feat: ( redirect ) add redirect url based on the domain name

apps/edr-passenger-api/src/modules/payments/payments.controller.ts

@@ -3,6 +3,7 @@ import {
   Controller,
   Delete,
   Get,
+  Headers,
   HttpStatus,
   Param,
   Patch,
@@ -37,6 +38,7 @@ import {
 } from "./payments.dto";
 import { PassengerStaff } from "../../common/passenger-guards";
 import { PASSENGER_PERMS } from "../../seed/passenger-permissions.registry";
+import { resolveAllowedOrigin } from "../../common/utils/redirect-origin.util";
 
 @ApiTags("Payment")
 @Controller("payments")
@@ -83,8 +85,19 @@ export class PaymentsController {
     summary: "Initiate payment with nationality-based payment methods",
     description: `Initiates payment for a booking with support for multiple payment providers:\n\n**Ethiopian Payment Methods:**\n- TELEBIRR - Ethiopia's leading mobile money\n- CBE_BIRR - Commercial Bank of Ethiopia\n- EBIRR - Electronic payment gateway\n\n**Djiboutian Payment Methods:**\n- WAAFI - Djibouti's mobile money service\n\n**International Payment Methods:**\n- CARD - Visa, Mastercard\n- WALLET - Internal wallet balance\n\n**Multi-Currency:**\n- All transactions processed in ETB\n- Display amounts in ETB, DJF, or USD\n- Real-time exchange rate conversion`,
   })
-  initiatePayment(@Body() dto: InitiatePaymentDto) {
-    return this.service.initiatePayment(dto);
+  initiatePayment(
+    @Body() dto: InitiatePaymentDto,
+    @Headers("origin") origin?: string,
+    @Headers("referer") referer?: string,
+    @Headers("x-frontend-base-url") frontendBaseUrl?: string,
+  ) {
+    // Browser-facing return URLs (telebirr/waafi) follow the domain the user is
+    // on — derived from Origin, then Referer, then the X-Frontend-Base-URL
+    // header the portal sets, all validated against the allowlist.
+    return this.service.initiatePayment(
+      dto,
+      resolveAllowedOrigin(origin, referer, frontendBaseUrl),
+    );
   }
 
   @Get("intents/:bookingId")