Merge pull request #251 from Tria-plc/passenger/feat/iam

Passenger/feat/iam
2026-08-27 00:52:50 +00:00 · 2026-06-23 19:41:03 +03:00
parent 2bd76756a4 4ce3e7970b
commit 1ea4ef95c5
71 changed files with 2393 additions and 2512 deletions
--- a/.github/workflows/deploy.yml
+++ b/.github/workflows/deploy.yml
@@ -13,7 +13,7 @@ permissions:
 jobs:
  detect-changes:
    name: Detect changed services
-    runs-on: self-hosted
+    runs-on: ${{ fromJson(format('["self-hosted", "{0}"]', github.ref_name)) }}
    outputs:
      matrix: ${{ steps.filter.outputs.matrix }}
    steps:
@@ -91,7 +91,7 @@ jobs:
    name: Deploy ${{ matrix.service }}
    needs: detect-changes
    if: ${{ needs.detect-changes.outputs.matrix != '[]' }}
-    runs-on: self-hosted
+    runs-on: ${{ fromJson(format('["self-hosted", "{0}"]', github.ref_name)) }}
    strategy:
      fail-fast: false
      matrix:
--- a/apps/edr-passenger-api/.env.example
+++ b/apps/edr-passenger-api/.env.example
@@ -2,17 +2,46 @@
 NODE_ENV=development
 PORT=4000

-# Database (Prisma)
-DATABASE_URL=postgresql://edr:edr_secret@localhost:5432/edr_passenger?schema=edr_passenger
+# Database (Prisma) — owns the `passenger` schema in edr_database
+DATABASE_URL=postgresql://edr:edr_secret@localhost:5432/edr_database?schema=passenger
+
+# Database (TypeORM / @tria-plc IAM) — shared `iam` schema in the SAME edr_database.
+# These mirror the connection vars read by @tria-plc/api-common's TypeORM DataSource.
+DATABASE_HOST=localhost
+DATABASE_PORT=5432
+DATABASE_NAME=edr_database
+DATABASE_USER=edr
+DATABASE_PASSWORD=edr_secret
+DATABASE_SCHEMA=iam
+
+# RabbitMQ — the @tria-plc IAM/notification modules register RMQ clients (SMS/notifications).
+# Connects lazily; a broker is only needed when those features actually send. Placeholder for dev.
+RABBITMQ_URL=amqp://localhost:5672
+
+# MinIO — the @tria-plc file/notification modules construct a MinIO client at boot (validates these).
+# Placeholders for dev; only contacted when file upload/download features are actually used.
+MINIO_ENDPOINT=localhost
+MINIO_PORT=9000
+MINIO_USE_SSL=false
+MINIO_ACCESS_KEY=minioadmin
+MINIO_SECRET_KEY=minioadmin
+MINIO_BUCKET=edr-dev

 # CORS
 FRONTEND_URL=http://localhost:5174
 BACK_OFFICE_URL=http://localhost:5184

-# JWT
+# JWT (legacy passenger auth — being replaced by IAM)
 JWT_SECRET=edr-platform-secret-change-in-production
 JWT_EXPIRES_IN=7d

+# @tria-plc IAM token contract — the package's JwtGuard/verifyToken + AuthService sign/verify with
+# these. MUST match the IAM issuer's secret in shared deployments. (Expiry strings use jsonwebtoken/ms.)
+JWT_ACCESS_TOKEN_SECRET=dev-iam-access-secret-change-me
+JWT_ACCESS_TOKEN_EXPIRES=1h
+JWT_REFRESH_TOKEN_SECRET=dev-iam-refresh-secret-change-me
+JWT_REFRESH_TOKEN_EXPIRES=7d
+
 # SendGrid
 SENDGRID_API_KEY=
 SENDGRID_FROM_EMAIL=noreply@edr-platform.com
--- a/apps/edr-passenger-api/package.json
+++ b/apps/edr-passenger-api/package.json
@@ -11,6 +11,8 @@
    "test": "jest",
    "test:e2e": "jest --config ./test/jest-e2e.json",
    "type-check": "tsc --noEmit",
+    "iam:migrate": "node --env-file=.env scripts/run-iam-migrations.cjs",
+    "iam:seed-dev-user": "node --env-file=.env scripts/seed-iam-dev-user.cjs",
    "prisma:generate": "prisma generate",
    "prisma:migrate": "prisma migrate deploy",
    "prisma:migrate:dev": "prisma migrate dev",
@@ -27,26 +29,30 @@
    "@nestjs/config": "^4.0.4",
    "@nestjs/core": "^11.1.19",
    "@nestjs/event-emitter": "^2.0.4",
-    "@nestjs/jwt": "^10.2.0",
    "@nestjs/microservices": "^11.1.24",
-    "@nestjs/passport": "^10.0.3",
    "@nestjs/platform-express": "^11.1.19",
    "@nestjs/schedule": "^6.1.3",
    "@nestjs/swagger": "^7.4.0",
+    "@nestjs/typeorm": "^11.0.1",
    "@prisma/client": "^6.19.3",
+    "@sendgrid/mail": "^8.1.0",
+    "@tria-plc/api-common": "file:../../local-packages/tria-plc-api-common-1.4.3.tgz",
+    "@tria-plc/iamapi-common": "file:../../local-packages/tria-plc-iamapi-common-0.7.3.tgz",
+    "amqp-connection-manager": "^5.0.0",
+    "amqplib": "^2.0.1",
    "axios": "^1.7.7",
-    "bcrypt": "^5.1.1",
    "class-transformer": "^0.5.1",
    "class-validator": "^0.14.0",
+    "dotenv": "^17.4.2",
    "express": "^4.18.2",
    "jose": "^5.10.0",
-    "passport": "^0.7.0",
-    "passport-jwt": "^4.0.1",
+    "pg": "^8.21.0",
    "qrcode": "^1.5.3",
    "reflect-metadata": "^0.2.2",
    "rxjs": "^7.8.1",
    "swagger-ui-express": "^5.0.0",
    "tsconfig-paths": "^4.2.0",
+    "typeorm": "^0.3.30",
    "uuid": "^10.0.0"
  },
  "devDependencies": {
@@ -55,11 +61,9 @@
    "@nestjs/cli": "^11.0.21",
    "@nestjs/schematics": "^11.1.0",
    "@nestjs/testing": "^11.1.19",
-    "@types/bcrypt": "^5.0.2",
-    "@types/express": "^5.0.6",
+    "@types/express": "^4.17.21",
    "@types/jest": "^29.5.11",
    "@types/node": "^20.10.6",
-    "@types/passport-jwt": "^4.0.1",
    "@types/qrcode": "^1.5.5",
    "@types/supertest": "^6.0.2",
    "@types/uuid": "^9.0.0",
--- a/apps/edr-passenger-api/prisma/migrations/20260606000000_add_iam_user_id_to_passenger/migration.sql
+++ b/apps/edr-passenger-api/prisma/migrations/20260606000000_add_iam_user_id_to_passenger/migration.sql
@@ -0,0 +1,14 @@
+-- AddColumn: iamUserId to Passenger (cross-schema reference to iam.users — no FK enforced)
+ALTER TABLE "passenger"."Passenger" ADD COLUMN "iamUserId" TEXT;
+
+-- Unique constraint: one IAM user maps to exactly one Passenger
+ALTER TABLE "passenger"."Passenger" ADD CONSTRAINT "Passenger_iamUserId_key" UNIQUE ("iamUserId");
+
+-- Index for fast lookup by iamUserId on every protected request
+CREATE INDEX "Passenger_iamUserId_idx" ON "passenger"."Passenger"("iamUserId");
+
+-- AddColumn: iamUserId to FaydaVerificationSession (no FK — cross-schema reference to iam.users)
+ALTER TABLE "passenger"."FaydaVerificationSession" ADD COLUMN "iamUserId" TEXT;
+
+-- Index for Fayda callback to resolve IAM user
+CREATE INDEX "FaydaVerificationSession_iamUserId_idx" ON "passenger"."FaydaVerificationSession"("iamUserId");
--- a/apps/edr-passenger-api/prisma/migrations/20260608061918_make_passenger_userid_nullable/migration.sql
+++ b/apps/edr-passenger-api/prisma/migrations/20260608061918_make_passenger_userid_nullable/migration.sql
@@ -0,0 +1,30 @@
+-- DropForeignKey
+ALTER TABLE "Passenger" DROP CONSTRAINT "Passenger_userId_fkey";
+
+-- AlterTable
+ALTER TABLE "Passenger" ALTER COLUMN "userId" DROP NOT NULL;
+
+-- CreateTable
+CREATE TABLE "TicketSeat" (
+    "id" TEXT NOT NULL,
+    "ticketId" TEXT NOT NULL,
+    "seatId" TEXT NOT NULL,
+    "seatIndex" INTEGER NOT NULL DEFAULT 0,
+
+    CONSTRAINT "TicketSeat_pkey" PRIMARY KEY ("id")
+);
+
+-- CreateIndex
+CREATE INDEX "TicketSeat_ticketId_idx" ON "TicketSeat"("ticketId");
+
+-- CreateIndex
+CREATE INDEX "TicketSeat_seatId_idx" ON "TicketSeat"("seatId");
+
+-- AddForeignKey
+ALTER TABLE "Passenger" ADD CONSTRAINT "Passenger_userId_fkey" FOREIGN KEY ("userId") REFERENCES "User"("id") ON DELETE SET NULL ON UPDATE CASCADE;
+
+-- AddForeignKey
+ALTER TABLE "TicketSeat" ADD CONSTRAINT "TicketSeat_ticketId_fkey" FOREIGN KEY ("ticketId") REFERENCES "Ticket"("id") ON DELETE CASCADE ON UPDATE CASCADE;
+
+-- AddForeignKey
+ALTER TABLE "TicketSeat" ADD CONSTRAINT "TicketSeat_seatId_fkey" FOREIGN KEY ("seatId") REFERENCES "Seat"("id") ON DELETE RESTRICT ON UPDATE CASCADE;
--- a/apps/edr-passenger-api/prisma/migrations/20260608080000_rename_userid_to_iamuserid_on_preferences_device_fraudalert/migration.sql
+++ b/apps/edr-passenger-api/prisma/migrations/20260608080000_rename_userid_to_iamuserid_on_preferences_device_fraudalert/migration.sql
@@ -0,0 +1,13 @@
+-- Drop FK constraints (they reference iam.users indirectly via local User, but these are within passenger schema)
+ALTER TABLE passenger."UserPreferences" DROP CONSTRAINT IF EXISTS "UserPreferences_userId_fkey";
+ALTER TABLE passenger."Device"          DROP CONSTRAINT IF EXISTS "Device_userId_fkey";
+ALTER TABLE passenger."FraudAlert"      DROP CONSTRAINT IF EXISTS "FraudAlert_userId_fkey";
+
+-- Rename columns (preserves all existing data)
+ALTER TABLE passenger."UserPreferences" RENAME COLUMN "userId" TO "iamUserId";
+ALTER TABLE passenger."Device"          RENAME COLUMN "userId" TO "iamUserId";
+ALTER TABLE passenger."FraudAlert"      RENAME COLUMN "userId" TO "iamUserId";
+
+-- Rename indexes on FraudAlert to match new column name
+DROP INDEX IF EXISTS passenger."FraudAlert_userId_createdAt_idx";
+CREATE INDEX "FraudAlert_iamUserId_createdAt_idx" ON passenger."FraudAlert"("iamUserId", "createdAt");
--- a/apps/edr-passenger-api/prisma/migrations/20260608090000_rename_auditlog_userid_drop_fayda_userid/migration.sql
+++ b/apps/edr-passenger-api/prisma/migrations/20260608090000_rename_auditlog_userid_drop_fayda_userid/migration.sql
@@ -0,0 +1,10 @@
+-- AuditLog: drop FK, rename column, update index
+ALTER TABLE passenger."AuditLog" DROP CONSTRAINT IF EXISTS "AuditLog_userId_fkey";
+ALTER TABLE passenger."AuditLog" RENAME COLUMN "userId" TO "iamUserId";
+DROP INDEX IF EXISTS passenger."AuditLog_userId_createdAt_idx";
+CREATE INDEX IF NOT EXISTS "AuditLog_iamUserId_createdAt_idx" ON passenger."AuditLog"("iamUserId", "createdAt");
+
+-- FaydaVerificationSession: drop userId column and FK (iamUserId already carries this data)
+ALTER TABLE passenger."FaydaVerificationSession" DROP CONSTRAINT IF EXISTS "FaydaVerificationSession_userId_fkey";
+ALTER TABLE passenger."FaydaVerificationSession" DROP COLUMN IF EXISTS "userId";
+DROP INDEX IF EXISTS passenger."FaydaVerificationSession_userId_idx";
--- a/apps/edr-passenger-api/prisma/migrations/20260609065750_add_blocked_until_to_passenger/migration.sql
+++ b/apps/edr-passenger-api/prisma/migrations/20260609065750_add_blocked_until_to_passenger/migration.sql
@@ -0,0 +1,5 @@
+-- AlterTable
+ALTER TABLE "Passenger" ADD COLUMN     "blockedUntil" TIMESTAMP(3);
+
+-- RenameIndex
+ALTER INDEX "UserPreferences_userId_key" RENAME TO "UserPreferences_iamUserId_key";
--- a/apps/edr-passenger-api/prisma/migrations/20260622000000_catchup_iam_columns/migration.sql
+++ b/apps/edr-passenger-api/prisma/migrations/20260622000000_catchup_iam_columns/migration.sql
@@ -0,0 +1,82 @@
+-- Catch-up migration: earlier migrations (20260606, 20260608) targeted passenger.*
+-- but ran when tables were still in public schema (before 20260626 moved them).
+-- All statements use IF NOT EXISTS / conditional blocks so this is safe to re-run.
+
+-- ────────────────────────────────────────────────────────────
+-- 1. Passenger.iamUserId
+-- ────────────────────────────────────────────────────────────
+ALTER TABLE passenger."Passenger" ADD COLUMN IF NOT EXISTS "iamUserId" TEXT;
+
+DO $$ BEGIN
+  IF NOT EXISTS (
+    SELECT 1 FROM pg_constraint
+    WHERE conname = 'Passenger_iamUserId_key'
+      AND conrelid = 'passenger."Passenger"'::regclass
+  ) THEN
+    ALTER TABLE passenger."Passenger" ADD CONSTRAINT "Passenger_iamUserId_key" UNIQUE ("iamUserId");
+  END IF;
+END $$;
+
+CREATE INDEX IF NOT EXISTS "Passenger_iamUserId_idx" ON passenger."Passenger"("iamUserId");
+
+-- ────────────────────────────────────────────────────────────
+-- 2. FaydaVerificationSession.iamUserId
+-- ────────────────────────────────────────────────────────────
+ALTER TABLE passenger."FaydaVerificationSession" ADD COLUMN IF NOT EXISTS "iamUserId" TEXT;
+CREATE INDEX IF NOT EXISTS "FaydaVerificationSession_iamUserId_idx" ON passenger."FaydaVerificationSession"("iamUserId");
+
+-- ────────────────────────────────────────────────────────────
+-- 3. UserPreferences: rename userId → iamUserId (if not yet renamed)
+-- ────────────────────────────────────────────────────────────
+DO $$ BEGIN
+  IF EXISTS (
+    SELECT 1 FROM information_schema.columns
+    WHERE table_schema = 'passenger' AND table_name = 'UserPreferences' AND column_name = 'userId'
+  ) THEN
+    ALTER TABLE passenger."UserPreferences" DROP CONSTRAINT IF EXISTS "UserPreferences_userId_fkey";
+    ALTER TABLE passenger."UserPreferences" RENAME COLUMN "userId" TO "iamUserId";
+  END IF;
+END $$;
+
+-- ────────────────────────────────────────────────────────────
+-- 4. Device: rename userId → iamUserId (if not yet renamed)
+-- ────────────────────────────────────────────────────────────
+DO $$ BEGIN
+  IF EXISTS (
+    SELECT 1 FROM information_schema.columns
+    WHERE table_schema = 'passenger' AND table_name = 'Device' AND column_name = 'userId'
+  ) THEN
+    ALTER TABLE passenger."Device" DROP CONSTRAINT IF EXISTS "Device_userId_fkey";
+    ALTER TABLE passenger."Device" RENAME COLUMN "userId" TO "iamUserId";
+  END IF;
+END $$;
+
+-- ────────────────────────────────────────────────────────────
+-- 5. FraudAlert: rename userId → iamUserId + fix index (if not yet renamed)
+-- ────────────────────────────────────────────────────────────
+DO $$ BEGIN
+  IF EXISTS (
+    SELECT 1 FROM information_schema.columns
+    WHERE table_schema = 'passenger' AND table_name = 'FraudAlert' AND column_name = 'userId'
+  ) THEN
+    ALTER TABLE passenger."FraudAlert" DROP CONSTRAINT IF EXISTS "FraudAlert_userId_fkey";
+    ALTER TABLE passenger."FraudAlert" RENAME COLUMN "userId" TO "iamUserId";
+    DROP INDEX IF EXISTS passenger."FraudAlert_userId_createdAt_idx";
+    CREATE INDEX "FraudAlert_iamUserId_createdAt_idx" ON passenger."FraudAlert"("iamUserId", "createdAt");
+  END IF;
+END $$;
+
+-- ────────────────────────────────────────────────────────────
+-- 6. AuditLog: rename userId → iamUserId + fix index (if not yet renamed)
+-- ────────────────────────────────────────────────────────────
+DO $$ BEGIN
+  IF EXISTS (
+    SELECT 1 FROM information_schema.columns
+    WHERE table_schema = 'passenger' AND table_name = 'AuditLog' AND column_name = 'userId'
+  ) THEN
+    ALTER TABLE passenger."AuditLog" DROP CONSTRAINT IF EXISTS "AuditLog_userId_fkey";
+    ALTER TABLE passenger."AuditLog" RENAME COLUMN "userId" TO "iamUserId";
+    DROP INDEX IF EXISTS passenger."AuditLog_userId_createdAt_idx";
+    CREATE INDEX IF NOT EXISTS "AuditLog_iamUserId_createdAt_idx" ON passenger."AuditLog"("iamUserId", "createdAt");
+  END IF;
+END $$;
--- a/apps/edr-passenger-api/prisma/migrations/20260622000001_make_passenger_userid_nullable/migration.sql
+++ b/apps/edr-passenger-api/prisma/migrations/20260622000001_make_passenger_userid_nullable/migration.sql
@@ -0,0 +1,5 @@
+-- 20260608061918 was marked-as-applied without running (it failed on CREATE TABLE TicketSeat).
+-- The two ALTER TABLE statements it contained never executed, so userId is still NOT NULL.
+
+ALTER TABLE passenger."Passenger" DROP CONSTRAINT IF EXISTS "Passenger_userId_fkey";
+ALTER TABLE passenger."Passenger" ALTER COLUMN "userId" DROP NOT NULL;
--- a/apps/edr-passenger-api/prisma/migrations/20260622000002_agent_iam_user_id_drop_user_fks/migration.sql
+++ b/apps/edr-passenger-api/prisma/migrations/20260622000002_agent_iam_user_id_drop_user_fks/migration.sql
@@ -0,0 +1,39 @@
+-- ────────────────────────────────────────────────────────────
+-- 1. Add iamUserId to Agent
+-- ────────────────────────────────────────────────────────────
+ALTER TABLE passenger."Agent" ADD COLUMN IF NOT EXISTS "iamUserId" TEXT;
+
+DO $$ BEGIN
+  IF NOT EXISTS (
+    SELECT 1 FROM pg_constraint
+    WHERE conname = 'Agent_iamUserId_key'
+      AND conrelid = 'passenger."Agent"'::regclass
+  ) THEN
+    ALTER TABLE passenger."Agent" ADD CONSTRAINT "Agent_iamUserId_key" UNIQUE ("iamUserId");
+  END IF;
+END $$;
+
+CREATE INDEX IF NOT EXISTS "Agent_iamUserId_idx" ON passenger."Agent"("iamUserId");
+
+-- ────────────────────────────────────────────────────────────
+-- 2. Populate iamUserId for existing agent records
+--    Match via User.email → iam.users.email
+-- ────────────────────────────────────────────────────────────
+UPDATE passenger."Agent" a
+SET "iamUserId" = iu.id
+FROM passenger."User" u
+JOIN iam.users iu ON iu.email = u.email
+WHERE a."userId" = u.id
+  AND a."iamUserId" IS NULL;
+
+-- ────────────────────────────────────────────────────────────
+-- 3. Drop Agent.userId FK and column — iamUserId replaces it entirely
+-- ────────────────────────────────────────────────────────────
+ALTER TABLE passenger."Agent" DROP CONSTRAINT IF EXISTS "Agent_userId_fkey";
+DROP INDEX IF EXISTS passenger."Agent_userId_key";
+ALTER TABLE passenger."Agent" DROP COLUMN IF EXISTS "userId";
+
+-- ────────────────────────────────────────────────────────────
+-- 4. Drop Passenger.userId FK (column stays as plain nullable string)
+-- ────────────────────────────────────────────────────────────
+ALTER TABLE passenger."Passenger" DROP CONSTRAINT IF EXISTS "Passenger_userId_fkey";
--- a/apps/edr-passenger-api/prisma/schema.prisma
+++ b/apps/edr-passenger-api/prisma/schema.prisma
@@ -260,15 +260,8 @@ model User {
  faydaVerifiedAt DateTime?
  faydaSub        String?   @unique

-  passenger   Passenger?
-  agent       Agent?
-  sessions    Session[]
-  devices     Device[]
-  preferences UserPreferences?
-  auditLogs   AuditLog[]
-  fraudAlerts FraudAlert[]
+  sessions     Session[]

-  faydaVerificationSessions FaydaVerificationSession[]
  @@schema("passenger")
 }

@@ -286,20 +279,21 @@ model Session {
 }

 model Passenger {
-  id                       String            @id @default(uuid())
-  userId                   String            @unique
+  id        String   @id @default(uuid())
+  userId    String?  @unique
+  iamUserId String?  @unique
  defaultTravelerProfileId String?
-  preferredLanguage        String?
-  createdAt                DateTime          @default(now())
-  user                     User              @relation(fields: [userId], references: [id])
-  bookings                 Booking[]
-  loyalty                  LoyaltyAccount?
-  wallet                   WalletAccount?
-  notifications            Notification[]
-  travelerProfiles         TravelerProfile[]
-  savedRoutes              SavedRoute[]
-
+  preferredLanguage String?
+  blockedUntil DateTime?
+  createdAt DateTime @default(now())
+  bookings         Booking[]
+  loyalty          LoyaltyAccount?
+  wallet           WalletAccount?
+  notifications    Notification[]
+  travelerProfiles TravelerProfile[]
+  savedRoutes      SavedRoute[]
  @@index([userId])
+  @@index([iamUserId])
  @@schema("passenger")
 }

@@ -895,7 +889,7 @@ model SupportMessage {

 model UserPreferences {
  id                     String  @id @default(uuid())
-  userId                 String  @unique
+  iamUserId              String  @unique
  pushEnabled            Boolean @default(true)
  emailEnabled           Boolean @default(true)
  smsEnabled             Boolean @default(false)
@@ -908,19 +902,19 @@ model UserPreferences {
  locale                 String  @default("en")
  darkMode               Boolean @default(false)
  language               String  @default("en")
-  user                   User    @relation(fields: [userId], references: [id])
+
  @@schema("passenger")
 }

 model Device {
  id         String         @id @default(uuid())
-  userId     String
+  iamUserId  String
  platform   DevicePlatform
  name       String
  pushToken  String?
  trusted    Boolean        @default(false)
  lastSeenAt DateTime       @default(now())
-  user       User           @relation(fields: [userId], references: [id])
+
  @@schema("passenger")
 }

@@ -1063,16 +1057,16 @@ model SegmentFareRule {

 model Agent {
  id             String            @id @default(uuid())
-  userId         String            @unique
+  iamUserId      String?           @unique
  agentCode      String            @unique
  stationId      String?
  commissionRate Int               @default(5)
  active         Boolean           @default(true)
  createdAt      DateTime          @default(now())
-  user           User              @relation(fields: [userId], references: [id])
  bookings       AgentBooking[]
  shifts         AgentShift[]
  commissions    AgentCommission[]
+  @@index([iamUserId])
  @@schema("passenger")
 }

@@ -1191,19 +1185,17 @@ model BaggageBooking {
 }

 model AuditLog {
-  id         String   @id @default(uuid())
-  userId     String?
-  action     String
-  entityType String
-  entityId   String?
-  oldData    Json?
-  newData    Json?
-  ipAddress  String?
-  userAgent  String?
-  createdAt  DateTime @default(now())
-  user       User?    @relation(fields: [userId], references: [id])
-
-  @@index([userId, createdAt])
+  id          String   @id @default(uuid())
+  iamUserId   String?
+  action      String
+  entityType  String
+  entityId    String?
+  oldData     Json?
+  newData     Json?
+  ipAddress   String?
+  userAgent   String?
+  createdAt   DateTime @default(now())
+  @@index([iamUserId, createdAt])
  @@index([entityType, entityId])
  @@schema("passenger")
 }
@@ -1259,16 +1251,14 @@ model FraudRule {

 model FraudAlert {
  id             String   @id @default(uuid())
-  userId         String
+  iamUserId      String
  eventType      String
  triggeredRules String[]
  context        Json
  severity       String   @default("MEDIUM")
  acknowledged   Boolean  @default(false)
  createdAt      DateTime @default(now())
-  user           User     @relation(fields: [userId], references: [id], onDelete: Cascade)
-
-  @@index([userId, createdAt])
+  @@index([iamUserId, createdAt])
  @@index([acknowledged])
  @@schema("passenger")
 }
@@ -1338,12 +1328,10 @@ model FaydaVerificationSession {
  expiresAt        DateTime
  completedAt      DateTime?

-  userId    String?
+  iamUserId String?
  bookingId String?

-  user User? @relation(fields: [userId], references: [id], onDelete: Cascade)
-
-  @@index([userId])
+  @@index([iamUserId])
  @@index([bookingId])
  @@index([state])
  @@index([expiresAt])
--- a/apps/edr-passenger-api/scripts/run-iam-migrations.cjs
+++ b/apps/edr-passenger-api/scripts/run-iam-migrations.cjs
@@ -0,0 +1,46 @@
+/**
+ * Dev helper: run the @tria-plc/iamapi-common TypeORM migrations against the shared `iam` schema.
+ *
+ * The package ships its migration CLI assuming you run it from inside the package repo (it needs
+ * the package's devDeps). As a consumer we instead drive the shipped (compiled) migrations with the
+ * passenger app's own installed TypeORM.
+ *
+ * Reads the same DATABASE_* env vars as the app's IAM DataSource (see config/iam-database.config.ts).
+ * Run via:  pnpm --filter @edr/passenger-api iam:migrate
+ * (the npm script loads .env with `node --env-file`).
+ *
+ * NOTE: in production the central IAM team owns/runs these migrations — this helper is for local dev.
+ */
+const path = require('path');
+const { DataSource } = require('typeorm');
+
+const iamDist = path
+  .dirname(require.resolve('@tria-plc/iamapi-common'))
+  .replace(/\\/g, '/');
+
+const ds = new DataSource({
+  type: 'postgres',
+  host: process.env.DATABASE_HOST,
+  port: Number(process.env.DATABASE_PORT || 5432),
+  database: process.env.DATABASE_NAME,
+  username: process.env.DATABASE_USER,
+  password: process.env.DATABASE_PASSWORD,
+  schema: process.env.DATABASE_SCHEMA || 'iam',
+  entities: [], // migrations are raw SQL — no entities needed to run them
+  migrations: [`${iamDist}/db/migrations/*.js`],
+  migrationsTableName: 'typeorm_migrations',
+});
+
+(async () => {
+  await ds.initialize();
+  // The IAM migrations rely on uuid_generate_v4() but never CREATE the extension themselves.
+  await ds.query('CREATE EXTENSION IF NOT EXISTS "uuid-ossp"');
+  const applied = await ds.runMigrations({ transaction: 'each' });
+  console.log(`[iam-migrations] applied ${applied.length} migration(s)`);
+  applied.slice(-5).forEach((m) => console.log('  +', m.name));
+  await ds.destroy();
+  console.log('[iam-migrations] DONE');
+})().catch((e) => {
+  console.error('[iam-migrations] FAIL:', e.message);
+  process.exit(1);
+});
--- a/apps/edr-passenger-api/scripts/seed-iam-dev-user.cjs
+++ b/apps/edr-passenger-api/scripts/seed-iam-dev-user.cjs
@@ -0,0 +1,74 @@
+/**
+ * Dev helper: create a dev IAM user + an ACTIVE session, and print a ready-to-use Bearer token.
+ *
+ * Why this exists: in prod the central IAM service issues tokens (via password login at
+ * /v1/auth/login). For local dev of the passenger API (a token *consumer*), this seeds a session
+ * directly and mints a matching token with the package's own `generateToken`, so you can call
+ * protected routes immediately (paste the token into Swagger's Authorize box or `curl -H`).
+ *
+ * Run:  pnpm --filter @edr/passenger-api iam:seed-dev-user
+ * Reads DATABASE_* + JWT_ACCESS_TOKEN_SECRET/EXPIRES from .env (loaded via `node --env-file`).
+ */
+const crypto = require('crypto');
+const { DataSource } = require('typeorm');
+const { generateToken } = require('@tria-plc/api-common/utils/token');
+
+const DEV_EMAIL = process.env.DEV_IAM_EMAIL || 'dev@edr.local';
+
+const ds = new DataSource({
+  type: 'postgres',
+  host: process.env.DATABASE_HOST,
+  port: Number(process.env.DATABASE_PORT || 5432),
+  database: process.env.DATABASE_NAME,
+  username: process.env.DATABASE_USER,
+  password: process.env.DATABASE_PASSWORD,
+});
+
+(async () => {
+  await ds.initialize();
+
+  // Upsert the dev user (users.email is UNIQUE).
+  const name = { en: 'Dev User', am: 'የሙከራ ተጠቃሚ' };
+  const [user] = await ds.query(
+    `INSERT INTO iam.users (name, username, email, user_type, status, is_active)
+       VALUES ($1::jsonb, $2, $3, 'individual', 'accepted', true)
+     ON CONFLICT (email) DO UPDATE SET updated_at = now()
+     RETURNING id`,
+    [JSON.stringify(name), 'dev-user', DEV_EMAIL],
+  );
+  const userId = user.id;
+
+  // Fresh ACTIVE session; userInfo is the denormalized TCurrentUser the guard puts on req.user.
+  const sessionId = crypto.randomUUID();
+  const userInfo = {
+    id: userId,
+    email: DEV_EMAIL,
+    name,
+    username: 'dev-user',
+    userType: 'individual',
+    status: 'accepted',
+    roles: [],
+    permissions: [],
+  };
+  await ds.query(
+    `INSERT INTO iam.sessions (id, email, device, "userInfo", user_id, status, expiry_time)
+       VALUES ($1, $2, 'dev-seeder', $3::jsonb, $4, 'ACTIVE', now() + interval '7 days')`,
+    [sessionId, DEV_EMAIL, JSON.stringify(userInfo), userId],
+  );
+
+  // The package JwtGuard looks up the session by the token's `id` claim.
+  const token = generateToken({ id: sessionId });
+
+  console.log('\n=== IAM dev user seeded ===');
+  console.log('user id   :', userId);
+  console.log('email     :', DEV_EMAIL);
+  console.log('session id:', sessionId);
+  console.log('\nBearer token (valid 7 days):\n' + token);
+  console.log('\nTry it:  curl -H "Authorization: Bearer <token>" http://localhost:3002/v1/auth/me');
+  console.log('(Run again any time for a fresh token/session.)\n');
+
+  await ds.destroy();
+})().catch((e) => {
+  console.error('[seed-iam-dev-user] FAIL:', e.message);
+  process.exit(1);
+});
--- a/apps/edr-passenger-api/src/app.module.ts
+++ b/apps/edr-passenger-api/src/app.module.ts
@@ -1,14 +1,29 @@
-import { Module, NestModule, MiddlewareConsumer } from '@nestjs/common';
-import { ConfigModule } from '@nestjs/config';
+import {
+  MiddlewareConsumer,
+  Module,
+  NestModule,
+  OnApplicationBootstrap,
+} from '@nestjs/common';
+import { ConfigModule, ConfigService } from '@nestjs/config';
 import { ScheduleModule } from '@nestjs/schedule';
 import { EventEmitterModule } from '@nestjs/event-emitter';
+import { TypeOrmModule, TypeOrmModuleOptions } from '@nestjs/typeorm';
+import { IamModule as TriaIamModule } from '@tria-plc/iamapi-common/iam.module';
+import { DataSeeder } from '@tria-plc/iamapi-common/db/seed/seeder';
+import { SharedAuthModule } from '@tria-plc/api-common/modules/auth/shared-auth.module';
+import {
+  EDR_PASSENGER_APPLICATION,
+  EDR_PASSENGER_PERMISSIONS,
+} from './seed/edr-passenger.seed';
+import { EdrPassengerOrgSeeder } from './seed/edr-passenger-org.seeder';
+import { PassengerStaffUsersSeeder } from './seed/passenger-staff-users.seeder';
 import { PrismaModule } from './common/prisma.module';
 import { AuditModule } from './common/audit.module';
 import { I18nModule } from './common/i18n/i18n.module';
-import { IamModule } from './common/iam.module';
 import { LocaleMiddleware } from './common/i18n/locale.middleware';
 import appConfig from './config/app.config';
 import dbConfig from './config/database.config';
+import iamDatabaseConfig from './config/iam-database.config';
 import telebirrConfig from './config/telebirr.config';
 import cbeConfig from './config/cbe.config';
 import ebirrConfig from './config/ebirr.config';
@@ -50,6 +65,7 @@ import { CurrenciesModule } from './modules/currencies/currencies.module';
      load: [
        appConfig,
        dbConfig,
+        iamDatabaseConfig,
        telebirrConfig,
        cbeConfig,
        ebirrConfig,
@@ -61,11 +77,20 @@ import { CurrenciesModule } from './modules/currencies/currencies.module';
    }),
    ScheduleModule.forRoot(),
    EventEmitterModule.forRoot(),
+    TypeOrmModule.forRootAsync({
+      inject: [ConfigService],
+      useFactory: (config: ConfigService): TypeOrmModuleOptions =>
+        config.get<TypeOrmModuleOptions>('iamDatabase')!,
+    }),
+    TriaIamModule.forRoot({
+      applications: [EDR_PASSENGER_APPLICATION],
+      permissions: EDR_PASSENGER_PERMISSIONS,
+    }),
+    SharedAuthModule,
    PrismaModule,
    AuditModule,
    I18nModule,
-    IamModule,
-    AuthModule,
+      AuthModule,
    StationsModule,
    FleetModule,
    SchedulesModule,
@@ -92,9 +117,25 @@ import { CurrenciesModule } from './modules/currencies/currencies.module';
    AuditModuleFeature,
    CurrenciesModule,
  ],
+  providers: [
+    EdrPassengerOrgSeeder,
+    PassengerStaffUsersSeeder,
+  ],
 })
-export class AppModule implements NestModule {
-  configure(consumer: MiddlewareConsumer) {
-    consumer.apply(LocaleMiddleware).forRoutes('*');
+export class AppModule implements OnApplicationBootstrap {
+  constructor(
+    private readonly seeder: DataSeeder,
+    private readonly edrPassengerOrgSeeder: EdrPassengerOrgSeeder,
+    private readonly passengerStaffUsersSeeder: PassengerStaffUsersSeeder,
+  ) {}
+
+  async onApplicationBootstrap() {
+    try {
+      await this.seeder.run();
+    } catch (err) {
+      console.error('[DataSeeder] Seed failed (non-fatal):', (err as Error).message);
+    }
+    await this.edrPassengerOrgSeeder.run();
+    await this.passengerStaffUsersSeeder.run();
  }
 }
--- a/apps/edr-passenger-api/src/common/audit.service.ts
+++ b/apps/edr-passenger-api/src/common/audit.service.ts
@@ -23,7 +23,7 @@ export class AuditService {

      await this.prisma.auditLog.create({
        data: {
-          userId: input.userId,
+          iamUserId: input.userId,
          action: input.action,
          entityType: input.entityType,
          entityId: input.entityId,
@@ -62,8 +62,7 @@ export class AuditService {
    if (filters.search) {
      where.OR = [
        { entityId: { contains: filters.search, mode: 'insensitive' } },
-        { user: { email: { contains: filters.search, mode: 'insensitive' } } },
-        { user: { fullName: { contains: filters.search, mode: 'insensitive' } } },
+        { iamUserId: { contains: filters.search, mode: 'insensitive' } },
      ];
    }

@@ -77,16 +76,12 @@ export class AuditService {

    return this.prisma.auditLog.findMany({
      where,
-      include: { user: true },
      orderBy: { createdAt: 'desc' },
-      take: 500, // Limit to last 500 logs
+      take: 500,
    });
  }

  async getLog(id: string) {
-    return this.prisma.auditLog.findUnique({
-      where: { id },
-      include: { user: true },
-    });
+    return this.prisma.auditLog.findUnique({ where: { id } });
  }
 }
--- a/apps/edr-passenger-api/src/common/iam-adapter.spec.ts
+++ b/apps/edr-passenger-api/src/common/iam-adapter.spec.ts
@@ -1,264 +0,0 @@
-import { Test, TestingModule } from '@nestjs/testing';
-import { ExecutionContext, UnauthorizedException, ForbiddenException } from '@nestjs/common';
-import { Reflector } from '@nestjs/core';
-import { ConfigService } from '@nestjs/config';
-import { HttpService } from '@nestjs/axios';
-import { IamGuard } from './iam-adapter';
-import { of, throwError } from 'rxjs';
-
-describe('IamGuard', () => {
-  let guard: IamGuard;
-  let httpService: HttpService;
-  let configService: ConfigService;
-  let reflector: Reflector;
-
-  const mockConfigService = {
-    get: jest.fn((key: string) => {
-      const config: Record<string, string> = {
-        IAM_API_URL: 'https://iam.test.com/api',
-        IAM_ENABLED: 'true',
-        IAM_API_KEY: 'test-api-key',
-      };
-      return config[key];
-    }),
-  };
-
-  const mockHttpService = {
-    post: jest.fn(),
-  };
-
-  const mockReflector = {
-    get: jest.fn(),
-  };
-
-  beforeEach(async () => {
-    const module: TestingModule = await Test.createTestingModule({
-      providers: [
-        IamGuard,
-        { provide: ConfigService, useValue: mockConfigService },
-        { provide: HttpService, useValue: mockHttpService },
-        { provide: Reflector, useValue: mockReflector },
-      ],
-    }).compile();
-
-    guard = module.get<IamGuard>(IamGuard);
-    httpService = module.get<HttpService>(HttpService);
-    configService = module.get<ConfigService>(ConfigService);
-    reflector = module.get<Reflector>(Reflector);
-
-    jest.clearAllMocks();
-  });
-
-  const createMockContext = (token?: string, roles?: string[]): ExecutionContext => {
-    const request = {
-      headers: token ? { authorization: `Bearer ${token}` } : {},
-      user: undefined,
-    };
-
-    return {
-      switchToHttp: () => ({
-        getRequest: () => request,
-      }),
-      getHandler: () => ({}),
-    } as ExecutionContext;
-  };
-
-  describe('canActivate', () => {
-    it('should allow access when IAM is disabled', async () => {
-      mockConfigService.get.mockReturnValueOnce('false'); // IAM_ENABLED
-
-      const context = createMockContext();
-      const result = await guard.canActivate(context);
-
-      expect(result).toBe(true);
-    });
-
-    it('should throw UnauthorizedException when no token provided', async () => {
-      const context = createMockContext();
-
-      await expect(guard.canActivate(context)).rejects.toThrow(UnauthorizedException);
-    });
-
-    it('should validate token and allow access', async () => {
-      const mockValidationResponse = {
-        data: {
-          valid: true,
-          payload: {
-            sub: 'user-123',
-            email: 'admin@test.com',
-            roles: ['ADMIN'],
-            permissions: ['read', 'write'],
-            exp: Date.now() + 3600000,
-            iat: Date.now(),
-          },
-        },
-      };
-
-      mockHttpService.post.mockReturnValue(of(mockValidationResponse));
-      mockReflector.get.mockReturnValue(null);
-
-      const context = createMockContext('valid-token');
-      const result = await guard.canActivate(context);
-
-      expect(result).toBe(true);
-      expect(mockHttpService.post).toHaveBeenCalledWith(
-        'https://iam.test.com/api/v1/auth/validate',
-        { token: 'valid-token' },
-        expect.objectContaining({
-          headers: expect.objectContaining({
-            'X-API-Key': 'test-api-key',
-          }),
-        }),
-      );
-    });
-
-    it('should throw UnauthorizedException for invalid token', async () => {
-      const mockValidationResponse = {
-        data: {
-          valid: false,
-          error: 'Token expired',
-        },
-      };
-
-      mockHttpService.post.mockReturnValue(of(mockValidationResponse));
-
-      const context = createMockContext('invalid-token');
-
-      await expect(guard.canActivate(context)).rejects.toThrow(UnauthorizedException);
-    });
-
-    it('should check required roles', async () => {
-      const mockValidationResponse = {
-        data: {
-          valid: true,
-          payload: {
-            sub: 'user-123',
-            email: 'agent@test.com',
-            roles: ['AGENT'],
-            permissions: [],
-            exp: Date.now() + 3600000,
-            iat: Date.now(),
-          },
-        },
-      };
-
-      mockHttpService.post.mockReturnValue(of(mockValidationResponse));
-      mockReflector.get.mockReturnValue(['ADMIN', 'SUPERVISOR']);
-
-      const context = createMockContext('valid-token');
-
-      await expect(guard.canActivate(context)).rejects.toThrow(ForbiddenException);
-    });
-
-    it('should allow access when user has required role', async () => {
-      const mockValidationResponse = {
-        data: {
-          valid: true,
-          payload: {
-            sub: 'user-123',
-            email: 'admin@test.com',
-            roles: ['ADMIN'],
-            permissions: [],
-            exp: Date.now() + 3600000,
-            iat: Date.now(),
-          },
-        },
-      };
-
-      mockHttpService.post.mockReturnValue(of(mockValidationResponse));
-      mockReflector.get.mockReturnValue(['ADMIN', 'SUPERVISOR']);
-
-      const context = createMockContext('valid-token');
-      const result = await guard.canActivate(context);
-
-      expect(result).toBe(true);
-    });
-
-    it('should handle HTTP errors gracefully', async () => {
-      mockHttpService.post.mockReturnValue(
-        throwError(() => new Error('Network error')),
-      );
-
-      const context = createMockContext('valid-token');
-
-      await expect(guard.canActivate(context)).rejects.toThrow(UnauthorizedException);
-    });
-
-    it('should attach user to request', async () => {
-      const mockValidationResponse = {
-        data: {
-          valid: true,
-          payload: {
-            sub: 'user-123',
-            email: 'admin@test.com',
-            roles: ['ADMIN'],
-            permissions: ['read', 'write'],
-            organizationId: 'org-456',
-            exp: Date.now() + 3600000,
-            iat: Date.now(),
-          },
-        },
-      };
-
-      mockHttpService.post.mockReturnValue(of(mockValidationResponse));
-      mockReflector.get.mockReturnValue(null);
-
-      const context = createMockContext('valid-token');
-      await guard.canActivate(context);
-
-      const request = context.switchToHttp().getRequest();
-      expect(request.user).toEqual({
-        userId: 'user-123',
-        email: 'admin@test.com',
-        roles: ['ADMIN'],
-        permissions: ['read', 'write'],
-        organizationId: 'org-456',
-      });
-    });
-  });
-
-  describe('token extraction', () => {
-    it('should extract token from Bearer header', async () => {
-      const mockValidationResponse = {
-        data: {
-          valid: true,
-          payload: {
-            sub: 'user-123',
-            email: 'test@test.com',
-            roles: [],
-            permissions: [],
-            exp: Date.now() + 3600000,
-            iat: Date.now(),
-          },
-        },
-      };
-
-      mockHttpService.post.mockReturnValue(of(mockValidationResponse));
-      mockReflector.get.mockReturnValue(null);
-
-      const context = createMockContext('my-token-123');
-      await guard.canActivate(context);
-
-      expect(mockHttpService.post).toHaveBeenCalledWith(
-        expect.any(String),
-        { token: 'my-token-123' },
-        expect.any(Object),
-      );
-    });
-
-    it('should reject malformed authorization header', async () => {
-      const request = {
-        headers: { authorization: 'InvalidFormat token' },
-      };
-
-      const context = {
-        switchToHttp: () => ({
-          getRequest: () => request,
-        }),
-        getHandler: () => ({}),
-      } as ExecutionContext;
-
-      await expect(guard.canActivate(context)).rejects.toThrow(UnauthorizedException);
-    });
-  });
-});
--- a/apps/edr-passenger-api/src/common/iam-adapter.ts
+++ b/apps/edr-passenger-api/src/common/iam-adapter.ts
@@ -1,144 +1 @@
-import { Injectable, CanActivate, ExecutionContext, UnauthorizedException, ForbiddenException } from '@nestjs/common';
-import { Reflector } from '@nestjs/core';
-import { ConfigService } from '@nestjs/config';
-import { HttpService } from '@nestjs/axios';
-import { firstValueFrom } from 'rxjs';
-
-/**
- * IAM Adapter for @tria-plc corporate identity integration
- * 
- * This adapter wraps the corporate IAM guards and provides a bridge
- * between the corporate identity system and the EDR passenger API.
- * 
- * For back-office roles (agent, supervisor, admin, staff), this guard
- * validates tokens against the corporate IAM service.
- * 
- * For passenger-facing routes, the existing JWT guard is used.
- */
-
-export interface IamTokenPayload {
-  sub: string;
-  email: string;
-  roles: string[];
-  permissions: string[];
-  organizationId?: string;
-  exp: number;
-  iat: number;
-}
-
-export interface IamValidationResponse {
-  valid: boolean;
-  payload?: IamTokenPayload;
-  error?: string;
-}
-
-@Injectable()
-export class IamGuard implements CanActivate {
-  private readonly iamApiUrl: string;
-  private readonly iamEnabled: boolean;
-
-  constructor(
-    private readonly reflector: Reflector,
-    private readonly config: ConfigService,
-    private readonly http: HttpService,
-  ) {
-    this.iamApiUrl = this.config.get<string>('IAM_API_URL') || 'https://iam.tria-plc.com/api';
-    this.iamEnabled = this.config.get<string>('IAM_ENABLED') === 'true';
-  }
-
-  async canActivate(context: ExecutionContext): Promise<boolean> {
-    if (!this.iamEnabled) {
-      // IAM disabled - allow access (for development)
-      return true;
-    }
-
-    const request = context.switchToHttp().getRequest();
-    const token = this.extractToken(request);
-
-    if (!token) {
-      throw new UnauthorizedException('No authentication token provided');
-    }
-
-    const validation = await this.validateToken(token);
-
-    if (!validation.valid || !validation.payload) {
-      throw new UnauthorizedException(validation.error || 'Invalid token');
-    }
-
-    // Check required roles
-    const requiredRoles = this.reflector.get<string[]>('roles', context.getHandler());
-    if (requiredRoles && requiredRoles.length > 0) {
-      const hasRole = requiredRoles.some((role) => validation.payload!.roles.includes(role));
-      if (!hasRole) {
-        throw new ForbiddenException('Insufficient permissions');
-      }
-    }
-
-    // Attach user to request
-    request.user = {
-      userId: validation.payload.sub,
-      email: validation.payload.email,
-      roles: validation.payload.roles,
-      permissions: validation.payload.permissions,
-      organizationId: validation.payload.organizationId,
-    };
-
-    return true;
-  }
-
-  private extractToken(request: any): string | null {
-    const authHeader = request.headers.authorization;
-    if (!authHeader) return null;
-
-    const parts = authHeader.split(' ');
-    if (parts.length !== 2 || parts[0] !== 'Bearer') return null;
-
-    return parts[1];
-  }
-
-  private async validateToken(token: string): Promise<IamValidationResponse> {
-    try {
-      const response = await firstValueFrom(
-        this.http.post<IamValidationResponse>(
-          `${this.iamApiUrl}/v1/auth/validate`,
-          { token },
-          {
-            headers: {
-              'Content-Type': 'application/json',
-              'X-API-Key': this.config.get<string>('IAM_API_KEY') || '',
-            },
-            timeout: 5000,
-          },
-        ),
-      );
-
-      return response.data;
-    } catch (err) {
-      return {
-        valid: false,
-        error: err instanceof Error ? err.message : 'Token validation failed',
-      };
-    }
-  }
-}
-
-/**
- * Decorator to mark routes as requiring IAM authentication
- */
-export const UseIamAuth = () => {
-  // This is a marker decorator that can be used with @UseGuards(IamGuard)
-  return (target: any, propertyKey?: string, descriptor?: PropertyDescriptor) => {
-    // Marker only - actual guard is applied via @UseGuards
-  };
-};
-
-/**
- * Decorator to specify required roles for IAM-protected routes
- */
-export const IamRoles = (...roles: string[]) => {
-  return (target: any, propertyKey?: string, descriptor?: PropertyDescriptor) => {
-    if (descriptor) {
-      Reflect.defineMetadata('roles', roles, descriptor.value);
-    }
-  };
-};
+export { JwtGuard as IamGuard } from '@tria-plc/api-common/modules/auth/services/jwt.guard';
--- a/apps/edr-passenger-api/src/common/iam-typeorm.config.ts
+++ b/apps/edr-passenger-api/src/common/iam-typeorm.config.ts
@@ -0,0 +1,56 @@
+import { TypeOrmModuleOptions } from '@nestjs/typeorm';
+import * as path from 'path';
+
+/**
+ * TypeORM DataSource options for the shared `iam` schema.
+ *
+ * Context (see docs/iam-package-understanding-guide.md):
+ * - The `iam` schema is owned by `@tria-plc/iamapi-common` (TypeORM). Prisma owns the
+ *   `passenger` schema. Both ORMs point at the same database (`edr_database`).
+ * - `@tria-plc/api-common`'s `JwtGuard` injects the *default* TypeORM `DataSource` and runs a
+ *   raw `SELECT ... FROM iam.sessions`, so the app must expose a DataSource that can reach it.
+ *
+ * Connection env vars intentionally mirror the package's own migration DataSource
+ * (`@tria-plc/api-common/dist/modules/typeorm/typeorm.config.internal.js`) so the app and the
+ * package CLI read the same configuration:
+ *   DATABASE_HOST, DATABASE_PORT, DATABASE_NAME, DATABASE_USER, DATABASE_PASSWORD, DATABASE_SCHEMA
+ *
+ * This NEVER manages the schema: `synchronize: false` and `migrationsRun: false`. The `iam`
+ * schema is created by the IAM package migrations (dev: self-hosted; prod: central IAM team).
+ */
+function resolvePackageDist(pkg: string): string {
+  // Node honors each package's `exports` map at runtime even though TS `moduleResolution: "Node"`
+  // does not — so `require.resolve` on the barrel resolves to the package's dist `index.js`.
+  const resolved = require.resolve(pkg);
+  // Normalize to forward slashes so the glob works on Windows too.
+  return path.dirname(resolved).replace(/\\/g, '/');
+}
+
+export function buildIamTypeOrmOptions(): TypeOrmModuleOptions {
+  const iamDist = resolvePackageDist('@tria-plc/iamapi-common');
+  // Some IAM entities (e.g. PositionType) relate to the notification entities that physically
+  // live in @tria-plc/api-common (the IAM barrel only re-exports them), so BOTH dist trees must
+  // be registered or TypeORM throws "Entity metadata ... was not found".
+  const apiDist = resolvePackageDist('@tria-plc/api-common');
+  return {
+    type: 'postgres',
+    host: process.env.DATABASE_HOST,
+    port: Number(process.env.DATABASE_PORT ?? 5432),
+    database: process.env.DATABASE_NAME,
+    username: process.env.DATABASE_USER,
+    password: process.env.DATABASE_PASSWORD,
+    schema: process.env.DATABASE_SCHEMA ?? 'iam',
+    // IAM entities live in the packages; registered so the same default DataSource also serves
+    // IamModule in the dev self-host phase (Phase 3). Harmless before the tables exist.
+    entities: [
+      `${iamDist}/entities/**/*.entity.{ts,js}`,
+      `${apiDist}/entities/**/*.entity.{ts,js}`,
+    ],
+    synchronize: false, // schema is owned by IAM migrations — never auto-sync
+    migrationsRun: false, // migrations are run by the IAM package CLI (dev) / IAM team (prod)
+    autoLoadEntities: false,
+    migrationsTableName: 'typeorm_migrations',
+    retryAttempts: 0, // fail fast in dev if the iam schema / DB is unreachable
+    logging: ['error'],
+  };
+}
--- a/apps/edr-passenger-api/src/common/iam.module.ts
+++ b/apps/edr-passenger-api/src/common/iam.module.ts
@@ -1,11 +0,0 @@
-import { Module, Global } from '@nestjs/common';
-import { HttpModule } from '@nestjs/axios';
-import { IamGuard } from './iam-adapter';
-
-@Global()
-@Module({
-  imports: [HttpModule.register({ timeout: 5000 })],
-  providers: [IamGuard],
-  exports: [IamGuard],
-})
-export class IamModule {}
--- a/apps/edr-passenger-api/src/common/interceptors/session-activity.interceptor.ts
+++ b/apps/edr-passenger-api/src/common/interceptors/session-activity.interceptor.ts
@@ -1,7 +1,8 @@
-import { Injectable, NestInterceptor, ExecutionContext, CallHandler, UnauthorizedException } from '@nestjs/common';
+import { Injectable, NestInterceptor, ExecutionContext, CallHandler } from '@nestjs/common';
 import { Observable } from 'rxjs';
 import { tap } from 'rxjs/operators';
-import { PrismaService } from '../prisma.service';
+import { InjectDataSource } from '@nestjs/typeorm';
+import { DataSource } from 'typeorm';
 import { ConfigService } from '@nestjs/config';

@Injectable()
@@ -9,7 +10,7 @@ export class SessionActivityInterceptor implements NestInterceptor {
  private readonly inactivityMinutes: number;

  constructor(
-    private readonly prisma: PrismaService,
+    @InjectDataSource() private readonly dataSource: DataSource,
    private readonly config: ConfigService,
  ) {
    this.inactivityMinutes = parseInt(this.config.get<string>('SESSION_INACTIVITY_MINUTES') || '30', 10);
@@ -18,29 +19,25 @@ export class SessionActivityInterceptor implements NestInterceptor {
  async intercept(context: ExecutionContext, next: CallHandler): Promise<Observable<any>> {
    const request = context.switchToHttp().getRequest();
    const response = context.switchToHttp().getResponse();
-    const user = request.user;
+    const sessionId: string | undefined = request.user?.sessionId;

-    if (user?.userId) {
-      const session = await this.prisma.session.findFirst({
-        where: { userId: user.userId },
-        orderBy: { lastActivityAt: 'desc' },
-      });
+    if (sessionId) {
+      const rows = await this.dataSource.query<Array<{ expiry_time: Date }>>(
+        `SELECT expiry_time FROM iam.sessions WHERE id = $1 AND status = 'ACTIVE' LIMIT 1`,
+        [sessionId],
+      );

-      if (session) {
-        const inactiveMinutes = (Date.now() - session.lastActivityAt.getTime()) / 60000;
-        
-        if (inactiveMinutes > this.inactivityMinutes) {
-          await this.prisma.session.delete({ where: { id: session.id } });
-          throw new UnauthorizedException('Session expired due to inactivity');
+      if (rows.length) {
+        const minutesLeft = (rows[0].expiry_time.getTime() - Date.now()) / 60000;
+        if (minutesLeft < this.inactivityMinutes * 0.2) {
+          response.setHeader('X-Session-Expiry-Warning', Math.floor(minutesLeft).toString());
        }

-        const expiryWarningMinutes = Math.max(0, this.inactivityMinutes - inactiveMinutes);
-        response.setHeader('X-Session-Expiry-Warning', Math.floor(expiryWarningMinutes).toString());
-
-        await this.prisma.session.update({
-          where: { id: session.id },
-          data: { lastActivityAt: new Date() },
-        });
+        // Extend session on every authenticated request
+        await this.dataSource.query(
+          `UPDATE iam.sessions SET expiry_time = NOW() + ($1 * INTERVAL '1 minute') WHERE id = $2 AND status = 'ACTIVE'`,
+          [this.inactivityMinutes, sessionId],
+        );
      }
    }

--- a/apps/edr-passenger-api/src/common/jwt.guard.ts
+++ b/apps/edr-passenger-api/src/common/jwt.guard.ts
@@ -1,5 +1,4 @@
-import { Injectable } from '@nestjs/common';
-import { AuthGuard } from '@nestjs/passport';
-
-@Injectable()
-export class JwtGuard extends AuthGuard('jwt') {}
+// Compatibility alias while passenger auth moves to @tria-plc IAM.
+// Existing controllers can keep importing `../../common/jwt.guard`, but the
+// guard now validates IAM-issued session tokens from `iam.sessions`.
+export { JwtGuard } from '@tria-plc/api-common/modules/auth/services/jwt.guard';
--- a/apps/edr-passenger-api/src/common/jwt.strategy.ts
+++ b/apps/edr-passenger-api/src/common/jwt.strategy.ts
@@ -1,19 +0,0 @@
-import { Injectable } from '@nestjs/common';
-import { PassportStrategy } from '@nestjs/passport';
-import { ExtractJwt, Strategy } from 'passport-jwt';
-import { ConfigService } from '@nestjs/config';
-
-@Injectable()
-export class JwtStrategy extends PassportStrategy(Strategy) {
-  constructor(config: ConfigService) {
-    const secret = config.get<string>('JWT_SECRET');
-    if (!secret) throw new Error('JWT_SECRET environment variable is not set');
-    super({
-      jwtFromRequest: ExtractJwt.fromAuthHeaderAsBearerToken(),
-      secretOrKey: secret,
-    });
-  }
-  async validate(payload: any) {
-    return { userId: payload.sub, email: payload.email, role: payload.role, passengerId: payload.passengerId };
-  }
-}
--- a/apps/edr-passenger-api/src/common/passenger-guards.ts
+++ b/apps/edr-passenger-api/src/common/passenger-guards.ts
@@ -0,0 +1,14 @@
+import { applyDecorators, UseGuards } from '@nestjs/common';
+import { JwtGuard } from '@tria-plc/api-common/modules/auth/services/jwt.guard';
+import { PassengerPermissionGuard } from './passenger-permission.guard';
+import { PASSENGER_PERMS } from '../seed/passenger-permissions.registry';
+
+export const PassengerStaff = (permission: string | string[]) =>
+  applyDecorators(
+    UseGuards(
+      JwtGuard,
+      PassengerPermissionGuard(Array.isArray(permission) ? permission : [permission]),
+    ),
+  );
+
+export const PassengerAdmin = () => PassengerStaff(PASSENGER_PERMS.admin);
--- a/apps/edr-passenger-api/src/common/passenger-permission.guard.ts
+++ b/apps/edr-passenger-api/src/common/passenger-permission.guard.ts
@@ -0,0 +1,30 @@
+import {
+  CanActivate,
+  ExecutionContext,
+  ForbiddenException,
+  Injectable,
+  Type,
+  UnauthorizedException,
+} from '@nestjs/common';
+import { hasPassengerPermission } from './passenger-permission.util';
+
+export function PassengerPermissionGuard(permissions: string[]): Type<CanActivate> {
+  @Injectable()
+  class PassengerPermissionsGuard implements CanActivate {
+    canActivate(context: ExecutionContext): boolean {
+      const request = context.switchToHttp().getRequest<{ user?: any }>();
+      const user = request.user;
+
+      if (!permissions?.length) return true;
+      if (!user) throw new UnauthorizedException('Authentication required');
+
+      if (permissions.some((p) => hasPassengerPermission(user, p))) return true;
+
+      throw new ForbiddenException(
+        `Missing permission. Required one of: ${permissions.join(', ')}`,
+      );
+    }
+  }
+
+  return PassengerPermissionsGuard;
+}
--- a/apps/edr-passenger-api/src/common/passenger-permission.util.ts
+++ b/apps/edr-passenger-api/src/common/passenger-permission.util.ts
@@ -0,0 +1,74 @@
+import { ForbiddenException } from '@nestjs/common';
+
+const SUPER_ADMIN_ROLE = 'super_admin';
+const ORGANIZATION_ADMIN_ROLE = 'organization_admin';
+
+type PermissionLike = { key?: string };
+type MeLikeUser = {
+  roles?: { key?: string }[];
+  permissions?: PermissionLike[];
+  employee?:
+    | { position?: { permissions?: PermissionLike[] }; delegatedPositions?: { permissions?: PermissionLike[] }[] }
+    | { positions?: { permissions?: PermissionLike[] }[] }[]
+    | null;
+};
+
+export function isSuperAdmin(user: MeLikeUser | null | undefined): boolean {
+  return user?.roles?.some((r) => r.key === SUPER_ADMIN_ROLE) ?? false;
+}
+
+export function isOrganizationAdmin(user: MeLikeUser | null | undefined): boolean {
+  return user?.roles?.some((r) => r.key === ORGANIZATION_ADMIN_ROLE) ?? false;
+}
+
+export function collectPermissionKeys(user: MeLikeUser | null | undefined): string[] {
+  if (!user) return [];
+
+  const keys = new Set<string>();
+
+  for (const p of user.permissions ?? []) {
+    if (p.key) keys.add(p.key);
+  }
+
+  const employee = user.employee;
+  if (!employee) return [...keys];
+
+  if (Array.isArray(employee)) {
+    for (const emp of employee) {
+      for (const pos of emp.positions ?? []) {
+        for (const p of pos.permissions ?? []) {
+          if (p.key) keys.add(p.key);
+        }
+      }
+    }
+    return [...keys];
+  }
+
+  for (const p of employee.position?.permissions ?? []) {
+    if (p.key) keys.add(p.key);
+  }
+  for (const delegated of employee.delegatedPositions ?? []) {
+    for (const p of delegated.permissions ?? []) {
+      if (p.key) keys.add(p.key);
+    }
+  }
+
+  return [...keys];
+}
+
+export function hasPassengerPermission(
+  user: MeLikeUser | null | undefined,
+  permissionKey: string,
+): boolean {
+  if (!user) return false;
+  if (isSuperAdmin(user) || isOrganizationAdmin(user)) return true;
+  return collectPermissionKeys(user).includes(permissionKey);
+}
+
+export function assertPassengerPermission(
+  user: MeLikeUser | null | undefined,
+  permissionKey: string,
+): void {
+  if (hasPassengerPermission(user, permissionKey)) return;
+  throw new ForbiddenException(`Missing permission: ${permissionKey}`);
+}
--- a/apps/edr-passenger-api/src/common/roles.decorator.ts
+++ b/apps/edr-passenger-api/src/common/roles.decorator.ts
@@ -1,5 +1,4 @@
 import { SetMetadata } from '@nestjs/common';
-import { UserRole } from '@prisma/client';

 export const ROLES_KEY = 'roles';
-export const Roles = (...roles: UserRole[]) => SetMetadata(ROLES_KEY, roles);
+export const Roles = (...roles: string[]) => SetMetadata(ROLES_KEY, roles);
--- a/apps/edr-passenger-api/src/common/roles.guard.ts
+++ b/apps/edr-passenger-api/src/common/roles.guard.ts
@@ -1,6 +1,5 @@
 import { Injectable, CanActivate, ExecutionContext } from '@nestjs/common';
 import { Reflector } from '@nestjs/core';
-import { UserRole } from '@prisma/client';
 import { ROLES_KEY } from './roles.decorator';

@Injectable()
@@ -8,12 +7,15 @@ export class RolesGuard implements CanActivate {
  constructor(private reflector: Reflector) {}

  canActivate(context: ExecutionContext): boolean {
-    const requiredRoles = this.reflector.getAllAndOverride<UserRole[]>(ROLES_KEY, [
+    const requiredRoles = this.reflector.getAllAndOverride<string[]>(ROLES_KEY, [
      context.getHandler(),
      context.getClass(),
    ]);
    if (!requiredRoles) return true;
    const { user } = context.switchToHttp().getRequest();
-    return requiredRoles.some((role) => user?.role === role);
+    // Support IAM roles array [{key, id}][] and legacy role string
+    return requiredRoles.some(
+      (role) => user?.roles?.some((r: { key: string }) => r.key === role) || user?.role === role,
+    );
  }
 }
--- a/apps/edr-passenger-api/src/config/iam-database.config.ts
+++ b/apps/edr-passenger-api/src/config/iam-database.config.ts
@@ -0,0 +1,18 @@
+import { registerAs } from '@nestjs/config';
+import { TypeOrmModuleOptions } from '@nestjs/typeorm';
+import { buildIamTypeOrmOptions } from '../common/iam-typeorm.config';
+
+/**
+ * Dedicated config namespace for the IAM **TypeORM** connection — the shared `iam` schema ONLY.
+ *
+ * This is intentionally separate from Prisma: Prisma remains the app's primary ORM and owns the
+ * `passenger` schema via `DATABASE_URL` (see prisma.service.ts). This second connection exists
+ * solely because `@tria-plc/api-common` / `@tria-plc/iamapi-common` are TypeORM-based and the
+ * `JwtGuard` reads `iam.sessions` through a TypeORM `DataSource`.
+ *
+ * Consumed by `TypeOrmModule.forRootAsync` in app.module.ts.
+ */
+export default registerAs(
+  'iamDatabase',
+  (): TypeOrmModuleOptions => buildIamTypeOrmOptions(),
+);
--- a/apps/edr-passenger-api/src/main.ts
+++ b/apps/edr-passenger-api/src/main.ts
@@ -1,6 +1,10 @@
+// Load .env into process.env BEFORE the module graph is built. Required because the @tria-plc IAM
+// modules read process.env at module-load time (e.g. MinioModule.register reads MINIO_ENDPOINT),
+// which happens before ConfigModule.forRoot() would populate it. Must be the very first import.
+import "dotenv/config";
 import "reflect-metadata";
 import { NestFactory } from "@nestjs/core";
-import { ValidationPipe } from "@nestjs/common";
+import { ValidationPipe, VersioningType } from "@nestjs/common";
 import { DocumentBuilder, SwaggerModule } from "@nestjs/swagger";
 import { AppModule } from "./app.module";
 import { HttpExceptionFilter } from "./common/filters/http-exception.filter";
@@ -12,6 +16,11 @@ async function bootstrap() {
  // (e.g. Waafi HMAC verification) can sign over the exact bytes the provider signed.
  const app = await NestFactory.create(AppModule, { rawBody: true });

+  // URI versioning: the @tria-plc IAM controllers declare `version: "1"` so they register under
+  // `/v1/...` (e.g. /v1/auth/login). Passenger controllers declare no version, so they stay
+  // version-neutral at their existing paths (e.g. /search, /bookings) — unchanged for the frontend.
+  app.enableVersioning({ type: VersioningType.URI });
+
  app.enableCors({
    origin: [
      process.env.PORTAL_URL ?? "http://localhost:5174",
--- a/apps/edr-passenger-api/src/modules/agents/agents.controller.ts
+++ b/apps/edr-passenger-api/src/modules/agents/agents.controller.ts
@@ -2,39 +2,37 @@ import { Body, Controller, Get, Param, Post, Query, UseGuards } from '@nestjs/co
 import { ApiTags, ApiOperation, ApiBearerAuth } from '@nestjs/swagger';
 import { AgentsService } from './agents.service';
 import { CreateAgentBookingDto, OpenShiftDto, CloseShiftDto } from './agents.dto';
-import { IamGuard, IamRoles } from '../../common/iam-adapter';
-import { UserRole } from '@prisma/client';
+// IAM auth: validate the IAM session token via @tria-plc/api-common's DB-backed JwtGuard.
+import { JwtGuard as IamJwtGuard } from '@tria-plc/api-common/modules/auth/services/jwt.guard';

@ApiTags('Agents')
@Controller('agents')
-@UseGuards(IamGuard)
+// TODO(iam-authz): restrict per route via @UseGuards(PermissionGuard([...])) once the IAM
+// role→permission mapping (EIamPermissionKey) is confirmed. For now: authenticated IAM users only.
+@UseGuards(IamJwtGuard)
@ApiBearerAuth('IAM-auth')
 export class AgentsController {
  constructor(private service: AgentsService) {}

  @Post('bookings')
-  @IamRoles('AGENT', 'ADMIN')
  @ApiOperation({ summary: 'Create agent booking with cash payment' })
  createBooking(@Body() dto: CreateAgentBookingDto) {
    return this.service.createAgentBooking(dto);
  }

  @Post('shifts/open')
-  @IamRoles('AGENT', 'ADMIN')
  @ApiOperation({ summary: 'Open agent shift' })
  openShift(@Body() dto: OpenShiftDto) {
    return this.service.openShift(dto);
  }

  @Post('shifts/close')
-  @IamRoles('AGENT', 'ADMIN')
  @ApiOperation({ summary: 'Close agent shift' })
  closeShift(@Body() dto: CloseShiftDto) {
    return this.service.closeShift(dto);
  }

  @Get(':agentId/commissions')
-  @IamRoles('AGENT', 'ADMIN')
  @ApiOperation({ summary: 'Get agent commissions' })
  getCommissions(
    @Param('agentId') agentId: string,
@@ -49,7 +47,6 @@ export class AgentsController {
  }

  @Get(':agentId/shifts')
-  @IamRoles('AGENT', 'ADMIN')
  @ApiOperation({ summary: 'Get agent shifts' })
  getShifts(@Param('agentId') agentId: string) {
    return this.service.getShifts(agentId);
--- a/apps/edr-passenger-api/src/modules/agents/agents.service.ts
+++ b/apps/edr-passenger-api/src/modules/agents/agents.service.ts
@@ -13,9 +13,13 @@ export class AgentsService {
  constructor(private prisma: PrismaService) {}

  async createAgentBooking(dto: CreateAgentBookingDto) {
-    const agent = await this.prisma.agent.findUnique({ where: { id: dto.agentId }, include: { user: { include: { passenger: true } } } });
+    const agent = await this.prisma.agent.findUnique({ where: { id: dto.agentId } });
    if (!agent || !agent.active) throw new NotFoundException('Agent not found or inactive');
-    if (!agent.user.passenger) throw new BadRequestException('Agent must have passenger account');
+
+    const passenger = agent.iamUserId
+      ? await this.prisma.passenger.findUnique({ where: { iamUserId: agent.iamUserId } })
+      : null;
+    if (!passenger) throw new BadRequestException('Agent must have a linked passenger account');

    const schedule = await this.prisma.trainSchedule.findUnique({ where: { id: dto.scheduleId } });
    if (!schedule) throw new NotFoundException('Schedule not found');
@@ -30,7 +34,7 @@ export class AgentsService {
    const booking = await this.prisma.booking.create({
      data: {
        bookingRef: generateRef(),
-        passengerId: agent.user.passenger.id,
+        passengerId: passenger.id,
        scheduleId: dto.scheduleId,
        status: dto.paymentMethod === 'CASH' ? 'CONFIRMED' : 'PENDING_PAYMENT',
        totalMinor,
--- a/apps/edr-passenger-api/src/modules/audit/audit.controller.ts
+++ b/apps/edr-passenger-api/src/modules/audit/audit.controller.ts
@@ -1,11 +1,12 @@
-import { Controller, Get, Param, Query, UseGuards } from '@nestjs/common';
+import { Controller, Get, Param, Query } from '@nestjs/common';
 import { ApiTags, ApiOperation, ApiBearerAuth, ApiQuery } from '@nestjs/swagger';
 import { AuditService } from '../../common/audit.service';
-import { IamGuard } from '../../common/iam-adapter';
+import { PassengerStaff } from '../../common/passenger-guards';
+import { PASSENGER_PERMS } from '../../seed/passenger-permissions.registry';

@ApiTags('Audit')
@Controller('audit')
-@UseGuards(IamGuard)
+@PassengerStaff([PASSENGER_PERMS.audit.view, PASSENGER_PERMS.admin])
@ApiBearerAuth('IAM-auth')
 export class AuditController {
  constructor(private auditService: AuditService) {}
--- a/apps/edr-passenger-api/src/modules/auth/auth.controller.ts
+++ b/apps/edr-passenger-api/src/modules/auth/auth.controller.ts
@@ -1,303 +1,69 @@
-import { Body, Controller, Post, HttpCode, HttpStatus, UseGuards, Get, Request, UnauthorizedException, Param, Patch, Delete, Query } from '@nestjs/common';
+import { Body, Controller, Post, HttpCode, HttpStatus, UseGuards, Get, Request, UnauthorizedException } from '@nestjs/common';
 import { ApiTags, ApiOperation, ApiResponse, ApiBody, ApiBearerAuth } from '@nestjs/swagger';
-import { AuthService } from './auth.service';
-import { RegisterDto, LoginDto, RequestOtpDto, VerifyOtpDto, RequestPasswordResetDto, ResetPasswordDto } from './auth.dto';
+import { IsPublic } from '@tria-plc/api-common/modules/auth/decorators/public.decorator';
+import { PassengerAuthService } from './passenger-auth.service';
+import { RegisterDto, LoginDto } from './auth.dto';
 import { JwtGuard } from '../../common/jwt.guard';
-import { RolesGuard } from '../../common/roles.guard';
-import { Roles } from '../../common/roles.decorator';
-import { UserRole } from '@prisma/client';

@ApiTags('Auth')
@Controller('auth')
 export class AuthController {
-  constructor(private service: AuthService) {}
+  constructor(private passengerAuthService: PassengerAuthService) {}

  @Post('register')
-  @ApiOperation({ 
-    summary: 'Register new passenger account',
-    description: 'Create a new passenger account with email, phone, and password. Returns user details and JWT token for immediate login.'
-  })
-  @ApiResponse({ status: 201, description: 'Account created successfully. Returns user object and JWT token.' })
-  @ApiResponse({ status: 400, description: 'Validation error (invalid email, weak password, etc.)' })
+  @IsPublic()
+  @ApiOperation({ summary: 'Register new passenger account' })
+  @ApiResponse({ status: 201, description: 'Account created. Returns token + user.' })
  @ApiResponse({ status: 409, description: 'Email or phone already registered' })
  @ApiBody({ type: RegisterDto })
-  register(@Body() dto: RegisterDto) { return this.service.register(dto); }
+  register(@Request() req: any, @Body() dto: RegisterDto) {
+    return this.passengerAuthService.register(dto, req);
+  }

  @Post('login')
+  @IsPublic()
  @HttpCode(HttpStatus.OK)
-  @ApiOperation({ 
-    summary: 'Login with email and password',
-    description: 'Authenticate user and receive JWT token. Token expires in 7 days by default. Failed login attempts are tracked and account may be locked after 5 consecutive failures.'
-  })
-  @ApiResponse({ status: 200, description: 'Login successful. Returns JWT token and user details.' })
-  @ApiResponse({ status: 401, description: 'Invalid credentials or account locked' })
-  @ApiResponse({ status: 403, description: 'Account temporarily blocked due to fraud detection' })
+  @ApiOperation({ summary: 'Login with email and password' })
+  @ApiResponse({ status: 200, description: 'Login successful. Returns token + passengerId.' })
+  @ApiResponse({ status: 401, description: 'Invalid credentials' })
  @ApiBody({ type: LoginDto })
-  login(@Body() dto: LoginDto) { return this.service.login(dto); }
-
-  @Post('otp/request')
-  @HttpCode(HttpStatus.OK)
-  @ApiOperation({ 
-    summary: 'Request OTP verification code',
-    description: 'Send a 6-digit OTP code to user email. Code expires in 10 minutes. Used for registration verification, password reset, or two-factor authentication.'
-  })
-  @ApiResponse({ status: 200, description: 'OTP sent successfully to email' })
-  @ApiResponse({ status: 404, description: 'Email not found (for PASSWORD_RESET purpose)' })
-  @ApiResponse({ status: 429, description: 'Too many OTP requests. Please wait before requesting again.' })
-  @ApiBody({ type: RequestOtpDto })
-  requestOtp(@Body() dto: RequestOtpDto) { return this.service.requestOtp(dto); }
-
-  @Post('otp/verify')
-  @HttpCode(HttpStatus.OK)
-  @ApiOperation({ 
-    summary: 'Verify OTP code',
-    description: 'Validate the 6-digit OTP code sent to user email. Code must match and not be expired.'
-  })
-  @ApiResponse({ status: 200, description: 'OTP verified successfully' })
-  @ApiResponse({ status: 400, description: 'Invalid or expired OTP code' })
-  @ApiResponse({ status: 404, description: 'No OTP found for this email and purpose' })
-  @ApiBody({ type: VerifyOtpDto })
-  verifyOtp(@Body() dto: VerifyOtpDto) { return this.service.verifyOtp(dto); }
-
-  @Post('password/reset-request')
-  @HttpCode(HttpStatus.OK)
-  @ApiOperation({ 
-    summary: 'Request password reset link',
-    description: 'Send password reset link to user email. Link contains a secure token valid for 1 hour.'
-  })
-  @ApiResponse({ status: 200, description: 'Password reset email sent successfully' })
-  @ApiResponse({ status: 404, description: 'Email not found' })
-  @ApiResponse({ status: 429, description: 'Too many reset requests. Please wait before trying again.' })
-  @ApiBody({ type: RequestPasswordResetDto })
-  requestPasswordReset(@Body() dto: RequestPasswordResetDto) { return this.service.requestPasswordReset(dto); }
-
-  @Post('password/reset')
-  @HttpCode(HttpStatus.OK)
-  @ApiOperation({ 
-    summary: 'Reset password with token',
-    description: 'Reset user password using the token received via email. Token is single-use and expires after 1 hour.'
-  })
-  @ApiResponse({ status: 200, description: 'Password reset successfully' })
-  @ApiResponse({ status: 400, description: 'Invalid, expired, or already used token' })
-  @ApiResponse({ status: 404, description: 'User not found' })
-  @ApiBody({ type: ResetPasswordDto })
-  resetPassword(@Body() dto: ResetPasswordDto) { return this.service.resetPassword(dto); }
+  login(@Request() req: any, @Body() dto: LoginDto) {
+    return this.passengerAuthService.login(dto, req);
+  }

  @Post('logout')
  @HttpCode(HttpStatus.OK)
  @UseGuards(JwtGuard)
  @ApiBearerAuth('JWT-auth')
-  @ApiOperation({ 
-    summary: 'Logout current user',
-    description: `Logout the authenticated user and invalidate their session.
+  @ApiOperation({ summary: 'Logout current user' })
+  @ApiResponse({ status: 200, description: 'Logout successful' })
+  @ApiResponse({ status: 401, description: 'Unauthorized' })
+  logout(@Request() req: any) {
+    if (!req.user?.id) throw new UnauthorizedException('User not authenticated');
+    return this.passengerAuthService.logout(req.user, req);
+  }

-### What happens:
- Invalidates the current session token
- Records logout in audit log
- Frontend should clear stored token and redirect to home
-
-### Authentication:
- **Required**: JWT Bearer Token
- Token will be invalidated after successful logout`
-  })
-  @ApiResponse({ 
-    status: 200, 
-    description: 'Logout successful',
-    schema: {
-      example: {
-        success: true,
-        message: 'Logged out successfully'
-      }
-    }
-  })
-  @ApiResponse({ status: 401, description: 'Unauthorized - Invalid or missing token' })
-  logout(@Request() req: any) { 
-    if (!req.user || !req.user.userId) {
-      throw new UnauthorizedException('User not authenticated');
-    }
-    return this.service.logout(req.user.userId); 
+  @Get('me')
+  @UseGuards(JwtGuard)
+  @ApiBearerAuth('JWT-auth')
+  @ApiOperation({ summary: '[DEV] Inspect raw JWT payload — shows full req.user from JwtGuard' })
+  @ApiResponse({ status: 200, description: 'Returns the full req.user object set by JwtGuard' })
+  @ApiResponse({ status: 401, description: 'Unauthorized' })
+  getMe(@Request() req: any) {
+    return { user: req.user };
  }

  @Get('profile')
  @UseGuards(JwtGuard)
  @ApiBearerAuth('JWT-auth')
-  @ApiOperation({ 
-    summary: 'Get current user profile',
-    description: `**Returns complete user profile with all connected data**
-
---
-
-### Response Includes
-
-#### User Information
- Basic details (id, email, phone, fullName, role)
- Nationality and document information
- Fayda verification status
- Account timestamps (created, last login)
-
-#### Passenger Data (if role=PASSENGER)
- Passenger ID and preferences
- **Loyalty Account**: Tier, points balance, lifetime points
- **Wallet Account**: Balance (minor units), currency
-
-#### Devices
- List of registered devices with platform, name, push token, and last seen time
-
-#### User Preferences
- Language, notification settings, etc.
-
---
-
-### Use Cases
-
-1. **App Initialization**: Fetch on app load to get user context
-
-2. **Profile Pre-fill**: Use data to auto-fill booking forms
-
-3. **Verification Check**: Check \`faydaVerified\` before registration
-
-4. **Loyalty Display**: Show tier and points in UI
-
-5. **Wallet Balance**: Display available balance
-
-6. **Device Management**: Get list of user's registered devices
-
---
-
-### Authentication
- **Required**: JWT Bearer Token
- Token must be valid and not expired
- Returns profile for authenticated user only`,
-  })
-  @ApiResponse({ 
-    status: 200, 
-    description: 'User profile retrieved successfully',
-    schema: {
-      example: {
-        id: 'user-uuid-123',
-        email: 'kelemu@email.com',
-        phone: '+251911234567',
-        fullName: 'Kelemu Abebe',
-        role: 'PASSENGER',
-        nationality: 'Ethiopian',
-        nationalityCode: 'ET',
-        nationalId: null,
-        passportNumber: null,
-        faydaVerified: true,
-        faydaVerifiedAt: '2024-01-15T10:30:00.000Z',
-        lastLoginAt: '2024-01-20T14:22:00.000Z',
-        createdAt: '2023-12-01T08:00:00.000Z',
-        passenger: {
-          id: 'passenger-uuid-456',
-          preferredLanguage: 'am',
-          loyalty: {
-            tier: 'SILVER',
-            pointsBalance: 1500,
-            lifetimePoints: 3000
-          },
-          wallet: {
-            balanceMinor: 50000,
-            currency: 'ETB'
-          }
-        },
-        preferences: {
-          emailNotifications: true,
-          smsNotifications: true,
-          language: 'am'
-        },
-        devices: [
-          {
-            id: 'device-uuid-1',
-            platform: 'WEB',
-            name: 'Chrome on Windows',
-            pushToken: 'token-abc123',
-            trusted: true,
-            lastSeenAt: '2024-01-20T14:22:00.000Z'
-          },
-          {
-            id: 'device-uuid-2',
-            platform: 'IOS',
-            name: 'iPhone 14',
-            pushToken: 'token-xyz789',
-            trusted: false,
-            lastSeenAt: '2024-01-19T10:15:00.000Z'
-          }
-        ]
-      }
-    }
-  })
-  @ApiResponse({ 
-    status: 401, 
-    description: 'Unauthorized - Invalid or missing JWT token',
-    schema: {
-      example: {
-        statusCode: 401,
-        message: 'Unauthorized'
-      }
-    }
-  })
-  getProfile(@Request() req: any) { 
-    console.log('Profile request - User from JWT:', req.user);
-    if (!req.user || !req.user.userId) {
-      throw new UnauthorizedException('User not authenticated');
-    }
-    return this.service.getProfile(req.user.userId); 
+  @ApiOperation({ summary: 'Get current user profile' })
+  @ApiResponse({ status: 200, description: 'User profile retrieved successfully' })
+  @ApiResponse({ status: 401, description: 'Unauthorized' })
+  getProfile(@Request() req: any) {
+    const userId = req.user?.id;
+    if (!userId) throw new UnauthorizedException('User not authenticated');
+    return this.passengerAuthService.getProfile(userId);
  }

-  @Get('users')
-  @UseGuards(JwtGuard, RolesGuard)
-  @Roles(UserRole.ADMIN, UserRole.SUPERVISOR)
-  @ApiBearerAuth('JWT-auth')
-  @ApiOperation({ summary: 'Get all backoffice users (admin/supervisor only)' })
-  getUsers(
-    @Query('search') search?: string,
-    @Query('role') role?: string,
-    @Query('status') status?: string,
-    @Query('page') page?: string,
-    @Query('pageSize') pageSize?: string,
-  ) {
-    return this.service.getUsers({
-      search,
-      role,
-      status,
-      page: page ? parseInt(page) : 1,
-      pageSize: pageSize ? parseInt(pageSize) : 10,
-    });
-  }
-
-  @Post('users')
-  @UseGuards(JwtGuard, RolesGuard)
-  @Roles(UserRole.ADMIN, UserRole.SUPERVISOR)
-  @ApiBearerAuth('JWT-auth')
-  @ApiOperation({ summary: 'Create new backoffice user (admin/supervisor only)' })
-  createUser(@Body() dto: any) {
-    return this.service.createUser(dto);
-  }
-
-  @Patch('users/:id')
-  @UseGuards(JwtGuard, RolesGuard)
-  @Roles(UserRole.ADMIN, UserRole.SUPERVISOR)
-  @ApiBearerAuth('JWT-auth')
-  @ApiOperation({ summary: 'Update backoffice user (admin/supervisor only)' })
-  updateUser(@Param('id') id: string, @Body() dto: any) {
-    return this.service.updateUser(id, dto);
-  }
-
-  @Delete('users/:id')
-  @UseGuards(JwtGuard, RolesGuard)
-  @Roles(UserRole.ADMIN)
-  @ApiBearerAuth('JWT-auth')
-  @ApiOperation({ summary: 'Delete backoffice user (admin only)' })
-  deleteUser(@Param('id') id: string) {
-    return this.service.deleteUser(id);
-  }
-
-  @Post('users/:id/reset-password')
-  @UseGuards(JwtGuard, RolesGuard)
-  @Roles(UserRole.ADMIN, UserRole.SUPERVISOR)
-  @ApiBearerAuth('JWT-auth')
-  @ApiOperation({ summary: 'Reset user password with temporary password (admin/supervisor only)' })
-  resetUserPassword(@Param('id') id: string, @Body() dto: { tempPassword: string }) {
-    return this.service.resetUserPassword(id, dto.tempPassword);
-  }
+  // TODO: admin user management endpoints — implement when admin module is ready
 }
--- a/apps/edr-passenger-api/src/modules/auth/auth.dto.ts
+++ b/apps/edr-passenger-api/src/modules/auth/auth.dto.ts
@@ -1,152 +1,51 @@
-import { IsEmail, IsString, MinLength, IsOptional } from 'class-validator';
-import { ApiProperty, ApiPropertyOptional } from '@nestjs/swagger';
+import { IsEmail, IsString, MinLength, ValidateNested } from 'class-validator';
+import { Type } from 'class-transformer';
+import { ApiProperty } from '@nestjs/swagger';
+
+export class NameDto {
+  @ApiProperty({ example: 'ቀለሙ ቀጸላ' })
+  @IsString()
+  am: string;
+
+  @ApiProperty({ example: 'Kelemu Ketsela' })
+  @IsString()
+  en: string;
+}

 export class RegisterDto {
-  @ApiProperty({ 
-    description: 'Full name of the passenger', 
-    example: 'Kelemu Ketsela',
-    minLength: 2,
-    maxLength: 100
-  }) 
-  @IsString() 
-  fullName: string;
-
-  @ApiProperty({ 
-    description: 'Email address (must be unique)', 
-    example: 'kelemu@email.com',
-    format: 'email'
-  }) 
-  @IsEmail() 
+  @ApiProperty({ example: 'kelemu@email.com' })
+  @IsEmail()
  email: string;

-  @ApiProperty({ 
-    description: 'Phone number with country code', 
-    example: '+251912345678',
-    pattern: '^\\+[1-9]\\d{1,14}$'
-  }) 
-  @IsString() 
-  phone: string;
+  @ApiProperty({ example: 'kelemu.ketsela' })
+  @IsString()
+  username: string;

-  @ApiProperty({ 
-    description: 'Password (minimum 8 characters)', 
-    example: 'SecurePass123',
-    minLength: 8,
-    format: 'password'
-  }) 
-  @IsString() 
-  @MinLength(8) 
+  @ApiProperty({ example: '+251912345678' })
+  @IsString()
+  phoneNumber: string;
+
+  @ApiProperty({ type: NameDto })
+  @ValidateNested()
+  @Type(() => NameDto)
+  name: NameDto;
+
+  @ApiProperty({ example: 'SecurePass123', minLength: 8, format: 'password' })
+  @IsString()
+  @MinLength(8)
  password: string;

-  @ApiPropertyOptional({ 
-    description: 'Nationality of the passenger', 
-    example: 'Ethiopian' 
-  }) 
-  @IsOptional() 
-  @IsString() 
-  nationality?: string;
-
-  @ApiPropertyOptional({ 
-    description: 'National ID number', 
-    example: 'ET123456789' 
-  }) 
-  @IsOptional() 
-  @IsString() 
-  nationalId?: string;
-
-  @ApiPropertyOptional({ 
-    description: 'Passport number for international travelers', 
-    example: 'P1234567' 
-  }) 
-  @IsOptional() 
-  @IsString() 
-  passportNumber?: string;
+  @ApiProperty({ example: 'SecurePass123', format: 'password' })
+  @IsString()
+  confirmPassword: string;
 }

 export class LoginDto {
-  @ApiProperty({ 
-    description: 'Registered email address', 
-    example: 'kelemu@email.com',
-    format: 'email'
-  }) 
-  @IsEmail() 
+  @ApiProperty({ example: 'kelemu@email.com' })
+  @IsEmail()
  email: string;

-  @ApiProperty({ 
-    description: 'Account password', 
-    example: 'password123',
-    format: 'password'
-  }) 
-  @IsString() 
+  @ApiProperty({ example: 'password123', format: 'password' })
+  @IsString()
  password: string;
 }
-
-export class RequestOtpDto {
-  @ApiProperty({ 
-    description: 'Email address to send OTP', 
-    example: 'kelemu@email.com' 
-  }) 
-  @IsEmail() 
-  email: string;
-
-  @ApiProperty({ 
-    description: 'Purpose of OTP (REGISTRATION, PASSWORD_RESET, VERIFICATION)', 
-    example: 'REGISTRATION',
-    enum: ['REGISTRATION', 'PASSWORD_RESET', 'VERIFICATION']
-  }) 
-  @IsString() 
-  purpose: string;
-}
-
-export class VerifyOtpDto {
-  @ApiProperty({ 
-    description: 'Email address', 
-    example: 'kelemu@email.com' 
-  }) 
-  @IsEmail() 
-  email: string;
-
-  @ApiProperty({ 
-    description: '6-digit OTP code', 
-    example: '123456',
-    minLength: 6,
-    maxLength: 6
-  }) 
-  @IsString() 
-  code: string;
-
-  @ApiProperty({ 
-    description: 'Purpose of OTP verification', 
-    example: 'REGISTRATION',
-    enum: ['REGISTRATION', 'PASSWORD_RESET', 'VERIFICATION']
-  }) 
-  @IsString() 
-  purpose: string;
-}
-
-export class RequestPasswordResetDto {
-  @ApiProperty({ 
-    description: 'Email address of the account', 
-    example: 'kelemu@email.com' 
-  }) 
-  @IsEmail() 
-  email: string;
-}
-
-export class ResetPasswordDto {
-  @ApiProperty({ 
-    description: 'Password reset token received via email', 
-    example: 'eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...' 
-  }) 
-  @IsString() 
-  token: string;
-
-  @ApiProperty({ 
-    description: 'New password (minimum 8 characters)', 
-    example: 'NewSecurePass123',
-    minLength: 8,
-    format: 'password'
-  }) 
-  @IsString() 
-  @MinLength(8) 
-  newPassword: string;
-}
--- a/apps/edr-passenger-api/src/modules/auth/auth.module.ts
+++ b/apps/edr-passenger-api/src/modules/auth/auth.module.ts
@@ -1,24 +1,10 @@
 import { Module } from '@nestjs/common';
-import { JwtModule } from '@nestjs/jwt';
-import { PassportModule } from '@nestjs/passport';
-import { ConfigService } from '@nestjs/config';
 import { AuthController } from './auth.controller';
-import { AuthService } from './auth.service';
-import { JwtStrategy } from '../../common/jwt.strategy';
+import { PassengerAuthService } from './passenger-auth.service';

@Module({
-  imports: [
-    PassportModule,
-    JwtModule.registerAsync({
-      inject: [ConfigService],
-      useFactory: (c: ConfigService) => ({
-        secret: c.get('JWT_SECRET'),
-        signOptions: { expiresIn: c.get('JWT_EXPIRES_IN', '7d') },
-      }),
-    }),
-  ],
  controllers: [AuthController],
-  providers: [AuthService, JwtStrategy],
-  exports: [JwtModule],
+  providers: [PassengerAuthService],
+  exports: [PassengerAuthService],
 })
 export class AuthModule {}
--- a/apps/edr-passenger-api/src/modules/auth/auth.service.ts
+++ b/apps/edr-passenger-api/src/modules/auth/auth.service.ts
@@ -1,410 +0,0 @@
-import { Injectable, UnauthorizedException, ConflictException, BadRequestException, NotFoundException } from '@nestjs/common';
-import { JwtService } from '@nestjs/jwt';
-import { PrismaService } from '../../common/prisma.service';
-import { RegisterDto, LoginDto, RequestOtpDto, VerifyOtpDto, RequestPasswordResetDto, ResetPasswordDto } from './auth.dto';
-import * as bcrypt from 'bcrypt';
-import * as crypto from 'crypto';
-
-@Injectable()
-export class AuthService {
-  constructor(private prisma: PrismaService, private jwt: JwtService) {}
-
-  async register(dto: RegisterDto) {
-    const exists = await this.prisma.user.findFirst({
-      where: { OR: [{ email: dto.email }, { phone: dto.phone }] },
-    });
-    if (exists) throw new ConflictException('Email or phone already registered');
-    const passwordHash = await bcrypt.hash(dto.password, 10);
-    const user = await this.prisma.user.create({
-      data: { 
-        fullName: dto.fullName, 
-        email: dto.email, 
-        phone: dto.phone, 
-        passwordHash,
-        nationality: dto.nationality,
-        nationalId: dto.nationalId,
-        passportNumber: dto.passportNumber
-      },
-    });
-    const passenger = await this.prisma.passenger.create({ data: { userId: user.id } });
-    await this.prisma.loyaltyAccount.create({ data: { passengerId: passenger.id } });
-    await this.prisma.walletAccount.create({ data: { passengerId: passenger.id } });
-    await this.prisma.userPreferences.create({ data: { userId: user.id } });
-    await this.createAuditLog(user.id, 'USER_REGISTERED', 'User', user.id, null, { email: user.email });
-    return await this.signToken(user.id, user.email, user.role, passenger.id);
-  }
-
-  async login(dto: LoginDto) {
-    const user = await this.prisma.user.findUnique({
-      where: { email: dto.email },
-      include: { passenger: true, agent: true },
-    });
-    if (!user) throw new UnauthorizedException('Invalid credentials');
-    
-    if (user.lockedUntil && user.lockedUntil > new Date()) {
-      throw new UnauthorizedException(`Account locked until ${user.lockedUntil.toISOString()}`);
-    }
-    
-    if (!(await bcrypt.compare(dto.password, user.passwordHash))) {
-      await this.prisma.user.update({
-        where: { id: user.id },
-        data: { 
-          failedLoginAttempts: { increment: 1 },
-          lockedUntil: user.failedLoginAttempts >= 4 ? new Date(Date.now() + 15 * 60 * 1000) : null
-        }
-      });
-      throw new UnauthorizedException('Invalid credentials');
-    }
-    
-    await this.prisma.user.update({
-      where: { id: user.id },
-      data: { failedLoginAttempts: 0, lockedUntil: null, lastLoginAt: new Date() }
-    });
-    
-    await this.createAuditLog(user.id, 'USER_LOGIN', 'User', user.id, null, null);
-    
-    // Ensure passenger exists and get its ID
-    let passengerId = user.passenger?.id;
-    if (!passengerId) {
-      // If passenger doesn't exist, create it
-      const passenger = await this.prisma.passenger.create({
-        data: { userId: user.id }
-      });
-      passengerId = passenger.id;
-      // Also create loyalty and wallet accounts
-      await this.prisma.loyaltyAccount.create({ data: { passengerId: passenger.id } });
-      await this.prisma.walletAccount.create({ data: { passengerId: passenger.id } });
-    }
-    
-    return await this.signToken(user.id, user.email, user.role, passengerId, user.agent?.id);
-  }
-
-  async requestOtp(dto: RequestOtpDto) {
-    const code = Math.floor(100000 + Math.random() * 900000).toString();
-    const expiresAt = new Date(Date.now() + 10 * 60 * 1000);
-    await this.prisma.otpCode.create({
-      data: { email: dto.email, code, purpose: dto.purpose, expiresAt }
-    });
-    console.log(`[OTP] ${dto.email} - ${code} (${dto.purpose})`);
-    return { sent: true, expiresIn: 600 };
-  }
-
-  async verifyOtp(dto: VerifyOtpDto) {
-    const otp = await this.prisma.otpCode.findFirst({
-      where: { email: dto.email, code: dto.code, purpose: dto.purpose, verified: false, expiresAt: { gt: new Date() } },
-      orderBy: { createdAt: 'desc' }
-    });
-    if (!otp) throw new BadRequestException('Invalid or expired OTP');
-    await this.prisma.otpCode.update({ where: { id: otp.id }, data: { verified: true } });
-    return { verified: true };
-  }
-
-  async requestPasswordReset(dto: RequestPasswordResetDto) {
-    const user = await this.prisma.user.findUnique({ where: { email: dto.email } });
-    if (!user) return { sent: true };
-    const token = crypto.randomBytes(32).toString('hex');
-    const expiresAt = new Date(Date.now() + 60 * 60 * 1000);
-    await this.prisma.passwordResetToken.create({
-      data: { userId: user.id, token, expiresAt }
-    });
-    console.log(`[PASSWORD_RESET] ${dto.email} - ${token}`);
-    return { sent: true };
-  }
-
-  async resetPassword(dto: ResetPasswordDto) {
-    const resetToken = await this.prisma.passwordResetToken.findUnique({
-      where: { token: dto.token }
-    });
-    if (!resetToken || resetToken.used || resetToken.expiresAt < new Date()) {
-      throw new BadRequestException('Invalid or expired reset token');
-    }
-    const passwordHash = await bcrypt.hash(dto.newPassword, 10);
-    await this.prisma.user.update({
-      where: { id: resetToken.userId },
-      data: { passwordHash, failedLoginAttempts: 0, lockedUntil: null }
-    });
-    await this.prisma.passwordResetToken.update({
-      where: { id: resetToken.id },
-      data: { used: true }
-    });
-    await this.createAuditLog(resetToken.userId, 'PASSWORD_RESET', 'User', resetToken.userId, null, null);
-    return { reset: true };
-  }
-
-  async getUsers(filters: { search?: string; role?: string; status?: string; page?: number; pageSize?: number }) {
-    const { search, role, status, page = 1, pageSize = 10 } = filters;
-    const skip = (page - 1) * pageSize;
-
-    const where: any = {
-      role: { not: 'PASSENGER' }, // Exclude passenger accounts
-    };
-
-    if (search) {
-      where.OR = [
-        { email: { contains: search, mode: 'insensitive' } },
-        { fullName: { contains: search, mode: 'insensitive' } },
-      ];
-    }
-
-    if (role) {
-      where.role = role;
-    }
-
-    // For status filtering, we check if user is active (no lock/block) or inactive
-    if (status === 'ACTIVE') {
-      where.AND = [
-        { blockedUntil: { lte: new Date() } },
-        { lockedUntil: { lte: new Date() } }
-      ];
-    } else if (status === 'INACTIVE') {
-      where.OR = [
-        { blockedUntil: { gt: new Date() } },
-        { lockedUntil: { gt: new Date() } }
-      ];
-    }
-
-    const [items, total] = await Promise.all([
-      this.prisma.user.findMany({
-        where,
-        select: {
-          id: true,
-          email: true,
-          fullName: true,
-          role: true,
-          lastLoginAt: true,
-          createdAt: true,
-          blockedUntil: true,
-          lockedUntil: true,
-        },
-        skip,
-        take: pageSize,
-        orderBy: { createdAt: 'desc' },
-      }),
-      this.prisma.user.count({ where }),
-    ]);
-
-    return {
-      items: items.map(user => ({
-        id: user.id,
-        email: user.email,
-        fullName: user.fullName,
-        role: user.role,
-        lastLogin: user.lastLoginAt,
-        status: (!user.blockedUntil || user.blockedUntil <= new Date()) &&
-                (!user.lockedUntil || user.lockedUntil <= new Date()) 
-          ? 'ACTIVE' 
-          : 'INACTIVE',
-      })),
-      total,
-      page,
-      pageSize,
-    };
-  }
-
-  async createUser(dto: { email: string; fullName: string; role: string; status?: string; password?: string }) {
-    const exists = await this.prisma.user.findFirst({
-      where: { OR: [{ email: dto.email }] },
-    });
-    if (exists) throw new ConflictException('Email already registered');
-
-    const passwordHash = await bcrypt.hash(dto.password || 'TempPassword123!', 10);
-    
-    const user = await this.prisma.user.create({
-      data: {
-        email: dto.email,
-        fullName: dto.fullName,
-        role: dto.role as any,
-        phone: dto.email, // Use email as phone temporarily for unique constraint
-        passwordHash,
-        blockedUntil: dto.status === 'INACTIVE' ? new Date(Date.now() + 365 * 24 * 60 * 60 * 1000) : undefined,
-      },
-      select: {
-        id: true,
-        email: true,
-        fullName: true,
-        role: true,
-        lastLoginAt: true,
-        createdAt: true,
-      },
-    });
-
-    await this.createAuditLog(user.id, 'USER_CREATED', 'User', user.id, null, { email: user.email, role: dto.role });
-
-    return user;
-  }
-
-  async updateUser(id: string, dto: Partial<{ email: string; fullName: string; role: string; status: string }>) {
-    const user = await this.prisma.user.findUnique({ where: { id } });
-    if (!user) throw new NotFoundException('User not found');
-
-    const updateData: any = {};
-    if (dto.fullName) updateData.fullName = dto.fullName;
-    if (dto.role) updateData.role = dto.role;
-    if (dto.status === 'ACTIVE') {
-      updateData.blockedUntil = null;
-      updateData.lockedUntil = null;
-    } else if (dto.status === 'INACTIVE') {
-      updateData.blockedUntil = new Date(Date.now() + 365 * 24 * 60 * 60 * 1000);
-    }
-
-    const updated = await this.prisma.user.update({
-      where: { id },
-      data: updateData,
-      select: {
-        id: true,
-        email: true,
-        fullName: true,
-        role: true,
-        lastLoginAt: true,
-        createdAt: true,
-      },
-    });
-
-    await this.createAuditLog(id, 'USER_UPDATED', 'User', id, { oldData: user }, { newData: updateData });
-
-    return updated;
-  }
-
-  async deleteUser(id: string) {
-    const user = await this.prisma.user.findUnique({ where: { id } });
-    if (!user) throw new NotFoundException('User not found');
-
-    // Don't actually delete, just deactivate
-    await this.prisma.user.update({
-      where: { id },
-      data: { blockedUntil: new Date(), lockedUntil: new Date() },
-    });
-
-    await this.createAuditLog(id, 'USER_DELETED', 'User', id, { email: user.email }, null);
-
-    return { deleted: true };
-  }
-
-  async resetUserPassword(id: string, tempPassword: string) {
-    const user = await this.prisma.user.findUnique({ where: { id } });
-    if (!user) throw new NotFoundException('User not found');
-
-    const passwordHash = await bcrypt.hash(tempPassword, 10);
-    await this.prisma.user.update({
-      where: { id },
-      data: {
-        passwordHash,
-        failedLoginAttempts: 0,
-        lockedUntil: null,
-      },
-    });
-
-    await this.createAuditLog(id, 'PASSWORD_RESET_ADMIN', 'User', id, null, { resetBy: 'admin' });
-
-    return { reset: true, tempPassword };
-  }
-
-  private async signToken(userId: string, email: string, role: string, passengerId?: string, agentId?: string) {
-    // Get the full user data to include fullName
-    const user = await this.prisma.user.findUnique({
-      where: { id: userId },
-      select: { id: true, email: true, fullName: true, role: true }
-    });
-    
-    const payload = { sub: userId, email, role, passengerId, agentId };
-    console.log('[AUTH] Creating JWT with payload:', payload);
-    
-    const token = this.jwt.sign(payload);
-    console.log('[AUTH] JWT created, token length:', token.length);
-    
-    const response = { 
-      token, 
-      user: { 
-        id: userId, 
-        email, 
-        fullName: user?.fullName || email, 
-        role, 
-        passengerId, 
-        agentId 
-      } 
-    };
-    console.log('[AUTH] Returning user object with passengerId:', response.user.passengerId);
-    return response;
-  }
-
-  private async createAuditLog(userId: string, action: string, entityType: string, entityId: string, oldData: any, newData: any) {
-    await this.prisma.auditLog.create({
-      data: { userId, action, entityType, entityId, oldData, newData }
-    });
-  }
-
-  async getProfile(userId: string) {
-    if (!userId) {
-      throw new UnauthorizedException('User ID not found in token');
-    }
-
-    const user = await this.prisma.user.findUnique({
-      where: { id: userId },
-      include: {
-        passenger: {
-          include: {
-            loyalty: true,
-            wallet: true,
-          },
-        },
-        preferences: true,
-        devices: true,
-      },
-    });
-
-    if (!user) throw new UnauthorizedException('User not found');
-
-    return {
-      id: user.id,
-      email: user.email,
-      phone: user.phone,
-      fullName: user.fullName,
-      role: user.role,
-      nationality: user.nationality,
-      nationalityCode: user.nationalityCode,
-      nationalId: user.nationalId,
-      passportNumber: user.passportNumber,
-      faydaVerified: user.faydaVerified,
-      faydaVerifiedAt: user.faydaVerifiedAt,
-      lastLoginAt: user.lastLoginAt,
-      createdAt: user.createdAt,
-      passenger: user.passenger ? {
-        id: user.passenger.id,
-        preferredLanguage: user.passenger.preferredLanguage,
-        loyalty: user.passenger.loyalty ? {
-          tier: user.passenger.loyalty.tier,
-          pointsBalance: user.passenger.loyalty.pointsBalance,
-          lifetimePoints: user.passenger.loyalty.lifetimePoints,
-        } : null,
-        wallet: user.passenger.wallet ? {
-          balanceMinor: user.passenger.wallet.balanceMinor,
-          currency: user.passenger.wallet.currency,
-        } : null,
-      } : null,
-      preferences: user.preferences,
-      devices: user.devices.map(device => ({
-        id: device.id,
-        platform: device.platform,
-        name: device.name,
-        pushToken: device.pushToken,
-        trusted: device.trusted,
-        lastSeenAt: device.lastSeenAt,
-      })),
-    };
-  }
-
-  async logout(userId: string) {
-    // Invalidate all active sessions for this user
-    await this.prisma.session.deleteMany({
-      where: { userId }
-    });
-
-    // Log the logout action
-    await this.createAuditLog(userId, 'USER_LOGOUT', 'User', userId, null, null);
-
-    return {
-      success: true,
-      message: 'Logged out successfully'
-    };
-  }
-}
--- a/apps/edr-passenger-api/src/modules/auth/passenger-auth.service.ts
+++ b/apps/edr-passenger-api/src/modules/auth/passenger-auth.service.ts
@@ -0,0 +1,231 @@
+import {
+  Injectable,
+  ConflictException,
+  InternalServerErrorException,
+  UnauthorizedException,
+} from '@nestjs/common';
+import { ModuleRef, ContextIdFactory } from '@nestjs/core';
+import { InjectDataSource } from '@nestjs/typeorm';
+import { DataSource } from 'typeorm';
+import { EventEmitter2 } from '@nestjs/event-emitter';
+import { AuthService as IamAuthService } from '@tria-plc/iamapi-common/module/auth/services/auth.service';
+import { EUserType } from '@tria-plc/api-common/utils/enums/user.enum';
+import { PrismaService } from '../../common/prisma.service';
+import { RegisterDto, LoginDto } from './auth.dto';
+
+type IamUserRow = {
+  id: string;
+  email: string;
+  name: { en: string; am: string } | null;
+  phone_number: string | null;
+  metadata: Record<string, any> | null;
+};
+
+@Injectable()
+export class PassengerAuthService {
+  constructor(
+    private readonly prisma: PrismaService,
+    @InjectDataSource() private readonly dataSource: DataSource,
+    private readonly moduleRef: ModuleRef,
+    private readonly eventEmitter: EventEmitter2,
+  ) {}
+
+  private async resolveIamAuthService(req: any): Promise<IamAuthService> {
+    const contextId = ContextIdFactory.getByRequest(req);
+    this.moduleRef.registerRequestByContextId(req, contextId);
+    return this.moduleRef.resolve(IamAuthService, contextId, { strict: false });
+  }
+
+  async register(dto: RegisterDto, req: any) {
+    const existing = await this.dataSource.query<{ id: string }[]>(
+      `SELECT id FROM iam.users WHERE email = $1 OR phone_number = $2 LIMIT 1`,
+      [dto.email, dto.phoneNumber],
+    );
+    if (existing.length) throw new ConflictException('Email or phone already registered');
+
+    const iamAuthService = await this.resolveIamAuthService(req);
+
+    const { token, refreshToken } = await iamAuthService.signupWithPassword({
+      email: dto.email,
+      username: dto.username,
+      phoneNumber: dto.phoneNumber,
+      userType: EUserType.INDIVIDUAL,
+      name: dto.name,
+      password: dto.password,
+      confirmPassword: dto.confirmPassword,
+    });
+
+    const iamRows = await this.dataSource.query<IamUserRow[]>(
+      `SELECT id, email, name, phone_number, metadata FROM iam.users WHERE email = $1 LIMIT 1`,
+      [dto.email],
+    );
+    if (!iamRows.length) {
+      await this.compensateIamSignup(dto.email);
+      throw new InternalServerErrorException('Account creation failed. Please try again.');
+    }
+    const iamUserId = iamRows[0].id;
+
+    let passengerId: string;
+    try {
+      const result = await this.provisionPassengerSatellite({ iamUserId, auditAction: 'USER_REGISTERED' });
+      passengerId = result.passengerId;
+    } catch {
+      await this.compensateIamSignup(dto.email);
+      throw new InternalServerErrorException('Account creation failed. Please try again.');
+    }
+
+    return {
+      token,
+      refreshToken,
+      user: { id: iamUserId, iamUserId, email: dto.email, fullName: dto.name.en, passengerId },
+    };
+  }
+
+  async login(dto: LoginDto, req: any) {
+    const iamAuthService = await this.resolveIamAuthService(req);
+
+    let iamResult: { token: string; refreshToken: string } | { mfaRequired: boolean };
+    try {
+      iamResult = await iamAuthService.login({ email: dto.email, password: dto.password });
+    } catch {
+      this.eventEmitter.emit('auth.login.failed', { email: dto.email });
+      throw new UnauthorizedException('Invalid credentials');
+    }
+
+    if ('mfaRequired' in iamResult && iamResult.mfaRequired) {
+      return iamResult;
+    }
+
+    const { token, refreshToken } = iamResult as { token: string; refreshToken: string };
+
+    const iamRows = await this.dataSource.query<IamUserRow[]>(
+      `SELECT id, email, name, phone_number, metadata FROM iam.users WHERE email = $1 LIMIT 1`,
+      [dto.email],
+    );
+    const iamUser = iamRows[0];
+    if (!iamUser) {
+      throw new InternalServerErrorException('IAM user not found after successful authentication');
+    }
+
+    // Find existing Passenger record or lazy-provision one on first login
+    let passenger = await this.prisma.passenger.findUnique({
+      where: { iamUserId: iamUser.id },
+      select: { id: true },
+    });
+
+    if (!passenger) {
+      const result = await this.provisionPassengerSatellite({
+        iamUserId: iamUser.id,
+        auditAction: 'USER_AUTO_PROVISIONED',
+      });
+      passenger = { id: result.passengerId };
+    }
+
+    return {
+      token,
+      refreshToken,
+      user: { id: iamUser.id, iamUserId: iamUser.id, email: dto.email, passengerId: passenger.id },
+    };
+  }
+
+  private async provisionPassengerSatellite(data: {
+    iamUserId: string;
+    auditAction: string;
+  }): Promise<{ passengerId: string }> {
+    return this.prisma.$transaction(async (tx) => {
+      const passenger = await tx.passenger.create({
+        data: { iamUserId: data.iamUserId },
+      });
+      await tx.loyaltyAccount.create({ data: { passengerId: passenger.id } });
+      await tx.walletAccount.create({ data: { passengerId: passenger.id } });
+      await tx.userPreferences.create({ data: { iamUserId: data.iamUserId } });
+      await tx.auditLog.create({
+        data: {
+          iamUserId: data.iamUserId,
+          action: data.auditAction,
+          entityType: 'User',
+          entityId: data.iamUserId,
+          newData: { iamUserId: data.iamUserId },
+        },
+      });
+      return { passengerId: passenger.id };
+    });
+  }
+
+  async logout(user: any, req: any) {
+    const iamAuthService = await this.resolveIamAuthService(req);
+    await iamAuthService.logout(user);
+    return { success: true, message: 'Logged out successfully' };
+  }
+
+  async getProfile(iamUserId: string) {
+    const [passenger, iamRows] = await Promise.all([
+      this.prisma.passenger.findUnique({
+        where: { iamUserId },
+        include: { loyalty: true, wallet: true },
+      }),
+      this.dataSource.query<IamUserRow[]>(
+        `SELECT id, email, name, phone_number, metadata FROM iam.users WHERE id = $1 LIMIT 1`,
+        [iamUserId],
+      ),
+    ]);
+
+    if (!passenger) throw new Error('Passenger not found');
+    const iam = iamRows[0];
+
+    return {
+      iamUserId,
+      email: iam?.email ?? null,
+      phone: iam?.phone_number ?? null,
+      fullName: iam?.name?.en ?? iam?.name?.am ?? null,
+      faydaVerified: iam?.metadata?.faydaVerified ?? false,
+      createdAt: passenger.createdAt,
+      passenger: {
+        id: passenger.id,
+        preferredLanguage: passenger.preferredLanguage,
+        loyalty: passenger.loyalty
+          ? { tier: passenger.loyalty.tier, pointsBalance: passenger.loyalty.pointsBalance, lifetimePoints: passenger.loyalty.lifetimePoints }
+          : null,
+        wallet: passenger.wallet
+          ? { balanceMinor: passenger.wallet.balanceMinor, currency: passenger.wallet.currency }
+          : null,
+      },
+    };
+  }
+
+  private async compensateIamSignup(email: string): Promise<void> {
+    try {
+      const rows = await this.dataSource.query<{ id: string }[]>(
+        `SELECT id FROM iam.users WHERE email = $1 LIMIT 1`,
+        [email],
+      );
+      if (!rows.length) return;
+      const iamUserId = rows[0].id;
+
+      // Discover every table in the iam schema that has a FK pointing at iam.users.id
+      const fkDeps = await this.dataSource.query<{ table_name: string; column_name: string }[]>(`
+        SELECT kcu.table_name, kcu.column_name
+        FROM information_schema.table_constraints tc
+        JOIN information_schema.key_column_usage kcu
+          ON tc.constraint_name = kcu.constraint_name AND tc.table_schema = kcu.table_schema
+        JOIN information_schema.referential_constraints rc
+          ON tc.constraint_name = rc.constraint_name
+        JOIN information_schema.key_column_usage ccu
+          ON rc.unique_constraint_name = ccu.constraint_name
+        WHERE ccu.table_schema = 'iam' AND ccu.table_name = 'users' AND ccu.column_name = 'id'
+          AND tc.table_schema = 'iam' AND tc.constraint_type = 'FOREIGN KEY'
+      `);
+
+      for (const { table_name, column_name } of fkDeps) {
+        await this.dataSource.query(
+          `DELETE FROM iam.${table_name} WHERE ${column_name} = $1`,
+          [iamUserId],
+        );
+      }
+
+      await this.dataSource.query(`DELETE FROM iam.users WHERE id = $1`, [iamUserId]);
+    } catch (err) {
+      console.error('[PassengerAuthService] IAM compensating cleanup failed for', email, (err as Error).message);
+    }
+  }
+}
--- a/apps/edr-passenger-api/src/modules/bookings/bookings.controller.ts
+++ b/apps/edr-passenger-api/src/modules/bookings/bookings.controller.ts
@@ -5,7 +5,6 @@ import { GuestBookingService } from './guest-booking.service';
 import { CreateBookingDto, ModifyBookingDto, CancelBookingDto } from './bookings.dto';
 import { CreateGuestBookingDto, GetSavedPassengersDto } from './guest-booking.dto';
 import { JwtGuard } from '../../common/jwt.guard';
-import { IamGuard } from '../../common/iam-adapter';

@ApiTags('Booking')
@Controller('bookings')
@@ -247,8 +246,8 @@ export class BookingsController {
  })
  @ApiResponse({ status: 201, description: 'Booking created successfully with fareBreakdown' })
  @ApiResponse({ status: 400, description: 'Missing required seat IDs for bookingType, or Verifayda verification failed' })
-  createGuest(@Body() dto: CreateGuestBookingDto) { 
-    return this.guestService.createGuestBooking(dto); 
+  createGuest(@Req() req: any, @Body() dto: CreateGuestBookingDto) {
+    return this.guestService.createGuestBooking(dto, req);
  }

  @Get('saved-passengers')
--- a/apps/edr-passenger-api/src/modules/bookings/bookings.module.ts
+++ b/apps/edr-passenger-api/src/modules/bookings/bookings.module.ts
@@ -7,12 +7,13 @@ import { GuestBookingService } from './guest-booking.service';
 import { SeatsModule } from '../seats/seats.module';
 import { VerifaydaModule } from '../verifayda/verifayda.module';
 import { CurrencyModule } from '../currency/currency.module';
+import { AuthModule } from '../auth/auth.module';
 import { FareEngineModule } from '../fare-engine/fare-engine.module';

-@Module({ 
-  imports: [AuditModule, SeatsModule, VerifaydaModule, CurrencyModule, FareEngineModule, HttpModule], 
-  controllers: [BookingsController], 
-  providers: [BookingsService, GuestBookingService], 
-  exports: [BookingsService, GuestBookingService] 
+@Module({
+  imports: [AuditModule, SeatsModule, VerifaydaModule, CurrencyModule, FareEngineModule, HttpModule, AuthModule],
+  controllers: [BookingsController],
+  providers: [BookingsService, GuestBookingService],
+  exports: [BookingsService, GuestBookingService]
 })
 export class BookingsModule {}
--- a/apps/edr-passenger-api/src/modules/bookings/bookings.service.ts
+++ b/apps/edr-passenger-api/src/modules/bookings/bookings.service.ts
@@ -1,4 +1,6 @@
 import { Injectable, NotFoundException, BadRequestException } from '@nestjs/common';
+import { InjectDataSource } from '@nestjs/typeorm';
+import { DataSource } from 'typeorm';
 import { PrismaService } from '../../common/prisma.service';
 import { SeatsService } from '../seats/seats.service';
 import { EventEmitter2 } from '@nestjs/event-emitter';
@@ -33,12 +35,13 @@ interface BookingFilters {
@Injectable()
 export class BookingsService {
  constructor(
-    private prisma: PrismaService,
-    private seatsService: SeatsService,
-    private eventEmitter: EventEmitter2,
-    private verifaydaService: VerifaydaService,
-    private currencyService: CurrencyService,
-    private fareEngine: FareEngineService,
+    private readonly prisma: PrismaService,
+    @InjectDataSource() private readonly dataSource: DataSource,
+    private readonly seatsService: SeatsService,
+    private readonly eventEmitter: EventEmitter2,
+    private readonly verifaydaService: VerifaydaService,
+    private readonly currencyService: CurrencyService,
+    private readonly fareEngine: FareEngineService,
  ) {}

  async findByPassengerId(passengerId: string, filters: BookingFilters = {}) {
@@ -111,22 +114,22 @@ export class BookingsService {
    const { search, status, page = 1, pageSize = 20 } = filters;
    const skip = (page - 1) * pageSize;
    
-    // Find user with this device ID
-    const device = await this.prisma.device.findUnique({
-      where: { id: deviceId },
-      include: { user: { include: { passenger: true } } },
-    }).catch(() => null);
-    
+    // Find passenger linked to this device via iamUserId
+    const device = await this.prisma.device.findUnique({ where: { id: deviceId } }).catch(() => null);
+    const passenger = device?.iamUserId
+      ? await this.prisma.passenger.findUnique({ where: { iamUserId: device.iamUserId } }).catch(() => null)
+      : null;
+
    const searchConditions = search ? [
      { bookingRef: { contains: search, mode: 'insensitive' } },
      { schedule: { originStation: { name: { contains: search, mode: 'insensitive' } } } },
      { schedule: { destinationStation: { name: { contains: search, mode: 'insensitive' } } } },
    ] : [];
-    
+
    const where: any = {
      OR: [
        { userAgent: deviceId },
-        ...(device?.user?.passenger ? [{ passengerId: device.user.passenger.id }] : []),
+        ...(passenger ? [{ passengerId: passenger.id }] : []),
      ],
    };
    
@@ -193,13 +196,26 @@ export class BookingsService {
    const where: any = {};
    
    if (search) {
+      const iamRows = await this.dataSource.query<{ id: string }[]>(
+        `SELECT u.id FROM iam.users u
+         WHERE (u.name->>'en') ILIKE $1 OR (u.name->>'am') ILIKE $1
+            OR u.email ILIKE $1 OR u.phone_number ILIKE $1`,
+        [`%${search}%`],
+      );
+      const matchedPassengers = iamRows.length > 0
+        ? await this.prisma.passenger.findMany({
+            where: { iamUserId: { in: iamRows.map(r => r.id) } },
+            select: { id: true },
+          })
+        : [];
+
      where.OR = [
        { bookingRef: { contains: search, mode: 'insensitive' } },
        { contactEmail: { contains: search, mode: 'insensitive' } },
        { contactPhone: { contains: search, mode: 'insensitive' } },
-        { passenger: { user: { fullName: { contains: search, mode: 'insensitive' } } } },
-        { passenger: { user: { email: { contains: search, mode: 'insensitive' } } } },
-        { passenger: { user: { phone: { contains: search, mode: 'insensitive' } } } },
+        ...(matchedPassengers.length > 0
+          ? [{ passengerId: { in: matchedPassengers.map(p => p.id) } }]
+          : []),
        { seats: { some: { passengerName: { contains: search, mode: 'insensitive' } } } },
      ];
    }
@@ -214,7 +230,7 @@ export class BookingsService {
        take: pageSize,
        orderBy: { createdAt: 'desc' },
        include: {
-          passenger: { include: { user: true } },
+          passenger: { select: { id: true, iamUserId: true } },
          schedule: { include: { originStation: true, destinationStation: true, train: true } },
          paymentIntent: true,
          seats: { include: { seat: true } },
@@ -222,34 +238,48 @@ export class BookingsService {
      }),
      this.prisma.booking.count({ where }),
    ]);
-    
+
+    const iamUserIds = items.map(b => b.passenger?.iamUserId).filter(Boolean) as string[];
+    const iamRows = iamUserIds.length > 0
+      ? await this.dataSource.query<{ id: string; email: string; name: any; phone_number: string | null }[]>(
+          `SELECT id, email, name, phone_number FROM iam.users WHERE id = ANY($1)`,
+          [iamUserIds],
+        )
+      : [];
+    const iamMap = new Map(iamRows.map(r => [r.id, r]));
+
    return {
-      items: items.map(booking => ({
-        id: booking.id,
-        bookingRef: booking.bookingRef,
-        status: booking.status,
-        totalMinor: booking.totalMinor,
-        currency: 'ETB',
-        displayCurrency: booking.displayCurrency,
-        displayTotalMinor: booking.displayTotalMinor,
-        contactEmail: booking.contactEmail,
-        contactPhone: booking.contactPhone,
-        bookingType: booking.bookingType,
-        returnLegStatus: (booking as any).returnLegStatus ?? null,
-        adultCount: booking.adultCount,
-        childCount: booking.childCount,
-        createdAt: booking.createdAt,
-        passenger: booking.passenger?.user,
-        passengerNames: [...new Set(booking.seats.map((s: any) => s.passengerName))],
-        schedule: {
-          train: booking.schedule.train,
-          originStation: booking.schedule.originStation,
-          destinationStation: booking.schedule.destinationStation,
-          departureAt: booking.schedule.departureAt,
-        },
-        paymentIntent: booking.paymentIntent,
-        seatCount: booking.seats.length,
-      })),
+      items: items.map(booking => {
+        const iam = booking.passenger?.iamUserId ? iamMap.get(booking.passenger.iamUserId) : undefined;
+        return {
+          id: booking.id,
+          bookingRef: booking.bookingRef,
+          status: booking.status,
+          totalMinor: booking.totalMinor,
+          currency: 'ETB',
+          displayCurrency: booking.displayCurrency,
+          displayTotalMinor: booking.displayTotalMinor,
+          contactEmail: booking.contactEmail,
+          contactPhone: booking.contactPhone,
+          bookingType: booking.bookingType,
+          returnLegStatus: (booking as any).returnLegStatus ?? null,
+          adultCount: booking.adultCount,
+          childCount: booking.childCount,
+          createdAt: booking.createdAt,
+          passenger: iam
+            ? { fullName: iam.name?.en ?? iam.name?.am ?? null, email: iam.email, phone: iam.phone_number }
+            : null,
+          passengerNames: [...new Set(booking.seats.map((s: any) => s.passengerName))],
+          schedule: {
+            train: booking.schedule.train,
+            originStation: booking.schedule.originStation,
+            destinationStation: booking.schedule.destinationStation,
+            departureAt: booking.schedule.departureAt,
+          },
+          paymentIntent: booking.paymentIntent,
+          seatCount: booking.seats.length,
+        };
+      }),
      meta: {
        page,
        pageSize,
--- a/apps/edr-passenger-api/src/modules/bookings/guest-booking.service.ts
+++ b/apps/edr-passenger-api/src/modules/bookings/guest-booking.service.ts
@@ -3,11 +3,11 @@ import { PrismaService } from '../../common/prisma.service';
 import { SeatsService } from '../seats/seats.service';
 import { VerifaydaService } from '../verifayda/verifayda.service';
 import { CurrencyService } from '../currency/currency.service';
+import { PassengerAuthService } from '../auth/passenger-auth.service';
 import { FareEngineService } from '../fare-engine/fare-engine.service';
 import { EventEmitter2 } from '@nestjs/event-emitter';
 import { CreateGuestBookingDto, SavedPassengerProfileDto } from './guest-booking.dto';
 import { Currency, PassengerCategory, IdDocumentType } from '@prisma/client';
-import * as bcrypt from 'bcrypt';

 function generateRef(): string {
  const chars = 'ABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789';
@@ -44,18 +44,19 @@ export class GuestBookingService {
    private seatsService: SeatsService,
    private verifaydaService: VerifaydaService,
    private currencyService: CurrencyService,
+    private passengerAuthService: PassengerAuthService,
    private fareEngine: FareEngineService,
    private eventEmitter: EventEmitter2,
  ) {}

-  async createGuestBooking(dto: CreateGuestBookingDto) {
-    if (dto.bookingType === 'ROUND_TRIP')         return this.createGuestRoundTripBooking(dto);
-    if (dto.bookingType === 'TRANSIT')            return this.createGuestTransitBooking(dto);
-    if (dto.bookingType === 'ROUND_TRIP_TRANSIT') return this.createGuestRoundTripTransitBooking(dto);
-    return this.createGuestOneWayBooking(dto);
+  async createGuestBooking(dto: CreateGuestBookingDto, req?: any) {
+    if (dto.bookingType === 'ROUND_TRIP')         return this.createGuestRoundTripBooking(dto, req);
+    if (dto.bookingType === 'TRANSIT')            return this.createGuestTransitBooking(dto, req);
+    if (dto.bookingType === 'ROUND_TRIP_TRANSIT') return this.createGuestRoundTripTransitBooking(dto, req);
+    return this.createGuestOneWayBooking(dto, req);
  }

-  private async createGuestOneWayBooking(dto: CreateGuestBookingDto) {
+  private async createGuestOneWayBooking(dto: CreateGuestBookingDto, req?: any) {
    // Validate hold
    const hold = await this.prisma.seatHold.findUnique({ where: { id: dto.holdId } });
    if (!hold || hold.expiresAt < new Date()) {
@@ -95,15 +96,12 @@ export class GuestBookingService {
      let verifaydaData: Record<string, any> | undefined;
      let nationality = passenger.nationality;

-      // Determine if passenger is Ethiopian
-      const isEthiopian = passenger.nationality === 'Ethiopian' || 
+      const isEthiopian = passenger.nationality === 'Ethiopian' ||
                          passenger.nationality === 'ETHIOPIAN' ||
                          passenger.idDocumentType === IdDocumentType.NATIONAL_ID;
-      
-      // Ethiopian with National ID
+
      if (isEthiopian && passenger.idDocumentType === IdDocumentType.NATIONAL_ID) {
        if (passenger.idDocumentNumber) {
-          // Attempt Fayda verification
          const verification = await this.verifaydaService.verifyNationalId(passenger.idDocumentNumber);
          if (!verification.verified) {
            throw new BadRequestException(
@@ -115,22 +113,14 @@ export class GuestBookingService {
          verifaydaData = verification.passengerData?.profileData;
        }
        nationality = 'Ethiopian';
-      } 
-      // International passenger with Passport (non-Ethiopian)
-      else if (!isEthiopian && passenger.idDocumentType === IdDocumentType.PASSPORT) {
-        // Passport details are required for international passengers
+      } else if (!isEthiopian && passenger.idDocumentType === IdDocumentType.PASSPORT) {
        if (!passenger.passportNumber || !passenger.passportCountry) {
          throw new BadRequestException(`Passport number and country required for ${passenger.passengerName}`);
        }
        nationality = nationality || (passenger.passportCountry === 'Djibouti' ? 'Djiboutian' : 'Other');
-      }
-      // Ethiopian with Passport (manual entry without Fayda)
-      else if (isEthiopian && passenger.idDocumentType === IdDocumentType.PASSPORT) {
-        // Ethiopians can use passport instead of national ID
+      } else if (isEthiopian && passenger.idDocumentType === IdDocumentType.PASSPORT) {
        nationality = 'Ethiopian';
-      }
-      // International with National ID (e.g., Djiboutian national ID)
-      else if (!isEthiopian && passenger.idDocumentType === IdDocumentType.NATIONAL_ID) {
+      } else if (!isEthiopian && passenger.idDocumentType === IdDocumentType.NATIONAL_ID) {
        nationality = nationality || 'Other';
      }

@@ -179,16 +169,27 @@ export class GuestBookingService {
      displayTotalMinor = await this.currencyService.convertAmount(totalMinor, Currency.ETB, displayCurrency);
    }

-    // Create or get guest passenger
+    // Resolve or create the guest Passenger record
    const firstPassenger = passengersData[0];
-    const { guestPassenger, userId, createdAccount } = await this.resolveGuestPassenger(dto, firstPassenger);
+    const { guestPassengerId, iamUserId, createdAccount } = await this.resolveGuestPassenger(dto, firstPassenger, req);

    // Save passenger details for future use (if requested)
    if (dto.savePassengerDetails && (dto.createAccount || dto.deviceId)) {
      for (const passenger of passengersData) {
-        // Note: SavedPassengerProfile will be available after migration
-        // Temporarily disabled until prisma generate completes
-        // await this.prisma.savedPassengerProfile.create({ ... });
+        await this.prisma.savedPassengerProfile.create({
+          data: {
+            userId: iamUserId ?? undefined,
+            deviceId: dto.deviceId,
+            passengerName: passenger.passengerName,
+            dateOfBirth: passenger.dateOfBirth,
+            idDocumentType: passenger.idDocumentType,
+            passportNumber: passenger.passportNumber,
+            passportCountry: passenger.passportCountry,
+            nationality: passenger.nationality,
+            phone: passenger.phone,
+            email: passenger.email,
+          },
+        });
      }
    }

@@ -196,7 +197,7 @@ export class GuestBookingService {
    const booking = await this.prisma.booking.create({
      data: {
        bookingRef: generateRef(),
-        passengerId: guestPassenger.id,
+        passengerId: guestPassengerId,
        scheduleId: dto.scheduleId,
        status: 'PENDING_PAYMENT',
        totalMinor,
@@ -237,7 +238,7 @@ export class GuestBookingService {
    return {
      ...booking,
      createdAccount,
-      userId,
+      iamUserId,
      fareBreakdown: {
        baseFareMinor,
        adultCount,
@@ -257,7 +258,7 @@ export class GuestBookingService {
    };
  }

-  private async createGuestRoundTripBooking(dto: CreateGuestBookingDto) {
+  private async createGuestRoundTripBooking(dto: CreateGuestBookingDto, req?: any) {
    if (!dto.returnScheduleId || !dto.returnHoldId || !dto.returnOriginStationId || !dto.returnDestinationStationId) {
      throw new BadRequestException('returnScheduleId, returnHoldId, returnOriginStationId and returnDestinationStationId are required for ROUND_TRIP');
    }
@@ -374,7 +375,7 @@ export class GuestBookingService {
      : totalMinor;

    // Create or resolve guest passenger (same as one-way)
-    const { guestPassenger, userId, createdAccount } = await this.resolveGuestPassenger(dto, passengersData[0]);
+    const { guestPassengerId, iamUserId, createdAccount } = await this.resolveGuestPassenger(dto, passengersData[0], req);

    // Create booking with outbound seats; return seats confirmed separately
    const outboundSeatIds = dto.passengers.map(p => p.seatId);
@@ -383,7 +384,7 @@ export class GuestBookingService {
    const booking = await this.prisma.booking.create({
      data: {
        bookingRef:                  generateRef(),
-        passengerId:                 guestPassenger.id,
+        passengerId:                 guestPassengerId,
        scheduleId:                  dto.scheduleId,
        status:                      'PENDING_PAYMENT',
        bookingType:                 'ROUND_TRIP',
@@ -451,7 +452,7 @@ export class GuestBookingService {
    return {
      ...booking,
      createdAccount,
-      userId,
+      iamUserId,
      fareBreakdown: {
        outboundBaseFareMinor: outboundBaseFare,
        returnBaseFareMinor:   returnBaseFare,
@@ -470,7 +471,7 @@ export class GuestBookingService {
    };
  }

-  private async createGuestTransitBooking(dto: CreateGuestBookingDto) {
+  private async createGuestTransitBooking(dto: CreateGuestBookingDto, req?: any) {
    if (!dto.leg2ScheduleId || !dto.leg2HoldId || !dto.transitStationId || !dto.leg2DestinationStationId) {
      throw new BadRequestException('leg2ScheduleId, leg2HoldId, transitStationId and leg2DestinationStationId are required for TRANSIT bookings');
    }
@@ -571,13 +572,13 @@ export class GuestBookingService {
      ? await this.currencyService.convertAmount(totalMinor, Currency.ETB, displayCurrency)
      : totalMinor;

-    const { guestPassenger, userId, createdAccount } = await this.resolveGuestPassenger(dto, passengersData[0]);
+    const { guestPassengerId, iamUserId, createdAccount } = await this.resolveGuestPassenger(dto, passengersData[0], req);

    // Single booking — leg-1 seats at leg=1, leg-2 seats at leg=2
    const booking = await this.prisma.booking.create({
      data: {
        bookingRef:              generateRef(),
-        passengerId:             guestPassenger.id,
+        passengerId:             guestPassengerId,
        scheduleId:              dto.scheduleId,
        status:                  'PENDING_PAYMENT',
        bookingType:             'TRANSIT',
@@ -643,7 +644,7 @@ export class GuestBookingService {
    return {
      ...booking,
      createdAccount,
-      userId,
+      iamUserId,
      fareBreakdown: {
        leg1BaseFareMinor: leg1BaseFare,
        leg2BaseFareMinor: leg2BaseFare,
@@ -657,7 +658,7 @@ export class GuestBookingService {
    };
  }

-  private async createGuestRoundTripTransitBooking(dto: CreateGuestBookingDto) {
+  private async createGuestRoundTripTransitBooking(dto: CreateGuestBookingDto, req?: any) {
    if (!dto.leg2ScheduleId || !dto.leg2HoldId || !dto.transitStationId || !dto.leg2DestinationStationId ||
        !dto.returnScheduleId || !dto.returnHoldId || !dto.returnOriginStationId || !dto.returnDestinationStationId ||
        !dto.returnLeg2ScheduleId || !dto.returnLeg2HoldId || !dto.returnTransitStationId || !dto.returnLeg2DestinationStationId) {
@@ -764,7 +765,7 @@ export class GuestBookingService {
      ? await this.currencyService.convertAmount(totalMinor, Currency.ETB, displayCurrency)
      : totalMinor;

-    const { guestPassenger, userId, createdAccount } = await this.resolveGuestPassenger(dto, passengersData[0]);
+    const { guestPassengerId, iamUserId, createdAccount } = await this.resolveGuestPassenger(dto, passengersData[0], req);

    const makeSeat = (p: any, seatId: string, leg: number, scheduleId: string, fare: number) => ({
      seat:              { connect: { id: seatId } },
@@ -785,7 +786,7 @@ export class GuestBookingService {
    const booking = await this.prisma.booking.create({
      data: {
        bookingRef:                   generateRef(),
-        passengerId:                  guestPassenger.id,
+        passengerId:                  guestPassengerId,
        scheduleId:                   dto.scheduleId,
        status:                       'PENDING_PAYMENT',
        bookingType:                  'ROUND_TRIP_TRANSIT',
@@ -832,7 +833,7 @@ export class GuestBookingService {
    return {
      ...booking,
      createdAccount,
-      userId,
+      iamUserId,
      fareBreakdown: {
        outboundLeg1FareMinor: obL1Fare,
        outboundLeg2FareMinor: obL2Fare,
@@ -851,59 +852,28 @@ export class GuestBookingService {
  private async resolveGuestPassenger(
    dto: Pick<CreateGuestBookingDto, 'createAccount' | 'password' | 'deviceId'>,
    firstPassenger: any,
-  ): Promise<{ guestPassenger: any; userId: string | null; createdAccount: boolean }> {
+    req?: any,
+  ): Promise<{ guestPassengerId: string; iamUserId: string | null; createdAccount: boolean }> {
    if (dto.createAccount && firstPassenger.email && dto.password) {
-      const existingUser = await this.prisma.user.findUnique({ where: { email: firstPassenger.email } });
-      if (existingUser) throw new BadRequestException('Email already registered. Please login instead.');
-
-      let accountPhone = firstPassenger.phone || null;
-      if (accountPhone) {
-        const existingPhone = await this.prisma.user.findUnique({ where: { phone: accountPhone } });
-        if (existingPhone) throw new BadRequestException('Phone number already registered. Please login instead.');
-      }
-      if (!accountPhone) accountPhone = generateEthiopianPhone();
-
-      const user = await this.prisma.user.create({
-        data: {
-          fullName:      firstPassenger.passengerName,
-          email:         firstPassenger.email,
-          phone:         accountPhone,
-          passwordHash:  await bcrypt.hash(dto.password, 10),
-          nationality:   firstPassenger.nationality,
-          nationalId:    firstPassenger.idDocumentType === IdDocumentType.NATIONAL_ID ? firstPassenger.idDocumentNumber : undefined,
-          passportNumber: firstPassenger.passportNumber,
+      const guestName = firstPassenger.passengerName ?? 'Guest';
+      const result = await this.passengerAuthService.register(
+        {
+          email: firstPassenger.email,
+          username: firstPassenger.email,
+          phoneNumber: firstPassenger.phone || `+251900000000`,
+          name: { en: guestName, am: guestName },
+          password: dto.password,
+          confirmPassword: dto.password,
        },
-      });
-      const guestPassenger = await this.prisma.passenger.create({ data: { userId: user.id } });
-      await this.prisma.loyaltyAccount.create({ data: { passengerId: guestPassenger.id, pointsBalance: 0, tier: 'BRONZE' } });
-      await this.prisma.walletAccount.create({ data: { passengerId: guestPassenger.id, balanceMinor: 0 } });
-      return { guestPassenger, userId: user.id, createdAccount: true };
+        req,
+      );
+      return { guestPassengerId: result.user.passengerId, iamUserId: result.user.iamUserId, createdAccount: true };
    }

-    const uniqueId   = `${Date.now()}-${Math.random().toString(36).substring(2, 9)}`;
-    let guestEmail   = firstPassenger.email || generateGuestEmail(uniqueId);
-    if (firstPassenger.email) {
-      const existing = await this.prisma.user.findUnique({ where: { email: firstPassenger.email } });
-      if (existing) guestEmail = generateGuestEmail(uniqueId);
-    }
-    let guestPhone = firstPassenger.phone || null;
-    if (guestPhone) {
-      const existing = await this.prisma.user.findUnique({ where: { phone: guestPhone } });
-      if (existing) guestPhone = null;
-    }
-    if (!guestPhone) guestPhone = generateEthiopianPhone();
-
-    const tempUser = await this.prisma.user.create({
-      data: {
-        fullName:     firstPassenger.passengerName,
-        email:        guestEmail,
-        phone:        guestPhone,
-        passwordHash: await bcrypt.hash(Math.random().toString(36), 10),
-        role:         'PASSENGER',
-      },
-    });
-    const guestPassenger = await this.prisma.passenger.create({ data: { userId: tempUser.id } });
-    return { guestPassenger, userId: null, createdAccount: false };
+    const guestPassenger = await this.prisma.passenger.create({ data: {} });
+    await this.prisma.loyaltyAccount.create({ data: { passengerId: guestPassenger.id, pointsBalance: 0, tier: 'BRONZE' } });
+    await this.prisma.walletAccount.create({ data: { passengerId: guestPassenger.id, balanceMinor: 0 } });
+    return { guestPassengerId: guestPassenger.id, iamUserId: null, createdAccount: false };
  }

  async getSavedPassengers(userId?: string, deviceId?: string): Promise<SavedPassengerProfileDto[]> {
@@ -911,10 +881,6 @@ export class GuestBookingService {
      throw new BadRequestException('Either userId or deviceId is required');
    }

-    // Temporarily return empty array until Prisma client is regenerated
-    return [];
-
-    /* Uncomment after running migration and prisma generate
    const profiles = await this.prisma.savedPassengerProfile.findMany({
      where: {
        OR: [
@@ -929,14 +895,13 @@ export class GuestBookingService {
      passengerName: p.passengerName,
      dateOfBirth: p.dateOfBirth.toISOString().split('T')[0],
      idDocumentType: p.idDocumentType,
-      idDocumentNumber: undefined, // Never return sensitive data
+      idDocumentNumber: undefined,
      passportNumber: p.passportNumber || undefined,
      passportCountry: p.passportCountry || undefined,
      nationality: p.nationality || undefined,
      phone: p.phone || undefined,
      email: p.email || undefined,
    }));
-    */
  }

  private async getBaseFare(
--- a/apps/edr-passenger-api/src/modules/currencies/currencies.controller.ts
+++ b/apps/edr-passenger-api/src/modules/currencies/currencies.controller.ts
@@ -1,8 +1,9 @@
-import { Controller, Get, Post, Patch, Delete, Body, Param, HttpCode, UseGuards } from '@nestjs/common';
+import { Controller, Get, Post, Patch, Delete, Body, Param, HttpCode } from '@nestjs/common';
 import { ApiTags, ApiBearerAuth } from '@nestjs/swagger';
 import { CurrenciesService } from './currencies.service';
 import { CreateCurrencyDto, UpdateCurrencyDto } from './currencies.dto';
-import { IamGuard, IamRoles } from '../../common/iam-adapter';
+import { PassengerAdmin, PassengerStaff } from '../../common/passenger-guards';
+import { PASSENGER_PERMS } from '../../seed/passenger-permissions.registry';

@ApiTags('Currencies')
@Controller('currencies')
@@ -15,8 +16,7 @@ export class CurrenciesController {
  }

  @Post()
-  @UseGuards(IamGuard)
-  @IamRoles('ADMIN')
+  @PassengerStaff(PASSENGER_PERMS.currencies.manage)
  @ApiBearerAuth('IAM-auth')
  @HttpCode(201)
  createCurrency(@Body() dto: CreateCurrencyDto) {
@@ -24,24 +24,21 @@ export class CurrenciesController {
  }

  @Patch(':id')
-  @UseGuards(IamGuard)
-  @IamRoles('ADMIN')
+  @PassengerStaff(PASSENGER_PERMS.currencies.manage)
  @ApiBearerAuth('IAM-auth')
  updateCurrency(@Param('id') id: string, @Body() dto: UpdateCurrencyDto) {
    return this.currenciesService.updateCurrency(id, dto);
  }

  @Delete(':id')
-  @UseGuards(IamGuard)
-  @IamRoles('ADMIN')
+  @PassengerAdmin()
  @ApiBearerAuth('IAM-auth')
  deleteCurrency(@Param('id') id: string) {
    return this.currenciesService.deleteCurrency(id);
  }

  @Post('sync-rates')
-  @UseGuards(IamGuard)
-  @IamRoles('ADMIN')
+  @PassengerStaff(PASSENGER_PERMS.currencies.manage)
  @ApiBearerAuth('IAM-auth')
  @HttpCode(200)
  syncRates() {
--- a/apps/edr-passenger-api/src/modules/dashboard/dashboard.service.ts
+++ b/apps/edr-passenger-api/src/modules/dashboard/dashboard.service.ts
@@ -1,14 +1,19 @@
 import { Injectable } from '@nestjs/common';
+import { InjectDataSource } from '@nestjs/typeorm';
+import { DataSource } from 'typeorm';
 import { PrismaService } from '../../common/prisma.service';

@Injectable()
 export class DashboardService {
-  constructor(private prisma: PrismaService) {}
+  constructor(
+    private prisma: PrismaService,
+    @InjectDataSource() private dataSource: DataSource,
+  ) {}

  async getHomeDashboard(passengerId: string) {
    const now = new Date();
    const [passenger, upcomingBooking, wallet, promos, weatherAlerts, stationSignals, savedRoutes] = await Promise.all([
-      this.prisma.passenger.findUnique({ where: { id: passengerId }, include: { user: { select: { fullName: true } }, loyalty: true } }),
+      this.prisma.passenger.findUnique({ where: { id: passengerId }, include: { loyalty: true } }),
      this.prisma.booking.findFirst({
        where: { passengerId, status: 'CONFIRMED', schedule: { departureAt: { gte: now } } },
        include: {
@@ -27,7 +32,16 @@ export class DashboardService {

    const hour = now.getHours();
    const greetingKey = hour < 12 ? 'MORNING' : hour < 17 ? 'AFTERNOON' : 'EVENING';
-    const firstName = passenger?.user.fullName.split(' ')[0] ?? '';
+
+    let firstName = '';
+    if (passenger?.iamUserId) {
+      const iamRows = await this.dataSource.query<{ name: { en?: string; am?: string } | null }[]>(
+        `SELECT name FROM iam.users WHERE id = $1 LIMIT 1`,
+        [passenger.iamUserId],
+      );
+      const name = iamRows[0]?.name;
+      firstName = (name?.en ?? name?.am ?? '').split(' ')[0];
+    }
    const seat = upcomingBooking?.seats[0];

    return {
--- a/apps/edr-passenger-api/src/modules/fraud/fraud.controller.ts
+++ b/apps/edr-passenger-api/src/modules/fraud/fraud.controller.ts
@@ -1,12 +1,12 @@
-import { Controller, Get, Post, Body, Query, UseGuards, Logger } from '@nestjs/common';
+import { Controller, Get, Post, Body, Query, Logger } from '@nestjs/common';
 import { ApiTags, ApiOperation, ApiBearerAuth } from '@nestjs/swagger';
 import { FraudService, FraudRuleConfig } from './fraud.service';
-import { IamGuard, IamRoles } from '../../common/iam-adapter';
-import { UserRole } from '@prisma/client';
+import { PassengerStaff } from '../../common/passenger-guards';
+import { PASSENGER_PERMS } from '../../seed/passenger-permissions.registry';

@ApiTags('Fraud Detection')
@Controller('fraud')
-@UseGuards(IamGuard)
+@PassengerStaff([PASSENGER_PERMS.fraud.view, PASSENGER_PERMS.admin])
@ApiBearerAuth('IAM-auth')
 export class FraudController {
  private readonly logger = new Logger(FraudController.name);
@@ -17,7 +17,6 @@ export class FraudController {
   * Get fraud alerts
   */
  @Get('alerts')
-  @IamRoles('ADMIN', 'SUPERVISOR')
  @ApiOperation({ summary: 'Get fraud alerts' })
  async getAlerts(
    @Query('userId') userId?: string,
@@ -32,7 +31,6 @@ export class FraudController {
   * Get fraud rules
   */
  @Get('rules')
-  @IamRoles('ADMIN')
  @ApiOperation({ summary: 'Get fraud detection rules' })
  async getRules() {
    const rules = await this.fraudService.getRules();
@@ -43,7 +41,7 @@ export class FraudController {
   * Create or update fraud rule
   */
  @Post('rules')
-  @IamRoles('ADMIN')
+  @PassengerStaff([PASSENGER_PERMS.fraud.manage, PASSENGER_PERMS.admin])
  @ApiOperation({ summary: 'Create or update fraud rule' })
  async upsertRule(@Body() body: { type: string; config: FraudRuleConfig }) {
    const rule = await this.fraudService.upsertRule(body.type, body.config);
@@ -54,10 +52,10 @@ export class FraudController {
   * Block user temporarily
   */
  @Post('actions/block')
-  @IamRoles('ADMIN', 'SUPERVISOR')
+  @PassengerStaff([PASSENGER_PERMS.fraud.manage, PASSENGER_PERMS.admin])
  @ApiOperation({ summary: 'Block user temporarily' })
-  async blockUser(@Body() body: { userId: string; durationMinutes: number }) {
-    await this.fraudService.blockUserTemporarily(body.userId, body.durationMinutes);
+  async blockUser(@Body() body: { iamUserId: string; durationMinutes: number }) {
+    await this.fraudService.blockUserTemporarily(body.iamUserId, body.durationMinutes);
    return { message: `User blocked for ${body.durationMinutes} minutes` };
  }

@@ -65,10 +63,10 @@ export class FraudController {
   * Unblock user
   */
  @Post('actions/unblock')
-  @IamRoles('ADMIN', 'SUPERVISOR')
+  @PassengerStaff([PASSENGER_PERMS.fraud.manage, PASSENGER_PERMS.admin])
  @ApiOperation({ summary: 'Unblock user' })
-  async unblockUser(@Body() body: { userId: string }) {
-    await this.fraudService.unblockUser(body.userId);
+  async unblockUser(@Body() body: { iamUserId: string }) {
+    await this.fraudService.unblockUser(body.iamUserId);
    return { message: 'User unblocked' };
  }
 }
--- a/apps/edr-passenger-api/src/modules/fraud/fraud.service.ts
+++ b/apps/edr-passenger-api/src/modules/fraud/fraud.service.ts
@@ -1,5 +1,7 @@
 import { Injectable, Logger } from '@nestjs/common';
 import { OnEvent } from '@nestjs/event-emitter';
+import { InjectDataSource } from '@nestjs/typeorm';
+import { DataSource } from 'typeorm';
 import { PrismaService } from '../../common/prisma.service';

 export interface FraudRuleConfig {
@@ -14,47 +16,37 @@ export interface FraudRuleConfig {
 export class FraudService {
  private readonly logger = new Logger(FraudService.name);

-  constructor(private prisma: PrismaService) {}
+  constructor(
+    private prisma: PrismaService,
+    @InjectDataSource() private dataSource: DataSource,
+  ) {}

  /**
   * Evaluate fraud rules and create alerts if triggered
   */
  async evaluateRules(
-    userId: string,
+    passengerId: string,
    eventType: 'booking.created' | 'payment.failed' | 'auth.login.failed',
    context: Record<string, unknown>,
  ): Promise<{ triggered: boolean; rules: string[] }> {
    const triggeredRules: string[] = [];
-    const user = await this.prisma.user.findUnique({ where: { id: userId } });

-    if (!user) return { triggered: false, rules: [] };
-
-    // Check velocity rule (multiple bookings in short time)
    if (eventType === 'booking.created') {
-      const velocityTriggered = await this.checkVelocityRule(userId);
-      if (velocityTriggered) {
-        triggeredRules.push('VELOCITY');
-      }
+      const velocityTriggered = await this.checkVelocityRule(passengerId);
+      if (velocityTriggered) triggeredRules.push('VELOCITY');

-      // Check high-value booking
      const amount = (context.amountMinor as number) || 0;
      const highValueTriggered = await this.checkHighValueRule(amount);
-      if (highValueTriggered) {
-        triggeredRules.push('HIGH_VALUE');
-      }
+      if (highValueTriggered) triggeredRules.push('HIGH_VALUE');
    }

-    // Check repeated failed payments
    if (eventType === 'payment.failed') {
-      const failedPaymentTriggered = await this.checkFailedPaymentRule(userId);
-      if (failedPaymentTriggered) {
-        triggeredRules.push('FAILED_PAYMENTS');
-      }
+      const failedPaymentTriggered = await this.checkFailedPaymentRule(passengerId);
+      if (failedPaymentTriggered) triggeredRules.push('FAILED_PAYMENTS');
    }

-    // Create alert if rules triggered
    if (triggeredRules.length > 0) {
-      await this.createFraudAlert(userId, eventType, triggeredRules, context);
+      await this.createFraudAlert(passengerId, eventType, triggeredRules, context);
      return { triggered: true, rules: triggeredRules };
    }

@@ -64,7 +56,7 @@ export class FraudService {
  /**
   * Check velocity rule: X bookings in Y minutes
   */
-  private async checkVelocityRule(userId: string): Promise<boolean> {
+  private async checkVelocityRule(passengerId: string): Promise<boolean> {
    const rule = await this.prisma.fraudRule.findFirst({
      where: { type: 'VELOCITY', enabled: true },
    });
@@ -72,18 +64,14 @@ export class FraudService {
    if (!rule) return false;

    const timeWindowMinutes = (rule.config as any)?.timeWindowMinutes || 30;
-    const threshold = rule.threshold;
-
    const bookingCount = await this.prisma.booking.count({
      where: {
-        passengerId: userId,
-        createdAt: {
-          gte: new Date(Date.now() - timeWindowMinutes * 60 * 1000),
-        },
+        passengerId,
+        createdAt: { gte: new Date(Date.now() - timeWindowMinutes * 60 * 1000) },
      },
    });

-    return bookingCount > threshold;
+    return bookingCount > rule.threshold;
  }

  /**
@@ -104,7 +92,7 @@ export class FraudService {
  /**
   * Check failed payment rule: X failed attempts in Y minutes
   */
-  private async checkFailedPaymentRule(userId: string): Promise<boolean> {
+  private async checkFailedPaymentRule(passengerId: string): Promise<boolean> {
    const rule = await this.prisma.fraudRule.findFirst({
      where: { type: 'FAILED_PAYMENTS', enabled: true },
    });
@@ -112,33 +100,33 @@ export class FraudService {
    if (!rule) return false;

    const timeWindowMinutes = (rule.config as any)?.timeWindowMinutes || 60;
-    const threshold = rule.threshold;
-
    const failedCount = await this.prisma.paymentIntent.count({
      where: {
-        booking: { passengerId: userId },
+        booking: { passengerId },
        status: 'FAILED',
-        updatedAt: {
-          gte: new Date(Date.now() - timeWindowMinutes * 60 * 1000),
-        },
+        updatedAt: { gte: new Date(Date.now() - timeWindowMinutes * 60 * 1000) },
      },
    });

-    return failedCount > threshold;
+    return failedCount > rule.threshold;
  }

  /**
   * Create a fraud alert
   */
  private async createFraudAlert(
-    userId: string,
+    passengerId: string,
    eventType: string,
    triggeredRules: string[],
    context: Record<string, unknown>,
  ): Promise<void> {
+    const passenger = await this.prisma.passenger.findUnique({
+      where: { id: passengerId },
+      select: { iamUserId: true },
+    });
    const alert = await this.prisma.fraudAlert.create({
      data: {
-        userId,
+        iamUserId: passenger?.iamUserId ?? passengerId,
        eventType,
        triggeredRules,
        context: context as any,
@@ -146,35 +134,34 @@ export class FraudService {
      },
    });

-    this.logger.warn(`Fraud alert created: ${alert.id} for user ${userId} - rules: ${triggeredRules.join(', ')}`);
+    this.logger.warn(`Fraud alert created: ${alert.id} for passenger ${passengerId} - rules: ${triggeredRules.join(', ')}`);

-    // Trigger blocking if needed
    if (triggeredRules.includes('HIGH_VALUE') || triggeredRules.length > 1) {
-      await this.blockUserTemporarily(userId, 30); // Block for 30 minutes
+      if (passenger?.iamUserId) await this.blockUserTemporarily(passenger.iamUserId, 30);
    }
  }

  /**
   * Block user temporarily
   */
-  async blockUserTemporarily(userId: string, durationMinutes: number): Promise<void> {
+  async blockUserTemporarily(iamUserId: string, durationMinutes: number): Promise<void> {
    const blockedUntil = new Date(Date.now() + durationMinutes * 60 * 1000);
-    await this.prisma.user.update({
-      where: { id: userId },
+    await this.prisma.passenger.updateMany({
+      where: { iamUserId },
      data: { blockedUntil },
    });
-    this.logger.warn(`User ${userId} blocked until ${blockedUntil.toISOString()}`);
+    this.logger.warn(`Passenger (iamUserId=${iamUserId}) blocked until ${blockedUntil.toISOString()}`);
  }

  /**
   * Unblock user
   */
-  async unblockUser(userId: string): Promise<void> {
-    await this.prisma.user.update({
-      where: { id: userId },
+  async unblockUser(iamUserId: string): Promise<void> {
+    await this.prisma.passenger.updateMany({
+      where: { iamUserId },
      data: { blockedUntil: null },
    });
-    this.logger.log(`User ${userId} unblocked`);
+    this.logger.log(`Passenger (iamUserId=${iamUserId}) unblocked`);
  }

  /**
@@ -182,7 +169,7 @@ export class FraudService {
   */
  async getAlerts(userId?: string, limit = 100, offset = 0) {
    return this.prisma.fraudAlert.findMany({
-      where: userId ? { userId } : {},
+      where: userId ? { iamUserId: userId } : {},
      orderBy: { createdAt: 'desc' },
      take: limit,
      skip: offset,
@@ -234,9 +221,10 @@ export class FraudService {
   * Event listener for payment failed
   */
  @OnEvent('payment.failed')
-  async onPaymentFailed(payload: { intentId: string; userId: string }) {
-    await this.evaluateRules(payload.userId, 'payment.failed', {
-      intentId: payload.intentId,
+  async onPaymentFailed(payload: { booking: { passengerId: string; id: string } }) {
+    if (!payload.booking?.passengerId) return;
+    await this.evaluateRules(payload.booking.passengerId, 'payment.failed', {
+      bookingId: payload.booking.id,
    });
  }

@@ -244,9 +232,18 @@ export class FraudService {
   * Event listener for auth login failed
   */
  @OnEvent('auth.login.failed')
-  async onLoginFailed(payload: { userId: string; email: string }) {
-    await this.evaluateRules(payload.userId, 'auth.login.failed', {
-      email: payload.email,
+  async onLoginFailed(payload: { email: string }) {
+    if (!payload.email) return;
+    const iamRows = await this.dataSource.query<{ id: string }[]>(
+      `SELECT id FROM iam.users WHERE email = $1 LIMIT 1`,
+      [payload.email],
+    );
+    if (!iamRows.length) return;
+    const passenger = await this.prisma.passenger.findUnique({
+      where: { iamUserId: iamRows[0].id },
+      select: { id: true },
    });
+    if (!passenger) return;
+    await this.evaluateRules(passenger.id, 'auth.login.failed', { email: payload.email });
  }
 }
--- a/apps/edr-passenger-api/src/modules/notifications/notifications.controller.ts
+++ b/apps/edr-passenger-api/src/modules/notifications/notifications.controller.ts
@@ -2,7 +2,8 @@ import { Controller, Get, Param, Patch, Post, Body, UseGuards } from '@nestjs/co
 import { ApiTags, ApiOperation, ApiBearerAuth, ApiBody } from '@nestjs/swagger';
 import { NotificationsService } from './notifications.service';
 import { JwtGuard } from '../../common/jwt.guard';
-import { IamGuard, IamRoles } from '../../common/iam-adapter';
+import { PassengerStaff } from '../../common/passenger-guards';
+import { PASSENGER_PERMS } from '../../seed/passenger-permissions.registry';
 import { TestNotificationDto } from './notifications.dto';
 import { EmailClientService } from './email-client.service';
 import { SmsClientService } from './sms-client.service';
@@ -39,8 +40,7 @@ export class NotificationsController {
  }

  @Post('send/email')
-  @UseGuards(IamGuard)
-  @IamRoles('ADMIN', 'STAFF')
+  @PassengerStaff([PASSENGER_PERMS.notifications.send, PASSENGER_PERMS.admin])
  @ApiOperation({ summary: 'Send a direct email via the email microservice' })
  @ApiBody({ type: SendEmail })
  sendEmail(@Body() dto: SendEmail) {
@@ -48,8 +48,7 @@ export class NotificationsController {
  }

  @Post('send/sms')
-  @UseGuards(IamGuard)
-  @IamRoles('ADMIN', 'STAFF')
+  @PassengerStaff([PASSENGER_PERMS.notifications.send, PASSENGER_PERMS.admin])
  @ApiOperation({ summary: 'Send a direct SMS via the SMS microservice' })
  @ApiBody({ type: SingleMessageDto })
  sendSms(@Body() dto: SingleMessageDto) {
@@ -57,8 +56,7 @@ export class NotificationsController {
  }

  @Post('send/sms/bulk')
-  @UseGuards(IamGuard)
-  @IamRoles('ADMIN', 'STAFF')
+  @PassengerStaff([PASSENGER_PERMS.notifications.send, PASSENGER_PERMS.admin])
  @ApiOperation({ summary: 'Send bulk SMS messages via the SMS microservice' })
  @ApiBody({ type: BulkMessagesDto })
  sendBulkSms(@Body() dto: BulkMessagesDto) {
@@ -66,8 +64,6 @@ export class NotificationsController {
  }

  @Post('test')
-  @UseGuards(IamGuard)
-  @IamRoles('ADMIN', 'STAFF')
  @ApiOperation({ summary: 'Test notification delivery (Admin only)' })
  async testNotification(@Body() dto: TestNotificationDto) {
    return this.service.send(
--- a/apps/edr-passenger-api/src/modules/notifications/notifications.service.ts
+++ b/apps/edr-passenger-api/src/modules/notifications/notifications.service.ts
@@ -1,5 +1,7 @@
 import { Injectable, Logger } from '@nestjs/common';
 import { OnEvent } from '@nestjs/event-emitter';
+import { InjectDataSource } from '@nestjs/typeorm';
+import { DataSource } from 'typeorm';
 import { PrismaService } from '../../common/prisma.service';
 import { PushAdapter, NotificationChannel } from './notification.adapters';
 import { EmailClientService } from './email-client.service';
@@ -7,6 +9,8 @@ import { SmsClientService } from './sms-client.service';

 export type NotificationChannelType = 'EMAIL' | 'SMS' | 'PUSH' | 'IN_APP';

+const UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+
@Injectable()
 export class NotificationsService {
  private readonly logger = new Logger(NotificationsService.name);
@@ -14,6 +18,7 @@ export class NotificationsService {

  constructor(
    private prisma: PrismaService,
+    @InjectDataSource() private readonly dataSource: DataSource,
    private emailClient: EmailClientService,
    private smsClient: SmsClientService,
    private pushAdapter: PushAdapter,
@@ -112,22 +117,20 @@ export class NotificationsService {
    body: string,
    context: Record<string, unknown>,
  ): Promise<void> {
-    // Try to find passenger by ID or email
    let passengerId = recipient;

-    if (!recipient.match(/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i)) {
-      const user = await this.prisma.user.findFirst({
-        where: {
-          OR: [{ email: recipient }, { phone: recipient }],
-        },
-        include: { passenger: true },
-      });
-      if (user?.passenger) {
-        passengerId = user.passenger.id;
-      } else {
+    if (!UUID_RE.test(recipient)) {
+      const iamUserId = await this.resolveIamUserId(recipient);
+      if (!iamUserId) {
        this.logger.warn(`Could not find passenger for recipient: ${recipient}`);
        return;
      }
+      const passenger = await this.prisma.passenger.findUnique({ where: { iamUserId } });
+      if (!passenger) {
+        this.logger.warn(`Could not find passenger for recipient: ${recipient}`);
+        return;
+      }
+      passengerId = passenger.id;
    }

    await this.prisma.notification.create({
@@ -163,26 +166,19 @@ export class NotificationsService {
  }

  private async getUserPreferredChannels(recipient: string): Promise<NotificationChannelType[]> {
-    const user = await this.prisma.user.findFirst({
-      where: {
-        OR: [
-          { id: recipient },
-          { email: recipient },
-          { phone: recipient },
-          { passenger: { id: recipient } },
-        ],
-      },
-      include: { preferences: true },
-    });
+    const iamUserId = await this.resolveIamUserId(recipient);
+    const preferences = iamUserId
+      ? await this.prisma.userPreferences.findUnique({ where: { iamUserId } })
+      : null;

-    if (!user?.preferences) {
+    if (!preferences) {
      return ['IN_APP', 'EMAIL'];
    }

    const channels: NotificationChannelType[] = ['IN_APP'];
-    if (user.preferences.emailEnabled) channels.push('EMAIL');
-    if (user.preferences.smsEnabled) channels.push('SMS');
-    if (user.preferences.pushEnabled) channels.push('PUSH');
+    if (preferences.emailEnabled) channels.push('EMAIL');
+    if (preferences.smsEnabled) channels.push('SMS');
+    if (preferences.pushEnabled) channels.push('PUSH');

    return channels;
  }
@@ -191,32 +187,44 @@ export class NotificationsService {
    recipient: string,
    channel: NotificationChannelType,
  ): Promise<string | null> {
-    const user = await this.prisma.user.findFirst({
-      where: {
-        OR: [
-          { id: recipient },
-          { email: recipient },
-          { phone: recipient },
-          { passenger: { id: recipient } },
-        ],
-      },
-    });
-
-    if (!user) return null;
+    const iamUserId = await this.resolveIamUserId(recipient);
+    if (!iamUserId) return null;
+    const contact = await this.resolveContactInfo(iamUserId);

    switch (channel) {
-      case 'EMAIL':
-        return user.email;
-      case 'SMS':
-        return user.phone;
-      case 'PUSH':
-        // Would need to fetch device push token
-        return user.id;
-      default:
-        return null;
+      case 'EMAIL': return contact.email;
+      case 'SMS': return contact.phone;
+      case 'PUSH': return iamUserId;
+      default: return null;
    }
  }

+  private async resolveIamUserId(recipient: string): Promise<string | null> {
+    if (UUID_RE.test(recipient)) {
+      const passenger = await this.prisma.passenger.findUnique({ where: { id: recipient } });
+      return passenger?.iamUserId ?? recipient;
+    }
+    const rows = await this.dataSource.query<{ id: string }[]>(
+      `SELECT id FROM iam.users WHERE email = $1 OR phone_number = $1 LIMIT 1`,
+      [recipient],
+    );
+    return rows[0]?.id ?? null;
+  }
+
+  private async resolveContactInfo(iamUserId: string): Promise<{ email: string | null; phone: string | null }> {
+    const rows = await this.dataSource.query<{ email: string; phone_number: string | null }[]>(
+      `SELECT email, phone_number FROM iam.users WHERE id = $1 LIMIT 1`,
+      [iamUserId],
+    );
+    return { email: rows[0]?.email ?? null, phone: rows[0]?.phone_number ?? null };
+  }
+
+  private sanitize(value: string): string {
+    return value
+      .replace(/[\r\n]/g, ' ')
+      .replace(/[<>&"']/g, (c) => ({ '<': '&lt;', '>': '&gt;', '&': '&amp;', '"': '&quot;', "'": '&#x27;' }[c] ?? c));
+  }
+
  getForPassenger(passengerId: string) {
    return this.prisma.notification.findMany({
      where: { passengerId },
--- a/apps/edr-passenger-api/src/modules/passengers/passengers.controller.ts
+++ b/apps/edr-passenger-api/src/modules/passengers/passengers.controller.ts
@@ -3,7 +3,6 @@ import { ApiTags, ApiOperation, ApiBearerAuth, ApiResponse, ApiQuery } from '@ne
 import { PassengersService } from './passengers.service';
 import { CreateTravelerProfileDto, CreateSavedRouteDto, VerifyFaydaDto, SavePassengersDto, RegisterPassengerDto } from './passengers.dto';
 import { JwtGuard } from '../../common/jwt.guard';
-import { IamGuard } from '../../common/iam-adapter';
 import { VerifaydaService } from '../verifayda/verifayda.service';
 import { OptionalJwtGuard } from '../verifayda/optional-jwt.guard';
 import { PrismaService } from '../../common/prisma.service';
@@ -53,25 +52,17 @@ export class PassengersController {
  })
  @ApiResponse({ status: 401, description: 'Unauthorized - Invalid or missing token' })
  async getMe(@Request() req: any) {
-    if (!req.user || !req.user.userId) {
+    if (!req.user || !req.user.id) {
      throw new UnauthorizedException('User not authenticated');
    }

    try {
-      const user = await this.prisma.user.findUnique({
-        where: { id: req.user.userId },
-        include: { 
-          passenger: true,
-        },
+      const passenger = await this.prisma.passenger.findUnique({
+        where: { iamUserId: req.user.id },
      });
-
-      if (!user || !user.passenger) {
-        return null;
-      }
-
-      return this.service.getProfile(user.passenger.id);
+      if (!passenger) return null;
+      return this.service.getProfile(passenger.id);
    } catch (error) {
-      // If profile lookup fails for any reason, return null to allow app to continue
      return null;
    }
  }
@@ -251,7 +242,7 @@ The API automatically detects:
    description: 'Invalid JWT token (only if token provided but invalid)' 
  })
  registerPassenger(@Body() dto: RegisterPassengerDto, @Request() req: any) {
-    const userId = req.user?.userId;
+    const userId = req.user?.id;
    return this.service.registerPassenger({ ...dto, userId });
  }

--- a/apps/edr-passenger-api/src/modules/passengers/passengers.service.ts
+++ b/apps/edr-passenger-api/src/modules/passengers/passengers.service.ts
@@ -1,4 +1,6 @@
 import { Injectable, NotFoundException, BadRequestException } from '@nestjs/common';
+import { InjectDataSource } from '@nestjs/typeorm';
+import { DataSource } from 'typeorm';
 import { PrismaService } from '../../common/prisma.service';
 import { CreateTravelerProfileDto, CreateSavedRouteDto, RegisterPassengerDto } from './passengers.dto';
 import { VerifaydaService } from '../verifayda/verifayda.service';
@@ -10,37 +12,68 @@ interface PassengerFilters {
  pageSize?: number;
 }

+type IamUserRow = {
+  id: string;
+  email: string;
+  name: { en: string; am: string } | null;
+  phone_number: string | null;
+  metadata: Record<string, any> | null;
+};
+
@Injectable()
 export class PassengersService {
  constructor(
-    private prisma: PrismaService,
-    private verifaydaService: VerifaydaService,
+    private readonly prisma: PrismaService,
+    @InjectDataSource() private readonly dataSource: DataSource,
+    private readonly verifaydaService: VerifaydaService,
  ) {}

  async findAll(filters: PassengerFilters = {}) {
    const { search, verified, page = 1, pageSize = 20 } = filters;
    const skip = (page - 1) * pageSize;
-    
-    const where: any = { user: { role: 'PASSENGER' } };
-    
-    if (search) {
-      where.user = {
-        ...where.user,
-        OR: [
-          { fullName: { contains: search, mode: 'insensitive' } },
-          { email: { contains: search, mode: 'insensitive' } },
-          { phone: { contains: search, mode: 'insensitive' } },
-        ],
-      };
+
+    let iamUserIdFilter: string[] | null = null;
+
+    if (search || verified !== undefined) {
+      const conditions: string[] = [];
+      const params: any[] = [];
+      let idx = 1;
+
+      if (search) {
+        conditions.push(`(
+          u.email ILIKE $${idx} OR
+          u.phone_number ILIKE $${idx} OR
+          (u.name->>'en') ILIKE $${idx} OR
+          (u.name->>'am') ILIKE $${idx}
+        )`);
+        params.push(`%${search}%`);
+        idx++;
+      }
+
+      if (verified !== undefined) {
+        if (verified) {
+          conditions.push(`u.metadata->>'faydaVerified' = 'true'`);
+        } else {
+          conditions.push(`(u.metadata IS NULL OR u.metadata->>'faydaVerified' IS DISTINCT FROM 'true')`);
+        }
+      }
+
+      const rows = await this.dataSource.query<{ id: string }[]>(
+        `SELECT u.id FROM iam.users u WHERE ${conditions.join(' AND ')}`,
+        params,
+      );
+      iamUserIdFilter = rows.map(r => r.id);
+
+      if (iamUserIdFilter.length === 0) {
+        return { items: [], meta: { page, pageSize, total: 0, totalPages: 0 } };
+      }
    }
-    
-    if (verified !== undefined) {
-      where.user = {
-        ...where.user,
-        nationalId: verified ? { not: null } : null,
-      };
+
+    const where: any = {};
+    if (iamUserIdFilter) {
+      where.iamUserId = { in: iamUserIdFilter };
    }
-    
+
    const [items, total] = await Promise.all([
      this.prisma.passenger.findMany({
        where,
@@ -48,42 +81,36 @@ export class PassengersService {
        take: pageSize,
        orderBy: { createdAt: 'desc' },
        include: {
-          user: true,
          loyalty: true,
-          wallet: true,
-          _count: {
-            select: {
-              bookings: true,
-            },
-          },
+          _count: { select: { bookings: true } },
        },
      }),
      this.prisma.passenger.count({ where }),
    ]);
-    
+
+    const iamUserIds = items.map(p => p.iamUserId).filter(Boolean) as string[];
+    const iamRows = iamUserIds.length > 0
+      ? await this.dataSource.query<IamUserRow[]>(
+          `SELECT id, email, name, phone_number, metadata FROM iam.users WHERE id = ANY($1)`,
+          [iamUserIds],
+        )
+      : [];
+    const iamMap = new Map(iamRows.map(r => [r.id, r]));
+
    return {
      items: items.map(passenger => {
-        const user = passenger.user as any;
+        const iam = passenger.iamUserId ? iamMap.get(passenger.iamUserId) : undefined;
+        const faydaVerified = iam?.metadata?.faydaVerified === true || iam?.metadata?.faydaVerified === 'true';
        return {
          id: passenger.id,
-          userId: passenger.userId,
-          fullName: user.fullName,
-          email: user.email,
-      phone: user.phone?.startsWith('+guest-') ? null : user.phone,
-          nationalId: user.nationalId,
-          nationality: user.nationality,
-          dateOfBirth: user.dateOfBirth ?? null,
-          gender: user.gender ?? null,
-          passportNumber: user.passportNumber,
-          passportCountry: user.passportCountry ?? null,
-          verified: !!user.nationalId,
+          fullName: iam?.name?.en ?? iam?.name?.am ?? null,
+          email: iam?.email ?? null,
+          phone: iam?.phone_number ?? null,
+          verified: faydaVerified,
          loyaltyTier: passenger.loyalty?.tier || 'BRONZE',
          loyaltyPoints: passenger.loyalty?.pointsBalance || 0,
          totalBookings: passenger._count.bookings,
          createdAt: passenger.createdAt,
-          updatedAt: user.updatedAt,
-          loyalty: passenger.loyalty,
-          wallet: passenger.wallet,
        };
      }),
      meta: {
@@ -99,33 +126,42 @@ export class PassengersService {
    const passenger = await this.prisma.passenger.findUnique({
      where: { id: passengerId },
      include: {
-        user: true,
-        bookings: { 
-          orderBy: { createdAt: 'desc' }, 
-          take: 10, 
-          include: { 
-            schedule: { include: { originStation: true, destinationStation: true, train: true } }, 
-            seats: { include: { seat: { include: { coach: true } } } } 
-          } 
+        bookings: {
+          orderBy: { createdAt: 'desc' },
+          take: 10,
+          include: {
+            schedule: { include: { originStation: true, destinationStation: true, train: true } },
+            seats: { include: { seat: { include: { coach: true } } } },
+          },
        },
-        loyalty: true, 
-        wallet: true, 
-        travelerProfiles: true, 
+        loyalty: true,
+        wallet: true,
+        travelerProfiles: true,
        savedRoutes: true,
      },
    });
    if (!passenger) throw new NotFoundException('Passenger not found');
+
+    let iamUser: IamUserRow | null = null;
+    if (passenger.iamUserId) {
+      const rows = await this.dataSource.query<IamUserRow[]>(
+        `SELECT id, email, name, phone_number, metadata FROM iam.users WHERE id = $1 LIMIT 1`,
+        [passenger.iamUserId],
+      );
+      iamUser = rows[0] ?? null;
+    }
+
    return {
      id: passenger.id,
-      fullName: passenger.user.fullName,
-      email: passenger.user.email,
-      phone: passenger.user.phone,
+      fullName: iamUser?.name?.en ?? iamUser?.name?.am ?? null,
+      email: iamUser?.email ?? null,
+      phone: iamUser?.phone_number ?? null,
      createdAt: passenger.createdAt,
      bookings: passenger.bookings.map((b) => ({
-        id: b.id, 
-        bookingRef: b.bookingRef, 
-        status: b.status, 
-        totalFare: b.totalMinor / 100, 
+        id: b.id,
+        bookingRef: b.bookingRef,
+        status: b.status,
+        totalFare: b.totalMinor / 100,
        createdAt: b.createdAt,
        trip: {
          number: b.schedule.train.number,
@@ -143,13 +179,9 @@ export class PassengersService {
          },
          departureAt: b.schedule.departureAt,
        },
-        passengers: b.seats.map((bs) => ({ 
-          fullName: bs.passengerName, 
-          seat: { 
-            number: bs.seat.seatNumber, 
-            coach: bs.seat.coach.number, 
-            class: 'N/A' 
-          } 
+        passengers: b.seats.map((bs) => ({
+          fullName: bs.passengerName,
+          seat: { number: bs.seat.seatNumber, coach: bs.seat.coach.number, class: 'N/A' },
        })),
      })),
    };
@@ -229,23 +261,53 @@ export class PassengersService {
  async updatePassenger(id: string, dto: any) {
    const passenger = await this.prisma.passenger.findUnique({ where: { id } });
    if (!passenger) throw new NotFoundException('Passenger not found');
-    return this.prisma.passenger.update({
-      where: { id },
-      data: {
-        user: {
-          update: {
-            fullName: dto.fullName || undefined,
-            email: dto.email || undefined,
-            phone: dto.phone || undefined,
-            nationality: dto.nationality || undefined,
-          },
-        },
-      },
-      include: {
-        user: true,
-        loyalty: true,
-      },
-    });
+
+    if (passenger.iamUserId && (dto.fullName || dto.email || dto.phone)) {
+      const updates: string[] = [];
+      const params: any[] = [];
+      let idx = 1;
+
+      if (dto.fullName) {
+        updates.push(`name = COALESCE(name, '{}') || jsonb_build_object('en', $${idx}::text, 'am', $${idx}::text)`);
+        params.push(dto.fullName);
+        idx++;
+      }
+      if (dto.email) {
+        updates.push(`email = $${idx}`);
+        params.push(dto.email);
+        idx++;
+      }
+      if (dto.phone) {
+        updates.push(`phone_number = $${idx}`);
+        params.push(dto.phone);
+        idx++;
+      }
+
+      params.push(passenger.iamUserId);
+      await this.dataSource.query(
+        `UPDATE iam.users SET ${updates.join(', ')} WHERE id = $${idx}`,
+        params,
+      );
+    }
+
+    const [updated, iamRows] = await Promise.all([
+      this.prisma.passenger.findUnique({ where: { id }, include: { loyalty: true } }),
+      passenger.iamUserId
+        ? this.dataSource.query<IamUserRow[]>(
+            `SELECT id, email, name, phone_number, metadata FROM iam.users WHERE id = $1 LIMIT 1`,
+            [passenger.iamUserId],
+          )
+        : Promise.resolve([] as IamUserRow[]),
+    ]);
+
+    const iamUser = iamRows[0] ?? null;
+    return {
+      id: updated!.id,
+      fullName: iamUser?.name?.en ?? iamUser?.name?.am ?? null,
+      email: iamUser?.email ?? null,
+      phone: iamUser?.phone_number ?? null,
+      loyalty: updated!.loyalty,
+    };
  }

  async registerPassenger(dto: RegisterPassengerDto) {
@@ -274,31 +336,16 @@ export class PassengersService {
    };

    if (isLoggedIn) {
-      const user = await this.prisma.user.findUnique({
-        where: { id: dto.userId },
-        include: { passenger: true },
+      const linkedPassenger = await this.prisma.passenger.findUnique({
+        where: { iamUserId: dto.userId },
      });

-      if (!user) {
-        throw new BadRequestException('User not found');
-      }
-
-      if (!user.faydaVerified && verifiedData) {
-        await this.prisma.user.update({
-          where: { id: dto.userId },
-          data: {
-            fullName: finalData.passengerName,
-            nationality: finalData.nationality,
-            nationalId: dto.nationalId,
-            passportNumber: dto.passportNumber,
-            faydaVerified: !!verifiedData,
-            faydaVerifiedAt: verifiedData ? new Date() : null,
-          },
-        });
+      if (!linkedPassenger) {
+        throw new BadRequestException('Passenger not found');
      }

      return {
-        id: user.passenger?.id || user.id,
+        id: linkedPassenger.id,
        passengerName: finalData.passengerName,
        dateOfBirth: finalData.dateOfBirth,
        nationality: finalData.nationality,
@@ -336,7 +383,9 @@ export class PassengersService {
  async deletePassenger(id: string) {
    const passenger = await this.prisma.passenger.findUnique({ where: { id } });
    if (!passenger) throw new NotFoundException('Passenger not found');
-    return this.prisma.passenger.delete({ where: { id } });
+
+    await this.prisma.passenger.delete({ where: { id } });
+    return { deleted: true, passengerId: id };
  }

  async checkPassengerUsage(id: string) {
--- a/apps/edr-passenger-api/src/modules/payments/payments.controller.ts
+++ b/apps/edr-passenger-api/src/modules/payments/payments.controller.ts
@@ -28,10 +28,8 @@ import {
  PaymentMethodTypeEnum,
  PaymentPlatformDto,
 } from "./payments.dto";
-import { JwtGuard } from "../../common/jwt.guard";
-import { RolesGuard } from "../../common/roles.guard";
-import { Roles } from "../../common/roles.decorator";
-import { UserRole } from "@prisma/client";
+import { PassengerStaff } from "../../common/passenger-guards";
+import { PASSENGER_PERMS } from "../../seed/passenger-permissions.registry";

@ApiTags("Payment")
@Controller("payments")
@@ -39,9 +37,8 @@ export class PaymentsController {
  constructor(private service: PaymentsService) {}

  @Get("all")
-  @UseGuards(JwtGuard, RolesGuard)
-  @Roles(UserRole.ADMIN, UserRole.SUPERVISOR, UserRole.STAFF)
-  @ApiBearerAuth("JWT-auth")
+  @PassengerStaff([PASSENGER_PERMS.payments.viewAll, PASSENGER_PERMS.admin])
+  @ApiBearerAuth("IAM-auth")
  @ApiOperation({ summary: "Get all payments with filters (staff/admin only)" })
  @ApiQuery({ name: "search", required: false })
  @ApiQuery({ name: "status", required: false })
@@ -102,18 +99,16 @@ export class PaymentsController {
  }

  @Post("refund")
-  @UseGuards(JwtGuard, RolesGuard)
-  @Roles(UserRole.ADMIN, UserRole.STAFF, UserRole.AGENT)
-  @ApiBearerAuth("JWT-auth")
+  @PassengerStaff([PASSENGER_PERMS.payments.refund, PASSENGER_PERMS.admin])
+  @ApiBearerAuth("IAM-auth")
  @ApiOperation({ summary: "Refund a confirmed booking (staff/agent only)" })
  refund(@Body() dto: RefundDto) {
    return this.service.refund(dto);
  }

  @Post("methods")
-  @UseGuards(JwtGuard, RolesGuard)
-  @Roles(UserRole.ADMIN, UserRole.STAFF)
-  @ApiBearerAuth("JWT-auth")
+  @PassengerStaff([PASSENGER_PERMS.payments.manageMethods, PASSENGER_PERMS.admin])
+  @ApiBearerAuth("IAM-auth")
  @ApiOperation({
    summary: "Add a payment system to the platform catalog (admin only)",
  })
--- a/apps/edr-passenger-api/src/modules/payments/payments.e2e-spec.ts
+++ b/apps/edr-passenger-api/src/modules/payments/payments.e2e-spec.ts
@@ -23,19 +23,7 @@ describe("Payments E2E", () => {

    prisma = app.get<PrismaService>(PrismaService);

-    const testUser = await prisma.user.create({
-      data: {
-        email: "payment-test@example.com",
-        phone: "+251911111112",
-        fullName: "Payment Test User",
-        passwordHash: "$2b$10$abcdefghijklmnopqrstuvwxyz",
-        role: "PASSENGER",
-      },
-    });
-
-    const passenger = await prisma.passenger.create({
-      data: { userId: testUser.id },
-    });
+    const passenger = await prisma.passenger.create({ data: { iamUserId: 'test-iam-payments-user' } });

    await prisma.walletAccount.create({
      data: {
@@ -151,7 +139,6 @@ describe("Payments E2E", () => {
      prisma.walletLedgerEntry.deleteMany(),
      prisma.walletAccount.deleteMany(),
      prisma.passenger.deleteMany(),
-      prisma.user.deleteMany({ where: { email: "payment-test@example.com" } }),
    ]);
    await app.close();
  });
--- a/apps/edr-passenger-api/src/modules/reports/reports.controller.ts
+++ b/apps/edr-passenger-api/src/modules/reports/reports.controller.ts
@@ -1,33 +1,30 @@
-import { Body, Controller, Get, Param, Post, Query, UseGuards } from '@nestjs/common';
+import { Body, Controller, Get, Param, Post, Query } from '@nestjs/common';
 import { ApiTags, ApiOperation, ApiBearerAuth } from '@nestjs/swagger';
 import { ReportsService } from './reports.service';
 import { GenerateReportDto } from './reports.dto';
-import { IamGuard, IamRoles } from '../../common/iam-adapter';
-import { UserRole } from '@prisma/client';
+import { PassengerStaff } from '../../common/passenger-guards';
+import { PASSENGER_PERMS } from '../../seed/passenger-permissions.registry';

@ApiTags('Reports')
@Controller('reports')
-@UseGuards(IamGuard)
+@PassengerStaff([PASSENGER_PERMS.reports.view, PASSENGER_PERMS.admin])
@ApiBearerAuth('IAM-auth')
 export class ReportsController {
  constructor(private service: ReportsService) {}

  @Post('generate')
-  @IamRoles('ADMIN', 'SUPERVISOR')
  @ApiOperation({ summary: 'Generate operational report' })
  generateReport(@Body() dto: GenerateReportDto) {
    return this.service.generateReport(dto);
  }

  @Get(':reportId')
-  @IamRoles('ADMIN', 'SUPERVISOR')
  @ApiOperation({ summary: 'Get report by ID' })
  getReport(@Param('reportId') reportId: string) {
    return this.service.getReport(reportId);
  }

  @Get()
-  @IamRoles('ADMIN', 'SUPERVISOR')
  @ApiOperation({ summary: 'List reports' })
  listReports(@Query('type') type?: string) {
    return this.service.listReports(type);
--- a/apps/edr-passenger-api/src/modules/reports/reports.service.ts
+++ b/apps/edr-passenger-api/src/modules/reports/reports.service.ts
@@ -1,10 +1,15 @@
 import { Injectable } from '@nestjs/common';
+import { InjectDataSource } from '@nestjs/typeorm';
+import { DataSource } from 'typeorm';
 import { PrismaService } from '../../common/prisma.service';
 import { GenerateReportDto, ReportType } from './reports.dto';

@Injectable()
 export class ReportsService {
-  constructor(private prisma: PrismaService) {}
+  constructor(
+    private prisma: PrismaService,
+    @InjectDataSource() private dataSource: DataSource,
+  ) {}

  async generateReport(dto: GenerateReportDto) {
    const dateFrom = new Date(dto.dateFrom);
@@ -113,13 +118,25 @@ export class ReportsService {
        ...(agentId ? { agentId } : {})
      },
      include: {
-        agent: { include: { user: true } },
+        agent: { select: { id: true, iamUserId: true, agentCode: true } },
        booking: true
      }
    });

+    const iamUserIds = [...new Set(
+      agentBookings.map(ab => ab.agent.iamUserId).filter(Boolean) as string[]
+    )];
+    const iamRows = iamUserIds.length > 0
+      ? await this.dataSource.query<{ id: string; name: { en?: string; am?: string } | null }[]>(
+          `SELECT id, name FROM iam.users WHERE id = ANY($1)`,
+          [iamUserIds],
+        )
+      : [];
+    const iamMap = new Map(iamRows.map(r => [r.id, r]));
+
    const byAgent = agentBookings.reduce((acc, ab) => {
-      const agentName = ab.agent.user.fullName;
+      const iam = ab.agent.iamUserId ? iamMap.get(ab.agent.iamUserId) : undefined;
+      const agentName = iam?.name?.en ?? iam?.name?.am ?? ab.agent.agentCode;
      if (!acc[agentName]) {
        acc[agentName] = { bookings: 0, revenueMinor: 0, cashCollected: 0 };
      }
--- a/apps/edr-passenger-api/src/modules/seats/seats.module.ts
+++ b/apps/edr-passenger-api/src/modules/seats/seats.module.ts
@@ -3,10 +3,9 @@ import { HttpModule } from '@nestjs/axios';
 import { SeatsController } from './seats.controller';
 import { SeatsService } from './seats.service';
 import { SegmentsModule } from '../segments/segments.module';
-import { IamModule } from '../../common/iam.module';

@Module({
-  imports: [SegmentsModule, HttpModule, IamModule],
+  imports: [SegmentsModule, HttpModule],
  controllers: [SeatsController],
  providers: [SeatsService],
  exports: [SeatsService],
--- a/apps/edr-passenger-api/src/modules/tickets/tickets.service.ts
+++ b/apps/edr-passenger-api/src/modules/tickets/tickets.service.ts
@@ -1,4 +1,6 @@
 import { Injectable, NotFoundException, BadRequestException } from '@nestjs/common';
+import { InjectDataSource } from '@nestjs/typeorm';
+import { DataSource } from 'typeorm';
 import { PrismaService } from '../../common/prisma.service';
 import * as QRCode from 'qrcode';

@@ -12,7 +14,10 @@ interface OfflineValidation {

@Injectable()
 export class TicketsService {
-  constructor(private prisma: PrismaService) {}
+  constructor(
+    private readonly prisma: PrismaService,
+    @InjectDataSource() private readonly dataSource: DataSource,
+  ) {}

  async listTickets(filters: { search?: string; status?: string; originStationId?: string; destinationStationId?: string; arrivalDate?: string; skip: number; take: number }) {
    const where: any = {};
@@ -38,50 +43,68 @@ export class TicketsService {
      end.setDate(end.getDate() + 1);
      where.booking = { ...where.booking, schedule: { ...where.booking?.schedule, arrivalAt: { gte: start, lt: end } } };
    }
-    const tickets = await this.prisma.ticket.findMany({
-      where,
-      include: {
-        booking: {
-          include: {
-            schedule: { include: { originStation: true, destinationStation: true, train: true } },
-            returnSchedule: { select: { departureAt: true, arrivalAt: true, originStation: true, destinationStation: true } },
-            seats: { include: { seat: { include: { coach: { include: { coachType: true } } } } } },
-            passenger: { include: { user: true } },
+    const [tickets, total] = await Promise.all([
+      this.prisma.ticket.findMany({
+        where,
+        include: {
+          booking: {
+            include: {
+              schedule: { include: { originStation: true, destinationStation: true, train: true } },
+              returnSchedule: { select: { departureAt: true, arrivalAt: true, originStation: true, destinationStation: true } },
+              seats: { include: { seat: { include: { coach: { include: { coachType: true } } } } } },
+              passenger: { select: { id: true, iamUserId: true } },
+            },
          },
        },
-      },
-      skip: filters.skip,
-      take: filters.take,
-      orderBy: { issuedAt: 'desc' },
-    });
-    const total = await this.prisma.ticket.count({ where });
+        skip: filters.skip,
+        take: filters.take,
+        orderBy: { issuedAt: 'desc' },
+      }),
+      this.prisma.ticket.count({ where }),
+    ]);
+
+    const iamUserIds = tickets.map(t => t.booking.passenger?.iamUserId).filter(Boolean) as string[];
+    const iamRows = iamUserIds.length > 0
+      ? await this.dataSource.query<{ id: string; email: string; name: any; phone_number: string | null }[]>(
+          `SELECT id, email, name, phone_number FROM iam.users WHERE id = ANY($1)`,
+          [iamUserIds],
+        )
+      : [];
+    const iamMap = new Map(iamRows.map(r => [r.id, r]));
+
    return {
-      items: tickets.map((t) => ({
-        id: t.id,
-        ticketNumber: t.barcodePayload,
-        bookingRef: t.bookingRef,
-        booking: {
-          bookingRef: t.booking.bookingRef,
-          status: t.booking.status,
-          bookingType: t.booking.bookingType,
-          returnLegStatus: (t.booking as any).returnLegStatus ?? null,
-          outboundBoardedAt: (t.booking as any).outboundBoardedAt ?? null,
-          returnBoardedAt: (t.booking as any).returnBoardedAt ?? null,
-          totalMinor: t.booking.totalMinor,
-          currency: t.booking.currency,
-          displayCurrency: t.booking.displayCurrency,
-          displayTotalMinor: t.booking.displayTotalMinor,
-          passenger: t.booking.passenger?.user || { fullName: 'Guest', email: t.booking.contactEmail },
-          contactEmail: t.booking.contactEmail,
-          contactPhone: t.booking.contactPhone,
-          returnSchedule: (t.booking as any).returnSchedule ?? null,
-        },
-        schedule: t.booking.schedule,
-        seat: t.booking.seats[0]?.seat,
-        status: t.status,
-        validatedAt: t.validatedAt,
-        createdAt: t.issuedAt,
-      })),
+      items: tickets.map((t) => {
+        const iam = t.booking.passenger?.iamUserId ? iamMap.get(t.booking.passenger.iamUserId) : undefined;
+        const passengerInfo = iam
+          ? { fullName: iam.name?.en ?? iam.name?.am ?? null, email: iam.email, phone: iam.phone_number }
+          : { fullName: 'Guest', email: t.booking.contactEmail, phone: null };
+        return {
+          id: t.id,
+          ticketNumber: t.barcodePayload,
+          bookingRef: t.bookingRef,
+          booking: {
+            bookingRef: t.booking.bookingRef,
+            status: t.booking.status,
+            bookingType: t.booking.bookingType,
+            returnLegStatus: (t.booking as any).returnLegStatus ?? null,
+            outboundBoardedAt: (t.booking as any).outboundBoardedAt ?? null,
+            returnBoardedAt: (t.booking as any).returnBoardedAt ?? null,
+            totalMinor: t.booking.totalMinor,
+            currency: t.booking.currency,
+            displayCurrency: t.booking.displayCurrency,
+            displayTotalMinor: t.booking.displayTotalMinor,
+            passenger: passengerInfo,
+            contactEmail: t.booking.contactEmail,
+            contactPhone: t.booking.contactPhone,
+            returnSchedule: (t.booking as any).returnSchedule ?? null,
+          },
+          schedule: t.booking.schedule,
+          seat: t.booking.seats[0]?.seat,
+          status: t.status,
+          validatedAt: t.validatedAt,
+          createdAt: t.issuedAt,
+        };
+      }),
      total,
      skip: filters.skip,
      take: filters.take,
@@ -390,8 +413,8 @@ export class TicketsService {
      where: { scheduleId: tripId, status: 'CONFIRMED' },
      include: {
        ticket: true,
-        seats: { include: { seat: { include: { coach: { include: { coachType: true } } } } } },
-        passenger: { include: { user: true } },
+        seats: { include: { seat: { include: { coach: true } } } },
+        passenger: { select: { id: true, iamUserId: true } },
      },
    });

--- a/apps/edr-passenger-api/src/modules/verifayda/optional-jwt.guard.ts
+++ b/apps/edr-passenger-api/src/modules/verifayda/optional-jwt.guard.ts
@@ -1,21 +1,30 @@
-import { Injectable } from '@nestjs/common';
-import { AuthGuard } from '@nestjs/passport';
+import { CanActivate, ExecutionContext, Injectable } from '@nestjs/common';
+import { Reflector } from '@nestjs/core';
+import { InjectDataSource } from '@nestjs/typeorm';
+import { JwtGuard as IamJwtGuard } from '@tria-plc/api-common/modules/auth/services/jwt.guard';
+import { DataSource } from 'typeorm';

 /**
- * Like {@link JwtGuard}, but never rejects the request.
+ * Like the IAM JwtGuard, but never rejects the request.
 *
- * When a valid `Authorization: Bearer <jwt>` is present, `request.user` is
- * populated from the JWT strategy (`{ userId, ... }`). When the token is
- * missing or invalid, the request still proceeds with `request.user`
- * undefined — the handler decides what to do.
- *
- * Used on `POST /fayda/verification/start`, which must work for both
- * logged-in users (who can opt to save the verification to their account)
- * and guests (anchored to a booking only).
+ * When a valid IAM bearer token is present, `request.user` is populated with
+ * the package `TCurrentUser`. Missing or invalid tokens continue as guests.
 */
@Injectable()
-export class OptionalJwtGuard extends AuthGuard('jwt') {
-  handleRequest<TUser = unknown>(_err: unknown, user: TUser): TUser {
-    return (user ?? null) as TUser;
+export class OptionalJwtGuard extends IamJwtGuard implements CanActivate {
+  constructor(
+    reflector: Reflector,
+    @InjectDataSource() dataSource: DataSource,
+  ) {
+    super(reflector, dataSource);
+  }
+
+  async canActivate(context: ExecutionContext): Promise<boolean> {
+    try {
+      await super.canActivate(context);
+    } catch {
+      context.switchToHttp().getRequest().user = undefined;
+    }
+    return true;
  }
 }
--- a/apps/edr-passenger-api/src/modules/verifayda/verifayda.controller.ts
+++ b/apps/edr-passenger-api/src/modules/verifayda/verifayda.controller.ts
@@ -15,6 +15,7 @@ import {
  ApiOperation,
  ApiTags,
 } from '@nestjs/swagger';
+import type { TCurrentUser } from '@tria-plc/api-common/modules/auth/types/current-user.type';
 import { JwtGuard } from '../../common/jwt.guard';
 import { OptionalJwtGuard } from './optional-jwt.guard';
 import {
@@ -25,21 +26,13 @@ import {
 } from './verifayda.dto';
 import { VerifaydaService } from './verifayda.service';

-/** Shape the JWT strategy puts on `request.user` (see common/jwt.strategy.ts). */
-interface AuthedUser {
-  userId: string;
-  email?: string;
-  role?: string;
-  passengerId?: string;
-}
-
 /** Minimal slices of the Express req we touch (avoids a hard dependency on
 * `@types/express`, which isn't resolved in this package). */
 interface RequestWithOptionalUser {
-  user?: AuthedUser;
+  user?: TCurrentUser;
 }
 interface RequestWithUser {
-  user: AuthedUser;
+  user: TCurrentUser;
 }

@ApiTags('Fayda Verification')
@@ -76,7 +69,7 @@ export class VerifaydaController {
    const authorizationUrl = await this.service.startVerification({
      purpose: dto.purpose ?? 'VERIFY',
      platform: dto.platform ?? 'WEB',
-      userId: req.user?.userId,
+      userId: req.user?.id,
    });
    return { authorizationUrl };
  }
@@ -105,6 +98,6 @@ export class VerifaydaController {
  async status(
    @Req() req: RequestWithUser,
  ): Promise<VerificationStatusDto> {
-    return this.service.getVerificationStatus(req.user.userId);
+    return this.service.getVerificationStatus(req.user.id);
  }
 }
--- a/apps/edr-passenger-api/src/modules/verifayda/verifayda.module.ts
+++ b/apps/edr-passenger-api/src/modules/verifayda/verifayda.module.ts
@@ -2,12 +2,9 @@ import { Module } from '@nestjs/common';
 import { VerifaydaController } from './verifayda.controller';
 import { VerifaydaService } from './verifayda.service';
 import { PrismaModule } from '../../common/prisma.module';
-import { AuthModule } from '../auth/auth.module';

@Module({
-  // AuthModule re-exports JwtModule, giving us JwtService (same secret/expiry
-  // config as /auth/login) to mint tokens for the LOGIN flow.
-  imports: [PrismaModule, AuthModule],
+  imports: [PrismaModule],
  controllers: [VerifaydaController],
  providers: [VerifaydaService],
  exports: [VerifaydaService],
--- a/apps/edr-passenger-api/src/modules/verifayda/verifayda.service.spec.ts
+++ b/apps/edr-passenger-api/src/modules/verifayda/verifayda.service.spec.ts
@@ -1,5 +1,4 @@
 import { ConfigService } from '@nestjs/config';
-import { JwtService } from '@nestjs/jwt';
 import { exportJWK, generateKeyPair, type JWK } from 'jose';
 import { PrismaService } from '../../common/prisma.service';
 import { FaydaConfig } from '../../config/fayda.config';
@@ -16,12 +15,6 @@ function buildPrismaMock() {
    bookingSeat: {
      updateMany: jest.fn(),
    },
-    user: {
-      findUnique: jest.fn(),
-      findFirst: jest.fn(),
-      create: jest.fn(),
-      update: jest.fn(),
-    },
    passenger: { create: jest.fn() },
    loyaltyAccount: { create: jest.fn() },
    walletAccount: { create: jest.fn() },
@@ -30,10 +23,8 @@ function buildPrismaMock() {
  };
 }

-function buildJwtMock(): jest.Mocked<JwtService> {
-  return {
-    sign: jest.fn(() => 'signed.jwt.token'),
-  } as unknown as jest.Mocked<JwtService>;
+function buildDataSourceMock() {
+  return { query: jest.fn().mockResolvedValue([]) };
 }

 function buildConfig(overrides?: Partial<FaydaConfig>): FaydaConfig {
@@ -65,7 +56,7 @@ function buildConfigService(faydaConfig: FaydaConfig): jest.Mocked<ConfigService

 describe('VerifaydaService (OIDC, client-callback)', () => {
  let prisma: ReturnType<typeof buildPrismaMock>;
-  let jwt: jest.Mocked<JwtService>;
+  let dataSource: ReturnType<typeof buildDataSourceMock>;
  let service: VerifaydaService;
  let realPrivateJwk: JWK;

@@ -77,12 +68,12 @@ describe('VerifaydaService (OIDC, client-callback)', () => {

  beforeEach(() => {
    prisma = buildPrismaMock();
-    jwt = buildJwtMock();
+    dataSource = buildDataSourceMock();
    const cfg = buildConfig({ privateJwk: realPrivateJwk as FaydaConfig['privateJwk'] });
    service = new VerifaydaService(
      buildConfigService(cfg),
      prisma as unknown as PrismaService,
-      jwt,
+      dataSource as any,
    );
    (global as any).fetch = jest.fn();
  });
@@ -135,7 +126,7 @@ describe('VerifaydaService (OIDC, client-callback)', () => {
      const disabledService = new VerifaydaService(
        buildConfigService(buildConfig({ enabled: false })),
        prisma as unknown as PrismaService,
-        jwt,
+        buildDataSourceMock() as any,
      );
      await expect(
        disabledService.startVerification({ purpose: 'VERIFY' }),
@@ -154,7 +145,7 @@ describe('VerifaydaService (OIDC, client-callback)', () => {
        status: 'PENDING',
        errorCode: null,
        errorDescription: null,
-        userId: null,
+        iamUserId: null,
        expiresAt: new Date(Date.now() + 60_000),
        ...overrides,
      };
@@ -215,7 +206,7 @@ describe('VerifaydaService (OIDC, client-callback)', () => {
        purpose: 'VERIFY',
        platform: 'WEB',
        status: 'PENDING',
-        userId: null,
+        iamUserId: null,
        expiresAt: new Date(Date.now() + 60_000),
        ...overrides,
      };
@@ -270,7 +261,6 @@ describe('VerifaydaService (OIDC, client-callback)', () => {
      expect(result.token).toBeUndefined();
      expect(result.user).toBeUndefined();
      expect(prisma.bookingSeat.updateMany).not.toHaveBeenCalled();
-      expect(prisma.user.update).not.toHaveBeenCalled();
    });

    it('throws 502 when the token endpoint returns 4xx', async () => {
@@ -337,7 +327,7 @@ describe('VerifaydaService (OIDC, client-callback)', () => {
        purpose: 'LOGIN',
        platform: 'WEB',
        status: 'PENDING',
-        userId: null,
+        iamUserId: null,
        expiresAt: new Date(Date.now() + 60_000),
        ...overrides,
      };
@@ -363,139 +353,41 @@ describe('VerifaydaService (OIDC, client-callback)', () => {
      (global as any).fetch = jest.fn(() => Promise.resolve(queue.shift()));
    }

-    /** user.findUnique answers the faydaSub lookup and the issueLoginToken id lookup. */
-    function mockUserFindUnique(bySub: any, fullUser: any) {
-      prisma.user.findUnique.mockImplementation(async (args: any) => {
-        if (args?.where?.faydaSub !== undefined) return bySub;
-        if (args?.where?.id !== undefined) return fullUser;
-        return null;
-      });
-    }
-
    beforeEach(() => {
      prisma.faydaVerificationSession.findUnique.mockResolvedValue(loginSession());
    });

-    it('creates a new user when no match and returns { token, user }', async () => {
-      const fullUser = {
-        id: 'new-user',
-        email: 'new@example.com',
-        role: 'PASSENGER',
-        passenger: { id: 'p-new' },
-        agent: null,
-      };
-      mockUserFindUnique(null, fullUser);
-      prisma.user.findFirst.mockResolvedValue(null);
-      prisma.user.create.mockResolvedValue({ id: 'new-user' });
-      prisma.passenger.create.mockResolvedValue({ id: 'p-new' });
-      prisma.loyaltyAccount.create.mockResolvedValue({});
-      prisma.walletAccount.create.mockResolvedValue({});
-      prisma.userPreferences.create.mockResolvedValue({});
-      prisma.faydaVerificationSession.update.mockResolvedValue({});
-
+    it('always rejects with FAYDA_LOGIN_MIGRATED_TO_IAM (401)', async () => {
      mockLoginFetch({ sub: 'login-sub-1', name: 'New Person', email: 'new@example.com' });
-
-      const result = await service.completeVerification({
-        code: 'c',
-        state: 'state-login',
-      });
-
-      expect(result).toMatchObject({
-        purpose: 'LOGIN',
-        verified: true,
-        token: 'signed.jwt.token',
-        user: { id: 'new-user', passengerId: 'p-new' },
-      });
-      expect(prisma.user.create).toHaveBeenCalledWith(
-        expect.objectContaining({
-          data: expect.objectContaining({
-            faydaSub: 'login-sub-1',
-            faydaVerified: true,
-            email: 'new@example.com',
-          }),
-        }),
-      );
-      expect(prisma.passenger.create).toHaveBeenCalled();
-      expect(jwt.sign).toHaveBeenCalledWith(
-        expect.objectContaining({ sub: 'new-user', passengerId: 'p-new' }),
-      );
-    });
-
-    it('logs in an existing user already linked by faydaSub', async () => {
-      const fullUser = {
-        id: 'known-user',
-        email: 'k@example.com',
-        role: 'PASSENGER',
-        passenger: { id: 'p-k' },
-        agent: null,
-      };
-      mockUserFindUnique({ id: 'known-user' }, fullUser);
-      prisma.faydaVerificationSession.update.mockResolvedValue({});
-
-      mockLoginFetch({ sub: 'login-sub-2', name: 'Known' });
-
-      const result = await service.completeVerification({
-        code: 'c',
-        state: 'state-login',
-      });
-
-      expect(result.user?.id).toBe('known-user');
-      expect(prisma.user.create).not.toHaveBeenCalled();
-    });
-
-    it('links Fayda to an existing account matched by email', async () => {
-      const fullUser = {
-        id: 'acc-1',
-        email: 'match@example.com',
-        role: 'PASSENGER',
-        passenger: { id: 'p-1' },
-        agent: null,
-      };
-      mockUserFindUnique(null, fullUser);
-      prisma.user.findFirst.mockResolvedValue({ id: 'acc-1', faydaSub: null });
-      prisma.user.update.mockResolvedValue({});
-      prisma.faydaVerificationSession.update.mockResolvedValue({});
-
-      mockLoginFetch({ sub: 'login-sub-3', email: 'match@example.com' });
-
-      const result = await service.completeVerification({
-        code: 'c',
-        state: 'state-login',
-      });
-
-      expect(result.user?.id).toBe('acc-1');
-      expect(prisma.user.update).toHaveBeenCalledWith(
-        expect.objectContaining({
-          where: { id: 'acc-1' },
-          data: expect.objectContaining({ faydaSub: 'login-sub-3' }),
-        }),
-      );
-      expect(prisma.user.create).not.toHaveBeenCalled();
-    });
-
-    it('throws identity_conflict (409) when matched account has a different faydaSub', async () => {
-      mockUserFindUnique(null, null);
-      prisma.user.findFirst.mockResolvedValue({ id: 'acc-2', faydaSub: 'someone-else' });
      prisma.faydaVerificationSession.updateMany.mockResolvedValue({ count: 1 });

-      mockLoginFetch({ sub: 'login-sub-4', email: 'match@example.com' });
-
      await expect(
        service.completeVerification({ code: 'c', state: 'state-login' }),
-      ).rejects.toMatchObject({ status: 409 });
-      expect(prisma.user.update).not.toHaveBeenCalled();
-      expect(prisma.user.create).not.toHaveBeenCalled();
+      ).rejects.toMatchObject({
+        status: 401,
+        response: expect.objectContaining({ code: 'FAYDA_LOGIN_MIGRATED_TO_IAM' }),
+      });
+    });
+
+    it('does not touch the database for LOGIN purpose', async () => {
+      mockLoginFetch({ sub: 'login-sub-2', name: 'Person' });
+      prisma.faydaVerificationSession.updateMany.mockResolvedValue({ count: 1 });
+
+      await expect(
+        service.completeVerification({ code: 'c', state: 'state-login' }),
+      ).rejects.toMatchObject({ status: 401 });
+      expect(dataSource.query).not.toHaveBeenCalled();
+      expect(prisma.passenger.create).not.toHaveBeenCalled();
    });
  });

  describe('getVerificationStatus', () => {
-    it('returns verified=true when User row has the flag', async () => {
-      prisma.user.findUnique.mockResolvedValue({
-        faydaVerified: true,
-        faydaVerifiedAt: new Date('2026-01-01T00:00:00Z'),
-        fullName: 'Test User',
-      });
-      const result = await service.getVerificationStatus('user-1');
+    it('returns verified=true when IAM user metadata has the flag', async () => {
+      dataSource.query.mockResolvedValueOnce([{
+        metadata: { faydaVerified: true, faydaVerifiedAt: '2026-01-01T00:00:00.000Z' },
+        name: { en: 'Test User', am: 'ቴስት ዩዘር' },
+      }]);
+      const result = await service.getVerificationStatus('iam-user-1');
      expect(result).toEqual({
        verified: true,
        verifiedAt: new Date('2026-01-01T00:00:00Z'),
@@ -503,9 +395,9 @@ describe('VerifaydaService (OIDC, client-callback)', () => {
      });
    });

-    it('returns verified=false when User row is missing or unverified', async () => {
-      prisma.user.findUnique.mockResolvedValue(null);
-      const result = await service.getVerificationStatus('user-x');
+    it('returns verified=false when IAM user is missing or unverified', async () => {
+      dataSource.query.mockResolvedValueOnce([]);
+      const result = await service.getVerificationStatus('iam-user-x');
      expect(result).toEqual({ verified: false });
    });
  });
--- a/apps/edr-passenger-api/src/modules/verifayda/verifayda.service.ts
+++ b/apps/edr-passenger-api/src/modules/verifayda/verifayda.service.ts
@@ -6,10 +6,9 @@ import {
  UnauthorizedException,
 } from '@nestjs/common';
 import { ConfigService } from '@nestjs/config';
-import { JwtService } from '@nestjs/jwt';
+import { InjectDataSource } from '@nestjs/typeorm';
+import { DataSource } from 'typeorm';
 import axios, { AxiosInstance } from 'axios';
-import * as bcrypt from 'bcrypt';
-import { randomBytes } from 'crypto';
 import { PrismaService } from '../../common/prisma.service';
 import { FaydaConfig, FaydaPlatform } from '../../config/fayda.config';
 import {
@@ -20,7 +19,6 @@ import {
 import { generateClientAssertion } from './utils/client-assertion.util';
 import { VerifaydaCallbackDto, VerificationStatusDto } from './verifayda.dto';
 import {
-  FaydaIdentityConflictException,
  FaydaTokenExchangeException,
  FaydaUserInfoException,
 } from './verifayda.errors';
@@ -48,7 +46,7 @@ export interface VerifaydaVerificationResult {
 export interface StartVerificationInput {
  purpose: VerifaydaPurpose;
  platform?: FaydaPlatform;
-  userId?: string;
+  userId?: string;   // iamUserId of the authenticated user, if any
 }

 export interface FaydaUserSummary {
@@ -91,7 +89,7 @@ export class VerifaydaService {
  constructor(
    private readonly config: ConfigService,
    private readonly prisma: PrismaService,
-    private readonly jwt: JwtService,
+    @InjectDataSource() private readonly dataSource: DataSource,
  ) {
    const fayda = this.config.get<FaydaConfig>('fayda');
    if (!fayda) {
@@ -146,7 +144,7 @@ export class VerifaydaService {
        codeVerifier,
        purpose: input.purpose,
        platform: input.platform ?? 'WEB',
-        userId: input.userId ?? null,
+        iamUserId: input.userId ?? null,
        expiresAt,
      },
    });
@@ -257,52 +255,25 @@ export class VerifaydaService {
    }
  }

-  /** Loads a user (+ relations) and mints the same JWT shape as `/auth/login`. */
  private async issueLoginToken(
-    userId: string,
+    _userId: string,
  ): Promise<{ token: string; user: FaydaUserSummary }> {
-    const user = await this.prisma.user.findUnique({
-      where: { id: userId },
-      include: { passenger: true, agent: true },
+    throw new UnauthorizedException({
+      code: 'FAYDA_LOGIN_MIGRATED_TO_IAM',
+      message: 'Fayda login tokens are issued by the IAM package auth endpoints.',
    });
-    if (!user) {
-      // Should not happen — we just resolved/created this user.
-      throw new UnauthorizedException({
-        code: 'FAYDA_LOGIN_FAILED',
-        message: 'Could not load the verified user',
-      });
-    }
-
-    const summary: FaydaUserSummary = {
-      id: user.id,
-      email: user.email,
-      role: user.role,
-      passengerId: user.passenger?.id,
-      agentId: user.agent?.id,
-    };
-    const token = this.jwt.sign({
-      sub: summary.id,
-      email: summary.email,
-      role: summary.role,
-      passengerId: summary.passengerId,
-      agentId: summary.agentId,
-    });
-
-    this.logger.log(`Fayda login issued token for user ${user.id}`);
-    return { token, user: summary };
  }

-  async getVerificationStatus(userId: string): Promise<VerificationStatusDto> {
-    const user = await this.prisma.user.findUnique({
-      where: { id: userId },
-      select: { faydaVerified: true, faydaVerifiedAt: true, fullName: true },
-    });
-
-    return {
-      verified: user?.faydaVerified ?? false,
-      verifiedAt: user?.faydaVerifiedAt ?? undefined,
-      fullName: user?.fullName ?? undefined,
-    };
+  async getVerificationStatus(iamUserId: string): Promise<VerificationStatusDto> {
+    const rows = await this.dataSource.query<{ metadata: Record<string, any> | null; name: { en: string; am: string } | null }[]>(
+      `SELECT metadata, name FROM iam.users WHERE id = $1 LIMIT 1`,
+      [iamUserId],
+    );
+    const iam = rows[0] ?? null;
+    const faydaVerified = iam?.metadata?.faydaVerified === true || iam?.metadata?.faydaVerified === 'true';
+    const faydaVerifiedAt = iam?.metadata?.faydaVerifiedAt ? new Date(iam.metadata.faydaVerifiedAt) : undefined;
+    const fullName = iam?.name?.en ?? iam?.name?.am ?? undefined;
+    return { verified: faydaVerified, verifiedAt: faydaVerifiedAt, fullName };
  }

  // ==========================================================================
@@ -428,106 +399,16 @@ export class VerifaydaService {
    };
  }

-  /**
-   * Resolves the User for a LOGIN flow and returns its id (the caller mints the
-   * JWT via {@link issueLoginToken}). Resolution order:
-   *   1. Existing user already linked to this Fayda `sub`.
-   *   2. Existing account whose email/phone matches — linked to this `sub`.
-   *   3. Otherwise a fresh Fayda-backed account is created.
-   */
+  // LOGIN via Fayda is now handled entirely by the IAM package's own OIDC flow.
+  // This method is kept as a stub so completeVerification() still compiles;
+  // it throws immediately without touching the database.
  private async handleLoginSuccess(
-    normalized: NormalizedFaydaUserInfo,
+    _normalized: NormalizedFaydaUserInfo,
  ): Promise<{ userId: string }> {
-    let userId: string;
-
-    const bySub = await this.prisma.user.findUnique({
-      where: { faydaSub: normalized.sub },
-      select: { id: true },
+    throw new UnauthorizedException({
+      code: 'FAYDA_LOGIN_MIGRATED_TO_IAM',
+      message: 'Fayda login tokens are issued by the IAM package at /v1/auth/fayda endpoints.',
    });
-
-    if (bySub) {
-      userId = bySub.id;
-    } else {
-      const matchers: Array<{ email?: string; phone?: string }> = [];
-      if (normalized.email) matchers.push({ email: normalized.email });
-      if (normalized.phoneNumber) matchers.push({ phone: normalized.phoneNumber });
-
-      const existing = matchers.length
-        ? await this.prisma.user.findFirst({
-            where: { OR: matchers },
-            select: { id: true, faydaSub: true },
-          })
-        : null;
-
-      if (existing) {
-        if (existing.faydaSub && existing.faydaSub !== normalized.sub) {
-          // The matched account is already tied to a different Fayda identity.
-          throw new FaydaIdentityConflictException();
-        }
-        await this.prisma.user.update({
-          where: { id: existing.id },
-          data: {
-            faydaSub: normalized.sub,
-            faydaVerified: true,
-            faydaVerifiedAt: new Date(),
-          },
-        });
-        userId = existing.id;
-        this.logger.log(`Fayda login linked existing user ${existing.id}`);
-      } else {
-        userId = await this.createFaydaUser(normalized);
-        this.logger.log(`Fayda login created new user ${userId}`);
-      }
-    }
-
-    return { userId };
-  }
-
-  /**
-   * Creates a Fayda-backed User plus the same satellite rows registration makes
-   * (Passenger, LoyaltyAccount, WalletAccount, UserPreferences).
-   *
-   * The user has no password — `passwordHash` is set to a bcrypt of random bytes
-   * so password login is impossible; they authenticate only via Fayda. When
-   * Fayda doesn't supply an email/phone, a deterministic placeholder derived from
-   * the (unique) `sub` keeps the NOT NULL + unique columns satisfied.
-   */
-  private async createFaydaUser(
-    normalized: NormalizedFaydaUserInfo,
-  ): Promise<string> {
-    const passwordHash = await bcrypt.hash(
-      randomBytes(32).toString('hex'),
-      10,
-    );
-    const email = normalized.email ?? `fayda_${normalized.sub}@users.fayda.local`;
-    const phone = normalized.phoneNumber ?? `fayda:${normalized.sub}`;
-    const fullName = normalized.fullName ?? 'Fayda User';
-
-    const user = await this.prisma.user.create({
-      data: {
-        fullName,
-        email,
-        phone,
-        passwordHash,
-        faydaVerified: true,
-        faydaVerifiedAt: new Date(),
-        faydaSub: normalized.sub,
-      },
-      select: { id: true },
-    });
-    const passenger = await this.prisma.passenger.create({
-      data: { userId: user.id },
-      select: { id: true },
-    });
-    await this.prisma.loyaltyAccount.create({
-      data: { passengerId: passenger.id },
-    });
-    await this.prisma.walletAccount.create({
-      data: { passengerId: passenger.id },
-    });
-    await this.prisma.userPreferences.create({ data: { userId: user.id } });
-
-    return user.id;
  }

  private async markSessionFailed(
@@ -548,7 +429,6 @@ export class VerifaydaService {
  }

  private classifyFailureReason(err: unknown): string {
-    if (err instanceof FaydaIdentityConflictException) return 'identity_conflict';
    if (err instanceof FaydaTokenExchangeException) return 'token_exchange_failed';
    if (err instanceof FaydaUserInfoException) return 'userinfo_failed';
    return 'verification_failed';
@@ -565,9 +445,8 @@ export class VerifaydaService {
  ): Promise<VerifaydaVerificationResult> {
    this.logger.log(`verifyNationalId called: stubEnabled=${this.stubEnabled}, type=${typeof this.stubEnabled}`);
    
-    if (this.stubEnabled != false || this.stubEnabled) {
-      this.logger.warn('Verifayda stub is disabled - returning mock data (development mode)');
-      // In development mode, return mock verified data
+    if (!this.stubEnabled) {
+      this.logger.warn('Verifayda not configured — returning mock data (development mode)');
      return {
        verified: true,
        passengerData: {
--- a/apps/edr-passenger-api/src/seed/edr-passenger-org.seeder.ts
+++ b/apps/edr-passenger-api/src/seed/edr-passenger-org.seeder.ts
@@ -0,0 +1,165 @@
+import { Injectable, Logger } from '@nestjs/common';
+import {
+  Application,
+  Organization,
+  OrganizationConfiguration,
+  Permission,
+  Role,
+  RolePermission,
+} from '@tria-plc/iamapi-common';
+import { DataSource, EntityManager, In } from 'typeorm';
+import { ERoleKey } from '@tria-plc/api-common/utils/enums/seed.enum';
+import {
+  PASSENGER_PERMISSIONS,
+  PASSENGER_PERMISSION_KEYS,
+} from './passenger-permissions.registry';
+import { EDR_PASSENGER_APPLICATION, EDR_PASSENGER_ROLES, type PassengerSeedRole } from './edr-passenger.seed';
+
+const EDR_ORG_KEY = 'edr';
+const EDR_ORG_NAME = { am: 'EDR', en: 'EDR' };
+const SEED_FLAG = 'SEED_EDR_PASSENGER_ORG';
+
+type SeedOrganization = { id: string; key: string };
+
+@Injectable()
+export class EdrPassengerOrgSeeder {
+  private readonly logger = new Logger(EdrPassengerOrgSeeder.name);
+
+  constructor(private readonly dataSource: DataSource) {}
+
+  async run() {
+    if (process.env[SEED_FLAG]?.trim().toLowerCase() !== 'true') {
+      this.logger.log(`Skipping passenger org seed because ${SEED_FLAG} is not enabled`);
+      return;
+    }
+
+    await this.dataSource.transaction(async (manager) => {
+      await this.ensureApplication(manager);
+      await this.ensurePermissions(manager);
+      const organization = await this.ensureOrganization(manager);
+      await this.ensureOrganizationConfiguration(manager, organization.id);
+      await this.ensureRoles(manager, EDR_PASSENGER_ROLES);
+      await this.ensureRolePermissions(manager, EDR_PASSENGER_ROLES);
+      await this.ensureSuperAdminPermissions(manager);
+    });
+
+    this.logger.log(`Ensured EDR passenger organization seed for '${EDR_ORG_KEY}'`);
+  }
+
+  private async ensureApplication(manager: EntityManager) {
+    await manager.getRepository(Application).upsert(
+      {
+        id: EDR_PASSENGER_APPLICATION.id,
+        key: EDR_PASSENGER_APPLICATION.key,
+        name: EDR_PASSENGER_APPLICATION.name,
+      },
+      { conflictPaths: { key: true } },
+    );
+    this.logger.log(`Ensured application '${EDR_PASSENGER_APPLICATION.key}'`);
+  }
+
+  private async ensurePermissions(manager: EntityManager) {
+    await manager.getRepository(Permission).upsert(
+      PASSENGER_PERMISSIONS.map((p) => ({
+        id: p.id,
+        key: p.key,
+        name: p.name,
+        applicationId: EDR_PASSENGER_APPLICATION.id,
+      })),
+      { conflictPaths: { key: true } },
+    );
+    this.logger.log(`Ensured ${PASSENGER_PERMISSIONS.length} passenger permissions`);
+  }
+
+  private async ensureOrganization(manager: EntityManager): Promise<SeedOrganization> {
+    const repo = manager.getRepository(Organization);
+    let org = await repo.findOne({ where: { key: EDR_ORG_KEY }, select: { id: true, key: true } });
+
+    if (!org) {
+      const result = await repo.insert({
+        key: EDR_ORG_KEY,
+        name: EDR_ORG_NAME,
+        isGovernmentOrganization: true,
+      });
+      this.logger.log(`Seeded EDR passenger organization '${EDR_ORG_KEY}'`);
+      return { id: result.identifiers[0]?.id as string, key: EDR_ORG_KEY };
+    }
+
+    this.logger.log(`Ensured EDR passenger organization '${EDR_ORG_KEY}'`);
+    return { id: org.id as string, key: EDR_ORG_KEY };
+  }
+
+  private async ensureOrganizationConfiguration(manager: EntityManager, organizationId: string) {
+    await manager.getRepository(OrganizationConfiguration).upsert(
+      { organizationId, canCreateBranchByItself: true, canStartReceivingRecord: true },
+      { conflictPaths: { organizationId: true } },
+    );
+    this.logger.log(`Ensured organization configuration for '${EDR_ORG_KEY}'`);
+  }
+
+  private async ensureRoles(manager: EntityManager, seedRoles: PassengerSeedRole[]) {
+    await manager.getRepository(Role).upsert(
+      seedRoles.map(({ key, name }) => ({ key, name })),
+      { conflictPaths: { key: true } },
+    );
+    this.logger.log(`Ensured passenger roles: ${seedRoles.map((r) => r.key).join(', ')}`);
+  }
+
+  private async ensureRolePermissions(manager: EntityManager, seedRoles: PassengerSeedRole[]) {
+    const allPermissionKeys = [...new Set(seedRoles.flatMap((r) => r.permissionKeys))];
+    if (!allPermissionKeys.length) return;
+
+    const roles = await manager.getRepository(Role).find({
+      where: { key: In(seedRoles.map((r) => r.key)) },
+      select: { id: true, key: true },
+    });
+    const permissions = await manager.getRepository(Permission).find({
+      where: { key: In(allPermissionKeys) },
+      select: { id: true, key: true },
+    });
+
+    const roleByKey = new Map(roles.map((r) => [r.key, r]));
+    const permByKey = new Map(permissions.map((p) => [p.key, p]));
+
+    const links = seedRoles.flatMap((seedRole) => {
+      const role = roleByKey.get(seedRole.key);
+      if (!role) throw new Error(`missing_role:${seedRole.key}`);
+
+      return seedRole.permissionKeys.map((key) => {
+        const perm = permByKey.get(key);
+        if (!perm) throw new Error(`missing_permission:${key}`);
+        return { roleId: role.id, permissionId: perm.id };
+      });
+    });
+
+    await manager.getRepository(RolePermission).upsert(links, {
+      conflictPaths: { roleId: true, permissionId: true },
+    });
+    this.logger.log(`Ensured ${links.length} passenger role-permission links`);
+  }
+
+  private async ensureSuperAdminPermissions(manager: EntityManager) {
+    const role = await manager.getRepository(Role).findOne({
+      where: { key: ERoleKey.SUPER_ADMIN },
+      select: { id: true, key: true },
+    });
+
+    if (!role) {
+      this.logger.warn(`Role ${ERoleKey.SUPER_ADMIN} not found; skipping super_admin permission links`);
+      return;
+    }
+
+    const permissions = await manager.getRepository(Permission).find({
+      where: { key: In(PASSENGER_PERMISSION_KEYS) },
+      select: { id: true, key: true },
+    });
+
+    if (!permissions.length) return;
+
+    await manager.getRepository(RolePermission).upsert(
+      permissions.map((p) => ({ roleId: role.id, permissionId: p.id })),
+      { conflictPaths: { roleId: true, permissionId: true } },
+    );
+    this.logger.log(`Ensured ${permissions.length} passenger permissions on super_admin`);
+  }
+}
--- a/apps/edr-passenger-api/src/seed/edr-passenger.seed.ts
+++ b/apps/edr-passenger-api/src/seed/edr-passenger.seed.ts
@@ -0,0 +1,47 @@
+import {
+  PASSENGER_PERMISSIONS,
+  PASSENGER_PERMISSION_KEYS,
+  ROLE_PERMISSION_PRESETS,
+} from './passenger-permissions.registry';
+
+export type PassengerSeedRole = {
+  key: string;
+  name: { en: string };
+  permissionKeys: string[];
+};
+
+export const EDR_PASSENGER_APPLICATION = {
+  id: 'd2000001-0001-4000-8000-000000000001',
+  key: 'edr_passenger_app',
+  name: {
+    am: 'EDR Passenger App',
+    en: 'EDR Passenger App',
+  },
+} as const;
+
+export const EDR_PASSENGER_PERMISSIONS = [...PASSENGER_PERMISSIONS];
+
+export { PASSENGER_PERMISSION_KEYS } from './passenger-permissions.registry';
+
+export const EDR_PASSENGER_ROLES: PassengerSeedRole[] = [
+  {
+    key: 'edr_passenger_backoffice_admin',
+    name: { en: 'EDR Passenger Backoffice Admin' },
+    permissionKeys: [...ROLE_PERMISSION_PRESETS.backofficeAdmin],
+  },
+  {
+    key: 'edr_passenger_backoffice_staff',
+    name: { en: 'EDR Passenger Backoffice Staff' },
+    permissionKeys: [...ROLE_PERMISSION_PRESETS.backofficeStaff],
+  },
+  {
+    key: 'edr_passenger_agent',
+    name: { en: 'EDR Passenger Agent' },
+    permissionKeys: [...ROLE_PERMISSION_PRESETS.agent],
+  },
+  {
+    key: 'edr_passenger_finance',
+    name: { en: 'EDR Passenger Finance' },
+    permissionKeys: [...ROLE_PERMISSION_PRESETS.finance],
+  },
+];
--- a/apps/edr-passenger-api/src/seed/passenger-permissions.registry.ts
+++ b/apps/edr-passenger-api/src/seed/passenger-permissions.registry.ts
@@ -0,0 +1,121 @@
+const APP_KEY = 'edr_passenger_app';
+
+export type PassengerPermissionSeed = {
+  id: string;
+  key: string;
+  name: { am: string; en: string };
+  applicationKey: string;
+};
+
+const perm = (id: string, key: string, en: string): PassengerPermissionSeed => ({
+  id,
+  key,
+  name: { am: en, en },
+  applicationKey: APP_KEY,
+});
+
+export const PASSENGER_PERMISSIONS: PassengerPermissionSeed[] = [
+  perm('c1000001-0001-4000-8000-000000000001', 'edr_passenger_app:bookings:view',              'View bookings'),
+  perm('c1000001-0001-4000-8000-000000000002', 'edr_passenger_app:bookings:manage',            'Manage bookings'),
+  perm('c1000001-0001-4000-8000-000000000003', 'edr_passenger_app:bookings:cancel',            'Cancel bookings'),
+  perm('c1000001-0001-4000-8000-000000000004', 'edr_passenger_app:passengers:view',            'View passengers'),
+  perm('c1000001-0001-4000-8000-000000000005', 'edr_passenger_app:passengers:manage',          'Manage passengers'),
+  perm('c1000001-0001-4000-8000-000000000006', 'edr_passenger_app:tickets:view',               'View tickets'),
+  perm('c1000001-0001-4000-8000-000000000007', 'edr_passenger_app:tickets:manage',             'Manage tickets'),
+  perm('c1000001-0001-4000-8000-000000000008', 'edr_passenger_app:payments:view_all',          'View all payments'),
+  perm('c1000001-0001-4000-8000-000000000009', 'edr_passenger_app:payments:refund',            'Refund payments'),
+  perm('c1000001-0001-4000-8000-00000000000a', 'edr_passenger_app:payments:manage_methods',   'Manage payment methods'),
+  perm('c1000001-0001-4000-8000-00000000000b', 'edr_passenger_app:reports:view',              'View reports'),
+  perm('c1000001-0001-4000-8000-00000000000c', 'edr_passenger_app:fraud:view',                'View fraud alerts'),
+  perm('c1000001-0001-4000-8000-00000000000d', 'edr_passenger_app:fraud:manage',              'Manage fraud rules'),
+  perm('c1000001-0001-4000-8000-00000000000e', 'edr_passenger_app:audit:view',                'View audit logs'),
+  perm('c1000001-0001-4000-8000-00000000000f', 'edr_passenger_app:agents:view',               'View agents'),
+  perm('c1000001-0001-4000-8000-000000000010', 'edr_passenger_app:agents:manage',             'Manage agents'),
+  perm('c1000001-0001-4000-8000-000000000011', 'edr_passenger_app:currencies:manage',         'Manage currencies'),
+  perm('c1000001-0001-4000-8000-000000000012', 'edr_passenger_app:notifications:send',        'Send notifications'),
+  perm('c1000001-0001-4000-8000-000000000013', 'edr_passenger_app:dashboard:view',            'View dashboard'),
+  perm('c1000001-0001-4000-8000-000000000014', 'edr_passenger_app:admin',                     'Full admin access'),
+];
+
+export const PASSENGER_PERMISSION_KEYS = PASSENGER_PERMISSIONS.map((p) => p.key);
+
+export const PASSENGER_PERMS = {
+  bookings: {
+    view:   'edr_passenger_app:bookings:view',
+    manage: 'edr_passenger_app:bookings:manage',
+    cancel: 'edr_passenger_app:bookings:cancel',
+  },
+  passengers: {
+    view:   'edr_passenger_app:passengers:view',
+    manage: 'edr_passenger_app:passengers:manage',
+  },
+  tickets: {
+    view:   'edr_passenger_app:tickets:view',
+    manage: 'edr_passenger_app:tickets:manage',
+  },
+  payments: {
+    viewAll:        'edr_passenger_app:payments:view_all',
+    refund:         'edr_passenger_app:payments:refund',
+    manageMethods:  'edr_passenger_app:payments:manage_methods',
+  },
+  reports: {
+    view: 'edr_passenger_app:reports:view',
+  },
+  fraud: {
+    view:   'edr_passenger_app:fraud:view',
+    manage: 'edr_passenger_app:fraud:manage',
+  },
+  audit: {
+    view: 'edr_passenger_app:audit:view',
+  },
+  agents: {
+    view:   'edr_passenger_app:agents:view',
+    manage: 'edr_passenger_app:agents:manage',
+  },
+  currencies: {
+    manage: 'edr_passenger_app:currencies:manage',
+  },
+  notifications: {
+    send: 'edr_passenger_app:notifications:send',
+  },
+  dashboard: {
+    view: 'edr_passenger_app:dashboard:view',
+  },
+  admin: 'edr_passenger_app:admin',
+} as const;
+
+export const ROLE_PERMISSION_PRESETS = {
+  backofficeAdmin: [...PASSENGER_PERMISSION_KEYS],
+
+  backofficeStaff: [
+    PASSENGER_PERMS.bookings.view,
+    PASSENGER_PERMS.bookings.manage,
+    PASSENGER_PERMS.bookings.cancel,
+    PASSENGER_PERMS.passengers.view,
+    PASSENGER_PERMS.passengers.manage,
+    PASSENGER_PERMS.tickets.view,
+    PASSENGER_PERMS.tickets.manage,
+    PASSENGER_PERMS.payments.viewAll,
+    PASSENGER_PERMS.reports.view,
+    PASSENGER_PERMS.dashboard.view,
+    PASSENGER_PERMS.notifications.send,
+    PASSENGER_PERMS.agents.view,
+    PASSENGER_PERMS.fraud.view,
+    PASSENGER_PERMS.audit.view,
+  ],
+
+  agent: [
+    PASSENGER_PERMS.bookings.view,
+    PASSENGER_PERMS.bookings.manage,
+    PASSENGER_PERMS.passengers.view,
+    PASSENGER_PERMS.tickets.view,
+    PASSENGER_PERMS.payments.refund,
+  ],
+
+  finance: [
+    PASSENGER_PERMS.payments.viewAll,
+    PASSENGER_PERMS.payments.refund,
+    PASSENGER_PERMS.reports.view,
+    PASSENGER_PERMS.dashboard.view,
+  ],
+} as const;
--- a/apps/edr-passenger-api/src/seed/passenger-staff-users.seeder.ts
+++ b/apps/edr-passenger-api/src/seed/passenger-staff-users.seeder.ts
@@ -0,0 +1,106 @@
+import { Injectable, Logger } from '@nestjs/common';
+import { hashPassword } from '@tria-plc/api-common/utils/argon';
+import { EUserStatus } from '@tria-plc/api-common/utils/enums/user.enum';
+import {
+  Employee,
+  Organization,
+  Role,
+  User,
+  UserCredential,
+  UserRole,
+} from '@tria-plc/iamapi-common';
+import { DataSource } from 'typeorm';
+
+const SEED_FLAG = 'SEED_PASSENGER_STAFF';
+const EDR_ORG_KEY = 'edr';
+
+const STAFF_USERS = [
+  { email: 'passenger.admin@edr.local',  username: 'passenger_admin',  roleKey: 'edr_passenger_backoffice_admin' },
+  { email: 'passenger.staff@edr.local',  username: 'passenger_staff',  roleKey: 'edr_passenger_backoffice_staff' },
+  { email: 'passenger.agent@edr.local',  username: 'passenger_agent',  roleKey: 'edr_passenger_agent' },
+  { email: 'passenger.finance@edr.local', username: 'passenger_finance', roleKey: 'edr_passenger_finance' },
+] as const;
+
+@Injectable()
+export class PassengerStaffUsersSeeder {
+  private readonly logger = new Logger(PassengerStaffUsersSeeder.name);
+
+  constructor(private readonly dataSource: DataSource) {}
+
+  async run() {
+    if (process.env[SEED_FLAG]?.trim().toLowerCase() !== 'true') {
+      this.logger.log(`Skipping passenger staff seed because ${SEED_FLAG} is not enabled`);
+      return;
+    }
+
+    const password = process.env.DEFAULT_PASSWORD?.trim() || '12345678';
+
+    await this.dataSource.transaction(async (manager) => {
+      const organization = await manager.getRepository(Organization).findOne({
+        where: { key: EDR_ORG_KEY },
+        select: { id: true, key: true },
+      });
+
+      if (!organization) throw new Error(`missing_organization:${EDR_ORG_KEY}`);
+
+      const hashedPassword = await hashPassword(password);
+
+      for (const staff of STAFF_USERS) {
+        const role = await manager.getRepository(Role).findOne({
+          where: { key: staff.roleKey },
+          select: { id: true, key: true },
+        });
+        if (!role) throw new Error(`missing_role:${staff.roleKey}`);
+
+        let user = await manager.getRepository(User).findOne({
+          where: { email: staff.email },
+          select: { id: true, email: true },
+        });
+
+        if (!user) {
+          user = await manager.getRepository(User).save(
+            manager.getRepository(User).create({
+              email: staff.email,
+              username: staff.username,
+              name: { en: staff.username },
+              isActive: true,
+              hasSetPassword: true,
+              status: EUserStatus.ACCEPTED,
+            }),
+          );
+          this.logger.log(`Seeded passenger staff user ${staff.email}`);
+        }
+
+        const credentialExists = await manager.getRepository(UserCredential).exists({
+          where: { userId: user.id, isActive: true },
+        });
+        if (!credentialExists) {
+          await manager.getRepository(UserCredential).insert({
+            userId: user.id,
+            password: hashedPassword,
+            isActive: true,
+          });
+        }
+
+        await manager.getRepository(UserRole).upsert(
+          { userId: user.id, roleId: role.id, organizationId: organization.id },
+          { conflictPaths: { userId: true, roleId: true } },
+        );
+
+        const employeeExists = await manager.getRepository(Employee).exists({
+          where: { userId: user.id, organizationId: organization.id, isCurrent: true },
+        });
+        if (!employeeExists) {
+          await manager.getRepository(Employee).insert({
+            userId: user.id,
+            organizationId: organization.id,
+            isCurrent: true,
+            name: { en: staff.username },
+          });
+        }
+      }
+    });
+
+    this.logger.log('Ensured passenger staff users');
+  }
+}
--- a/apps/edr-passenger-api/tsconfig.json
+++ b/apps/edr-passenger-api/tsconfig.json
@@ -8,6 +8,8 @@
    "incremental": true,
    "tsBuildInfoFile": "./.tsbuildinfo",
    "paths": { "@/*": ["./src/*"] },
+    "module": "node16",
+    "moduleResolution": "node16",
    "strictPropertyInitialization": false,
    "noUnusedLocals": false,
    "noUnusedParameters": false
--- a/apps/edr-passenger-web/backoffice/src/lib/auth-store.ts
+++ b/apps/edr-passenger-web/backoffice/src/lib/auth-store.ts
@@ -4,9 +4,17 @@ import axios from 'axios';

 const API_URL = process.env.NEXT_PUBLIC_API_URL || 'http://localhost:4000';

+function mapIamRole(roles: { key?: string }[]): 'ADMIN' | 'AGENT' | 'SUPERVISOR' {
+  const keys = roles.map((r) => r.key ?? '');
+  if (keys.some((k) => k.includes('admin') || k === 'super_admin' || k === 'organization_admin')) return 'ADMIN';
+  if (keys.some((k) => k.includes('agent'))) return 'AGENT';
+  return 'SUPERVISOR';
+}
+
 interface AuthState {
  user: AdminUser | null;
  token: string | null;
+  refreshToken: string | null;
  isAuthenticated: boolean;
  login: (email: string, password: string) => Promise<void>;
  logout: () => void;
@@ -17,6 +25,7 @@ interface AuthState {
 export const useAuthStore = create<AuthState>((set) => ({
  user: null,
  token: null,
+  refreshToken: null,
  isAuthenticated: false,

  initialize: () => {
@@ -27,57 +36,47 @@ export const useAuthStore = create<AuthState>((set) => ({
      try {
        const user = JSON.parse(userStr);
        set({ user, token, isAuthenticated: true });
-      } catch (e) {
+      } catch {
        localStorage.removeItem('auth_token');
+        localStorage.removeItem('auth_refresh_token');
        localStorage.removeItem('auth_user');
      }
    }
  },

  login: async (email: string, password: string) => {
-    try {
-      console.log('Attempting login to:', `${API_URL}/auth/login`);
-      const response = await axios.post(`${API_URL}/auth/login`, { email, password });
-      console.log('Full response:', response.data);
-      
-      // Backend wraps response in { success, data: { token, user }, timestamp }
-      const responseData = response.data.data || response.data;
-      
-      if (!responseData || !responseData.token || !responseData.user) {
-        console.error('Invalid response structure:', response.data);
-        throw new Error('Invalid response from server');
-      }
-      
-      const { token, user: apiUser } = responseData;
-      
-      const user: AdminUser = {
-        id: apiUser.id,
-        email: apiUser.email,
-        fullName: apiUser.fullName,
-        role: apiUser.role,
-        active: true,
-      };
-      
-      console.log('Login successful! User:', user);
-      
-      localStorage.setItem('auth_token', token);
-      localStorage.setItem('auth_user', JSON.stringify(user));
-      
-      set({ user, token, isAuthenticated: true });
-    } catch (error: any) {
-      console.error('Login error details:', {
-        message: error.message,
-        response: error.response?.data,
-        status: error.response?.status,
-      });
-      throw error;
-    }
+    // Step 1: IAM login — returns token + refreshToken only
+    const loginRes = await axios.post(`${API_URL}/v1/auth/login`, { email, password });
+    const loginData = loginRes.data?.data ?? loginRes.data;
+    const { token, refreshToken } = loginData;
+    if (!token) throw new Error('No token received from server');
+
+    // Step 2: fetch full user info with the token
+    const meRes = await axios.get(`${API_URL}/v1/auth/me`, {
+      headers: { Authorization: `Bearer ${token}` },
+    });
+    const iamUser = meRes.data?.data ?? meRes.data;
+
+    const user: AdminUser = {
+      id: iamUser.id,
+      email: iamUser.email,
+      fullName: iamUser.name?.en ?? iamUser.name?.am ?? iamUser.email,
+      role: mapIamRole(iamUser.roles ?? []),
+      active: true,
+    };
+
+    localStorage.setItem('auth_token', token);
+    localStorage.setItem('auth_user', JSON.stringify(user));
+    if (refreshToken) localStorage.setItem('auth_refresh_token', refreshToken);
+
+    set({ user, token, refreshToken: refreshToken ?? null, isAuthenticated: true });
  },

  logout: () => {
    localStorage.removeItem('auth_token');
+    localStorage.removeItem('auth_refresh_token');
    localStorage.removeItem('auth_user');
-    set({ user: null, token: null, isAuthenticated: false });
+    set({ user: null, token: null, refreshToken: null, isAuthenticated: false });
  },

  setUser: (user: AdminUser, token: string) => {
--- a/local-packages/tria-plc-api-common-1.4.3.tgz
+++ b/local-packages/tria-plc-api-common-1.4.3.tgz
--- a/local-packages/tria-plc-iamapi-common-0.7.3.tgz
+++ b/local-packages/tria-plc-iamapi-common-0.7.3.tgz
--- a/local-packages/tria-plc-iamui-0.0.3.tgz
+++ b/local-packages/tria-plc-iamui-0.0.3.tgz
--- a/pnpm-lock.yaml
+++ b/pnpm-lock.yaml
@@ -431,15 +431,9 @@ importers:
      '@nestjs/event-emitter':
        specifier: ^2.0.4
        version: 2.1.1(@nestjs/common@11.1.24(class-transformer@0.5.1)(class-validator@0.14.4)(reflect-metadata@0.2.2)(rxjs@7.8.2))(@nestjs/core@11.1.24)
-      '@nestjs/jwt':
-        specifier: ^10.2.0
-        version: 10.2.0(@nestjs/common@11.1.24(class-transformer@0.5.1)(class-validator@0.14.4)(reflect-metadata@0.2.2)(rxjs@7.8.2))
      '@nestjs/microservices':
        specifier: ^11.1.24
        version: 11.1.24(@nestjs/common@11.1.24(class-transformer@0.5.1)(class-validator@0.14.4)(reflect-metadata@0.2.2)(rxjs@7.8.2))(@nestjs/core@11.1.24)(amqp-connection-manager@5.0.0(amqplib@2.0.1))(amqplib@2.0.1)(reflect-metadata@0.2.2)(rxjs@7.8.2)
-      '@nestjs/passport':
-        specifier: ^10.0.3
-        version: 10.0.3(@nestjs/common@11.1.24(class-transformer@0.5.1)(class-validator@0.14.4)(reflect-metadata@0.2.2)(rxjs@7.8.2))(passport@0.7.0)
      '@nestjs/platform-express':
        specifier: ^11.1.19
        version: 11.1.24(@nestjs/common@11.1.24(class-transformer@0.5.1)(class-validator@0.14.4)(reflect-metadata@0.2.2)(rxjs@7.8.2))(@nestjs/core@11.1.24)
@@ -449,33 +443,48 @@ importers:
      '@nestjs/swagger':
        specifier: ^7.4.0
        version: 7.4.2(@nestjs/common@11.1.24(class-transformer@0.5.1)(class-validator@0.14.4)(reflect-metadata@0.2.2)(rxjs@7.8.2))(@nestjs/core@11.1.24)(class-transformer@0.5.1)(class-validator@0.14.4)(reflect-metadata@0.2.2)
+      '@nestjs/typeorm':
+        specifier: ^11.0.1
+        version: 11.0.1(@nestjs/common@11.1.24(class-transformer@0.5.1)(class-validator@0.14.4)(reflect-metadata@0.2.2)(rxjs@7.8.2))(@nestjs/core@11.1.24)(reflect-metadata@0.2.2)(rxjs@7.8.2)(typeorm@0.3.30(babel-plugin-macros@3.1.0)(pg@8.21.0)(ts-node@10.9.2(@types/node@20.19.42)(typescript@5.9.3)))
      '@prisma/client':
        specifier: ^6.19.3
        version: 6.19.3(prisma@6.19.3(typescript@5.9.3))(typescript@5.9.3)
+      '@sendgrid/mail':
+        specifier: ^8.1.0
+        version: 8.1.6
+      '@tria-plc/api-common':
+        specifier: file:../../local-packages/tria-plc-api-common-1.4.3.tgz
+        version: file:local-packages/tria-plc-api-common-1.4.3.tgz(d81a2b6a79840fd7ce8c5d0cfc968145)
+      '@tria-plc/iamapi-common':
+        specifier: file:../../local-packages/tria-plc-iamapi-common-0.7.3.tgz
+        version: file:local-packages/tria-plc-iamapi-common-0.7.3.tgz(c97ba831ddde82920910406ab5262991)
+      amqp-connection-manager:
+        specifier: ^5.0.0
+        version: 5.0.0(amqplib@2.0.1)
+      amqplib:
+        specifier: ^2.0.1
+        version: 2.0.1
      axios:
        specifier: ^1.7.7
        version: 1.17.0
-      bcrypt:
-        specifier: ^5.1.1
-        version: 5.1.1
      class-transformer:
        specifier: ^0.5.1
        version: 0.5.1
      class-validator:
        specifier: ^0.14.0
        version: 0.14.4
+      dotenv:
+        specifier: ^17.4.2
+        version: 17.4.2
      express:
        specifier: ^4.18.2
        version: 4.22.2(supports-color@5.5.0)
      jose:
        specifier: ^5.10.0
        version: 5.10.0
-      passport:
-        specifier: ^0.7.0
-        version: 0.7.0
-      passport-jwt:
-        specifier: ^4.0.1
-        version: 4.0.1
+      pg:
+        specifier: ^8.21.0
+        version: 8.21.0
      qrcode:
        specifier: ^1.5.3
        version: 1.5.4
@@ -491,6 +500,9 @@ importers:
      tsconfig-paths:
        specifier: ^4.2.0
        version: 4.2.0
+      typeorm:
+        specifier: ^0.3.30
+        version: 0.3.30(babel-plugin-macros@3.1.0)(pg@8.21.0)(ts-node@10.9.2(@types/node@20.19.42)(typescript@5.9.3))
      uuid:
        specifier: ^10.0.0
        version: 10.0.0
@@ -510,21 +522,15 @@ importers:
      '@nestjs/testing':
        specifier: ^11.1.19
        version: 11.1.24(@nestjs/common@11.1.24(class-transformer@0.5.1)(class-validator@0.14.4)(reflect-metadata@0.2.2)(rxjs@7.8.2))(@nestjs/core@11.1.24)(@nestjs/microservices@11.1.24)(@nestjs/platform-express@11.1.24)
-      '@types/bcrypt':
-        specifier: ^5.0.2
-        version: 5.0.2
      '@types/express':
-        specifier: ^5.0.6
-        version: 5.0.6
+        specifier: ^4.17.21
+        version: 4.17.25
      '@types/jest':
        specifier: ^29.5.11
        version: 29.5.14
      '@types/node':
        specifier: ^20.10.6
        version: 20.19.42
-      '@types/passport-jwt':
-        specifier: ^4.0.1
-        version: 4.0.1
      '@types/qrcode':
        specifier: ^1.5.5
        version: 1.5.6
@@ -634,6 +640,9 @@ importers:
      '@tanstack/react-query':
        specifier: ^5.59.0
        version: 5.101.0(react@18.3.1)
+      '@types/qrcode':
+        specifier: ^1.5.6
+        version: 1.5.6
      axios:
        specifier: ^1.7.7
        version: 1.17.0
@@ -643,12 +652,21 @@ importers:
      date-fns:
        specifier: ^3.0.0
        version: 3.6.0
+      jspdf:
+        specifier: ^4.2.1
+        version: 4.2.1
+      jspdf-autotable:
+        specifier: ^5.0.8
+        version: 5.0.8(jspdf@4.2.1)
      lucide-react:
        specifier: ^0.446.0
        version: 0.446.0(react@18.3.1)
      next:
        specifier: ^14.2.0
        version: 14.2.35(babel-plugin-macros@3.1.0)(react-dom@18.3.1(react@18.3.1))(react@18.3.1)
+      qrcode:
+        specifier: ^1.5.4
+        version: 1.5.4
      qrcode.react:
        specifier: ^3.1.0
        version: 3.2.0(react@18.3.1)
@@ -2011,10 +2029,6 @@ packages:
    peerDependencies:
      react: ^19.2.0

-  '@mapbox/node-pre-gyp@1.0.11':
-    resolution: {integrity: sha512-Yhlar6v9WQgUp/He7BdgzOz8lqMQ8sU+jkCq7Wx8Myc5YFJLbEe7lgui/V7G1qB1DJykHSGwreceSaD60Y0PUQ==}
-    hasBin: true
-
  '@microsoft/tsdoc@0.15.1':
    resolution: {integrity: sha512-4aErSrCR/On/e5G2hDP0wjooqDdauzEbIq8hIkIe5pXV0rtWJZvdCEKL0ykZxex+IxIwBp0eGeV48hQN07dXtw==}

@@ -3753,6 +3767,18 @@ packages:
  '@sec-ant/readable-stream@0.4.1':
    resolution: {integrity: sha512-831qok9r2t8AlxLko40y2ebgSDhenenCatLVeW/uBtnHPyhHOvG0C7TvfgecV+wHzIm5KUICgzmVpWS+IMEAeg==}

+  '@sendgrid/client@8.1.6':
+    resolution: {integrity: sha512-/BHu0hqwXNHr2aLhcXU7RmmlVqrdfrbY9KpaNj00KZHlVOVoRxRVrpOCabIB+91ISXJ6+mLM9vpaVUhK6TwBWA==}
+    engines: {node: '>=12.*'}
+
+  '@sendgrid/helpers@8.0.0':
+    resolution: {integrity: sha512-Ze7WuW2Xzy5GT5WRx+yEv89fsg/pgy3T1E3FS0QEx0/VvRmigMZ5qyVGhJz4SxomegDkzXv/i0aFPpHKN8qdAA==}
+    engines: {node: '>= 12.0.0'}
+
+  '@sendgrid/mail@8.1.6':
+    resolution: {integrity: sha512-/ZqxUvKeEztU9drOoPC/8opEPOk+jLlB2q4+xpx6HVLq6aFu3pMpalkTpAQz8XfRfpLp8O25bh6pGPcHDCYpqg==}
+    engines: {node: '>=12.*'}
+
  '@sinclair/typebox@0.27.10':
    resolution: {integrity: sha512-MTBk/3jGLNB2tVxv6uLlFh1iu64iYOQ2PbdOSK3NW8JZsmlaOh2q6sdtKowBhfw8QFLmYNzTW4/oK4uATIi6ZA==}

@@ -4135,6 +4161,23 @@ packages:
      rxjs: ^7.8.0
      typeorm: ^0.3.0

+  '@tria-plc/api-common@file:local-packages/tria-plc-api-common-1.4.3.tgz':
+    resolution: {integrity: sha512-cHlo96Wh3ET8qHjq5mevJwqitFRynU17KzEpE5fz0efCs9NIw7N3K6L+bYwConOCP7jbIROe/2rkG9ToY/AA3w==, tarball: file:local-packages/tria-plc-api-common-1.4.3.tgz}
+    version: 1.4.3
+    peerDependencies:
+      '@nestjs/common': ^11.0.0
+      '@nestjs/core': ^11.0.0
+      '@nestjs/jwt': ^11.0.0
+      '@nestjs/microservices': ^11.0.0
+      '@nestjs/passport': ^11.0.0
+      '@nestjs/swagger': ^11.0.0
+      '@nestjs/throttler': ^6.0.0
+      '@nestjs/typeorm': ^11.0.0
+      '@tria-plc/iamapi-common': ^0.1.0
+      reflect-metadata: ^0.2.0
+      rxjs: ^7.8.0
+      typeorm: ^0.3.0
+
  '@tria-plc/iamapi-common@0.6.6':
    resolution: {integrity: sha512-derY8wJBonsQM2/oHsFgqZw7q4jQA3ilwN3kTDJP3I0h5l3d6zDVWYAFFHQFuH8Qx+q1DChla3g6x1+RPe++hg==, tarball: https://npm.pkg.github.com/download/@tria-plc/iamapi-common/0.6.6/5211a9de00895776017415caab771f13ac3acaef}
    engines: {node: '>=20'}
@@ -4156,6 +4199,28 @@ packages:
      rxjs: ^7.8.0
      typeorm: ^0.3.0

+  '@tria-plc/iamapi-common@file:local-packages/tria-plc-iamapi-common-0.7.3.tgz':
+    resolution: {integrity: sha512-poMG3sm+HmnfNbWNqMDZJMf3pXdc3HHA+o/ay6CA4E6ehLKkO7Np77C6xrCYuGxyDgqqKdmWiFLqKKddkv5rig==, tarball: file:local-packages/tria-plc-iamapi-common-0.7.3.tgz}
+    version: 0.7.3
+    engines: {node: '>=20'}
+    peerDependencies:
+      '@nestjs/axios': ^4.0.0
+      '@nestjs/common': ^11.0.0
+      '@nestjs/core': ^11.0.0
+      '@nestjs/jwt': ^11.0.0
+      '@nestjs/microservices': ^11.0.0
+      '@nestjs/passport': ^11.0.0
+      '@nestjs/swagger': ^11.0.0
+      '@nestjs/throttler': ^6.0.0
+      '@nestjs/typeorm': ^11.0.0
+      '@tria-plc/api-common': '*'
+      axios: ^1.9.0
+      class-transformer: ^0.5.1
+      class-validator: ^0.14.1
+      reflect-metadata: ^0.2.0
+      rxjs: ^7.8.0
+      typeorm: ^0.3.0
+
  '@tria-plc/iamui-common@1.1.2':
    resolution: {integrity: sha512-oKFxs7/003/UcGf0q1R7lfubvsawPxgTzx8O2Fi/6oN3oGECnc3YNkbDPoOvMrmXYOxfMExIYZmhCv+OpstWAQ==, tarball: https://npm.pkg.github.com/download/@tria-plc/iamui-common/1.1.2/01aa8b5799f0fa5a876c64ed6ebfe4b4134ccc55}

@@ -4222,9 +4287,6 @@ packages:
  '@types/babel__traverse@7.28.0':
    resolution: {integrity: sha512-8PvcXf70gTDZBgt9ptxJ8elBeBjcLOAcOtoO/mPJjtji1+CdGbHgm77om1GrsPxsiE+uXIpNSK64UYaIwQXd4Q==}

-  '@types/bcrypt@5.0.2':
-    resolution: {integrity: sha512-6atioO8Y75fNcbmj0G7UjI9lXN2pQ/IGJ2FWT4a/btd0Lk9lQalHLKhkgKVZ3r+spnmWUKfbMi1GEe9wyHQfNQ==}
-
  '@types/body-parser@1.19.6':
    resolution: {integrity: sha512-HLFeCYgz89uk22N5Qg3dvGvsv46B8GLvKKo1zKG4NybA8U2DiEO3w9lqGg29t/tfLRJpJ6iQxnVw4OnB7MoM9g==}

@@ -4273,9 +4335,15 @@ packages:
  '@types/estree@1.0.9':
    resolution: {integrity: sha512-GhdPgy1el4/ImP05X05Uw4cw2/M93BCUmnEvWZNStlCzEKME4Fkk+YpoA5OiHNQmoS7Cafb8Xa3Pya8m1Qrzeg==}

+  '@types/express-serve-static-core@4.19.8':
+    resolution: {integrity: sha512-02S5fmqeoKzVZCHPZid4b8JH2eM5HzQLZWN2FohQEy/0eXTq8VXZfSN6Pcr3F6N9R/vNrj7cpgbhjie6m/1tCA==}
+
  '@types/express-serve-static-core@5.1.1':
    resolution: {integrity: sha512-v4zIMr/cX7/d2BpAEX3KNKL/JrT1s43s96lLvvdTmza1oEvDudCqK9aF/djc/SWgy8Yh0h30TZx5VpzqFCxk5A==}

+  '@types/express@4.17.25':
+    resolution: {integrity: sha512-dVd04UKsfpINUnK0yBoYHDF3xu7xVH4BuDotC/xGuycx4CgbP48X/KF/586bcObxT0HENHXEU8Nqtu6NR+eKhw==}
+
  '@types/express@5.0.6':
    resolution: {integrity: sha512-sKYVuV7Sv9fbPIt/442koC7+IIwK5olP1KWeD88e/idgoJqDm3JV/YUiPwkoKK92ylff2MGxSz1CSjsXelx0YA==}

@@ -4311,9 +4379,6 @@ packages:
  '@types/json5@0.0.29':
    resolution: {integrity: sha512-dRLjCWHYg4oaA77cxO64oO+7JwCwnIzkZPdrrC71jQmQtlhM556pwKo5bUzqvZndkVbeFLIIi+9TC40JNF5hNQ==}

-  '@types/jsonwebtoken@9.0.10':
-    resolution: {integrity: sha512-asx5hIG9Qmf/1oStypjanR7iKTv0gXQ1Ov/jfrX6kS/EO0OFni8orbmGCn0672NHR3kXHwpAwR+B368ZGN/2rA==}
-
  '@types/jsonwebtoken@9.0.5':
    resolution: {integrity: sha512-VRLSGzik+Unrup6BsouBeHsf4d1hOEgYWTm/7Nmw1sXoN1+tRly/Gy/po3yeahnP4jfnQWWAhQAqcNfH7ngOkA==}

@@ -4326,8 +4391,8 @@ packages:
  '@types/methods@1.1.4':
    resolution: {integrity: sha512-ymXWVrDiCxTBE3+RIrrP533E70eA+9qu7zdWoHuOmGujkYtzf4HQF96b8nwHLqhuf4ykX61IGRIB38CC6/sImQ==}

-  '@types/ms@2.1.0':
-    resolution: {integrity: sha512-GsCCIZDE/p3i96vtEqx+7dBUGXrc7zeSK3wwPHIaRThS+9OhWIXRqzs4d6k1SVU8g91DrNRWxWUGhp5KXQb2VA==}
+  '@types/mime@1.3.5':
+    resolution: {integrity: sha512-/pyBZWSLD2n0dcHE3hq8s8ZvcETHtEuF+3E7XVt0Ig2nvsVQXdghHVcEkIWjy9A0wKfTn97a/PSDYohKIlnP/w==}

  '@types/multer@2.1.0':
    resolution: {integrity: sha512-zYZb0+nJhOHtPpGDb3vqPjwpdeGlGC157VpkqNQL+UU2qwoacoQ7MpsAmUptI/0Oa127X32JzWDqQVEXp2RcIA==}
@@ -4347,15 +4412,6 @@ packages:
  '@types/parse-json@4.0.2':
    resolution: {integrity: sha512-dISoDXWWQwUquiKsyZ4Ng+HX2KsPL7LyHKHQwgGFEA3IaKac4Obd+h2a/a6waisAoepJlBcx9paWqjA8/HVjCw==}

-  '@types/passport-jwt@4.0.1':
-    resolution: {integrity: sha512-Y0Ykz6nWP4jpxgEUYq8NoVZeCQPo1ZndJLfapI249g1jHChvRfZRO/LS3tqu26YgAS/laI1qx98sYGz0IalRXQ==}
-
-  '@types/passport-strategy@0.2.38':
-    resolution: {integrity: sha512-GC6eMqqojOooq993Tmnmp7AUTbbQSgilyvpCYQjT+H6JfG/g6RGc7nXEniZlp0zyKJ0WUdOiZWLBZft9Yug1uA==}
-
-  '@types/passport@1.0.17':
-    resolution: {integrity: sha512-aciLyx+wDwT2t2/kJGJR2AEeBz0nJU4WuRX04Wu9Dqc5lSUtwu0WERPHYsLhF9PtseiAMPBGNUOtFjxZ56prsg==}
-
  '@types/pg@8.20.0':
    resolution: {integrity: sha512-bEPFOaMAHTEP1EzpvHTbmwR8UsFyHSKsRisLIHVMXnpNefSbGA1bD6CVy+qKjGSqmZqNqBDV2azOBo8TgkcVow==}

@@ -4387,9 +4443,15 @@ packages:
  '@types/react@18.3.31':
    resolution: {integrity: sha512-vfEqpXTvwT91yhmwdfouStN2hSKwTvyRs8qpLfADyrq/kxDw0hZM7Wk9Ug1FELj8hIby+S/+kQCSRFF32nv2Qw==}

+  '@types/send@0.17.6':
+    resolution: {integrity: sha512-Uqt8rPBE8SY0RK8JB1EzVOIZ32uqy8HwdxCnoCOsYrvnswqmFZ/k+9Ikidlk/ImhsdvBsloHbAlewb2IEBV/Og==}
+
  '@types/send@1.2.1':
    resolution: {integrity: sha512-arsCikDvlU99zl1g69TcAB3mzZPpxgw0UQnaHeC1Nwb015xp8bknZv5rIfri9xTOcMuaVgvabfIRA7PSZVuZIQ==}

+  '@types/serve-static@1.15.10':
+    resolution: {integrity: sha512-tRs1dB+g8Itk72rlSI2ZrW6vZg0YrLI81iQSTkMmOqnqCaNr/8Ek4VwWcN5vZgCYWbg/JJSGBlUaYGAOP73qBw==}
+
  '@types/serve-static@2.2.0':
    resolution: {integrity: sha512-8mam4H1NHLtu7nmtalF7eyBH14QyOASmcxHhSfEoRyr0nP/YdoesEtU+uSRvMe96TW/HPTtkoKqQLl53N7UXMQ==}

@@ -4947,9 +5009,6 @@ packages:
    resolution: {integrity: sha512-E+iruNOY8VV9s4JEbe1aNEm6MiszPRr/UfcHMz0TQh1BXSxHK+ASV1R6W4HpjBhSeS+54PIsAMCBmwD06LLsqQ==}
    hasBin: true

-  abbrev@1.1.1:
-    resolution: {integrity: sha512-nne9/IiQ/hzIhY6pdDnbBtz7DjPTKrY00P/zvPSm5pOFkl6xuGrGnXn/VtTNNfNtAfZ9/1RtehkszU9qcTii0Q==}
-
  abort-controller@3.0.0:
    resolution: {integrity: sha512-h8lQ8tacZYnR3vNQTgibj+tODHI5/+l06Au2Pcriv/Gmet0eaj4TwWH41sO9wnHDiQsEj19q0drzdWdeAHtweg==}
    engines: {node: '>=6.5'}
@@ -5255,9 +5314,6 @@ packages:
  append-field@1.0.0:
    resolution: {integrity: sha512-klpgFSWLW1ZEs8svjfb7g4qWY0YS5imI82dTg+QahUvJ8YqAY0P10Uk8tTyh9ZGuYEZEMaeJYCF5BFuX552hsw==}

-  aproba@2.1.0:
-    resolution: {integrity: sha512-tLIEcj5GuR2RSTnxNKdkK0dJ/GrC7P38sUkiDmDuHfsHmbagTFAxDVIBltoklXEVIQ/f14IL8IMJ5pn9Hez1Ew==}
-
  archiver-utils@2.1.0:
    resolution: {integrity: sha512-bEL/yUb/fNNiNTuUz979Z0Yg5L+LzLxGJz8x79lYmR54fmTIb6ob/hNQgkQnIUDWIFjZVQwl9Xs356I6BAMHfw==}
    engines: {node: '>= 6'}
@@ -5270,11 +5326,6 @@ packages:
    resolution: {integrity: sha512-+25nxyyznAXF7Nef3y0EbBeqmGZgeN/BxHX29Rs39djAfaFalmQ89SE6CWyDCHzGL0yt/ycBtNOmGTW0FyGWNw==}
    engines: {node: '>= 10'}

-  are-we-there-yet@2.0.0:
-    resolution: {integrity: sha512-Ci/qENmwHnsYo9xKIcUJN5LeDKdJ6R1Z1j9V/J5wyq8nh/mYPEpIKJbBZXtZjG04HiK7zV/p6Vs9952MrMeUIw==}
-    engines: {node: '>=10'}
-    deprecated: This package is no longer supported.
-
  arg@4.1.3:
    resolution: {integrity: sha512-58S9QDqG0Xx27YwPSt9fJxivjYl432YCwfDMfZ+71RAqUrZef7LrKQZ3LHLOwCS4FLNBplP533Zx895SeOCHvA==}

@@ -5581,10 +5632,6 @@ packages:
  bcrypt-pbkdf@1.0.2:
    resolution: {integrity: sha512-qeFIXtP4MSoi6NLqO12WfqARWWuCKi2Rn/9hJLEmtB5yTNr9DqFWkJRCf2qShWzPeAMRnOgCrq0sg/KLv5ES9w==}

-  bcrypt@5.1.1:
-    resolution: {integrity: sha512-AGBHOG5hPYZ5Xl9KXzU5iKq9516yEmvCKDg3ecP5kX2aB6UqTeXZxk2ELnDgDm6BQSMlLt9rDB4LoSMx0rYwww==}
-    engines: {node: '>= 10.0.0'}
-
  bidi-js@1.0.3:
    resolution: {integrity: sha512-RKshQI1R3YQ+n9YJz2QQ147P66ELpa1FQEg20Dk8oW9t2KgLbpDLLp9aGZ7y8WHSshDknG0bknqGw5/tyCs5tw==}

@@ -5872,10 +5919,6 @@ packages:
    resolution: {integrity: sha512-Qgzu8kfBvo+cA4962jnP1KkS6Dop5NS6g7R5LFYJr4b8Ub94PPQXUksCw9PvXoeXPRRddRNC5C1JQUR2SMGtnA==}
    engines: {node: '>= 14.16.0'}

-  chownr@2.0.0:
-    resolution: {integrity: sha512-bIomtDF5KGpdogkLd9VspvFzk9KfpyyGlS8YFVZl7TGPBHL5snIOnxeshwVgPteQ9b4Eydl+pVbIyE1DcvCWgQ==}
-    engines: {node: '>=10'}
-
  chrome-trace-event@1.0.4:
    resolution: {integrity: sha512-rNjApaLzuwaOTjCiT8lSDdGN1APCiqkChLMJxJPWLunPAt5fy8xgU9/jNOchV84wfIxrA0lRQB7oCT8jrn/wrQ==}
    engines: {node: '>=6.0'}
@@ -6014,10 +6057,6 @@ packages:
    resolution: {integrity: sha512-Bb6Cq8oq0IjDOe8wJmi4JeNn763Xs9cfrBcaylK1tPypWzyoy2G3l90v9k64kjphl/ZJjPIShFztenRomi8WTg==}
    engines: {node: '>=18'}

-  color-support@1.1.3:
-    resolution: {integrity: sha512-qiBjkpbMLO/HL68y+lh4q0/O1MZFj2RX6X/KmMa3+gJD3z+WwI1ZzDHysvqHGS3mP6mznPckpXmw1nI9cJjyRg==}
-    hasBin: true
-
  colorette@2.0.20:
    resolution: {integrity: sha512-IfEDxwoWIjkeXL1eXcDiow4UbKjhLdq6/EuSVR9GMN7KVH3r9gQ83e73hsz1Nd1T3ijd5xv1wcWRYO+D6kCI2w==}

@@ -6094,9 +6133,6 @@ packages:
  console-browserify@1.2.0:
    resolution: {integrity: sha512-ZMkYO/LkF17QvCPqM0gxw8yUzigAOZOSWSHg91FH6orS7vcEj5dVZTidN2fQ14yBSdg97RqhSNwLUXInd52OTA==}

-  console-control-strings@1.1.0:
-    resolution: {integrity: sha512-ty/fTekppD2fIwRvnZAVdeOiGd1c7YXEixbgJTNzqcxJWKQnjJ/V1bNEEE6hygpM3WjwHFUVK6HTjWSzV4a8sQ==}
-
  constants-browserify@1.0.0:
    resolution: {integrity: sha512-xFxOwqIzR/e1k1gLiWEophSCMqXcwVHIH7akf7b/vxcUeGunlj3hvZaaqxwHsTgn+IndtkQJgSztIDWeumWJDQ==}

@@ -6512,9 +6548,6 @@ packages:
    resolution: {integrity: sha512-ZySD7Nf91aLB0RxL4KGrKHBXl7Eds1DAmEdcoVawXnLD7SDhpNgtuII2aAkg7a7QS41jxPSZ17p4VdGnMHk3MQ==}
    engines: {node: '>=0.4.0'}

-  delegates@1.0.0:
-    resolution: {integrity: sha512-bd2L678uiWATM6m5Z1VzNCErI3jiGzt6HGY8OVICs40JQq/HALfbyNJmp0UDakEY4pMMaN0Ly5om/B1VI/+xfQ==}
-
  depd@1.1.2:
    resolution: {integrity: sha512-7emPTl6Dpo6JRXOXjLRxck+FlLRX5847cLKEn00PLAgc3g2hTZZgr+e4c2v6QpSmLeFP3n5yUo7ft6avBK/5jQ==}
    engines: {node: '>= 0.6'}
@@ -7425,10 +7458,6 @@ packages:
    resolution: {integrity: sha512-eKpRKAovdpZtR1WopLHxlBWvAgPny3c4gX1G5Jhwmmw4XJj0ifSD5qB5TOo8hmA0wlRKDAOAhEE1yVPgs6Fgcg==}
    engines: {node: '>=14.14'}

-  fs-minipass@2.1.0:
-    resolution: {integrity: sha512-V/JgOLFCS+R6Vcq0slCuaeWEdNC3ouDlJMNIsacH2VtALiu9mV4LPrHc5cDl8k5aw6J8jwgWWpiTo5RYhmIzvg==}
-    engines: {node: '>= 8'}
-
  fs-monkey@1.1.0:
    resolution: {integrity: sha512-QMUezzXWII9EV5aTFXW1UBVUO77wYPpjqIF8/AviUCThNeSYZykpoTixUeaNNBwmCev0AMDWMAni+f8Hxb1IFw==}

@@ -7464,11 +7493,6 @@ packages:
  fuzzysort@3.1.0:
    resolution: {integrity: sha512-sR9BNCjBg6LNgwvxlBd0sBABvQitkLzoVY9MYYROQVX/FvfJ4Mai9LsGhDgd8qYdds0bY77VzYd5iuB+v5rwQQ==}

-  gauge@3.0.2:
-    resolution: {integrity: sha512-+5J6MS/5XksCuXq++uFRsnUd7Ovu1XenbeuIuNRJxYWjgQbPuFhT14lAvsWfqfAmnwluf1OwMjz39HjfLPci0Q==}
-    engines: {node: '>=10'}
-    deprecated: This package is no longer supported.
-
  generator-function@2.0.1:
    resolution: {integrity: sha512-SFdFmIJi+ybC0vjlHN0ZGVGHc3lgE0DxPAT0djjVg+kjOnSqclqmj0KQ7ykTOLP6YxoqOvuAODGdcHJn+43q3g==}
    engines: {node: '>= 0.4'}
@@ -7696,9 +7720,6 @@ packages:
    resolution: {integrity: sha512-NqADB8VjPFLM2V0VvHUewwwsw0ZWBaIdgo+ieHtK3hasLz4qeCRjYcqfB6AQrBggRKppKF8L52/VqdVsO47Dlw==}
    engines: {node: '>= 0.4'}

-  has-unicode@2.0.1:
-    resolution: {integrity: sha512-8Rf9Y83NBReMnx0gFzA8JImQACstCYWUplepDa9xprwwtmgEZUF0h/i5xSA625zB/I37EtrswSST6OXxwaaIJQ==}
-
  has-value@0.3.1:
    resolution: {integrity: sha512-gpG936j8/MzaeID5Yif+577c17TxaDmhuyVgSwtnL/q8UUTySg8Mecb+8Cf1otgLoD7DDH75axp86ER7LFsf3Q==}
    engines: {node: '>=0.10.0'}
@@ -8646,9 +8667,17 @@ packages:
    resolution: {integrity: sha512-MT/xP0CrubFRNLNKvxJ2BYfy53Zkm++5bX9dtuPbqAeQpTVe0MQTFhao8+Cp//EmJp244xt6Drw/GVEGCUj40g==}
    engines: {node: '>=12', npm: '>=6'}

+  jspdf-autotable@5.0.8:
+    resolution: {integrity: sha512-Hy05N86yBO7CXBrnSLOge7i1ZYpKH2DjQ94iybaP7vBhSInjvRBgDc99ngKzSbSO8Jc98ZCally8I6n0tj2RJQ==}
+    peerDependencies:
+      jspdf: ^2 || ^3 || ^4
+
  jspdf@3.0.4:
    resolution: {integrity: sha512-dc6oQ8y37rRcHn316s4ngz/nOjayLF/FFxBF4V9zamQKRqXxyiH1zagkCdktdWhtoQId5K20xt1lB90XzkB+hQ==}

+  jspdf@4.2.1:
+    resolution: {integrity: sha512-YyAXyvnmjTbR4bHQRLzex3CuINCDlQnBqoSYyjJwTP2x9jDLuKDzy7aKUl0hgx3uhcl7xzg32agn5vlie6HIlQ==}
+
  jsprim@1.4.2:
    resolution: {integrity: sha512-P2bSOMAc/ciLz6DzgjVlGJP9+BrJWu5UDGK70C2iweC5QBIeFf0ZXRvGjEj2uYgrY2MkAAhsSWHDWlFtEroZWw==}
    engines: {node: '>=0.6.0'}
@@ -9087,10 +9116,6 @@ packages:
  make-cancellable-promise@2.0.0:
    resolution: {integrity: sha512-3SEQqTpV9oqVsIWqAcmDuaNeo7yBO3tqPtqGRcKkEo0lrzD3wqbKG9mkxO65KoOgXqj+zH2phJ2LiAsdzlogSw==}

-  make-dir@3.1.0:
-    resolution: {integrity: sha512-g3FeP20LNwhALb/6Cz6Dd4F2ngze0jz7tbzrD2wAV+o9FeNHe4rL+yK2md0J/fiSf1sa1ADhXqi5+oVwOM/eGw==}
-    engines: {node: '>=8'}
-
  make-dir@4.0.0:
    resolution: {integrity: sha512-hXdUTZYIVOt1Ex//jAQi+wTZZpUpwBj/0QsOzqegb3rGMMeJiSEu5xLHnYfBrRV4RH2+OCSOO95Is/7x1WJ4bw==}
    engines: {node: '>=10'}
@@ -9270,22 +9295,10 @@ packages:
    resolution: {integrity: sha512-xPrLjWkTT5E7H7VnzOjF//xBp9I40jYB4aWhb2xTFopXXfw+Wo82DDWngdUju7Doy3Wk7R8C4LAgwhLHHnf0wA==}
    engines: {node: ^16 || ^18 || >=20}

-  minipass@3.3.6:
-    resolution: {integrity: sha512-DxiNidxSEK+tHG6zOIklvNOwm3hvCrbUrdtzY74U6HKTJxvIDfOUL5W5P2Ghd3DTkhhKPYGqeNUIh5qcM4YBfw==}
-    engines: {node: '>=8'}
-
-  minipass@5.0.0:
-    resolution: {integrity: sha512-3FnjYuehv9k6ovOEbyOswadCDPX1piCfhV8ncmYtHOjuPwylVWsghTLo7rabjC3Rx5xD4HDx8Wm1xnMF7S5qFQ==}
-    engines: {node: '>=8'}
-
  minipass@7.1.3:
    resolution: {integrity: sha512-tEBHqDnIoM/1rXME1zgka9g6Q2lcoCkxHLuc7ODJ5BxbP5d4c2Z5cGgtXAku59200Cx7diuHTOYfSBD8n6mm8A==}
    engines: {node: '>=16 || 14 >=14.17'}

-  minizlib@2.1.2:
-    resolution: {integrity: sha512-bAxsR8BVfj60DWXHE3u30oHzfl4G7khkSuPW+qvpd7jFRHm7dLxOjUk1EHACJ/hxLY8phGJ0YhYHZo7jil7Qdg==}
-    engines: {node: '>= 8'}
-
  mitt@3.0.1:
    resolution: {integrity: sha512-vKivATfr97l2/QBCYAkXYDbrIWPM2IIKEl7YPhjCvKlG3kE2gm+uBo6nEXK3M5/Ffh/FLpKExzOQ3JJoJGFKBw==}

@@ -9302,11 +9315,6 @@ packages:
    resolution: {integrity: sha512-FP+p8RB8OWpF3YZBCrP5gtADmtXApB5AMLn+vdyA+PyxCjrCs00mjyUozssO33cwDeT3wNGdLxJ5M//YqtHAJw==}
    hasBin: true

-  mkdirp@1.0.4:
-    resolution: {integrity: sha512-vVqVZQyf3WLx2Shd0qJ9xuvqgAyKPLAiqITEtqW0oIUjzo3PePDd6fW9iFz30ef7Ysp/oiWqbhszeGWW2T6Gzw==}
-    engines: {node: '>=10'}
-    hasBin: true
-
  moment@2.30.1:
    resolution: {integrity: sha512-uEmtNhbDOrWPFS+hdjFCBfy9f2YoyzRpwcl+DqpC6taX21FzsTLQVbMV/W7PzNSX6x/bhC1zA3c2UQ5NzH6how==}

@@ -9448,9 +9456,6 @@ packages:
  node-abort-controller@3.1.1:
    resolution: {integrity: sha512-AGK2yQKIjRuqnc6VkX2Xj5d+QW8xZ87pa1UK6yA6ouUyuxfHuMP6umE5QK7UmTeOAymo+Zx1Fxiuw9rVx8taHQ==}

-  node-addon-api@5.1.0:
-    resolution: {integrity: sha512-eh0GgfEkpnoWDq+VY8OyvYhFEzBk6jIYbRKdIlyTiAXIVJ8PyBaKb0rp7oDtoddbdoHWhq8wwr+XZ81F1rpNdA==}
-
  node-addon-api@7.1.1:
    resolution: {integrity: sha512-5m3bsyrjFWE1xf7nz7YXdN4udnVtXK6/Yfgn5qnahL6bCkf2yKt4k3nuTKAtT4r3IG8JNR2ncsIMdZuAzJjHQQ==}

@@ -9507,11 +9512,6 @@ packages:
    resolution: {integrity: sha512-Uzmd6LXpouKo8EUK68IjH4+E01w/hXyV3R3g/geCJo+rXLNfh1xucB+LOzYEOQPSiUK3h/xZf0cQGcSsmyL2Og==}
    engines: {node: '>=18'}

-  nopt@5.0.0:
-    resolution: {integrity: sha512-Tbj67rffqceeLpcRXrT7vKAN8CwfPeIBgM7E6iBkmKLV7bEMwpGgYLGv0jACUsECaa/vuxP0IjEont6umdMgtQ==}
-    engines: {node: '>=6'}
-    hasBin: true
-
  normalize-package-data@2.5.0:
    resolution: {integrity: sha512-/5CMN3T0R4XTj4DcGaexo+roZSdSFW/0AOOTROrjxzCG1wrWXEsGbRKevjlIL+ZDE4sZlJr5ED4YW0yqmkK+eA==}

@@ -9542,10 +9542,6 @@ packages:
    resolution: {integrity: sha512-9qny7Z9DsQU8Ou39ERsPU4OZQlSTP47ShQzuKZ6PRXpYLtIFgl/DEBYEXKlvcEa+9tHVcK8CF81Y2V72qaZhWA==}
    engines: {node: '>=18'}

-  npmlog@5.0.1:
-    resolution: {integrity: sha512-AqZtDUWOMKs1G/8lwylVjrdYgqA4d9nu8hc+0gzRxlDb1I10+FHBGMXs6aiQHFdCUUlqH99MUMuLfzWDNDtfxw==}
-    deprecated: This package is no longer supported.
-
  nth-check@2.1.1:
    resolution: {integrity: sha512-lqjrjmaOoAnWfMmBPL+XNnynZh2+swxiX3WUE0s4yEHI6m+AwrK2UZOimIRl3X/4QctVqS8AiZjFqyOGrMXb/w==}

@@ -11557,11 +11553,6 @@ packages:
  tar-stream@3.2.0:
    resolution: {integrity: sha512-ojzvCvVaNp6aOTFmG7jaRD0meowIAuPc3cMMhSgKiVWws1GyHbGd/xvnyuRKcKlMpt3qvxx6r0hreCNITP9hIg==}

-  tar@6.2.1:
-    resolution: {integrity: sha512-DZ4yORTwrbTj/7MZYq2w+/ZFdI6OZ/f9SFHR+71gIVUZhOQPHzVCLpvRnPgyaMpfWxxk/4ONva3GQSyNIKRv6A==}
-    engines: {node: '>=10'}
-    deprecated: Old versions of tar are not supported, and contain widely publicized security vulnerabilities, which have been fixed in the current version. Please update. Support for old versions may be purchased (at exorbitant rates) by contacting i@izs.me
-
  teex@1.0.1:
    resolution: {integrity: sha512-eYE6iEI62Ni1H8oIa7KlDU6uQBtqr4Eajni3wX7rpfXD8ysFx8z0+dri+KWEPWpBsxXfxu58x/0jvTVT1ekOSg==}

@@ -12508,9 +12499,6 @@ packages:
    engines: {node: '>=8'}
    hasBin: true

-  wide-align@1.1.5:
-    resolution: {integrity: sha512-eDMORYaPNZ4sQIuuYPDHdQvf4gyCF9rEEV/yPxGfwPkRodwEgiMUUXTx/dex+Me0wxx53S+NgUHaP7y3MGlDmg==}
-
  window-size@0.1.0:
    resolution: {integrity: sha512-1pTPQDKTdd61ozlKGNCjhNRd+KPmgLSGa3mZTHoOliaGcESD8G1PXhh7c1fgiPjVbNVfgy2Faw4BI8/m0cC8Mg==}
    engines: {node: '>= 0.8.0'}
@@ -12645,9 +12633,6 @@ packages:
  yallist@3.1.1:
    resolution: {integrity: sha512-a4UGQaWPH59mOXUYnAG2ewncQS4i4F43Tv3JoAM+s2VDAmS9NsK8GpDMLrCHPksFT7h3K6TOoUNn2pb7RoXx4g==}

-  yallist@4.0.0:
-    resolution: {integrity: sha512-3wdGidZyq5PB084XLES5TpOSRA3wjXAlIWMhum2kRcv/41Sn2emQ0dycQW4uZXLejwKvg6EsvbdlVL+FYEct7A==}
-
  yaml@1.10.3:
    resolution: {integrity: sha512-vIYeF1u3CjlhAFekPPAk2h/Kv4T3mAkMox5OymRiJQB0spDP10LHvt+K7G9Ny6NuuMAb25/6n1qyUjAcGNf/AA==}
    engines: {node: '>= 6'}
@@ -14110,21 +14095,6 @@ snapshots:
    dependencies:
      react: 19.2.6

-  '@mapbox/node-pre-gyp@1.0.11':
-    dependencies:
-      detect-libc: 2.1.2
-      https-proxy-agent: 5.0.1
-      make-dir: 3.1.0
-      node-fetch: 2.7.0
-      nopt: 5.0.0
-      npmlog: 5.0.1
-      rimraf: 3.0.2
-      semver: 7.8.2
-      tar: 6.2.1
-    transitivePeerDependencies:
-      - encoding
-      - supports-color
-
  '@microsoft/tsdoc@0.15.1': {}

  '@microsoft/tsdoc@0.16.0': {}
@@ -16627,6 +16597,26 @@ snapshots:

  '@sec-ant/readable-stream@0.4.1': {}

+  '@sendgrid/client@8.1.6':
+    dependencies:
+      '@sendgrid/helpers': 8.0.0
+      axios: 1.17.0
+    transitivePeerDependencies:
+      - debug
+      - supports-color
+
+  '@sendgrid/helpers@8.0.0':
+    dependencies:
+      deepmerge: 4.3.1
+
+  '@sendgrid/mail@8.1.6':
+    dependencies:
+      '@sendgrid/client': 8.1.6
+      '@sendgrid/helpers': 8.0.0
+    transitivePeerDependencies:
+      - debug
+      - supports-color
+
  '@sinclair/typebox@0.27.10': {}

  '@sindresorhus/merge-streams@4.0.0': {}
@@ -17034,6 +17024,50 @@ snapshots:
      - debug
      - supports-color

+  '@tria-plc/api-common@file:local-packages/tria-plc-api-common-1.4.3.tgz(d81a2b6a79840fd7ce8c5d0cfc968145)':
+    dependencies:
+      '@nestjs/axios': 4.0.1(@nestjs/common@11.1.24(class-transformer@0.5.1)(class-validator@0.14.4)(reflect-metadata@0.2.2)(rxjs@7.8.2))(axios@1.17.0)(rxjs@7.8.2)
+      '@nestjs/common': 11.1.24(class-transformer@0.5.1)(class-validator@0.14.4)(reflect-metadata@0.2.2)(rxjs@7.8.2)
+      '@nestjs/core': 11.1.24(@nestjs/common@11.1.24(class-transformer@0.5.1)(class-validator@0.14.4)(reflect-metadata@0.2.2)(rxjs@7.8.2))(@nestjs/microservices@11.1.24)(@nestjs/platform-express@11.1.24)(reflect-metadata@0.2.2)(rxjs@7.8.2)
+      '@nestjs/jwt': 10.2.0(@nestjs/common@11.1.24(class-transformer@0.5.1)(class-validator@0.14.4)(reflect-metadata@0.2.2)(rxjs@7.8.2))
+      '@nestjs/microservices': 11.1.24(@nestjs/common@11.1.24(class-transformer@0.5.1)(class-validator@0.14.4)(reflect-metadata@0.2.2)(rxjs@7.8.2))(@nestjs/core@11.1.24)(amqp-connection-manager@5.0.0(amqplib@2.0.1))(amqplib@2.0.1)(reflect-metadata@0.2.2)(rxjs@7.8.2)
+      '@nestjs/passport': 10.0.3(@nestjs/common@11.1.24(class-transformer@0.5.1)(class-validator@0.14.4)(reflect-metadata@0.2.2)(rxjs@7.8.2))(passport@0.7.0)
+      '@nestjs/swagger': 7.4.2(@nestjs/common@11.1.24(class-transformer@0.5.1)(class-validator@0.14.4)(reflect-metadata@0.2.2)(rxjs@7.8.2))(@nestjs/core@11.1.24)(class-transformer@0.5.1)(class-validator@0.14.4)(reflect-metadata@0.2.2)
+      '@nestjs/throttler': 6.5.0(@nestjs/common@11.1.24(class-transformer@0.5.1)(class-validator@0.14.4)(reflect-metadata@0.2.2)(rxjs@7.8.2))(@nestjs/core@11.1.24)(reflect-metadata@0.2.2)
+      '@nestjs/typeorm': 11.0.1(@nestjs/common@11.1.24(class-transformer@0.5.1)(class-validator@0.14.4)(reflect-metadata@0.2.2)(rxjs@7.8.2))(@nestjs/core@11.1.24)(reflect-metadata@0.2.2)(rxjs@7.8.2)(typeorm@0.3.30(babel-plugin-macros@3.1.0)(pg@8.21.0)(ts-node@10.9.2(@types/node@20.19.42)(typescript@5.9.3)))
+      '@tria-plc/iamapi-common': file:local-packages/tria-plc-iamapi-common-0.7.3.tgz(c97ba831ddde82920910406ab5262991)
+      argon2: 0.43.1
+      axios: 1.17.0
+      change-case: 5.4.4
+      class-transformer: 0.5.1
+      class-validator: 0.14.4
+      dotenv: 16.6.1
+      ethiopian-calendar-date-converter: 2.1.6
+      ethiopian-date: 0.0.6
+      exceljs: 4.4.0
+      file-type: 21.3.4
+      handlebars: 4.7.9
+      handlebars-helpers: 0.10.0
+      jmespath: 0.16.0
+      jose: 5.10.0
+      jsonwebtoken: 9.0.3
+      libphonenumber-js: 1.13.6
+      libreoffice-convert: 1.8.1
+      nestjs-minio-client: 2.2.0(@nestjs/common@11.1.24(class-transformer@0.5.1)(class-validator@0.14.4)(reflect-metadata@0.2.2)(rxjs@7.8.2))(@nestjs/core@11.1.24)
+      passport-jwt: 4.0.1
+      qrcode: 1.5.4
+      reflect-metadata: 0.2.2
+      rxjs: 7.8.2
+      style-object-to-css-string: 1.1.3
+      typeorm: 0.3.30(babel-plugin-macros@3.1.0)(pg@8.21.0)(ts-node@10.9.2(@types/node@20.19.42)(typescript@5.9.3))
+      typeorm-extension: 3.9.0(@faker-js/faker@10.4.0)(typeorm@0.3.30(babel-plugin-macros@3.1.0)(pg@8.21.0)(ts-node@10.9.2(@types/node@20.19.42)(typescript@5.9.3)))
+      uuid: 11.1.1
+      xlsx: 0.18.5
+    transitivePeerDependencies:
+      - '@faker-js/faker'
+      - debug
+      - supports-color
+
  '@tria-plc/iamapi-common@0.6.6(578386f46cf99fd4720e3e99f196f69e)':
    dependencies:
      '@nestjs/axios': 4.0.1(@nestjs/common@11.1.24(class-transformer@0.5.1)(class-validator@0.14.4)(reflect-metadata@0.2.2)(rxjs@7.8.2))(axios@1.17.0)(rxjs@7.8.2)
@@ -17068,6 +17102,41 @@ snapshots:
      - '@faker-js/faker'
      - supports-color

+  '@tria-plc/iamapi-common@file:local-packages/tria-plc-iamapi-common-0.7.3.tgz(c97ba831ddde82920910406ab5262991)':
+    dependencies:
+      '@nestjs/axios': 4.0.1(@nestjs/common@11.1.24(class-transformer@0.5.1)(class-validator@0.14.4)(reflect-metadata@0.2.2)(rxjs@7.8.2))(axios@1.17.0)(rxjs@7.8.2)
+      '@nestjs/common': 11.1.24(class-transformer@0.5.1)(class-validator@0.14.4)(reflect-metadata@0.2.2)(rxjs@7.8.2)
+      '@nestjs/core': 11.1.24(@nestjs/common@11.1.24(class-transformer@0.5.1)(class-validator@0.14.4)(reflect-metadata@0.2.2)(rxjs@7.8.2))(@nestjs/microservices@11.1.24)(@nestjs/platform-express@11.1.24)(reflect-metadata@0.2.2)(rxjs@7.8.2)
+      '@nestjs/jwt': 10.2.0(@nestjs/common@11.1.24(class-transformer@0.5.1)(class-validator@0.14.4)(reflect-metadata@0.2.2)(rxjs@7.8.2))
+      '@nestjs/microservices': 11.1.24(@nestjs/common@11.1.24(class-transformer@0.5.1)(class-validator@0.14.4)(reflect-metadata@0.2.2)(rxjs@7.8.2))(@nestjs/core@11.1.24)(amqp-connection-manager@5.0.0(amqplib@2.0.1))(amqplib@2.0.1)(reflect-metadata@0.2.2)(rxjs@7.8.2)
+      '@nestjs/passport': 10.0.3(@nestjs/common@11.1.24(class-transformer@0.5.1)(class-validator@0.14.4)(reflect-metadata@0.2.2)(rxjs@7.8.2))(passport@0.7.0)
+      '@nestjs/swagger': 7.4.2(@nestjs/common@11.1.24(class-transformer@0.5.1)(class-validator@0.14.4)(reflect-metadata@0.2.2)(rxjs@7.8.2))(@nestjs/core@11.1.24)(class-transformer@0.5.1)(class-validator@0.14.4)(reflect-metadata@0.2.2)
+      '@nestjs/throttler': 6.5.0(@nestjs/common@11.1.24(class-transformer@0.5.1)(class-validator@0.14.4)(reflect-metadata@0.2.2)(rxjs@7.8.2))(@nestjs/core@11.1.24)(reflect-metadata@0.2.2)
+      '@nestjs/typeorm': 11.0.1(@nestjs/common@11.1.24(class-transformer@0.5.1)(class-validator@0.14.4)(reflect-metadata@0.2.2)(rxjs@7.8.2))(@nestjs/core@11.1.24)(reflect-metadata@0.2.2)(rxjs@7.8.2)(typeorm@0.3.30(babel-plugin-macros@3.1.0)(pg@8.21.0)(ts-node@10.9.2(@types/node@20.19.42)(typescript@5.9.3)))
+      '@tria-plc/api-common': file:local-packages/tria-plc-api-common-1.4.3.tgz(d81a2b6a79840fd7ce8c5d0cfc968145)
+      api-common: 1.2.2
+      argon2: 0.43.1
+      axios: 1.17.0
+      class-transformer: 0.5.1
+      class-validator: 0.14.4
+      dotenv: 17.4.2
+      ethiopian-date: 0.0.6
+      file-type: 21.3.4
+      jose: 5.10.0
+      jsonwebtoken: 9.0.3
+      libphonenumber-js: 1.13.6
+      nestjs-minio-client: 2.2.0(@nestjs/common@11.1.24(class-transformer@0.5.1)(class-validator@0.14.4)(reflect-metadata@0.2.2)(rxjs@7.8.2))(@nestjs/core@11.1.24)
+      passport-jwt: 4.0.1
+      qrcode: 1.5.4
+      reflect-metadata: 0.2.2
+      rxjs: 7.8.2
+      typeorm: 0.3.30(babel-plugin-macros@3.1.0)(pg@8.21.0)(ts-node@10.9.2(@types/node@20.19.42)(typescript@5.9.3))
+      typeorm-extension: 3.9.0(@faker-js/faker@10.4.0)(typeorm@0.3.30(babel-plugin-macros@3.1.0)(pg@8.21.0)(ts-node@10.9.2(@types/node@20.19.42)(typescript@5.9.3)))
+      uuid: 11.1.1
+    transitivePeerDependencies:
+      - '@faker-js/faker'
+      - supports-color
+
  '@tria-plc/iamui-common@1.1.2(631ddfe3435b77e5a0893e986e0c71da)':
    dependencies:
      '@chakra-ui/react': 3.35.0(@emotion/react@11.14.0(@types/react@18.3.31)(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
@@ -17410,10 +17479,6 @@ snapshots:
    dependencies:
      '@babel/types': 7.29.7

-  '@types/bcrypt@5.0.2':
-    dependencies:
-      '@types/node': 20.19.42
-
  '@types/body-parser@1.19.6':
    dependencies:
      '@types/connect': 3.4.38
@@ -17465,6 +17530,13 @@ snapshots:

  '@types/estree@1.0.9': {}

+  '@types/express-serve-static-core@4.19.8':
+    dependencies:
+      '@types/node': 20.19.42
+      '@types/qs': 6.15.1
+      '@types/range-parser': 1.2.7
+      '@types/send': 1.2.1
+
  '@types/express-serve-static-core@5.1.1':
    dependencies:
      '@types/node': 20.19.42
@@ -17472,6 +17544,13 @@ snapshots:
      '@types/range-parser': 1.2.7
      '@types/send': 1.2.1

+  '@types/express@4.17.25':
+    dependencies:
+      '@types/body-parser': 1.19.6
+      '@types/express-serve-static-core': 4.19.8
+      '@types/qs': 6.15.1
+      '@types/serve-static': 1.15.10
+
  '@types/express@5.0.6':
    dependencies:
      '@types/body-parser': 1.19.6
@@ -17510,11 +17589,6 @@ snapshots:

  '@types/json5@0.0.29': {}

-  '@types/jsonwebtoken@9.0.10':
-    dependencies:
-      '@types/ms': 2.1.0
-      '@types/node': 20.19.42
-
  '@types/jsonwebtoken@9.0.5':
    dependencies:
      '@types/node': 20.19.42
@@ -17525,7 +17599,7 @@ snapshots:

  '@types/methods@1.1.4': {}

-  '@types/ms@2.1.0': {}
+  '@types/mime@1.3.5': {}

  '@types/multer@2.1.0':
    dependencies:
@@ -17545,20 +17619,6 @@ snapshots:

  '@types/parse-json@4.0.2': {}

-  '@types/passport-jwt@4.0.1':
-    dependencies:
-      '@types/jsonwebtoken': 9.0.10
-      '@types/passport-strategy': 0.2.38
-
-  '@types/passport-strategy@0.2.38':
-    dependencies:
-      '@types/express': 5.0.6
-      '@types/passport': 1.0.17
-
-  '@types/passport@1.0.17':
-    dependencies:
-      '@types/express': 5.0.6
-
  '@types/pg@8.20.0':
    dependencies:
      '@types/node': 20.19.42
@@ -17591,10 +17651,21 @@ snapshots:
      '@types/prop-types': 15.7.15
      csstype: 3.2.3

+  '@types/send@0.17.6':
+    dependencies:
+      '@types/mime': 1.3.5
+      '@types/node': 20.19.42
+
  '@types/send@1.2.1':
    dependencies:
      '@types/node': 20.19.42

+  '@types/serve-static@1.15.10':
+    dependencies:
+      '@types/http-errors': 2.0.5
+      '@types/node': 20.19.42
+      '@types/send': 0.17.6
+
  '@types/serve-static@2.2.0':
    dependencies:
      '@types/http-errors': 2.0.5
@@ -18519,8 +18590,6 @@ snapshots:
      jsonparse: 1.3.1
      through: 2.3.8

-  abbrev@1.1.1: {}
-
  abort-controller@3.0.0:
    dependencies:
      event-target-shim: 5.0.1
@@ -18839,8 +18908,6 @@ snapshots:

  append-field@1.0.0: {}

-  aproba@2.1.0: {}
-
  archiver-utils@2.1.0:
    dependencies:
      glob: 7.2.3
@@ -18877,11 +18944,6 @@ snapshots:
      tar-stream: 2.2.0
      zip-stream: 4.1.1

-  are-we-there-yet@2.0.0:
-    dependencies:
-      delegates: 1.0.0
-      readable-stream: 3.6.2
-
  arg@4.1.3: {}

  arg@5.0.2: {}
@@ -19210,14 +19272,6 @@ snapshots:
    dependencies:
      tweetnacl: 0.14.5

-  bcrypt@5.1.1:
-    dependencies:
-      '@mapbox/node-pre-gyp': 1.0.11
-      node-addon-api: 5.1.0
-    transitivePeerDependencies:
-      - encoding
-      - supports-color
-
  bidi-js@1.0.3:
    dependencies:
      require-from-string: 2.0.2
@@ -19633,8 +19687,6 @@ snapshots:
    dependencies:
      readdirp: 4.1.2

-  chownr@2.0.0: {}
-
  chrome-trace-event@1.0.4: {}

  chromium-bidi@14.0.0(devtools-protocol@0.0.1608973):
@@ -19778,8 +19830,6 @@ snapshots:
    dependencies:
      color-name: 2.1.0

-  color-support@1.1.3: {}
-
  colorette@2.0.20: {}

  colors@1.0.3: {}
@@ -19854,8 +19904,6 @@ snapshots:

  console-browserify@1.2.0: {}

-  console-control-strings@1.1.0: {}
-
  constants-browserify@1.0.0: {}

  content-disposition@0.5.4:
@@ -20280,8 +20328,6 @@ snapshots:

  delayed-stream@1.0.0: {}

-  delegates@1.0.0: {}
-
  depd@1.1.2: {}

  depd@2.0.0: {}
@@ -21546,10 +21592,6 @@ snapshots:
      jsonfile: 6.2.1
      universalify: 2.0.1

-  fs-minipass@2.1.0:
-    dependencies:
-      minipass: 3.3.6
-
  fs-monkey@1.1.0: {}

  fs.realpath@1.0.0: {}
@@ -21585,18 +21627,6 @@ snapshots:

  fuzzysort@3.1.0: {}

-  gauge@3.0.2:
-    dependencies:
-      aproba: 2.1.0
-      color-support: 1.1.3
-      console-control-strings: 1.1.0
-      has-unicode: 2.0.1
-      object-assign: 4.1.1
-      signal-exit: 3.0.7
-      string-width: 4.2.3
-      strip-ansi: 6.0.1
-      wide-align: 1.1.5
-
  generator-function@2.0.1: {}

  gensync@1.0.0-beta.2: {}
@@ -21861,8 +21891,6 @@ snapshots:
    dependencies:
      has-symbols: 1.1.0

-  has-unicode@2.0.1: {}
-
  has-value@0.3.1:
    dependencies:
      get-value: 2.0.6
@@ -22968,6 +22996,10 @@ snapshots:
      ms: 2.1.3
      semver: 7.8.2

+  jspdf-autotable@5.0.8(jspdf@4.2.1):
+    dependencies:
+      jspdf: 4.2.1
+
  jspdf@3.0.4:
    dependencies:
      '@babel/runtime': 7.29.7
@@ -22979,6 +23011,17 @@ snapshots:
      dompurify: 3.4.8
      html2canvas: 1.4.1

+  jspdf@4.2.1:
+    dependencies:
+      '@babel/runtime': 7.29.7
+      fast-png: 6.4.0
+      fflate: 0.8.3
+    optionalDependencies:
+      canvg: 3.0.11
+      core-js: 3.49.0
+      dompurify: 3.4.8
+      html2canvas: 1.4.1
+
  jsprim@1.4.2:
    dependencies:
      assert-plus: 1.0.0
@@ -23398,10 +23441,6 @@ snapshots:

  make-cancellable-promise@2.0.0: {}

-  make-dir@3.1.0:
-    dependencies:
-      semver: 6.3.1
-
  make-dir@4.0.0:
    dependencies:
      semver: 7.8.2
@@ -23612,19 +23651,8 @@ snapshots:
      xml: 1.0.1
      xml2js: 0.5.0

-  minipass@3.3.6:
-    dependencies:
-      yallist: 4.0.0
-
-  minipass@5.0.0: {}
-
  minipass@7.1.3: {}

-  minizlib@2.1.2:
-    dependencies:
-      minipass: 3.3.6
-      yallist: 4.0.0
-
  mitt@3.0.1: {}

  mixin-deep@1.3.2:
@@ -23640,8 +23668,6 @@ snapshots:
    dependencies:
      minimist: 1.2.8

-  mkdirp@1.0.4: {}
-
  moment@2.30.1: {}

  motion-dom@12.40.0:
@@ -23826,8 +23852,6 @@ snapshots:

  node-abort-controller@3.1.1: {}

-  node-addon-api@5.1.0: {}
-
  node-addon-api@7.1.1: {}

  node-addon-api@8.8.0: {}
@@ -23896,10 +23920,6 @@ snapshots:

  node-releases@2.0.47: {}

-  nopt@5.0.0:
-    dependencies:
-      abbrev: 1.1.1
-
  normalize-package-data@2.5.0:
    dependencies:
      hosted-git-info: 2.8.9
@@ -23934,13 +23954,6 @@ snapshots:
      path-key: 4.0.0
      unicorn-magic: 0.3.0

-  npmlog@5.0.1:
-    dependencies:
-      are-we-there-yet: 2.0.0
-      console-control-strings: 1.1.0
-      gauge: 3.0.2
-      set-blocking: 2.0.0
-
  nth-check@2.1.1:
    dependencies:
      boolbase: 1.0.0
@@ -26460,15 +26473,6 @@ snapshots:
      - bare-buffer
      - react-native-b4a

-  tar@6.2.1:
-    dependencies:
-      chownr: 2.0.0
-      fs-minipass: 2.1.0
-      minipass: 5.0.0
-      minizlib: 2.1.2
-      mkdirp: 1.0.4
-      yallist: 4.0.0
-
  teex@1.0.1:
    dependencies:
      streamx: 2.27.0
@@ -27572,10 +27576,6 @@ snapshots:
      siginfo: 2.0.0
      stackback: 0.0.2

-  wide-align@1.1.5:
-    dependencies:
-      string-width: 4.2.3
-
  window-size@0.1.0: {}

  winston-daily-rotate-file@1.7.2(winston@2.4.7):
@@ -27684,8 +27684,6 @@ snapshots:

  yallist@3.1.1: {}

-  yallist@4.0.0: {}
-
  yaml@1.10.3: {}

  yaml@2.9.0: {}