Fixed GET APIs for FileMaker and FileReviewer getting their own files

src/request-management/entities/schema/blame-cases.schema.ts

@@ -109,6 +109,20 @@ export class BlameRequest {
   /** Who fills the blame data: CUSTOMER (LINK) or EXPERT (IN_PERSON). */
   @Prop({ type: String, enum: FilledBy })
   filledBy?: FilledBy;
+
+  /**
+   * True when this file was created by a FileMaker (V4 split flow).
+   * These files are sealed by the FileMaker and completed by a FileReviewer.
+   */
+  @Prop({ default: false })
+  isMadeByFileMaker?: boolean;
+
+  /**
+   * The FileReviewer who claimed this file for completion (V4 flow only).
+   * Set when a FileReviewer calls assign on this file; enforces one-reviewer-per-file.
+   */
+  @Prop({ type: Types.ObjectId })
+  assignedFileReviewerId?: Types.ObjectId;
 }
 
 export type BlameRequestDocument = HydratedDocument<BlameRequest>;

src/request-management/request-management.service.ts

@@ -4151,15 +4151,12 @@ export class RequestManagementService {
    * Verify the current user (field expert) can access this BlameRequest (v2).
    */
   private verifyExpertAccessForBlameV2(req: any, expert: any): void {
-    // FILE_REVIEWER can access any sealed expert-initiated IN_PERSON file
-    // (status WAITING_FOR_FILE_REVIEWER or beyond) scoped to their clientKey.
+    // FILE_REVIEWER can access V4 FileMaker-sealed files.
+    // They must be the assigned reviewer (or the file is still open for taking).
     if (expert?.role === RoleEnum.FILE_REVIEWER) {
-      if (
-        !req?.expertInitiated ||
-        req?.creationMethod !== CreationMethod.IN_PERSON
-      ) {
+      if (!req?.isMadeByFileMaker || !req?.expertInitiated || req?.creationMethod !== CreationMethod.IN_PERSON) {
         throw new ForbiddenException(
-          "FileReviewer can only access expert-initiated IN_PERSON files.",
+          "FileReviewer can only access V4 FileMaker files.",
         );
       }
       if (
@@ -4171,6 +4168,15 @@ export class RequestManagementService {
           "This file has not been sealed by a FileMaker yet.",
         );
       }
+      // Enforce reviewer assignment: must be assigned to them or open (no reviewer yet)
+      const assignedId = req.assignedFileReviewerId
+        ? String(req.assignedFileReviewerId)
+        : null;
+      if (assignedId && assignedId !== String(expert.sub)) {
+        throw new ForbiddenException(
+          "This file has been taken by another FileReviewer.",
+        );
+      }
       return;
     }
     if (req?.expertInitiated && req?.initiatedByFieldExpertId) {
@@ -4441,6 +4447,7 @@ export class RequestManagementService {
       });
     }
 
+    const isFileMakerRole = (expert as any)?.role === RoleEnum.FILE_MAKER;
     const created = await this.blameRequestDbService.create({
       publicId,
       requestNo: publicId,
@@ -4460,6 +4467,7 @@ export class RequestManagementService {
         dto.creationMethod === CreationMethod.IN_PERSON
           ? FilledBy.EXPERT
           : FilledBy.CUSTOMER,
+      ...(isFileMakerRole ? { isMadeByFileMaker: true } : {}),
     });
 
     const requestId = String((created as any)._id);