Merge branch 'alpha' into passenger/feat/iam-integration

apps/edr-passenger-api/src/modules/bookings/bookings.controller.ts

@@ -1,4 +1,4 @@
-import { Body, Controller, Delete, Get, Param, Post, Patch, UseGuards, Query } from '@nestjs/common';
+import { Body, Controller, Delete, Get, Param, Post, Patch, UseGuards, Query, Req, BadRequestException } from '@nestjs/common';
 import { ApiTags, ApiOperation, ApiBearerAuth, ApiResponse, ApiQuery } from '@nestjs/swagger';
 import { BookingsService } from './bookings.service';
 import { GuestBookingService } from './guest-booking.service';
@@ -14,6 +14,63 @@ export class BookingsController {
     private guestService: GuestBookingService,
   ) {}
   
+  @Get('my')
+  @UseGuards(JwtGuard)
+  @ApiBearerAuth('JWT-auth')
+  @ApiOperation({ 
+    summary: 'Get logged-in user\'s booking history',
+    description: 'Returns all bookings for the authenticated user with schedule and payment details'
+  })
+  @ApiQuery({ name: 'search', required: false, description: 'Search by booking reference or station names' })
+  @ApiQuery({ name: 'status', required: false, description: 'Filter by booking status' })
+  @ApiQuery({ name: 'page', required: false, description: 'Page number' })
+  @ApiQuery({ name: 'pageSize', required: false, description: 'Items per page' })
+  @ApiResponse({ status: 200, description: 'List of user bookings with schedule and passenger details' })
+  getMyBookings(
+    @Req() req: any,
+    @Query('search') search?: string,
+    @Query('status') status?: string,
+    @Query('page') page?: string,
+    @Query('pageSize') pageSize?: string,
+  ) {
+    const passengerId = req.user?.passengerId;
+    if (!passengerId) throw new Error('Passenger ID not found in token');
+    return this.service.findByPassengerId(passengerId, { 
+      search, 
+      status, 
+      page: page ? parseInt(page) : 1, 
+      pageSize: pageSize ? parseInt(pageSize) : 20 
+    });
+  }
+
+  @Get('by-device')
+  @ApiOperation({ 
+    summary: 'Get bookings by device ID',
+    description: 'Returns all bookings associated with a device ID (for guest users). Includes saved passenger details and booking history.'
+  })
+  @ApiQuery({ name: 'deviceId', required: true, description: 'Device identifier' })
+  @ApiQuery({ name: 'search', required: false, description: 'Search by booking reference or station names' })
+  @ApiQuery({ name: 'status', required: false, description: 'Filter by booking status' })
+  @ApiQuery({ name: 'page', required: false, description: 'Page number' })
+  @ApiQuery({ name: 'pageSize', required: false, description: 'Items per page' })
+  @ApiResponse({ status: 200, description: 'List of guest bookings and saved passengers for device' })
+  @ApiResponse({ status: 400, description: 'Device ID is required' })
+  getByDevice(
+    @Query('deviceId') deviceId?: string,
+    @Query('search') search?: string,
+    @Query('status') status?: string,
+    @Query('page') page?: string,
+    @Query('pageSize') pageSize?: string,
+  ) {
+    if (!deviceId) throw new BadRequestException('Device ID is required');
+    return this.service.findByDeviceId(deviceId, { 
+      search, 
+      status, 
+      page: page ? parseInt(page) : 1, 
+      pageSize: pageSize ? parseInt(pageSize) : 20 
+    });
+  }
+  
   @Get()
   @ApiOperation({ 
     summary: 'List all bookings with filters (Admin/Agent)',
@@ -108,6 +165,17 @@ export class BookingsController {
     return this.service.getByRef(ref); 
   }
   
+  @Patch(':id')
+  @ApiOperation({ 
+    summary: 'Update booking details',
+    description: 'Updates booking information for admin/agent operations'
+  })
+  @ApiResponse({ status: 200, description: 'Booking updated successfully' })
+  @ApiResponse({ status: 404, description: 'Booking not found' })
+  update(@Param('id') id: string, @Body() dto: any) { 
+    return this.service.update(id, dto); 
+  }
+  
   @Patch(':bookingRef/modify')
   @UseGuards(JwtGuard)
   @ApiBearerAuth('JWT-auth')
@@ -121,6 +189,28 @@ export class BookingsController {
     return this.service.modify(dto);
   }
   
+  @Delete(':id')
+  @ApiOperation({ 
+    summary: 'Delete booking (admin only)',
+    description: 'Permanently deletes a booking record'
+  })
+  @ApiResponse({ status: 200, description: 'Booking deleted successfully' })
+  @ApiResponse({ status: 404, description: 'Booking not found' })
+  delete(@Param('id') id: string) { 
+    return this.service.delete(id); 
+  }
+
+  @Get(':id/usage')
+  @ApiOperation({ 
+    summary: 'Check if booking is in use',
+    description: 'Returns list of modules/data that reference this booking'
+  })
+  @ApiResponse({ status: 200, description: 'Usage information retrieved' })
+  @ApiResponse({ status: 404, description: 'Booking not found' })
+  checkUsage(@Param('id') id: string) {
+    return this.service.checkBookingUsage(id);
+  }
+  
   @Delete(':bookingRef')
   @UseGuards(JwtGuard)
   @ApiBearerAuth('JWT-auth')

apps/edr-passenger-api/src/modules/bookings/bookings.service.ts

@@ -38,6 +38,147 @@ export class BookingsService {
     private currencyService: CurrencyService,
   ) {}
 
+  async findByPassengerId(passengerId: string, filters: BookingFilters = {}) {
+    const { search, status, page = 1, pageSize = 20 } = filters;
+    const skip = (page - 1) * pageSize;
+    
+    const where: any = { passengerId };
+    
+    if (search) {
+      where.OR = [
+        { bookingRef: { contains: search, mode: 'insensitive' } },
+        { schedule: { originStation: { name: { contains: search, mode: 'insensitive' } } } },
+        { schedule: { destinationStation: { name: { contains: search, mode: 'insensitive' } } } },
+      ];
+    }
+    
+    if (status) {
+      where.status = status;
+    }
+    
+    const [items, total] = await Promise.all([
+      this.prisma.booking.findMany({
+        where,
+        skip,
+        take: pageSize,
+        orderBy: { createdAt: 'desc' },
+        include: {
+          schedule: { include: { originStation: true, destinationStation: true, train: true } },
+          paymentIntent: true,
+          seats: { include: { seat: true } },
+        },
+      }),
+      this.prisma.booking.count({ where }),
+    ]);
+    
+    return {
+      items: items.map(booking => ({
+        id: booking.id,
+        bookingRef: booking.bookingRef,
+        status: booking.status,
+        totalMinor: booking.totalMinor,
+        currency: 'ETB',
+        displayCurrency: booking.displayCurrency,
+        displayTotalMinor: booking.displayTotalMinor,
+        adultCount: booking.adultCount,
+        childCount: booking.childCount,
+        createdAt: booking.createdAt,
+        schedule: {
+          train: booking.schedule.train,
+          originStation: booking.schedule.originStation,
+          destinationStation: booking.schedule.destinationStation,
+          departureAt: booking.schedule.departureAt,
+          arrivalAt: booking.schedule.arrivalAt,
+        },
+        paymentIntent: booking.paymentIntent,
+        seatCount: booking.seats.length,
+      })),
+      meta: {
+        page,
+        pageSize,
+        total,
+        totalPages: Math.ceil(total / pageSize),
+      },
+    };
+  }
+
+  async findByDeviceId(deviceId: string, filters: BookingFilters = {}) {
+    const { search, status, page = 1, pageSize = 20 } = filters;
+    const skip = (page - 1) * pageSize;
+    
+    // Find user with this device ID
+    const device = await this.prisma.device.findUnique({
+      where: { id: deviceId },
+      include: { user: { include: { passenger: true } } },
+    }).catch(() => null);
+    
+    const searchConditions = search ? [
+      { bookingRef: { contains: search, mode: 'insensitive' } },
+      { schedule: { originStation: { name: { contains: search, mode: 'insensitive' } } } },
+      { schedule: { destinationStation: { name: { contains: search, mode: 'insensitive' } } } },
+    ] : [];
+    
+    const where: any = {
+      OR: [
+        { userAgent: deviceId },
+        ...(device?.user?.passenger ? [{ passengerId: device.user.passenger.id }] : []),
+      ],
+    };
+    
+    if (search) {
+      where.AND = [{ OR: searchConditions }];
+    }
+    
+    if (status) {
+      where.status = status;
+    }
+    
+    const [items, total] = await Promise.all([
+      this.prisma.booking.findMany({
+        where,
+        skip,
+        take: pageSize,
+        orderBy: { createdAt: 'desc' },
+        include: {
+          schedule: { include: { originStation: true, destinationStation: true, train: true } },
+          paymentIntent: true,
+          seats: { include: { seat: true } },
+        },
+      }),
+      this.prisma.booking.count({ where }),
+    ]);
+    
+    return {
+      items: items.map(booking => ({
+        id: booking.id,
+        bookingRef: booking.bookingRef,
+        status: booking.status,
+        totalMinor: booking.totalMinor,
+        currency: 'ETB',
+        displayCurrency: booking.displayCurrency,
+        displayTotalMinor: booking.displayTotalMinor,
+        adultCount: booking.adultCount,
+        childCount: booking.childCount,
+        createdAt: booking.createdAt,
+        schedule: {
+          train: booking.schedule.train,
+          originStation: booking.schedule.originStation,
+          destinationStation: booking.schedule.destinationStation,
+          departureAt: booking.schedule.departureAt,
+          arrivalAt: booking.schedule.arrivalAt,
+        },
+        paymentIntent: booking.paymentIntent,
+        seatCount: booking.seats.length,
+      })),
+      meta: {
+        page,
+        pageSize,
+        total,
+        totalPages: Math.ceil(total / pageSize),
+      },
+    };
+  }
+
   async findAll(filters: BookingFilters = {}) {
     const { search, status, page = 1, pageSize = 20 } = filters;
     const skip = (page - 1) * pageSize;
@@ -154,7 +295,6 @@ export class BookingsService {
       passengersData.push({ ...passenger, passengerName, dateOfBirth, category, verifaydaVerified, verifaydaData, nationality });
     }
 
-    // Use first passenger's nationality for fare lookup (or allow per-passenger pricing)
     const primaryNationality = passengersData[0]?.nationality;
     const baseFareMinor = await this.getBaseFare(dto.scheduleId, dto.seatClassId, segmentRoute, fullRoute, primaryNationality);
     const adultFareMinor = baseFareMinor * adultCount;
@@ -302,6 +442,60 @@ export class BookingsService {
     return { cancelled: true, refundAmount: refundAmount / 100, currency: 'ETB' };
   }
 
+  async update(id: string, dto: any) {
+    const booking = await this.prisma.booking.findUnique({ where: { id } });
+    if (!booking) throw new NotFoundException('Booking not found');
+    return this.prisma.booking.update({
+      where: { id },
+      data: {
+        status: dto.status || booking.status,
+        totalMinor: dto.totalMinor !== undefined ? dto.totalMinor : booking.totalMinor,
+        displayCurrency: dto.displayCurrency || booking.displayCurrency,
+        displayTotalMinor: dto.displayTotalMinor !== undefined ? dto.displayTotalMinor : booking.displayTotalMinor,
+      },
+      include: {
+        schedule: { include: { originStation: true, destinationStation: true, train: true } },
+        paymentIntent: true,
+        seats: { include: { seat: true } },
+      },
+    });
+  }
+
+  async delete(id: string) {
+    const booking = await this.prisma.booking.findUnique({ where: { id }, include: { seats: true } });
+    if (!booking) throw new NotFoundException('Booking not found');
+    
+    await this.seatsService.releaseSeats(booking.seats.map((s) => s.seatId));
+    
+    await this.prisma.bookingSeat.deleteMany({ where: { bookingId: id } });
+    await this.prisma.booking.delete({ where: { id } });
+    
+    return { deleted: true, bookingRef: booking.bookingRef };
+  }
+
+  async checkBookingUsage(id: string) {
+    const booking = await this.prisma.booking.findUnique({ where: { id } });
+    if (!booking) throw new NotFoundException('Booking not found');
+
+    const [ticketCount, paymentIntentCount, modificationsCount, cancellationCount] = await Promise.all([
+      this.prisma.ticket.count({ where: { bookingId: id } }),
+      this.prisma.paymentIntent.count({ where: { bookingId: id } }),
+      this.prisma.bookingModification.count({ where: { bookingId: id } }),
+      this.prisma.bookingCancellation.count({ where: { bookingId: id } }),
+    ]);
+
+    const usage = [];
+    if (ticketCount > 0) usage.push('Ticket(s)');
+    if (paymentIntentCount > 0) usage.push('Payment record(s)');
+    if (modificationsCount > 0) usage.push('Modification history');
+    if (cancellationCount > 0) usage.push('Cancellation record(s)');
+
+    return {
+      isInUse: usage.length > 0,
+      affectedModules: usage,
+    };
+  }
+
   @Cron(CronExpression.EVERY_MINUTE)
   async expirePendingBookings() {
     const cutoff = new Date(Date.now() - 20 * 60 * 1000);

apps/edr-passenger-api/src/modules/bookings/guest-booking.service.ts

@@ -168,12 +168,19 @@ export class GuestBookingService {
         throw new BadRequestException('Email already registered. Please login instead.');
       }
 
+      let accountPhone = firstPassenger.phone || null;
+      if (accountPhone) {
+        const existingPhone = await this.prisma.user.findUnique({ where: { phone: accountPhone } });
+        if (existingPhone) throw new BadRequestException('Phone number already registered. Please login instead.');
+      }
+      if (!accountPhone) accountPhone = `+guest-${Date.now()}-${Math.random().toString(36).substring(2, 9)}`;
+
       const passwordHash = await bcrypt.hash(dto.password, 10);
       const user = await this.prisma.user.create({
         data: {
           fullName: firstPassenger.passengerName,
           email: firstPassenger.email,
-          phone: firstPassenger.phone || '',
+          phone: accountPhone,
           passwordHash,
           nationality: firstPassenger.nationality,
           nationalId: firstPassenger.idDocumentType === IdDocumentType.NATIONAL_ID ? firstPassenger.idDocumentNumber : undefined,
@@ -201,11 +208,19 @@ export class GuestBookingService {
         }
       }
       
+      // Use a guaranteed-unique guest phone to avoid constraint collisions
+      let guestPhone = firstPassenger.phone || null;
+      if (guestPhone) {
+        const existingPhone = await this.prisma.user.findUnique({ where: { phone: guestPhone } });
+        if (existingPhone) guestPhone = null;
+      }
+      if (!guestPhone) guestPhone = `+guest-${uniqueId}`;
+
       const tempUser = await this.prisma.user.create({
         data: {
           fullName: firstPassenger.passengerName,
           email: guestEmail,
-          phone: firstPassenger.phone || `+251${uniqueId.replace(/[^0-9]/g, '').slice(0, 9)}`,
+          phone: guestPhone,
           passwordHash: await bcrypt.hash(Math.random().toString(36), 10),
           role: 'PASSENGER',
         },
@@ -235,6 +250,7 @@ export class GuestBookingService {
         displayCurrency,
         displayTotalMinor,
         bookingType: 'ONE_WAY',
+        userAgent: dto.deviceId,
         // contactEmail: firstPassenger.email,  // Temporarily disabled until migration
         // contactPhone: firstPassenger.phone,  // Temporarily disabled until migration
         seats: {

apps/edr-passenger-api/src/modules/fare-engine/fare-engine.controller.ts

@@ -1,12 +1,17 @@
 import { Body, Controller, Post, Get, Query } from '@nestjs/common';
 import { ApiTags, ApiOperation, ApiQuery, ApiResponse } from '@nestjs/swagger';
+import { ConfigService } from '@nestjs/config';
 import { FareEngineService } from './fare-engine.service';
 import { FareCalculateDto, FareBreakdownDto } from './fare-engine.dto';
+import { FaydaConfig } from '../../config/fayda.config';
 
 @ApiTags('Fare Engine')
 @Controller('fare-engine')
 export class FareEngineController {
-  constructor(private service: FareEngineService) {}
+  constructor(
+    private service: FareEngineService,
+    private configService: ConfigService,
+  ) {}
 
   @Post('calculate')
   @ApiOperation({
@@ -63,3 +68,36 @@ Returns a full breakdown including a human-readable calculation trace.`,
     );
   }
 }
+
+@ApiTags('Config')
+@Controller('config')
+export class ConfigController {
+  constructor(private configService: ConfigService) {}
+
+  @Get('fayda-status')
+  @ApiOperation({ 
+    summary: 'Check Verifayda 2.0 configuration status',
+    description: 'Returns whether Verifayda integration is enabled and ready to use'
+  })
+  @ApiResponse({ 
+    status: 200, 
+    description: 'Verifayda status retrieved successfully',
+    schema: {
+      example: {
+        enabled: true,
+        mode: 'production',
+        apiUrl: 'https://api.verifayda.gov.et/v2'
+      }
+    }
+  })
+  getFaydaStatus() {
+    const faydaConfig = this.configService.get<FaydaConfig>('fayda');
+    const verifaydaEnabled = this.configService.get<boolean>('VERIFAYDA_ENABLED', false);
+    
+    return {
+      enabled: faydaConfig?.enabled || verifaydaEnabled,
+      mode: verifaydaEnabled ? 'production' : 'development',
+      apiUrl: this.configService.get<string>('VERIFAYDA_API_URL', 'https://api.verifayda.gov.et/v2'),
+    };
+  }
+}

apps/edr-passenger-api/src/modules/fare-engine/fare-engine.module.ts

@@ -1,12 +1,12 @@
 import { Module } from '@nestjs/common';
-import { FareEngineController } from './fare-engine.controller';
+import { FareEngineController, ConfigController } from './fare-engine.controller';
 import { FareEngineService } from './fare-engine.service';
 import { CurrencyController } from './currency.controller';
 import { CurrencyModule } from '../currency/currency.module';
 
 @Module({
   imports: [CurrencyModule],
-  controllers: [FareEngineController, CurrencyController],
+  controllers: [FareEngineController, CurrencyController, ConfigController],
   providers: [FareEngineService],
   exports: [FareEngineService],
 })

apps/edr-passenger-api/src/modules/fleet/fleet.controller.ts

@@ -22,6 +22,14 @@ export class FleetController {
   @ApiResponse({ status: 201, description: 'Train created' })
   createTrain(@Body() dto: CreateTrainDto) { return this.service.createTrain(dto); }
 
+  @Patch('trains/:id')
+  @ApiOperation({ summary: 'Update a train service' })
+  @ApiParam({ name: 'id', description: 'Train UUID' })
+  @ApiBody({ type: CreateTrainDto })
+  @ApiResponse({ status: 200, description: 'Train updated' })
+  @ApiResponse({ status: 404, description: 'Train not found' })
+  updateTrain(@Param('id') id: string, @Body() dto: CreateTrainDto) { return this.service.updateTrain(id, dto); }
+
   @Get('coaches')
   @ApiOperation({ summary: 'List coaches filtered by status, mode, seat class, or schedule assignment' })
   @ApiQuery({ name: 'isActive', required: false, type: Boolean, description: 'true = active only, false = inactive only, omit = all' })

apps/edr-passenger-api/src/modules/fleet/fleet.service.ts

@@ -112,6 +112,12 @@ export class FleetService {
 
   createTrain(dto: CreateTrainDto) { return this.prisma.train.create({ data: dto }); }
 
+  async updateTrain(id: string, dto: CreateTrainDto) {
+    const train = await this.prisma.train.findUnique({ where: { id } });
+    if (!train) throw new NotFoundException('Train not found');
+    return this.prisma.train.update({ where: { id }, data: dto });
+  }
+
   async getCoach(id: string) {
     const coach = await this.prisma.coach.findUnique({
       where: { id },

apps/edr-passenger-api/src/modules/passengers/passengers.controller.ts

@@ -1,10 +1,11 @@
-import { Body, Controller, Get, Param, Post, UseGuards, Query, Request } from '@nestjs/common';
+import { Body, Controller, Get, Param, Post, UseGuards, Query, Request, UnauthorizedException, Patch, Delete } from '@nestjs/common';
 import { ApiTags, ApiOperation, ApiBearerAuth, ApiResponse, ApiQuery } from '@nestjs/swagger';
 import { PassengersService } from './passengers.service';
 import { CreateTravelerProfileDto, CreateSavedRouteDto, VerifyFaydaDto, SavePassengersDto, RegisterPassengerDto } from './passengers.dto';
 import { JwtGuard } from '../../common/jwt.guard';
 import { VerifaydaService } from '../verifayda/verifayda.service';
 import { OptionalJwtGuard } from '../verifayda/optional-jwt.guard';
+import { PrismaService } from '../../common/prisma.service';
 
 @ApiTags('Passengers')
 @Controller('passengers')
@@ -12,6 +13,7 @@ export class PassengersController {
   constructor(
     private service: PassengersService,
     private verifaydaService: VerifaydaService,
+    private prisma: PrismaService,
   ) {}
 
   @Get()
@@ -37,6 +39,42 @@ export class PassengersController {
     });
   }
 
+  @Get('me')
+  @UseGuards(JwtGuard)
+  @ApiBearerAuth('JWT-auth')
+  @ApiOperation({ 
+    summary: 'Get current passenger profile',
+    description: 'Returns complete profile for authenticated passenger including passport details and verification status. Returns null if no passenger profile exists.'
+  })
+  @ApiResponse({ 
+    status: 200, 
+    description: 'Passenger profile retrieved successfully or null if not found'
+  })
+  @ApiResponse({ status: 401, description: 'Unauthorized - Invalid or missing token' })
+  async getMe(@Request() req: any) {
+    if (!req.user || !req.user.userId) {
+      throw new UnauthorizedException('User not authenticated');
+    }
+
+    try {
+      const user = await this.prisma.user.findUnique({
+        where: { id: req.user.userId },
+        include: { 
+          passenger: true,
+        },
+      });
+
+      if (!user || !user.passenger) {
+        return null;
+      }
+
+      return this.service.getProfile(user.passenger.id);
+    } catch (error) {
+      // If profile lookup fails for any reason, return null to allow app to continue
+      return null;
+    }
+  }
+
   @Get(':id/profile')
   @UseGuards(JwtGuard)
   @ApiBearerAuth('JWT-auth')
@@ -313,4 +351,37 @@ Returns saved passenger details with generated IDs and confirmation.`,
   getSavedRoutes(@Param('id') id: string) {
     return this.service.getSavedRoutes(id);
   }
+
+  @Patch(':id')
+  @ApiOperation({ 
+    summary: 'Update passenger details',
+    description: 'Updates passenger information for admin/agent operations'
+  })
+  @ApiResponse({ status: 200, description: 'Passenger updated successfully' })
+  @ApiResponse({ status: 404, description: 'Passenger not found' })
+  updatePassenger(@Param('id') id: string, @Body() dto: any) {
+    return this.service.updatePassenger(id, dto);
+  }
+
+  @Delete(':id')
+  @ApiOperation({ 
+    summary: 'Delete passenger (admin only)',
+    description: 'Permanently deletes a passenger record and associated data'
+  })
+  @ApiResponse({ status: 200, description: 'Passenger deleted successfully' })
+  @ApiResponse({ status: 404, description: 'Passenger not found' })
+  deletePassenger(@Param('id') id: string) {
+    return this.service.deletePassenger(id);
+  }
+
+  @Get(':id/usage')
+  @ApiOperation({ 
+    summary: 'Check if passenger is in use',
+    description: 'Returns list of modules/data that reference this passenger'
+  })
+  @ApiResponse({ status: 200, description: 'Usage information retrieved' })
+  @ApiResponse({ status: 404, description: 'Passenger not found' })
+  checkUsage(@Param('id') id: string) {
+    return this.service.checkPassengerUsage(id);
+  }
 }

apps/edr-passenger-api/src/modules/passengers/passengers.module.ts

@@ -3,9 +3,10 @@ import { HttpModule } from '@nestjs/axios';
 import { PassengersController } from './passengers.controller';
 import { PassengersService } from './passengers.service';
 import { VerifaydaModule } from '../verifayda/verifayda.module';
+import { PrismaModule } from '../../common/prisma.module';
 
 @Module({ 
-  imports: [VerifaydaModule, HttpModule],
+  imports: [VerifaydaModule, HttpModule, PrismaModule],
   controllers: [PassengersController], 
   providers: [PassengersService] 
 })

apps/edr-passenger-api/src/modules/passengers/passengers.service.ts

@@ -180,6 +180,28 @@ export class PassengersService {
 
   getSavedRoutes(passengerId: string) { return this.prisma.savedRoute.findMany({ where: { passengerId }, orderBy: { tripCount: 'desc' } }); }
 
+  async updatePassenger(id: string, dto: any) {
+    const passenger = await this.prisma.passenger.findUnique({ where: { id } });
+    if (!passenger) throw new NotFoundException('Passenger not found');
+    return this.prisma.passenger.update({
+      where: { id },
+      data: {
+        user: {
+          update: {
+            fullName: dto.fullName || undefined,
+            email: dto.email || undefined,
+            phone: dto.phone || undefined,
+            nationality: dto.nationality || undefined,
+          },
+        },
+      },
+      include: {
+        user: { select: { fullName: true, email: true, phone: true, nationality: true } },
+        loyalty: true,
+      },
+    });
+  }
+
   async registerPassenger(dto: RegisterPassengerDto) {
     const isEthiopian = !!dto.nationalId;
     const isLoggedIn = !!dto.userId;
@@ -270,4 +292,30 @@ export class PassengersService {
       message: 'Passenger details saved for guest booking',
     };
   }
+
+  async deletePassenger(id: string) {
+    const passenger = await this.prisma.passenger.findUnique({ where: { id } });
+    if (!passenger) throw new NotFoundException('Passenger not found');
+    
+    await this.prisma.passenger.delete({ where: { id } });
+    return { deleted: true, passengerId: id };
+  }
+
+  async checkPassengerUsage(id: string) {
+    const [bookingCount, loyaltyAccount, walletAccount] = await Promise.all([
+      this.prisma.booking.count({ where: { passengerId: id } }),
+      this.prisma.loyaltyAccount.findUnique({ where: { passengerId: id } }),
+      this.prisma.walletAccount.findUnique({ where: { passengerId: id } }),
+    ]);
+
+    const usage = [];
+    if (bookingCount > 0) usage.push(`${bookingCount} booking(s)`);
+    if (loyaltyAccount) usage.push('Loyalty account');
+    if (walletAccount) usage.push('Wallet account');
+
+    return {
+      isInUse: usage.length > 0,
+      affectedModules: usage,
+    };
+  }
 }

apps/edr-passenger-api/src/modules/payments/payments.controller.ts

@@ -1,7 +1,8 @@
-import { Body, Controller, Get, Param, Post, Query, UseGuards } from '@nestjs/common';
-import { ApiTags, ApiOperation, ApiBearerAuth, ApiQuery, ApiOkResponse } from '@nestjs/swagger';
+import { Body, Controller, Get, HttpStatus, Param, Post, Query, Res, UseGuards } from '@nestjs/common';
+import { ApiTags, ApiOperation, ApiBearerAuth, ApiQuery, ApiOkResponse, ApiProduces } from '@nestjs/swagger';
+import { Response } from 'express';
 import { PaymentsService } from './payments.service';
-import { InitiatePaymentDto, RefundDto, AddPaymentMethodDto, PaymentRegionEnum, SupportedPaymentMethodDto } from './payments.dto';
+import { InitiatePaymentDto, RefundDto, AddPaymentMethodDto, PaymentRegionEnum, SupportedPaymentMethodDto, PaymentMethodTypeEnum, PaymentPlatformDto } from './payments.dto';
 import { JwtGuard } from '../../common/jwt.guard';
 import { RolesGuard } from '../../common/roles.guard';
 import { Roles } from '../../common/roles.decorator';
@@ -62,4 +63,113 @@ export class PaymentsController {
   @ApiQuery({ name: 'region', enum: PaymentRegionEnum, required: false })
   @ApiOkResponse({ type: [SupportedPaymentMethodDto] })
   getMethods(@Query('region') region?: PaymentRegionEnum) { return this.service.getSupportedPaymentMethods(region); }
+
+  @Get('checkout')
+  @ApiOperation({
+    summary: 'Browser checkout redirect',
+    description: 'Initiates payment and returns an HTML page that auto-redirects the browser to the provider checkout URL. Designed to be opened directly in a browser tab.',
+  })
+  @ApiQuery({ name: 'bookingId', required: true })
+  @ApiQuery({ name: 'method', enum: PaymentMethodTypeEnum, required: true })
+  @ApiQuery({ name: 'platform', enum: ['web', 'mobile'], required: false })
+  @ApiProduces('text/html')
+  async checkout(
+    @Query('bookingId') bookingId: string,
+    @Query('method') method: PaymentMethodTypeEnum,
+    @Query('platform') platform: PaymentPlatformDto = 'web',
+    @Res() res: Response,
+  ) {
+    if (!bookingId) {
+      return res.status(HttpStatus.BAD_REQUEST).type('html').send(this.buildErrorHtml('Missing required query parameter: bookingId'));
+    }
+    if (!method || !Object.values(PaymentMethodTypeEnum).includes(method)) {
+      return res.status(HttpStatus.BAD_REQUEST).type('html').send(this.buildErrorHtml('Missing or invalid query parameter: method'));
+    }
+
+    try {
+      const result = await this.service.initiatePayment({ bookingId, method, platform });
+      const url = result.clientAction?.type === 'REDIRECT' ? result.clientAction.url : undefined;
+
+      if (url) {
+        return res.status(HttpStatus.OK).type('html').send(this.buildRedirectHtml(url));
+      }
+
+      return res.status(HttpStatus.OK).type('html').send(this.buildStatusHtml(result.status, result.intentId));
+    } catch (err: unknown) {
+      const message = err instanceof Error ? err.message : 'An unexpected error occurred';
+      return res.status(HttpStatus.OK).type('html').send(this.buildErrorHtml(message));
+    }
+  }
+
+  private buildRedirectHtml(url: string): string {
+    const escaped = url.replace(/"/g, '"');
+    return `<!DOCTYPE html>
+<html lang="en">
+<head>
+  <meta charset="UTF-8">
+  <meta http-equiv="refresh" content="0;url=${escaped}">
+  <title>Redirecting to payment…</title>
+  <style>
+    body { font-family: sans-serif; display: flex; align-items: center; justify-content: center; min-height: 100vh; margin: 0; background: #f5f5f5; }
+    .card { background: #fff; border-radius: 8px; padding: 40px; text-align: center; box-shadow: 0 2px 8px rgba(0,0,0,.1); max-width: 400px; }
+    .spinner { width: 40px; height: 40px; border: 4px solid #e0e0e0; border-top-color: #1a73e8; border-radius: 50%; animation: spin .8s linear infinite; margin: 0 auto 20px; }
+    @keyframes spin { to { transform: rotate(360deg); } }
+    p { color: #555; margin: 0 0 16px; }
+    a { color: #1a73e8; }
+  </style>
+</head>
+<body>
+  <div class="card">
+    <div class="spinner"></div>
+    <p>Redirecting to payment provider…</p>
+    <p><a href="${escaped}">Click here if you are not redirected</a></p>
+  </div>
+  <script>window.location.href = "${escaped}";</script>
+</body>
+</html>`;
+  }
+
+  private buildStatusHtml(status: string, intentId: string): string {
+    return `<!DOCTYPE html>
+<html lang="en">
+<head>
+  <meta charset="UTF-8">
+  <title>Payment status</title>
+  <style>
+    body { font-family: sans-serif; display: flex; align-items: center; justify-content: center; min-height: 100vh; margin: 0; background: #f5f5f5; }
+    .card { background: #fff; border-radius: 8px; padding: 40px; text-align: center; box-shadow: 0 2px 8px rgba(0,0,0,.1); max-width: 400px; }
+    .status { font-size: 1.1rem; font-weight: 600; color: #333; margin-bottom: 8px; }
+    small { color: #888; }
+  </style>
+</head>
+<body>
+  <div class="card">
+    <div class="status">${status}</div>
+    <small>Intent: ${intentId}</small>
+  </div>
+</body>
+</html>`;
+  }
+
+  private buildErrorHtml(message: string): string {
+    return `<!DOCTYPE html>
+<html lang="en">
+<head>
+  <meta charset="UTF-8">
+  <title>Payment error</title>
+  <style>
+    body { font-family: sans-serif; display: flex; align-items: center; justify-content: center; min-height: 100vh; margin: 0; background: #f5f5f5; }
+    .card { background: #fff; border-radius: 8px; padding: 40px; text-align: center; box-shadow: 0 2px 8px rgba(0,0,0,.1); max-width: 400px; }
+    .error { color: #d32f2f; font-weight: 600; margin-bottom: 8px; }
+    p { color: #555; }
+  </style>
+</head>
+<body>
+  <div class="card">
+    <div class="error">Payment could not be initiated</div>
+    <p>${message}</p>
+  </div>
+</body>
+</html>`;
+  }
 }

apps/edr-passenger-api/src/modules/payments/payments.service.ts

@@ -182,8 +182,6 @@ export class PaymentsService {
     return this.formatIntentResponse(intent);
   }
 
-
-
   private formatIntentResponse(
     intent: Prisma.PaymentIntentGetPayload<Record<string, never>>,
   ): InitiateResponseDto {
@@ -349,9 +347,31 @@ export class PaymentsService {
       });
     });
 
-    await this.seatsService.confirmSeats(booking.seats.map((s) => s.seatId));
-    await this.ticketsService.generate(booking.id);
-    await this.awardLoyaltyPoints(booking.passengerId, booking.totalMinor, booking.id);
+    try {
+      await this.seatsService.confirmSeats(booking.seats.map((s) => s.seatId));
+    } catch (err) {
+      this.logger.error(`Error confirming seats: ${err instanceof Error ? err.message : String(err)}`);
+    }
+
+    try {
+      await this.createJourneySegments(booking);
+    } catch (err) {
+      this.logger.error(`Error creating journey segments: ${err instanceof Error ? err.message : String(err)}`);
+    }
+
+    try {
+      await this.ticketsService.generate(booking.id);
+    } catch (err) {
+      this.logger.error(`Error generating ticket: ${err instanceof Error ? err.message : String(err)}`);
+      throw err;
+    }
+
+    try {
+      await this.awardLoyaltyPoints(booking.passengerId, booking.totalMinor, booking.id);
+    } catch (err) {
+      this.logger.warn(`Error awarding loyalty points: ${err instanceof Error ? err.message : String(err)}`);
+    }
+
     this.eventEmitter.emit('payment.succeeded', { booking });
     return { alreadyFinalized: false };
   }
@@ -390,4 +410,47 @@ export class PaymentsService {
     await this.prisma.loyaltyAccount.update({ where: { passengerId }, data: { pointsBalance: { increment: points }, tier: tier as any } });
     await this.prisma.loyaltyLedgerEntry.create({ data: { accountId: account.id, delta: points, reason: 'TRIP_COMPLETED', bookingId, balanceAfter: newBalance } });
   }
+
+  private async createJourneySegments(booking: Prisma.BookingGetPayload<{ include: { seats: true } }>) {
+    const schedule = await this.prisma.trainSchedule.findUnique({
+      where: { id: booking.scheduleId },
+      include: { stopTimes: { include: { station: true }, orderBy: { sequence: 'asc' } } },
+    });
+    if (!schedule) return;
+
+    const stopTimes = schedule.stopTimes;
+    if (stopTimes.length < 2) return;
+
+    const originSequence = stopTimes.findIndex(st => st.stationId === schedule.originStationId);
+    const destSequence = stopTimes.findIndex(st => st.stationId === schedule.destinationStationId);
+
+    if (originSequence < 0 || destSequence < 0 || originSequence >= destSequence) return;
+
+    const journey = await this.prisma.journey.create({
+      data: {
+        passengerId: booking.passengerId,
+        status: 'CONFIRMED',
+        totalMinor: booking.totalMinor,
+        currency: booking.currency,
+      },
+    });
+
+    const journeySegments = [];
+    for (const bookingSeat of booking.seats) {
+      for (let i = originSequence; i < destSequence; i++) {
+        journeySegments.push({
+          journeyId: journey.id,
+          scheduleId: booking.scheduleId,
+          segmentOrder: i,
+          seatId: bookingSeat.seatId,
+          departureStationId: stopTimes[i].stationId,
+          arrivalStationId: stopTimes[i + 1].stationId,
+        });
+      }
+    }
+
+    if (journeySegments.length > 0) {
+      await this.prisma.journeySegment.createMany({ data: journeySegments });
+    }
+  }
 }

apps/edr-passenger-api/src/modules/payments/providers/telebirr.provider.ts

@@ -190,7 +190,7 @@ export class TelebirrProvider implements PaymentProvider {
         merch_code: this.merchantCode,
         merch_order_id: input.merchantOrderId,
         trade_type: 'Checkout' as const,
-        title: `EDR Booking ${input.bookingRef}`,
+        title: `EDR Booking`,
         total_amount: totalAmount,
         trans_currency: input.currency,
         timeout_express: this.timeoutExpress,

apps/edr-passenger-api/src/modules/seats/seats.service.ts

@@ -353,9 +353,13 @@ export class SeatsService {
     // No-op for status — availability is segment-scoped via JourneySegment
     // seat.status = BLOCKED is the only hard gate; BOOKED is not used as a booking flag
   }
+
   async releaseSeats(seatIds: string[]) {
-    // Only reset seats that are physically BLOCKED back to AVAILABLE if needed
-    // For segment-based bookings, releasing is handled by JourneySegment deletion
+    if (seatIds.length > 0) {
+      await this.prisma.journeySegment.deleteMany({
+        where: { seatId: { in: seatIds } },
+      });
+    }
   }
 
   async autoAssignSeats(scheduleId: string, count: number, seatClassName: string, eligibility?: string): Promise<string[]> {
@@ -480,6 +484,16 @@ export class SeatsService {
   @Cron(CronExpression.EVERY_MINUTE)
   async expireHolds() {
     const expired = await this.prisma.seatHold.findMany({ where: { expiresAt: { lt: new Date() } } });
-    for (const hold of expired) { await this.releaseSeats(hold.seatIds); await this.prisma.seatHold.delete({ where: { id: hold.id } }); }
+    for (const hold of expired) { 
+      await this.releaseSeats(hold.seatIds);
+      try {
+        await this.prisma.seatHold.delete({ where: { id: hold.id } });
+      } catch (err) {
+        // Ignore if already deleted (e.g., by another process)
+        if (err instanceof Error && !err.message.includes('P2025')) {
+          throw err;
+        }
+      }
+    }
   }
 }

apps/edr-passenger-api/src/modules/tickets/tickets.controller.ts

@@ -1,16 +1,52 @@
-import { Body, Controller, Get, Param, Post, Query, UseGuards } from '@nestjs/common';
+import { Body, Controller, Get, Param, Post, Query, UseGuards, Delete, Patch } from '@nestjs/common';
 import { ApiTags, ApiOperation, ApiBearerAuth } from '@nestjs/swagger';
 import { TicketsService } from './tickets.service';
 import { JwtGuard } from '../../common/jwt.guard';
 
 @ApiTags('Tickets')
 @Controller('tickets')
-@UseGuards(JwtGuard)
-@ApiBearerAuth('JWT-auth')
 export class TicketsController {
   constructor(private service: TicketsService) {}
   
+  @Post('generate/:bookingId')
+  @ApiOperation({ 
+    summary: 'Generate ticket for booking (confirmation page)',
+    description: 'Creates a ticket when confirmation page is reached and permanently holds all associated seats with SeatBlock records.'
+  })
+  generateTicket(@Param('bookingId') bookingId: string) {
+    return this.service.generate(bookingId);
+  }
+
+  @Patch('update-seats/:bookingId')
+  @ApiOperation({
+    summary: 'Update ticket seats before final confirmation',
+    description: 'Allows users to change selected seats after ticket generation. Removes old seat blocks and creates new ones for updated seats.'
+  })
+  updateSeats(@Param('bookingId') bookingId: string, @Body() body: { seatIds: string[] }) {
+    return this.service.updateSeats(bookingId, body.seatIds);
+  }
+  
+  @Get()
+  @UseGuards(JwtGuard)
+  @ApiBearerAuth('JWT-auth')
+  @ApiOperation({ summary: 'List all tickets with optional filters' })
+  listTickets(
+    @Query('search') search?: string,
+    @Query('status') status?: string,
+    @Query('skip') skip?: string,
+    @Query('take') take?: string,
+  ) {
+    return this.service.listTickets({
+      search,
+      status,
+      skip: skip ? parseInt(skip) : 0,
+      take: take ? parseInt(take) : 50,
+    });
+  }
+  
   @Get(':bookingRef')
+  @UseGuards(JwtGuard)
+  @ApiBearerAuth('JWT-auth')
   @ApiOperation({ 
     summary: 'Get ticket with QR code and passenger details',
     description: `Returns ticket information including:
@@ -26,6 +62,8 @@ export class TicketsController {
   }
   
   @Post(':bookingRef/validate')
+  @UseGuards(JwtGuard)
+  @ApiBearerAuth('JWT-auth')
   @ApiOperation({ 
     summary: 'Validate ticket at gate with audit logging',
     description: 'Validates ticket QR/barcode at station gate. Records validation in audit log with timestamp, gate, and validator.'
@@ -39,20 +77,37 @@ export class TicketsController {
   }
   
   @Get(':ticketId/validation-logs')
+  @UseGuards(JwtGuard)
+  @ApiBearerAuth('JWT-auth')
   @ApiOperation({ summary: 'Get validation logs for ticket' })
   getValidationLogs(@Param('ticketId') ticketId: string) {
     return this.service.getValidationLogs(ticketId);
   }
 
   @Get('offline/export')
+  @UseGuards(JwtGuard)
+  @ApiBearerAuth('JWT-auth')
   @ApiOperation({ summary: 'Export tickets for offline validation' })
   exportOfflineData(@Query('scheduleId') scheduleId: string) {
     return this.service.exportOfflineData(scheduleId);
   }
 
   @Post('validate/offline')
+  @UseGuards(JwtGuard)
+  @ApiBearerAuth('JWT-auth')
   @ApiOperation({ summary: 'Batch import offline validations' })
   validateOfflineBatch(@Body() body: { validations: any[] }) {
     return this.service.validateOfflineBatch(body.validations);
   }
+
+  @Delete(':id')
+  @UseGuards(JwtGuard)
+  @ApiBearerAuth('JWT-auth')
+  @ApiOperation({ 
+    summary: 'Delete ticket (admin only)',
+    description: 'Permanently deletes a ticket record and removes associated seat blocks'
+  })
+  delete(@Param('id') id: string) {
+    return this.service.delete(id);
+  }
 }

apps/edr-passenger-api/src/modules/tickets/tickets.module.ts

@@ -1,6 +1,13 @@
 import { Module } from '@nestjs/common';
 import { TicketsController } from './tickets.controller';
 import { TicketsService } from './tickets.service';
+import { JwtGuard } from '../../common/jwt.guard';
 
-@Module({ controllers: [TicketsController], providers: [TicketsService], exports: [TicketsService] })
+@Module({
+  controllers: [TicketsController],
+  providers: [TicketsService, JwtGuard],
+  exports: [TicketsService, JwtGuard],
+})
 export class TicketsModule {}
+
+export { TicketsController } from './tickets.controller';

apps/edr-passenger-api/src/modules/tickets/tickets.service.ts

@@ -13,19 +13,142 @@ interface OfflineValidation {
 export class TicketsService {
   constructor(private prisma: PrismaService) {}
 
+  async listTickets(filters: { search?: string; status?: string; skip: number; take: number }) {
+    const where: any = {};
+    if (filters.search) {
+      where.OR = [
+        { bookingRef: { contains: filters.search, mode: 'insensitive' } },
+        { barcodePayload: { contains: filters.search, mode: 'insensitive' } },
+        { booking: { bookingRef: { contains: filters.search, mode: 'insensitive' } } },
+      ];
+    }
+    if (filters.status) {
+      where.booking = { status: filters.status };
+    }
+    const tickets = await this.prisma.ticket.findMany({
+      where,
+      include: {
+        booking: {
+          include: {
+            schedule: { include: { originStation: true, destinationStation: true, train: true } },
+            seats: { include: { seat: { include: { coach: true } } } },
+            passenger: { include: { user: true } },
+          },
+        },
+      },
+      skip: filters.skip,
+      take: filters.take,
+      orderBy: { issuedAt: 'desc' },
+    });
+    const total = await this.prisma.ticket.count({ where });
+    return {
+      items: tickets.map((t) => ({
+        id: t.id,
+        ticketNumber: t.barcodePayload,
+        bookingRef: t.bookingRef,
+        booking: {
+          bookingRef: t.booking.bookingRef,
+          status: t.booking.status,
+          passenger: t.booking.passenger?.user || { fullName: 'Guest', email: t.booking.contactEmail },
+          contactEmail: t.booking.contactEmail,
+        },
+        schedule: t.booking.schedule,
+        seat: t.booking.seats[0]?.seat,
+        status: t.booking.status,
+        validatedAt: t.validatedAt,
+        createdAt: t.issuedAt,
+      })),
+      total,
+      skip: filters.skip,
+      take: filters.take,
+    };
+  }
+
   async generate(bookingId: string) {
+    if (!bookingId) {
+      throw new BadRequestException('Booking ID is required');
+    }
+    
     const booking = await this.prisma.booking.findUnique({
       where: { id: bookingId },
-      include: { schedule: { include: { originStation: true, destinationStation: true, train: true } }, seats: { include: { seat: { include: { coach: true } } } } },
+      include: { 
+        schedule: { include: { originStation: true, destinationStation: true, train: true } }, 
+        seats: { include: { seat: { include: { coach: true } } } } 
+      },
     });
-    if (!booking) throw new NotFoundException('Booking not found');
+    if (!booking) throw new NotFoundException(`Booking ${bookingId} not found`);
+    
     const qrPayload = await QRCode.toDataURL(`edr:tkt:${booking.id}:${booking.bookingRef}`);
     const barcodePayload = `EDR${booking.bookingRef}${booking.id.substring(0, 8).toUpperCase()}`;
-    return this.prisma.ticket.upsert({ 
-      where: { bookingId }, 
-      update: { qrPayload, barcodePayload }, 
-      create: { bookingId, bookingRef: booking.bookingRef, qrPayload, barcodePayload } 
+    
+    const ticket = await this.prisma.ticket.upsert({
+      where: { bookingId },
+      update: { qrPayload, barcodePayload },
+      create: { bookingId, bookingRef: booking.bookingRef, qrPayload, barcodePayload },
     });
+
+    // Create permanent seat blocks for all booked seats
+    const seatIds = booking.seats.map(bs => bs.seatId);
+    for (const seatId of seatIds) {
+      await this.prisma.seatBlock.create({
+        data: {
+          seatId,
+          reason: `Permanently booked in ticket ${ticket.id}`,
+          blockedBy: 'SYSTEM',
+          approvedBy: 'SYSTEM',
+        }
+      }).catch(() => null); // Ignore if already exists
+    }
+    
+    return ticket;
+  }
+
+  async updateSeats(bookingId: string, newSeatIds: string[]) {
+    const booking = await this.prisma.booking.findUnique({
+      where: { id: bookingId },
+      include: { seats: true, ticket: true },
+    });
+    if (!booking) throw new NotFoundException(`Booking ${bookingId} not found`);
+    if (!booking.ticket) throw new BadRequestException('No ticket found for this booking');
+
+    // Remove old seat blocks
+    const oldSeatIds = booking.seats.map(bs => bs.seatId);
+    for (const seatId of oldSeatIds) {
+      await this.prisma.seatBlock.deleteMany({
+        where: { 
+          seatId,
+          reason: { contains: booking.ticket.id }
+        }
+      });
+    }
+
+    // Remove old booking seats
+    await this.prisma.bookingSeat.deleteMany({ where: { bookingId } });
+
+    // Create new seat blocks
+    for (const seatId of newSeatIds) {
+      await this.prisma.seatBlock.create({
+        data: {
+          seatId,
+          reason: `Permanently booked in ticket ${booking.ticket.id}`,
+          blockedBy: 'SYSTEM',
+          approvedBy: 'SYSTEM',
+        }
+      }).catch(() => null);
+    }
+
+    // Create new booking seats (placeholder with minimal data)
+    for (let i = 0; i < newSeatIds.length; i++) {
+      await this.prisma.bookingSeat.create({
+        data: {
+          bookingId,
+          seatId: newSeatIds[i],
+          passengerName: `Passenger ${i + 1}`,
+        }
+      });
+    }
+
+    return { success: true, updatedSeats: newSeatIds.length };
   }
 
   async getByRef(bookingRef: string) {
@@ -147,4 +270,22 @@ export class TicketsService {
 
     return results;
   }
+
+  async delete(id: string) {
+    const ticket = await this.prisma.ticket.findUnique({ where: { id } });
+    if (!ticket) throw new NotFoundException('Ticket not found');
+    
+    await this.prisma.gateValidationLog.deleteMany({ where: { ticketId: id } });
+    
+    // Remove seat blocks associated with this ticket
+    await this.prisma.seatBlock.deleteMany({
+      where: { 
+        reason: { contains: id }
+      }
+    });
+    
+    await this.prisma.ticket.delete({ where: { id } });
+    
+    return { deleted: true, ticketId: id };
+  }
 }