@fiado/type-kit 3.115.0 → 3.116.0

package/bin/cognitoBackofficeConnector/dtos/VerifyPasswordResponse.d.ts

@@ -1,4 +1,11 @@
 import { CognitoChallengeType } from '../enums/CognitoChallengeType';
+export declare class VerifyPasswordTokens {
+    accessToken: string;
+    idToken: string;
+    refreshToken: string;
+    expiresIn: number;
+    tokenType: string;
+}
 /**
  * Respuesta de `POST /auth/verify-password`.
  *
@@ -15,4 +22,5 @@ export declare class VerifyPasswordResponse {
     challengeType?: CognitoChallengeType;
     session?: string;
     challengeParameters?: Record<string, string>;
+    tokens?: VerifyPasswordTokens;
 }

package/bin/cognitoBackofficeConnector/dtos/VerifyPasswordResponse.js

@@ -9,10 +9,38 @@ var __metadata = (this && this.__metadata) || function (k, v) {
     if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.VerifyPasswordResponse = void 0;
+exports.VerifyPasswordResponse = exports.VerifyPasswordTokens = void 0;
 const class_transformer_1 = require("class-transformer");
 const class_validator_1 = require("class-validator");
 const CognitoChallengeType_1 = require("../enums/CognitoChallengeType");
+class VerifyPasswordTokens {
+}
+exports.VerifyPasswordTokens = VerifyPasswordTokens;
+__decorate([
+    (0, class_transformer_1.Expose)(),
+    (0, class_validator_1.IsString)(),
+    __metadata("design:type", String)
+], VerifyPasswordTokens.prototype, "accessToken", void 0);
+__decorate([
+    (0, class_transformer_1.Expose)(),
+    (0, class_validator_1.IsString)(),
+    __metadata("design:type", String)
+], VerifyPasswordTokens.prototype, "idToken", void 0);
+__decorate([
+    (0, class_transformer_1.Expose)(),
+    (0, class_validator_1.IsString)(),
+    __metadata("design:type", String)
+], VerifyPasswordTokens.prototype, "refreshToken", void 0);
+__decorate([
+    (0, class_transformer_1.Expose)(),
+    (0, class_validator_1.IsNumber)(),
+    __metadata("design:type", Number)
+], VerifyPasswordTokens.prototype, "expiresIn", void 0);
+__decorate([
+    (0, class_transformer_1.Expose)(),
+    (0, class_validator_1.IsString)(),
+    __metadata("design:type", String)
+], VerifyPasswordTokens.prototype, "tokenType", void 0);
 /**
  * Respuesta de `POST /auth/verify-password`.
  *
@@ -50,3 +78,10 @@ __decorate([
     (0, class_validator_1.IsObject)(),
     __metadata("design:type", Object)
 ], VerifyPasswordResponse.prototype, "challengeParameters", void 0);
+__decorate([
+    (0, class_transformer_1.Expose)(),
+    (0, class_validator_1.IsOptional)(),
+    (0, class_validator_1.ValidateNested)(),
+    (0, class_transformer_1.Type)(() => VerifyPasswordTokens),
+    __metadata("design:type", VerifyPasswordTokens)
+], VerifyPasswordResponse.prototype, "tokens", void 0);

package/bin/platformRbac/application/Application.d.ts

@@ -7,6 +7,7 @@ export interface LevelDef {
     displayName: string;
 }
 export interface ApplicationSecurityPolicyDefault {
+    mfaEnabled?: boolean;
     mfaRequired?: boolean;
     methodsAllowed?: Array<'TOTP' | 'EMAIL'>;
     defaultPreferred?: 'TOTP' | 'EMAIL';

package/bin/platformRbac/dtos/TenantSecurityPolicyResponse.d.ts

@@ -7,4 +7,5 @@
  */
 export interface TenantSecurityPolicyResponse {
     methodsAllowed: ('EMAIL' | 'TOTP')[];
+    mfaEnabled?: boolean;
 }

package/bin/platformRbac/dtos/UpdateTenantSecurityPolicyRequest.d.ts

@@ -1,3 +1,4 @@
 export declare class UpdateTenantSecurityPolicyRequest {
     methodsAllowed: ('EMAIL' | 'TOTP')[];
+    mfaEnabled?: boolean;
 }

package/bin/platformRbac/dtos/UpdateTenantSecurityPolicyRequest.js

@@ -12,8 +12,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.UpdateTenantSecurityPolicyRequest = void 0;
 const class_transformer_1 = require("class-transformer");
 const class_validator_1 = require("class-validator");
-// TD-RBAC-071: methodsAllowed usa el value-set 'EMAIL'|'TOTP' (string), distinto de MfaMethodEnum
-// ('EMAIL_OTP'|'TOTP') a propósito. Ver TECH_DEBT.md del platform-rbac-business.
+// TD-RBAC-071: methodsAllowed usa el value-set 'EMAIL'|'TOTP' (string), distinto de MfaMethodEnum.
 class UpdateTenantSecurityPolicyRequest {
 }
 exports.UpdateTenantSecurityPolicyRequest = UpdateTenantSecurityPolicyRequest;
@@ -23,3 +22,9 @@ __decorate([
     (0, class_validator_1.IsIn)(['EMAIL', 'TOTP'], { each: true }),
     __metadata("design:type", Array)
 ], UpdateTenantSecurityPolicyRequest.prototype, "methodsAllowed", void 0);
+__decorate([
+    (0, class_transformer_1.Expose)(),
+    (0, class_validator_1.IsOptional)(),
+    (0, class_validator_1.IsBoolean)(),
+    __metadata("design:type", Boolean)
+], UpdateTenantSecurityPolicyRequest.prototype, "mfaEnabled", void 0);

package/bin/walletFunding/dtos/CancelFundingReferenceRequest.d.ts

@@ -1,14 +1,6 @@
-/**
- * Body para cancelar una referencia de funding ya creada. La referencia/fundingId
- * viaja en la URL (`/funding/{moduleName}/{fundingId}/cancel`); este body aporta
- * el contexto del solicitante + idempotencia.
- *
- * NOTA: shape inferido desde el uso en `@fiado/api-invoker`
- * (benefits-marketplace / equality-connector) — confirmar con el dueño del
- * módulo walletFunding / el lambda equality-connector que implementa el cancel.
- */
 export declare class CancelFundingReferenceRequest {
+    /** Referencia Passport (PK de EqualityFundingReference_GT). */
+    reference: string;
     directoryId: string;
-    reason?: string;
     idempotencyKey: string;
 }

package/bin/walletFunding/dtos/CancelFundingReferenceRequest.js

@@ -11,15 +11,6 @@ var __metadata = (this && this.__metadata) || function (k, v) {
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.CancelFundingReferenceRequest = void 0;
 const class_validator_1 = require("class-validator");
-/**
- * Body para cancelar una referencia de funding ya creada. La referencia/fundingId
- * viaja en la URL (`/funding/{moduleName}/{fundingId}/cancel`); este body aporta
- * el contexto del solicitante + idempotencia.
- *
- * NOTA: shape inferido desde el uso en `@fiado/api-invoker`
- * (benefits-marketplace / equality-connector) — confirmar con el dueño del
- * módulo walletFunding / el lambda equality-connector que implementa el cancel.
- */
 class CancelFundingReferenceRequest {
 }
 exports.CancelFundingReferenceRequest = CancelFundingReferenceRequest;
@@ -27,13 +18,12 @@ __decorate([
     (0, class_validator_1.IsString)(),
     (0, class_validator_1.MaxLength)(64),
     __metadata("design:type", String)
-], CancelFundingReferenceRequest.prototype, "directoryId", void 0);
+], CancelFundingReferenceRequest.prototype, "reference", void 0);
 __decorate([
-    (0, class_validator_1.IsOptional)(),
     (0, class_validator_1.IsString)(),
-    (0, class_validator_1.MaxLength)(256),
+    (0, class_validator_1.MaxLength)(64),
     __metadata("design:type", String)
-], CancelFundingReferenceRequest.prototype, "reason", void 0);
+], CancelFundingReferenceRequest.prototype, "directoryId", void 0);
 __decorate([
     (0, class_validator_1.IsString)(),
     (0, class_validator_1.MaxLength)(64),

package/bin/walletFunding/dtos/CancelFundingReferenceResponse.d.ts

@@ -1,14 +1,6 @@
 import { BenefitPaymentStatusEnum } from "../../benefitCenter/enums/BenefitPaymentStatusEnum";
 import { WalletFundingErrorCodeEnum } from "../enums/WalletFundingErrorCodeEnum";
-/**
- * Respuesta de la cancelación de una referencia de funding. Mismo estilo que
- * CreateFundingReferenceResponse.
- *
- * NOTA: shape inferido desde el uso en `@fiado/api-invoker` — confirmar con el
- * dueño del módulo walletFunding / el lambda equality-connector.
- */
 export declare class CancelFundingReferenceResponse {
-    /** Referencia cancelada (misma PK que se creó). */
     reference: string;
     status: BenefitPaymentStatusEnum;
     errorCode?: WalletFundingErrorCodeEnum;

package/bin/walletFunding/dtos/CancelFundingReferenceResponse.js

@@ -1,13 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.CancelFundingReferenceResponse = void 0;
-/**
- * Respuesta de la cancelación de una referencia de funding. Mismo estilo que
- * CreateFundingReferenceResponse.
- *
- * NOTA: shape inferido desde el uso en `@fiado/api-invoker` — confirmar con el
- * dueño del módulo walletFunding / el lambda equality-connector.
- */
 class CancelFundingReferenceResponse {
 }
 exports.CancelFundingReferenceResponse = CancelFundingReferenceResponse;

package/bin/walletFunding/dtos/CancelFundingRequest.d.ts

@@ -0,0 +1,11 @@
+/**
+ * Request del cancel via Centro de Beneficios (spec 13 v2.0).
+ * `reference` viaja en el path, `directoryId` se resuelve del JWT.
+ * `providerModuleName` permite al marketplace rutear al publisher correcto
+ * sin tener que persistir el mapping (el wallet-app sabe el moduleName
+ * porque vino en la respuesta del authorize).
+ */
+export declare class CancelFundingRequest {
+    idempotencyKey: string;
+    providerModuleName: string;
+}

package/bin/walletFunding/dtos/CancelFundingRequest.js

@@ -0,0 +1,33 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CancelFundingRequest = void 0;
+const class_validator_1 = require("class-validator");
+/**
+ * Request del cancel via Centro de Beneficios (spec 13 v2.0).
+ * `reference` viaja en el path, `directoryId` se resuelve del JWT.
+ * `providerModuleName` permite al marketplace rutear al publisher correcto
+ * sin tener que persistir el mapping (el wallet-app sabe el moduleName
+ * porque vino en la respuesta del authorize).
+ */
+class CancelFundingRequest {
+}
+exports.CancelFundingRequest = CancelFundingRequest;
+__decorate([
+    (0, class_validator_1.IsString)(),
+    (0, class_validator_1.MaxLength)(64),
+    __metadata("design:type", String)
+], CancelFundingRequest.prototype, "idempotencyKey", void 0);
+__decorate([
+    (0, class_validator_1.IsString)(),
+    (0, class_validator_1.MaxLength)(128),
+    __metadata("design:type", String)
+], CancelFundingRequest.prototype, "providerModuleName", void 0);

package/bin/walletFunding/dtos/CancelFundingResponse.d.ts

@@ -0,0 +1,14 @@
+import { BenefitPaymentStatusEnum } from "../../benefitCenter/enums/BenefitPaymentStatusEnum";
+import { WalletFundingErrorCodeEnum } from "../enums/WalletFundingErrorCodeEnum";
+/**
+ * Response del cancel via Centro de Beneficios (spec 13 v2.0).
+ * `status` reusa `BenefitPaymentStatusEnum` (APPROVED = cancel aceptado;
+ * REJECTED = no se pudo) para consistencia con `CancelFundingReferenceResponse`
+ * (marketplace ↔ connector). Idempotente: re-cancelar devuelve APPROVED.
+ */
+export declare class CancelFundingResponse {
+    reference: string;
+    status: BenefitPaymentStatusEnum;
+    errorCode?: WalletFundingErrorCodeEnum;
+    message?: string;
+}

package/bin/walletFunding/dtos/CancelFundingResponse.js

@@ -0,0 +1,12 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CancelFundingResponse = void 0;
+/**
+ * Response del cancel via Centro de Beneficios (spec 13 v2.0).
+ * `status` reusa `BenefitPaymentStatusEnum` (APPROVED = cancel aceptado;
+ * REJECTED = no se pudo) para consistencia con `CancelFundingReferenceResponse`
+ * (marketplace ↔ connector). Idempotente: re-cancelar devuelve APPROVED.
+ */
+class CancelFundingResponse {
+}
+exports.CancelFundingResponse = CancelFundingResponse;

package/bin/walletFunding/dtos/CancelWalletFundingResponse.d.ts

@@ -3,5 +3,5 @@ import { WalletFundingErrorCodeEnum } from "../enums/WalletFundingErrorCodeEnum"
 export declare class CancelWalletFundingResponse {
     status: BenefitPaymentStatusEnum;
     errorCode?: WalletFundingErrorCodeEnum;
-    fundingId?: string;
+    reference?: string;
 }

package/bin/walletFunding/dtos/index.d.ts

@@ -7,8 +7,6 @@ export * from "./ListWalletFundingReferencesRequest";
 export * from "./ListWalletFundingReferencesResponse";
 export * from "./CreateFundingReferenceRequest";
 export * from "./CreateFundingReferenceResponse";
-export * from "./CancelFundingReferenceRequest";
-export * from "./CancelFundingReferenceResponse";
 export * from "./ListFundingReferencesRequest";
 export * from "./ListFundingReferencesResponse";
 export * from "./ValidateWalletFundingRequest";

package/bin/walletFunding/dtos/index.js

@@ -23,8 +23,6 @@ __exportStar(require("./ListWalletFundingReferencesRequest"), exports);
 __exportStar(require("./ListWalletFundingReferencesResponse"), exports);
 __exportStar(require("./CreateFundingReferenceRequest"), exports);
 __exportStar(require("./CreateFundingReferenceResponse"), exports);
-__exportStar(require("./CancelFundingReferenceRequest"), exports);
-__exportStar(require("./CancelFundingReferenceResponse"), exports);
 __exportStar(require("./ListFundingReferencesRequest"), exports);
 __exportStar(require("./ListFundingReferencesResponse"), exports);
 __exportStar(require("./ValidateWalletFundingRequest"), exports);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fiado/type-kit",
-  "version": "3.115.0",
+  "version": "3.116.0",
   "description": "",
   "main": "bin/index.js",
   "types": "bin/index.d.ts",

package/src/cognitoBackofficeConnector/dtos/VerifyPasswordResponse.ts

@@ -1,7 +1,15 @@
-import { Expose } from 'class-transformer';
-import { IsBoolean, IsEnum, IsObject, IsOptional, IsString } from 'class-validator';
+import { Expose, Type } from 'class-transformer';
+import { IsBoolean, IsEnum, IsNumber, IsObject, IsOptional, IsString, ValidateNested } from 'class-validator';
 import { CognitoChallengeType } from '../enums/CognitoChallengeType';
 
+export class VerifyPasswordTokens {
+    @Expose() @IsString() accessToken!: string;
+    @Expose() @IsString() idToken!: string;
+    @Expose() @IsString() refreshToken!: string;
+    @Expose() @IsNumber() expiresIn!: number;
+    @Expose() @IsString() tokenType!: string;
+}
+
 /**
  * Respuesta de `POST /auth/verify-password`.
  *
@@ -21,4 +29,8 @@ export class VerifyPasswordResponse {
     @Expose() @IsOptional() @IsString() session?: string;
 
     @Expose() @IsOptional() @IsObject() challengeParameters?: Record<string, string>;
+
+    // DEC-RBAC-045: tokens directos de ADMIN_USER_PASSWORD_AUTH cuando no hay challenge. El rbac SOLO
+    // los usa si el tenant tiene mfaEnabled=false. Aditivo, backward-compatible.
+    @Expose() @IsOptional() @ValidateNested() @Type(() => VerifyPasswordTokens) tokens?: VerifyPasswordTokens;
 }

package/src/platformRbac/application/Application.ts

@@ -9,6 +9,8 @@ export interface LevelDef {
 }
 
 export interface ApplicationSecurityPolicyDefault {
+    // DEC-RBAC-045: 2FA master switch por tenant. Ausente ⇒ habilitado (secure-by-default).
+    mfaEnabled?: boolean;
     mfaRequired?: boolean;
     methodsAllowed?: Array<'TOTP' | 'EMAIL'>;
     defaultPreferred?: 'TOTP' | 'EMAIL';

package/src/platformRbac/dtos/TenantSecurityPolicyResponse.ts

@@ -7,4 +7,7 @@
  */
 export interface TenantSecurityPolicyResponse {
     methodsAllowed: ('EMAIL' | 'TOTP')[];
+
+    // DEC-RBAC-045: 2FA master switch por tenant. Ausente ⇒ habilitado (secure-by-default).
+    mfaEnabled?: boolean;
 }

package/src/platformRbac/dtos/UpdateTenantSecurityPolicyRequest.ts

@@ -1,11 +1,16 @@
 import { Expose } from 'class-transformer';
-import { ArrayNotEmpty, IsIn } from 'class-validator';
+import { ArrayNotEmpty, IsBoolean, IsIn, IsOptional } from 'class-validator';
 
-// TD-RBAC-071: methodsAllowed usa el value-set 'EMAIL'|'TOTP' (string), distinto de MfaMethodEnum
-// ('EMAIL_OTP'|'TOTP') a propósito. Ver TECH_DEBT.md del platform-rbac-business.
+// TD-RBAC-071: methodsAllowed usa el value-set 'EMAIL'|'TOTP' (string), distinto de MfaMethodEnum.
 export class UpdateTenantSecurityPolicyRequest {
     @Expose()
     @ArrayNotEmpty()
     @IsIn(['EMAIL', 'TOTP'], { each: true })
     methodsAllowed!: ('EMAIL' | 'TOTP')[];
+
+    // DEC-RBAC-045: 2FA master switch por tenant. Ausente ⇒ habilitado (secure-by-default).
+    @Expose()
+    @IsOptional()
+    @IsBoolean()
+    mfaEnabled?: boolean;
 }

package/src/walletFunding/dtos/index.ts

@@ -7,8 +7,6 @@ export * from "./ListWalletFundingReferencesRequest";
 export * from "./ListWalletFundingReferencesResponse";
 export * from "./CreateFundingReferenceRequest";
 export * from "./CreateFundingReferenceResponse";
-export * from "./CancelFundingReferenceRequest";
-export * from "./CancelFundingReferenceResponse";
 export * from "./ListFundingReferencesRequest";
 export * from "./ListFundingReferencesResponse";
 export * from "./ValidateWalletFundingRequest";

package/src/walletFunding/dtos/CancelFundingReferenceRequest.ts

@@ -1,16 +0,0 @@
-import { IsString, IsOptional, MaxLength } from "class-validator";
-
-/**
- * Body para cancelar una referencia de funding ya creada. La referencia/fundingId
- * viaja en la URL (`/funding/{moduleName}/{fundingId}/cancel`); este body aporta
- * el contexto del solicitante + idempotencia.
- *
- * NOTA: shape inferido desde el uso en `@fiado/api-invoker`
- * (benefits-marketplace / equality-connector) — confirmar con el dueño del
- * módulo walletFunding / el lambda equality-connector que implementa el cancel.
- */
-export class CancelFundingReferenceRequest {
-    @IsString() @MaxLength(64) directoryId!: string;
-    @IsOptional() @IsString() @MaxLength(256) reason?: string;
-    @IsString() @MaxLength(64) idempotencyKey!: string;
-}

package/src/walletFunding/dtos/CancelFundingReferenceResponse.ts

@@ -1,16 +0,0 @@
-import { BenefitPaymentStatusEnum } from "../../benefitCenter/enums/BenefitPaymentStatusEnum";
-import { WalletFundingErrorCodeEnum } from "../enums/WalletFundingErrorCodeEnum";
-
-/**
- * Respuesta de la cancelación de una referencia de funding. Mismo estilo que
- * CreateFundingReferenceResponse.
- *
- * NOTA: shape inferido desde el uso en `@fiado/api-invoker` — confirmar con el
- * dueño del módulo walletFunding / el lambda equality-connector.
- */
-export class CancelFundingReferenceResponse {
-    /** Referencia cancelada (misma PK que se creó). */
-    reference!: string;
-    status!: BenefitPaymentStatusEnum;
-    errorCode?: WalletFundingErrorCodeEnum;
-}