@fiado/api-invoker 4.59.0 → 4.60.0

package/src/cognitoBackofficeConnector/api/interfaces/ICognitoBackofficeConnectorApi.ts

@@ -1,216 +1,216 @@
-import { ApiGatewayResponse } from "@fiado/gateway-adapter";
-import {
-    CreateUserRequest,
-    CreateUserResponse,
-    UpdateUserAttributesRequest,
-    UserActionRequest,
-    ResendInvitationRequest,
-    SetUserPasswordRequest,
-    UserDetailResponse,
-    AuthEventsRequest,
-    AuthEventResponse,
-    InitiateAuthRequest,
-    InitiateAuthResponse,
-    RespondToChallengeRequest,
-    RespondToChallengeResponse,
-    RefreshTokensRequest,
-    RefreshTokensResponse,
-    ForgotPasswordRequest,
-    ConfirmForgotPasswordRequest,
-    ResendConfirmationRequest,
-    ChangePasswordRequest,
-    TotpBeginRequest,
-    TotpBeginResponse,
-    TotpVerifyRequest,
-    MfaVerifyResponse,
-    SetMfaPreferenceRequest,
-    MfaResetRequest,
-    UpdateEmailRequest,
-    VerifyEmailRequest,
-    UpdateProfileRequest,
-    CreatePoolRequest,
-    CreatePoolResponse,
-    DeletePoolRequest,
-    HealthcheckResponse,
-    VerifyPasswordRequest,
-    VerifyPasswordResponse,
-    IntrospectRequest,
-    IntrospectResponse,
-} from "@fiado/type-kit/bin/cognitoBackofficeConnector/index.js";
-
-/**
- * Contrato del publisher HTTP del lambda `cognito-backoffice-connector` (componente 05 SureKeep Fase 0).
- *
- * Cobertura: 27 endpoints del openapi privado del connector, agrupados por dominio.
- *
- * Patrón de retorno: `Promise<ApiGatewayResponse<T>>` sin unwrap (v4 canonical Fiado).
- * El consumer accede `result.body.data` para llegar al payload tipado.
- */
-export interface ICognitoBackofficeConnectorApi {
-    // ============= Admin user CRUD (9) =============
-
-    /** POST /users — crea un usuario admin en el pool. */
-    createUser(input: CreateUserRequest): Promise<ApiGatewayResponse<CreateUserResponse>>;
-
-    /** GET /users/{cognitoSub}?userPoolId=...&region=... — obtiene un usuario por sub (v1.4.1 stateless). */
-    getUser(cognitoSub: string, userPoolId: string, region: string): Promise<ApiGatewayResponse<UserDetailResponse>>;
-
-    /** PUT /users/{cognitoSub}/attributes — actualiza atributos del usuario. */
-    updateUserAttributes(
-        cognitoSub: string,
-        input: UpdateUserAttributesRequest,
-    ): Promise<ApiGatewayResponse<void>>;
-
-    /** DELETE /users/{cognitoSub}?userPoolId=...&region=... — elimina al usuario del pool (v1.4.1 stateless). */
-    deleteUser(cognitoSub: string, userPoolId: string, region: string): Promise<ApiGatewayResponse<void>>;
-
-    /** POST /users/{cognitoSub}/disable — disable + globalSignOut encadenado (D1 connector). */
-    disableUser(
-        cognitoSub: string,
-        input: UserActionRequest,
-    ): Promise<ApiGatewayResponse<void>>;
-
-    /** POST /users/{cognitoSub}/enable — habilita al usuario. */
-    enableUser(
-        cognitoSub: string,
-        input: UserActionRequest,
-    ): Promise<ApiGatewayResponse<void>>;
-
-    /** POST /users/{cognitoSub}/password/reset — reset + globalSignOut encadenado (D1 connector). */
-    resetUserPassword(
-        cognitoSub: string,
-        input: UserActionRequest,
-    ): Promise<ApiGatewayResponse<void>>;
-
-    /**
-     * POST /users/{cognitoSub}/password/set — fija una password temporal admin
-     * (el `cognitoSub` viaja por path param). Distinto de `resetUserPassword`:
-     * acá el caller provee la `temporaryPassword` en vez de que Cognito la genere.
-     */
-    setUserPassword(
-        cognitoSub: string,
-        input: SetUserPasswordRequest,
-    ): Promise<ApiGatewayResponse<{ cognitoSub: string }>>;
-
-    /** POST /users/{cognitoSub}/global-signout — revoca todas las sesiones activas. */
-    globalSignOut(
-        cognitoSub: string,
-        input: UserActionRequest,
-    ): Promise<ApiGatewayResponse<void>>;
-
-    /**
-     * POST /users/{cognitoSub}/resend-invitation — re-envía email de invitación con
-     * temporaryPassword regenerada. Devuelve solo `cognitoSub` + `temporaryPassword?`
-     * (NO `CreateUserResponse` completa).
-     */
-    resendInvitation(
-        cognitoSub: string,
-        input: ResendInvitationRequest,
-    ): Promise<ApiGatewayResponse<{ cognitoSub: string; temporaryPassword?: string }>>;
-
-    // ============= MFA admin + setup (4) =============
-
-    /** POST /mfa/totp/begin — genera secretCode + sessionToken para asociar app TOTP. */
-    mfaTotpBegin(input: TotpBeginRequest): Promise<ApiGatewayResponse<TotpBeginResponse>>;
-
-    /** POST /mfa/totp/verify — verifica el primer userCode contra el secretCode. */
-    mfaTotpVerify(input: TotpVerifyRequest): Promise<ApiGatewayResponse<MfaVerifyResponse>>;
-
-    /** PUT /mfa/preference — fija preferencia MFA (TOTP vs EMAIL) del usuario. */
-    setMfaPreference(input: SetMfaPreferenceRequest): Promise<ApiGatewayResponse<void>>;
-
-    /** POST /users/{cognitoSub}/mfa/reset — reset MFA admin + globalSignOut encadenado (D1 connector). */
-    resetUserMfa(
-        cognitoSub: string,
-        input: MfaResetRequest,
-    ): Promise<ApiGatewayResponse<void>>;
-
-    // ============= Auth flow no-admin BFF M18 (8) =============
-
-    /** POST /auth/initiate — inicia auth flow no-admin (devuelve tokens o challenge). */
-    authInitiate(input: InitiateAuthRequest): Promise<ApiGatewayResponse<InitiateAuthResponse>>;
-
-    /**
-     * POST /auth/verify-password — valida un password contra Cognito (DEC-AUTH-012).
-     * El connector encapsula el mecanismo (hoy ADMIN_USER_PASSWORD_AUTH) y devuelve
-     * solo un veredicto `{ valid }`. El caller (rbac) NO conoce el mecanismo.
-     */
-    authVerifyPassword(
-        input: VerifyPasswordRequest,
-    ): Promise<ApiGatewayResponse<VerifyPasswordResponse>>;
-
-    /**
-     * POST /auth/introspect — valida un token (firma + exp + iss + client_id +
-     * token_use) y devuelve `{ valid, cognitoSub?, reason? }`. El connector es
-     * stateless: el caller (rbac) pasa userPoolId + region + clientId del pool.
-     * Consumido por el `AuthorizeManager` del platform-rbac-business durante el
-     * enforcement RBAC (PDP).
-     */
-    introspect(
-        input: IntrospectRequest,
-    ): Promise<ApiGatewayResponse<IntrospectResponse>>;
-
-    /** POST /auth/respond-challenge — responde a challenge pendiente (devuelve tokens o nuevo challenge). */
-    authRespondChallenge(
-        input: RespondToChallengeRequest,
-    ): Promise<ApiGatewayResponse<RespondToChallengeResponse>>;
-
-    /** POST /auth/refresh-tokens — refresca accessToken+idToken usando refreshToken. */
-    authRefreshTokens(
-        input: RefreshTokensRequest,
-    ): Promise<ApiGatewayResponse<RefreshTokensResponse>>;
-
-    /** POST /auth/forgot-password — inicia flow forgot password no-admin. */
-    authForgotPassword(input: ForgotPasswordRequest): Promise<ApiGatewayResponse<void>>;
-
-    /** POST /auth/confirm-forgot-password — confirma código + nueva password. */
-    authConfirmForgotPassword(
-        input: ConfirmForgotPasswordRequest,
-    ): Promise<ApiGatewayResponse<void>>;
-
-    /** POST /auth/resend-confirmation — re-envía código de confirmation. */
-    authResendConfirmation(
-        input: ResendConfirmationRequest,
-    ): Promise<ApiGatewayResponse<void>>;
-
-    /** POST /auth/change-password — cambia password self-service usando accessToken. */
-    authChangePassword(input: ChangePasswordRequest): Promise<ApiGatewayResponse<void>>;
-
-    // ============= Email + Profile self-service (3) =============
-
-    /** POST /users/email/update — request cambio de email self-service (queda pending verification). */
-    updateEmail(input: UpdateEmailRequest): Promise<ApiGatewayResponse<void>>;
-
-    /** POST /users/email/verify — verifica código del email nuevo. */
-    verifyEmail(input: VerifyEmailRequest): Promise<ApiGatewayResponse<void>>;
-
-    /** POST /users/profile/update — actualiza profile attrs self-service (NO email — usar updateEmail). */
-    updateProfile(input: UpdateProfileRequest): Promise<ApiGatewayResponse<void>>;
-
-    // ============= Pool + auth events + healthcheck (4) =============
-
-    /** GET /users/{cognitoSub}/auth-events?userPoolId=...&maxResults=... — lista eventos auth recientes. */
-    listUserAuthEvents(
-        cognitoSub: string,
-        input: AuthEventsRequest,
-    ): Promise<ApiGatewayResponse<AuthEventResponse[]>>;
-
-    /**
-     * POST /pools — crea un user pool nuevo (pivote v1.4.1 stateless).
-     * Consumido por la saga `TenantOnboardingManager` del platform-rbac-business
-     * (Flujo 2 v1.2 PASO 4). El connector ejecuta CreateUserPool +
-     * SetUserPoolMfaConfig + CreateUserPoolClient con cleanup chain observable.
-     */
-    createPool(input: CreatePoolRequest): Promise<ApiGatewayResponse<CreatePoolResponse>>;
-
-    /**
-     * DELETE /pools/{userPoolId}?region=X — elimina un user pool vacío (pivote
-     * v1.4.1 — compensation chain de saga). Requiere pool sin users; si tiene
-     * users devuelve 409 (CognitoPoolNotEmptyError). Si no existe devuelve 404
-     * (CognitoResourceNotFoundError) — el caller trata 404 como idempotente.
-     */
-    deletePool(userPoolId: string, region: string): Promise<ApiGatewayResponse<void>>;
-
-    /** GET /healthcheck — liveness probe del connector. */
-    healthcheck(): Promise<ApiGatewayResponse<HealthcheckResponse>>;
-}
+import { ApiGatewayResponse } from "@fiado/gateway-adapter";
+import {
+    CreateUserRequest,
+    CreateUserResponse,
+    UpdateUserAttributesRequest,
+    UserActionRequest,
+    ResendInvitationRequest,
+    SetUserPasswordRequest,
+    UserDetailResponse,
+    AuthEventsRequest,
+    AuthEventResponse,
+    InitiateAuthRequest,
+    InitiateAuthResponse,
+    RespondToChallengeRequest,
+    RespondToChallengeResponse,
+    RefreshTokensRequest,
+    RefreshTokensResponse,
+    ForgotPasswordRequest,
+    ConfirmForgotPasswordRequest,
+    ResendConfirmationRequest,
+    ChangePasswordRequest,
+    TotpBeginRequest,
+    TotpBeginResponse,
+    TotpVerifyRequest,
+    MfaVerifyResponse,
+    SetMfaPreferenceRequest,
+    MfaResetRequest,
+    UpdateEmailRequest,
+    VerifyEmailRequest,
+    UpdateProfileRequest,
+    CreatePoolRequest,
+    CreatePoolResponse,
+    DeletePoolRequest,
+    HealthcheckResponse,
+    VerifyPasswordRequest,
+    VerifyPasswordResponse,
+    IntrospectRequest,
+    IntrospectResponse,
+} from "@fiado/type-kit/bin/cognitoBackofficeConnector/index.js";
+
+/**
+ * Contrato del publisher HTTP del lambda `cognito-backoffice-connector` (componente 05 SureKeep Fase 0).
+ *
+ * Cobertura: 27 endpoints del openapi privado del connector, agrupados por dominio.
+ *
+ * Patrón de retorno: `Promise<ApiGatewayResponse<T>>` sin unwrap (v4 canonical Fiado).
+ * El consumer accede `result.body.data` para llegar al payload tipado.
+ */
+export interface ICognitoBackofficeConnectorApi {
+    // ============= Admin user CRUD (9) =============
+
+    /** POST /users — crea un usuario admin en el pool. */
+    createUser(input: CreateUserRequest): Promise<ApiGatewayResponse<CreateUserResponse>>;
+
+    /** GET /users/{cognitoSub}?userPoolId=...&region=... — obtiene un usuario por sub (v1.4.1 stateless). */
+    getUser(cognitoSub: string, userPoolId: string, region: string): Promise<ApiGatewayResponse<UserDetailResponse>>;
+
+    /** PUT /users/{cognitoSub}/attributes — actualiza atributos del usuario. */
+    updateUserAttributes(
+        cognitoSub: string,
+        input: UpdateUserAttributesRequest,
+    ): Promise<ApiGatewayResponse<void>>;
+
+    /** DELETE /users/{cognitoSub}?userPoolId=...&region=... — elimina al usuario del pool (v1.4.1 stateless). */
+    deleteUser(cognitoSub: string, userPoolId: string, region: string): Promise<ApiGatewayResponse<void>>;
+
+    /** POST /users/{cognitoSub}/disable — disable + globalSignOut encadenado (D1 connector). */
+    disableUser(
+        cognitoSub: string,
+        input: UserActionRequest,
+    ): Promise<ApiGatewayResponse<void>>;
+
+    /** POST /users/{cognitoSub}/enable — habilita al usuario. */
+    enableUser(
+        cognitoSub: string,
+        input: UserActionRequest,
+    ): Promise<ApiGatewayResponse<void>>;
+
+    /** POST /users/{cognitoSub}/password/reset — reset + globalSignOut encadenado (D1 connector). */
+    resetUserPassword(
+        cognitoSub: string,
+        input: UserActionRequest,
+    ): Promise<ApiGatewayResponse<void>>;
+
+    /**
+     * POST /users/{cognitoSub}/password/set — fija una password temporal admin
+     * (el `cognitoSub` viaja por path param). Distinto de `resetUserPassword`:
+     * acá el caller provee la `temporaryPassword` en vez de que Cognito la genere.
+     */
+    setUserPassword(
+        cognitoSub: string,
+        input: SetUserPasswordRequest,
+    ): Promise<ApiGatewayResponse<{ cognitoSub: string }>>;
+
+    /** POST /users/{cognitoSub}/global-signout — revoca todas las sesiones activas. */
+    globalSignOut(
+        cognitoSub: string,
+        input: UserActionRequest,
+    ): Promise<ApiGatewayResponse<void>>;
+
+    /**
+     * POST /users/{cognitoSub}/resend-invitation — re-envía email de invitación con
+     * temporaryPassword regenerada. Devuelve solo `cognitoSub` + `temporaryPassword?`
+     * (NO `CreateUserResponse` completa).
+     */
+    resendInvitation(
+        cognitoSub: string,
+        input: ResendInvitationRequest,
+    ): Promise<ApiGatewayResponse<{ cognitoSub: string; temporaryPassword?: string }>>;
+
+    // ============= MFA admin + setup (4) =============
+
+    /** POST /mfa/totp/begin — genera secretCode + sessionToken para asociar app TOTP. */
+    mfaTotpBegin(input: TotpBeginRequest): Promise<ApiGatewayResponse<TotpBeginResponse>>;
+
+    /** POST /mfa/totp/verify — verifica el primer userCode contra el secretCode. */
+    mfaTotpVerify(input: TotpVerifyRequest): Promise<ApiGatewayResponse<MfaVerifyResponse>>;
+
+    /** PUT /mfa/preference — fija preferencia MFA (TOTP vs EMAIL) del usuario. */
+    setMfaPreference(input: SetMfaPreferenceRequest): Promise<ApiGatewayResponse<void>>;
+
+    /** POST /users/{cognitoSub}/mfa/reset — reset MFA admin + globalSignOut encadenado (D1 connector). */
+    resetUserMfa(
+        cognitoSub: string,
+        input: MfaResetRequest,
+    ): Promise<ApiGatewayResponse<void>>;
+
+    // ============= Auth flow no-admin BFF M18 (8) =============
+
+    /** POST /auth/initiate — inicia auth flow no-admin (devuelve tokens o challenge). */
+    authInitiate(input: InitiateAuthRequest): Promise<ApiGatewayResponse<InitiateAuthResponse>>;
+
+    /**
+     * POST /auth/verify-password — valida un password contra Cognito (DEC-AUTH-012).
+     * El connector encapsula el mecanismo (hoy ADMIN_USER_PASSWORD_AUTH) y devuelve
+     * solo un veredicto `{ valid }`. El caller (rbac) NO conoce el mecanismo.
+     */
+    authVerifyPassword(
+        input: VerifyPasswordRequest,
+    ): Promise<ApiGatewayResponse<VerifyPasswordResponse>>;
+
+    /**
+     * POST /auth/introspect — valida un token (firma + exp + iss + client_id +
+     * token_use) y devuelve `{ valid, cognitoSub?, reason? }`. El connector es
+     * stateless: el caller (rbac) pasa userPoolId + region + clientId del pool.
+     * Consumido por el `AuthorizeManager` del platform-rbac-business durante el
+     * enforcement RBAC (PDP).
+     */
+    introspect(
+        input: IntrospectRequest,
+    ): Promise<ApiGatewayResponse<IntrospectResponse>>;
+
+    /** POST /auth/respond-challenge — responde a challenge pendiente (devuelve tokens o nuevo challenge). */
+    authRespondChallenge(
+        input: RespondToChallengeRequest,
+    ): Promise<ApiGatewayResponse<RespondToChallengeResponse>>;
+
+    /** POST /auth/refresh-tokens — refresca accessToken+idToken usando refreshToken. */
+    authRefreshTokens(
+        input: RefreshTokensRequest,
+    ): Promise<ApiGatewayResponse<RefreshTokensResponse>>;
+
+    /** POST /auth/forgot-password — inicia flow forgot password no-admin. */
+    authForgotPassword(input: ForgotPasswordRequest): Promise<ApiGatewayResponse<void>>;
+
+    /** POST /auth/confirm-forgot-password — confirma código + nueva password. */
+    authConfirmForgotPassword(
+        input: ConfirmForgotPasswordRequest,
+    ): Promise<ApiGatewayResponse<void>>;
+
+    /** POST /auth/resend-confirmation — re-envía código de confirmation. */
+    authResendConfirmation(
+        input: ResendConfirmationRequest,
+    ): Promise<ApiGatewayResponse<void>>;
+
+    /** POST /auth/change-password — cambia password self-service usando accessToken. */
+    authChangePassword(input: ChangePasswordRequest): Promise<ApiGatewayResponse<void>>;
+
+    // ============= Email + Profile self-service (3) =============
+
+    /** POST /users/email/update — request cambio de email self-service (queda pending verification). */
+    updateEmail(input: UpdateEmailRequest): Promise<ApiGatewayResponse<void>>;
+
+    /** POST /users/email/verify — verifica código del email nuevo. */
+    verifyEmail(input: VerifyEmailRequest): Promise<ApiGatewayResponse<void>>;
+
+    /** POST /users/profile/update — actualiza profile attrs self-service (NO email — usar updateEmail). */
+    updateProfile(input: UpdateProfileRequest): Promise<ApiGatewayResponse<void>>;
+
+    // ============= Pool + auth events + healthcheck (4) =============
+
+    /** GET /users/{cognitoSub}/auth-events?userPoolId=...&maxResults=... — lista eventos auth recientes. */
+    listUserAuthEvents(
+        cognitoSub: string,
+        input: AuthEventsRequest,
+    ): Promise<ApiGatewayResponse<AuthEventResponse[]>>;
+
+    /**
+     * POST /pools — crea un user pool nuevo (pivote v1.4.1 stateless).
+     * Consumido por la saga `TenantOnboardingManager` del platform-rbac-business
+     * (Flujo 2 v1.2 PASO 4). El connector ejecuta CreateUserPool +
+     * SetUserPoolMfaConfig + CreateUserPoolClient con cleanup chain observable.
+     */
+    createPool(input: CreatePoolRequest): Promise<ApiGatewayResponse<CreatePoolResponse>>;
+
+    /**
+     * DELETE /pools/{userPoolId}?region=X — elimina un user pool vacío (pivote
+     * v1.4.1 — compensation chain de saga). Requiere pool sin users; si tiene
+     * users devuelve 409 (CognitoPoolNotEmptyError). Si no existe devuelve 404
+     * (CognitoResourceNotFoundError) — el caller trata 404 como idempotente.
+     */
+    deletePool(userPoolId: string, region: string): Promise<ApiGatewayResponse<void>>;
+
+    /** GET /healthcheck — liveness probe del connector. */
+    healthcheck(): Promise<ApiGatewayResponse<HealthcheckResponse>>;
+}

package/src/cognitoBackofficeConnector/index.ts

@@ -1,2 +1,2 @@
-export * from "./api/interfaces/ICognitoBackofficeConnectorApi.js";
-export { default as CognitoBackofficeConnectorApi } from "./api/CognitoBackofficeConnectorApi.js";
+export * from "./api/interfaces/ICognitoBackofficeConnectorApi.js";
+export { default as CognitoBackofficeConnectorApi } from "./api/CognitoBackofficeConnectorApi.js";