diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml index d8413bf71..0ea92d1a6 100644 --- a/.github/workflows/deploy.yml +++ b/.github/workflows/deploy.yml @@ -13,7 +13,7 @@ permissions: jobs: detect-changes: name: Detect changed services - runs-on: self-hosted + runs-on: ${{ fromJson(format('["self-hosted", "{0}"]', github.ref_name)) }} outputs: matrix: ${{ steps.filter.outputs.matrix }} steps: @@ -91,7 +91,7 @@ jobs: name: Deploy ${{ matrix.service }} needs: detect-changes if: ${{ needs.detect-changes.outputs.matrix != '[]' }} - runs-on: self-hosted + runs-on: ${{ fromJson(format('["self-hosted", "{0}"]', github.ref_name)) }} strategy: fail-fast: false matrix: diff --git a/apps/edr-passenger-api/.env.example b/apps/edr-passenger-api/.env.example index 482a0df2c..a4774af84 100644 --- a/apps/edr-passenger-api/.env.example +++ b/apps/edr-passenger-api/.env.example @@ -2,17 +2,46 @@ NODE_ENV=development PORT=4000 -# Database (Prisma) -DATABASE_URL=postgresql://edr:edr_secret@localhost:5432/edr_passenger?schema=edr_passenger +# Database (Prisma) — owns the `passenger` schema in edr_database +DATABASE_URL=postgresql://edr:edr_secret@localhost:5432/edr_database?schema=passenger + +# Database (TypeORM / @tria-plc IAM) — shared `iam` schema in the SAME edr_database. +# These mirror the connection vars read by @tria-plc/api-common's TypeORM DataSource. +DATABASE_HOST=localhost +DATABASE_PORT=5432 +DATABASE_NAME=edr_database +DATABASE_USER=edr +DATABASE_PASSWORD=edr_secret +DATABASE_SCHEMA=iam + +# RabbitMQ — the @tria-plc IAM/notification modules register RMQ clients (SMS/notifications). +# Connects lazily; a broker is only needed when those features actually send. Placeholder for dev. +RABBITMQ_URL=amqp://localhost:5672 + +# MinIO — the @tria-plc file/notification modules construct a MinIO client at boot (validates these). +# Placeholders for dev; only contacted when file upload/download features are actually used. +MINIO_ENDPOINT=localhost +MINIO_PORT=9000 +MINIO_USE_SSL=false +MINIO_ACCESS_KEY=minioadmin +MINIO_SECRET_KEY=minioadmin +MINIO_BUCKET=edr-dev # CORS FRONTEND_URL=http://localhost:5174 BACK_OFFICE_URL=http://localhost:5184 -# JWT +# JWT (legacy passenger auth — being replaced by IAM) JWT_SECRET=edr-platform-secret-change-in-production JWT_EXPIRES_IN=7d +# @tria-plc IAM token contract — the package's JwtGuard/verifyToken + AuthService sign/verify with +# these. MUST match the IAM issuer's secret in shared deployments. (Expiry strings use jsonwebtoken/ms.) +JWT_ACCESS_TOKEN_SECRET=dev-iam-access-secret-change-me +JWT_ACCESS_TOKEN_EXPIRES=1h +JWT_REFRESH_TOKEN_SECRET=dev-iam-refresh-secret-change-me +JWT_REFRESH_TOKEN_EXPIRES=7d + # SendGrid SENDGRID_API_KEY= SENDGRID_FROM_EMAIL=noreply@edr-platform.com diff --git a/apps/edr-passenger-api/package.json b/apps/edr-passenger-api/package.json index 8ef7e669a..5ab08b399 100644 --- a/apps/edr-passenger-api/package.json +++ b/apps/edr-passenger-api/package.json @@ -11,6 +11,8 @@ "test": "jest", "test:e2e": "jest --config ./test/jest-e2e.json", "type-check": "tsc --noEmit", + "iam:migrate": "node --env-file=.env scripts/run-iam-migrations.cjs", + "iam:seed-dev-user": "node --env-file=.env scripts/seed-iam-dev-user.cjs", "prisma:generate": "prisma generate", "prisma:migrate": "prisma migrate deploy", "prisma:migrate:dev": "prisma migrate dev", @@ -27,26 +29,30 @@ "@nestjs/config": "^4.0.4", "@nestjs/core": "^11.1.19", "@nestjs/event-emitter": "^2.0.4", - "@nestjs/jwt": "^10.2.0", "@nestjs/microservices": "^11.1.24", - "@nestjs/passport": "^10.0.3", "@nestjs/platform-express": "^11.1.19", "@nestjs/schedule": "^6.1.3", "@nestjs/swagger": "^7.4.0", + "@nestjs/typeorm": "^11.0.1", "@prisma/client": "^6.19.3", + "@sendgrid/mail": "^8.1.0", + "@tria-plc/api-common": "file:../../local-packages/tria-plc-api-common-1.4.3.tgz", + "@tria-plc/iamapi-common": "file:../../local-packages/tria-plc-iamapi-common-0.7.3.tgz", + "amqp-connection-manager": "^5.0.0", + "amqplib": "^2.0.1", "axios": "^1.7.7", - "bcrypt": "^5.1.1", "class-transformer": "^0.5.1", "class-validator": "^0.14.0", + "dotenv": "^17.4.2", "express": "^4.18.2", "jose": "^5.10.0", - "passport": "^0.7.0", - "passport-jwt": "^4.0.1", + "pg": "^8.21.0", "qrcode": "^1.5.3", "reflect-metadata": "^0.2.2", "rxjs": "^7.8.1", "swagger-ui-express": "^5.0.0", "tsconfig-paths": "^4.2.0", + "typeorm": "^0.3.30", "uuid": "^10.0.0" }, "devDependencies": { @@ -55,11 +61,9 @@ "@nestjs/cli": "^11.0.21", "@nestjs/schematics": "^11.1.0", "@nestjs/testing": "^11.1.19", - "@types/bcrypt": "^5.0.2", - "@types/express": "^5.0.6", + "@types/express": "^4.17.21", "@types/jest": "^29.5.11", "@types/node": "^20.10.6", - "@types/passport-jwt": "^4.0.1", "@types/qrcode": "^1.5.5", "@types/supertest": "^6.0.2", "@types/uuid": "^9.0.0", diff --git a/apps/edr-passenger-api/prisma/migrations/20260606000000_add_iam_user_id_to_passenger/migration.sql b/apps/edr-passenger-api/prisma/migrations/20260606000000_add_iam_user_id_to_passenger/migration.sql new file mode 100644 index 000000000..9ccd3d52e --- /dev/null +++ b/apps/edr-passenger-api/prisma/migrations/20260606000000_add_iam_user_id_to_passenger/migration.sql @@ -0,0 +1,14 @@ +-- AddColumn: iamUserId to Passenger (cross-schema reference to iam.users — no FK enforced) +ALTER TABLE "passenger"."Passenger" ADD COLUMN "iamUserId" TEXT; + +-- Unique constraint: one IAM user maps to exactly one Passenger +ALTER TABLE "passenger"."Passenger" ADD CONSTRAINT "Passenger_iamUserId_key" UNIQUE ("iamUserId"); + +-- Index for fast lookup by iamUserId on every protected request +CREATE INDEX "Passenger_iamUserId_idx" ON "passenger"."Passenger"("iamUserId"); + +-- AddColumn: iamUserId to FaydaVerificationSession (no FK — cross-schema reference to iam.users) +ALTER TABLE "passenger"."FaydaVerificationSession" ADD COLUMN "iamUserId" TEXT; + +-- Index for Fayda callback to resolve IAM user +CREATE INDEX "FaydaVerificationSession_iamUserId_idx" ON "passenger"."FaydaVerificationSession"("iamUserId"); diff --git a/apps/edr-passenger-api/prisma/migrations/20260608061918_make_passenger_userid_nullable/migration.sql b/apps/edr-passenger-api/prisma/migrations/20260608061918_make_passenger_userid_nullable/migration.sql new file mode 100644 index 000000000..a9fa8190b --- /dev/null +++ b/apps/edr-passenger-api/prisma/migrations/20260608061918_make_passenger_userid_nullable/migration.sql @@ -0,0 +1,30 @@ +-- DropForeignKey +ALTER TABLE "Passenger" DROP CONSTRAINT "Passenger_userId_fkey"; + +-- AlterTable +ALTER TABLE "Passenger" ALTER COLUMN "userId" DROP NOT NULL; + +-- CreateTable +CREATE TABLE "TicketSeat" ( + "id" TEXT NOT NULL, + "ticketId" TEXT NOT NULL, + "seatId" TEXT NOT NULL, + "seatIndex" INTEGER NOT NULL DEFAULT 0, + + CONSTRAINT "TicketSeat_pkey" PRIMARY KEY ("id") +); + +-- CreateIndex +CREATE INDEX "TicketSeat_ticketId_idx" ON "TicketSeat"("ticketId"); + +-- CreateIndex +CREATE INDEX "TicketSeat_seatId_idx" ON "TicketSeat"("seatId"); + +-- AddForeignKey +ALTER TABLE "Passenger" ADD CONSTRAINT "Passenger_userId_fkey" FOREIGN KEY ("userId") REFERENCES "User"("id") ON DELETE SET NULL ON UPDATE CASCADE; + +-- AddForeignKey +ALTER TABLE "TicketSeat" ADD CONSTRAINT "TicketSeat_ticketId_fkey" FOREIGN KEY ("ticketId") REFERENCES "Ticket"("id") ON DELETE CASCADE ON UPDATE CASCADE; + +-- AddForeignKey +ALTER TABLE "TicketSeat" ADD CONSTRAINT "TicketSeat_seatId_fkey" FOREIGN KEY ("seatId") REFERENCES "Seat"("id") ON DELETE RESTRICT ON UPDATE CASCADE; diff --git a/apps/edr-passenger-api/prisma/migrations/20260608080000_rename_userid_to_iamuserid_on_preferences_device_fraudalert/migration.sql b/apps/edr-passenger-api/prisma/migrations/20260608080000_rename_userid_to_iamuserid_on_preferences_device_fraudalert/migration.sql new file mode 100644 index 000000000..ec1cfd078 --- /dev/null +++ b/apps/edr-passenger-api/prisma/migrations/20260608080000_rename_userid_to_iamuserid_on_preferences_device_fraudalert/migration.sql @@ -0,0 +1,13 @@ +-- Drop FK constraints (they reference iam.users indirectly via local User, but these are within passenger schema) +ALTER TABLE passenger."UserPreferences" DROP CONSTRAINT IF EXISTS "UserPreferences_userId_fkey"; +ALTER TABLE passenger."Device" DROP CONSTRAINT IF EXISTS "Device_userId_fkey"; +ALTER TABLE passenger."FraudAlert" DROP CONSTRAINT IF EXISTS "FraudAlert_userId_fkey"; + +-- Rename columns (preserves all existing data) +ALTER TABLE passenger."UserPreferences" RENAME COLUMN "userId" TO "iamUserId"; +ALTER TABLE passenger."Device" RENAME COLUMN "userId" TO "iamUserId"; +ALTER TABLE passenger."FraudAlert" RENAME COLUMN "userId" TO "iamUserId"; + +-- Rename indexes on FraudAlert to match new column name +DROP INDEX IF EXISTS passenger."FraudAlert_userId_createdAt_idx"; +CREATE INDEX "FraudAlert_iamUserId_createdAt_idx" ON passenger."FraudAlert"("iamUserId", "createdAt"); diff --git a/apps/edr-passenger-api/prisma/migrations/20260608090000_rename_auditlog_userid_drop_fayda_userid/migration.sql b/apps/edr-passenger-api/prisma/migrations/20260608090000_rename_auditlog_userid_drop_fayda_userid/migration.sql new file mode 100644 index 000000000..52914b220 --- /dev/null +++ b/apps/edr-passenger-api/prisma/migrations/20260608090000_rename_auditlog_userid_drop_fayda_userid/migration.sql @@ -0,0 +1,10 @@ +-- AuditLog: drop FK, rename column, update index +ALTER TABLE passenger."AuditLog" DROP CONSTRAINT IF EXISTS "AuditLog_userId_fkey"; +ALTER TABLE passenger."AuditLog" RENAME COLUMN "userId" TO "iamUserId"; +DROP INDEX IF EXISTS passenger."AuditLog_userId_createdAt_idx"; +CREATE INDEX IF NOT EXISTS "AuditLog_iamUserId_createdAt_idx" ON passenger."AuditLog"("iamUserId", "createdAt"); + +-- FaydaVerificationSession: drop userId column and FK (iamUserId already carries this data) +ALTER TABLE passenger."FaydaVerificationSession" DROP CONSTRAINT IF EXISTS "FaydaVerificationSession_userId_fkey"; +ALTER TABLE passenger."FaydaVerificationSession" DROP COLUMN IF EXISTS "userId"; +DROP INDEX IF EXISTS passenger."FaydaVerificationSession_userId_idx"; diff --git a/apps/edr-passenger-api/prisma/migrations/20260609065750_add_blocked_until_to_passenger/migration.sql b/apps/edr-passenger-api/prisma/migrations/20260609065750_add_blocked_until_to_passenger/migration.sql new file mode 100644 index 000000000..125074c12 --- /dev/null +++ b/apps/edr-passenger-api/prisma/migrations/20260609065750_add_blocked_until_to_passenger/migration.sql @@ -0,0 +1,5 @@ +-- AlterTable +ALTER TABLE "Passenger" ADD COLUMN "blockedUntil" TIMESTAMP(3); + +-- RenameIndex +ALTER INDEX "UserPreferences_userId_key" RENAME TO "UserPreferences_iamUserId_key"; diff --git a/apps/edr-passenger-api/prisma/migrations/20260622000000_catchup_iam_columns/migration.sql b/apps/edr-passenger-api/prisma/migrations/20260622000000_catchup_iam_columns/migration.sql new file mode 100644 index 000000000..582db9567 --- /dev/null +++ b/apps/edr-passenger-api/prisma/migrations/20260622000000_catchup_iam_columns/migration.sql @@ -0,0 +1,82 @@ +-- Catch-up migration: earlier migrations (20260606, 20260608) targeted passenger.* +-- but ran when tables were still in public schema (before 20260626 moved them). +-- All statements use IF NOT EXISTS / conditional blocks so this is safe to re-run. + +-- ──────────────────────────────────────────────────────────── +-- 1. Passenger.iamUserId +-- ──────────────────────────────────────────────────────────── +ALTER TABLE passenger."Passenger" ADD COLUMN IF NOT EXISTS "iamUserId" TEXT; + +DO $$ BEGIN + IF NOT EXISTS ( + SELECT 1 FROM pg_constraint + WHERE conname = 'Passenger_iamUserId_key' + AND conrelid = 'passenger."Passenger"'::regclass + ) THEN + ALTER TABLE passenger."Passenger" ADD CONSTRAINT "Passenger_iamUserId_key" UNIQUE ("iamUserId"); + END IF; +END $$; + +CREATE INDEX IF NOT EXISTS "Passenger_iamUserId_idx" ON passenger."Passenger"("iamUserId"); + +-- ──────────────────────────────────────────────────────────── +-- 2. FaydaVerificationSession.iamUserId +-- ──────────────────────────────────────────────────────────── +ALTER TABLE passenger."FaydaVerificationSession" ADD COLUMN IF NOT EXISTS "iamUserId" TEXT; +CREATE INDEX IF NOT EXISTS "FaydaVerificationSession_iamUserId_idx" ON passenger."FaydaVerificationSession"("iamUserId"); + +-- ──────────────────────────────────────────────────────────── +-- 3. UserPreferences: rename userId → iamUserId (if not yet renamed) +-- ──────────────────────────────────────────────────────────── +DO $$ BEGIN + IF EXISTS ( + SELECT 1 FROM information_schema.columns + WHERE table_schema = 'passenger' AND table_name = 'UserPreferences' AND column_name = 'userId' + ) THEN + ALTER TABLE passenger."UserPreferences" DROP CONSTRAINT IF EXISTS "UserPreferences_userId_fkey"; + ALTER TABLE passenger."UserPreferences" RENAME COLUMN "userId" TO "iamUserId"; + END IF; +END $$; + +-- ──────────────────────────────────────────────────────────── +-- 4. Device: rename userId → iamUserId (if not yet renamed) +-- ──────────────────────────────────────────────────────────── +DO $$ BEGIN + IF EXISTS ( + SELECT 1 FROM information_schema.columns + WHERE table_schema = 'passenger' AND table_name = 'Device' AND column_name = 'userId' + ) THEN + ALTER TABLE passenger."Device" DROP CONSTRAINT IF EXISTS "Device_userId_fkey"; + ALTER TABLE passenger."Device" RENAME COLUMN "userId" TO "iamUserId"; + END IF; +END $$; + +-- ──────────────────────────────────────────────────────────── +-- 5. FraudAlert: rename userId → iamUserId + fix index (if not yet renamed) +-- ──────────────────────────────────────────────────────────── +DO $$ BEGIN + IF EXISTS ( + SELECT 1 FROM information_schema.columns + WHERE table_schema = 'passenger' AND table_name = 'FraudAlert' AND column_name = 'userId' + ) THEN + ALTER TABLE passenger."FraudAlert" DROP CONSTRAINT IF EXISTS "FraudAlert_userId_fkey"; + ALTER TABLE passenger."FraudAlert" RENAME COLUMN "userId" TO "iamUserId"; + DROP INDEX IF EXISTS passenger."FraudAlert_userId_createdAt_idx"; + CREATE INDEX "FraudAlert_iamUserId_createdAt_idx" ON passenger."FraudAlert"("iamUserId", "createdAt"); + END IF; +END $$; + +-- ──────────────────────────────────────────────────────────── +-- 6. AuditLog: rename userId → iamUserId + fix index (if not yet renamed) +-- ──────────────────────────────────────────────────────────── +DO $$ BEGIN + IF EXISTS ( + SELECT 1 FROM information_schema.columns + WHERE table_schema = 'passenger' AND table_name = 'AuditLog' AND column_name = 'userId' + ) THEN + ALTER TABLE passenger."AuditLog" DROP CONSTRAINT IF EXISTS "AuditLog_userId_fkey"; + ALTER TABLE passenger."AuditLog" RENAME COLUMN "userId" TO "iamUserId"; + DROP INDEX IF EXISTS passenger."AuditLog_userId_createdAt_idx"; + CREATE INDEX IF NOT EXISTS "AuditLog_iamUserId_createdAt_idx" ON passenger."AuditLog"("iamUserId", "createdAt"); + END IF; +END $$; diff --git a/apps/edr-passenger-api/prisma/migrations/20260622000001_make_passenger_userid_nullable/migration.sql b/apps/edr-passenger-api/prisma/migrations/20260622000001_make_passenger_userid_nullable/migration.sql new file mode 100644 index 000000000..33f793aa3 --- /dev/null +++ b/apps/edr-passenger-api/prisma/migrations/20260622000001_make_passenger_userid_nullable/migration.sql @@ -0,0 +1,5 @@ +-- 20260608061918 was marked-as-applied without running (it failed on CREATE TABLE TicketSeat). +-- The two ALTER TABLE statements it contained never executed, so userId is still NOT NULL. + +ALTER TABLE passenger."Passenger" DROP CONSTRAINT IF EXISTS "Passenger_userId_fkey"; +ALTER TABLE passenger."Passenger" ALTER COLUMN "userId" DROP NOT NULL; diff --git a/apps/edr-passenger-api/prisma/migrations/20260622000002_agent_iam_user_id_drop_user_fks/migration.sql b/apps/edr-passenger-api/prisma/migrations/20260622000002_agent_iam_user_id_drop_user_fks/migration.sql new file mode 100644 index 000000000..dcd55c066 --- /dev/null +++ b/apps/edr-passenger-api/prisma/migrations/20260622000002_agent_iam_user_id_drop_user_fks/migration.sql @@ -0,0 +1,39 @@ +-- ──────────────────────────────────────────────────────────── +-- 1. Add iamUserId to Agent +-- ──────────────────────────────────────────────────────────── +ALTER TABLE passenger."Agent" ADD COLUMN IF NOT EXISTS "iamUserId" TEXT; + +DO $$ BEGIN + IF NOT EXISTS ( + SELECT 1 FROM pg_constraint + WHERE conname = 'Agent_iamUserId_key' + AND conrelid = 'passenger."Agent"'::regclass + ) THEN + ALTER TABLE passenger."Agent" ADD CONSTRAINT "Agent_iamUserId_key" UNIQUE ("iamUserId"); + END IF; +END $$; + +CREATE INDEX IF NOT EXISTS "Agent_iamUserId_idx" ON passenger."Agent"("iamUserId"); + +-- ──────────────────────────────────────────────────────────── +-- 2. Populate iamUserId for existing agent records +-- Match via User.email → iam.users.email +-- ──────────────────────────────────────────────────────────── +UPDATE passenger."Agent" a +SET "iamUserId" = iu.id +FROM passenger."User" u +JOIN iam.users iu ON iu.email = u.email +WHERE a."userId" = u.id + AND a."iamUserId" IS NULL; + +-- ──────────────────────────────────────────────────────────── +-- 3. Drop Agent.userId FK and column — iamUserId replaces it entirely +-- ──────────────────────────────────────────────────────────── +ALTER TABLE passenger."Agent" DROP CONSTRAINT IF EXISTS "Agent_userId_fkey"; +DROP INDEX IF EXISTS passenger."Agent_userId_key"; +ALTER TABLE passenger."Agent" DROP COLUMN IF EXISTS "userId"; + +-- ──────────────────────────────────────────────────────────── +-- 4. Drop Passenger.userId FK (column stays as plain nullable string) +-- ──────────────────────────────────────────────────────────── +ALTER TABLE passenger."Passenger" DROP CONSTRAINT IF EXISTS "Passenger_userId_fkey"; diff --git a/apps/edr-passenger-api/prisma/schema.prisma b/apps/edr-passenger-api/prisma/schema.prisma index 33fb53610..d8b995745 100644 --- a/apps/edr-passenger-api/prisma/schema.prisma +++ b/apps/edr-passenger-api/prisma/schema.prisma @@ -260,15 +260,8 @@ model User { faydaVerifiedAt DateTime? faydaSub String? @unique - passenger Passenger? - agent Agent? - sessions Session[] - devices Device[] - preferences UserPreferences? - auditLogs AuditLog[] - fraudAlerts FraudAlert[] + sessions Session[] - faydaVerificationSessions FaydaVerificationSession[] @@schema("passenger") } @@ -286,10 +279,12 @@ model Session { } model Passenger { - id String @id @default(uuid()) - userId String @unique + id String @id @default(uuid()) + userId String? @unique + iamUserId String? @unique defaultTravelerProfileId String? preferredLanguage String? + blockedUntil DateTime? createdAt DateTime @default(now()) user User @relation(fields: [userId], references: [id]) bookings Booking[] @@ -298,9 +293,9 @@ model Passenger { notifications Notification[] travelerProfiles TravelerProfile[] savedRoutes SavedRoute[] - packageBookings PackageBooking[] - +packageBookings PackageBooking[] @@index([userId]) + @@index([iamUserId]) @@schema("passenger") } @@ -898,7 +893,7 @@ model SupportMessage { model UserPreferences { id String @id @default(uuid()) - userId String @unique + iamUserId String @unique pushEnabled Boolean @default(true) emailEnabled Boolean @default(true) smsEnabled Boolean @default(false) @@ -911,19 +906,19 @@ model UserPreferences { locale String @default("en") darkMode Boolean @default(false) language String @default("en") - user User @relation(fields: [userId], references: [id]) + @@schema("passenger") } model Device { id String @id @default(uuid()) - userId String + iamUserId String platform DevicePlatform name String pushToken String? trusted Boolean @default(false) lastSeenAt DateTime @default(now()) - user User @relation(fields: [userId], references: [id]) + @@schema("passenger") } @@ -1066,16 +1061,16 @@ model SegmentFareRule { model Agent { id String @id @default(uuid()) - userId String @unique + iamUserId String? @unique agentCode String @unique stationId String? commissionRate Int @default(5) active Boolean @default(true) createdAt DateTime @default(now()) - user User @relation(fields: [userId], references: [id]) bookings AgentBooking[] shifts AgentShift[] commissions AgentCommission[] + @@index([iamUserId]) @@schema("passenger") } @@ -1194,19 +1189,17 @@ model BaggageBooking { } model AuditLog { - id String @id @default(uuid()) - userId String? - action String - entityType String - entityId String? - oldData Json? - newData Json? - ipAddress String? - userAgent String? - createdAt DateTime @default(now()) - user User? @relation(fields: [userId], references: [id]) - - @@index([userId, createdAt]) + id String @id @default(uuid()) + iamUserId String? + action String + entityType String + entityId String? + oldData Json? + newData Json? + ipAddress String? + userAgent String? + createdAt DateTime @default(now()) + @@index([iamUserId, createdAt]) @@index([entityType, entityId]) @@schema("passenger") } @@ -1262,16 +1255,14 @@ model FraudRule { model FraudAlert { id String @id @default(uuid()) - userId String + iamUserId String eventType String triggeredRules String[] context Json severity String @default("MEDIUM") acknowledged Boolean @default(false) createdAt DateTime @default(now()) - user User @relation(fields: [userId], references: [id], onDelete: Cascade) - - @@index([userId, createdAt]) + @@index([iamUserId, createdAt]) @@index([acknowledged]) @@schema("passenger") } @@ -1341,12 +1332,10 @@ model FaydaVerificationSession { expiresAt DateTime completedAt DateTime? - userId String? + iamUserId String? bookingId String? - user User? @relation(fields: [userId], references: [id], onDelete: Cascade) - - @@index([userId]) + @@index([iamUserId]) @@index([bookingId]) @@index([state]) @@index([expiresAt]) diff --git a/apps/edr-passenger-api/scripts/run-iam-migrations.cjs b/apps/edr-passenger-api/scripts/run-iam-migrations.cjs new file mode 100644 index 000000000..1a448070b --- /dev/null +++ b/apps/edr-passenger-api/scripts/run-iam-migrations.cjs @@ -0,0 +1,46 @@ +/** + * Dev helper: run the @tria-plc/iamapi-common TypeORM migrations against the shared `iam` schema. + * + * The package ships its migration CLI assuming you run it from inside the package repo (it needs + * the package's devDeps). As a consumer we instead drive the shipped (compiled) migrations with the + * passenger app's own installed TypeORM. + * + * Reads the same DATABASE_* env vars as the app's IAM DataSource (see config/iam-database.config.ts). + * Run via: pnpm --filter @edr/passenger-api iam:migrate + * (the npm script loads .env with `node --env-file`). + * + * NOTE: in production the central IAM team owns/runs these migrations — this helper is for local dev. + */ +const path = require('path'); +const { DataSource } = require('typeorm'); + +const iamDist = path + .dirname(require.resolve('@tria-plc/iamapi-common')) + .replace(/\\/g, '/'); + +const ds = new DataSource({ + type: 'postgres', + host: process.env.DATABASE_HOST, + port: Number(process.env.DATABASE_PORT || 5432), + database: process.env.DATABASE_NAME, + username: process.env.DATABASE_USER, + password: process.env.DATABASE_PASSWORD, + schema: process.env.DATABASE_SCHEMA || 'iam', + entities: [], // migrations are raw SQL — no entities needed to run them + migrations: [`${iamDist}/db/migrations/*.js`], + migrationsTableName: 'typeorm_migrations', +}); + +(async () => { + await ds.initialize(); + // The IAM migrations rely on uuid_generate_v4() but never CREATE the extension themselves. + await ds.query('CREATE EXTENSION IF NOT EXISTS "uuid-ossp"'); + const applied = await ds.runMigrations({ transaction: 'each' }); + console.log(`[iam-migrations] applied ${applied.length} migration(s)`); + applied.slice(-5).forEach((m) => console.log(' +', m.name)); + await ds.destroy(); + console.log('[iam-migrations] DONE'); +})().catch((e) => { + console.error('[iam-migrations] FAIL:', e.message); + process.exit(1); +}); diff --git a/apps/edr-passenger-api/scripts/seed-iam-dev-user.cjs b/apps/edr-passenger-api/scripts/seed-iam-dev-user.cjs new file mode 100644 index 000000000..37451f871 --- /dev/null +++ b/apps/edr-passenger-api/scripts/seed-iam-dev-user.cjs @@ -0,0 +1,74 @@ +/** + * Dev helper: create a dev IAM user + an ACTIVE session, and print a ready-to-use Bearer token. + * + * Why this exists: in prod the central IAM service issues tokens (via password login at + * /v1/auth/login). For local dev of the passenger API (a token *consumer*), this seeds a session + * directly and mints a matching token with the package's own `generateToken`, so you can call + * protected routes immediately (paste the token into Swagger's Authorize box or `curl -H`). + * + * Run: pnpm --filter @edr/passenger-api iam:seed-dev-user + * Reads DATABASE_* + JWT_ACCESS_TOKEN_SECRET/EXPIRES from .env (loaded via `node --env-file`). + */ +const crypto = require('crypto'); +const { DataSource } = require('typeorm'); +const { generateToken } = require('@tria-plc/api-common/utils/token'); + +const DEV_EMAIL = process.env.DEV_IAM_EMAIL || 'dev@edr.local'; + +const ds = new DataSource({ + type: 'postgres', + host: process.env.DATABASE_HOST, + port: Number(process.env.DATABASE_PORT || 5432), + database: process.env.DATABASE_NAME, + username: process.env.DATABASE_USER, + password: process.env.DATABASE_PASSWORD, +}); + +(async () => { + await ds.initialize(); + + // Upsert the dev user (users.email is UNIQUE). + const name = { en: 'Dev User', am: 'የሙከራ ተጠቃሚ' }; + const [user] = await ds.query( + `INSERT INTO iam.users (name, username, email, user_type, status, is_active) + VALUES ($1::jsonb, $2, $3, 'individual', 'accepted', true) + ON CONFLICT (email) DO UPDATE SET updated_at = now() + RETURNING id`, + [JSON.stringify(name), 'dev-user', DEV_EMAIL], + ); + const userId = user.id; + + // Fresh ACTIVE session; userInfo is the denormalized TCurrentUser the guard puts on req.user. + const sessionId = crypto.randomUUID(); + const userInfo = { + id: userId, + email: DEV_EMAIL, + name, + username: 'dev-user', + userType: 'individual', + status: 'accepted', + roles: [], + permissions: [], + }; + await ds.query( + `INSERT INTO iam.sessions (id, email, device, "userInfo", user_id, status, expiry_time) + VALUES ($1, $2, 'dev-seeder', $3::jsonb, $4, 'ACTIVE', now() + interval '7 days')`, + [sessionId, DEV_EMAIL, JSON.stringify(userInfo), userId], + ); + + // The package JwtGuard looks up the session by the token's `id` claim. + const token = generateToken({ id: sessionId }); + + console.log('\n=== IAM dev user seeded ==='); + console.log('user id :', userId); + console.log('email :', DEV_EMAIL); + console.log('session id:', sessionId); + console.log('\nBearer token (valid 7 days):\n' + token); + console.log('\nTry it: curl -H "Authorization: Bearer " http://localhost:3002/v1/auth/me'); + console.log('(Run again any time for a fresh token/session.)\n'); + + await ds.destroy(); +})().catch((e) => { + console.error('[seed-iam-dev-user] FAIL:', e.message); + process.exit(1); +}); diff --git a/apps/edr-passenger-api/src/app.module.ts b/apps/edr-passenger-api/src/app.module.ts index 7fab3d082..98f6a2a6e 100644 --- a/apps/edr-passenger-api/src/app.module.ts +++ b/apps/edr-passenger-api/src/app.module.ts @@ -1,14 +1,29 @@ -import { Module, NestModule, MiddlewareConsumer } from '@nestjs/common'; -import { ConfigModule } from '@nestjs/config'; +import { + MiddlewareConsumer, + Module, + NestModule, + OnApplicationBootstrap, +} from '@nestjs/common'; +import { ConfigModule, ConfigService } from '@nestjs/config'; import { ScheduleModule } from '@nestjs/schedule'; import { EventEmitterModule } from '@nestjs/event-emitter'; +import { TypeOrmModule, TypeOrmModuleOptions } from '@nestjs/typeorm'; +import { IamModule as TriaIamModule } from '@tria-plc/iamapi-common/iam.module'; +import { DataSeeder } from '@tria-plc/iamapi-common/db/seed/seeder'; +import { SharedAuthModule } from '@tria-plc/api-common/modules/auth/shared-auth.module'; +import { + EDR_PASSENGER_APPLICATION, + EDR_PASSENGER_PERMISSIONS, +} from './seed/edr-passenger.seed'; +import { EdrPassengerOrgSeeder } from './seed/edr-passenger-org.seeder'; +import { PassengerStaffUsersSeeder } from './seed/passenger-staff-users.seeder'; import { PrismaModule } from './common/prisma.module'; import { AuditModule } from './common/audit.module'; import { I18nModule } from './common/i18n/i18n.module'; -import { IamModule } from './common/iam.module'; import { LocaleMiddleware } from './common/i18n/locale.middleware'; import appConfig from './config/app.config'; import dbConfig from './config/database.config'; +import iamDatabaseConfig from './config/iam-database.config'; import telebirrConfig from './config/telebirr.config'; import cbeConfig from './config/cbe.config'; import ebirrConfig from './config/ebirr.config'; @@ -52,6 +67,7 @@ import { PackagesModule } from './modules/packages/packages.module'; load: [ appConfig, dbConfig, + iamDatabaseConfig, telebirrConfig, cbeConfig, ebirrConfig, @@ -63,11 +79,20 @@ import { PackagesModule } from './modules/packages/packages.module'; }), ScheduleModule.forRoot(), EventEmitterModule.forRoot(), + TypeOrmModule.forRootAsync({ + inject: [ConfigService], + useFactory: (config: ConfigService): TypeOrmModuleOptions => + config.get('iamDatabase')!, + }), + TriaIamModule.forRoot({ + applications: [EDR_PASSENGER_APPLICATION], + permissions: EDR_PASSENGER_PERMISSIONS, + }), + SharedAuthModule, PrismaModule, AuditModule, I18nModule, - IamModule, - AuthModule, + AuthModule, StationsModule, FleetModule, SchedulesModule, @@ -96,9 +121,25 @@ import { PackagesModule } from './modules/packages/packages.module'; SystemConfigModule, PackagesModule, ], + providers: [ + EdrPassengerOrgSeeder, + PassengerStaffUsersSeeder, + ], }) -export class AppModule implements NestModule { - configure(consumer: MiddlewareConsumer) { - consumer.apply(LocaleMiddleware).forRoutes('*'); +export class AppModule implements OnApplicationBootstrap { + constructor( + private readonly seeder: DataSeeder, + private readonly edrPassengerOrgSeeder: EdrPassengerOrgSeeder, + private readonly passengerStaffUsersSeeder: PassengerStaffUsersSeeder, + ) {} + + async onApplicationBootstrap() { + try { + await this.seeder.run(); + } catch (err) { + console.error('[DataSeeder] Seed failed (non-fatal):', (err as Error).message); + } + await this.edrPassengerOrgSeeder.run(); + await this.passengerStaffUsersSeeder.run(); } } diff --git a/apps/edr-passenger-api/src/common/audit.service.ts b/apps/edr-passenger-api/src/common/audit.service.ts index 342e786bd..3f1dc161f 100644 --- a/apps/edr-passenger-api/src/common/audit.service.ts +++ b/apps/edr-passenger-api/src/common/audit.service.ts @@ -23,7 +23,7 @@ export class AuditService { await this.prisma.auditLog.create({ data: { - userId: input.userId, + iamUserId: input.userId, action: input.action, entityType: input.entityType, entityId: input.entityId, @@ -62,8 +62,7 @@ export class AuditService { if (filters.search) { where.OR = [ { entityId: { contains: filters.search, mode: 'insensitive' } }, - { user: { email: { contains: filters.search, mode: 'insensitive' } } }, - { user: { fullName: { contains: filters.search, mode: 'insensitive' } } }, + { iamUserId: { contains: filters.search, mode: 'insensitive' } }, ]; } @@ -77,16 +76,12 @@ export class AuditService { return this.prisma.auditLog.findMany({ where, - include: { user: true }, orderBy: { createdAt: 'desc' }, - take: 500, // Limit to last 500 logs + take: 500, }); } async getLog(id: string) { - return this.prisma.auditLog.findUnique({ - where: { id }, - include: { user: true }, - }); + return this.prisma.auditLog.findUnique({ where: { id } }); } } diff --git a/apps/edr-passenger-api/src/common/iam-adapter.spec.ts b/apps/edr-passenger-api/src/common/iam-adapter.spec.ts deleted file mode 100644 index d0c404366..000000000 --- a/apps/edr-passenger-api/src/common/iam-adapter.spec.ts +++ /dev/null @@ -1,264 +0,0 @@ -import { Test, TestingModule } from '@nestjs/testing'; -import { ExecutionContext, UnauthorizedException, ForbiddenException } from '@nestjs/common'; -import { Reflector } from '@nestjs/core'; -import { ConfigService } from '@nestjs/config'; -import { HttpService } from '@nestjs/axios'; -import { IamGuard } from './iam-adapter'; -import { of, throwError } from 'rxjs'; - -describe('IamGuard', () => { - let guard: IamGuard; - let httpService: HttpService; - let configService: ConfigService; - let reflector: Reflector; - - const mockConfigService = { - get: jest.fn((key: string) => { - const config: Record = { - IAM_API_URL: 'https://iam.test.com/api', - IAM_ENABLED: 'true', - IAM_API_KEY: 'test-api-key', - }; - return config[key]; - }), - }; - - const mockHttpService = { - post: jest.fn(), - }; - - const mockReflector = { - get: jest.fn(), - }; - - beforeEach(async () => { - const module: TestingModule = await Test.createTestingModule({ - providers: [ - IamGuard, - { provide: ConfigService, useValue: mockConfigService }, - { provide: HttpService, useValue: mockHttpService }, - { provide: Reflector, useValue: mockReflector }, - ], - }).compile(); - - guard = module.get(IamGuard); - httpService = module.get(HttpService); - configService = module.get(ConfigService); - reflector = module.get(Reflector); - - jest.clearAllMocks(); - }); - - const createMockContext = (token?: string, roles?: string[]): ExecutionContext => { - const request = { - headers: token ? { authorization: `Bearer ${token}` } : {}, - user: undefined, - }; - - return { - switchToHttp: () => ({ - getRequest: () => request, - }), - getHandler: () => ({}), - } as ExecutionContext; - }; - - describe('canActivate', () => { - it('should allow access when IAM is disabled', async () => { - mockConfigService.get.mockReturnValueOnce('false'); // IAM_ENABLED - - const context = createMockContext(); - const result = await guard.canActivate(context); - - expect(result).toBe(true); - }); - - it('should throw UnauthorizedException when no token provided', async () => { - const context = createMockContext(); - - await expect(guard.canActivate(context)).rejects.toThrow(UnauthorizedException); - }); - - it('should validate token and allow access', async () => { - const mockValidationResponse = { - data: { - valid: true, - payload: { - sub: 'user-123', - email: 'admin@test.com', - roles: ['ADMIN'], - permissions: ['read', 'write'], - exp: Date.now() + 3600000, - iat: Date.now(), - }, - }, - }; - - mockHttpService.post.mockReturnValue(of(mockValidationResponse)); - mockReflector.get.mockReturnValue(null); - - const context = createMockContext('valid-token'); - const result = await guard.canActivate(context); - - expect(result).toBe(true); - expect(mockHttpService.post).toHaveBeenCalledWith( - 'https://iam.test.com/api/v1/auth/validate', - { token: 'valid-token' }, - expect.objectContaining({ - headers: expect.objectContaining({ - 'X-API-Key': 'test-api-key', - }), - }), - ); - }); - - it('should throw UnauthorizedException for invalid token', async () => { - const mockValidationResponse = { - data: { - valid: false, - error: 'Token expired', - }, - }; - - mockHttpService.post.mockReturnValue(of(mockValidationResponse)); - - const context = createMockContext('invalid-token'); - - await expect(guard.canActivate(context)).rejects.toThrow(UnauthorizedException); - }); - - it('should check required roles', async () => { - const mockValidationResponse = { - data: { - valid: true, - payload: { - sub: 'user-123', - email: 'agent@test.com', - roles: ['AGENT'], - permissions: [], - exp: Date.now() + 3600000, - iat: Date.now(), - }, - }, - }; - - mockHttpService.post.mockReturnValue(of(mockValidationResponse)); - mockReflector.get.mockReturnValue(['ADMIN', 'SUPERVISOR']); - - const context = createMockContext('valid-token'); - - await expect(guard.canActivate(context)).rejects.toThrow(ForbiddenException); - }); - - it('should allow access when user has required role', async () => { - const mockValidationResponse = { - data: { - valid: true, - payload: { - sub: 'user-123', - email: 'admin@test.com', - roles: ['ADMIN'], - permissions: [], - exp: Date.now() + 3600000, - iat: Date.now(), - }, - }, - }; - - mockHttpService.post.mockReturnValue(of(mockValidationResponse)); - mockReflector.get.mockReturnValue(['ADMIN', 'SUPERVISOR']); - - const context = createMockContext('valid-token'); - const result = await guard.canActivate(context); - - expect(result).toBe(true); - }); - - it('should handle HTTP errors gracefully', async () => { - mockHttpService.post.mockReturnValue( - throwError(() => new Error('Network error')), - ); - - const context = createMockContext('valid-token'); - - await expect(guard.canActivate(context)).rejects.toThrow(UnauthorizedException); - }); - - it('should attach user to request', async () => { - const mockValidationResponse = { - data: { - valid: true, - payload: { - sub: 'user-123', - email: 'admin@test.com', - roles: ['ADMIN'], - permissions: ['read', 'write'], - organizationId: 'org-456', - exp: Date.now() + 3600000, - iat: Date.now(), - }, - }, - }; - - mockHttpService.post.mockReturnValue(of(mockValidationResponse)); - mockReflector.get.mockReturnValue(null); - - const context = createMockContext('valid-token'); - await guard.canActivate(context); - - const request = context.switchToHttp().getRequest(); - expect(request.user).toEqual({ - userId: 'user-123', - email: 'admin@test.com', - roles: ['ADMIN'], - permissions: ['read', 'write'], - organizationId: 'org-456', - }); - }); - }); - - describe('token extraction', () => { - it('should extract token from Bearer header', async () => { - const mockValidationResponse = { - data: { - valid: true, - payload: { - sub: 'user-123', - email: 'test@test.com', - roles: [], - permissions: [], - exp: Date.now() + 3600000, - iat: Date.now(), - }, - }, - }; - - mockHttpService.post.mockReturnValue(of(mockValidationResponse)); - mockReflector.get.mockReturnValue(null); - - const context = createMockContext('my-token-123'); - await guard.canActivate(context); - - expect(mockHttpService.post).toHaveBeenCalledWith( - expect.any(String), - { token: 'my-token-123' }, - expect.any(Object), - ); - }); - - it('should reject malformed authorization header', async () => { - const request = { - headers: { authorization: 'InvalidFormat token' }, - }; - - const context = { - switchToHttp: () => ({ - getRequest: () => request, - }), - getHandler: () => ({}), - } as ExecutionContext; - - await expect(guard.canActivate(context)).rejects.toThrow(UnauthorizedException); - }); - }); -}); diff --git a/apps/edr-passenger-api/src/common/iam-adapter.ts b/apps/edr-passenger-api/src/common/iam-adapter.ts index fb32d9ec6..96168dba8 100644 --- a/apps/edr-passenger-api/src/common/iam-adapter.ts +++ b/apps/edr-passenger-api/src/common/iam-adapter.ts @@ -1,144 +1 @@ -import { Injectable, CanActivate, ExecutionContext, UnauthorizedException, ForbiddenException } from '@nestjs/common'; -import { Reflector } from '@nestjs/core'; -import { ConfigService } from '@nestjs/config'; -import { HttpService } from '@nestjs/axios'; -import { firstValueFrom } from 'rxjs'; - -/** - * IAM Adapter for @tria-plc corporate identity integration - * - * This adapter wraps the corporate IAM guards and provides a bridge - * between the corporate identity system and the EDR passenger API. - * - * For back-office roles (agent, supervisor, admin, staff), this guard - * validates tokens against the corporate IAM service. - * - * For passenger-facing routes, the existing JWT guard is used. - */ - -export interface IamTokenPayload { - sub: string; - email: string; - roles: string[]; - permissions: string[]; - organizationId?: string; - exp: number; - iat: number; -} - -export interface IamValidationResponse { - valid: boolean; - payload?: IamTokenPayload; - error?: string; -} - -@Injectable() -export class IamGuard implements CanActivate { - private readonly iamApiUrl: string; - private readonly iamEnabled: boolean; - - constructor( - private readonly reflector: Reflector, - private readonly config: ConfigService, - private readonly http: HttpService, - ) { - this.iamApiUrl = this.config.get('IAM_API_URL') || 'https://iam.tria-plc.com/api'; - this.iamEnabled = this.config.get('IAM_ENABLED') === 'true'; - } - - async canActivate(context: ExecutionContext): Promise { - if (!this.iamEnabled) { - // IAM disabled - allow access (for development) - return true; - } - - const request = context.switchToHttp().getRequest(); - const token = this.extractToken(request); - - if (!token) { - throw new UnauthorizedException('No authentication token provided'); - } - - const validation = await this.validateToken(token); - - if (!validation.valid || !validation.payload) { - throw new UnauthorizedException(validation.error || 'Invalid token'); - } - - // Check required roles - const requiredRoles = this.reflector.get('roles', context.getHandler()); - if (requiredRoles && requiredRoles.length > 0) { - const hasRole = requiredRoles.some((role) => validation.payload!.roles.includes(role)); - if (!hasRole) { - throw new ForbiddenException('Insufficient permissions'); - } - } - - // Attach user to request - request.user = { - userId: validation.payload.sub, - email: validation.payload.email, - roles: validation.payload.roles, - permissions: validation.payload.permissions, - organizationId: validation.payload.organizationId, - }; - - return true; - } - - private extractToken(request: any): string | null { - const authHeader = request.headers.authorization; - if (!authHeader) return null; - - const parts = authHeader.split(' '); - if (parts.length !== 2 || parts[0] !== 'Bearer') return null; - - return parts[1]; - } - - private async validateToken(token: string): Promise { - try { - const response = await firstValueFrom( - this.http.post( - `${this.iamApiUrl}/v1/auth/validate`, - { token }, - { - headers: { - 'Content-Type': 'application/json', - 'X-API-Key': this.config.get('IAM_API_KEY') || '', - }, - timeout: 5000, - }, - ), - ); - - return response.data; - } catch (err) { - return { - valid: false, - error: err instanceof Error ? err.message : 'Token validation failed', - }; - } - } -} - -/** - * Decorator to mark routes as requiring IAM authentication - */ -export const UseIamAuth = () => { - // This is a marker decorator that can be used with @UseGuards(IamGuard) - return (target: any, propertyKey?: string, descriptor?: PropertyDescriptor) => { - // Marker only - actual guard is applied via @UseGuards - }; -}; - -/** - * Decorator to specify required roles for IAM-protected routes - */ -export const IamRoles = (...roles: string[]) => { - return (target: any, propertyKey?: string, descriptor?: PropertyDescriptor) => { - if (descriptor) { - Reflect.defineMetadata('roles', roles, descriptor.value); - } - }; -}; +export { JwtGuard as IamGuard } from '@tria-plc/api-common/modules/auth/services/jwt.guard'; diff --git a/apps/edr-passenger-api/src/common/iam-typeorm.config.ts b/apps/edr-passenger-api/src/common/iam-typeorm.config.ts new file mode 100644 index 000000000..42ce89c9e --- /dev/null +++ b/apps/edr-passenger-api/src/common/iam-typeorm.config.ts @@ -0,0 +1,56 @@ +import { TypeOrmModuleOptions } from '@nestjs/typeorm'; +import * as path from 'path'; + +/** + * TypeORM DataSource options for the shared `iam` schema. + * + * Context (see docs/iam-package-understanding-guide.md): + * - The `iam` schema is owned by `@tria-plc/iamapi-common` (TypeORM). Prisma owns the + * `passenger` schema. Both ORMs point at the same database (`edr_database`). + * - `@tria-plc/api-common`'s `JwtGuard` injects the *default* TypeORM `DataSource` and runs a + * raw `SELECT ... FROM iam.sessions`, so the app must expose a DataSource that can reach it. + * + * Connection env vars intentionally mirror the package's own migration DataSource + * (`@tria-plc/api-common/dist/modules/typeorm/typeorm.config.internal.js`) so the app and the + * package CLI read the same configuration: + * DATABASE_HOST, DATABASE_PORT, DATABASE_NAME, DATABASE_USER, DATABASE_PASSWORD, DATABASE_SCHEMA + * + * This NEVER manages the schema: `synchronize: false` and `migrationsRun: false`. The `iam` + * schema is created by the IAM package migrations (dev: self-hosted; prod: central IAM team). + */ +function resolvePackageDist(pkg: string): string { + // Node honors each package's `exports` map at runtime even though TS `moduleResolution: "Node"` + // does not — so `require.resolve` on the barrel resolves to the package's dist `index.js`. + const resolved = require.resolve(pkg); + // Normalize to forward slashes so the glob works on Windows too. + return path.dirname(resolved).replace(/\\/g, '/'); +} + +export function buildIamTypeOrmOptions(): TypeOrmModuleOptions { + const iamDist = resolvePackageDist('@tria-plc/iamapi-common'); + // Some IAM entities (e.g. PositionType) relate to the notification entities that physically + // live in @tria-plc/api-common (the IAM barrel only re-exports them), so BOTH dist trees must + // be registered or TypeORM throws "Entity metadata ... was not found". + const apiDist = resolvePackageDist('@tria-plc/api-common'); + return { + type: 'postgres', + host: process.env.DATABASE_HOST, + port: Number(process.env.DATABASE_PORT ?? 5432), + database: process.env.DATABASE_NAME, + username: process.env.DATABASE_USER, + password: process.env.DATABASE_PASSWORD, + schema: process.env.DATABASE_SCHEMA ?? 'iam', + // IAM entities live in the packages; registered so the same default DataSource also serves + // IamModule in the dev self-host phase (Phase 3). Harmless before the tables exist. + entities: [ + `${iamDist}/entities/**/*.entity.{ts,js}`, + `${apiDist}/entities/**/*.entity.{ts,js}`, + ], + synchronize: false, // schema is owned by IAM migrations — never auto-sync + migrationsRun: false, // migrations are run by the IAM package CLI (dev) / IAM team (prod) + autoLoadEntities: false, + migrationsTableName: 'typeorm_migrations', + retryAttempts: 0, // fail fast in dev if the iam schema / DB is unreachable + logging: ['error'], + }; +} diff --git a/apps/edr-passenger-api/src/common/iam.module.ts b/apps/edr-passenger-api/src/common/iam.module.ts deleted file mode 100644 index 7a8ec9599..000000000 --- a/apps/edr-passenger-api/src/common/iam.module.ts +++ /dev/null @@ -1,11 +0,0 @@ -import { Module, Global } from '@nestjs/common'; -import { HttpModule } from '@nestjs/axios'; -import { IamGuard } from './iam-adapter'; - -@Global() -@Module({ - imports: [HttpModule.register({ timeout: 5000 })], - providers: [IamGuard], - exports: [IamGuard], -}) -export class IamModule {} diff --git a/apps/edr-passenger-api/src/common/interceptors/session-activity.interceptor.ts b/apps/edr-passenger-api/src/common/interceptors/session-activity.interceptor.ts index 9c962ba60..d5735231d 100644 --- a/apps/edr-passenger-api/src/common/interceptors/session-activity.interceptor.ts +++ b/apps/edr-passenger-api/src/common/interceptors/session-activity.interceptor.ts @@ -1,7 +1,8 @@ -import { Injectable, NestInterceptor, ExecutionContext, CallHandler, UnauthorizedException } from '@nestjs/common'; +import { Injectable, NestInterceptor, ExecutionContext, CallHandler } from '@nestjs/common'; import { Observable } from 'rxjs'; import { tap } from 'rxjs/operators'; -import { PrismaService } from '../prisma.service'; +import { InjectDataSource } from '@nestjs/typeorm'; +import { DataSource } from 'typeorm'; import { ConfigService } from '@nestjs/config'; @Injectable() @@ -9,7 +10,7 @@ export class SessionActivityInterceptor implements NestInterceptor { private readonly inactivityMinutes: number; constructor( - private readonly prisma: PrismaService, + @InjectDataSource() private readonly dataSource: DataSource, private readonly config: ConfigService, ) { this.inactivityMinutes = parseInt(this.config.get('SESSION_INACTIVITY_MINUTES') || '30', 10); @@ -18,29 +19,25 @@ export class SessionActivityInterceptor implements NestInterceptor { async intercept(context: ExecutionContext, next: CallHandler): Promise> { const request = context.switchToHttp().getRequest(); const response = context.switchToHttp().getResponse(); - const user = request.user; + const sessionId: string | undefined = request.user?.sessionId; - if (user?.userId) { - const session = await this.prisma.session.findFirst({ - where: { userId: user.userId }, - orderBy: { lastActivityAt: 'desc' }, - }); + if (sessionId) { + const rows = await this.dataSource.query>( + `SELECT expiry_time FROM iam.sessions WHERE id = $1 AND status = 'ACTIVE' LIMIT 1`, + [sessionId], + ); - if (session) { - const inactiveMinutes = (Date.now() - session.lastActivityAt.getTime()) / 60000; - - if (inactiveMinutes > this.inactivityMinutes) { - await this.prisma.session.delete({ where: { id: session.id } }); - throw new UnauthorizedException('Session expired due to inactivity'); + if (rows.length) { + const minutesLeft = (rows[0].expiry_time.getTime() - Date.now()) / 60000; + if (minutesLeft < this.inactivityMinutes * 0.2) { + response.setHeader('X-Session-Expiry-Warning', Math.floor(minutesLeft).toString()); } - const expiryWarningMinutes = Math.max(0, this.inactivityMinutes - inactiveMinutes); - response.setHeader('X-Session-Expiry-Warning', Math.floor(expiryWarningMinutes).toString()); - - await this.prisma.session.update({ - where: { id: session.id }, - data: { lastActivityAt: new Date() }, - }); + // Extend session on every authenticated request + await this.dataSource.query( + `UPDATE iam.sessions SET expiry_time = NOW() + ($1 * INTERVAL '1 minute') WHERE id = $2 AND status = 'ACTIVE'`, + [this.inactivityMinutes, sessionId], + ); } } diff --git a/apps/edr-passenger-api/src/common/jwt.guard.ts b/apps/edr-passenger-api/src/common/jwt.guard.ts index f65f8455d..dfdeed190 100644 --- a/apps/edr-passenger-api/src/common/jwt.guard.ts +++ b/apps/edr-passenger-api/src/common/jwt.guard.ts @@ -1,5 +1,4 @@ -import { Injectable } from '@nestjs/common'; -import { AuthGuard } from '@nestjs/passport'; - -@Injectable() -export class JwtGuard extends AuthGuard('jwt') {} +// Compatibility alias while passenger auth moves to @tria-plc IAM. +// Existing controllers can keep importing `../../common/jwt.guard`, but the +// guard now validates IAM-issued session tokens from `iam.sessions`. +export { JwtGuard } from '@tria-plc/api-common/modules/auth/services/jwt.guard'; diff --git a/apps/edr-passenger-api/src/common/jwt.strategy.ts b/apps/edr-passenger-api/src/common/jwt.strategy.ts deleted file mode 100644 index c1f532ba1..000000000 --- a/apps/edr-passenger-api/src/common/jwt.strategy.ts +++ /dev/null @@ -1,19 +0,0 @@ -import { Injectable } from '@nestjs/common'; -import { PassportStrategy } from '@nestjs/passport'; -import { ExtractJwt, Strategy } from 'passport-jwt'; -import { ConfigService } from '@nestjs/config'; - -@Injectable() -export class JwtStrategy extends PassportStrategy(Strategy) { - constructor(config: ConfigService) { - const secret = config.get('JWT_SECRET'); - if (!secret) throw new Error('JWT_SECRET environment variable is not set'); - super({ - jwtFromRequest: ExtractJwt.fromAuthHeaderAsBearerToken(), - secretOrKey: secret, - }); - } - async validate(payload: any) { - return { userId: payload.sub, email: payload.email, role: payload.role, passengerId: payload.passengerId }; - } -} diff --git a/apps/edr-passenger-api/src/common/passenger-guards.ts b/apps/edr-passenger-api/src/common/passenger-guards.ts new file mode 100644 index 000000000..cadd56889 --- /dev/null +++ b/apps/edr-passenger-api/src/common/passenger-guards.ts @@ -0,0 +1,14 @@ +import { applyDecorators, UseGuards } from '@nestjs/common'; +import { JwtGuard } from '@tria-plc/api-common/modules/auth/services/jwt.guard'; +import { PassengerPermissionGuard } from './passenger-permission.guard'; +import { PASSENGER_PERMS } from '../seed/passenger-permissions.registry'; + +export const PassengerStaff = (permission: string | string[]) => + applyDecorators( + UseGuards( + JwtGuard, + PassengerPermissionGuard(Array.isArray(permission) ? permission : [permission]), + ), + ); + +export const PassengerAdmin = () => PassengerStaff(PASSENGER_PERMS.admin); diff --git a/apps/edr-passenger-api/src/common/passenger-permission.guard.ts b/apps/edr-passenger-api/src/common/passenger-permission.guard.ts new file mode 100644 index 000000000..a93b2060b --- /dev/null +++ b/apps/edr-passenger-api/src/common/passenger-permission.guard.ts @@ -0,0 +1,30 @@ +import { + CanActivate, + ExecutionContext, + ForbiddenException, + Injectable, + Type, + UnauthorizedException, +} from '@nestjs/common'; +import { hasPassengerPermission } from './passenger-permission.util'; + +export function PassengerPermissionGuard(permissions: string[]): Type { + @Injectable() + class PassengerPermissionsGuard implements CanActivate { + canActivate(context: ExecutionContext): boolean { + const request = context.switchToHttp().getRequest<{ user?: any }>(); + const user = request.user; + + if (!permissions?.length) return true; + if (!user) throw new UnauthorizedException('Authentication required'); + + if (permissions.some((p) => hasPassengerPermission(user, p))) return true; + + throw new ForbiddenException( + `Missing permission. Required one of: ${permissions.join(', ')}`, + ); + } + } + + return PassengerPermissionsGuard; +} diff --git a/apps/edr-passenger-api/src/common/passenger-permission.util.ts b/apps/edr-passenger-api/src/common/passenger-permission.util.ts new file mode 100644 index 000000000..62df74603 --- /dev/null +++ b/apps/edr-passenger-api/src/common/passenger-permission.util.ts @@ -0,0 +1,74 @@ +import { ForbiddenException } from '@nestjs/common'; + +const SUPER_ADMIN_ROLE = 'super_admin'; +const ORGANIZATION_ADMIN_ROLE = 'organization_admin'; + +type PermissionLike = { key?: string }; +type MeLikeUser = { + roles?: { key?: string }[]; + permissions?: PermissionLike[]; + employee?: + | { position?: { permissions?: PermissionLike[] }; delegatedPositions?: { permissions?: PermissionLike[] }[] } + | { positions?: { permissions?: PermissionLike[] }[] }[] + | null; +}; + +export function isSuperAdmin(user: MeLikeUser | null | undefined): boolean { + return user?.roles?.some((r) => r.key === SUPER_ADMIN_ROLE) ?? false; +} + +export function isOrganizationAdmin(user: MeLikeUser | null | undefined): boolean { + return user?.roles?.some((r) => r.key === ORGANIZATION_ADMIN_ROLE) ?? false; +} + +export function collectPermissionKeys(user: MeLikeUser | null | undefined): string[] { + if (!user) return []; + + const keys = new Set(); + + for (const p of user.permissions ?? []) { + if (p.key) keys.add(p.key); + } + + const employee = user.employee; + if (!employee) return [...keys]; + + if (Array.isArray(employee)) { + for (const emp of employee) { + for (const pos of emp.positions ?? []) { + for (const p of pos.permissions ?? []) { + if (p.key) keys.add(p.key); + } + } + } + return [...keys]; + } + + for (const p of employee.position?.permissions ?? []) { + if (p.key) keys.add(p.key); + } + for (const delegated of employee.delegatedPositions ?? []) { + for (const p of delegated.permissions ?? []) { + if (p.key) keys.add(p.key); + } + } + + return [...keys]; +} + +export function hasPassengerPermission( + user: MeLikeUser | null | undefined, + permissionKey: string, +): boolean { + if (!user) return false; + if (isSuperAdmin(user) || isOrganizationAdmin(user)) return true; + return collectPermissionKeys(user).includes(permissionKey); +} + +export function assertPassengerPermission( + user: MeLikeUser | null | undefined, + permissionKey: string, +): void { + if (hasPassengerPermission(user, permissionKey)) return; + throw new ForbiddenException(`Missing permission: ${permissionKey}`); +} diff --git a/apps/edr-passenger-api/src/common/roles.decorator.ts b/apps/edr-passenger-api/src/common/roles.decorator.ts index ec0c377c6..e038e1682 100644 --- a/apps/edr-passenger-api/src/common/roles.decorator.ts +++ b/apps/edr-passenger-api/src/common/roles.decorator.ts @@ -1,5 +1,4 @@ import { SetMetadata } from '@nestjs/common'; -import { UserRole } from '@prisma/client'; export const ROLES_KEY = 'roles'; -export const Roles = (...roles: UserRole[]) => SetMetadata(ROLES_KEY, roles); +export const Roles = (...roles: string[]) => SetMetadata(ROLES_KEY, roles); diff --git a/apps/edr-passenger-api/src/common/roles.guard.ts b/apps/edr-passenger-api/src/common/roles.guard.ts index 7b4b3eafc..b654bfa28 100644 --- a/apps/edr-passenger-api/src/common/roles.guard.ts +++ b/apps/edr-passenger-api/src/common/roles.guard.ts @@ -1,6 +1,5 @@ import { Injectable, CanActivate, ExecutionContext } from '@nestjs/common'; import { Reflector } from '@nestjs/core'; -import { UserRole } from '@prisma/client'; import { ROLES_KEY } from './roles.decorator'; @Injectable() @@ -8,12 +7,15 @@ export class RolesGuard implements CanActivate { constructor(private reflector: Reflector) {} canActivate(context: ExecutionContext): boolean { - const requiredRoles = this.reflector.getAllAndOverride(ROLES_KEY, [ + const requiredRoles = this.reflector.getAllAndOverride(ROLES_KEY, [ context.getHandler(), context.getClass(), ]); if (!requiredRoles) return true; const { user } = context.switchToHttp().getRequest(); - return requiredRoles.some((role) => user?.role === role); + // Support IAM roles array [{key, id}][] and legacy role string + return requiredRoles.some( + (role) => user?.roles?.some((r: { key: string }) => r.key === role) || user?.role === role, + ); } } diff --git a/apps/edr-passenger-api/src/config/iam-database.config.ts b/apps/edr-passenger-api/src/config/iam-database.config.ts new file mode 100644 index 000000000..4223a01c3 --- /dev/null +++ b/apps/edr-passenger-api/src/config/iam-database.config.ts @@ -0,0 +1,18 @@ +import { registerAs } from '@nestjs/config'; +import { TypeOrmModuleOptions } from '@nestjs/typeorm'; +import { buildIamTypeOrmOptions } from '../common/iam-typeorm.config'; + +/** + * Dedicated config namespace for the IAM **TypeORM** connection — the shared `iam` schema ONLY. + * + * This is intentionally separate from Prisma: Prisma remains the app's primary ORM and owns the + * `passenger` schema via `DATABASE_URL` (see prisma.service.ts). This second connection exists + * solely because `@tria-plc/api-common` / `@tria-plc/iamapi-common` are TypeORM-based and the + * `JwtGuard` reads `iam.sessions` through a TypeORM `DataSource`. + * + * Consumed by `TypeOrmModule.forRootAsync` in app.module.ts. + */ +export default registerAs( + 'iamDatabase', + (): TypeOrmModuleOptions => buildIamTypeOrmOptions(), +); diff --git a/apps/edr-passenger-api/src/main.ts b/apps/edr-passenger-api/src/main.ts index 928789c04..dae085bc4 100644 --- a/apps/edr-passenger-api/src/main.ts +++ b/apps/edr-passenger-api/src/main.ts @@ -1,6 +1,10 @@ +// Load .env into process.env BEFORE the module graph is built. Required because the @tria-plc IAM +// modules read process.env at module-load time (e.g. MinioModule.register reads MINIO_ENDPOINT), +// which happens before ConfigModule.forRoot() would populate it. Must be the very first import. +import "dotenv/config"; import "reflect-metadata"; import { NestFactory } from "@nestjs/core"; -import { ValidationPipe } from "@nestjs/common"; +import { ValidationPipe, VersioningType } from "@nestjs/common"; import { DocumentBuilder, SwaggerModule } from "@nestjs/swagger"; import { AppModule } from "./app.module"; import { HttpExceptionFilter } from "./common/filters/http-exception.filter"; @@ -12,6 +16,11 @@ async function bootstrap() { // (e.g. Waafi HMAC verification) can sign over the exact bytes the provider signed. const app = await NestFactory.create(AppModule, { rawBody: true }); + // URI versioning: the @tria-plc IAM controllers declare `version: "1"` so they register under + // `/v1/...` (e.g. /v1/auth/login). Passenger controllers declare no version, so they stay + // version-neutral at their existing paths (e.g. /search, /bookings) — unchanged for the frontend. + app.enableVersioning({ type: VersioningType.URI }); + app.enableCors({ origin: [ process.env.PORTAL_URL ?? "http://localhost:5174", diff --git a/apps/edr-passenger-api/src/modules/agents/agents.controller.ts b/apps/edr-passenger-api/src/modules/agents/agents.controller.ts index aa23fe6d0..378a2a361 100644 --- a/apps/edr-passenger-api/src/modules/agents/agents.controller.ts +++ b/apps/edr-passenger-api/src/modules/agents/agents.controller.ts @@ -2,39 +2,37 @@ import { Body, Controller, Get, Param, Post, Query, UseGuards } from '@nestjs/co import { ApiTags, ApiOperation, ApiBearerAuth } from '@nestjs/swagger'; import { AgentsService } from './agents.service'; import { CreateAgentBookingDto, OpenShiftDto, CloseShiftDto } from './agents.dto'; -import { IamGuard, IamRoles } from '../../common/iam-adapter'; -import { UserRole } from '@prisma/client'; +// IAM auth: validate the IAM session token via @tria-plc/api-common's DB-backed JwtGuard. +import { JwtGuard as IamJwtGuard } from '@tria-plc/api-common/modules/auth/services/jwt.guard'; @ApiTags('Agents') @Controller('agents') -@UseGuards(IamGuard) +// TODO(iam-authz): restrict per route via @UseGuards(PermissionGuard([...])) once the IAM +// role→permission mapping (EIamPermissionKey) is confirmed. For now: authenticated IAM users only. +@UseGuards(IamJwtGuard) @ApiBearerAuth('IAM-auth') export class AgentsController { constructor(private service: AgentsService) {} @Post('bookings') - @IamRoles('AGENT', 'ADMIN') @ApiOperation({ summary: 'Create agent booking with cash payment' }) createBooking(@Body() dto: CreateAgentBookingDto) { return this.service.createAgentBooking(dto); } @Post('shifts/open') - @IamRoles('AGENT', 'ADMIN') @ApiOperation({ summary: 'Open agent shift' }) openShift(@Body() dto: OpenShiftDto) { return this.service.openShift(dto); } @Post('shifts/close') - @IamRoles('AGENT', 'ADMIN') @ApiOperation({ summary: 'Close agent shift' }) closeShift(@Body() dto: CloseShiftDto) { return this.service.closeShift(dto); } @Get(':agentId/commissions') - @IamRoles('AGENT', 'ADMIN') @ApiOperation({ summary: 'Get agent commissions' }) getCommissions( @Param('agentId') agentId: string, @@ -49,7 +47,6 @@ export class AgentsController { } @Get(':agentId/shifts') - @IamRoles('AGENT', 'ADMIN') @ApiOperation({ summary: 'Get agent shifts' }) getShifts(@Param('agentId') agentId: string) { return this.service.getShifts(agentId); diff --git a/apps/edr-passenger-api/src/modules/agents/agents.service.ts b/apps/edr-passenger-api/src/modules/agents/agents.service.ts index 12982f570..1cee0b4e4 100644 --- a/apps/edr-passenger-api/src/modules/agents/agents.service.ts +++ b/apps/edr-passenger-api/src/modules/agents/agents.service.ts @@ -13,9 +13,13 @@ export class AgentsService { constructor(private prisma: PrismaService) {} async createAgentBooking(dto: CreateAgentBookingDto) { - const agent = await this.prisma.agent.findUnique({ where: { id: dto.agentId }, include: { user: { include: { passenger: true } } } }); + const agent = await this.prisma.agent.findUnique({ where: { id: dto.agentId } }); if (!agent || !agent.active) throw new NotFoundException('Agent not found or inactive'); - if (!agent.user.passenger) throw new BadRequestException('Agent must have passenger account'); + + const passenger = agent.iamUserId + ? await this.prisma.passenger.findUnique({ where: { iamUserId: agent.iamUserId } }) + : null; + if (!passenger) throw new BadRequestException('Agent must have a linked passenger account'); const schedule = await this.prisma.trainSchedule.findUnique({ where: { id: dto.scheduleId } }); if (!schedule) throw new NotFoundException('Schedule not found'); @@ -30,7 +34,7 @@ export class AgentsService { const booking = await this.prisma.booking.create({ data: { bookingRef: generateRef(), - passengerId: agent.user.passenger.id, + passengerId: passenger.id, scheduleId: dto.scheduleId, status: dto.paymentMethod === 'CASH' ? 'CONFIRMED' : 'PENDING_PAYMENT', totalMinor, diff --git a/apps/edr-passenger-api/src/modules/audit/audit.controller.ts b/apps/edr-passenger-api/src/modules/audit/audit.controller.ts index 37bc89855..1202e4d45 100644 --- a/apps/edr-passenger-api/src/modules/audit/audit.controller.ts +++ b/apps/edr-passenger-api/src/modules/audit/audit.controller.ts @@ -1,11 +1,12 @@ -import { Controller, Get, Param, Query, UseGuards } from '@nestjs/common'; +import { Controller, Get, Param, Query } from '@nestjs/common'; import { ApiTags, ApiOperation, ApiBearerAuth, ApiQuery } from '@nestjs/swagger'; import { AuditService } from '../../common/audit.service'; -import { IamGuard } from '../../common/iam-adapter'; +import { PassengerStaff } from '../../common/passenger-guards'; +import { PASSENGER_PERMS } from '../../seed/passenger-permissions.registry'; @ApiTags('Audit') @Controller('audit') -@UseGuards(IamGuard) +@PassengerStaff([PASSENGER_PERMS.audit.view, PASSENGER_PERMS.admin]) @ApiBearerAuth('IAM-auth') export class AuditController { constructor(private auditService: AuditService) {} diff --git a/apps/edr-passenger-api/src/modules/auth/auth.controller.ts b/apps/edr-passenger-api/src/modules/auth/auth.controller.ts index 0565faf8f..8d3e0e4ca 100644 --- a/apps/edr-passenger-api/src/modules/auth/auth.controller.ts +++ b/apps/edr-passenger-api/src/modules/auth/auth.controller.ts @@ -1,303 +1,69 @@ -import { Body, Controller, Post, HttpCode, HttpStatus, UseGuards, Get, Request, UnauthorizedException, Param, Patch, Delete, Query } from '@nestjs/common'; +import { Body, Controller, Post, HttpCode, HttpStatus, UseGuards, Get, Request, UnauthorizedException } from '@nestjs/common'; import { ApiTags, ApiOperation, ApiResponse, ApiBody, ApiBearerAuth } from '@nestjs/swagger'; -import { AuthService } from './auth.service'; -import { RegisterDto, LoginDto, RequestOtpDto, VerifyOtpDto, RequestPasswordResetDto, ResetPasswordDto } from './auth.dto'; +import { IsPublic } from '@tria-plc/api-common/modules/auth/decorators/public.decorator'; +import { PassengerAuthService } from './passenger-auth.service'; +import { RegisterDto, LoginDto } from './auth.dto'; import { JwtGuard } from '../../common/jwt.guard'; -import { RolesGuard } from '../../common/roles.guard'; -import { Roles } from '../../common/roles.decorator'; -import { UserRole } from '@prisma/client'; @ApiTags('Auth') @Controller('auth') export class AuthController { - constructor(private service: AuthService) {} + constructor(private passengerAuthService: PassengerAuthService) {} @Post('register') - @ApiOperation({ - summary: 'Register new passenger account', - description: 'Create a new passenger account with email, phone, and password. Returns user details and JWT token for immediate login.' - }) - @ApiResponse({ status: 201, description: 'Account created successfully. Returns user object and JWT token.' }) - @ApiResponse({ status: 400, description: 'Validation error (invalid email, weak password, etc.)' }) + @IsPublic() + @ApiOperation({ summary: 'Register new passenger account' }) + @ApiResponse({ status: 201, description: 'Account created. Returns token + user.' }) @ApiResponse({ status: 409, description: 'Email or phone already registered' }) @ApiBody({ type: RegisterDto }) - register(@Body() dto: RegisterDto) { return this.service.register(dto); } + register(@Request() req: any, @Body() dto: RegisterDto) { + return this.passengerAuthService.register(dto, req); + } @Post('login') + @IsPublic() @HttpCode(HttpStatus.OK) - @ApiOperation({ - summary: 'Login with email and password', - description: 'Authenticate user and receive JWT token. Token expires in 7 days by default. Failed login attempts are tracked and account may be locked after 5 consecutive failures.' - }) - @ApiResponse({ status: 200, description: 'Login successful. Returns JWT token and user details.' }) - @ApiResponse({ status: 401, description: 'Invalid credentials or account locked' }) - @ApiResponse({ status: 403, description: 'Account temporarily blocked due to fraud detection' }) + @ApiOperation({ summary: 'Login with email and password' }) + @ApiResponse({ status: 200, description: 'Login successful. Returns token + passengerId.' }) + @ApiResponse({ status: 401, description: 'Invalid credentials' }) @ApiBody({ type: LoginDto }) - login(@Body() dto: LoginDto) { return this.service.login(dto); } - - @Post('otp/request') - @HttpCode(HttpStatus.OK) - @ApiOperation({ - summary: 'Request OTP verification code', - description: 'Send a 6-digit OTP code to user email. Code expires in 10 minutes. Used for registration verification, password reset, or two-factor authentication.' - }) - @ApiResponse({ status: 200, description: 'OTP sent successfully to email' }) - @ApiResponse({ status: 404, description: 'Email not found (for PASSWORD_RESET purpose)' }) - @ApiResponse({ status: 429, description: 'Too many OTP requests. Please wait before requesting again.' }) - @ApiBody({ type: RequestOtpDto }) - requestOtp(@Body() dto: RequestOtpDto) { return this.service.requestOtp(dto); } - - @Post('otp/verify') - @HttpCode(HttpStatus.OK) - @ApiOperation({ - summary: 'Verify OTP code', - description: 'Validate the 6-digit OTP code sent to user email. Code must match and not be expired.' - }) - @ApiResponse({ status: 200, description: 'OTP verified successfully' }) - @ApiResponse({ status: 400, description: 'Invalid or expired OTP code' }) - @ApiResponse({ status: 404, description: 'No OTP found for this email and purpose' }) - @ApiBody({ type: VerifyOtpDto }) - verifyOtp(@Body() dto: VerifyOtpDto) { return this.service.verifyOtp(dto); } - - @Post('password/reset-request') - @HttpCode(HttpStatus.OK) - @ApiOperation({ - summary: 'Request password reset link', - description: 'Send password reset link to user email. Link contains a secure token valid for 1 hour.' - }) - @ApiResponse({ status: 200, description: 'Password reset email sent successfully' }) - @ApiResponse({ status: 404, description: 'Email not found' }) - @ApiResponse({ status: 429, description: 'Too many reset requests. Please wait before trying again.' }) - @ApiBody({ type: RequestPasswordResetDto }) - requestPasswordReset(@Body() dto: RequestPasswordResetDto) { return this.service.requestPasswordReset(dto); } - - @Post('password/reset') - @HttpCode(HttpStatus.OK) - @ApiOperation({ - summary: 'Reset password with token', - description: 'Reset user password using the token received via email. Token is single-use and expires after 1 hour.' - }) - @ApiResponse({ status: 200, description: 'Password reset successfully' }) - @ApiResponse({ status: 400, description: 'Invalid, expired, or already used token' }) - @ApiResponse({ status: 404, description: 'User not found' }) - @ApiBody({ type: ResetPasswordDto }) - resetPassword(@Body() dto: ResetPasswordDto) { return this.service.resetPassword(dto); } + login(@Request() req: any, @Body() dto: LoginDto) { + return this.passengerAuthService.login(dto, req); + } @Post('logout') @HttpCode(HttpStatus.OK) @UseGuards(JwtGuard) @ApiBearerAuth('JWT-auth') - @ApiOperation({ - summary: 'Logout current user', - description: `Logout the authenticated user and invalidate their session. + @ApiOperation({ summary: 'Logout current user' }) + @ApiResponse({ status: 200, description: 'Logout successful' }) + @ApiResponse({ status: 401, description: 'Unauthorized' }) + logout(@Request() req: any) { + if (!req.user?.id) throw new UnauthorizedException('User not authenticated'); + return this.passengerAuthService.logout(req.user, req); + } -### What happens: -- Invalidates the current session token -- Records logout in audit log -- Frontend should clear stored token and redirect to home - -### Authentication: -- **Required**: JWT Bearer Token -- Token will be invalidated after successful logout` - }) - @ApiResponse({ - status: 200, - description: 'Logout successful', - schema: { - example: { - success: true, - message: 'Logged out successfully' - } - } - }) - @ApiResponse({ status: 401, description: 'Unauthorized - Invalid or missing token' }) - logout(@Request() req: any) { - if (!req.user || !req.user.userId) { - throw new UnauthorizedException('User not authenticated'); - } - return this.service.logout(req.user.userId); + @Get('me') + @UseGuards(JwtGuard) + @ApiBearerAuth('JWT-auth') + @ApiOperation({ summary: '[DEV] Inspect raw JWT payload — shows full req.user from JwtGuard' }) + @ApiResponse({ status: 200, description: 'Returns the full req.user object set by JwtGuard' }) + @ApiResponse({ status: 401, description: 'Unauthorized' }) + getMe(@Request() req: any) { + return { user: req.user }; } @Get('profile') @UseGuards(JwtGuard) @ApiBearerAuth('JWT-auth') - @ApiOperation({ - summary: 'Get current user profile', - description: `**Returns complete user profile with all connected data** - ---- - -### Response Includes - -#### User Information -- Basic details (id, email, phone, fullName, role) -- Nationality and document information -- Fayda verification status -- Account timestamps (created, last login) - -#### Passenger Data (if role=PASSENGER) -- Passenger ID and preferences -- **Loyalty Account**: Tier, points balance, lifetime points -- **Wallet Account**: Balance (minor units), currency - -#### Devices -- List of registered devices with platform, name, push token, and last seen time - -#### User Preferences -- Language, notification settings, etc. - ---- - -### Use Cases - -1. **App Initialization**: Fetch on app load to get user context - -2. **Profile Pre-fill**: Use data to auto-fill booking forms - -3. **Verification Check**: Check \`faydaVerified\` before registration - -4. **Loyalty Display**: Show tier and points in UI - -5. **Wallet Balance**: Display available balance - -6. **Device Management**: Get list of user's registered devices - ---- - -### Authentication -- **Required**: JWT Bearer Token -- Token must be valid and not expired -- Returns profile for authenticated user only`, - }) - @ApiResponse({ - status: 200, - description: 'User profile retrieved successfully', - schema: { - example: { - id: 'user-uuid-123', - email: 'kelemu@email.com', - phone: '+251911234567', - fullName: 'Kelemu Abebe', - role: 'PASSENGER', - nationality: 'Ethiopian', - nationalityCode: 'ET', - nationalId: null, - passportNumber: null, - faydaVerified: true, - faydaVerifiedAt: '2024-01-15T10:30:00.000Z', - lastLoginAt: '2024-01-20T14:22:00.000Z', - createdAt: '2023-12-01T08:00:00.000Z', - passenger: { - id: 'passenger-uuid-456', - preferredLanguage: 'am', - loyalty: { - tier: 'SILVER', - pointsBalance: 1500, - lifetimePoints: 3000 - }, - wallet: { - balanceMinor: 50000, - currency: 'ETB' - } - }, - preferences: { - emailNotifications: true, - smsNotifications: true, - language: 'am' - }, - devices: [ - { - id: 'device-uuid-1', - platform: 'WEB', - name: 'Chrome on Windows', - pushToken: 'token-abc123', - trusted: true, - lastSeenAt: '2024-01-20T14:22:00.000Z' - }, - { - id: 'device-uuid-2', - platform: 'IOS', - name: 'iPhone 14', - pushToken: 'token-xyz789', - trusted: false, - lastSeenAt: '2024-01-19T10:15:00.000Z' - } - ] - } - } - }) - @ApiResponse({ - status: 401, - description: 'Unauthorized - Invalid or missing JWT token', - schema: { - example: { - statusCode: 401, - message: 'Unauthorized' - } - } - }) - getProfile(@Request() req: any) { - console.log('Profile request - User from JWT:', req.user); - if (!req.user || !req.user.userId) { - throw new UnauthorizedException('User not authenticated'); - } - return this.service.getProfile(req.user.userId); + @ApiOperation({ summary: 'Get current user profile' }) + @ApiResponse({ status: 200, description: 'User profile retrieved successfully' }) + @ApiResponse({ status: 401, description: 'Unauthorized' }) + getProfile(@Request() req: any) { + const userId = req.user?.id; + if (!userId) throw new UnauthorizedException('User not authenticated'); + return this.passengerAuthService.getProfile(userId); } - @Get('users') - @UseGuards(JwtGuard, RolesGuard) - @Roles(UserRole.ADMIN, UserRole.SUPERVISOR) - @ApiBearerAuth('JWT-auth') - @ApiOperation({ summary: 'Get all backoffice users (admin/supervisor only)' }) - getUsers( - @Query('search') search?: string, - @Query('role') role?: string, - @Query('status') status?: string, - @Query('page') page?: string, - @Query('pageSize') pageSize?: string, - ) { - return this.service.getUsers({ - search, - role, - status, - page: page ? parseInt(page) : 1, - pageSize: pageSize ? parseInt(pageSize) : 10, - }); - } - - @Post('users') - @UseGuards(JwtGuard, RolesGuard) - @Roles(UserRole.ADMIN, UserRole.SUPERVISOR) - @ApiBearerAuth('JWT-auth') - @ApiOperation({ summary: 'Create new backoffice user (admin/supervisor only)' }) - createUser(@Body() dto: any) { - return this.service.createUser(dto); - } - - @Patch('users/:id') - @UseGuards(JwtGuard, RolesGuard) - @Roles(UserRole.ADMIN, UserRole.SUPERVISOR) - @ApiBearerAuth('JWT-auth') - @ApiOperation({ summary: 'Update backoffice user (admin/supervisor only)' }) - updateUser(@Param('id') id: string, @Body() dto: any) { - return this.service.updateUser(id, dto); - } - - @Delete('users/:id') - @UseGuards(JwtGuard, RolesGuard) - @Roles(UserRole.ADMIN) - @ApiBearerAuth('JWT-auth') - @ApiOperation({ summary: 'Delete backoffice user (admin only)' }) - deleteUser(@Param('id') id: string) { - return this.service.deleteUser(id); - } - - @Post('users/:id/reset-password') - @UseGuards(JwtGuard, RolesGuard) - @Roles(UserRole.ADMIN, UserRole.SUPERVISOR) - @ApiBearerAuth('JWT-auth') - @ApiOperation({ summary: 'Reset user password with temporary password (admin/supervisor only)' }) - resetUserPassword(@Param('id') id: string, @Body() dto: { tempPassword: string }) { - return this.service.resetUserPassword(id, dto.tempPassword); - } + // TODO: admin user management endpoints — implement when admin module is ready } diff --git a/apps/edr-passenger-api/src/modules/auth/auth.dto.ts b/apps/edr-passenger-api/src/modules/auth/auth.dto.ts index d44159c67..e12c8cd06 100644 --- a/apps/edr-passenger-api/src/modules/auth/auth.dto.ts +++ b/apps/edr-passenger-api/src/modules/auth/auth.dto.ts @@ -1,152 +1,51 @@ -import { IsEmail, IsString, MinLength, IsOptional } from 'class-validator'; -import { ApiProperty, ApiPropertyOptional } from '@nestjs/swagger'; +import { IsEmail, IsString, MinLength, ValidateNested } from 'class-validator'; +import { Type } from 'class-transformer'; +import { ApiProperty } from '@nestjs/swagger'; + +export class NameDto { + @ApiProperty({ example: 'ቀለሙ ቀጸላ' }) + @IsString() + am: string; + + @ApiProperty({ example: 'Kelemu Ketsela' }) + @IsString() + en: string; +} export class RegisterDto { - @ApiProperty({ - description: 'Full name of the passenger', - example: 'Kelemu Ketsela', - minLength: 2, - maxLength: 100 - }) - @IsString() - fullName: string; - - @ApiProperty({ - description: 'Email address (must be unique)', - example: 'kelemu@email.com', - format: 'email' - }) - @IsEmail() + @ApiProperty({ example: 'kelemu@email.com' }) + @IsEmail() email: string; - @ApiProperty({ - description: 'Phone number with country code', - example: '+251912345678', - pattern: '^\\+[1-9]\\d{1,14}$' - }) - @IsString() - phone: string; + @ApiProperty({ example: 'kelemu.ketsela' }) + @IsString() + username: string; - @ApiProperty({ - description: 'Password (minimum 8 characters)', - example: 'SecurePass123', - minLength: 8, - format: 'password' - }) - @IsString() - @MinLength(8) + @ApiProperty({ example: '+251912345678' }) + @IsString() + phoneNumber: string; + + @ApiProperty({ type: NameDto }) + @ValidateNested() + @Type(() => NameDto) + name: NameDto; + + @ApiProperty({ example: 'SecurePass123', minLength: 8, format: 'password' }) + @IsString() + @MinLength(8) password: string; - @ApiPropertyOptional({ - description: 'Nationality of the passenger', - example: 'Ethiopian' - }) - @IsOptional() - @IsString() - nationality?: string; - - @ApiPropertyOptional({ - description: 'National ID number', - example: 'ET123456789' - }) - @IsOptional() - @IsString() - nationalId?: string; - - @ApiPropertyOptional({ - description: 'Passport number for international travelers', - example: 'P1234567' - }) - @IsOptional() - @IsString() - passportNumber?: string; + @ApiProperty({ example: 'SecurePass123', format: 'password' }) + @IsString() + confirmPassword: string; } export class LoginDto { - @ApiProperty({ - description: 'Registered email address', - example: 'kelemu@email.com', - format: 'email' - }) - @IsEmail() + @ApiProperty({ example: 'kelemu@email.com' }) + @IsEmail() email: string; - @ApiProperty({ - description: 'Account password', - example: 'password123', - format: 'password' - }) - @IsString() + @ApiProperty({ example: 'password123', format: 'password' }) + @IsString() password: string; } - -export class RequestOtpDto { - @ApiProperty({ - description: 'Email address to send OTP', - example: 'kelemu@email.com' - }) - @IsEmail() - email: string; - - @ApiProperty({ - description: 'Purpose of OTP (REGISTRATION, PASSWORD_RESET, VERIFICATION)', - example: 'REGISTRATION', - enum: ['REGISTRATION', 'PASSWORD_RESET', 'VERIFICATION'] - }) - @IsString() - purpose: string; -} - -export class VerifyOtpDto { - @ApiProperty({ - description: 'Email address', - example: 'kelemu@email.com' - }) - @IsEmail() - email: string; - - @ApiProperty({ - description: '6-digit OTP code', - example: '123456', - minLength: 6, - maxLength: 6 - }) - @IsString() - code: string; - - @ApiProperty({ - description: 'Purpose of OTP verification', - example: 'REGISTRATION', - enum: ['REGISTRATION', 'PASSWORD_RESET', 'VERIFICATION'] - }) - @IsString() - purpose: string; -} - -export class RequestPasswordResetDto { - @ApiProperty({ - description: 'Email address of the account', - example: 'kelemu@email.com' - }) - @IsEmail() - email: string; -} - -export class ResetPasswordDto { - @ApiProperty({ - description: 'Password reset token received via email', - example: 'eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...' - }) - @IsString() - token: string; - - @ApiProperty({ - description: 'New password (minimum 8 characters)', - example: 'NewSecurePass123', - minLength: 8, - format: 'password' - }) - @IsString() - @MinLength(8) - newPassword: string; -} diff --git a/apps/edr-passenger-api/src/modules/auth/auth.module.ts b/apps/edr-passenger-api/src/modules/auth/auth.module.ts index 547937d74..54357df06 100644 --- a/apps/edr-passenger-api/src/modules/auth/auth.module.ts +++ b/apps/edr-passenger-api/src/modules/auth/auth.module.ts @@ -1,24 +1,10 @@ import { Module } from '@nestjs/common'; -import { JwtModule } from '@nestjs/jwt'; -import { PassportModule } from '@nestjs/passport'; -import { ConfigService } from '@nestjs/config'; import { AuthController } from './auth.controller'; -import { AuthService } from './auth.service'; -import { JwtStrategy } from '../../common/jwt.strategy'; +import { PassengerAuthService } from './passenger-auth.service'; @Module({ - imports: [ - PassportModule, - JwtModule.registerAsync({ - inject: [ConfigService], - useFactory: (c: ConfigService) => ({ - secret: c.get('JWT_SECRET'), - signOptions: { expiresIn: c.get('JWT_EXPIRES_IN', '7d') }, - }), - }), - ], controllers: [AuthController], - providers: [AuthService, JwtStrategy], - exports: [JwtModule], + providers: [PassengerAuthService], + exports: [PassengerAuthService], }) export class AuthModule {} diff --git a/apps/edr-passenger-api/src/modules/auth/auth.service.ts b/apps/edr-passenger-api/src/modules/auth/auth.service.ts deleted file mode 100644 index e937a106b..000000000 --- a/apps/edr-passenger-api/src/modules/auth/auth.service.ts +++ /dev/null @@ -1,410 +0,0 @@ -import { Injectable, UnauthorizedException, ConflictException, BadRequestException, NotFoundException } from '@nestjs/common'; -import { JwtService } from '@nestjs/jwt'; -import { PrismaService } from '../../common/prisma.service'; -import { RegisterDto, LoginDto, RequestOtpDto, VerifyOtpDto, RequestPasswordResetDto, ResetPasswordDto } from './auth.dto'; -import * as bcrypt from 'bcrypt'; -import * as crypto from 'crypto'; - -@Injectable() -export class AuthService { - constructor(private prisma: PrismaService, private jwt: JwtService) {} - - async register(dto: RegisterDto) { - const exists = await this.prisma.user.findFirst({ - where: { OR: [{ email: dto.email }, { phone: dto.phone }] }, - }); - if (exists) throw new ConflictException('Email or phone already registered'); - const passwordHash = await bcrypt.hash(dto.password, 10); - const user = await this.prisma.user.create({ - data: { - fullName: dto.fullName, - email: dto.email, - phone: dto.phone, - passwordHash, - nationality: dto.nationality, - nationalId: dto.nationalId, - passportNumber: dto.passportNumber - }, - }); - const passenger = await this.prisma.passenger.create({ data: { userId: user.id } }); - await this.prisma.loyaltyAccount.create({ data: { passengerId: passenger.id } }); - await this.prisma.walletAccount.create({ data: { passengerId: passenger.id } }); - await this.prisma.userPreferences.create({ data: { userId: user.id } }); - await this.createAuditLog(user.id, 'USER_REGISTERED', 'User', user.id, null, { email: user.email }); - return await this.signToken(user.id, user.email, user.role, passenger.id); - } - - async login(dto: LoginDto) { - const user = await this.prisma.user.findUnique({ - where: { email: dto.email }, - include: { passenger: true, agent: true }, - }); - if (!user) throw new UnauthorizedException('Invalid credentials'); - - if (user.lockedUntil && user.lockedUntil > new Date()) { - throw new UnauthorizedException(`Account locked until ${user.lockedUntil.toISOString()}`); - } - - if (!(await bcrypt.compare(dto.password, user.passwordHash))) { - await this.prisma.user.update({ - where: { id: user.id }, - data: { - failedLoginAttempts: { increment: 1 }, - lockedUntil: user.failedLoginAttempts >= 4 ? new Date(Date.now() + 15 * 60 * 1000) : null - } - }); - throw new UnauthorizedException('Invalid credentials'); - } - - await this.prisma.user.update({ - where: { id: user.id }, - data: { failedLoginAttempts: 0, lockedUntil: null, lastLoginAt: new Date() } - }); - - await this.createAuditLog(user.id, 'USER_LOGIN', 'User', user.id, null, null); - - // Ensure passenger exists and get its ID - let passengerId = user.passenger?.id; - if (!passengerId) { - // If passenger doesn't exist, create it - const passenger = await this.prisma.passenger.create({ - data: { userId: user.id } - }); - passengerId = passenger.id; - // Also create loyalty and wallet accounts - await this.prisma.loyaltyAccount.create({ data: { passengerId: passenger.id } }); - await this.prisma.walletAccount.create({ data: { passengerId: passenger.id } }); - } - - return await this.signToken(user.id, user.email, user.role, passengerId, user.agent?.id); - } - - async requestOtp(dto: RequestOtpDto) { - const code = Math.floor(100000 + Math.random() * 900000).toString(); - const expiresAt = new Date(Date.now() + 10 * 60 * 1000); - await this.prisma.otpCode.create({ - data: { email: dto.email, code, purpose: dto.purpose, expiresAt } - }); - console.log(`[OTP] ${dto.email} - ${code} (${dto.purpose})`); - return { sent: true, expiresIn: 600 }; - } - - async verifyOtp(dto: VerifyOtpDto) { - const otp = await this.prisma.otpCode.findFirst({ - where: { email: dto.email, code: dto.code, purpose: dto.purpose, verified: false, expiresAt: { gt: new Date() } }, - orderBy: { createdAt: 'desc' } - }); - if (!otp) throw new BadRequestException('Invalid or expired OTP'); - await this.prisma.otpCode.update({ where: { id: otp.id }, data: { verified: true } }); - return { verified: true }; - } - - async requestPasswordReset(dto: RequestPasswordResetDto) { - const user = await this.prisma.user.findUnique({ where: { email: dto.email } }); - if (!user) return { sent: true }; - const token = crypto.randomBytes(32).toString('hex'); - const expiresAt = new Date(Date.now() + 60 * 60 * 1000); - await this.prisma.passwordResetToken.create({ - data: { userId: user.id, token, expiresAt } - }); - console.log(`[PASSWORD_RESET] ${dto.email} - ${token}`); - return { sent: true }; - } - - async resetPassword(dto: ResetPasswordDto) { - const resetToken = await this.prisma.passwordResetToken.findUnique({ - where: { token: dto.token } - }); - if (!resetToken || resetToken.used || resetToken.expiresAt < new Date()) { - throw new BadRequestException('Invalid or expired reset token'); - } - const passwordHash = await bcrypt.hash(dto.newPassword, 10); - await this.prisma.user.update({ - where: { id: resetToken.userId }, - data: { passwordHash, failedLoginAttempts: 0, lockedUntil: null } - }); - await this.prisma.passwordResetToken.update({ - where: { id: resetToken.id }, - data: { used: true } - }); - await this.createAuditLog(resetToken.userId, 'PASSWORD_RESET', 'User', resetToken.userId, null, null); - return { reset: true }; - } - - async getUsers(filters: { search?: string; role?: string; status?: string; page?: number; pageSize?: number }) { - const { search, role, status, page = 1, pageSize = 10 } = filters; - const skip = (page - 1) * pageSize; - - const where: any = { - role: { not: 'PASSENGER' }, // Exclude passenger accounts - }; - - if (search) { - where.OR = [ - { email: { contains: search, mode: 'insensitive' } }, - { fullName: { contains: search, mode: 'insensitive' } }, - ]; - } - - if (role) { - where.role = role; - } - - // For status filtering, we check if user is active (no lock/block) or inactive - if (status === 'ACTIVE') { - where.AND = [ - { blockedUntil: { lte: new Date() } }, - { lockedUntil: { lte: new Date() } } - ]; - } else if (status === 'INACTIVE') { - where.OR = [ - { blockedUntil: { gt: new Date() } }, - { lockedUntil: { gt: new Date() } } - ]; - } - - const [items, total] = await Promise.all([ - this.prisma.user.findMany({ - where, - select: { - id: true, - email: true, - fullName: true, - role: true, - lastLoginAt: true, - createdAt: true, - blockedUntil: true, - lockedUntil: true, - }, - skip, - take: pageSize, - orderBy: { createdAt: 'desc' }, - }), - this.prisma.user.count({ where }), - ]); - - return { - items: items.map(user => ({ - id: user.id, - email: user.email, - fullName: user.fullName, - role: user.role, - lastLogin: user.lastLoginAt, - status: (!user.blockedUntil || user.blockedUntil <= new Date()) && - (!user.lockedUntil || user.lockedUntil <= new Date()) - ? 'ACTIVE' - : 'INACTIVE', - })), - total, - page, - pageSize, - }; - } - - async createUser(dto: { email: string; fullName: string; role: string; status?: string; password?: string }) { - const exists = await this.prisma.user.findFirst({ - where: { OR: [{ email: dto.email }] }, - }); - if (exists) throw new ConflictException('Email already registered'); - - const passwordHash = await bcrypt.hash(dto.password || 'TempPassword123!', 10); - - const user = await this.prisma.user.create({ - data: { - email: dto.email, - fullName: dto.fullName, - role: dto.role as any, - phone: dto.email, // Use email as phone temporarily for unique constraint - passwordHash, - blockedUntil: dto.status === 'INACTIVE' ? new Date(Date.now() + 365 * 24 * 60 * 60 * 1000) : undefined, - }, - select: { - id: true, - email: true, - fullName: true, - role: true, - lastLoginAt: true, - createdAt: true, - }, - }); - - await this.createAuditLog(user.id, 'USER_CREATED', 'User', user.id, null, { email: user.email, role: dto.role }); - - return user; - } - - async updateUser(id: string, dto: Partial<{ email: string; fullName: string; role: string; status: string }>) { - const user = await this.prisma.user.findUnique({ where: { id } }); - if (!user) throw new NotFoundException('User not found'); - - const updateData: any = {}; - if (dto.fullName) updateData.fullName = dto.fullName; - if (dto.role) updateData.role = dto.role; - if (dto.status === 'ACTIVE') { - updateData.blockedUntil = null; - updateData.lockedUntil = null; - } else if (dto.status === 'INACTIVE') { - updateData.blockedUntil = new Date(Date.now() + 365 * 24 * 60 * 60 * 1000); - } - - const updated = await this.prisma.user.update({ - where: { id }, - data: updateData, - select: { - id: true, - email: true, - fullName: true, - role: true, - lastLoginAt: true, - createdAt: true, - }, - }); - - await this.createAuditLog(id, 'USER_UPDATED', 'User', id, { oldData: user }, { newData: updateData }); - - return updated; - } - - async deleteUser(id: string) { - const user = await this.prisma.user.findUnique({ where: { id } }); - if (!user) throw new NotFoundException('User not found'); - - // Don't actually delete, just deactivate - await this.prisma.user.update({ - where: { id }, - data: { blockedUntil: new Date(), lockedUntil: new Date() }, - }); - - await this.createAuditLog(id, 'USER_DELETED', 'User', id, { email: user.email }, null); - - return { deleted: true }; - } - - async resetUserPassword(id: string, tempPassword: string) { - const user = await this.prisma.user.findUnique({ where: { id } }); - if (!user) throw new NotFoundException('User not found'); - - const passwordHash = await bcrypt.hash(tempPassword, 10); - await this.prisma.user.update({ - where: { id }, - data: { - passwordHash, - failedLoginAttempts: 0, - lockedUntil: null, - }, - }); - - await this.createAuditLog(id, 'PASSWORD_RESET_ADMIN', 'User', id, null, { resetBy: 'admin' }); - - return { reset: true, tempPassword }; - } - - private async signToken(userId: string, email: string, role: string, passengerId?: string, agentId?: string) { - // Get the full user data to include fullName - const user = await this.prisma.user.findUnique({ - where: { id: userId }, - select: { id: true, email: true, fullName: true, role: true } - }); - - const payload = { sub: userId, email, role, passengerId, agentId }; - console.log('[AUTH] Creating JWT with payload:', payload); - - const token = this.jwt.sign(payload); - console.log('[AUTH] JWT created, token length:', token.length); - - const response = { - token, - user: { - id: userId, - email, - fullName: user?.fullName || email, - role, - passengerId, - agentId - } - }; - console.log('[AUTH] Returning user object with passengerId:', response.user.passengerId); - return response; - } - - private async createAuditLog(userId: string, action: string, entityType: string, entityId: string, oldData: any, newData: any) { - await this.prisma.auditLog.create({ - data: { userId, action, entityType, entityId, oldData, newData } - }); - } - - async getProfile(userId: string) { - if (!userId) { - throw new UnauthorizedException('User ID not found in token'); - } - - const user = await this.prisma.user.findUnique({ - where: { id: userId }, - include: { - passenger: { - include: { - loyalty: true, - wallet: true, - }, - }, - preferences: true, - devices: true, - }, - }); - - if (!user) throw new UnauthorizedException('User not found'); - - return { - id: user.id, - email: user.email, - phone: user.phone, - fullName: user.fullName, - role: user.role, - nationality: user.nationality, - nationalityCode: user.nationalityCode, - nationalId: user.nationalId, - passportNumber: user.passportNumber, - faydaVerified: user.faydaVerified, - faydaVerifiedAt: user.faydaVerifiedAt, - lastLoginAt: user.lastLoginAt, - createdAt: user.createdAt, - passenger: user.passenger ? { - id: user.passenger.id, - preferredLanguage: user.passenger.preferredLanguage, - loyalty: user.passenger.loyalty ? { - tier: user.passenger.loyalty.tier, - pointsBalance: user.passenger.loyalty.pointsBalance, - lifetimePoints: user.passenger.loyalty.lifetimePoints, - } : null, - wallet: user.passenger.wallet ? { - balanceMinor: user.passenger.wallet.balanceMinor, - currency: user.passenger.wallet.currency, - } : null, - } : null, - preferences: user.preferences, - devices: user.devices.map(device => ({ - id: device.id, - platform: device.platform, - name: device.name, - pushToken: device.pushToken, - trusted: device.trusted, - lastSeenAt: device.lastSeenAt, - })), - }; - } - - async logout(userId: string) { - // Invalidate all active sessions for this user - await this.prisma.session.deleteMany({ - where: { userId } - }); - - // Log the logout action - await this.createAuditLog(userId, 'USER_LOGOUT', 'User', userId, null, null); - - return { - success: true, - message: 'Logged out successfully' - }; - } -} diff --git a/apps/edr-passenger-api/src/modules/auth/passenger-auth.service.ts b/apps/edr-passenger-api/src/modules/auth/passenger-auth.service.ts new file mode 100644 index 000000000..dab714ef4 --- /dev/null +++ b/apps/edr-passenger-api/src/modules/auth/passenger-auth.service.ts @@ -0,0 +1,231 @@ +import { + Injectable, + ConflictException, + InternalServerErrorException, + UnauthorizedException, +} from '@nestjs/common'; +import { ModuleRef, ContextIdFactory } from '@nestjs/core'; +import { InjectDataSource } from '@nestjs/typeorm'; +import { DataSource } from 'typeorm'; +import { EventEmitter2 } from '@nestjs/event-emitter'; +import { AuthService as IamAuthService } from '@tria-plc/iamapi-common/module/auth/services/auth.service'; +import { EUserType } from '@tria-plc/api-common/utils/enums/user.enum'; +import { PrismaService } from '../../common/prisma.service'; +import { RegisterDto, LoginDto } from './auth.dto'; + +type IamUserRow = { + id: string; + email: string; + name: { en: string; am: string } | null; + phone_number: string | null; + metadata: Record | null; +}; + +@Injectable() +export class PassengerAuthService { + constructor( + private readonly prisma: PrismaService, + @InjectDataSource() private readonly dataSource: DataSource, + private readonly moduleRef: ModuleRef, + private readonly eventEmitter: EventEmitter2, + ) {} + + private async resolveIamAuthService(req: any): Promise { + const contextId = ContextIdFactory.getByRequest(req); + this.moduleRef.registerRequestByContextId(req, contextId); + return this.moduleRef.resolve(IamAuthService, contextId, { strict: false }); + } + + async register(dto: RegisterDto, req: any) { + const existing = await this.dataSource.query<{ id: string }[]>( + `SELECT id FROM iam.users WHERE email = $1 OR phone_number = $2 LIMIT 1`, + [dto.email, dto.phoneNumber], + ); + if (existing.length) throw new ConflictException('Email or phone already registered'); + + const iamAuthService = await this.resolveIamAuthService(req); + + const { token, refreshToken } = await iamAuthService.signupWithPassword({ + email: dto.email, + username: dto.username, + phoneNumber: dto.phoneNumber, + userType: EUserType.INDIVIDUAL, + name: dto.name, + password: dto.password, + confirmPassword: dto.confirmPassword, + }); + + const iamRows = await this.dataSource.query( + `SELECT id, email, name, phone_number, metadata FROM iam.users WHERE email = $1 LIMIT 1`, + [dto.email], + ); + if (!iamRows.length) { + await this.compensateIamSignup(dto.email); + throw new InternalServerErrorException('Account creation failed. Please try again.'); + } + const iamUserId = iamRows[0].id; + + let passengerId: string; + try { + const result = await this.provisionPassengerSatellite({ iamUserId, auditAction: 'USER_REGISTERED' }); + passengerId = result.passengerId; + } catch { + await this.compensateIamSignup(dto.email); + throw new InternalServerErrorException('Account creation failed. Please try again.'); + } + + return { + token, + refreshToken, + user: { id: iamUserId, iamUserId, email: dto.email, fullName: dto.name.en, passengerId }, + }; + } + + async login(dto: LoginDto, req: any) { + const iamAuthService = await this.resolveIamAuthService(req); + + let iamResult: { token: string; refreshToken: string } | { mfaRequired: boolean }; + try { + iamResult = await iamAuthService.login({ email: dto.email, password: dto.password }); + } catch { + this.eventEmitter.emit('auth.login.failed', { email: dto.email }); + throw new UnauthorizedException('Invalid credentials'); + } + + if ('mfaRequired' in iamResult && iamResult.mfaRequired) { + return iamResult; + } + + const { token, refreshToken } = iamResult as { token: string; refreshToken: string }; + + const iamRows = await this.dataSource.query( + `SELECT id, email, name, phone_number, metadata FROM iam.users WHERE email = $1 LIMIT 1`, + [dto.email], + ); + const iamUser = iamRows[0]; + if (!iamUser) { + throw new InternalServerErrorException('IAM user not found after successful authentication'); + } + + // Find existing Passenger record or lazy-provision one on first login + let passenger = await this.prisma.passenger.findUnique({ + where: { iamUserId: iamUser.id }, + select: { id: true }, + }); + + if (!passenger) { + const result = await this.provisionPassengerSatellite({ + iamUserId: iamUser.id, + auditAction: 'USER_AUTO_PROVISIONED', + }); + passenger = { id: result.passengerId }; + } + + return { + token, + refreshToken, + user: { id: iamUser.id, iamUserId: iamUser.id, email: dto.email, passengerId: passenger.id }, + }; + } + + private async provisionPassengerSatellite(data: { + iamUserId: string; + auditAction: string; + }): Promise<{ passengerId: string }> { + return this.prisma.$transaction(async (tx) => { + const passenger = await tx.passenger.create({ + data: { iamUserId: data.iamUserId }, + }); + await tx.loyaltyAccount.create({ data: { passengerId: passenger.id } }); + await tx.walletAccount.create({ data: { passengerId: passenger.id } }); + await tx.userPreferences.create({ data: { iamUserId: data.iamUserId } }); + await tx.auditLog.create({ + data: { + iamUserId: data.iamUserId, + action: data.auditAction, + entityType: 'User', + entityId: data.iamUserId, + newData: { iamUserId: data.iamUserId }, + }, + }); + return { passengerId: passenger.id }; + }); + } + + async logout(user: any, req: any) { + const iamAuthService = await this.resolveIamAuthService(req); + await iamAuthService.logout(user); + return { success: true, message: 'Logged out successfully' }; + } + + async getProfile(iamUserId: string) { + const [passenger, iamRows] = await Promise.all([ + this.prisma.passenger.findUnique({ + where: { iamUserId }, + include: { loyalty: true, wallet: true }, + }), + this.dataSource.query( + `SELECT id, email, name, phone_number, metadata FROM iam.users WHERE id = $1 LIMIT 1`, + [iamUserId], + ), + ]); + + if (!passenger) throw new Error('Passenger not found'); + const iam = iamRows[0]; + + return { + iamUserId, + email: iam?.email ?? null, + phone: iam?.phone_number ?? null, + fullName: iam?.name?.en ?? iam?.name?.am ?? null, + faydaVerified: iam?.metadata?.faydaVerified ?? false, + createdAt: passenger.createdAt, + passenger: { + id: passenger.id, + preferredLanguage: passenger.preferredLanguage, + loyalty: passenger.loyalty + ? { tier: passenger.loyalty.tier, pointsBalance: passenger.loyalty.pointsBalance, lifetimePoints: passenger.loyalty.lifetimePoints } + : null, + wallet: passenger.wallet + ? { balanceMinor: passenger.wallet.balanceMinor, currency: passenger.wallet.currency } + : null, + }, + }; + } + + private async compensateIamSignup(email: string): Promise { + try { + const rows = await this.dataSource.query<{ id: string }[]>( + `SELECT id FROM iam.users WHERE email = $1 LIMIT 1`, + [email], + ); + if (!rows.length) return; + const iamUserId = rows[0].id; + + // Discover every table in the iam schema that has a FK pointing at iam.users.id + const fkDeps = await this.dataSource.query<{ table_name: string; column_name: string }[]>(` + SELECT kcu.table_name, kcu.column_name + FROM information_schema.table_constraints tc + JOIN information_schema.key_column_usage kcu + ON tc.constraint_name = kcu.constraint_name AND tc.table_schema = kcu.table_schema + JOIN information_schema.referential_constraints rc + ON tc.constraint_name = rc.constraint_name + JOIN information_schema.key_column_usage ccu + ON rc.unique_constraint_name = ccu.constraint_name + WHERE ccu.table_schema = 'iam' AND ccu.table_name = 'users' AND ccu.column_name = 'id' + AND tc.table_schema = 'iam' AND tc.constraint_type = 'FOREIGN KEY' + `); + + for (const { table_name, column_name } of fkDeps) { + await this.dataSource.query( + `DELETE FROM iam.${table_name} WHERE ${column_name} = $1`, + [iamUserId], + ); + } + + await this.dataSource.query(`DELETE FROM iam.users WHERE id = $1`, [iamUserId]); + } catch (err) { + console.error('[PassengerAuthService] IAM compensating cleanup failed for', email, (err as Error).message); + } + } +} diff --git a/apps/edr-passenger-api/src/modules/bookings/bookings.controller.ts b/apps/edr-passenger-api/src/modules/bookings/bookings.controller.ts index 285e38bf0..2a8e237e6 100644 --- a/apps/edr-passenger-api/src/modules/bookings/bookings.controller.ts +++ b/apps/edr-passenger-api/src/modules/bookings/bookings.controller.ts @@ -5,7 +5,6 @@ import { GuestBookingService } from './guest-booking.service'; import { CreateBookingDto, ModifyBookingDto, CancelBookingDto } from './bookings.dto'; import { CreateGuestBookingDto, GetSavedPassengersDto } from './guest-booking.dto'; import { JwtGuard } from '../../common/jwt.guard'; -import { IamGuard } from '../../common/iam-adapter'; @ApiTags('Booking') @Controller('bookings') @@ -247,8 +246,8 @@ export class BookingsController { }) @ApiResponse({ status: 201, description: 'Booking created successfully with fareBreakdown' }) @ApiResponse({ status: 400, description: 'Missing required seat IDs for bookingType, or Verifayda verification failed' }) - createGuest(@Body() dto: CreateGuestBookingDto) { - return this.guestService.createGuestBooking(dto); + createGuest(@Req() req: any, @Body() dto: CreateGuestBookingDto) { + return this.guestService.createGuestBooking(dto, req); } @Get('saved-passengers') diff --git a/apps/edr-passenger-api/src/modules/bookings/bookings.module.ts b/apps/edr-passenger-api/src/modules/bookings/bookings.module.ts index bce07b915..63fd8be85 100644 --- a/apps/edr-passenger-api/src/modules/bookings/bookings.module.ts +++ b/apps/edr-passenger-api/src/modules/bookings/bookings.module.ts @@ -7,12 +7,13 @@ import { GuestBookingService } from './guest-booking.service'; import { SeatsModule } from '../seats/seats.module'; import { VerifaydaModule } from '../verifayda/verifayda.module'; import { CurrencyModule } from '../currency/currency.module'; +import { AuthModule } from '../auth/auth.module'; import { FareEngineModule } from '../fare-engine/fare-engine.module'; -@Module({ - imports: [AuditModule, SeatsModule, VerifaydaModule, CurrencyModule, FareEngineModule, HttpModule], - controllers: [BookingsController], - providers: [BookingsService, GuestBookingService], - exports: [BookingsService, GuestBookingService] +@Module({ + imports: [AuditModule, SeatsModule, VerifaydaModule, CurrencyModule, FareEngineModule, HttpModule, AuthModule], + controllers: [BookingsController], + providers: [BookingsService, GuestBookingService], + exports: [BookingsService, GuestBookingService] }) export class BookingsModule {} diff --git a/apps/edr-passenger-api/src/modules/bookings/bookings.service.ts b/apps/edr-passenger-api/src/modules/bookings/bookings.service.ts index 6686df9df..21532fa44 100644 --- a/apps/edr-passenger-api/src/modules/bookings/bookings.service.ts +++ b/apps/edr-passenger-api/src/modules/bookings/bookings.service.ts @@ -1,4 +1,6 @@ import { Injectable, NotFoundException, BadRequestException } from '@nestjs/common'; +import { InjectDataSource } from '@nestjs/typeorm'; +import { DataSource } from 'typeorm'; import { PrismaService } from '../../common/prisma.service'; import { SeatsService } from '../seats/seats.service'; import { EventEmitter2 } from '@nestjs/event-emitter'; @@ -33,12 +35,13 @@ interface BookingFilters { @Injectable() export class BookingsService { constructor( - private prisma: PrismaService, - private seatsService: SeatsService, - private eventEmitter: EventEmitter2, - private verifaydaService: VerifaydaService, - private currencyService: CurrencyService, - private fareEngine: FareEngineService, + private readonly prisma: PrismaService, + @InjectDataSource() private readonly dataSource: DataSource, + private readonly seatsService: SeatsService, + private readonly eventEmitter: EventEmitter2, + private readonly verifaydaService: VerifaydaService, + private readonly currencyService: CurrencyService, + private readonly fareEngine: FareEngineService, ) {} async findByPassengerId(passengerId: string, filters: BookingFilters = {}) { @@ -111,22 +114,22 @@ export class BookingsService { const { search, status, page = 1, pageSize = 20 } = filters; const skip = (page - 1) * pageSize; - // Find user with this device ID - const device = await this.prisma.device.findUnique({ - where: { id: deviceId }, - include: { user: { include: { passenger: true } } }, - }).catch(() => null); - + // Find passenger linked to this device via iamUserId + const device = await this.prisma.device.findUnique({ where: { id: deviceId } }).catch(() => null); + const passenger = device?.iamUserId + ? await this.prisma.passenger.findUnique({ where: { iamUserId: device.iamUserId } }).catch(() => null) + : null; + const searchConditions = search ? [ { bookingRef: { contains: search, mode: 'insensitive' } }, { schedule: { originStation: { name: { contains: search, mode: 'insensitive' } } } }, { schedule: { destinationStation: { name: { contains: search, mode: 'insensitive' } } } }, ] : []; - + const where: any = { OR: [ { userAgent: deviceId }, - ...(device?.user?.passenger ? [{ passengerId: device.user.passenger.id }] : []), + ...(passenger ? [{ passengerId: passenger.id }] : []), ], }; @@ -193,13 +196,26 @@ export class BookingsService { const where: any = {}; if (search) { + const iamRows = await this.dataSource.query<{ id: string }[]>( + `SELECT u.id FROM iam.users u + WHERE (u.name->>'en') ILIKE $1 OR (u.name->>'am') ILIKE $1 + OR u.email ILIKE $1 OR u.phone_number ILIKE $1`, + [`%${search}%`], + ); + const matchedPassengers = iamRows.length > 0 + ? await this.prisma.passenger.findMany({ + where: { iamUserId: { in: iamRows.map(r => r.id) } }, + select: { id: true }, + }) + : []; + where.OR = [ { bookingRef: { contains: search, mode: 'insensitive' } }, { contactEmail: { contains: search, mode: 'insensitive' } }, { contactPhone: { contains: search, mode: 'insensitive' } }, - { passenger: { user: { fullName: { contains: search, mode: 'insensitive' } } } }, - { passenger: { user: { email: { contains: search, mode: 'insensitive' } } } }, - { passenger: { user: { phone: { contains: search, mode: 'insensitive' } } } }, + ...(matchedPassengers.length > 0 + ? [{ passengerId: { in: matchedPassengers.map(p => p.id) } }] + : []), { seats: { some: { passengerName: { contains: search, mode: 'insensitive' } } } }, ]; } @@ -214,7 +230,7 @@ export class BookingsService { take: pageSize, orderBy: { createdAt: 'desc' }, include: { - passenger: { include: { user: true } }, + passenger: { select: { id: true, iamUserId: true } }, schedule: { include: { originStation: true, destinationStation: true, train: true } }, paymentIntent: true, seats: { include: { seat: true } }, @@ -222,34 +238,48 @@ export class BookingsService { }), this.prisma.booking.count({ where }), ]); - + + const iamUserIds = items.map(b => b.passenger?.iamUserId).filter(Boolean) as string[]; + const iamRows = iamUserIds.length > 0 + ? await this.dataSource.query<{ id: string; email: string; name: any; phone_number: string | null }[]>( + `SELECT id, email, name, phone_number FROM iam.users WHERE id = ANY($1)`, + [iamUserIds], + ) + : []; + const iamMap = new Map(iamRows.map(r => [r.id, r])); + return { - items: items.map(booking => ({ - id: booking.id, - bookingRef: booking.bookingRef, - status: booking.status, - totalMinor: booking.totalMinor, - currency: 'ETB', - displayCurrency: booking.displayCurrency, - displayTotalMinor: booking.displayTotalMinor, - contactEmail: booking.contactEmail, - contactPhone: booking.contactPhone, - bookingType: booking.bookingType, - returnLegStatus: (booking as any).returnLegStatus ?? null, - adultCount: booking.adultCount, - childCount: booking.childCount, - createdAt: booking.createdAt, - passenger: booking.passenger?.user, - passengerNames: [...new Set(booking.seats.map((s: any) => s.passengerName))], - schedule: { - train: booking.schedule.train, - originStation: booking.schedule.originStation, - destinationStation: booking.schedule.destinationStation, - departureAt: booking.schedule.departureAt, - }, - paymentIntent: booking.paymentIntent, - seatCount: booking.seats.length, - })), + items: items.map(booking => { + const iam = booking.passenger?.iamUserId ? iamMap.get(booking.passenger.iamUserId) : undefined; + return { + id: booking.id, + bookingRef: booking.bookingRef, + status: booking.status, + totalMinor: booking.totalMinor, + currency: 'ETB', + displayCurrency: booking.displayCurrency, + displayTotalMinor: booking.displayTotalMinor, + contactEmail: booking.contactEmail, + contactPhone: booking.contactPhone, + bookingType: booking.bookingType, + returnLegStatus: (booking as any).returnLegStatus ?? null, + adultCount: booking.adultCount, + childCount: booking.childCount, + createdAt: booking.createdAt, + passenger: iam + ? { fullName: iam.name?.en ?? iam.name?.am ?? null, email: iam.email, phone: iam.phone_number } + : null, + passengerNames: [...new Set(booking.seats.map((s: any) => s.passengerName))], + schedule: { + train: booking.schedule.train, + originStation: booking.schedule.originStation, + destinationStation: booking.schedule.destinationStation, + departureAt: booking.schedule.departureAt, + }, + paymentIntent: booking.paymentIntent, + seatCount: booking.seats.length, + }; + }), meta: { page, pageSize, diff --git a/apps/edr-passenger-api/src/modules/bookings/guest-booking.service.ts b/apps/edr-passenger-api/src/modules/bookings/guest-booking.service.ts index de1c8afcb..f6971a1bc 100644 --- a/apps/edr-passenger-api/src/modules/bookings/guest-booking.service.ts +++ b/apps/edr-passenger-api/src/modules/bookings/guest-booking.service.ts @@ -3,11 +3,11 @@ import { PrismaService } from '../../common/prisma.service'; import { SeatsService } from '../seats/seats.service'; import { VerifaydaService } from '../verifayda/verifayda.service'; import { CurrencyService } from '../currency/currency.service'; +import { PassengerAuthService } from '../auth/passenger-auth.service'; import { FareEngineService } from '../fare-engine/fare-engine.service'; import { EventEmitter2 } from '@nestjs/event-emitter'; import { CreateGuestBookingDto, SavedPassengerProfileDto } from './guest-booking.dto'; import { Currency, PassengerCategory, IdDocumentType } from '@prisma/client'; -import * as bcrypt from 'bcrypt'; function generateRef(): string { const chars = 'ABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789'; @@ -44,18 +44,19 @@ export class GuestBookingService { private seatsService: SeatsService, private verifaydaService: VerifaydaService, private currencyService: CurrencyService, + private passengerAuthService: PassengerAuthService, private fareEngine: FareEngineService, private eventEmitter: EventEmitter2, ) {} - async createGuestBooking(dto: CreateGuestBookingDto) { - if (dto.bookingType === 'ROUND_TRIP') return this.createGuestRoundTripBooking(dto); - if (dto.bookingType === 'TRANSIT') return this.createGuestTransitBooking(dto); - if (dto.bookingType === 'ROUND_TRIP_TRANSIT') return this.createGuestRoundTripTransitBooking(dto); - return this.createGuestOneWayBooking(dto); + async createGuestBooking(dto: CreateGuestBookingDto, req?: any) { + if (dto.bookingType === 'ROUND_TRIP') return this.createGuestRoundTripBooking(dto, req); + if (dto.bookingType === 'TRANSIT') return this.createGuestTransitBooking(dto, req); + if (dto.bookingType === 'ROUND_TRIP_TRANSIT') return this.createGuestRoundTripTransitBooking(dto, req); + return this.createGuestOneWayBooking(dto, req); } - private async createGuestOneWayBooking(dto: CreateGuestBookingDto) { + private async createGuestOneWayBooking(dto: CreateGuestBookingDto, req?: any) { // Validate hold const hold = await this.prisma.seatHold.findUnique({ where: { id: dto.holdId } }); if (!hold || hold.expiresAt < new Date()) { @@ -95,15 +96,12 @@ export class GuestBookingService { let verifaydaData: Record | undefined; let nationality = passenger.nationality; - // Determine if passenger is Ethiopian - const isEthiopian = passenger.nationality === 'Ethiopian' || + const isEthiopian = passenger.nationality === 'Ethiopian' || passenger.nationality === 'ETHIOPIAN' || passenger.idDocumentType === IdDocumentType.NATIONAL_ID; - - // Ethiopian with National ID + if (isEthiopian && passenger.idDocumentType === IdDocumentType.NATIONAL_ID) { if (passenger.idDocumentNumber) { - // Attempt Fayda verification const verification = await this.verifaydaService.verifyNationalId(passenger.idDocumentNumber); if (!verification.verified) { throw new BadRequestException( @@ -115,22 +113,14 @@ export class GuestBookingService { verifaydaData = verification.passengerData?.profileData; } nationality = 'Ethiopian'; - } - // International passenger with Passport (non-Ethiopian) - else if (!isEthiopian && passenger.idDocumentType === IdDocumentType.PASSPORT) { - // Passport details are required for international passengers + } else if (!isEthiopian && passenger.idDocumentType === IdDocumentType.PASSPORT) { if (!passenger.passportNumber || !passenger.passportCountry) { throw new BadRequestException(`Passport number and country required for ${passenger.passengerName}`); } nationality = nationality || (passenger.passportCountry === 'Djibouti' ? 'Djiboutian' : 'Other'); - } - // Ethiopian with Passport (manual entry without Fayda) - else if (isEthiopian && passenger.idDocumentType === IdDocumentType.PASSPORT) { - // Ethiopians can use passport instead of national ID + } else if (isEthiopian && passenger.idDocumentType === IdDocumentType.PASSPORT) { nationality = 'Ethiopian'; - } - // International with National ID (e.g., Djiboutian national ID) - else if (!isEthiopian && passenger.idDocumentType === IdDocumentType.NATIONAL_ID) { + } else if (!isEthiopian && passenger.idDocumentType === IdDocumentType.NATIONAL_ID) { nationality = nationality || 'Other'; } @@ -179,16 +169,27 @@ export class GuestBookingService { displayTotalMinor = await this.currencyService.convertAmount(totalMinor, Currency.ETB, displayCurrency); } - // Create or get guest passenger + // Resolve or create the guest Passenger record const firstPassenger = passengersData[0]; - const { guestPassenger, userId, createdAccount } = await this.resolveGuestPassenger(dto, firstPassenger); + const { guestPassengerId, iamUserId, createdAccount } = await this.resolveGuestPassenger(dto, firstPassenger, req); // Save passenger details for future use (if requested) if (dto.savePassengerDetails && (dto.createAccount || dto.deviceId)) { for (const passenger of passengersData) { - // Note: SavedPassengerProfile will be available after migration - // Temporarily disabled until prisma generate completes - // await this.prisma.savedPassengerProfile.create({ ... }); + await this.prisma.savedPassengerProfile.create({ + data: { + userId: iamUserId ?? undefined, + deviceId: dto.deviceId, + passengerName: passenger.passengerName, + dateOfBirth: passenger.dateOfBirth, + idDocumentType: passenger.idDocumentType, + passportNumber: passenger.passportNumber, + passportCountry: passenger.passportCountry, + nationality: passenger.nationality, + phone: passenger.phone, + email: passenger.email, + }, + }); } } @@ -196,7 +197,7 @@ export class GuestBookingService { const booking = await this.prisma.booking.create({ data: { bookingRef: generateRef(), - passengerId: guestPassenger.id, + passengerId: guestPassengerId, scheduleId: dto.scheduleId, status: 'PENDING_PAYMENT', totalMinor, @@ -237,7 +238,7 @@ export class GuestBookingService { return { ...booking, createdAccount, - userId, + iamUserId, fareBreakdown: { baseFareMinor, adultCount, @@ -257,7 +258,7 @@ export class GuestBookingService { }; } - private async createGuestRoundTripBooking(dto: CreateGuestBookingDto) { + private async createGuestRoundTripBooking(dto: CreateGuestBookingDto, req?: any) { if (!dto.returnScheduleId || !dto.returnHoldId || !dto.returnOriginStationId || !dto.returnDestinationStationId) { throw new BadRequestException('returnScheduleId, returnHoldId, returnOriginStationId and returnDestinationStationId are required for ROUND_TRIP'); } @@ -374,7 +375,7 @@ export class GuestBookingService { : totalMinor; // Create or resolve guest passenger (same as one-way) - const { guestPassenger, userId, createdAccount } = await this.resolveGuestPassenger(dto, passengersData[0]); + const { guestPassengerId, iamUserId, createdAccount } = await this.resolveGuestPassenger(dto, passengersData[0], req); // Create booking with outbound seats; return seats confirmed separately const outboundSeatIds = dto.passengers.map(p => p.seatId); @@ -383,7 +384,7 @@ export class GuestBookingService { const booking = await this.prisma.booking.create({ data: { bookingRef: generateRef(), - passengerId: guestPassenger.id, + passengerId: guestPassengerId, scheduleId: dto.scheduleId, status: 'PENDING_PAYMENT', bookingType: 'ROUND_TRIP', @@ -451,7 +452,7 @@ export class GuestBookingService { return { ...booking, createdAccount, - userId, + iamUserId, fareBreakdown: { outboundBaseFareMinor: outboundBaseFare, returnBaseFareMinor: returnBaseFare, @@ -470,7 +471,7 @@ export class GuestBookingService { }; } - private async createGuestTransitBooking(dto: CreateGuestBookingDto) { + private async createGuestTransitBooking(dto: CreateGuestBookingDto, req?: any) { if (!dto.leg2ScheduleId || !dto.leg2HoldId || !dto.transitStationId || !dto.leg2DestinationStationId) { throw new BadRequestException('leg2ScheduleId, leg2HoldId, transitStationId and leg2DestinationStationId are required for TRANSIT bookings'); } @@ -571,13 +572,13 @@ export class GuestBookingService { ? await this.currencyService.convertAmount(totalMinor, Currency.ETB, displayCurrency) : totalMinor; - const { guestPassenger, userId, createdAccount } = await this.resolveGuestPassenger(dto, passengersData[0]); + const { guestPassengerId, iamUserId, createdAccount } = await this.resolveGuestPassenger(dto, passengersData[0], req); // Single booking — leg-1 seats at leg=1, leg-2 seats at leg=2 const booking = await this.prisma.booking.create({ data: { bookingRef: generateRef(), - passengerId: guestPassenger.id, + passengerId: guestPassengerId, scheduleId: dto.scheduleId, status: 'PENDING_PAYMENT', bookingType: 'TRANSIT', @@ -643,7 +644,7 @@ export class GuestBookingService { return { ...booking, createdAccount, - userId, + iamUserId, fareBreakdown: { leg1BaseFareMinor: leg1BaseFare, leg2BaseFareMinor: leg2BaseFare, @@ -657,7 +658,7 @@ export class GuestBookingService { }; } - private async createGuestRoundTripTransitBooking(dto: CreateGuestBookingDto) { + private async createGuestRoundTripTransitBooking(dto: CreateGuestBookingDto, req?: any) { if (!dto.leg2ScheduleId || !dto.leg2HoldId || !dto.transitStationId || !dto.leg2DestinationStationId || !dto.returnScheduleId || !dto.returnHoldId || !dto.returnOriginStationId || !dto.returnDestinationStationId || !dto.returnLeg2ScheduleId || !dto.returnLeg2HoldId || !dto.returnTransitStationId || !dto.returnLeg2DestinationStationId) { @@ -764,7 +765,7 @@ export class GuestBookingService { ? await this.currencyService.convertAmount(totalMinor, Currency.ETB, displayCurrency) : totalMinor; - const { guestPassenger, userId, createdAccount } = await this.resolveGuestPassenger(dto, passengersData[0]); + const { guestPassengerId, iamUserId, createdAccount } = await this.resolveGuestPassenger(dto, passengersData[0], req); const makeSeat = (p: any, seatId: string, leg: number, scheduleId: string, fare: number) => ({ seat: { connect: { id: seatId } }, @@ -785,7 +786,7 @@ export class GuestBookingService { const booking = await this.prisma.booking.create({ data: { bookingRef: generateRef(), - passengerId: guestPassenger.id, + passengerId: guestPassengerId, scheduleId: dto.scheduleId, status: 'PENDING_PAYMENT', bookingType: 'ROUND_TRIP_TRANSIT', @@ -832,7 +833,7 @@ export class GuestBookingService { return { ...booking, createdAccount, - userId, + iamUserId, fareBreakdown: { outboundLeg1FareMinor: obL1Fare, outboundLeg2FareMinor: obL2Fare, @@ -851,59 +852,28 @@ export class GuestBookingService { private async resolveGuestPassenger( dto: Pick, firstPassenger: any, - ): Promise<{ guestPassenger: any; userId: string | null; createdAccount: boolean }> { + req?: any, + ): Promise<{ guestPassengerId: string; iamUserId: string | null; createdAccount: boolean }> { if (dto.createAccount && firstPassenger.email && dto.password) { - const existingUser = await this.prisma.user.findUnique({ where: { email: firstPassenger.email } }); - if (existingUser) throw new BadRequestException('Email already registered. Please login instead.'); - - let accountPhone = firstPassenger.phone || null; - if (accountPhone) { - const existingPhone = await this.prisma.user.findUnique({ where: { phone: accountPhone } }); - if (existingPhone) throw new BadRequestException('Phone number already registered. Please login instead.'); - } - if (!accountPhone) accountPhone = generateEthiopianPhone(); - - const user = await this.prisma.user.create({ - data: { - fullName: firstPassenger.passengerName, - email: firstPassenger.email, - phone: accountPhone, - passwordHash: await bcrypt.hash(dto.password, 10), - nationality: firstPassenger.nationality, - nationalId: firstPassenger.idDocumentType === IdDocumentType.NATIONAL_ID ? firstPassenger.idDocumentNumber : undefined, - passportNumber: firstPassenger.passportNumber, + const guestName = firstPassenger.passengerName ?? 'Guest'; + const result = await this.passengerAuthService.register( + { + email: firstPassenger.email, + username: firstPassenger.email, + phoneNumber: firstPassenger.phone || `+251900000000`, + name: { en: guestName, am: guestName }, + password: dto.password, + confirmPassword: dto.password, }, - }); - const guestPassenger = await this.prisma.passenger.create({ data: { userId: user.id } }); - await this.prisma.loyaltyAccount.create({ data: { passengerId: guestPassenger.id, pointsBalance: 0, tier: 'BRONZE' } }); - await this.prisma.walletAccount.create({ data: { passengerId: guestPassenger.id, balanceMinor: 0 } }); - return { guestPassenger, userId: user.id, createdAccount: true }; + req, + ); + return { guestPassengerId: result.user.passengerId, iamUserId: result.user.iamUserId, createdAccount: true }; } - const uniqueId = `${Date.now()}-${Math.random().toString(36).substring(2, 9)}`; - let guestEmail = firstPassenger.email || generateGuestEmail(uniqueId); - if (firstPassenger.email) { - const existing = await this.prisma.user.findUnique({ where: { email: firstPassenger.email } }); - if (existing) guestEmail = generateGuestEmail(uniqueId); - } - let guestPhone = firstPassenger.phone || null; - if (guestPhone) { - const existing = await this.prisma.user.findUnique({ where: { phone: guestPhone } }); - if (existing) guestPhone = null; - } - if (!guestPhone) guestPhone = generateEthiopianPhone(); - - const tempUser = await this.prisma.user.create({ - data: { - fullName: firstPassenger.passengerName, - email: guestEmail, - phone: guestPhone, - passwordHash: await bcrypt.hash(Math.random().toString(36), 10), - role: 'PASSENGER', - }, - }); - const guestPassenger = await this.prisma.passenger.create({ data: { userId: tempUser.id } }); - return { guestPassenger, userId: null, createdAccount: false }; + const guestPassenger = await this.prisma.passenger.create({ data: {} }); + await this.prisma.loyaltyAccount.create({ data: { passengerId: guestPassenger.id, pointsBalance: 0, tier: 'BRONZE' } }); + await this.prisma.walletAccount.create({ data: { passengerId: guestPassenger.id, balanceMinor: 0 } }); + return { guestPassengerId: guestPassenger.id, iamUserId: null, createdAccount: false }; } async getSavedPassengers(userId?: string, deviceId?: string): Promise { @@ -911,10 +881,6 @@ export class GuestBookingService { throw new BadRequestException('Either userId or deviceId is required'); } - // Temporarily return empty array until Prisma client is regenerated - return []; - - /* Uncomment after running migration and prisma generate const profiles = await this.prisma.savedPassengerProfile.findMany({ where: { OR: [ @@ -929,14 +895,13 @@ export class GuestBookingService { passengerName: p.passengerName, dateOfBirth: p.dateOfBirth.toISOString().split('T')[0], idDocumentType: p.idDocumentType, - idDocumentNumber: undefined, // Never return sensitive data + idDocumentNumber: undefined, passportNumber: p.passportNumber || undefined, passportCountry: p.passportCountry || undefined, nationality: p.nationality || undefined, phone: p.phone || undefined, email: p.email || undefined, })); - */ } private async getBaseFare( diff --git a/apps/edr-passenger-api/src/modules/currencies/currencies.controller.ts b/apps/edr-passenger-api/src/modules/currencies/currencies.controller.ts index 3081c7a75..87dee3ec8 100644 --- a/apps/edr-passenger-api/src/modules/currencies/currencies.controller.ts +++ b/apps/edr-passenger-api/src/modules/currencies/currencies.controller.ts @@ -1,8 +1,9 @@ -import { Controller, Get, Post, Patch, Delete, Body, Param, HttpCode, UseGuards } from '@nestjs/common'; +import { Controller, Get, Post, Patch, Delete, Body, Param, HttpCode } from '@nestjs/common'; import { ApiTags, ApiBearerAuth } from '@nestjs/swagger'; import { CurrenciesService } from './currencies.service'; import { CreateCurrencyDto, UpdateCurrencyDto } from './currencies.dto'; -import { IamGuard, IamRoles } from '../../common/iam-adapter'; +import { PassengerAdmin, PassengerStaff } from '../../common/passenger-guards'; +import { PASSENGER_PERMS } from '../../seed/passenger-permissions.registry'; @ApiTags('Currencies') @Controller('currencies') @@ -15,8 +16,7 @@ export class CurrenciesController { } @Post() - @UseGuards(IamGuard) - @IamRoles('ADMIN') + @PassengerStaff(PASSENGER_PERMS.currencies.manage) @ApiBearerAuth('IAM-auth') @HttpCode(201) createCurrency(@Body() dto: CreateCurrencyDto) { @@ -24,24 +24,21 @@ export class CurrenciesController { } @Patch(':id') - @UseGuards(IamGuard) - @IamRoles('ADMIN') + @PassengerStaff(PASSENGER_PERMS.currencies.manage) @ApiBearerAuth('IAM-auth') updateCurrency(@Param('id') id: string, @Body() dto: UpdateCurrencyDto) { return this.currenciesService.updateCurrency(id, dto); } @Delete(':id') - @UseGuards(IamGuard) - @IamRoles('ADMIN') + @PassengerAdmin() @ApiBearerAuth('IAM-auth') deleteCurrency(@Param('id') id: string) { return this.currenciesService.deleteCurrency(id); } @Post('sync-rates') - @UseGuards(IamGuard) - @IamRoles('ADMIN') + @PassengerStaff(PASSENGER_PERMS.currencies.manage) @ApiBearerAuth('IAM-auth') @HttpCode(200) syncRates() { diff --git a/apps/edr-passenger-api/src/modules/dashboard/dashboard.service.ts b/apps/edr-passenger-api/src/modules/dashboard/dashboard.service.ts index 1f9717c6a..2d52879a8 100644 --- a/apps/edr-passenger-api/src/modules/dashboard/dashboard.service.ts +++ b/apps/edr-passenger-api/src/modules/dashboard/dashboard.service.ts @@ -1,14 +1,19 @@ import { Injectable } from '@nestjs/common'; +import { InjectDataSource } from '@nestjs/typeorm'; +import { DataSource } from 'typeorm'; import { PrismaService } from '../../common/prisma.service'; @Injectable() export class DashboardService { - constructor(private prisma: PrismaService) {} + constructor( + private prisma: PrismaService, + @InjectDataSource() private dataSource: DataSource, + ) {} async getHomeDashboard(passengerId: string) { const now = new Date(); const [passenger, upcomingBooking, wallet, promos, weatherAlerts, stationSignals, savedRoutes] = await Promise.all([ - this.prisma.passenger.findUnique({ where: { id: passengerId }, include: { user: { select: { fullName: true } }, loyalty: true } }), + this.prisma.passenger.findUnique({ where: { id: passengerId }, include: { loyalty: true } }), this.prisma.booking.findFirst({ where: { passengerId, status: 'CONFIRMED', schedule: { departureAt: { gte: now } } }, include: { @@ -27,7 +32,16 @@ export class DashboardService { const hour = now.getHours(); const greetingKey = hour < 12 ? 'MORNING' : hour < 17 ? 'AFTERNOON' : 'EVENING'; - const firstName = passenger?.user.fullName.split(' ')[0] ?? ''; + + let firstName = ''; + if (passenger?.iamUserId) { + const iamRows = await this.dataSource.query<{ name: { en?: string; am?: string } | null }[]>( + `SELECT name FROM iam.users WHERE id = $1 LIMIT 1`, + [passenger.iamUserId], + ); + const name = iamRows[0]?.name; + firstName = (name?.en ?? name?.am ?? '').split(' ')[0]; + } const seat = upcomingBooking?.seats[0]; return { diff --git a/apps/edr-passenger-api/src/modules/fraud/fraud.controller.ts b/apps/edr-passenger-api/src/modules/fraud/fraud.controller.ts index 4056b4259..c53d3a5fb 100644 --- a/apps/edr-passenger-api/src/modules/fraud/fraud.controller.ts +++ b/apps/edr-passenger-api/src/modules/fraud/fraud.controller.ts @@ -1,12 +1,12 @@ -import { Controller, Get, Post, Body, Query, UseGuards, Logger } from '@nestjs/common'; +import { Controller, Get, Post, Body, Query, Logger } from '@nestjs/common'; import { ApiTags, ApiOperation, ApiBearerAuth } from '@nestjs/swagger'; import { FraudService, FraudRuleConfig } from './fraud.service'; -import { IamGuard, IamRoles } from '../../common/iam-adapter'; -import { UserRole } from '@prisma/client'; +import { PassengerStaff } from '../../common/passenger-guards'; +import { PASSENGER_PERMS } from '../../seed/passenger-permissions.registry'; @ApiTags('Fraud Detection') @Controller('fraud') -@UseGuards(IamGuard) +@PassengerStaff([PASSENGER_PERMS.fraud.view, PASSENGER_PERMS.admin]) @ApiBearerAuth('IAM-auth') export class FraudController { private readonly logger = new Logger(FraudController.name); @@ -17,7 +17,6 @@ export class FraudController { * Get fraud alerts */ @Get('alerts') - @IamRoles('ADMIN', 'SUPERVISOR') @ApiOperation({ summary: 'Get fraud alerts' }) async getAlerts( @Query('userId') userId?: string, @@ -32,7 +31,6 @@ export class FraudController { * Get fraud rules */ @Get('rules') - @IamRoles('ADMIN') @ApiOperation({ summary: 'Get fraud detection rules' }) async getRules() { const rules = await this.fraudService.getRules(); @@ -43,7 +41,7 @@ export class FraudController { * Create or update fraud rule */ @Post('rules') - @IamRoles('ADMIN') + @PassengerStaff([PASSENGER_PERMS.fraud.manage, PASSENGER_PERMS.admin]) @ApiOperation({ summary: 'Create or update fraud rule' }) async upsertRule(@Body() body: { type: string; config: FraudRuleConfig }) { const rule = await this.fraudService.upsertRule(body.type, body.config); @@ -54,10 +52,10 @@ export class FraudController { * Block user temporarily */ @Post('actions/block') - @IamRoles('ADMIN', 'SUPERVISOR') + @PassengerStaff([PASSENGER_PERMS.fraud.manage, PASSENGER_PERMS.admin]) @ApiOperation({ summary: 'Block user temporarily' }) - async blockUser(@Body() body: { userId: string; durationMinutes: number }) { - await this.fraudService.blockUserTemporarily(body.userId, body.durationMinutes); + async blockUser(@Body() body: { iamUserId: string; durationMinutes: number }) { + await this.fraudService.blockUserTemporarily(body.iamUserId, body.durationMinutes); return { message: `User blocked for ${body.durationMinutes} minutes` }; } @@ -65,10 +63,10 @@ export class FraudController { * Unblock user */ @Post('actions/unblock') - @IamRoles('ADMIN', 'SUPERVISOR') + @PassengerStaff([PASSENGER_PERMS.fraud.manage, PASSENGER_PERMS.admin]) @ApiOperation({ summary: 'Unblock user' }) - async unblockUser(@Body() body: { userId: string }) { - await this.fraudService.unblockUser(body.userId); + async unblockUser(@Body() body: { iamUserId: string }) { + await this.fraudService.unblockUser(body.iamUserId); return { message: 'User unblocked' }; } } diff --git a/apps/edr-passenger-api/src/modules/fraud/fraud.service.ts b/apps/edr-passenger-api/src/modules/fraud/fraud.service.ts index 7c3b66e6b..a75db4449 100644 --- a/apps/edr-passenger-api/src/modules/fraud/fraud.service.ts +++ b/apps/edr-passenger-api/src/modules/fraud/fraud.service.ts @@ -1,5 +1,7 @@ import { Injectable, Logger } from '@nestjs/common'; import { OnEvent } from '@nestjs/event-emitter'; +import { InjectDataSource } from '@nestjs/typeorm'; +import { DataSource } from 'typeorm'; import { PrismaService } from '../../common/prisma.service'; export interface FraudRuleConfig { @@ -14,47 +16,37 @@ export interface FraudRuleConfig { export class FraudService { private readonly logger = new Logger(FraudService.name); - constructor(private prisma: PrismaService) {} + constructor( + private prisma: PrismaService, + @InjectDataSource() private dataSource: DataSource, + ) {} /** * Evaluate fraud rules and create alerts if triggered */ async evaluateRules( - userId: string, + passengerId: string, eventType: 'booking.created' | 'payment.failed' | 'auth.login.failed', context: Record, ): Promise<{ triggered: boolean; rules: string[] }> { const triggeredRules: string[] = []; - const user = await this.prisma.user.findUnique({ where: { id: userId } }); - if (!user) return { triggered: false, rules: [] }; - - // Check velocity rule (multiple bookings in short time) if (eventType === 'booking.created') { - const velocityTriggered = await this.checkVelocityRule(userId); - if (velocityTriggered) { - triggeredRules.push('VELOCITY'); - } + const velocityTriggered = await this.checkVelocityRule(passengerId); + if (velocityTriggered) triggeredRules.push('VELOCITY'); - // Check high-value booking const amount = (context.amountMinor as number) || 0; const highValueTriggered = await this.checkHighValueRule(amount); - if (highValueTriggered) { - triggeredRules.push('HIGH_VALUE'); - } + if (highValueTriggered) triggeredRules.push('HIGH_VALUE'); } - // Check repeated failed payments if (eventType === 'payment.failed') { - const failedPaymentTriggered = await this.checkFailedPaymentRule(userId); - if (failedPaymentTriggered) { - triggeredRules.push('FAILED_PAYMENTS'); - } + const failedPaymentTriggered = await this.checkFailedPaymentRule(passengerId); + if (failedPaymentTriggered) triggeredRules.push('FAILED_PAYMENTS'); } - // Create alert if rules triggered if (triggeredRules.length > 0) { - await this.createFraudAlert(userId, eventType, triggeredRules, context); + await this.createFraudAlert(passengerId, eventType, triggeredRules, context); return { triggered: true, rules: triggeredRules }; } @@ -64,7 +56,7 @@ export class FraudService { /** * Check velocity rule: X bookings in Y minutes */ - private async checkVelocityRule(userId: string): Promise { + private async checkVelocityRule(passengerId: string): Promise { const rule = await this.prisma.fraudRule.findFirst({ where: { type: 'VELOCITY', enabled: true }, }); @@ -72,18 +64,14 @@ export class FraudService { if (!rule) return false; const timeWindowMinutes = (rule.config as any)?.timeWindowMinutes || 30; - const threshold = rule.threshold; - const bookingCount = await this.prisma.booking.count({ where: { - passengerId: userId, - createdAt: { - gte: new Date(Date.now() - timeWindowMinutes * 60 * 1000), - }, + passengerId, + createdAt: { gte: new Date(Date.now() - timeWindowMinutes * 60 * 1000) }, }, }); - return bookingCount > threshold; + return bookingCount > rule.threshold; } /** @@ -104,7 +92,7 @@ export class FraudService { /** * Check failed payment rule: X failed attempts in Y minutes */ - private async checkFailedPaymentRule(userId: string): Promise { + private async checkFailedPaymentRule(passengerId: string): Promise { const rule = await this.prisma.fraudRule.findFirst({ where: { type: 'FAILED_PAYMENTS', enabled: true }, }); @@ -112,33 +100,33 @@ export class FraudService { if (!rule) return false; const timeWindowMinutes = (rule.config as any)?.timeWindowMinutes || 60; - const threshold = rule.threshold; - const failedCount = await this.prisma.paymentIntent.count({ where: { - booking: { passengerId: userId }, + booking: { passengerId }, status: 'FAILED', - updatedAt: { - gte: new Date(Date.now() - timeWindowMinutes * 60 * 1000), - }, + updatedAt: { gte: new Date(Date.now() - timeWindowMinutes * 60 * 1000) }, }, }); - return failedCount > threshold; + return failedCount > rule.threshold; } /** * Create a fraud alert */ private async createFraudAlert( - userId: string, + passengerId: string, eventType: string, triggeredRules: string[], context: Record, ): Promise { + const passenger = await this.prisma.passenger.findUnique({ + where: { id: passengerId }, + select: { iamUserId: true }, + }); const alert = await this.prisma.fraudAlert.create({ data: { - userId, + iamUserId: passenger?.iamUserId ?? passengerId, eventType, triggeredRules, context: context as any, @@ -146,35 +134,34 @@ export class FraudService { }, }); - this.logger.warn(`Fraud alert created: ${alert.id} for user ${userId} - rules: ${triggeredRules.join(', ')}`); + this.logger.warn(`Fraud alert created: ${alert.id} for passenger ${passengerId} - rules: ${triggeredRules.join(', ')}`); - // Trigger blocking if needed if (triggeredRules.includes('HIGH_VALUE') || triggeredRules.length > 1) { - await this.blockUserTemporarily(userId, 30); // Block for 30 minutes + if (passenger?.iamUserId) await this.blockUserTemporarily(passenger.iamUserId, 30); } } /** * Block user temporarily */ - async blockUserTemporarily(userId: string, durationMinutes: number): Promise { + async blockUserTemporarily(iamUserId: string, durationMinutes: number): Promise { const blockedUntil = new Date(Date.now() + durationMinutes * 60 * 1000); - await this.prisma.user.update({ - where: { id: userId }, + await this.prisma.passenger.updateMany({ + where: { iamUserId }, data: { blockedUntil }, }); - this.logger.warn(`User ${userId} blocked until ${blockedUntil.toISOString()}`); + this.logger.warn(`Passenger (iamUserId=${iamUserId}) blocked until ${blockedUntil.toISOString()}`); } /** * Unblock user */ - async unblockUser(userId: string): Promise { - await this.prisma.user.update({ - where: { id: userId }, + async unblockUser(iamUserId: string): Promise { + await this.prisma.passenger.updateMany({ + where: { iamUserId }, data: { blockedUntil: null }, }); - this.logger.log(`User ${userId} unblocked`); + this.logger.log(`Passenger (iamUserId=${iamUserId}) unblocked`); } /** @@ -182,7 +169,7 @@ export class FraudService { */ async getAlerts(userId?: string, limit = 100, offset = 0) { return this.prisma.fraudAlert.findMany({ - where: userId ? { userId } : {}, + where: userId ? { iamUserId: userId } : {}, orderBy: { createdAt: 'desc' }, take: limit, skip: offset, @@ -234,9 +221,10 @@ export class FraudService { * Event listener for payment failed */ @OnEvent('payment.failed') - async onPaymentFailed(payload: { intentId: string; userId: string }) { - await this.evaluateRules(payload.userId, 'payment.failed', { - intentId: payload.intentId, + async onPaymentFailed(payload: { booking: { passengerId: string; id: string } }) { + if (!payload.booking?.passengerId) return; + await this.evaluateRules(payload.booking.passengerId, 'payment.failed', { + bookingId: payload.booking.id, }); } @@ -244,9 +232,18 @@ export class FraudService { * Event listener for auth login failed */ @OnEvent('auth.login.failed') - async onLoginFailed(payload: { userId: string; email: string }) { - await this.evaluateRules(payload.userId, 'auth.login.failed', { - email: payload.email, + async onLoginFailed(payload: { email: string }) { + if (!payload.email) return; + const iamRows = await this.dataSource.query<{ id: string }[]>( + `SELECT id FROM iam.users WHERE email = $1 LIMIT 1`, + [payload.email], + ); + if (!iamRows.length) return; + const passenger = await this.prisma.passenger.findUnique({ + where: { iamUserId: iamRows[0].id }, + select: { id: true }, }); + if (!passenger) return; + await this.evaluateRules(passenger.id, 'auth.login.failed', { email: payload.email }); } } diff --git a/apps/edr-passenger-api/src/modules/notifications/notifications.controller.ts b/apps/edr-passenger-api/src/modules/notifications/notifications.controller.ts index b622e3b7d..f27bd8ecd 100644 --- a/apps/edr-passenger-api/src/modules/notifications/notifications.controller.ts +++ b/apps/edr-passenger-api/src/modules/notifications/notifications.controller.ts @@ -2,7 +2,8 @@ import { Controller, Get, Param, Patch, Post, Body, UseGuards } from '@nestjs/co import { ApiTags, ApiOperation, ApiBearerAuth, ApiBody } from '@nestjs/swagger'; import { NotificationsService } from './notifications.service'; import { JwtGuard } from '../../common/jwt.guard'; -import { IamGuard, IamRoles } from '../../common/iam-adapter'; +import { PassengerStaff } from '../../common/passenger-guards'; +import { PASSENGER_PERMS } from '../../seed/passenger-permissions.registry'; import { TestNotificationDto } from './notifications.dto'; import { EmailClientService } from './email-client.service'; import { SmsClientService } from './sms-client.service'; @@ -39,8 +40,7 @@ export class NotificationsController { } @Post('send/email') - @UseGuards(IamGuard) - @IamRoles('ADMIN', 'STAFF') + @PassengerStaff([PASSENGER_PERMS.notifications.send, PASSENGER_PERMS.admin]) @ApiOperation({ summary: 'Send a direct email via the email microservice' }) @ApiBody({ type: SendEmail }) sendEmail(@Body() dto: SendEmail) { @@ -48,8 +48,7 @@ export class NotificationsController { } @Post('send/sms') - @UseGuards(IamGuard) - @IamRoles('ADMIN', 'STAFF') + @PassengerStaff([PASSENGER_PERMS.notifications.send, PASSENGER_PERMS.admin]) @ApiOperation({ summary: 'Send a direct SMS via the SMS microservice' }) @ApiBody({ type: SingleMessageDto }) sendSms(@Body() dto: SingleMessageDto) { @@ -57,8 +56,7 @@ export class NotificationsController { } @Post('send/sms/bulk') - @UseGuards(IamGuard) - @IamRoles('ADMIN', 'STAFF') + @PassengerStaff([PASSENGER_PERMS.notifications.send, PASSENGER_PERMS.admin]) @ApiOperation({ summary: 'Send bulk SMS messages via the SMS microservice' }) @ApiBody({ type: BulkMessagesDto }) sendBulkSms(@Body() dto: BulkMessagesDto) { @@ -66,8 +64,6 @@ export class NotificationsController { } @Post('test') - @UseGuards(IamGuard) - @IamRoles('ADMIN', 'STAFF') @ApiOperation({ summary: 'Test notification delivery (Admin only)' }) async testNotification(@Body() dto: TestNotificationDto) { return this.service.send( diff --git a/apps/edr-passenger-api/src/modules/notifications/notifications.service.ts b/apps/edr-passenger-api/src/modules/notifications/notifications.service.ts index 0c6add4b2..db09ab402 100644 --- a/apps/edr-passenger-api/src/modules/notifications/notifications.service.ts +++ b/apps/edr-passenger-api/src/modules/notifications/notifications.service.ts @@ -1,5 +1,7 @@ import { Injectable, Logger } from '@nestjs/common'; import { OnEvent } from '@nestjs/event-emitter'; +import { InjectDataSource } from '@nestjs/typeorm'; +import { DataSource } from 'typeorm'; import { PrismaService } from '../../common/prisma.service'; import { PushAdapter, NotificationChannel } from './notification.adapters'; import { EmailClientService } from './email-client.service'; @@ -7,6 +9,8 @@ import { SmsClientService } from './sms-client.service'; export type NotificationChannelType = 'EMAIL' | 'SMS' | 'PUSH' | 'IN_APP'; +const UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i; + @Injectable() export class NotificationsService { private readonly logger = new Logger(NotificationsService.name); @@ -14,6 +18,7 @@ export class NotificationsService { constructor( private prisma: PrismaService, + @InjectDataSource() private readonly dataSource: DataSource, private emailClient: EmailClientService, private smsClient: SmsClientService, private pushAdapter: PushAdapter, @@ -112,22 +117,20 @@ export class NotificationsService { body: string, context: Record, ): Promise { - // Try to find passenger by ID or email let passengerId = recipient; - if (!recipient.match(/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i)) { - const user = await this.prisma.user.findFirst({ - where: { - OR: [{ email: recipient }, { phone: recipient }], - }, - include: { passenger: true }, - }); - if (user?.passenger) { - passengerId = user.passenger.id; - } else { + if (!UUID_RE.test(recipient)) { + const iamUserId = await this.resolveIamUserId(recipient); + if (!iamUserId) { this.logger.warn(`Could not find passenger for recipient: ${recipient}`); return; } + const passenger = await this.prisma.passenger.findUnique({ where: { iamUserId } }); + if (!passenger) { + this.logger.warn(`Could not find passenger for recipient: ${recipient}`); + return; + } + passengerId = passenger.id; } await this.prisma.notification.create({ @@ -163,26 +166,19 @@ export class NotificationsService { } private async getUserPreferredChannels(recipient: string): Promise { - const user = await this.prisma.user.findFirst({ - where: { - OR: [ - { id: recipient }, - { email: recipient }, - { phone: recipient }, - { passenger: { id: recipient } }, - ], - }, - include: { preferences: true }, - }); + const iamUserId = await this.resolveIamUserId(recipient); + const preferences = iamUserId + ? await this.prisma.userPreferences.findUnique({ where: { iamUserId } }) + : null; - if (!user?.preferences) { + if (!preferences) { return ['IN_APP', 'EMAIL']; } const channels: NotificationChannelType[] = ['IN_APP']; - if (user.preferences.emailEnabled) channels.push('EMAIL'); - if (user.preferences.smsEnabled) channels.push('SMS'); - if (user.preferences.pushEnabled) channels.push('PUSH'); + if (preferences.emailEnabled) channels.push('EMAIL'); + if (preferences.smsEnabled) channels.push('SMS'); + if (preferences.pushEnabled) channels.push('PUSH'); return channels; } @@ -191,32 +187,44 @@ export class NotificationsService { recipient: string, channel: NotificationChannelType, ): Promise { - const user = await this.prisma.user.findFirst({ - where: { - OR: [ - { id: recipient }, - { email: recipient }, - { phone: recipient }, - { passenger: { id: recipient } }, - ], - }, - }); - - if (!user) return null; + const iamUserId = await this.resolveIamUserId(recipient); + if (!iamUserId) return null; + const contact = await this.resolveContactInfo(iamUserId); switch (channel) { - case 'EMAIL': - return user.email; - case 'SMS': - return user.phone; - case 'PUSH': - // Would need to fetch device push token - return user.id; - default: - return null; + case 'EMAIL': return contact.email; + case 'SMS': return contact.phone; + case 'PUSH': return iamUserId; + default: return null; } } + private async resolveIamUserId(recipient: string): Promise { + if (UUID_RE.test(recipient)) { + const passenger = await this.prisma.passenger.findUnique({ where: { id: recipient } }); + return passenger?.iamUserId ?? recipient; + } + const rows = await this.dataSource.query<{ id: string }[]>( + `SELECT id FROM iam.users WHERE email = $1 OR phone_number = $1 LIMIT 1`, + [recipient], + ); + return rows[0]?.id ?? null; + } + + private async resolveContactInfo(iamUserId: string): Promise<{ email: string | null; phone: string | null }> { + const rows = await this.dataSource.query<{ email: string; phone_number: string | null }[]>( + `SELECT email, phone_number FROM iam.users WHERE id = $1 LIMIT 1`, + [iamUserId], + ); + return { email: rows[0]?.email ?? null, phone: rows[0]?.phone_number ?? null }; + } + + private sanitize(value: string): string { + return value + .replace(/[\r\n]/g, ' ') + .replace(/[<>&"']/g, (c) => ({ '<': '<', '>': '>', '&': '&', '"': '"', "'": ''' }[c] ?? c)); + } + getForPassenger(passengerId: string) { return this.prisma.notification.findMany({ where: { passengerId }, diff --git a/apps/edr-passenger-api/src/modules/passengers/passengers.controller.ts b/apps/edr-passenger-api/src/modules/passengers/passengers.controller.ts index 24aadbd4c..a03750965 100644 --- a/apps/edr-passenger-api/src/modules/passengers/passengers.controller.ts +++ b/apps/edr-passenger-api/src/modules/passengers/passengers.controller.ts @@ -3,7 +3,6 @@ import { ApiTags, ApiOperation, ApiBearerAuth, ApiResponse, ApiQuery } from '@ne import { PassengersService } from './passengers.service'; import { CreateTravelerProfileDto, CreateSavedRouteDto, VerifyFaydaDto, SavePassengersDto, RegisterPassengerDto } from './passengers.dto'; import { JwtGuard } from '../../common/jwt.guard'; -import { IamGuard } from '../../common/iam-adapter'; import { VerifaydaService } from '../verifayda/verifayda.service'; import { OptionalJwtGuard } from '../verifayda/optional-jwt.guard'; import { PrismaService } from '../../common/prisma.service'; @@ -53,25 +52,17 @@ export class PassengersController { }) @ApiResponse({ status: 401, description: 'Unauthorized - Invalid or missing token' }) async getMe(@Request() req: any) { - if (!req.user || !req.user.userId) { + if (!req.user || !req.user.id) { throw new UnauthorizedException('User not authenticated'); } try { - const user = await this.prisma.user.findUnique({ - where: { id: req.user.userId }, - include: { - passenger: true, - }, + const passenger = await this.prisma.passenger.findUnique({ + where: { iamUserId: req.user.id }, }); - - if (!user || !user.passenger) { - return null; - } - - return this.service.getProfile(user.passenger.id); + if (!passenger) return null; + return this.service.getProfile(passenger.id); } catch (error) { - // If profile lookup fails for any reason, return null to allow app to continue return null; } } @@ -251,7 +242,7 @@ The API automatically detects: description: 'Invalid JWT token (only if token provided but invalid)' }) registerPassenger(@Body() dto: RegisterPassengerDto, @Request() req: any) { - const userId = req.user?.userId; + const userId = req.user?.id; return this.service.registerPassenger({ ...dto, userId }); } diff --git a/apps/edr-passenger-api/src/modules/passengers/passengers.service.ts b/apps/edr-passenger-api/src/modules/passengers/passengers.service.ts index a4c9b8a30..a9f6c8f77 100644 --- a/apps/edr-passenger-api/src/modules/passengers/passengers.service.ts +++ b/apps/edr-passenger-api/src/modules/passengers/passengers.service.ts @@ -1,4 +1,6 @@ import { Injectable, NotFoundException, BadRequestException } from '@nestjs/common'; +import { InjectDataSource } from '@nestjs/typeorm'; +import { DataSource } from 'typeorm'; import { PrismaService } from '../../common/prisma.service'; import { CreateTravelerProfileDto, CreateSavedRouteDto, RegisterPassengerDto } from './passengers.dto'; import { VerifaydaService } from '../verifayda/verifayda.service'; @@ -10,37 +12,68 @@ interface PassengerFilters { pageSize?: number; } +type IamUserRow = { + id: string; + email: string; + name: { en: string; am: string } | null; + phone_number: string | null; + metadata: Record | null; +}; + @Injectable() export class PassengersService { constructor( - private prisma: PrismaService, - private verifaydaService: VerifaydaService, + private readonly prisma: PrismaService, + @InjectDataSource() private readonly dataSource: DataSource, + private readonly verifaydaService: VerifaydaService, ) {} async findAll(filters: PassengerFilters = {}) { const { search, verified, page = 1, pageSize = 20 } = filters; const skip = (page - 1) * pageSize; - - const where: any = { user: { role: 'PASSENGER' } }; - - if (search) { - where.user = { - ...where.user, - OR: [ - { fullName: { contains: search, mode: 'insensitive' } }, - { email: { contains: search, mode: 'insensitive' } }, - { phone: { contains: search, mode: 'insensitive' } }, - ], - }; + + let iamUserIdFilter: string[] | null = null; + + if (search || verified !== undefined) { + const conditions: string[] = []; + const params: any[] = []; + let idx = 1; + + if (search) { + conditions.push(`( + u.email ILIKE $${idx} OR + u.phone_number ILIKE $${idx} OR + (u.name->>'en') ILIKE $${idx} OR + (u.name->>'am') ILIKE $${idx} + )`); + params.push(`%${search}%`); + idx++; + } + + if (verified !== undefined) { + if (verified) { + conditions.push(`u.metadata->>'faydaVerified' = 'true'`); + } else { + conditions.push(`(u.metadata IS NULL OR u.metadata->>'faydaVerified' IS DISTINCT FROM 'true')`); + } + } + + const rows = await this.dataSource.query<{ id: string }[]>( + `SELECT u.id FROM iam.users u WHERE ${conditions.join(' AND ')}`, + params, + ); + iamUserIdFilter = rows.map(r => r.id); + + if (iamUserIdFilter.length === 0) { + return { items: [], meta: { page, pageSize, total: 0, totalPages: 0 } }; + } } - - if (verified !== undefined) { - where.user = { - ...where.user, - nationalId: verified ? { not: null } : null, - }; + + const where: any = {}; + if (iamUserIdFilter) { + where.iamUserId = { in: iamUserIdFilter }; } - + const [items, total] = await Promise.all([ this.prisma.passenger.findMany({ where, @@ -48,42 +81,36 @@ export class PassengersService { take: pageSize, orderBy: { createdAt: 'desc' }, include: { - user: true, loyalty: true, - wallet: true, - _count: { - select: { - bookings: true, - }, - }, + _count: { select: { bookings: true } }, }, }), this.prisma.passenger.count({ where }), ]); - + + const iamUserIds = items.map(p => p.iamUserId).filter(Boolean) as string[]; + const iamRows = iamUserIds.length > 0 + ? await this.dataSource.query( + `SELECT id, email, name, phone_number, metadata FROM iam.users WHERE id = ANY($1)`, + [iamUserIds], + ) + : []; + const iamMap = new Map(iamRows.map(r => [r.id, r])); + return { items: items.map(passenger => { - const user = passenger.user as any; + const iam = passenger.iamUserId ? iamMap.get(passenger.iamUserId) : undefined; + const faydaVerified = iam?.metadata?.faydaVerified === true || iam?.metadata?.faydaVerified === 'true'; return { id: passenger.id, - userId: passenger.userId, - fullName: user.fullName, - email: user.email, - phone: user.phone?.startsWith('+guest-') ? null : user.phone, - nationalId: user.nationalId, - nationality: user.nationality, - dateOfBirth: user.dateOfBirth ?? null, - gender: user.gender ?? null, - passportNumber: user.passportNumber, - passportCountry: user.passportCountry ?? null, - verified: !!user.nationalId, + fullName: iam?.name?.en ?? iam?.name?.am ?? null, + email: iam?.email ?? null, + phone: iam?.phone_number ?? null, + verified: faydaVerified, loyaltyTier: passenger.loyalty?.tier || 'BRONZE', loyaltyPoints: passenger.loyalty?.pointsBalance || 0, totalBookings: passenger._count.bookings, createdAt: passenger.createdAt, - updatedAt: user.updatedAt, - loyalty: passenger.loyalty, - wallet: passenger.wallet, }; }), meta: { @@ -99,33 +126,42 @@ export class PassengersService { const passenger = await this.prisma.passenger.findUnique({ where: { id: passengerId }, include: { - user: true, - bookings: { - orderBy: { createdAt: 'desc' }, - take: 10, - include: { - schedule: { include: { originStation: true, destinationStation: true, train: true } }, - seats: { include: { seat: { include: { coach: true } } } } - } + bookings: { + orderBy: { createdAt: 'desc' }, + take: 10, + include: { + schedule: { include: { originStation: true, destinationStation: true, train: true } }, + seats: { include: { seat: { include: { coach: true } } } }, + }, }, - loyalty: true, - wallet: true, - travelerProfiles: true, + loyalty: true, + wallet: true, + travelerProfiles: true, savedRoutes: true, }, }); if (!passenger) throw new NotFoundException('Passenger not found'); + + let iamUser: IamUserRow | null = null; + if (passenger.iamUserId) { + const rows = await this.dataSource.query( + `SELECT id, email, name, phone_number, metadata FROM iam.users WHERE id = $1 LIMIT 1`, + [passenger.iamUserId], + ); + iamUser = rows[0] ?? null; + } + return { id: passenger.id, - fullName: passenger.user.fullName, - email: passenger.user.email, - phone: passenger.user.phone, + fullName: iamUser?.name?.en ?? iamUser?.name?.am ?? null, + email: iamUser?.email ?? null, + phone: iamUser?.phone_number ?? null, createdAt: passenger.createdAt, bookings: passenger.bookings.map((b) => ({ - id: b.id, - bookingRef: b.bookingRef, - status: b.status, - totalFare: b.totalMinor / 100, + id: b.id, + bookingRef: b.bookingRef, + status: b.status, + totalFare: b.totalMinor / 100, createdAt: b.createdAt, trip: { number: b.schedule.train.number, @@ -143,13 +179,9 @@ export class PassengersService { }, departureAt: b.schedule.departureAt, }, - passengers: b.seats.map((bs) => ({ - fullName: bs.passengerName, - seat: { - number: bs.seat.seatNumber, - coach: bs.seat.coach.number, - class: 'N/A' - } + passengers: b.seats.map((bs) => ({ + fullName: bs.passengerName, + seat: { number: bs.seat.seatNumber, coach: bs.seat.coach.number, class: 'N/A' }, })), })), }; @@ -229,23 +261,53 @@ export class PassengersService { async updatePassenger(id: string, dto: any) { const passenger = await this.prisma.passenger.findUnique({ where: { id } }); if (!passenger) throw new NotFoundException('Passenger not found'); - return this.prisma.passenger.update({ - where: { id }, - data: { - user: { - update: { - fullName: dto.fullName || undefined, - email: dto.email || undefined, - phone: dto.phone || undefined, - nationality: dto.nationality || undefined, - }, - }, - }, - include: { - user: true, - loyalty: true, - }, - }); + + if (passenger.iamUserId && (dto.fullName || dto.email || dto.phone)) { + const updates: string[] = []; + const params: any[] = []; + let idx = 1; + + if (dto.fullName) { + updates.push(`name = COALESCE(name, '{}') || jsonb_build_object('en', $${idx}::text, 'am', $${idx}::text)`); + params.push(dto.fullName); + idx++; + } + if (dto.email) { + updates.push(`email = $${idx}`); + params.push(dto.email); + idx++; + } + if (dto.phone) { + updates.push(`phone_number = $${idx}`); + params.push(dto.phone); + idx++; + } + + params.push(passenger.iamUserId); + await this.dataSource.query( + `UPDATE iam.users SET ${updates.join(', ')} WHERE id = $${idx}`, + params, + ); + } + + const [updated, iamRows] = await Promise.all([ + this.prisma.passenger.findUnique({ where: { id }, include: { loyalty: true } }), + passenger.iamUserId + ? this.dataSource.query( + `SELECT id, email, name, phone_number, metadata FROM iam.users WHERE id = $1 LIMIT 1`, + [passenger.iamUserId], + ) + : Promise.resolve([] as IamUserRow[]), + ]); + + const iamUser = iamRows[0] ?? null; + return { + id: updated!.id, + fullName: iamUser?.name?.en ?? iamUser?.name?.am ?? null, + email: iamUser?.email ?? null, + phone: iamUser?.phone_number ?? null, + loyalty: updated!.loyalty, + }; } async registerPassenger(dto: RegisterPassengerDto) { @@ -274,31 +336,16 @@ export class PassengersService { }; if (isLoggedIn) { - const user = await this.prisma.user.findUnique({ - where: { id: dto.userId }, - include: { passenger: true }, + const linkedPassenger = await this.prisma.passenger.findUnique({ + where: { iamUserId: dto.userId }, }); - if (!user) { - throw new BadRequestException('User not found'); - } - - if (!user.faydaVerified && verifiedData) { - await this.prisma.user.update({ - where: { id: dto.userId }, - data: { - fullName: finalData.passengerName, - nationality: finalData.nationality, - nationalId: dto.nationalId, - passportNumber: dto.passportNumber, - faydaVerified: !!verifiedData, - faydaVerifiedAt: verifiedData ? new Date() : null, - }, - }); + if (!linkedPassenger) { + throw new BadRequestException('Passenger not found'); } return { - id: user.passenger?.id || user.id, + id: linkedPassenger.id, passengerName: finalData.passengerName, dateOfBirth: finalData.dateOfBirth, nationality: finalData.nationality, @@ -336,7 +383,9 @@ export class PassengersService { async deletePassenger(id: string) { const passenger = await this.prisma.passenger.findUnique({ where: { id } }); if (!passenger) throw new NotFoundException('Passenger not found'); - return this.prisma.passenger.delete({ where: { id } }); + + await this.prisma.passenger.delete({ where: { id } }); + return { deleted: true, passengerId: id }; } async checkPassengerUsage(id: string) { diff --git a/apps/edr-passenger-api/src/modules/payments/payments.controller.ts b/apps/edr-passenger-api/src/modules/payments/payments.controller.ts index a64c4ae9c..4cb79a89f 100644 --- a/apps/edr-passenger-api/src/modules/payments/payments.controller.ts +++ b/apps/edr-passenger-api/src/modules/payments/payments.controller.ts @@ -28,10 +28,8 @@ import { PaymentMethodTypeEnum, PaymentPlatformDto, } from "./payments.dto"; -import { JwtGuard } from "../../common/jwt.guard"; -import { RolesGuard } from "../../common/roles.guard"; -import { Roles } from "../../common/roles.decorator"; -import { UserRole } from "@prisma/client"; +import { PassengerStaff } from "../../common/passenger-guards"; +import { PASSENGER_PERMS } from "../../seed/passenger-permissions.registry"; @ApiTags("Payment") @Controller("payments") @@ -39,9 +37,8 @@ export class PaymentsController { constructor(private service: PaymentsService) {} @Get("all") - @UseGuards(JwtGuard, RolesGuard) - @Roles(UserRole.ADMIN, UserRole.SUPERVISOR, UserRole.STAFF) - @ApiBearerAuth("JWT-auth") + @PassengerStaff([PASSENGER_PERMS.payments.viewAll, PASSENGER_PERMS.admin]) + @ApiBearerAuth("IAM-auth") @ApiOperation({ summary: "Get all payments with filters (staff/admin only)" }) @ApiQuery({ name: "search", required: false }) @ApiQuery({ name: "status", required: false }) @@ -102,18 +99,16 @@ export class PaymentsController { } @Post("refund") - @UseGuards(JwtGuard, RolesGuard) - @Roles(UserRole.ADMIN, UserRole.STAFF, UserRole.AGENT) - @ApiBearerAuth("JWT-auth") + @PassengerStaff([PASSENGER_PERMS.payments.refund, PASSENGER_PERMS.admin]) + @ApiBearerAuth("IAM-auth") @ApiOperation({ summary: "Refund a confirmed booking (staff/agent only)" }) refund(@Body() dto: RefundDto) { return this.service.refund(dto); } @Post("methods") - @UseGuards(JwtGuard, RolesGuard) - @Roles(UserRole.ADMIN, UserRole.STAFF) - @ApiBearerAuth("JWT-auth") + @PassengerStaff([PASSENGER_PERMS.payments.manageMethods, PASSENGER_PERMS.admin]) + @ApiBearerAuth("IAM-auth") @ApiOperation({ summary: "Add a payment system to the platform catalog (admin only)", }) diff --git a/apps/edr-passenger-api/src/modules/payments/payments.e2e-spec.ts b/apps/edr-passenger-api/src/modules/payments/payments.e2e-spec.ts index 0fd594b39..5393696bf 100644 --- a/apps/edr-passenger-api/src/modules/payments/payments.e2e-spec.ts +++ b/apps/edr-passenger-api/src/modules/payments/payments.e2e-spec.ts @@ -23,19 +23,7 @@ describe("Payments E2E", () => { prisma = app.get(PrismaService); - const testUser = await prisma.user.create({ - data: { - email: "payment-test@example.com", - phone: "+251911111112", - fullName: "Payment Test User", - passwordHash: "$2b$10$abcdefghijklmnopqrstuvwxyz", - role: "PASSENGER", - }, - }); - - const passenger = await prisma.passenger.create({ - data: { userId: testUser.id }, - }); + const passenger = await prisma.passenger.create({ data: { iamUserId: 'test-iam-payments-user' } }); await prisma.walletAccount.create({ data: { @@ -151,7 +139,6 @@ describe("Payments E2E", () => { prisma.walletLedgerEntry.deleteMany(), prisma.walletAccount.deleteMany(), prisma.passenger.deleteMany(), - prisma.user.deleteMany({ where: { email: "payment-test@example.com" } }), ]); await app.close(); }); diff --git a/apps/edr-passenger-api/src/modules/reports/reports.controller.ts b/apps/edr-passenger-api/src/modules/reports/reports.controller.ts index 772a1428c..0c0d02ea4 100644 --- a/apps/edr-passenger-api/src/modules/reports/reports.controller.ts +++ b/apps/edr-passenger-api/src/modules/reports/reports.controller.ts @@ -1,33 +1,30 @@ -import { Body, Controller, Get, Param, Post, Query, UseGuards } from '@nestjs/common'; +import { Body, Controller, Get, Param, Post, Query } from '@nestjs/common'; import { ApiTags, ApiOperation, ApiBearerAuth } from '@nestjs/swagger'; import { ReportsService } from './reports.service'; import { GenerateReportDto } from './reports.dto'; -import { IamGuard, IamRoles } from '../../common/iam-adapter'; -import { UserRole } from '@prisma/client'; +import { PassengerStaff } from '../../common/passenger-guards'; +import { PASSENGER_PERMS } from '../../seed/passenger-permissions.registry'; @ApiTags('Reports') @Controller('reports') -@UseGuards(IamGuard) +@PassengerStaff([PASSENGER_PERMS.reports.view, PASSENGER_PERMS.admin]) @ApiBearerAuth('IAM-auth') export class ReportsController { constructor(private service: ReportsService) {} @Post('generate') - @IamRoles('ADMIN', 'SUPERVISOR') @ApiOperation({ summary: 'Generate operational report' }) generateReport(@Body() dto: GenerateReportDto) { return this.service.generateReport(dto); } @Get(':reportId') - @IamRoles('ADMIN', 'SUPERVISOR') @ApiOperation({ summary: 'Get report by ID' }) getReport(@Param('reportId') reportId: string) { return this.service.getReport(reportId); } @Get() - @IamRoles('ADMIN', 'SUPERVISOR') @ApiOperation({ summary: 'List reports' }) listReports(@Query('type') type?: string) { return this.service.listReports(type); diff --git a/apps/edr-passenger-api/src/modules/reports/reports.service.ts b/apps/edr-passenger-api/src/modules/reports/reports.service.ts index d1f25dde7..5c1b5e582 100644 --- a/apps/edr-passenger-api/src/modules/reports/reports.service.ts +++ b/apps/edr-passenger-api/src/modules/reports/reports.service.ts @@ -1,10 +1,15 @@ import { Injectable } from '@nestjs/common'; +import { InjectDataSource } from '@nestjs/typeorm'; +import { DataSource } from 'typeorm'; import { PrismaService } from '../../common/prisma.service'; import { GenerateReportDto, ReportType } from './reports.dto'; @Injectable() export class ReportsService { - constructor(private prisma: PrismaService) {} + constructor( + private prisma: PrismaService, + @InjectDataSource() private dataSource: DataSource, + ) {} async generateReport(dto: GenerateReportDto) { const dateFrom = new Date(dto.dateFrom); @@ -113,13 +118,25 @@ export class ReportsService { ...(agentId ? { agentId } : {}) }, include: { - agent: { include: { user: true } }, + agent: { select: { id: true, iamUserId: true, agentCode: true } }, booking: true } }); + const iamUserIds = [...new Set( + agentBookings.map(ab => ab.agent.iamUserId).filter(Boolean) as string[] + )]; + const iamRows = iamUserIds.length > 0 + ? await this.dataSource.query<{ id: string; name: { en?: string; am?: string } | null }[]>( + `SELECT id, name FROM iam.users WHERE id = ANY($1)`, + [iamUserIds], + ) + : []; + const iamMap = new Map(iamRows.map(r => [r.id, r])); + const byAgent = agentBookings.reduce((acc, ab) => { - const agentName = ab.agent.user.fullName; + const iam = ab.agent.iamUserId ? iamMap.get(ab.agent.iamUserId) : undefined; + const agentName = iam?.name?.en ?? iam?.name?.am ?? ab.agent.agentCode; if (!acc[agentName]) { acc[agentName] = { bookings: 0, revenueMinor: 0, cashCollected: 0 }; } diff --git a/apps/edr-passenger-api/src/modules/seats/seats.module.ts b/apps/edr-passenger-api/src/modules/seats/seats.module.ts index 99bbadaa2..97c2268c7 100644 --- a/apps/edr-passenger-api/src/modules/seats/seats.module.ts +++ b/apps/edr-passenger-api/src/modules/seats/seats.module.ts @@ -3,7 +3,6 @@ import { HttpModule } from '@nestjs/axios'; import { SeatsController } from './seats.controller'; import { SeatsService } from './seats.service'; import { SegmentsModule } from '../segments/segments.module'; -import { IamModule } from '../../common/iam.module'; import { SystemConfigModule } from '../system-config/system-config.module'; @Module({ diff --git a/apps/edr-passenger-api/src/modules/tickets/tickets.service.ts b/apps/edr-passenger-api/src/modules/tickets/tickets.service.ts index b7d335ad5..7bbe580fc 100644 --- a/apps/edr-passenger-api/src/modules/tickets/tickets.service.ts +++ b/apps/edr-passenger-api/src/modules/tickets/tickets.service.ts @@ -1,4 +1,6 @@ import { Injectable, NotFoundException, BadRequestException } from '@nestjs/common'; +import { InjectDataSource } from '@nestjs/typeorm'; +import { DataSource } from 'typeorm'; import { PrismaService } from '../../common/prisma.service'; import * as QRCode from 'qrcode'; @@ -12,7 +14,10 @@ interface OfflineValidation { @Injectable() export class TicketsService { - constructor(private prisma: PrismaService) {} + constructor( + private readonly prisma: PrismaService, + @InjectDataSource() private readonly dataSource: DataSource, + ) {} async listTickets(filters: { search?: string; status?: string; originStationId?: string; destinationStationId?: string; arrivalDate?: string; skip: number; take: number }) { const where: any = {}; @@ -38,50 +43,68 @@ export class TicketsService { end.setDate(end.getDate() + 1); where.booking = { ...where.booking, schedule: { ...where.booking?.schedule, arrivalAt: { gte: start, lt: end } } }; } - const tickets = await this.prisma.ticket.findMany({ - where, - include: { - booking: { - include: { - schedule: { include: { originStation: true, destinationStation: true, train: true } }, - returnSchedule: { select: { departureAt: true, arrivalAt: true, originStation: true, destinationStation: true } }, - seats: { include: { seat: { include: { coach: { include: { coachType: true } } } } } }, - passenger: { include: { user: true } }, + const [tickets, total] = await Promise.all([ + this.prisma.ticket.findMany({ + where, + include: { + booking: { + include: { + schedule: { include: { originStation: true, destinationStation: true, train: true } }, + returnSchedule: { select: { departureAt: true, arrivalAt: true, originStation: true, destinationStation: true } }, + seats: { include: { seat: { include: { coach: { include: { coachType: true } } } } } }, + passenger: { select: { id: true, iamUserId: true } }, + }, }, }, - }, - skip: filters.skip, - take: filters.take, - orderBy: { issuedAt: 'desc' }, - }); - const total = await this.prisma.ticket.count({ where }); + skip: filters.skip, + take: filters.take, + orderBy: { issuedAt: 'desc' }, + }), + this.prisma.ticket.count({ where }), + ]); + + const iamUserIds = tickets.map(t => t.booking.passenger?.iamUserId).filter(Boolean) as string[]; + const iamRows = iamUserIds.length > 0 + ? await this.dataSource.query<{ id: string; email: string; name: any; phone_number: string | null }[]>( + `SELECT id, email, name, phone_number FROM iam.users WHERE id = ANY($1)`, + [iamUserIds], + ) + : []; + const iamMap = new Map(iamRows.map(r => [r.id, r])); + return { - items: tickets.map((t) => ({ - id: t.id, - ticketNumber: t.barcodePayload, - bookingRef: t.bookingRef, - booking: { - bookingRef: t.booking.bookingRef, - status: t.booking.status, - bookingType: t.booking.bookingType, - returnLegStatus: (t.booking as any).returnLegStatus ?? null, - outboundBoardedAt: (t.booking as any).outboundBoardedAt ?? null, - returnBoardedAt: (t.booking as any).returnBoardedAt ?? null, - totalMinor: t.booking.totalMinor, - currency: t.booking.currency, - displayCurrency: t.booking.displayCurrency, - displayTotalMinor: t.booking.displayTotalMinor, - passenger: t.booking.passenger?.user || { fullName: 'Guest', email: t.booking.contactEmail }, - contactEmail: t.booking.contactEmail, - contactPhone: t.booking.contactPhone, - returnSchedule: (t.booking as any).returnSchedule ?? null, - }, - schedule: t.booking.schedule, - seat: t.booking.seats[0]?.seat, - status: t.status, - validatedAt: t.validatedAt, - createdAt: t.issuedAt, - })), + items: tickets.map((t) => { + const iam = t.booking.passenger?.iamUserId ? iamMap.get(t.booking.passenger.iamUserId) : undefined; + const passengerInfo = iam + ? { fullName: iam.name?.en ?? iam.name?.am ?? null, email: iam.email, phone: iam.phone_number } + : { fullName: 'Guest', email: t.booking.contactEmail, phone: null }; + return { + id: t.id, + ticketNumber: t.barcodePayload, + bookingRef: t.bookingRef, + booking: { + bookingRef: t.booking.bookingRef, + status: t.booking.status, + bookingType: t.booking.bookingType, + returnLegStatus: (t.booking as any).returnLegStatus ?? null, + outboundBoardedAt: (t.booking as any).outboundBoardedAt ?? null, + returnBoardedAt: (t.booking as any).returnBoardedAt ?? null, + totalMinor: t.booking.totalMinor, + currency: t.booking.currency, + displayCurrency: t.booking.displayCurrency, + displayTotalMinor: t.booking.displayTotalMinor, + passenger: passengerInfo, + contactEmail: t.booking.contactEmail, + contactPhone: t.booking.contactPhone, + returnSchedule: (t.booking as any).returnSchedule ?? null, + }, + schedule: t.booking.schedule, + seat: t.booking.seats[0]?.seat, + status: t.status, + validatedAt: t.validatedAt, + createdAt: t.issuedAt, + }; + }), total, skip: filters.skip, take: filters.take, @@ -390,8 +413,8 @@ export class TicketsService { where: { scheduleId: tripId, status: 'CONFIRMED' }, include: { ticket: true, - seats: { include: { seat: { include: { coach: { include: { coachType: true } } } } } }, - passenger: { include: { user: true } }, + seats: { include: { seat: { include: { coach: true } } } }, + passenger: { select: { id: true, iamUserId: true } }, }, }); diff --git a/apps/edr-passenger-api/src/modules/verifayda/optional-jwt.guard.ts b/apps/edr-passenger-api/src/modules/verifayda/optional-jwt.guard.ts index 5f5fac19b..8673aa60e 100644 --- a/apps/edr-passenger-api/src/modules/verifayda/optional-jwt.guard.ts +++ b/apps/edr-passenger-api/src/modules/verifayda/optional-jwt.guard.ts @@ -1,21 +1,30 @@ -import { Injectable } from '@nestjs/common'; -import { AuthGuard } from '@nestjs/passport'; +import { CanActivate, ExecutionContext, Injectable } from '@nestjs/common'; +import { Reflector } from '@nestjs/core'; +import { InjectDataSource } from '@nestjs/typeorm'; +import { JwtGuard as IamJwtGuard } from '@tria-plc/api-common/modules/auth/services/jwt.guard'; +import { DataSource } from 'typeorm'; /** - * Like {@link JwtGuard}, but never rejects the request. + * Like the IAM JwtGuard, but never rejects the request. * - * When a valid `Authorization: Bearer ` is present, `request.user` is - * populated from the JWT strategy (`{ userId, ... }`). When the token is - * missing or invalid, the request still proceeds with `request.user` - * undefined — the handler decides what to do. - * - * Used on `POST /fayda/verification/start`, which must work for both - * logged-in users (who can opt to save the verification to their account) - * and guests (anchored to a booking only). + * When a valid IAM bearer token is present, `request.user` is populated with + * the package `TCurrentUser`. Missing or invalid tokens continue as guests. */ @Injectable() -export class OptionalJwtGuard extends AuthGuard('jwt') { - handleRequest(_err: unknown, user: TUser): TUser { - return (user ?? null) as TUser; +export class OptionalJwtGuard extends IamJwtGuard implements CanActivate { + constructor( + reflector: Reflector, + @InjectDataSource() dataSource: DataSource, + ) { + super(reflector, dataSource); + } + + async canActivate(context: ExecutionContext): Promise { + try { + await super.canActivate(context); + } catch { + context.switchToHttp().getRequest().user = undefined; + } + return true; } } diff --git a/apps/edr-passenger-api/src/modules/verifayda/verifayda.controller.ts b/apps/edr-passenger-api/src/modules/verifayda/verifayda.controller.ts index ac5d0c59c..059c6ec1f 100644 --- a/apps/edr-passenger-api/src/modules/verifayda/verifayda.controller.ts +++ b/apps/edr-passenger-api/src/modules/verifayda/verifayda.controller.ts @@ -15,6 +15,7 @@ import { ApiOperation, ApiTags, } from '@nestjs/swagger'; +import type { TCurrentUser } from '@tria-plc/api-common/modules/auth/types/current-user.type'; import { JwtGuard } from '../../common/jwt.guard'; import { OptionalJwtGuard } from './optional-jwt.guard'; import { @@ -25,21 +26,13 @@ import { } from './verifayda.dto'; import { VerifaydaService } from './verifayda.service'; -/** Shape the JWT strategy puts on `request.user` (see common/jwt.strategy.ts). */ -interface AuthedUser { - userId: string; - email?: string; - role?: string; - passengerId?: string; -} - /** Minimal slices of the Express req we touch (avoids a hard dependency on * `@types/express`, which isn't resolved in this package). */ interface RequestWithOptionalUser { - user?: AuthedUser; + user?: TCurrentUser; } interface RequestWithUser { - user: AuthedUser; + user: TCurrentUser; } @ApiTags('Fayda Verification') @@ -76,7 +69,7 @@ export class VerifaydaController { const authorizationUrl = await this.service.startVerification({ purpose: dto.purpose ?? 'VERIFY', platform: dto.platform ?? 'WEB', - userId: req.user?.userId, + userId: req.user?.id, }); return { authorizationUrl }; } @@ -105,6 +98,6 @@ export class VerifaydaController { async status( @Req() req: RequestWithUser, ): Promise { - return this.service.getVerificationStatus(req.user.userId); + return this.service.getVerificationStatus(req.user.id); } } diff --git a/apps/edr-passenger-api/src/modules/verifayda/verifayda.module.ts b/apps/edr-passenger-api/src/modules/verifayda/verifayda.module.ts index d850b1dbf..e54b94726 100644 --- a/apps/edr-passenger-api/src/modules/verifayda/verifayda.module.ts +++ b/apps/edr-passenger-api/src/modules/verifayda/verifayda.module.ts @@ -2,12 +2,9 @@ import { Module } from '@nestjs/common'; import { VerifaydaController } from './verifayda.controller'; import { VerifaydaService } from './verifayda.service'; import { PrismaModule } from '../../common/prisma.module'; -import { AuthModule } from '../auth/auth.module'; @Module({ - // AuthModule re-exports JwtModule, giving us JwtService (same secret/expiry - // config as /auth/login) to mint tokens for the LOGIN flow. - imports: [PrismaModule, AuthModule], + imports: [PrismaModule], controllers: [VerifaydaController], providers: [VerifaydaService], exports: [VerifaydaService], diff --git a/apps/edr-passenger-api/src/modules/verifayda/verifayda.service.spec.ts b/apps/edr-passenger-api/src/modules/verifayda/verifayda.service.spec.ts index cfd7c51bb..ede9aa9e8 100644 --- a/apps/edr-passenger-api/src/modules/verifayda/verifayda.service.spec.ts +++ b/apps/edr-passenger-api/src/modules/verifayda/verifayda.service.spec.ts @@ -1,5 +1,4 @@ import { ConfigService } from '@nestjs/config'; -import { JwtService } from '@nestjs/jwt'; import { exportJWK, generateKeyPair, type JWK } from 'jose'; import { PrismaService } from '../../common/prisma.service'; import { FaydaConfig } from '../../config/fayda.config'; @@ -16,12 +15,6 @@ function buildPrismaMock() { bookingSeat: { updateMany: jest.fn(), }, - user: { - findUnique: jest.fn(), - findFirst: jest.fn(), - create: jest.fn(), - update: jest.fn(), - }, passenger: { create: jest.fn() }, loyaltyAccount: { create: jest.fn() }, walletAccount: { create: jest.fn() }, @@ -30,10 +23,8 @@ function buildPrismaMock() { }; } -function buildJwtMock(): jest.Mocked { - return { - sign: jest.fn(() => 'signed.jwt.token'), - } as unknown as jest.Mocked; +function buildDataSourceMock() { + return { query: jest.fn().mockResolvedValue([]) }; } function buildConfig(overrides?: Partial): FaydaConfig { @@ -65,7 +56,7 @@ function buildConfigService(faydaConfig: FaydaConfig): jest.Mocked { let prisma: ReturnType; - let jwt: jest.Mocked; + let dataSource: ReturnType; let service: VerifaydaService; let realPrivateJwk: JWK; @@ -77,12 +68,12 @@ describe('VerifaydaService (OIDC, client-callback)', () => { beforeEach(() => { prisma = buildPrismaMock(); - jwt = buildJwtMock(); + dataSource = buildDataSourceMock(); const cfg = buildConfig({ privateJwk: realPrivateJwk as FaydaConfig['privateJwk'] }); service = new VerifaydaService( buildConfigService(cfg), prisma as unknown as PrismaService, - jwt, + dataSource as any, ); (global as any).fetch = jest.fn(); }); @@ -135,7 +126,7 @@ describe('VerifaydaService (OIDC, client-callback)', () => { const disabledService = new VerifaydaService( buildConfigService(buildConfig({ enabled: false })), prisma as unknown as PrismaService, - jwt, + buildDataSourceMock() as any, ); await expect( disabledService.startVerification({ purpose: 'VERIFY' }), @@ -154,7 +145,7 @@ describe('VerifaydaService (OIDC, client-callback)', () => { status: 'PENDING', errorCode: null, errorDescription: null, - userId: null, + iamUserId: null, expiresAt: new Date(Date.now() + 60_000), ...overrides, }; @@ -215,7 +206,7 @@ describe('VerifaydaService (OIDC, client-callback)', () => { purpose: 'VERIFY', platform: 'WEB', status: 'PENDING', - userId: null, + iamUserId: null, expiresAt: new Date(Date.now() + 60_000), ...overrides, }; @@ -270,7 +261,6 @@ describe('VerifaydaService (OIDC, client-callback)', () => { expect(result.token).toBeUndefined(); expect(result.user).toBeUndefined(); expect(prisma.bookingSeat.updateMany).not.toHaveBeenCalled(); - expect(prisma.user.update).not.toHaveBeenCalled(); }); it('throws 502 when the token endpoint returns 4xx', async () => { @@ -337,7 +327,7 @@ describe('VerifaydaService (OIDC, client-callback)', () => { purpose: 'LOGIN', platform: 'WEB', status: 'PENDING', - userId: null, + iamUserId: null, expiresAt: new Date(Date.now() + 60_000), ...overrides, }; @@ -363,139 +353,41 @@ describe('VerifaydaService (OIDC, client-callback)', () => { (global as any).fetch = jest.fn(() => Promise.resolve(queue.shift())); } - /** user.findUnique answers the faydaSub lookup and the issueLoginToken id lookup. */ - function mockUserFindUnique(bySub: any, fullUser: any) { - prisma.user.findUnique.mockImplementation(async (args: any) => { - if (args?.where?.faydaSub !== undefined) return bySub; - if (args?.where?.id !== undefined) return fullUser; - return null; - }); - } - beforeEach(() => { prisma.faydaVerificationSession.findUnique.mockResolvedValue(loginSession()); }); - it('creates a new user when no match and returns { token, user }', async () => { - const fullUser = { - id: 'new-user', - email: 'new@example.com', - role: 'PASSENGER', - passenger: { id: 'p-new' }, - agent: null, - }; - mockUserFindUnique(null, fullUser); - prisma.user.findFirst.mockResolvedValue(null); - prisma.user.create.mockResolvedValue({ id: 'new-user' }); - prisma.passenger.create.mockResolvedValue({ id: 'p-new' }); - prisma.loyaltyAccount.create.mockResolvedValue({}); - prisma.walletAccount.create.mockResolvedValue({}); - prisma.userPreferences.create.mockResolvedValue({}); - prisma.faydaVerificationSession.update.mockResolvedValue({}); - + it('always rejects with FAYDA_LOGIN_MIGRATED_TO_IAM (401)', async () => { mockLoginFetch({ sub: 'login-sub-1', name: 'New Person', email: 'new@example.com' }); - - const result = await service.completeVerification({ - code: 'c', - state: 'state-login', - }); - - expect(result).toMatchObject({ - purpose: 'LOGIN', - verified: true, - token: 'signed.jwt.token', - user: { id: 'new-user', passengerId: 'p-new' }, - }); - expect(prisma.user.create).toHaveBeenCalledWith( - expect.objectContaining({ - data: expect.objectContaining({ - faydaSub: 'login-sub-1', - faydaVerified: true, - email: 'new@example.com', - }), - }), - ); - expect(prisma.passenger.create).toHaveBeenCalled(); - expect(jwt.sign).toHaveBeenCalledWith( - expect.objectContaining({ sub: 'new-user', passengerId: 'p-new' }), - ); - }); - - it('logs in an existing user already linked by faydaSub', async () => { - const fullUser = { - id: 'known-user', - email: 'k@example.com', - role: 'PASSENGER', - passenger: { id: 'p-k' }, - agent: null, - }; - mockUserFindUnique({ id: 'known-user' }, fullUser); - prisma.faydaVerificationSession.update.mockResolvedValue({}); - - mockLoginFetch({ sub: 'login-sub-2', name: 'Known' }); - - const result = await service.completeVerification({ - code: 'c', - state: 'state-login', - }); - - expect(result.user?.id).toBe('known-user'); - expect(prisma.user.create).not.toHaveBeenCalled(); - }); - - it('links Fayda to an existing account matched by email', async () => { - const fullUser = { - id: 'acc-1', - email: 'match@example.com', - role: 'PASSENGER', - passenger: { id: 'p-1' }, - agent: null, - }; - mockUserFindUnique(null, fullUser); - prisma.user.findFirst.mockResolvedValue({ id: 'acc-1', faydaSub: null }); - prisma.user.update.mockResolvedValue({}); - prisma.faydaVerificationSession.update.mockResolvedValue({}); - - mockLoginFetch({ sub: 'login-sub-3', email: 'match@example.com' }); - - const result = await service.completeVerification({ - code: 'c', - state: 'state-login', - }); - - expect(result.user?.id).toBe('acc-1'); - expect(prisma.user.update).toHaveBeenCalledWith( - expect.objectContaining({ - where: { id: 'acc-1' }, - data: expect.objectContaining({ faydaSub: 'login-sub-3' }), - }), - ); - expect(prisma.user.create).not.toHaveBeenCalled(); - }); - - it('throws identity_conflict (409) when matched account has a different faydaSub', async () => { - mockUserFindUnique(null, null); - prisma.user.findFirst.mockResolvedValue({ id: 'acc-2', faydaSub: 'someone-else' }); prisma.faydaVerificationSession.updateMany.mockResolvedValue({ count: 1 }); - mockLoginFetch({ sub: 'login-sub-4', email: 'match@example.com' }); - await expect( service.completeVerification({ code: 'c', state: 'state-login' }), - ).rejects.toMatchObject({ status: 409 }); - expect(prisma.user.update).not.toHaveBeenCalled(); - expect(prisma.user.create).not.toHaveBeenCalled(); + ).rejects.toMatchObject({ + status: 401, + response: expect.objectContaining({ code: 'FAYDA_LOGIN_MIGRATED_TO_IAM' }), + }); + }); + + it('does not touch the database for LOGIN purpose', async () => { + mockLoginFetch({ sub: 'login-sub-2', name: 'Person' }); + prisma.faydaVerificationSession.updateMany.mockResolvedValue({ count: 1 }); + + await expect( + service.completeVerification({ code: 'c', state: 'state-login' }), + ).rejects.toMatchObject({ status: 401 }); + expect(dataSource.query).not.toHaveBeenCalled(); + expect(prisma.passenger.create).not.toHaveBeenCalled(); }); }); describe('getVerificationStatus', () => { - it('returns verified=true when User row has the flag', async () => { - prisma.user.findUnique.mockResolvedValue({ - faydaVerified: true, - faydaVerifiedAt: new Date('2026-01-01T00:00:00Z'), - fullName: 'Test User', - }); - const result = await service.getVerificationStatus('user-1'); + it('returns verified=true when IAM user metadata has the flag', async () => { + dataSource.query.mockResolvedValueOnce([{ + metadata: { faydaVerified: true, faydaVerifiedAt: '2026-01-01T00:00:00.000Z' }, + name: { en: 'Test User', am: 'ቴስት ዩዘር' }, + }]); + const result = await service.getVerificationStatus('iam-user-1'); expect(result).toEqual({ verified: true, verifiedAt: new Date('2026-01-01T00:00:00Z'), @@ -503,9 +395,9 @@ describe('VerifaydaService (OIDC, client-callback)', () => { }); }); - it('returns verified=false when User row is missing or unverified', async () => { - prisma.user.findUnique.mockResolvedValue(null); - const result = await service.getVerificationStatus('user-x'); + it('returns verified=false when IAM user is missing or unverified', async () => { + dataSource.query.mockResolvedValueOnce([]); + const result = await service.getVerificationStatus('iam-user-x'); expect(result).toEqual({ verified: false }); }); }); diff --git a/apps/edr-passenger-api/src/modules/verifayda/verifayda.service.ts b/apps/edr-passenger-api/src/modules/verifayda/verifayda.service.ts index e2f52bcd0..795a6f158 100644 --- a/apps/edr-passenger-api/src/modules/verifayda/verifayda.service.ts +++ b/apps/edr-passenger-api/src/modules/verifayda/verifayda.service.ts @@ -6,10 +6,9 @@ import { UnauthorizedException, } from '@nestjs/common'; import { ConfigService } from '@nestjs/config'; -import { JwtService } from '@nestjs/jwt'; +import { InjectDataSource } from '@nestjs/typeorm'; +import { DataSource } from 'typeorm'; import axios, { AxiosInstance } from 'axios'; -import * as bcrypt from 'bcrypt'; -import { randomBytes } from 'crypto'; import { PrismaService } from '../../common/prisma.service'; import { FaydaConfig, FaydaPlatform } from '../../config/fayda.config'; import { @@ -20,7 +19,6 @@ import { import { generateClientAssertion } from './utils/client-assertion.util'; import { VerifaydaCallbackDto, VerificationStatusDto } from './verifayda.dto'; import { - FaydaIdentityConflictException, FaydaTokenExchangeException, FaydaUserInfoException, } from './verifayda.errors'; @@ -48,7 +46,7 @@ export interface VerifaydaVerificationResult { export interface StartVerificationInput { purpose: VerifaydaPurpose; platform?: FaydaPlatform; - userId?: string; + userId?: string; // iamUserId of the authenticated user, if any } export interface FaydaUserSummary { @@ -91,7 +89,7 @@ export class VerifaydaService { constructor( private readonly config: ConfigService, private readonly prisma: PrismaService, - private readonly jwt: JwtService, + @InjectDataSource() private readonly dataSource: DataSource, ) { const fayda = this.config.get('fayda'); if (!fayda) { @@ -146,7 +144,7 @@ export class VerifaydaService { codeVerifier, purpose: input.purpose, platform: input.platform ?? 'WEB', - userId: input.userId ?? null, + iamUserId: input.userId ?? null, expiresAt, }, }); @@ -257,52 +255,25 @@ export class VerifaydaService { } } - /** Loads a user (+ relations) and mints the same JWT shape as `/auth/login`. */ private async issueLoginToken( - userId: string, + _userId: string, ): Promise<{ token: string; user: FaydaUserSummary }> { - const user = await this.prisma.user.findUnique({ - where: { id: userId }, - include: { passenger: true, agent: true }, + throw new UnauthorizedException({ + code: 'FAYDA_LOGIN_MIGRATED_TO_IAM', + message: 'Fayda login tokens are issued by the IAM package auth endpoints.', }); - if (!user) { - // Should not happen — we just resolved/created this user. - throw new UnauthorizedException({ - code: 'FAYDA_LOGIN_FAILED', - message: 'Could not load the verified user', - }); - } - - const summary: FaydaUserSummary = { - id: user.id, - email: user.email, - role: user.role, - passengerId: user.passenger?.id, - agentId: user.agent?.id, - }; - const token = this.jwt.sign({ - sub: summary.id, - email: summary.email, - role: summary.role, - passengerId: summary.passengerId, - agentId: summary.agentId, - }); - - this.logger.log(`Fayda login issued token for user ${user.id}`); - return { token, user: summary }; } - async getVerificationStatus(userId: string): Promise { - const user = await this.prisma.user.findUnique({ - where: { id: userId }, - select: { faydaVerified: true, faydaVerifiedAt: true, fullName: true }, - }); - - return { - verified: user?.faydaVerified ?? false, - verifiedAt: user?.faydaVerifiedAt ?? undefined, - fullName: user?.fullName ?? undefined, - }; + async getVerificationStatus(iamUserId: string): Promise { + const rows = await this.dataSource.query<{ metadata: Record | null; name: { en: string; am: string } | null }[]>( + `SELECT metadata, name FROM iam.users WHERE id = $1 LIMIT 1`, + [iamUserId], + ); + const iam = rows[0] ?? null; + const faydaVerified = iam?.metadata?.faydaVerified === true || iam?.metadata?.faydaVerified === 'true'; + const faydaVerifiedAt = iam?.metadata?.faydaVerifiedAt ? new Date(iam.metadata.faydaVerifiedAt) : undefined; + const fullName = iam?.name?.en ?? iam?.name?.am ?? undefined; + return { verified: faydaVerified, verifiedAt: faydaVerifiedAt, fullName }; } // ========================================================================== @@ -428,106 +399,16 @@ export class VerifaydaService { }; } - /** - * Resolves the User for a LOGIN flow and returns its id (the caller mints the - * JWT via {@link issueLoginToken}). Resolution order: - * 1. Existing user already linked to this Fayda `sub`. - * 2. Existing account whose email/phone matches — linked to this `sub`. - * 3. Otherwise a fresh Fayda-backed account is created. - */ + // LOGIN via Fayda is now handled entirely by the IAM package's own OIDC flow. + // This method is kept as a stub so completeVerification() still compiles; + // it throws immediately without touching the database. private async handleLoginSuccess( - normalized: NormalizedFaydaUserInfo, + _normalized: NormalizedFaydaUserInfo, ): Promise<{ userId: string }> { - let userId: string; - - const bySub = await this.prisma.user.findUnique({ - where: { faydaSub: normalized.sub }, - select: { id: true }, + throw new UnauthorizedException({ + code: 'FAYDA_LOGIN_MIGRATED_TO_IAM', + message: 'Fayda login tokens are issued by the IAM package at /v1/auth/fayda endpoints.', }); - - if (bySub) { - userId = bySub.id; - } else { - const matchers: Array<{ email?: string; phone?: string }> = []; - if (normalized.email) matchers.push({ email: normalized.email }); - if (normalized.phoneNumber) matchers.push({ phone: normalized.phoneNumber }); - - const existing = matchers.length - ? await this.prisma.user.findFirst({ - where: { OR: matchers }, - select: { id: true, faydaSub: true }, - }) - : null; - - if (existing) { - if (existing.faydaSub && existing.faydaSub !== normalized.sub) { - // The matched account is already tied to a different Fayda identity. - throw new FaydaIdentityConflictException(); - } - await this.prisma.user.update({ - where: { id: existing.id }, - data: { - faydaSub: normalized.sub, - faydaVerified: true, - faydaVerifiedAt: new Date(), - }, - }); - userId = existing.id; - this.logger.log(`Fayda login linked existing user ${existing.id}`); - } else { - userId = await this.createFaydaUser(normalized); - this.logger.log(`Fayda login created new user ${userId}`); - } - } - - return { userId }; - } - - /** - * Creates a Fayda-backed User plus the same satellite rows registration makes - * (Passenger, LoyaltyAccount, WalletAccount, UserPreferences). - * - * The user has no password — `passwordHash` is set to a bcrypt of random bytes - * so password login is impossible; they authenticate only via Fayda. When - * Fayda doesn't supply an email/phone, a deterministic placeholder derived from - * the (unique) `sub` keeps the NOT NULL + unique columns satisfied. - */ - private async createFaydaUser( - normalized: NormalizedFaydaUserInfo, - ): Promise { - const passwordHash = await bcrypt.hash( - randomBytes(32).toString('hex'), - 10, - ); - const email = normalized.email ?? `fayda_${normalized.sub}@users.fayda.local`; - const phone = normalized.phoneNumber ?? `fayda:${normalized.sub}`; - const fullName = normalized.fullName ?? 'Fayda User'; - - const user = await this.prisma.user.create({ - data: { - fullName, - email, - phone, - passwordHash, - faydaVerified: true, - faydaVerifiedAt: new Date(), - faydaSub: normalized.sub, - }, - select: { id: true }, - }); - const passenger = await this.prisma.passenger.create({ - data: { userId: user.id }, - select: { id: true }, - }); - await this.prisma.loyaltyAccount.create({ - data: { passengerId: passenger.id }, - }); - await this.prisma.walletAccount.create({ - data: { passengerId: passenger.id }, - }); - await this.prisma.userPreferences.create({ data: { userId: user.id } }); - - return user.id; } private async markSessionFailed( @@ -548,7 +429,6 @@ export class VerifaydaService { } private classifyFailureReason(err: unknown): string { - if (err instanceof FaydaIdentityConflictException) return 'identity_conflict'; if (err instanceof FaydaTokenExchangeException) return 'token_exchange_failed'; if (err instanceof FaydaUserInfoException) return 'userinfo_failed'; return 'verification_failed'; @@ -565,9 +445,8 @@ export class VerifaydaService { ): Promise { this.logger.log(`verifyNationalId called: stubEnabled=${this.stubEnabled}, type=${typeof this.stubEnabled}`); - if (this.stubEnabled != false || this.stubEnabled) { - this.logger.warn('Verifayda stub is disabled - returning mock data (development mode)'); - // In development mode, return mock verified data + if (!this.stubEnabled) { + this.logger.warn('Verifayda not configured — returning mock data (development mode)'); return { verified: true, passengerData: { diff --git a/apps/edr-passenger-api/src/seed/edr-passenger-org.seeder.ts b/apps/edr-passenger-api/src/seed/edr-passenger-org.seeder.ts new file mode 100644 index 000000000..51995b2d9 --- /dev/null +++ b/apps/edr-passenger-api/src/seed/edr-passenger-org.seeder.ts @@ -0,0 +1,165 @@ +import { Injectable, Logger } from '@nestjs/common'; +import { + Application, + Organization, + OrganizationConfiguration, + Permission, + Role, + RolePermission, +} from '@tria-plc/iamapi-common'; +import { DataSource, EntityManager, In } from 'typeorm'; +import { ERoleKey } from '@tria-plc/api-common/utils/enums/seed.enum'; +import { + PASSENGER_PERMISSIONS, + PASSENGER_PERMISSION_KEYS, +} from './passenger-permissions.registry'; +import { EDR_PASSENGER_APPLICATION, EDR_PASSENGER_ROLES, type PassengerSeedRole } from './edr-passenger.seed'; + +const EDR_ORG_KEY = 'edr'; +const EDR_ORG_NAME = { am: 'EDR', en: 'EDR' }; +const SEED_FLAG = 'SEED_EDR_PASSENGER_ORG'; + +type SeedOrganization = { id: string; key: string }; + +@Injectable() +export class EdrPassengerOrgSeeder { + private readonly logger = new Logger(EdrPassengerOrgSeeder.name); + + constructor(private readonly dataSource: DataSource) {} + + async run() { + if (process.env[SEED_FLAG]?.trim().toLowerCase() !== 'true') { + this.logger.log(`Skipping passenger org seed because ${SEED_FLAG} is not enabled`); + return; + } + + await this.dataSource.transaction(async (manager) => { + await this.ensureApplication(manager); + await this.ensurePermissions(manager); + const organization = await this.ensureOrganization(manager); + await this.ensureOrganizationConfiguration(manager, organization.id); + await this.ensureRoles(manager, EDR_PASSENGER_ROLES); + await this.ensureRolePermissions(manager, EDR_PASSENGER_ROLES); + await this.ensureSuperAdminPermissions(manager); + }); + + this.logger.log(`Ensured EDR passenger organization seed for '${EDR_ORG_KEY}'`); + } + + private async ensureApplication(manager: EntityManager) { + await manager.getRepository(Application).upsert( + { + id: EDR_PASSENGER_APPLICATION.id, + key: EDR_PASSENGER_APPLICATION.key, + name: EDR_PASSENGER_APPLICATION.name, + }, + { conflictPaths: { key: true } }, + ); + this.logger.log(`Ensured application '${EDR_PASSENGER_APPLICATION.key}'`); + } + + private async ensurePermissions(manager: EntityManager) { + await manager.getRepository(Permission).upsert( + PASSENGER_PERMISSIONS.map((p) => ({ + id: p.id, + key: p.key, + name: p.name, + applicationId: EDR_PASSENGER_APPLICATION.id, + })), + { conflictPaths: { key: true } }, + ); + this.logger.log(`Ensured ${PASSENGER_PERMISSIONS.length} passenger permissions`); + } + + private async ensureOrganization(manager: EntityManager): Promise { + const repo = manager.getRepository(Organization); + let org = await repo.findOne({ where: { key: EDR_ORG_KEY }, select: { id: true, key: true } }); + + if (!org) { + const result = await repo.insert({ + key: EDR_ORG_KEY, + name: EDR_ORG_NAME, + isGovernmentOrganization: true, + }); + this.logger.log(`Seeded EDR passenger organization '${EDR_ORG_KEY}'`); + return { id: result.identifiers[0]?.id as string, key: EDR_ORG_KEY }; + } + + this.logger.log(`Ensured EDR passenger organization '${EDR_ORG_KEY}'`); + return { id: org.id as string, key: EDR_ORG_KEY }; + } + + private async ensureOrganizationConfiguration(manager: EntityManager, organizationId: string) { + await manager.getRepository(OrganizationConfiguration).upsert( + { organizationId, canCreateBranchByItself: true, canStartReceivingRecord: true }, + { conflictPaths: { organizationId: true } }, + ); + this.logger.log(`Ensured organization configuration for '${EDR_ORG_KEY}'`); + } + + private async ensureRoles(manager: EntityManager, seedRoles: PassengerSeedRole[]) { + await manager.getRepository(Role).upsert( + seedRoles.map(({ key, name }) => ({ key, name })), + { conflictPaths: { key: true } }, + ); + this.logger.log(`Ensured passenger roles: ${seedRoles.map((r) => r.key).join(', ')}`); + } + + private async ensureRolePermissions(manager: EntityManager, seedRoles: PassengerSeedRole[]) { + const allPermissionKeys = [...new Set(seedRoles.flatMap((r) => r.permissionKeys))]; + if (!allPermissionKeys.length) return; + + const roles = await manager.getRepository(Role).find({ + where: { key: In(seedRoles.map((r) => r.key)) }, + select: { id: true, key: true }, + }); + const permissions = await manager.getRepository(Permission).find({ + where: { key: In(allPermissionKeys) }, + select: { id: true, key: true }, + }); + + const roleByKey = new Map(roles.map((r) => [r.key, r])); + const permByKey = new Map(permissions.map((p) => [p.key, p])); + + const links = seedRoles.flatMap((seedRole) => { + const role = roleByKey.get(seedRole.key); + if (!role) throw new Error(`missing_role:${seedRole.key}`); + + return seedRole.permissionKeys.map((key) => { + const perm = permByKey.get(key); + if (!perm) throw new Error(`missing_permission:${key}`); + return { roleId: role.id, permissionId: perm.id }; + }); + }); + + await manager.getRepository(RolePermission).upsert(links, { + conflictPaths: { roleId: true, permissionId: true }, + }); + this.logger.log(`Ensured ${links.length} passenger role-permission links`); + } + + private async ensureSuperAdminPermissions(manager: EntityManager) { + const role = await manager.getRepository(Role).findOne({ + where: { key: ERoleKey.SUPER_ADMIN }, + select: { id: true, key: true }, + }); + + if (!role) { + this.logger.warn(`Role ${ERoleKey.SUPER_ADMIN} not found; skipping super_admin permission links`); + return; + } + + const permissions = await manager.getRepository(Permission).find({ + where: { key: In(PASSENGER_PERMISSION_KEYS) }, + select: { id: true, key: true }, + }); + + if (!permissions.length) return; + + await manager.getRepository(RolePermission).upsert( + permissions.map((p) => ({ roleId: role.id, permissionId: p.id })), + { conflictPaths: { roleId: true, permissionId: true } }, + ); + this.logger.log(`Ensured ${permissions.length} passenger permissions on super_admin`); + } +} diff --git a/apps/edr-passenger-api/src/seed/edr-passenger.seed.ts b/apps/edr-passenger-api/src/seed/edr-passenger.seed.ts new file mode 100644 index 000000000..8413cadb2 --- /dev/null +++ b/apps/edr-passenger-api/src/seed/edr-passenger.seed.ts @@ -0,0 +1,47 @@ +import { + PASSENGER_PERMISSIONS, + PASSENGER_PERMISSION_KEYS, + ROLE_PERMISSION_PRESETS, +} from './passenger-permissions.registry'; + +export type PassengerSeedRole = { + key: string; + name: { en: string }; + permissionKeys: string[]; +}; + +export const EDR_PASSENGER_APPLICATION = { + id: 'd2000001-0001-4000-8000-000000000001', + key: 'edr_passenger_app', + name: { + am: 'EDR Passenger App', + en: 'EDR Passenger App', + }, +} as const; + +export const EDR_PASSENGER_PERMISSIONS = [...PASSENGER_PERMISSIONS]; + +export { PASSENGER_PERMISSION_KEYS } from './passenger-permissions.registry'; + +export const EDR_PASSENGER_ROLES: PassengerSeedRole[] = [ + { + key: 'edr_passenger_backoffice_admin', + name: { en: 'EDR Passenger Backoffice Admin' }, + permissionKeys: [...ROLE_PERMISSION_PRESETS.backofficeAdmin], + }, + { + key: 'edr_passenger_backoffice_staff', + name: { en: 'EDR Passenger Backoffice Staff' }, + permissionKeys: [...ROLE_PERMISSION_PRESETS.backofficeStaff], + }, + { + key: 'edr_passenger_agent', + name: { en: 'EDR Passenger Agent' }, + permissionKeys: [...ROLE_PERMISSION_PRESETS.agent], + }, + { + key: 'edr_passenger_finance', + name: { en: 'EDR Passenger Finance' }, + permissionKeys: [...ROLE_PERMISSION_PRESETS.finance], + }, +]; diff --git a/apps/edr-passenger-api/src/seed/passenger-permissions.registry.ts b/apps/edr-passenger-api/src/seed/passenger-permissions.registry.ts new file mode 100644 index 000000000..9b06c812b --- /dev/null +++ b/apps/edr-passenger-api/src/seed/passenger-permissions.registry.ts @@ -0,0 +1,121 @@ +const APP_KEY = 'edr_passenger_app'; + +export type PassengerPermissionSeed = { + id: string; + key: string; + name: { am: string; en: string }; + applicationKey: string; +}; + +const perm = (id: string, key: string, en: string): PassengerPermissionSeed => ({ + id, + key, + name: { am: en, en }, + applicationKey: APP_KEY, +}); + +export const PASSENGER_PERMISSIONS: PassengerPermissionSeed[] = [ + perm('c1000001-0001-4000-8000-000000000001', 'edr_passenger_app:bookings:view', 'View bookings'), + perm('c1000001-0001-4000-8000-000000000002', 'edr_passenger_app:bookings:manage', 'Manage bookings'), + perm('c1000001-0001-4000-8000-000000000003', 'edr_passenger_app:bookings:cancel', 'Cancel bookings'), + perm('c1000001-0001-4000-8000-000000000004', 'edr_passenger_app:passengers:view', 'View passengers'), + perm('c1000001-0001-4000-8000-000000000005', 'edr_passenger_app:passengers:manage', 'Manage passengers'), + perm('c1000001-0001-4000-8000-000000000006', 'edr_passenger_app:tickets:view', 'View tickets'), + perm('c1000001-0001-4000-8000-000000000007', 'edr_passenger_app:tickets:manage', 'Manage tickets'), + perm('c1000001-0001-4000-8000-000000000008', 'edr_passenger_app:payments:view_all', 'View all payments'), + perm('c1000001-0001-4000-8000-000000000009', 'edr_passenger_app:payments:refund', 'Refund payments'), + perm('c1000001-0001-4000-8000-00000000000a', 'edr_passenger_app:payments:manage_methods', 'Manage payment methods'), + perm('c1000001-0001-4000-8000-00000000000b', 'edr_passenger_app:reports:view', 'View reports'), + perm('c1000001-0001-4000-8000-00000000000c', 'edr_passenger_app:fraud:view', 'View fraud alerts'), + perm('c1000001-0001-4000-8000-00000000000d', 'edr_passenger_app:fraud:manage', 'Manage fraud rules'), + perm('c1000001-0001-4000-8000-00000000000e', 'edr_passenger_app:audit:view', 'View audit logs'), + perm('c1000001-0001-4000-8000-00000000000f', 'edr_passenger_app:agents:view', 'View agents'), + perm('c1000001-0001-4000-8000-000000000010', 'edr_passenger_app:agents:manage', 'Manage agents'), + perm('c1000001-0001-4000-8000-000000000011', 'edr_passenger_app:currencies:manage', 'Manage currencies'), + perm('c1000001-0001-4000-8000-000000000012', 'edr_passenger_app:notifications:send', 'Send notifications'), + perm('c1000001-0001-4000-8000-000000000013', 'edr_passenger_app:dashboard:view', 'View dashboard'), + perm('c1000001-0001-4000-8000-000000000014', 'edr_passenger_app:admin', 'Full admin access'), +]; + +export const PASSENGER_PERMISSION_KEYS = PASSENGER_PERMISSIONS.map((p) => p.key); + +export const PASSENGER_PERMS = { + bookings: { + view: 'edr_passenger_app:bookings:view', + manage: 'edr_passenger_app:bookings:manage', + cancel: 'edr_passenger_app:bookings:cancel', + }, + passengers: { + view: 'edr_passenger_app:passengers:view', + manage: 'edr_passenger_app:passengers:manage', + }, + tickets: { + view: 'edr_passenger_app:tickets:view', + manage: 'edr_passenger_app:tickets:manage', + }, + payments: { + viewAll: 'edr_passenger_app:payments:view_all', + refund: 'edr_passenger_app:payments:refund', + manageMethods: 'edr_passenger_app:payments:manage_methods', + }, + reports: { + view: 'edr_passenger_app:reports:view', + }, + fraud: { + view: 'edr_passenger_app:fraud:view', + manage: 'edr_passenger_app:fraud:manage', + }, + audit: { + view: 'edr_passenger_app:audit:view', + }, + agents: { + view: 'edr_passenger_app:agents:view', + manage: 'edr_passenger_app:agents:manage', + }, + currencies: { + manage: 'edr_passenger_app:currencies:manage', + }, + notifications: { + send: 'edr_passenger_app:notifications:send', + }, + dashboard: { + view: 'edr_passenger_app:dashboard:view', + }, + admin: 'edr_passenger_app:admin', +} as const; + +export const ROLE_PERMISSION_PRESETS = { + backofficeAdmin: [...PASSENGER_PERMISSION_KEYS], + + backofficeStaff: [ + PASSENGER_PERMS.bookings.view, + PASSENGER_PERMS.bookings.manage, + PASSENGER_PERMS.bookings.cancel, + PASSENGER_PERMS.passengers.view, + PASSENGER_PERMS.passengers.manage, + PASSENGER_PERMS.tickets.view, + PASSENGER_PERMS.tickets.manage, + PASSENGER_PERMS.payments.viewAll, + PASSENGER_PERMS.reports.view, + PASSENGER_PERMS.dashboard.view, + PASSENGER_PERMS.notifications.send, + PASSENGER_PERMS.agents.view, + PASSENGER_PERMS.fraud.view, + PASSENGER_PERMS.audit.view, + ], + + agent: [ + PASSENGER_PERMS.bookings.view, + PASSENGER_PERMS.bookings.manage, + PASSENGER_PERMS.passengers.view, + PASSENGER_PERMS.tickets.view, + PASSENGER_PERMS.payments.refund, + ], + + finance: [ + PASSENGER_PERMS.payments.viewAll, + PASSENGER_PERMS.payments.refund, + PASSENGER_PERMS.reports.view, + PASSENGER_PERMS.dashboard.view, + ], +} as const; diff --git a/apps/edr-passenger-api/src/seed/passenger-staff-users.seeder.ts b/apps/edr-passenger-api/src/seed/passenger-staff-users.seeder.ts new file mode 100644 index 000000000..b16138ea2 --- /dev/null +++ b/apps/edr-passenger-api/src/seed/passenger-staff-users.seeder.ts @@ -0,0 +1,106 @@ +import { Injectable, Logger } from '@nestjs/common'; +import { hashPassword } from '@tria-plc/api-common/utils/argon'; +import { EUserStatus } from '@tria-plc/api-common/utils/enums/user.enum'; +import { + Employee, + Organization, + Role, + User, + UserCredential, + UserRole, +} from '@tria-plc/iamapi-common'; +import { DataSource } from 'typeorm'; + +const SEED_FLAG = 'SEED_PASSENGER_STAFF'; +const EDR_ORG_KEY = 'edr'; + +const STAFF_USERS = [ + { email: 'passenger.admin@edr.local', username: 'passenger_admin', roleKey: 'edr_passenger_backoffice_admin' }, + { email: 'passenger.staff@edr.local', username: 'passenger_staff', roleKey: 'edr_passenger_backoffice_staff' }, + { email: 'passenger.agent@edr.local', username: 'passenger_agent', roleKey: 'edr_passenger_agent' }, + { email: 'passenger.finance@edr.local', username: 'passenger_finance', roleKey: 'edr_passenger_finance' }, +] as const; + +@Injectable() +export class PassengerStaffUsersSeeder { + private readonly logger = new Logger(PassengerStaffUsersSeeder.name); + + constructor(private readonly dataSource: DataSource) {} + + async run() { + if (process.env[SEED_FLAG]?.trim().toLowerCase() !== 'true') { + this.logger.log(`Skipping passenger staff seed because ${SEED_FLAG} is not enabled`); + return; + } + + const password = process.env.DEFAULT_PASSWORD?.trim() || '12345678'; + + await this.dataSource.transaction(async (manager) => { + const organization = await manager.getRepository(Organization).findOne({ + where: { key: EDR_ORG_KEY }, + select: { id: true, key: true }, + }); + + if (!organization) throw new Error(`missing_organization:${EDR_ORG_KEY}`); + + const hashedPassword = await hashPassword(password); + + for (const staff of STAFF_USERS) { + const role = await manager.getRepository(Role).findOne({ + where: { key: staff.roleKey }, + select: { id: true, key: true }, + }); + if (!role) throw new Error(`missing_role:${staff.roleKey}`); + + let user = await manager.getRepository(User).findOne({ + where: { email: staff.email }, + select: { id: true, email: true }, + }); + + if (!user) { + user = await manager.getRepository(User).save( + manager.getRepository(User).create({ + email: staff.email, + username: staff.username, + name: { en: staff.username }, + isActive: true, + hasSetPassword: true, + status: EUserStatus.ACCEPTED, + }), + ); + this.logger.log(`Seeded passenger staff user ${staff.email}`); + } + + const credentialExists = await manager.getRepository(UserCredential).exists({ + where: { userId: user.id, isActive: true }, + }); + if (!credentialExists) { + await manager.getRepository(UserCredential).insert({ + userId: user.id, + password: hashedPassword, + isActive: true, + }); + } + + await manager.getRepository(UserRole).upsert( + { userId: user.id, roleId: role.id, organizationId: organization.id }, + { conflictPaths: { userId: true, roleId: true } }, + ); + + const employeeExists = await manager.getRepository(Employee).exists({ + where: { userId: user.id, organizationId: organization.id, isCurrent: true }, + }); + if (!employeeExists) { + await manager.getRepository(Employee).insert({ + userId: user.id, + organizationId: organization.id, + isCurrent: true, + name: { en: staff.username }, + }); + } + } + }); + + this.logger.log('Ensured passenger staff users'); + } +} diff --git a/apps/edr-passenger-api/tsconfig.json b/apps/edr-passenger-api/tsconfig.json index e9fbe1ffe..49158fb15 100644 --- a/apps/edr-passenger-api/tsconfig.json +++ b/apps/edr-passenger-api/tsconfig.json @@ -8,6 +8,8 @@ "incremental": true, "tsBuildInfoFile": "./.tsbuildinfo", "paths": { "@/*": ["./src/*"] }, + "module": "node16", + "moduleResolution": "node16", "strictPropertyInitialization": false, "noUnusedLocals": false, "noUnusedParameters": false diff --git a/apps/edr-passenger-web/backoffice/src/lib/auth-store.ts b/apps/edr-passenger-web/backoffice/src/lib/auth-store.ts index bdbbc6ba8..fcba670b6 100644 --- a/apps/edr-passenger-web/backoffice/src/lib/auth-store.ts +++ b/apps/edr-passenger-web/backoffice/src/lib/auth-store.ts @@ -4,9 +4,17 @@ import axios from 'axios'; const API_URL = process.env.NEXT_PUBLIC_API_URL || 'http://localhost:4000'; +function mapIamRole(roles: { key?: string }[]): 'ADMIN' | 'AGENT' | 'SUPERVISOR' { + const keys = roles.map((r) => r.key ?? ''); + if (keys.some((k) => k.includes('admin') || k === 'super_admin' || k === 'organization_admin')) return 'ADMIN'; + if (keys.some((k) => k.includes('agent'))) return 'AGENT'; + return 'SUPERVISOR'; +} + interface AuthState { user: AdminUser | null; token: string | null; + refreshToken: string | null; isAuthenticated: boolean; login: (email: string, password: string) => Promise; logout: () => void; @@ -17,6 +25,7 @@ interface AuthState { export const useAuthStore = create((set) => ({ user: null, token: null, + refreshToken: null, isAuthenticated: false, initialize: () => { @@ -27,57 +36,47 @@ export const useAuthStore = create((set) => ({ try { const user = JSON.parse(userStr); set({ user, token, isAuthenticated: true }); - } catch (e) { + } catch { localStorage.removeItem('auth_token'); + localStorage.removeItem('auth_refresh_token'); localStorage.removeItem('auth_user'); } } }, login: async (email: string, password: string) => { - try { - console.log('Attempting login to:', `${API_URL}/auth/login`); - const response = await axios.post(`${API_URL}/auth/login`, { email, password }); - console.log('Full response:', response.data); - - // Backend wraps response in { success, data: { token, user }, timestamp } - const responseData = response.data.data || response.data; - - if (!responseData || !responseData.token || !responseData.user) { - console.error('Invalid response structure:', response.data); - throw new Error('Invalid response from server'); - } - - const { token, user: apiUser } = responseData; - - const user: AdminUser = { - id: apiUser.id, - email: apiUser.email, - fullName: apiUser.fullName, - role: apiUser.role, - active: true, - }; - - console.log('Login successful! User:', user); - - localStorage.setItem('auth_token', token); - localStorage.setItem('auth_user', JSON.stringify(user)); - - set({ user, token, isAuthenticated: true }); - } catch (error: any) { - console.error('Login error details:', { - message: error.message, - response: error.response?.data, - status: error.response?.status, - }); - throw error; - } + // Step 1: IAM login — returns token + refreshToken only + const loginRes = await axios.post(`${API_URL}/v1/auth/login`, { email, password }); + const loginData = loginRes.data?.data ?? loginRes.data; + const { token, refreshToken } = loginData; + if (!token) throw new Error('No token received from server'); + + // Step 2: fetch full user info with the token + const meRes = await axios.get(`${API_URL}/v1/auth/me`, { + headers: { Authorization: `Bearer ${token}` }, + }); + const iamUser = meRes.data?.data ?? meRes.data; + + const user: AdminUser = { + id: iamUser.id, + email: iamUser.email, + fullName: iamUser.name?.en ?? iamUser.name?.am ?? iamUser.email, + role: mapIamRole(iamUser.roles ?? []), + active: true, + }; + + localStorage.setItem('auth_token', token); + localStorage.setItem('auth_user', JSON.stringify(user)); + if (refreshToken) localStorage.setItem('auth_refresh_token', refreshToken); + + set({ user, token, refreshToken: refreshToken ?? null, isAuthenticated: true }); }, logout: () => { localStorage.removeItem('auth_token'); + localStorage.removeItem('auth_refresh_token'); localStorage.removeItem('auth_user'); - set({ user: null, token: null, isAuthenticated: false }); + set({ user: null, token: null, refreshToken: null, isAuthenticated: false }); }, setUser: (user: AdminUser, token: string) => { diff --git a/local-packages/tria-plc-api-common-1.4.3.tgz b/local-packages/tria-plc-api-common-1.4.3.tgz new file mode 100644 index 000000000..b2ac0150f Binary files /dev/null and b/local-packages/tria-plc-api-common-1.4.3.tgz differ diff --git a/local-packages/tria-plc-iamapi-common-0.7.3.tgz b/local-packages/tria-plc-iamapi-common-0.7.3.tgz new file mode 100644 index 000000000..70dae003d Binary files /dev/null and b/local-packages/tria-plc-iamapi-common-0.7.3.tgz differ diff --git a/local-packages/tria-plc-iamui-0.0.3.tgz b/local-packages/tria-plc-iamui-0.0.3.tgz new file mode 100644 index 000000000..5fb9f439c Binary files /dev/null and b/local-packages/tria-plc-iamui-0.0.3.tgz differ diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml index f3d3231c9..ddeca7b4c 100644 --- a/pnpm-lock.yaml +++ b/pnpm-lock.yaml @@ -431,15 +431,9 @@ importers: '@nestjs/event-emitter': specifier: ^2.0.4 version: 2.1.1(@nestjs/common@11.1.24(class-transformer@0.5.1)(class-validator@0.14.4)(reflect-metadata@0.2.2)(rxjs@7.8.2))(@nestjs/core@11.1.24) - '@nestjs/jwt': - specifier: ^10.2.0 - version: 10.2.0(@nestjs/common@11.1.24(class-transformer@0.5.1)(class-validator@0.14.4)(reflect-metadata@0.2.2)(rxjs@7.8.2)) '@nestjs/microservices': specifier: ^11.1.24 version: 11.1.24(@nestjs/common@11.1.24(class-transformer@0.5.1)(class-validator@0.14.4)(reflect-metadata@0.2.2)(rxjs@7.8.2))(@nestjs/core@11.1.24)(amqp-connection-manager@5.0.0(amqplib@2.0.1))(amqplib@2.0.1)(reflect-metadata@0.2.2)(rxjs@7.8.2) - '@nestjs/passport': - specifier: ^10.0.3 - version: 10.0.3(@nestjs/common@11.1.24(class-transformer@0.5.1)(class-validator@0.14.4)(reflect-metadata@0.2.2)(rxjs@7.8.2))(passport@0.7.0) '@nestjs/platform-express': specifier: ^11.1.19 version: 11.1.24(@nestjs/common@11.1.24(class-transformer@0.5.1)(class-validator@0.14.4)(reflect-metadata@0.2.2)(rxjs@7.8.2))(@nestjs/core@11.1.24) @@ -449,33 +443,48 @@ importers: '@nestjs/swagger': specifier: ^7.4.0 version: 7.4.2(@nestjs/common@11.1.24(class-transformer@0.5.1)(class-validator@0.14.4)(reflect-metadata@0.2.2)(rxjs@7.8.2))(@nestjs/core@11.1.24)(class-transformer@0.5.1)(class-validator@0.14.4)(reflect-metadata@0.2.2) + '@nestjs/typeorm': + specifier: ^11.0.1 + version: 11.0.1(@nestjs/common@11.1.24(class-transformer@0.5.1)(class-validator@0.14.4)(reflect-metadata@0.2.2)(rxjs@7.8.2))(@nestjs/core@11.1.24)(reflect-metadata@0.2.2)(rxjs@7.8.2)(typeorm@0.3.30(babel-plugin-macros@3.1.0)(pg@8.21.0)(ts-node@10.9.2(@types/node@20.19.42)(typescript@5.9.3))) '@prisma/client': specifier: ^6.19.3 version: 6.19.3(prisma@6.19.3(typescript@5.9.3))(typescript@5.9.3) + '@sendgrid/mail': + specifier: ^8.1.0 + version: 8.1.6 + '@tria-plc/api-common': + specifier: file:../../local-packages/tria-plc-api-common-1.4.3.tgz + version: file:local-packages/tria-plc-api-common-1.4.3.tgz(d81a2b6a79840fd7ce8c5d0cfc968145) + '@tria-plc/iamapi-common': + specifier: file:../../local-packages/tria-plc-iamapi-common-0.7.3.tgz + version: file:local-packages/tria-plc-iamapi-common-0.7.3.tgz(c97ba831ddde82920910406ab5262991) + amqp-connection-manager: + specifier: ^5.0.0 + version: 5.0.0(amqplib@2.0.1) + amqplib: + specifier: ^2.0.1 + version: 2.0.1 axios: specifier: ^1.7.7 version: 1.17.0 - bcrypt: - specifier: ^5.1.1 - version: 5.1.1 class-transformer: specifier: ^0.5.1 version: 0.5.1 class-validator: specifier: ^0.14.0 version: 0.14.4 + dotenv: + specifier: ^17.4.2 + version: 17.4.2 express: specifier: ^4.18.2 version: 4.22.2(supports-color@5.5.0) jose: specifier: ^5.10.0 version: 5.10.0 - passport: - specifier: ^0.7.0 - version: 0.7.0 - passport-jwt: - specifier: ^4.0.1 - version: 4.0.1 + pg: + specifier: ^8.21.0 + version: 8.21.0 qrcode: specifier: ^1.5.3 version: 1.5.4 @@ -491,6 +500,9 @@ importers: tsconfig-paths: specifier: ^4.2.0 version: 4.2.0 + typeorm: + specifier: ^0.3.30 + version: 0.3.30(babel-plugin-macros@3.1.0)(pg@8.21.0)(ts-node@10.9.2(@types/node@20.19.42)(typescript@5.9.3)) uuid: specifier: ^10.0.0 version: 10.0.0 @@ -510,21 +522,15 @@ importers: '@nestjs/testing': specifier: ^11.1.19 version: 11.1.24(@nestjs/common@11.1.24(class-transformer@0.5.1)(class-validator@0.14.4)(reflect-metadata@0.2.2)(rxjs@7.8.2))(@nestjs/core@11.1.24)(@nestjs/microservices@11.1.24)(@nestjs/platform-express@11.1.24) - '@types/bcrypt': - specifier: ^5.0.2 - version: 5.0.2 '@types/express': - specifier: ^5.0.6 - version: 5.0.6 + specifier: ^4.17.21 + version: 4.17.25 '@types/jest': specifier: ^29.5.11 version: 29.5.14 '@types/node': specifier: ^20.10.6 version: 20.19.42 - '@types/passport-jwt': - specifier: ^4.0.1 - version: 4.0.1 '@types/qrcode': specifier: ^1.5.5 version: 1.5.6 @@ -2023,10 +2029,6 @@ packages: peerDependencies: react: ^19.2.0 - '@mapbox/node-pre-gyp@1.0.11': - resolution: {integrity: sha512-Yhlar6v9WQgUp/He7BdgzOz8lqMQ8sU+jkCq7Wx8Myc5YFJLbEe7lgui/V7G1qB1DJykHSGwreceSaD60Y0PUQ==} - hasBin: true - '@microsoft/tsdoc@0.15.1': resolution: {integrity: sha512-4aErSrCR/On/e5G2hDP0wjooqDdauzEbIq8hIkIe5pXV0rtWJZvdCEKL0ykZxex+IxIwBp0eGeV48hQN07dXtw==} @@ -3765,6 +3767,18 @@ packages: '@sec-ant/readable-stream@0.4.1': resolution: {integrity: sha512-831qok9r2t8AlxLko40y2ebgSDhenenCatLVeW/uBtnHPyhHOvG0C7TvfgecV+wHzIm5KUICgzmVpWS+IMEAeg==} + '@sendgrid/client@8.1.6': + resolution: {integrity: sha512-/BHu0hqwXNHr2aLhcXU7RmmlVqrdfrbY9KpaNj00KZHlVOVoRxRVrpOCabIB+91ISXJ6+mLM9vpaVUhK6TwBWA==} + engines: {node: '>=12.*'} + + '@sendgrid/helpers@8.0.0': + resolution: {integrity: sha512-Ze7WuW2Xzy5GT5WRx+yEv89fsg/pgy3T1E3FS0QEx0/VvRmigMZ5qyVGhJz4SxomegDkzXv/i0aFPpHKN8qdAA==} + engines: {node: '>= 12.0.0'} + + '@sendgrid/mail@8.1.6': + resolution: {integrity: sha512-/ZqxUvKeEztU9drOoPC/8opEPOk+jLlB2q4+xpx6HVLq6aFu3pMpalkTpAQz8XfRfpLp8O25bh6pGPcHDCYpqg==} + engines: {node: '>=12.*'} + '@sinclair/typebox@0.27.10': resolution: {integrity: sha512-MTBk/3jGLNB2tVxv6uLlFh1iu64iYOQ2PbdOSK3NW8JZsmlaOh2q6sdtKowBhfw8QFLmYNzTW4/oK4uATIi6ZA==} @@ -4147,6 +4161,23 @@ packages: rxjs: ^7.8.0 typeorm: ^0.3.0 + '@tria-plc/api-common@file:local-packages/tria-plc-api-common-1.4.3.tgz': + resolution: {integrity: sha512-cHlo96Wh3ET8qHjq5mevJwqitFRynU17KzEpE5fz0efCs9NIw7N3K6L+bYwConOCP7jbIROe/2rkG9ToY/AA3w==, tarball: file:local-packages/tria-plc-api-common-1.4.3.tgz} + version: 1.4.3 + peerDependencies: + '@nestjs/common': ^11.0.0 + '@nestjs/core': ^11.0.0 + '@nestjs/jwt': ^11.0.0 + '@nestjs/microservices': ^11.0.0 + '@nestjs/passport': ^11.0.0 + '@nestjs/swagger': ^11.0.0 + '@nestjs/throttler': ^6.0.0 + '@nestjs/typeorm': ^11.0.0 + '@tria-plc/iamapi-common': ^0.1.0 + reflect-metadata: ^0.2.0 + rxjs: ^7.8.0 + typeorm: ^0.3.0 + '@tria-plc/iamapi-common@0.6.6': resolution: {integrity: sha512-derY8wJBonsQM2/oHsFgqZw7q4jQA3ilwN3kTDJP3I0h5l3d6zDVWYAFFHQFuH8Qx+q1DChla3g6x1+RPe++hg==, tarball: https://npm.pkg.github.com/download/@tria-plc/iamapi-common/0.6.6/5211a9de00895776017415caab771f13ac3acaef} engines: {node: '>=20'} @@ -4168,6 +4199,28 @@ packages: rxjs: ^7.8.0 typeorm: ^0.3.0 + '@tria-plc/iamapi-common@file:local-packages/tria-plc-iamapi-common-0.7.3.tgz': + resolution: {integrity: sha512-poMG3sm+HmnfNbWNqMDZJMf3pXdc3HHA+o/ay6CA4E6ehLKkO7Np77C6xrCYuGxyDgqqKdmWiFLqKKddkv5rig==, tarball: file:local-packages/tria-plc-iamapi-common-0.7.3.tgz} + version: 0.7.3 + engines: {node: '>=20'} + peerDependencies: + '@nestjs/axios': ^4.0.0 + '@nestjs/common': ^11.0.0 + '@nestjs/core': ^11.0.0 + '@nestjs/jwt': ^11.0.0 + '@nestjs/microservices': ^11.0.0 + '@nestjs/passport': ^11.0.0 + '@nestjs/swagger': ^11.0.0 + '@nestjs/throttler': ^6.0.0 + '@nestjs/typeorm': ^11.0.0 + '@tria-plc/api-common': '*' + axios: ^1.9.0 + class-transformer: ^0.5.1 + class-validator: ^0.14.1 + reflect-metadata: ^0.2.0 + rxjs: ^7.8.0 + typeorm: ^0.3.0 + '@tria-plc/iamui-common@1.1.2': resolution: {integrity: sha512-oKFxs7/003/UcGf0q1R7lfubvsawPxgTzx8O2Fi/6oN3oGECnc3YNkbDPoOvMrmXYOxfMExIYZmhCv+OpstWAQ==, tarball: https://npm.pkg.github.com/download/@tria-plc/iamui-common/1.1.2/01aa8b5799f0fa5a876c64ed6ebfe4b4134ccc55} @@ -4234,9 +4287,6 @@ packages: '@types/babel__traverse@7.28.0': resolution: {integrity: sha512-8PvcXf70gTDZBgt9ptxJ8elBeBjcLOAcOtoO/mPJjtji1+CdGbHgm77om1GrsPxsiE+uXIpNSK64UYaIwQXd4Q==} - '@types/bcrypt@5.0.2': - resolution: {integrity: sha512-6atioO8Y75fNcbmj0G7UjI9lXN2pQ/IGJ2FWT4a/btd0Lk9lQalHLKhkgKVZ3r+spnmWUKfbMi1GEe9wyHQfNQ==} - '@types/body-parser@1.19.6': resolution: {integrity: sha512-HLFeCYgz89uk22N5Qg3dvGvsv46B8GLvKKo1zKG4NybA8U2DiEO3w9lqGg29t/tfLRJpJ6iQxnVw4OnB7MoM9g==} @@ -4285,9 +4335,15 @@ packages: '@types/estree@1.0.9': resolution: {integrity: sha512-GhdPgy1el4/ImP05X05Uw4cw2/M93BCUmnEvWZNStlCzEKME4Fkk+YpoA5OiHNQmoS7Cafb8Xa3Pya8m1Qrzeg==} + '@types/express-serve-static-core@4.19.8': + resolution: {integrity: sha512-02S5fmqeoKzVZCHPZid4b8JH2eM5HzQLZWN2FohQEy/0eXTq8VXZfSN6Pcr3F6N9R/vNrj7cpgbhjie6m/1tCA==} + '@types/express-serve-static-core@5.1.1': resolution: {integrity: sha512-v4zIMr/cX7/d2BpAEX3KNKL/JrT1s43s96lLvvdTmza1oEvDudCqK9aF/djc/SWgy8Yh0h30TZx5VpzqFCxk5A==} + '@types/express@4.17.25': + resolution: {integrity: sha512-dVd04UKsfpINUnK0yBoYHDF3xu7xVH4BuDotC/xGuycx4CgbP48X/KF/586bcObxT0HENHXEU8Nqtu6NR+eKhw==} + '@types/express@5.0.6': resolution: {integrity: sha512-sKYVuV7Sv9fbPIt/442koC7+IIwK5olP1KWeD88e/idgoJqDm3JV/YUiPwkoKK92ylff2MGxSz1CSjsXelx0YA==} @@ -4323,9 +4379,6 @@ packages: '@types/json5@0.0.29': resolution: {integrity: sha512-dRLjCWHYg4oaA77cxO64oO+7JwCwnIzkZPdrrC71jQmQtlhM556pwKo5bUzqvZndkVbeFLIIi+9TC40JNF5hNQ==} - '@types/jsonwebtoken@9.0.10': - resolution: {integrity: sha512-asx5hIG9Qmf/1oStypjanR7iKTv0gXQ1Ov/jfrX6kS/EO0OFni8orbmGCn0672NHR3kXHwpAwR+B368ZGN/2rA==} - '@types/jsonwebtoken@9.0.5': resolution: {integrity: sha512-VRLSGzik+Unrup6BsouBeHsf4d1hOEgYWTm/7Nmw1sXoN1+tRly/Gy/po3yeahnP4jfnQWWAhQAqcNfH7ngOkA==} @@ -4338,8 +4391,8 @@ packages: '@types/methods@1.1.4': resolution: {integrity: sha512-ymXWVrDiCxTBE3+RIrrP533E70eA+9qu7zdWoHuOmGujkYtzf4HQF96b8nwHLqhuf4ykX61IGRIB38CC6/sImQ==} - '@types/ms@2.1.0': - resolution: {integrity: sha512-GsCCIZDE/p3i96vtEqx+7dBUGXrc7zeSK3wwPHIaRThS+9OhWIXRqzs4d6k1SVU8g91DrNRWxWUGhp5KXQb2VA==} + '@types/mime@1.3.5': + resolution: {integrity: sha512-/pyBZWSLD2n0dcHE3hq8s8ZvcETHtEuF+3E7XVt0Ig2nvsVQXdghHVcEkIWjy9A0wKfTn97a/PSDYohKIlnP/w==} '@types/multer@2.1.0': resolution: {integrity: sha512-zYZb0+nJhOHtPpGDb3vqPjwpdeGlGC157VpkqNQL+UU2qwoacoQ7MpsAmUptI/0Oa127X32JzWDqQVEXp2RcIA==} @@ -4359,15 +4412,6 @@ packages: '@types/parse-json@4.0.2': resolution: {integrity: sha512-dISoDXWWQwUquiKsyZ4Ng+HX2KsPL7LyHKHQwgGFEA3IaKac4Obd+h2a/a6waisAoepJlBcx9paWqjA8/HVjCw==} - '@types/passport-jwt@4.0.1': - resolution: {integrity: sha512-Y0Ykz6nWP4jpxgEUYq8NoVZeCQPo1ZndJLfapI249g1jHChvRfZRO/LS3tqu26YgAS/laI1qx98sYGz0IalRXQ==} - - '@types/passport-strategy@0.2.38': - resolution: {integrity: sha512-GC6eMqqojOooq993Tmnmp7AUTbbQSgilyvpCYQjT+H6JfG/g6RGc7nXEniZlp0zyKJ0WUdOiZWLBZft9Yug1uA==} - - '@types/passport@1.0.17': - resolution: {integrity: sha512-aciLyx+wDwT2t2/kJGJR2AEeBz0nJU4WuRX04Wu9Dqc5lSUtwu0WERPHYsLhF9PtseiAMPBGNUOtFjxZ56prsg==} - '@types/pg@8.20.0': resolution: {integrity: sha512-bEPFOaMAHTEP1EzpvHTbmwR8UsFyHSKsRisLIHVMXnpNefSbGA1bD6CVy+qKjGSqmZqNqBDV2azOBo8TgkcVow==} @@ -4399,9 +4443,15 @@ packages: '@types/react@18.3.31': resolution: {integrity: sha512-vfEqpXTvwT91yhmwdfouStN2hSKwTvyRs8qpLfADyrq/kxDw0hZM7Wk9Ug1FELj8hIby+S/+kQCSRFF32nv2Qw==} + '@types/send@0.17.6': + resolution: {integrity: sha512-Uqt8rPBE8SY0RK8JB1EzVOIZ32uqy8HwdxCnoCOsYrvnswqmFZ/k+9Ikidlk/ImhsdvBsloHbAlewb2IEBV/Og==} + '@types/send@1.2.1': resolution: {integrity: sha512-arsCikDvlU99zl1g69TcAB3mzZPpxgw0UQnaHeC1Nwb015xp8bknZv5rIfri9xTOcMuaVgvabfIRA7PSZVuZIQ==} + '@types/serve-static@1.15.10': + resolution: {integrity: sha512-tRs1dB+g8Itk72rlSI2ZrW6vZg0YrLI81iQSTkMmOqnqCaNr/8Ek4VwWcN5vZgCYWbg/JJSGBlUaYGAOP73qBw==} + '@types/serve-static@2.2.0': resolution: {integrity: sha512-8mam4H1NHLtu7nmtalF7eyBH14QyOASmcxHhSfEoRyr0nP/YdoesEtU+uSRvMe96TW/HPTtkoKqQLl53N7UXMQ==} @@ -4959,9 +5009,6 @@ packages: resolution: {integrity: sha512-E+iruNOY8VV9s4JEbe1aNEm6MiszPRr/UfcHMz0TQh1BXSxHK+ASV1R6W4HpjBhSeS+54PIsAMCBmwD06LLsqQ==} hasBin: true - abbrev@1.1.1: - resolution: {integrity: sha512-nne9/IiQ/hzIhY6pdDnbBtz7DjPTKrY00P/zvPSm5pOFkl6xuGrGnXn/VtTNNfNtAfZ9/1RtehkszU9qcTii0Q==} - abort-controller@3.0.0: resolution: {integrity: sha512-h8lQ8tacZYnR3vNQTgibj+tODHI5/+l06Au2Pcriv/Gmet0eaj4TwWH41sO9wnHDiQsEj19q0drzdWdeAHtweg==} engines: {node: '>=6.5'} @@ -5267,9 +5314,6 @@ packages: append-field@1.0.0: resolution: {integrity: sha512-klpgFSWLW1ZEs8svjfb7g4qWY0YS5imI82dTg+QahUvJ8YqAY0P10Uk8tTyh9ZGuYEZEMaeJYCF5BFuX552hsw==} - aproba@2.1.0: - resolution: {integrity: sha512-tLIEcj5GuR2RSTnxNKdkK0dJ/GrC7P38sUkiDmDuHfsHmbagTFAxDVIBltoklXEVIQ/f14IL8IMJ5pn9Hez1Ew==} - archiver-utils@2.1.0: resolution: {integrity: sha512-bEL/yUb/fNNiNTuUz979Z0Yg5L+LzLxGJz8x79lYmR54fmTIb6ob/hNQgkQnIUDWIFjZVQwl9Xs356I6BAMHfw==} engines: {node: '>= 6'} @@ -5282,11 +5326,6 @@ packages: resolution: {integrity: sha512-+25nxyyznAXF7Nef3y0EbBeqmGZgeN/BxHX29Rs39djAfaFalmQ89SE6CWyDCHzGL0yt/ycBtNOmGTW0FyGWNw==} engines: {node: '>= 10'} - are-we-there-yet@2.0.0: - resolution: {integrity: sha512-Ci/qENmwHnsYo9xKIcUJN5LeDKdJ6R1Z1j9V/J5wyq8nh/mYPEpIKJbBZXtZjG04HiK7zV/p6Vs9952MrMeUIw==} - engines: {node: '>=10'} - deprecated: This package is no longer supported. - arg@4.1.3: resolution: {integrity: sha512-58S9QDqG0Xx27YwPSt9fJxivjYl432YCwfDMfZ+71RAqUrZef7LrKQZ3LHLOwCS4FLNBplP533Zx895SeOCHvA==} @@ -5593,10 +5632,6 @@ packages: bcrypt-pbkdf@1.0.2: resolution: {integrity: sha512-qeFIXtP4MSoi6NLqO12WfqARWWuCKi2Rn/9hJLEmtB5yTNr9DqFWkJRCf2qShWzPeAMRnOgCrq0sg/KLv5ES9w==} - bcrypt@5.1.1: - resolution: {integrity: sha512-AGBHOG5hPYZ5Xl9KXzU5iKq9516yEmvCKDg3ecP5kX2aB6UqTeXZxk2ELnDgDm6BQSMlLt9rDB4LoSMx0rYwww==} - engines: {node: '>= 10.0.0'} - bidi-js@1.0.3: resolution: {integrity: sha512-RKshQI1R3YQ+n9YJz2QQ147P66ELpa1FQEg20Dk8oW9t2KgLbpDLLp9aGZ7y8WHSshDknG0bknqGw5/tyCs5tw==} @@ -5884,10 +5919,6 @@ packages: resolution: {integrity: sha512-Qgzu8kfBvo+cA4962jnP1KkS6Dop5NS6g7R5LFYJr4b8Ub94PPQXUksCw9PvXoeXPRRddRNC5C1JQUR2SMGtnA==} engines: {node: '>= 14.16.0'} - chownr@2.0.0: - resolution: {integrity: sha512-bIomtDF5KGpdogkLd9VspvFzk9KfpyyGlS8YFVZl7TGPBHL5snIOnxeshwVgPteQ9b4Eydl+pVbIyE1DcvCWgQ==} - engines: {node: '>=10'} - chrome-trace-event@1.0.4: resolution: {integrity: sha512-rNjApaLzuwaOTjCiT8lSDdGN1APCiqkChLMJxJPWLunPAt5fy8xgU9/jNOchV84wfIxrA0lRQB7oCT8jrn/wrQ==} engines: {node: '>=6.0'} @@ -6026,10 +6057,6 @@ packages: resolution: {integrity: sha512-Bb6Cq8oq0IjDOe8wJmi4JeNn763Xs9cfrBcaylK1tPypWzyoy2G3l90v9k64kjphl/ZJjPIShFztenRomi8WTg==} engines: {node: '>=18'} - color-support@1.1.3: - resolution: {integrity: sha512-qiBjkpbMLO/HL68y+lh4q0/O1MZFj2RX6X/KmMa3+gJD3z+WwI1ZzDHysvqHGS3mP6mznPckpXmw1nI9cJjyRg==} - hasBin: true - colorette@2.0.20: resolution: {integrity: sha512-IfEDxwoWIjkeXL1eXcDiow4UbKjhLdq6/EuSVR9GMN7KVH3r9gQ83e73hsz1Nd1T3ijd5xv1wcWRYO+D6kCI2w==} @@ -6106,9 +6133,6 @@ packages: console-browserify@1.2.0: resolution: {integrity: sha512-ZMkYO/LkF17QvCPqM0gxw8yUzigAOZOSWSHg91FH6orS7vcEj5dVZTidN2fQ14yBSdg97RqhSNwLUXInd52OTA==} - console-control-strings@1.1.0: - resolution: {integrity: sha512-ty/fTekppD2fIwRvnZAVdeOiGd1c7YXEixbgJTNzqcxJWKQnjJ/V1bNEEE6hygpM3WjwHFUVK6HTjWSzV4a8sQ==} - constants-browserify@1.0.0: resolution: {integrity: sha512-xFxOwqIzR/e1k1gLiWEophSCMqXcwVHIH7akf7b/vxcUeGunlj3hvZaaqxwHsTgn+IndtkQJgSztIDWeumWJDQ==} @@ -6524,9 +6548,6 @@ packages: resolution: {integrity: sha512-ZySD7Nf91aLB0RxL4KGrKHBXl7Eds1DAmEdcoVawXnLD7SDhpNgtuII2aAkg7a7QS41jxPSZ17p4VdGnMHk3MQ==} engines: {node: '>=0.4.0'} - delegates@1.0.0: - resolution: {integrity: sha512-bd2L678uiWATM6m5Z1VzNCErI3jiGzt6HGY8OVICs40JQq/HALfbyNJmp0UDakEY4pMMaN0Ly5om/B1VI/+xfQ==} - depd@1.1.2: resolution: {integrity: sha512-7emPTl6Dpo6JRXOXjLRxck+FlLRX5847cLKEn00PLAgc3g2hTZZgr+e4c2v6QpSmLeFP3n5yUo7ft6avBK/5jQ==} engines: {node: '>= 0.6'} @@ -7437,10 +7458,6 @@ packages: resolution: {integrity: sha512-eKpRKAovdpZtR1WopLHxlBWvAgPny3c4gX1G5Jhwmmw4XJj0ifSD5qB5TOo8hmA0wlRKDAOAhEE1yVPgs6Fgcg==} engines: {node: '>=14.14'} - fs-minipass@2.1.0: - resolution: {integrity: sha512-V/JgOLFCS+R6Vcq0slCuaeWEdNC3ouDlJMNIsacH2VtALiu9mV4LPrHc5cDl8k5aw6J8jwgWWpiTo5RYhmIzvg==} - engines: {node: '>= 8'} - fs-monkey@1.1.0: resolution: {integrity: sha512-QMUezzXWII9EV5aTFXW1UBVUO77wYPpjqIF8/AviUCThNeSYZykpoTixUeaNNBwmCev0AMDWMAni+f8Hxb1IFw==} @@ -7476,11 +7493,6 @@ packages: fuzzysort@3.1.0: resolution: {integrity: sha512-sR9BNCjBg6LNgwvxlBd0sBABvQitkLzoVY9MYYROQVX/FvfJ4Mai9LsGhDgd8qYdds0bY77VzYd5iuB+v5rwQQ==} - gauge@3.0.2: - resolution: {integrity: sha512-+5J6MS/5XksCuXq++uFRsnUd7Ovu1XenbeuIuNRJxYWjgQbPuFhT14lAvsWfqfAmnwluf1OwMjz39HjfLPci0Q==} - engines: {node: '>=10'} - deprecated: This package is no longer supported. - generator-function@2.0.1: resolution: {integrity: sha512-SFdFmIJi+ybC0vjlHN0ZGVGHc3lgE0DxPAT0djjVg+kjOnSqclqmj0KQ7ykTOLP6YxoqOvuAODGdcHJn+43q3g==} engines: {node: '>= 0.4'} @@ -7708,9 +7720,6 @@ packages: resolution: {integrity: sha512-NqADB8VjPFLM2V0VvHUewwwsw0ZWBaIdgo+ieHtK3hasLz4qeCRjYcqfB6AQrBggRKppKF8L52/VqdVsO47Dlw==} engines: {node: '>= 0.4'} - has-unicode@2.0.1: - resolution: {integrity: sha512-8Rf9Y83NBReMnx0gFzA8JImQACstCYWUplepDa9xprwwtmgEZUF0h/i5xSA625zB/I37EtrswSST6OXxwaaIJQ==} - has-value@0.3.1: resolution: {integrity: sha512-gpG936j8/MzaeID5Yif+577c17TxaDmhuyVgSwtnL/q8UUTySg8Mecb+8Cf1otgLoD7DDH75axp86ER7LFsf3Q==} engines: {node: '>=0.10.0'} @@ -9107,10 +9116,6 @@ packages: make-cancellable-promise@2.0.0: resolution: {integrity: sha512-3SEQqTpV9oqVsIWqAcmDuaNeo7yBO3tqPtqGRcKkEo0lrzD3wqbKG9mkxO65KoOgXqj+zH2phJ2LiAsdzlogSw==} - make-dir@3.1.0: - resolution: {integrity: sha512-g3FeP20LNwhALb/6Cz6Dd4F2ngze0jz7tbzrD2wAV+o9FeNHe4rL+yK2md0J/fiSf1sa1ADhXqi5+oVwOM/eGw==} - engines: {node: '>=8'} - make-dir@4.0.0: resolution: {integrity: sha512-hXdUTZYIVOt1Ex//jAQi+wTZZpUpwBj/0QsOzqegb3rGMMeJiSEu5xLHnYfBrRV4RH2+OCSOO95Is/7x1WJ4bw==} engines: {node: '>=10'} @@ -9290,22 +9295,10 @@ packages: resolution: {integrity: sha512-xPrLjWkTT5E7H7VnzOjF//xBp9I40jYB4aWhb2xTFopXXfw+Wo82DDWngdUju7Doy3Wk7R8C4LAgwhLHHnf0wA==} engines: {node: ^16 || ^18 || >=20} - minipass@3.3.6: - resolution: {integrity: sha512-DxiNidxSEK+tHG6zOIklvNOwm3hvCrbUrdtzY74U6HKTJxvIDfOUL5W5P2Ghd3DTkhhKPYGqeNUIh5qcM4YBfw==} - engines: {node: '>=8'} - - minipass@5.0.0: - resolution: {integrity: sha512-3FnjYuehv9k6ovOEbyOswadCDPX1piCfhV8ncmYtHOjuPwylVWsghTLo7rabjC3Rx5xD4HDx8Wm1xnMF7S5qFQ==} - engines: {node: '>=8'} - minipass@7.1.3: resolution: {integrity: sha512-tEBHqDnIoM/1rXME1zgka9g6Q2lcoCkxHLuc7ODJ5BxbP5d4c2Z5cGgtXAku59200Cx7diuHTOYfSBD8n6mm8A==} engines: {node: '>=16 || 14 >=14.17'} - minizlib@2.1.2: - resolution: {integrity: sha512-bAxsR8BVfj60DWXHE3u30oHzfl4G7khkSuPW+qvpd7jFRHm7dLxOjUk1EHACJ/hxLY8phGJ0YhYHZo7jil7Qdg==} - engines: {node: '>= 8'} - mitt@3.0.1: resolution: {integrity: sha512-vKivATfr97l2/QBCYAkXYDbrIWPM2IIKEl7YPhjCvKlG3kE2gm+uBo6nEXK3M5/Ffh/FLpKExzOQ3JJoJGFKBw==} @@ -9322,11 +9315,6 @@ packages: resolution: {integrity: sha512-FP+p8RB8OWpF3YZBCrP5gtADmtXApB5AMLn+vdyA+PyxCjrCs00mjyUozssO33cwDeT3wNGdLxJ5M//YqtHAJw==} hasBin: true - mkdirp@1.0.4: - resolution: {integrity: sha512-vVqVZQyf3WLx2Shd0qJ9xuvqgAyKPLAiqITEtqW0oIUjzo3PePDd6fW9iFz30ef7Ysp/oiWqbhszeGWW2T6Gzw==} - engines: {node: '>=10'} - hasBin: true - moment@2.30.1: resolution: {integrity: sha512-uEmtNhbDOrWPFS+hdjFCBfy9f2YoyzRpwcl+DqpC6taX21FzsTLQVbMV/W7PzNSX6x/bhC1zA3c2UQ5NzH6how==} @@ -9468,9 +9456,6 @@ packages: node-abort-controller@3.1.1: resolution: {integrity: sha512-AGK2yQKIjRuqnc6VkX2Xj5d+QW8xZ87pa1UK6yA6ouUyuxfHuMP6umE5QK7UmTeOAymo+Zx1Fxiuw9rVx8taHQ==} - node-addon-api@5.1.0: - resolution: {integrity: sha512-eh0GgfEkpnoWDq+VY8OyvYhFEzBk6jIYbRKdIlyTiAXIVJ8PyBaKb0rp7oDtoddbdoHWhq8wwr+XZ81F1rpNdA==} - node-addon-api@7.1.1: resolution: {integrity: sha512-5m3bsyrjFWE1xf7nz7YXdN4udnVtXK6/Yfgn5qnahL6bCkf2yKt4k3nuTKAtT4r3IG8JNR2ncsIMdZuAzJjHQQ==} @@ -9527,11 +9512,6 @@ packages: resolution: {integrity: sha512-Uzmd6LXpouKo8EUK68IjH4+E01w/hXyV3R3g/geCJo+rXLNfh1xucB+LOzYEOQPSiUK3h/xZf0cQGcSsmyL2Og==} engines: {node: '>=18'} - nopt@5.0.0: - resolution: {integrity: sha512-Tbj67rffqceeLpcRXrT7vKAN8CwfPeIBgM7E6iBkmKLV7bEMwpGgYLGv0jACUsECaa/vuxP0IjEont6umdMgtQ==} - engines: {node: '>=6'} - hasBin: true - normalize-package-data@2.5.0: resolution: {integrity: sha512-/5CMN3T0R4XTj4DcGaexo+roZSdSFW/0AOOTROrjxzCG1wrWXEsGbRKevjlIL+ZDE4sZlJr5ED4YW0yqmkK+eA==} @@ -9562,10 +9542,6 @@ packages: resolution: {integrity: sha512-9qny7Z9DsQU8Ou39ERsPU4OZQlSTP47ShQzuKZ6PRXpYLtIFgl/DEBYEXKlvcEa+9tHVcK8CF81Y2V72qaZhWA==} engines: {node: '>=18'} - npmlog@5.0.1: - resolution: {integrity: sha512-AqZtDUWOMKs1G/8lwylVjrdYgqA4d9nu8hc+0gzRxlDb1I10+FHBGMXs6aiQHFdCUUlqH99MUMuLfzWDNDtfxw==} - deprecated: This package is no longer supported. - nth-check@2.1.1: resolution: {integrity: sha512-lqjrjmaOoAnWfMmBPL+XNnynZh2+swxiX3WUE0s4yEHI6m+AwrK2UZOimIRl3X/4QctVqS8AiZjFqyOGrMXb/w==} @@ -11577,11 +11553,6 @@ packages: tar-stream@3.2.0: resolution: {integrity: sha512-ojzvCvVaNp6aOTFmG7jaRD0meowIAuPc3cMMhSgKiVWws1GyHbGd/xvnyuRKcKlMpt3qvxx6r0hreCNITP9hIg==} - tar@6.2.1: - resolution: {integrity: sha512-DZ4yORTwrbTj/7MZYq2w+/ZFdI6OZ/f9SFHR+71gIVUZhOQPHzVCLpvRnPgyaMpfWxxk/4ONva3GQSyNIKRv6A==} - engines: {node: '>=10'} - deprecated: Old versions of tar are not supported, and contain widely publicized security vulnerabilities, which have been fixed in the current version. Please update. Support for old versions may be purchased (at exorbitant rates) by contacting i@izs.me - teex@1.0.1: resolution: {integrity: sha512-eYE6iEI62Ni1H8oIa7KlDU6uQBtqr4Eajni3wX7rpfXD8ysFx8z0+dri+KWEPWpBsxXfxu58x/0jvTVT1ekOSg==} @@ -12528,9 +12499,6 @@ packages: engines: {node: '>=8'} hasBin: true - wide-align@1.1.5: - resolution: {integrity: sha512-eDMORYaPNZ4sQIuuYPDHdQvf4gyCF9rEEV/yPxGfwPkRodwEgiMUUXTx/dex+Me0wxx53S+NgUHaP7y3MGlDmg==} - window-size@0.1.0: resolution: {integrity: sha512-1pTPQDKTdd61ozlKGNCjhNRd+KPmgLSGa3mZTHoOliaGcESD8G1PXhh7c1fgiPjVbNVfgy2Faw4BI8/m0cC8Mg==} engines: {node: '>= 0.8.0'} @@ -12665,9 +12633,6 @@ packages: yallist@3.1.1: resolution: {integrity: sha512-a4UGQaWPH59mOXUYnAG2ewncQS4i4F43Tv3JoAM+s2VDAmS9NsK8GpDMLrCHPksFT7h3K6TOoUNn2pb7RoXx4g==} - yallist@4.0.0: - resolution: {integrity: sha512-3wdGidZyq5PB084XLES5TpOSRA3wjXAlIWMhum2kRcv/41Sn2emQ0dycQW4uZXLejwKvg6EsvbdlVL+FYEct7A==} - yaml@1.10.3: resolution: {integrity: sha512-vIYeF1u3CjlhAFekPPAk2h/Kv4T3mAkMox5OymRiJQB0spDP10LHvt+K7G9Ny6NuuMAb25/6n1qyUjAcGNf/AA==} engines: {node: '>= 6'} @@ -14130,21 +14095,6 @@ snapshots: dependencies: react: 19.2.6 - '@mapbox/node-pre-gyp@1.0.11': - dependencies: - detect-libc: 2.1.2 - https-proxy-agent: 5.0.1 - make-dir: 3.1.0 - node-fetch: 2.7.0 - nopt: 5.0.0 - npmlog: 5.0.1 - rimraf: 3.0.2 - semver: 7.8.2 - tar: 6.2.1 - transitivePeerDependencies: - - encoding - - supports-color - '@microsoft/tsdoc@0.15.1': {} '@microsoft/tsdoc@0.16.0': {} @@ -16647,6 +16597,26 @@ snapshots: '@sec-ant/readable-stream@0.4.1': {} + '@sendgrid/client@8.1.6': + dependencies: + '@sendgrid/helpers': 8.0.0 + axios: 1.17.0 + transitivePeerDependencies: + - debug + - supports-color + + '@sendgrid/helpers@8.0.0': + dependencies: + deepmerge: 4.3.1 + + '@sendgrid/mail@8.1.6': + dependencies: + '@sendgrid/client': 8.1.6 + '@sendgrid/helpers': 8.0.0 + transitivePeerDependencies: + - debug + - supports-color + '@sinclair/typebox@0.27.10': {} '@sindresorhus/merge-streams@4.0.0': {} @@ -17054,6 +17024,50 @@ snapshots: - debug - supports-color + '@tria-plc/api-common@file:local-packages/tria-plc-api-common-1.4.3.tgz(d81a2b6a79840fd7ce8c5d0cfc968145)': + dependencies: + '@nestjs/axios': 4.0.1(@nestjs/common@11.1.24(class-transformer@0.5.1)(class-validator@0.14.4)(reflect-metadata@0.2.2)(rxjs@7.8.2))(axios@1.17.0)(rxjs@7.8.2) + '@nestjs/common': 11.1.24(class-transformer@0.5.1)(class-validator@0.14.4)(reflect-metadata@0.2.2)(rxjs@7.8.2) + '@nestjs/core': 11.1.24(@nestjs/common@11.1.24(class-transformer@0.5.1)(class-validator@0.14.4)(reflect-metadata@0.2.2)(rxjs@7.8.2))(@nestjs/microservices@11.1.24)(@nestjs/platform-express@11.1.24)(reflect-metadata@0.2.2)(rxjs@7.8.2) + '@nestjs/jwt': 10.2.0(@nestjs/common@11.1.24(class-transformer@0.5.1)(class-validator@0.14.4)(reflect-metadata@0.2.2)(rxjs@7.8.2)) + '@nestjs/microservices': 11.1.24(@nestjs/common@11.1.24(class-transformer@0.5.1)(class-validator@0.14.4)(reflect-metadata@0.2.2)(rxjs@7.8.2))(@nestjs/core@11.1.24)(amqp-connection-manager@5.0.0(amqplib@2.0.1))(amqplib@2.0.1)(reflect-metadata@0.2.2)(rxjs@7.8.2) + '@nestjs/passport': 10.0.3(@nestjs/common@11.1.24(class-transformer@0.5.1)(class-validator@0.14.4)(reflect-metadata@0.2.2)(rxjs@7.8.2))(passport@0.7.0) + '@nestjs/swagger': 7.4.2(@nestjs/common@11.1.24(class-transformer@0.5.1)(class-validator@0.14.4)(reflect-metadata@0.2.2)(rxjs@7.8.2))(@nestjs/core@11.1.24)(class-transformer@0.5.1)(class-validator@0.14.4)(reflect-metadata@0.2.2) + '@nestjs/throttler': 6.5.0(@nestjs/common@11.1.24(class-transformer@0.5.1)(class-validator@0.14.4)(reflect-metadata@0.2.2)(rxjs@7.8.2))(@nestjs/core@11.1.24)(reflect-metadata@0.2.2) + '@nestjs/typeorm': 11.0.1(@nestjs/common@11.1.24(class-transformer@0.5.1)(class-validator@0.14.4)(reflect-metadata@0.2.2)(rxjs@7.8.2))(@nestjs/core@11.1.24)(reflect-metadata@0.2.2)(rxjs@7.8.2)(typeorm@0.3.30(babel-plugin-macros@3.1.0)(pg@8.21.0)(ts-node@10.9.2(@types/node@20.19.42)(typescript@5.9.3))) + '@tria-plc/iamapi-common': file:local-packages/tria-plc-iamapi-common-0.7.3.tgz(c97ba831ddde82920910406ab5262991) + argon2: 0.43.1 + axios: 1.17.0 + change-case: 5.4.4 + class-transformer: 0.5.1 + class-validator: 0.14.4 + dotenv: 16.6.1 + ethiopian-calendar-date-converter: 2.1.6 + ethiopian-date: 0.0.6 + exceljs: 4.4.0 + file-type: 21.3.4 + handlebars: 4.7.9 + handlebars-helpers: 0.10.0 + jmespath: 0.16.0 + jose: 5.10.0 + jsonwebtoken: 9.0.3 + libphonenumber-js: 1.13.6 + libreoffice-convert: 1.8.1 + nestjs-minio-client: 2.2.0(@nestjs/common@11.1.24(class-transformer@0.5.1)(class-validator@0.14.4)(reflect-metadata@0.2.2)(rxjs@7.8.2))(@nestjs/core@11.1.24) + passport-jwt: 4.0.1 + qrcode: 1.5.4 + reflect-metadata: 0.2.2 + rxjs: 7.8.2 + style-object-to-css-string: 1.1.3 + typeorm: 0.3.30(babel-plugin-macros@3.1.0)(pg@8.21.0)(ts-node@10.9.2(@types/node@20.19.42)(typescript@5.9.3)) + typeorm-extension: 3.9.0(@faker-js/faker@10.4.0)(typeorm@0.3.30(babel-plugin-macros@3.1.0)(pg@8.21.0)(ts-node@10.9.2(@types/node@20.19.42)(typescript@5.9.3))) + uuid: 11.1.1 + xlsx: 0.18.5 + transitivePeerDependencies: + - '@faker-js/faker' + - debug + - supports-color + '@tria-plc/iamapi-common@0.6.6(578386f46cf99fd4720e3e99f196f69e)': dependencies: '@nestjs/axios': 4.0.1(@nestjs/common@11.1.24(class-transformer@0.5.1)(class-validator@0.14.4)(reflect-metadata@0.2.2)(rxjs@7.8.2))(axios@1.17.0)(rxjs@7.8.2) @@ -17088,6 +17102,41 @@ snapshots: - '@faker-js/faker' - supports-color + '@tria-plc/iamapi-common@file:local-packages/tria-plc-iamapi-common-0.7.3.tgz(c97ba831ddde82920910406ab5262991)': + dependencies: + '@nestjs/axios': 4.0.1(@nestjs/common@11.1.24(class-transformer@0.5.1)(class-validator@0.14.4)(reflect-metadata@0.2.2)(rxjs@7.8.2))(axios@1.17.0)(rxjs@7.8.2) + '@nestjs/common': 11.1.24(class-transformer@0.5.1)(class-validator@0.14.4)(reflect-metadata@0.2.2)(rxjs@7.8.2) + '@nestjs/core': 11.1.24(@nestjs/common@11.1.24(class-transformer@0.5.1)(class-validator@0.14.4)(reflect-metadata@0.2.2)(rxjs@7.8.2))(@nestjs/microservices@11.1.24)(@nestjs/platform-express@11.1.24)(reflect-metadata@0.2.2)(rxjs@7.8.2) + '@nestjs/jwt': 10.2.0(@nestjs/common@11.1.24(class-transformer@0.5.1)(class-validator@0.14.4)(reflect-metadata@0.2.2)(rxjs@7.8.2)) + '@nestjs/microservices': 11.1.24(@nestjs/common@11.1.24(class-transformer@0.5.1)(class-validator@0.14.4)(reflect-metadata@0.2.2)(rxjs@7.8.2))(@nestjs/core@11.1.24)(amqp-connection-manager@5.0.0(amqplib@2.0.1))(amqplib@2.0.1)(reflect-metadata@0.2.2)(rxjs@7.8.2) + '@nestjs/passport': 10.0.3(@nestjs/common@11.1.24(class-transformer@0.5.1)(class-validator@0.14.4)(reflect-metadata@0.2.2)(rxjs@7.8.2))(passport@0.7.0) + '@nestjs/swagger': 7.4.2(@nestjs/common@11.1.24(class-transformer@0.5.1)(class-validator@0.14.4)(reflect-metadata@0.2.2)(rxjs@7.8.2))(@nestjs/core@11.1.24)(class-transformer@0.5.1)(class-validator@0.14.4)(reflect-metadata@0.2.2) + '@nestjs/throttler': 6.5.0(@nestjs/common@11.1.24(class-transformer@0.5.1)(class-validator@0.14.4)(reflect-metadata@0.2.2)(rxjs@7.8.2))(@nestjs/core@11.1.24)(reflect-metadata@0.2.2) + '@nestjs/typeorm': 11.0.1(@nestjs/common@11.1.24(class-transformer@0.5.1)(class-validator@0.14.4)(reflect-metadata@0.2.2)(rxjs@7.8.2))(@nestjs/core@11.1.24)(reflect-metadata@0.2.2)(rxjs@7.8.2)(typeorm@0.3.30(babel-plugin-macros@3.1.0)(pg@8.21.0)(ts-node@10.9.2(@types/node@20.19.42)(typescript@5.9.3))) + '@tria-plc/api-common': file:local-packages/tria-plc-api-common-1.4.3.tgz(d81a2b6a79840fd7ce8c5d0cfc968145) + api-common: 1.2.2 + argon2: 0.43.1 + axios: 1.17.0 + class-transformer: 0.5.1 + class-validator: 0.14.4 + dotenv: 17.4.2 + ethiopian-date: 0.0.6 + file-type: 21.3.4 + jose: 5.10.0 + jsonwebtoken: 9.0.3 + libphonenumber-js: 1.13.6 + nestjs-minio-client: 2.2.0(@nestjs/common@11.1.24(class-transformer@0.5.1)(class-validator@0.14.4)(reflect-metadata@0.2.2)(rxjs@7.8.2))(@nestjs/core@11.1.24) + passport-jwt: 4.0.1 + qrcode: 1.5.4 + reflect-metadata: 0.2.2 + rxjs: 7.8.2 + typeorm: 0.3.30(babel-plugin-macros@3.1.0)(pg@8.21.0)(ts-node@10.9.2(@types/node@20.19.42)(typescript@5.9.3)) + typeorm-extension: 3.9.0(@faker-js/faker@10.4.0)(typeorm@0.3.30(babel-plugin-macros@3.1.0)(pg@8.21.0)(ts-node@10.9.2(@types/node@20.19.42)(typescript@5.9.3))) + uuid: 11.1.1 + transitivePeerDependencies: + - '@faker-js/faker' + - supports-color + '@tria-plc/iamui-common@1.1.2(631ddfe3435b77e5a0893e986e0c71da)': dependencies: '@chakra-ui/react': 3.35.0(@emotion/react@11.14.0(@types/react@18.3.31)(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6) @@ -17430,10 +17479,6 @@ snapshots: dependencies: '@babel/types': 7.29.7 - '@types/bcrypt@5.0.2': - dependencies: - '@types/node': 20.19.42 - '@types/body-parser@1.19.6': dependencies: '@types/connect': 3.4.38 @@ -17485,6 +17530,13 @@ snapshots: '@types/estree@1.0.9': {} + '@types/express-serve-static-core@4.19.8': + dependencies: + '@types/node': 20.19.42 + '@types/qs': 6.15.1 + '@types/range-parser': 1.2.7 + '@types/send': 1.2.1 + '@types/express-serve-static-core@5.1.1': dependencies: '@types/node': 20.19.42 @@ -17492,6 +17544,13 @@ snapshots: '@types/range-parser': 1.2.7 '@types/send': 1.2.1 + '@types/express@4.17.25': + dependencies: + '@types/body-parser': 1.19.6 + '@types/express-serve-static-core': 4.19.8 + '@types/qs': 6.15.1 + '@types/serve-static': 1.15.10 + '@types/express@5.0.6': dependencies: '@types/body-parser': 1.19.6 @@ -17530,11 +17589,6 @@ snapshots: '@types/json5@0.0.29': {} - '@types/jsonwebtoken@9.0.10': - dependencies: - '@types/ms': 2.1.0 - '@types/node': 20.19.42 - '@types/jsonwebtoken@9.0.5': dependencies: '@types/node': 20.19.42 @@ -17545,7 +17599,7 @@ snapshots: '@types/methods@1.1.4': {} - '@types/ms@2.1.0': {} + '@types/mime@1.3.5': {} '@types/multer@2.1.0': dependencies: @@ -17565,20 +17619,6 @@ snapshots: '@types/parse-json@4.0.2': {} - '@types/passport-jwt@4.0.1': - dependencies: - '@types/jsonwebtoken': 9.0.10 - '@types/passport-strategy': 0.2.38 - - '@types/passport-strategy@0.2.38': - dependencies: - '@types/express': 5.0.6 - '@types/passport': 1.0.17 - - '@types/passport@1.0.17': - dependencies: - '@types/express': 5.0.6 - '@types/pg@8.20.0': dependencies: '@types/node': 20.19.42 @@ -17611,10 +17651,21 @@ snapshots: '@types/prop-types': 15.7.15 csstype: 3.2.3 + '@types/send@0.17.6': + dependencies: + '@types/mime': 1.3.5 + '@types/node': 20.19.42 + '@types/send@1.2.1': dependencies: '@types/node': 20.19.42 + '@types/serve-static@1.15.10': + dependencies: + '@types/http-errors': 2.0.5 + '@types/node': 20.19.42 + '@types/send': 0.17.6 + '@types/serve-static@2.2.0': dependencies: '@types/http-errors': 2.0.5 @@ -18539,8 +18590,6 @@ snapshots: jsonparse: 1.3.1 through: 2.3.8 - abbrev@1.1.1: {} - abort-controller@3.0.0: dependencies: event-target-shim: 5.0.1 @@ -18859,8 +18908,6 @@ snapshots: append-field@1.0.0: {} - aproba@2.1.0: {} - archiver-utils@2.1.0: dependencies: glob: 7.2.3 @@ -18897,11 +18944,6 @@ snapshots: tar-stream: 2.2.0 zip-stream: 4.1.1 - are-we-there-yet@2.0.0: - dependencies: - delegates: 1.0.0 - readable-stream: 3.6.2 - arg@4.1.3: {} arg@5.0.2: {} @@ -19230,14 +19272,6 @@ snapshots: dependencies: tweetnacl: 0.14.5 - bcrypt@5.1.1: - dependencies: - '@mapbox/node-pre-gyp': 1.0.11 - node-addon-api: 5.1.0 - transitivePeerDependencies: - - encoding - - supports-color - bidi-js@1.0.3: dependencies: require-from-string: 2.0.2 @@ -19653,8 +19687,6 @@ snapshots: dependencies: readdirp: 4.1.2 - chownr@2.0.0: {} - chrome-trace-event@1.0.4: {} chromium-bidi@14.0.0(devtools-protocol@0.0.1608973): @@ -19798,8 +19830,6 @@ snapshots: dependencies: color-name: 2.1.0 - color-support@1.1.3: {} - colorette@2.0.20: {} colors@1.0.3: {} @@ -19874,8 +19904,6 @@ snapshots: console-browserify@1.2.0: {} - console-control-strings@1.1.0: {} - constants-browserify@1.0.0: {} content-disposition@0.5.4: @@ -20300,8 +20328,6 @@ snapshots: delayed-stream@1.0.0: {} - delegates@1.0.0: {} - depd@1.1.2: {} depd@2.0.0: {} @@ -21566,10 +21592,6 @@ snapshots: jsonfile: 6.2.1 universalify: 2.0.1 - fs-minipass@2.1.0: - dependencies: - minipass: 3.3.6 - fs-monkey@1.1.0: {} fs.realpath@1.0.0: {} @@ -21605,18 +21627,6 @@ snapshots: fuzzysort@3.1.0: {} - gauge@3.0.2: - dependencies: - aproba: 2.1.0 - color-support: 1.1.3 - console-control-strings: 1.1.0 - has-unicode: 2.0.1 - object-assign: 4.1.1 - signal-exit: 3.0.7 - string-width: 4.2.3 - strip-ansi: 6.0.1 - wide-align: 1.1.5 - generator-function@2.0.1: {} gensync@1.0.0-beta.2: {} @@ -21881,8 +21891,6 @@ snapshots: dependencies: has-symbols: 1.1.0 - has-unicode@2.0.1: {} - has-value@0.3.1: dependencies: get-value: 2.0.6 @@ -23433,10 +23441,6 @@ snapshots: make-cancellable-promise@2.0.0: {} - make-dir@3.1.0: - dependencies: - semver: 6.3.1 - make-dir@4.0.0: dependencies: semver: 7.8.2 @@ -23647,19 +23651,8 @@ snapshots: xml: 1.0.1 xml2js: 0.5.0 - minipass@3.3.6: - dependencies: - yallist: 4.0.0 - - minipass@5.0.0: {} - minipass@7.1.3: {} - minizlib@2.1.2: - dependencies: - minipass: 3.3.6 - yallist: 4.0.0 - mitt@3.0.1: {} mixin-deep@1.3.2: @@ -23675,8 +23668,6 @@ snapshots: dependencies: minimist: 1.2.8 - mkdirp@1.0.4: {} - moment@2.30.1: {} motion-dom@12.40.0: @@ -23861,8 +23852,6 @@ snapshots: node-abort-controller@3.1.1: {} - node-addon-api@5.1.0: {} - node-addon-api@7.1.1: {} node-addon-api@8.8.0: {} @@ -23931,10 +23920,6 @@ snapshots: node-releases@2.0.47: {} - nopt@5.0.0: - dependencies: - abbrev: 1.1.1 - normalize-package-data@2.5.0: dependencies: hosted-git-info: 2.8.9 @@ -23969,13 +23954,6 @@ snapshots: path-key: 4.0.0 unicorn-magic: 0.3.0 - npmlog@5.0.1: - dependencies: - are-we-there-yet: 2.0.0 - console-control-strings: 1.1.0 - gauge: 3.0.2 - set-blocking: 2.0.0 - nth-check@2.1.1: dependencies: boolbase: 1.0.0 @@ -26495,15 +26473,6 @@ snapshots: - bare-buffer - react-native-b4a - tar@6.2.1: - dependencies: - chownr: 2.0.0 - fs-minipass: 2.1.0 - minipass: 5.0.0 - minizlib: 2.1.2 - mkdirp: 1.0.4 - yallist: 4.0.0 - teex@1.0.1: dependencies: streamx: 2.27.0 @@ -27607,10 +27576,6 @@ snapshots: siginfo: 2.0.0 stackback: 0.0.2 - wide-align@1.1.5: - dependencies: - string-width: 4.2.3 - window-size@0.1.0: {} winston-daily-rotate-file@1.7.2(winston@2.4.7): @@ -27719,8 +27684,6 @@ snapshots: yallist@3.1.1: {} - yallist@4.0.0: {} - yaml@1.10.3: {} yaml@2.9.0: {}