feat: dev and staging bypass

apps/edr-freight-api/src/modules/verifayda/verifayda.service.ts

@@ -28,6 +28,11 @@ import {
   NormalizedFaydaUserInfo,
   VerifaydaPurpose,
 } from './verifayda.types';
+import { randomUUID } from 'node:crypto';
+import { isBypassEnv } from '../../common/dev-bypass.util';
+
+/** Sentinel `code` that skips the real eSignet exchange in dev/staging. */
+export const DEV_BYPASS_FAYDA_CODE = 'DEV_BYPASS';
 
 export interface StartVerificationInput {
   purpose: VerifaydaPurpose;
@@ -143,6 +148,26 @@ export class VerifaydaService {
   async completeVerification(
     query: VerifaydaCallbackDto,
   ): Promise<CompleteVerificationResult> {
+    // Dev/staging only: caller sends the sentinel code instead of a real
+    // eSignet redirect — skip the token exchange/session entirely and hand
+    // back a canned VERIFY result. `sub` is unique per call so binding both
+    // owner and PoA in the same bypass session doesn't collide.
+    if (isBypassEnv() && query.code === DEV_BYPASS_FAYDA_CODE) {
+      this.logger.warn('Fayda verification BYPASSED (dev/staging)');
+      return {
+        purpose: 'VERIFY',
+        verified: true,
+        sub: `dev-bypass-${randomUUID()}`,
+        fullName: 'Dev Bypass User',
+        email: 'dev-bypass@example.com',
+        phoneNumber: '+251900000000',
+        birthdate: '1990-01-01',
+        gender: 'M',
+        address: 'Dev Bypass Address',
+        userDataSaved: false,
+      };
+    }
+
     if (query.error) {
       this.logger.warn(`Fayda callback returned error: ${query.error}`);
       if (query.state) {