@fiado/type-kit 3.661.0 → 3.663.0

package/src/cognitoBackofficeConnector/dtos/RespondToChallengeRequest.ts

@@ -1,5 +1,5 @@
 import { Expose } from 'class-transformer';
-import { IsEnum, IsNotEmpty, IsObject, IsString } from 'class-validator';
+import { IsBoolean, IsEnum, IsNotEmpty, IsObject, IsOptional, IsString } from 'class-validator';
 import { CognitoChallengeType } from '../enums/CognitoChallengeType';
 
 export class RespondToChallengeRequest {
@@ -9,4 +9,5 @@ export class RespondToChallengeRequest {
     @Expose() @IsEnum(CognitoChallengeType) challengeName!: CognitoChallengeType;
     @Expose() @IsString() @IsNotEmpty() session!: string;
     @Expose() @IsObject() challengeResponses!: Record<string, string>;
+    @Expose() @IsOptional() @IsBoolean() useClientSecret?: boolean;
 }

package/src/cognitoBackofficeConnector/dtos/StartOtpLoginRequest.ts

@@ -0,0 +1,11 @@
+import { Expose } from 'class-transformer';
+import { IsBoolean, IsNotEmpty, IsOptional, IsString } from 'class-validator';
+
+/** Body de POST /auth/start-otp-login: inicia CUSTOM_AUTH sin SRP ni contraseña. */
+export class StartOtpLoginRequest {
+    @Expose() @IsString() @IsNotEmpty() userPoolId!: string;
+    @Expose() @IsString() @IsNotEmpty() region!: string;
+    @Expose() @IsString() @IsNotEmpty() clientId!: string;
+    @Expose() @IsString() @IsNotEmpty() username!: string;
+    @Expose() @IsOptional() @IsBoolean() useClientSecret?: boolean;
+}

package/src/cognitoBackofficeConnector/index.ts

@@ -23,6 +23,7 @@ export * from './dtos/AuthEventResponse';
 export * from './dtos/AuthTokensResponse';
 export * from './dtos/AuthStartLoginRequest';
 export * from './dtos/AuthStartLoginResponse';
+export * from './dtos/StartOtpLoginRequest';
 export * from './dtos/InitiateAuthRequest';
 export * from './dtos/InitiateAuthResponse';
 export * from './dtos/VerifyPasswordRequest';

package/src/common/constants/InputPatterns.ts

@@ -5,6 +5,10 @@ export const PHONE_MX_PATTERN = /^\d{10}$/;
 export const PHONE_MX_ACCEPTED_PATTERN = /^(?:\+52)?\d{10}$/;
 export const PHONE_MX_MESSAGE = 'El teléfono debe tener 10 dígitos';
 
+/** Celular guardado en todo SureKeep: `+52` y 10 dígitos. */
+export const PHONE_E164_PATTERN = /^\+52\d{10}$/;
+export const PHONE_E164_MESSAGE = 'El teléfono debe tener el formato +52 y 10 dígitos';
+
 /** Correo pragmático: algo@dominio.tld, sin espacios. */
 export const EMAIL_PATTERN = /^[^\s@]+@[^\s@]+\.[^\s@]+$/;
 export const EMAIL_MAX_LENGTH = 254;

package/src/loanScoring/dtos/requests/EvaluateSciRequest.ts

@@ -1,6 +1,6 @@
 import { Type } from 'class-transformer';
 import { IsBoolean, IsEmail, IsNotEmpty, IsOptional, IsString, Matches, MaxLength, ValidateNested } from 'class-validator';
-import { PHONE_MX_PATTERN } from '../../../common/constants/InputPatterns';
+import { PHONE_MX_ACCEPTED_PATTERN } from '../../../common/constants/InputPatterns';
 import { CREDIT_ID_PATTERN } from '../../../common/constants/CreditIdPattern';
 import { SciInternalHistoryInput } from './SciInternalHistoryInput';
 
@@ -49,10 +49,10 @@ export class EvaluateSciRequest {
     @MaxLength(64)
     curp!: string;
 
-    /** Celular del solicitante: 10 dígitos, sin `+52` (requerido por Modelias). */
+    /** Celular del solicitante: 10 dígitos, con o sin `+52`; loan-scoring lo manda a 10 a Modelias. */
     @IsString()
     @IsNotEmpty()
-    @Matches(PHONE_MX_PATTERN, { message: 'cellphone debe tener 10 dígitos' })
+    @Matches(PHONE_MX_ACCEPTED_PATTERN, { message: 'cellphone debe tener 10 dígitos, con o sin +52' })
     cellphone!: string;
 
     @IsOptional()

package/src/messagesConnector/dtos/OtpLoginStateRequest.ts

@@ -0,0 +1,8 @@
+import { Expose } from 'class-transformer';
+import { IsNotEmpty, IsString } from 'class-validator';
+
+/** Body de POST /messages/otp/login-state. */
+export class OtpLoginStateRequest {
+    @Expose() @IsString() @IsNotEmpty() directoryId!: string;
+    @Expose() @IsString() @IsNotEmpty() typeOfDirectoryId!: string;
+}

package/src/messagesConnector/dtos/OtpLoginStateResponse.ts

@@ -0,0 +1,5 @@
+/** Respuesta de POST /messages/otp/login-state. `lockedUntil` va en epoch ms. */
+export class OtpLoginStateResponse {
+    lastFailureCode!: 'OTP_NOT_FOUND' | 'OTP_EXPIRED' | 'OTP_ALREADY_USED' | null;
+    lockedUntil!: number | null;
+}

package/src/messagesConnector/index.ts

@@ -10,6 +10,8 @@ export * from './dtos/AgentSendNotificationRequest';
 export * from './dtos/SendMessageResponse';
 export * from './dtos/VerifyOtpRequest';
 export * from './dtos/VerifyOtpResponse';
+export * from './dtos/OtpLoginStateRequest';
+export * from './dtos/OtpLoginStateResponse';
 export * from './dtos/OtpValidatedResponse';
 export * from './dtos/NotificationResponse';
 export * from './dtos/NotificationsPageResponse';

package/src/platformRbac/application/Application.ts

@@ -3,6 +3,7 @@ import { PrincipalIdentifierEnum } from '../enums/PrincipalIdentifierEnum';
 import { ApplicationStatus } from '../enums/ApplicationStatus';
 import type { UserFieldDef } from '../dtos/UserFieldDef';
 import type { TokenValidationMode } from '../enums/TokenValidationMode';
+import type { LoginModeEnum } from '../enums/LoginModeEnum';
 
 export interface LevelDef {
     level: PermissionScope; // LEVEL_1 | LEVEL_2 | LEVEL_3
@@ -55,6 +56,8 @@ export interface ApplicationDefaults {
      * UsernameAttributes del pool): true ⇒ pool con ['email','phone_number']. Heredado al tenant.
      */
     allowSecondary?: boolean;
+    /** Modo de login que heredan los tenants de esta aplicación; sin valor entran con contraseña. */
+    loginMode?: LoginModeEnum | null;
     /**
      * DEC-RBAC-111: política de contraseña que heredan los tenants creados desde esta aplicación.
      *

package/src/platformRbac/auth/DefineNextChallengeResponse.ts

@@ -1,5 +1,6 @@
 import { IsBoolean, IsEnum, IsOptional } from 'class-validator';
 import { ChallengeNameEnum } from '../enums/ChallengeNameEnum';
+import { LoginModeEnum } from '../enums/LoginModeEnum';
 
 export class DefineNextChallengeResponse {
     @IsOptional()
@@ -11,4 +12,8 @@ export class DefineNextChallengeResponse {
 
     @IsBoolean()
     failAuthentication!: boolean;
+
+    @IsOptional()
+    @IsEnum(LoginModeEnum)
+    loginMode?: LoginModeEnum;
 }

package/src/platformRbac/auth/PrepareChallengeRequest.ts

@@ -1,5 +1,6 @@
-import { IsEmail, IsEnum, IsOptional, IsString, ValidateIf } from 'class-validator';
+import { IsBoolean, IsEmail, IsEnum, IsOptional, IsString, ValidateIf } from 'class-validator';
 import { ChallengeNameEnum } from '../enums/ChallengeNameEnum';
+import { LoginModeEnum } from '../enums/LoginModeEnum';
 
 export class PrepareChallengeRequest {
     @IsString()
@@ -23,4 +24,13 @@ export class PrepareChallengeRequest {
     @IsOptional()
     @IsString()
     phone?: string;
+
+    @IsOptional()
+    @IsEnum(LoginModeEnum)
+    loginMode?: LoginModeEnum;
+
+    // Indica que la sesión ya trae un SMS_OTP fallido.
+    @IsOptional()
+    @IsBoolean()
+    isRetry?: boolean;
 }

package/src/platformRbac/dtos/EnsureCustomerAccountRequest.ts

@@ -0,0 +1,12 @@
+import { Expose } from 'class-transformer';
+import { IsNotEmpty, IsString, Matches } from 'class-validator';
+import { PHONE_E164_PATTERN } from '../../common/constants/InputPatterns';
+
+/** Body de POST /internal/tenants/{tenantId}/customer-accounts. */
+export class EnsureCustomerAccountRequest {
+    @Expose() @IsString() @Matches(PHONE_E164_PATTERN) phone!: string;
+    @Expose() @IsString() @IsNotEmpty() retailCustomerId!: string;
+    @Expose() @IsString() @IsNotEmpty() directoryId!: string;
+    @Expose() @IsString() @IsNotEmpty() displayName!: string;
+    @Expose() @IsString() @IsNotEmpty() createdBy!: string;
+}

package/src/platformRbac/dtos/EnsureCustomerAccountResponse.ts

@@ -0,0 +1,5 @@
+/** Respuesta de POST /internal/tenants/{tenantId}/customer-accounts. */
+export interface EnsureCustomerAccountResponse {
+    outcome: 'CREATED' | 'EXISTING';
+    cognitoSub: string;
+}

package/src/platformRbac/dtos/OtpLoginRequest.ts

@@ -0,0 +1,8 @@
+import { Expose } from 'class-transformer';
+import { IsNotEmpty, IsString } from 'class-validator';
+
+/** Body de POST /auth/otp-login. */
+export class OtpLoginRequest {
+    @Expose() @IsString() @IsNotEmpty() phone!: string;
+    @Expose() @IsString() @IsNotEmpty() tenantId!: string;
+}

package/src/platformRbac/dtos/UserProfileResponse.ts

@@ -6,4 +6,6 @@ export interface UserProfileResponse {
     email?: string;
     phone?: string;
     status?: string;
+    retailCustomerId?: string | null;
+    directoryId?: string | null;
 }

package/src/platformRbac/enums/LoginModeEnum.ts

@@ -0,0 +1,4 @@
+/** Modo de login de un tenant. Sin valor, el tenant entra con contraseña. */
+export enum LoginModeEnum {
+    OTP_ONLY = 'OTP_ONLY',
+}

package/src/platformRbac/enums/Permission.ts

@@ -167,6 +167,8 @@ export enum Permission {
     TENANT_API_USER_MANAGE = 'tenant.api_user.manage',
     // Activa la integración de un retailer externo (Zentral); scope PLATFORM.
     PLATFORM_RETAIL_INTEGRATION_ACTIVATE = 'platform.retail_integration.activate',
+    // Lectura del portal del cliente.
+    CUSTOMER_PORTAL_READ = 'customer.portal.read',
 }
 
 /**
@@ -289,6 +291,7 @@ export const PERMISSION_BIT_ORDER: readonly Permission[] = [
     Permission.TENANT_INTEGRATION_DIAGNOSTIC,
     Permission.TENANT_API_USER_MANAGE,
     Permission.PLATFORM_RETAIL_INTEGRATION_ACTIVATE,
+    Permission.CUSTOMER_PORTAL_READ,
 ] as const;
 
 function djb2(input: string): number {

package/src/platformRbac/index.ts

@@ -34,6 +34,7 @@ export type { EffectivePermissionsResponse } from './dtos/EffectivePermissionsRe
 export * from './enums/MfaMethodEnum';
 export * from './enums/TokenValidationMode';
 export * from './enums/ChallengeNameEnum';
+export * from './enums/LoginModeEnum';
 export * from './auth/DefineNextChallengeRequest';
 export * from './auth/DefineNextChallengeResponse';
 export * from './auth/PrepareChallengeRequest';
@@ -130,6 +131,9 @@ export type {
 // plain (type-only). Consumidos por los endpoints públicos de platform-rbac-business + el gate de perfil.
 export * from './dtos/SelfRegisterStartRequest';
 export * from './dtos/SelfRegisterVerifyOtpRequest';
+export * from './dtos/EnsureCustomerAccountRequest';
+export type { EnsureCustomerAccountResponse } from './dtos/EnsureCustomerAccountResponse';
+export * from './dtos/OtpLoginRequest';
 export * from './dtos/SelfRegisterCompleteRequest';
 
 // Endpoints privados de espejo de jerarquía + alta de usuario (SureKeep F1, scope mirror).

package/src/retailCustomer/dtos/requests/UpsertCustomerFromKycRequest.ts

@@ -10,7 +10,8 @@ import {
     Matches,
     ValidateNested,
 } from 'class-validator';
-import { regexCurp, regexIso8601Date, regexPhoneMx } from '../../../helpers/constans/regex';
+import { PHONE_MX_ACCEPTED_PATTERN } from '../../../common/constants/InputPatterns';
+import { regexCurp, regexIso8601Date } from '../../../helpers/constans/regex';
 import { RetailAddress } from '../RetailAddress';
 import { KycMethodEnum } from '../../enums/KycMethodEnum';
 import { KycModalityEnum } from '../../enums/KycModalityEnum';
@@ -53,7 +54,7 @@ export class UpsertCustomerFromKycRequest {
     @Expose()
     @Transform(({ value }) => (typeof value === 'string' ? value.replace(/[\s-]/g, '') : value))
     @IsString()
-    @Matches(regexPhoneMx, { message: 'phone debe ser 10 dígitos MX' })
+    @Matches(PHONE_MX_ACCEPTED_PATTERN, { message: 'phone debe ser 10 dígitos MX, con o sin +52' })
     phone!: string;
 
     // Normalización en el boundary: el CURP se uppercasea para no evadir la unicidad transaccional

package/src/retailOrg/dtos/requests/LinkRetailUserWalletRequest.ts

@@ -1,5 +1,6 @@
 import { Expose } from 'class-transformer';
 import { IsOptional, IsString, Matches, Validate, ValidateIf } from 'class-validator';
+import { PHONE_MX_ACCEPTED_PATTERN } from '../../../common/constants/InputPatterns';
 import { IsSingleWalletKeyConstraint } from '../../validators/IsSingleWalletKeyConstraint';
 
 /**
@@ -19,6 +20,6 @@ export class LinkRetailUserWalletRequest {
     @Expose()
     @IsOptional()
     @IsString({ message: 'phone debe ser texto' })
-    @Matches(/^(\+52)?\d{10}$/, { message: 'phone debe tener 10 dígitos, con o sin +52' })
+    @Matches(PHONE_MX_ACCEPTED_PATTERN, { message: 'phone debe tener 10 dígitos, con o sin +52' })
     phone?: string | null;
 }

package/src/retailOrg/dtos/requests/LookupRetailUserWalletRequest.ts

@@ -1,5 +1,6 @@
 import { Expose } from 'class-transformer';
 import { IsOptional, IsString, Matches, Validate, ValidateIf } from 'class-validator';
+import { PHONE_MX_ACCEPTED_PATTERN } from '../../../common/constants/InputPatterns';
 import { IsSingleWalletKeyConstraint } from '../../validators/IsSingleWalletKeyConstraint';
 
 /**
@@ -19,6 +20,6 @@ export class LookupRetailUserWalletRequest {
     @Expose()
     @IsOptional()
     @IsString({ message: 'phone debe ser texto' })
-    @Matches(/^(\+52)?\d{10}$/, { message: 'phone debe tener 10 dígitos, con o sin +52' })
+    @Matches(PHONE_MX_ACCEPTED_PATTERN, { message: 'phone debe tener 10 dígitos, con o sin +52' })
     phone?: string | null;
 }

package/src/retailWizard/dtos/requests/StartSessionRequest.ts

@@ -1,6 +1,6 @@
 import { Expose } from 'class-transformer';
 import { IsBoolean, IsOptional, IsString, Matches } from 'class-validator';
-import { regexPhoneMx } from '../../../helpers/constans/regex';
+import { PHONE_MX_ACCEPTED_PATTERN } from '../../../common/constants/InputPatterns';
 
 /**
  * POST /wizard/sessions — arranca (o reanuda) la saga del wizard para un teléfono.
@@ -10,7 +10,7 @@ import { regexPhoneMx } from '../../../helpers/constans/regex';
 export class StartSessionRequest {
   @Expose()
   @IsString()
-  @Matches(regexPhoneMx, { message: 'phone debe ser un teléfono MX de 10 dígitos' })
+  @Matches(PHONE_MX_ACCEPTED_PATTERN, { message: 'phone debe ser un teléfono MX de 10 dígitos, con o sin +52' })
   phone!: string;
 
   /** Prospecto a reanudar (opcional): si viene, la sesión se vincula al prospecto. */