enforced matching client id for moving on with the case

src/sand-hub/dto/sand-hub.dto.ts

@@ -9,6 +9,9 @@ export class SandHubInquiryOptionsDto {
       "Insurer client Mongo ObjectId. When omitted, resolves from deployment CLIENT_ID env.",
   })
   clientId?: string;
+
+  /** Require the returned policy insurer to match the deployment CLIENT_ID. */
+  enforceDeploymentClientMatch?: boolean;
 }
 
 export type SandHubInquiryOptions = SandHubInquiryOptionsDto;

src/sand-hub/sand-hub.service.spec.ts

@@ -1,4 +1,8 @@
 import { SandHubService } from "./sand-hub.service";
+import {
+  ForbiddenException,
+  ServiceUnavailableException,
+} from "@nestjs/common";
 import { ExternalInquirySettingsService } from "src/client/external-inquiry-settings.service";
 import { SandHubDetailDto } from "./dto/sand-hub.dto";
 
@@ -34,7 +38,7 @@ describe("SandHubService inquiry mocks", () => {
 
   beforeEach(() => {
     jest.clearAllMocks();
-    delete process.env.CLIENT_ID;
+    process.env.CLIENT_ID = "8";
     delete process.env.FANAVARAN_CLIENT;
     service = new SandHubService(
       httpService as any,
@@ -132,6 +136,87 @@ describe("SandHubService inquiry mocks", () => {
     expect(result.mapped.PrntPlcyCmpDocNo).toBe("REAL-ESG-POLICY");
   });
 
+  it("rejects a guilty third-party policy issued by another insurer", async () => {
+    process.env.CLIENT_ID = "15";
+    externalInquirySettings.isInquiryLive.mockResolvedValue(true);
+    jest.spyOn(service as any, "makeTejaratRequest").mockResolvedValue({
+      CompanyCode: "8",
+      CompanyName: "بیمه پارسیان",
+      PrntPlcyCmpDocNo: "OTHER-INSURER-POLICY",
+    });
+
+    await expect(
+      service.getTejaratBlockInquiry(userDetail, {
+        enforceDeploymentClientMatch: true,
+      } as any),
+    ).rejects.toBeInstanceOf(ForbiddenException);
+  });
+
+  it("allows an unchecked third-party policy from another insurer", async () => {
+    process.env.CLIENT_ID = "15";
+    externalInquirySettings.isInquiryLive.mockResolvedValue(true);
+    jest.spyOn(service as any, "makeTejaratRequest").mockResolvedValue({
+      CompanyCode: "8",
+      CompanyName: "بیمه پارسیان",
+    });
+
+    await expect(service.getTejaratBlockInquiry(userDetail)).resolves.toEqual(
+      expect.objectContaining({
+        mapped: expect.objectContaining({ CompanyCode: "8" }),
+      }),
+    );
+  });
+
+  it("rejects a guilty VIN third-party policy issued by another insurer", async () => {
+    process.env.CLIENT_ID = "15";
+    externalInquirySettings.isInquiryLive.mockResolvedValue(true);
+    jest.spyOn(service as any, "makeEsgRequest").mockResolvedValue({
+      success: true,
+      data: { CmpCod: "8", CmpNam: "بیمه پارسیان" },
+    });
+
+    await expect(
+      service.getPolicyByChassisInquiry("NAAR03HFFRDE07024", {
+        enforceDeploymentClientMatch: true,
+      }),
+    ).rejects.toBeInstanceOf(ForbiddenException);
+  });
+
+  it("does not accept a policy when CLIENT_ID is not configured", async () => {
+    delete process.env.CLIENT_ID;
+
+    await expect(service.getCarBodyInquiry(userDetail)).rejects.toBeInstanceOf(
+      ServiceUnavailableException,
+    );
+  });
+
+  it("rejects a CAR_BODY policy from another insurer on the Parsian lookup route", async () => {
+    process.env.CLIENT_ID = "15";
+    process.env.FANAVARAN_CLIENT = "parsian";
+    externalInquirySettings.isInquiryLive.mockResolvedValue(true);
+    lookupsService.findLastProcessedCarPolicy.mockResolvedValue({
+      policy: { CINumber: "70019846985" },
+      customer: {},
+      vehicle: {},
+    });
+
+    await expect(service.getCarBodyInquiry(userDetail)).rejects.toBeInstanceOf(
+      ForbiddenException,
+    );
+  });
+
+  it("rejects a CAR_BODY policy from another insurer on the Tejarat lookup route", async () => {
+    process.env.CLIENT_ID = "15";
+    jest.spyOn(service, "getTejaratCarBodyInquiry").mockResolvedValue({
+      raw: { data: { companyId: "8" } },
+      mapped: { companyId: "8", CompanyCode: "8" },
+    });
+
+    await expect(service.getCarBodyInquiry(userDetail)).rejects.toBeInstanceOf(
+      ForbiddenException,
+    );
+  });
+
   it("uses the processed CAR_BODY lookup when the active Fanavaran client is Parsian", async () => {
     process.env.FANAVARAN_CLIENT = "parsian";
     externalInquirySettings.isInquiryLive.mockResolvedValue(true);

src/sand-hub/sand-hub.service.ts

@@ -2,6 +2,7 @@ import { HttpService } from "@nestjs/axios";
 import {
   BadGatewayException,
   BadRequestException,
+  ForbiddenException,
   GatewayTimeoutException,
   Injectable,
   Logger,
@@ -89,6 +90,60 @@ export class SandHubService {
     return resolveFanavaranClientKey() === "parsian";
   }
 
+  /**
+   * A case may proceed only when the policy belongs to the insurer served by
+   * this deployment. Callers opt in for the guilty/first-party policy only.
+   */
+  assertInsuranceMatchesDeployment(
+    mapped: Record<string, unknown> | null | undefined,
+    insuranceLine: "THIRD_PARTY" | "CAR_BODY",
+  ): void {
+    const expectedClientCode = String(process.env.CLIENT_ID ?? "").trim();
+    if (!expectedClientCode) {
+      throw new ServiceUnavailableException(
+        "CLIENT_ID must be configured before insurance eligibility can be checked.",
+      );
+    }
+
+    const actualClientCode = String(
+      mapped?.CompanyCode ?? mapped?.companyId ?? mapped?.CompanyId ?? "",
+    ).trim();
+    if (actualClientCode === expectedClientCode) return;
+
+    throw new ForbiddenException(
+      `${insuranceLine} policy insurer does not match this deployment.`,
+    );
+  }
+
+  private enforceDeploymentClientMatch(
+    mapped: Record<string, unknown>,
+    insuranceLine: "THIRD_PARTY" | "CAR_BODY",
+    options?: SandHubInquiryOptions,
+  ): void {
+    if (options?.enforceDeploymentClientMatch) {
+      this.assertInsuranceMatchesDeployment(mapped, insuranceLine);
+    }
+  }
+
+  /**
+   * The processed Fanavaran CAR_BODY endpoint is a Parsian-only source and its
+   * response does not contain a reliable insurer company code. Treat the source
+   * itself as proof that the returned policy is Parsian.
+   */
+  private assertParsianCarBodyLookupMatchesDeployment(): void {
+    const expectedClientCode = String(process.env.CLIENT_ID ?? "").trim();
+    if (!expectedClientCode) {
+      throw new ServiceUnavailableException(
+        "CLIENT_ID must be configured before insurance eligibility can be checked.",
+      );
+    }
+    if (expectedClientCode === "8") return;
+
+    throw new ForbiddenException(
+      "CAR_BODY policy insurer does not match this deployment.",
+    );
+  }
+
   /** Fixed plate/insurance inquiry payload used everywhere we mock block-inquiry style APIs. */
   private buildMockPlateInquiryRaw(
     ctx: MockInquiryCompanyContext,
@@ -779,6 +834,11 @@ export class SandHubService {
         ir: String(userDetail.plate.ir),
       });
       if (offlineHit) {
+        this.enforceDeploymentClientMatch(
+          offlineHit.mapped,
+          "THIRD_PARTY",
+          options,
+        );
         return {
           raw: offlineHit.raw,
           mapped: offlineHit.mapped,
@@ -818,6 +878,7 @@ export class SandHubService {
         );
       }
       const mapped = this.mapEsgPolicyByPlateToOldFormat(raw);
+      this.enforceDeploymentClientMatch(mapped, "THIRD_PARTY", options);
       return { raw, mapped };
     }
 
@@ -846,6 +907,7 @@ export class SandHubService {
       );
     }
     const mapped = this.mapNewApiResponseToOldFormat(raw);
+    this.enforceDeploymentClientMatch(mapped, "THIRD_PARTY", options);
     return { raw, mapped };
   }
 
@@ -874,6 +936,7 @@ export class SandHubService {
         userDetail as SandHubDetailDto,
         options,
       );
+      this.assertInsuranceMatchesDeployment(result.mapped, "CAR_BODY");
       return {
         source:
           typeof userDetail.plate === "string"
@@ -890,6 +953,7 @@ export class SandHubService {
         userDetail as SandHubDetailDto,
         options,
       );
+      this.assertParsianCarBodyLookupMatchesDeployment();
       return {
         source:
           typeof userDetail.plate === "string"
@@ -917,6 +981,7 @@ export class SandHubService {
       "car-body",
       query,
     );
+    this.assertParsianCarBodyLookupMatchesDeployment();
 
     return {
       source:
@@ -1057,6 +1122,7 @@ export class SandHubService {
         `[MOCK] getPolicyByChassisInquiry chassisNo=${chassisNo}`,
       );
       const mapped = this.mapEsgPolicyByPlateToOldFormat(raw);
+      this.enforceDeploymentClientMatch(mapped, "THIRD_PARTY", options);
       return { raw, mapped };
     }
 
@@ -1067,6 +1133,7 @@ export class SandHubService {
       options,
     );
     const mapped = this.mapEsgPolicyByPlateToOldFormat(raw);
+    this.enforceDeploymentClientMatch(mapped, "THIRD_PARTY", options);
     return { raw, mapped };
   }
 
@@ -1297,6 +1364,7 @@ export class SandHubService {
       }
 
       const result = this.mapNewApiResponseToOldFormat(response);
+      this.enforceDeploymentClientMatch(result, "THIRD_PARTY", options);
 
       // if (result.usgCod !== "8") {
       //   throw new Error("خودرو شما شخصی / سواری نمی باشد")
@@ -1304,6 +1372,12 @@ export class SandHubService {
 
       return result;
     } catch (err) {
+      if (
+        err instanceof ForbiddenException ||
+        err instanceof ServiceUnavailableException
+      ) {
+        throw err;
+      }
       throw new Error(err);
     }
   }