YARA-898

src/request-management/request-management.v2.controller.ts

@@ -28,6 +28,7 @@ import { GlobalGuard } from "src/auth/guards/global.guard";
 import { RolesGuard } from "src/auth/guards/role.guard";
 import { Roles } from "src/decorators/roles.decorator";
 import { CurrentUser } from "src/decorators/user.decorator";
+import { MediaPolicyService } from "src/media-policy/media-policy.service";
 import { RoleEnum } from "src/Types&Enums/role.enum";
 import { AddPlateDto } from "src/profile/dto/user/AddPlateDto";
 import {
@@ -53,6 +54,7 @@ import { RequestManagementService } from "./request-management.service";
 export class RequestManagementV2Controller {
   constructor(
     private readonly requestManagementService: RequestManagementService,
+    private readonly mediaPolicyService: MediaPolicyService,
   ) { }
 
   @Post()
@@ -154,6 +156,7 @@ export class RequestManagementV2Controller {
     @CurrentUser() user,
     @UploadedFile() file?: Express.Multer.File,
   ) {
+    await this.mediaPolicyService.assertForBlame(file, requestId, "video");
     return this.requestManagementService.uploadFirstPartyVideoV2(
       requestId,
       file,
@@ -222,6 +225,7 @@ export class RequestManagementV2Controller {
     @CurrentUser() user,
     @UploadedFile() voice?: Express.Multer.File,
   ) {
+    await this.mediaPolicyService.assertForBlame(voice, requestId, "voice");
     return this.requestManagementService.uploadVoiceV2(requestId, voice, user);
   }
 
@@ -338,6 +342,8 @@ export class RequestManagementV2Controller {
     @CurrentUser() user: any,
     @UploadedFile() sign: Express.Multer.File,
   ) {
+    await this.mediaPolicyService.assertForBlame(sign, requestId, "image");
+
     // Convert string "true"/"false" to boolean
     const acceptDecision = typeof isAccept === "string"
       ? isAccept === "true"
@@ -449,6 +455,18 @@ export class RequestManagementV2Controller {
     @Body("description") description?: string,
     @Body("textDescription") textDescription?: string,
   ) {
+    // Each multipart field maps to a media kind so the policy gate can pick
+    // the right per-client bounds. Document images = `image`, audio = `voice`,
+    // video = `video`.
+    await this.mediaPolicyService.assertForBlameMany(files, requestId, {
+      drivingLicense: "image",
+      carCertificate: "image",
+      nationalCertificate: "image",
+      carGreenCard: "image",
+      voice: "voice",
+      video: "video",
+    });
+
     const descCandidates = [description, textDescription]
       .map((x) => (x != null ? String(x).trim() : ""))
       .filter((s) => s.length > 0);