feat(passenger-api): integrate @tria-plc IAM package (dual-ORM iam schema + package auth guard)

apps/edr-passenger-api/src/modules/fraud/fraud.controller.ts

@@ -1,12 +1,14 @@
 import { Controller, Get, Post, Body, Query, UseGuards, Logger } from '@nestjs/common';
 import { ApiTags, ApiOperation, ApiBearerAuth } from '@nestjs/swagger';
 import { FraudService, FraudRuleConfig } from './fraud.service';
-import { IamGuard, IamRoles } from '../../common/iam-adapter';
-import { UserRole } from '@prisma/client';
+// IAM auth: validate the IAM session token via @tria-plc/api-common's DB-backed JwtGuard.
+import { JwtGuard as IamJwtGuard } from '@tria-plc/api-common/modules/auth/services/jwt.guard';
 
 @ApiTags('Fraud Detection')
 @Controller('fraud')
-@UseGuards(IamGuard)
+// TODO(iam-authz): restrict per route via @UseGuards(PermissionGuard([...])) once the IAM
+// role→permission mapping (EIamPermissionKey) is confirmed. For now: authenticated IAM users only.
+@UseGuards(IamJwtGuard)
 @ApiBearerAuth('IAM-auth')
 export class FraudController {
   private readonly logger = new Logger(FraudController.name);
@@ -17,7 +19,6 @@ export class FraudController {
    * Get fraud alerts
    */
   @Get('alerts')
-  @IamRoles('ADMIN', 'SUPERVISOR')
   @ApiOperation({ summary: 'Get fraud alerts' })
   async getAlerts(
     @Query('userId') userId?: string,
@@ -32,7 +33,6 @@ export class FraudController {
    * Get fraud rules
    */
   @Get('rules')
-  @IamRoles('ADMIN')
   @ApiOperation({ summary: 'Get fraud detection rules' })
   async getRules() {
     const rules = await this.fraudService.getRules();
@@ -43,7 +43,6 @@ export class FraudController {
    * Create or update fraud rule
    */
   @Post('rules')
-  @IamRoles('ADMIN')
   @ApiOperation({ summary: 'Create or update fraud rule' })
   async upsertRule(@Body() body: { type: string; config: FraudRuleConfig }) {
     const rule = await this.fraudService.upsertRule(body.type, body.config);
@@ -54,7 +53,6 @@ export class FraudController {
    * Block user temporarily
    */
   @Post('actions/block')
-  @IamRoles('ADMIN', 'SUPERVISOR')
   @ApiOperation({ summary: 'Block user temporarily' })
   async blockUser(@Body() body: { userId: string; durationMinutes: number }) {
     await this.fraudService.blockUserTemporarily(body.userId, body.durationMinutes);
@@ -65,7 +63,6 @@ export class FraudController {
    * Unblock user
    */
   @Post('actions/unblock')
-  @IamRoles('ADMIN', 'SUPERVISOR')
   @ApiOperation({ summary: 'Unblock user' })
   async unblockUser(@Body() body: { userId: string }) {
     await this.fraudService.unblockUser(body.userId);