PM-4011 - check reviewer role

Author: vas3a

src/api/review/review.service.spec.ts

@@ -3667,13 +3667,51 @@ describe('ReviewService.updateReviewItem validations', () => {
     expect(prismaMock.reviewItem.update).not.toHaveBeenCalled();
   });
 
+  it('allows admins assigned as reviewers on the challenge to update review item scores without a manager comment', async () => {
+    const adminReviewerUser: JwtUser = {
+      userId: 'admin-reviewer-1',
+      roles: [UserRole.Admin],
+      isMachine: false,
+    };
+
+    resourceApiServiceMock.getMemberResourcesRoles.mockResolvedValueOnce([
+      {
+        id: 'resource-1',
+        memberId: 'admin-reviewer-1',
+        roleName: 'Reviewer',
+        challengeId: 'challenge-1',
+      },
+    ]);
+
+    prismaMock.reviewItem.update.mockResolvedValueOnce({
+      ...baseExistingItem,
+      finalAnswer: 'No',
+      managerComment: null,
+      reviewItemComments: [],
+    });
+
+    await expect(
+      service.updateReviewItem(adminReviewerUser, 'item-1', {
+        ...baseRequest,
+        finalAnswer: 'No',
+      }),
+    ).resolves.toMatchObject({ id: 'item-1' });
+
+    expect(resourceApiServiceMock.getMemberResourcesRoles).toHaveBeenCalledWith(
+      'challenge-1',
+      'admin-reviewer-1',
+    );
+    expect(prismaMock.reviewItem.update).toHaveBeenCalled();
+  });
+
   it('requires manager comment when an admin updates the score on a review item', async () => {
     const adminUser: JwtUser = {
       userId: 'admin-1',
       roles: [UserRole.Admin],
       isMachine: false,
     };
 
+    resourceApiServiceMock.getMemberResourcesRoles.mockResolvedValueOnce([]);
     prismaMock.reviewItem.update.mockClear();
     prismaMock.reviewAudit.create.mockClear();
 
@@ -3689,9 +3727,10 @@ describe('ReviewService.updateReviewItem validations', () => {
       status: 400,
     });
 
-    expect(
-      resourceApiServiceMock.getMemberResourcesRoles,
-    ).not.toHaveBeenCalled();
+    expect(resourceApiServiceMock.getMemberResourcesRoles).toHaveBeenCalledWith(
+      'challenge-1',
+      'admin-1',
+    );
     expect(prismaMock.reviewItem.update).not.toHaveBeenCalled();
     expect(prismaMock.reviewAudit.create).not.toHaveBeenCalled();
   });

src/api/review/review.service.ts

@@ -799,6 +799,8 @@ export class ReviewService {
 
     await this.ensureChallengeWhitelistAccess(requester, challengeId);
 
+    const isRequesterAdmin = isAdmin(requester);
+
     if (requester.isMachine) {
       return {
         mode: 'machine',
@@ -810,17 +812,6 @@ export class ReviewService {
       };
     }
 
-    if (isAdmin(requester)) {
-      return {
-        mode: 'admin',
-        hasReviewerRole: false,
-        hasCopilotRole: false,
-        ownsReview: false,
-        requiresManagerComment: true,
-        requesterResources: [],
-      };
-    }
-
     const normalizedRoles = Array.isArray(requester.roles)
       ? requester.roles.map((role) => String(role).trim().toLowerCase())
       : [];
@@ -840,7 +831,7 @@ export class ReviewService {
           ? 'delete'
           : 'update';
 
-    if (!hasReviewerRole && !hasCopilotRole) {
+    if (!hasReviewerRole && !hasCopilotRole && !isRequesterAdmin) {
       throw new ForbiddenException({
         message: `You do not have permission to ${actionVerb} this review item.`,
         code: `REVIEW_ITEM_${context.action.toUpperCase()}_FORBIDDEN_ROLE`,
@@ -891,6 +882,38 @@ export class ReviewService {
       });
     }
 
+    if (isRequesterAdmin) {
+      const isAssignedReviewerRole = requesterResources.some((resource) => {
+        const normalizedRoleName = (resource.roleName || '').toLowerCase();
+        const matchesReviewer = normalizedRoleName.includes('reviewer');
+        const matchesChallenge = challengeId
+          ? resource.challengeId === challengeId
+          : false;
+        return matchesReviewer && matchesChallenge;
+      });
+
+      return {
+        mode: 'admin',
+        hasReviewerRole,
+        hasCopilotRole,
+        ownsReview: false,
+        requiresManagerComment: !isAssignedReviewerRole,
+        requesterResources,
+      };
+    }
+
+    if (!hasReviewerRole && !hasCopilotRole) {
+      throw new ForbiddenException({
+        message: `You do not have permission to ${actionVerb} this review item.`,
+        code: `REVIEW_ITEM_${context.action.toUpperCase()}_FORBIDDEN_ROLE`,
+        details: {
+          reviewId: review.id,
+          itemId: context.itemId,
+          requesterRoles: requester.roles,
+        },
+      });
+    }
+
     let ownsReview = false;
     let mode: ReviewItemAccessMode | null = null;
     let hasCopilotAccess = false;