Tweaks for showing specific details to mixed roles

Author: jmgasper

src/api/review/review.service.spec.ts

@@ -806,6 +806,35 @@ describe('ReviewService.getReview authorization checks', () => {
     });
   });
 
+  it('allows copilots who also have reviewer resources to access other reviews before completion', async () => {
+    resourceApiServiceMock.getMemberResourcesRoles.mockResolvedValueOnce([
+      baseReviewerResource,
+      {
+        ...baseReviewerResource,
+        id: 'resource-copilot',
+        roleName: 'Copilot',
+      },
+    ]);
+
+    prismaMock.review.findUniqueOrThrow.mockResolvedValueOnce({
+      ...defaultReviewData(),
+      resourceId: 'resource-other',
+      phaseId: 'phase-review',
+    });
+
+    const copilotReviewerUser: JwtUser = {
+      ...baseAuthUser,
+      roles: [UserRole.Reviewer, UserRole.Copilot],
+    };
+
+    await expect(
+      service.getReview(copilotReviewerUser, 'review-1'),
+    ).resolves.toMatchObject({
+      id: 'review-1',
+      resourceId: 'resource-other',
+    });
+  });
+
   it('allows reviewers to access screening reviews that are not their own before completion', async () => {
     prismaMock.review.findUniqueOrThrow.mockResolvedValue({
       ...defaultReviewData(),
@@ -1544,6 +1573,117 @@ describe('ReviewService.getReviews reviewer visibility', () => {
     expect(callArgs.where.resourceId).toBeUndefined();
   });
 
+  it('uses the most permissive access when the requester is both reviewer and copilot', async () => {
+    const now = new Date();
+    const reviewerResource = {
+      ...buildResource('Reviewer'),
+      id: 'resource-reviewer',
+    };
+    const copilotResource = {
+      ...buildResource('Copilot'),
+      id: 'resource-copilot',
+      roleId: 'role-copilot',
+    };
+
+    resourceApiServiceMock.getMemberResourcesRoles.mockResolvedValue([
+      reviewerResource,
+      copilotResource,
+    ]);
+
+    const reviewRecords = [
+      {
+        id: 'review-1',
+        resourceId: 'resource-other',
+        submissionId: 'submission-1',
+        phaseId: 'phase-review',
+        scorecardId: 'scorecard-1',
+        typeId: 'type-1',
+        status: ReviewStatus.COMPLETED,
+        reviewDate: now,
+        committed: true,
+        metadata: null,
+        initialScore: 80,
+        finalScore: 85,
+        createdAt: now,
+        createdBy: 'system',
+        updatedAt: now,
+        updatedBy: 'system',
+        reviewItems: [
+          {
+            id: 'item-1',
+            reviewId: 'review-1',
+            scorecardQuestionId: 'question-1',
+            initialAnswer: 'Yes',
+            finalAnswer: 'No',
+            managerComment: null,
+            reviewItemComments: [],
+          },
+        ],
+        submission: {
+          id: 'submission-1',
+          memberId: 'submitter-1',
+          challengeId: 'challenge-1',
+        },
+      },
+      {
+        id: 'review-2',
+        resourceId: 'resource-reviewer',
+        submissionId: 'submission-2',
+        phaseId: 'phase-review',
+        scorecardId: 'scorecard-1',
+        typeId: 'type-1',
+        status: ReviewStatus.COMPLETED,
+        reviewDate: now,
+        committed: true,
+        metadata: null,
+        initialScore: 90,
+        finalScore: 95,
+        createdAt: now,
+        createdBy: 'system',
+        updatedAt: now,
+        updatedBy: 'system',
+        reviewItems: [
+          {
+            id: 'item-2',
+            reviewId: 'review-2',
+            scorecardQuestionId: 'question-2',
+            initialAnswer: 'Yes',
+            finalAnswer: 'Yes',
+            managerComment: 'Great work',
+            reviewItemComments: [],
+          },
+        ],
+        submission: {
+          id: 'submission-2',
+          memberId: 'submitter-2',
+          challengeId: 'challenge-1',
+        },
+      },
+    ];
+
+    prismaMock.review.findMany.mockResolvedValue(reviewRecords);
+    prismaMock.review.count.mockResolvedValue(reviewRecords.length);
+
+    const response = await service.getReviews(
+      {
+        ...baseAuthUser,
+        roles: [UserRole.Reviewer, UserRole.Copilot],
+      },
+      undefined,
+      'challenge-1',
+    );
+
+    const callArgs = prismaMock.review.findMany.mock.calls[0][0];
+    expect(callArgs.where.resourceId).toBeUndefined();
+
+    const otherReview = response.data.find(
+      (review) => review.id === 'review-1',
+    );
+    expect(otherReview).toBeDefined();
+    expect(otherReview?.finalScore).toBe(85);
+    expect(otherReview?.reviewItems?.length).toBe(1);
+  });
+
   it('hides scores and review items for other reviewers on active challenges while keeping reviewer metadata', async () => {
     const now = new Date();
     const reviewerUser: JwtUser = {

src/api/review/review.service.ts

@@ -3432,6 +3432,7 @@ export class ReviewService {
           challengeForReview?.status ?? challengeDetail?.status ?? null;
         const shouldMaskOtherReviewerDetails =
           !isPrivilegedRequester &&
+          !hasCopilotRoleForChallenge &&
           reviewerResourceIdSet.size > 0 &&
           !isReviewerForReview &&
           !this.isCompletedOrCancelledStatus(challengeStatusForReview) &&
@@ -3690,7 +3691,9 @@ export class ReviewService {
         );
         isReviewerForReview = reviewerResourceIds.has(reviewResourceId);
 
-        if (reviewerResources.length > 0) {
+        if (hasCopilotRole) {
+          // Copilots on the challenge can view any review regardless of reviewer ownership.
+        } else if (reviewerResources.length > 0) {
           const challengeInFinalState = [
             ChallengeStatus.COMPLETED,
             ChallengeStatus.CANCELLED_FAILED_REVIEW,
@@ -3720,7 +3723,7 @@ export class ReviewService {
               details: { challengeId, reviewId, requester: uid },
             });
           }
-        } else if (!hasCopilotRole) {
+        } else {
           // Confirm the user has actually submitted to this challenge (has a submission record)
           const mySubs = await this.prisma.submission.findMany({
             where: { challengeId, memberId: uid },