feat: ( payment ) implement cbe payment

apps/edr-passenger-api/src/modules/payments/internal-payments.controller.ts

@@ -4,11 +4,17 @@ import {
   HttpCode,
   HttpStatus,
   Post,
+  SetMetadata,
   UseGuards,
 } from "@nestjs/common";
 import { ApiOperation, ApiTags } from "@nestjs/swagger";
 import { ServiceAuthGuard } from "../../common/guards/service-auth.guard";
-import { PaymentEventDto, MarkPaidResponseDto } from "./internal-payments.dto";
+import {
+  PaymentEventDto,
+  MarkPaidResponseDto,
+  BillQueryRequestDto,
+  BillQueryResponseDto,
+} from "./internal-payments.dto";
 import { PaymentsService } from "./payments.service";
 
 /**
@@ -18,6 +24,9 @@ import { PaymentsService } from "./payments.service";
  * consumer when RabbitMQ lands — the handler logic is transport-agnostic.
  */
 @ApiTags("Internal Payments")
+// isPublic only skips the global IAM user-JWT guard — these routes stay protected by
+// ServiceAuthGuard's shared service token (the payment service is not an IAM user).
+@SetMetadata("isPublic", true)
 @UseGuards(ServiceAuthGuard)
 @Controller("internal/payments")
 export class InternalPaymentsController {
@@ -32,4 +41,16 @@ export class InternalPaymentsController {
   async markPaid(@Body() event: PaymentEventDto): Promise<MarkPaidResponseDto> {
     return this.paymentsService.handlePaymentEvent(event);
   }
+
+  @Post("bill-query")
+  @HttpCode(HttpStatus.OK)
+  @ApiOperation({
+    summary:
+      "Live still-payable check + payer name for a CBE bill (called while CBE is on the line)",
+  })
+  async billQuery(
+    @Body() request: BillQueryRequestDto,
+  ): Promise<BillQueryResponseDto> {
+    return this.paymentsService.billQuery(request.referenceId);
+  }
 }