@fiado/type-kit 3.116.0 → 3.118.0

package/bin/platformRbac/application/Application.d.ts

@@ -28,12 +28,23 @@ export interface ApplicationBrandingDefault {
     faviconUrl?: string;
     webappBaseUrl?: string;
 }
+export interface AutoregisterAllowedRole {
+    roleId: string;
+    scope: PermissionScope;
+    allowedScopeRefs?: string[];
+}
+export interface AutoregisterConfig {
+    enabled: boolean;
+    allowedRoles: AutoregisterAllowedRole[];
+    otpTtlSeconds?: number;
+}
 export interface ApplicationDefaults {
     externalScopeLevels?: PermissionScope[];
     userFieldDefs?: UserFieldDef[];
     securityPolicy?: ApplicationSecurityPolicyDefault;
     brandingConfig?: ApplicationBrandingDefault;
     tokenValidationMode?: TokenValidationMode;
+    autoregister?: AutoregisterConfig;
 }
 export interface SeedRole {
     roleId: string;

package/bin/platformRbac/dtos/SelfRegisterCompleteRequest.d.ts

@@ -1,21 +1,18 @@
 /**
  * Body del POST /self-register/complete (público, anónimo). DEC-RBAC-033.
  * Consume el `completionToken` del verify-otp (validación condicional atómica server-side, anti
- * doble-complete). La password la elige el usuario y nace permanente (usuario ACTIVE). `displayName`
- * y `customFields` son opcionales (point 6): si llegan completos, `profileComplete=true` y se saltea
- * el gate post-MFA; si no, el usuario nace `profileComplete=false` con displayName placeholder.
+ * doble-complete). La password la elige el usuario y nace permanente (usuario ACTIVE).
  * La password NUNCA se persiste: viaja solo acá, directo a Cognito.
+ * DEC-RBAC-046: el autoregistro ya no captura perfil (displayName/customFields). El usuario nace
+ * ACTIVE sin paso de perfil; no hay gate post-MFA ni `profileComplete`.
  */
 export declare class SelfRegisterCompleteRequest {
     tenantId: string;
     email: string;
     completionToken: string;
     password: string;
-    displayName?: string;
-    customFields?: Record<string, string>;
 }
-/** Respuesta del complete. El usuario nace ACTIVE; `profileComplete` indica si falta completar perfil. */
+/** Respuesta del complete. El usuario nace ACTIVE. DEC-RBAC-046: sin `profileComplete`. */
 export interface SelfRegisterCompleteResponse {
     cognitoSub: string;
-    profileComplete: boolean;
 }

package/bin/platformRbac/dtos/SelfRegisterCompleteRequest.js

@@ -15,10 +15,10 @@ const class_validator_1 = require("class-validator");
 /**
  * Body del POST /self-register/complete (público, anónimo). DEC-RBAC-033.
  * Consume el `completionToken` del verify-otp (validación condicional atómica server-side, anti
- * doble-complete). La password la elige el usuario y nace permanente (usuario ACTIVE). `displayName`
- * y `customFields` son opcionales (point 6): si llegan completos, `profileComplete=true` y se saltea
- * el gate post-MFA; si no, el usuario nace `profileComplete=false` con displayName placeholder.
+ * doble-complete). La password la elige el usuario y nace permanente (usuario ACTIVE).
  * La password NUNCA se persiste: viaja solo acá, directo a Cognito.
+ * DEC-RBAC-046: el autoregistro ya no captura perfil (displayName/customFields). El usuario nace
+ * ACTIVE sin paso de perfil; no hay gate post-MFA ni `profileComplete`.
  */
 class SelfRegisterCompleteRequest {
 }
@@ -46,15 +46,3 @@ __decorate([
     (0, class_validator_1.MinLength)(8),
     __metadata("design:type", String)
 ], SelfRegisterCompleteRequest.prototype, "password", void 0);
-__decorate([
-    (0, class_transformer_1.Expose)(),
-    (0, class_validator_1.IsOptional)(),
-    (0, class_validator_1.IsString)(),
-    __metadata("design:type", String)
-], SelfRegisterCompleteRequest.prototype, "displayName", void 0);
-__decorate([
-    (0, class_transformer_1.Expose)(),
-    (0, class_validator_1.IsOptional)(),
-    (0, class_validator_1.IsObject)(),
-    __metadata("design:type", Object)
-], SelfRegisterCompleteRequest.prototype, "customFields", void 0);

package/bin/platformRbac/index.d.ts

@@ -36,10 +36,9 @@ export * from './dtos/UpdateUserFieldRequest';
 export type { InjectableUserAttributesResponse } from './dtos/InjectableUserAttributesResponse';
 export * from './enums/ApplicationStatus';
 export * from './enums/PermissionKind';
-export type { LevelDef, ApplicationSecurityPolicyDefault, ApplicationBrandingDefault, ApplicationDefaults, SeedRole, Application, } from './application/Application';
+export type { LevelDef, ApplicationSecurityPolicyDefault, ApplicationBrandingDefault, AutoregisterAllowedRole, AutoregisterConfig, ApplicationDefaults, SeedRole, Application, } from './application/Application';
 export type { ApplicationPermission } from './application/ApplicationPermission';
 export type { CreateApplicationRequest, UpdateApplicationRequest, UpsertApplicationPermissionRequest, } from './application/requests';
 export * from './dtos/SelfRegisterStartRequest';
 export * from './dtos/SelfRegisterVerifyOtpRequest';
 export * from './dtos/SelfRegisterCompleteRequest';
-export * from './dtos/CompleteMyProfileRequest';

package/bin/platformRbac/index.js

@@ -92,4 +92,3 @@ __exportStar(require("./enums/PermissionKind"), exports);
 __exportStar(require("./dtos/SelfRegisterStartRequest"), exports);
 __exportStar(require("./dtos/SelfRegisterVerifyOtpRequest"), exports);
 __exportStar(require("./dtos/SelfRegisterCompleteRequest"), exports);
-__exportStar(require("./dtos/CompleteMyProfileRequest"), exports);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fiado/type-kit",
-  "version": "3.116.0",
+  "version": "3.118.0",
   "description": "",
   "main": "bin/index.js",
   "types": "bin/index.d.ts",

package/src/platformRbac/application/Application.ts

@@ -23,12 +23,29 @@ export interface ApplicationBrandingDefault {
     logoWidth?: number; faviconUrl?: string; webappBaseUrl?: string;
 }
 
+// DEC-RBAC-038: config de autoregistro self-service. Promovido desde el tipo local
+// `PlatformTenantConfigRow.AutoregisterConfig` del platform-rbac-business a shape compartido
+// (patrón stub→swap DEC-001). `allowedRoles` es la allowlist anti-escalación que valida el
+// server contra el roleId/scope/scopeRef del SelfRegisterStartRequest.
+export interface AutoregisterAllowedRole {
+    roleId: string;
+    scope: PermissionScope;
+    allowedScopeRefs?: string[];
+}
+
+export interface AutoregisterConfig {
+    enabled: boolean;
+    allowedRoles: AutoregisterAllowedRole[];
+    otpTtlSeconds?: number;
+}
+
 export interface ApplicationDefaults {
     externalScopeLevels?: PermissionScope[];
     userFieldDefs?: UserFieldDef[];
     securityPolicy?: ApplicationSecurityPolicyDefault;
     brandingConfig?: ApplicationBrandingDefault;
     tokenValidationMode?: TokenValidationMode;
+    autoregister?: AutoregisterConfig;
 }
 
 export interface SeedRole {

package/src/platformRbac/dtos/SelfRegisterCompleteRequest.ts

@@ -1,25 +1,22 @@
 import { Expose } from 'class-transformer';
-import { IsEmail, IsNotEmpty, IsObject, IsOptional, IsString, MinLength } from 'class-validator';
+import { IsEmail, IsNotEmpty, IsString, MinLength } from 'class-validator';
 
 /**
  * Body del POST /self-register/complete (público, anónimo). DEC-RBAC-033.
  * Consume el `completionToken` del verify-otp (validación condicional atómica server-side, anti
- * doble-complete). La password la elige el usuario y nace permanente (usuario ACTIVE). `displayName`
- * y `customFields` son opcionales (point 6): si llegan completos, `profileComplete=true` y se saltea
- * el gate post-MFA; si no, el usuario nace `profileComplete=false` con displayName placeholder.
+ * doble-complete). La password la elige el usuario y nace permanente (usuario ACTIVE).
  * La password NUNCA se persiste: viaja solo acá, directo a Cognito.
+ * DEC-RBAC-046: el autoregistro ya no captura perfil (displayName/customFields). El usuario nace
+ * ACTIVE sin paso de perfil; no hay gate post-MFA ni `profileComplete`.
  */
 export class SelfRegisterCompleteRequest {
     @Expose() @IsString() @IsNotEmpty() tenantId!: string;
     @Expose() @IsEmail() email!: string;
     @Expose() @IsString() @IsNotEmpty() completionToken!: string;
     @Expose() @IsString() @MinLength(8) password!: string;
-    @Expose() @IsOptional() @IsString() displayName?: string;
-    @Expose() @IsOptional() @IsObject() customFields?: Record<string, string>;
 }
 
-/** Respuesta del complete. El usuario nace ACTIVE; `profileComplete` indica si falta completar perfil. */
+/** Respuesta del complete. El usuario nace ACTIVE. DEC-RBAC-046: sin `profileComplete`. */
 export interface SelfRegisterCompleteResponse {
     cognitoSub: string;
-    profileComplete: boolean;
 }

package/src/platformRbac/index.ts

@@ -83,6 +83,8 @@ export type {
     LevelDef,
     ApplicationSecurityPolicyDefault,
     ApplicationBrandingDefault,
+    AutoregisterAllowedRole,
+    AutoregisterConfig,
     ApplicationDefaults,
     SeedRole,
     Application,
@@ -100,4 +102,3 @@ export type {
 export * from './dtos/SelfRegisterStartRequest';
 export * from './dtos/SelfRegisterVerifyOtpRequest';
 export * from './dtos/SelfRegisterCompleteRequest';
-export * from './dtos/CompleteMyProfileRequest';

package/bin/platformRbac/dtos/CompleteMyProfileRequest.d.ts

@@ -1,9 +0,0 @@
-/**
- * Body del PUT /me/profile/complete (autenticado, gate post-MFA del autoregistro). DEC-RBAC-034.
- * Opera sobre el propio usuario (cognitoSub del token). Valida nombre + los `userFieldDefs` requeridos
- * del tenant (422 MISSING_REQUIRED_FIELDS si faltan) y flipea `profileComplete=true`.
- */
-export declare class CompleteMyProfileRequest {
-    displayName: string;
-    customFields?: Record<string, string>;
-}

package/bin/platformRbac/dtos/CompleteMyProfileRequest.js

@@ -1,34 +0,0 @@
-"use strict";
-var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
-    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
-    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
-    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
-    return c > 3 && r && Object.defineProperty(target, key, r), r;
-};
-var __metadata = (this && this.__metadata) || function (k, v) {
-    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
-};
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.CompleteMyProfileRequest = void 0;
-const class_transformer_1 = require("class-transformer");
-const class_validator_1 = require("class-validator");
-/**
- * Body del PUT /me/profile/complete (autenticado, gate post-MFA del autoregistro). DEC-RBAC-034.
- * Opera sobre el propio usuario (cognitoSub del token). Valida nombre + los `userFieldDefs` requeridos
- * del tenant (422 MISSING_REQUIRED_FIELDS si faltan) y flipea `profileComplete=true`.
- */
-class CompleteMyProfileRequest {
-}
-exports.CompleteMyProfileRequest = CompleteMyProfileRequest;
-__decorate([
-    (0, class_transformer_1.Expose)(),
-    (0, class_validator_1.IsString)(),
-    (0, class_validator_1.IsNotEmpty)(),
-    __metadata("design:type", String)
-], CompleteMyProfileRequest.prototype, "displayName", void 0);
-__decorate([
-    (0, class_transformer_1.Expose)(),
-    (0, class_validator_1.IsOptional)(),
-    (0, class_validator_1.IsObject)(),
-    __metadata("design:type", Object)
-], CompleteMyProfileRequest.prototype, "customFields", void 0);

package/bin/walletFunding/dtos/CancelFundingReferenceRequest.d.ts

@@ -1,6 +0,0 @@
-export declare class CancelFundingReferenceRequest {
-    /** Referencia Passport (PK de EqualityFundingReference_GT). */
-    reference: string;
-    directoryId: string;
-    idempotencyKey: string;
-}

package/bin/walletFunding/dtos/CancelFundingReferenceRequest.js

@@ -1,31 +0,0 @@
-"use strict";
-var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
-    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
-    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
-    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
-    return c > 3 && r && Object.defineProperty(target, key, r), r;
-};
-var __metadata = (this && this.__metadata) || function (k, v) {
-    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
-};
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.CancelFundingReferenceRequest = void 0;
-const class_validator_1 = require("class-validator");
-class CancelFundingReferenceRequest {
-}
-exports.CancelFundingReferenceRequest = CancelFundingReferenceRequest;
-__decorate([
-    (0, class_validator_1.IsString)(),
-    (0, class_validator_1.MaxLength)(64),
-    __metadata("design:type", String)
-], CancelFundingReferenceRequest.prototype, "reference", void 0);
-__decorate([
-    (0, class_validator_1.IsString)(),
-    (0, class_validator_1.MaxLength)(64),
-    __metadata("design:type", String)
-], CancelFundingReferenceRequest.prototype, "directoryId", void 0);
-__decorate([
-    (0, class_validator_1.IsString)(),
-    (0, class_validator_1.MaxLength)(64),
-    __metadata("design:type", String)
-], CancelFundingReferenceRequest.prototype, "idempotencyKey", void 0);

package/bin/walletFunding/dtos/CancelFundingReferenceResponse.d.ts

@@ -1,7 +0,0 @@
-import { BenefitPaymentStatusEnum } from "../../benefitCenter/enums/BenefitPaymentStatusEnum";
-import { WalletFundingErrorCodeEnum } from "../enums/WalletFundingErrorCodeEnum";
-export declare class CancelFundingReferenceResponse {
-    reference: string;
-    status: BenefitPaymentStatusEnum;
-    errorCode?: WalletFundingErrorCodeEnum;
-}

package/bin/walletFunding/dtos/CancelFundingReferenceResponse.js

@@ -1,6 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.CancelFundingReferenceResponse = void 0;
-class CancelFundingReferenceResponse {
-}
-exports.CancelFundingReferenceResponse = CancelFundingReferenceResponse;

package/bin/walletFunding/dtos/CancelFundingRequest.d.ts

@@ -1,11 +0,0 @@
-/**
- * Request del cancel via Centro de Beneficios (spec 13 v2.0).
- * `reference` viaja en el path, `directoryId` se resuelve del JWT.
- * `providerModuleName` permite al marketplace rutear al publisher correcto
- * sin tener que persistir el mapping (el wallet-app sabe el moduleName
- * porque vino en la respuesta del authorize).
- */
-export declare class CancelFundingRequest {
-    idempotencyKey: string;
-    providerModuleName: string;
-}

package/bin/walletFunding/dtos/CancelFundingRequest.js

@@ -1,33 +0,0 @@
-"use strict";
-var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
-    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
-    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
-    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
-    return c > 3 && r && Object.defineProperty(target, key, r), r;
-};
-var __metadata = (this && this.__metadata) || function (k, v) {
-    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
-};
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.CancelFundingRequest = void 0;
-const class_validator_1 = require("class-validator");
-/**
- * Request del cancel via Centro de Beneficios (spec 13 v2.0).
- * `reference` viaja en el path, `directoryId` se resuelve del JWT.
- * `providerModuleName` permite al marketplace rutear al publisher correcto
- * sin tener que persistir el mapping (el wallet-app sabe el moduleName
- * porque vino en la respuesta del authorize).
- */
-class CancelFundingRequest {
-}
-exports.CancelFundingRequest = CancelFundingRequest;
-__decorate([
-    (0, class_validator_1.IsString)(),
-    (0, class_validator_1.MaxLength)(64),
-    __metadata("design:type", String)
-], CancelFundingRequest.prototype, "idempotencyKey", void 0);
-__decorate([
-    (0, class_validator_1.IsString)(),
-    (0, class_validator_1.MaxLength)(128),
-    __metadata("design:type", String)
-], CancelFundingRequest.prototype, "providerModuleName", void 0);

package/bin/walletFunding/dtos/CancelFundingResponse.d.ts

@@ -1,14 +0,0 @@
-import { BenefitPaymentStatusEnum } from "../../benefitCenter/enums/BenefitPaymentStatusEnum";
-import { WalletFundingErrorCodeEnum } from "../enums/WalletFundingErrorCodeEnum";
-/**
- * Response del cancel via Centro de Beneficios (spec 13 v2.0).
- * `status` reusa `BenefitPaymentStatusEnum` (APPROVED = cancel aceptado;
- * REJECTED = no se pudo) para consistencia con `CancelFundingReferenceResponse`
- * (marketplace ↔ connector). Idempotente: re-cancelar devuelve APPROVED.
- */
-export declare class CancelFundingResponse {
-    reference: string;
-    status: BenefitPaymentStatusEnum;
-    errorCode?: WalletFundingErrorCodeEnum;
-    message?: string;
-}

package/bin/walletFunding/dtos/CancelFundingResponse.js

@@ -1,12 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.CancelFundingResponse = void 0;
-/**
- * Response del cancel via Centro de Beneficios (spec 13 v2.0).
- * `status` reusa `BenefitPaymentStatusEnum` (APPROVED = cancel aceptado;
- * REJECTED = no se pudo) para consistencia con `CancelFundingReferenceResponse`
- * (marketplace ↔ connector). Idempotente: re-cancelar devuelve APPROVED.
- */
-class CancelFundingResponse {
-}
-exports.CancelFundingResponse = CancelFundingResponse;

package/bin/walletFunding/dtos/CancelWalletFundingRequest.d.ts

@@ -1,3 +0,0 @@
-export declare class CancelWalletFundingRequest {
-    idempotencyKey: string;
-}

package/bin/walletFunding/dtos/CancelWalletFundingRequest.js

@@ -1,21 +0,0 @@
-"use strict";
-var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
-    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
-    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
-    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
-    return c > 3 && r && Object.defineProperty(target, key, r), r;
-};
-var __metadata = (this && this.__metadata) || function (k, v) {
-    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
-};
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.CancelWalletFundingRequest = void 0;
-const class_validator_1 = require("class-validator");
-class CancelWalletFundingRequest {
-}
-exports.CancelWalletFundingRequest = CancelWalletFundingRequest;
-__decorate([
-    (0, class_validator_1.IsString)(),
-    (0, class_validator_1.MaxLength)(64),
-    __metadata("design:type", String)
-], CancelWalletFundingRequest.prototype, "idempotencyKey", void 0);

package/bin/walletFunding/dtos/CancelWalletFundingResponse.d.ts

@@ -1,7 +0,0 @@
-import { BenefitPaymentStatusEnum } from "../../benefitCenter/enums/BenefitPaymentStatusEnum";
-import { WalletFundingErrorCodeEnum } from "../enums/WalletFundingErrorCodeEnum";
-export declare class CancelWalletFundingResponse {
-    status: BenefitPaymentStatusEnum;
-    errorCode?: WalletFundingErrorCodeEnum;
-    reference?: string;
-}

package/bin/walletFunding/dtos/CancelWalletFundingResponse.js

@@ -1,6 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.CancelWalletFundingResponse = void 0;
-class CancelWalletFundingResponse {
-}
-exports.CancelWalletFundingResponse = CancelWalletFundingResponse;

package/src/platformRbac/dtos/CompleteMyProfileRequest.ts

@@ -1,12 +0,0 @@
-import { Expose } from 'class-transformer';
-import { IsNotEmpty, IsObject, IsOptional, IsString } from 'class-validator';
-
-/**
- * Body del PUT /me/profile/complete (autenticado, gate post-MFA del autoregistro). DEC-RBAC-034.
- * Opera sobre el propio usuario (cognitoSub del token). Valida nombre + los `userFieldDefs` requeridos
- * del tenant (422 MISSING_REQUIRED_FIELDS si faltan) y flipea `profileComplete=true`.
- */
-export class CompleteMyProfileRequest {
-    @Expose() @IsString() @IsNotEmpty() displayName!: string;
-    @Expose() @IsOptional() @IsObject() customFields?: Record<string, string>;
-}