feat: ( payments ) add merchant-order and booking/PNR payment status lookups

apps/edr-payment-api/src/modules/intents/intents.controller.ts

@@ -8,8 +8,12 @@ import {
   Query,
   UseGuards,
 } from "@nestjs/common";
-import { ApiOperation, ApiTags } from "@nestjs/swagger";
-import { PaymentIntentSnapshot } from "@edr/types";
+import { ApiOperation, ApiQuery, ApiTags } from "@nestjs/swagger";
+import {
+  PaymentIntentSnapshot,
+  ProviderMethod,
+  ProviderStatus,
+} from "@edr/types";
 import { ServiceAuthGuard } from "../../common/guards/service-auth.guard";
 import {
   InitiatePaymentRequestDto,
@@ -17,6 +21,7 @@ import {
 } from "./dto/initiate-payment.dto";
 import { ConfirmPaymentDto } from "./dto/confirm-payment.dto";
 import { IntentsService } from "./intents.service";
+import { PaymentIntent } from "./entities/payment-intent.entity";
 
 /**
  * Internal surface — called only by the domain apps (service-authenticated), never by
@@ -68,6 +73,41 @@ export class IntentsController {
     );
   }
 
+  @Get("diagnostic")
+  @ApiOperation({
+    summary: "DB row + live provider status by domain reference (diagnostic)",
+    description:
+      "Returns { db, provider } for a domain reference (service + referenceType + referenceId): " +
+      "the active stored intent row and a live provider status query, side by side. Pure read — " +
+      "does not mutate the intent. `db` is null when no active intent exists for the reference.",
+  })
+  async getDiagnosticByReference(
+    @Query() query: IntentReferenceQueryDto,
+  ): Promise<{ db: PaymentIntent | null; provider: ProviderStatus | null }> {
+    return this.intentsService.getDiagnosticByReference(
+      query.service,
+      query.referenceType,
+      query.referenceId,
+    );
+  }
+
+  @Get("by-merchant-order/:merchantOrderId")
+  @ApiOperation({
+    summary: "DB row + live provider status by merchant order id (diagnostic)",
+    description:
+      "Returns { db, provider } for a provider-facing merchant order id (PSG-/FRT-…): the " +
+      "stored intent row and a live provider status query, side by side. Pure read — does not " +
+      "mutate the intent. `db` is null when no intent has this merchant order id; supply " +
+      "`?provider=` in that case so the provider can still be queried by merchant order id.",
+  })
+  @ApiQuery({ name: "provider", enum: ProviderMethod, required: false })
+  async getByMerchantOrderId(
+    @Param("merchantOrderId") merchantOrderId: string,
+    @Query("provider") provider?: ProviderMethod,
+  ): Promise<{ db: PaymentIntent | null; provider: ProviderStatus | null }> {
+    return this.intentsService.getByMerchantOrderId(merchantOrderId, provider);
+  }
+
   @Post("intents/:id/confirm")
   @ApiOperation({
     summary: "Confirm an OTP-based payment intent (e.g. CAC Bank)",

apps/edr-payment-api/src/modules/intents/intents.service.ts

@@ -304,6 +304,90 @@ export class IntentsService {
     return this.toSnapshot(await this.refreshIfStale(intent));
   }
 
+  /**
+   * Diagnostic lookup by domain reference (service + referenceType + referenceId). Returns the
+   * stored intent AND a LIVE provider status query side by side — the reference-keyed twin of
+   * {@link getByMerchantOrderId}, used by the domain apps to resolve a booking/shipment without
+   * knowing the merchant order id. Pure read (no state-machine mutation).
+   *
+   * - `db`: the active stored intent for the reference, or `null` when none exists.
+   * - `provider`: the raw provider status response (queried using the intent's own provider), or
+   *   `null` when there is no intent or the query fails.
+   */
+  async getDiagnosticByReference(
+    service: PaymentService,
+    referenceType: PaymentReferenceType,
+    referenceId: string,
+  ): Promise<{ db: PaymentIntent | null; provider: ProviderStatus | null }> {
+    const intent = await this.intentsRepository.findActiveByReference(
+      service,
+      referenceType,
+      referenceId,
+    );
+    const providerStatus = intent
+      ? await this.queryProviderForMerchantOrder(
+          intent.merchantOrderId,
+          intent,
+          undefined,
+        )
+      : null;
+    return { db: intent ?? null, provider: providerStatus };
+  }
+
+  /**
+   * Diagnostic lookup by provider-facing merchant order id (PSG-/FRT-…). Returns the stored
+   * intent AND a LIVE provider status query side by side, so the caller can compare what the
+   * platform believes against what the provider currently reports. This is a pure read — it
+   * does NOT mutate the intent (no state-machine transition, no outbox event).
+   *
+   * - `db`: the full stored intent row, or `null` when no intent has this merchant order id.
+   * - `provider`: the raw provider status response. When there is a DB row its provider is
+   *   used; when there is no DB row a `providerHint` must be supplied to know which provider
+   *   to ask (the merchant-order prefix only identifies the service). `null` if the provider
+   *   is unknown or the query fails.
+   */
+  async getByMerchantOrderId(
+    merchantOrderId: string,
+    providerHint?: ProviderMethod,
+  ): Promise<{ db: PaymentIntent | null; provider: ProviderStatus | null }> {
+    const intent =
+      await this.intentsRepository.findByMerchantOrderId(merchantOrderId);
+
+    const providerStatus = await this.queryProviderForMerchantOrder(
+      merchantOrderId,
+      intent,
+      providerHint,
+    );
+
+    return { db: intent ?? null, provider: providerStatus };
+  }
+
+  /** Best-effort live provider status for a merchant order id; never throws (returns null). */
+  private async queryProviderForMerchantOrder(
+    merchantOrderId: string,
+    intent: PaymentIntent | null,
+    providerHint?: ProviderMethod,
+  ): Promise<ProviderStatus | null> {
+    try {
+      if (intent) {
+        const provider = this.providers.get(intent.provider);
+        if (!provider) return null;
+        return await this.queryProviderStatus(intent);
+      }
+      // No DB row — fall back to the caller-supplied provider hint keyed on merchantOrderId.
+      if (!providerHint) return null;
+      const provider = this.providers.get(providerHint);
+      if (!provider) return null;
+      return await provider.queryStatus(merchantOrderId);
+    } catch (err) {
+      const message = err instanceof Error ? err.message : String(err);
+      this.logger.warn(
+        `provider status query failed for merchantOrderId ${merchantOrderId}: ${message}`,
+      );
+      return null;
+    }
+  }
+
   /**
    * Pull-side reconciliation: when a polled intent is non-terminal and stale, ask the
    * provider for the truth and run the answer through the state machine. The browser