feat: setup the notification module to the api

apps/edr-freight-api/src/modules/companies/companies.module.ts

@@ -33,6 +33,11 @@ import { ETradeService } from "./services/etrade.service";
     CompanyDashboardRepository,
     ETradeService,
   ],
-  exports: [CompaniesService],
+  exports: [
+    CompaniesService,
+    // Consumed by NotificationInboxModule for portal recipient targeting.
+    ExternalProfileRepository,
+    CompanyProfileRepository,
+  ],
 })
 export class CompaniesModule { }

apps/edr-freight-api/src/modules/companies/companies.service.ts

@@ -334,9 +334,28 @@ export class CompaniesService {
     const company = await this.companiesRepo.findById(id);
     if (!company) throw new NotFoundException(`Company ${id} not found`);
     company.companyProfiles = await this.companyProfilesRepo.findByCompanyId(id);
+    for (const profile of company.companyProfiles) {
+      profile.businessLicenseFiles = await this.signLicenseFiles(
+        profile.businessLicenseFiles,
+      );
+    }
     return company;
   }
 
+  /**
+   * Business-license files are stored as raw, unsigned MinIO URLs (see
+   * `BusinessLicenseFile` on `CompanyProfile`) — a browser can't fetch them
+   * directly. Sign each one with a short-lived URL before it reaches a response.
+   */
+  private async signLicenseFiles(
+    files?: BusinessLicenseFile[] | null,
+  ): Promise<BusinessLicenseFile[]> {
+    if (!files?.length) return [];
+    return Promise.all(
+      files.map(async (f) => ({ ...f, url: await this.filesService.signUrl(f.url) })),
+    );
+  }
+
   /**
    * Validate an explicitly-chosen company profile for a booking: it must belong
    * to the booking's company and be Active. Used for government bookings (staff