feat: setup contact person verification

apps/edr-freight-api/src/modules/companies/companies.service.ts

@@ -582,6 +582,8 @@ export class CompaniesService {
       attrUpdates.contactPersonEmail = dto.contactPersonEmail;
     if (dto.contactPersonPhone !== undefined)
       attrUpdates.contactPersonPhone = normalizeE164(dto.contactPersonPhone);
+    if (dto.contactVerifiedPhone !== undefined)
+      attrUpdates.contactVerifiedPhone = normalizeE164(dto.contactVerifiedPhone);
     if (dto.generalManagerName !== undefined)
       attrUpdates.generalManagerName = dto.generalManagerName;
     if (dto.generalManagerEmail !== undefined)

apps/edr-freight-api/src/modules/companies/dto/profile-response.dto.ts

@@ -34,6 +34,8 @@ export class ProfileResponseDto {
   contactPersonPosition: string | null;
   contactPersonEmail: string | null;
   contactPersonPhone: string | null;
+  /** Phone that passed SMS OTP verification (drives the verify-step resume). */
+  contactVerifiedPhone: string | null;
   generalManagerName: string | null;
   generalManagerEmail: string | null;
   generalManagerPhone: string | null;
@@ -81,6 +83,7 @@ export class ProfileResponseDto {
     this.contactPersonPosition = attrs.contactPersonPosition ?? null;
     this.contactPersonEmail = attrs.contactPersonEmail ?? null;
     this.contactPersonPhone = attrs.contactPersonPhone ?? null;
+    this.contactVerifiedPhone = attrs.contactVerifiedPhone ?? null;
     this.generalManagerName = attrs.generalManagerName ?? null;
     this.generalManagerEmail = attrs.generalManagerEmail ?? null;
     this.generalManagerPhone = attrs.generalManagerPhone ?? null;

apps/edr-freight-api/src/modules/companies/dto/update-profile.dto.ts

@@ -65,6 +65,16 @@ export class UpdateProfileDto {
   @IsValidPhone()
   contactPersonPhone?: string;
 
+  /**
+   * The contact-person phone that completed SMS OTP verification. Persisted so
+   * the onboarding "verify" step can resume its "done" state after a refresh
+   * (compared against the current contactPersonPhone on the client).
+   */
+  @IsOptional()
+  @IsString()
+  @IsValidPhone()
+  contactVerifiedPhone?: string;
+
   @IsOptional()
   @IsString()
   generalManagerName?: string;

apps/edr-freight-api/src/modules/otp/otp.controller.ts

@@ -24,13 +24,9 @@ export class OtpController {
   @Post("send")
   async sendOtp(
     @Body("phone")
-    phone: string,
-     @Body("otp")
-    otp: string
+    phone: string
   ) {
-    return this.otpService.sendOtp(
-      phone,otp
-    );
+    return this.otpService.sendOtp(phone);
   }
 
   // ---------------------------------------------------------------------------

apps/edr-freight-api/src/modules/otp/otp.service.ts

@@ -29,11 +29,12 @@ export class OtpService {
   // Send OTP
   // ---------------------------------------------------------------------------
 
-  async sendOtp(phone: string, otp: string) {
+  async sendOtp(phone: string) {
     try {
-      // generate otp
-      // const otp =
-      //   this.generateOtp();
+      // The verification code is generated server-side — never supplied by the
+      // caller — so the OTP stays a secret known only to the server and the
+      // recipient of the SMS.
+      const otp = this.generateOtp();
 
       // find existing phone
       const existingPhone =