From d8f7766f10874adc1b16054762f7b0c7439446a6 Mon Sep 17 00:00:00 2001 From: Sepehr Yahyaee Date: Thu, 18 Jun 2026 13:31:56 +0330 Subject: [PATCH] Fixed Lock for Field expert + user view of files --- package-lock.json | 191 ++++-------------- .../claim-request-management.service.ts | 40 +++- src/expert-blame/expert-blame.service.ts | 75 ++++++- .../expert-blame.v2.controller.ts | 2 +- src/expert-claim/expert-claim.service.ts | 104 +++++++--- src/helpers/iran-mobile.ts | 25 +++ src/helpers/tenant-scope.ts | 14 ++ .../request-management.service.ts | 111 +++++----- 8 files changed, 328 insertions(+), 234 deletions(-) diff --git a/package-lock.json b/package-lock.json index b7abe52..6915688 100644 --- a/package-lock.json +++ b/package-lock.json @@ -179,24 +179,6 @@ "url": "https://github.com/sponsors/epoberezkin" } }, - "node_modules/@angular-devkit/schematics-cli/node_modules/chokidar": { - "version": "4.0.3", - "resolved": "https://registry.npmjs.org/chokidar/-/chokidar-4.0.3.tgz", - "integrity": "sha512-Qgzu8kfBvo+cA4962jnP1KkS6Dop5NS6g7R5LFYJr4b8Ub94PPQXUksCw9PvXoeXPRRddRNC5C1JQUR2SMGtnA==", - "dev": true, - "license": "MIT", - "optional": true, - "peer": true, - "dependencies": { - "readdirp": "^4.0.1" - }, - "engines": { - "node": ">= 14.16.0" - }, - "funding": { - "url": "https://paulmillr.com/funding/" - } - }, "node_modules/@angular-devkit/schematics-cli/node_modules/json-schema-traverse": { "version": "1.0.0", "resolved": "https://registry.npmjs.org/json-schema-traverse/-/json-schema-traverse-1.0.0.tgz", @@ -204,22 +186,6 @@ "dev": true, "license": "MIT" }, - "node_modules/@angular-devkit/schematics-cli/node_modules/readdirp": { - "version": "4.1.2", - "resolved": "https://registry.npmjs.org/readdirp/-/readdirp-4.1.2.tgz", - "integrity": "sha512-GDhwkLfywWL2s6vEjyhri+eXmfH6j1L7JE27WhqLeYzoh/A3DBaYGEj2H/HFZCn/kMfim73FXxEJTw06WtxQwg==", - "dev": true, - "license": "MIT", - "optional": true, - "peer": true, - "engines": { - "node": ">= 14.18.0" - }, - "funding": { - "type": "individual", - "url": "https://paulmillr.com/funding/" - } - }, "node_modules/@angular-devkit/schematics-cli/node_modules/rxjs": { "version": "7.8.1", "resolved": "https://registry.npmjs.org/rxjs/-/rxjs-7.8.1.tgz", @@ -275,24 +241,6 @@ "url": "https://github.com/sponsors/epoberezkin" } }, - "node_modules/@angular-devkit/schematics/node_modules/chokidar": { - "version": "4.0.3", - "resolved": "https://registry.npmjs.org/chokidar/-/chokidar-4.0.3.tgz", - "integrity": "sha512-Qgzu8kfBvo+cA4962jnP1KkS6Dop5NS6g7R5LFYJr4b8Ub94PPQXUksCw9PvXoeXPRRddRNC5C1JQUR2SMGtnA==", - "dev": true, - "license": "MIT", - "optional": true, - "peer": true, - "dependencies": { - "readdirp": "^4.0.1" - }, - "engines": { - "node": ">= 14.16.0" - }, - "funding": { - "url": "https://paulmillr.com/funding/" - } - }, "node_modules/@angular-devkit/schematics/node_modules/json-schema-traverse": { "version": "1.0.0", "resolved": "https://registry.npmjs.org/json-schema-traverse/-/json-schema-traverse-1.0.0.tgz", @@ -300,22 +248,6 @@ "dev": true, "license": "MIT" }, - "node_modules/@angular-devkit/schematics/node_modules/readdirp": { - "version": "4.1.2", - "resolved": "https://registry.npmjs.org/readdirp/-/readdirp-4.1.2.tgz", - "integrity": "sha512-GDhwkLfywWL2s6vEjyhri+eXmfH6j1L7JE27WhqLeYzoh/A3DBaYGEj2H/HFZCn/kMfim73FXxEJTw06WtxQwg==", - "dev": true, - "license": "MIT", - "optional": true, - "peer": true, - "engines": { - "node": ">= 14.18.0" - }, - "funding": { - "type": "individual", - "url": "https://paulmillr.com/funding/" - } - }, "node_modules/@angular-devkit/schematics/node_modules/rxjs": { "version": "7.8.1", "resolved": "https://registry.npmjs.org/rxjs/-/rxjs-7.8.1.tgz", @@ -1075,9 +1007,9 @@ "license": "BSD-3-Clause" }, "node_modules/@hapi/tlds": { - "version": "1.1.6", - "resolved": "https://registry.npmjs.org/@hapi/tlds/-/tlds-1.1.6.tgz", - "integrity": "sha512-xdi7A/4NZokvV0ewovme3aUO5kQhW9pQ2YD1hRqZGhhSi5rBv4usHYidVocXSi9eihYsznZxLtAiEYYUL6VBGw==", + "version": "1.1.7", + "resolved": "https://registry.npmjs.org/@hapi/tlds/-/tlds-1.1.7.tgz", + "integrity": "sha512-MgNjRwy9Ti92yVAixLmDc8dd1bJIKwO9qlWCfFQRwRmUEDPQHYn4G6hwPFvFGUTzAa0FsS+inMjLin7GnyBRhA==", "license": "BSD-3-Clause", "engines": { "node": ">=14.0.0" @@ -2175,6 +2107,9 @@ "arm64" ], "dev": true, + "libc": [ + "glibc" + ], "license": "MIT", "optional": true, "os": [ @@ -2192,6 +2127,9 @@ "arm64" ], "dev": true, + "libc": [ + "musl" + ], "license": "MIT", "optional": true, "os": [ @@ -2209,6 +2147,9 @@ "ppc64" ], "dev": true, + "libc": [ + "glibc" + ], "license": "MIT", "optional": true, "os": [ @@ -2226,6 +2167,9 @@ "riscv64" ], "dev": true, + "libc": [ + "glibc" + ], "license": "MIT", "optional": true, "os": [ @@ -2243,6 +2187,9 @@ "s390x" ], "dev": true, + "libc": [ + "glibc" + ], "license": "MIT", "optional": true, "os": [ @@ -2905,24 +2852,6 @@ "url": "https://github.com/sponsors/epoberezkin" } }, - "node_modules/@nestjs/schematics/node_modules/chokidar": { - "version": "4.0.3", - "resolved": "https://registry.npmjs.org/chokidar/-/chokidar-4.0.3.tgz", - "integrity": "sha512-Qgzu8kfBvo+cA4962jnP1KkS6Dop5NS6g7R5LFYJr4b8Ub94PPQXUksCw9PvXoeXPRRddRNC5C1JQUR2SMGtnA==", - "dev": true, - "license": "MIT", - "optional": true, - "peer": true, - "dependencies": { - "readdirp": "^4.0.1" - }, - "engines": { - "node": ">= 14.16.0" - }, - "funding": { - "url": "https://paulmillr.com/funding/" - } - }, "node_modules/@nestjs/schematics/node_modules/json-schema-traverse": { "version": "1.0.0", "resolved": "https://registry.npmjs.org/json-schema-traverse/-/json-schema-traverse-1.0.0.tgz", @@ -2930,22 +2859,6 @@ "dev": true, "license": "MIT" }, - "node_modules/@nestjs/schematics/node_modules/readdirp": { - "version": "4.1.2", - "resolved": "https://registry.npmjs.org/readdirp/-/readdirp-4.1.2.tgz", - "integrity": "sha512-GDhwkLfywWL2s6vEjyhri+eXmfH6j1L7JE27WhqLeYzoh/A3DBaYGEj2H/HFZCn/kMfim73FXxEJTw06WtxQwg==", - "dev": true, - "license": "MIT", - "optional": true, - "peer": true, - "engines": { - "node": ">= 14.18.0" - }, - "funding": { - "type": "individual", - "url": "https://paulmillr.com/funding/" - } - }, "node_modules/@nestjs/schematics/node_modules/rxjs": { "version": "7.8.1", "resolved": "https://registry.npmjs.org/rxjs/-/rxjs-7.8.1.tgz", @@ -3340,6 +3253,9 @@ "arm64" ], "dev": true, + "libc": [ + "glibc" + ], "license": "Apache-2.0 AND MIT", "optional": true, "os": [ @@ -3357,6 +3273,9 @@ "arm64" ], "dev": true, + "libc": [ + "musl" + ], "license": "Apache-2.0 AND MIT", "optional": true, "os": [ @@ -3374,6 +3293,9 @@ "ppc64" ], "dev": true, + "libc": [ + "glibc" + ], "license": "Apache-2.0 AND MIT", "optional": true, "os": [ @@ -3391,6 +3313,9 @@ "s390x" ], "dev": true, + "libc": [ + "glibc" + ], "license": "Apache-2.0 AND MIT", "optional": true, "os": [ @@ -5794,24 +5719,6 @@ "dev": true, "license": "MIT" }, - "node_modules/chokidar": { - "version": "5.0.0", - "resolved": "https://registry.npmjs.org/chokidar/-/chokidar-5.0.0.tgz", - "integrity": "sha512-TQMmc3w+5AxjpL8iIiwebF73dRDF4fBIieAqGn9RGCWaEVwQ6Fb2cGe31Yns0RRIzii5goJ1Y7xbMwo1TxMplw==", - "dev": true, - "license": "MIT", - "optional": true, - "peer": true, - "dependencies": { - "readdirp": "^5.0.0" - }, - "engines": { - "node": ">= 20.19.0" - }, - "funding": { - "url": "https://paulmillr.com/funding/" - } - }, "node_modules/chrome-trace-event": { "version": "1.0.4", "resolved": "https://registry.npmjs.org/chrome-trace-event/-/chrome-trace-event-1.0.4.tgz", @@ -7254,16 +7161,16 @@ } }, "node_modules/form-data": { - "version": "4.0.5", - "resolved": "https://registry.npmjs.org/form-data/-/form-data-4.0.5.tgz", - "integrity": "sha512-8RipRLol37bNs2bhoV67fiTEvdTrbMUYcFTiy3+wuuOnUog2QBHCZWXDRijWQfAkhBj2Uf5UnVaiWwA5vdd82w==", + "version": "4.0.6", + "resolved": "https://registry.npmjs.org/form-data/-/form-data-4.0.6.tgz", + "integrity": "sha512-vKatAh4SlVfgbv+YtmhiRjhEMJsYpsG1Y2rMQtR+SVSbytsSD1YGzDIcrAJmdFec88u/+VoGmxnl+80gL1tRCQ==", "license": "MIT", "dependencies": { "asynckit": "^0.4.0", "combined-stream": "^1.0.8", "es-set-tostringtag": "^2.1.0", - "hasown": "^2.0.2", - "mime-types": "^2.1.12" + "hasown": "^2.0.4", + "mime-types": "^2.1.35" }, "engines": { "node": ">= 6" @@ -7711,9 +7618,9 @@ } }, "node_modules/hasown": { - "version": "2.0.3", - "resolved": "https://registry.npmjs.org/hasown/-/hasown-2.0.3.tgz", - "integrity": "sha512-ej4AhfhfL2Q2zpMmLo7U1Uv9+PyhIZpgQLGT1F9miIGmiCJIoCgSmczFdrc97mWT4kVY72KA+WnnhJ5pghSvSg==", + "version": "2.0.4", + "resolved": "https://registry.npmjs.org/hasown/-/hasown-2.0.4.tgz", + "integrity": "sha512-T2UbfbBEF32wiepXIsMlTW9+dDYC6wMh/t/vYA4tuOMKqWz/n3vr1NFSxQiyP+zk2mXsoMA/i/7qV6LKut1t1A==", "license": "MIT", "dependencies": { "function-bind": "^1.1.2" @@ -8810,9 +8717,9 @@ } }, "node_modules/joi": { - "version": "18.2.1", - "resolved": "https://registry.npmjs.org/joi/-/joi-18.2.1.tgz", - "integrity": "sha512-2/OKlogiESf2Nh3TFCrRjrr9z1DRHeW0I+KReF67+4J0Ns+8hBtHRmoWAZ2OFU6I5+TWLEe6sVlSdXPjHm5UbQ==", + "version": "18.2.2", + "resolved": "https://registry.npmjs.org/joi/-/joi-18.2.2.tgz", + "integrity": "sha512-STrV933NPLPME2nfPo+lFIfgCff9T/vhObpoRtFb/vNlLQynrUJPBCS3OePJ4Lunu/Egw9lqtNms72xbPbxrxw==", "license": "BSD-3-Clause", "dependencies": { "@hapi/address": "^5.1.1", @@ -10396,22 +10303,6 @@ "node": ">= 6" } }, - "node_modules/readdirp": { - "version": "5.0.0", - "resolved": "https://registry.npmjs.org/readdirp/-/readdirp-5.0.0.tgz", - "integrity": "sha512-9u/XQ1pvrQtYyMpZe7DXKv2p5CNvyVwzUB6uhLAnQwHMSgKMBR62lc7AHljaeteeHXn11XTAaLLUVZYVZyuRBQ==", - "dev": true, - "license": "MIT", - "optional": true, - "peer": true, - "engines": { - "node": ">= 20.19.0" - }, - "funding": { - "type": "individual", - "url": "https://paulmillr.com/funding/" - } - }, "node_modules/reflect-metadata": { "version": "0.2.2", "resolved": "https://registry.npmjs.org/reflect-metadata/-/reflect-metadata-0.2.2.tgz", diff --git a/src/claim-request-management/claim-request-management.service.ts b/src/claim-request-management/claim-request-management.service.ts index e7afe2f..d50834f 100644 --- a/src/claim-request-management/claim-request-management.service.ts +++ b/src/claim-request-management/claim-request-management.service.ts @@ -59,6 +59,7 @@ import { } from "./dto/my-claims-v2.dto"; import { ListQueryV2Dto } from "src/common/dto/list-query-v2.dto"; import { applyListQueryV2 } from "src/helpers/list-query-v2"; +import { partyPersonMatchesUser } from "src/helpers/iran-mobile"; import { ClaimDetailsV2ResponseDto } from "./dto/claim-details-v2.dto"; import { ClaimCaseStatus } from "src/Types&Enums/claim-request-management/claim-case-status.enum"; import { ClaimRequiredDocumentType } from "src/Types&Enums/claim-request-management/required-document-type.enum"; @@ -4179,6 +4180,26 @@ export class ClaimRequestManagementService { return; } + if ( + (!actor?.role || actor.role === RoleEnum.USER) && + claim.blameRequestId + ) { + const blame = await this.blameRequestDbService.findById( + claim.blameRequestId.toString(), + ); + const isParty = + Array.isArray(blame?.parties) && + blame.parties.some((p: any) => + partyPersonMatchesUser(p?.person, { + sub: currentUserId, + username: (actor as { username?: string })?.username, + }), + ); + if (isParty) { + return; + } + } + if (actor?.role === RoleEnum.FIELD_EXPERT) { if (claim.initiatedByFieldExpertId?.toString() === currentUserId) { return; @@ -6603,8 +6624,25 @@ export class ClaimRequestManagementService { { lean: true }, ); } else { + const partyBlameIds = await this.blameRequestDbService + .find( + { + $or: [ + { "parties.person.userId": new Types.ObjectId(currentUserId) }, + ], + }, + { select: "_id", lean: true }, + ) + .then((docs) => docs.map((d) => (d as any)._id)); claims = await this.claimCaseDbService.find( - { "owner.userId": new Types.ObjectId(currentUserId) }, + { + $or: [ + { "owner.userId": new Types.ObjectId(currentUserId) }, + ...(partyBlameIds.length + ? [{ blameRequestId: { $in: partyBlameIds } }] + : []), + ], + }, { lean: true }, ); } diff --git a/src/expert-blame/expert-blame.service.ts b/src/expert-blame/expert-blame.service.ts index 77d8730..6541d88 100644 --- a/src/expert-blame/expert-blame.service.ts +++ b/src/expert-blame/expert-blame.service.ts @@ -11,6 +11,7 @@ import { import { assertBlameCaseForExpertTenant, blameCaseAccessibleToExpert, + blameCaseInitiatedByFieldExpert, requireActorClientKey, } from "src/helpers/tenant-scope"; import { @@ -436,8 +437,9 @@ export class ExpertBlameService { } /** - * Blame review inbox for FIELD_EXPERT — expert-initiated DISAGREEMENT files only. - * IN_PERSON flows are AGREED and handled outside this panel; completed blames appear in expert-claim. + * Blame review inbox for FIELD_EXPERT — expert-initiated DISAGREEMENT files. + * Covers LINK flows (parties complete via link → WAITING_FOR_EXPERT) and in-progress + * disputes while parties are still filling. IN_PERSON AGREED blames use expert-claim instead. */ private async getFieldExpertBlameListV2( actor: { sub: string }, @@ -448,9 +450,25 @@ export class ExpertBlameService { const visibleCases = (await this.blameRequestDbService.find( { - blameStatus: BlameStatus.DISAGREEMENT, expertInitiated: true, initiatedByFieldExpertId: expertOid, + blameStatus: BlameStatus.DISAGREEMENT, + type: { $ne: BlameRequestType.CAR_BODY }, + $or: [ + { status: CaseStatus.WAITING_FOR_EXPERT }, + { + status: { + $in: [ + CaseStatus.OPEN, + CaseStatus.WAITING_FOR_SECOND_PARTY, + CaseStatus.WAITING_FOR_DOCUMENT_RESEND, + ], + }, + }, + { "workflow.lockedBy.actorId": expertOid }, + { "workflow.assignedForReviewBy.actorId": expertOid }, + { "expert.decision.decidedByExpertId": expertOid }, + ], }, { lean: true }, )) as Record[]; @@ -966,6 +984,8 @@ export class ExpertBlameService { ); } + const isFieldExpertOwner = blameCaseInitiatedByFieldExpert(doc, actor); + const decision = (doc.expert as any)?.decision; const decidedByExpertId = decision?.decidedByExpertId ? String(decision.decidedByExpertId) @@ -978,6 +998,7 @@ export class ExpertBlameService { (doc.workflow as any)?.assignedForReviewBy?.actorId ?? "", ); + if (!isFieldExpertOwner) { // Access gates — must satisfy at least one bucket const isAvailable = doc.status === CaseStatus.WAITING_FOR_EXPERT && !decidedByExpertId; @@ -1002,6 +1023,7 @@ export class ExpertBlameService { "You do not have permission to view this request.", ); } + } // Build evidence URLs const parties = Array.isArray(doc.parties) ? doc.parties : []; @@ -1158,7 +1180,12 @@ export class ExpertBlameService { */ async assignBlameCaseForReviewV2( requestId: string, - actor: { sub: string; fullName?: string; clientKey?: string }, + actor: { + sub: string; + fullName?: string; + clientKey?: string; + role?: string; + }, ): Promise { await this.expireBlameCaseWorkflowLockV2IfStale(requestId); @@ -1169,6 +1196,8 @@ export class ExpertBlameService { assertBlameCaseForExpertTenant(request, actor); + const isFieldExpertOwner = blameCaseInitiatedByFieldExpert(request, actor); + if (request.type === BlameRequestType.CAR_BODY) { throw new BadRequestException({ success: false, @@ -1177,9 +1206,17 @@ export class ExpertBlameService { }); } + if (request.blameStatus !== BlameStatus.DISAGREEMENT) { + throw new BadRequestException({ + success: false, + status: "unavailable" satisfies ExpertFileAssignStatus, + message: "Request is not available for expert review", + }); + } + if ( - request.status !== CaseStatus.WAITING_FOR_EXPERT || - request.blameStatus !== BlameStatus.DISAGREEMENT + !isFieldExpertOwner && + request.status !== CaseStatus.WAITING_FOR_EXPERT ) { throw new BadRequestException({ success: false, @@ -1188,6 +1225,26 @@ export class ExpertBlameService { }); } + if (isFieldExpertOwner && request.expert?.decision) { + throw new BadRequestException({ + success: false, + status: "unavailable" satisfies ExpertFileAssignStatus, + message: "This request already has an expert decision", + }); + } + + if ( + isFieldExpertOwner && + request.status !== CaseStatus.WAITING_FOR_EXPERT + ) { + throw new BadRequestException({ + success: false, + status: "unavailable" satisfies ExpertFileAssignStatus, + message: + "Parties are still completing this file. Lock and review become available when status is WAITING_FOR_EXPERT (e.g. after both parties finish via link).", + }); + } + if ( request.expertInitiated && request.initiatedByFieldExpertId && @@ -1272,7 +1329,6 @@ export class ExpertBlameService { const assignFilter: Record = { _id: new Types.ObjectId(requestId), - status: CaseStatus.WAITING_FOR_EXPERT, blameStatus: BlameStatus.DISAGREEMENT, $and: [ { @@ -1293,8 +1349,11 @@ export class ExpertBlameService { ], }; - if (request.expertInitiated) { + if (isFieldExpertOwner) { assignFilter.initiatedByFieldExpertId = expertOid; + assignFilter.status = CaseStatus.WAITING_FOR_EXPERT; + } else { + assignFilter.status = CaseStatus.WAITING_FOR_EXPERT; } const updated = await this.blameRequestDbService.findOneAndUpdate( diff --git a/src/expert-blame/expert-blame.v2.controller.ts b/src/expert-blame/expert-blame.v2.controller.ts index 1fc6911..864c689 100644 --- a/src/expert-blame/expert-blame.v2.controller.ts +++ b/src/expert-blame/expert-blame.v2.controller.ts @@ -43,7 +43,7 @@ export class ExpertBlameV2Controller { summary: "List blame cases for expert review (V2)", description: "Damage experts (`expert`): tenant-scoped **DISAGREEMENT** queue (available, locked, or decided by you). " + - "Field experts (`field_expert`): only **DISAGREEMENT** files they initiated that need expert review (e.g. LINK disputes). " + + "Field experts (`field_expert`): expert-initiated **DISAGREEMENT** files — including **LINK** flows where parties complete via link and the case moves to `WAITING_FOR_EXPERT` for your review. " + "IN_PERSON expert-initiated blames are usually `AGREED` and are managed via expert-initiated / request-management APIs; after completion, use expert-claim. " + "Optional query: `search`, `sortBy` (publicId | createdAt | requestNo | status), `sortOrder`, `page`, `limit`.", }) diff --git a/src/expert-claim/expert-claim.service.ts b/src/expert-claim/expert-claim.service.ts index 594a80c..bc8853b 100644 --- a/src/expert-claim/expert-claim.service.ts +++ b/src/expert-claim/expert-claim.service.ts @@ -2404,12 +2404,35 @@ export class ExpertClaimService { assertClaimCaseForExpertActor(claim, actor); + const isFieldExpertOwner = + (actor as any).role === RoleEnum.FIELD_EXPERT && + claimCaseInitiatedByFieldExpert(claim, actor); const isFactorValidationLock = claimIsAwaitingExpertFactorValidationV2(claim); const isDamageReviewLock = claim.status === ClaimCaseStatus.WAITING_FOR_DAMAGE_EXPERT; + const isExpertReviewingReentry = + claim.status === ClaimCaseStatus.EXPERT_REVIEWING; + const isResendPending = + claim.status === ClaimCaseStatus.WAITING_FOR_USER_RESEND; + const isTerminalClaim = + claim.status === ClaimCaseStatus.COMPLETED || + claim.status === ClaimCaseStatus.CANCELLED; + const isFieldExpertPortfolioLock = + isFieldExpertOwner && + !isTerminalClaim && + !isDamageReviewLock && + !isFactorValidationLock && + !isExpertReviewingReentry && + !isResendPending; - if (!isDamageReviewLock && !isFactorValidationLock) { + if ( + !isDamageReviewLock && + !isFactorValidationLock && + !isExpertReviewingReentry && + !isResendPending && + !isFieldExpertPortfolioLock + ) { throw new BadRequestException({ success: false, status: "unavailable" satisfies ExpertFileAssignStatus, @@ -2457,11 +2480,15 @@ export class ExpertClaimService { const now = new Date(); const lockSnapshot = await this.snapshotDamageExpert(actor.sub); const expiredAt = new Date(now.getTime() + this.claimV2WorkflowLockTtlMs); + const actorType = isFieldExpertOwner ? "field_expert" : "damage_expert"; + const actorRoleLabel = isFieldExpertOwner + ? ("field_expert" as const) + : ("damage_expert" as const); const lockedByPayload = { actorId: expertOid, actorName: actor.fullName, - actorRole: "damage_expert" as const, + actorRole: actorRoleLabel, ...(lockSnapshot && { expertProfileSnapshot: lockSnapshot }), }; @@ -2470,34 +2497,40 @@ export class ExpertClaimService { "workflow.lockedAt": now, "workflow.expiredAt": expiredAt, "workflow.lockedBy": lockedByPayload, - "workflow.preLockQueueSnapshot": { - claimStatus: claim.claimStatus, - currentStep: this.normalizeClaimWorkflowStepForSnapshot( - claim.workflow?.currentStep, - ClaimWorkflowStep.USER_SUBMISSION_COMPLETE, - ), - ...(claim.workflow?.nextStep != null - ? { - nextStep: this.normalizeClaimWorkflowStepForSnapshot( - claim.workflow.nextStep, - ClaimWorkflowStep.EXPERT_DAMAGE_ASSESSMENT, + ...(isDamageReviewLock || isExpertReviewingReentry || isResendPending + ? { + "workflow.preLockQueueSnapshot": { + claimStatus: claim.claimStatus, + currentStep: this.normalizeClaimWorkflowStepForSnapshot( + claim.workflow?.currentStep, + ClaimWorkflowStep.USER_SUBMISSION_COMPLETE, ), - } - : {}), - }, + ...(claim.workflow?.nextStep != null + ? { + nextStep: this.normalizeClaimWorkflowStepForSnapshot( + claim.workflow.nextStep, + ClaimWorkflowStep.EXPERT_DAMAGE_ASSESSMENT, + ), + } + : {}), + }, + } + : {}), $push: { history: { type: "CLAIM_ASSIGNED", actor: { actorId: expertOid, actorName: actor.fullName, - actorType: "damage_expert", + actorType, }, timestamp: now, metadata: { note: isFactorValidationLock ? "Expert assigned for factor validation review" - : "Expert assigned via review assign endpoint", + : isFieldExpertPortfolioLock + ? "Field expert portfolio lock (no status change)" + : "Expert assigned via review assign endpoint", ...(isFactorValidationLock ? { phase: "factorValidation" } : {}), }, }, @@ -2508,14 +2541,18 @@ export class ExpertClaimService { baseLockUpdate["workflow.assignedForReviewBy"] = lockedByPayload; } - const lockUpdate: Record = isFactorValidationLock - ? baseLockUpdate - : { - ...baseLockUpdate, - status: ClaimCaseStatus.EXPERT_REVIEWING, - claimStatus: ClaimStatus.UNDER_REVIEW, - "workflow.currentStep": ClaimWorkflowStep.EXPERT_DAMAGE_ASSESSMENT, - }; + const lockUpdate: Record = + isFactorValidationLock || + isExpertReviewingReentry || + isResendPending || + isFieldExpertPortfolioLock + ? baseLockUpdate + : { + ...baseLockUpdate, + status: ClaimCaseStatus.EXPERT_REVIEWING, + claimStatus: ClaimStatus.UNDER_REVIEW, + "workflow.currentStep": ClaimWorkflowStep.EXPERT_DAMAGE_ASSESSMENT, + }; const assignFilter: Record = { _id: new Types.ObjectId(claimRequestId), @@ -2548,6 +2585,13 @@ export class ExpertClaimService { ClaimCaseStatus.WAITING_FOR_INSURER_APPROVAL, ], }; + } else if (isExpertReviewingReentry) { + assignFilter.status = ClaimCaseStatus.EXPERT_REVIEWING; + } else if (isResendPending) { + assignFilter.status = ClaimCaseStatus.WAITING_FOR_USER_RESEND; + } else if (isFieldExpertPortfolioLock) { + assignFilter.initiatedByFieldExpertId = expertOid; + assignFilter.status = claim.status; } else { assignFilter.status = ClaimCaseStatus.WAITING_FOR_DAMAGE_EXPERT; } @@ -2601,7 +2645,13 @@ export class ExpertClaimService { }); const ownerPhone = await this.resolveClaimOwnerPhone(updated); - if (ownerPhone) { + if ( + ownerPhone && + isDamageReviewLock && + !isFieldExpertPortfolioLock && + !isExpertReviewingReentry && + !isResendPending + ) { const expertLastName = actor?.fullName?.trim()?.split(/\s+/).pop() || "کارشناس"; await this.smsOrchestrationService.sendThirdPartyExpertStartedReviewNotice( diff --git a/src/helpers/iran-mobile.ts b/src/helpers/iran-mobile.ts index 4e9e5da..9e5dde7 100644 --- a/src/helpers/iran-mobile.ts +++ b/src/helpers/iran-mobile.ts @@ -44,3 +44,28 @@ export function buildUserLookupByPhone( $or: variants.flatMap((v) => [{ username: v }, { mobile: v }]), }; } + +/** True when a blame party person row belongs to the authenticated user. */ +export function partyPersonMatchesUser( + person: + | { userId?: unknown; phoneNumber?: string } + | null + | undefined, + user: { sub?: string; username?: string } | null | undefined, +): boolean { + if (!person || !user) return false; + if ( + person.userId != null && + user.sub && + String(person.userId) === String(user.sub) + ) { + return true; + } + if (!person.phoneNumber || !user.username) return false; + const stored = + normalizeIranMobile(person.phoneNumber) ?? person.phoneNumber; + const variants = iranMobileLookupVariants(user.username); + return variants.some( + (v) => v === stored || v === person.phoneNumber, + ); +} diff --git a/src/helpers/tenant-scope.ts b/src/helpers/tenant-scope.ts index bc0e038..2c2ae8d 100644 --- a/src/helpers/tenant-scope.ts +++ b/src/helpers/tenant-scope.ts @@ -1,4 +1,5 @@ import { BadRequestException, ForbiddenException } from "@nestjs/common"; +import { RoleEnum } from "src/Types&Enums/role.enum"; /** Insurance company tenant id on the actor JWT (Mongo ObjectId string). */ export function requireActorClientKey(actor: { clientKey?: string }): string { @@ -64,6 +65,19 @@ export function blameCaseAccessibleToExpert( return blameCaseTouchesClient(doc, ck); } +/** True when the acting field expert created this expert-initiated blame file. */ +export function blameCaseInitiatedByFieldExpert( + doc: any, + actor: { sub: string; role?: string }, +): boolean { + return ( + actor.role === RoleEnum.FIELD_EXPERT && + !!doc?.expertInitiated && + !!doc?.initiatedByFieldExpertId && + String(doc.initiatedByFieldExpertId) === String(actor.sub) + ); +} + export function assertBlameCaseForExpertTenant( doc: any, actor: { sub: string; clientKey?: string }, diff --git a/src/request-management/request-management.service.ts b/src/request-management/request-management.service.ts index e742e50..9ca5a00 100644 --- a/src/request-management/request-management.service.ts +++ b/src/request-management/request-management.service.ts @@ -91,6 +91,12 @@ import { MUTUAL_AGREEMENT_EXPERT_DECISION_FIELDS, } from "src/helpers/blame-party-agreement-decision"; import { buildFileLink } from "src/helpers/urlCreator"; +import { + buildUserLookupByPhone, + iranMobileLookupVariants, + normalizeIranMobile, + partyPersonMatchesUser, +} from "src/helpers/iran-mobile"; @Injectable() export class RequestManagementService { @@ -209,14 +215,8 @@ export class RequestManagementService { private assertPartyOwner(party: any, user: any, errMsg: string, req?: any) { // The initiating field-expert/registrar fills steps on behalf of parties. if (req && this.isBlameOnBehalfActor(req, user)) return; - const partyUserId = party?.person?.userId - ? String(party.person.userId) - : null; - const ok = - (partyUserId && partyUserId === String(user?.sub)) || - (party?.person?.phoneNumber && - party.person.phoneNumber === user?.username); - if (!ok) throw new ForbiddenException(errMsg); + if (partyPersonMatchesUser(party?.person, user)) return; + throw new ForbiddenException(errMsg); } /** @@ -4434,7 +4434,8 @@ export class RequestManagementService { throw new BadRequestException("First party not found on request"); const userId = await this.getOrCreateUserByPhoneNumber(phone); if (!req.parties[firstIdx].person) req.parties[firstIdx].person = {} as any; - req.parties[firstIdx].person.phoneNumber = phone; + req.parties[firstIdx].person.phoneNumber = + normalizeIranMobile(phone) ?? phone; req.parties[firstIdx].person.userId = userId; const expertName = `${expert?.lastName || ""}`.trim() || "کارشناس"; @@ -4591,7 +4592,9 @@ export class RequestManagementService { throw new BadRequestException("First party not found on request"); if (!req.parties[firstIdx].person) req.parties[firstIdx].person = {} as any; req.parties[firstIdx].person.userId = firstUserId; - req.parties[firstIdx].person.phoneNumber = dto.firstPartyPhoneNumber; + req.parties[firstIdx].person.phoneNumber = + normalizeIranMobile(dto.firstPartyPhoneNumber) ?? + dto.firstPartyPhoneNumber; if ( req.type === BlameRequestType.THIRD_PARTY && @@ -4617,7 +4620,9 @@ export class RequestManagementService { if (!req.parties[secondIdx].person) req.parties[secondIdx].person = {} as any; req.parties[secondIdx].person.userId = secondUserId; - req.parties[secondIdx].person.phoneNumber = dto.secondPartyPhoneNumber; + req.parties[secondIdx].person.phoneNumber = + normalizeIranMobile(dto.secondPartyPhoneNumber) ?? + dto.secondPartyPhoneNumber; } } else if ( req.type === BlameRequestType.THIRD_PARTY && @@ -4794,6 +4799,7 @@ export class RequestManagementService { const valid = await this.hashService.compare(otp, u.otp); if (!valid) throw new BadRequestException(`Invalid OTP for ${phone}`); const userId = u._id as Types.ObjectId; + const canonicalPhone = normalizeIranMobile(phone) ?? phone; if (role === PartyRole.FIRST) { if (firstIdx === -1) @@ -4801,13 +4807,21 @@ export class RequestManagementService { if (!req.parties[firstIdx].person) req.parties[firstIdx].person = {} as any; req.parties[firstIdx].person.userId = userId; - req.parties[firstIdx].person.phoneNumber = phone; + req.parties[firstIdx].person.phoneNumber = canonicalPhone; } else { const firstPhone = firstIdx !== -1 ? (req.parties[firstIdx]?.person as any)?.phoneNumber : undefined; - if (firstPhone && firstPhone === phone) { + const firstVariants = firstPhone + ? iranMobileLookupVariants(firstPhone) + : []; + if ( + firstPhone && + (firstPhone === phone || + firstVariants.includes(phone) || + firstVariants.includes(canonicalPhone)) + ) { throw new BadRequestException( "Second party phone number cannot be the same as first party.", ); @@ -4816,13 +4830,13 @@ export class RequestManagementService { if (secondIdx === -1) { req.parties.push({ role: PartyRole.SECOND, - person: { userId, phoneNumber: phone }, + person: { userId, phoneNumber: canonicalPhone }, } as any); } else { if (!req.parties[secondIdx].person) req.parties[secondIdx].person = {} as any; req.parties[secondIdx].person.userId = userId; - req.parties[secondIdx].person.phoneNumber = phone; + req.parties[secondIdx].person.phoneNumber = canonicalPhone; } } @@ -5018,9 +5032,16 @@ export class RequestManagementService { user?.sub && Types.ObjectId.isValid(user.sub) ? { "parties.person.userId": new Types.ObjectId(user.sub) } : null; - const phoneFilter = user?.username - ? { "parties.person.phoneNumber": user.username } - : null; + const phoneVariants = + user?.role === RoleEnum.USER && user?.username + ? iranMobileLookupVariants(user.username) + : user?.username + ? [user.username] + : []; + const phoneFilter = + phoneVariants.length > 0 + ? { "parties.person.phoneNumber": { $in: phoneVariants } } + : null; const orConditions: Record[] = []; if (userIdFilter) orConditions.push(userIdFilter); @@ -5061,11 +5082,8 @@ export class RequestManagementService { req.registrarInitiated && String(req.initiatedByRegistrarId) === String(user.sub)); - const party = req.parties?.find( - (p: any) => - (p?.person?.userId && - String(p.person.userId) === String(user.sub)) || - (p?.person?.phoneNumber && p.person.phoneNumber === user?.username), + const party = req.parties?.find((p: any) => + partyPersonMatchesUser(p?.person, user), ); const obj = req.toObject(); @@ -5340,14 +5358,7 @@ export class RequestManagementService { String(req.initiatedByRegistrarId) === String(user?.sub); const isParty = Array.isArray(req.parties) && - req.parties.some((p: any) => { - const pid = p?.person?.userId ? String(p.person.userId) : null; - const phone = p?.person?.phoneNumber; - return ( - (pid && pid === String(user?.sub)) || - (phone && phone === user?.username) - ); - }); + req.parties.some((p: any) => partyPersonMatchesUser(p?.person, user)); if (!isFieldExpertOwner && !isRegistrarOwner && !isParty) { throw new ForbiddenException("You do not have access to this request"); } @@ -5359,10 +5370,22 @@ export class RequestManagementService { Types.ObjectId.isValid(user.sub) ) { let updated = false; + const phoneVariants = iranMobileLookupVariants(user?.username); for (const p of req.parties || []) { - if (p?.person?.phoneNumber === user?.username && !p.person?.userId) { + const person = p?.person; + if (!person) continue; + const phoneMatch = + person.phoneNumber && + phoneVariants.some( + (v) => v === person.phoneNumber || v === normalizeIranMobile(person.phoneNumber), + ); + if (phoneMatch && !person?.userId) { p.person = p.person || {}; (p.person as any).userId = new Types.ObjectId(user.sub); + if (user?.username) { + (p.person as any).phoneNumber = + normalizeIranMobile(user.username) ?? user.username; + } updated = true; } } @@ -5384,14 +5407,9 @@ export class RequestManagementService { const visibleParties = isFieldExpertOwner || isRegistrarOwner ? allParties - : allParties.filter((p: any) => { - const pid = p?.person?.userId ? String(p.person.userId) : null; - const phone = p?.person?.phoneNumber; - return ( - (pid && pid === String(user?.sub)) || - (phone && phone === user?.username) - ); - }); + : allParties.filter((p: any) => + partyPersonMatchesUser(p?.person, user), + ); const parties = await Promise.all( visibleParties.map((p: any) => this.sanitizePartyForBlameUserView(p)), ); @@ -7288,19 +7306,18 @@ export class RequestManagementService { private async getOrCreateUserByPhoneNumber( phoneNumber: string, ): Promise { - // Try to find existing user by phone number (username or mobile) - let user = await this.userDbService.findOne({ - $or: [{ username: phoneNumber }, { mobile: phoneNumber }], - }); + const canonical = normalizeIranMobile(phoneNumber) ?? phoneNumber.trim(); + let user = await this.userDbService.findOne( + buildUserLookupByPhone(canonical), + ); if (user) { return new Types.ObjectId((user as any)._id); } - // User doesn't exist, create a new one const newUser = await this.userDbService.createUser({ - mobile: phoneNumber, - username: phoneNumber, + mobile: canonical, + username: canonical, otp: "", tokens: { token: "",