Use FileMaker and FileReviewer Fanavaran expert ids on V4/V5 flows.

Block file create and review when the matching third-party or car-body code is missing, and override GEN.03/GEN.06 ClaimExpertId from those profiles instead of tenant defaults.

Co-authored-by: Cursor <cursoragent@cursor.com>

src/request-management/request-management.service.ts

@@ -52,6 +52,12 @@ import { StepsEnum } from "src/Types&Enums/blame-request-management/steps.enum";
 import { ExpertDbService } from "src/users/entities/db-service/expert.db.service";
 import { UserDbService } from "src/users/entities/db-service/user.db.service";
 import { FanavaranLocationService } from "src/fanavaran/fanavaran-location.service";
+import {
+  assertFileMakerCanCreateBlameType,
+  assertFileReviewerCanReviewBlameType,
+} from "src/fanavaran/fanavaran-file-role-expert-ids";
+import { FileMakerDbService } from "src/users/entities/db-service/file-maker.db.service";
+import { FileReviewerDbService } from "src/users/entities/db-service/file-reviewer.db.service";
 import { isOtpExpiryActive } from "src/helpers/user-otp-expiry";
 import { parseIranLocalDateTime } from "src/helpers/iran-datetime";
 import { applyListQueryV2 } from "src/helpers/list-query-v2";
@@ -1088,6 +1094,8 @@ export class RequestManagementService {
     private readonly hashService: HashService,
     private readonly userAuthService: UserAuthService,
     private readonly fanavaranLocationService: FanavaranLocationService,
+    private readonly fileMakerDbService: FileMakerDbService,
+    private readonly fileReviewerDbService: FileReviewerDbService,
   ) {}
 
   /**
@@ -5325,6 +5333,14 @@ export class RequestManagementService {
           "This file has been taken by another FileReviewer.",
         );
       }
+      const fileReviewer = await this.fileReviewerDbService.findById(
+        String(expert.sub),
+      );
+      if (!fileReviewer) {
+        throw new ForbiddenException("FileReviewer account not found.");
+      }
+      assertFileReviewerCanReviewBlameType(fileReviewer, req.type);
+
       if (!assignedId) {
         // Atomically claim — ignore if another reviewer won the race (they would have
         // been caught by the assignedId check above on their own first call).
@@ -5633,6 +5649,13 @@ export class RequestManagementService {
     }
 
     const isFileMakerRole = (expert as any)?.role === RoleEnum.FILE_MAKER;
+    if (isFileMakerRole) {
+      const fileMaker = await this.fileMakerDbService.findById(String(expert.sub));
+      if (!fileMaker) {
+        throw new ForbiddenException("FileMaker account not found.");
+      }
+      assertFileMakerCanCreateBlameType(fileMaker, type);
+    }
     const created = await this.blameRequestDbService.create({
       publicId,
       requestNo: publicId,