@fiado/api-invoker 4.8.2 → 4.10.1

package/bin/cognitoBackofficeConnector/api/CognitoBackofficeConnectorApi.d.ts

@@ -1,6 +1,6 @@
 import type { IHttpRequest } from "@fiado/http-client";
 import { ApiGatewayResponse } from "@fiado/gateway-adapter";
-import { CreateUserRequest, CreateUserResponse, UpdateUserAttributesRequest, UserActionRequest, ResendInvitationRequest, UserDetailResponse, AuthEventsRequest, AuthEventResponse, InitiateAuthRequest, InitiateAuthResponse, RespondToChallengeRequest, RespondToChallengeResponse, RefreshTokensRequest, RefreshTokensResponse, ForgotPasswordRequest, ConfirmForgotPasswordRequest, ResendConfirmationRequest, ChangePasswordRequest, TotpBeginRequest, TotpBeginResponse, TotpVerifyRequest, MfaVerifyResponse, SetMfaPreferenceRequest, MfaResetRequest, UpdateEmailRequest, VerifyEmailRequest, UpdateProfileRequest, CreatePoolRequest, CreatePoolResponse, HealthcheckResponse, VerifyPasswordRequest, VerifyPasswordResponse } from "@fiado/type-kit/bin/cognitoBackofficeConnector";
+import { CreateUserRequest, CreateUserResponse, UpdateUserAttributesRequest, UserActionRequest, ResendInvitationRequest, UserDetailResponse, AuthEventsRequest, AuthEventResponse, InitiateAuthRequest, InitiateAuthResponse, RespondToChallengeRequest, RespondToChallengeResponse, RefreshTokensRequest, RefreshTokensResponse, ForgotPasswordRequest, ConfirmForgotPasswordRequest, ResendConfirmationRequest, ChangePasswordRequest, TotpBeginRequest, TotpBeginResponse, TotpVerifyRequest, MfaVerifyResponse, SetMfaPreferenceRequest, MfaResetRequest, UpdateEmailRequest, VerifyEmailRequest, UpdateProfileRequest, CreatePoolRequest, CreatePoolResponse, HealthcheckResponse, VerifyPasswordRequest, VerifyPasswordResponse, IntrospectRequest, IntrospectResponse } from "@fiado/type-kit/bin/cognitoBackofficeConnector";
 import { ICognitoBackofficeConnectorApi } from "./interfaces/ICognitoBackofficeConnectorApi";
 /**
  * Publisher HTTP del lambda `cognito-backoffice-connector` (componente 05 SureKeep Fase 0).
@@ -37,6 +37,7 @@ export default class CognitoBackofficeConnectorApi implements ICognitoBackoffice
     resetUserMfa(cognitoSub: string, input: MfaResetRequest): Promise<ApiGatewayResponse<void>>;
     authInitiate(input: InitiateAuthRequest): Promise<ApiGatewayResponse<InitiateAuthResponse>>;
     authVerifyPassword(input: VerifyPasswordRequest): Promise<ApiGatewayResponse<VerifyPasswordResponse>>;
+    introspect(input: IntrospectRequest): Promise<ApiGatewayResponse<IntrospectResponse>>;
     authRespondChallenge(input: RespondToChallengeRequest): Promise<ApiGatewayResponse<RespondToChallengeResponse>>;
     authRefreshTokens(input: RefreshTokensRequest): Promise<ApiGatewayResponse<RefreshTokensResponse>>;
     authForgotPassword(input: ForgotPasswordRequest): Promise<ApiGatewayResponse<void>>;

package/bin/cognitoBackofficeConnector/api/CognitoBackofficeConnectorApi.js

@@ -95,6 +95,10 @@ let CognitoBackofficeConnectorApi = class CognitoBackofficeConnectorApi {
         const url = `${this.baseUrl}/auth/verify-password`;
         return await this.httpRequest.post(url, input);
     }
+    async introspect(input) {
+        const url = `${this.baseUrl}/auth/introspect`;
+        return await this.httpRequest.post(url, input);
+    }
     async authRespondChallenge(input) {
         const url = `${this.baseUrl}/auth/respond-challenge`;
         return await this.httpRequest.post(url, input);

package/bin/cognitoBackofficeConnector/api/interfaces/ICognitoBackofficeConnectorApi.d.ts

@@ -1,5 +1,5 @@
 import { ApiGatewayResponse } from "@fiado/gateway-adapter";
-import { CreateUserRequest, CreateUserResponse, UpdateUserAttributesRequest, UserActionRequest, ResendInvitationRequest, UserDetailResponse, AuthEventsRequest, AuthEventResponse, InitiateAuthRequest, InitiateAuthResponse, RespondToChallengeRequest, RespondToChallengeResponse, RefreshTokensRequest, RefreshTokensResponse, ForgotPasswordRequest, ConfirmForgotPasswordRequest, ResendConfirmationRequest, ChangePasswordRequest, TotpBeginRequest, TotpBeginResponse, TotpVerifyRequest, MfaVerifyResponse, SetMfaPreferenceRequest, MfaResetRequest, UpdateEmailRequest, VerifyEmailRequest, UpdateProfileRequest, CreatePoolRequest, CreatePoolResponse, HealthcheckResponse, VerifyPasswordRequest, VerifyPasswordResponse } from "@fiado/type-kit/bin/cognitoBackofficeConnector";
+import { CreateUserRequest, CreateUserResponse, UpdateUserAttributesRequest, UserActionRequest, ResendInvitationRequest, UserDetailResponse, AuthEventsRequest, AuthEventResponse, InitiateAuthRequest, InitiateAuthResponse, RespondToChallengeRequest, RespondToChallengeResponse, RefreshTokensRequest, RefreshTokensResponse, ForgotPasswordRequest, ConfirmForgotPasswordRequest, ResendConfirmationRequest, ChangePasswordRequest, TotpBeginRequest, TotpBeginResponse, TotpVerifyRequest, MfaVerifyResponse, SetMfaPreferenceRequest, MfaResetRequest, UpdateEmailRequest, VerifyEmailRequest, UpdateProfileRequest, CreatePoolRequest, CreatePoolResponse, HealthcheckResponse, VerifyPasswordRequest, VerifyPasswordResponse, IntrospectRequest, IntrospectResponse } from "@fiado/type-kit/bin/cognitoBackofficeConnector";
 /**
  * Contrato del publisher HTTP del lambda `cognito-backoffice-connector` (componente 05 SureKeep Fase 0).
  *
@@ -50,6 +50,14 @@ export interface ICognitoBackofficeConnectorApi {
      * solo un veredicto `{ valid }`. El caller (rbac) NO conoce el mecanismo.
      */
     authVerifyPassword(input: VerifyPasswordRequest): Promise<ApiGatewayResponse<VerifyPasswordResponse>>;
+    /**
+     * POST /auth/introspect — valida un token (firma + exp + iss + client_id +
+     * token_use) y devuelve `{ valid, cognitoSub?, reason? }`. El connector es
+     * stateless: el caller (rbac) pasa userPoolId + region + clientId del pool.
+     * Consumido por el `AuthorizeManager` del platform-rbac-business durante el
+     * enforcement RBAC (PDP).
+     */
+    introspect(input: IntrospectRequest): Promise<ApiGatewayResponse<IntrospectResponse>>;
     /** POST /auth/respond-challenge — responde a challenge pendiente (devuelve tokens o nuevo challenge). */
     authRespondChallenge(input: RespondToChallengeRequest): Promise<ApiGatewayResponse<RespondToChallengeResponse>>;
     /** POST /auth/refresh-tokens — refresca accessToken+idToken usando refreshToken. */

package/bin/container.config.js

@@ -107,6 +107,8 @@ const PlatformRbacBusinessApi_1 = __importDefault(require("./platformRbac/api/Pl
 // Messages business — API client + OTP/notifications SQS publisher (Fase 0 SureKeep)
 const messages_business_1 = require("./messages-business");
 const MessagesBusinessPublisher_1 = __importDefault(require("./messages-business/queue/MessagesBusinessPublisher"));
+// Totp security — connector HTTP-only síncrono (Fase 2 SureKeep)
+const totp_security_1 = require("./totp-security");
 exports.apiInvokerBindings = new inversify_1.ContainerModule(({ bind }) => {
     // UTILS bindings
     bind("InvokerUtils").to(InvokerUtils_1.InvokerUtils);
@@ -219,4 +221,6 @@ exports.apiInvokerBindings = new inversify_1.ContainerModule(({ bind }) => {
     // Messages business — API client + OTP/notifications SQS publisher (Fase 0 SureKeep)
     bind("IMessagesBusinessApi").to(messages_business_1.MessagesBusinessApi);
     bind("IMessagesBusinessPublisher").to(MessagesBusinessPublisher_1.default);
+    // Totp security — connector HTTP-only síncrono (Fase 2 SureKeep)
+    bind("ITotpSecurityApi").to(totp_security_1.TotpSecurityApi);
 });

package/bin/index.d.ts

@@ -76,3 +76,4 @@ export * from "./milestone-business";
 export * from "./cognitoBackofficeConnector";
 export * from "./platformRbac";
 export * from "./messages-business";
+export * from "./totp-security";

package/bin/index.js

@@ -92,3 +92,4 @@ __exportStar(require("./milestone-business"), exports);
 __exportStar(require("./cognitoBackofficeConnector"), exports);
 __exportStar(require("./platformRbac"), exports);
 __exportStar(require("./messages-business"), exports);
+__exportStar(require("./totp-security"), exports);

package/bin/platformRbac/api/PlatformRbacBusinessApi.d.ts

@@ -1,6 +1,6 @@
-import { IHttpRequest } from "@fiado/http-client";
+import type { IHttpRequest } from "@fiado/http-client";
 import { ApiGatewayResponse } from "@fiado/gateway-adapter";
-import { DefineNextChallengeRequest, DefineNextChallengeResponse, PrepareChallengeRequest, PrepareChallengeResponse, VerifyChallengeRequest, VerifyChallengeResponse } from "@fiado/type-kit/bin/platformRbac";
+import { DefineNextChallengeRequest, DefineNextChallengeResponse, PrepareChallengeRequest, PrepareChallengeResponse, VerifyChallengeRequest, VerifyChallengeResponse, AuthorizeRequest, AuthorizeResponse } from "@fiado/type-kit/bin/platformRbac";
 import { IPlatformRbacBusinessApi } from "./interfaces/IPlatformRbacBusinessApi";
 /**
  * Publisher HTTP del lambda `platform-rbac-business` (componente 06 SureKeep Fase 0)
@@ -23,4 +23,5 @@ export default class PlatformRbacBusinessApi implements IPlatformRbacBusinessApi
     defineNextChallenge(input: DefineNextChallengeRequest): Promise<ApiGatewayResponse<DefineNextChallengeResponse>>;
     prepareChallenge(input: PrepareChallengeRequest): Promise<ApiGatewayResponse<PrepareChallengeResponse>>;
     verifyChallenge(input: VerifyChallengeRequest): Promise<ApiGatewayResponse<VerifyChallengeResponse>>;
+    authorize(input: AuthorizeRequest): Promise<ApiGatewayResponse<AuthorizeResponse>>;
 }

package/bin/platformRbac/api/PlatformRbacBusinessApi.js

@@ -45,6 +45,10 @@ let PlatformRbacBusinessApi = class PlatformRbacBusinessApi {
         const url = `${this.baseUrl}/internal/auth/verify-challenge`;
         return await this.httpRequest.post(url, input);
     }
+    async authorize(input) {
+        const url = `${this.baseUrl}/internal/authorize`;
+        return await this.httpRequest.post(url, input);
+    }
 };
 PlatformRbacBusinessApi = __decorate([
     (0, inversify_1.injectable)(),

package/bin/platformRbac/api/interfaces/IPlatformRbacBusinessApi.d.ts

@@ -1,5 +1,5 @@
 import { ApiGatewayResponse } from "@fiado/gateway-adapter";
-import { DefineNextChallengeRequest, DefineNextChallengeResponse, PrepareChallengeRequest, PrepareChallengeResponse, VerifyChallengeRequest, VerifyChallengeResponse } from "@fiado/type-kit/bin/platformRbac";
+import { DefineNextChallengeRequest, DefineNextChallengeResponse, PrepareChallengeRequest, PrepareChallengeResponse, VerifyChallengeRequest, VerifyChallengeResponse, AuthorizeRequest, AuthorizeResponse } from "@fiado/type-kit/bin/platformRbac";
 /**
  * Contrato del publisher HTTP del lambda `platform-rbac-business` (componente 06 SureKeep Fase 0)
  * para los 3 endpoints internos del Custom Auth Challenge flow (MFA).
@@ -37,4 +37,12 @@ export interface IPlatformRbacBusinessApi {
      * `verifyAuthChallengeResponse`.
      */
     verifyChallenge(input: VerifyChallengeRequest): Promise<ApiGatewayResponse<VerifyChallengeResponse>>;
+    /**
+     * POST /internal/authorize — decide allow/deny de un permiso (PDP del modelo
+     * PEP/PDP de RBAC enforcement). Invocado por el decorador `@RequirePermission`
+     * del `@fiado/gateway-adapter` vía la impl `IAuthorizer` de cada lambda consumidor.
+     * El rbac descubre el pool por `iss`, valida el token (vía connector introspect),
+     * resuelve permisos efectivos y devuelve `{ allow, reason?, context? }`.
+     */
+    authorize(input: AuthorizeRequest): Promise<ApiGatewayResponse<AuthorizeResponse>>;
 }

package/bin/stp-business/api/STPBusinessApi.d.ts

@@ -16,4 +16,5 @@ export default class STPBusinessApi implements ISTPBusinessApi {
         sort?: "ascending" | "descending";
         date: string;
     }): Promise<any>;
+    getAccountDetailByDirectoryId(directoryId: string): Promise<any>;
 }

package/bin/stp-business/api/STPBusinessApi.js

@@ -43,6 +43,14 @@ let STPBusinessApi = class STPBusinessApi {
         const url = `${this.baseUrl}conciliation/PAGOCONFIADO?${queryParams.toString()}`;
         return await this.httpRequest.get(url);
     }
+    async getAccountDetailByDirectoryId(directoryId) {
+        const url = `${this.baseUrl}`;
+        const headers = {
+            'Content-Type': 'application/json',
+            operationName: "privateGetAccountDetailByDirectoryId"
+        };
+        return await this.httpRequest.post(url, { directoryId }, headers);
+    }
 };
 STPBusinessApi = __decorate([
     (0, inversify_1.injectable)(),

package/bin/stp-business/api/interfaces/ISTPBusinessApi.d.ts

@@ -11,4 +11,5 @@ export interface ISTPBusinessApi {
         sort?: "ascending" | "descending";
         date: string;
     }): Promise<any>;
+    getAccountDetailByDirectoryId(directoryId: string): Promise<any>;
 }

package/bin/totp-security/api/TotpSecurityApi.d.ts

@@ -0,0 +1,14 @@
+import type { IHttpRequest } from '@fiado/http-client';
+import FiadoApiResponse from '@fiado/type-kit/bin/apiResponse/dtos/FiadoApiResponse';
+import { TotpEnrollRequest, TotpEnrollResponse, TotpVerifyEnrollmentRequest, TotpVerifyEnrollmentResponse, TotpVerifyRequest, TotpVerifyResponse, TotpDeleteRequest, TotpDeleteResponse, TotpStatusRequest, TotpStatusResponse } from '@fiado/type-kit/bin/totpSecurity';
+import { ITotpSecurityApi } from './interfaces/ITotpSecurityApi';
+export declare class TotpSecurityApi implements ITotpSecurityApi {
+    private readonly httpRequest;
+    private readonly baseUrl;
+    constructor(httpRequest: IHttpRequest);
+    enroll(req: TotpEnrollRequest): Promise<FiadoApiResponse<TotpEnrollResponse>>;
+    verifyEnrollment(req: TotpVerifyEnrollmentRequest): Promise<FiadoApiResponse<TotpVerifyEnrollmentResponse>>;
+    verify(req: TotpVerifyRequest): Promise<FiadoApiResponse<TotpVerifyResponse>>;
+    deleteSecret(req: TotpDeleteRequest): Promise<FiadoApiResponse<TotpDeleteResponse>>;
+    status(req: TotpStatusRequest): Promise<FiadoApiResponse<TotpStatusResponse>>;
+}

package/bin/totp-security/api/TotpSecurityApi.js

@@ -0,0 +1,44 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.TotpSecurityApi = void 0;
+const inversify_1 = require("inversify");
+let TotpSecurityApi = class TotpSecurityApi {
+    httpRequest;
+    baseUrl = process.env.TOTP_SECURITY_URL || '';
+    constructor(httpRequest) {
+        this.httpRequest = httpRequest;
+    }
+    async enroll(req) {
+        return await this.httpRequest.post(`${this.baseUrl}totp/enroll`, req, { 'operationName': 'privateTotpEnroll' });
+    }
+    async verifyEnrollment(req) {
+        return await this.httpRequest.post(`${this.baseUrl}totp/verify-enrollment`, req, { 'operationName': 'privateTotpVerifyEnrollment' });
+    }
+    async verify(req) {
+        return await this.httpRequest.post(`${this.baseUrl}totp/verify`, req, { 'operationName': 'privateTotpVerify' });
+    }
+    async deleteSecret(req) {
+        return await this.httpRequest.post(`${this.baseUrl}totp/secret/delete`, req, { 'operationName': 'privateTotpDelete' });
+    }
+    async status(req) {
+        return await this.httpRequest.get(`${this.baseUrl}totp/status`, req, { 'operationName': 'privateTotpStatus' });
+    }
+};
+exports.TotpSecurityApi = TotpSecurityApi;
+exports.TotpSecurityApi = TotpSecurityApi = __decorate([
+    (0, inversify_1.injectable)(),
+    __param(0, (0, inversify_1.inject)('IHttpRequest')),
+    __metadata("design:paramtypes", [Object])
+], TotpSecurityApi);

package/bin/totp-security/api/interfaces/ITotpSecurityApi.d.ts

@@ -0,0 +1,9 @@
+import FiadoApiResponse from '@fiado/type-kit/bin/apiResponse/dtos/FiadoApiResponse';
+import { TotpEnrollRequest, TotpEnrollResponse, TotpVerifyEnrollmentRequest, TotpVerifyEnrollmentResponse, TotpVerifyRequest, TotpVerifyResponse, TotpDeleteRequest, TotpDeleteResponse, TotpStatusRequest, TotpStatusResponse } from '@fiado/type-kit/bin/totpSecurity';
+export interface ITotpSecurityApi {
+    enroll(req: TotpEnrollRequest): Promise<FiadoApiResponse<TotpEnrollResponse>>;
+    verifyEnrollment(req: TotpVerifyEnrollmentRequest): Promise<FiadoApiResponse<TotpVerifyEnrollmentResponse>>;
+    verify(req: TotpVerifyRequest): Promise<FiadoApiResponse<TotpVerifyResponse>>;
+    deleteSecret(req: TotpDeleteRequest): Promise<FiadoApiResponse<TotpDeleteResponse>>;
+    status(req: TotpStatusRequest): Promise<FiadoApiResponse<TotpStatusResponse>>;
+}

package/bin/totp-security/api/interfaces/ITotpSecurityApi.js

@@ -0,0 +1,2 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });

package/bin/totp-security/index.d.ts

@@ -0,0 +1,2 @@
+export * from './api/TotpSecurityApi';
+export * from './api/interfaces/ITotpSecurityApi';

package/bin/totp-security/index.js

@@ -0,0 +1,18 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+__exportStar(require("./api/TotpSecurityApi"), exports);
+__exportStar(require("./api/interfaces/ITotpSecurityApi"), exports);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fiado/api-invoker",
-  "version": "4.8.2",
+  "version": "4.10.1",
   "description": "Sirve como un puente entre diferentes funciones lambda, facilitando la comunicación entre ellas a través de invocaciones http",
   "main": "bin/index.js",
   "types": "bin/index.d.ts",
@@ -17,7 +17,7 @@
     "@fiado/gateway-adapter": "^2.0.0",
     "@fiado/http-client": "^2.0.0",
     "@fiado/logger": "^1.0.3",
-    "@fiado/type-kit": "^3.46.0",
+    "@fiado/type-kit": "^3.48.0",
     "dotenv": "^16.4.7"
   },
   "peerDependencies": {

package/src/cognitoBackofficeConnector/api/CognitoBackofficeConnectorApi.ts

@@ -35,6 +35,8 @@ import {
     HealthcheckResponse,
     VerifyPasswordRequest,
     VerifyPasswordResponse,
+    IntrospectRequest,
+    IntrospectResponse,
 } from "@fiado/type-kit/bin/cognitoBackofficeConnector";
 import { ICognitoBackofficeConnectorApi } from "./interfaces/ICognitoBackofficeConnectorApi";
 
@@ -177,6 +179,13 @@ export default class CognitoBackofficeConnectorApi implements ICognitoBackoffice
         return await this.httpRequest.post(url, input);
     }
 
+    async introspect(
+        input: IntrospectRequest,
+    ): Promise<ApiGatewayResponse<IntrospectResponse>> {
+        const url = `${this.baseUrl}/auth/introspect`;
+        return await this.httpRequest.post(url, input);
+    }
+
     async authRespondChallenge(
         input: RespondToChallengeRequest,
     ): Promise<ApiGatewayResponse<RespondToChallengeResponse>> {

package/src/cognitoBackofficeConnector/api/interfaces/ICognitoBackofficeConnectorApi.ts

@@ -33,6 +33,8 @@ import {
     HealthcheckResponse,
     VerifyPasswordRequest,
     VerifyPasswordResponse,
+    IntrospectRequest,
+    IntrospectResponse,
 } from "@fiado/type-kit/bin/cognitoBackofficeConnector";
 
 /**
@@ -126,6 +128,17 @@ export interface ICognitoBackofficeConnectorApi {
         input: VerifyPasswordRequest,
     ): Promise<ApiGatewayResponse<VerifyPasswordResponse>>;
 
+    /**
+     * POST /auth/introspect — valida un token (firma + exp + iss + client_id +
+     * token_use) y devuelve `{ valid, cognitoSub?, reason? }`. El connector es
+     * stateless: el caller (rbac) pasa userPoolId + region + clientId del pool.
+     * Consumido por el `AuthorizeManager` del platform-rbac-business durante el
+     * enforcement RBAC (PDP).
+     */
+    introspect(
+        input: IntrospectRequest,
+    ): Promise<ApiGatewayResponse<IntrospectResponse>>;
+
     /** POST /auth/respond-challenge — responde a challenge pendiente (devuelve tokens o nuevo challenge). */
     authRespondChallenge(
         input: RespondToChallengeRequest,

package/src/container.config.ts

@@ -160,6 +160,8 @@ import PlatformRbacBusinessApi from "./platformRbac/api/PlatformRbacBusinessApi"
 import { IMessagesBusinessApi, MessagesBusinessApi } from "./messages-business";
 import MessagesBusinessPublisher from "./messages-business/queue/MessagesBusinessPublisher";
 import { IMessagesBusinessPublisher } from "./messages-business/queue/interfaces/IMessagesBusinessPublisher";
+// Totp security — connector HTTP-only síncrono (Fase 2 SureKeep)
+import { ITotpSecurityApi, TotpSecurityApi } from "./totp-security";
 
 export const apiInvokerBindings = new ContainerModule(({ bind }) => {
     // UTILS bindings
@@ -286,4 +288,7 @@ export const apiInvokerBindings = new ContainerModule(({ bind }) => {
     // Messages business — API client + OTP/notifications SQS publisher (Fase 0 SureKeep)
     bind<IMessagesBusinessApi>("IMessagesBusinessApi").to(MessagesBusinessApi);
     bind<IMessagesBusinessPublisher>("IMessagesBusinessPublisher").to(MessagesBusinessPublisher);
+
+    // Totp security — connector HTTP-only síncrono (Fase 2 SureKeep)
+    bind<ITotpSecurityApi>("ITotpSecurityApi").to(TotpSecurityApi);
 });

package/src/index.ts

@@ -76,3 +76,4 @@ export * from "./milestone-business";
 export * from "./cognitoBackofficeConnector";
 export * from "./platformRbac";
 export * from "./messages-business";
+export * from "./totp-security";

package/src/platformRbac/api/PlatformRbacBusinessApi.ts

@@ -1,5 +1,5 @@
 import { inject, injectable } from "inversify";
-import { IHttpRequest } from "@fiado/http-client";
+import type { IHttpRequest } from "@fiado/http-client";
 import { ApiGatewayResponse } from "@fiado/gateway-adapter";
 // TD-AI-001: import de @fiado/type-kit/bin/platformRbac requiere npm link a type-kit 3.43.1 hasta publish final. Ver docs/TECH_DEBT.md.
 import {
@@ -9,6 +9,8 @@ import {
     PrepareChallengeResponse,
     VerifyChallengeRequest,
     VerifyChallengeResponse,
+    AuthorizeRequest,
+    AuthorizeResponse,
 } from "@fiado/type-kit/bin/platformRbac";
 import { IPlatformRbacBusinessApi } from "./interfaces/IPlatformRbacBusinessApi";
 
@@ -52,4 +54,11 @@ export default class PlatformRbacBusinessApi implements IPlatformRbacBusinessApi
         const url = `${this.baseUrl}/internal/auth/verify-challenge`;
         return await this.httpRequest.post(url, input);
     }
+
+    async authorize(
+        input: AuthorizeRequest,
+    ): Promise<ApiGatewayResponse<AuthorizeResponse>> {
+        const url = `${this.baseUrl}/internal/authorize`;
+        return await this.httpRequest.post(url, input);
+    }
 }

package/src/platformRbac/api/interfaces/IPlatformRbacBusinessApi.ts

@@ -6,6 +6,8 @@ import {
     PrepareChallengeResponse,
     VerifyChallengeRequest,
     VerifyChallengeResponse,
+    AuthorizeRequest,
+    AuthorizeResponse,
 } from "@fiado/type-kit/bin/platformRbac";
 
 /**
@@ -53,4 +55,15 @@ export interface IPlatformRbacBusinessApi {
     verifyChallenge(
         input: VerifyChallengeRequest,
     ): Promise<ApiGatewayResponse<VerifyChallengeResponse>>;
+
+    /**
+     * POST /internal/authorize — decide allow/deny de un permiso (PDP del modelo
+     * PEP/PDP de RBAC enforcement). Invocado por el decorador `@RequirePermission`
+     * del `@fiado/gateway-adapter` vía la impl `IAuthorizer` de cada lambda consumidor.
+     * El rbac descubre el pool por `iss`, valida el token (vía connector introspect),
+     * resuelve permisos efectivos y devuelve `{ allow, reason?, context? }`.
+     */
+    authorize(
+        input: AuthorizeRequest,
+    ): Promise<ApiGatewayResponse<AuthorizeResponse>>;
 }

package/src/stp-business/api/STPBusinessApi.ts

@@ -26,7 +26,16 @@ export default class STPBusinessApi implements ISTPBusinessApi {
         if (params.sort) queryParams.append('sort', params.sort);
         queryParams.append('date', params.date);
         const url: string = `${this.baseUrl}conciliation/PAGOCONFIADO?${queryParams.toString()}`;
-        return await this.httpRequest.get(url);    
+        return await this.httpRequest.get(url);
+    }
+
+    async getAccountDetailByDirectoryId(directoryId: string): Promise<any> {
+        const url: string = `${this.baseUrl}`;
+        const headers = {
+            'Content-Type': 'application/json',
+            operationName: "privateGetAccountDetailByDirectoryId"
+        };
+        return await this.httpRequest.post(url, { directoryId }, headers);
     }
-   
+
 }

package/src/stp-business/api/interfaces/ISTPBusinessApi.ts

@@ -12,4 +12,6 @@ export interface ISTPBusinessApi {
         sort?:"ascending"|"descending",
         date:string,
     }): Promise<any>;
+
+    getAccountDetailByDirectoryId(directoryId: string): Promise<any>;
 }

package/src/totp-security/api/TotpSecurityApi.ts

@@ -0,0 +1,38 @@
+import { inject, injectable } from 'inversify';
+import type { IHttpRequest } from '@fiado/http-client';
+import FiadoApiResponse from '@fiado/type-kit/bin/apiResponse/dtos/FiadoApiResponse';
+import {
+    TotpEnrollRequest, TotpEnrollResponse,
+    TotpVerifyEnrollmentRequest, TotpVerifyEnrollmentResponse,
+    TotpVerifyRequest, TotpVerifyResponse,
+    TotpDeleteRequest, TotpDeleteResponse,
+    TotpStatusRequest, TotpStatusResponse,
+} from '@fiado/type-kit/bin/totpSecurity';
+import { ITotpSecurityApi } from './interfaces/ITotpSecurityApi';
+
+@injectable()
+export class TotpSecurityApi implements ITotpSecurityApi {
+    private readonly baseUrl = process.env.TOTP_SECURITY_URL || '';
+
+    constructor(@inject('IHttpRequest') private readonly httpRequest: IHttpRequest) {}
+
+    async enroll(req: TotpEnrollRequest): Promise<FiadoApiResponse<TotpEnrollResponse>> {
+        return await this.httpRequest.post(`${this.baseUrl}totp/enroll`, req, { 'operationName': 'privateTotpEnroll' });
+    }
+
+    async verifyEnrollment(req: TotpVerifyEnrollmentRequest): Promise<FiadoApiResponse<TotpVerifyEnrollmentResponse>> {
+        return await this.httpRequest.post(`${this.baseUrl}totp/verify-enrollment`, req, { 'operationName': 'privateTotpVerifyEnrollment' });
+    }
+
+    async verify(req: TotpVerifyRequest): Promise<FiadoApiResponse<TotpVerifyResponse>> {
+        return await this.httpRequest.post(`${this.baseUrl}totp/verify`, req, { 'operationName': 'privateTotpVerify' });
+    }
+
+    async deleteSecret(req: TotpDeleteRequest): Promise<FiadoApiResponse<TotpDeleteResponse>> {
+        return await this.httpRequest.post(`${this.baseUrl}totp/secret/delete`, req, { 'operationName': 'privateTotpDelete' });
+    }
+
+    async status(req: TotpStatusRequest): Promise<FiadoApiResponse<TotpStatusResponse>> {
+        return await this.httpRequest.get(`${this.baseUrl}totp/status`, req, { 'operationName': 'privateTotpStatus' });
+    }
+}

package/src/totp-security/api/interfaces/ITotpSecurityApi.ts

@@ -0,0 +1,16 @@
+import FiadoApiResponse from '@fiado/type-kit/bin/apiResponse/dtos/FiadoApiResponse';
+import {
+    TotpEnrollRequest, TotpEnrollResponse,
+    TotpVerifyEnrollmentRequest, TotpVerifyEnrollmentResponse,
+    TotpVerifyRequest, TotpVerifyResponse,
+    TotpDeleteRequest, TotpDeleteResponse,
+    TotpStatusRequest, TotpStatusResponse,
+} from '@fiado/type-kit/bin/totpSecurity';
+
+export interface ITotpSecurityApi {
+    enroll(req: TotpEnrollRequest): Promise<FiadoApiResponse<TotpEnrollResponse>>;
+    verifyEnrollment(req: TotpVerifyEnrollmentRequest): Promise<FiadoApiResponse<TotpVerifyEnrollmentResponse>>;
+    verify(req: TotpVerifyRequest): Promise<FiadoApiResponse<TotpVerifyResponse>>;
+    deleteSecret(req: TotpDeleteRequest): Promise<FiadoApiResponse<TotpDeleteResponse>>;
+    status(req: TotpStatusRequest): Promise<FiadoApiResponse<TotpStatusResponse>>;
+}

package/src/totp-security/index.ts

@@ -0,0 +1,2 @@
+export * from './api/TotpSecurityApi';
+export * from './api/interfaces/ITotpSecurityApi';