@fiado/type-kit 3.165.0 → 3.167.0

package/_test_/unit/emailVerification/enums/EmailVerificationStatusEnum.test.ts

@@ -1,17 +1,17 @@
-import { EmailVerificationStatusEnum } from '../../../../src/emailVerification/enums/EmailVerificationStatusEnum';
-
-describe('EmailVerificationStatusEnum', () => {
-    it('contiene exactamente los 5 estados del contrato con value === key', () => {
-        expect(EmailVerificationStatusEnum.PENDING).toBe('PENDING');
-        expect(EmailVerificationStatusEnum.SENT).toBe('SENT');
-        expect(EmailVerificationStatusEnum.VERIFIED).toBe('VERIFIED');
-        expect(EmailVerificationStatusEnum.EXPIRED).toBe('EXPIRED');
-        expect(EmailVerificationStatusEnum.FAILED).toBe('FAILED');
-    });
-
-    it('no tiene estados de más', () => {
-        expect(Object.values(EmailVerificationStatusEnum).sort()).toEqual(
-            ['EXPIRED', 'FAILED', 'PENDING', 'SENT', 'VERIFIED'],
-        );
-    });
-});
+import { EmailVerificationStatusEnum } from '../../../../src/emailVerification/enums/EmailVerificationStatusEnum';
+
+describe('EmailVerificationStatusEnum', () => {
+    it('contiene exactamente los 5 estados del contrato con value === key', () => {
+        expect(EmailVerificationStatusEnum.PENDING).toBe('PENDING');
+        expect(EmailVerificationStatusEnum.SENT).toBe('SENT');
+        expect(EmailVerificationStatusEnum.VERIFIED).toBe('VERIFIED');
+        expect(EmailVerificationStatusEnum.EXPIRED).toBe('EXPIRED');
+        expect(EmailVerificationStatusEnum.FAILED).toBe('FAILED');
+    });
+
+    it('no tiene estados de más', () => {
+        expect(Object.values(EmailVerificationStatusEnum).sort()).toEqual(
+            ['EXPIRED', 'FAILED', 'PENDING', 'SENT', 'VERIFIED'],
+        );
+    });
+});

package/_test_/unit/platformRbac/auth/PrepareChallengeRequest.test.ts

@@ -1,64 +1,64 @@
-import 'reflect-metadata';
-import { plainToInstance } from 'class-transformer';
-import { validate } from 'class-validator';
-import { PrepareChallengeRequest } from '../../../../src/platformRbac/auth/PrepareChallengeRequest';
-import { ChallengeNameEnum } from '../../../../src/platformRbac/enums/ChallengeNameEnum';
-
-/**
- * DEC-RBAC-093: `email` es opcional y robusto a string vacío. Un usuario phone-primario
- * (sin email) hace login MFA (SMS_OTP / TOTP) sin email — el trigger CreateAuthChallenge
- * ya no manda `''`. `@ValidateIf` saltea undefined/null/'' (`@IsOptional` NO saltea `''`).
- * La rama EMAIL_OTP del preparer sigue necesitando email en runtime — eso NO lo valida el DTO.
- */
-describe('PrepareChallengeRequest', () => {
-    const base = {
-        cognitoSub: 'f4586478-20c1-700c-c40a-2396db1affe3',
-        challengeName: ChallengeNameEnum.SMS_OTP,
-        phone: '+524422194128',
-    };
-
-    it('valida SMS_OTP sin email (undefined)', async () => {
-        const dto = plainToInstance(PrepareChallengeRequest, { ...base });
-        const errors = await validate(dto);
-        expect(errors).toEqual([]);
-    });
-
-    it('valida SMS_OTP con email = "" (string vacío del trigger legacy)', async () => {
-        const dto = plainToInstance(PrepareChallengeRequest, { ...base, email: '' });
-        const errors = await validate(dto);
-        expect(errors).toEqual([]);
-    });
-
-    it('valida SMS_OTP con email = null', async () => {
-        const dto = plainToInstance(PrepareChallengeRequest, { ...base, email: null });
-        const errors = await validate(dto);
-        expect(errors).toEqual([]);
-    });
-
-    it('valida cuando email SÍ viene y es un email válido', async () => {
-        const dto = plainToInstance(PrepareChallengeRequest, {
-            ...base,
-            challengeName: ChallengeNameEnum.EMAIL_OTP,
-            email: 'user@dominio.com',
-        });
-        const errors = await validate(dto);
-        expect(errors).toEqual([]);
-    });
-
-    it('falla cuando email viene pero NO es un email válido', async () => {
-        const dto = plainToInstance(PrepareChallengeRequest, { ...base, email: 'no-es-email' });
-        const errors = await validate(dto);
-        expect(errors.length).toBeGreaterThan(0);
-        expect(errors[0].property).toBe('email');
-    });
-
-    it('falla si challengeName no es un valor del enum', async () => {
-        const dto = plainToInstance(PrepareChallengeRequest, {
-            ...base,
-            challengeName: 'BOGUS' as ChallengeNameEnum,
-        });
-        const errors = await validate(dto);
-        expect(errors.length).toBeGreaterThan(0);
-        expect(errors[0].property).toBe('challengeName');
-    });
-});
+import 'reflect-metadata';
+import { plainToInstance } from 'class-transformer';
+import { validate } from 'class-validator';
+import { PrepareChallengeRequest } from '../../../../src/platformRbac/auth/PrepareChallengeRequest';
+import { ChallengeNameEnum } from '../../../../src/platformRbac/enums/ChallengeNameEnum';
+
+/**
+ * DEC-RBAC-093: `email` es opcional y robusto a string vacío. Un usuario phone-primario
+ * (sin email) hace login MFA (SMS_OTP / TOTP) sin email — el trigger CreateAuthChallenge
+ * ya no manda `''`. `@ValidateIf` saltea undefined/null/'' (`@IsOptional` NO saltea `''`).
+ * La rama EMAIL_OTP del preparer sigue necesitando email en runtime — eso NO lo valida el DTO.
+ */
+describe('PrepareChallengeRequest', () => {
+    const base = {
+        cognitoSub: 'f4586478-20c1-700c-c40a-2396db1affe3',
+        challengeName: ChallengeNameEnum.SMS_OTP,
+        phone: '+524422194128',
+    };
+
+    it('valida SMS_OTP sin email (undefined)', async () => {
+        const dto = plainToInstance(PrepareChallengeRequest, { ...base });
+        const errors = await validate(dto);
+        expect(errors).toEqual([]);
+    });
+
+    it('valida SMS_OTP con email = "" (string vacío del trigger legacy)', async () => {
+        const dto = plainToInstance(PrepareChallengeRequest, { ...base, email: '' });
+        const errors = await validate(dto);
+        expect(errors).toEqual([]);
+    });
+
+    it('valida SMS_OTP con email = null', async () => {
+        const dto = plainToInstance(PrepareChallengeRequest, { ...base, email: null });
+        const errors = await validate(dto);
+        expect(errors).toEqual([]);
+    });
+
+    it('valida cuando email SÍ viene y es un email válido', async () => {
+        const dto = plainToInstance(PrepareChallengeRequest, {
+            ...base,
+            challengeName: ChallengeNameEnum.EMAIL_OTP,
+            email: 'user@dominio.com',
+        });
+        const errors = await validate(dto);
+        expect(errors).toEqual([]);
+    });
+
+    it('falla cuando email viene pero NO es un email válido', async () => {
+        const dto = plainToInstance(PrepareChallengeRequest, { ...base, email: 'no-es-email' });
+        const errors = await validate(dto);
+        expect(errors.length).toBeGreaterThan(0);
+        expect(errors[0].property).toBe('email');
+    });
+
+    it('falla si challengeName no es un valor del enum', async () => {
+        const dto = plainToInstance(PrepareChallengeRequest, {
+            ...base,
+            challengeName: 'BOGUS' as ChallengeNameEnum,
+        });
+        const errors = await validate(dto);
+        expect(errors.length).toBeGreaterThan(0);
+        expect(errors[0].property).toBe('challengeName');
+    });
+});

package/_test_/unit/platformRbac/auth/dtos.test.ts

@@ -1,42 +1,42 @@
-import 'reflect-metadata';
-import { plainToInstance } from 'class-transformer';
-import { validate } from 'class-validator';
-import {
-    DefineNextChallengeRequest,
-    ChallengeResultEntry,
-} from '../../../../src/platformRbac/auth/DefineNextChallengeRequest';
-import { ChallengeNameEnum } from '../../../../src/platformRbac/enums/ChallengeNameEnum';
-
-describe('DefineNextChallengeRequest', () => {
-    it('valida happy path con session vacia', async () => {
-        const dto = plainToInstance(DefineNextChallengeRequest, {
-            cognitoSub: 'abc-123',
-            userNotFound: false,
-            session: [],
-        });
-        const errors = await validate(dto);
-        expect(errors).toEqual([]);
-    });
-
-    it('valida happy path con session de un PASSWORD result', async () => {
-        const dto = plainToInstance(DefineNextChallengeRequest, {
-            cognitoSub: 'abc-123',
-            userNotFound: false,
-            session: [{ challengeName: ChallengeNameEnum.PASSWORD, challengeResult: true }],
-        });
-        const errors = await validate(dto);
-        expect(errors).toEqual([]);
-        expect(dto.session[0]).toBeInstanceOf(ChallengeResultEntry);
-    });
-
-    it('falla si cognitoSub no es string', async () => {
-        const dto = plainToInstance(DefineNextChallengeRequest, {
-            cognitoSub: 42,
-            userNotFound: false,
-            session: [],
-        });
-        const errors = await validate(dto);
-        expect(errors.length).toBeGreaterThan(0);
-        expect(errors[0].property).toBe('cognitoSub');
-    });
-});
+import 'reflect-metadata';
+import { plainToInstance } from 'class-transformer';
+import { validate } from 'class-validator';
+import {
+    DefineNextChallengeRequest,
+    ChallengeResultEntry,
+} from '../../../../src/platformRbac/auth/DefineNextChallengeRequest';
+import { ChallengeNameEnum } from '../../../../src/platformRbac/enums/ChallengeNameEnum';
+
+describe('DefineNextChallengeRequest', () => {
+    it('valida happy path con session vacia', async () => {
+        const dto = plainToInstance(DefineNextChallengeRequest, {
+            cognitoSub: 'abc-123',
+            userNotFound: false,
+            session: [],
+        });
+        const errors = await validate(dto);
+        expect(errors).toEqual([]);
+    });
+
+    it('valida happy path con session de un PASSWORD result', async () => {
+        const dto = plainToInstance(DefineNextChallengeRequest, {
+            cognitoSub: 'abc-123',
+            userNotFound: false,
+            session: [{ challengeName: ChallengeNameEnum.PASSWORD, challengeResult: true }],
+        });
+        const errors = await validate(dto);
+        expect(errors).toEqual([]);
+        expect(dto.session[0]).toBeInstanceOf(ChallengeResultEntry);
+    });
+
+    it('falla si cognitoSub no es string', async () => {
+        const dto = plainToInstance(DefineNextChallengeRequest, {
+            cognitoSub: 42,
+            userNotFound: false,
+            session: [],
+        });
+        const errors = await validate(dto);
+        expect(errors.length).toBeGreaterThan(0);
+        expect(errors[0].property).toBe('cognitoSub');
+    });
+});

package/_test_/unit/platformRbac/dtos/AuthorizeRequest.test.ts

@@ -1,30 +1,30 @@
-import 'reflect-metadata';
-import { plainToInstance } from 'class-transformer';
-import { validate } from 'class-validator';
-import { AuthorizeRequest } from '../../../../src/platformRbac/dtos/AuthorizeRequest';
-import { PermissionScope } from '../../../../src/platformRbac/enums/PermissionScope';
-
-describe('AuthorizeRequest', () => {
-    it('valida happy path con scope opcional', async () => {
-        const dto = plainToInstance(AuthorizeRequest, {
-            token: 'jwt.abc.def',
-            permission: 'tenant.user.create',
-            scope: PermissionScope.LEVEL_1,
-            scopeRef: 'VL-001',
-        });
-        const errors = await validate(dto);
-        expect(errors).toEqual([]);
-    });
-
-    it('falla si falta token', async () => {
-        const dto = plainToInstance(AuthorizeRequest, { permission: 'tenant.user.create' });
-        const errors = await validate(dto);
-        expect(errors.some(e => e.property === 'token')).toBe(true);
-    });
-
-    it('acepta sin scope/scopeRef (permiso sin scope)', async () => {
-        const dto = plainToInstance(AuthorizeRequest, { token: 'jwt', permission: 'catalog.read' });
-        const errors = await validate(dto);
-        expect(errors).toEqual([]);
-    });
-});
+import 'reflect-metadata';
+import { plainToInstance } from 'class-transformer';
+import { validate } from 'class-validator';
+import { AuthorizeRequest } from '../../../../src/platformRbac/dtos/AuthorizeRequest';
+import { PermissionScope } from '../../../../src/platformRbac/enums/PermissionScope';
+
+describe('AuthorizeRequest', () => {
+    it('valida happy path con scope opcional', async () => {
+        const dto = plainToInstance(AuthorizeRequest, {
+            token: 'jwt.abc.def',
+            permission: 'tenant.user.create',
+            scope: PermissionScope.LEVEL_1,
+            scopeRef: 'VL-001',
+        });
+        const errors = await validate(dto);
+        expect(errors).toEqual([]);
+    });
+
+    it('falla si falta token', async () => {
+        const dto = plainToInstance(AuthorizeRequest, { permission: 'tenant.user.create' });
+        const errors = await validate(dto);
+        expect(errors.some(e => e.property === 'token')).toBe(true);
+    });
+
+    it('acepta sin scope/scopeRef (permiso sin scope)', async () => {
+        const dto = plainToInstance(AuthorizeRequest, { token: 'jwt', permission: 'catalog.read' });
+        const errors = await validate(dto);
+        expect(errors).toEqual([]);
+    });
+});

package/_test_/unit/platformRbac/dtos/AuthorizeResponse.test.ts

@@ -1,25 +1,25 @@
-import 'reflect-metadata';
-import { plainToInstance } from 'class-transformer';
-import { validate } from 'class-validator';
-import { AuthorizeResponse } from '../../../../src/platformRbac/dtos/AuthorizeResponse';
-import { AuthorizeDenyReason } from '../../../../src/platformRbac/enums/AuthorizeDenyReason';
-
-describe('AuthorizeResponse', () => {
-    it('valida allow=true sin reason', async () => {
-        const dto = plainToInstance(AuthorizeResponse, { allow: true });
-        const errors = await validate(dto);
-        expect(errors).toEqual([]);
-    });
-
-    it('valida allow=false con reason enum', async () => {
-        const dto = plainToInstance(AuthorizeResponse, { allow: false, reason: AuthorizeDenyReason.NO_PERMISSION });
-        const errors = await validate(dto);
-        expect(errors).toEqual([]);
-    });
-
-    it('rechaza reason fuera del enum', async () => {
-        const dto = plainToInstance(AuthorizeResponse, { allow: false, reason: 'WHATEVER' });
-        const errors = await validate(dto);
-        expect(errors.some(e => e.property === 'reason')).toBe(true);
-    });
-});
+import 'reflect-metadata';
+import { plainToInstance } from 'class-transformer';
+import { validate } from 'class-validator';
+import { AuthorizeResponse } from '../../../../src/platformRbac/dtos/AuthorizeResponse';
+import { AuthorizeDenyReason } from '../../../../src/platformRbac/enums/AuthorizeDenyReason';
+
+describe('AuthorizeResponse', () => {
+    it('valida allow=true sin reason', async () => {
+        const dto = plainToInstance(AuthorizeResponse, { allow: true });
+        const errors = await validate(dto);
+        expect(errors).toEqual([]);
+    });
+
+    it('valida allow=false con reason enum', async () => {
+        const dto = plainToInstance(AuthorizeResponse, { allow: false, reason: AuthorizeDenyReason.NO_PERMISSION });
+        const errors = await validate(dto);
+        expect(errors).toEqual([]);
+    });
+
+    it('rechaza reason fuera del enum', async () => {
+        const dto = plainToInstance(AuthorizeResponse, { allow: false, reason: 'WHATEVER' });
+        const errors = await validate(dto);
+        expect(errors.some(e => e.property === 'reason')).toBe(true);
+    });
+});

package/_test_/unit/platformRbac/dtos/CreateTenantRequest.test.ts

@@ -1,119 +1,119 @@
-import 'reflect-metadata';
-import { plainToInstance } from 'class-transformer';
-import { validate } from 'class-validator';
-import { CreateTenantRequest } from '../../../../src/platformRbac/dtos/CreateTenantRequest';
-
-describe('CreateTenantRequest', () => {
-    const valid = {
-        tenantId: 'acme-mx',
-        displayName: 'Acme México',
-        emailDomain: 'acme.com',
-        tablePrefix: 'acme',
-        adminEmail: 'admin@acme.com',
-        adminName: 'Admin Acme',
-        region: 'us-east-1',
-    };
-
-    it('valida happy path (0 errores)', async () => {
-        const dto = plainToInstance(CreateTenantRequest, valid);
-        const errors = await validate(dto);
-        expect(errors).toEqual([]);
-    });
-
-    it('valida solo con los campos obligatorios (sin ningún opcional)', async () => {
-        // valid ya no incluye opcionales (mfaRequired/passwordMinLength purgados — DEC-RBAC-051/052);
-        // este caso confirma que el contrato valida con el set mínimo obligatorio.
-        const dto = plainToInstance(CreateTenantRequest, valid);
-        const errors = await validate(dto);
-        expect(errors).toEqual([]);
-    });
-
-    it('falla si adminEmail es inválido', async () => {
-        const dto = plainToInstance(CreateTenantRequest, { ...valid, adminEmail: 'no-es-email' });
-        const errors = await validate(dto);
-        expect(errors.some(e => e.property === 'adminEmail')).toBe(true);
-    });
-
-    it('falla si tenantId tiene mayúsculas', async () => {
-        const dto = plainToInstance(CreateTenantRequest, { ...valid, tenantId: 'Acme-MX' });
-        const errors = await validate(dto);
-        expect(errors.some(e => e.property === 'tenantId')).toBe(true);
-    });
-
-    it('falla si tenantId tiene caracteres inválidos (espacios / underscore)', async () => {
-        const dto = plainToInstance(CreateTenantRequest, { ...valid, tenantId: 'acme_mx 01' });
-        const errors = await validate(dto);
-        expect(errors.some(e => e.property === 'tenantId')).toBe(true);
-    });
-
-    it('valida con tenantType opcional (legacy string libre — DEC-RBAC-062/063, purga v4.0.0)', async () => {
-        // Tras la purga de los tenant-types de dominio, tenantType es string libre por back-compat
-        // del shape del body (el alta se hace por applicationId). Cualquier string valida.
-        const dto = plainToInstance(CreateTenantRequest, { ...valid, tenantType: 'agents' });
-        const errors = await validate(dto);
-        expect(errors).toEqual([]);
-        expect(dto.tenantType).toBe('agents');
-    });
-
-    it('falla si tenantType no es string', async () => {
-        const dto = plainToInstance(CreateTenantRequest, { ...valid, tenantType: 123 });
-        const errors = await validate(dto);
-        expect(errors.some(e => e.property === 'tenantType')).toBe(true);
-    });
-
-    it('valida con securityPolicy omitido (opcional — hereda app.defaults)', async () => {
-        const dto = plainToInstance(CreateTenantRequest, valid);
-        const errors = await validate(dto);
-        expect(errors).toEqual([]);
-        expect(dto.securityPolicy).toBeUndefined();
-    });
-
-    it('valida securityPolicy con métodos válidos y mfaEnabled', async () => {
-        const dto = plainToInstance(CreateTenantRequest, {
-            ...valid,
-            securityPolicy: { methodsAllowed: ['EMAIL', 'TOTP'], mfaEnabled: true },
-        });
-        const errors = await validate(dto);
-        expect(errors).toEqual([]);
-        expect(dto.securityPolicy?.methodsAllowed).toEqual(['EMAIL', 'TOTP']);
-        expect(dto.securityPolicy?.mfaEnabled).toBe(true);
-    });
-
-    it('valida securityPolicy con ambos campos opcionales ausentes (objeto vacío)', async () => {
-        const dto = plainToInstance(CreateTenantRequest, { ...valid, securityPolicy: {} });
-        const errors = await validate(dto);
-        expect(errors).toEqual([]);
-    });
-
-    it('falla si securityPolicy.methodsAllowed tiene un método fuera del value-set', async () => {
-        // DEC-RBAC-085: 'SMS' pasó a ser válido; usamos un valor realmente fuera del set.
-        const dto = plainToInstance(CreateTenantRequest, {
-            ...valid,
-            securityPolicy: { methodsAllowed: ['PUSH'] },
-        });
-        const errors = await validate(dto);
-        expect(errors.some(e => e.property === 'securityPolicy')).toBe(true);
-    });
-
-    it('falla si securityPolicy.mfaEnabled no es boolean', async () => {
-        const dto = plainToInstance(CreateTenantRequest, {
-            ...valid,
-            securityPolicy: { mfaEnabled: 'si' },
-        });
-        const errors = await validate(dto);
-        expect(errors.some(e => e.property === 'securityPolicy')).toBe(true);
-    });
-
-    it('NO expone temporaryPassword en el request (campo del response, no del body)', () => {
-        // El request NO debe llevar temporaryPassword (es solo del response, fallback out-of-band F-11).
-        // Con excludeExtraneousValues solo sobreviven las props @Expose() del DTO → el contrato lo excluye.
-        const dto = plainToInstance(
-            CreateTenantRequest,
-            { ...valid, temporaryPassword: 'Secreto123!' },
-            { excludeExtraneousValues: true },
-        );
-        expect((dto as unknown as Record<string, unknown>).temporaryPassword).toBeUndefined();
-        // sanity: una prop sí declarada en el contrato sí sobrevive
-        expect(dto.tenantId).toBe('acme-mx');
-    });
-});
+import 'reflect-metadata';
+import { plainToInstance } from 'class-transformer';
+import { validate } from 'class-validator';
+import { CreateTenantRequest } from '../../../../src/platformRbac/dtos/CreateTenantRequest';
+
+describe('CreateTenantRequest', () => {
+    const valid = {
+        tenantId: 'acme-mx',
+        displayName: 'Acme México',
+        emailDomain: 'acme.com',
+        tablePrefix: 'acme',
+        adminEmail: 'admin@acme.com',
+        adminName: 'Admin Acme',
+        region: 'us-east-1',
+    };
+
+    it('valida happy path (0 errores)', async () => {
+        const dto = plainToInstance(CreateTenantRequest, valid);
+        const errors = await validate(dto);
+        expect(errors).toEqual([]);
+    });
+
+    it('valida solo con los campos obligatorios (sin ningún opcional)', async () => {
+        // valid ya no incluye opcionales (mfaRequired/passwordMinLength purgados — DEC-RBAC-051/052);
+        // este caso confirma que el contrato valida con el set mínimo obligatorio.
+        const dto = plainToInstance(CreateTenantRequest, valid);
+        const errors = await validate(dto);
+        expect(errors).toEqual([]);
+    });
+
+    it('falla si adminEmail es inválido', async () => {
+        const dto = plainToInstance(CreateTenantRequest, { ...valid, adminEmail: 'no-es-email' });
+        const errors = await validate(dto);
+        expect(errors.some(e => e.property === 'adminEmail')).toBe(true);
+    });
+
+    it('falla si tenantId tiene mayúsculas', async () => {
+        const dto = plainToInstance(CreateTenantRequest, { ...valid, tenantId: 'Acme-MX' });
+        const errors = await validate(dto);
+        expect(errors.some(e => e.property === 'tenantId')).toBe(true);
+    });
+
+    it('falla si tenantId tiene caracteres inválidos (espacios / underscore)', async () => {
+        const dto = plainToInstance(CreateTenantRequest, { ...valid, tenantId: 'acme_mx 01' });
+        const errors = await validate(dto);
+        expect(errors.some(e => e.property === 'tenantId')).toBe(true);
+    });
+
+    it('valida con tenantType opcional (legacy string libre — DEC-RBAC-062/063, purga v4.0.0)', async () => {
+        // Tras la purga de los tenant-types de dominio, tenantType es string libre por back-compat
+        // del shape del body (el alta se hace por applicationId). Cualquier string valida.
+        const dto = plainToInstance(CreateTenantRequest, { ...valid, tenantType: 'agents' });
+        const errors = await validate(dto);
+        expect(errors).toEqual([]);
+        expect(dto.tenantType).toBe('agents');
+    });
+
+    it('falla si tenantType no es string', async () => {
+        const dto = plainToInstance(CreateTenantRequest, { ...valid, tenantType: 123 });
+        const errors = await validate(dto);
+        expect(errors.some(e => e.property === 'tenantType')).toBe(true);
+    });
+
+    it('valida con securityPolicy omitido (opcional — hereda app.defaults)', async () => {
+        const dto = plainToInstance(CreateTenantRequest, valid);
+        const errors = await validate(dto);
+        expect(errors).toEqual([]);
+        expect(dto.securityPolicy).toBeUndefined();
+    });
+
+    it('valida securityPolicy con métodos válidos y mfaEnabled', async () => {
+        const dto = plainToInstance(CreateTenantRequest, {
+            ...valid,
+            securityPolicy: { methodsAllowed: ['EMAIL', 'TOTP'], mfaEnabled: true },
+        });
+        const errors = await validate(dto);
+        expect(errors).toEqual([]);
+        expect(dto.securityPolicy?.methodsAllowed).toEqual(['EMAIL', 'TOTP']);
+        expect(dto.securityPolicy?.mfaEnabled).toBe(true);
+    });
+
+    it('valida securityPolicy con ambos campos opcionales ausentes (objeto vacío)', async () => {
+        const dto = plainToInstance(CreateTenantRequest, { ...valid, securityPolicy: {} });
+        const errors = await validate(dto);
+        expect(errors).toEqual([]);
+    });
+
+    it('falla si securityPolicy.methodsAllowed tiene un método fuera del value-set', async () => {
+        // DEC-RBAC-085: 'SMS' pasó a ser válido; usamos un valor realmente fuera del set.
+        const dto = plainToInstance(CreateTenantRequest, {
+            ...valid,
+            securityPolicy: { methodsAllowed: ['PUSH'] },
+        });
+        const errors = await validate(dto);
+        expect(errors.some(e => e.property === 'securityPolicy')).toBe(true);
+    });
+
+    it('falla si securityPolicy.mfaEnabled no es boolean', async () => {
+        const dto = plainToInstance(CreateTenantRequest, {
+            ...valid,
+            securityPolicy: { mfaEnabled: 'si' },
+        });
+        const errors = await validate(dto);
+        expect(errors.some(e => e.property === 'securityPolicy')).toBe(true);
+    });
+
+    it('NO expone temporaryPassword en el request (campo del response, no del body)', () => {
+        // El request NO debe llevar temporaryPassword (es solo del response, fallback out-of-band F-11).
+        // Con excludeExtraneousValues solo sobreviven las props @Expose() del DTO → el contrato lo excluye.
+        const dto = plainToInstance(
+            CreateTenantRequest,
+            { ...valid, temporaryPassword: 'Secreto123!' },
+            { excludeExtraneousValues: true },
+        );
+        expect((dto as unknown as Record<string, unknown>).temporaryPassword).toBeUndefined();
+        // sanity: una prop sí declarada en el contrato sí sobrevive
+        expect(dto.tenantId).toBe('acme-mx');
+    });
+});