From edbef5ccf20e8513f591c64284e54d846952447b Mon Sep 17 00:00:00 2001 From: Abubeker Yasin Date: Thu, 16 Jul 2026 11:01:31 +0300 Subject: [PATCH] add permissions --- .../src/modules/tickets/tickets.controller.ts | 7 ++++--- .../src/seed/passenger-permissions.registry.ts | 9 +++++++-- apps/edr-passenger-web/backoffice/src/lib/permissions.ts | 1 + .../src/providers/waafi/waafi.provider.ts | 6 +++++- 4 files changed, 17 insertions(+), 6 deletions(-) diff --git a/apps/edr-passenger-api/src/modules/tickets/tickets.controller.ts b/apps/edr-passenger-api/src/modules/tickets/tickets.controller.ts index e98245755..51d3b0630 100644 --- a/apps/edr-passenger-api/src/modules/tickets/tickets.controller.ts +++ b/apps/edr-passenger-api/src/modules/tickets/tickets.controller.ts @@ -2,7 +2,8 @@ import { Body, Controller, Get, Param, Post, Query, UseGuards, Delete, Patch, Se import { ApiTags, ApiOperation, ApiBearerAuth, ApiBody, ApiQuery } from '@nestjs/swagger'; import { TicketsService } from './tickets.service'; import { JwtGuard } from '../../common/jwt.guard'; -import { PassengerAdmin } from '../../common/passenger-guards'; +import { PassengerStaff } from '../../common/passenger-guards'; +import { PASSENGER_PERMS } from '../../seed/passenger-permissions.registry'; @ApiTags('Tickets') @Controller('tickets') @@ -10,7 +11,7 @@ export class TicketsController { constructor(private service: TicketsService) {} @Post('smart-assign/:bookingId') - @PassengerAdmin() + @PassengerStaff(PASSENGER_PERMS.tickets.generate) @ApiBearerAuth('IAM-auth') @ApiOperation({ summary: 'Smart seat assignment + ticket generation', @@ -23,7 +24,7 @@ export class TicketsController { } @Post('generate/:bookingId') - @PassengerAdmin() + @PassengerStaff(PASSENGER_PERMS.tickets.generate) @ApiBearerAuth('IAM-auth') @ApiOperation({ summary: 'Generate ticket for booking (confirmation page)', diff --git a/apps/edr-passenger-api/src/seed/passenger-permissions.registry.ts b/apps/edr-passenger-api/src/seed/passenger-permissions.registry.ts index d62d5a261..05235e3a8 100644 --- a/apps/edr-passenger-api/src/seed/passenger-permissions.registry.ts +++ b/apps/edr-passenger-api/src/seed/passenger-permissions.registry.ts @@ -22,6 +22,7 @@ export const PASSENGER_PERMISSIONS: PassengerPermissionSeed[] = [ perm('ff5d33a0-0fe7-427f-a065-46dd14ac1da0', 'edr_passenger_app:passengers:manage', 'Manage passengers'), perm('326ec767-1da8-4c7e-b557-d4d2f9dd6d2c', 'edr_passenger_app:tickets:view', 'View tickets'), perm('8ec5697f-d2d4-40a2-a365-ad624991a2ab', 'edr_passenger_app:tickets:manage', 'Manage tickets'), + perm('7f3a1e9c-2b4d-4c8a-9e6f-1a2b3c4d5e6f', 'edr_passenger_app:tickets:generate', 'Generate tickets'), perm('736aca18-6660-4865-9773-81a636f51fa0', 'edr_passenger_app:payments:view_all', 'View all payments'), perm('44065042-b4af-4af2-b213-34a823f78be1', 'edr_passenger_app:payments:refund', 'Refund payments'), perm('558f0172-ab9f-4d13-9477-4ca247d94f3c', 'edr_passenger_app:payments:manage_methods', 'Manage payment methods'), @@ -82,8 +83,9 @@ export const PASSENGER_PERMS = { manage: 'edr_passenger_app:passengers:manage', }, tickets: { - view: 'edr_passenger_app:tickets:view', - manage: 'edr_passenger_app:tickets:manage', + view: 'edr_passenger_app:tickets:view', + manage: 'edr_passenger_app:tickets:manage', + generate: 'edr_passenger_app:tickets:generate', }, payments: { view: 'edr_passenger_app:payments:view', @@ -172,6 +174,7 @@ export const ROLE_PERMISSION_PRESETS = { PASSENGER_PERMS.bookings.manage, PASSENGER_PERMS.tickets.view, PASSENGER_PERMS.tickets.manage, + PASSENGER_PERMS.tickets.generate, PASSENGER_PERMS.passengers.view, PASSENGER_PERMS.agents.view, PASSENGER_PERMS.audit.view, @@ -182,6 +185,7 @@ export const ROLE_PERMISSION_PRESETS = { ticketOfficer: [ PASSENGER_PERMS.tickets.view, PASSENGER_PERMS.tickets.manage, + PASSENGER_PERMS.tickets.generate, PASSENGER_PERMS.bookings.view, PASSENGER_PERMS.passengers.view, PASSENGER_PERMS.dashboard.view, @@ -194,6 +198,7 @@ export const ROLE_PERMISSION_PRESETS = { PASSENGER_PERMS.passengers.view, PASSENGER_PERMS.tickets.view, PASSENGER_PERMS.tickets.manage, + PASSENGER_PERMS.tickets.generate, PASSENGER_PERMS.payments.refund, PASSENGER_PERMS.dashboard.view, ], diff --git a/apps/edr-passenger-web/backoffice/src/lib/permissions.ts b/apps/edr-passenger-web/backoffice/src/lib/permissions.ts index 2a893f971..2c2d54f80 100644 --- a/apps/edr-passenger-web/backoffice/src/lib/permissions.ts +++ b/apps/edr-passenger-web/backoffice/src/lib/permissions.ts @@ -12,6 +12,7 @@ export const PERMS = { tickets: { view: 'edr_passenger_app:tickets:view', manage: 'edr_passenger_app:tickets:manage', + generate: 'edr_passenger_app:tickets:generate', }, // ── Master Data ──────────────────────────────────────────────── diff --git a/packages/payment-providers/src/providers/waafi/waafi.provider.ts b/packages/payment-providers/src/providers/waafi/waafi.provider.ts index 5914fcd61..e7d78f752 100644 --- a/packages/payment-providers/src/providers/waafi/waafi.provider.ts +++ b/packages/payment-providers/src/providers/waafi/waafi.provider.ts @@ -129,13 +129,17 @@ export class WaafiProvider implements PaymentProvider, OnModuleInit { requestBody, ); + this.logger.log( + `Waafi HPP_GETTRANINFO ref=${merchantOrderId} response: ${JSON.stringify(response)}`, + ); + // Waafi returns transaction info (params.status) ONLY when responseCode is 2001. For an // unpaid or not-yet-existing transaction it returns an error envelope (e.g. 5001 / E10206 // "Failed to get transaction info") with no status. Treat that as still-pending (PROCESSING), // never terminal — so the intent keeps waiting for the webhook / its expiry rather than being // wrongly resolved off a "no info" response. if (response.responseCode !== WAAFI_SUCCESS_CODE) { - this.logger.debug( + this.logger.warn( `Waafi HPP_GETTRANINFO ${merchantOrderId}: ${response.responseCode}/${response.errorCode} ${response.responseMsg} — treating as pending`, ); return {