Fare and route-coach, production checklist updates

apps/edr-passenger-api/src/main.ts

@@ -1,11 +1,12 @@
-// Load .env into process.env BEFORE the module graph is built. Required because the @tria-plc IAM
+// Load .env into process.env BEFORE the module graph is built. Required because the @tria-plc IAM
 // modules read process.env at module-load time (e.g. MinioModule.register reads MINIO_ENDPOINT),
 // which happens before ConfigModule.forRoot() would populate it. Must be the very first import.
 import "dotenv/config";
 import "reflect-metadata";
 import { NestFactory } from "@nestjs/core";
-import { ValidationPipe, VersioningType } from "@nestjs/common";
+import { Logger, ValidationPipe, VersioningType } from "@nestjs/common";
 import { DocumentBuilder, SwaggerModule } from "@nestjs/swagger";
+import helmet from "helmet";
 import { AppModule } from "./app.module";
 import { HttpExceptionFilter } from "./common/filters/http-exception.filter";
 import { ResponseTransformInterceptor } from "./common/interceptors/response-transform.interceptor";
@@ -14,21 +15,32 @@ import { SessionActivityInterceptor } from "./common/interceptors/session-activi
 // Set timezone to Africa/Addis_Ababa (EAT - UTC+3) for Ethiopian Railway operations
 process.env.TZ = 'Africa/Addis_Ababa';
 
+// Safety guard: prevent insecure TLS from being enabled in production
+if (process.env.NODE_ENV === 'production' && process.env.WAAFI_INSECURE_TLS === 'true') {
+  throw new Error('WAAFI_INSECURE_TLS=true is not allowed in production');
+}
+
 async function bootstrap() {
   // rawBody: true buffers the unparsed request body onto req.rawBody so webhook handlers
   // (e.g. Waafi HMAC verification) can sign over the exact bytes the provider signed.
   const app = await NestFactory.create(AppModule, { rawBody: true });
 
+  // Security headers
+  app.use(helmet());
+
   // URI versioning: the @tria-plc IAM controllers declare `version: "1"` so they register under
   // `/v1/...` (e.g. /v1/auth/login). Passenger controllers declare no version, so they stay
-  // version-neutral at their existing paths (e.g. /search, /bookings) — unchanged for the frontend.
+  // version-neutral at their existing paths (e.g. /search, /bookings) — unchanged for the frontend.
   app.enableVersioning({ type: VersioningType.URI });
 
   app.enableCors({
     origin: [
       process.env.PORTAL_URL ?? "http://localhost:5174",
-      process.env.BACK_OFFICE_URL ?? "http://localhost:5184",      
+      process.env.BACK_OFFICE_URL ?? "http://localhost:5184",
     ],
+    methods: ['GET', 'POST', 'PUT', 'PATCH', 'DELETE', 'OPTIONS'],
+    allowedHeaders: ['Content-Type', 'Authorization', 'Accept-Language', 'X-Request-ID'],
+    credentials: true,
   });
 
   app.useGlobalFilters(new HttpExceptionFilter());
@@ -38,6 +50,7 @@ async function bootstrap() {
   );
   app.useGlobalPipes(new ValidationPipe({ whitelist: true, transform: true, forbidUnknownValues: false }));
 
+  if (process.env.NODE_ENV !== 'production') {
   const config = new DocumentBuilder()
     .setTitle("EDR Passenger API")
     .setDescription(
@@ -130,7 +143,7 @@ Enterprise-grade REST API for the Ethio-Djibouti Railway passenger booking and m
 - Ticket lifecycle tracking (validatedAt, outboundBoardedAt, returnBoardedAt timestamps)
 - Gate validation accepts leg (OUTBOUND or RETURN) for round-trip tickets
 - Complete audit trail per leg for compliance and reporting
-- **Boarding pass delivered via email + SMS on every successful gate validation** — includes route, train, departure/arrival, QR code (email), seat assignments per passenger, and barcode
+- **Boarding pass delivered via email + SMS on every successful gate validation** — includes route, train, departure/arrival, QR code (email), seat assignments per passenger, and barcode
 
 ### Booking Type Matrix
 
@@ -240,28 +253,28 @@ For round-trips also pass \`returnScheduleId\`, \`returnOriginStationId\`, \`ret
 
 ### Step 3: Passenger Information & Verification
 **For Ethiopian Passengers:**
-\`POST /passengers/verify-fayda\` — Automatic Fayda verification for adults (5+ years)
+\`POST /passengers/verify-fayda\` — Automatic Fayda verification for adults (5+ years)
 
 **For International Passengers:**
-\`POST /passengers/register-international\` — Passport information collection
+\`POST /passengers/register-international\` — Passport information collection
 
 ### Step 4: View Seat Map
-\`GET /seats/seatmap/{scheduleId}\` — Show available coaches and seats.
+\`GET /seats/seatmap/{scheduleId}\` — Show available coaches and seats.
 For round-trips, call this twice: once for outbound scheduleId, once for return scheduleId.
 
 ### Step 5: Hold Seats
 \`POST /seats/hold\` to reserve seats for 15 minutes.
-- ONE_WAY / TRANSIT outbound leg: one hold call → \`holdId\`
-- TRANSIT leg-2: second hold call → \`leg2HoldId\`
-- ROUND_TRIP return: second hold call → \`returnHoldId\`
-- ROUND_TRIP_TRANSIT: four hold calls → \`holdId\`, \`leg2HoldId\`, \`returnHoldId\`, \`returnLeg2HoldId\`
+- ONE_WAY / TRANSIT outbound leg: one hold call → \`holdId\`
+- TRANSIT leg-2: second hold call → \`leg2HoldId\`
+- ROUND_TRIP return: second hold call → \`returnHoldId\`
+- ROUND_TRIP_TRANSIT: four hold calls → \`holdId\`, \`leg2HoldId\`, \`returnHoldId\`, \`returnLeg2HoldId\`
 
 ### Step 6: Create Booking
 Choose the right endpoint and bookingType:
-- **ONE_WAY** → \`POST /bookings/guest\` or \`POST /bookings\` with \`bookingType: ONE_WAY\`, passenger \`seatId\`
-- **ROUND_TRIP** → same endpoint with \`bookingType: ROUND_TRIP\`, \`returnScheduleId/returnHoldId/returnOriginStationId/returnDestinationStationId\`, passenger \`seatId + returnSeatId\`
-- **TRANSIT** → same endpoint with \`bookingType: TRANSIT\`, \`leg2ScheduleId/leg2HoldId/transitStationId/leg2DestinationStationId\`, passenger \`seatId + leg2SeatId\`
-- **ROUND_TRIP_TRANSIT** → same endpoint with \`bookingType: ROUND_TRIP_TRANSIT\`, all 4 sets of schedule/hold/station fields, passenger \`seatId + leg2SeatId + returnSeatId + returnLeg2SeatId\`
+- **ONE_WAY** → \`POST /bookings/guest\` or \`POST /bookings\` with \`bookingType: ONE_WAY\`, passenger \`seatId\`
+- **ROUND_TRIP** → same endpoint with \`bookingType: ROUND_TRIP\`, \`returnScheduleId/returnHoldId/returnOriginStationId/returnDestinationStationId\`, passenger \`seatId + returnSeatId\`
+- **TRANSIT** → same endpoint with \`bookingType: TRANSIT\`, \`leg2ScheduleId/leg2HoldId/transitStationId/leg2DestinationStationId\`, passenger \`seatId + leg2SeatId\`
+- **ROUND_TRIP_TRANSIT** → same endpoint with \`bookingType: ROUND_TRIP_TRANSIT\`, all 4 sets of schedule/hold/station fields, passenger \`seatId + leg2SeatId + returnSeatId + returnLeg2SeatId\`
 
 ### Step 7: Process Payment
 \`POST /payments/telebirr\` (Ethiopian) or \`POST /payments/waafi\` (Djiboutian)
@@ -406,10 +419,12 @@ Payment providers send notifications to:
       operationsSorter: "alpha",
     },
   });
+  } // end if (NODE_ENV !== 'production')
 
   const port = process.env.PORT ?? 4000;
   await app.listen(port);
-  console.log(`🚀 EDR Passenger API running on port ${port}`);
-  console.log(`📚 Swagger: http://localhost:${port}/api-docs`);
+  const logger = new Logger('Bootstrap');
+  logger.log(`EDR Passenger API running on port ${port}`);
+  logger.log(`Swagger: http://localhost:${port}/api-docs`);
 }
 bootstrap();