@fiado/type-kit 3.77.0 → 3.79.0

package/bin/platformRbac/dtos/TenantSecurityPolicyResponse.d.ts

@@ -0,0 +1,10 @@
+/**
+ * Output de la consulta/actualización de la security policy del tenant. Response plain sin
+ * validators (no validamos lo que mandamos al cliente — fiado-validation-and-dtos § 7).
+ *
+ * TD-RBAC-071: methodsAllowed usa el value-set 'EMAIL'|'TOTP' (string), distinto de
+ * MfaMethodEnum ('EMAIL_OTP'|'TOTP') a propósito. Ver TECH_DEBT.md del platform-rbac-business.
+ */
+export interface TenantSecurityPolicyResponse {
+    methodsAllowed: ('EMAIL' | 'TOTP')[];
+}

package/bin/platformRbac/dtos/TenantSecurityPolicyResponse.js

@@ -0,0 +1,2 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });

package/bin/platformRbac/dtos/UpdateTenantSecurityPolicyRequest.d.ts

@@ -0,0 +1,3 @@
+export declare class UpdateTenantSecurityPolicyRequest {
+    methodsAllowed: ('EMAIL' | 'TOTP')[];
+}

package/bin/platformRbac/dtos/UpdateTenantSecurityPolicyRequest.js

@@ -0,0 +1,25 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.UpdateTenantSecurityPolicyRequest = void 0;
+const class_transformer_1 = require("class-transformer");
+const class_validator_1 = require("class-validator");
+// TD-RBAC-071: methodsAllowed usa el value-set 'EMAIL'|'TOTP' (string), distinto de MfaMethodEnum
+// ('EMAIL_OTP'|'TOTP') a propósito. Ver TECH_DEBT.md del platform-rbac-business.
+class UpdateTenantSecurityPolicyRequest {
+}
+exports.UpdateTenantSecurityPolicyRequest = UpdateTenantSecurityPolicyRequest;
+__decorate([
+    (0, class_transformer_1.Expose)(),
+    (0, class_validator_1.ArrayNotEmpty)(),
+    (0, class_validator_1.IsIn)(['EMAIL', 'TOTP'], { each: true }),
+    __metadata("design:type", Array)
+], UpdateTenantSecurityPolicyRequest.prototype, "methodsAllowed", void 0);

package/bin/platformRbac/index.d.ts

@@ -20,9 +20,12 @@ export * from './mfa/EnrollTotpResponse';
 export * from './mfa/VerifyTotpEnrollmentRequest';
 export * from './mfa/ChangeMfaMethodRequest';
 export * from './mfa/MfaStatusResponse';
+export * from './mfa/MfaOptionsResponse';
 export { AuthorizeDenyReason } from './enums/AuthorizeDenyReason';
 export * from './dtos/AuthorizeRequest';
 export * from './dtos/AuthorizeResponse';
 export * from './dtos/CreateTenantRequest';
 export type { CreateTenantResponse } from './dtos/CreateTenantResponse';
+export * from './dtos/UpdateTenantSecurityPolicyRequest';
+export type { TenantSecurityPolicyResponse } from './dtos/TenantSecurityPolicyResponse';
 export { TenantType, TENANT_TYPES, levelsOf, tableSuffixForLevel, scopeRankOrder } from './tenantTypes';

package/bin/platformRbac/index.js

@@ -51,6 +51,7 @@ __exportStar(require("./mfa/EnrollTotpResponse"), exports);
 __exportStar(require("./mfa/VerifyTotpEnrollmentRequest"), exports);
 __exportStar(require("./mfa/ChangeMfaMethodRequest"), exports);
 __exportStar(require("./mfa/MfaStatusResponse"), exports);
+__exportStar(require("./mfa/MfaOptionsResponse"), exports);
 // RBAC enforcement (capa de protección) — DTOs del POST /internal/authorize.
 var AuthorizeDenyReason_1 = require("./enums/AuthorizeDenyReason");
 Object.defineProperty(exports, "AuthorizeDenyReason", { enumerable: true, get: function () { return AuthorizeDenyReason_1.AuthorizeDenyReason; } });
@@ -59,6 +60,10 @@ __exportStar(require("./dtos/AuthorizeResponse"), exports);
 // F-11 — onboarding de tenant (POST backoffice createTenant). CreateTenantRequest lleva
 // decoradores class-validator → export de valor; CreateTenantResponse es interface → type-only.
 __exportStar(require("./dtos/CreateTenantRequest"), exports);
+// MFA por tenant — methodsAllowed (value-set 'EMAIL'|'TOTP', TD-RBAC-071, DEC-095).
+// UpdateTenantSecurityPolicyRequest lleva decoradores class-validator → export de valor;
+// TenantSecurityPolicyResponse es interface plain → type-only.
+__exportStar(require("./dtos/UpdateTenantSecurityPolicyRequest"), exports);
 // A1 — registro data-driven de tenant-types (niveles debajo de TENANT, por tipo).
 // Consumido por ScopeValidationService._rank vía scopeRankOrder() y por los seeds.
 // Accesible bajo el namespace PlatformRbac (el index raíz hace export * as PlatformRbac).

package/bin/platformRbac/mfa/MfaOptionsResponse.d.ts

@@ -0,0 +1,6 @@
+import { MfaMethodEnum } from '../enums/MfaMethodEnum';
+export declare class MfaOptionsResponse {
+    allowedMethods: MfaMethodEnum[];
+    currentMethod: MfaMethodEnum;
+    mfaConfigured: boolean;
+}

package/bin/platformRbac/mfa/MfaOptionsResponse.js

@@ -0,0 +1,30 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.MfaOptionsResponse = void 0;
+const class_validator_1 = require("class-validator");
+const MfaMethodEnum_1 = require("../enums/MfaMethodEnum");
+class MfaOptionsResponse {
+}
+exports.MfaOptionsResponse = MfaOptionsResponse;
+__decorate([
+    (0, class_validator_1.IsArray)(),
+    (0, class_validator_1.IsEnum)(MfaMethodEnum_1.MfaMethodEnum, { each: true }),
+    __metadata("design:type", Array)
+], MfaOptionsResponse.prototype, "allowedMethods", void 0);
+__decorate([
+    (0, class_validator_1.IsEnum)(MfaMethodEnum_1.MfaMethodEnum),
+    __metadata("design:type", String)
+], MfaOptionsResponse.prototype, "currentMethod", void 0);
+__decorate([
+    (0, class_validator_1.IsBoolean)(),
+    __metadata("design:type", Boolean)
+], MfaOptionsResponse.prototype, "mfaConfigured", void 0);

package/bin/riskProfile/dtos/private/CreateProfileNoteRequest.d.ts

@@ -0,0 +1,13 @@
+/**
+ * Request de `POST /risk/backoffice/profiles/{directoryId}/notes` (BO-03 §3.3).
+ *
+ * Nota de revisión humana del OC sobre el perfil. Cualquier nota cuenta como
+ * revisión y reinicia el sello `lastReviewedAt`/`lastReviewedBy` del perfil
+ * (Manual de Cumplimiento sec. 8.25 / Art. 24 — re-evaluación cíclica).
+ * No se distingue "Revisión OK" de "Nota libre".
+ */
+export declare class CreateProfileNoteRequest {
+    email: string;
+    comment: string;
+    attachmentKeys?: string[];
+}

package/bin/riskProfile/dtos/private/CreateProfileNoteRequest.js

@@ -0,0 +1,44 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CreateProfileNoteRequest = void 0;
+const class_transformer_1 = require("class-transformer");
+const class_validator_1 = require("class-validator");
+/**
+ * Request de `POST /risk/backoffice/profiles/{directoryId}/notes` (BO-03 §3.3).
+ *
+ * Nota de revisión humana del OC sobre el perfil. Cualquier nota cuenta como
+ * revisión y reinicia el sello `lastReviewedAt`/`lastReviewedBy` del perfil
+ * (Manual de Cumplimiento sec. 8.25 / Art. 24 — re-evaluación cíclica).
+ * No se distingue "Revisión OK" de "Nota libre".
+ */
+class CreateProfileNoteRequest {
+}
+exports.CreateProfileNoteRequest = CreateProfileNoteRequest;
+__decorate([
+    (0, class_transformer_1.Expose)(),
+    (0, class_validator_1.IsEmail)({}, { message: "email debe ser un correo válido" }),
+    __metadata("design:type", String)
+], CreateProfileNoteRequest.prototype, "email", void 0);
+__decorate([
+    (0, class_transformer_1.Expose)(),
+    (0, class_validator_1.IsString)(),
+    (0, class_validator_1.MinLength)(10),
+    (0, class_validator_1.MaxLength)(2000),
+    __metadata("design:type", String)
+], CreateProfileNoteRequest.prototype, "comment", void 0);
+__decorate([
+    (0, class_transformer_1.Expose)(),
+    (0, class_validator_1.IsOptional)(),
+    (0, class_validator_1.IsArray)(),
+    (0, class_validator_1.IsString)({ each: true }),
+    __metadata("design:type", Array)
+], CreateProfileNoteRequest.prototype, "attachmentKeys", void 0);

package/bin/riskProfile/index.d.ts

@@ -40,3 +40,4 @@ export * from './dtos/private/SetDeclaredIncomeResponse';
 export * from './dtos/private/CreateClientFinancialHistoryRequest';
 export * from './dtos/private/ClientFinancialHistoryResponse';
 export * from './dtos/private/ListClientFinancialHistoryResponse';
+export * from './dtos/private/CreateProfileNoteRequest';

package/bin/riskProfile/index.js

@@ -58,3 +58,4 @@ __exportStar(require("./dtos/private/SetDeclaredIncomeResponse"), exports);
 __exportStar(require("./dtos/private/CreateClientFinancialHistoryRequest"), exports);
 __exportStar(require("./dtos/private/ClientFinancialHistoryResponse"), exports);
 __exportStar(require("./dtos/private/ListClientFinancialHistoryResponse"), exports);
+__exportStar(require("./dtos/private/CreateProfileNoteRequest"), exports);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fiado/type-kit",
-  "version": "3.77.0",
+  "version": "3.79.0",
   "description": "",
   "main": "bin/index.js",
   "types": "bin/index.d.ts",

package/src/platformRbac/dtos/TenantSecurityPolicyResponse.ts

@@ -0,0 +1,10 @@
+/**
+ * Output de la consulta/actualización de la security policy del tenant. Response plain sin
+ * validators (no validamos lo que mandamos al cliente — fiado-validation-and-dtos § 7).
+ *
+ * TD-RBAC-071: methodsAllowed usa el value-set 'EMAIL'|'TOTP' (string), distinto de
+ * MfaMethodEnum ('EMAIL_OTP'|'TOTP') a propósito. Ver TECH_DEBT.md del platform-rbac-business.
+ */
+export interface TenantSecurityPolicyResponse {
+    methodsAllowed: ('EMAIL' | 'TOTP')[];
+}

package/src/platformRbac/dtos/UpdateTenantSecurityPolicyRequest.ts

@@ -0,0 +1,11 @@
+import { Expose } from 'class-transformer';
+import { ArrayNotEmpty, IsIn } from 'class-validator';
+
+// TD-RBAC-071: methodsAllowed usa el value-set 'EMAIL'|'TOTP' (string), distinto de MfaMethodEnum
+// ('EMAIL_OTP'|'TOTP') a propósito. Ver TECH_DEBT.md del platform-rbac-business.
+export class UpdateTenantSecurityPolicyRequest {
+    @Expose()
+    @ArrayNotEmpty()
+    @IsIn(['EMAIL', 'TOTP'], { each: true })
+    methodsAllowed!: ('EMAIL' | 'TOTP')[];
+}

package/src/platformRbac/index.ts

@@ -40,6 +40,7 @@ export * from './mfa/EnrollTotpResponse';
 export * from './mfa/VerifyTotpEnrollmentRequest';
 export * from './mfa/ChangeMfaMethodRequest';
 export * from './mfa/MfaStatusResponse';
+export * from './mfa/MfaOptionsResponse';
 
 // RBAC enforcement (capa de protección) — DTOs del POST /internal/authorize.
 export { AuthorizeDenyReason } from './enums/AuthorizeDenyReason';
@@ -51,6 +52,12 @@ export * from './dtos/AuthorizeResponse';
 export * from './dtos/CreateTenantRequest';
 export type { CreateTenantResponse } from './dtos/CreateTenantResponse';
 
+// MFA por tenant — methodsAllowed (value-set 'EMAIL'|'TOTP', TD-RBAC-071, DEC-095).
+// UpdateTenantSecurityPolicyRequest lleva decoradores class-validator → export de valor;
+// TenantSecurityPolicyResponse es interface plain → type-only.
+export * from './dtos/UpdateTenantSecurityPolicyRequest';
+export type { TenantSecurityPolicyResponse } from './dtos/TenantSecurityPolicyResponse';
+
 // A1 — registro data-driven de tenant-types (niveles debajo de TENANT, por tipo).
 // Consumido por ScopeValidationService._rank vía scopeRankOrder() y por los seeds.
 // Accesible bajo el namespace PlatformRbac (el index raíz hace export * as PlatformRbac).

package/src/platformRbac/mfa/MfaOptionsResponse.ts

@@ -0,0 +1,14 @@
+import { IsArray, IsBoolean, IsEnum } from 'class-validator';
+import { MfaMethodEnum } from '../enums/MfaMethodEnum';
+
+export class MfaOptionsResponse {
+    @IsArray()
+    @IsEnum(MfaMethodEnum, { each: true })
+    allowedMethods!: MfaMethodEnum[];
+
+    @IsEnum(MfaMethodEnum)
+    currentMethod!: MfaMethodEnum;
+
+    @IsBoolean()
+    mfaConfigured!: boolean;
+}

package/src/riskProfile/dtos/private/CreateProfileNoteRequest.ts

@@ -0,0 +1,32 @@
+import { Expose } from "class-transformer";
+import { IsArray, IsEmail, IsOptional, IsString, MaxLength, MinLength } from "class-validator";
+
+/**
+ * Request de `POST /risk/backoffice/profiles/{directoryId}/notes` (BO-03 §3.3).
+ *
+ * Nota de revisión humana del OC sobre el perfil. Cualquier nota cuenta como
+ * revisión y reinicia el sello `lastReviewedAt`/`lastReviewedBy` del perfil
+ * (Manual de Cumplimiento sec. 8.25 / Art. 24 — re-evaluación cíclica).
+ * No se distingue "Revisión OK" de "Nota libre".
+ */
+export class CreateProfileNoteRequest {
+
+    // Email del OC que registra la nota → se persiste como autor + lastReviewedBy.
+    @Expose()
+    @IsEmail({}, { message: "email debe ser un correo válido" })
+    email!: string;
+
+    // Texto de la nota. Entre 10 y 2000 caracteres.
+    @Expose()
+    @IsString()
+    @MinLength(10)
+    @MaxLength(2000)
+    comment!: string;
+
+    // Claves S3 de adjuntos opcionales (PDF/imagen). El Dashboard firma y sube.
+    @Expose()
+    @IsOptional()
+    @IsArray()
+    @IsString({ each: true })
+    attachmentKeys?: string[];
+}

package/src/riskProfile/index.ts

@@ -45,4 +45,5 @@ export * from './dtos/private/SetDeclaredIncomeResponse';
 export * from './dtos/private/CreateClientFinancialHistoryRequest';
 export * from './dtos/private/ClientFinancialHistoryResponse';
 export * from './dtos/private/ListClientFinancialHistoryResponse';
+export * from './dtos/private/CreateProfileNoteRequest';