feat: ( payments ) add merchant-order and booking/PNR payment status lookups

apps/edr-passenger-api/src/modules/payments/payment-client.service.ts

@@ -12,8 +12,15 @@ import {
   PaymentIntentSnapshot,
   PaymentReferenceType,
   PaymentService,
+  ProviderStatus,
 } from "@edr/types";
 
+/** Side-by-side DB row + live provider status from the payment service diagnostic endpoints. */
+export interface PaymentDiagnostic {
+  db: Record<string, unknown> | null;
+  provider: ProviderStatus | null;
+}
+
 /**
  * Thin HTTP client for the payment microservice (apps/edr-payment-api) — the passenger app's
  * side of the Phase 6 cutover (docs/payment-service §10). Domain validation stays here;
@@ -55,6 +62,28 @@ export class PaymentClientService {
     }
   }
 
+  /**
+   * GET /payments/diagnostic?… — DB intent row + live provider status for a domain reference,
+   * side by side. Returns { db: null, provider: null } when the payment service has no intent.
+   */
+  async getDiagnosticByReference(
+    referenceType: PaymentReferenceType,
+    referenceId: string,
+  ): Promise<PaymentDiagnostic> {
+    const query = new URLSearchParams({
+      service: PaymentService.PASSENGER,
+      referenceType,
+      referenceId,
+    });
+    try {
+      return await this.call("GET", `/payments/diagnostic?${query.toString()}`);
+    } catch (err) {
+      if (err instanceof AxiosError && err.response?.status === 404)
+        return { db: null, provider: null };
+      throw err;
+    }
+  }
+
   /**
    * POST /payments/intents/:id/confirm — submit an OTP for a COLLECT_OTP provider (CAC Bank).
    * A wrong/expired OTP comes back as 400 from the payment service; surface that as a

apps/edr-passenger-api/src/modules/payments/payments.controller.ts

@@ -133,6 +133,33 @@ export class PaymentsController {
     return this.service.getIntentByBookingId(bookingId);
   }
 
+  @Get("status/:bookingRefOrId")
+  @SetMetadata("isPublic", true)
+  @ApiOperation({
+    summary: "Get payment status by booking id or booking reference (PNR)",
+    description:
+      "Accepts either a booking UUID or a booking reference / PNR (e.g. EDR-20240001), " +
+      "resolves it to the booking, and returns the authoritative payment status pulled from " +
+      "the payment microservice.",
+  })
+  getStatusByBookingRefOrId(@Param("bookingRefOrId") bookingRefOrId: string) {
+    return this.service.getIntentByBookingRefOrId(bookingRefOrId);
+  }
+
+  @Get("diagnostic/:bookingRefOrId")
+  @SetMetadata("isPublic", true)
+  @ApiOperation({
+    summary:
+      "Get { db, provider } by booking id or booking reference (PNR) — diagnostic",
+    description:
+      "Accepts a booking UUID or a booking reference / PNR (e.g. EDR-20240001), resolves it to " +
+      "the booking, and returns { db, provider }: the payment service's stored intent row and a " +
+      "live provider status query, side by side. Pure read — does not reconcile the booking.",
+  })
+  getPaymentDiagnostic(@Param("bookingRefOrId") bookingRefOrId: string) {
+    return this.service.getPaymentDiagnosticByBookingRefOrId(bookingRefOrId);
+  }
+
   @Post(":bookingId/confirm")
   @SetMetadata("isPublic", true)
   @ApiOperation({

apps/edr-passenger-api/src/modules/payments/payments.service.ts

@@ -24,7 +24,10 @@ import {
   ForceConfirmDto,
 } from "./payments.dto";
 import { PaymentEventDto, MarkPaidResponseDto } from "./internal-payments.dto";
-import { PaymentClientService } from "./payment-client.service";
+import {
+  PaymentClientService,
+  PaymentDiagnostic,
+} from "./payment-client.service";
 import { CurrencyService } from "../currency/currency.service";
 import { AuditService } from "../../common/audit.service";
 import { rebaseUrlOrigin } from "../../common/utils/redirect-origin.util";
@@ -534,6 +537,51 @@ export class PaymentsService {
     };
   }
 
+  /**
+   * Payment status by booking id (UUID) OR booking reference / PNR (e.g. EDR-20240001).
+   * Resolves the PNR to its booking id, then pulls the authoritative status from the payment
+   * microservice (via {@link getIntentByBookingId}).
+   */
+  async getIntentByBookingRefOrId(
+    bookingRefOrId: string,
+  ): Promise<IntentStatusDto> {
+    const bookingId = await this.resolveBookingId(bookingRefOrId);
+    return this.getIntentByBookingId(bookingId);
+  }
+
+  /**
+   * Diagnostic view by booking id (UUID) OR booking reference / PNR: the payment service's
+   * stored intent row and a live provider status query, side by side ({ db, provider }).
+   * Pure read — does not reconcile or confirm the booking.
+   */
+  async getPaymentDiagnosticByBookingRefOrId(
+    bookingRefOrId: string,
+  ): Promise<PaymentDiagnostic> {
+    const bookingId = await this.resolveBookingId(bookingRefOrId);
+    return this.paymentClient.getDiagnosticByReference(
+      PaymentReferenceType.BOOKING,
+      bookingId,
+    );
+  }
+
+  /** Accept a booking UUID as-is; otherwise look the id up from its bookingRef/PNR. */
+  private async resolveBookingId(bookingRefOrId: string): Promise<string> {
+    const isUuid =
+      /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i.test(
+        bookingRefOrId,
+      );
+    if (isUuid) return bookingRefOrId;
+
+    const booking = await this.prisma.booking.findUnique({
+      where: { bookingRef: bookingRefOrId },
+      select: { id: true },
+    });
+    if (!booking) {
+      throw new NotFoundException(`Booking not found: ${bookingRefOrId}`);
+    }
+    return booking.id;
+  }
+
   async getIntentByBookingId(bookingId: string): Promise<IntentStatusDto> {
     const local = await this.prisma.paymentIntent.findUnique({
       where: { bookingId },