PM-4026: allow challenge-wide roles to view challenge payments

What was broken:
Challenge payment lookups in the review flow were forced to winner-only results for non-privileged users, so challenge managers reviewing completed challenges could see "No payments found" even when payments existed.

Root cause:
Challenge-wide access expansion only checked copilot roles. Manager/full-write challenge resource roles were not treated as challenge-wide readers.

What was changed:
Updated challenge-payments access checks to allow full challenge visibility for users with challenge-wide roles (fullWriteAccess roles plus manager/copilot role names).
Kept winner-based filtering for users without challenge-wide access.
Hardened role claim parsing to only stringify primitive claim values.
Extended the challenge resource-role model with optional fullWriteAccess for this access check.

Any added/updated tests:
Added unit tests for ChallengePaymentsService to verify manager access returns all challenge payments and non-challenge-wide users remain winner-filtered.

Author: jmgasper

src/api/challenge-payments/challenge-payments.service.spec.ts

@@ -0,0 +1,101 @@
+jest.mock('src/shared/global', () => ({
+  Logger: class {
+    debug = jest.fn();
+
+    error = jest.fn();
+
+    info = jest.fn();
+
+    log = jest.fn();
+
+    warn = jest.fn();
+  },
+}));
+
+jest.mock('src/config', () => ({
+  ENV_CONFIG: {
+    TOPCODER_API_V6_BASE_URL: 'https://api.topcoder-dev.com/v6',
+  },
+}));
+
+import { ChallengePaymentsService } from './challenge-payments.service';
+
+describe('ChallengePaymentsService', () => {
+  let findManyMock: jest.Mock;
+  let m2mFetchMock: jest.Mock;
+  let service: ChallengePaymentsService;
+
+  beforeEach(() => {
+    findManyMock = jest.fn().mockResolvedValue([]);
+    m2mFetchMock = jest.fn();
+
+    service = new ChallengePaymentsService(
+      {
+        winnings: {
+          findMany: findManyMock,
+        },
+      } as any,
+      {
+        m2mFetch: m2mFetchMock,
+      } as any,
+    );
+  });
+
+  it('returns all challenge payments for managers', async () => {
+    m2mFetchMock
+      .mockResolvedValueOnce([
+        {
+          memberHandle: 'manager-user',
+          memberId: '123',
+          roleId: 'manager-role-id',
+        },
+      ])
+      .mockResolvedValueOnce([
+        {
+          fullWriteAccess: false,
+          id: 'manager-role-id',
+          name: 'Manager',
+        },
+      ]);
+
+    await service.listChallengePayments({
+      auth0User: { roles: ['Topcoder User'] },
+      challengeId: 'challenge-id',
+      isMachineToken: false,
+      requestUserId: '123',
+      winnerOnly: false,
+    });
+
+    const where = findManyMock.mock.calls[0][0].where;
+    expect(where.winner_id).toBeUndefined();
+  });
+
+  it('keeps winner filtering for users without challenge-wide access', async () => {
+    m2mFetchMock
+      .mockResolvedValueOnce([
+        {
+          memberHandle: 'reviewer-user',
+          memberId: '456',
+          roleId: 'reviewer-role-id',
+        },
+      ])
+      .mockResolvedValueOnce([
+        {
+          fullWriteAccess: false,
+          id: 'reviewer-role-id',
+          name: 'Reviewer',
+        },
+      ]);
+
+    await service.listChallengePayments({
+      auth0User: { roles: ['Topcoder User'] },
+      challengeId: 'challenge-id',
+      isMachineToken: false,
+      requestUserId: '456',
+      winnerOnly: false,
+    });
+
+    const where = findManyMock.mock.calls[0][0].where;
+    expect(where.winner_id).toBe('456');
+  });
+});

src/api/challenge-payments/challenge-payments.service.ts

@@ -101,16 +101,17 @@ export class ChallengePaymentsService {
       }
 
       try {
-        const isCopilot = await this.isCopilotForChallenge(
-          challengeId,
-          requestUserId,
-        );
-        if (isCopilot) {
+        const hasChallengeWideAccess =
+          await this.hasChallengeWideAccessForChallenge(
+            challengeId,
+            requestUserId,
+          );
+        if (hasChallengeWideAccess) {
           allowAllForChallenge = true;
         }
       } catch (error) {
         this.logger.warn(
-          `Failed to verify copilot status for user ${requestUserId} on challenge ${challengeId}`,
+          `Failed to verify challenge-wide payment access for user ${requestUserId} on challenge ${challengeId}`,
           error instanceof Error ? error.message : error,
         );
       }
@@ -150,7 +151,11 @@ export class ChallengePaymentsService {
             roles.push(String(role));
           }
         });
-      } else if (value) {
+      } else if (
+        typeof value === 'string' ||
+        typeof value === 'number' ||
+        typeof value === 'boolean'
+      ) {
         roles.push(String(value));
       }
     });
@@ -165,7 +170,7 @@ export class ChallengePaymentsService {
     return roles;
   }
 
-  private async isCopilotForChallenge(
+  private async hasChallengeWideAccessForChallenge(
     challengeId: string,
     userId: string,
   ): Promise<boolean> {
@@ -181,19 +186,26 @@ export class ChallengePaymentsService {
       return false;
     }
 
-    const copilotRoleIds = new Set(
+    const challengeWideRoleIds = new Set(
       resourceRoles
-        ?.filter((role) =>
-          role?.name ? role.name.toLowerCase().includes('copilot') : false,
+        ?.filter(
+          (role) =>
+            role?.fullWriteAccess === true ||
+            (role?.name
+              ? role.name.toLowerCase().includes('copilot') ||
+                role.name.toLowerCase().includes('manager')
+              : false),
         )
         .map((role) => role.id),
     );
 
-    if (copilotRoleIds.size === 0) {
+    if (challengeWideRoleIds.size === 0) {
       return false;
     }
 
-    return resources.some((resource) => copilotRoleIds.has(resource.roleId));
+    return resources.some((resource) =>
+      challengeWideRoleIds.has(resource.roleId),
+    );
   }
 
   private async fetchWinnings(

src/api/challenges/models/challenge.ts

@@ -148,6 +148,7 @@ export interface ChallengeResource {
 export interface ResourceRole {
   id: string;
   name: string;
+  fullWriteAccess?: boolean;
 }
 
 export interface ChallengeReview {