Merge pull request #727 from Tria-plc/alpha

add permissions

apps/edr-passenger-api/src/modules/tickets/tickets.controller.ts

@@ -2,7 +2,8 @@ import { Body, Controller, Get, Param, Post, Query, UseGuards, Delete, Patch, Se
 import { ApiTags, ApiOperation, ApiBearerAuth, ApiBody, ApiQuery } from '@nestjs/swagger';
 import { TicketsService } from './tickets.service';
 import { JwtGuard } from '../../common/jwt.guard';
-import { PassengerAdmin } from '../../common/passenger-guards';
+import { PassengerStaff } from '../../common/passenger-guards';
+import { PASSENGER_PERMS } from '../../seed/passenger-permissions.registry';
 
 @ApiTags('Tickets')
 @Controller('tickets')
@@ -10,7 +11,7 @@ export class TicketsController {
   constructor(private service: TicketsService) {}
   
   @Post('smart-assign/:bookingId')
-  @PassengerAdmin()
+  @PassengerStaff(PASSENGER_PERMS.tickets.generate)
   @ApiBearerAuth('IAM-auth')
   @ApiOperation({
     summary: 'Smart seat assignment + ticket generation',
@@ -23,7 +24,7 @@ export class TicketsController {
   }
 
   @Post('generate/:bookingId')
-  @PassengerAdmin()
+  @PassengerStaff(PASSENGER_PERMS.tickets.generate)
   @ApiBearerAuth('IAM-auth')
   @ApiOperation({
     summary: 'Generate ticket for booking (confirmation page)',

apps/edr-passenger-api/src/seed/passenger-permissions.registry.ts

@@ -22,6 +22,7 @@ export const PASSENGER_PERMISSIONS: PassengerPermissionSeed[] = [
   perm('ff5d33a0-0fe7-427f-a065-46dd14ac1da0', 'edr_passenger_app:passengers:manage',          'Manage passengers'),
   perm('326ec767-1da8-4c7e-b557-d4d2f9dd6d2c', 'edr_passenger_app:tickets:view',               'View tickets'),
   perm('8ec5697f-d2d4-40a2-a365-ad624991a2ab', 'edr_passenger_app:tickets:manage',             'Manage tickets'),
+  perm('7f3a1e9c-2b4d-4c8a-9e6f-1a2b3c4d5e6f', 'edr_passenger_app:tickets:generate',           'Generate tickets'),
   perm('736aca18-6660-4865-9773-81a636f51fa0', 'edr_passenger_app:payments:view_all',          'View all payments'),
   perm('44065042-b4af-4af2-b213-34a823f78be1', 'edr_passenger_app:payments:refund',            'Refund payments'),
   perm('558f0172-ab9f-4d13-9477-4ca247d94f3c', 'edr_passenger_app:payments:manage_methods',   'Manage payment methods'),
@@ -82,8 +83,9 @@ export const PASSENGER_PERMS = {
     manage: 'edr_passenger_app:passengers:manage',
   },
   tickets: {
-    view:   'edr_passenger_app:tickets:view',
+    view:     'edr_passenger_app:tickets:view',
-    manage: 'edr_passenger_app:tickets:manage',
+    manage:   'edr_passenger_app:tickets:manage',
+    generate: 'edr_passenger_app:tickets:generate',
   },
   payments: {
     view:           'edr_passenger_app:payments:view',
@@ -172,6 +174,7 @@ export const ROLE_PERMISSION_PRESETS = {
     PASSENGER_PERMS.bookings.manage,
     PASSENGER_PERMS.tickets.view,
     PASSENGER_PERMS.tickets.manage,
+    PASSENGER_PERMS.tickets.generate,
     PASSENGER_PERMS.passengers.view,
     PASSENGER_PERMS.agents.view,
     PASSENGER_PERMS.audit.view,
@@ -182,6 +185,7 @@ export const ROLE_PERMISSION_PRESETS = {
   ticketOfficer: [
     PASSENGER_PERMS.tickets.view,
     PASSENGER_PERMS.tickets.manage,
+    PASSENGER_PERMS.tickets.generate,
     PASSENGER_PERMS.bookings.view,
     PASSENGER_PERMS.passengers.view,
     PASSENGER_PERMS.dashboard.view,
@@ -194,6 +198,7 @@ export const ROLE_PERMISSION_PRESETS = {
     PASSENGER_PERMS.passengers.view,
     PASSENGER_PERMS.tickets.view,
     PASSENGER_PERMS.tickets.manage,
+    PASSENGER_PERMS.tickets.generate,
     PASSENGER_PERMS.payments.refund,
     PASSENGER_PERMS.dashboard.view,
   ],

apps/edr-passenger-web/backoffice/src/lib/permissions.ts

@@ -12,6 +12,7 @@ export const PERMS = {
   tickets: {
     view:        'edr_passenger_app:tickets:view',
     manage:      'edr_passenger_app:tickets:manage',
+    generate:    'edr_passenger_app:tickets:generate',
   },
 
   // ── Master Data ────────────────────────────────────────────────

packages/payment-providers/src/providers/waafi/waafi.provider.ts

@@ -129,13 +129,17 @@ export class WaafiProvider implements PaymentProvider, OnModuleInit {
       requestBody,
     );
 
+    this.logger.log(
+      `Waafi HPP_GETTRANINFO ref=${merchantOrderId} response: ${JSON.stringify(response)}`,
+    );
+
     // Waafi returns transaction info (params.status) ONLY when responseCode is 2001. For an
     // unpaid or not-yet-existing transaction it returns an error envelope (e.g. 5001 / E10206
     // "Failed to get transaction info") with no status. Treat that as still-pending (PROCESSING),
     // never terminal — so the intent keeps waiting for the webhook / its expiry rather than being
     // wrongly resolved off a "no info" response.
     if (response.responseCode !== WAAFI_SUCCESS_CODE) {
-      this.logger.debug(
+      this.logger.warn(
         `Waafi HPP_GETTRANINFO ${merchantOrderId}: ${response.responseCode}/${response.errorCode} ${response.responseMsg} — treating as pending`,
       );
       return {