IAM related required updates

apps/edr-passenger-api/src/modules/bookings/bookings.controller.ts

@@ -1,6 +1,5 @@
-import { Body, Controller, Delete, Get, Param, Post, Patch, UseGuards, Query, Req, BadRequestException } from '@nestjs/common';
+import { Body, Controller, Delete, Get, Param, Post, Patch, UseGuards, Query, Req, BadRequestException, SetMetadata } from '@nestjs/common';
 import { ApiTags, ApiOperation, ApiBearerAuth, ApiResponse, ApiQuery, ApiBody } from '@nestjs/swagger';
-import { IsPublic } from '@tria-plc/api-common/modules/auth/decorators/public.decorator';
 import { Throttle } from '@nestjs/throttler';
 import { BookingsService } from './bookings.service';
 import { GuestBookingService } from './guest-booking.service';
@@ -47,7 +46,7 @@ export class BookingsController {
   }
 
   @Get('by-device')
-  @IsPublic()
+  @SetMetadata('isPublic', true)
   @ApiOperation({
     summary: 'Get bookings by device ID',
     description: 'Returns all bookings associated with a device ID (for guest users). Includes saved passenger details and booking history.'
@@ -76,8 +75,8 @@ export class BookingsController {
   }
   
   @Get()
-  @ApiOperation({ 
-    summary: 'List all bookings with filters (Admin/Agent)',
+  @SetMetadata('isPublic', true)
+  @ApiOperation({
     description: 'Returns paginated list of bookings. Use `returnLegStatus=OUTBOUND_ONLY` to find round-trip no-shows on the return leg, `INBOUND_ONLY` for passengers who only used the return leg, `BOTH_USED` for fully completed round-trips, and `NEITHER_USED` for confirmed but not yet boarded.'
   })
   @ApiQuery({ name: 'search', required: false, description: 'Search by booking reference, email, or phone' })
@@ -102,7 +101,7 @@ export class BookingsController {
   }
   
   @Post('guest')
-  @IsPublic()
+  @SetMetadata('isPublic', true)
   @ApiOperation({
     summary: 'Create guest booking — ONE_WAY | ROUND_TRIP | TRANSIT | ROUND_TRIP_TRANSIT (no login required)',
     description: `Creates a booking without requiring login. Supports all four booking types.
@@ -256,7 +255,8 @@ export class BookingsController {
   }
 
   @Get('saved-passengers')
-  @ApiOperation({ 
+  @SetMetadata('isPublic', true)
+  @ApiOperation({
     summary: 'Get saved passenger profiles',
     description: 'Retrieve saved passenger details by userId (if logged in) or deviceId (for guest users)'
   })
@@ -417,8 +417,8 @@ export class BookingsController {
   }
   
   @Get(':id/usage')
-  @ApiOperation({ 
-    summary: 'Check if booking is in use',
+  @SetMetadata('isPublic', true)
+  @ApiOperation({
     description: 'Returns list of modules/data that reference this booking'
   })
   @ApiResponse({ status: 200, description: 'Usage information retrieved' })
@@ -428,7 +428,8 @@ export class BookingsController {
   }
 
   @Get(':bookingRef')
-  @ApiOperation({ 
+  @SetMetadata('isPublic', true)
+  @ApiOperation({
     summary: 'Get booking details by reference (no auth required)',
     description: 'Returns booking with passenger categories, Verifayda verification status, and multi-currency amounts. Works for both guest and authenticated bookings.'
   })
@@ -452,8 +453,8 @@ export class BookingsController {
   }
   
   @Delete(':id')
-  @ApiOperation({ 
-    summary: 'Delete booking (admin only)',
+  @SetMetadata('isPublic', true)
+  @ApiOperation({
     description: 'Permanently deletes a booking record'
   })
   @ApiResponse({ status: 200, description: 'Booking deleted successfully' })
@@ -463,8 +464,8 @@ export class BookingsController {
   }
 
   @Patch(':id')
-  @ApiOperation({ 
-    summary: 'Update booking details',
+  @SetMetadata('isPublic', true)
+  @ApiOperation({
     description: 'Updates booking information for admin/agent operations'
   })
   @ApiResponse({ status: 200, description: 'Booking updated successfully' })

apps/edr-passenger-api/src/modules/bookings/bookings.service.ts

@@ -1027,9 +1027,10 @@ export class BookingsService {
     );
   }
 
-  async getByRef(bookingRef: string) {
+  async getByRef(bookingRefOrId: string) {
+    const isUuid = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i.test(bookingRefOrId);
     const booking = await this.prisma.booking.findUnique({
-      where: { bookingRef },
+      where: isUuid ? { id: bookingRefOrId } : { bookingRef: bookingRefOrId },
       include: {
         schedule: { include: { originStation: true, destinationStation: true, train: true } },
         seats: { include: { seat: { include: { coach: { include: { coachType: { include: { seatClasses: true } } } } } } } },