fix claim validation and expert branch scoping

src/fanavaran/fanavaran-location.service.ts

@@ -113,6 +113,54 @@ export class FanavaranLocationService {
     }
   }
 
+  async fileMakerBranchId(
+    fileMakerId: string | null | undefined,
+  ): Promise<string | undefined> {
+    if (!fileMakerId) return undefined;
+    const doc = await this.fileMakerDbService.findById(String(fileMakerId));
+    const branchId = (doc as any)?.branchId;
+    return branchId ? String(branchId) : undefined;
+  }
+
+  async fileReviewerBranchId(
+    fileReviewerId: string | null | undefined,
+  ): Promise<string | undefined> {
+    if (!fileReviewerId) return undefined;
+    const doc = await this.fileReviewerDbService.findById(
+      String(fileReviewerId),
+    );
+    const branchId = (doc as any)?.branchId;
+    return branchId ? String(branchId) : undefined;
+  }
+
+  /**
+   * V4/V5 case visibility is branch-scoped by the FileMaker who created it.
+   * Missing branch assignments are denied instead of widening visibility.
+   */
+  async assertMakerReviewerBranchCompatible(input: {
+    fileMakerId?: string | null;
+    fileReviewerId?: string | null;
+    caseBranchId?: string | null;
+  }): Promise<void> {
+    const reviewerBranchId = await this.fileReviewerBranchId(
+      input.fileReviewerId,
+    );
+    const caseBranchId =
+      (input.caseBranchId ? String(input.caseBranchId) : undefined) ??
+      (await this.fileMakerBranchId(input.fileMakerId));
+
+    if (!reviewerBranchId) {
+      throw new ForbiddenException(
+        "FileReviewer account is not assigned to a branch.",
+      );
+    }
+    if (!caseBranchId || caseBranchId !== reviewerBranchId) {
+      throw new ForbiddenException(
+        "This file belongs to another branch.",
+      );
+    }
+  }
+
   private async loadPrimaryLocationId(
     userId: string | null | undefined,
     kind: "maker" | "reviewer",