refactor: ( iam ) add public decorator for public endpoins

apps/edr-passenger-api/src/modules/bookings/bookings.controller.ts

@@ -1,5 +1,6 @@
 import { Body, Controller, Delete, Get, Param, Post, Patch, UseGuards, Query, Req, BadRequestException } from '@nestjs/common';
 import { ApiTags, ApiOperation, ApiBearerAuth, ApiResponse, ApiQuery, ApiBody } from '@nestjs/swagger';
+import { IsPublic } from '@tria-plc/api-common/modules/auth/decorators/public.decorator';
 import { BookingsService } from './bookings.service';
 import { GuestBookingService } from './guest-booking.service';
 import { CreateBookingDto, ModifyBookingDto, CancelBookingDto } from './bookings.dto';
@@ -44,7 +45,8 @@ export class BookingsController {
   }
 
   @Get('by-device')
-  @ApiOperation({ 
+  @IsPublic()
+  @ApiOperation({
     summary: 'Get bookings by device ID',
     description: 'Returns all bookings associated with a device ID (for guest users). Includes saved passenger details and booking history.'
   })
@@ -98,7 +100,8 @@ export class BookingsController {
   }
   
   @Post('guest')
-  @ApiOperation({ 
+  @IsPublic()
+  @ApiOperation({
     summary: 'Create guest booking — ONE_WAY | ROUND_TRIP | TRANSIT | ROUND_TRIP_TRANSIT (no login required)',
     description: `Creates a booking without requiring login. Supports all four booking types.
 

apps/edr-passenger-api/src/modules/payments/payments.controller.ts

@@ -17,6 +17,7 @@ import {
   ApiOkResponse,
   ApiProduces,
 } from "@nestjs/swagger";
+import { IsPublic } from "@tria-plc/api-common/modules/auth/decorators/public.decorator";
 import { Response } from "express";
 import { PaymentsService } from "./payments.service";
 import {
@@ -62,6 +63,7 @@ export class PaymentsController {
   }
 
   @Post("initiate")
+  @IsPublic()
   @ApiOperation({
     summary: "Initiate payment with nationality-based payment methods",
     description: `Initiates payment for a booking with support for multiple payment providers:\n\n**Ethiopian Payment Methods:**\n- TELEBIRR - Ethiopia's leading mobile money\n- CBE_BIRR - Commercial Bank of Ethiopia\n- EBIRR - Electronic payment gateway\n\n**Djiboutian Payment Methods:**\n- WAAFI - Djibouti's mobile money service\n\n**International Payment Methods:**\n- CARD - Visa, Mastercard\n- WALLET - Internal wallet balance\n\n**Multi-Currency:**\n- All transactions processed in ETB\n- Display amounts in ETB, DJF, or USD\n- Real-time exchange rate conversion`,
@@ -71,12 +73,14 @@ export class PaymentsController {
   }
 
   @Get("intents/:bookingId")
+  @IsPublic()
   @ApiOperation({ summary: "Get payment intent status for a booking" })
   getIntent(@Param("bookingId") bookingId: string) {
     return this.service.getIntentByBookingId(bookingId);
   }
 
   @Get("waafi/return")
+  @IsPublic()
   @ApiOperation({
     summary:
       "DEMO ONLY — confirm a Waafi payment from the browser-return params and return JSON for the " +
@@ -117,6 +121,7 @@ export class PaymentsController {
   }
 
   @Get("methods")
+  @IsPublic()
   @ApiOperation({
     summary: "List payment systems supported by the platform",
     description:
@@ -129,6 +134,7 @@ export class PaymentsController {
   }
 
   @Get("checkout")
+  @IsPublic()
   @ApiOperation({
     summary: "Browser checkout redirect",
     description:

apps/edr-passenger-api/src/modules/schedules/schedules.controller.ts

@@ -1,5 +1,6 @@
 import { Body, Controller, Delete, Get, Param, Patch, Post, Query, ParseIntPipe, UseGuards } from '@nestjs/common';
 import { ApiTags, ApiOperation, ApiBearerAuth, ApiParam, ApiQuery, ApiResponse } from '@nestjs/swagger';
+import { IsPublic } from '@tria-plc/api-common/modules/auth/decorators/public.decorator';
 import { SchedulesService } from './schedules.service';
 import { CreateScheduleDto, UpdateScheduleDto, CreateFareRuleDto, UpdateScheduleStatusDto, UpdateStopTimeDto, ListSchedulesDto, BulkCreateSchedulesDto, BulkSchedulesResponseDto } from './schedules.dto';
 import { JwtGuard } from '../../common/jwt.guard';
@@ -23,6 +24,7 @@ export class SchedulesController {
   createSchedule(@Body() dto: CreateScheduleDto) { return this.service.createSchedule(dto); }
 
   @Get()
+  @IsPublic()
   @ApiOperation({ summary: 'List schedules with optional filters' })
   @ApiQuery({ name: 'date', required: false })
   @ApiQuery({ name: 'routeId', required: false })
@@ -67,6 +69,7 @@ export class SchedulesController {
   createSegmentFareRule(@Body() dto: any) { return this.service.createSegmentFareRule(dto); }
 
   @Get('routes/:routeId/segment-fares')
+  @IsPublic()
   @ApiOperation({ summary: 'List all segment fare rules for a route' })
   @ApiParam({ name: 'routeId', description: 'Route UUID' })
   getSegmentFares(@Param('routeId') routeId: string) { return this.service.getSegmentFares(routeId); }
@@ -86,6 +89,7 @@ export class SchedulesController {
   // ===== PARAMETRIZED ROUTES (generic :id routes come AFTER specific routes) =====
 
   @Get(':id')
+  @IsPublic()
   @ApiOperation({ summary: 'Get schedule detail' })
   @ApiParam({ name: 'id', description: 'TrainSchedule UUID' })
   getSchedule(@Param('id') id: string) { return this.service.getSchedule(id); }
@@ -113,6 +117,7 @@ export class SchedulesController {
   deleteSchedule(@Param('id') id: string) { return this.service.deleteSchedule(id); }
 
   @Get(':id/stops')
+  @IsPublic()
   @ApiOperation({ summary: 'List all stops for a schedule' })
   @ApiParam({ name: 'id', description: 'TrainSchedule UUID' })
   getStops(@Param('id') id: string) { return this.service.getStops(id); }

apps/edr-passenger-api/src/modules/search/search.controller.ts

@@ -1,10 +1,12 @@
 import { Body, Controller, Post } from '@nestjs/common';
 import { ApiTags, ApiOperation, ApiResponse } from '@nestjs/swagger';
+import { IsPublic } from '@tria-plc/api-common/modules/auth/decorators/public.decorator';
 import { SearchService } from './search.service';
 import { SearchTripsDto, FareQuoteDto } from './search.dto';
 
 @ApiTags('Search')
 @Controller('search')
+@IsPublic()
 export class SearchController {
   constructor(private service: SearchService) {}
 

apps/edr-passenger-api/src/modules/seat-classes/seat-classes.controller.ts

@@ -1,5 +1,6 @@
 import { Body, Controller, Delete, Get, Param, Patch, Post, UseGuards } from '@nestjs/common';
 import { ApiTags, ApiOperation, ApiBearerAuth, ApiParam, ApiResponse, ApiBody } from '@nestjs/swagger';
+import { IsPublic } from '@tria-plc/api-common/modules/auth/decorators/public.decorator';
 import { SeatClassesService } from './seat-classes.service';
 import { CreateSeatClassDto, UpdateSeatClassDto } from './seat-classes.dto';
 import { JwtGuard } from '../../common/jwt.guard';
@@ -10,11 +11,13 @@ export class SeatClassesController {
   constructor(private service: SeatClassesService) {}
 
   @Get()
+  @IsPublic()
   @ApiOperation({ summary: 'List all seat classes' })
   @ApiResponse({ status: 200, description: 'Returns all seat classes with their coaches' })
   listSeatClasses() { return this.service.listSeatClasses(); }
 
   @Get(':id')
+  @IsPublic()
   @ApiOperation({ summary: 'Get a seat class by ID' })
   @ApiParam({ name: 'id', description: 'Seat class UUID' })
   @ApiResponse({ status: 200, description: 'Returns seat class with its coaches' })

apps/edr-passenger-api/src/modules/seats/seats.controller.ts

@@ -1,5 +1,6 @@
 import { Body, Controller, Delete, Get, Param, Post, Patch, Query, UseGuards } from '@nestjs/common';
 import { ApiTags, ApiOperation, ApiBearerAuth, ApiParam, ApiQuery, ApiResponse } from '@nestjs/swagger';
+import { IsPublic } from '@tria-plc/api-common/modules/auth/decorators/public.decorator';
 import { SeatsService } from './seats.service';
 import { HoldSeatsDto } from './seats.dto';
 import { JwtGuard } from '../../common/jwt.guard';
@@ -12,7 +13,8 @@ export class SeatsController {
 
   // ── Seat Map ──────────────────────────────────────────────────────────────
   @Get('seatmap/:scheduleId')
-  @ApiOperation({ 
+  @IsPublic()
+  @ApiOperation({
     summary: 'Get seat map with real-time availability by class',
     description: `Returns seat map for a schedule with availability by seat class:
 - Economy Regular

apps/edr-passenger-api/src/modules/stations/stations.controller.ts

@@ -1,5 +1,6 @@
 import { Body, Controller, Get, Param, Post, Patch, Delete, UseGuards, Query } from '@nestjs/common';
 import { ApiTags, ApiOperation, ApiBearerAuth, ApiQuery, ApiResponse } from '@nestjs/swagger';
+import { IsPublic } from '@tria-plc/api-common/modules/auth/decorators/public.decorator';
 import { StationsService } from './stations.service';
 import { CreateStationDto } from './stations.dto';
 import { JwtGuard } from '../../common/jwt.guard';
@@ -10,7 +11,8 @@ export class StationsController {
   constructor(private service: StationsService) {}
   
   @Get()
-  @ApiOperation({ 
+  @IsPublic()
+  @ApiOperation({
     summary: 'List all stations with country information',
     description: 'Returns all stations on the Ethio-Djibouti Railway with country codes (ET for Ethiopia, DJ for Djibouti)'
   })
@@ -48,7 +50,8 @@ export class StationsController {
   }
   
   @Get(':id')
-  @ApiOperation({ 
+  @IsPublic()
+  @ApiOperation({
     summary: 'Get station details by ID',
     description: 'Returns station information including name, code, country, coordinates, and facilities'
   })