@fiado/type-kit 3.108.0 → 3.110.0

package/_test_/unit/platformRbac/tenantTypes.test.ts

@@ -6,13 +6,16 @@ describe('tenantTypes', () => {
         expect(levelsOf(TenantType.RETAIL)).toEqual([PermissionScope.RETAILER, PermissionScope.STORE]);
     });
 
-    it('scopeRankOrder = [PLATFORM, TENANT, RETAILER, STORE, GROUP] (retail + agents)', () => {
+    it('scopeRankOrder = [PLATFORM, TENANT, RETAILER, STORE, GROUP, LEVEL_1, LEVEL_2, LEVEL_3]', () => {
         expect(scopeRankOrder()).toEqual([
             PermissionScope.PLATFORM,
             PermissionScope.TENANT,
             PermissionScope.RETAILER,
             PermissionScope.STORE,
             PermissionScope.GROUP,
+            PermissionScope.LEVEL_1,
+            PermissionScope.LEVEL_2,
+            PermissionScope.LEVEL_3,
         ]);
     });
 
@@ -40,13 +43,16 @@ describe('tenantTypes', () => {
         expect(tableSuffixForLevel(TenantType.AGENTS, PermissionScope.GROUP)).toBe('SharedGroup');
     });
 
-    it('scopeRankOrder incluye GROUP al final (vía los levels de agents, después de los de retail)', () => {
+    it('scopeRankOrder incluye GROUP (vía los levels de agents) seguido de los niveles genéricos LEVEL_1/2/3', () => {
         expect(scopeRankOrder()).toEqual([
             PermissionScope.PLATFORM,
             PermissionScope.TENANT,
             PermissionScope.RETAILER,
             PermissionScope.STORE,
             PermissionScope.GROUP,
+            PermissionScope.LEVEL_1,
+            PermissionScope.LEVEL_2,
+            PermissionScope.LEVEL_3,
         ]);
     });
 });

package/bin/platformRbac/application/Application.d.ts

@@ -0,0 +1,54 @@
+import { PermissionScope } from '../enums/PermissionScope';
+import { ApplicationStatus } from '../enums/ApplicationStatus';
+import type { UserFieldDef } from '../dtos/UserFieldDef';
+import type { TokenValidationMode } from '../enums/TokenValidationMode';
+export interface LevelDef {
+    level: PermissionScope;
+    displayName: string;
+}
+export interface ApplicationSecurityPolicyDefault {
+    mfaRequired?: boolean;
+    methodsAllowed?: Array<'TOTP' | 'EMAIL'>;
+    defaultPreferred?: 'TOTP' | 'EMAIL';
+    sessionTimeoutMin?: number;
+    passwordPolicy?: {
+        minLength: number;
+        requireSymbol: boolean;
+        requireNumber: boolean;
+        requireUppercase: boolean;
+    };
+}
+export interface ApplicationBrandingDefault {
+    logoUrl?: string;
+    primaryColor?: string;
+    secondaryColor?: string;
+    accentColor?: string;
+    logoWidth?: number;
+    faviconUrl?: string;
+    webappBaseUrl?: string;
+}
+export interface ApplicationDefaults {
+    externalScopeLevels?: PermissionScope[];
+    userFieldDefs?: UserFieldDef[];
+    securityPolicy?: ApplicationSecurityPolicyDefault;
+    brandingConfig?: ApplicationBrandingDefault;
+    tokenValidationMode?: TokenValidationMode;
+}
+export interface SeedRole {
+    roleId: string;
+    displayName: string;
+    description?: string;
+    permissions: string[];
+    scope: PermissionScope;
+    isSystem: boolean;
+}
+export interface Application {
+    applicationId: string;
+    displayName: string;
+    levels: LevelDef[];
+    defaults: ApplicationDefaults;
+    seedRoles: SeedRole[];
+    status: ApplicationStatus;
+    createdAt?: number;
+    updatedAt?: number;
+}

package/bin/platformRbac/application/Application.js

@@ -0,0 +1,2 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });

package/bin/platformRbac/application/ApplicationPermission.d.ts

@@ -0,0 +1,13 @@
+import { PermissionScope } from '../enums/PermissionScope';
+import { PermissionKind } from '../enums/PermissionKind';
+export interface ApplicationPermission {
+    applicationId: string;
+    permissionKey: string;
+    displayName: string;
+    description: string;
+    scope: PermissionScope;
+    kind: PermissionKind;
+    category?: string;
+    createdAt?: number;
+    updatedAt?: number;
+}

package/bin/platformRbac/application/ApplicationPermission.js

@@ -0,0 +1,2 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });

package/bin/platformRbac/application/requests.d.ts

@@ -0,0 +1,22 @@
+import { PermissionScope } from '../enums/PermissionScope';
+import type { LevelDef, ApplicationDefaults, SeedRole } from './Application';
+export interface CreateApplicationRequest {
+    applicationId: string;
+    displayName: string;
+    levels: LevelDef[];
+    defaults?: ApplicationDefaults;
+    seedRoles?: SeedRole[];
+}
+export interface UpdateApplicationRequest {
+    displayName?: string;
+    levels?: LevelDef[];
+    defaults?: ApplicationDefaults;
+    seedRoles?: SeedRole[];
+}
+export interface UpsertApplicationPermissionRequest {
+    permissionKey: string;
+    displayName: string;
+    description: string;
+    scope: PermissionScope;
+    category?: string;
+}

package/bin/platformRbac/application/requests.js

@@ -0,0 +1,2 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });

package/bin/platformRbac/enums/ApplicationStatus.d.ts

@@ -0,0 +1,5 @@
+/** Estado de una aplicación (plantilla). Archivar en vez de borrar si tiene tenants. DEC-RBAC-031. */
+export declare enum ApplicationStatus {
+    ACTIVE = "ACTIVE",
+    ARCHIVED = "ARCHIVED"
+}

package/bin/platformRbac/enums/ApplicationStatus.js

@@ -0,0 +1,9 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ApplicationStatus = void 0;
+/** Estado de una aplicación (plantilla). Archivar en vez de borrar si tiene tenants. DEC-RBAC-031. */
+var ApplicationStatus;
+(function (ApplicationStatus) {
+    ApplicationStatus["ACTIVE"] = "ACTIVE";
+    ApplicationStatus["ARCHIVED"] = "ARCHIVED";
+})(ApplicationStatus || (exports.ApplicationStatus = ApplicationStatus = {}));

package/bin/platformRbac/enums/PermissionKind.d.ts

@@ -0,0 +1,9 @@
+/**
+ * Clase de un permiso del catálogo (DEC-RBAC-033).
+ * SYSTEM: gestión del propio RBAC, key inmutable y no borrable (gatea endpoints del lambda).
+ * CUSTOM: negocio de la app protegida, CRUD libre (lo enforza la app de destino).
+ */
+export declare enum PermissionKind {
+    SYSTEM = "SYSTEM",
+    CUSTOM = "CUSTOM"
+}

package/bin/platformRbac/enums/PermissionKind.js

@@ -0,0 +1,13 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.PermissionKind = void 0;
+/**
+ * Clase de un permiso del catálogo (DEC-RBAC-033).
+ * SYSTEM: gestión del propio RBAC, key inmutable y no borrable (gatea endpoints del lambda).
+ * CUSTOM: negocio de la app protegida, CRUD libre (lo enforza la app de destino).
+ */
+var PermissionKind;
+(function (PermissionKind) {
+    PermissionKind["SYSTEM"] = "SYSTEM";
+    PermissionKind["CUSTOM"] = "CUSTOM";
+})(PermissionKind || (exports.PermissionKind = PermissionKind = {}));

package/bin/platformRbac/enums/PermissionScope.d.ts

@@ -2,11 +2,20 @@
  * Jerarquía retail: PLATFORM > TENANT > RETAILER > STORE.
  * Jerarquía agents: PLATFORM > TENANT > GROUP.
  * Componente 01 spec.
+ *
+ * Modelo genérico de aplicación (DEC-RBAC-032): además de los niveles legacy
+ * (RETAILER/STORE/GROUP, atados a tenant-types concretos), una aplicación define
+ * su jerarquía DEBAJO de TENANT con niveles genéricos LEVEL_1 > LEVEL_2 > LEVEL_3,
+ * cuyo `displayName` lo decide cada aplicación (ver LevelDef en application/Application).
+ * Los niveles legacy se conservan para no romper retail/agents existentes.
  */
 export declare enum PermissionScope {
     PLATFORM = "PLATFORM",
     TENANT = "TENANT",
     RETAILER = "RETAILER",
     STORE = "STORE",
-    GROUP = "GROUP"
+    GROUP = "GROUP",
+    LEVEL_1 = "LEVEL_1",
+    LEVEL_2 = "LEVEL_2",
+    LEVEL_3 = "LEVEL_3"
 }

package/bin/platformRbac/enums/PermissionScope.js

@@ -5,6 +5,12 @@ exports.PermissionScope = void 0;
  * Jerarquía retail: PLATFORM > TENANT > RETAILER > STORE.
  * Jerarquía agents: PLATFORM > TENANT > GROUP.
  * Componente 01 spec.
+ *
+ * Modelo genérico de aplicación (DEC-RBAC-032): además de los niveles legacy
+ * (RETAILER/STORE/GROUP, atados a tenant-types concretos), una aplicación define
+ * su jerarquía DEBAJO de TENANT con niveles genéricos LEVEL_1 > LEVEL_2 > LEVEL_3,
+ * cuyo `displayName` lo decide cada aplicación (ver LevelDef en application/Application).
+ * Los niveles legacy se conservan para no romper retail/agents existentes.
  */
 var PermissionScope;
 (function (PermissionScope) {
@@ -13,4 +19,7 @@ var PermissionScope;
     PermissionScope["RETAILER"] = "RETAILER";
     PermissionScope["STORE"] = "STORE";
     PermissionScope["GROUP"] = "GROUP";
+    PermissionScope["LEVEL_1"] = "LEVEL_1";
+    PermissionScope["LEVEL_2"] = "LEVEL_2";
+    PermissionScope["LEVEL_3"] = "LEVEL_3";
 })(PermissionScope || (exports.PermissionScope = PermissionScope = {}));

package/bin/platformRbac/index.d.ts

@@ -34,3 +34,8 @@ export type { UserFieldDef } from './dtos/UserFieldDef';
 export * from './dtos/CreateUserFieldRequest';
 export * from './dtos/UpdateUserFieldRequest';
 export type { InjectableUserAttributesResponse } from './dtos/InjectableUserAttributesResponse';
+export * from './enums/ApplicationStatus';
+export * from './enums/PermissionKind';
+export type { LevelDef, ApplicationSecurityPolicyDefault, ApplicationBrandingDefault, ApplicationDefaults, SeedRole, Application, } from './application/Application';
+export type { ApplicationPermission } from './application/ApplicationPermission';
+export type { CreateApplicationRequest, UpdateApplicationRequest, UpsertApplicationPermissionRequest, } from './application/requests';

package/bin/platformRbac/index.js

@@ -81,3 +81,8 @@ Object.defineProperty(exports, "UserFieldType", { enumerable: true, get: functio
 // InjectableUserAttributesResponse es interface plain (consumida por jwt-inyector) → type-only.
 __exportStar(require("./dtos/CreateUserFieldRequest"), exports);
 __exportStar(require("./dtos/UpdateUserFieldRequest"), exports);
+// Aplicación + niveles genéricos (sub-proyecto #1 de platform-rbac-business, DEC-RBAC-030/031/033).
+// ApplicationStatus/PermissionKind son enums (export de valor); Application, ApplicationPermission y
+// los requests son interfaces plain (sin decoradores class-validator) → type-only.
+__exportStar(require("./enums/ApplicationStatus"), exports);
+__exportStar(require("./enums/PermissionKind"), exports);

package/bin/platformRbac/tenantTypes.js

@@ -49,5 +49,10 @@ function scopeRankOrder() {
             if (!order.includes(lvl))
                 order.push(lvl);
     }
+    // DEC-RBAC-032: niveles genéricos al final del orden total (UI/ranking). Append-only, después de los legacy.
+    for (const lvl of [PermissionScope_1.PermissionScope.LEVEL_1, PermissionScope_1.PermissionScope.LEVEL_2, PermissionScope_1.PermissionScope.LEVEL_3]) {
+        if (!order.includes(lvl))
+            order.push(lvl);
+    }
     return order;
 }

package/bin/walletFunding/enums/WalletFundingErrorCodeEnum.d.ts

@@ -12,5 +12,12 @@ export declare enum WalletFundingErrorCodeEnum {
     REFERENCE_ALREADY_PAID = "REFERENCE_ALREADY_PAID",
     AMOUNT_MISMATCH = "AMOUNT_MISMATCH",
     PROVIDER_REJECTED = "PROVIDER_REJECTED",
-    PROVIDER_TIMEOUT = "PROVIDER_TIMEOUT"
+    PROVIDER_TIMEOUT = "PROVIDER_TIMEOUT",
+    /**
+     * Connector (o servicio downstream) está en modo mantenimiento manual.
+     * Devuelto en outbound cuando `EQUALITY_MAINTENANCE_MODE=true`. Para el
+     * inbound (webhooks), Equality recibe `responseCode 99` directamente
+     * (sin pasar por este enum).
+     */
+    MAINTENANCE_MODE = "MAINTENANCE_MODE"
 }

package/bin/walletFunding/enums/WalletFundingErrorCodeEnum.js

@@ -17,4 +17,11 @@ var WalletFundingErrorCodeEnum;
     WalletFundingErrorCodeEnum["AMOUNT_MISMATCH"] = "AMOUNT_MISMATCH";
     WalletFundingErrorCodeEnum["PROVIDER_REJECTED"] = "PROVIDER_REJECTED";
     WalletFundingErrorCodeEnum["PROVIDER_TIMEOUT"] = "PROVIDER_TIMEOUT";
+    /**
+     * Connector (o servicio downstream) está en modo mantenimiento manual.
+     * Devuelto en outbound cuando `EQUALITY_MAINTENANCE_MODE=true`. Para el
+     * inbound (webhooks), Equality recibe `responseCode 99` directamente
+     * (sin pasar por este enum).
+     */
+    WalletFundingErrorCodeEnum["MAINTENANCE_MODE"] = "MAINTENANCE_MODE";
 })(WalletFundingErrorCodeEnum || (exports.WalletFundingErrorCodeEnum = WalletFundingErrorCodeEnum = {}));

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fiado/type-kit",
-  "version": "3.108.0",
+  "version": "3.110.0",
   "description": "",
   "main": "bin/index.js",
   "types": "bin/index.d.ts",

package/src/platformRbac/application/Application.ts

@@ -0,0 +1,41 @@
+import { PermissionScope } from '../enums/PermissionScope';
+import { ApplicationStatus } from '../enums/ApplicationStatus';
+import type { UserFieldDef } from '../dtos/UserFieldDef';
+import type { TokenValidationMode } from '../enums/TokenValidationMode';
+
+export interface LevelDef {
+    level: PermissionScope; // LEVEL_1 | LEVEL_2 | LEVEL_3
+    displayName: string;
+}
+
+export interface ApplicationSecurityPolicyDefault {
+    mfaRequired?: boolean;
+    methodsAllowed?: Array<'TOTP' | 'EMAIL'>;
+    defaultPreferred?: 'TOTP' | 'EMAIL';
+    sessionTimeoutMin?: number;
+    passwordPolicy?: { minLength: number; requireSymbol: boolean; requireNumber: boolean; requireUppercase: boolean };
+}
+
+export interface ApplicationBrandingDefault {
+    logoUrl?: string; primaryColor?: string; secondaryColor?: string; accentColor?: string;
+    logoWidth?: number; faviconUrl?: string; webappBaseUrl?: string;
+}
+
+export interface ApplicationDefaults {
+    externalScopeLevels?: PermissionScope[];
+    userFieldDefs?: UserFieldDef[];
+    securityPolicy?: ApplicationSecurityPolicyDefault;
+    brandingConfig?: ApplicationBrandingDefault;
+    tokenValidationMode?: TokenValidationMode;
+}
+
+export interface SeedRole {
+    roleId: string; displayName: string; description?: string;
+    permissions: string[]; scope: PermissionScope; isSystem: boolean;
+}
+
+export interface Application {
+    applicationId: string; displayName: string; levels: LevelDef[];
+    defaults: ApplicationDefaults; seedRoles: SeedRole[]; status: ApplicationStatus;
+    createdAt?: number; updatedAt?: number;
+}

package/src/platformRbac/application/ApplicationPermission.ts

@@ -0,0 +1,8 @@
+import { PermissionScope } from '../enums/PermissionScope';
+import { PermissionKind } from '../enums/PermissionKind';
+
+export interface ApplicationPermission {
+    applicationId: string; permissionKey: string; displayName: string; description: string;
+    scope: PermissionScope; kind: PermissionKind; category?: string;
+    createdAt?: number; updatedAt?: number;
+}

package/src/platformRbac/application/requests.ts

@@ -0,0 +1,13 @@
+import { PermissionScope } from '../enums/PermissionScope';
+import type { LevelDef, ApplicationDefaults, SeedRole } from './Application';
+
+export interface CreateApplicationRequest {
+    applicationId: string; displayName: string; levels: LevelDef[];
+    defaults?: ApplicationDefaults; seedRoles?: SeedRole[];
+}
+export interface UpdateApplicationRequest {
+    displayName?: string; levels?: LevelDef[]; defaults?: ApplicationDefaults; seedRoles?: SeedRole[];
+}
+export interface UpsertApplicationPermissionRequest {
+    permissionKey: string; displayName: string; description: string; scope: PermissionScope; category?: string;
+}

package/src/platformRbac/enums/ApplicationStatus.ts

@@ -0,0 +1,5 @@
+/** Estado de una aplicación (plantilla). Archivar en vez de borrar si tiene tenants. DEC-RBAC-031. */
+export enum ApplicationStatus {
+    ACTIVE = 'ACTIVE',
+    ARCHIVED = 'ARCHIVED',
+}

package/src/platformRbac/enums/PermissionKind.ts

@@ -0,0 +1,9 @@
+/**
+ * Clase de un permiso del catálogo (DEC-RBAC-033).
+ * SYSTEM: gestión del propio RBAC, key inmutable y no borrable (gatea endpoints del lambda).
+ * CUSTOM: negocio de la app protegida, CRUD libre (lo enforza la app de destino).
+ */
+export enum PermissionKind {
+    SYSTEM = 'SYSTEM',
+    CUSTOM = 'CUSTOM',
+}

package/src/platformRbac/enums/PermissionScope.ts

@@ -2,6 +2,12 @@
  * Jerarquía retail: PLATFORM > TENANT > RETAILER > STORE.
  * Jerarquía agents: PLATFORM > TENANT > GROUP.
  * Componente 01 spec.
+ *
+ * Modelo genérico de aplicación (DEC-RBAC-032): además de los niveles legacy
+ * (RETAILER/STORE/GROUP, atados a tenant-types concretos), una aplicación define
+ * su jerarquía DEBAJO de TENANT con niveles genéricos LEVEL_1 > LEVEL_2 > LEVEL_3,
+ * cuyo `displayName` lo decide cada aplicación (ver LevelDef en application/Application).
+ * Los niveles legacy se conservan para no romper retail/agents existentes.
  */
 export enum PermissionScope {
     PLATFORM = 'PLATFORM',
@@ -9,4 +15,7 @@ export enum PermissionScope {
     RETAILER = 'RETAILER',
     STORE = 'STORE',
     GROUP = 'GROUP',
+    LEVEL_1 = 'LEVEL_1',
+    LEVEL_2 = 'LEVEL_2',
+    LEVEL_3 = 'LEVEL_3',
 }

package/src/platformRbac/index.ts

@@ -73,3 +73,23 @@ export type { UserFieldDef } from './dtos/UserFieldDef';
 export * from './dtos/CreateUserFieldRequest';
 export * from './dtos/UpdateUserFieldRequest';
 export type { InjectableUserAttributesResponse } from './dtos/InjectableUserAttributesResponse';
+
+// Aplicación + niveles genéricos (sub-proyecto #1 de platform-rbac-business, DEC-RBAC-030/031/033).
+// ApplicationStatus/PermissionKind son enums (export de valor); Application, ApplicationPermission y
+// los requests son interfaces plain (sin decoradores class-validator) → type-only.
+export * from './enums/ApplicationStatus';
+export * from './enums/PermissionKind';
+export type {
+    LevelDef,
+    ApplicationSecurityPolicyDefault,
+    ApplicationBrandingDefault,
+    ApplicationDefaults,
+    SeedRole,
+    Application,
+} from './application/Application';
+export type { ApplicationPermission } from './application/ApplicationPermission';
+export type {
+    CreateApplicationRequest,
+    UpdateApplicationRequest,
+    UpsertApplicationPermissionRequest,
+} from './application/requests';

package/src/platformRbac/tenantTypes.ts

@@ -53,5 +53,9 @@ export function scopeRankOrder(): PermissionScope[] {
     for (const def of Object.values(TENANT_TYPES)) {
         for (const lvl of def.levels) if (!order.includes(lvl)) order.push(lvl);
     }
+    // DEC-RBAC-032: niveles genéricos al final del orden total (UI/ranking). Append-only, después de los legacy.
+    for (const lvl of [PermissionScope.LEVEL_1, PermissionScope.LEVEL_2, PermissionScope.LEVEL_3]) {
+        if (!order.includes(lvl)) order.push(lvl);
+    }
     return order;
 }

package/src/walletFunding/enums/WalletFundingErrorCodeEnum.ts

@@ -13,4 +13,11 @@ export enum WalletFundingErrorCodeEnum {
     AMOUNT_MISMATCH = "AMOUNT_MISMATCH",
     PROVIDER_REJECTED = "PROVIDER_REJECTED",
     PROVIDER_TIMEOUT = "PROVIDER_TIMEOUT",
+    /**
+     * Connector (o servicio downstream) está en modo mantenimiento manual.
+     * Devuelto en outbound cuando `EQUALITY_MAINTENANCE_MODE=true`. Para el
+     * inbound (webhooks), Equality recibe `responseCode 99` directamente
+     * (sin pasar por este enum).
+     */
+    MAINTENANCE_MODE = "MAINTENANCE_MODE",
 }