Merge pull request 'YARA-725' (#18) from s.yahyaee/yara724-api:main into main

Reviewed-on: Yara724/api#18

src/expert-blame/expert-blame.service.ts

@@ -617,12 +617,35 @@ export class ExpertBlameService {
   }
 
   async lockRequest(requestId: string, actorDetail) {
+    const existing = await this.requestManagementDbService.findOne(requestId);
+    if (!existing) {
+      throw new NotFoundException("Request not found");
+    }
+    if (existing.blameStatus === ReqBlameStatus.UserPending) {
+      throw new BadRequestException(
+        "Cannot lock request because blameStatus is UserPending",
+      );
+    }
+
+    const isLocked = !!existing.lockFile;
+    const lockedByCurrent =
+      String(existing?.actorLocked?.actorId || "") === String(actorDetail.sub);
+    const isLockExpired =
+      !!existing.unlockTime && Date.now() >= new Date(existing.unlockTime).getTime();
+
+    // Idempotent behavior: same expert can re-enter their locked file.
+    if (isLocked && lockedByCurrent && !isLockExpired) {
+      return { _id: requestId, lock: true, message: "Already locked by you" };
+    }
+    if (isLocked && !lockedByCurrent && !isLockExpired) {
+      throw new BadRequestException("Request is locked by another expert");
+    }
+
     const fifteenMinutes = new Date(Date.now() + 15 * 60 * 1000);
 
     const updateResult = await this.requestManagementDbService.findOneAndUpdate(
       {
         _id: requestId,
-        lockFile: false,
         blameStatus: { $ne: ReqBlameStatus.UserPending },
       },
       {

src/expert-claim/expert-claim.service.ts

@@ -319,8 +319,18 @@ export class ExpertClaimService {
       await this.claimRequestManagementDbService.findOne(requestId);
     if (!request) throw new BadRequestException("Claim request not found");
 
-    if (request.lockFile) {
-      throw new BadRequestException("Claim request is locked");
+    const isLocked = !!request.lockFile;
+    const lockedByCurrent =
+      String(request?.actorLocked?.actorId || "") === String(actorDetail.sub);
+    const isLockExpired =
+      !!request.unlockTime && Date.now() >= new Date(request.unlockTime).getTime();
+
+    // Idempotent behavior: same expert can re-enter their locked file.
+    if (isLocked && lockedByCurrent && !isLockExpired) {
+      return { _id: requestId, lock: true, message: "Already locked by you" };
+    }
+    if (isLocked && !lockedByCurrent && !isLockExpired) {
+      throw new BadRequestException("Claim request is locked by another expert");
     }
 
     if (request.claimStatus === ReqClaimStatus.UserPending) {