Rework the reports and insurer part

src/helpers/tenant-scope.ts

@@ -0,0 +1,66 @@
+import { BadRequestException, ForbiddenException } from "@nestjs/common";
+
+/** Insurance company tenant id on the actor JWT (Mongo ObjectId string). */
+export function requireActorClientKey(actor: { clientKey?: string }): string {
+  const ck = actor?.clientKey;
+  if (!ck || typeof ck !== "string") {
+    throw new BadRequestException(
+      "Client scope is missing for this account. Insurer/expert users must be bound to an insurance company.",
+    );
+  }
+  return ck;
+}
+
+export function blameCaseTouchesClient(doc: any, clientKey: string): boolean {
+  const id = String(clientKey);
+  return (doc?.parties ?? []).some(
+    (p: any) => String(p?.person?.clientId ?? "") === id,
+  );
+}
+
+export function claimCaseTouchesClient(doc: any, clientKey: string): boolean {
+  return String(doc?.owner?.userClientKey ?? "") === String(clientKey);
+}
+
+/**
+ * Field expert–initiated cases may not yet have party clientId filled; the
+ * initiating expert is always scoped to their insurer via JWT.
+ */
+export function blameCaseAccessibleToExpert(
+  doc: any,
+  actor: { sub: string; clientKey?: string },
+): boolean {
+  if (
+    doc.expertInitiated &&
+    doc.initiatedByFieldExpertId &&
+    String(doc.initiatedByFieldExpertId) === actor.sub
+  ) {
+    return true;
+  }
+  const ck = actor?.clientKey;
+  if (!ck) return false;
+  return blameCaseTouchesClient(doc, ck);
+}
+
+export function assertBlameCaseForExpertTenant(
+  doc: any,
+  actor: { sub: string; clientKey?: string },
+): void {
+  if (!blameCaseAccessibleToExpert(doc, actor)) {
+    throw new ForbiddenException(
+      "This blame case does not belong to your organization.",
+    );
+  }
+}
+
+export function assertClaimCaseForTenant(
+  doc: any,
+  actor: { clientKey?: string },
+): void {
+  const ck = requireActorClientKey(actor);
+  if (!claimCaseTouchesClient(doc, ck)) {
+    throw new ForbiddenException(
+      "This claim does not belong to your organization.",
+    );
+  }
+}