feat(passenger-api): integrate @tria-plc IAM package (dual-ORM iam schema + package auth guard)

apps/edr-passenger-api/src/common/iam-adapter.ts

@@ -1,144 +0,0 @@
-import { Injectable, CanActivate, ExecutionContext, UnauthorizedException, ForbiddenException } from '@nestjs/common';
-import { Reflector } from '@nestjs/core';
-import { ConfigService } from '@nestjs/config';
-import { HttpService } from '@nestjs/axios';
-import { firstValueFrom } from 'rxjs';
-
-/**
- * IAM Adapter for @tria-plc corporate identity integration
- * 
- * This adapter wraps the corporate IAM guards and provides a bridge
- * between the corporate identity system and the EDR passenger API.
- * 
- * For back-office roles (agent, supervisor, admin, staff), this guard
- * validates tokens against the corporate IAM service.
- * 
- * For passenger-facing routes, the existing JWT guard is used.
- */
-
-export interface IamTokenPayload {
-  sub: string;
-  email: string;
-  roles: string[];
-  permissions: string[];
-  organizationId?: string;
-  exp: number;
-  iat: number;
-}
-
-export interface IamValidationResponse {
-  valid: boolean;
-  payload?: IamTokenPayload;
-  error?: string;
-}
-
-@Injectable()
-export class IamGuard implements CanActivate {
-  private readonly iamApiUrl: string;
-  private readonly iamEnabled: boolean;
-
-  constructor(
-    private readonly reflector: Reflector,
-    private readonly config: ConfigService,
-    private readonly http: HttpService,
-  ) {
-    this.iamApiUrl = this.config.get<string>('IAM_API_URL') || 'https://iam.tria-plc.com/api';
-    this.iamEnabled = this.config.get<string>('IAM_ENABLED') === 'true';
-  }
-
-  async canActivate(context: ExecutionContext): Promise<boolean> {
-    if (!this.iamEnabled) {
-      // IAM disabled - allow access (for development)
-      return true;
-    }
-
-    const request = context.switchToHttp().getRequest();
-    const token = this.extractToken(request);
-
-    if (!token) {
-      throw new UnauthorizedException('No authentication token provided');
-    }
-
-    const validation = await this.validateToken(token);
-
-    if (!validation.valid || !validation.payload) {
-      throw new UnauthorizedException(validation.error || 'Invalid token');
-    }
-
-    // Check required roles
-    const requiredRoles = this.reflector.get<string[]>('roles', context.getHandler());
-    if (requiredRoles && requiredRoles.length > 0) {
-      const hasRole = requiredRoles.some((role) => validation.payload!.roles.includes(role));
-      if (!hasRole) {
-        throw new ForbiddenException('Insufficient permissions');
-      }
-    }
-
-    // Attach user to request
-    request.user = {
-      userId: validation.payload.sub,
-      email: validation.payload.email,
-      roles: validation.payload.roles,
-      permissions: validation.payload.permissions,
-      organizationId: validation.payload.organizationId,
-    };
-
-    return true;
-  }
-
-  private extractToken(request: any): string | null {
-    const authHeader = request.headers.authorization;
-    if (!authHeader) return null;
-
-    const parts = authHeader.split(' ');
-    if (parts.length !== 2 || parts[0] !== 'Bearer') return null;
-
-    return parts[1];
-  }
-
-  private async validateToken(token: string): Promise<IamValidationResponse> {
-    try {
-      const response = await firstValueFrom(
-        this.http.post<IamValidationResponse>(
-          `${this.iamApiUrl}/v1/auth/validate`,
-          { token },
-          {
-            headers: {
-              'Content-Type': 'application/json',
-              'X-API-Key': this.config.get<string>('IAM_API_KEY') || '',
-            },
-            timeout: 5000,
-          },
-        ),
-      );
-
-      return response.data;
-    } catch (err) {
-      return {
-        valid: false,
-        error: err instanceof Error ? err.message : 'Token validation failed',
-      };
-    }
-  }
-}
-
-/**
- * Decorator to mark routes as requiring IAM authentication
- */
-export const UseIamAuth = () => {
-  // This is a marker decorator that can be used with @UseGuards(IamGuard)
-  return (target: any, propertyKey?: string, descriptor?: PropertyDescriptor) => {
-    // Marker only - actual guard is applied via @UseGuards
-  };
-};
-
-/**
- * Decorator to specify required roles for IAM-protected routes
- */
-export const IamRoles = (...roles: string[]) => {
-  return (target: any, propertyKey?: string, descriptor?: PropertyDescriptor) => {
-    if (descriptor) {
-      Reflect.defineMetadata('roles', roles, descriptor.value);
-    }
-  };
-};