@fiado/type-kit 3.499.0 → 3.500.0

package/_test_/unit/cognitoBackofficeConnector/dtos/AuthStartLogin.test.ts

@@ -0,0 +1,76 @@
+import 'reflect-metadata';
+import { plainToInstance } from 'class-transformer';
+import { validate } from 'class-validator';
+import { AuthStartLoginRequest } from '../../../../src/cognitoBackofficeConnector/dtos/AuthStartLoginRequest';
+import {
+    AuthStartLoginResponse,
+    AuthStartLoginTokens,
+} from '../../../../src/cognitoBackofficeConnector/dtos/AuthStartLoginResponse';
+import { CognitoChallengeType } from '../../../../src/cognitoBackofficeConnector/enums/CognitoChallengeType';
+
+describe('AuthStartLoginRequest', () => {
+    const base = {
+        userPoolId: 'us-east-1_abc',
+        region: 'us-east-1',
+        clientId: 'client-123',
+        username: 'sub-123',
+        password: 'Secret123!',
+    };
+
+    it('valida happy path', async () => {
+        const dto = plainToInstance(AuthStartLoginRequest, base);
+        expect(await validate(dto)).toEqual([]);
+    });
+
+    it('falla si falta password', async () => {
+        const dto = plainToInstance(AuthStartLoginRequest, { ...base, password: '' });
+        expect((await validate(dto)).some((e) => e.property === 'password')).toBe(true);
+    });
+
+    it('falla si clientId no es string', async () => {
+        const dto = plainToInstance(AuthStartLoginRequest, { ...base, clientId: 42 });
+        expect((await validate(dto)).some((e) => e.property === 'clientId')).toBe(true);
+    });
+});
+
+describe('AuthStartLoginResponse', () => {
+    it('tokens directos (2FA apagado)', async () => {
+        const dto = plainToInstance(AuthStartLoginResponse, {
+            tokens: {
+                accessToken: 'a',
+                idToken: 'i',
+                refreshToken: 'r',
+                expiresIn: 3600,
+                tokenType: 'Bearer',
+            },
+        });
+        expect(await validate(dto)).toEqual([]);
+        expect(dto.tokens).toBeInstanceOf(AuthStartLoginTokens);
+    });
+
+    it('challenge CUSTOM_CHALLENGE + session + parameters', async () => {
+        const dto = plainToInstance(AuthStartLoginResponse, {
+            challengeType: CognitoChallengeType.CUSTOM_CHALLENGE,
+            session: 'sess-123',
+            challengeParameters: { challengeName: 'EMAIL_OTP' },
+        });
+        expect(await validate(dto)).toEqual([]);
+    });
+
+    it('vacio es valido (todos opcionales)', async () => {
+        const dto = plainToInstance(AuthStartLoginResponse, {});
+        expect(await validate(dto)).toEqual([]);
+    });
+
+    it('falla si challengeType no es del enum', async () => {
+        const dto = plainToInstance(AuthStartLoginResponse, { challengeType: 'BOGUS' });
+        expect((await validate(dto)).some((e) => e.property === 'challengeType')).toBe(true);
+    });
+
+    it('falla si expiresIn de tokens no es number', async () => {
+        const dto = plainToInstance(AuthStartLoginResponse, {
+            tokens: { accessToken: 'a', idToken: 'i', refreshToken: 'r', expiresIn: 'x', tokenType: 'Bearer' },
+        });
+        expect((await validate(dto)).length).toBeGreaterThan(0);
+    });
+});

package/_test_/unit/platformRbac/auth/dtos.test.ts

@@ -39,4 +39,37 @@ describe('DefineNextChallengeRequest', () => {
         expect(errors.length).toBeGreaterThan(0);
         expect(errors[0].property).toBe('cognitoSub');
     });
+
+    it('acepta userStatus opcional (cognito:user_status, C-06)', async () => {
+        const dto = plainToInstance(DefineNextChallengeRequest, {
+            cognitoSub: 'abc-123',
+            userNotFound: false,
+            session: [],
+            userStatus: 'FORCE_CHANGE_PASSWORD',
+        });
+        const errors = await validate(dto);
+        expect(errors).toEqual([]);
+        expect(dto.userStatus).toBe('FORCE_CHANGE_PASSWORD');
+    });
+
+    it('userStatus ausente sigue siendo valido (aditivo)', async () => {
+        const dto = plainToInstance(DefineNextChallengeRequest, {
+            cognitoSub: 'abc-123',
+            userNotFound: false,
+            session: [],
+        });
+        expect(await validate(dto)).toEqual([]);
+        expect(dto.userStatus).toBeUndefined();
+    });
+
+    it('falla si userStatus no es string', async () => {
+        const dto = plainToInstance(DefineNextChallengeRequest, {
+            cognitoSub: 'abc-123',
+            userNotFound: false,
+            session: [],
+            userStatus: 99,
+        });
+        const errors = await validate(dto);
+        expect(errors.some((e) => e.property === 'userStatus')).toBe(true);
+    });
 });

package/_test_/unit/platformRbac/enums/ChallengeNameEnum.test.ts

@@ -0,0 +1,17 @@
+import { ChallengeNameEnum } from '../../../../src/platformRbac/enums/ChallengeNameEnum';
+
+describe('ChallengeNameEnum', () => {
+    it('incluye SRP_A y PASSWORD_VERIFIER (SRP dentro de CUSTOM_AUTH)', () => {
+        expect(ChallengeNameEnum.SRP_A).toBe('SRP_A');
+        expect(ChallengeNameEnum.PASSWORD_VERIFIER).toBe('PASSWORD_VERIFIER');
+    });
+
+    it('conserva los valores previos', () => {
+        expect(ChallengeNameEnum.PASSWORD).toBe('PASSWORD');
+        expect(ChallengeNameEnum.EMAIL_OTP).toBe('EMAIL_OTP');
+        expect(ChallengeNameEnum.TOTP).toBe('TOTP');
+        expect(ChallengeNameEnum.NEW_PASSWORD_REQUIRED).toBe('NEW_PASSWORD_REQUIRED');
+        expect(ChallengeNameEnum.RESET_PASSWORD).toBe('RESET_PASSWORD');
+        expect(ChallengeNameEnum.SMS_OTP).toBe('SMS_OTP');
+    });
+});

package/bin/cognitoBackofficeConnector/dtos/AuthStartLoginRequest.d.ts

@@ -0,0 +1,13 @@
+/**
+ * Request del login de un solo flujo (SRP dentro de CUSTOM_AUTH). El connector
+ * hace InitiateAuth(CUSTOM_AUTH, CHALLENGE_NAME=SRP_A) y responde PASSWORD_VERIFIER
+ * firmado en la misma operacion. La contraseña nunca viaja en claro a Cognito: SRP
+ * la convierte en prueba. El caller (rbac) no conoce el mecanismo.
+ */
+export declare class AuthStartLoginRequest {
+    userPoolId: string;
+    region: string;
+    clientId: string;
+    username: string;
+    password: string;
+}

package/bin/cognitoBackofficeConnector/dtos/AuthStartLoginRequest.js

@@ -0,0 +1,53 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AuthStartLoginRequest = void 0;
+const class_transformer_1 = require("class-transformer");
+const class_validator_1 = require("class-validator");
+/**
+ * Request del login de un solo flujo (SRP dentro de CUSTOM_AUTH). El connector
+ * hace InitiateAuth(CUSTOM_AUTH, CHALLENGE_NAME=SRP_A) y responde PASSWORD_VERIFIER
+ * firmado en la misma operacion. La contraseña nunca viaja en claro a Cognito: SRP
+ * la convierte en prueba. El caller (rbac) no conoce el mecanismo.
+ */
+class AuthStartLoginRequest {
+}
+exports.AuthStartLoginRequest = AuthStartLoginRequest;
+__decorate([
+    (0, class_transformer_1.Expose)(),
+    (0, class_validator_1.IsString)(),
+    (0, class_validator_1.IsNotEmpty)(),
+    __metadata("design:type", String)
+], AuthStartLoginRequest.prototype, "userPoolId", void 0);
+__decorate([
+    (0, class_transformer_1.Expose)(),
+    (0, class_validator_1.IsString)(),
+    (0, class_validator_1.IsNotEmpty)(),
+    __metadata("design:type", String)
+], AuthStartLoginRequest.prototype, "region", void 0);
+__decorate([
+    (0, class_transformer_1.Expose)(),
+    (0, class_validator_1.IsString)(),
+    (0, class_validator_1.IsNotEmpty)(),
+    __metadata("design:type", String)
+], AuthStartLoginRequest.prototype, "clientId", void 0);
+__decorate([
+    (0, class_transformer_1.Expose)(),
+    (0, class_validator_1.IsString)(),
+    (0, class_validator_1.IsNotEmpty)(),
+    __metadata("design:type", String)
+], AuthStartLoginRequest.prototype, "username", void 0);
+__decorate([
+    (0, class_transformer_1.Expose)(),
+    (0, class_validator_1.IsString)(),
+    (0, class_validator_1.IsNotEmpty)(),
+    __metadata("design:type", String)
+], AuthStartLoginRequest.prototype, "password", void 0);

package/bin/cognitoBackofficeConnector/dtos/AuthStartLoginResponse.d.ts

@@ -0,0 +1,22 @@
+import { CognitoChallengeType } from '../enums/CognitoChallengeType';
+export declare class AuthStartLoginTokens {
+    accessToken: string;
+    idToken: string;
+    refreshToken: string;
+    expiresIn: number;
+    tokenType: string;
+}
+/**
+ * Respuesta de `authStartLogin`. Tras verificar el password via SRP
+ * (PASSWORD_VERIFIER), Cognito devuelve una de dos cosas: `tokens` si el flujo
+ * quedo completo (2FA apagado), o `challengeType` + `session` + `challengeParameters`
+ * si falta un paso (NEW_PASSWORD_REQUIRED, o el CUSTOM_CHALLENGE del 2do factor con
+ * el sub-challenge real en `challengeParameters.challengeName`). Todos los campos son
+ * opcionales: el caller (rbac) decide por que rama sigue.
+ */
+export declare class AuthStartLoginResponse {
+    tokens?: AuthStartLoginTokens;
+    challengeType?: CognitoChallengeType;
+    session?: string;
+    challengeParameters?: Record<string, string>;
+}

package/bin/cognitoBackofficeConnector/dtos/AuthStartLoginResponse.js

@@ -0,0 +1,79 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AuthStartLoginResponse = exports.AuthStartLoginTokens = void 0;
+const class_transformer_1 = require("class-transformer");
+const class_validator_1 = require("class-validator");
+const CognitoChallengeType_1 = require("../enums/CognitoChallengeType");
+class AuthStartLoginTokens {
+}
+exports.AuthStartLoginTokens = AuthStartLoginTokens;
+__decorate([
+    (0, class_transformer_1.Expose)(),
+    (0, class_validator_1.IsString)(),
+    __metadata("design:type", String)
+], AuthStartLoginTokens.prototype, "accessToken", void 0);
+__decorate([
+    (0, class_transformer_1.Expose)(),
+    (0, class_validator_1.IsString)(),
+    __metadata("design:type", String)
+], AuthStartLoginTokens.prototype, "idToken", void 0);
+__decorate([
+    (0, class_transformer_1.Expose)(),
+    (0, class_validator_1.IsString)(),
+    __metadata("design:type", String)
+], AuthStartLoginTokens.prototype, "refreshToken", void 0);
+__decorate([
+    (0, class_transformer_1.Expose)(),
+    (0, class_validator_1.IsNumber)(),
+    __metadata("design:type", Number)
+], AuthStartLoginTokens.prototype, "expiresIn", void 0);
+__decorate([
+    (0, class_transformer_1.Expose)(),
+    (0, class_validator_1.IsString)(),
+    __metadata("design:type", String)
+], AuthStartLoginTokens.prototype, "tokenType", void 0);
+/**
+ * Respuesta de `authStartLogin`. Tras verificar el password via SRP
+ * (PASSWORD_VERIFIER), Cognito devuelve una de dos cosas: `tokens` si el flujo
+ * quedo completo (2FA apagado), o `challengeType` + `session` + `challengeParameters`
+ * si falta un paso (NEW_PASSWORD_REQUIRED, o el CUSTOM_CHALLENGE del 2do factor con
+ * el sub-challenge real en `challengeParameters.challengeName`). Todos los campos son
+ * opcionales: el caller (rbac) decide por que rama sigue.
+ */
+class AuthStartLoginResponse {
+}
+exports.AuthStartLoginResponse = AuthStartLoginResponse;
+__decorate([
+    (0, class_transformer_1.Expose)(),
+    (0, class_validator_1.IsOptional)(),
+    (0, class_validator_1.ValidateNested)(),
+    (0, class_transformer_1.Type)(() => AuthStartLoginTokens),
+    __metadata("design:type", AuthStartLoginTokens)
+], AuthStartLoginResponse.prototype, "tokens", void 0);
+__decorate([
+    (0, class_transformer_1.Expose)(),
+    (0, class_validator_1.IsOptional)(),
+    (0, class_validator_1.IsEnum)(CognitoChallengeType_1.CognitoChallengeType),
+    __metadata("design:type", String)
+], AuthStartLoginResponse.prototype, "challengeType", void 0);
+__decorate([
+    (0, class_transformer_1.Expose)(),
+    (0, class_validator_1.IsOptional)(),
+    (0, class_validator_1.IsString)(),
+    __metadata("design:type", String)
+], AuthStartLoginResponse.prototype, "session", void 0);
+__decorate([
+    (0, class_transformer_1.Expose)(),
+    (0, class_validator_1.IsOptional)(),
+    (0, class_validator_1.IsObject)(),
+    __metadata("design:type", Object)
+], AuthStartLoginResponse.prototype, "challengeParameters", void 0);

package/bin/cognitoBackofficeConnector/index.d.ts

@@ -21,6 +21,8 @@ export * from './dtos/UserDetailResponse';
 export * from './dtos/AuthEventsRequest';
 export * from './dtos/AuthEventResponse';
 export * from './dtos/AuthTokensResponse';
+export * from './dtos/AuthStartLoginRequest';
+export * from './dtos/AuthStartLoginResponse';
 export * from './dtos/InitiateAuthRequest';
 export * from './dtos/InitiateAuthResponse';
 export * from './dtos/VerifyPasswordRequest';

package/bin/cognitoBackofficeConnector/index.js

@@ -37,6 +37,8 @@ __exportStar(require("./dtos/UserDetailResponse"), exports);
 __exportStar(require("./dtos/AuthEventsRequest"), exports);
 __exportStar(require("./dtos/AuthEventResponse"), exports);
 __exportStar(require("./dtos/AuthTokensResponse"), exports);
+__exportStar(require("./dtos/AuthStartLoginRequest"), exports);
+__exportStar(require("./dtos/AuthStartLoginResponse"), exports);
 __exportStar(require("./dtos/InitiateAuthRequest"), exports);
 __exportStar(require("./dtos/InitiateAuthResponse"), exports);
 __exportStar(require("./dtos/VerifyPasswordRequest"), exports);

package/bin/platformRbac/auth/DefineNextChallengeRequest.d.ts

@@ -8,4 +8,5 @@ export declare class DefineNextChallengeRequest {
     cognitoSub: string;
     userNotFound: boolean;
     session: ChallengeResultEntry[];
+    userStatus?: string;
 }

package/bin/platformRbac/auth/DefineNextChallengeRequest.js

@@ -42,3 +42,8 @@ __decorate([
     (0, class_transformer_1.Type)(() => ChallengeResultEntry),
     __metadata("design:type", Array)
 ], DefineNextChallengeRequest.prototype, "session", void 0);
+__decorate([
+    (0, class_validator_1.IsOptional)(),
+    (0, class_validator_1.IsString)(),
+    __metadata("design:type", String)
+], DefineNextChallengeRequest.prototype, "userStatus", void 0);

package/bin/platformRbac/enums/ChallengeNameEnum.d.ts

@@ -4,5 +4,7 @@ export declare enum ChallengeNameEnum {
     TOTP = "TOTP",
     NEW_PASSWORD_REQUIRED = "NEW_PASSWORD_REQUIRED",
     RESET_PASSWORD = "RESET_PASSWORD",
-    SMS_OTP = "SMS_OTP"
+    SMS_OTP = "SMS_OTP",
+    SRP_A = "SRP_A",
+    PASSWORD_VERIFIER = "PASSWORD_VERIFIER"
 }

package/bin/platformRbac/enums/ChallengeNameEnum.js

@@ -9,4 +9,8 @@ var ChallengeNameEnum;
     ChallengeNameEnum["NEW_PASSWORD_REQUIRED"] = "NEW_PASSWORD_REQUIRED";
     ChallengeNameEnum["RESET_PASSWORD"] = "RESET_PASSWORD";
     ChallengeNameEnum["SMS_OTP"] = "SMS_OTP";
+    // SRP dentro de CUSTOM_AUTH: entries nativos que Cognito deja en session[] y que
+    // el orquestador del rbac lee para decidir el siguiente paso del login de un solo flujo.
+    ChallengeNameEnum["SRP_A"] = "SRP_A";
+    ChallengeNameEnum["PASSWORD_VERIFIER"] = "PASSWORD_VERIFIER";
 })(ChallengeNameEnum || (exports.ChallengeNameEnum = ChallengeNameEnum = {}));

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fiado/type-kit",
-  "version": "3.499.0",
+  "version": "3.500.0",
   "description": "",
   "main": "bin/index.js",
   "types": "bin/index.d.ts",

package/src/cognitoBackofficeConnector/dtos/AuthStartLoginRequest.ts

@@ -0,0 +1,16 @@
+import { Expose } from 'class-transformer';
+import { IsNotEmpty, IsString } from 'class-validator';
+
+/**
+ * Request del login de un solo flujo (SRP dentro de CUSTOM_AUTH). El connector
+ * hace InitiateAuth(CUSTOM_AUTH, CHALLENGE_NAME=SRP_A) y responde PASSWORD_VERIFIER
+ * firmado en la misma operacion. La contraseña nunca viaja en claro a Cognito: SRP
+ * la convierte en prueba. El caller (rbac) no conoce el mecanismo.
+ */
+export class AuthStartLoginRequest {
+    @Expose() @IsString() @IsNotEmpty() userPoolId!: string;
+    @Expose() @IsString() @IsNotEmpty() region!: string;
+    @Expose() @IsString() @IsNotEmpty() clientId!: string;
+    @Expose() @IsString() @IsNotEmpty() username!: string;
+    @Expose() @IsString() @IsNotEmpty() password!: string;
+}

package/src/cognitoBackofficeConnector/dtos/AuthStartLoginResponse.ts

@@ -0,0 +1,29 @@
+import { Expose, Type } from 'class-transformer';
+import { IsEnum, IsNumber, IsObject, IsOptional, IsString, ValidateNested } from 'class-validator';
+import { CognitoChallengeType } from '../enums/CognitoChallengeType';
+
+export class AuthStartLoginTokens {
+    @Expose() @IsString() accessToken!: string;
+    @Expose() @IsString() idToken!: string;
+    @Expose() @IsString() refreshToken!: string;
+    @Expose() @IsNumber() expiresIn!: number;
+    @Expose() @IsString() tokenType!: string;
+}
+
+/**
+ * Respuesta de `authStartLogin`. Tras verificar el password via SRP
+ * (PASSWORD_VERIFIER), Cognito devuelve una de dos cosas: `tokens` si el flujo
+ * quedo completo (2FA apagado), o `challengeType` + `session` + `challengeParameters`
+ * si falta un paso (NEW_PASSWORD_REQUIRED, o el CUSTOM_CHALLENGE del 2do factor con
+ * el sub-challenge real en `challengeParameters.challengeName`). Todos los campos son
+ * opcionales: el caller (rbac) decide por que rama sigue.
+ */
+export class AuthStartLoginResponse {
+    @Expose() @IsOptional() @ValidateNested() @Type(() => AuthStartLoginTokens) tokens?: AuthStartLoginTokens;
+
+    @Expose() @IsOptional() @IsEnum(CognitoChallengeType) challengeType?: CognitoChallengeType;
+
+    @Expose() @IsOptional() @IsString() session?: string;
+
+    @Expose() @IsOptional() @IsObject() challengeParameters?: Record<string, string>;
+}

package/src/cognitoBackofficeConnector/index.ts

@@ -21,6 +21,8 @@ export * from './dtos/UserDetailResponse';
 export * from './dtos/AuthEventsRequest';
 export * from './dtos/AuthEventResponse';
 export * from './dtos/AuthTokensResponse';
+export * from './dtos/AuthStartLoginRequest';
+export * from './dtos/AuthStartLoginResponse';
 export * from './dtos/InitiateAuthRequest';
 export * from './dtos/InitiateAuthResponse';
 export * from './dtos/VerifyPasswordRequest';

package/src/platformRbac/auth/DefineNextChallengeRequest.ts

@@ -1,6 +1,6 @@
 import 'reflect-metadata';
 import { Type } from 'class-transformer';
-import { IsArray, IsBoolean, IsEnum, IsString, ValidateNested } from 'class-validator';
+import { IsArray, IsBoolean, IsEnum, IsOptional, IsString, ValidateNested } from 'class-validator';
 import { ChallengeNameEnum } from '../enums/ChallengeNameEnum';
 
 export class ChallengeResultEntry {
@@ -22,4 +22,10 @@ export class DefineNextChallengeRequest {
     @ValidateNested({ each: true })
     @Type(() => ChallengeResultEntry)
     session!: ChallengeResultEntry[];
+
+    // cognito:user_status del evento de Define (C-06). El orquestador decide
+    // NEW_PASSWORD_REQUIRED por este valor, no por el fail-safe de getUser.
+    @IsOptional()
+    @IsString()
+    userStatus?: string;
 }

package/src/platformRbac/enums/ChallengeNameEnum.ts

@@ -5,4 +5,8 @@ export enum ChallengeNameEnum {
     NEW_PASSWORD_REQUIRED = 'NEW_PASSWORD_REQUIRED',
     RESET_PASSWORD = 'RESET_PASSWORD',
     SMS_OTP = 'SMS_OTP',
+    // SRP dentro de CUSTOM_AUTH: entries nativos que Cognito deja en session[] y que
+    // el orquestador del rbac lee para decidir el siguiente paso del login de un solo flujo.
+    SRP_A = 'SRP_A',
+    PASSWORD_VERIFIER = 'PASSWORD_VERIFIER',
 }