refactor: ( passenger-api.auth ) remove the existing auth module

apps/edr-passenger-api/src/modules/verifayda/optional-jwt.guard.ts

@@ -1,21 +1,30 @@
-import { Injectable } from '@nestjs/common';
-import { AuthGuard } from '@nestjs/passport';
+import { CanActivate, ExecutionContext, Injectable } from '@nestjs/common';
+import { Reflector } from '@nestjs/core';
+import { InjectDataSource } from '@nestjs/typeorm';
+import { JwtGuard as IamJwtGuard } from '@tria-plc/api-common/modules/auth/services/jwt.guard';
+import { DataSource } from 'typeorm';
 
 /**
- * Like {@link JwtGuard}, but never rejects the request.
+ * Like the IAM JwtGuard, but never rejects the request.
  *
- * When a valid `Authorization: Bearer <jwt>` is present, `request.user` is
- * populated from the JWT strategy (`{ userId, ... }`). When the token is
- * missing or invalid, the request still proceeds with `request.user`
- * undefined — the handler decides what to do.
- *
- * Used on `POST /fayda/verification/start`, which must work for both
- * logged-in users (who can opt to save the verification to their account)
- * and guests (anchored to a booking only).
+ * When a valid IAM bearer token is present, `request.user` is populated with
+ * the package `TCurrentUser`. Missing or invalid tokens continue as guests.
  */
 @Injectable()
-export class OptionalJwtGuard extends AuthGuard('jwt') {
-  handleRequest<TUser = unknown>(_err: unknown, user: TUser): TUser {
-    return (user ?? null) as TUser;
+export class OptionalJwtGuard extends IamJwtGuard implements CanActivate {
+  constructor(
+    reflector: Reflector,
+    @InjectDataSource() dataSource: DataSource,
+  ) {
+    super(reflector, dataSource);
+  }
+
+  async canActivate(context: ExecutionContext): Promise<boolean> {
+    try {
+      await super.canActivate(context);
+    } catch {
+      context.switchToHttp().getRequest().user = undefined;
+    }
+    return true;
   }
 }

apps/edr-passenger-api/src/modules/verifayda/verifayda.controller.ts

@@ -15,6 +15,7 @@ import {
   ApiOperation,
   ApiTags,
 } from '@nestjs/swagger';
+import type { TCurrentUser } from '@tria-plc/api-common/modules/auth/types/current-user.type';
 import { JwtGuard } from '../../common/jwt.guard';
 import { OptionalJwtGuard } from './optional-jwt.guard';
 import {
@@ -25,21 +26,13 @@ import {
 } from './verifayda.dto';
 import { VerifaydaService } from './verifayda.service';
 
-/** Shape the JWT strategy puts on `request.user` (see common/jwt.strategy.ts). */
-interface AuthedUser {
-  userId: string;
-  email?: string;
-  role?: string;
-  passengerId?: string;
-}
-
 /** Minimal slices of the Express req we touch (avoids a hard dependency on
  * `@types/express`, which isn't resolved in this package). */
 interface RequestWithOptionalUser {
-  user?: AuthedUser;
+  user?: TCurrentUser;
 }
 interface RequestWithUser {
-  user: AuthedUser;
+  user: TCurrentUser;
 }
 
 @ApiTags('Fayda Verification')
@@ -75,7 +68,7 @@ export class VerifaydaController {
     const authorizationUrl = await this.service.startVerification({
       purpose: dto.purpose ?? 'PURCHASE',
       platform: dto.platform ?? 'WEB',
-      userId: req.user?.userId,
+      userId: req.user?.id,
       bookingId: dto.bookingId,
       saveToAccount: dto.saveToAccount,
     });
@@ -106,6 +99,6 @@ export class VerifaydaController {
   async status(
     @Req() req: RequestWithUser,
   ): Promise<VerificationStatusDto> {
-    return this.service.getVerificationStatus(req.user.userId);
+    return this.service.getVerificationStatus(req.user.id);
   }
 }

apps/edr-passenger-api/src/modules/verifayda/verifayda.module.ts

@@ -2,12 +2,9 @@ import { Module } from '@nestjs/common';
 import { VerifaydaController } from './verifayda.controller';
 import { VerifaydaService } from './verifayda.service';
 import { PrismaModule } from '../../common/prisma.module';
-import { AuthModule } from '../auth/auth.module';
 
 @Module({
-  // AuthModule re-exports JwtModule, giving us JwtService (same secret/expiry
-  // config as /auth/login) to mint tokens for the LOGIN flow.
-  imports: [PrismaModule, AuthModule],
+  imports: [PrismaModule],
   controllers: [VerifaydaController],
   providers: [VerifaydaService],
   exports: [VerifaydaService],

apps/edr-passenger-api/src/modules/verifayda/verifayda.service.spec.ts

@@ -1,5 +1,4 @@
 import { ConfigService } from '@nestjs/config';
-import { JwtService } from '@nestjs/jwt';
 import { exportJWK, generateKeyPair, type JWK } from 'jose';
 import { PrismaService } from '../../common/prisma.service';
 import { FaydaConfig } from '../../config/fayda.config';
@@ -30,12 +29,6 @@ function buildPrismaMock() {
   };
 }
 
-function buildJwtMock(): jest.Mocked<JwtService> {
-  return {
-    sign: jest.fn(() => 'signed.jwt.token'),
-  } as unknown as jest.Mocked<JwtService>;
-}
-
 function buildConfig(overrides?: Partial<FaydaConfig>): FaydaConfig {
   return {
     enabled: true,
@@ -65,7 +58,6 @@ function buildConfigService(faydaConfig: FaydaConfig): jest.Mocked<ConfigService
 
 describe('VerifaydaService (OIDC, client-callback)', () => {
   let prisma: ReturnType<typeof buildPrismaMock>;
-  let jwt: jest.Mocked<JwtService>;
   let service: VerifaydaService;
   let realPrivateJwk: JWK;
 
@@ -77,12 +69,10 @@ describe('VerifaydaService (OIDC, client-callback)', () => {
 
   beforeEach(() => {
     prisma = buildPrismaMock();
-    jwt = buildJwtMock();
     const cfg = buildConfig({ privateJwk: realPrivateJwk as FaydaConfig['privateJwk'] });
     service = new VerifaydaService(
       buildConfigService(cfg),
       prisma as unknown as PrismaService,
-      jwt,
     );
     (global as any).fetch = jest.fn();
   });
@@ -136,7 +126,6 @@ describe('VerifaydaService (OIDC, client-callback)', () => {
       const disabledService = new VerifaydaService(
         buildConfigService(buildConfig({ enabled: false })),
         prisma as unknown as PrismaService,
-        jwt,
       );
       await expect(
         disabledService.startVerification({ purpose: 'PURCHASE' }),
@@ -433,7 +422,7 @@ describe('VerifaydaService (OIDC, client-callback)', () => {
       prisma.faydaVerificationSession.findUnique.mockResolvedValue(loginSession());
     });
 
-    it('creates a new user when no match and returns { token, user }', async () => {
+    it('creates a new user but rejects legacy local token issuance', async () => {
       const fullUser = {
         id: 'new-user',
         email: 'new@example.com',
@@ -452,17 +441,12 @@ describe('VerifaydaService (OIDC, client-callback)', () => {
 
       mockLoginFetch({ sub: 'login-sub-1', name: 'New Person', email: 'new@example.com' });
 
-      const result = await service.completeVerification({
-        code: 'c',
-        state: 'state-login',
-      });
-
-      expect(result).toMatchObject({
-        purpose: 'LOGIN',
-        verified: true,
-        token: 'signed.jwt.token',
-        user: { id: 'new-user', passengerId: 'p-new' },
-      });
+      await expect(
+        service.completeVerification({
+          code: 'c',
+          state: 'state-login',
+        }),
+      ).rejects.toMatchObject({ status: 401 });
       expect(prisma.user.create).toHaveBeenCalledWith(
         expect.objectContaining({
           data: expect.objectContaining({
@@ -473,12 +457,9 @@ describe('VerifaydaService (OIDC, client-callback)', () => {
         }),
       );
       expect(prisma.passenger.create).toHaveBeenCalled();
-      expect(jwt.sign).toHaveBeenCalledWith(
-        expect.objectContaining({ sub: 'new-user', passengerId: 'p-new' }),
-      );
     });
 
-    it('logs in an existing user already linked by faydaSub', async () => {
+    it('resolves an existing linked user but rejects legacy local token issuance', async () => {
       const fullUser = {
         id: 'known-user',
         email: 'k@example.com',
@@ -491,16 +472,16 @@ describe('VerifaydaService (OIDC, client-callback)', () => {
 
       mockLoginFetch({ sub: 'login-sub-2', name: 'Known' });
 
-      const result = await service.completeVerification({
-        code: 'c',
-        state: 'state-login',
-      });
-
-      expect(result.user?.id).toBe('known-user');
+      await expect(
+        service.completeVerification({
+          code: 'c',
+          state: 'state-login',
+        }),
+      ).rejects.toMatchObject({ status: 401 });
       expect(prisma.user.create).not.toHaveBeenCalled();
     });
 
-    it('links Fayda to an existing account matched by email', async () => {
+    it('links Fayda to an existing account matched by email but rejects legacy local token issuance', async () => {
       const fullUser = {
         id: 'acc-1',
         email: 'match@example.com',
@@ -515,12 +496,12 @@ describe('VerifaydaService (OIDC, client-callback)', () => {
 
       mockLoginFetch({ sub: 'login-sub-3', email: 'match@example.com' });
 
-      const result = await service.completeVerification({
-        code: 'c',
-        state: 'state-login',
-      });
-
-      expect(result.user?.id).toBe('acc-1');
+      await expect(
+        service.completeVerification({
+          code: 'c',
+          state: 'state-login',
+        }),
+      ).rejects.toMatchObject({ status: 401 });
       expect(prisma.user.update).toHaveBeenCalledWith(
         expect.objectContaining({
           where: { id: 'acc-1' },

apps/edr-passenger-api/src/modules/verifayda/verifayda.service.ts

@@ -6,7 +6,6 @@ import {
   UnauthorizedException,
 } from '@nestjs/common';
 import { ConfigService } from '@nestjs/config';
-import { JwtService } from '@nestjs/jwt';
 import axios, { AxiosInstance } from 'axios';
 import * as bcrypt from 'bcrypt';
 import { randomBytes } from 'crypto';
@@ -88,7 +87,6 @@ export class VerifaydaService {
   constructor(
     private readonly config: ConfigService,
     private readonly prisma: PrismaService,
-    private readonly jwt: JwtService,
   ) {
     const fayda = this.config.get<FaydaConfig>('fayda');
     if (!fayda) {
@@ -274,16 +272,15 @@ export class VerifaydaService {
       passengerId: user.passenger?.id,
       agentId: user.agent?.id,
     };
-    const token = this.jwt.sign({
-      sub: summary.id,
-      email: summary.email,
-      role: summary.role,
-      passengerId: summary.passengerId,
-      agentId: summary.agentId,
-    });
 
-    this.logger.log(`Fayda login issued token for user ${user.id}`);
-    return { token, user: summary };
+    this.logger.warn(
+      `Legacy passenger Fayda login reached for user ${user.id}; use IAM /v1/auth Fayda login to issue tokens.`,
+    );
+    throw new UnauthorizedException({
+      code: 'FAYDA_LOGIN_MIGRATED_TO_IAM',
+      message: 'Fayda login tokens are issued by the IAM package auth endpoints.',
+      user: summary,
+    });
   }
 
   async getVerificationStatus(userId: string): Promise<VerificationStatusDto> {