yara724-api/src/request-management/request-management.file-reviewer.spec.ts

import { Types } from "mongoose";
import { ExpertClaimService } from "src/expert-claim/expert-claim.service";
import { RoleEnum } from "src/Types&Enums/role.enum";
import { RequestManagementService } from "./request-management.service";

describe("RequestManagementService FileReviewer inbox", () => {
  const reviewerId = new Types.ObjectId();
  const otherReviewerId = new Types.ObjectId();
  const clientId = new Types.ObjectId();
  const otherClientId = new Types.ObjectId();

  const sealedFile = {
    _id: new Types.ObjectId(),
    publicId: "BLM-OPEN",
    type: "THIRD_PARTY",
    status: "WAITING_FOR_FILE_REVIEWER",
    isMadeByFileMaker: true,
    expertInitiated: true,
    creationMethod: "IN_PERSON",
    parties: [
      {
        role: "FIRST",
        person: { clientId, userId: new Types.ObjectId() },
      },
    ],
    expert: { decision: { guiltyPartyId: new Types.ObjectId() } },
  };

  function createService(files: any[]) {
    const blameRequestDbService = {
      find: jest.fn().mockResolvedValue(files),
    };
    const service = new (RequestManagementService as any)(
      undefined,
      blameRequestDbService,
    ) as RequestManagementService;
    return { service, blameRequestDbService };
  }

  it("lists a FileMaker-sealed, unassigned file for a reviewer in the same tenant", async () => {
    const { service, blameRequestDbService } = createService([sealedFile]);

    const result = await service.getMyFileReviewerFiles({
      sub: String(reviewerId),
      role: RoleEnum.FILE_REVIEWER,
      clientKey: String(clientId),
    });

    expect(result).toEqual([
      expect.objectContaining({ _id: sealedFile._id, publicId: "BLM-OPEN" }),
    ]);
    expect(blameRequestDbService.find).toHaveBeenCalledWith(
      expect.objectContaining({
        isMadeByFileMaker: true,
        expertInitiated: true,
        creationMethod: "IN_PERSON",
        $or: expect.arrayContaining([
          expect.objectContaining({ status: "WAITING_FOR_FILE_REVIEWER" }),
          expect.objectContaining({ assignedFileReviewerId: reviewerId }),
        ]),
      }),
    );
  });

  it("does not list another tenant's open file or a file assigned to another reviewer", async () => {
    const { service } = createService([
      {
        ...sealedFile,
        _id: new Types.ObjectId(),
        parties: [{ role: "FIRST", person: { clientId: otherClientId } }],
      },
      {
        ...sealedFile,
        _id: new Types.ObjectId(),
        assignedFileReviewerId: otherReviewerId,
      },
    ]);

    const result = await service.getMyFileReviewerFiles({
      sub: String(reviewerId),
      role: RoleEnum.FILE_REVIEWER,
      clientKey: String(clientId),
    });

    expect(result).toEqual([]);
  });

  it("does not expose an open file's details to a reviewer from another tenant", async () => {
    const { service } = createService([]);
    (service as any).blameRequestDbService.findById = jest.fn().mockResolvedValue({
      ...sealedFile,
      parties: [{ role: "FIRST", person: { clientId: otherClientId } }],
    });

    await expect(
      service.getMyFileReviewerFileDetail(
        {
          sub: String(reviewerId),
          role: RoleEnum.FILE_REVIEWER,
          clientKey: String(clientId),
        },
        String(sealedFile._id),
      ),
    ).rejects.toThrow("does not belong to your organization");
  });

  it("does not let a reviewer claim another tenant's file through its linked claim ID", async () => {
    const blameRequestDbService = {
      findById: jest.fn().mockResolvedValue({
        ...sealedFile,
        parties: [{ role: "FIRST", person: { clientId: otherClientId } }],
      }),
      findOneAndUpdate: jest.fn(),
    };
    const expertClaimService = new (ExpertClaimService as any)(
      undefined,
      undefined,
      undefined,
      undefined,
      undefined,
      undefined,
      undefined,
      undefined,
      blameRequestDbService,
    ) as ExpertClaimService;

    await expect(
      (expertClaimService as any).assignFileReviewerToV4Blame(
        String(new Types.ObjectId()),
        { blameRequestId: sealedFile._id },
        {
          sub: String(reviewerId),
          role: RoleEnum.FILE_REVIEWER,
          clientKey: String(clientId),
        },
      ),
    ).rejects.toThrow("does not belong to your organization");
    expect(blameRequestDbService.findOneAndUpdate).not.toHaveBeenCalled();
  });
});