@fiado/type-kit 3.114.0 → 3.116.0

package/bin/cognitoBackofficeConnector/dtos/VerifyPasswordResponse.d.ts

@@ -1,4 +1,11 @@
 import { CognitoChallengeType } from '../enums/CognitoChallengeType';
+export declare class VerifyPasswordTokens {
+    accessToken: string;
+    idToken: string;
+    refreshToken: string;
+    expiresIn: number;
+    tokenType: string;
+}
 /**
  * Respuesta de `POST /auth/verify-password`.
  *
@@ -15,4 +22,5 @@ export declare class VerifyPasswordResponse {
     challengeType?: CognitoChallengeType;
     session?: string;
     challengeParameters?: Record<string, string>;
+    tokens?: VerifyPasswordTokens;
 }

package/bin/cognitoBackofficeConnector/dtos/VerifyPasswordResponse.js

@@ -9,10 +9,38 @@ var __metadata = (this && this.__metadata) || function (k, v) {
     if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.VerifyPasswordResponse = void 0;
+exports.VerifyPasswordResponse = exports.VerifyPasswordTokens = void 0;
 const class_transformer_1 = require("class-transformer");
 const class_validator_1 = require("class-validator");
 const CognitoChallengeType_1 = require("../enums/CognitoChallengeType");
+class VerifyPasswordTokens {
+}
+exports.VerifyPasswordTokens = VerifyPasswordTokens;
+__decorate([
+    (0, class_transformer_1.Expose)(),
+    (0, class_validator_1.IsString)(),
+    __metadata("design:type", String)
+], VerifyPasswordTokens.prototype, "accessToken", void 0);
+__decorate([
+    (0, class_transformer_1.Expose)(),
+    (0, class_validator_1.IsString)(),
+    __metadata("design:type", String)
+], VerifyPasswordTokens.prototype, "idToken", void 0);
+__decorate([
+    (0, class_transformer_1.Expose)(),
+    (0, class_validator_1.IsString)(),
+    __metadata("design:type", String)
+], VerifyPasswordTokens.prototype, "refreshToken", void 0);
+__decorate([
+    (0, class_transformer_1.Expose)(),
+    (0, class_validator_1.IsNumber)(),
+    __metadata("design:type", Number)
+], VerifyPasswordTokens.prototype, "expiresIn", void 0);
+__decorate([
+    (0, class_transformer_1.Expose)(),
+    (0, class_validator_1.IsString)(),
+    __metadata("design:type", String)
+], VerifyPasswordTokens.prototype, "tokenType", void 0);
 /**
  * Respuesta de `POST /auth/verify-password`.
  *
@@ -50,3 +78,10 @@ __decorate([
     (0, class_validator_1.IsObject)(),
     __metadata("design:type", Object)
 ], VerifyPasswordResponse.prototype, "challengeParameters", void 0);
+__decorate([
+    (0, class_transformer_1.Expose)(),
+    (0, class_validator_1.IsOptional)(),
+    (0, class_validator_1.ValidateNested)(),
+    (0, class_transformer_1.Type)(() => VerifyPasswordTokens),
+    __metadata("design:type", VerifyPasswordTokens)
+], VerifyPasswordResponse.prototype, "tokens", void 0);

package/bin/platformRbac/application/Application.d.ts

@@ -7,6 +7,7 @@ export interface LevelDef {
     displayName: string;
 }
 export interface ApplicationSecurityPolicyDefault {
+    mfaEnabled?: boolean;
     mfaRequired?: boolean;
     methodsAllowed?: Array<'TOTP' | 'EMAIL'>;
     defaultPreferred?: 'TOTP' | 'EMAIL';

package/bin/platformRbac/dtos/TenantSecurityPolicyResponse.d.ts

@@ -7,4 +7,5 @@
  */
 export interface TenantSecurityPolicyResponse {
     methodsAllowed: ('EMAIL' | 'TOTP')[];
+    mfaEnabled?: boolean;
 }

package/bin/platformRbac/dtos/UpdateTenantSecurityPolicyRequest.d.ts

@@ -1,3 +1,4 @@
 export declare class UpdateTenantSecurityPolicyRequest {
     methodsAllowed: ('EMAIL' | 'TOTP')[];
+    mfaEnabled?: boolean;
 }

package/bin/platformRbac/dtos/UpdateTenantSecurityPolicyRequest.js

@@ -12,8 +12,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.UpdateTenantSecurityPolicyRequest = void 0;
 const class_transformer_1 = require("class-transformer");
 const class_validator_1 = require("class-validator");
-// TD-RBAC-071: methodsAllowed usa el value-set 'EMAIL'|'TOTP' (string), distinto de MfaMethodEnum
-// ('EMAIL_OTP'|'TOTP') a propósito. Ver TECH_DEBT.md del platform-rbac-business.
+// TD-RBAC-071: methodsAllowed usa el value-set 'EMAIL'|'TOTP' (string), distinto de MfaMethodEnum.
 class UpdateTenantSecurityPolicyRequest {
 }
 exports.UpdateTenantSecurityPolicyRequest = UpdateTenantSecurityPolicyRequest;
@@ -23,3 +22,9 @@ __decorate([
     (0, class_validator_1.IsIn)(['EMAIL', 'TOTP'], { each: true }),
     __metadata("design:type", Array)
 ], UpdateTenantSecurityPolicyRequest.prototype, "methodsAllowed", void 0);
+__decorate([
+    (0, class_transformer_1.Expose)(),
+    (0, class_validator_1.IsOptional)(),
+    (0, class_validator_1.IsBoolean)(),
+    __metadata("design:type", Boolean)
+], UpdateTenantSecurityPolicyRequest.prototype, "mfaEnabled", void 0);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fiado/type-kit",
-  "version": "3.114.0",
+  "version": "3.116.0",
   "description": "",
   "main": "bin/index.js",
   "types": "bin/index.d.ts",

package/src/cognitoBackofficeConnector/dtos/VerifyPasswordResponse.ts

@@ -1,7 +1,15 @@
-import { Expose } from 'class-transformer';
-import { IsBoolean, IsEnum, IsObject, IsOptional, IsString } from 'class-validator';
+import { Expose, Type } from 'class-transformer';
+import { IsBoolean, IsEnum, IsNumber, IsObject, IsOptional, IsString, ValidateNested } from 'class-validator';
 import { CognitoChallengeType } from '../enums/CognitoChallengeType';
 
+export class VerifyPasswordTokens {
+    @Expose() @IsString() accessToken!: string;
+    @Expose() @IsString() idToken!: string;
+    @Expose() @IsString() refreshToken!: string;
+    @Expose() @IsNumber() expiresIn!: number;
+    @Expose() @IsString() tokenType!: string;
+}
+
 /**
  * Respuesta de `POST /auth/verify-password`.
  *
@@ -21,4 +29,8 @@ export class VerifyPasswordResponse {
     @Expose() @IsOptional() @IsString() session?: string;
 
     @Expose() @IsOptional() @IsObject() challengeParameters?: Record<string, string>;
+
+    // DEC-RBAC-045: tokens directos de ADMIN_USER_PASSWORD_AUTH cuando no hay challenge. El rbac SOLO
+    // los usa si el tenant tiene mfaEnabled=false. Aditivo, backward-compatible.
+    @Expose() @IsOptional() @ValidateNested() @Type(() => VerifyPasswordTokens) tokens?: VerifyPasswordTokens;
 }

package/src/platformRbac/application/Application.ts

@@ -9,6 +9,8 @@ export interface LevelDef {
 }
 
 export interface ApplicationSecurityPolicyDefault {
+    // DEC-RBAC-045: 2FA master switch por tenant. Ausente ⇒ habilitado (secure-by-default).
+    mfaEnabled?: boolean;
     mfaRequired?: boolean;
     methodsAllowed?: Array<'TOTP' | 'EMAIL'>;
     defaultPreferred?: 'TOTP' | 'EMAIL';

package/src/platformRbac/dtos/TenantSecurityPolicyResponse.ts

@@ -7,4 +7,7 @@
  */
 export interface TenantSecurityPolicyResponse {
     methodsAllowed: ('EMAIL' | 'TOTP')[];
+
+    // DEC-RBAC-045: 2FA master switch por tenant. Ausente ⇒ habilitado (secure-by-default).
+    mfaEnabled?: boolean;
 }

package/src/platformRbac/dtos/UpdateTenantSecurityPolicyRequest.ts

@@ -1,11 +1,16 @@
 import { Expose } from 'class-transformer';
-import { ArrayNotEmpty, IsIn } from 'class-validator';
+import { ArrayNotEmpty, IsBoolean, IsIn, IsOptional } from 'class-validator';
 
-// TD-RBAC-071: methodsAllowed usa el value-set 'EMAIL'|'TOTP' (string), distinto de MfaMethodEnum
-// ('EMAIL_OTP'|'TOTP') a propósito. Ver TECH_DEBT.md del platform-rbac-business.
+// TD-RBAC-071: methodsAllowed usa el value-set 'EMAIL'|'TOTP' (string), distinto de MfaMethodEnum.
 export class UpdateTenantSecurityPolicyRequest {
     @Expose()
     @ArrayNotEmpty()
     @IsIn(['EMAIL', 'TOTP'], { each: true })
     methodsAllowed!: ('EMAIL' | 'TOTP')[];
+
+    // DEC-RBAC-045: 2FA master switch por tenant. Ausente ⇒ habilitado (secure-by-default).
+    @Expose()
+    @IsOptional()
+    @IsBoolean()
+    mfaEnabled?: boolean;
 }