From dcc3ee71dec9ca5cbb9964e33972d29c974cdb43 Mon Sep 17 00:00:00 2001 From: Sepehr Yahyaee Date: Thu, 18 Jun 2026 18:15:20 +0330 Subject: [PATCH] Fixed GET users --- package.json | 3 + .../claim-request-management.service.ts | 86 ++++++++++-------- src/expert-blame/expert-blame.service.ts | 32 ++----- .../expert-blame.v2.controller.ts | 3 +- src/expert-claim/expert-claim.service.ts | 58 ++++++++++--- .../expert-claim.v2.controller.ts | 3 +- src/helpers/party-access-queries.spec.ts | 61 +++++++++++++ src/helpers/party-access-queries.ts | 87 +++++++++++++++++++ src/helpers/tenant-scope.spec.ts | 86 ++++++++++++++++++ src/helpers/tenant-scope.ts | 32 ++++--- .../request-management.service.ts | 20 +---- 11 files changed, 368 insertions(+), 103 deletions(-) create mode 100644 src/helpers/party-access-queries.spec.ts create mode 100644 src/helpers/party-access-queries.ts create mode 100644 src/helpers/tenant-scope.spec.ts diff --git a/package.json b/package.json index 7920a6b..6bfcf3c 100644 --- a/package.json +++ b/package.json @@ -84,6 +84,9 @@ "transform": { "^.+\\.(t|j)s$": "ts-jest" }, + "moduleNameMapper": { + "^src/(.*)$": "/$1" + }, "collectCoverageFrom": [ "**/*.(t|j)s" ], diff --git a/src/claim-request-management/claim-request-management.service.ts b/src/claim-request-management/claim-request-management.service.ts index d50834f..13ee9c2 100644 --- a/src/claim-request-management/claim-request-management.service.ts +++ b/src/claim-request-management/claim-request-management.service.ts @@ -60,6 +60,11 @@ import { import { ListQueryV2Dto } from "src/common/dto/list-query-v2.dto"; import { applyListQueryV2 } from "src/helpers/list-query-v2"; import { partyPersonMatchesUser } from "src/helpers/iran-mobile"; +import { + buildBlamePartyAccessOrConditions, + mongoUserIdEqualityFilter, +} from "src/helpers/party-access-queries"; +import { claimCaseInitiatedByFieldExpert } from "src/helpers/tenant-scope"; import { ClaimDetailsV2ResponseDto } from "./dto/claim-details-v2.dto"; import { ClaimCaseStatus } from "src/Types&Enums/claim-request-management/claim-case-status.enum"; import { ClaimRequiredDocumentType } from "src/Types&Enums/claim-request-management/required-document-type.enum"; @@ -4201,21 +4206,16 @@ export class ClaimRequestManagementService { } if (actor?.role === RoleEnum.FIELD_EXPERT) { - if (claim.initiatedByFieldExpertId?.toString() === currentUserId) { + const blame = claim.blameRequestId + ? await this.blameRequestDbService.findById( + claim.blameRequestId.toString(), + ) + : null; + if ( + claimCaseInitiatedByFieldExpert(claim, { sub: currentUserId }, blame) + ) { return; } - if (claim.blameRequestId) { - const blame = await this.blameRequestDbService.findById( - claim.blameRequestId.toString(), - ); - if ( - blame?.expertInitiated && - blame.initiatedByFieldExpertId && - String(blame.initiatedByFieldExpertId) === currentUserId - ) { - return; - } - } } if (actor?.role === RoleEnum.REGISTRAR && claim.blameRequestId) { @@ -6580,25 +6580,24 @@ export class ClaimRequestManagementService { try { let claims: any[]; if (actor?.role === RoleEnum.FIELD_EXPERT) { + const expertOid = new Types.ObjectId(currentUserId); const expertBlameIds = await this.blameRequestDbService .find( { expertInitiated: true, - initiatedByFieldExpertId: new Types.ObjectId(currentUserId), + initiatedByFieldExpertId: expertOid, }, { select: "_id", lean: true }, ) .then((docs) => docs.map((d) => (d as any)._id)); + const claimOr: Record[] = [ + { initiatedByFieldExpertId: expertOid }, + ]; + if (expertBlameIds.length > 0) { + claimOr.push({ blameRequestId: { $in: expertBlameIds } }); + } claims = await this.claimCaseDbService.find( - { - $or: [ - { "owner.userId": new Types.ObjectId(currentUserId) }, - ...(expertBlameIds.length - ? [{ blameRequestId: { $in: expertBlameIds } }] - : []), - { initiatedByFieldExpertId: new Types.ObjectId(currentUserId) }, - ], - }, + { $or: claimOr }, { lean: true }, ); } else if (actor?.role === RoleEnum.REGISTRAR) { @@ -6624,27 +6623,38 @@ export class ClaimRequestManagementService { { lean: true }, ); } else { + const partyBlameOr = buildBlamePartyAccessOrConditions({ + sub: currentUserId, + username: (actor as { username?: string })?.username, + }); const partyBlameIds = await this.blameRequestDbService .find( - { - $or: [ - { "parties.person.userId": new Types.ObjectId(currentUserId) }, - ], - }, + partyBlameOr.length === 1 + ? (partyBlameOr[0] as any) + : ({ $or: partyBlameOr } as any), { select: "_id", lean: true }, ) .then((docs) => docs.map((d) => (d as any)._id)); - claims = await this.claimCaseDbService.find( - { - $or: [ - { "owner.userId": new Types.ObjectId(currentUserId) }, - ...(partyBlameIds.length - ? [{ blameRequestId: { $in: partyBlameIds } }] - : []), - ], - }, - { lean: true }, + + const ownerOr = mongoUserIdEqualityFilter( + "owner.userId", + currentUserId, ); + const claimOr: Record[] = []; + if (ownerOr) claimOr.push(ownerOr); + if (partyBlameIds.length) { + claimOr.push({ blameRequestId: { $in: partyBlameIds } }); + } + + claims = + claimOr.length === 0 + ? [] + : await this.claimCaseDbService.find( + claimOr.length === 1 + ? (claimOr[0] as any) + : ({ $or: claimOr } as any), + { lean: true }, + ); } const list = (claims as any[]).map((c) => ({ claimRequestId: c._id.toString(), diff --git a/src/expert-blame/expert-blame.service.ts b/src/expert-blame/expert-blame.service.ts index 6541d88..ed3927e 100644 --- a/src/expert-blame/expert-blame.service.ts +++ b/src/expert-blame/expert-blame.service.ts @@ -437,9 +437,9 @@ export class ExpertBlameService { } /** - * Blame review inbox for FIELD_EXPERT — expert-initiated DISAGREEMENT files. - * Covers LINK flows (parties complete via link → WAITING_FOR_EXPERT) and in-progress - * disputes while parties are still filling. IN_PERSON AGREED blames use expert-claim instead. + * Blame inbox for FIELD_EXPERT — all expert-initiated blame files they created + * (LINK disputes, IN_PERSON, in-progress and completed). Claim work is usually + * via expert-claim after blame completion. */ private async getFieldExpertBlameListV2( actor: { sub: string }, @@ -452,23 +452,6 @@ export class ExpertBlameService { { expertInitiated: true, initiatedByFieldExpertId: expertOid, - blameStatus: BlameStatus.DISAGREEMENT, - type: { $ne: BlameRequestType.CAR_BODY }, - $or: [ - { status: CaseStatus.WAITING_FOR_EXPERT }, - { - status: { - $in: [ - CaseStatus.OPEN, - CaseStatus.WAITING_FOR_SECOND_PARTY, - CaseStatus.WAITING_FOR_DOCUMENT_RESEND, - ], - }, - }, - { "workflow.lockedBy.actorId": expertOid }, - { "workflow.assignedForReviewBy.actorId": expertOid }, - { "expert.decision.decidedByExpertId": expertOid }, - ], }, { lean: true }, )) as Record[]; @@ -967,7 +950,12 @@ export class ExpertBlameService { // Tenant check assertBlameCaseForExpertTenant(doc, actor); - if (doc.type === BlameRequestType.CAR_BODY) { + const isFieldExpertOwner = blameCaseInitiatedByFieldExpert(doc, actor); + + if ( + doc.type === BlameRequestType.CAR_BODY && + !isFieldExpertOwner + ) { throw new ForbiddenException( "CAR_BODY type requests are automatically handled and do not require expert review.", ); @@ -984,8 +972,6 @@ export class ExpertBlameService { ); } - const isFieldExpertOwner = blameCaseInitiatedByFieldExpert(doc, actor); - const decision = (doc.expert as any)?.decision; const decidedByExpertId = decision?.decidedByExpertId ? String(decision.decidedByExpertId) diff --git a/src/expert-blame/expert-blame.v2.controller.ts b/src/expert-blame/expert-blame.v2.controller.ts index 864c689..7680d87 100644 --- a/src/expert-blame/expert-blame.v2.controller.ts +++ b/src/expert-blame/expert-blame.v2.controller.ts @@ -43,8 +43,7 @@ export class ExpertBlameV2Controller { summary: "List blame cases for expert review (V2)", description: "Damage experts (`expert`): tenant-scoped **DISAGREEMENT** queue (available, locked, or decided by you). " + - "Field experts (`field_expert`): expert-initiated **DISAGREEMENT** files — including **LINK** flows where parties complete via link and the case moves to `WAITING_FOR_EXPERT` for your review. " + - "IN_PERSON expert-initiated blames are usually `AGREED` and are managed via expert-initiated / request-management APIs; after completion, use expert-claim. " + + "Field experts (`field_expert`): all expert-initiated blame files they created (LINK + IN_PERSON). Use expert-claim for claims after blame completion. " + "Optional query: `search`, `sortBy` (publicId | createdAt | requestNo | status), `sortOrder`, `page`, `limit`.", }) async findAll( diff --git a/src/expert-claim/expert-claim.service.ts b/src/expert-claim/expert-claim.service.ts index bc8853b..68d9ea2 100644 --- a/src/expert-claim/expert-claim.service.ts +++ b/src/expert-claim/expert-claim.service.ts @@ -339,6 +339,28 @@ export class ExpertClaimService { return ev; } + /** Load linked blame when resolving field-expert ownership on a claim. */ + private async loadBlameForClaim( + claim: { blameRequestId?: unknown } | null | undefined, + ) { + const id = claim?.blameRequestId?.toString?.(); + if (!id) return null; + return this.blameRequestDbService.findById(id); + } + + private async assertExpertActorOnClaim(claim: any, actor: any): Promise { + const blame = await this.loadBlameForClaim(claim); + assertClaimCaseForExpertActor(claim, actor, blame); + } + + private async fieldExpertOwnsClaim( + claim: any, + actor: { sub: string }, + ): Promise { + const blame = await this.loadBlameForClaim(claim); + return claimCaseInitiatedByFieldExpert(claim, actor, blame); + } + /** Load immutable profile fields from `damage-expert` for the acting expert. */ private async snapshotDamageExpert(actorId: string) { const doc = await this.damageExpertDbService.findById(actorId); @@ -2151,7 +2173,7 @@ export class ExpertClaimService { throw new NotFoundException("Claim request not found"); } - assertClaimCaseForExpertActor(claim, actor); + await this.assertExpertActorOnClaim(claim, actor); const factorValidationSnapshot = await this.snapshotDamageExpert(actor.sub); @@ -2402,11 +2424,11 @@ export class ExpertClaimService { throw new NotFoundException("Claim request not found"); } - assertClaimCaseForExpertActor(claim, actor); + await this.assertExpertActorOnClaim(claim, actor); const isFieldExpertOwner = (actor as any).role === RoleEnum.FIELD_EXPERT && - claimCaseInitiatedByFieldExpert(claim, actor); + (await this.fieldExpertOwnsClaim(claim, actor)); const isFactorValidationLock = claimIsAwaitingExpertFactorValidationV2(claim); const isDamageReviewLock = @@ -2745,7 +2767,7 @@ export class ExpertClaimService { throw new NotFoundException("Claim request not found"); } - assertClaimCaseForExpertActor(claim, actor); + await this.assertExpertActorOnClaim(claim, actor); if (claim.status !== ClaimCaseStatus.EXPERT_REVIEWING) { throw new BadRequestException( @@ -2910,7 +2932,7 @@ export class ExpertClaimService { throw new NotFoundException("Claim request not found"); } - assertClaimCaseForExpertActor(claim, actor); + await this.assertExpertActorOnClaim(claim, actor); if (claim.status !== ClaimCaseStatus.EXPERT_REVIEWING) { throw new BadRequestException( @@ -3579,8 +3601,23 @@ export class ExpertClaimService { actor: any, query: ListQueryV2Dto = {}, ): Promise { + const expertOid = new Types.ObjectId(actor.sub); + const expertBlameIds = await this.blameRequestDbService + .find( + { expertInitiated: true, initiatedByFieldExpertId: expertOid }, + { select: "_id", lean: true }, + ) + .then((docs) => docs.map((d) => (d as { _id: unknown })._id)); + + const claimOr: Record[] = [ + { initiatedByFieldExpertId: expertOid }, + ]; + if (expertBlameIds.length > 0) { + claimOr.push({ blameRequestId: { $in: expertBlameIds } }); + } + const claims = (await this.claimCaseDbService.find({ - initiatedByFieldExpertId: new Types.ObjectId(actor.sub), + $or: claimOr, })) as any[]; const blameIds = [ @@ -4008,7 +4045,8 @@ export class ExpertClaimService { throw new NotFoundException("Claim request not found"); } - assertClaimCaseForExpertActor(claim, actor); + const linkedBlame = await this.loadBlameForClaim(claim); + assertClaimCaseForExpertActor(claim, actor, linkedBlame); // Variables used both in the gate block and in the detail-build section below const isDamageExpertPhase = @@ -4019,7 +4057,7 @@ export class ExpertClaimService { // Field experts can always view their own initiated claims regardless of status if (actor.role === RoleEnum.FIELD_EXPERT) { - if (!claimCaseInitiatedByFieldExpert(claim, actor)) { + if (!claimCaseInitiatedByFieldExpert(claim, actor, linkedBlame)) { throw new ForbiddenException("This claim was not initiated by you."); } // Fall through to the detail build below (skip the damage-expert gate) @@ -4317,7 +4355,7 @@ export class ExpertClaimService { /** V2 price-drop: claim locked by this expert during damage assessment. */ private assertExpertCanEditClaimDuringReviewV2(claim: any, actor: any): void { if (actor.role !== RoleEnum.FIELD_EXPERT) requireActorClientKey(actor); - assertClaimCaseForExpertActor(claim, actor); + await this.assertExpertActorOnClaim(claim, actor); if (claim.status !== ClaimCaseStatus.EXPERT_REVIEWING) { throw new BadRequestException( `Claim must be EXPERT_REVIEWING to edit price drop. Current status: ${claim.status}`, @@ -4551,7 +4589,7 @@ export class ExpertClaimService { if (!claim) { throw new NotFoundException("Claim request not found"); } - assertClaimCaseForExpertActor(claim, actor); + await this.assertExpertActorOnClaim(claim, actor); if (claim.status !== ClaimCaseStatus.EXPERT_REVIEWING) { throw new BadRequestException( `Claim is not in EXPERT_REVIEWING state. Current status: ${claim.status}`, diff --git a/src/expert-claim/expert-claim.v2.controller.ts b/src/expert-claim/expert-claim.v2.controller.ts index f774c31..9bb33dd 100644 --- a/src/expert-claim/expert-claim.v2.controller.ts +++ b/src/expert-claim/expert-claim.v2.controller.ts @@ -115,7 +115,8 @@ export class ExpertClaimV2Controller { @ApiOperation({ summary: "List available claim requests for damage expert", description: - "Returns claims that are WAITING_FOR_DAMAGE_EXPERT and not locked by another expert, this expert's locked/in-progress claims, and claims awaiting factor validation. Optional query: `search`, `sortBy` (publicId | createdAt | requestNo | status), `sortOrder`, `page`, `limit`. Without `page`/`limit`, returns the full filtered list.", + "Damage experts: tenant queue (`WAITING_FOR_DAMAGE_EXPERT`), locked/in-progress, factor validation. " + + "Field experts: all claims linked to blame files they initiated (`initiatedByFieldExpertId` or matching `blameRequestId`). Optional query: `search`, `sortBy`, `sortOrder`, `page`, `limit`.", }) @ApiResponse({ status: 200, type: GetClaimListV2ResponseDto }) async getClaimListV2( diff --git a/src/helpers/party-access-queries.spec.ts b/src/helpers/party-access-queries.spec.ts new file mode 100644 index 0000000..1b2faad --- /dev/null +++ b/src/helpers/party-access-queries.spec.ts @@ -0,0 +1,61 @@ +import { Types } from "mongoose"; +import { partyPersonMatchesUser } from "./iran-mobile"; +import { + buildBlamePartyAccessOrConditions, + mongoUserIdEqualityFilter, +} from "./party-access-queries"; + +describe("party access queries", () => { + const userId = new Types.ObjectId(); + + describe("mongoUserIdEqualityFilter", () => { + it("includes both ObjectId and string forms", () => { + const filter = mongoUserIdEqualityFilter( + "parties.person.userId", + String(userId), + ); + expect(filter).toEqual({ + $or: [ + { "parties.person.userId": String(userId) }, + { "parties.person.userId": userId }, + ], + }); + }); + }); + + describe("buildBlamePartyAccessOrConditions", () => { + it("builds userId and phone branches", () => { + const or = buildBlamePartyAccessOrConditions({ + sub: String(userId), + username: "09123456789", + }); + expect(or).toHaveLength(2); + expect(or[0]).toHaveProperty("$or"); + expect(or[1]).toEqual({ + "parties.person.phoneNumber": { + $in: expect.arrayContaining(["09123456789", "9123456789"]), + }, + }); + }); + }); + + describe("partyPersonMatchesUser", () => { + it("matches party userId stored as ObjectId against string JWT sub", () => { + expect( + partyPersonMatchesUser( + { userId, phoneNumber: "09111111111" }, + { sub: String(userId), username: "09999999999" }, + ), + ).toBe(true); + }); + + it("matches phone variants when userId is not set yet", () => { + expect( + partyPersonMatchesUser( + { phoneNumber: "9123456789" }, + { sub: "other", username: "09123456789" }, + ), + ).toBe(true); + }); + }); +}); diff --git a/src/helpers/party-access-queries.ts b/src/helpers/party-access-queries.ts new file mode 100644 index 0000000..17d64d4 --- /dev/null +++ b/src/helpers/party-access-queries.ts @@ -0,0 +1,87 @@ +import { Types } from "mongoose"; +import { RoleEnum } from "src/Types&Enums/role.enum"; +import { iranMobileLookupVariants } from "./iran-mobile"; + +/** + * Mongo filter matching a user id field stored as ObjectId or legacy string. + */ +export function mongoUserIdEqualityFilter( + fieldPath: string, + userSub: string, +): Record | null { + if (!userSub) return null; + const variants: unknown[] = [userSub]; + if (Types.ObjectId.isValid(userSub)) { + variants.push(new Types.ObjectId(userSub)); + } + if (variants.length === 1) { + return { [fieldPath]: variants[0] }; + } + return { $or: variants.map((v) => ({ [fieldPath]: v })) }; +} + +/** `$or` branches: user is a party on a blame case (by userId and/or phone). */ +export function buildBlamePartyAccessOrConditions(user: { + sub?: string; + username?: string; +}): Record[] { + const or: Record[] = []; + const userIdCond = user?.sub + ? mongoUserIdEqualityFilter("parties.person.userId", user.sub) + : null; + if (userIdCond) or.push(userIdCond); + + const phoneVariants = user?.username + ? iranMobileLookupVariants(user.username) + : []; + if (phoneVariants.length > 0) { + or.push({ "parties.person.phoneNumber": { $in: phoneVariants } }); + } + return or; +} + +/** `$or` branches: user owns a claim or is tied via blame party membership. */ +export function buildClaimOwnerAccessOrConditions( + userSub: string, + username?: string, +): Record[] { + const or: Record[] = []; + const ownerIdCond = mongoUserIdEqualityFilter("owner.userId", userSub); + if (ownerIdCond) or.push(ownerIdCond); + return or; +} + +export function buildFieldExpertInitiatedBlameFilter( + expertSub: string, +): Record { + const expertOid = Types.ObjectId.isValid(expertSub) + ? new Types.ObjectId(expertSub) + : expertSub; + return { + expertInitiated: true, + initiatedByFieldExpertId: expertOid, + }; +} + +export function buildFieldExpertClaimAccessOrConditions( + expertSub: string, + expertBlameIds: unknown[], +): Record[] { + const expertOid = Types.ObjectId.isValid(expertSub) + ? new Types.ObjectId(expertSub) + : expertSub; + const or: Record[] = [ + { initiatedByFieldExpertId: expertOid }, + ]; + if (expertBlameIds.length > 0) { + or.push({ blameRequestId: { $in: expertBlameIds } }); + } + return or; +} + +/** True when actor is the field expert who initiated this blame (any JWT shape). */ +export function actorIsFieldExpertInitiator( + actor: { sub?: string; role?: string } | null | undefined, +): boolean { + return actor?.role === RoleEnum.FIELD_EXPERT && !!actor?.sub; +} diff --git a/src/helpers/tenant-scope.spec.ts b/src/helpers/tenant-scope.spec.ts new file mode 100644 index 0000000..f89e02c --- /dev/null +++ b/src/helpers/tenant-scope.spec.ts @@ -0,0 +1,86 @@ +import { Types } from "mongoose"; +import { + blameCaseInitiatedByFieldExpert, + claimCaseInitiatedByFieldExpert, +} from "./tenant-scope"; + +describe("field expert ownership helpers", () => { + const expertId = new Types.ObjectId(); + const otherExpertId = new Types.ObjectId(); + const blameId = new Types.ObjectId(); + + describe("blameCaseInitiatedByFieldExpert", () => { + it("matches when initiatedByFieldExpertId equals actor.sub (string)", () => { + expect( + blameCaseInitiatedByFieldExpert( + { + expertInitiated: true, + initiatedByFieldExpertId: expertId, + }, + { sub: String(expertId) }, + ), + ).toBe(true); + }); + + it("does not require actor.role on JWT", () => { + expect( + blameCaseInitiatedByFieldExpert( + { + expertInitiated: true, + initiatedByFieldExpertId: expertId, + }, + { sub: String(expertId) }, + ), + ).toBe(true); + }); + + it("rejects another expert", () => { + expect( + blameCaseInitiatedByFieldExpert( + { + expertInitiated: true, + initiatedByFieldExpertId: expertId, + }, + { sub: String(otherExpertId) }, + ), + ).toBe(false); + }); + }); + + describe("claimCaseInitiatedByFieldExpert", () => { + it("matches claim.initiatedByFieldExpertId", () => { + expect( + claimCaseInitiatedByFieldExpert( + { initiatedByFieldExpertId: expertId }, + { sub: String(expertId) }, + ), + ).toBe(true); + }); + + it("matches via linked expert-initiated blame when claim field is missing", () => { + expect( + claimCaseInitiatedByFieldExpert( + { blameRequestId: blameId }, + { sub: String(expertId) }, + { + expertInitiated: true, + initiatedByFieldExpertId: expertId, + }, + ), + ).toBe(true); + }); + + it("rejects when neither claim nor blame links to actor", () => { + expect( + claimCaseInitiatedByFieldExpert( + { blameRequestId: blameId }, + { sub: String(expertId) }, + { + expertInitiated: true, + initiatedByFieldExpertId: otherExpertId, + }, + ), + ).toBe(false); + }); + }); +}); diff --git a/src/helpers/tenant-scope.ts b/src/helpers/tenant-scope.ts index 2c2ae8d..13dab4a 100644 --- a/src/helpers/tenant-scope.ts +++ b/src/helpers/tenant-scope.ts @@ -1,5 +1,4 @@ import { BadRequestException, ForbiddenException } from "@nestjs/common"; -import { RoleEnum } from "src/Types&Enums/role.enum"; /** Insurance company tenant id on the actor JWT (Mongo ObjectId string). */ export function requireActorClientKey(actor: { clientKey?: string }): string { @@ -65,13 +64,12 @@ export function blameCaseAccessibleToExpert( return blameCaseTouchesClient(doc, ck); } -/** True when the acting field expert created this expert-initiated blame file. */ +/** True when `actor` is the field expert who created this expert-initiated blame file. */ export function blameCaseInitiatedByFieldExpert( doc: any, - actor: { sub: string; role?: string }, + actor: { sub: string }, ): boolean { return ( - actor.role === RoleEnum.FIELD_EXPERT && !!doc?.expertInitiated && !!doc?.initiatedByFieldExpertId && String(doc.initiatedByFieldExpertId) === String(actor.sub) @@ -102,28 +100,40 @@ export function assertClaimCaseForTenant( } /** - * Returns true when a field expert (no clientKey) initiated this claim via an - * expert-initiated IN_PERSON blame file. + * True when the field expert initiated this claim directly or via the linked + * expert-initiated blame file (`blameRequestId` → blame.initiatedByFieldExpertId). */ export function claimCaseInitiatedByFieldExpert( doc: any, actor: { sub: string }, + blame?: { expertInitiated?: boolean; initiatedByFieldExpertId?: unknown } | null, ): boolean { - return ( - !!doc.initiatedByFieldExpertId && + if ( + doc?.initiatedByFieldExpertId && String(doc.initiatedByFieldExpertId) === String(actor.sub) - ); + ) { + return true; + } + if ( + blame?.expertInitiated && + blame?.initiatedByFieldExpertId && + String(blame.initiatedByFieldExpertId) === String(actor.sub) + ) { + return true; + } + return false; } /** * Authorization check that works for both damage experts (clientKey tenant - * scope) and field experts (initiatedByFieldExpertId ownership). + * scope) and field experts (initiatedByFieldExpertId / linked blame ownership). */ export function assertClaimCaseForExpertActor( doc: any, actor: { sub: string; clientKey?: string }, + blame?: { expertInitiated?: boolean; initiatedByFieldExpertId?: unknown } | null, ): void { - if (claimCaseInitiatedByFieldExpert(doc, actor)) return; + if (claimCaseInitiatedByFieldExpert(doc, actor, blame)) return; assertClaimCaseForTenant(doc, actor); } diff --git a/src/request-management/request-management.service.ts b/src/request-management/request-management.service.ts index 9ca5a00..6a76763 100644 --- a/src/request-management/request-management.service.ts +++ b/src/request-management/request-management.service.ts @@ -97,6 +97,7 @@ import { normalizeIranMobile, partyPersonMatchesUser, } from "src/helpers/iran-mobile"; +import { buildBlamePartyAccessOrConditions } from "src/helpers/party-access-queries"; @Injectable() export class RequestManagementService { @@ -5028,24 +5029,7 @@ export class RequestManagementService { query: ListQueryV2Dto = {}, ): Promise { try { - const userIdFilter = - user?.sub && Types.ObjectId.isValid(user.sub) - ? { "parties.person.userId": new Types.ObjectId(user.sub) } - : null; - const phoneVariants = - user?.role === RoleEnum.USER && user?.username - ? iranMobileLookupVariants(user.username) - : user?.username - ? [user.username] - : []; - const phoneFilter = - phoneVariants.length > 0 - ? { "parties.person.phoneNumber": { $in: phoneVariants } } - : null; - - const orConditions: Record[] = []; - if (userIdFilter) orConditions.push(userIdFilter); - if (phoneFilter) orConditions.push(phoneFilter); + const orConditions = buildBlamePartyAccessOrConditions(user); if (user?.role === RoleEnum.FIELD_EXPERT && user?.sub) { orConditions.push({