feat(passenger-api): integrate @tria-plc IAM package (dual-ORM iam schema + package auth guard)

apps/edr-passenger-api/src/modules/agents/agents.controller.ts

@@ -2,39 +2,37 @@ import { Body, Controller, Get, Param, Post, Query, UseGuards } from '@nestjs/co
 import { ApiTags, ApiOperation, ApiBearerAuth } from '@nestjs/swagger';
 import { AgentsService } from './agents.service';
 import { CreateAgentBookingDto, OpenShiftDto, CloseShiftDto } from './agents.dto';
-import { IamGuard, IamRoles } from '../../common/iam-adapter';
-import { UserRole } from '@prisma/client';
+// IAM auth: validate the IAM session token via @tria-plc/api-common's DB-backed JwtGuard.
+import { JwtGuard as IamJwtGuard } from '@tria-plc/api-common/modules/auth/services/jwt.guard';
 
 @ApiTags('Agents')
 @Controller('agents')
-@UseGuards(IamGuard)
+// TODO(iam-authz): restrict per route via @UseGuards(PermissionGuard([...])) once the IAM
+// role→permission mapping (EIamPermissionKey) is confirmed. For now: authenticated IAM users only.
+@UseGuards(IamJwtGuard)
 @ApiBearerAuth('IAM-auth')
 export class AgentsController {
   constructor(private service: AgentsService) {}
 
   @Post('bookings')
-  @IamRoles('AGENT', 'ADMIN')
   @ApiOperation({ summary: 'Create agent booking with cash payment' })
   createBooking(@Body() dto: CreateAgentBookingDto) {
     return this.service.createAgentBooking(dto);
   }
 
   @Post('shifts/open')
-  @IamRoles('AGENT', 'ADMIN')
   @ApiOperation({ summary: 'Open agent shift' })
   openShift(@Body() dto: OpenShiftDto) {
     return this.service.openShift(dto);
   }
 
   @Post('shifts/close')
-  @IamRoles('AGENT', 'ADMIN')
   @ApiOperation({ summary: 'Close agent shift' })
   closeShift(@Body() dto: CloseShiftDto) {
     return this.service.closeShift(dto);
   }
 
   @Get(':agentId/commissions')
-  @IamRoles('AGENT', 'ADMIN')
   @ApiOperation({ summary: 'Get agent commissions' })
   getCommissions(
     @Param('agentId') agentId: string,
@@ -49,7 +47,6 @@ export class AgentsController {
   }
 
   @Get(':agentId/shifts')
-  @IamRoles('AGENT', 'ADMIN')
   @ApiOperation({ summary: 'Get agent shifts' })
   getShifts(@Param('agentId') agentId: string) {
     return this.service.getShifts(agentId);