Tria/edr-platform
1
0
Fork 0
mirror of https://github.com/Tria-plc/edr-platform.git synced 2026-08-26 18:42:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #969 from Tria-plc/alpha

Browse Source 
Alpha
This commit is contained in:
Abubeker Yasin
2026-07-27 11:08:44 +03:00
committed by GitHub
parent 89a0bc6948 f5bdc6971d
commit 3e2ae80e5a
11 changed files with 283 additions and 84 deletions
Download Patch File Download Diff File Expand all files Collapse all files

21
apps/edr-passenger-api/src/modules/auth/passenger-auth.service.ts
View File

@@ -261,10 +261,26 @@ export class PassengerAuthService {
if (!passenger) throw new Error('Passenger not found');
const iam = iamRows[0];
const meta = iam?.metadata ?? {};
const faydaVerified = iam?.verified_by === 'fayda';
const nationality = iam?.metadata?.nationality ?? null;
// A Fayda-verified holder is an Ethiopian national ID holder, so default nationality to
// Ethiopian when the metadata doesn't carry it explicitly.
const nationality = meta.nationality ?? (faydaVerified ? 'ETHIOPIAN' : null);
// Fayda stores gender as { am, en }; tolerate a legacy plain string too.
const gender =
meta.gender && typeof meta.gender === 'object'
? (meta.gender.en ?? meta.gender.am ?? null)
: (meta.gender ?? null);
// birthdate is persisted as ISO by the Fayda upsert; tolerate a "/"-separated legacy value.
const rawDob = meta.dateOfBirth ?? meta.birthdate ?? null;
const dateOfBirth = rawDob ? String(rawDob).replace(/\//g, '-') : null;
return {
// The web User object keys on `id` (the IAM user id) — the login response returns it, so
// this profile refresh MUST too, otherwise fetchProfile() overwrites the logged-in user
// with an id-less object and everything guarded on `user.id` (passenger-form prefill,
// save-details userId) silently breaks.
id: iamUserId,
iamUserId,
// Top-level passengerId keeps the profile shape consistent with the login
// response so the web User object always carries it (the JWT does not).
@@ -272,8 +288,11 @@ export class PassengerAuthService {
email: iam?.email ?? null,
phone: iam?.phone_number ?? null,
fullName: iam?.name?.en ?? iam?.name?.am ?? null,
gender,
dateOfBirth,
nationality,
faydaVerified,
faydaSub: meta.sub ?? null,
preferredCurrency: resolvePreferredCurrency(nationality, faydaVerified),
createdAt: passenger.createdAt,
passenger: {

7
apps/edr-passenger-api/src/modules/bookings/bookings.controller.ts
View File

@@ -557,10 +557,13 @@ export class BookingsController {
})
@ApiResponse({ status: 404, description: "Schedule or seat hold not found" })
create(@Req() req: any, @Body() dto: CreateBookingDto) {
// Always resolve passengerId from the authenticated JWT — never trust the request body
// Always resolve identity from the authenticated JWT — never trust the request body.
// Routed through the unified GuestBookingService: because req.user.id is present, it
// resolves the existing passenger from the token and layers on the authenticated-only
// behaviours (iam.users contact, loyalty, audit, package inventory, seat-vs-hold guard).
const iamUserId = req.user?.id;
if (!iamUserId) throw new UnauthorizedException();
return this.service.create({ ...dto, passengerId: iamUserId });
return this.guestService.createGuestBooking(dto as unknown as CreateGuestBookingDto, req);
}
@Get(":id/usage")

84
apps/edr-passenger-api/src/modules/bookings/guest-booking.service.ts
View File

@@ -1,10 +1,13 @@
import { Injectable, BadRequestException, NotFoundException, Logger } from '@nestjs/common';
import { InjectDataSource } from '@nestjs/typeorm';
import { DataSource } from 'typeorm';
import { PrismaService } from '../../common/prisma.service';
import { SeatsService } from '../seats/seats.service';
import { VerifaydaService } from '../verifayda/verifayda.service';
import { CurrencyService } from '../currency/currency.service';
import { PassengerAuthService } from '../auth/passenger-auth.service';
import { FareEngineService } from '../fare-engine/fare-engine.service';
import { AuditService } from '../../common/audit.service';
import { EventEmitter2 } from '@nestjs/event-emitter';
import { PaymentsService } from '../payments/payments.service';
import { AuditService } from '../../common/audit.service';
@@ -87,11 +90,13 @@ export class GuestBookingService {
constructor(
private prisma: PrismaService,
@InjectDataSource() private readonly dataSource: DataSource,
private seatsService: SeatsService,
private verifaydaService: VerifaydaService,
private currencyService: CurrencyService,
private passengerAuthService: PassengerAuthService,
private fareEngine: FareEngineService,
private auditService: AuditService,
private eventEmitter: EventEmitter2,
private paymentsService: PaymentsService,
private auditService: AuditService,
@@ -138,6 +143,7 @@ export class GuestBookingService {
}
private async createGuestOneWayBooking(dto: CreateGuestBookingDto, req?: any) {
const authUserId: string | null = req?.user?.id ?? null;
// Validate hold
const hold = await this.prisma.seatHold.findUnique({ where: { id: dto.holdId } });
if (!hold || hold.expiresAt < new Date()) {
@@ -319,6 +325,7 @@ export class GuestBookingService {
// Resolve or create the guest Passenger record
const firstPassenger = passengersData[0];
const { guestPassengerId, iamUserId, createdAccount } = await this.resolveGuestPassenger(dto, firstPassenger, req);
const contact = await this.resolveActorContact(req, firstPassenger);
// Save passenger details for future use (if requested)
if (dto.savePassengerDetails && (dto.createAccount || dto.deviceId)) {
@@ -360,8 +367,8 @@ export class GuestBookingService {
bookingType: 'ONE_WAY',
...(dto.packageId ? { packageId: dto.packageId, priceTierId: dto.priceTierId } : {}),
userAgent: dto.deviceId,
contactEmail: firstPassenger.email || null,
contactPhone: firstPassenger.phone || null,
contactEmail: contact.contactEmail,
contactPhone: contact.contactPhone,
seats: {
create: passengersWithFares.map((p) => ({
seat: { connect: { id: p.seatId } },
@@ -385,11 +392,18 @@ export class GuestBookingService {
},
});
// Save passenger details as traveler profiles
await this.createTravelerProfiles(guestPassengerId, passengersData);
// Save passenger details as traveler profiles — guest bookings only.
// Authenticated passengers already have a profile, matching the old BookingsService.
if (!authUserId) await this.createTravelerProfiles(guestPassengerId, passengersData);
// Confirm seats
await this.seatsService.confirmSeats(dto.passengers.map(p => p.seatId).filter((id): id is string => !!id));
// Authenticated-only side effect: audit the booking creation.
if (authUserId) {
await this.auditService.log({ userId: guestPassengerId, action: 'CREATE', entityType: 'Booking', entityId: booking.id, newData: { bookingRef: booking.bookingRef, bookingType: 'ONE_WAY', totalMinor: resolvedTotalMinor } });
}
this.eventEmitter.emit('booking.created', { booking });
return {
@@ -652,6 +666,7 @@ export class GuestBookingService {
}
private async createGuestRoundTripBooking(dto: CreateGuestBookingDto, req?: any) {
const authUserId: string | null = req?.user?.id ?? null;
if (!dto.returnScheduleId || !dto.returnHoldId || !dto.returnOriginStationId || !dto.returnDestinationStationId) {
throw new BadRequestException('returnScheduleId, returnHoldId, returnOriginStationId and returnDestinationStationId are required for ROUND_TRIP');
}
@@ -852,6 +867,7 @@ export class GuestBookingService {
// Create or resolve guest passenger (same as one-way)
const { guestPassengerId, iamUserId, createdAccount } = await this.resolveGuestPassenger(dto, passengersData[0], req);
const contact = await this.resolveActorContact(req, passengersData[0]);
// Create booking with outbound seats; return seats confirmed separately
const outboundSeatIds = dto.passengers.map(p => p.seatId).filter((id): id is string => !!id);
@@ -880,8 +896,8 @@ export class GuestBookingService {
returnLegStatus: 'NEITHER_USED',
...(dto.packageId ? { packageId: dto.packageId, priceTierId: dto.priceTierId } : {}),
userAgent: dto.deviceId,
contactEmail: passengersData[0]?.email || null,
contactPhone: passengersData[0]?.phone || null,
contactEmail: contact.contactEmail,
contactPhone: contact.contactPhone,
seats: {
create: [
...passengersWithFares.map((p) => ({
@@ -923,12 +939,19 @@ export class GuestBookingService {
},
});
await this.createTravelerProfiles(guestPassengerId, passengersData);
// Traveler profiles: guest bookings only (authenticated passengers already have one).
if (!authUserId) await this.createTravelerProfiles(guestPassengerId, passengersData);
await Promise.all([
this.seatsService.confirmSeats(outboundSeatIds),
this.seatsService.confirmSeats(returnSeatIds),
]);
// Authenticated-only side effect: audit the booking creation.
if (authUserId) {
await this.auditService.log({ userId: guestPassengerId, action: 'CREATE', entityType: 'Booking', entityId: booking.id, newData: { bookingRef: booking.bookingRef, bookingType: 'ROUND_TRIP', totalMinor } });
}
this.eventEmitter.emit('booking.created', { booking });
return {
@@ -954,6 +977,7 @@ export class GuestBookingService {
}
private async createGuestTransitBooking(dto: CreateGuestBookingDto, req?: any) {
const authUserId: string | null = req?.user?.id ?? null;
if (!dto.leg2ScheduleId || !dto.leg2HoldId || !dto.transitStationId || !dto.leg2DestinationStationId) {
throw new BadRequestException('leg2ScheduleId, leg2HoldId, transitStationId and leg2DestinationStationId are required for TRANSIT bookings');
}
@@ -1059,6 +1083,7 @@ export class GuestBookingService {
: totalMinor;
const { guestPassengerId, iamUserId, createdAccount } = await this.resolveGuestPassenger(dto, passengersData[0], req);
const contact = await this.resolveActorContact(req, passengersData[0]);
// Single booking — leg-1 seats at leg=1, leg-2 seats at leg=2
const booking = await this.prisma.booking.create({
@@ -1081,8 +1106,8 @@ export class GuestBookingService {
leg2DestinationStationId: dto.leg2DestinationStationId,
leg2SeatClassId: leg2SeatClassId,
userAgent: dto.deviceId,
contactEmail: passengersData[0]?.email || null,
contactPhone: passengersData[0]?.phone || null,
contactEmail: contact.contactEmail,
contactPhone: contact.contactPhone,
seats: {
create: [
...passengersData.map(p => ({
@@ -1124,7 +1149,8 @@ export class GuestBookingService {
},
});
await this.createTravelerProfiles(guestPassengerId, passengersData);
// Traveler profiles: guest bookings only (authenticated passengers already have one).
if (!authUserId) await this.createTravelerProfiles(guestPassengerId, passengersData);
await Promise.all([
this.seatsService.confirmSeats(dto.passengers.map(p => p.seatId).filter((id): id is string => !!id)),
@@ -1150,6 +1176,7 @@ export class GuestBookingService {
}
private async createGuestRoundTripTransitBooking(dto: CreateGuestBookingDto, req?: any) {
const authUserId: string | null = req?.user?.id ?? null;
if (!dto.leg2ScheduleId || !dto.leg2HoldId || !dto.transitStationId || !dto.leg2DestinationStationId ||
!dto.returnScheduleId || !dto.returnHoldId || !dto.returnOriginStationId || !dto.returnDestinationStationId ||
!dto.returnLeg2ScheduleId || !dto.returnLeg2HoldId || !dto.returnTransitStationId || !dto.returnLeg2DestinationStationId) {
@@ -1261,6 +1288,7 @@ export class GuestBookingService {
: totalMinor;
const { guestPassengerId, iamUserId, createdAccount } = await this.resolveGuestPassenger(dto, passengersData[0], req);
const contact = await this.resolveActorContact(req, passengersData[0]);
const makeSeat = (p: any, seatId: string, leg: number, scheduleId: string, fare: number) => ({
seat: { connect: { id: seatId } },
@@ -1302,8 +1330,8 @@ export class GuestBookingService {
returnLeg2SeatClassId: retL2ClassId,
returnLegStatus: 'NEITHER_USED',
userAgent: dto.deviceId,
contactEmail: passengersData[0]?.email || null,
contactPhone: passengersData[0]?.phone || null,
contactEmail: contact.contactEmail,
contactPhone: contact.contactPhone,
seats: {
create: [
...passengersData.map(p => makeSeat(p, p.seatId, 1, dto.scheduleId, obL1Fare)),
@@ -1319,7 +1347,8 @@ export class GuestBookingService {
},
});
await this.createTravelerProfiles(guestPassengerId, passengersData);
// Traveler profiles: guest bookings only (authenticated passengers already have one).
if (!authUserId) await this.createTravelerProfiles(guestPassengerId, passengersData);
await Promise.all([
this.seatsService.confirmSeats(dto.passengers.map(p => p.seatId).filter((id): id is string => !!id)),
@@ -1348,11 +1377,40 @@ export class GuestBookingService {
};
}
/**
* Resolves the booking contact. Authenticated callers get their contact from iam.users
* (matching the old BookingsService.resolveIamContact); guests fall back to the first
* passenger's inline phone/email exactly as before.
*/
private async resolveActorContact(
req: any,
firstPassenger: any,
): Promise<{ contactEmail: string | null; contactPhone: string | null }> {
const iamUserId = req?.user?.id;
if (iamUserId) {
const rows = await this.dataSource.query<{ email: string; phone_number: string | null }[]>(
`SELECT email, phone_number FROM iam.users WHERE id = $1 LIMIT 1`,
[iamUserId],
);
return { contactEmail: rows[0]?.email ?? null, contactPhone: rows[0]?.phone_number ?? null };
}
return { contactEmail: firstPassenger?.email || null, contactPhone: firstPassenger?.phone || null };
}
private async resolveGuestPassenger(
dto: Pick<CreateGuestBookingDto, 'createAccount' | 'password' | 'deviceId'>,
firstPassenger: any,
req?: any,
): Promise<{ guestPassengerId: string; iamUserId: string | null; createdAccount: boolean }> {
// Authenticated caller: resolve the existing passenger from the JWT subject.
// Never trust a client-supplied passengerId — identity comes from the token only.
const authUserId = req?.user?.id;
if (authUserId) {
const passenger = await this.prisma.passenger.findUnique({ where: { iamUserId: authUserId }, select: { id: true } });
if (!passenger) throw new NotFoundException('Passenger profile not found for this account');
return { guestPassengerId: passenger.id, iamUserId: authUserId, createdAccount: false };
}
if (dto.createAccount && firstPassenger.email && dto.password) {
const guestName = firstPassenger.passengerName ?? 'Guest';
const result = await this.passengerAuthService.registerWithPassword(

9
apps/edr-passenger-api/src/modules/passengers/passengers.controller.ts
View File

@@ -254,11 +254,10 @@ export class PassengersController {
}
try {
const passenger = await this.prisma.passenger.findUnique({
where: { iamUserId: req.user.id },
});
if (!passenger) return null;
return this.service.getProfile(passenger.id);
// Identity (name, DOB, gender, nationality, Fayda status) lives on the IAM user record,
// not the Passenger row — return the full booking-form payload built from it so an
// already-verified passenger's form can prefill and lock. See getMyProfile.
return await this.service.getMyProfile(req.user.id);
} catch (error) {
return null;
}

61
apps/edr-passenger-api/src/modules/passengers/passengers.service.ts
View File

@@ -22,6 +22,7 @@ type IamUserRow = {
name: { en: string; am: string } | null;
phone_number: string | null;
metadata: Record<string, any> | null;
verified_by?: string | null;
};
@Injectable()
@@ -237,6 +238,66 @@ export class PassengersService {
};
}
/**
* Full passenger-form payload for the logged-in user, sourced from the IAM user record
* (iam.users) — where the Fayda-verified identity actually lives — rather than the sparse
* Passenger row. The booking passenger form (/booking/passengers) calls this via
* GET /passengers/me to prefill (and lock) an already-verified passenger's details.
*
* Identity fields don't depend on a Passenger row existing; only `id` (used later to tag the
* primary passenger on the booking) does, and it's null if no Passenger row is linked yet.
*/
async getMyProfile(iamUserId: string) {
const [passenger, iamRows] = await Promise.all([
this.prisma.passenger.findUnique({ where: { iamUserId } }),
this.dataSource.query<IamUserRow[]>(
`SELECT id, email, name, phone_number, metadata, verified_by FROM iam.users WHERE id = $1 LIMIT 1`,
[iamUserId],
),
]);
const iam = iamRows[0] ?? null;
if (!iam && !passenger) return null;
const meta = iam?.metadata ?? {};
const faydaVerified =
iam?.verified_by === 'fayda' ||
meta.faydaVerified === true ||
meta.faydaVerified === 'true';
// Fayda writes gender as { am, en }; older/manual records may store a plain string.
const gender =
meta.gender && typeof meta.gender === 'object'
? (meta.gender.en ?? meta.gender.am ?? null)
: (meta.gender ?? null);
const fullName = iam?.name?.en ?? iam?.name?.am ?? null;
// Stored as ISO by the Fayda upsert; tolerate a "/"-separated legacy value.
const rawDob = meta.dateOfBirth ?? meta.birthdate ?? null;
const dateOfBirth = rawDob ? String(rawDob).replace(/\//g, '-') : null;
// Nationality isn't always in metadata; a Fayda-verified holder is Ethiopian by definition.
const nationality = meta.nationality ?? (faydaVerified ? 'ETHIOPIAN' : null);
return {
id: passenger?.id ?? null,
fullName,
email: iam?.email ?? meta.email ?? null,
phone: iam?.phone_number ?? meta.phoneNumber ?? null,
gender,
dateOfBirth,
nationality,
faydaVerified,
faydaSub: meta.sub ?? null,
passportNumber: meta.passportNumber ?? null,
passportCountry: meta.passportCountry ?? null,
passportIssueDate: meta.passportIssueDate ?? null,
passportExpiryDate: meta.passportExpiryDate ?? null,
passportIssuingAuthority: meta.passportIssuingAuthority ?? null,
};
}
async getStats(passengerId: string) {
const [totalTrips, totalSpendResult, loyalty] = await Promise.all([
this.prisma.booking.count({ where: { passengerId, status: 'BOARDED' as any } }),

19
apps/edr-passenger-api/src/modules/verifayda/verifayda.service.ts
View File

@@ -512,17 +512,30 @@ export class VerifaydaService {
gender: { am: normalized.genderAm ?? '', en: normalized.genderEn ?? '' },
name: { am: normalized.nameAm ?? '', en: normalized.nameEn ?? '' },
phoneNumber: normalized.rawPhoneNumber ?? '',
// Persist the identity fields the passenger booking form needs. Fayda returns
// these on every verification but they were previously dropped, leaving the
// logged-in/verified form with nothing to prefill. birthdate arrives as
// YYYY/MM/DD — store it as the ISO YYYY-MM-DD the form expects. A Fayda-verified
// holder is an Ethiopian national ID holder, so nationality is always Ethiopian.
dateOfBirth: normalized.birthdate ? normalized.birthdate.replace(/\//g, '-') : '',
nationality: 'ETHIOPIAN',
};
// Step 1 — already linked to this Fayda sub; ensure verified_by is set
// Step 1 — already linked to this Fayda sub; refresh metadata (backfills the newly
// persisted dateOfBirth/nationality for users linked before this change) and ensure
// verified_by is set.
const bySub = await this.dataSource.query<{ id: string }[]>(
`SELECT id FROM iam.users WHERE metadata->>'sub' = $1 LIMIT 1`,
[normalized.sub],
);
if (bySub.length > 0) {
await this.dataSource.query(
`UPDATE iam.users SET verified_by = 'fayda', updated_at = NOW() WHERE id = $1`,
[bySub[0].id],
`UPDATE iam.users
SET metadata = COALESCE(metadata, '{}'::jsonb) || $1::jsonb,
verified_by = 'fayda',
updated_at = NOW()
WHERE id = $2`,
[JSON.stringify(iamMetadata), bySub[0].id],
);
return { iamUserId: bySub[0].id, userDataSaved: true };
}