feat: ( passenger ) wire IAM global guard, org seeder, and backoffice auth

apps/edr-passenger-api/src/modules/audit/audit.controller.ts

@@ -1,11 +1,12 @@
-import { Controller, Get, Param, Query, UseGuards } from '@nestjs/common';
+import { Controller, Get, Param, Query } from '@nestjs/common';
 import { ApiTags, ApiOperation, ApiBearerAuth, ApiQuery } from '@nestjs/swagger';
 import { AuditService } from '../../common/audit.service';
-import { IamGuard } from '../../common/iam-adapter';
+import { PassengerStaff } from '../../common/passenger-guards';
+import { PASSENGER_PERMS } from '../../seed/passenger-permissions.registry';
 
 @ApiTags('Audit')
 @Controller('audit')
-@UseGuards(IamGuard)
+@PassengerStaff([PASSENGER_PERMS.audit.view, PASSENGER_PERMS.admin])
 @ApiBearerAuth('IAM-auth')
 export class AuditController {
   constructor(private auditService: AuditService) {}

apps/edr-passenger-api/src/modules/auth/auth.controller.ts

@@ -1,5 +1,6 @@
 import { Body, Controller, Post, HttpCode, HttpStatus, UseGuards, Get, Request, UnauthorizedException } from '@nestjs/common';
 import { ApiTags, ApiOperation, ApiResponse, ApiBody, ApiBearerAuth } from '@nestjs/swagger';
+import { IsPublic } from '@tria-plc/api-common/modules/auth/decorators/public.decorator';
 import { PassengerAuthService } from './passenger-auth.service';
 import { RegisterDto, LoginDto } from './auth.dto';
 import { JwtGuard } from '../../common/jwt.guard';
@@ -10,6 +11,7 @@ export class AuthController {
   constructor(private passengerAuthService: PassengerAuthService) {}
 
   @Post('register')
+  @IsPublic()
   @ApiOperation({ summary: 'Register new passenger account' })
   @ApiResponse({ status: 201, description: 'Account created. Returns token + user.' })
   @ApiResponse({ status: 409, description: 'Email or phone already registered' })
@@ -19,6 +21,7 @@ export class AuthController {
   }
 
   @Post('login')
+  @IsPublic()
   @HttpCode(HttpStatus.OK)
   @ApiOperation({ summary: 'Login with email and password' })
   @ApiResponse({ status: 200, description: 'Login successful. Returns token + passengerId.' })

apps/edr-passenger-api/src/modules/currencies/currencies.controller.ts

@@ -1,10 +1,9 @@
-import { Controller, Get, Post, Patch, Delete, Body, Param, HttpCode, UseGuards } from '@nestjs/common';
+import { Controller, Get, Post, Patch, Delete, Body, Param, HttpCode } from '@nestjs/common';
 import { ApiTags, ApiBearerAuth } from '@nestjs/swagger';
 import { CurrenciesService } from './currencies.service';
 import { CreateCurrencyDto, UpdateCurrencyDto } from './currencies.dto';
-import { IamGuard } from '../../common/iam-adapter';
-import { Roles } from '../../common/roles.decorator';
-import { RolesGuard } from '../../common/roles.guard';
+import { PassengerAdmin, PassengerStaff } from '../../common/passenger-guards';
+import { PASSENGER_PERMS } from '../../seed/passenger-permissions.registry';
 
 @ApiTags('Currencies')
 @Controller('currencies')
@@ -17,8 +16,7 @@ export class CurrenciesController {
   }
 
   @Post()
-  @UseGuards(IamGuard, RolesGuard)
-  @Roles('ADMIN')
+  @PassengerStaff(PASSENGER_PERMS.currencies.manage)
   @ApiBearerAuth('IAM-auth')
   @HttpCode(201)
   createCurrency(@Body() dto: CreateCurrencyDto) {
@@ -26,24 +24,21 @@ export class CurrenciesController {
   }
 
   @Patch(':id')
-  @UseGuards(IamGuard, RolesGuard)
-  @Roles('ADMIN')
+  @PassengerStaff(PASSENGER_PERMS.currencies.manage)
   @ApiBearerAuth('IAM-auth')
   updateCurrency(@Param('id') id: string, @Body() dto: UpdateCurrencyDto) {
     return this.currenciesService.updateCurrency(id, dto);
   }
 
   @Delete(':id')
-  @UseGuards(IamGuard, RolesGuard)
-  @Roles('ADMIN')
+  @PassengerAdmin()
   @ApiBearerAuth('IAM-auth')
   deleteCurrency(@Param('id') id: string) {
     return this.currenciesService.deleteCurrency(id);
   }
 
   @Post('sync-rates')
-  @UseGuards(IamGuard, RolesGuard)
-  @Roles('ADMIN')
+  @PassengerStaff(PASSENGER_PERMS.currencies.manage)
   @ApiBearerAuth('IAM-auth')
   @HttpCode(200)
   syncRates() {

apps/edr-passenger-api/src/modules/fraud/fraud.controller.ts

@@ -1,14 +1,12 @@
-import { Controller, Get, Post, Body, Query, UseGuards, Logger } from '@nestjs/common';
+import { Controller, Get, Post, Body, Query, Logger } from '@nestjs/common';
 import { ApiTags, ApiOperation, ApiBearerAuth } from '@nestjs/swagger';
 import { FraudService, FraudRuleConfig } from './fraud.service';
-// IAM auth: validate the IAM session token via @tria-plc/api-common's DB-backed JwtGuard.
-import { JwtGuard as IamJwtGuard } from '@tria-plc/api-common/modules/auth/services/jwt.guard';
+import { PassengerStaff } from '../../common/passenger-guards';
+import { PASSENGER_PERMS } from '../../seed/passenger-permissions.registry';
 
 @ApiTags('Fraud Detection')
 @Controller('fraud')
-// TODO(iam-authz): restrict per route via @UseGuards(PermissionGuard([...])) once the IAM
-// role→permission mapping (EIamPermissionKey) is confirmed. For now: authenticated IAM users only.
-@UseGuards(IamJwtGuard)
+@PassengerStaff([PASSENGER_PERMS.fraud.view, PASSENGER_PERMS.admin])
 @ApiBearerAuth('IAM-auth')
 export class FraudController {
   private readonly logger = new Logger(FraudController.name);
@@ -43,6 +41,7 @@ export class FraudController {
    * Create or update fraud rule
    */
   @Post('rules')
+  @PassengerStaff([PASSENGER_PERMS.fraud.manage, PASSENGER_PERMS.admin])
   @ApiOperation({ summary: 'Create or update fraud rule' })
   async upsertRule(@Body() body: { type: string; config: FraudRuleConfig }) {
     const rule = await this.fraudService.upsertRule(body.type, body.config);
@@ -53,6 +52,7 @@ export class FraudController {
    * Block user temporarily
    */
   @Post('actions/block')
+  @PassengerStaff([PASSENGER_PERMS.fraud.manage, PASSENGER_PERMS.admin])
   @ApiOperation({ summary: 'Block user temporarily' })
   async blockUser(@Body() body: { iamUserId: string; durationMinutes: number }) {
     await this.fraudService.blockUserTemporarily(body.iamUserId, body.durationMinutes);
@@ -63,6 +63,7 @@ export class FraudController {
    * Unblock user
    */
   @Post('actions/unblock')
+  @PassengerStaff([PASSENGER_PERMS.fraud.manage, PASSENGER_PERMS.admin])
   @ApiOperation({ summary: 'Unblock user' })
   async unblockUser(@Body() body: { iamUserId: string }) {
     await this.fraudService.unblockUser(body.iamUserId);

apps/edr-passenger-api/src/modules/notifications/notifications.controller.ts

@@ -2,9 +2,8 @@ import { Controller, Get, Param, Patch, Post, Body, UseGuards } from '@nestjs/co
 import { ApiTags, ApiOperation, ApiBearerAuth, ApiBody } from '@nestjs/swagger';
 import { NotificationsService } from './notifications.service';
 import { JwtGuard } from '../../common/jwt.guard';
-import { IamGuard } from '../../common/iam-adapter';
-import { Roles } from '../../common/roles.decorator';
-import { RolesGuard } from '../../common/roles.guard';
+import { PassengerStaff } from '../../common/passenger-guards';
+import { PASSENGER_PERMS } from '../../seed/passenger-permissions.registry';
 import { TestNotificationDto } from './notifications.dto';
 import { EmailClientService } from './email-client.service';
 import { SmsClientService } from './sms-client.service';
@@ -41,8 +40,7 @@ export class NotificationsController {
   }
 
   @Post('send/email')
-  @UseGuards(IamGuard, RolesGuard)
-  @Roles('ADMIN', 'STAFF')
+  @PassengerStaff([PASSENGER_PERMS.notifications.send, PASSENGER_PERMS.admin])
   @ApiOperation({ summary: 'Send a direct email via the email microservice' })
   @ApiBody({ type: SendEmail })
   sendEmail(@Body() dto: SendEmail) {
@@ -50,8 +48,7 @@ export class NotificationsController {
   }
 
   @Post('send/sms')
-  @UseGuards(IamGuard, RolesGuard)
-  @Roles('ADMIN', 'STAFF')
+  @PassengerStaff([PASSENGER_PERMS.notifications.send, PASSENGER_PERMS.admin])
   @ApiOperation({ summary: 'Send a direct SMS via the SMS microservice' })
   @ApiBody({ type: SingleMessageDto })
   sendSms(@Body() dto: SingleMessageDto) {
@@ -59,8 +56,7 @@ export class NotificationsController {
   }
 
   @Post('send/sms/bulk')
-  @UseGuards(IamGuard, RolesGuard)
-  @Roles('ADMIN', 'STAFF')
+  @PassengerStaff([PASSENGER_PERMS.notifications.send, PASSENGER_PERMS.admin])
   @ApiOperation({ summary: 'Send bulk SMS messages via the SMS microservice' })
   @ApiBody({ type: BulkMessagesDto })
   sendBulkSms(@Body() dto: BulkMessagesDto) {
@@ -68,8 +64,6 @@ export class NotificationsController {
   }
 
   @Post('test')
-  // TODO(iam-authz): restrict to admin/staff via IAM PermissionGuard once role→permission mapping
-  // is confirmed. Currently protected by the class-level JwtGuard only.
   @ApiOperation({ summary: 'Test notification delivery (Admin only)' })
   async testNotification(@Body() dto: TestNotificationDto) {
     return this.service.send(

apps/edr-passenger-api/src/modules/payments/payments.controller.ts

@@ -28,9 +28,8 @@ import {
   PaymentMethodTypeEnum,
   PaymentPlatformDto,
 } from "./payments.dto";
-import { JwtGuard } from "../../common/jwt.guard";
-import { RolesGuard } from "../../common/roles.guard";
-import { Roles } from "../../common/roles.decorator";
+import { PassengerStaff } from "../../common/passenger-guards";
+import { PASSENGER_PERMS } from "../../seed/passenger-permissions.registry";
 
 @ApiTags("Payment")
 @Controller("payments")
@@ -38,9 +37,8 @@ export class PaymentsController {
   constructor(private service: PaymentsService) {}
 
   @Get("all")
-  @UseGuards(JwtGuard, RolesGuard)
-  @Roles('ADMIN', 'SUPERVISOR', 'STAFF')
-  @ApiBearerAuth("JWT-auth")
+  @PassengerStaff([PASSENGER_PERMS.payments.viewAll, PASSENGER_PERMS.admin])
+  @ApiBearerAuth("IAM-auth")
   @ApiOperation({ summary: "Get all payments with filters (staff/admin only)" })
   @ApiQuery({ name: "search", required: false })
   @ApiQuery({ name: "status", required: false })
@@ -101,18 +99,16 @@ export class PaymentsController {
   }
 
   @Post("refund")
-  @UseGuards(JwtGuard, RolesGuard)
-  @Roles('ADMIN', 'STAFF', 'AGENT')
-  @ApiBearerAuth("JWT-auth")
+  @PassengerStaff([PASSENGER_PERMS.payments.refund, PASSENGER_PERMS.admin])
+  @ApiBearerAuth("IAM-auth")
   @ApiOperation({ summary: "Refund a confirmed booking (staff/agent only)" })
   refund(@Body() dto: RefundDto) {
     return this.service.refund(dto);
   }
 
   @Post("methods")
-  @UseGuards(JwtGuard, RolesGuard)
-  @Roles('ADMIN', 'STAFF')
-  @ApiBearerAuth("JWT-auth")
+  @PassengerStaff([PASSENGER_PERMS.payments.manageMethods, PASSENGER_PERMS.admin])
+  @ApiBearerAuth("IAM-auth")
   @ApiOperation({
     summary: "Add a payment system to the platform catalog (admin only)",
   })

apps/edr-passenger-api/src/modules/reports/reports.controller.ts

@@ -1,15 +1,13 @@
-import { Body, Controller, Get, Param, Post, Query, UseGuards } from '@nestjs/common';
+import { Body, Controller, Get, Param, Post, Query } from '@nestjs/common';
 import { ApiTags, ApiOperation, ApiBearerAuth } from '@nestjs/swagger';
 import { ReportsService } from './reports.service';
 import { GenerateReportDto } from './reports.dto';
-// IAM auth: validate the IAM session token via @tria-plc/api-common's DB-backed JwtGuard.
-import { JwtGuard as IamJwtGuard } from '@tria-plc/api-common/modules/auth/services/jwt.guard';
+import { PassengerStaff } from '../../common/passenger-guards';
+import { PASSENGER_PERMS } from '../../seed/passenger-permissions.registry';
 
 @ApiTags('Reports')
 @Controller('reports')
-// TODO(iam-authz): restrict per route via @UseGuards(PermissionGuard([...])) once the IAM
-// role→permission mapping (EIamPermissionKey) is confirmed. For now: authenticated IAM users only.
-@UseGuards(IamJwtGuard)
+@PassengerStaff([PASSENGER_PERMS.reports.view, PASSENGER_PERMS.admin])
 @ApiBearerAuth('IAM-auth')
 export class ReportsController {
   constructor(private service: ReportsService) {}