diff --git a/src/expert-claim/expert-claim.service.ts b/src/expert-claim/expert-claim.service.ts index b80c82d..cd7cd12 100644 --- a/src/expert-claim/expert-claim.service.ts +++ b/src/expert-claim/expert-claim.service.ts @@ -4266,6 +4266,7 @@ export class ExpertClaimService { const blameIds = makerBlames.map((b) => b._id); const claims = (await this.claimCaseDbService.find({ blameRequestId: { $in: blameIds }, + requiresFileMakerApproval: true, })) as any[]; const blameById = new Map( @@ -4690,7 +4691,8 @@ export class ExpertClaimService { const isFactorValidationPending = claimIsAwaitingExpertFactorValidationV2(claim); - // FileMaker: can always view their own V4 files at any status. + // FileMaker: can only view V5 files (requiresFileMakerApproval: true) that they created. + // V4 files do not require FileMaker approval and must not appear in their panel. if (actor.role === RoleEnum.FILE_MAKER) { const isOwn = claimCaseInitiatedByFieldExpert(claim, actor, linkedBlame); if (!isOwn) { @@ -4698,6 +4700,11 @@ export class ExpertClaimService { "FileMakers can only view files they created.", ); } + if (!(claim as any).requiresFileMakerApproval) { + throw new ForbiddenException( + "This file does not require FileMaker approval.", + ); + } // Fall through to the detail build below } else if ( // Field experts and FileReviewers can view IN_PERSON expert-initiated claims