Tria/edr-platform
1
0
Fork 0
mirror of https://github.com/Tria-plc/edr-platform.git synced 2026-08-26 18:42:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix: ( fayda ) block one Fayda identity from verifying multiple passengers

Browse Source
This commit is contained in:
Abubeker Yasin
2026-08-19 09:25:51 +03:00
parent 0eb64ad9a1
commit 1f38b5a3c6
3 changed files with 58 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
apps/edr-passenger-api/src/modules/verifayda/verifayda.dto.ts
View File

@@ -57,6 +57,14 @@ export class CompleteVerificationResultDto {
agentId?: string;
};
@ApiPropertyOptional({
description:
'eSignet subject identifier for the verified individual (VERIFY flow). A PSUT — ' +
'pairwise and stable per client_id, never the FIN. The booking flow compares it across ' +
'passengers so one Fayda identity cannot verify more than one passenger on a booking.',
})
faydaSub?: string;
@ApiPropertyOptional({ description: 'Verified full name from Fayda (VERIFY flow).' })
fullName?: string;

18
apps/edr-passenger-api/src/modules/verifayda/verifayda.service.ts
View File

@@ -70,11 +70,19 @@ export interface FaydaUserSummary {
/**
* Result of completing a verification. `verified` is always true on success.
* LOGIN additionally returns a JWT + user; VERIFY returns the verified identity
* attributes (name, email, phone, dob, gender) for the caller to consume.
* attributes (name, email, phone, dob, gender, faydaSub) for the caller to consume.
*/
export interface CompleteVerificationResult {
purpose: VerifaydaPurpose;
verified: boolean;
/**
* eSignet subject identifier for the verified individual. This is a PSUT —
* pairwise and stable per `client_id`, never the FIN — so it is safe to hand
* to the browser, and it is the same value `/passengers/me` already returns.
* The booking flow uses it to stop one Fayda identity from verifying more
* than one passenger on the same booking.
*/
faydaSub?: string;
token?: string;
refreshToken?: string;
requiresPassword?: boolean;
@@ -280,6 +288,7 @@ export class VerifaydaService {
result = {
purpose: 'VERIFY',
verified: true,
faydaSub: normalized.sub,
fullName: normalized.fullName,
email: normalized.email,
phoneNumber: normalized.phoneNumber,
@@ -357,6 +366,13 @@ export class VerifaydaService {
code_challenge_method: 'S256',
acr_values: this.faydaConfig.acrValues,
claims_locales: this.faydaConfig.claimsLocales,
// Force a fresh authentication instead of silently reusing the eSignet
// SSO session. A booking can carry several passengers, each of whom must
// verify with their OWN Fayda; without this, the second and third
// "Verify with Fayda" clicks round-trip in a couple of seconds and hand
// back the first passenger's identity, which the booking flow then has to
// reject with no way for the user to authenticate as the right person.
prompt: 'login',
});
// Every claim is marked essential so eSignet shows them locked/pre-checked