fix: gm email

apps/edr-freight-api/src/modules/companies/companies.fayda-identity.spec.ts

@@ -354,6 +354,93 @@ describe("Fayda identity verification binds a person to the company", () => {
     ).resolves.toBeDefined();
   });
 
+  // Fayda's email and phone claims are optional and routinely absent. The owner
+  // is who the company is reached through and the step renders no input for
+  // their contact details, so the onboarding account — already OTP-proven —
+  // stands in rather than leaving the company unreachable.
+  describe("account contact details stand in for absent Fayda claims", () => {
+    const noContactClaims = {
+      purpose: "VERIFY",
+      verified: true,
+      sub: "new-sub",
+      fullName: "Haile Gebrselassie",
+      address: "Addis Ababa",
+    };
+    const account = {
+      email: "account@example.com",
+      phoneNumber: "+251911777777",
+    };
+
+    it("falls back to the account for an owner Fayda gave no email or phone", async () => {
+      const { service, ctx } = makeService({ verification: noContactClaims });
+
+      await service.completeIdentityVerification(
+        "user-1",
+        { subject: "owner", code: "c", state: "s" },
+        account,
+      );
+
+      expect(ctx.attributes.ownerEmail).toBe("account@example.com");
+      expect(ctx.attributes.ownerPhone).toBe("+251911777777");
+    });
+
+    it("prefers the Fayda claim over the account when there is one", async () => {
+      const { service, ctx } = makeService();
+
+      await service.completeIdentityVerification(
+        "user-1",
+        { subject: "owner", code: "c", state: "s" },
+        account,
+      );
+
+      expect(ctx.attributes.ownerEmail).toBe("haile@example.com");
+      expect(ctx.attributes.ownerPhone).toBe("+251922000000");
+    });
+
+    it("leaves the PoA alone — the account is not that person", async () => {
+      const { service, ctx } = makeService({ verification: noContactClaims });
+
+      await service.completeIdentityVerification(
+        "user-1",
+        { subject: "poa", code: "c", state: "s" },
+        account,
+      );
+
+      expect(ctx.attributes.poaEmail).toBeUndefined();
+      expect(ctx.attributes.poaPhone).toBeUndefined();
+    });
+
+    // Owners verified before the fallback existed hold blank contacts. Copying
+    // those blanks onto the GM makes generalManagerEmail required by onboarding
+    // with no field anywhere to satisfy it.
+    it("fills the GM copy from the account when the stored owner has no contacts", async () => {
+      const { service, ctx } = makeService({
+        attributes: { ...OWNER_VERIFIED },
+      });
+
+      await service.setGmSameAsOwner("user-1", account);
+
+      expect(ctx.attributes.gmEmail).toBe("account@example.com");
+      expect(ctx.attributes.generalManagerEmail).toBe("account@example.com");
+      expect(ctx.attributes.generalManagerPhone).toBe("+251911777777");
+    });
+
+    it("keeps the stored owner contacts when the GM copy has them", async () => {
+      const { service, ctx } = makeService({
+        attributes: {
+          ...OWNER_VERIFIED,
+          ownerEmail: "abebe@example.com",
+          ownerPhone: "+251911000111",
+        },
+      });
+
+      await service.setGmSameAsOwner("user-1", account);
+
+      expect(ctx.attributes.generalManagerEmail).toBe("abebe@example.com");
+      expect(ctx.attributes.generalManagerPhone).toBe("+251911000111");
+    });
+  });
+
   it("never locks or gates the general manager — it is not the verified subject", async () => {
     // GM is a plain typed role; the portal offers a "same as owner" copy, but
     // the backend must not treat it as identity-owned or require it verified.