feat(passenger-api): integrate @tria-plc IAM package (dual-ORM iam schema + package auth guard)

apps/edr-passenger-api/src/modules/reports/reports.controller.ts

@@ -2,32 +2,31 @@ import { Body, Controller, Get, Param, Post, Query, UseGuards } from '@nestjs/co
 import { ApiTags, ApiOperation, ApiBearerAuth } from '@nestjs/swagger';
 import { ReportsService } from './reports.service';
 import { GenerateReportDto } from './reports.dto';
-import { IamGuard, IamRoles } from '../../common/iam-adapter';
-import { UserRole } from '@prisma/client';
+// IAM auth: validate the IAM session token via @tria-plc/api-common's DB-backed JwtGuard.
+import { JwtGuard as IamJwtGuard } from '@tria-plc/api-common/modules/auth/services/jwt.guard';
 
 @ApiTags('Reports')
 @Controller('reports')
-@UseGuards(IamGuard)
+// TODO(iam-authz): restrict per route via @UseGuards(PermissionGuard([...])) once the IAM
+// role→permission mapping (EIamPermissionKey) is confirmed. For now: authenticated IAM users only.
+@UseGuards(IamJwtGuard)
 @ApiBearerAuth('IAM-auth')
 export class ReportsController {
   constructor(private service: ReportsService) {}
 
   @Post('generate')
-  @IamRoles('ADMIN', 'SUPERVISOR')
   @ApiOperation({ summary: 'Generate operational report' })
   generateReport(@Body() dto: GenerateReportDto) {
     return this.service.generateReport(dto);
   }
 
   @Get(':reportId')
-  @IamRoles('ADMIN', 'SUPERVISOR')
   @ApiOperation({ summary: 'Get report by ID' })
   getReport(@Param('reportId') reportId: string) {
     return this.service.getReport(reportId);
   }
 
   @Get()
-  @IamRoles('ADMIN', 'SUPERVISOR')
   @ApiOperation({ summary: 'List reports' })
   listReports(@Query('type') type?: string) {
     return this.service.listReports(type);