Merge pull request #972 from Tria-plc/freight/nati-1

IAM Seeder centralized

apps/edr-passenger-api/.env.example

@@ -181,6 +181,17 @@ GITHUB_PACKAGE_TOKEN=<your-github-packages-token>
 # Login endpoint for backoffice users: POST /v1/auth/login
 SEED_EDR_PASSENGER_ORG=false
 SEED_PASSENGER_STAFF=false
+# IAM baseline shared with edr-freight-api (roles, IAM app + permissions, position
+# types, organization types + default units, org/unit settings, super admin).
+# Replaces the seeder that used to ship inside @tria-plc/iamapi-common — see
+# packages/iam-seed. Seeds by DEFAULT when unset; every write is insert-only.
+# Set to false to opt out.
+SEED_IAM_BASELINE=true
+# Super-admin account seeded by the above. Shared across the apps on this schema.
+SUPER_ADMIN_EMAIL=superadmin@tria.com
+SUPER_ADMIN_PHONE=
+# Falls back to DEFAULT_PASSWORD when empty.
+SUPER_ADMIN_DEFAULT_PASSWORD=
 # Plain-text password set on seeded staff accounts. Defaults to '12345678' if unset.
 DEFAULT_PASSWORD=Admin@1234
 

apps/edr-passenger-api/package.json

@@ -27,6 +27,7 @@
     "prisma:verify": "ts-node prisma/verify-backfill.ts"
   },
   "dependencies": {
+    "@edr/iam-seed": "workspace:*",
     "@edr/types": "workspace:*",
     "@golevelup/nestjs-rabbitmq": "^5.5.0",
     "@nestjs/axios": "^4.0.1",

apps/edr-passenger-api/src/app.module.ts

@@ -4,8 +4,8 @@ import { ConfigModule, ConfigService } from "@nestjs/config";
 import { ScheduleModule } from "@nestjs/schedule";
 import { EventEmitterModule } from "@nestjs/event-emitter";
 import { TypeOrmModule, TypeOrmModuleOptions } from "@nestjs/typeorm";
+import { IamBaselineSeeder, IamSeedModule } from "@edr/iam-seed";
 import { IamModule as TriaIamModule } from "@tria-plc/iamapi-common/iam.module";
-import { DataSeeder } from "@tria-plc/iamapi-common/db/seed/seeder";
 import { SharedAuthModule } from "@tria-plc/api-common/modules/auth/shared-auth.module";
 import {
   EDR_PASSENGER_APPLICATION,
@@ -103,6 +103,17 @@ import { EOtpType } from "@tria-plc/iamapi-common";
           `Set your EDR Passenger password using this link: ${route}`,
       },
     }),
+    // Replaces the package's DataSeeder. Shared with edr-freight-api, which
+    // seeds the same `iam` schema — see packages/iam-seed.
+    IamSeedModule.forRoot({
+      superAdmin: {
+        username: "superadmin",
+        name: { am: "ሱፐር አድሚን", en: "Super Admin" },
+        roleKey: "super_admin",
+        organizationKey: "edr",
+        fallbackEmail: "superadmin@tria.com",
+      },
+    }),
     SharedAuthModule,
     PrismaModule,
     AuditModule,
@@ -151,18 +162,23 @@ import { EOtpType } from "@tria-plc/iamapi-common";
 export class AppModule implements OnApplicationBootstrap {
   private readonly logger = new Logger(AppModule.name);
   constructor(
-    private readonly seeder: DataSeeder,
+    private readonly iamBaselineSeeder: IamBaselineSeeder,
     private readonly edrPassengerOrgSeeder: EdrPassengerOrgSeeder,
     private readonly passengerStaffUsersSeeder: PassengerStaffUsersSeeder,
     private readonly segmentFareSeeder: SegmentFareSeeder,
   ) {}
 
   async onApplicationBootstrap() {
+    // Runs first so the roles it seeds exist before EdrPassengerOrgSeeder links
+    // super_admin permissions. Its own super-admin account attaches to the `edr`
+    // organization, which that seeder creates — so on a brand-new database the
+    // account lands on the next boot; it logs a warning and skips until then.
+    // Non-fatal internally, but the wrapper stays for symmetry with the rest.
     try {
-      await this.seeder.run();
+      await this.iamBaselineSeeder.run();
     } catch (err) {
       this.logger.error(
-        "[DataSeeder] Seed failed (non-fatal):",
+        "[IamBaselineSeeder] Seed failed (non-fatal):",
         (err as Error).message,
       );
     }