Audit Auth JWT · Driver · Partner — cập nhật sau IMP

2026-07-24 · WP-AUTH-02 · WP-DRV-* · WP-PAR-AUTH-01 · FE auth scaffold đã PASS.

Trạng thái hiện tại

Phần	Status	Chi tiết
OTP + JWT	IMP	`surface`: CONSUMER \| DRIVER \| PARTNER
Roles từ DB mỗi request	IMP	`JwtStrategy.validate` reload
`RolesGuard` `/driver/*`	IMP	USER → 403 trên `me`/trips
`POST /driver/register`	IMP	→ `DriverProfile` PENDING
Admin duyệt driver	IMP	→ Role.DRIVER
Online / accept / pickup / complete	IMP	Ride `REQUESTED` → driver nhận
Earnings	IMP MVP	Tổng fare COMPLETED
App `driver/` FE	IMP scaffold	Expo port 8082 · OTP + register + online
App `partner/` FE	IMP scaffold	Expo port 8083 · OTP + onboarding + staff RO
Mobile FE auth	IMP	OTP + SecureStore · `UsersApi.me` hydrate
Partner onboarding	IMP	`POST /partners/onboarding` → PENDING
Admin duyệt partner	IMP	→ Role.PARTNER_OWNER
Partner staff / analytics	IMP MVP	cần APPROVED + PARTNER_OWNER
Driver KYC media	IMP	4 ảnh + `kycStatus` + admin `.../kyc`
OTP store	IMP Redis	`OtpStoreService` · fallback memory

Luồng Partner

sequenceDiagram
  participant U as User
  participant API as NestAPI
  participant ADM as Admin
  U->>API: OTP verify surface=PARTNER
  API-->>U: JWT USER + requiresRegistration
  U->>API: POST /partners/onboarding
  API-->>U: PENDING
  ADM->>API: PATCH partners/admin/applications/:id APPROVED
  API-->>ADM: status APPROVED + Role.PARTNER_OWNER
  U->>API: GET /partners/staff · analytics

Dev admin

ADMIN_PHONES trong api/.env — OTP verify gắn ADMIN.
Secrets: secrets/LOCAL-CREDENTIALS.md (gitignore).

Smoke đã chạy

USER → driver/me = 403
register → admin approve → DRIVER
Partner onboarding → admin approve → PARTNER_OWNER → staff
Token cũ sau approve vẫn OK (reload roles)

Còn lại

Soft-delete media khi KYC reject; token blacklist
Parking bookings / fuel partner prices → Prisma
Partner menu merchant UI
WP-PAY-01