Merge branch 'alpha' of https://github.com/Tria-plc/edr-platform into alpha

apps/edr-passenger-api/src/common/guards/service-auth.guard.ts

@@ -0,0 +1,54 @@
+import {
+  CanActivate,
+  ExecutionContext,
+  Injectable,
+  Logger,
+  UnauthorizedException,
+} from "@nestjs/common";
+import { timingSafeEqual } from "node:crypto";
+import { Request } from "express";
+
+/**
+ * Shared-secret guard for endpoints only the payment microservice may call
+ * (e.g. /internal/payments/mark-paid). The secret is the same SERVICE_AUTH_TOKEN the
+ * payment service enforces on its own internal surface. A forged mark-paid must not be able
+ * to confirm a booking without a real payment.
+ * TODO: integrate @tria-plc IAM / mTLS as the long-term mechanism.
+ */
+@Injectable()
+export class ServiceAuthGuard implements CanActivate {
+  private readonly logger = new Logger(ServiceAuthGuard.name);
+  private readonly token = process.env.SERVICE_AUTH_TOKEN ?? "";
+  private warned = false;
+
+  constructor() {
+    if (!this.token && process.env.NODE_ENV === "production") {
+      throw new Error("SERVICE_AUTH_TOKEN must be set in production");
+    }
+  }
+
+  canActivate(context: ExecutionContext): boolean {
+    if (!this.token) {
+      if (!this.warned) {
+        this.logger.warn(
+          "SERVICE_AUTH_TOKEN unset — internal endpoints are UNGUARDED (dev only)",
+        );
+        this.warned = true;
+      }
+      return true;
+    }
+
+    const request = context.switchToHttp().getRequest<Request>();
+    const header = request.headers["x-service-token"];
+    const bearer = request.headers.authorization?.replace(/^Bearer\s+/i, "");
+    const presented =
+      (Array.isArray(header) ? header[0] : header) ?? bearer ?? "";
+
+    const expected = Buffer.from(this.token);
+    const actual = Buffer.from(presented);
+    const valid =
+      expected.length === actual.length && timingSafeEqual(expected, actual);
+    if (!valid) throw new UnauthorizedException("Invalid service token");
+    return true;
+  }
+}