feat(freight-api): drop fan claim from fayda verification

esignet userinfo carries no national id number. keep sub/name/email/
phone/address, remove fanClaims config and the hard-fail gate that
would've blocked every real verification.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

apps/edr-freight-api/.env.example

@@ -93,6 +93,9 @@ FAYDA_PRIVATE_KEY_BASE64=
 FAYDA_REDIRECT_URI=http://localhost:3001/api/fayda/verification/complete
 # OAuth redirect_uri for WEB clients. Defaults to FAYDA_REDIRECT_URI when unset.
 FAYDA_WEB_REDIRECT_URI=http://localhost:3000/callback
+# OAuth redirect_uri for the customer portal (its own origin — must also be
+# registered with eSignet). Defaults to FAYDA_WEB_REDIRECT_URI when unset.
+FAYDA_PORTAL_REDIRECT_URI=http://localhost:5173/callback
 CLIENT_ASSERTION_TYPE=urn:ietf:params:oauth:client-assertion-type:jwt-bearer
 FAYDA_SCOPE=openid profile email phone address
 FAYDA_ACR_VALUES=mosip:idp:acr:generated-code

apps/edr-freight-api/src/config/fayda.config.ts

@@ -15,7 +15,7 @@ export interface FaydaJwk {
   qi?: string;
 }
 
-export type FaydaPlatform = 'WEB' | 'MOBILE';
+export type FaydaPlatform = 'WEB' | 'MOBILE' | 'PORTAL';
 
 export interface FaydaConfig {
   enabled: boolean;
@@ -25,8 +25,10 @@ export interface FaydaConfig {
   userInfoEndpoint: string;
   /** OAuth redirect_uri sent to eSignet for MOBILE clients. */
   redirectUri: string;
-  /** OAuth redirect_uri sent to eSignet for WEB clients. Falls back to `redirectUri`. */
+  /** OAuth redirect_uri sent to eSignet for WEB (backoffice) clients. Falls back to `redirectUri`. */
   webRedirectUri: string;
+  /** OAuth redirect_uri sent to eSignet for the customer portal. Falls back to `webRedirectUri`. */
+  portalRedirectUri: string;
   privateJwk: FaydaJwk;
   scope: string;
   acrValues: string;
@@ -77,6 +79,7 @@ export default registerAs('fayda', (): FaydaConfig => {
   const sessionTtl = Number.parseInt(process.env.FAYDA_SESSION_TTL_MINUTES ?? '10', 10);
   const redirectUri = process.env.FAYDA_REDIRECT_URI ?? '';
   const webRedirectUri = process.env.FAYDA_WEB_REDIRECT_URI || redirectUri;
+  const portalRedirectUri = process.env.FAYDA_PORTAL_REDIRECT_URI || webRedirectUri;
   if (!enabled) {
     return {
       enabled: false,
@@ -86,6 +89,7 @@ export default registerAs('fayda', (): FaydaConfig => {
       userInfoEndpoint: process.env.FAYDA_USERINFO_ENDPOINT ?? '',
       redirectUri,
       webRedirectUri,
+      portalRedirectUri,
       privateJwk: { kty: 'RSA', n: '', e: '', d: '' },
       scope,
       acrValues,
@@ -117,6 +121,7 @@ export default registerAs('fayda', (): FaydaConfig => {
     userInfoEndpoint: process.env.FAYDA_USERINFO_ENDPOINT!,
     redirectUri,
     webRedirectUri,
+    portalRedirectUri,
     privateJwk: decodePrivateJwk(process.env.FAYDA_PRIVATE_KEY_BASE64!),
     scope,
     acrValues,

apps/edr-freight-api/src/modules/verifayda/verifayda.dto.ts

@@ -13,14 +13,14 @@ export class StartVerificationDto {
   purpose?: 'LOGIN' | 'VERIFY';
 
   @ApiPropertyOptional({
-    enum: ['WEB', 'MOBILE'],
+    enum: ['WEB', 'MOBILE', 'PORTAL'],
     default: 'WEB',
     description:
-      'Client platform. Selects which OAuth redirect_uri is sent to eSignet: WEB uses FAYDA_WEB_REDIRECT_URI, MOBILE uses FAYDA_REDIRECT_URI. Both land on the same /complete endpoint with identical handling.',
+      'Client platform. Selects which OAuth redirect_uri is sent to eSignet: WEB (backoffice) uses FAYDA_WEB_REDIRECT_URI, PORTAL uses FAYDA_PORTAL_REDIRECT_URI, MOBILE uses FAYDA_REDIRECT_URI. All land on the same /complete handling.',
   })
   @IsOptional()
-  @IsIn(['WEB', 'MOBILE'])
+  @IsIn(['WEB', 'MOBILE', 'PORTAL'])
-  platform?: 'WEB' | 'MOBILE';
+  platform?: 'WEB' | 'MOBILE' | 'PORTAL';
 
   @ApiPropertyOptional({
     type: Boolean,
@@ -57,6 +57,12 @@ export class CompleteVerificationResultDto {
     agentId?: string;
   };
 
+  @ApiPropertyOptional({
+    description:
+      'Fayda OIDC subject — the stable key a verified identity is stored under (VERIFY flow). Pairwise pseudonymous.',
+  })
+  sub?: string;
+
   @ApiPropertyOptional({ description: 'Verified full name from Fayda (VERIFY flow).' })
   fullName?: string;
 
@@ -74,6 +80,11 @@ export class CompleteVerificationResultDto {
   @ApiPropertyOptional({ description: 'Verified gender from Fayda (VERIFY flow).' })
   gender?: string;
 
+  @ApiPropertyOptional({
+    description: 'Verified address from Fayda, English rendering (VERIFY flow).',
+  })
+  address?: string;
+
   @ApiPropertyOptional({ description: 'Whether the verified identity was saved to IAM. False if the IAM write failed.' })
   userDataSaved?: boolean;
 

apps/edr-freight-api/src/modules/verifayda/verifayda.service.ts

@@ -56,11 +56,15 @@ export interface CompleteVerificationResult {
   promptPasswordSetup?: boolean;
   iamUserId?: string;
   user?: FaydaUserSummary;
+  /** Fayda OIDC subject — the stable key a verified identity is stored under. */
+  sub?: string;
   fullName?: string;
   email?: string;
   phoneNumber?: string;
   birthdate?: string;
   gender?: string;
+  /** Verified address, English rendering (falls back to Amharic). */
+  address?: string;
   userDataSaved?: boolean;
 }
 
@@ -125,11 +129,15 @@ export class VerifaydaService {
     });
   }
 
-  /** WEB clients use `webRedirectUri`; MOBILE uses the base `redirectUri`. */
+  /**
+   * Each client lands on its own registered redirect_uri: MOBILE on the base
+   * one, the customer portal on its own origin, everything else (backoffice) on
+   * the web one. All three must be registered with eSignet.
+   */
   private redirectUriForPlatform(platform?: FaydaPlatform): string {
-    return platform === 'MOBILE'
+    if (platform === 'MOBILE') return this.faydaConfig.redirectUri;
-      ? this.faydaConfig.redirectUri
+    if (platform === 'PORTAL') return this.faydaConfig.portalRedirectUri;
-      : this.faydaConfig.webRedirectUri;
+    return this.faydaConfig.webRedirectUri;
   }
 
   async completeVerification(
@@ -210,11 +218,13 @@ export class VerifaydaService {
         result = {
           purpose: 'VERIFY',
           verified: true,
+          sub: normalized.sub,
           fullName: normalized.fullName,
           email: normalized.email,
           phoneNumber: normalized.phoneNumber,
           birthdate: normalized.birthdate,
           gender: normalized.gender,
+          address: normalized.addressEn ?? normalized.addressAm,
           userDataSaved,
           iamUserId: iamUserId ?? undefined,
           token: sessionToken?.token,