Merge pull request #972 from Tria-plc/freight/nati-1

IAM Seeder centralized

apps/edr-passenger-api/src/app.module.ts

@@ -4,8 +4,8 @@ import { ConfigModule, ConfigService } from "@nestjs/config";
 import { ScheduleModule } from "@nestjs/schedule";
 import { EventEmitterModule } from "@nestjs/event-emitter";
 import { TypeOrmModule, TypeOrmModuleOptions } from "@nestjs/typeorm";
+import { IamBaselineSeeder, IamSeedModule } from "@edr/iam-seed";
 import { IamModule as TriaIamModule } from "@tria-plc/iamapi-common/iam.module";
-import { DataSeeder } from "@tria-plc/iamapi-common/db/seed/seeder";
 import { SharedAuthModule } from "@tria-plc/api-common/modules/auth/shared-auth.module";
 import {
   EDR_PASSENGER_APPLICATION,
@@ -103,6 +103,17 @@ import { EOtpType } from "@tria-plc/iamapi-common";
           `Set your EDR Passenger password using this link: ${route}`,
       },
     }),
+    // Replaces the package's DataSeeder. Shared with edr-freight-api, which
+    // seeds the same `iam` schema — see packages/iam-seed.
+    IamSeedModule.forRoot({
+      superAdmin: {
+        username: "superadmin",
+        name: { am: "ሱፐር አድሚን", en: "Super Admin" },
+        roleKey: "super_admin",
+        organizationKey: "edr",
+        fallbackEmail: "superadmin@tria.com",
+      },
+    }),
     SharedAuthModule,
     PrismaModule,
     AuditModule,
@@ -151,18 +162,23 @@ import { EOtpType } from "@tria-plc/iamapi-common";
 export class AppModule implements OnApplicationBootstrap {
   private readonly logger = new Logger(AppModule.name);
   constructor(
-    private readonly seeder: DataSeeder,
+    private readonly iamBaselineSeeder: IamBaselineSeeder,
     private readonly edrPassengerOrgSeeder: EdrPassengerOrgSeeder,
     private readonly passengerStaffUsersSeeder: PassengerStaffUsersSeeder,
     private readonly segmentFareSeeder: SegmentFareSeeder,
   ) {}
 
   async onApplicationBootstrap() {
+    // Runs first so the roles it seeds exist before EdrPassengerOrgSeeder links
+    // super_admin permissions. Its own super-admin account attaches to the `edr`
+    // organization, which that seeder creates — so on a brand-new database the
+    // account lands on the next boot; it logs a warning and skips until then.
+    // Non-fatal internally, but the wrapper stays for symmetry with the rest.
     try {
-      await this.seeder.run();
+      await this.iamBaselineSeeder.run();
     } catch (err) {
       this.logger.error(
-        "[DataSeeder] Seed failed (non-fatal):",
+        "[IamBaselineSeeder] Seed failed (non-fatal):",
         (err as Error).message,
       );
     }