feat: (reschedule): hide the reschedule button from viewers who did not book the trip

apps/edr-passenger-web/portal/src/app/booking/detail/page.tsx

@@ -5,6 +5,7 @@ import { useSearchParams, useRouter } from "next/navigation";
 import { useQuery, useMutation } from "@tanstack/react-query";
 import { apiClient } from "@/lib/api-client";
 import { useAuthStore } from "@/lib/auth-store";
+import { samePhone } from "@/utils/phone";
 import { resolvePaymentRedirectUrl } from "@/lib/payment-redirect";
 import { useEffect, useState } from "react";
 import {
@@ -84,6 +85,7 @@ function BookingDetailContent() {
   // every render as logged-out. AppSidebar calls initialize() from the root layout.
   const isAuthenticated = useAuthStore((s) => s.isAuthenticated);
   const isAuthInitialized = useAuthStore((s) => s.isInitialized);
+  const currentUserPhone = useAuthStore((s) => s.user?.phone);
 
   // Mirrors /booking/payment's state shape: selectedMethod is the PaymentMethod `type`
   // (used both for lookup and to decide provider-specific redirect handling), not the id.
@@ -344,6 +346,10 @@ function BookingDetailContent() {
     ["ONE_WAY", "ROUND_TRIP"].includes(booking.bookingType) &&
     !booking.outboundBoardedAt;
 
+  const isBooker = samePhone(currentUserPhone, booking.contactPhone);
+
+  const canReschedule = isAuthenticated && (isBooker || !booking.contactPhone);
+
   const reschedulePath = `/booking/reschedule?ref=${booking.bookingRef}`;
 
   const StatusBadge = () => {
@@ -1043,7 +1049,7 @@ function BookingDetailContent() {
                         JwtGuard and resolves ownership from the signed-in IAM user. A guest who got
                         here through booking lookup (ref + phone) has no session, so instead of hiding
                         the option we name the blocker and send them somewhere that fixes it. */}
-                    {bookingSupportsReschedule && (
+                    {bookingSupportsReschedule && (!isAuthInitialized || !isAuthenticated || canReschedule) && (
                       <button
                         disabled={!isAuthInitialized}
                         onClick={() =>

apps/edr-passenger-web/portal/src/utils/phone.ts

@@ -0,0 +1,16 @@
+
+export function normalizePhone(phone?: string | null): string | null {
+  if (!phone) return null;
+  const digits = phone.replace(/\D/g, '');
+  if (!digits) return null;
+  if (digits.startsWith('251')) return `+${digits}`;
+  if (digits.startsWith('0')) return `+251${digits.slice(1)}`;
+  if (digits.length === 9) return `+251${digits}`;
+  return `+${digits}`;
+}
+
+export function samePhone(a?: string | null, b?: string | null): boolean {
+  const left = normalizePhone(a);
+  const right = normalizePhone(b);
+  return !!left && !!right && left === right;
+}