feat: ( permissions ) add permssions for master data

2026-08-30 04:08:11 +00:00 · 2026-07-14 20:04:42 +03:00
parent ef5d643ba4
commit fc684a0f65
13 changed files with 282 additions and 80 deletions
--- a/apps/edr-passenger-api/src/modules/fleet/fleet.controller.ts
+++ b/apps/edr-passenger-api/src/modules/fleet/fleet.controller.ts
@@ -3,7 +3,8 @@ import { ApiTags, ApiOperation, ApiBearerAuth, ApiParam, ApiQuery, ApiBody, ApiR
 import { FleetService } from './fleet.service';
 import { CreateTrainDto, CreateCoachDto, UpdateCoachDto, AssignCoachDto, ListCoachesDto, CreateCoachTypeDto, UpdateCoachTypeDto, CreateClassDto, UpdateClassDto, GenerateSeatMapDto } from './fleet.dto';
 import { JwtGuard } from '../../common/jwt.guard';
-import { PassengerAdmin } from '../../common/passenger-guards';
+import { PassengerAdmin, PassengerStaff } from '../../common/passenger-guards';
+import { PASSENGER_PERMS } from '../../seed/passenger-permissions.registry';

@ApiTags('Fleet')
@Controller('fleet')
@@ -21,6 +22,7 @@ export class FleetController {
  }

  @Post('coach-types')
+  @PassengerStaff([PASSENGER_PERMS.coaches.manage, PASSENGER_PERMS.admin])
  @ApiOperation({ summary: 'Create a coach type' })
  @ApiBody({ type: CreateCoachTypeDto })
  @ApiResponse({ status: 201, description: 'Coach type created' })
@@ -29,6 +31,7 @@ export class FleetController {
  }

  @Patch('coach-types/:id')
+  @PassengerStaff([PASSENGER_PERMS.coaches.manage, PASSENGER_PERMS.admin])
  @ApiOperation({ summary: 'Update a coach type' })
  @ApiParam({ name: 'id', description: 'Coach Type UUID' })
  @ApiBody({ type: UpdateCoachTypeDto })
@@ -59,6 +62,7 @@ export class FleetController {
  }

  @Post('classes')
+  @PassengerStaff([PASSENGER_PERMS.classes.manage, PASSENGER_PERMS.admin])
  @ApiOperation({ summary: 'Create a class' })
  @ApiBody({ type: CreateClassDto })
  @ApiResponse({ status: 201, description: 'Class created' })
@@ -67,6 +71,7 @@ export class FleetController {
  }

  @Patch('classes/:id')
+  @PassengerStaff([PASSENGER_PERMS.classes.manage, PASSENGER_PERMS.admin])
  @ApiOperation({ summary: 'Update a class' })
  @ApiParam({ name: 'id', description: 'Class UUID' })
  @ApiBody({ type: UpdateClassDto })
@@ -98,6 +103,7 @@ export class FleetController {
  }

  @Post('seat-classes')
+  @PassengerStaff([PASSENGER_PERMS.classes.manage, PASSENGER_PERMS.admin])
  @ApiOperation({ summary: 'Create a class (DEPRECATED - use /fleet/classes)' })
  @ApiBody({ type: CreateClassDto })
  @ApiResponse({ status: 201, description: 'Class created' })
@@ -106,6 +112,7 @@ export class FleetController {
  }

  @Patch('seat-classes/:id')
+  @PassengerStaff([PASSENGER_PERMS.classes.manage, PASSENGER_PERMS.admin])
  @ApiOperation({ summary: 'Update a class (DEPRECATED - use /fleet/classes)' })
  @ApiParam({ name: 'id', description: 'Class UUID' })
  @ApiBody({ type: UpdateClassDto })
@@ -136,6 +143,7 @@ export class FleetController {
  }

  @Post('trains')
+  @PassengerStaff([PASSENGER_PERMS.trains.manage, PASSENGER_PERMS.admin])
  @ApiOperation({ summary: 'Create a train service' })
  @ApiBody({ type: CreateTrainDto })
  @ApiResponse({ status: 201, description: 'Train created' })
@@ -144,6 +152,7 @@ export class FleetController {
  }

  @Patch('trains/:id')
+  @PassengerStaff([PASSENGER_PERMS.trains.manage, PASSENGER_PERMS.admin])
  @ApiOperation({ summary: 'Update a train service' })
  @ApiParam({ name: 'id', description: 'Train UUID' })
  @ApiBody({ type: CreateTrainDto })
@@ -166,6 +175,7 @@ export class FleetController {
  }

  @Patch('trains/:id/restore')
+  @PassengerStaff([PASSENGER_PERMS.trains.manage, PASSENGER_PERMS.admin])
  @ApiOperation({ summary: 'Restore (reactivate) a deactivated train' })
  @ApiParam({ name: 'id', description: 'Train UUID' })
  @ApiResponse({ status: 200, description: 'Train restored' })
@@ -268,6 +278,7 @@ export class FleetController {
  }

  @Post('coaches')
+  @PassengerStaff([PASSENGER_PERMS.coaches.manage, PASSENGER_PERMS.admin])
  @ApiOperation({ summary: 'Create a coach with auto-generated seat numbers' })
  @ApiBody({ type: CreateCoachDto })
  @ApiResponse({ 
@@ -293,6 +304,7 @@ export class FleetController {
  }

  @Patch('coaches/:id')
+  @PassengerStaff([PASSENGER_PERMS.coaches.manage, PASSENGER_PERMS.admin])
  @ApiOperation({ summary: 'Update coach properties' })
  @ApiParam({ name: 'id', description: 'Coach UUID' })
  @ApiBody({ type: UpdateCoachDto })
@@ -331,6 +343,7 @@ export class FleetController {
  }

  @Post('assignments')
+  @PassengerStaff([PASSENGER_PERMS.coaches.manage, PASSENGER_PERMS.admin])
  @ApiOperation({ summary: 'Assign a coach to a schedule' })
  @ApiBody({ type: AssignCoachDto })
  @ApiResponse({ status: 201, description: 'Coach assigned' })
--- a/apps/edr-passenger-api/src/modules/packages/packages.controller.ts
+++ b/apps/edr-passenger-api/src/modules/packages/packages.controller.ts
@@ -3,10 +3,10 @@ import { ApiTags, ApiOperation, ApiBearerAuth, ApiQuery } from '@nestjs/swagger'
 import { IsPublic } from '@tria-plc/api-common/modules/auth/decorators/public.decorator';
 import { PackagesService } from './packages.service';
 import { CreatePackageDto, BookPackageDto, CreatePriceTierDto, UpdatePriceTierDto, CreateInquiryDto, UpdateInquiryStatusDto, PackageBookingContextDto } from './packages.dto';
-import { IamGuard } from '../../common/iam-adapter';
 import { JwtGuard } from '../../common/jwt.guard';
 import { OptionalJwtGuard } from '../verifayda/optional-jwt.guard';
-import { PassengerAdmin } from '../../common/passenger-guards';
+import { PassengerAdmin, PassengerStaff } from '../../common/passenger-guards';
+import { PASSENGER_PERMS } from '../../seed/passenger-permissions.registry';

@ApiTags('Packages')
@Controller('packages')
@@ -21,7 +21,7 @@ export class PackagesController {
  }

  @Get('inquiries')
-  @UseGuards(IamGuard)
+  @PassengerStaff([PASSENGER_PERMS.inquiries.view, PASSENGER_PERMS.admin])
  @ApiBearerAuth('IAM-auth')
  @ApiOperation({ summary: 'List all inquiries (backoffice)' })
  listInquiries(
@@ -34,7 +34,7 @@ export class PackagesController {
  }

  @Patch('inquiries/:id/status')
-  @UseGuards(IamGuard)
+  @PassengerStaff([PASSENGER_PERMS.inquiries.manage, PASSENGER_PERMS.admin])
  @ApiBearerAuth('IAM-auth')
  @ApiOperation({ summary: 'Update inquiry status (backoffice)' })
  updateInquiryStatus(@Param('id') id: string, @Body() dto: UpdateInquiryStatusDto) {
@@ -57,7 +57,7 @@ export class PackagesController {
  }

  @Get('all')
-  @UseGuards(IamGuard)
+  @PassengerStaff([PASSENGER_PERMS.packages.view, PASSENGER_PERMS.admin])
  @ApiBearerAuth('IAM-auth')
  @ApiOperation({ summary: 'List all packages (backoffice)' })
  listAll(@Query('page') page?: string, @Query('pageSize') pageSize?: string) {
@@ -65,7 +65,7 @@ export class PackagesController {
  }

  @Get('bookings')
-  @UseGuards(IamGuard)
+  @PassengerStaff([PASSENGER_PERMS.packages.view, PASSENGER_PERMS.admin])
  @ApiBearerAuth('IAM-auth')
  @ApiOperation({ summary: 'List all package bookings (backoffice)' })
  listBookings(
@@ -124,7 +124,7 @@ export class PackagesController {
  }

  @Post()
-  @UseGuards(IamGuard)
+  @PassengerStaff([PASSENGER_PERMS.packages.manage, PASSENGER_PERMS.admin])
  @ApiBearerAuth('IAM-auth')
  @ApiOperation({ summary: 'Create package (admin)' })
  create(@Body() dto: CreatePackageDto) {
@@ -132,7 +132,7 @@ export class PackagesController {
  }

  @Patch(':id')
-  @UseGuards(IamGuard)
+  @PassengerStaff([PASSENGER_PERMS.packages.manage, PASSENGER_PERMS.admin])
  @ApiBearerAuth('IAM-auth')
  @ApiOperation({ summary: 'Update package (admin)' })
  update(@Param('id') id: string, @Body() dto: Partial<CreatePackageDto>) {
@@ -149,7 +149,7 @@ export class PackagesController {
  }

  @Patch(':id/activate')
-  @UseGuards(IamGuard)
+  @PassengerStaff([PASSENGER_PERMS.packages.manage, PASSENGER_PERMS.admin])
  @ApiBearerAuth('IAM-auth')
  @ApiOperation({ summary: 'Activate package (admin)' })
  activate(@Param('id') id: string) {
@@ -157,7 +157,7 @@ export class PackagesController {
  }

  @Patch(':id/deactivate')
-  @UseGuards(IamGuard)
+  @PassengerStaff([PASSENGER_PERMS.packages.manage, PASSENGER_PERMS.admin])
  @ApiBearerAuth('IAM-auth')
  @ApiOperation({ summary: 'Deactivate package (admin)' })
  deactivate(@Param('id') id: string) {
@@ -165,7 +165,7 @@ export class PackagesController {
  }

  @Post(':id/tiers')
-  @UseGuards(IamGuard)
+  @PassengerStaff([PASSENGER_PERMS.packages.manage, PASSENGER_PERMS.admin])
  @ApiBearerAuth('IAM-auth')
  @ApiOperation({ summary: 'Add price tier to package (admin)' })
  addTier(@Param('id') id: string, @Body() dto: CreatePriceTierDto) {
@@ -173,7 +173,7 @@ export class PackagesController {
  }

  @Patch('tiers/:tierId')
-  @UseGuards(IamGuard)
+  @PassengerStaff([PASSENGER_PERMS.packages.manage, PASSENGER_PERMS.admin])
  @ApiBearerAuth('IAM-auth')
  @ApiOperation({ summary: 'Update price tier (admin)' })
  updateTier(@Param('tierId') tierId: string, @Body() dto: UpdatePriceTierDto) {
--- a/apps/edr-passenger-api/src/modules/payments/payments.controller.ts
+++ b/apps/edr-passenger-api/src/modules/payments/payments.controller.ts
@@ -55,7 +55,11 @@ export class PaymentsController {
  }

  @Get("all")
-  @PassengerStaff([PASSENGER_PERMS.payments.viewAll, PASSENGER_PERMS.admin])
+  @PassengerStaff([
+    PASSENGER_PERMS.payments.view,
+    PASSENGER_PERMS.payments.viewAll,
+    PASSENGER_PERMS.admin,
+  ])
  @ApiBearerAuth("IAM-auth")
  @ApiOperation({ summary: "Get all payments with filters (staff/admin only)" })
  @ApiQuery({ name: "search", required: false })
@@ -146,7 +150,11 @@ export class PaymentsController {
  }

  @Post("refund")
-  @PassengerStaff([PASSENGER_PERMS.payments.refund, PASSENGER_PERMS.admin])
+  @PassengerStaff([
+    PASSENGER_PERMS.payments.manage,
+    PASSENGER_PERMS.payments.refund,
+    PASSENGER_PERMS.admin,
+  ])
  @ApiBearerAuth("IAM-auth")
  @ApiOperation({ summary: "Refund a confirmed booking (staff/agent only)" })
  refund(@Body() dto: RefundDto) {
@@ -155,6 +163,7 @@ export class PaymentsController {

  @Post(":bookingId/force-confirm")
  @PassengerStaff([
+    PASSENGER_PERMS.payments.manage,
    PASSENGER_PERMS.payments.manageMethods,
    PASSENGER_PERMS.admin,
  ])
@@ -174,6 +183,7 @@ export class PaymentsController {

  @Post("methods")
  @PassengerStaff([
+    PASSENGER_PERMS.paymentMethods.manage,
    PASSENGER_PERMS.payments.manageMethods,
    PASSENGER_PERMS.admin,
  ])
@@ -187,6 +197,7 @@ export class PaymentsController {

  @Patch("methods/:id")
  @PassengerStaff([
+    PASSENGER_PERMS.paymentMethods.manage,
    PASSENGER_PERMS.payments.manageMethods,
    PASSENGER_PERMS.admin,
  ])
--- a/apps/edr-passenger-api/src/modules/schedules/routes.controller.ts
+++ b/apps/edr-passenger-api/src/modules/schedules/routes.controller.ts
@@ -1,9 +1,9 @@
-import { Body, Controller, Delete, Get, Param, Patch, Post, Put, Query, ParseIntPipe, UseGuards } from '@nestjs/common';
+import { Body, Controller, Delete, Get, Param, Patch, Post, Put, Query, ParseIntPipe } from '@nestjs/common';
 import { ApiTags, ApiOperation, ApiBearerAuth, ApiParam, ApiQuery, ApiResponse } from '@nestjs/swagger';
 import { RoutesService } from './routes.service';
 import { CreateRouteDto, AddRouteStopDto, UpdateRouteDto, SetRouteCoachTemplateDto } from './routes.dto';
-import { JwtGuard } from '../../common/jwt.guard';
-import { PassengerAdmin } from '../../common/passenger-guards';
+import { PassengerAdmin, PassengerStaff } from '../../common/passenger-guards';
+import { PASSENGER_PERMS } from '../../seed/passenger-permissions.registry';

@ApiTags('Routes')
@Controller('routes')
@@ -13,7 +13,7 @@ export class RoutesController {
  // ── Routes ─────────────────────────────────────────────────────────────────

  @Post()
-  @UseGuards(JwtGuard) @ApiBearerAuth('JWT-auth')
+  @PassengerStaff([PASSENGER_PERMS.routes.manage, PASSENGER_PERMS.admin]) @ApiBearerAuth('IAM-auth')
  @ApiOperation({
    summary: 'Create a reusable route with its ordered stops',
    description: `Define the physical corridor once (e.g. ADD→ADM→AWS→DDW→AYS→DJI).
@@ -41,7 +41,7 @@ Route stops carry distanceKm for fare-by-distance calculations.`,
  getRoute(@Param('id') id: string) { return this.service.getRoute(id); }

  @Patch(':id')
-  @UseGuards(JwtGuard) @ApiBearerAuth('JWT-auth')
+  @PassengerStaff([PASSENGER_PERMS.routes.manage, PASSENGER_PERMS.admin]) @ApiBearerAuth('IAM-auth')
  @ApiOperation({ summary: 'Update route metadata (name, description, active flag, effectiveUntil)' })
  @ApiParam({ name: 'id', description: 'Route UUID' })
  @ApiResponse({ status: 200, description: 'Route updated' })
@@ -68,7 +68,7 @@ Route stops carry distanceKm for fare-by-distance calculations.`,
  getStops(@Param('id') id: string) { return this.service.getStops(id); }

  @Post(':id/stops')
-  @UseGuards(JwtGuard) @ApiBearerAuth('JWT-auth')
+  @PassengerStaff([PASSENGER_PERMS.routes.manage, PASSENGER_PERMS.admin]) @ApiBearerAuth('IAM-auth')
  @ApiOperation({ summary: 'Add a stop to an existing route' })
  @ApiParam({ name: 'id', description: 'Route UUID' })
  @ApiResponse({ status: 201, description: 'Stop added' })
@@ -108,7 +108,7 @@ Route stops carry distanceKm for fare-by-distance calculations.`,
  getCoachTemplate(@Param('id') id: string) { return this.service.getRouteCoachTemplate(id); }

  @Put(':id/coaches')
-  @UseGuards(JwtGuard) @ApiBearerAuth('JWT-auth')
+  @PassengerStaff([PASSENGER_PERMS.routes.manage, PASSENGER_PERMS.admin]) @ApiBearerAuth('IAM-auth')
  @ApiOperation({
    summary: 'Set the default coach lineup for this route',
    description: 'Replaces the entire coach template. Coaches are auto-assigned in this order when a new schedule is created for this route.',
--- a/apps/edr-passenger-api/src/modules/schedules/schedules.controller.ts
+++ b/apps/edr-passenger-api/src/modules/schedules/schedules.controller.ts
@@ -1,10 +1,10 @@
-import { Body, Controller, Delete, Get, Param, Patch, Post, Put, Query, ParseIntPipe, UseGuards } from '@nestjs/common';
+import { Body, Controller, Delete, Get, Param, Patch, Post, Put, Query, ParseIntPipe } from '@nestjs/common';
 import { ApiTags, ApiOperation, ApiBearerAuth, ApiParam, ApiQuery, ApiResponse } from '@nestjs/swagger';
 import { IsPublic } from '@tria-plc/api-common/modules/auth/decorators/public.decorator';
 import { SchedulesService } from './schedules.service';
 import { CreateScheduleDto, UpdateScheduleDto, CreateFareRuleDto, UpdateScheduleStatusDto, UpdateStopTimeDto, ListSchedulesDto, BulkCreateSchedulesDto, BulkSchedulesResponseDto, TripStatus } from './schedules.dto';
-import { JwtGuard } from '../../common/jwt.guard';
-import { PassengerAdmin } from '../../common/passenger-guards';
+import { PassengerAdmin, PassengerStaff } from '../../common/passenger-guards';
+import { PASSENGER_PERMS } from '../../seed/passenger-permissions.registry';

@ApiTags('Schedule')
@Controller('schedules')
@@ -12,14 +12,14 @@ export class SchedulesController {
  constructor(private service: SchedulesService) {}

  @Post('bulk-generate')
-  @UseGuards(JwtGuard) @ApiBearerAuth('JWT-auth')
+  @PassengerStaff([PASSENGER_PERMS.schedules.manage, PASSENGER_PERMS.admin]) @ApiBearerAuth('IAM-auth')
  @ApiOperation({ summary: 'Bulk generate repetitive schedules' })
  bulkGenerateSchedules(@Body() dto: BulkCreateSchedulesDto) {
    return this.service.bulkGenerateSchedules(dto);
  }

  @Post()
-  @UseGuards(JwtGuard) @ApiBearerAuth('JWT-auth')
+  @PassengerStaff([PASSENGER_PERMS.schedules.manage, PASSENGER_PERMS.admin]) @ApiBearerAuth('IAM-auth')
  @ApiOperation({ summary: 'Create a train schedule from a route template' })
  createSchedule(@Body() dto: CreateScheduleDto) { return this.service.createSchedule(dto); }

@@ -42,13 +42,13 @@ export class SchedulesController {
  // ===== SPECIFIC ROUTES (must come BEFORE generic :id routes) =====

  @Post('fares')
-  @UseGuards(JwtGuard) @ApiBearerAuth('JWT-auth')
+  @PassengerStaff([PASSENGER_PERMS.schedules.manage, PASSENGER_PERMS.admin]) @ApiBearerAuth('IAM-auth')
  @ApiOperation({ summary: 'Create a fare rule scoped to a schedule or route code' })
  @ApiResponse({ status: 201, description: 'Fare rule created' })
  createFareRule(@Body() dto: CreateFareRuleDto) { return this.service.createFareRule(dto); }

  @Patch('fares/:id')
-  @UseGuards(JwtGuard) @ApiBearerAuth('JWT-auth')
+  @PassengerStaff([PASSENGER_PERMS.schedules.manage, PASSENGER_PERMS.admin]) @ApiBearerAuth('IAM-auth')
  @ApiOperation({ summary: 'Update a fare rule' })
  @ApiParam({ name: 'id', description: 'FareRule UUID' })
  @ApiResponse({ status: 200, description: 'Fare rule updated' })
@@ -65,7 +65,7 @@ export class SchedulesController {
  deleteFareRule(@Param('id') id: string) { return this.service.deleteFareRule(id); }

  @Post('segment-fares')
-  @UseGuards(JwtGuard) @ApiBearerAuth('JWT-auth')
+  @PassengerStaff([PASSENGER_PERMS.schedules.manage, PASSENGER_PERMS.admin]) @ApiBearerAuth('IAM-auth')
  @ApiOperation({ summary: 'Create a segment fare rule' })
  createSegmentFareRule(@Body() dto: any) { return this.service.createSegmentFareRule(dto); }

@@ -76,7 +76,7 @@ export class SchedulesController {
  getSegmentFares(@Param('routeId') routeId: string) { return this.service.getSegmentFares(routeId); }

  @Patch('segment-fares/:id')
-  @UseGuards(JwtGuard) @ApiBearerAuth('JWT-auth')
+  @PassengerStaff([PASSENGER_PERMS.schedules.manage, PASSENGER_PERMS.admin]) @ApiBearerAuth('IAM-auth')
  @ApiOperation({ summary: 'Update a segment fare rule' })
  @ApiParam({ name: 'id', description: 'SegmentFareRule UUID' })
  updateSegmentFareRule(@Param('id') id: string, @Body() dto: any) { return this.service.updateSegmentFareRule(id, dto); }
@@ -97,7 +97,7 @@ export class SchedulesController {
  getSchedule(@Param('id') id: string) { return this.service.getSchedule(id); }

  @Patch(':id')
-  @UseGuards(JwtGuard) @ApiBearerAuth('JWT-auth')
+  @PassengerStaff([PASSENGER_PERMS.schedules.manage, PASSENGER_PERMS.admin]) @ApiBearerAuth('IAM-auth')
  @ApiOperation({ summary: 'Update a schedule (partial)' })
  @ApiParam({ name: 'id', description: 'TrainSchedule UUID' })
  updateSchedule(@Param('id') id: string, @Body() dto: UpdateScheduleDto) {
@@ -105,7 +105,7 @@ export class SchedulesController {
  }

  @Patch(':id/status')
-  @UseGuards(JwtGuard) @ApiBearerAuth('JWT-auth')
+  @PassengerStaff([PASSENGER_PERMS.schedules.manage, PASSENGER_PERMS.admin]) @ApiBearerAuth('IAM-auth')
  @ApiOperation({ summary: 'Update schedule status' })
  @ApiParam({ name: 'id', description: 'TrainSchedule UUID' })
  updateStatus(@Param('id') id: string, @Body() dto: UpdateScheduleStatusDto) {
@@ -127,7 +127,7 @@ export class SchedulesController {
  getStops(@Param('id') id: string) { return this.service.getStops(id); }

  @Patch(':id/stops/:sequence')
-  @UseGuards(JwtGuard) @ApiBearerAuth('JWT-auth')
+  @PassengerStaff([PASSENGER_PERMS.schedules.manage, PASSENGER_PERMS.admin]) @ApiBearerAuth('IAM-auth')
  @ApiOperation({ summary: 'Update a stop time' })
  @ApiParam({ name: 'id', description: 'TrainSchedule UUID' })
  @ApiParam({ name: 'sequence', description: 'Stop sequence number' })
@@ -138,7 +138,7 @@ export class SchedulesController {
  ) { return this.service.updateStop(id, sequence, dto); }

  @Put(':scheduleId/fares/:seatClassId')
-  @UseGuards(JwtGuard) @ApiBearerAuth('JWT-auth')
+  @PassengerStaff([PASSENGER_PERMS.schedules.manage, PASSENGER_PERMS.admin]) @ApiBearerAuth('IAM-auth')
  @ApiOperation({
    summary: 'Override fare for a specific seat class on a schedule',
    description: 'Upserts a schedule-scoped FareRule. Expires any existing active rule for the same schedule+seatClass and creates a new one.',
@@ -186,12 +186,13 @@ export class SchedulesController {
  }

  @Post(':id/fares/sync')
+  @PassengerStaff([PASSENGER_PERMS.schedules.manage, PASSENGER_PERMS.admin]) @ApiBearerAuth('IAM-auth')
  @ApiOperation({ summary: 'Sync fares from fare engine' })
  @ApiParam({ name: 'id', description: 'TrainSchedule UUID' })
  syncFares(@Param('id') id: string) { return this.service.syncFaresFromEngine(id); }

  @Post(':id/coaches')
-  @UseGuards(JwtGuard) @ApiBearerAuth('JWT-auth')
+  @PassengerStaff([PASSENGER_PERMS.schedules.manage, PASSENGER_PERMS.admin]) @ApiBearerAuth('IAM-auth')
  @ApiOperation({ summary: 'Assign coaches to a schedule' })
  @ApiParam({ name: 'id', description: 'TrainSchedule UUID' })
  assignCoaches(
--- a/apps/edr-passenger-api/src/modules/seat-classes/seat-classes.controller.ts
+++ b/apps/edr-passenger-api/src/modules/seat-classes/seat-classes.controller.ts
@@ -1,10 +1,10 @@
-import { Body, Controller, Delete, Get, Param, Patch, Post, UseGuards } from '@nestjs/common';
+import { Body, Controller, Delete, Get, Param, Patch, Post } from '@nestjs/common';
 import { ApiTags, ApiOperation, ApiBearerAuth, ApiParam, ApiResponse, ApiBody } from '@nestjs/swagger';
 import { IsPublic } from '@tria-plc/api-common/modules/auth/decorators/public.decorator';
 import { SeatClassesService } from './seat-classes.service';
 import { CreateSeatClassDto, UpdateSeatClassDto } from './seat-classes.dto';
-import { JwtGuard } from '../../common/jwt.guard';
-import { PassengerAdmin } from '../../common/passenger-guards';
+import { PassengerAdmin, PassengerStaff } from '../../common/passenger-guards';
+import { PASSENGER_PERMS } from '../../seed/passenger-permissions.registry';

@ApiTags('Seat Classes')
@Controller('seat-classes')
@@ -26,7 +26,7 @@ export class SeatClassesController {
  getSeatClass(@Param('id') id: string) { return this.service.getSeatClass(id); }

  @Post()
-  @UseGuards(JwtGuard) @ApiBearerAuth('JWT-auth')
+  @PassengerStaff([PASSENGER_PERMS.tariffRates.manage, PASSENGER_PERMS.admin]) @ApiBearerAuth('IAM-auth')
  @ApiOperation({ summary: 'Create a seat class' })
  @ApiBody({ type: CreateSeatClassDto })
  @ApiResponse({ status: 201, description: 'Seat class created' })
@@ -34,7 +34,7 @@ export class SeatClassesController {
  createSeatClass(@Body() dto: CreateSeatClassDto) { return this.service.createSeatClass(dto); }

  @Patch(':id')
-  @UseGuards(JwtGuard) @ApiBearerAuth('JWT-auth')
+  @PassengerStaff([PASSENGER_PERMS.tariffRates.manage, PASSENGER_PERMS.admin]) @ApiBearerAuth('IAM-auth')
  @ApiOperation({ summary: 'Update a seat class' })
  @ApiParam({ name: 'id', description: 'Seat class UUID' })
  @ApiBody({ type: UpdateSeatClassDto })
--- a/apps/edr-passenger-api/src/modules/seats/seats.controller.ts
+++ b/apps/edr-passenger-api/src/modules/seats/seats.controller.ts
@@ -21,7 +21,8 @@ import {
 import { SeatsService } from "./seats.service";
 import { HoldSeatsDto, ReleaseHoldDto } from "./seats.dto";
 import { JwtGuard } from "../../common/jwt.guard";
-import { IamGuard } from "../../common/iam-adapter";
+import { PassengerStaff } from "../../common/passenger-guards";
+import { PASSENGER_PERMS } from "../../seed/passenger-permissions.registry";

@ApiTags("Seats")
@Controller("seats")
@@ -205,7 +206,7 @@ This makes it clear which segment of the route each seat is held for, enabling s

  // ── Seat Block / Unblock ───────────────────────────────────────────────────
  @Post(":seatId/block")
-  @UseGuards(IamGuard)
+  @PassengerStaff([PASSENGER_PERMS.seats.manage, PASSENGER_PERMS.admin])
  @ApiBearerAuth("IAM-auth")
  @ApiOperation({ summary: "Block a seat (e.g., maintenance, damage)" })
  @ApiParam({ name: "seatId", description: "Seat UUID" })
@@ -215,7 +216,7 @@ This makes it clear which segment of the route each seat is held for, enabling s
  }

  @Delete(":seatId/block")
-  @UseGuards(IamGuard)
+  @PassengerStaff([PASSENGER_PERMS.seats.manage, PASSENGER_PERMS.admin])
  @ApiBearerAuth("IAM-auth")
  @ApiOperation({ summary: "Unblock a seat" })
  @ApiParam({ name: "seatId", description: "Seat UUID" })
@@ -226,7 +227,7 @@ This makes it clear which segment of the route each seat is held for, enabling s

  // ── Maintenance ───────────────────────────────────────────────────────────
  @Post(":seatId/maintenance")
-  @UseGuards(IamGuard)
+  @PassengerStaff([PASSENGER_PERMS.seats.manage, PASSENGER_PERMS.admin])
  @ApiBearerAuth("IAM-auth")
  @ApiOperation({ summary: "Set seat status to Under Maintenance" })
  @ApiParam({ name: "seatId", description: "Seat UUID" })
@@ -236,7 +237,7 @@ This makes it clear which segment of the route each seat is held for, enabling s
  }

  @Delete(":seatId/maintenance")
-  @UseGuards(IamGuard)
+  @PassengerStaff([PASSENGER_PERMS.seats.manage, PASSENGER_PERMS.admin])
  @ApiBearerAuth("IAM-auth")
  @ApiOperation({ summary: "Clear seat maintenance status" })
  @ApiParam({ name: "seatId", description: "Seat UUID" })
@@ -247,7 +248,7 @@ This makes it clear which segment of the route each seat is held for, enabling s

  // ── Remove Seat ────────────────────────────────────────────────────────────
  @Patch(":seatId/remove")
-  @UseGuards(IamGuard)
+  @PassengerStaff([PASSENGER_PERMS.seats.manage, PASSENGER_PERMS.admin])
  @ApiBearerAuth("IAM-auth")
  @ApiOperation({
    summary: "Remove a seat by marking with negative seatNumber",
@@ -263,7 +264,7 @@ This makes it clear which segment of the route each seat is held for, enabling s
  }

  @Patch(":seatId/undo-remove")
-  @UseGuards(IamGuard)
+  @PassengerStaff([PASSENGER_PERMS.seats.manage, PASSENGER_PERMS.admin])
  @ApiBearerAuth("IAM-auth")
  @ApiOperation({
    summary: "Undo seat removal by restoring original seatNumber",
--- a/apps/edr-passenger-api/src/modules/stations/stations.controller.ts
+++ b/apps/edr-passenger-api/src/modules/stations/stations.controller.ts
@@ -1,10 +1,10 @@
-import { Body, Controller, Get, Param, Post, Patch, Delete, UseGuards, Query } from '@nestjs/common';
+import { Body, Controller, Get, Param, Post, Patch, Delete, Query } from '@nestjs/common';
 import { ApiTags, ApiOperation, ApiBearerAuth, ApiQuery, ApiResponse } from '@nestjs/swagger';
 import { IsPublic } from '@tria-plc/api-common/modules/auth/decorators/public.decorator';
 import { StationsService } from './stations.service';
 import { CreateStationDto } from './stations.dto';
-import { JwtGuard } from '../../common/jwt.guard';
-import { PassengerAdmin } from '../../common/passenger-guards';
+import { PassengerAdmin, PassengerStaff } from '../../common/passenger-guards';
+import { PASSENGER_PERMS } from '../../seed/passenger-permissions.registry';

@ApiTags('Stations')
@Controller('stations')
@@ -79,8 +79,8 @@ export class StationsController {
  findOne(@Param('id') id: string) { return this.service.findOne(id); }
  
  @Post()
-  @UseGuards(JwtGuard)
-  @ApiBearerAuth('JWT-auth')
+  @PassengerStaff([PASSENGER_PERMS.stations.manage, PASSENGER_PERMS.admin])
+  @ApiBearerAuth('IAM-auth')
  @ApiOperation({ summary: 'Create new station' })
  @ApiResponse({
    status: 201,
@@ -105,8 +105,8 @@ export class StationsController {
  create(@Body() dto: CreateStationDto) { return this.service.create(dto); }

  @Patch(':id')
-  @UseGuards(JwtGuard)
-  @ApiBearerAuth('JWT-auth')
+  @PassengerStaff([PASSENGER_PERMS.stations.manage, PASSENGER_PERMS.admin])
+  @ApiBearerAuth('IAM-auth')
  @ApiOperation({ summary: 'Update station' })
  @ApiResponse({
    status: 200,