@fiado/api-invoker 4.66.0 → 4.67.0

package/bin/platformRbac/api/PlatformRbacBusinessApi.d.ts

@@ -1,6 +1,6 @@
 import type { IHttpRequest } from "@fiado/http-client";
 import { ApiGatewayResponse, ResolvedPermissions, ResolveInput } from "@fiado/gateway-adapter";
-import { DefineNextChallengeRequest, DefineNextChallengeResponse, PrepareChallengeRequest, PrepareChallengeResponse, VerifyChallengeRequest, VerifyChallengeResponse, AuthorizeRequest, AuthorizeResponse, EffectivePermissionsResponse, InjectableUserAttributesResponse } from "@fiado/type-kit/bin/platformRbac/index.js";
+import { DefineNextChallengeRequest, DefineNextChallengeResponse, PrepareChallengeRequest, PrepareChallengeResponse, VerifyChallengeRequest, VerifyChallengeResponse, AuthorizeRequest, AuthorizeResponse, EffectivePermissionsResponse, InjectableUserAttributesResponse, PermissionScope, CreateLevelEntityRequest, CreateLevelEntityResponse, CreateTenantUserRequest, CreateTenantUserResponse } from "@fiado/type-kit/bin/platformRbac/index.js";
 import { IPlatformRbacBusinessApi } from "./interfaces/IPlatformRbacBusinessApi.js";
 /**
  * Publisher HTTP del lambda `platform-rbac-business` (componente 06 SureKeep Fase 0)
@@ -26,4 +26,6 @@ export default class PlatformRbacBusinessApi implements IPlatformRbacBusinessApi
     effectivePermissions(cognitoSub: string, tenantId?: string): Promise<ApiGatewayResponse<EffectivePermissionsResponse>>;
     getInjectableUserAttributes(cognitoSub: string, tenantId: string): Promise<ApiGatewayResponse<InjectableUserAttributesResponse>>;
     resolvePermissions(input: ResolveInput): Promise<ApiGatewayResponse<ResolvedPermissions>>;
+    createLevelEntity(tenantId: string, level: PermissionScope, input: CreateLevelEntityRequest): Promise<ApiGatewayResponse<CreateLevelEntityResponse>>;
+    createTenantUser(tenantId: string, input: CreateTenantUserRequest): Promise<ApiGatewayResponse<CreateTenantUserResponse>>;
 }

package/bin/platformRbac/api/PlatformRbacBusinessApi.js

@@ -68,6 +68,14 @@ let PlatformRbacBusinessApi = class PlatformRbacBusinessApi {
         const url = `${this.baseUrl}/internal/permissions/resolve`;
         return await this.httpRequest.post(url, input);
     }
+    async createLevelEntity(tenantId, level, input) {
+        const url = `${this.baseUrl}/internal/tenants/${encodeURIComponent(tenantId)}/levels/${encodeURIComponent(level)}/entities`;
+        return await this.httpRequest.post(url, input);
+    }
+    async createTenantUser(tenantId, input) {
+        const url = `${this.baseUrl}/internal/tenants/${encodeURIComponent(tenantId)}/users`;
+        return await this.httpRequest.post(url, input);
+    }
 };
 PlatformRbacBusinessApi = __decorate([
     injectable(),

package/bin/platformRbac/api/interfaces/IPlatformRbacBusinessApi.d.ts

@@ -1,5 +1,5 @@
 import { ApiGatewayResponse, ResolvedPermissions, ResolveInput } from "@fiado/gateway-adapter";
-import { DefineNextChallengeRequest, DefineNextChallengeResponse, PrepareChallengeRequest, PrepareChallengeResponse, VerifyChallengeRequest, VerifyChallengeResponse, AuthorizeRequest, AuthorizeResponse, EffectivePermissionsResponse, InjectableUserAttributesResponse } from "@fiado/type-kit/bin/platformRbac/index.js";
+import { DefineNextChallengeRequest, DefineNextChallengeResponse, PrepareChallengeRequest, PrepareChallengeResponse, VerifyChallengeRequest, VerifyChallengeResponse, AuthorizeRequest, AuthorizeResponse, EffectivePermissionsResponse, InjectableUserAttributesResponse, PermissionScope, CreateLevelEntityRequest, CreateLevelEntityResponse, CreateTenantUserRequest, CreateTenantUserResponse } from "@fiado/type-kit/bin/platformRbac/index.js";
 /**
  * Contrato del publisher HTTP del lambda `platform-rbac-business` (componente 06 SureKeep Fase 0)
  * para los 3 endpoints internos del Custom Auth Challenge flow (MFA).
@@ -63,4 +63,16 @@ export interface IPlatformRbacBusinessApi {
     getInjectableUserAttributes(cognitoSub: string, tenantId: string): Promise<ApiGatewayResponse<InjectableUserAttributesResponse>>;
     /** POST /internal/permissions/resolve — resuelve permisos scope-bound (set completo, paginación interna) para el RBAC enforcement del gateway-adapter. DEC-RBAC-064. */
     resolvePermissions(input: ResolveInput): Promise<ApiGatewayResponse<ResolvedPermissions>>;
+    /**
+     * POST /internal/tenants/{tenantId}/levels/{level}/entities — crea una scope-entity genérica
+     * L1/L2/L3 en RBAC (endpoint privado, VPC/ANONIMUS). Espejo de jerarquía de SureKeep F1
+     * (retailer→L1, zona→L2, tienda→L3). BYOID + idempotente. `level` (LEVEL_1|2|3) va en el path.
+     */
+    createLevelEntity(tenantId: string, level: PermissionScope, input: CreateLevelEntityRequest): Promise<ApiGatewayResponse<CreateLevelEntityResponse>>;
+    /**
+     * POST /internal/tenants/{tenantId}/users — provisiona un usuario del tenant (Cognito + SharedUser +
+     * RoleAssignment) en RBAC (endpoint privado, VPC/ANONIMUS). Alta orquestada de SureKeep F1: el usuario
+     * queda INVITED (mitiga orphan) y retail-org guarda el `cognitoSub` retornado. Idempotente por identidad Cognito.
+     */
+    createTenantUser(tenantId: string, input: CreateTenantUserRequest): Promise<ApiGatewayResponse<CreateTenantUserResponse>>;
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fiado/api-invoker",
-  "version": "4.66.0",
+  "version": "4.67.0",
   "description": "Sirve como un puente entre diferentes funciones lambda, facilitando la comunicación entre ellas a través de invocaciones http",
   "type": "module",
   "main": "bin/index.js",
@@ -34,7 +34,7 @@
     "@fiado/gateway-adapter": "^3.9.0",
     "@fiado/http-client": "^2.0.1",
     "@fiado/logger": "^1.1.3",
-    "@fiado/type-kit": "^3.191.0",
+    "@fiado/type-kit": "^3.193.0",
     "dotenv": "^16.4.7"
   },
   "peerDependencies": {

package/src/platformRbac/api/PlatformRbacBusinessApi.ts

@@ -13,6 +13,11 @@ import {
     AuthorizeResponse,
     EffectivePermissionsResponse,
     InjectableUserAttributesResponse,
+    PermissionScope,
+    CreateLevelEntityRequest,
+    CreateLevelEntityResponse,
+    CreateTenantUserRequest,
+    CreateTenantUserResponse,
 } from "@fiado/type-kit/bin/platformRbac/index.js";
 import { IPlatformRbacBusinessApi } from "./interfaces/IPlatformRbacBusinessApi.js";
 
@@ -95,4 +100,21 @@ export default class PlatformRbacBusinessApi implements IPlatformRbacBusinessApi
         const url = `${this.baseUrl}/internal/permissions/resolve`;
         return await this.httpRequest.post(url, input);
     }
+
+    async createLevelEntity(
+        tenantId: string,
+        level: PermissionScope,
+        input: CreateLevelEntityRequest,
+    ): Promise<ApiGatewayResponse<CreateLevelEntityResponse>> {
+        const url = `${this.baseUrl}/internal/tenants/${encodeURIComponent(tenantId)}/levels/${encodeURIComponent(level)}/entities`;
+        return await this.httpRequest.post(url, input);
+    }
+
+    async createTenantUser(
+        tenantId: string,
+        input: CreateTenantUserRequest,
+    ): Promise<ApiGatewayResponse<CreateTenantUserResponse>> {
+        const url = `${this.baseUrl}/internal/tenants/${encodeURIComponent(tenantId)}/users`;
+        return await this.httpRequest.post(url, input);
+    }
 }

package/src/platformRbac/api/interfaces/IPlatformRbacBusinessApi.ts

@@ -10,6 +10,11 @@ import {
     AuthorizeResponse,
     EffectivePermissionsResponse,
     InjectableUserAttributesResponse,
+    PermissionScope,
+    CreateLevelEntityRequest,
+    CreateLevelEntityResponse,
+    CreateTenantUserRequest,
+    CreateTenantUserResponse,
 } from "@fiado/type-kit/bin/platformRbac/index.js";
 
 /**
@@ -95,4 +100,25 @@ export interface IPlatformRbacBusinessApi {
 
     /** POST /internal/permissions/resolve — resuelve permisos scope-bound (set completo, paginación interna) para el RBAC enforcement del gateway-adapter. DEC-RBAC-064. */
     resolvePermissions(input: ResolveInput): Promise<ApiGatewayResponse<ResolvedPermissions>>;
+
+    /**
+     * POST /internal/tenants/{tenantId}/levels/{level}/entities — crea una scope-entity genérica
+     * L1/L2/L3 en RBAC (endpoint privado, VPC/ANONIMUS). Espejo de jerarquía de SureKeep F1
+     * (retailer→L1, zona→L2, tienda→L3). BYOID + idempotente. `level` (LEVEL_1|2|3) va en el path.
+     */
+    createLevelEntity(
+        tenantId: string,
+        level: PermissionScope,
+        input: CreateLevelEntityRequest,
+    ): Promise<ApiGatewayResponse<CreateLevelEntityResponse>>;
+
+    /**
+     * POST /internal/tenants/{tenantId}/users — provisiona un usuario del tenant (Cognito + SharedUser +
+     * RoleAssignment) en RBAC (endpoint privado, VPC/ANONIMUS). Alta orquestada de SureKeep F1: el usuario
+     * queda INVITED (mitiga orphan) y retail-org guarda el `cognitoSub` retornado. Idempotente por identidad Cognito.
+     */
+    createTenantUser(
+        tenantId: string,
+        input: CreateTenantUserRequest,
+    ): Promise<ApiGatewayResponse<CreateTenantUserResponse>>;
 }