Merge branch 'alpha' of github.com:Tria-plc/edr-platform into alpha

apps/edr-passenger-api/src/modules/seats/seats.controller.ts

@@ -19,7 +19,7 @@ import {
   ApiResponse,
 } from "@nestjs/swagger";
 import { SeatsService } from "./seats.service";
-import { HoldSeatsDto } from "./seats.dto";
+import { HoldSeatsDto, ReleaseHoldDto } from "./seats.dto";
 import { JwtGuard } from "../../common/jwt.guard";
 import { IamGuard } from "../../common/iam-adapter";
 
@@ -182,6 +182,27 @@ This makes it clear which segment of the route each seat is held for, enabling s
     return this.service.releaseHold(holdId);
   }
 
+  @Post("release")
+  @SetMetadata('isPublic', true)
+  @ApiOperation({
+    summary: "Release a seat hold by holdId (portal-server use only)",
+    description:
+      "Frees a previously-created hold's seats immediately instead of waiting for it to " +
+      "expire — used when a guest or logged-in user changes their seat selection, so the " +
+      "stale hold doesn't linger and block that seat for other travellers.\n\n" +
+      "This is a public endpoint (no JWT), like POST /seats/hold, since guest sessions have " +
+      "no login to authenticate with. It must ONLY ever be called from the passenger portal's " +
+      "own Next.js server (a server-side route handler), never directly from browser code — " +
+      "calling it straight from client JS would let anyone script mass hold-cancellation " +
+      "against other travellers' in-progress seat selections. The portal's server-side proxy " +
+      "is what keeps this endpoint's existence out of the browser's network requests.",
+  })
+  @ApiResponse({ status: 200, description: "Hold released" })
+  @ApiResponse({ status: 404, description: "Hold not found" })
+  releaseSeatById(@Body() dto: ReleaseHoldDto) {
+    return this.service.releaseHold(dto.holdId);
+  }
+
   // ── Seat Block / Unblock ───────────────────────────────────────────────────
   @Post(":seatId/block")
   @UseGuards(IamGuard)

apps/edr-passenger-api/src/modules/seats/seats.dto.ts

@@ -48,3 +48,8 @@ export class HoldSeatsDto {
   @Type(() => PassengerSeatDto)
   passengers: PassengerSeatDto[];
 }
+
+export class ReleaseHoldDto {
+  @ApiProperty({ example: 'hold-uuid', description: 'SeatHold UUID to release' })
+  @IsString() holdId: string;
+}