Merge branch 'dev' of github.com:Tria-plc/edr-platform into freight/feature/vehicle_2

apps/edr-freight-api/src/migrations/1810000000002-MakeCompanyProfileReferenceNullable.ts

@@ -0,0 +1,31 @@
+import { MigrationInterface, QueryRunner } from "typeorm";
+
+/**
+ * Company-profile references are now minted only when a profile is approved
+ * (status → Active); pending profiles carry NULL. Drop the NOT NULL constraint
+ * on freight.company_profiles.reference. The existing unique index is kept —
+ * Postgres treats NULLs as distinct, so multiple pending (NULL) profiles don't
+ * collide.
+ */
+export class MakeCompanyProfileReferenceNullable1810000000002
+  implements MigrationInterface
+{
+  name = "MakeCompanyProfileReferenceNullable1810000000002";
+
+  public async up(queryRunner: QueryRunner): Promise<void> {
+    await queryRunner.query(
+      `ALTER TABLE "freight"."company_profiles" ALTER COLUMN "reference" DROP NOT NULL`,
+    );
+  }
+
+  public async down(queryRunner: QueryRunner): Promise<void> {
+    // Reinstating NOT NULL requires every row to have a reference; any pending
+    // (NULL) profiles get a placeholder so the constraint can be re-applied.
+    await queryRunner.query(
+      `UPDATE "freight"."company_profiles" SET "reference" = 'PENDING-' || left(replace("id"::text, '-', ''), 12) WHERE "reference" IS NULL`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "freight"."company_profiles" ALTER COLUMN "reference" SET NOT NULL`,
+    );
+  }
+}

apps/edr-freight-api/src/migrations/1810000000003-CreateOtpVerifications.ts

@@ -0,0 +1,42 @@
+import { MigrationInterface, QueryRunner, Table } from "typeorm";
+
+/**
+ * Create the public.otp_verifications table backing the OTP module
+ * (OtpVerification entity). One row per phone, holding the latest server-issued
+ * code and whether that phone has been verified.
+ */
+export class CreateOtpVerifications1810000000003
+  implements MigrationInterface
+{
+  name = "CreateOtpVerifications1810000000003";
+
+  public async up(queryRunner: QueryRunner): Promise<void> {
+    const exists = await queryRunner.hasTable("otp_verifications");
+    if (exists) return;
+
+    await queryRunner.createTable(
+      new Table({
+        name: "otp_verifications",
+        columns: [
+          {
+            name: "id",
+            type: "uuid",
+            isPrimary: true,
+            default: "gen_random_uuid()",
+          },
+          { name: "phone", type: "varchar", isUnique: true },
+          { name: "otp", type: "varchar" },
+          { name: "verified", type: "boolean", default: false },
+          { name: "created_at", type: "timestamptz", default: "now()" },
+          { name: "updated_at", type: "timestamptz", default: "now()" },
+          { name: "deleted_at", type: "timestamptz", isNullable: true },
+        ],
+      }),
+      true,
+    );
+  }
+
+  public async down(queryRunner: QueryRunner): Promise<void> {
+    await queryRunner.dropTable("otp_verifications", true);
+  }
+}

apps/edr-freight-api/src/modules/bookings/bookings.service.ts

@@ -371,6 +371,17 @@ export class BookingsService {
           tradeDirection,
           fallbackType,
         );
+
+      // A customer booking under their own account may only do so once the
+      // resolved operational profile has been approved by the backoffice. Staff-
+      // and government-initiated bookings (companyId supplied explicitly) bypass
+      // this gate.
+      const customerSelfBooking = !dto.companyId && !!userId;
+      if (customerSelfBooking && companyProfileId) {
+        await this.companiesService.assertCompanyProfileApprovedForBooking(
+          companyProfileId,
+        );
+      }
     }
 
     const needsConsolidation =

apps/edr-freight-api/src/modules/companies/companies.controller.ts

@@ -41,6 +41,7 @@ import { ProfileResponseDto } from "./dto/profile-response.dto";
 import { DashboardSummaryResponseDto } from "./dto/dashboard-summary-response.dto";
 import { ListCompaniesQueryDto } from "./dto/list-companies-query.dto";
 import { CompanyStatsResponseDto } from "./dto/company-stats-response.dto";
+import { OnboardingRequirementsResponseDto } from "./dto/onboarding-requirements-response.dto";
 import { UpdateCompanyProfileStatusDto } from "./dto/update-company-profile-status.dto";
 import { FetchETradeDto } from "./dto/fetch-etrade.dto";
 import { ETradeResponseDto } from "./dto/etrade-response.dto";
@@ -226,6 +227,17 @@ export class CompaniesController {
     await this.companiesService.setOnboardingStep(user.id, dto.step);
   }
 
+  @Get("onboarding/requirements")
+  @ApiOperation({
+    summary:
+      "What the current user's company still needs to finish onboarding (server-driven documents + outstanding items)",
+  })
+  async getOnboardingRequirements(
+    @CurrentUser() user: CurrentIamUser,
+  ): Promise<OnboardingRequirementsResponseDto> {
+    return this.companiesService.getOnboardingRequirements(user.id);
+  }
+
   @Post("onboarding/complete")
   @ApiOperation({ summary: "Mark the current user's onboarding as complete" })
   async completeOnboarding(

apps/edr-freight-api/src/modules/companies/companies.module.ts

@@ -2,6 +2,7 @@ import { Module } from "@nestjs/common";
 import { TypeOrmModule } from "@nestjs/typeorm";
 import { HttpModule } from "@nestjs/axios";
 import { FilesModule } from "../files/files.module";
+import { FileUploadSettingsModule } from "../file-upload-settings/file-upload-settings.module";
 import { MinioModule } from "../minio/minio.module";
 import { CompaniesController } from "./companies.controller";
 import { CompaniesService } from "./companies.service";
@@ -20,6 +21,7 @@ import { ETradeService } from "./services/etrade.service";
     TypeOrmModule.forFeature([Company, ExternalProfile, CompanyProfile, Booking]),
     HttpModule,
     FilesModule,
+    FileUploadSettingsModule,
     MinioModule,
   ],
   controllers: [CompaniesController],

apps/edr-freight-api/src/modules/companies/companies.service.ts

@@ -3,6 +3,7 @@ import {
   NotFoundException,
   ConflictException,
   BadRequestException,
+  ForbiddenException,
 } from "@nestjs/common";
 import { CompaniesRepository } from "./companies.repository";
 import { CompanyProfileRepository } from "./company-profile.repository";
@@ -12,7 +13,10 @@ import {
   DashboardScope,
 } from "./company-dashboard.repository";
 import { MinioService } from "../minio/minio.service";
+import { FilesService } from "../files/files.service";
+import { FileUploadSettingsService } from "../file-upload-settings/file-upload-settings.service";
 import { ETradeService } from "./services/etrade.service";
+import { OnboardingRequirementsResponseDto } from "./dto/onboarding-requirements-response.dto";
 import { normalizeE164 } from "../../common/validators/is-phone-number.validator";
 import { CreateCompanyDto } from "./dto/create-company.dto";
 import { UpdateCompanyDto } from "./dto/update-company.dto";
@@ -53,9 +57,67 @@ export class CompaniesService {
     private readonly profilesRepo: ExternalProfileRepository,
     private readonly dashboardRepo: CompanyDashboardRepository,
     private readonly minioService: MinioService,
+    private readonly filesService: FilesService,
+    private readonly fileUploadSettingsService: FileUploadSettingsService,
     private readonly etradeService: ETradeService,
   ) { }
 
+  /**
+   * Required company-information fields that must be filled before onboarding can
+   * be submitted. The backend owns this list so the portal never has to know
+   * which fields are mandatory — it just renders what's reported outstanding.
+   * `get` reads the value from the company (some live in the attributes blob).
+   */
+  private readonly REQUIRED_COMPANY_INFO: {
+    key: string;
+    label: string;
+    get: (company: Company) => unknown;
+  }[] = [
+    {
+      key: "tinNumber",
+      label: "Company TIN",
+      get: (c) => (c.tin && !c.tin.startsWith("D") ? c.tin : null),
+    },
+    { key: "companyEmail", label: "Company email", get: (c) => c.email },
+    { key: "companyPhone", label: "Company phone", get: (c) => c.phone },
+    { key: "companyAddress", label: "Company address", get: (c) => c.address },
+    { key: "fanNumber", label: "FAN number", get: (c) => c.fanNumber },
+    {
+      key: "contactPersonName",
+      label: "Contact person name",
+      get: (c) => c.attributes?.contactPersonName,
+    },
+    {
+      key: "contactPersonPhone",
+      label: "Contact person phone",
+      get: (c) => c.attributes?.contactPersonPhone,
+    },
+    {
+      key: "generalManagerName",
+      label: "General manager name",
+      get: (c) => c.attributes?.generalManagerName,
+    },
+    {
+      key: "generalManagerEmail",
+      label: "General manager email",
+      get: (c) => c.attributes?.generalManagerEmail,
+    },
+    {
+      key: "generalManagerPhone",
+      label: "General manager phone",
+      get: (c) => c.attributes?.generalManagerPhone,
+    },
+  ];
+
+  /** The nationality-based document setting code for a company. */
+  private documentSettingCodeFor(
+    nationality: CompanyNationality | null | undefined,
+  ): string {
+    return nationality === CompanyNationality.Foreign
+      ? "company_onboarding_documents_foreign"
+      : "company_onboarding_documents_ethiopian";
+  }
+
   async createCompany(dto: CreateCompanyDto): Promise<Company> {
     const exists = await this.companiesRepo.existsByTin(dto.tin);
     if (exists) {
@@ -134,15 +196,13 @@ export class CompaniesService {
           input.type,
         );
         if (existing) continue;
-        const reference = await this.companyProfilesRepo.generateReference(
-          input.type,
-        );
+        // No reference yet — these profiles await backoffice approval, which
+        // is when the reference is minted (see setCompanyProfileStatus).
         await this.companyProfilesRepo.create({
           companyId: company.id,
           type: input.type,
-          reference,
           businessLicense: input.businessLicense ?? null,
-          status: ProfileStatus.Active,
+          status: ProfileStatus.Pending,
         });
       }
       company.companyProfiles = await this.companyProfilesRepo.findByCompanyId(
@@ -251,12 +311,11 @@ export class CompaniesService {
         type,
       );
       if (existing) continue;
-      const reference = await this.companyProfilesRepo.generateReference(type);
+      // No reference yet — minted on backoffice approval (setCompanyProfileStatus).
       await this.companyProfilesRepo.create({
         companyId,
         type,
-        reference,
-        status: ProfileStatus.Active,
+        status: ProfileStatus.Pending,
       });
     }
   }
@@ -527,6 +586,8 @@ export class CompaniesService {
       attrUpdates.contactPersonEmail = dto.contactPersonEmail;
     if (dto.contactPersonPhone !== undefined)
       attrUpdates.contactPersonPhone = normalizeE164(dto.contactPersonPhone);
+    if (dto.contactVerifiedPhone !== undefined)
+      attrUpdates.contactVerifiedPhone = normalizeE164(dto.contactVerifiedPhone);
     if (dto.generalManagerName !== undefined)
       attrUpdates.generalManagerName = dto.generalManagerName;
     if (dto.generalManagerEmail !== undefined)
@@ -622,12 +683,33 @@ export class CompaniesService {
     profileId: string,
     status: ProfileStatus,
   ): Promise<CompanyProfile> {
-    const updated = await this.companyProfilesRepo.updateStatus(
-      profileId,
-      status,
-    );
+    const existing = await this.companyProfilesRepo.findById(profileId);
+    if (!existing)
+      throw new NotFoundException(`Company profile ${profileId} not found`);
+
+    // A reference number is only minted the first time a profile is approved
+    // (status → Active). Pending/unapproved profiles carry no reference.
+    const patch: Partial<CompanyProfile> = { status };
+    if (status === ProfileStatus.Active && !existing.reference) {
+      patch.reference = await this.companyProfilesRepo.generateReference(
+        existing.type,
+      );
+    }
+
+    const updated = await this.companyProfilesRepo.update(profileId, patch);
     if (!updated)
       throw new NotFoundException(`Company profile ${profileId} not found`);
+
+    // Approving any profile promotes a pending company to active, so the
+    // customer can start working as soon as their first profile is cleared.
+    if (status === ProfileStatus.Active) {
+      const company = await this.companiesRepo.findById(updated.companyId);
+      if (company && company.status === CompanyStatus.Pending) {
+        await this.companiesRepo.update(updated.companyId, {
+          status: CompanyStatus.Active,
+        });
+      }
+    }
     return updated;
   }
 
@@ -649,7 +731,7 @@ export class CompaniesService {
     const existing = await this.companyProfilesRepo.findByType(companyId, type);
     if (existing) {
       throw new ConflictException(
-        `Company already has a ${type} profile (${existing.reference})`,
+        `Company already has a ${type} profile (${existing.reference ?? "pending approval"})`,
       );
     }
 
@@ -813,6 +895,100 @@ export class CompaniesService {
     await this.profilesRepo.update(profile.id, { onboardingStep: step });
   }
 
+  /**
+   * Server-driven onboarding requirements for the current user's company.
+   *
+   * The backend resolves the nationality-based document set, checks which
+   * company documents and per-profile licenses are already uploaded, and reports
+   * exactly what is still outstanding. The portal renders this list verbatim and
+   * relies on `isComplete` to decide when to auto-finish — it never decides for
+   * itself which documents apply or which fields are mandatory.
+   */
+  async getOnboardingRequirements(
+    userId: string,
+  ): Promise<OnboardingRequirementsResponseDto> {
+    const { profile, company } = await this.getCompanyInfoByUserId(userId);
+
+    // 1. Required company-information fields.
+    const missingInfo = this.REQUIRED_COMPANY_INFO.filter(
+      (f) => !f.get(company),
+    ).map((f) => ({ key: f.key, label: f.label }));
+
+    // 2. Nationality-based company documents + which are already uploaded.
+    const documentSettingCode = this.documentSettingCodeFor(company.nationality);
+    const [setting, uploadedFiles] = await Promise.all([
+      this.fileUploadSettingsService
+        .getByCode(documentSettingCode)
+        .catch(() => null),
+      this.filesService.findByResource(company.id, "companies"),
+    ]);
+    const uploadedCodes = new Set(uploadedFiles.map((f) => f.code));
+    const documents = (setting?.fields ?? [])
+      .slice()
+      .sort((a, b) => a.displayOrder - b.displayOrder)
+      .map((f) => ({
+        fileKey: f.fileKey,
+        fileLabel: f.fileLabel,
+        helpText: f.helpText ?? null,
+        isRequired: f.isRequired,
+        isMultiple: f.isMultiple,
+        maxFiles: f.maxFiles,
+        allowedExtensions: f.allowedExtensions,
+        maxSizeMb: f.maxSizeMb,
+        displayOrder: f.displayOrder,
+        uploaded: uploadedCodes.has(f.fileKey),
+      }));
+    const missingDocs = documents.filter((d) => d.isRequired && !d.uploaded);
+
+    // 3. Per-operational-profile business licenses.
+    const licenseProfiles = (company.companyProfiles ?? []).map((p) => ({
+      profileId: p.id,
+      type: p.type,
+      reference: p.reference ?? "",
+      uploaded: (p.businessLicenseFiles?.length ?? 0) > 0,
+    }));
+    const missingLicenses = licenseProfiles.filter((p) => !p.uploaded);
+
+    const outstanding = [
+      ...missingInfo.map((f) => `Add your ${f.label.toLowerCase()}`),
+      ...missingDocs.map((d) => `Upload your ${d.fileLabel}`),
+      ...missingLicenses.map(
+        (p) =>
+          `Upload a business license for your ${p.type.replace(/_/g, " ")} profile`,
+      ),
+    ];
+
+    // Progress spans every required item the user has to satisfy: company-info
+    // fields, required documents and one license per operational profile.
+    const requiredDocCount = documents.filter((d) => d.isRequired).length;
+    const total =
+      this.REQUIRED_COMPANY_INFO.length +
+      requiredDocCount +
+      licenseProfiles.length;
+    const completed =
+      total -
+      (missingInfo.length + missingDocs.length + missingLicenses.length);
+
+    return new OnboardingRequirementsResponseDto({
+      documentSettingCode,
+      nationality: company.nationality ?? CompanyNationality.Ethiopian,
+      companyInfo: { complete: missingInfo.length === 0, missingFields: missingInfo },
+      documents,
+      licenseProfiles,
+      progress: { completed, total },
+      isComplete: outstanding.length === 0,
+      onboardingCompleted: profile.onboardingCompleted,
+      outstanding,
+    });
+  }
+
+  /**
+   * Submit onboarding for review. Validation is delegated entirely to
+   * getOnboardingRequirements (the same source of truth the portal renders), so
+   * the gate can never drift from what the UI shows. On success the company and
+   * all its operational profiles move to PENDING — the backoffice approves each
+   * profile before it can be used (see setCompanyProfileStatus).
+   */
   async markOnboardingComplete(
     userId: string,
   ): Promise<{ profile: ExternalProfile; company: Company }> {
@@ -821,23 +997,21 @@ export class CompaniesService {
       throw new NotFoundException(`Profile for user ${userId} not found`);
 
     const companyId = profile.company?.id ?? profile.companyId;
-    const company = await this.findCompanyById(companyId);
 
-    // Guard against finishing on a still-draft company (TIN never filled in).
-    if (!company.tin || company.tin.startsWith("D")) {
+    const requirements = await this.getOnboardingRequirements(userId);
+    if (!requirements.isComplete) {
       throw new BadRequestException(
-        "Company information is incomplete — please fill in your company details before finishing.",
+        requirements.outstanding[0] ??
+          "Your onboarding is incomplete. Please complete all required steps before submitting.",
       );
     }
 
-    // Every operational profile must have at least one business-license file
-    // (stored directly on the profile).
+    // Send every operational profile in for approval; the company itself becomes
+    // active once the backoffice approves at least one profile.
     const profiles = await this.companyProfilesRepo.findByCompanyId(companyId);
     for (const cp of profiles) {
-      if (!cp.businessLicenseFiles || cp.businessLicenseFiles.length === 0) {
-        throw new BadRequestException(
-          `Please upload a business license for your ${cp.type.replace(/_/g, " ")} profile before finishing.`,
-        );
+      if (cp.status !== ProfileStatus.Pending) {
+        await this.companyProfilesRepo.updateStatus(cp.id, ProfileStatus.Pending);
       }
     }
 
@@ -852,6 +1026,25 @@ export class CompaniesService {
     return this.getCompanyInfoByUserId(userId);
   }
 
+  /**
+   * Block a customer from booking under a profile that isn't approved yet.
+   * Called from the booking-create path for self-service bookings; staff- and
+   * government-initiated bookings bypass this. No-op when the profile can't be
+   * found (defensive — resolution is best-effort upstream).
+   */
+  async assertCompanyProfileApprovedForBooking(
+    companyProfileId: string,
+  ): Promise<void> {
+    const profile = await this.companyProfilesRepo.findById(companyProfileId);
+    if (!profile) return;
+    if (profile.status !== ProfileStatus.Active) {
+      const role = profile.type.replace(/_/g, " ");
+      throw new ForbiddenException(
+        `Your ${role} profile is awaiting approval. You'll be able to create bookings once it has been approved.`,
+      );
+    }
+  }
+
   /**
    * Authorize and resolve a company_profile that must belong to the current
    * user's company — used before accepting/returning its license files.

apps/edr-freight-api/src/modules/companies/company-profile.repository.ts

@@ -30,7 +30,11 @@ export class CompanyProfileRepository extends BaseRepository<CompanyProfile> {
   }
 
   async generateReference(type: ProfileType): Promise<string> {
-    const seqName = SEQUENCE_MAP[type];
+    // The sequences live in the same schema as the entity (e.g. "freight"), but
+    // the connection's search_path is "public" — so the sequence MUST be
+    // schema-qualified or `nextval` fails with "relation does not exist".
+    const schema = this.repository.metadata.schema ?? "public";
+    const seqName = `"${schema}".${SEQUENCE_MAP[type]}`;
     const result = await this.repository.query(
       `SELECT nextval('${seqName}') AS next_id`,
     );

apps/edr-freight-api/src/modules/companies/dto/onboarding-requirements-response.dto.ts

@@ -0,0 +1,78 @@
+/**
+ * Server-driven description of what a company still needs to finish onboarding.
+ *
+ * The portal renders this verbatim instead of deciding for itself which
+ * documents apply or which fields are mandatory: the backend resolves the
+ * nationality-based document set, checks which files are already uploaded, and
+ * reports exactly what is outstanding. `isComplete` is the single source of
+ * truth the wizard uses to auto-finish.
+ */
+
+export interface OnboardingInfoField {
+  key: string;
+  label: string;
+}
+
+export interface OnboardingDocumentField {
+  fileKey: string;
+  fileLabel: string;
+  helpText: string | null;
+  isRequired: boolean;
+  isMultiple: boolean;
+  maxFiles: number;
+  allowedExtensions: string[];
+  maxSizeMb: number;
+  displayOrder: number;
+  /** True when a file with this code is already stored for the company. */
+  uploaded: boolean;
+}
+
+export interface OnboardingLicenseProfile {
+  profileId: string;
+  type: string;
+  reference: string;
+  /** True when at least one business-license file is stored on the profile. */
+  uploaded: boolean;
+}
+
+export class OnboardingRequirementsResponseDto {
+  /** Resolved document setting code (by nationality) the docs were drawn from. */
+  documentSettingCode: string;
+  nationality: string;
+
+  /** Required company-information fields and whether each is filled. */
+  companyInfo: {
+    complete: boolean;
+    missingFields: OnboardingInfoField[];
+  };
+
+  /** The document fields the portal should render, with upload state. */
+  documents: OnboardingDocumentField[];
+
+  /** Per-operational-profile business-license requirements. */
+  licenseProfiles: OnboardingLicenseProfile[];
+
+  /** Overall setup progress across fields + documents + licenses. */
+  progress: { completed: number; total: number };
+
+  /** True once every required field, document and license is satisfied. */
+  isComplete: boolean;
+
+  /** Whether the user has already submitted onboarding (awaiting approval). */
+  onboardingCompleted: boolean;
+
+  /** Human-readable list of everything still outstanding (empty when complete). */
+  outstanding: string[];
+
+  constructor(init: Omit<OnboardingRequirementsResponseDto, never>) {
+    this.documentSettingCode = init.documentSettingCode;
+    this.nationality = init.nationality;
+    this.companyInfo = init.companyInfo;
+    this.documents = init.documents;
+    this.licenseProfiles = init.licenseProfiles;
+    this.progress = init.progress;
+    this.isComplete = init.isComplete;
+    this.onboardingCompleted = init.onboardingCompleted;
+    this.outstanding = init.outstanding;
+  }
+}

apps/edr-freight-api/src/modules/companies/dto/profile-response.dto.ts

@@ -34,6 +34,8 @@ export class ProfileResponseDto {
   contactPersonPosition: string | null;
   contactPersonEmail: string | null;
   contactPersonPhone: string | null;
+  /** Phone that passed SMS OTP verification (drives the verify-step resume). */
+  contactVerifiedPhone: string | null;
   generalManagerName: string | null;
   generalManagerEmail: string | null;
   generalManagerPhone: string | null;
@@ -81,6 +83,7 @@ export class ProfileResponseDto {
     this.contactPersonPosition = attrs.contactPersonPosition ?? null;
     this.contactPersonEmail = attrs.contactPersonEmail ?? null;
     this.contactPersonPhone = attrs.contactPersonPhone ?? null;
+    this.contactVerifiedPhone = attrs.contactVerifiedPhone ?? null;
     this.generalManagerName = attrs.generalManagerName ?? null;
     this.generalManagerEmail = attrs.generalManagerEmail ?? null;
     this.generalManagerPhone = attrs.generalManagerPhone ?? null;

apps/edr-freight-api/src/modules/companies/dto/response-company.dto.ts

@@ -28,7 +28,7 @@ export class ResponseCompanyProfileDto {
     this.id = profile.id;
     this.companyId = profile.companyId;
     this.type = profile.type;
-    this.reference = profile.reference;
+    this.reference = profile.reference ?? '';
     this.status = profile.status;
     this.businessLicense = profile.businessLicense;
     this.licenseFiles = profile.businessLicenseFiles ?? [];

apps/edr-freight-api/src/modules/companies/dto/update-profile.dto.ts

@@ -67,6 +67,16 @@ export class UpdateProfileDto {
   @IsValidPhone()
   contactPersonPhone?: string;
 
+  /**
+   * The contact-person phone that completed SMS OTP verification. Persisted so
+   * the onboarding "verify" step can resume its "done" state after a refresh
+   * (compared against the current contactPersonPhone on the client).
+   */
+  @IsOptional()
+  @IsString()
+  @IsValidPhone()
+  contactVerifiedPhone?: string;
+
   @IsOptional()
   @IsString()
   generalManagerName?: string;

apps/edr-freight-api/src/modules/companies/entities/company-profile.entity.ts

@@ -40,14 +40,19 @@ export class CompanyProfile extends BaseEntity {
   @Column({ name: "type", type: "varchar", length: 32, enum: ProfileType })
   type!: ProfileType;
 
+  /**
+   * Official profile reference (e.g. "EX-00001"). Minted only when the profile
+   * is approved (status → Active); pending/unapproved profiles carry NULL.
+   * The unique index tolerates this because Postgres treats NULLs as distinct.
+   * API responses surface it as "" when absent — see ResponseCompanyProfileDto.
+   */
   @Column({
     name: "reference",
     type: "varchar",
     length: 20,
-    nullable: false,
-    unique: true,
+    nullable: true,
   })
-  reference!: string;
+  reference!: string | null;
 
   @Column({
     name: "status",

apps/edr-freight-api/src/modules/otp/otp.controller.ts

@@ -24,13 +24,9 @@ export class OtpController {
   @Post("send")
   async sendOtp(
     @Body("phone")
-    phone: string,
-     @Body("otp")
-    otp: string
+    phone: string
   ) {
-    return this.otpService.sendOtp(
-      phone,otp
-    );
+    return this.otpService.sendOtp(phone);
   }
 
   // ---------------------------------------------------------------------------

apps/edr-freight-api/src/modules/otp/otp.service.ts

@@ -29,11 +29,12 @@ export class OtpService {
   // Send OTP
   // ---------------------------------------------------------------------------
 
-  async sendOtp(phone: string, otp: string) {
+  async sendOtp(phone: string) {
     try {
-      // generate otp
-      // const otp =
-      //   this.generateOtp();
+      // The verification code is generated server-side — never supplied by the
+      // caller — so the OTP stays a secret known only to the server and the
+      // recipient of the SMS.
+      const otp = this.generateOtp();
 
       // find existing phone
       const existingPhone =