merge upstream

src/claim-request-management/claim-request-management.service.ts

@@ -4776,6 +4776,50 @@ export class ClaimRequestManagementService {
     };
   }
 
+  private async assertActorCanViewClaimV2(
+    claim: any,
+    currentUserId: string,
+    actor?: { sub: string; role?: string },
+  ): Promise<void> {
+    const ownerId = claim.owner?.userId?.toString();
+    if (ownerId && ownerId === currentUserId) {
+      return;
+    }
+
+    if (actor?.role === RoleEnum.FIELD_EXPERT) {
+      if (claim.initiatedByFieldExpertId?.toString() === currentUserId) {
+        return;
+      }
+      if (claim.blameRequestId) {
+        const blame = await this.blameRequestDbService.findById(
+          claim.blameRequestId.toString(),
+        );
+        if (
+          blame?.expertInitiated &&
+          blame.initiatedByFieldExpertId &&
+          String(blame.initiatedByFieldExpertId) === currentUserId
+        ) {
+          return;
+        }
+      }
+    }
+
+    if (actor?.role === RoleEnum.REGISTRAR && claim.blameRequestId) {
+      const blame = await this.blameRequestDbService.findById(
+        claim.blameRequestId.toString(),
+      );
+      if (
+        blame?.registrarInitiated &&
+        blame.initiatedByRegistrarId &&
+        String(blame.initiatedByRegistrarId) === currentUserId
+      ) {
+        return;
+      }
+    }
+
+    throw new ForbiddenException("You do not have access to this claim");
+  }
+
   /**
    * Resolve effective user id for claim operations.
    * For FIELD_EXPERT acting on expert-initiated IN_PERSON claim, returns the claim owner's id; otherwise returns currentUserId.
@@ -7139,7 +7183,6 @@ export class ClaimRequestManagementService {
           .find(
             {
               expertInitiated: true,
-              creationMethod: "IN_PERSON",
               initiatedByFieldExpertId: new Types.ObjectId(currentUserId),
             },
             { select: "_id", lean: true },
@@ -7152,6 +7195,7 @@ export class ClaimRequestManagementService {
               ...(expertBlameIds.length
                 ? [{ blameRequestId: { $in: expertBlameIds } }]
                 : []),
+              { initiatedByFieldExpertId: new Types.ObjectId(currentUserId) },
             ],
           },
           { lean: true },
@@ -7241,17 +7285,7 @@ export class ClaimRequestManagementService {
       if (!claim) {
         throw new NotFoundException("Claim request not found");
       }
-      const effectiveUserId = await this.resolveClaimEffectiveUserId(
-        claim,
-        currentUserId,
-        actor?.role,
-      );
-      if (
-        !claim.owner?.userId ||
-        claim.owner.userId.toString() !== effectiveUserId
-      ) {
-        throw new ForbiddenException("You do not have access to this claim");
-      }
+      await this.assertActorCanViewClaimV2(claim, currentUserId, actor);
 
       const hasCapture = (data: any, key: string) =>
         data && (data instanceof Map ? data.get(key) : data[key]);
@@ -7365,7 +7399,9 @@ export class ClaimRequestManagementService {
         s ? s.replace(/^(.{4})(.*)(.{4})$/, "IR$1************$3") : undefined;
       const maskNationalCode = (s?: string) =>
         s ? s.replace(/^(.{2})(.*)(.{2})$/, "$1******$3") : undefined;
-      const isExpertViewer = actor?.role === RoleEnum.FIELD_EXPERT;
+      const isExpertViewer =
+        actor?.role === RoleEnum.FIELD_EXPERT ||
+        actor?.role === RoleEnum.REGISTRAR;
       const ownerData = claim.owner
         ? {
             userId: claim.owner.userId?.toString(),