From c6f6616218813c6e5fe743e4de78eca2ffc2aaaa Mon Sep 17 00:00:00 2001 From: Stephanos A Date: Wed, 22 Jul 2026 14:31:27 +0300 Subject: [PATCH] Restore ticket generation guard --- .../src/modules/tickets/tickets.controller.ts | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/apps/edr-passenger-api/src/modules/tickets/tickets.controller.ts b/apps/edr-passenger-api/src/modules/tickets/tickets.controller.ts index 3a48ca2a1..4ecaeb267 100644 --- a/apps/edr-passenger-api/src/modules/tickets/tickets.controller.ts +++ b/apps/edr-passenger-api/src/modules/tickets/tickets.controller.ts @@ -34,10 +34,11 @@ export class TicketsController { } @Post('generate/:bookingId') - @SetMetadata('isPublic', true) + @PassengerStaff(PASSENGER_PERMS.tickets.generate) + @ApiBearerAuth('IAM-auth') @ApiOperation({ - summary: 'Generate ticket for booking (confirmation page)', - description: 'Creates a ticket when confirmation page is reached and permanently holds all associated seats with SeatBlock records. Requires payment to be SUCCEEDED and booking to be CONFIRMED.' + summary: 'Generate ticket for booking', + description: 'Creates a ticket for a confirmed booking with succeeded payment. Requires payment to be SUCCEEDED and booking to be CONFIRMED.' }) generateTicket(@Param('bookingId') bookingId: string) { return this.service.generate(bookingId);