Merge branch 'alpha' of github.com:Tria-plc/edr-platform into alpha

2026-08-29 16:28:12 +00:00 · 2026-07-14 20:58:36 +03:00
parent f243fdd4e3 c8fe2a78f8
commit 05ff0c2595
96 changed files with 3654 additions and 542 deletions
--- a/apps/edr-passenger-api/src/modules/bookings/bookings.service.ts
+++ b/apps/edr-passenger-api/src/modules/bookings/bookings.service.ts
@@ -1745,13 +1745,40 @@ export class BookingsService {
    );
  }

+  // Resolves the passenger's actual boarding/alighting stations for one leg from
+  // originStationId/destinationStationId (set when the booking covers only part of a
+  // longer multi-stop schedule, e.g. train runs A→D but the passenger booked B→D) via
+  // the schedule's stopTimes, falling back to the schedule's own full-route endpoints
+  // when there's no segment override (older records, or a booking that covers the
+  // whole run). Mirrors notifications.service.ts's resolveSegmentStations — that's
+  // already applied to SMS/email; this brings the booking API (voucher, detail page,
+  // confirmation) to the same behavior instead of always showing the train's full route.
+  private resolveSegmentStations(
+    schedule: any,
+    originStationId: string | null | undefined,
+    destinationStationId: string | null | undefined,
+  ): { origin: any; destination: any } {
+    const stopTimes: any[] = schedule?.stopTimes ?? [];
+    const findStation = (stationId: string | null | undefined, fallback: any) => {
+      if (stationId && stopTimes.length > 0) {
+        const stop = stopTimes.find((st: any) => st.stationId === stationId);
+        if (stop?.station) return stop.station;
+      }
+      return fallback ?? null;
+    };
+    return {
+      origin: findStation(originStationId, schedule?.originStation),
+      destination: findStation(destinationStationId, schedule?.destinationStation),
+    };
+  }
+
  async getByRef(bookingRefOrId: string) {
    const isUuid = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i.test(bookingRefOrId);
    const booking = await this.prisma.booking.findUnique({
      where: isUuid ? { id: bookingRefOrId } : { bookingRef: bookingRefOrId },
      include: {
-        schedule: { include: { originStation: true, destinationStation: true, train: true } },
-        returnSchedule: { include: { originStation: true, destinationStation: true, train: true } },
+        schedule: { include: { originStation: true, destinationStation: true, train: true, stopTimes: { include: { station: true } } } },
+        returnSchedule: { include: { originStation: true, destinationStation: true, train: true, stopTimes: { include: { station: true } } } },
        seats: { include: { seat: { include: { coach: { include: { coachType: { include: { seatClasses: true } } } } } } } },
        paymentIntent: true, tickets: true,
        priceTier: { select: { priceMinor: true } },
@@ -1820,6 +1847,19 @@ export class BookingsService {
      };
    }

+    const outboundSegment = this.resolveSegmentStations(
+      (booking as any).schedule,
+      (booking as any).originStationId,
+      (booking as any).destinationStationId,
+    );
+    const returnSegment = (booking as any).returnSchedule
+      ? this.resolveSegmentStations(
+          (booking as any).returnSchedule,
+          (booking as any).returnOriginStationId,
+          (booking as any).returnDestinationStationId,
+        )
+      : null;
+
    return {
      id: booking.id, bookingRef: booking.bookingRef, status: booking.status,
      totalMinor: resolvePackageRoundTripTotal(booking, (booking as any).priceTier?.priceMinor, booking.adultCount, booking.childCount), currency: 'ETB',
@@ -1836,8 +1876,8 @@ export class BookingsService {
        id: (booking as any).schedule.id,
        trainNumber: (booking as any).schedule.train.number,
        trainName: (booking as any).schedule.train.name,
-        origin: { id: (booking as any).schedule.originStation.id, name: (booking as any).schedule.originStation.name, code: (booking as any).schedule.originStation.code, city: (booking as any).schedule.originStation.city },
-        destination: { id: (booking as any).schedule.destinationStation.id, name: (booking as any).schedule.destinationStation.name, code: (booking as any).schedule.destinationStation.code, city: (booking as any).schedule.destinationStation.city },
+        origin: { id: outboundSegment.origin.id, name: outboundSegment.origin.name, code: outboundSegment.origin.code, city: outboundSegment.origin.city },
+        destination: { id: outboundSegment.destination.id, name: outboundSegment.destination.name, code: outboundSegment.destination.code, city: outboundSegment.destination.city },
        departureAt: (booking as any).schedule.departureAt, arrivalAt: (booking as any).schedule.arrivalAt,
      },
      returnSchedule: (booking as any).returnSchedule
@@ -1845,8 +1885,8 @@ export class BookingsService {
            id: (booking as any).returnSchedule.id,
            trainNumber: (booking as any).returnSchedule.train.number,
            trainName: (booking as any).returnSchedule.train.name,
-            origin: { id: (booking as any).returnSchedule.originStation.id, name: (booking as any).returnSchedule.originStation.name, code: (booking as any).returnSchedule.originStation.code, city: (booking as any).returnSchedule.originStation.city },
-            destination: { id: (booking as any).returnSchedule.destinationStation.id, name: (booking as any).returnSchedule.destinationStation.name, code: (booking as any).returnSchedule.destinationStation.code, city: (booking as any).returnSchedule.destinationStation.city },
+            origin: { id: returnSegment!.origin.id, name: returnSegment!.origin.name, code: returnSegment!.origin.code, city: returnSegment!.origin.city },
+            destination: { id: returnSegment!.destination.id, name: returnSegment!.destination.name, code: returnSegment!.destination.code, city: returnSegment!.destination.city },
            departureAt: (booking as any).returnSchedule.departureAt, arrivalAt: (booking as any).returnSchedule.arrivalAt,
          }
        : null,
--- a/apps/edr-passenger-api/src/modules/fleet/fleet.controller.ts
+++ b/apps/edr-passenger-api/src/modules/fleet/fleet.controller.ts
@@ -3,7 +3,8 @@ import { ApiTags, ApiOperation, ApiBearerAuth, ApiParam, ApiQuery, ApiBody, ApiR
 import { FleetService } from './fleet.service';
 import { CreateTrainDto, CreateCoachDto, UpdateCoachDto, AssignCoachDto, ListCoachesDto, CreateCoachTypeDto, UpdateCoachTypeDto, CreateClassDto, UpdateClassDto, GenerateSeatMapDto } from './fleet.dto';
 import { JwtGuard } from '../../common/jwt.guard';
-import { PassengerAdmin } from '../../common/passenger-guards';
+import { PassengerAdmin, PassengerStaff } from '../../common/passenger-guards';
+import { PASSENGER_PERMS } from '../../seed/passenger-permissions.registry';

@ApiTags('Fleet')
@Controller('fleet')
@@ -21,6 +22,7 @@ export class FleetController {
  }

  @Post('coach-types')
+  @PassengerStaff([PASSENGER_PERMS.coaches.manage, PASSENGER_PERMS.admin])
  @ApiOperation({ summary: 'Create a coach type' })
  @ApiBody({ type: CreateCoachTypeDto })
  @ApiResponse({ status: 201, description: 'Coach type created' })
@@ -29,6 +31,7 @@ export class FleetController {
  }

  @Patch('coach-types/:id')
+  @PassengerStaff([PASSENGER_PERMS.coaches.manage, PASSENGER_PERMS.admin])
  @ApiOperation({ summary: 'Update a coach type' })
  @ApiParam({ name: 'id', description: 'Coach Type UUID' })
  @ApiBody({ type: UpdateCoachTypeDto })
@@ -59,6 +62,7 @@ export class FleetController {
  }

  @Post('classes')
+  @PassengerStaff([PASSENGER_PERMS.classes.manage, PASSENGER_PERMS.admin])
  @ApiOperation({ summary: 'Create a class' })
  @ApiBody({ type: CreateClassDto })
  @ApiResponse({ status: 201, description: 'Class created' })
@@ -67,6 +71,7 @@ export class FleetController {
  }

  @Patch('classes/:id')
+  @PassengerStaff([PASSENGER_PERMS.classes.manage, PASSENGER_PERMS.admin])
  @ApiOperation({ summary: 'Update a class' })
  @ApiParam({ name: 'id', description: 'Class UUID' })
  @ApiBody({ type: UpdateClassDto })
@@ -98,6 +103,7 @@ export class FleetController {
  }

  @Post('seat-classes')
+  @PassengerStaff([PASSENGER_PERMS.classes.manage, PASSENGER_PERMS.admin])
  @ApiOperation({ summary: 'Create a class (DEPRECATED - use /fleet/classes)' })
  @ApiBody({ type: CreateClassDto })
  @ApiResponse({ status: 201, description: 'Class created' })
@@ -106,6 +112,7 @@ export class FleetController {
  }

  @Patch('seat-classes/:id')
+  @PassengerStaff([PASSENGER_PERMS.classes.manage, PASSENGER_PERMS.admin])
  @ApiOperation({ summary: 'Update a class (DEPRECATED - use /fleet/classes)' })
  @ApiParam({ name: 'id', description: 'Class UUID' })
  @ApiBody({ type: UpdateClassDto })
@@ -136,6 +143,7 @@ export class FleetController {
  }

  @Post('trains')
+  @PassengerStaff([PASSENGER_PERMS.trains.manage, PASSENGER_PERMS.admin])
  @ApiOperation({ summary: 'Create a train service' })
  @ApiBody({ type: CreateTrainDto })
  @ApiResponse({ status: 201, description: 'Train created' })
@@ -144,6 +152,7 @@ export class FleetController {
  }

  @Patch('trains/:id')
+  @PassengerStaff([PASSENGER_PERMS.trains.manage, PASSENGER_PERMS.admin])
  @ApiOperation({ summary: 'Update a train service' })
  @ApiParam({ name: 'id', description: 'Train UUID' })
  @ApiBody({ type: CreateTrainDto })
@@ -166,6 +175,7 @@ export class FleetController {
  }

  @Patch('trains/:id/restore')
+  @PassengerStaff([PASSENGER_PERMS.trains.manage, PASSENGER_PERMS.admin])
  @ApiOperation({ summary: 'Restore (reactivate) a deactivated train' })
  @ApiParam({ name: 'id', description: 'Train UUID' })
  @ApiResponse({ status: 200, description: 'Train restored' })
@@ -268,6 +278,7 @@ export class FleetController {
  }

  @Post('coaches')
+  @PassengerStaff([PASSENGER_PERMS.coaches.manage, PASSENGER_PERMS.admin])
  @ApiOperation({ summary: 'Create a coach with auto-generated seat numbers' })
  @ApiBody({ type: CreateCoachDto })
  @ApiResponse({ 
@@ -293,6 +304,7 @@ export class FleetController {
  }

  @Patch('coaches/:id')
+  @PassengerStaff([PASSENGER_PERMS.coaches.manage, PASSENGER_PERMS.admin])
  @ApiOperation({ summary: 'Update coach properties' })
  @ApiParam({ name: 'id', description: 'Coach UUID' })
  @ApiBody({ type: UpdateCoachDto })
@@ -331,6 +343,7 @@ export class FleetController {
  }

  @Post('assignments')
+  @PassengerStaff([PASSENGER_PERMS.coaches.manage, PASSENGER_PERMS.admin])
  @ApiOperation({ summary: 'Assign a coach to a schedule' })
  @ApiBody({ type: AssignCoachDto })
  @ApiResponse({ status: 201, description: 'Coach assigned' })
--- a/apps/edr-passenger-api/src/modules/packages/packages.controller.ts
+++ b/apps/edr-passenger-api/src/modules/packages/packages.controller.ts
@@ -3,10 +3,10 @@ import { ApiTags, ApiOperation, ApiBearerAuth, ApiQuery } from '@nestjs/swagger'
 import { IsPublic } from '@tria-plc/api-common/modules/auth/decorators/public.decorator';
 import { PackagesService } from './packages.service';
 import { CreatePackageDto, BookPackageDto, CreatePriceTierDto, UpdatePriceTierDto, CreateInquiryDto, UpdateInquiryStatusDto, PackageBookingContextDto } from './packages.dto';
-import { IamGuard } from '../../common/iam-adapter';
 import { JwtGuard } from '../../common/jwt.guard';
 import { OptionalJwtGuard } from '../verifayda/optional-jwt.guard';
-import { PassengerAdmin } from '../../common/passenger-guards';
+import { PassengerAdmin, PassengerStaff } from '../../common/passenger-guards';
+import { PASSENGER_PERMS } from '../../seed/passenger-permissions.registry';

@ApiTags('Packages')
@Controller('packages')
@@ -21,7 +21,7 @@ export class PackagesController {
  }

  @Get('inquiries')
-  @UseGuards(IamGuard)
+  @PassengerStaff([PASSENGER_PERMS.inquiries.view, PASSENGER_PERMS.admin])
  @ApiBearerAuth('IAM-auth')
  @ApiOperation({ summary: 'List all inquiries (backoffice)' })
  listInquiries(
@@ -34,7 +34,7 @@ export class PackagesController {
  }

  @Patch('inquiries/:id/status')
-  @UseGuards(IamGuard)
+  @PassengerStaff([PASSENGER_PERMS.inquiries.manage, PASSENGER_PERMS.admin])
  @ApiBearerAuth('IAM-auth')
  @ApiOperation({ summary: 'Update inquiry status (backoffice)' })
  updateInquiryStatus(@Param('id') id: string, @Body() dto: UpdateInquiryStatusDto) {
@@ -57,7 +57,7 @@ export class PackagesController {
  }

  @Get('all')
-  @UseGuards(IamGuard)
+  @PassengerStaff([PASSENGER_PERMS.packages.view, PASSENGER_PERMS.admin])
  @ApiBearerAuth('IAM-auth')
  @ApiOperation({ summary: 'List all packages (backoffice)' })
  listAll(@Query('page') page?: string, @Query('pageSize') pageSize?: string) {
@@ -65,7 +65,7 @@ export class PackagesController {
  }

  @Get('bookings')
-  @UseGuards(IamGuard)
+  @PassengerStaff([PASSENGER_PERMS.packages.view, PASSENGER_PERMS.admin])
  @ApiBearerAuth('IAM-auth')
  @ApiOperation({ summary: 'List all package bookings (backoffice)' })
  listBookings(
@@ -124,7 +124,7 @@ export class PackagesController {
  }

  @Post()
-  @UseGuards(IamGuard)
+  @PassengerStaff([PASSENGER_PERMS.packages.manage, PASSENGER_PERMS.admin])
  @ApiBearerAuth('IAM-auth')
  @ApiOperation({ summary: 'Create package (admin)' })
  create(@Body() dto: CreatePackageDto) {
@@ -132,7 +132,7 @@ export class PackagesController {
  }

  @Patch(':id')
-  @UseGuards(IamGuard)
+  @PassengerStaff([PASSENGER_PERMS.packages.manage, PASSENGER_PERMS.admin])
  @ApiBearerAuth('IAM-auth')
  @ApiOperation({ summary: 'Update package (admin)' })
  update(@Param('id') id: string, @Body() dto: Partial<CreatePackageDto>) {
@@ -149,7 +149,7 @@ export class PackagesController {
  }

  @Patch(':id/activate')
-  @UseGuards(IamGuard)
+  @PassengerStaff([PASSENGER_PERMS.packages.manage, PASSENGER_PERMS.admin])
  @ApiBearerAuth('IAM-auth')
  @ApiOperation({ summary: 'Activate package (admin)' })
  activate(@Param('id') id: string) {
@@ -157,7 +157,7 @@ export class PackagesController {
  }

  @Patch(':id/deactivate')
-  @UseGuards(IamGuard)
+  @PassengerStaff([PASSENGER_PERMS.packages.manage, PASSENGER_PERMS.admin])
  @ApiBearerAuth('IAM-auth')
  @ApiOperation({ summary: 'Deactivate package (admin)' })
  deactivate(@Param('id') id: string) {
@@ -165,7 +165,7 @@ export class PackagesController {
  }

  @Post(':id/tiers')
-  @UseGuards(IamGuard)
+  @PassengerStaff([PASSENGER_PERMS.packages.manage, PASSENGER_PERMS.admin])
  @ApiBearerAuth('IAM-auth')
  @ApiOperation({ summary: 'Add price tier to package (admin)' })
  addTier(@Param('id') id: string, @Body() dto: CreatePriceTierDto) {
@@ -173,7 +173,7 @@ export class PackagesController {
  }

  @Patch('tiers/:tierId')
-  @UseGuards(IamGuard)
+  @PassengerStaff([PASSENGER_PERMS.packages.manage, PASSENGER_PERMS.admin])
  @ApiBearerAuth('IAM-auth')
  @ApiOperation({ summary: 'Update price tier (admin)' })
  updateTier(@Param('tierId') tierId: string, @Body() dto: UpdatePriceTierDto) {
--- a/apps/edr-passenger-api/src/modules/payments/payments.controller.ts
+++ b/apps/edr-passenger-api/src/modules/payments/payments.controller.ts
@@ -55,7 +55,11 @@ export class PaymentsController {
  }

  @Get("all")
-  @PassengerStaff([PASSENGER_PERMS.payments.viewAll, PASSENGER_PERMS.admin])
+  @PassengerStaff([
+    PASSENGER_PERMS.payments.view,
+    PASSENGER_PERMS.payments.viewAll,
+    PASSENGER_PERMS.admin,
+  ])
  @ApiBearerAuth("IAM-auth")
  @ApiOperation({ summary: "Get all payments with filters (staff/admin only)" })
  @ApiQuery({ name: "search", required: false })
@@ -146,7 +150,11 @@ export class PaymentsController {
  }

  @Post("refund")
-  @PassengerStaff([PASSENGER_PERMS.payments.refund, PASSENGER_PERMS.admin])
+  @PassengerStaff([
+    PASSENGER_PERMS.payments.manage,
+    PASSENGER_PERMS.payments.refund,
+    PASSENGER_PERMS.admin,
+  ])
  @ApiBearerAuth("IAM-auth")
  @ApiOperation({ summary: "Refund a confirmed booking (staff/agent only)" })
  refund(@Body() dto: RefundDto) {
@@ -155,6 +163,7 @@ export class PaymentsController {

  @Post(":bookingId/force-confirm")
  @PassengerStaff([
+    PASSENGER_PERMS.payments.manage,
    PASSENGER_PERMS.payments.manageMethods,
    PASSENGER_PERMS.admin,
  ])
@@ -174,6 +183,7 @@ export class PaymentsController {

  @Post("methods")
  @PassengerStaff([
+    PASSENGER_PERMS.paymentMethods.manage,
    PASSENGER_PERMS.payments.manageMethods,
    PASSENGER_PERMS.admin,
  ])
@@ -187,6 +197,7 @@ export class PaymentsController {

  @Patch("methods/:id")
  @PassengerStaff([
+    PASSENGER_PERMS.paymentMethods.manage,
    PASSENGER_PERMS.payments.manageMethods,
    PASSENGER_PERMS.admin,
  ])
--- a/apps/edr-passenger-api/src/modules/schedules/routes.controller.ts
+++ b/apps/edr-passenger-api/src/modules/schedules/routes.controller.ts
@@ -1,9 +1,9 @@
-import { Body, Controller, Delete, Get, Param, Patch, Post, Put, Query, ParseIntPipe, UseGuards } from '@nestjs/common';
+import { Body, Controller, Delete, Get, Param, Patch, Post, Put, Query, ParseIntPipe } from '@nestjs/common';
 import { ApiTags, ApiOperation, ApiBearerAuth, ApiParam, ApiQuery, ApiResponse } from '@nestjs/swagger';
 import { RoutesService } from './routes.service';
 import { CreateRouteDto, AddRouteStopDto, UpdateRouteDto, SetRouteCoachTemplateDto } from './routes.dto';
-import { JwtGuard } from '../../common/jwt.guard';
-import { PassengerAdmin } from '../../common/passenger-guards';
+import { PassengerAdmin, PassengerStaff } from '../../common/passenger-guards';
+import { PASSENGER_PERMS } from '../../seed/passenger-permissions.registry';

@ApiTags('Routes')
@Controller('routes')
@@ -13,7 +13,7 @@ export class RoutesController {
  // ── Routes ─────────────────────────────────────────────────────────────────

  @Post()
-  @UseGuards(JwtGuard) @ApiBearerAuth('JWT-auth')
+  @PassengerStaff([PASSENGER_PERMS.routes.manage, PASSENGER_PERMS.admin]) @ApiBearerAuth('IAM-auth')
  @ApiOperation({
    summary: 'Create a reusable route with its ordered stops',
    description: `Define the physical corridor once (e.g. ADD→ADM→AWS→DDW→AYS→DJI).
@@ -41,7 +41,7 @@ Route stops carry distanceKm for fare-by-distance calculations.`,
  getRoute(@Param('id') id: string) { return this.service.getRoute(id); }

  @Patch(':id')
-  @UseGuards(JwtGuard) @ApiBearerAuth('JWT-auth')
+  @PassengerStaff([PASSENGER_PERMS.routes.manage, PASSENGER_PERMS.admin]) @ApiBearerAuth('IAM-auth')
  @ApiOperation({ summary: 'Update route metadata (name, description, active flag, effectiveUntil)' })
  @ApiParam({ name: 'id', description: 'Route UUID' })
  @ApiResponse({ status: 200, description: 'Route updated' })
@@ -68,7 +68,7 @@ Route stops carry distanceKm for fare-by-distance calculations.`,
  getStops(@Param('id') id: string) { return this.service.getStops(id); }

  @Post(':id/stops')
-  @UseGuards(JwtGuard) @ApiBearerAuth('JWT-auth')
+  @PassengerStaff([PASSENGER_PERMS.routes.manage, PASSENGER_PERMS.admin]) @ApiBearerAuth('IAM-auth')
  @ApiOperation({ summary: 'Add a stop to an existing route' })
  @ApiParam({ name: 'id', description: 'Route UUID' })
  @ApiResponse({ status: 201, description: 'Stop added' })
@@ -108,7 +108,7 @@ Route stops carry distanceKm for fare-by-distance calculations.`,
  getCoachTemplate(@Param('id') id: string) { return this.service.getRouteCoachTemplate(id); }

  @Put(':id/coaches')
-  @UseGuards(JwtGuard) @ApiBearerAuth('JWT-auth')
+  @PassengerStaff([PASSENGER_PERMS.routes.manage, PASSENGER_PERMS.admin]) @ApiBearerAuth('IAM-auth')
  @ApiOperation({
    summary: 'Set the default coach lineup for this route',
    description: 'Replaces the entire coach template. Coaches are auto-assigned in this order when a new schedule is created for this route.',
--- a/apps/edr-passenger-api/src/modules/schedules/schedules.controller.ts
+++ b/apps/edr-passenger-api/src/modules/schedules/schedules.controller.ts
@@ -1,10 +1,10 @@
-import { Body, Controller, Delete, Get, Param, Patch, Post, Put, Query, ParseIntPipe, UseGuards } from '@nestjs/common';
+import { Body, Controller, Delete, Get, Param, Patch, Post, Put, Query, ParseIntPipe } from '@nestjs/common';
 import { ApiTags, ApiOperation, ApiBearerAuth, ApiParam, ApiQuery, ApiResponse } from '@nestjs/swagger';
 import { IsPublic } from '@tria-plc/api-common/modules/auth/decorators/public.decorator';
 import { SchedulesService } from './schedules.service';
 import { CreateScheduleDto, UpdateScheduleDto, CreateFareRuleDto, UpdateScheduleStatusDto, UpdateStopTimeDto, ListSchedulesDto, BulkCreateSchedulesDto, BulkSchedulesResponseDto, TripStatus } from './schedules.dto';
-import { JwtGuard } from '../../common/jwt.guard';
-import { PassengerAdmin } from '../../common/passenger-guards';
+import { PassengerAdmin, PassengerStaff } from '../../common/passenger-guards';
+import { PASSENGER_PERMS } from '../../seed/passenger-permissions.registry';

@ApiTags('Schedule')
@Controller('schedules')
@@ -12,14 +12,14 @@ export class SchedulesController {
  constructor(private service: SchedulesService) {}

  @Post('bulk-generate')
-  @UseGuards(JwtGuard) @ApiBearerAuth('JWT-auth')
+  @PassengerStaff([PASSENGER_PERMS.schedules.manage, PASSENGER_PERMS.admin]) @ApiBearerAuth('IAM-auth')
  @ApiOperation({ summary: 'Bulk generate repetitive schedules' })
  bulkGenerateSchedules(@Body() dto: BulkCreateSchedulesDto) {
    return this.service.bulkGenerateSchedules(dto);
  }

  @Post()
-  @UseGuards(JwtGuard) @ApiBearerAuth('JWT-auth')
+  @PassengerStaff([PASSENGER_PERMS.schedules.manage, PASSENGER_PERMS.admin]) @ApiBearerAuth('IAM-auth')
  @ApiOperation({ summary: 'Create a train schedule from a route template' })
  createSchedule(@Body() dto: CreateScheduleDto) { return this.service.createSchedule(dto); }

@@ -42,13 +42,13 @@ export class SchedulesController {
  // ===== SPECIFIC ROUTES (must come BEFORE generic :id routes) =====

  @Post('fares')
-  @UseGuards(JwtGuard) @ApiBearerAuth('JWT-auth')
+  @PassengerStaff([PASSENGER_PERMS.schedules.manage, PASSENGER_PERMS.admin]) @ApiBearerAuth('IAM-auth')
  @ApiOperation({ summary: 'Create a fare rule scoped to a schedule or route code' })
  @ApiResponse({ status: 201, description: 'Fare rule created' })
  createFareRule(@Body() dto: CreateFareRuleDto) { return this.service.createFareRule(dto); }

  @Patch('fares/:id')
-  @UseGuards(JwtGuard) @ApiBearerAuth('JWT-auth')
+  @PassengerStaff([PASSENGER_PERMS.schedules.manage, PASSENGER_PERMS.admin]) @ApiBearerAuth('IAM-auth')
  @ApiOperation({ summary: 'Update a fare rule' })
  @ApiParam({ name: 'id', description: 'FareRule UUID' })
  @ApiResponse({ status: 200, description: 'Fare rule updated' })
@@ -65,7 +65,7 @@ export class SchedulesController {
  deleteFareRule(@Param('id') id: string) { return this.service.deleteFareRule(id); }

  @Post('segment-fares')
-  @UseGuards(JwtGuard) @ApiBearerAuth('JWT-auth')
+  @PassengerStaff([PASSENGER_PERMS.schedules.manage, PASSENGER_PERMS.admin]) @ApiBearerAuth('IAM-auth')
  @ApiOperation({ summary: 'Create a segment fare rule' })
  createSegmentFareRule(@Body() dto: any) { return this.service.createSegmentFareRule(dto); }

@@ -80,7 +80,7 @@ export class SchedulesController {
  }

  @Patch('routes/fare-rules/:id')
-  @UseGuards(JwtGuard) @ApiBearerAuth('JWT-auth')
+  @PassengerStaff([PASSENGER_PERMS.schedules.manage, PASSENGER_PERMS.admin]) @ApiBearerAuth('IAM-auth')
  @ApiOperation({ summary: 'Update a route-level fare override' })
  @ApiParam({ name: 'id', description: 'RouteFareRule UUID' })
  updateRouteFareRule(@Param('id') id: string, @Body() dto: any) {
@@ -96,7 +96,7 @@ export class SchedulesController {
  }

  @Post('routes/:routeId/fare-rules')
-  @UseGuards(JwtGuard) @ApiBearerAuth('JWT-auth')
+  @PassengerStaff([PASSENGER_PERMS.schedules.manage, PASSENGER_PERMS.admin]) @ApiBearerAuth('IAM-auth')
  @ApiOperation({ summary: 'Create a route-level fare override' })
  @ApiParam({ name: 'routeId', description: 'Route UUID' })
  createRouteFareRule(@Param('routeId') routeId: string, @Body() dto: any) {
@@ -110,7 +110,7 @@ export class SchedulesController {
  getSegmentFares(@Param('routeId') routeId: string) { return this.service.getSegmentFares(routeId); }

  @Patch('segment-fares/:id')
-  @UseGuards(JwtGuard) @ApiBearerAuth('JWT-auth')
+  @PassengerStaff([PASSENGER_PERMS.schedules.manage, PASSENGER_PERMS.admin]) @ApiBearerAuth('IAM-auth')
  @ApiOperation({ summary: 'Update a segment fare rule' })
  @ApiParam({ name: 'id', description: 'SegmentFareRule UUID' })
  updateSegmentFareRule(@Param('id') id: string, @Body() dto: any) { return this.service.updateSegmentFareRule(id, dto); }
@@ -131,7 +131,7 @@ export class SchedulesController {
  getSchedule(@Param('id') id: string) { return this.service.getSchedule(id); }

  @Patch(':id')
-  @UseGuards(JwtGuard) @ApiBearerAuth('JWT-auth')
+  @PassengerStaff([PASSENGER_PERMS.schedules.manage, PASSENGER_PERMS.admin]) @ApiBearerAuth('IAM-auth')
  @ApiOperation({ summary: 'Update a schedule (partial)' })
  @ApiParam({ name: 'id', description: 'TrainSchedule UUID' })
  updateSchedule(@Param('id') id: string, @Body() dto: UpdateScheduleDto) {
@@ -139,7 +139,7 @@ export class SchedulesController {
  }

  @Patch(':id/status')
-  @UseGuards(JwtGuard) @ApiBearerAuth('JWT-auth')
+  @PassengerStaff([PASSENGER_PERMS.schedules.manage, PASSENGER_PERMS.admin]) @ApiBearerAuth('IAM-auth')
  @ApiOperation({ summary: 'Update schedule status' })
  @ApiParam({ name: 'id', description: 'TrainSchedule UUID' })
  updateStatus(@Param('id') id: string, @Body() dto: UpdateScheduleStatusDto) {
@@ -161,7 +161,7 @@ export class SchedulesController {
  getStops(@Param('id') id: string) { return this.service.getStops(id); }

  @Patch(':id/stops/:sequence')
-  @UseGuards(JwtGuard) @ApiBearerAuth('JWT-auth')
+  @PassengerStaff([PASSENGER_PERMS.schedules.manage, PASSENGER_PERMS.admin]) @ApiBearerAuth('IAM-auth')
  @ApiOperation({ summary: 'Update a stop time' })
  @ApiParam({ name: 'id', description: 'TrainSchedule UUID' })
  @ApiParam({ name: 'sequence', description: 'Stop sequence number' })
@@ -172,7 +172,7 @@ export class SchedulesController {
  ) { return this.service.updateStop(id, sequence, dto); }

  @Put(':scheduleId/fares/:seatClassId')
-  @UseGuards(JwtGuard) @ApiBearerAuth('JWT-auth')
+  @PassengerStaff([PASSENGER_PERMS.schedules.manage, PASSENGER_PERMS.admin]) @ApiBearerAuth('IAM-auth')
  @ApiOperation({
    summary: 'Override fare for a specific seat class on a schedule',
    description: 'Upserts a schedule-scoped FareRule. Expires any existing active rule for the same schedule+seatClass and creates a new one.',
@@ -220,12 +220,13 @@ export class SchedulesController {
  }

  @Post(':id/fares/sync')
+  @PassengerStaff([PASSENGER_PERMS.schedules.manage, PASSENGER_PERMS.admin]) @ApiBearerAuth('IAM-auth')
  @ApiOperation({ summary: 'Sync fares from fare engine' })
  @ApiParam({ name: 'id', description: 'TrainSchedule UUID' })
  syncFares(@Param('id') id: string) { return this.service.syncFaresFromEngine(id); }

  @Post(':id/coaches')
-  @UseGuards(JwtGuard) @ApiBearerAuth('JWT-auth')
+  @PassengerStaff([PASSENGER_PERMS.schedules.manage, PASSENGER_PERMS.admin]) @ApiBearerAuth('IAM-auth')
  @ApiOperation({ summary: 'Assign coaches to a schedule' })
  @ApiParam({ name: 'id', description: 'TrainSchedule UUID' })
  assignCoaches(
--- a/apps/edr-passenger-api/src/modules/seat-classes/seat-classes.controller.ts
+++ b/apps/edr-passenger-api/src/modules/seat-classes/seat-classes.controller.ts
@@ -1,10 +1,10 @@
-import { Body, Controller, Delete, Get, Param, Patch, Post, Query, UseGuards } from '@nestjs/common';
+import { Body, Controller, Delete, Get, Param, Patch, Post, Query } from '@nestjs/common';
 import { ApiTags, ApiOperation, ApiBearerAuth, ApiParam, ApiResponse, ApiBody } from '@nestjs/swagger';
 import { IsPublic } from '@tria-plc/api-common/modules/auth/decorators/public.decorator';
 import { SeatClassesService } from './seat-classes.service';
 import { CreateSeatClassDto, UpdateSeatClassDto } from './seat-classes.dto';
-import { JwtGuard } from '../../common/jwt.guard';
-import { PassengerAdmin } from '../../common/passenger-guards';
+import { PassengerAdmin, PassengerStaff } from '../../common/passenger-guards';
+import { PASSENGER_PERMS } from '../../seed/passenger-permissions.registry';

@ApiTags('Seat Classes')
@Controller('seat-classes')
@@ -26,7 +26,7 @@ export class SeatClassesController {
  getSeatClass(@Param('id') id: string) { return this.service.getSeatClass(id); }

  @Post()
-  @UseGuards(JwtGuard) @ApiBearerAuth('JWT-auth')
+  @PassengerStaff([PASSENGER_PERMS.tariffRates.manage, PASSENGER_PERMS.admin]) @ApiBearerAuth('IAM-auth')
  @ApiOperation({ summary: 'Create a seat class' })
  @ApiBody({ type: CreateSeatClassDto })
  @ApiResponse({ status: 201, description: 'Seat class created' })
@@ -34,7 +34,7 @@ export class SeatClassesController {
  createSeatClass(@Body() dto: CreateSeatClassDto) { return this.service.createSeatClass(dto); }

  @Patch(':id')
-  @UseGuards(JwtGuard) @ApiBearerAuth('JWT-auth')
+  @PassengerStaff([PASSENGER_PERMS.tariffRates.manage, PASSENGER_PERMS.admin]) @ApiBearerAuth('IAM-auth')
  @ApiOperation({ summary: 'Update a seat class' })
  @ApiParam({ name: 'id', description: 'Seat class UUID' })
  @ApiBody({ type: UpdateSeatClassDto })
--- a/apps/edr-passenger-api/src/modules/seats/seats.controller.ts
+++ b/apps/edr-passenger-api/src/modules/seats/seats.controller.ts
@@ -21,7 +21,8 @@ import {
 import { SeatsService } from "./seats.service";
 import { HoldSeatsDto, ReleaseHoldDto } from "./seats.dto";
 import { JwtGuard } from "../../common/jwt.guard";
-import { IamGuard } from "../../common/iam-adapter";
+import { PassengerStaff } from "../../common/passenger-guards";
+import { PASSENGER_PERMS } from "../../seed/passenger-permissions.registry";

@ApiTags("Seats")
@Controller("seats")
@@ -205,7 +206,7 @@ This makes it clear which segment of the route each seat is held for, enabling s

  // ── Seat Block / Unblock ───────────────────────────────────────────────────
  @Post(":seatId/block")
-  @UseGuards(IamGuard)
+  @PassengerStaff([PASSENGER_PERMS.seats.manage, PASSENGER_PERMS.admin])
  @ApiBearerAuth("IAM-auth")
  @ApiOperation({ summary: "Block a seat (e.g., maintenance, damage)" })
  @ApiParam({ name: "seatId", description: "Seat UUID" })
@@ -215,7 +216,7 @@ This makes it clear which segment of the route each seat is held for, enabling s
  }

  @Delete(":seatId/block")
-  @UseGuards(IamGuard)
+  @PassengerStaff([PASSENGER_PERMS.seats.manage, PASSENGER_PERMS.admin])
  @ApiBearerAuth("IAM-auth")
  @ApiOperation({ summary: "Unblock a seat" })
  @ApiParam({ name: "seatId", description: "Seat UUID" })
@@ -226,7 +227,7 @@ This makes it clear which segment of the route each seat is held for, enabling s

  // ── Maintenance ───────────────────────────────────────────────────────────
  @Post(":seatId/maintenance")
-  @UseGuards(IamGuard)
+  @PassengerStaff([PASSENGER_PERMS.seats.manage, PASSENGER_PERMS.admin])
  @ApiBearerAuth("IAM-auth")
  @ApiOperation({ summary: "Set seat status to Under Maintenance" })
  @ApiParam({ name: "seatId", description: "Seat UUID" })
@@ -236,7 +237,7 @@ This makes it clear which segment of the route each seat is held for, enabling s
  }

  @Delete(":seatId/maintenance")
-  @UseGuards(IamGuard)
+  @PassengerStaff([PASSENGER_PERMS.seats.manage, PASSENGER_PERMS.admin])
  @ApiBearerAuth("IAM-auth")
  @ApiOperation({ summary: "Clear seat maintenance status" })
  @ApiParam({ name: "seatId", description: "Seat UUID" })
@@ -247,7 +248,7 @@ This makes it clear which segment of the route each seat is held for, enabling s

  // ── Remove Seat ────────────────────────────────────────────────────────────
  @Patch(":seatId/remove")
-  @UseGuards(IamGuard)
+  @PassengerStaff([PASSENGER_PERMS.seats.manage, PASSENGER_PERMS.admin])
  @ApiBearerAuth("IAM-auth")
  @ApiOperation({
    summary: "Remove a seat by marking with negative seatNumber",
@@ -263,7 +264,7 @@ This makes it clear which segment of the route each seat is held for, enabling s
  }

  @Patch(":seatId/undo-remove")
-  @UseGuards(IamGuard)
+  @PassengerStaff([PASSENGER_PERMS.seats.manage, PASSENGER_PERMS.admin])
  @ApiBearerAuth("IAM-auth")
  @ApiOperation({
    summary: "Undo seat removal by restoring original seatNumber",
--- a/apps/edr-passenger-api/src/modules/stations/stations.controller.ts
+++ b/apps/edr-passenger-api/src/modules/stations/stations.controller.ts
@@ -1,10 +1,10 @@
-import { Body, Controller, Get, Param, Post, Patch, Delete, UseGuards, Query } from '@nestjs/common';
+import { Body, Controller, Get, Param, Post, Patch, Delete, Query } from '@nestjs/common';
 import { ApiTags, ApiOperation, ApiBearerAuth, ApiQuery, ApiResponse } from '@nestjs/swagger';
 import { IsPublic } from '@tria-plc/api-common/modules/auth/decorators/public.decorator';
 import { StationsService } from './stations.service';
 import { CreateStationDto } from './stations.dto';
-import { JwtGuard } from '../../common/jwt.guard';
-import { PassengerAdmin } from '../../common/passenger-guards';
+import { PassengerAdmin, PassengerStaff } from '../../common/passenger-guards';
+import { PASSENGER_PERMS } from '../../seed/passenger-permissions.registry';

@ApiTags('Stations')
@Controller('stations')
@@ -79,8 +79,8 @@ export class StationsController {
  findOne(@Param('id') id: string) { return this.service.findOne(id); }
  
  @Post()
-  @UseGuards(JwtGuard)
-  @ApiBearerAuth('JWT-auth')
+  @PassengerStaff([PASSENGER_PERMS.stations.manage, PASSENGER_PERMS.admin])
+  @ApiBearerAuth('IAM-auth')
  @ApiOperation({ summary: 'Create new station' })
  @ApiResponse({
    status: 201,
@@ -105,8 +105,8 @@ export class StationsController {
  create(@Body() dto: CreateStationDto) { return this.service.create(dto); }

  @Patch(':id')
-  @UseGuards(JwtGuard)
-  @ApiBearerAuth('JWT-auth')
+  @PassengerStaff([PASSENGER_PERMS.stations.manage, PASSENGER_PERMS.admin])
+  @ApiBearerAuth('IAM-auth')
  @ApiOperation({ summary: 'Update station' })
  @ApiResponse({
    status: 200,