What's new

Important: If you are updating from Jasper, there are changes on the Jutro side. See the Jutro documentation for more information. If you are updating from a pre-Jasper version, there may be significant changes to your codebase. See the Update Guide documentation for more information.

2025.03.5 release

This section lists the updates introduced in patch 5 of the 2025.03 release.

New Jutro patch version

Digital reference applications now use Jutro patch version 10.10.2-next-20260108162831 which brings enhanced security to the Jutro Design System.

2025.03.4 release

This section lists the updates introduced in patch 4 of the 2025.03 release.

New Jutro patch version

Digital reference applications now use Jutro patch version 10.10.1-next-20251113142236 which brings enhanced security to the Jutro Design System.

2025.03.3 release

There are no customer-facing changes in this release.

2025.03.2 release

This section lists the updates introduced in patch 2 of the 2025.03 release.

New Node 22 patch version

The supported Node version for Digital reference applications has been updated to patch version 22.15.1.

2025.03.1 release

This section lists the updates introduced in patch 1 of the 2025.03 release.

Node 22 support

Node 22 is now supported. Support for Node 18 will continue until the December 2025 at which point it will no longer receive support.

Edge API configuration changes

Guidewire has modified the configuration of certain Edge APIs in addition to the changes made in the 2025.03 release, so that particular fields are only returned to users who are authorized to access such data in those fields. For a list of the previous changes, see the Edge API configuration changes section from the 2025.03 release.

There are steps that you must take to continue returning that data, along with testing your Edge configuration. You can find these file changes in your own repository using the us_mamm_2025_03_1-bc-cc-cm-pc-dg/13.1.0.1 tag and need to manually add the changes to your own files. The following files show the configuration changes:

Changes to draft claims in the ClaimCenter API

Additional roles and allowances for policyholders and agents have been added for draft claims in the following files:

ClaimCenter/modules/configuration/gsrc/edge/capabilities/claim/lob/impl/personalauto/fnol/PAFnolPlugin.gs
ClaimCenter/modules/configuration/gsrc/edge/capabilities/claim/lob/impl/commonauto/DefaultVehicleIncidentPlugin.gs

The following changes have been made in the DefaultVehicleIncidentPlugin.gs file:

Original file contents:

override function toDTO(incident : VehicleIncident) : VehicleIncidentDTO {
  if (VehicleUtil.isPolicyVehicle(incident.Claim, incident.Vehicle)) {

    return Mapper.mapRef(incident,\ i -> {
      final var res = new VehicleIncidentDTO()
      fillBaseProperties(res, incident)

public static function updateBaseProperties(incident : VehicleIncident, dto : VehicleIncidentDTO) {
    incident.Description = dto.DamageDescription
    incident.PropertyDesc = dto.PropertyDamageDescription
    incident.VehicleOperable = dto.SafeToDrive
    incident.AirbagsDeployed = dto.AirbagsDeployed
    incident.EquipmentFailure = dto.EquipmentFailure
    incident.VehTowedInd = dto.VehicleTowed
    incident.RentalRequired = dto.RentalRequired
    incident.Collision = dto.Collision
    incident.CollisionPoint = dto.CollisionPoint
    incident.VehStolenInd = dto.Theft
    incident.Severity = dto.Severity

  }
}

Updated file contents:

override function toDTO(incident : VehicleIncident) : VehicleIncidentDTO {

  if ((incident.Claim.DraftClaim && incident.LossParty == TC_THIRD_PARTY) || VehicleUtil.isPolicyVehicle(incident.Claim, incident.Vehicle)) {
    return Mapper.mapRef(incident,\ i -> {
      final var res = new VehicleIncidentDTO()
      fillBaseProperties(res, incident)

public static function updateBaseProperties(incident : VehicleIncident, dto : VehicleIncidentDTO) {
    incident.Description = dto.DamageDescription
    incident.PropertyDesc = dto.PropertyDamageDescription
    incident.VehicleOperable = dto.SafeToDrive
    incident.AirbagsDeployed = dto.AirbagsDeployed
    incident.EquipmentFailure = dto.EquipmentFailure
    incident.VehTowedInd = dto.VehicleTowed
    incident.RentalRequired = dto.RentalRequired
    incident.Collision = dto.Collision
    incident.CollisionPoint = dto.CollisionPoint
    incident.VehStolenInd = dto.Theft
    incident.Severity = dto.Severity
    incident.LossParty = VehicleUtil.isPolicyVehicle(incident.Claim, incident.Vehicle) ? TC_INSURED : TC_THIRD_PARTY
  }
}

The following changes have been made in the PAFnolPlugin.gs file:

Original file contents:

override function toDTO(claim: Claim): PAFnolExtensionDTO {
  if (claim.Policy.PolicyType != PaTypeCode.PersonalAuto) {
    return null
  }

  final var res = new PAFnolExtensionDTO()
  res.Vehicles = Mapper.mapArray(claim.Policy.Vehicles*.Vehicle, \v -> VehicleUtil.toDTO(claim, v))
  res.VehicleIncidents = Mapper.mapArray(claim.VehicleIncidentsOnly, \v -> _incidentPlugin.toDTO(v))
  res.FixedPropertyIncident = Mapper.mapArray(claim.FixedPropertyIncidentsOnly, \e -> IncidentUtil.toDTO(e)).first()
  res.RepairOption = getRepairOptionDTO(claim)
  return res
}

Updated file contents:

override function toDTO(claim: Claim): PAFnolExtensionDTO {
  if (claim.Policy.PolicyType != PaTypeCode.PersonalAuto) {
    return null
  }

  final var res = new PAFnolExtensionDTO()
  res.Vehicles = Mapper.mapArray(claim.Policy.Vehicles*.Vehicle, \v -> VehicleUtil.toDTO(claim, v)).where(\elt -> elt != null)
  res.VehicleIncidents = Mapper.mapArray(claim.VehicleIncidentsOnly, \v -> _incidentPlugin.toDTO(v)).where(\elt -> elt != null)
  res.FixedPropertyIncident = Mapper.mapArray(claim.FixedPropertyIncidentsOnly, \e -> IncidentUtil.toDTO(e)).first()
  res.RepairOption = getRepairOptionDTO(claim)
  return res
}

Policy access changes in the PolicyCenter API

Policy access has been restricted in the following PolicyCenter API files:

PolicyCenter/modules/configuration/gsrc/edge/capabilities/policyjob/policydiff/GatewayPolicyDiffHandler.gs
PolicyCenter/modules/configuration/gsrc/edge/capabilities/policy/auth/DefaultPolicyAccessPlugin.gs
PolicyCenter/modules/configuration/gsrc/edge/capabilities/policyjob/policydiff/PolicyDiffHandler.gs

The following changes have been made in the GatewayPolicyDiffHandler.gs file:

Original file contents:

package edge.capabilities.policyjob.policydiff


uses edge.jsonrpc.AbstractRpcHandler
uses edge.di.annotations.InjectableNode
uses edge.capabilities.helpers.JobUtil
uses edge.doc.ApidocAvailableSince
uses edge.jsonrpc.annotation.JsonRpcMethod
uses edge.PlatformSupport.Bundle
uses edge.doc.ApidocMethodDescription
uses edge.jsonrpc.annotation.JsonRpcRunAsInternalGWUser

class GatewayPolicyDiffHandler extends PolicyDiffHandler {

  @InjectableNode
  construct(aPolicyDiffPlugin : IPolicyDiffPlugin, aJobUtil : JobUtil) {
    super(aPolicyDiffPlugin, aJobUtil)
  }

Updated file contents:

package edge.capabilities.policyjob.policydiff

uses edge.capabilities.policy.auth.IPolicyAccessPlugin
uses edge.jsonrpc.AbstractRpcHandler
uses edge.di.annotations.InjectableNode
uses edge.capabilities.helpers.JobUtil
uses edge.doc.ApidocAvailableSince
uses edge.jsonrpc.annotation.JsonRpcMethod
uses edge.PlatformSupport.Bundle
uses edge.doc.ApidocMethodDescription
uses edge.jsonrpc.annotation.JsonRpcRunAsInternalGWUser

class GatewayPolicyDiffHandler extends PolicyDiffHandler {

  @InjectableNode
  construct(aPolicyDiffPlugin : IPolicyDiffPlugin, aJobUtil : JobUtil,policyAccessPlugin: IPolicyAccessPlugin) {
    super(aPolicyDiffPlugin, aJobUtil,policyAccessPlugin)
  }

The following changes have been made in the DefaultPolicyAccessPlugin.gs file:

Original file contents:

override function hasAccess(policy : PolicyPeriod) : Boolean {
  var user = _userProvider.EffectiveUser
  /* Explicit access to a policy by number. */
  if (user.hasAuthority(AuthorityType.POLICY, policy.PolicyNumber)) {
    return true
  }

  /* Access to a parent entity. */
  if (hasAccess(policy.Policy)) {
    return true
  }

  return false

}

Updated file contents:

override function hasAccess(policy : PolicyPeriod) : Boolean {
  var user = _userProvider.EffectiveUser
  /* Explicit access to a policy by number. */
  if (user.hasAuthority(AuthorityType.POLICY, policy.PolicyNumber)) {
    return true
  }

  /* Access to a parent entity. */
  if (hasAccess(policy.Policy)) {
    return true
  }

  return perm.PolicyPeriod.view(policy)

}

The following changes have been made in the PolicyDiffHandler.gs file:

Original file content:

package edge.capabilities.policyjob.policydiff

uses edge.jsonrpc.AbstractRpcHandler
uses edge.di.annotations.InjectableNode
uses edge.capabilities.helpers.JobUtil
uses edge.doc.ApidocAvailableSince
uses edge.jsonrpc.annotation.JsonRpcMethod
uses edge.PlatformSupport.Bundle
uses edge.doc.ApidocMethodDescription
uses edge.jsonrpc.annotation.JsonRpcRunAsInternalGWUser

class PolicyDiffHandler extends AbstractRpcHandler {

  private var _policyDiffPlugin : IPolicyDiffPlugin
  private var _jobUtil: JobUtil as JobUtil

  @InjectableNode
  construct(aPolicyDiffPlugin: IPolicyDiffPlugin, aJobUtil: JobUtil){
    this._policyDiffPlugin = aPolicyDiffPlugin
    this._jobUtil = aJobUtil
  }

  @ApidocAvailableSince("11.2")
  @JsonRpcMethod
  @ApidocMethodDescription("Returns the policy diff tree for a given job")
  function getPolicyDiffWithPrevious(jobNumber:String) : Object {
    var rootNode = Bundle.resolveInTransaction(\bundle -> {
      var policyPeriod = bundle.add(JobUtil.findJobByJobNumber(jobNumber).LatestPeriod)
      return new gw.api.tree.RowTreeRootNodeWrapper(gw.diff.tree.DiffTree.recalculateRootNodeForPolicyReview(policyPeriod)).rowTreeRootNode
  })
    return _policyDiffPlugin.toDTO(rootNode)
  }

  @ApidocAvailableSince("11.2")
  @JsonRpcMethod
  @ApidocMethodDescription("Returns the policy diff tree for given jobs")
  function compareJobs(jobNumber1:String, jobNumber2: String) : Object {
    var rootNode = Bundle.resolveInTransaction(\bundle -> {
      var policyPeriod1 = bundle.add(JobUtil.findJobByJobNumber(jobNumber1).LatestPeriod)
      var policyPeriod2 = bundle.add(JobUtil.findJobByJobNumber(jobNumber2).LatestPeriod)
      return new gw.api.tree.RowTreeRootNodeWrapper(
        gw.diff.tree.DiffTree.recalculateRootNode(policyPeriod1, policyPeriod2, DiffReason.TC_COMPAREJOBS)).rowTreeRootNode
    })

Updated file content:

package edge.capabilities.policyjob.policydiff

uses edge.capabilities.policy.auth.IPolicyAccessPlugin
uses edge.jsonrpc.AbstractRpcHandler
uses edge.di.annotations.InjectableNode
uses edge.capabilities.helpers.JobUtil
uses edge.doc.ApidocAvailableSince
uses edge.jsonrpc.annotation.JsonRpcMethod
uses edge.PlatformSupport.Bundle
uses edge.doc.ApidocMethodDescription
uses edge.jsonrpc.annotation.JsonRpcRunAsInternalGWUser
uses gw.api.webservice.exception.BadIdentifierException

class PolicyDiffHandler extends AbstractRpcHandler {
  private var _policyDiffPlugin : IPolicyDiffPlugin
  private var _jobUtil: JobUtil as JobUtil
  private var _policyAccessPlugin: IPolicyAccessPlugin

  @InjectableNode
  @Param("policyAccessPlugin", "Plugin used to validate policy access rules")
  construct(aPolicyDiffPlugin: IPolicyDiffPlugin, aJobUtil: JobUtil,policyAccessPlugin: IPolicyAccessPlugin){
    this._policyDiffPlugin = aPolicyDiffPlugin
    this._jobUtil = aJobUtil
    this._policyAccessPlugin = policyAccessPlugin
  }

  @ApidocAvailableSince("11.2")
  @JsonRpcMethod
  @ApidocMethodDescription("Returns the policy diff tree for a given job")
  function getPolicyDiffWithPrevious(jobNumber:String) : Object {

    var rootNode = Bundle.resolveInTransaction(\bundle -> {
      var policyPeriod = bundle.add(JobUtil.findJobByJobNumber(jobNumber).LatestPeriod)

      if (policyPeriod == null || !_policyAccessPlugin.hasAccess(policyPeriod)) {
        throw new BadIdentifierException("Bad job number " + jobNumber)
      }

    return new gw.api.tree.RowTreeRootNodeWrapper(gw.diff.tree.DiffTree.recalculateRootNodeForPolicyReview(policyPeriod)).rowTreeRootNode
    })
    return _policyDiffPlugin.toDTO(rootNode)
  }
  @ApidocAvailableSince("11.2")
  @JsonRpcMethod
  @ApidocMethodDescription("Returns the policy diff tree for given jobs")
  function compareJobs(jobNumber1:String, jobNumber2: String) : Object {
    var rootNode = Bundle.resolveInTransaction(\bundle -> {
      var policyPeriod1 = bundle.add(JobUtil.findJobByJobNumber(jobNumber1).LatestPeriod)

      if (policyPeriod1 == null || !_policyAccessPlugin.hasAccess(policyPeriod1)) {
        throw new BadIdentifierException("Bad job number " + jobNumber1)
      }

      var policyPeriod2 = bundle.add(JobUtil.findJobByJobNumber(jobNumber2).LatestPeriod)

      if (policyPeriod2 == null || !_policyAccessPlugin.hasAccess(policyPeriod2)) {
        throw new BadIdentifierException("Bad job number " + jobNumber2)
      }

    return new gw.api.tree.RowTreeRootNodeWrapper(
      gw.diff.tree.DiffTree.recalculateRootNode(policyPeriod1, policyPeriod2, DiffReason.TC_COMPAREJOBS)).rowTreeRootNode
    })

FEIN changes in the PolicyCenter API

The FEINOfficialID and _feinNumber have been masked in the following files:

PolicyCenter/modules/configuration/gsrc/edge/capabilities/gateway/contact/DefaultUnderwritingContactPlugin.gs
PolicyCenter/modules/configuration/gsrc/edge/capabilities/quote/submission/UnderwritingQuoteHandler.gs
PolicyCenter/modules/configuration/gsrc/edge/capabilities/quote/submission/base/DefaultUnderwritingBaseSubmissionPlugin.gs

The following changes have been made in the DefaultUnderwritingContactPlugin.gs file:

Original file content:

uses edge.capabilities.gateway.contact.dto.CompanyDTO
uses edge.capabilities.gateway.contact.dto.NamedInsuredCompanyDTO
uses edge.di.annotations.ForAllGwNodes
...
override function toDTO(aCompany: Company): NamedInsuredCompanyDTO {
    if (aCompany == null) {
      return null
    }
    final var dto = new NamedInsuredCompanyDTO()
    dto.FEIN = aCompany.FEINOfficialID
    dto.EmailAddress2 = aCompany.EmailAddress2
    dto.FaxNumber = aCompany.FaxPhone
    fillContact(aCompany, dto)
    return dto
  }

/**
   * Updates entity.Company from the values in the DTO
   *
   * @param aCompany entity.Company
   * @param dto      NamedInsuredCompanyDTO
   */

  override function updateContact(aCompany: Company, dto: NamedInsuredCompanyDTO) {
    if (aCompany == null) {
      return
    }
    aCompany.FEINOfficialID = dto.FEIN
    aCompany.EmailAddress2 = dto.EmailAddress2
    aCompany.FaxPhone = dto.FaxNumber
    super.updateContact(aCompany, dto)
  }
}

Updated file content:

uses edge.capabilities.gateway.contact.dto.CompanyDTO
uses edge.capabilities.gateway.contact.dto.NamedInsuredCompanyDTO
uses edge.di.annotations.ForAllGwNodes
uses gw.api.privacy.EncryptionMaskExpressions
...
override function toDTO(aCompany: Company): NamedInsuredCompanyDTO {
    if (aCompany == null) {
      return null
    }
    final var dto = new NamedInsuredCompanyDTO()
    dto.FEIN = EncryptionMaskExpressions.maskTaxId(aCompany.FEINOfficialID)
    dto.EmailAddress2 = aCompany.EmailAddress2
    dto.FaxNumber = aCompany.FaxPhone
    fillContact(aCompany, dto)
    return dto
  }

  /**
   * Updates entity.Company from the values in the DTO
   *
   * @param aCompany entity.Company
   * @param dto      NamedInsuredCompanyDTO
   */
  override function updateContact(aCompany: Company, dto: NamedInsuredCompanyDTO) {
    if (aCompany == null) {
      return
    }
    if (dto.FEIN != null && !dto.FEIN.equals(EncryptionMaskExpressions.maskTaxId(aCompany.FEINOfficialID))) {
      aCompany.FEINOfficialID = dto.FEIN
    }
    aCompany.EmailAddress2 = dto.EmailAddress2
    aCompany.FaxPhone = dto.FaxNumber
    super.updateContact(aCompany, dto)
  }
}

The following changes have been made in the UnderwritingQuoteHandler.gs file:

Original file content:

uses edge.security.authorization.IAuthorizerProviderPlugin
uses java.lang.IllegalArgumentException
uses java.lang.IllegalStateException
...
private function toDTOUpdateDraftSubmissionResponse(quoteDataDTO: QuoteDataDTO, submission: Submission): UpdateDraftSubmissionResponseDTO {
    return new UpdateDraftSubmissionResponseDTO(){
        :SessionUUID = quoteDataDTO.SessionUUID,
        :QuoteID = quoteDataDTO.QuoteID,
        :BaseData = quoteDataDTO.BaseData,
        :LobData = quoteDataDTO.LobData,
        :BindData = quoteDataDTO.BindData,
        :QuoteData = quoteDataDTO.QuoteData,
        :IsSubmitAgent = quoteDataDTO.IsSubmitAgent,
        :FeinNumber = submission.SelectedVersion.PrimaryNamedInsured.AccountContactRole.AccountContact.Contact.FEINOfficialID,
        :IndustryCode = _industryCodePlugin.toDTO(submission.SelectedVersion.PrimaryNamedInsured.IndustryCode)
        }
  }

Updated file content:

uses edge.security.authorization.IAuthorizerProviderPlugin
uses java.lang.IllegalArgumentException
uses java.lang.IllegalStateException
uses gw.api.privacy.EncryptionMaskExpressions
...
private function toDTOUpdateDraftSubmissionResponse(quoteDataDTO: QuoteDataDTO, submission: Submission): UpdateDraftSubmissionResponseDTO {
    return new UpdateDraftSubmissionResponseDTO(){
        :SessionUUID = quoteDataDTO.SessionUUID,
        :QuoteID = quoteDataDTO.QuoteID,
        :BaseData = quoteDataDTO.BaseData,
        :LobData = quoteDataDTO.LobData,
        :BindData = quoteDataDTO.BindData,
        :QuoteData = quoteDataDTO.QuoteData,
        :IsSubmitAgent = quoteDataDTO.IsSubmitAgent,
        :FeinNumber = EncryptionMaskExpressions.maskTaxId(submission.SelectedVersion.PrimaryNamedInsured.AccountContactRole.AccountContact.Contact.FEINOfficialID),
        :IndustryCode = _industryCodePlugin.toDTO(submission.SelectedVersion.PrimaryNamedInsured.IndustryCode)
        }
  }

The following changes have been made in the DefaultUnderwritingBaseSubmissionPlugin.gs file:

Original file content:

uses gw.api.util.DateUtil
uses java.lang.IllegalArgumentException
uses java.util.Date
...
override function updateDraftSubmission(selectedPeriod: PolicyPeriod, data: QuoteBaseDataDTO, updateDraftSubmissionRequestDTO: UpdateDraftSubmissionRequestDTO) {
    var allowedTermTypes = getTermTypes(selectedPeriod)
    if (not allowedTermTypes.contains(data.TermType)) {
      throw new IllegalArgumentException("Illeagl term ${data.TermType} for period")
    }
    selectedPeriod.TermType = data.TermType
    if (data.TermType == TermType.TC_OTHER and data.PeriodEndDate == null) {
      throw new IllegalArgumentException("Period End Date must be set when TermType is ${data.TermType}")
    }
    setPeriodDates(selectedPeriod, LocalDateUtil.toMidnightDate(data.PeriodStartDate), data.TermType)
    if (data.TermType == TermType.TC_OTHER) {
      selectedPeriod.PeriodEnd = LocalDateUtil.toMidnightDate(data.PeriodEndDate)
    }
    if (updateDraftSubmissionRequestDTO.FeinNumber.HasContent) {
      selectedPeriod.PrimaryNamedInsured.AccountContactRole.AccountContact.Contact.FEINOfficialID = updateDraftSubmissionRequestDTO.FeinNumber
    }
    if (updateDraftSubmissionRequestDTO.IndustryCode.Code.HasContent) {
      selectedPeriod.PrimaryNamedInsured.IndustryCode = _industryCodePlugin.findByCode(updateDraftSubmissionRequestDTO.IndustryCode.Code)
    }
  }

Updated file content:

uses gw.api.util.DateUtil
uses java.lang.IllegalArgumentException
uses java.util.Date
uses gw.api.privacy.EncryptionMaskExpressions
...
override function updateDraftSubmission(selectedPeriod: PolicyPeriod, data: QuoteBaseDataDTO, updateDraftSubmissionRequestDTO: UpdateDraftSubmissionRequestDTO) {
    var allowedTermTypes = getTermTypes(selectedPeriod)
    if (not allowedTermTypes.contains(data.TermType)) {
      throw new IllegalArgumentException("Illeagl term ${data.TermType} for period")
    }
    selectedPeriod.TermType = data.TermType
    if (data.TermType == TermType.TC_OTHER and data.PeriodEndDate == null) {
      throw new IllegalArgumentException("Period End Date must be set when TermType is ${data.TermType}")
    }

    setPeriodDates(selectedPeriod, LocalDateUtil.toMidnightDate(data.PeriodStartDate), data.TermType)
    if (data.TermType == TermType.TC_OTHER) {
      selectedPeriod.PeriodEnd = LocalDateUtil.toMidnightDate(data.PeriodEndDate)
    }
    if (updateDraftSubmissionRequestDTO.FeinNumber.HasContent) {
      var _feinNumber = updateDraftSubmissionRequestDTO.FeinNumber
      if (_feinNumber != null && !_feinNumber.equals(EncryptionMaskExpressions.maskTaxId(_feinNumber))) {
        selectedPeriod.PrimaryNamedInsured.AccountContactRole.AccountContact.Contact.FEINOfficialID = _feinNumber
      }
    }
    if (updateDraftSubmissionRequestDTO.IndustryCode.Code.HasContent) {
      selectedPeriod.PrimaryNamedInsured.IndustryCode = _industryCodePlugin.findByCode(updateDraftSubmissionRequestDTO.IndustryCode.Code)
    }
  }

Policyholder contact changes in the PolicyCenter API

Access to the policyholder account contacts have been restricted in the following files:

PolicyCenter/modules/configuration/gsrc/edge/capabilities/gateway/contact/ContactsHandler.gs
PolicyCenter/modules/configuration/gsrc/edge/capabilities/gateway/policy/PolicyHandler.gs
PolicyCenter/modules/configuration/gsrc/edge/capabilities/rewrite/GatewayRewriteHandler.gs
PolicyCenter/modules/configuration/gsrc/edge/capabilities/renewal/GatewayRenewalHandler.gs

The following changes have been made in the ContactsHandler.gs file:

Original file content:

@JsonRpcMethod
  @ApidocMethodDescription("Retrieves the main account contacts.")
  @ApidocAvailableSince("6.0")
  public function getMainAccountContacts(

Updated file content:

@JsonRpcRunAsInternalGWUser
  @JsonRpcMethod
  @ApidocMethodDescription("Retrieves the main account contacts.")
  @ApidocAvailableSince("6.0")
  public function getMainAccountContacts(

Original file contents:

@JsonRpcMethod
  @ApidocMethodDescription("Retrieves related account contacts.")
  @ApidocAvailableSince("6.0")
  public function getRelatedAccountContacts(

Updated file contents:

@JsonRpcRunAsInternalGWUser
  @JsonRpcMethod
  @ApidocMethodDescription("Retrieves related account contacts.")
  @ApidocAvailableSince("6.0")
  public function getRelatedAccountContacts(

Original file contents:

 @JsonRpcMethod
  @ApidocMethodDescription("Retrieves common account contacts.")
  @ApidocAvailableSince("6.0")
  public function getCommonAccountContacts(

Updated file contents:

@JsonRpcRunAsInternalGWUser
  @JsonRpcMethod
  @ApidocMethodDescription("Retrieves common account contacts.")
  @ApidocAvailableSince("6.0")
  public function getCommonAccountContacts(

Original file contents:

@JsonRpcMethod
  @ApidocMethodDescription("Retrieves account contact details.")
  @ApidocAvailableSince("6.0")
  function getAccountContactDetails(publicId : String) : AccountContactDetailsDTO {

Updated file contents:

@JsonRpcRunAsInternalGWUser
  @JsonRpcMethod
  @ApidocMethodDescription("Retrieves account contact details.")
  @ApidocAvailableSince("6.0")
  function getAccountContactDetails(publicId : String) : AccountContactDetailsDTO {

Original file contents:

@JsonRpcMethod
  @ApidocMethodDescription("Removes the Policy Contact From a Job, if Contact is not Primary Insured")
  @ApidocAvailableSince("7.0")
  public function removePolicyContact(jobId: String, contactId: String) {

Updated file contents:

@JsonRpcRunAsInternalGWUser
  @JsonRpcMethod
  @ApidocMethodDescription("Removes the Policy Contact From a Job, if Contact is not Primary Insured")
  @ApidocAvailableSince("7.0")
  public function removePolicyContact(jobId: String, contactId: String) {

Original file contents:

@JsonRpcMethod
  @ApidocMethodDescription("Removes the Coverable Contact from the all Lines on the Job")
  @ApidocAvailableSince("7.0")
  public function removeCoverableContact(jobId: String, coverableId: String, contactId: String) {

Updated file contents:

@JsonRpcRunAsInternalGWUser
  @JsonRpcMethod
  @ApidocMethodDescription("Removes the Coverable Contact from the all Lines on the Job")
  @ApidocAvailableSince("7.0")
  public function removeCoverableContact(jobId: String, coverableId: String, contactId: String) {

Original file contents:

@JsonRpcMethod
  @ApidocMethodDescription("Retrieves all Policy Contact Roles")
  @ApidocAvailableSince("7.0")
  public function getAllPolicyContactRoles(): AvailableContactRoleDTO[] {

Updated file contents:

@JsonRpcRunAsInternalGWUser
  @JsonRpcMethod
  @ApidocMethodDescription("Retrieves all Policy Contact Roles")
  @ApidocAvailableSince("7.0")
  public function getAllPolicyContactRoles(): AvailableContactRoleDTO[] {

Original file contents:

@JsonRpcMethod
  @ApidocMethodDescription("Creates a new contact on the policy job")
  @ApidocAvailableSince("7.0")
  public function createPolicyContact(jobId: String, aPolicyContactDetailsDTO:

Updated file contents:

@JsonRpcRunAsInternalGWUser
  @JsonRpcMethod
  @ApidocMethodDescription("Creates a new contact on the policy job")
  @ApidocAvailableSince("7.0")
  public function createPolicyContact(jobId: String, aPolicyContactDetailsDTO:

Original file contents:

@JsonRpcMethod
  @ApidocMethodDescription("Updates an existing contact on the policy job")
  @ApidocAvailableSince("7.0")
  public function updatePolicyContact(jobId: String, aPolicyContactDetailsDTO:

Updated file contents:

@JsonRpcRunAsInternalGWUser
  @JsonRpcMethod
  @ApidocMethodDescription("Updates an existing contact on the policy job")
  @ApidocAvailableSince("7.0")
  public function updatePolicyContact(jobId: String, aPolicyContactDetailsDTO:

Original file contents:

@JsonRpcMethod
  @ApidocMethodDescription("Create an Account Contact on the account")
  @ApidocAvailableSince("7.0")
  public function createAccountContact(accountId: String, anAccountContactDetailsDTO:

Updated file contents:

@JsonRpcRunAsInternalGWUser
  @JsonRpcMethod
  @ApidocMethodDescription("Create an Account Contact on the account")
  @ApidocAvailableSince("7.0")
  public function createAccountContact(accountId: String, anAccountContactDetailsDTO:

Original file contents:

@JsonRpcMethod
  @ApidocMethodDescription("Delete an Account Contact from the account")
  @ApidocAvailableSince("7.0")
  public function removeAccountContact(accountId: String, accountContactPublicId: String) {

Updated file contents:

@JsonRpcRunAsInternalGWUser
  @JsonRpcMethod
  @ApidocMethodDescription("Delete an Account Contact from the account")
  @ApidocAvailableSince("7.0")
  public function removeAccountContact(accountId: String, accountContactPublicId: String) {

Original file contents:

@JsonRpcMethod
  @ApidocMethodDescription("Update an Account Contact from the account")
  @ApidocAvailableSince("7.0")
  public function updateAccountContact(accountId: String, anAccountContactDetailsDTO:

Updated file contents:

@JsonRpcRunAsInternalGWUser
  @JsonRpcMethod
  @ApidocMethodDescription("Update an Account Contact from the account")
  @ApidocAvailableSince("7.0")
  public function updateAccountContact(accountId: String, anAccountContactDetailsDTO:

Original file contents:

@JsonRpcMethod
  @ApidocMethodDescription("Update an Account Contact from the account")
  @ApidocAvailableSince("7.0")
  public function createContact(accountContactDTO: AccountContactDTO) : AccountContactDTO {

Updated file contents:

@JsonRpcRunAsInternalGWUser
  @JsonRpcMethod
  @ApidocMethodDescription("Update an Account Contact from the account")
  @ApidocAvailableSince("7.0")
  public function createContact(accountContactDTO: AccountContactDTO) : AccountContactDTO {

Original file contents:

@JsonRpcMethod
  @ApidocMethodDescription("Retrieves all Account Contact Roles")
  @ApidocAvailableSince("7.0")
  public function getAllAccountContactRoles(): AvailableContactRoleDTO[] {

Updated file contents:

@JsonRpcRunAsInternalGWUser
  @JsonRpcMethod
  @ApidocMethodDescription("Retrieves all Account Contact Roles")
  @ApidocAvailableSince("7.0")
  public function getAllAccountContactRoles(): AvailableContactRoleDTO[] {

The following changes have been made in the PolicyHandler.gs file:

Original file contents:

@JsonRpcMethod
  @ApidocMethodDescription("Returns the job type of a policy period")
  @ApidocAvailableSince("8.0")
  function getPolicyPeriodJobType(policyNumber: String, termNumber: int): String {

Updated file content:

@JsonRpcRunAsInternalGWUser
  @JsonRpcMethod
  @ApidocMethodDescription("Returns the job type of a policy period")
  @ApidocAvailableSince("8.0")
  function getPolicyPeriodJobType(policyNumber: String, termNumber: int): String {

The following changes have been made in the GatewayRewriteHandler.gs file:

Original file content:

@JsonRpcMethod
  @ApidocMethodDescription("Checks if a job has been quoted.")
  @ApidocAvailableSince("8.0")
  function isQuoted(jobNumber: String) : Boolean {

Updated file content:

@JsonRpcRunAsInternalGWUser
  @JsonRpcMethod
  @ApidocMethodDescription("Checks if a job has been quoted.")
  @ApidocAvailableSince("8.0")
  function isQuoted(jobNumber: String) : Boolean {

The following changes have been made in the GatewayRenewalHandler.gs file:

Original file content:

@JsonRpcMethod
  @ApidocMethodDescription("Checks if a job has been quoted.")
  @ApidocAvailableSince("7.0")
  function isQuoted(renewalNumber:String) : Boolean {

Updated file content:

@JsonRpcRunAsInternalGWUser
  @JsonRpcMethod
  @ApidocMethodDescription("Checks if a job has been quoted.")
  @ApidocAvailableSince("7.0")
  function isQuoted(renewalNumber:String) : Boolean {

Fixed undefined values for the frontend ClaimsDetails file

The following changes have been made in the DigitalPortals/applications/common/capabilities-react/gw-capability-claim-react/pages/ClaimDetails/ClaimDetails.jsx file:

Original file contents:

getReportedByName = (claimDetailsData, translator) => {
  if (claimDetailsData.claimReporter.reportedBy.displayName) {
    return claimDetailsData.claimReporter.reportedBy.displayName;
  }
return translator(messages.unknown);

Updated file contents:

  getReportedByName = (claimDetailsData, translator) => {
  if (claimDetailsData.claimReporter.reportedBy?.displayName) {
    return claimDetailsData.claimReporter.reportedBy.displayName;
  }
return translator(messages.unknown);

2025.03 release

This section lists the updates introduced in the 2025.03 release.

New Jutro version

Digital reference applications now use Jutro 10.10.0. For changes in Jutro since the previous release, see the Jutro release notes.

Inactivity timer customization

A new feature has been introduced to customize the inactivity timer duration. Previously a session would be logged out after a set period of time which was linked to the auth token expiration duration and this could not be changed. You can now customize the duration of this inactivity timer. For more information, see the CustomerEngage Account Management Development Guide.

Authentication client changes

A new Okta authentication client has been introduced, as an alternative to the OIDC authentication client. This Okta client is an updated version of the client used previously and is now the default client. Users of the OIDC client do not need to take any action, your setup is unchanged, the OIDC client is still functional and can still be used. If you are migrating from a pre-Innsbruck release, your applications are configured to use the new Okta authentication client by default.

See the Installation Guide for more information about the updates to support for authentication clients.

Note: Updates and upgrades are not affected by your choice of auth client.

Updated version of babel/core

The babel/core package has been updated to version 7.22.0.

Update to Jest version

The Jest version has been updated from version 26.6.3 to version 29.7.0. Some changes from Jest version 27 onward may have impacted how asynchronous tests behave.

Removal of the platform/api-docs folder

The platform/api-docs folder has been removed and JS Docs can no longer be generated locally. See the Digital Frontend API Documentation for more information.

Node 22 support

Node 22 is not yet supported. Support for Node 22 will be included in upcoming patches of the release in June.

Edge API configuration changes

Guidewire has modified the configuration of certain Edge APIs so that particular fields are only returned to users who are authorized to access such data in those fields. There are steps that you must take to continue returning that data, along with testing your Edge configuration. You can find these file changes in your own repository using the us_mamm_2025_03_0-bc-cc-cm-pc-dg/13.0.13.2 tag and need to manually add the changes to your own files. The following files show the configuration changes:

Claim contacts changes in the ClaimCenter API

The returned third-party claim contacts have been restricted by applying a filter in following ClaimCenter API files:

ClaimCenter/modules/configuration/gsrc/edge/capabilities/claim/auth/ClaimContactAuthorizer.gs
ClaimCenter/modules/configuration/gsrc/edge/capabilities/claim/auth/GatewayClaimContactAuthorizer.gs

The following changes have been made in the ClaimContactAuthorizer.gs file:

Original file contents:

override function canAccess(contact: ClaimContact): boolean {
  var user = UserProvider.EffectiveUser

  if (!_supportedLobsPlugin.getSupportedLobs().contains(contact.Claim.Policy.PolicyType)) {
    return false
  }

  if (user.getTargets(AuthorityType.PRODUCER).HasElements) {
    // Producers can access any contact
    return true
  }

  if (user.getTargets(AuthorityType.POLICY).HasElements || user.getTargets(AuthorityType.ACCOUNT).HasElements) {
    // Policyholders can access any contact but vendors other than auto repair shops or auto towing agencies
    if (!ClaimContactUtil.isVendor(contact) || AuthorityPolicyCanView(contact)) {
      return true
    }
  }

  final var vendorAuths = user.getTargets(AuthorityType.VENDOR)
  if (vendorAuths.HasElements) {
    // Vendors can see any contact but vendors other than themselves
    if (!ClaimContactUtil.isVendor(contact) || vendorAuths.contains(contact.Contact.AddressBookUID)) {
      return true
    }
  }

  return false
}

private function AuthorityPolicyCanView(contact: ClaimContact): boolean {
    /*
     * Policyholders can access any contact but vendors except auto repair shops, auto towing agencies, or if vendor
     * type any of the following: a) CompanyVendor or b) PersonVendor or c.) a subtypes of the type of CompanyVendor or
     * PersonVendor
     */
    var isAuto = contact.AutoRepairShop != null || contact.AutoTowingAgcy != null
    var isCompanyVendor = contact.CompanyVendor != null && contact.Company.Subtype.Code == "CompanyVendor"
    var isPersonVendor = contact.PersonVendor != null
    return isAuto || isCompanyVendor || isPersonVendor
  }
}

Updated file contents:

override function canAccess(contact: ClaimContact): boolean {
    var user = UserProvider.EffectiveUser
    if (!_supportedLobsPlugin.getSupportedLobs().contains(contact.Claim.Policy.PolicyType)) {
      return false
    }
    if (user.getTargets(AuthorityType.PRODUCER).HasElements) {
      if (authorityProducerRolesAllowed(contact)) {
        return true
      }
    }
    if (user.getTargets(AuthorityType.POLICY).HasElements || user.getTargets(AuthorityType.ACCOUNT).HasElements) {
      // Policyholders can access allowed contact contact roles, no vendors other than auto repair shops or auto towing agencies
      if (authorityPolicyRolesAllowed(contact) || AuthorityPolicyCanView(contact)) {
        return true
      }
    }
    final var vendorAuths = user.getTargets(AuthorityType.VENDOR)
    if (vendorAuths.HasElements) {
      if (authorityVendorRolesAllowed(contact) || vendorAuths.contains(contact.Contact.AddressBookUID)) {
        return true
      }
    }
    return false
  }

  private function authorityProducerRolesAllowed(contact: ClaimContact): boolean {

    var allowedRoles = new ArrayList<ContactRole>()
    //Please add additional allowed roles here
    allowedRoles.add(ContactRole.get("insured"))
    allowedRoles.add(ContactRole.get("coveredparty"))
    allowedRoles.add(ContactRole.get("agent"))

    var hasRole = false
    var roles = contact.getRoles()
    for (role in roles) {
      if (allowedRoles.contains(role.getRole())) {
        hasRole = true
        break
      }
    }
    return hasRole
  }

  private function authorityVendorRolesAllowed(contact: ClaimContact): boolean {
    var allowedRoles = new ArrayList<ContactRole>()
    //Please add additional allowed roles here
    allowedRoles.add(ContactRole.get("insured"))
    var hasRole = false
    var roles = contact.getRoles()
    for (role in roles) {
      if (allowedRoles.contains(role.getRole())) {
        hasRole = true
        break
      }
    }
    return hasRole
  }

  private function authorityPolicyRolesAllowed(contact: ClaimContact): boolean {
    var allowedRoles = new ArrayList<ContactRole>()
    //Please add additional allowed roles here
    allowedRoles.add(ContactRole.get("insured"))
    allowedRoles.add(ContactRole.get("coveredparty"))
    var hasRole = false
    var roles = contact.getRoles()
    for (role in roles) {
      if (allowedRoles.contains(role.getRole())) {
        hasRole = true
        break
      }
    }
    return hasRole
  }

  private function AuthorityPolicyCanView(contact: ClaimContact): boolean {
    var isAuto = contact.AutoRepairShop != null || contact.AutoTowingAgcy != null
    return isAuto
  }
}

The following changes have been made in the GatewayClaimContactAuthorizer.gs file:

Original file contents:

override function canAccess(contact: ClaimContact): boolean {
  if (!_supportedLobsPlugin.getSupportedLobs().contains(contact.Claim.Policy.PolicyType)) {
    return false
  }

  return true
  }
}

Updated file contents:

override function canAccess(contact: ClaimContact): boolean {
    if (!_supportedLobsPlugin.getSupportedLobs().contains(contact.Claim.Policy.PolicyType)) {
      return false
    }

    return authorityProducerRolesAllowed(contact)
  }

  private function authorityProducerRolesAllowed(contact: ClaimContact): boolean {

    var allowedRoles = new ArrayList<ContactRole>()
    //Please add additional allowed roles here
    allowedRoles.add(ContactRole.get("insured"))
    allowedRoles.add(ContactRole.get("coveredparty"))
    allowedRoles.add(ContactRole.get("agent"))

    var hasRole = false
    var roles = contact.getRoles()
    for (role in roles) {
      if (allowedRoles.contains(role.getRole())) {
        hasRole = true
        break
      }
    }
    return hasRole
  }
}

Third-party exposure changes in the ClaimCenter API

The returned third-party exposures have been restricted by modifying how the toContactDTO method filters the exposures being returned in the following ClaimCenter API files:

ClaimCenter/modules/configuration/gsrc/edge/capabilities/claim/details/DefaultClaimDetailPlugin.gs

Original file contents:

res.Exposures = claim.Exposures.map(\ e -> convertExposure(e))

Updated file contents:

res.Exposures = claim.Exposures.where(\e -> e.LossParty == TC_INSURED)
.map(\e -> convertExposure(e))

Third-party service request changes in the ClaimCenter API

The returned third-party service requests have been restricted by applying a filter in the following ClaimCenter API files:

ClaimCenter/modules/configuration/gsrc/edge/capabilities/claim/auth/ServiceRequestAuthorizer.gs
ClaimCenter/modules/configuration/gsrc/edge/capabilities/claim/auth/GatewayServiceRequestAuthorizer.gs

The following changes have been made in the ServiceRequestAuthorizer.gs file:

Original file contents:

var _userProvider : EffectiveUserProvider as readonly UserProvider

@ForAllGwNodes("claim")
@ForAllGwNodes("fnol")
@ForAllGwNodes("document")
construct(aUserProvider: EffectiveUserProvider) {
  _userProvider = aUserProvider
}

override function canAccess(serviceRequest: ServiceRequest): boolean {
  var user = UserProvider.EffectiveUser

  if (user.hasAuthority(AuthorityType.PRODUCER, serviceRequest.Claim.Policy.ProducerCode)) {
    return true

  }

  if (user.hasAuthority(AuthorityType.POLICY, serviceRequest.Claim.Policy.PolicyNumber)) {
    if (serviceRequest.Claim.Policy.PolicyType == PolicyType.TC_WORKERSCOMP) {
      if (serviceRequest.Claim.getContactByRole(ContactRole.TC_CLAIMANT) == serviceRequest.Instruction.CustomerContact) {
        return true
      }
    } else {
      if (serviceRequest.Claim.Policy.insured == serviceRequest.Instruction.CustomerContact) {
        return true
      }
    }
  } else if (hasAccessToAccount(user, serviceRequest.Claim.Policy.AccountNumber)) {
    return true
  }

  return false;
}

Updated file contents:

private var _claimContactAuthorizer : Authorizer<ClaimContact>

@ForAllGwNodes("claim")
@ForAllGwNodes("fnol")
@ForAllGwNodes("document")
construct(aUserProvider: EffectiveUserProvider, claimContactAuthorizer : Authorizer<ClaimContact>) {
  _userProvider = aUserProvider
  this._claimContactAuthorizer = claimContactAuthorizer
}

override function canAccess(serviceRequest: ServiceRequest): boolean {
  var user = UserProvider.EffectiveUser

  if (user.hasAuthority(AuthorityType.PRODUCER, serviceRequest.Claim.Policy.ProducerCode)) {
    if (_claimContactAuthorizer.canAccess(serviceRequest.Claim.getClaimContact(serviceRequest.Instruction.CustomerContact))) {
      return true
    }
  }

  if (user.hasAuthority(AuthorityType.POLICY, serviceRequest.Claim.Policy.PolicyNumber)) {
    if (serviceRequest.Claim.Policy.PolicyType == PolicyType.TC_WORKERSCOMP) {
      if (serviceRequest.Claim.getContactByRole(ContactRole.TC_CLAIMANT) == serviceRequest.Instruction.CustomerContact) {
        return true
      }
    } else {
      if (serviceRequest.Claim.Policy.insured == serviceRequest.Instruction.CustomerContact) {
        return true
      }
    }
  } else if (hasAccessToAccount(user, serviceRequest.Claim.Policy.AccountNumber)
      && serviceRequest.Claim.Policy.insured == serviceRequest.Instruction.CustomerContact) {
    return true
  }

  return false;
}

The following changes have been made in the GatewayServiceRequestAuthorizer.gs file:

Original file contents:

class GatewayServiceRequestAuthorizer implements Authorizer<ServiceRequest> {
  private var _userProvider : EffectiveUserProvider as readonly UserProvider
  private var _edgeAuthorizationPlugin : IEdgeAuthorizationPlugin

  @ForAllGwNodes("gatewayclaim")
  @ForAllGwNodes("gatewayfnol")
  @ForAllGwNodes("gatewaydocument")
  @Param("anEdgeAuthorizationPlugin", "Plugin to check authorization to access entities")
  construct(anEdgeAuthorizationPlugin : IEdgeAuthorizationPlugin) {
    this._edgeAuthorizationPlugin = anEdgeAuthorizationPlugin
  }

  override function canAccess(item : ServiceRequest) : boolean {
    return _edgeAuthorizationPlugin.isAuthorizedOnPolicy(item.Claim.Policy.PolicyNumber)

  }
}

Updated file contents:

class GatewayServiceRequestAuthorizer implements Authorizer<ServiceRequest> {
  private var _userProvider : EffectiveUserProvider as readonly UserProvider
  private var _edgeAuthorizationPlugin : IEdgeAuthorizationPlugin
  private var _claimContactAuthorizer : Authorizer<ClaimContact>

  @ForAllGwNodes("gatewayclaim")
  @ForAllGwNodes("gatewayfnol")
  @ForAllGwNodes("gatewaydocument")
  @Param("anEdgeAuthorizationPlugin", "Plugin to check authorization to access entities")
  construct(anEdgeAuthorizationPlugin : IEdgeAuthorizationPlugin, claimContactAuthorizer : Authorizer<ClaimContact>) {
    this._edgeAuthorizationPlugin = anEdgeAuthorizationPlugin
    this._claimContactAuthorizer = claimContactAuthorizer
  }

  override function canAccess(item : ServiceRequest) : boolean {
    return _edgeAuthorizationPlugin.isAuthorizedOnPolicy(item.Claim.Policy.PolicyNumber) &&
        _claimContactAuthorizer.canAccess(item.Claim.getClaimContact(item.Instruction.CustomerContactGw))
  }
}

Third-party check changes in the ClaimCenter API

The returned third-party checks have been restricted by applying a filter in the following ClaimCenter API files:

ClaimCenter/modules/configuration/gsrc/edge/capabilities/claim/auth/CheckAuthorizer.gs

Original file contents:

class CheckAuthorizer implements Authorizer<Check> {
  /**
   * User provider for the check.
   */
  private var _userProvider : EffectiveUserProvider as readonly UserProvider

  @ForAllGwNodes
  construct(aUserProvider : EffectiveUserProvider) {
    this._userProvider = aUserProvider
  }

  override function canAccess(item : Check) : boolean {
    var isVendor = UserProvider.EffectiveUser.GrantedAuthorities.hasMatch(\authority -> authority.AuthorityType == AuthorityType.VENDOR)
    return !isVendor
  }
}

Updated file contents:

class CheckAuthorizer implements Authorizer<Check> {
  /**
   * User provider for the check.
   */
  private var _userProvider : EffectiveUserProvider as readonly UserProvider
  private var _claimContactAuthorizer : Authorizer<ClaimContact>

  @ForAllGwNodes
  construct(aUserProvider : EffectiveUserProvider, claimContactAuthorizer : Authorizer<ClaimContact>) {

    this._userProvider = aUserProvider
    this._claimContactAuthorizer = claimContactAuthorizer
  }

  override function canAccess(item : Check) : boolean {

    if (UserProvider.EffectiveUser.GrantedAuthorities.hasMatch(\authority -> authority.AuthorityType == AuthorityType.VENDOR)){
        return false
    }

    if (_claimContactAuthorizer.canAccess(item.FirstPayee.ClaimContact)) {
      return true
    }

    return false
  }
}

Policy-only vehicle and vehicle incident changes in the ClaimCenter API

The returned policy-only vehicles and vehicles incidents have been restricted by applying a filter in the following ClaimCenter API files:

ClaimCenter/modules/configuration/gsrc/edge/capabilities/claim/lob/impl/lob-pa-personalauto/claimdetail/PAClaimDetailPlugin.gs
ClaimCenter/modules/configuration/gsrc/edge/capabilities/claim/lob/impl/commonauto/DefaultVehicleIncidentPlugin.gs

The following changes have been made in the PAClaimDetailPlugin.gs file:

Original file contents:

override function toDTO(claim : Claim) : PAClaimDetailExtensionDTO {
    if (claim.Policy.PolicyType != PaTypeCode.PersonalAuto) {
      return null
    }

    final var res = new PAClaimDetailExtensionDTO()
    res.Vehicles = claim.Vehicles.map(\ v -> vehicleToDTO(claim, v))
    res.VehicleIncidents = claim.VehicleIncidentsOnly.map(\i -> _vehicleIncidentPlugin.toDTO(i))
    return res
  }

  override function exposureToDTO(exposure : Exposure) : PAClaimExposureExtensionDTO {
    if (exposure.VehicleIncident == null) {
      return null
    }

    final var res = new PAClaimExposureExtensionDTO()
    res.VehicleIncident = _vehicleIncidentPlugin.toDTO(exposure.VehicleIncident)
    return res
  }

  protected function vehicleToDTO(claim : Claim, v : Vehicle) : VehicleDTO {
    final var res = new VehicleDTO()
    VehicleUtil.fillBaseProperties(res, v)
    res.PolicyVehicle = VehicleUtil.isPolicyVehicle(claim, v)

    return res
  }
}

Updated file contents:

override function toDTO(claim : Claim) : PAClaimDetailExtensionDTO {
    if (claim.Policy.PolicyType != PaTypeCode.PersonalAuto) {
      return null
    }

    final var res = new PAClaimDetailExtensionDTO()
    res.Vehicles = claim.Vehicles.map(\ v -> vehicleToDTO(claim, v)).where(\elt -> elt != null)
    res.VehicleIncidents = claim.VehicleIncidentsOnly.map(\i -> _vehicleIncidentPlugin.toDTO(i)).where(\elt -> elt != null)
    return res
  }

  override function exposureToDTO(exposure : Exposure) : PAClaimExposureExtensionDTO {
    if (exposure.VehicleIncident == null) {
      return null
    }

    final var res = new PAClaimExposureExtensionDTO()
    res.VehicleIncident = _vehicleIncidentPlugin.toDTO(exposure.VehicleIncident)
    return res
  }

  protected function vehicleToDTO(claim : Claim, v : Vehicle) : VehicleDTO {
    var res = new VehicleDTO()
    if (VehicleUtil.isPolicyVehicle(claim, v)) {
      VehicleUtil.fillBaseProperties(res, v)
      res.PolicyVehicle = true
    } else {
      res = null
    }

    return res
  }
}

The following changes have been made in the DefaultVehicleIncidentPlugin file:

Original file contents:

override function toDTO(incident : VehicleIncident) : VehicleIncidentDTO {
    return Mapper.mapRef(incident,\ i -> {
      final var res = new VehicleIncidentDTO()
      fillBaseProperties(res, incident)
      res.Driver = Mapper.mapRef(
          incident.getClaimContactByRole(ContactRole.TC_DRIVER),
          \ c -> _claimContactPlugin.toContactDTO(c)
      )
      res.Passengers = _claimContactPlugin.toContactDTO(incident.getClaimContactsByRole(ContactRole.TC_PASSENGER))
      res.Vehicle = _mapper.mapRef(incident.Vehicle, \ v -> vehicleToDTO(incident.Claim, v))

      return res
    })
  }

Updated file contents:

override function toDTO(incident : VehicleIncident) : VehicleIncidentDTO {
    if (VehicleUtil.isPolicyVehicle(incident.Claim, incident.Vehicle)) {
      return Mapper.mapRef(incident,\ i -> {
        final var res = new VehicleIncidentDTO()
        fillBaseProperties(res, incident)
        res.Driver = Mapper.mapRef(
            incident.getClaimContactByRole(ContactRole.TC_DRIVER),
            \ c -> _claimContactPlugin.toContactDTO(c)
        )
        res.Passengers = _claimContactPlugin.toContactDTO(incident.getClaimContactsByRole(ContactRole.TC_PASSENGER))
        res.Vehicle = _mapper.mapRef(incident.Vehicle, \ v -> vehicleToDTO(incident.Claim, v))

        return res
      })
    } else {
      return null
    }
  }

TaxId changes in the ClaimCenter API

The TaxId has been masked in the ContactDTO in the following ClaimCenter API files:

ClaimCenter/modules/configuration/gsrc/edge/capabilities/claim/contact/dto/ContactDTO.gs
ClaimCenter/modules/configuration/gsrc/edge/capabilities/claim/contact/DefaultContactPlugin.gs

The following changes have been made in the ContactDTO.gs file:

Original file contents:

@JsonProperty @Pattern("^([0-9]{3}-[0-9]{2}-[0-9]{4}$|^[0-9]{2}-[0-9]{7})$")
var _taxID : String as TaxID

Updated file contents:

@JsonProperty @Pattern("^([0-9,*]{3}-[0-9,*]{2}-[0-9,*]{4}$|^[0-9,*]{2}-[0-9,*]{7})$")
var _taxID : String as TaxID

The following changes have been made in the DefaultContactPlugin.gs file:

Original file contents:

public static function updateBaseProperties(contact : Contact, dto : ContactDTO) {
  if ( contact typeis Person ) {
    final var person = contact as Person  // Carbon complains on Contact.FirstName
    person.FirstName = dto.FirstName
    person.LastName = dto.LastName
    person.Prefix = dto.Prefix
    person.Suffix = dto.Suffix
    person.MiddleName = dto.MiddleName
    person.CellPhone = dto.CellNumber
    person.DateOfBirth = dto.DateOfBirth
    person.Gender = dto.Gender
    ClaimContactPlatformHelper.updatePersonProperties(person, dto)
  }
  contact.Name = dto.ContactName
  contact.PrimaryPhone = dto.PrimaryPhoneType
  contact.HomePhone = dto.HomeNumber
  contact.WorkPhone = dto.WorkNumber
  contact.EmailAddress1 = dto.EmailAddress1
  contact.TaxID = dto.TaxID
}

public static function fillBaseProperties(dto : ContactDTO, contact : Contact) {
    dto.PublicID = contact.PublicID
    dto.AddressBookUID = contact.AddressBookUID
    dto.Subtype = contact.Subtype.Code
    dto.DisplayName = contact.DisplayName
    if(contact typeis CompanyVendor){
      dto.ContactType = "CompanyVendor"
    } else if(contact typeis PersonVendor){
      dto.ContactType = "PersonVendor"
    } else {
      dto.ContactType = contact.Subtype.Code
    }
    if(contact typeis Person){
      dto.FirstName = contact.FirstName
      dto.LastName = contact.LastName
      dto.Prefix = contact.Prefix
      dto.Suffix = contact.Suffix
      dto.MiddleName = contact.MiddleName
      dto.CellNumber = contact.CellPhone
      dto.DateOfBirth = contact.DateOfBirth
      dto.Gender = contact.Gender
      ClaimContactPlatformHelper.fillPersonProperties(dto, contact)
      if (contact typeis PersonVendor) {
        dto.PrimaryContactName = contact.PrimaryContact.DisplayName
      }
    } else if (contact typeis CompanyVendor) {
      dto.PrimaryContactName = contact.PrimaryContact.DisplayName
    }
    dto.ContactName = contact.Name
    dto.PrimaryPhoneType = contact.PrimaryPhone
    dto.HomeNumber = contact.HomePhone
    dto.WorkNumber = contact.WorkPhone
    dto.FaxNumber = contact.FaxPhone
    dto.EmailAddress1 = contact.EmailAddress1
    dto.TaxID = contact.TaxID
  }
}

Updated file contents:

public static function updateBaseProperties(contact : Contact, dto : ContactDTO) {
  if ( contact typeis Person ) {
    final var person = contact as Person  // Carbon complains on Contact.FirstName
    person.FirstName = dto.FirstName
    person.LastName = dto.LastName
    person.Prefix = dto.Prefix
    person.Suffix = dto.Suffix
    person.MiddleName = dto.MiddleName
    person.CellPhone = dto.CellNumber
    person.DateOfBirth = dto.DateOfBirth
    person.Gender = dto.Gender
    ClaimContactPlatformHelper.updatePersonProperties(person, dto)
  }
  contact.Name = dto.ContactName
  contact.PrimaryPhone = dto.PrimaryPhoneType
  contact.HomePhone = dto.HomeNumber
  contact.WorkPhone = dto.WorkNumber
  contact.EmailAddress1 = dto.EmailAddress1
  if (dto.TaxID != null && !dto.TaxID.equals(contact.maskTaxId(contact.TaxID))) {
        contact.TaxID = dto.TaxID
  }
}

public static function fillBaseProperties(dto : ContactDTO, contact : Contact) {
    dto.PublicID = contact.PublicID
    dto.AddressBookUID = contact.AddressBookUID
    dto.Subtype = contact.Subtype.Code
    dto.DisplayName = contact.DisplayName
    if(contact typeis CompanyVendor){
      dto.ContactType = "CompanyVendor"
    } else if(contact typeis PersonVendor){
      dto.ContactType = "PersonVendor"
    } else {
      dto.ContactType = contact.Subtype.Code
    }
    if(contact typeis Person){
      dto.FirstName = contact.FirstName
      dto.LastName = contact.LastName
      dto.Prefix = contact.Prefix
      dto.Suffix = contact.Suffix
      dto.MiddleName = contact.MiddleName
      dto.CellNumber = contact.CellPhone
      dto.DateOfBirth = contact.DateOfBirth
      dto.Gender = contact.Gender
      ClaimContactPlatformHelper.fillPersonProperties(dto, contact)
      if (contact typeis PersonVendor) {
        dto.PrimaryContactName = contact.PrimaryContact.DisplayName
      }
    } else if (contact typeis CompanyVendor) {
      dto.PrimaryContactName = contact.PrimaryContact.DisplayName
    }
    dto.ContactName = contact.Name
    dto.PrimaryPhoneType = contact.PrimaryPhone
    dto.HomeNumber = contact.HomePhone
    dto.WorkNumber = contact.WorkPhone
    dto.FaxNumber = contact.FaxPhone
    dto.EmailAddress1 = contact.EmailAddress1
    dto.TaxID = contact.maskTaxId(contact.TaxID)
  }
}

Vendor claim access changes in the ClaimCenter API

Vendor claim access has been restricted by removing vendor authority access in the following ClaimCenter API files:

ClaimCenter/modules/configuration/gsrc/edge/capabilities/claim/auth/DocumentAuthorizer.gs
ClaimCenter/modules/configuration/gsrc/edge/capabilities/claim/auth/PolicyAuthorizer.gs

The following changes have been made in the DocumentAuthorizer.gs file:

Original file contents:

override function canAccess(doc : Document) : boolean {
  if (!isPortalDefaultAccessible(doc) || !perm.Document.view(doc)) {
    return false
  }
  var user = UserProvider.EffectiveUser
  if (user.hasAuthority(AuthorityType.POLICY, doc.Claim.Policy.PolicyNumber)) {
    if (doc.Author == user.Username) {
      return true
    }
  }
  if (user.hasAuthority(AuthorityType.PRODUCER, doc.Claim.Policy.ProducerCode)) {
    return true
  }
  if (user.hasAuthority(AuthorityType.ACCOUNT, doc.Claim.Policy.AccountNumber)) {
    return true
  }
  final var vendorAuths = user.getTargets(AuthorityType.VENDOR)
  if (vendorAuths.HasElements &&
      doc.Claim.Contacts.where(\cc -> ClaimContactUtil.isVendor(cc))*.Contact*.AddressBookUID
          .hasMatch(\s -> vendorAuths.contains(s))) {
    return true
  }
  return false
}

Updated file contents:

override function canAccess(doc : Document) : boolean {
  if (!isPortalDefaultAccessible(doc) || !perm.Document.view(doc)) {
    return false
  }
  var user = UserProvider.EffectiveUser
  if (user.hasAuthority(AuthorityType.POLICY, doc.Claim.Policy.PolicyNumber)) {
    if (doc.Author == user.Username) {
      return true
    }
  }
  if (user.hasAuthority(AuthorityType.PRODUCER, doc.Claim.Policy.ProducerCode)) {
    return true
  }
  if (user.hasAuthority(AuthorityType.ACCOUNT, doc.Claim.Policy.AccountNumber)) {
    return true
  }
  return false
}

The following changes have been made in the PolicyAuthorizer.gs file:

Original file contents:

override function canAccess(policy : Policy) : boolean {
    if (!_supportedLobsPlugin.getSupportedLobs().contains(policy.PolicyType)) {
      return false
    }
    var user = UserProvider.EffectiveUser
    if (user.hasAuthority(AuthorityType.POLICY, policy.PolicyNumber)) {
      return true
    }
    if (user.hasAuthority(AuthorityType.PRODUCER, policy.ProducerCode)) {
      return true
    }
    if (user.hasAuthority(AuthorityType.ACCOUNT, policy.AccountNumber)) {
      return true
    }
    final var vendorAuths = user.getTargets(AuthorityType.VENDOR)
    if (vendorAuths.HasElements &&
        policy.Claim.Contacts.where(\cc -> ClaimContactUtil.isVendor(cc))*.Contact*.AddressBookUID
            .hasMatch(\s -> vendorAuths.contains(s))) {
      return true
    }
    return false
  }
}

Updated file contents:

override function canAccess(policy : Policy) : boolean {
    if (!_supportedLobsPlugin.getSupportedLobs().contains(policy.PolicyType)) {
      return false
    }
    var user = UserProvider.EffectiveUser
    if (user.hasAuthority(AuthorityType.POLICY, policy.PolicyNumber)) {
      return true
    }
    if (user.hasAuthority(AuthorityType.PRODUCER, policy.ProducerCode)) {
      return true
    }
    if (user.hasAuthority(AuthorityType.ACCOUNT, policy.AccountNumber)) {
      return true
    }
    return false
  }
}

Financial details changes in the BillingCenter API

Credit card numbers and bank account details have been masked in the following BillingCenter API files:

BillingCenter/modules/configuration/gsrc/edge/aspects/validation/annotations/CreditCardNumber.gs
BillingCenter/modules/configuration/gsrc/edge/capabilities/billing/dto/AccountBankDetailsDTO.gs
BillingCenter/modules/configuration/gsrc/edge/capabilities/billing/PaymentInstrumentTokenHelper.gs

The following changes have been made in the CreditCardNumber.gs file:

Original file contents:

final var codeMap :  HashMap<String, int> = {
        CreditCardIssuer.TC_AMEX.Code -> 15,
        CreditCardIssuer.TC_MASTERCARD.Code -> 16,
        CreditCardIssuer.TC_DISCOVER.Code -> 16,
        CreditCardIssuer.TC_VISA.Code -> 16,
        CreditCardIssuer.TC_DINERSCLUB.Code -> 14
    }
  final var issuer = Expr.getProperty("CreditCardIssuer.Code", Validation.PARENT)
  final var requiredLength = Expr.call(ValidationFunctions#getFromMap(java.util.HashMap<Object,Object>,Object), {Expr.dtoConst(codeMap), issuer})
  override function getState(): Object[] {
    var creditCardNumberLength = Validation.strLength(Validation.VALUE)
    return {new ValidationRuleDTO(
        Expr.isNot(Expr.lessThan(creditCardNumberLength, requiredLength)),
            Expr.translate("Edge.Web.Api.Model.CreditCardNumber", {}))}
  }
}

Updated file contents:

final var codeMap :  HashMap<String, int> = {
     CreditCardIssuer.TC_AMEX.Code -> 15,
     CreditCardIssuer.TC_MASTERCARD.Code -> 16,
     CreditCardIssuer.TC_DISCOVER.Code -> 16,
     CreditCardIssuer.TC_VISA.Code -> 16,
     CreditCardIssuer.TC_DINERSCLUB.Code -> 14
}
final var issuer = Expr.getProperty("CreditCardIssuer.Code", Validation.PARENT)
final var requiredLength = Expr.call(ValidationFunctions#getFromMap(java.util.HashMap<Object,Object>,Object), {Expr.dtoConst(codeMap), issuer})
override function getState(): Object[] {
  var creditCardNumberLength = Validation.strLength(Validation.VALUE)
  return {new ValidationRuleDTO(
      Expr.all({
          Expr.isNot(Expr.lessThan(creditCardNumberLength, requiredLength)),
          Expr.isNot(Expr.call(ValidationFunctions#matchesPattern(String, String), {Expr.const("[0-9*-]+\\*+[0-9*-]+"), Validation.VALUE}))
      }),

      Expr.translate("Edge.Web.Api.Model.CreditCardNumber", {}))}
}

The following changes have been made in the AccountBankDetailsDTO.gs file:

Original file contents:

uses edge.aspects.validation.annotations.Required

class AccountBankDetailsDTO {
  @JsonProperty @Required
  var _bankABANumber : String as BankABANumber
  @JsonProperty @Required
  var _bankAccountNumber : String as BankAccountNumber
  @JsonProperty
  var _bankAccountType : typekey.BankAccountType as BankAccountType
  @JsonProperty @Required
  var _bankName : String as BankName
  construct(){}
}

Updated file contents:

uses edge.aspects.validation.annotations.Required
uses edge.aspects.validation.annotations.Pattern

class AccountBankDetailsDTO {
  @JsonProperty @Required @Pattern("[^\\*]+")
  var _bankABANumber : String as BankABANumber
  @JsonProperty @Required @Pattern("[^\\*]+")
  var _bankAccountNumber : String as BankAccountNumber
  @JsonProperty
  var _bankAccountType : typekey.BankAccountType as BankAccountType
  @JsonProperty @Required  @Pattern("[^\\*]+")
  var _bankName : String as BankName
  construct(){}
}

The following changes have been made in the PaymentInstrumentTokenHelper.gs file:

Original file contents:

uses edge.capabilities.billing.dto.AccountCreditCardDTO
uses java.io.IOException
uses java.util.Date
uses java.io.EOFException
uses java.lang.IllegalArgumentException

public static function toToken(dto : PaymentInstrumentDTO) : String {
  final var tokenWriter = new DemoTokenWriter()
    .putString(MAGIC)
    .putInt(2)

  switch (dto.PaymentMethod) {
    case PaymentMethod.TC_CREDITCARD:
      tokenWriter
        .putInt(1)
        .putString(dto.CreditCardData.CreditCardNumber)
        .putString(dto.CreditCardData.CreditCardIssuer.Code)
        .putLong(dto.CreditCardData.CreditCardExpDate.Time)
      break
    case PaymentMethod.TC_WIRE:
      tokenWriter
        .putInt(2)
        .putString(dto.BankAccountData.BankABANumber)
        .putString(dto.BankAccountData.BankAccountNumber)
        .putString(dto.BankAccountData.BankAccountType.Code)
        .putString(dto.BankAccountData.BankName)
      break
    default:
      throw new IllegalArgumentException("Bad payment method " + dto.PaymentMethod)
  }

  return tokenWriter.getString()

final var version = tokenizer.nextInt()
switch(version) {
  case 1:
    result.PaymentMethod = PaymentMethod.TC_WIRE
    result.BankAccountData = new AccountBankDetailsDTO()
    result.BankAccountData.BankABANumber = tokenizer.nextString()
    result.BankAccountData.BankAccountNumber = tokenizer.nextString()
    result.BankAccountData.BankAccountType = BankAccountType.get(tokenizer.nextString())
    result.BankAccountData.BankName = tokenizer.nextString()
    if (tokenizer.nextToken() != null) {
      throw new IOException("Bad token format: Trailing data")
    }
    return result
  case 2:
    final var methodCode = tokenizer.nextInt()
    switch (methodCode) {
      case 1:
        result.PaymentMethod = PaymentMethod.TC_CREDITCARD
        result.CreditCardData = new AccountCreditCardDTO()
        result.CreditCardData.CreditCardNumber = tokenizer.nextString()
        result.CreditCardData.CreditCardIssuer = CreditCardIssuer.get(tokenizer.nextString())
        result.CreditCardData.CreditCardExpDate = new Date(tokenizer.nextLong())
        if (tokenizer.nextToken() != null) {
          throw new IOException("Bad token format: Trailing data")
        }
        return result
      case 2:
        result.PaymentMethod = PaymentMethod.TC_WIRE
        result.BankAccountData = new AccountBankDetailsDTO()
        result.BankAccountData.BankABANumber = tokenizer.nextString()
        result.BankAccountData.BankAccountNumber = tokenizer.nextString()
        result.BankAccountData.BankAccountType = BankAccountType.get(tokenizer.nextString())
        result.BankAccountData.BankName = tokenizer.nextString()
        if (tokenizer.nextToken() != null) {
          throw new IOException("Bad token format: Trailing data")
        }

Updated file contents:

uses edge.capabilities.billing.dto.AccountCreditCardDTO
uses java.io.IOException
uses java.util.Date
uses java.io.EOFException
uses java.lang.IllegalArgumentException
uses gw.api.privacy.EncryptionMaskExpressions

public static function toToken(dto : PaymentInstrumentDTO) : String {
  final var tokenWriter = new DemoTokenWriter()
      .putString(MAGIC)
      .putInt(2)

  switch (dto.PaymentMethod) {
    case PaymentMethod.TC_CREDITCARD:
        tokenWriter
            .putInt(1)
            .putString(dto.CreditCardData.CreditCardNumber)
            .putString(dto.CreditCardData.CreditCardIssuer.Code)
            .putLong(dto.CreditCardData.CreditCardExpDate.Time)
      break
    case PaymentMethod.TC_WIRE:
        tokenWriter
            .putInt(2)
            .putString(dto.BankAccountData.BankABANumber)
            .putString(dto.BankAccountData.BankAccountNumber)
            .putString(dto.BankAccountData.BankAccountType.Code)
            .putString(dto.BankAccountData.BankName)
      break
    default:
      throw new IllegalArgumentException("Bad payment method " + dto.PaymentMethod)
  }
  return tokenWriter.getString()
}

final var version = tokenizer.nextInt()
switch(version) {
  case 1:
    result.PaymentMethod = PaymentMethod.TC_WIRE
    result.BankAccountData = new AccountBankDetailsDTO()
    result.BankAccountData.BankABANumber = EncryptionMaskExpressions.maskString(tokenizer.nextString(), 14,3)
    result.BankAccountData.BankAccountNumber = EncryptionMaskExpressions.maskString(tokenizer.nextString(), 14, 3)
    result.BankAccountData.BankAccountType = BankAccountType.get(tokenizer.nextString())
    result.BankAccountData.BankName = EncryptionMaskExpressions.maskString(tokenizer.nextString(), 14, 3)
    if (tokenizer.nextToken() != null) {
      throw new IOException("Bad token format: Trailing data")
    }
    return result
  case 2:
    final var methodCode = tokenizer.nextInt()
    switch (methodCode) {
      case 1:
        result.PaymentMethod = PaymentMethod.TC_CREDITCARD
        result.CreditCardData = new AccountCreditCardDTO()
        var number = tokenizer.nextString()
        result.CreditCardData.CreditCardNumber = EncryptionMaskExpressions.maskString(number, 14,4)
        result.CreditCardData.CreditCardIssuer = CreditCardIssuer.get(tokenizer.nextString())
        result.CreditCardData.CreditCardExpDate = new Date(tokenizer.nextLong())
        if (tokenizer.nextToken() != null) {
          throw new IOException("Bad token format: Trailing data")
        }
        return result
      case 2:
        result.PaymentMethod = PaymentMethod.TC_WIRE
        result.BankAccountData = new AccountBankDetailsDTO()
        result.BankAccountData.BankABANumber = EncryptionMaskExpressions.maskString(tokenizer.nextString(), 14, 3)
        result.BankAccountData.BankAccountNumber = EncryptionMaskExpressions.maskString(tokenizer.nextString(), 14, 3)
        result.BankAccountData.BankAccountType = BankAccountType.get(tokenizer.nextString())
        result.BankAccountData.BankName = EncryptionMaskExpressions.maskString(tokenizer.nextString(), 14, 3)
        if (tokenizer.nextToken() != null) {
          throw new IOException("Bad token format: Trailing data")
        }

As a part of this update, to mask the corresponding information on the frontend, you need to add the following code snippet - "maskChar": "*", to the creditCardNumber object in a number of files:

DigitalPortals/applications/common/capabilities-react/gw-capability-policychange-common-react/pages/Payments/HOPAPaymentPage/PaymentPage.metadata.json5
DigitalPortals/applications/common/capabilities-react/gw-capability-policyrenewal-common-react/pages/RenewalPaymentPage/PaymentPage.metadata.json5
DigitalPortals/applications/common/capabilities-react/gw-capability-quoteandbind-common-react/pages/PaymentDetails/PaymentDetailsPage.metadata.json5
DigitalPortals/applications/common/modules-react/gw-components-platform-react/PaymentComponent/PaymentComponent.metadata.json5

For more information about authorizers, see the CustomerEngage Account Management Development Guide. For more information about Guidewire's recommendations for personally identifiable information (PII), see this Guidewire Cloud Standards documentation page.