import { Types } from "mongoose"; import { ExpertClaimService } from "src/expert-claim/expert-claim.service"; import { RoleEnum } from "src/Types&Enums/role.enum"; import { RequestManagementService } from "./request-management.service"; describe("RequestManagementService FileReviewer inbox", () => { const reviewerId = new Types.ObjectId(); const otherReviewerId = new Types.ObjectId(); const clientId = new Types.ObjectId(); const otherClientId = new Types.ObjectId(); const sealedFile = { _id: new Types.ObjectId(), publicId: "BLM-OPEN", type: "THIRD_PARTY", status: "WAITING_FOR_FILE_REVIEWER", isMadeByFileMaker: true, expertInitiated: true, creationMethod: "IN_PERSON", parties: [ { role: "FIRST", person: { clientId, userId: new Types.ObjectId() }, }, ], expert: { decision: { guiltyPartyId: new Types.ObjectId() } }, }; function createService(files: any[]) { const blameRequestDbService = { find: jest.fn().mockResolvedValue(files), }; const service = new (RequestManagementService as any)( undefined, blameRequestDbService, ) as RequestManagementService; return { service, blameRequestDbService }; } it("lists a FileMaker-sealed, unassigned file for a reviewer in the same tenant", async () => { const { service, blameRequestDbService } = createService([sealedFile]); const result = await service.getMyFileReviewerFiles({ sub: String(reviewerId), role: RoleEnum.FILE_REVIEWER, clientKey: String(clientId), }); expect(result).toEqual([ expect.objectContaining({ _id: sealedFile._id, publicId: "BLM-OPEN" }), ]); expect(blameRequestDbService.find).toHaveBeenCalledWith( expect.objectContaining({ isMadeByFileMaker: true, expertInitiated: true, creationMethod: "IN_PERSON", $or: expect.arrayContaining([ expect.objectContaining({ status: "WAITING_FOR_FILE_REVIEWER" }), expect.objectContaining({ assignedFileReviewerId: reviewerId }), ]), }), ); }); it("does not list another tenant's open file or a file assigned to another reviewer", async () => { const { service } = createService([ { ...sealedFile, _id: new Types.ObjectId(), parties: [{ role: "FIRST", person: { clientId: otherClientId } }], }, { ...sealedFile, _id: new Types.ObjectId(), assignedFileReviewerId: otherReviewerId, }, ]); const result = await service.getMyFileReviewerFiles({ sub: String(reviewerId), role: RoleEnum.FILE_REVIEWER, clientKey: String(clientId), }); expect(result).toEqual([]); }); it("does not expose an open file's details to a reviewer from another tenant", async () => { const { service } = createService([]); (service as any).blameRequestDbService.findById = jest.fn().mockResolvedValue({ ...sealedFile, parties: [{ role: "FIRST", person: { clientId: otherClientId } }], }); await expect( service.getMyFileReviewerFileDetail( { sub: String(reviewerId), role: RoleEnum.FILE_REVIEWER, clientKey: String(clientId), }, String(sealedFile._id), ), ).rejects.toThrow("does not belong to your organization"); }); it("does not let a reviewer claim another tenant's file through its linked claim ID", async () => { const blameRequestDbService = { findById: jest.fn().mockResolvedValue({ ...sealedFile, parties: [{ role: "FIRST", person: { clientId: otherClientId } }], }), findOneAndUpdate: jest.fn(), }; const expertClaimService = new (ExpertClaimService as any)( undefined, undefined, undefined, undefined, undefined, undefined, undefined, undefined, blameRequestDbService, ) as ExpertClaimService; await expect( (expertClaimService as any).assignFileReviewerToV4Blame( String(new Types.ObjectId()), { blameRequestId: sealedFile._id }, { sub: String(reviewerId), role: RoleEnum.FILE_REVIEWER, clientKey: String(clientId), }, ), ).rejects.toThrow("does not belong to your organization"); expect(blameRequestDbService.findOneAndUpdate).not.toHaveBeenCalled(); }); });