feat(passenger-api): integrate @tria-plc IAM package (dual-ORM iam schema + package auth guard)

apps/edr-passenger-api/src/modules/agents/agents.controller.ts

@@ -2,39 +2,37 @@ import { Body, Controller, Get, Param, Post, Query, UseGuards } from '@nestjs/co
 import { ApiTags, ApiOperation, ApiBearerAuth } from '@nestjs/swagger';
 import { AgentsService } from './agents.service';
 import { CreateAgentBookingDto, OpenShiftDto, CloseShiftDto } from './agents.dto';
-import { IamGuard, IamRoles } from '../../common/iam-adapter';
-import { UserRole } from '@prisma/client';
+// IAM auth: validate the IAM session token via @tria-plc/api-common's DB-backed JwtGuard.
+import { JwtGuard as IamJwtGuard } from '@tria-plc/api-common/modules/auth/services/jwt.guard';
 
 @ApiTags('Agents')
 @Controller('agents')
-@UseGuards(IamGuard)
+// TODO(iam-authz): restrict per route via @UseGuards(PermissionGuard([...])) once the IAM
+// role→permission mapping (EIamPermissionKey) is confirmed. For now: authenticated IAM users only.
+@UseGuards(IamJwtGuard)
 @ApiBearerAuth('IAM-auth')
 export class AgentsController {
   constructor(private service: AgentsService) {}
 
   @Post('bookings')
-  @IamRoles('AGENT', 'ADMIN')
   @ApiOperation({ summary: 'Create agent booking with cash payment' })
   createBooking(@Body() dto: CreateAgentBookingDto) {
     return this.service.createAgentBooking(dto);
   }
 
   @Post('shifts/open')
-  @IamRoles('AGENT', 'ADMIN')
   @ApiOperation({ summary: 'Open agent shift' })
   openShift(@Body() dto: OpenShiftDto) {
     return this.service.openShift(dto);
   }
 
   @Post('shifts/close')
-  @IamRoles('AGENT', 'ADMIN')
   @ApiOperation({ summary: 'Close agent shift' })
   closeShift(@Body() dto: CloseShiftDto) {
     return this.service.closeShift(dto);
   }
 
   @Get(':agentId/commissions')
-  @IamRoles('AGENT', 'ADMIN')
   @ApiOperation({ summary: 'Get agent commissions' })
   getCommissions(
     @Param('agentId') agentId: string,
@@ -49,7 +47,6 @@ export class AgentsController {
   }
 
   @Get(':agentId/shifts')
-  @IamRoles('AGENT', 'ADMIN')
   @ApiOperation({ summary: 'Get agent shifts' })
   getShifts(@Param('agentId') agentId: string) {
     return this.service.getShifts(agentId);

apps/edr-passenger-api/src/modules/bookings/bookings.controller.ts

@@ -5,7 +5,6 @@ import { GuestBookingService } from './guest-booking.service';
 import { CreateBookingDto, ModifyBookingDto, CancelBookingDto } from './bookings.dto';
 import { CreateGuestBookingDto, GetSavedPassengersDto } from './guest-booking.dto';
 import { JwtGuard } from '../../common/jwt.guard';
-import { IamGuard } from '../../common/iam-adapter';
 
 @ApiTags('Booking')
 @Controller('bookings')

apps/edr-passenger-api/src/modules/fraud/fraud.controller.ts

@@ -1,12 +1,14 @@
 import { Controller, Get, Post, Body, Query, UseGuards, Logger } from '@nestjs/common';
 import { ApiTags, ApiOperation, ApiBearerAuth } from '@nestjs/swagger';
 import { FraudService, FraudRuleConfig } from './fraud.service';
-import { IamGuard, IamRoles } from '../../common/iam-adapter';
-import { UserRole } from '@prisma/client';
+// IAM auth: validate the IAM session token via @tria-plc/api-common's DB-backed JwtGuard.
+import { JwtGuard as IamJwtGuard } from '@tria-plc/api-common/modules/auth/services/jwt.guard';
 
 @ApiTags('Fraud Detection')
 @Controller('fraud')
-@UseGuards(IamGuard)
+// TODO(iam-authz): restrict per route via @UseGuards(PermissionGuard([...])) once the IAM
+// role→permission mapping (EIamPermissionKey) is confirmed. For now: authenticated IAM users only.
+@UseGuards(IamJwtGuard)
 @ApiBearerAuth('IAM-auth')
 export class FraudController {
   private readonly logger = new Logger(FraudController.name);
@@ -17,7 +19,6 @@ export class FraudController {
    * Get fraud alerts
    */
   @Get('alerts')
-  @IamRoles('ADMIN', 'SUPERVISOR')
   @ApiOperation({ summary: 'Get fraud alerts' })
   async getAlerts(
     @Query('userId') userId?: string,
@@ -32,7 +33,6 @@ export class FraudController {
    * Get fraud rules
    */
   @Get('rules')
-  @IamRoles('ADMIN')
   @ApiOperation({ summary: 'Get fraud detection rules' })
   async getRules() {
     const rules = await this.fraudService.getRules();
@@ -43,7 +43,6 @@ export class FraudController {
    * Create or update fraud rule
    */
   @Post('rules')
-  @IamRoles('ADMIN')
   @ApiOperation({ summary: 'Create or update fraud rule' })
   async upsertRule(@Body() body: { type: string; config: FraudRuleConfig }) {
     const rule = await this.fraudService.upsertRule(body.type, body.config);
@@ -54,7 +53,6 @@ export class FraudController {
    * Block user temporarily
    */
   @Post('actions/block')
-  @IamRoles('ADMIN', 'SUPERVISOR')
   @ApiOperation({ summary: 'Block user temporarily' })
   async blockUser(@Body() body: { userId: string; durationMinutes: number }) {
     await this.fraudService.blockUserTemporarily(body.userId, body.durationMinutes);
@@ -65,7 +63,6 @@ export class FraudController {
    * Unblock user
    */
   @Post('actions/unblock')
-  @IamRoles('ADMIN', 'SUPERVISOR')
   @ApiOperation({ summary: 'Unblock user' })
   async unblockUser(@Body() body: { userId: string }) {
     await this.fraudService.unblockUser(body.userId);

apps/edr-passenger-api/src/modules/notifications/notifications.controller.ts

@@ -2,7 +2,6 @@ import { Controller, Get, Param, Patch, Post, Body, UseGuards } from '@nestjs/co
 import { ApiTags, ApiOperation, ApiBearerAuth } from '@nestjs/swagger';
 import { NotificationsService } from './notifications.service';
 import { JwtGuard } from '../../common/jwt.guard';
-import { IamGuard, IamRoles } from '../../common/iam-adapter';
 import { TestNotificationDto } from './notifications.dto';
 
 @ApiTags('Notifications')
@@ -31,8 +30,8 @@ export class NotificationsController {
   }
 
   @Post('test')
-  @UseGuards(IamGuard)
-  @IamRoles('ADMIN', 'STAFF')
+  // TODO(iam-authz): restrict to admin/staff via IAM PermissionGuard once role→permission mapping
+  // is confirmed. Currently protected by the class-level JwtGuard only.
   @ApiOperation({ summary: 'Test notification delivery (Admin only)' })
   async testNotification(@Body() dto: TestNotificationDto) {
     return this.service.send(

apps/edr-passenger-api/src/modules/passengers/passengers.controller.ts

@@ -3,7 +3,6 @@ import { ApiTags, ApiOperation, ApiBearerAuth, ApiResponse, ApiQuery } from '@ne
 import { PassengersService } from './passengers.service';
 import { CreateTravelerProfileDto, CreateSavedRouteDto, VerifyFaydaDto, RegisterInternationalPassengerDto } from './passengers.dto';
 import { JwtGuard } from '../../common/jwt.guard';
-import { IamGuard } from '../../common/iam-adapter';
 import { VerifaydaService } from '../verifayda/verifayda.service';
 
 @ApiTags('Passenger')

apps/edr-passenger-api/src/modules/reports/reports.controller.ts

@@ -2,32 +2,31 @@ import { Body, Controller, Get, Param, Post, Query, UseGuards } from '@nestjs/co
 import { ApiTags, ApiOperation, ApiBearerAuth } from '@nestjs/swagger';
 import { ReportsService } from './reports.service';
 import { GenerateReportDto } from './reports.dto';
-import { IamGuard, IamRoles } from '../../common/iam-adapter';
-import { UserRole } from '@prisma/client';
+// IAM auth: validate the IAM session token via @tria-plc/api-common's DB-backed JwtGuard.
+import { JwtGuard as IamJwtGuard } from '@tria-plc/api-common/modules/auth/services/jwt.guard';
 
 @ApiTags('Reports')
 @Controller('reports')
-@UseGuards(IamGuard)
+// TODO(iam-authz): restrict per route via @UseGuards(PermissionGuard([...])) once the IAM
+// role→permission mapping (EIamPermissionKey) is confirmed. For now: authenticated IAM users only.
+@UseGuards(IamJwtGuard)
 @ApiBearerAuth('IAM-auth')
 export class ReportsController {
   constructor(private service: ReportsService) {}
 
   @Post('generate')
-  @IamRoles('ADMIN', 'SUPERVISOR')
   @ApiOperation({ summary: 'Generate operational report' })
   generateReport(@Body() dto: GenerateReportDto) {
     return this.service.generateReport(dto);
   }
 
   @Get(':reportId')
-  @IamRoles('ADMIN', 'SUPERVISOR')
   @ApiOperation({ summary: 'Get report by ID' })
   getReport(@Param('reportId') reportId: string) {
     return this.service.getReport(reportId);
   }
 
   @Get()
-  @IamRoles('ADMIN', 'SUPERVISOR')
   @ApiOperation({ summary: 'List reports' })
   listReports(@Query('type') type?: string) {
     return this.service.listReports(type);