Merge pull request #917 from Tria-plc/tests

Tests

apps/edr-passenger-api/src/modules/payments/payments.service.ts

@@ -1017,6 +1017,19 @@ export class PaymentsService {
       return { processed: false, reason: "booking-not-found" };
     }
 
+    // C-4 guard: a settlement must cover what the passenger was quoted. Compare the provider-settled
+    // amount against the booking's display-currency total (the amount the customer agreed to pay);
+    // a short payment must NOT confirm the booking. Amount-only — the display↔charge currency
+    // divergence is tracked separately under the USD/DJF findings. The 1% tolerance absorbs rounding.
+    const expectedMinor = booking.displayTotalMinor ?? booking.totalMinor;
+    const shortPayTolerance = Math.max(1, Math.round(expectedMinor * 0.01));
+    if (event.amountMinor < expectedMinor - shortPayTolerance) {
+      this.logger.error(
+        `mark-paid: short payment for booking ${booking.id} — settled ${event.amountMinor} ${event.currency} < expected ${expectedMinor} ${booking.displayCurrency}; not confirming`,
+      );
+      return { processed: false, reason: "amount-mismatch" };
+    }
+
     // Local intent row is a projection during the strangler migration: reuse it when the
     // legacy initiate path created one, otherwise materialize it from the event.
     let intent = await this.prisma.paymentIntent.findUnique({