@fiado/type-kit 3.112.0 → 3.113.0

package/bin/platformRbac/dtos/CompleteMyProfileRequest.d.ts

@@ -0,0 +1,9 @@
+/**
+ * Body del PUT /me/profile/complete (autenticado, gate post-MFA del autoregistro). DEC-RBAC-034.
+ * Opera sobre el propio usuario (cognitoSub del token). Valida nombre + los `userFieldDefs` requeridos
+ * del tenant (422 MISSING_REQUIRED_FIELDS si faltan) y flipea `profileComplete=true`.
+ */
+export declare class CompleteMyProfileRequest {
+    displayName: string;
+    customFields?: Record<string, string>;
+}

package/bin/platformRbac/dtos/CompleteMyProfileRequest.js

@@ -0,0 +1,34 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CompleteMyProfileRequest = void 0;
+const class_transformer_1 = require("class-transformer");
+const class_validator_1 = require("class-validator");
+/**
+ * Body del PUT /me/profile/complete (autenticado, gate post-MFA del autoregistro). DEC-RBAC-034.
+ * Opera sobre el propio usuario (cognitoSub del token). Valida nombre + los `userFieldDefs` requeridos
+ * del tenant (422 MISSING_REQUIRED_FIELDS si faltan) y flipea `profileComplete=true`.
+ */
+class CompleteMyProfileRequest {
+}
+exports.CompleteMyProfileRequest = CompleteMyProfileRequest;
+__decorate([
+    (0, class_transformer_1.Expose)(),
+    (0, class_validator_1.IsString)(),
+    (0, class_validator_1.IsNotEmpty)(),
+    __metadata("design:type", String)
+], CompleteMyProfileRequest.prototype, "displayName", void 0);
+__decorate([
+    (0, class_transformer_1.Expose)(),
+    (0, class_validator_1.IsOptional)(),
+    (0, class_validator_1.IsObject)(),
+    __metadata("design:type", Object)
+], CompleteMyProfileRequest.prototype, "customFields", void 0);

package/bin/platformRbac/dtos/SelfRegisterCompleteRequest.d.ts

@@ -0,0 +1,21 @@
+/**
+ * Body del POST /self-register/complete (público, anónimo). DEC-RBAC-033.
+ * Consume el `completionToken` del verify-otp (validación condicional atómica server-side, anti
+ * doble-complete). La password la elige el usuario y nace permanente (usuario ACTIVE). `displayName`
+ * y `customFields` son opcionales (point 6): si llegan completos, `profileComplete=true` y se saltea
+ * el gate post-MFA; si no, el usuario nace `profileComplete=false` con displayName placeholder.
+ * La password NUNCA se persiste: viaja solo acá, directo a Cognito.
+ */
+export declare class SelfRegisterCompleteRequest {
+    tenantId: string;
+    email: string;
+    completionToken: string;
+    password: string;
+    displayName?: string;
+    customFields?: Record<string, string>;
+}
+/** Respuesta del complete. El usuario nace ACTIVE; `profileComplete` indica si falta completar perfil. */
+export interface SelfRegisterCompleteResponse {
+    cognitoSub: string;
+    profileComplete: boolean;
+}

package/bin/platformRbac/dtos/SelfRegisterCompleteRequest.js

@@ -0,0 +1,60 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SelfRegisterCompleteRequest = void 0;
+const class_transformer_1 = require("class-transformer");
+const class_validator_1 = require("class-validator");
+/**
+ * Body del POST /self-register/complete (público, anónimo). DEC-RBAC-033.
+ * Consume el `completionToken` del verify-otp (validación condicional atómica server-side, anti
+ * doble-complete). La password la elige el usuario y nace permanente (usuario ACTIVE). `displayName`
+ * y `customFields` son opcionales (point 6): si llegan completos, `profileComplete=true` y se saltea
+ * el gate post-MFA; si no, el usuario nace `profileComplete=false` con displayName placeholder.
+ * La password NUNCA se persiste: viaja solo acá, directo a Cognito.
+ */
+class SelfRegisterCompleteRequest {
+}
+exports.SelfRegisterCompleteRequest = SelfRegisterCompleteRequest;
+__decorate([
+    (0, class_transformer_1.Expose)(),
+    (0, class_validator_1.IsString)(),
+    (0, class_validator_1.IsNotEmpty)(),
+    __metadata("design:type", String)
+], SelfRegisterCompleteRequest.prototype, "tenantId", void 0);
+__decorate([
+    (0, class_transformer_1.Expose)(),
+    (0, class_validator_1.IsEmail)(),
+    __metadata("design:type", String)
+], SelfRegisterCompleteRequest.prototype, "email", void 0);
+__decorate([
+    (0, class_transformer_1.Expose)(),
+    (0, class_validator_1.IsString)(),
+    (0, class_validator_1.IsNotEmpty)(),
+    __metadata("design:type", String)
+], SelfRegisterCompleteRequest.prototype, "completionToken", void 0);
+__decorate([
+    (0, class_transformer_1.Expose)(),
+    (0, class_validator_1.IsString)(),
+    (0, class_validator_1.MinLength)(8),
+    __metadata("design:type", String)
+], SelfRegisterCompleteRequest.prototype, "password", void 0);
+__decorate([
+    (0, class_transformer_1.Expose)(),
+    (0, class_validator_1.IsOptional)(),
+    (0, class_validator_1.IsString)(),
+    __metadata("design:type", String)
+], SelfRegisterCompleteRequest.prototype, "displayName", void 0);
+__decorate([
+    (0, class_transformer_1.Expose)(),
+    (0, class_validator_1.IsOptional)(),
+    (0, class_validator_1.IsObject)(),
+    __metadata("design:type", Object)
+], SelfRegisterCompleteRequest.prototype, "customFields", void 0);

package/bin/platformRbac/dtos/SelfRegisterStartRequest.d.ts

@@ -0,0 +1,18 @@
+import { PermissionScope } from '../enums/PermissionScope';
+/**
+ * Body del POST /self-register/start (público, anónimo). DEC-RBAC-030/031.
+ * El `roleId`/`scope`/`scopeRef` los manda el front pero el server los valida contra la allowlist
+ * del tenant (`autoregister.allowedRoles`) — guarda anti-escalación. NO incluye campos obligatorios:
+ * se completan post-MFA (DEC-RBAC-034). El email se normaliza lowercase server-side.
+ */
+export declare class SelfRegisterStartRequest {
+    tenantId: string;
+    email: string;
+    roleId: string;
+    scope: PermissionScope;
+    scopeRef: string;
+}
+/** Respuesta del start. `expiresAt` epoch ms del registro pendiente. Genérica también en los caminos de rechazo silencioso (anti-enumeración). */
+export interface SelfRegisterStartResponse {
+    expiresAt: number;
+}

package/bin/platformRbac/dtos/SelfRegisterStartRequest.js

@@ -0,0 +1,52 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SelfRegisterStartRequest = void 0;
+const class_transformer_1 = require("class-transformer");
+const class_validator_1 = require("class-validator");
+const PermissionScope_1 = require("../enums/PermissionScope");
+/**
+ * Body del POST /self-register/start (público, anónimo). DEC-RBAC-030/031.
+ * El `roleId`/`scope`/`scopeRef` los manda el front pero el server los valida contra la allowlist
+ * del tenant (`autoregister.allowedRoles`) — guarda anti-escalación. NO incluye campos obligatorios:
+ * se completan post-MFA (DEC-RBAC-034). El email se normaliza lowercase server-side.
+ */
+class SelfRegisterStartRequest {
+}
+exports.SelfRegisterStartRequest = SelfRegisterStartRequest;
+__decorate([
+    (0, class_transformer_1.Expose)(),
+    (0, class_validator_1.IsString)(),
+    (0, class_validator_1.IsNotEmpty)(),
+    __metadata("design:type", String)
+], SelfRegisterStartRequest.prototype, "tenantId", void 0);
+__decorate([
+    (0, class_transformer_1.Expose)(),
+    (0, class_validator_1.IsEmail)(),
+    __metadata("design:type", String)
+], SelfRegisterStartRequest.prototype, "email", void 0);
+__decorate([
+    (0, class_transformer_1.Expose)(),
+    (0, class_validator_1.IsString)(),
+    (0, class_validator_1.IsNotEmpty)(),
+    __metadata("design:type", String)
+], SelfRegisterStartRequest.prototype, "roleId", void 0);
+__decorate([
+    (0, class_transformer_1.Expose)(),
+    (0, class_validator_1.IsEnum)(PermissionScope_1.PermissionScope),
+    __metadata("design:type", String)
+], SelfRegisterStartRequest.prototype, "scope", void 0);
+__decorate([
+    (0, class_transformer_1.Expose)(),
+    (0, class_validator_1.IsString)(),
+    (0, class_validator_1.IsNotEmpty)(),
+    __metadata("design:type", String)
+], SelfRegisterStartRequest.prototype, "scopeRef", void 0);

package/bin/platformRbac/dtos/SelfRegisterVerifyOtpRequest.d.ts

@@ -0,0 +1,14 @@
+/**
+ * Body del POST /self-register/verify-otp (público, anónimo). DEC-RBAC-032.
+ * El OTP lo verifica `fiado-messages-lambda` (one-shot). En éxito el server devuelve un
+ * `completionToken` one-time que `complete` debe presentar.
+ */
+export declare class SelfRegisterVerifyOtpRequest {
+    tenantId: string;
+    email: string;
+    otp: string;
+}
+/** Respuesta del verify-otp. `completionToken` one-time para el paso `complete`. */
+export interface SelfRegisterVerifyOtpResponse {
+    completionToken: string;
+}

package/bin/platformRbac/dtos/SelfRegisterVerifyOtpRequest.js

@@ -0,0 +1,39 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SelfRegisterVerifyOtpRequest = void 0;
+const class_transformer_1 = require("class-transformer");
+const class_validator_1 = require("class-validator");
+/**
+ * Body del POST /self-register/verify-otp (público, anónimo). DEC-RBAC-032.
+ * El OTP lo verifica `fiado-messages-lambda` (one-shot). En éxito el server devuelve un
+ * `completionToken` one-time que `complete` debe presentar.
+ */
+class SelfRegisterVerifyOtpRequest {
+}
+exports.SelfRegisterVerifyOtpRequest = SelfRegisterVerifyOtpRequest;
+__decorate([
+    (0, class_transformer_1.Expose)(),
+    (0, class_validator_1.IsString)(),
+    (0, class_validator_1.IsNotEmpty)(),
+    __metadata("design:type", String)
+], SelfRegisterVerifyOtpRequest.prototype, "tenantId", void 0);
+__decorate([
+    (0, class_transformer_1.Expose)(),
+    (0, class_validator_1.IsEmail)(),
+    __metadata("design:type", String)
+], SelfRegisterVerifyOtpRequest.prototype, "email", void 0);
+__decorate([
+    (0, class_transformer_1.Expose)(),
+    (0, class_validator_1.IsString)(),
+    (0, class_validator_1.IsNotEmpty)(),
+    __metadata("design:type", String)
+], SelfRegisterVerifyOtpRequest.prototype, "otp", void 0);

package/bin/platformRbac/index.d.ts

@@ -39,3 +39,7 @@ export * from './enums/PermissionKind';
 export type { LevelDef, ApplicationSecurityPolicyDefault, ApplicationBrandingDefault, ApplicationDefaults, SeedRole, Application, } from './application/Application';
 export type { ApplicationPermission } from './application/ApplicationPermission';
 export type { CreateApplicationRequest, UpdateApplicationRequest, UpsertApplicationPermissionRequest, } from './application/requests';
+export * from './dtos/SelfRegisterStartRequest';
+export * from './dtos/SelfRegisterVerifyOtpRequest';
+export * from './dtos/SelfRegisterCompleteRequest';
+export * from './dtos/CompleteMyProfileRequest';

package/bin/platformRbac/index.js

@@ -86,3 +86,10 @@ __exportStar(require("./dtos/UpdateUserFieldRequest"), exports);
 // los requests son interfaces plain (sin decoradores class-validator) → type-only.
 __exportStar(require("./enums/ApplicationStatus"), exports);
 __exportStar(require("./enums/PermissionKind"), exports);
+// Autoregistro self-service por tenant (DEC-RBAC-030..034). Los Request llevan decoradores
+// class-validator (export de valor — se hidratan con plainToInstance); los Response son interfaces
+// plain (type-only). Consumidos por los endpoints públicos de platform-rbac-business + el gate de perfil.
+__exportStar(require("./dtos/SelfRegisterStartRequest"), exports);
+__exportStar(require("./dtos/SelfRegisterVerifyOtpRequest"), exports);
+__exportStar(require("./dtos/SelfRegisterCompleteRequest"), exports);
+__exportStar(require("./dtos/CompleteMyProfileRequest"), exports);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fiado/type-kit",
-  "version": "3.112.0",
+  "version": "3.113.0",
   "description": "",
   "main": "bin/index.js",
   "types": "bin/index.d.ts",

package/src/platformRbac/dtos/CompleteMyProfileRequest.ts

@@ -0,0 +1,12 @@
+import { Expose } from 'class-transformer';
+import { IsNotEmpty, IsObject, IsOptional, IsString } from 'class-validator';
+
+/**
+ * Body del PUT /me/profile/complete (autenticado, gate post-MFA del autoregistro). DEC-RBAC-034.
+ * Opera sobre el propio usuario (cognitoSub del token). Valida nombre + los `userFieldDefs` requeridos
+ * del tenant (422 MISSING_REQUIRED_FIELDS si faltan) y flipea `profileComplete=true`.
+ */
+export class CompleteMyProfileRequest {
+    @Expose() @IsString() @IsNotEmpty() displayName!: string;
+    @Expose() @IsOptional() @IsObject() customFields?: Record<string, string>;
+}

package/src/platformRbac/dtos/SelfRegisterCompleteRequest.ts

@@ -0,0 +1,25 @@
+import { Expose } from 'class-transformer';
+import { IsEmail, IsNotEmpty, IsObject, IsOptional, IsString, MinLength } from 'class-validator';
+
+/**
+ * Body del POST /self-register/complete (público, anónimo). DEC-RBAC-033.
+ * Consume el `completionToken` del verify-otp (validación condicional atómica server-side, anti
+ * doble-complete). La password la elige el usuario y nace permanente (usuario ACTIVE). `displayName`
+ * y `customFields` son opcionales (point 6): si llegan completos, `profileComplete=true` y se saltea
+ * el gate post-MFA; si no, el usuario nace `profileComplete=false` con displayName placeholder.
+ * La password NUNCA se persiste: viaja solo acá, directo a Cognito.
+ */
+export class SelfRegisterCompleteRequest {
+    @Expose() @IsString() @IsNotEmpty() tenantId!: string;
+    @Expose() @IsEmail() email!: string;
+    @Expose() @IsString() @IsNotEmpty() completionToken!: string;
+    @Expose() @IsString() @MinLength(8) password!: string;
+    @Expose() @IsOptional() @IsString() displayName?: string;
+    @Expose() @IsOptional() @IsObject() customFields?: Record<string, string>;
+}
+
+/** Respuesta del complete. El usuario nace ACTIVE; `profileComplete` indica si falta completar perfil. */
+export interface SelfRegisterCompleteResponse {
+    cognitoSub: string;
+    profileComplete: boolean;
+}

package/src/platformRbac/dtos/SelfRegisterStartRequest.ts

@@ -0,0 +1,22 @@
+import { Expose } from 'class-transformer';
+import { IsEmail, IsEnum, IsNotEmpty, IsString } from 'class-validator';
+import { PermissionScope } from '../enums/PermissionScope';
+
+/**
+ * Body del POST /self-register/start (público, anónimo). DEC-RBAC-030/031.
+ * El `roleId`/`scope`/`scopeRef` los manda el front pero el server los valida contra la allowlist
+ * del tenant (`autoregister.allowedRoles`) — guarda anti-escalación. NO incluye campos obligatorios:
+ * se completan post-MFA (DEC-RBAC-034). El email se normaliza lowercase server-side.
+ */
+export class SelfRegisterStartRequest {
+    @Expose() @IsString() @IsNotEmpty() tenantId!: string;
+    @Expose() @IsEmail() email!: string;
+    @Expose() @IsString() @IsNotEmpty() roleId!: string;
+    @Expose() @IsEnum(PermissionScope) scope!: PermissionScope;
+    @Expose() @IsString() @IsNotEmpty() scopeRef!: string;
+}
+
+/** Respuesta del start. `expiresAt` epoch ms del registro pendiente. Genérica también en los caminos de rechazo silencioso (anti-enumeración). */
+export interface SelfRegisterStartResponse {
+    expiresAt: number;
+}

package/src/platformRbac/dtos/SelfRegisterVerifyOtpRequest.ts

@@ -0,0 +1,18 @@
+import { Expose } from 'class-transformer';
+import { IsEmail, IsNotEmpty, IsString } from 'class-validator';
+
+/**
+ * Body del POST /self-register/verify-otp (público, anónimo). DEC-RBAC-032.
+ * El OTP lo verifica `fiado-messages-lambda` (one-shot). En éxito el server devuelve un
+ * `completionToken` one-time que `complete` debe presentar.
+ */
+export class SelfRegisterVerifyOtpRequest {
+    @Expose() @IsString() @IsNotEmpty() tenantId!: string;
+    @Expose() @IsEmail() email!: string;
+    @Expose() @IsString() @IsNotEmpty() otp!: string;
+}
+
+/** Respuesta del verify-otp. `completionToken` one-time para el paso `complete`. */
+export interface SelfRegisterVerifyOtpResponse {
+    completionToken: string;
+}

package/src/platformRbac/index.ts

@@ -93,3 +93,11 @@ export type {
     UpdateApplicationRequest,
     UpsertApplicationPermissionRequest,
 } from './application/requests';
+
+// Autoregistro self-service por tenant (DEC-RBAC-030..034). Los Request llevan decoradores
+// class-validator (export de valor — se hidratan con plainToInstance); los Response son interfaces
+// plain (type-only). Consumidos por los endpoints públicos de platform-rbac-business + el gate de perfil.
+export * from './dtos/SelfRegisterStartRequest';
+export * from './dtos/SelfRegisterVerifyOtpRequest';
+export * from './dtos/SelfRegisterCompleteRequest';
+export * from './dtos/CompleteMyProfileRequest';