YARA-1259

src/request-management/request-management.service.ts

@@ -109,6 +109,10 @@ import {
   buildBlamePartyAccessOrConditions,
   collectUserIdVariants,
 } from "src/helpers/party-access-queries";
+import {
+  blameCaseTouchesClient,
+  requireActorClientKey,
+} from "src/helpers/tenant-scope";
 import { resolveLinkedUserIdStrings } from "src/helpers/user-access-resolver";
 import { normalizePlateText } from "src/utils/plate-normalizer/plate-normalizer.service";
 
@@ -4671,6 +4675,12 @@ export class RequestManagementService {
           "FileReviewer can only access V4/V5 FileMaker files.",
         );
       }
+      const clientKey = requireActorClientKey(expert);
+      if (!blameCaseTouchesClient(req, clientKey)) {
+        throw new ForbiddenException(
+          "This file does not belong to your organization.",
+        );
+      }
       if (
         req.status !== CaseStatus.WAITING_FOR_FILE_REVIEWER &&
         req.status !== CaseStatus.WAITING_FOR_EXPERT &&
@@ -11415,12 +11425,41 @@ export class RequestManagementService {
     if (fileReviewer?.role !== RoleEnum.FILE_REVIEWER) {
       throw new ForbiddenException("Only FileReviewers can use this endpoint.");
     }
+    const clientKey = requireActorClientKey(fileReviewer);
     const reviewerId = new Types.ObjectId(fileReviewer.sub);
     const files = await this.blameRequestDbService.find({
       isMadeByFileMaker: true,
-      assignedFileReviewerId: reviewerId,
+      expertInitiated: true,
+      creationMethod: CreationMethod.IN_PERSON,
+      $or: [
+        // A FileMaker-sealed file must be discoverable before a reviewer can
+        // claim it. Once another reviewer takes it, only that reviewer sees it.
+        {
+          status: CaseStatus.WAITING_FOR_FILE_REVIEWER,
+          $or: [
+            { assignedFileReviewerId: { $exists: false } },
+            { assignedFileReviewerId: null },
+          ],
+        },
+        { assignedFileReviewerId: reviewerId },
+      ],
     });
-    return (files || []).map((f: any) => ({
+    const visibleFiles = (files || []).filter((file: any) => {
+      const assignedReviewerId = file.assignedFileReviewerId
+        ? String(file.assignedFileReviewerId)
+        : null;
+      const isOpen =
+        file.status === CaseStatus.WAITING_FOR_FILE_REVIEWER &&
+        !assignedReviewerId;
+      const isAssignedToReviewer =
+        assignedReviewerId === String(fileReviewer.sub);
+      return (
+        blameCaseTouchesClient(file, clientKey) &&
+        (isOpen || isAssignedToReviewer)
+      );
+    });
+
+    return visibleFiles.map((f: any) => ({
       _id: f._id,
       publicId: f.publicId,
       requestNo: f.requestNo,
@@ -11442,17 +11481,33 @@ export class RequestManagementService {
     if (fileReviewer?.role !== RoleEnum.FILE_REVIEWER) {
       throw new ForbiddenException("Only FileReviewers can use this endpoint.");
     }
+    const clientKey = requireActorClientKey(fileReviewer);
     const req = await this.blameRequestDbService.findById(requestId);
     if (!req) throw new NotFoundException("Blame request not found");
-    if (!req.isMadeByFileMaker) {
+    if (
+      !req.isMadeByFileMaker ||
+      !req.expertInitiated ||
+      req.creationMethod !== CreationMethod.IN_PERSON
+    ) {
       throw new ForbiddenException("FileReviewer can only access V4/V5 FileMaker files.");
     }
+    if (!blameCaseTouchesClient(req, clientKey)) {
+      throw new ForbiddenException(
+        "This file does not belong to your organization.",
+      );
+    }
     const assignedId = (req as any).assignedFileReviewerId
       ? String((req as any).assignedFileReviewerId)
       : null;
     if (assignedId && assignedId !== String(fileReviewer.sub)) {
       throw new ForbiddenException("This file has been taken by another FileReviewer.");
     }
+    if (
+      !assignedId &&
+      req.status !== CaseStatus.WAITING_FOR_FILE_REVIEWER
+    ) {
+      throw new ForbiddenException("This file is not available for review.");
+    }
     const plain = typeof (req as any).toObject === "function"
       ? (req as any).toObject({ versionKey: false })
       : { ...(req as any) };