210,6 +5260,7 @@ export class ClaimRequestManagementService {
     const signedAt = new Date();
     const approvalPayload = {
       agree,
+      branchId: new Types.ObjectId(rawBranchId),
       signDetailId: signId,
       signedAt,
     };
@@ -5233,7 +5284,7 @@ export class ClaimRequestManagementService {
             type: "OWNER_REJECTED_INSURER_APPROVAL_PRICING",
             actor: historyActor,
             timestamp: signedAt,
-            metadata: {},
+            metadata: { branchId: rawBranchId },
           },
         },
       });
@@ -5262,7 +5313,7 @@ export class ClaimRequestManagementService {
           type: "OWNER_SIGNED_INSURER_APPROVAL",
           actor: historyActor,
           timestamp: signedAt,
-          metadata: {},
+          metadata: { branchId: rawBranchId },
         },
       },
     });