forked from Yara724/api
Fixed a bug where file makers would be able to view v4 files as well as v5 ones
This commit is contained in:
@@ -4266,6 +4266,7 @@ export class ExpertClaimService {
|
||||
const blameIds = makerBlames.map((b) => b._id);
|
||||
const claims = (await this.claimCaseDbService.find({
|
||||
blameRequestId: { $in: blameIds },
|
||||
requiresFileMakerApproval: true,
|
||||
})) as any[];
|
||||
|
||||
const blameById = new Map<string, any>(
|
||||
@@ -4690,7 +4691,8 @@ export class ExpertClaimService {
|
||||
const isFactorValidationPending =
|
||||
claimIsAwaitingExpertFactorValidationV2(claim);
|
||||
|
||||
// FileMaker: can always view their own V4 files at any status.
|
||||
// FileMaker: can only view V5 files (requiresFileMakerApproval: true) that they created.
|
||||
// V4 files do not require FileMaker approval and must not appear in their panel.
|
||||
if (actor.role === RoleEnum.FILE_MAKER) {
|
||||
const isOwn = claimCaseInitiatedByFieldExpert(claim, actor, linkedBlame);
|
||||
if (!isOwn) {
|
||||
@@ -4698,6 +4700,11 @@ export class ExpertClaimService {
|
||||
"FileMakers can only view files they created.",
|
||||
);
|
||||
}
|
||||
if (!(claim as any).requiresFileMakerApproval) {
|
||||
throw new ForbiddenException(
|
||||
"This file does not require FileMaker approval.",
|
||||
);
|
||||
}
|
||||
// Fall through to the detail build below
|
||||
} else if (
|
||||
// Field experts and FileReviewers can view IN_PERSON expert-initiated claims
|
||||
|
||||
Reference in New Issue
Block a user