@fiado/api-invoker 4.15.0 → 4.16.0

package/bin/platformRbac/api/PlatformRbacBusinessApi.d.ts

@@ -1,6 +1,6 @@
 import type { IHttpRequest } from "@fiado/http-client";
 import { ApiGatewayResponse } from "@fiado/gateway-adapter";
-import { DefineNextChallengeRequest, DefineNextChallengeResponse, PrepareChallengeRequest, PrepareChallengeResponse, VerifyChallengeRequest, VerifyChallengeResponse, AuthorizeRequest, AuthorizeResponse } from "@fiado/type-kit/bin/platformRbac";
+import { DefineNextChallengeRequest, DefineNextChallengeResponse, PrepareChallengeRequest, PrepareChallengeResponse, VerifyChallengeRequest, VerifyChallengeResponse, AuthorizeRequest, AuthorizeResponse, EffectivePermissionsResponse } from "@fiado/type-kit/bin/platformRbac";
 import { IPlatformRbacBusinessApi } from "./interfaces/IPlatformRbacBusinessApi";
 /**
  * Publisher HTTP del lambda `platform-rbac-business` (componente 06 SureKeep Fase 0)
@@ -24,4 +24,5 @@ export default class PlatformRbacBusinessApi implements IPlatformRbacBusinessApi
     prepareChallenge(input: PrepareChallengeRequest): Promise<ApiGatewayResponse<PrepareChallengeResponse>>;
     verifyChallenge(input: VerifyChallengeRequest): Promise<ApiGatewayResponse<VerifyChallengeResponse>>;
     authorize(input: AuthorizeRequest): Promise<ApiGatewayResponse<AuthorizeResponse>>;
+    effectivePermissions(cognitoSub: string): Promise<ApiGatewayResponse<EffectivePermissionsResponse>>;
 }

package/bin/platformRbac/api/PlatformRbacBusinessApi.js

@@ -49,6 +49,10 @@ let PlatformRbacBusinessApi = class PlatformRbacBusinessApi {
         const url = `${this.baseUrl}/internal/authorize`;
         return await this.httpRequest.post(url, input);
     }
+    async effectivePermissions(cognitoSub) {
+        const url = `${this.baseUrl}/internal/users/${encodeURIComponent(cognitoSub)}/effective-permissions`;
+        return await this.httpRequest.get(url);
+    }
 };
 PlatformRbacBusinessApi = __decorate([
     (0, inversify_1.injectable)(),

package/bin/platformRbac/api/interfaces/IPlatformRbacBusinessApi.d.ts

@@ -1,5 +1,5 @@
 import { ApiGatewayResponse } from "@fiado/gateway-adapter";
-import { DefineNextChallengeRequest, DefineNextChallengeResponse, PrepareChallengeRequest, PrepareChallengeResponse, VerifyChallengeRequest, VerifyChallengeResponse, AuthorizeRequest, AuthorizeResponse } from "@fiado/type-kit/bin/platformRbac";
+import { DefineNextChallengeRequest, DefineNextChallengeResponse, PrepareChallengeRequest, PrepareChallengeResponse, VerifyChallengeRequest, VerifyChallengeResponse, AuthorizeRequest, AuthorizeResponse, EffectivePermissionsResponse } from "@fiado/type-kit/bin/platformRbac";
 /**
  * Contrato del publisher HTTP del lambda `platform-rbac-business` (componente 06 SureKeep Fase 0)
  * para los 3 endpoints internos del Custom Auth Challenge flow (MFA).
@@ -45,4 +45,11 @@ export interface IPlatformRbacBusinessApi {
      * resuelve permisos efectivos y devuelve `{ allow, reason?, context? }`.
      */
     authorize(input: AuthorizeRequest): Promise<ApiGatewayResponse<AuthorizeResponse>>;
+    /**
+     * GET /internal/users/{cognitoSub}/effective-permissions — resuelve los permisos
+     * efectivos (más epoch y role assignments) de un usuario. Invocado por el
+     * `jwt-inyector-trigger` al emitir el token para embeber el bitset RBAC.
+     * El `cognitoSub` va en el path param (encodeURIComponent en el publisher).
+     */
+    effectivePermissions(cognitoSub: string): Promise<ApiGatewayResponse<EffectivePermissionsResponse>>;
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fiado/api-invoker",
-  "version": "4.15.0",
+  "version": "4.16.0",
   "description": "Sirve como un puente entre diferentes funciones lambda, facilitando la comunicación entre ellas a través de invocaciones http",
   "main": "bin/index.js",
   "types": "bin/index.d.ts",
@@ -17,7 +17,7 @@
     "@fiado/gateway-adapter": "^2.0.0",
     "@fiado/http-client": "^2.0.0",
     "@fiado/logger": "^1.0.3",
-    "@fiado/type-kit": "^3.68.0",
+    "@fiado/type-kit": "^3.71.0",
     "dotenv": "^16.4.7"
   },
   "peerDependencies": {

package/src/platformRbac/api/PlatformRbacBusinessApi.ts

@@ -11,6 +11,7 @@ import {
     VerifyChallengeResponse,
     AuthorizeRequest,
     AuthorizeResponse,
+    EffectivePermissionsResponse,
 } from "@fiado/type-kit/bin/platformRbac";
 import { IPlatformRbacBusinessApi } from "./interfaces/IPlatformRbacBusinessApi";
 
@@ -61,4 +62,11 @@ export default class PlatformRbacBusinessApi implements IPlatformRbacBusinessApi
         const url = `${this.baseUrl}/internal/authorize`;
         return await this.httpRequest.post(url, input);
     }
+
+    async effectivePermissions(
+        cognitoSub: string,
+    ): Promise<ApiGatewayResponse<EffectivePermissionsResponse>> {
+        const url = `${this.baseUrl}/internal/users/${encodeURIComponent(cognitoSub)}/effective-permissions`;
+        return await this.httpRequest.get(url);
+    }
 }

package/src/platformRbac/api/interfaces/IPlatformRbacBusinessApi.ts

@@ -8,6 +8,7 @@ import {
     VerifyChallengeResponse,
     AuthorizeRequest,
     AuthorizeResponse,
+    EffectivePermissionsResponse,
 } from "@fiado/type-kit/bin/platformRbac";
 
 /**
@@ -66,4 +67,14 @@ export interface IPlatformRbacBusinessApi {
     authorize(
         input: AuthorizeRequest,
     ): Promise<ApiGatewayResponse<AuthorizeResponse>>;
+
+    /**
+     * GET /internal/users/{cognitoSub}/effective-permissions — resuelve los permisos
+     * efectivos (más epoch y role assignments) de un usuario. Invocado por el
+     * `jwt-inyector-trigger` al emitir el token para embeber el bitset RBAC.
+     * El `cognitoSub` va en el path param (encodeURIComponent en el publisher).
+     */
+    effectivePermissions(
+        cognitoSub: string,
+    ): Promise<ApiGatewayResponse<EffectivePermissionsResponse>>;
 }