@fiado/type-kit 3.142.0 → 3.143.0

package/_test_/unit/platformRbac/dtos/CreateTenantRequest.test.ts

@@ -86,9 +86,10 @@ describe('CreateTenantRequest', () => {
     });
 
     it('falla si securityPolicy.methodsAllowed tiene un método fuera del value-set', async () => {
+        // DEC-RBAC-085: 'SMS' pasó a ser válido; usamos un valor realmente fuera del set.
         const dto = plainToInstance(CreateTenantRequest, {
             ...valid,
-            securityPolicy: { methodsAllowed: ['SMS'] },
+            securityPolicy: { methodsAllowed: ['PUSH'] },
         });
         const errors = await validate(dto);
         expect(errors.some(e => e.property === 'securityPolicy')).toBe(true);

package/bin/platformRbac/application/Application.d.ts

@@ -9,7 +9,7 @@ export interface LevelDef {
 }
 export interface ApplicationSecurityPolicyDefault {
     mfaEnabled?: boolean;
-    methodsAllowed?: Array<'TOTP' | 'EMAIL'>;
+    methodsAllowed?: Array<'TOTP' | 'EMAIL' | 'SMS'>;
 }
 export interface ApplicationBrandingDefault {
     logoUrl?: string;

package/bin/platformRbac/dtos/CreateTenantRequest.d.ts

@@ -9,7 +9,7 @@ import { TokenValidationMode } from '../enums/TokenValidationMode';
  * (@ArrayNotEmpty); en el create es opcional.
  */
 export declare class CreateTenantSecurityPolicy {
-    methodsAllowed?: ('EMAIL' | 'TOTP')[];
+    methodsAllowed?: ('EMAIL' | 'TOTP' | 'SMS')[];
     mfaEnabled?: boolean;
 }
 /**

package/bin/platformRbac/dtos/CreateTenantRequest.js

@@ -29,7 +29,7 @@ __decorate([
     (0, class_transformer_1.Expose)(),
     (0, class_validator_1.IsOptional)(),
     (0, class_validator_1.IsArray)(),
-    (0, class_validator_1.IsIn)(['EMAIL', 'TOTP'], { each: true }),
+    (0, class_validator_1.IsIn)(['EMAIL', 'TOTP', 'SMS'], { each: true }),
     __metadata("design:type", Array)
 ], CreateTenantSecurityPolicy.prototype, "methodsAllowed", void 0);
 __decorate([

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fiado/type-kit",
-  "version": "3.142.0",
+  "version": "3.143.0",
   "description": "",
   "main": "bin/index.js",
   "types": "bin/index.d.ts",

package/src/platformRbac/application/Application.ts

@@ -12,7 +12,8 @@ export interface LevelDef {
 export interface ApplicationSecurityPolicyDefault {
     // DEC-RBAC-045: 2FA master switch por tenant. Ausente ⇒ habilitado (secure-by-default).
     mfaEnabled?: boolean;
-    methodsAllowed?: Array<'TOTP' | 'EMAIL'>;
+    // DEC-RBAC-085: 'SMS' se suma como 3er método de MFA tenant-controlado.
+    methodsAllowed?: Array<'TOTP' | 'EMAIL' | 'SMS'>;
     // DEC-RBAC-051: purgados mfaRequired / defaultPreferred / sessionTimeoutMin (write-only sin enforcement).
     // DEC-RBAC-052: passwordPolicy deja de ser per-tenant → política global por env vars (Cognito enforce).
 }

package/src/platformRbac/dtos/CreateTenantRequest.ts

@@ -22,8 +22,9 @@ import { TokenValidationMode } from '../enums/TokenValidationMode';
  * (@ArrayNotEmpty); en el create es opcional.
  */
 export class CreateTenantSecurityPolicy {
-    @Expose() @IsOptional() @IsArray() @IsIn(['EMAIL', 'TOTP'], { each: true })
-    methodsAllowed?: ('EMAIL' | 'TOTP')[];
+    // DEC-RBAC-085: 'SMS' se suma como 3er método de MFA tenant-controlado.
+    @Expose() @IsOptional() @IsArray() @IsIn(['EMAIL', 'TOTP', 'SMS'], { each: true })
+    methodsAllowed?: ('EMAIL' | 'TOTP' | 'SMS')[];
 
     @Expose() @IsOptional() @IsBoolean()
     mfaEnabled?: boolean;