YARA-821

src/claim-request-management/claim-request-management.service.ts

@@ -4987,14 +4987,14 @@ export class ClaimRequestManagementService {
         data && (data instanceof Map ? data.get(key) : data[key]);
 
       const requiredDocs = claim.requiredDocuments as any;
-      const requiredDocumentsStatus: Record<string, { uploaded: boolean; fileId?: string }> = {};
+      const requiredDocumentsStatus: Record<string, { uploaded: boolean; fileUrl?: string }> = {};
       if (requiredDocs) {
         const keys = requiredDocs instanceof Map ? Array.from(requiredDocs.keys()) : Object.keys(requiredDocs);
         for (const k of keys) {
           const doc = requiredDocs instanceof Map ? requiredDocs.get(k) : requiredDocs[k];
           requiredDocumentsStatus[k] = {
             uploaded: !!doc?.uploaded,
-            fileId: doc?.fileId?.toString(),
+            fileUrl: doc?.filePath ? buildFileLink(doc.filePath) : undefined,
           };
         }
       }
@@ -5041,6 +5041,25 @@ export class ClaimRequestManagementService {
         s ? s.replace(/^(.{4})(.*)(.{4})$/, 'IR$1************$3') : undefined;
       const maskNationalCode = (s?: string) =>
         s ? s.replace(/^(.{2})(.*)(.{2})$/, '$1******$3') : undefined;
+      const isExpertViewer = actor?.role === RoleEnum.FIELD_EXPERT;
+      const ownerData = claim.owner
+        ? {
+            userId: claim.owner.userId?.toString(),
+            fullName: claim.owner.fullName,
+          }
+        : undefined;
+      const moneyForUser = claim.money
+        ? {
+            sheba: maskSheba(claim.money.sheba),
+            nationalCodeOfOwner: maskNationalCode(claim.money.nationalCodeOfInsurer),
+          }
+        : undefined;
+      const moneyForExpert = claim.money
+        ? {
+            sheba: claim.money.sheba,
+            nationalCodeOfOwner: claim.money.nationalCodeOfInsurer,
+          }
+        : undefined;
 
       return {
         claimRequestId: claim._id.toString(),
@@ -5052,34 +5071,28 @@ export class ClaimRequestManagementService {
         nextStep: claim.workflow?.nextStep,
         blameRequestId: claim.blameRequestId?.toString(),
         blameRequestNo: claim.blameRequestNo,
-        owner: claim.owner
-          ? {
-              userId: claim.owner.userId?.toString(),
-              fullName: claim.owner.fullName,
-            }
-          : undefined,
+        ...(isExpertViewer ? { owner: ownerData } : {}),
         vehicle: claim.vehicle,
         selectedParts: claim.damage?.selectedParts,
         otherParts: claim.damage?.otherParts,
-        money: claim.money
-          ? {
-              sheba: maskSheba(claim.money.sheba),
-              nationalCodeOfOwner: maskNationalCode(claim.money.nationalCodeOfInsurer),
-            }
-          : undefined,
+        money: isExpertViewer ? moneyForExpert : moneyForUser,
         requiredDocuments: Object.keys(requiredDocumentsStatus).length > 0 ? requiredDocumentsStatus : undefined,
         carAngles,
         damagedParts,
         expertResend,
-        userRating: claim.userRating
+        ...(isExpertViewer
           ? {
-              progressSpeed: claim.userRating.progressSpeed,
-              registrationEase: claim.userRating.registrationEase,
-              overallEvaluation: claim.userRating.overallEvaluation,
-              comment: claim.userRating.comment,
-              createdAt: claim.userRating.createdAt,
+              userRating: claim.userRating
+                ? {
+                    progressSpeed: claim.userRating.progressSpeed,
+                    registrationEase: claim.userRating.registrationEase,
+                    overallEvaluation: claim.userRating.overallEvaluation,
+                    comment: claim.userRating.comment,
+                    createdAt: claim.userRating.createdAt,
+                  }
+                : undefined,
             }
-          : undefined,
+          : {}),
         createdAt: (claim as any).createdAt,
         updatedAt: (claim as any).updatedAt,
       };

src/claim-request-management/claim-request-management.v2.controller.ts

@@ -75,7 +75,8 @@ export class ClaimRequestManagementV2Controller {
   })
   @ApiOperation({
     summary: "Get Claim Details (V2)",
-    description: "Get full details of a claim request. Only the claim owner can access.",
+    description:
+      "Get claim details for current actor. USER receives only minimal own-needed payload (no extra owner/security fields). FIELD_EXPERT keeps full view for expert workflows.",
   })
   @ApiResponse({
     status: 200,

src/claim-request-management/dto/claim-details-v2.dto.ts

@@ -69,8 +69,8 @@ export class ClaimDetailsV2ResponseDto {
     nationalCodeOfOwner?: string;
   };
 
-  @ApiPropertyOptional({ description: 'Required documents status' })
-  requiredDocuments?: Record<string, { uploaded: boolean; fileId?: string }>;
+  @ApiPropertyOptional({ description: 'Required documents status (link instead of id)' })
+  requiredDocuments?: Record<string, { uploaded: boolean; fileUrl?: string }>;
 
   @ApiPropertyOptional({ description: 'Car angles captured' })
   carAngles?: Record<string, { captured: boolean; url?: string }>;