YARA-898

src/request-management/expert-initiated.v2.controller.ts

@@ -24,6 +24,7 @@ import { LocalActorAuthGuard } from "src/auth/guards/actor-local.guard";
 import { RolesGuard } from "src/auth/guards/role.guard";
 import { CurrentUser } from "src/decorators/user.decorator";
 import { Roles } from "src/decorators/roles.decorator";
+import { MediaPolicyService } from "src/media-policy/media-policy.service";
 import { RoleEnum } from "src/Types&Enums/role.enum";
 import { RequestManagementService } from "./request-management.service";
 import { CreateExpertInitiatedFileDto } from "./dto/expert-initiated.dto";
@@ -53,6 +54,7 @@ export class ExpertInitiatedV2Controller {
   constructor(
     private readonly requestManagementService: RequestManagementService,
     private readonly claimRequestManagementService: ClaimRequestManagementService,
+    private readonly mediaPolicyService: MediaPolicyService,
   ) {}
 
   @Get("my-files")
@@ -393,6 +395,7 @@ export class ExpertInitiatedV2Controller {
     @Param("requestId") requestId: string,
     @UploadedFile() file?: Express.Multer.File,
   ) {
+    await this.mediaPolicyService.assertForBlame(file, requestId, "video");
     return this.requestManagementService.expertUploadVideoForBlameV2(
       expert,
       requestId,
@@ -432,6 +435,7 @@ export class ExpertInitiatedV2Controller {
     @Param("requestId") requestId: string,
     @UploadedFile() voice?: Express.Multer.File,
   ) {
+    await this.mediaPolicyService.assertForBlame(voice, requestId, "voice");
     return this.requestManagementService.expertUploadVoiceForBlameV2(
       expert,
       requestId,
@@ -497,6 +501,8 @@ export class ExpertInitiatedV2Controller {
     @Body() body: { partyRole?: string; isAccept?: string | boolean },
     @UploadedFile() sign?: Express.Multer.File,
   ) {
+    await this.mediaPolicyService.assertForBlame(sign, requestId, "image");
+
     const partyRole = (body.partyRole === "FIRST" || body.partyRole === "SECOND")
       ? body.partyRole
       : ("FIRST" as const);

src/request-management/request-management.module.ts

@@ -15,6 +15,7 @@ import { HashModule } from "src/utils/hash/hash.module";
 import { SmsOrchestrationModule } from "src/sms-orchestration/sms-orchestration.module";
 import { WorkflowStepManagementModule } from "src/workflow-step-management/workflow-step-management.module";
 import { AuthModule } from "src/auth/auth.module";
+import { MediaPolicyModule } from "src/media-policy/media-policy.module";
 import { BlameDocumentDbService } from "./entities/db-service/blame-document.db.service";
 import { BlameVoiceDbService } from "./entities/db-service/blame.voice.db.service";
 import { UserSignDbService } from "./entities/db-service/sign.db.service";
@@ -64,6 +65,7 @@ import { RegistrarInitiatedController } from "./registrar-initiated.controller";
     forwardRef(() => ClaimRequestManagementModule),
     CronModule,
     AuthModule,
+    MediaPolicyModule,
   ],
   controllers: [
     RequestManagementController,

src/request-management/request-management.v2.controller.ts

@@ -28,6 +28,7 @@ import { GlobalGuard } from "src/auth/guards/global.guard";
 import { RolesGuard } from "src/auth/guards/role.guard";
 import { Roles } from "src/decorators/roles.decorator";
 import { CurrentUser } from "src/decorators/user.decorator";
+import { MediaPolicyService } from "src/media-policy/media-policy.service";
 import { RoleEnum } from "src/Types&Enums/role.enum";
 import { AddPlateDto } from "src/profile/dto/user/AddPlateDto";
 import {
@@ -53,6 +54,7 @@ import { RequestManagementService } from "./request-management.service";
 export class RequestManagementV2Controller {
   constructor(
     private readonly requestManagementService: RequestManagementService,
+    private readonly mediaPolicyService: MediaPolicyService,
   ) { }
 
   @Post()
@@ -154,6 +156,7 @@ export class RequestManagementV2Controller {
     @CurrentUser() user,
     @UploadedFile() file?: Express.Multer.File,
   ) {
+    await this.mediaPolicyService.assertForBlame(file, requestId, "video");
     return this.requestManagementService.uploadFirstPartyVideoV2(
       requestId,
       file,
@@ -222,6 +225,7 @@ export class RequestManagementV2Controller {
     @CurrentUser() user,
     @UploadedFile() voice?: Express.Multer.File,
   ) {
+    await this.mediaPolicyService.assertForBlame(voice, requestId, "voice");
     return this.requestManagementService.uploadVoiceV2(requestId, voice, user);
   }
 
@@ -338,6 +342,8 @@ export class RequestManagementV2Controller {
     @CurrentUser() user: any,
     @UploadedFile() sign: Express.Multer.File,
   ) {
+    await this.mediaPolicyService.assertForBlame(sign, requestId, "image");
+
     // Convert string "true"/"false" to boolean
     const acceptDecision = typeof isAccept === "string"
       ? isAccept === "true"
@@ -449,6 +455,18 @@ export class RequestManagementV2Controller {
     @Body("description") description?: string,
     @Body("textDescription") textDescription?: string,
   ) {
+    // Each multipart field maps to a media kind so the policy gate can pick
+    // the right per-client bounds. Document images = `image`, audio = `voice`,
+    // video = `video`.
+    await this.mediaPolicyService.assertForBlameMany(files, requestId, {
+      drivingLicense: "image",
+      carCertificate: "image",
+      nationalCertificate: "image",
+      carGreenCard: "image",
+      voice: "voice",
+      video: "video",
+    });
+
     const descCandidates = [description, textDescription]
       .map((x) => (x != null ? String(x).trim() : ""))
       .filter((s) => s.length > 0);