permissions-contractx 1.6.0 → 2.0.0

package/dist/constants/contractx-roles.constants.d.ts

@@ -1,6 +1,14 @@
 /**
  * ContractX Role Constants
- * Based on the ODS permissions matrix and auth-service-contract structure
+ * ------------------------------------------------------------------------
+ * FUENTE DE VERDAD: el servicio de Auth (`contractx-Auth`,
+ * `src/common/constants/security.constants.ts` → `ROLES`). Estas constantes
+ * DEBEN reflejar exactamente los `code` de rol que Auth emite en el claim
+ * `role[]` del JWT. Cualquier divergencia (p. ej. `superadmin` vs `super_admin`,
+ * `*_manager` vs `*_resp`) rompe la comparación de roles en los guards.
+ *
+ * Matriz v5 (14 roles de negocio) + `support`. Reconciliado con Auth (2026-06).
+ * ------------------------------------------------------------------------
  */
 export declare enum ContractXRoleType {
     ADMIN = "admin",
@@ -18,23 +26,24 @@ export declare enum ContractXRoleScope {
     TEAM = "team"
 }
 export declare const CONTRACTX_ROLES: {
-    SUPERADMIN: string;
+    SUPER_ADMIN: string;
     SUPPORT: string;
+    CLIENT_SUPERADMIN: string;
     CLIENT_CONTRACT_ADMIN: string;
-    CLIENT_PERFORMANCE_MANAGER: string;
-    CLIENT_FINANCE_MANAGER: string;
-    CLIENT_REPORTS_MANAGER: string;
-    CLIENT_RELATIONSHIP_MANAGER: string;
-    CLIENT_RISK_MANAGER: string;
+    CLIENT_PERFORMANCE_RESP: string;
+    CLIENT_FINANCE_RESP: string;
+    CLIENT_REPORTS_RESP: string;
+    CLIENT_RELATIONSHIP_RESP: string;
+    CLIENT_RISK_RESP: string;
     PROVIDER_CONTRACT_ADMIN: string;
-    PROVIDER_PERFORMANCE_MANAGER: string;
-    PROVIDER_FINANCE_MANAGER: string;
-    PROVIDER_REPORTS_MANAGER: string;
-    PROVIDER_RELATIONSHIP_MANAGER: string;
-    PROVIDER_RISK_MANAGER: string;
+    PROVIDER_PERFORMANCE_RESP: string;
+    PROVIDER_FINANCE_RESP: string;
+    PROVIDER_REPORTS_RESP: string;
+    PROVIDER_RELATIONSHIP_RESP: string;
+    PROVIDER_RISK_RESP: string;
 };
 export declare const CONTRACTX_ROLE_DEFINITIONS: {
-    [CONTRACTX_ROLES.SUPERADMIN]: {
+    [CONTRACTX_ROLES.SUPER_ADMIN]: {
         name: string;
         description: string;
         type: ContractXRoleType;
@@ -52,6 +61,15 @@ export declare const CONTRACTX_ROLE_DEFINITIONS: {
         isSystem: boolean;
         tenant: string;
     };
+    [CONTRACTX_ROLES.CLIENT_SUPERADMIN]: {
+        name: string;
+        description: string;
+        type: ContractXRoleType;
+        scope: ContractXRoleScope;
+        level: number;
+        isSystem: boolean;
+        tenant: string;
+    };
     [CONTRACTX_ROLES.CLIENT_CONTRACT_ADMIN]: {
         name: string;
         description: string;
@@ -61,7 +79,7 @@ export declare const CONTRACTX_ROLE_DEFINITIONS: {
         isSystem: boolean;
         tenant: string;
     };
-    [CONTRACTX_ROLES.CLIENT_PERFORMANCE_MANAGER]: {
+    [CONTRACTX_ROLES.CLIENT_PERFORMANCE_RESP]: {
         name: string;
         description: string;
         type: ContractXRoleType;
@@ -70,7 +88,7 @@ export declare const CONTRACTX_ROLE_DEFINITIONS: {
         isSystem: boolean;
         tenant: string;
     };
-    [CONTRACTX_ROLES.CLIENT_FINANCE_MANAGER]: {
+    [CONTRACTX_ROLES.CLIENT_FINANCE_RESP]: {
         name: string;
         description: string;
         type: ContractXRoleType;
@@ -79,7 +97,7 @@ export declare const CONTRACTX_ROLE_DEFINITIONS: {
         isSystem: boolean;
         tenant: string;
     };
-    [CONTRACTX_ROLES.CLIENT_REPORTS_MANAGER]: {
+    [CONTRACTX_ROLES.CLIENT_REPORTS_RESP]: {
         name: string;
         description: string;
         type: ContractXRoleType;
@@ -88,7 +106,7 @@ export declare const CONTRACTX_ROLE_DEFINITIONS: {
         isSystem: boolean;
         tenant: string;
     };
-    [CONTRACTX_ROLES.CLIENT_RELATIONSHIP_MANAGER]: {
+    [CONTRACTX_ROLES.CLIENT_RELATIONSHIP_RESP]: {
         name: string;
         description: string;
         type: ContractXRoleType;
@@ -97,7 +115,7 @@ export declare const CONTRACTX_ROLE_DEFINITIONS: {
         isSystem: boolean;
         tenant: string;
     };
-    [CONTRACTX_ROLES.CLIENT_RISK_MANAGER]: {
+    [CONTRACTX_ROLES.CLIENT_RISK_RESP]: {
         name: string;
         description: string;
         type: ContractXRoleType;
@@ -115,7 +133,7 @@ export declare const CONTRACTX_ROLE_DEFINITIONS: {
         isSystem: boolean;
         tenant: string;
     };
-    [CONTRACTX_ROLES.PROVIDER_PERFORMANCE_MANAGER]: {
+    [CONTRACTX_ROLES.PROVIDER_PERFORMANCE_RESP]: {
         name: string;
         description: string;
         type: ContractXRoleType;
@@ -124,7 +142,7 @@ export declare const CONTRACTX_ROLE_DEFINITIONS: {
         isSystem: boolean;
         tenant: string;
     };
-    [CONTRACTX_ROLES.PROVIDER_FINANCE_MANAGER]: {
+    [CONTRACTX_ROLES.PROVIDER_FINANCE_RESP]: {
         name: string;
         description: string;
         type: ContractXRoleType;
@@ -133,7 +151,7 @@ export declare const CONTRACTX_ROLE_DEFINITIONS: {
         isSystem: boolean;
         tenant: string;
     };
-    [CONTRACTX_ROLES.PROVIDER_REPORTS_MANAGER]: {
+    [CONTRACTX_ROLES.PROVIDER_REPORTS_RESP]: {
         name: string;
         description: string;
         type: ContractXRoleType;
@@ -142,7 +160,7 @@ export declare const CONTRACTX_ROLE_DEFINITIONS: {
         isSystem: boolean;
         tenant: string;
     };
-    [CONTRACTX_ROLES.PROVIDER_RELATIONSHIP_MANAGER]: {
+    [CONTRACTX_ROLES.PROVIDER_RELATIONSHIP_RESP]: {
         name: string;
         description: string;
         type: ContractXRoleType;
@@ -151,7 +169,7 @@ export declare const CONTRACTX_ROLE_DEFINITIONS: {
         isSystem: boolean;
         tenant: string;
     };
-    [CONTRACTX_ROLES.PROVIDER_RISK_MANAGER]: {
+    [CONTRACTX_ROLES.PROVIDER_RISK_RESP]: {
         name: string;
         description: string;
         type: ContractXRoleType;

package/dist/constants/contractx-roles.constants.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"contractx-roles.constants.d.ts","sourceRoot":"","sources":["../../src/constants/contractx-roles.constants.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,oBAAY,iBAAiB;IAC3B,KAAK,UAAU;IACf,OAAO,YAAY;IACnB,QAAQ,aAAa;IACrB,MAAM,WAAW;IACjB,MAAM,WAAW;IACjB,MAAM,WAAW;CAClB;AAED,oBAAY,kBAAkB;IAC5B,MAAM,WAAW;IACjB,YAAY,iBAAiB;IAC7B,OAAO,YAAY;IACnB,UAAU,eAAe;IACzB,IAAI,SAAS;CACd;AAED,eAAO,MAAM,eAAe;;;;;;;;;;;;;;;CAkB3B,CAAC;AAEF,eAAO,MAAM,0BAA0B;IACnC,CAAC,eAAe,CAAC,UAAU,CAAC;;;;;;;;MAQ3B;IACD,CAAC,eAAe,CAAC,OAAO,CAAC;;;;;;;;MAQxB;IAED,CAAC,eAAe,CAAC,qBAAqB,CAAC;;;;;;;;MAQtC;IACD,CAAC,eAAe,CAAC,0BAA0B,CAAC;;;;;;;;MAQ3C;IACD,CAAC,eAAe,CAAC,sBAAsB,CAAC;;;;;;;;MAQvC;IACD,CAAC,eAAe,CAAC,sBAAsB,CAAC;;;;;;;;MAQvC;IACD,CAAC,eAAe,CAAC,2BAA2B,CAAC;;;;;;;;MAQ5C;IACD,CAAC,eAAe,CAAC,mBAAmB,CAAC;;;;;;;;MAQpC;IAED,CAAC,eAAe,CAAC,uBAAuB,CAAC;;;;;;;;MAQxC;IACD,CAAC,eAAe,CAAC,4BAA4B,CAAC;;;;;;;;MAQ7C;IACD,CAAC,eAAe,CAAC,wBAAwB,CAAC;;;;;;;;MAQzC;IACD,CAAC,eAAe,CAAC,wBAAwB,CAAC;;;;;;;;MAQzC;IACD,CAAC,eAAe,CAAC,6BAA6B,CAAC;;;;;;;;MAQ9C;IACD,CAAC,eAAe,CAAC,qBAAqB,CAAC;;;;;;;;MAQtC;CACJ,CAAC;AAEF,eAAO,MAAM,qBAAqB,UAAiC,CAAC;AAEpE,eAAO,MAAM,qBAAqB;;;;;;CA+BjC,CAAC;AAEF,eAAO,MAAM,YAAY,GAAI,SAAI,YAEhC,CAAC;AACF,eAAO,MAAM,YAAY,GAAI,SAAI,YAEhC,CAAC;AACF,eAAO,MAAM,cAAc,GAAI,SAAI,YAElC,CAAC;AACF,eAAO,MAAM,WAAW,GAAI,SAAI,YAE/B,CAAC;AACF,eAAO,MAAM,eAAe,GAAI,SAAI;;;;;;;;CAEnC,CAAC;AACF,eAAO,MAAM,YAAY,GAAI,SAAI,YAEhC,CAAC;AAIF,MAAM,MAAM,aAAa,GAAG,CAAC,OAAO,eAAe,CAAC,CAAC,MAAM,OAAO,eAAe,CAAC,CAAC;AACnF,MAAM,MAAM,mBAAmB,GAAG,CAAC,OAAO,qBAAqB,CAAC,YAAY,CAAC,CAAC,MAAM,CAAC,CAAC;AACtF,MAAM,MAAM,mBAAmB,GAAG,CAAC,OAAO,qBAAqB,CAAC,YAAY,CAAC,CAAC,MAAM,CAAC,CAAC;AACtF,MAAM,MAAM,qBAAqB,GAAG,CAAC,OAAO,qBAAqB,CAAC,cAAc,CAAC,CAAC,MAAM,CAAC,CAAC;AAC1F,MAAM,MAAM,kBAAkB,GAAG,CAAC,OAAO,qBAAqB,CAAC,WAAW,CAAC,CAAC,MAAM,CAAC,CAAC"}
+{"version":3,"file":"contractx-roles.constants.d.ts","sourceRoot":"","sources":["../../src/constants/contractx-roles.constants.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,oBAAY,iBAAiB;IAC3B,KAAK,UAAU;IACf,OAAO,YAAY;IACnB,QAAQ,aAAa;IACrB,MAAM,WAAW;IACjB,MAAM,WAAW;IACjB,MAAM,WAAW;CAClB;AAED,oBAAY,kBAAkB;IAC5B,MAAM,WAAW;IACjB,YAAY,iBAAiB;IAC7B,OAAO,YAAY;IACnB,UAAU,eAAe;IACzB,IAAI,SAAS;CACd;AAED,eAAO,MAAM,eAAe;;;;;;;;;;;;;;;;CAmB3B,CAAC;AAEF,eAAO,MAAM,0BAA0B;IACnC,CAAC,eAAe,CAAC,WAAW,CAAC;;;;;;;;MAQ5B;IACD,CAAC,eAAe,CAAC,OAAO,CAAC;;;;;;;;MAQxB;IAED,CAAC,eAAe,CAAC,iBAAiB,CAAC;;;;;;;;MAQlC;IACD,CAAC,eAAe,CAAC,qBAAqB,CAAC;;;;;;;;MAQtC;IACD,CAAC,eAAe,CAAC,uBAAuB,CAAC;;;;;;;;MAQxC;IACD,CAAC,eAAe,CAAC,mBAAmB,CAAC;;;;;;;;MAQpC;IACD,CAAC,eAAe,CAAC,mBAAmB,CAAC;;;;;;;;MAQpC;IACD,CAAC,eAAe,CAAC,wBAAwB,CAAC;;;;;;;;MAQzC;IACD,CAAC,eAAe,CAAC,gBAAgB,CAAC;;;;;;;;MAQjC;IAED,CAAC,eAAe,CAAC,uBAAuB,CAAC;;;;;;;;MAQxC;IACD,CAAC,eAAe,CAAC,yBAAyB,CAAC;;;;;;;;MAQ1C;IACD,CAAC,eAAe,CAAC,qBAAqB,CAAC;;;;;;;;MAQtC;IACD,CAAC,eAAe,CAAC,qBAAqB,CAAC;;;;;;;;MAQtC;IACD,CAAC,eAAe,CAAC,0BAA0B,CAAC;;;;;;;;MAQ3C;IACD,CAAC,eAAe,CAAC,kBAAkB,CAAC;;;;;;;;MAQnC;CACJ,CAAC;AAEF,eAAO,MAAM,qBAAqB,UAAiC,CAAC;AAEpE,eAAO,MAAM,qBAAqB;;;;;;CAiCjC,CAAC;AAEF,eAAO,MAAM,YAAY,GAAI,SAAI,YAEhC,CAAC;AACF,eAAO,MAAM,YAAY,GAAI,SAAI,YAEhC,CAAC;AACF,eAAO,MAAM,cAAc,GAAI,SAAI,YAElC,CAAC;AACF,eAAO,MAAM,WAAW,GAAI,SAAI,YAE/B,CAAC;AACF,eAAO,MAAM,eAAe,GAAI,SAAI;;;;;;;;CAEnC,CAAC;AACF,eAAO,MAAM,YAAY,GAAI,SAAI,YAEhC,CAAC;AAIF,MAAM,MAAM,aAAa,GAAG,CAAC,OAAO,eAAe,CAAC,CAAC,MAAM,OAAO,eAAe,CAAC,CAAC;AACnF,MAAM,MAAM,mBAAmB,GAAG,CAAC,OAAO,qBAAqB,CAAC,YAAY,CAAC,CAAC,MAAM,CAAC,CAAC;AACtF,MAAM,MAAM,mBAAmB,GAAG,CAAC,OAAO,qBAAqB,CAAC,YAAY,CAAC,CAAC,MAAM,CAAC,CAAC;AACtF,MAAM,MAAM,qBAAqB,GAAG,CAAC,OAAO,qBAAqB,CAAC,cAAc,CAAC,CAAC,MAAM,CAAC,CAAC;AAC1F,MAAM,MAAM,kBAAkB,GAAG,CAAC,OAAO,qBAAqB,CAAC,WAAW,CAAC,CAAC,MAAM,CAAC,CAAC"}

package/dist/constants/contractx-roles.constants.js

@@ -3,7 +3,15 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.validateRole = exports.getRoleMetadata = exports.isAdminRole = exports.isProviderRole = exports.isClientRole = exports.isSystemRole = exports.CONTRACTX_ROLE_GROUPS = exports.VALID_CONTRACTX_ROLES = exports.CONTRACTX_ROLE_DEFINITIONS = exports.CONTRACTX_ROLES = exports.ContractXRoleScope = exports.ContractXRoleType = void 0;
 /**
  * ContractX Role Constants
- * Based on the ODS permissions matrix and auth-service-contract structure
+ * ------------------------------------------------------------------------
+ * FUENTE DE VERDAD: el servicio de Auth (`contractx-Auth`,
+ * `src/common/constants/security.constants.ts` → `ROLES`). Estas constantes
+ * DEBEN reflejar exactamente los `code` de rol que Auth emite en el claim
+ * `role[]` del JWT. Cualquier divergencia (p. ej. `superadmin` vs `super_admin`,
+ * `*_manager` vs `*_resp`) rompe la comparación de roles en los guards.
+ *
+ * Matriz v5 (14 roles de negocio) + `support`. Reconciliado con Auth (2026-06).
+ * ------------------------------------------------------------------------
  */
 // Role Types from auth-service
 var ContractXRoleType;
@@ -24,29 +32,30 @@ var ContractXRoleScope;
     ContractXRoleScope["DEPARTMENT"] = "department";
     ContractXRoleScope["TEAM"] = "team";
 })(ContractXRoleScope || (exports.ContractXRoleScope = ContractXRoleScope = {}));
-// Standard ContractX Roles (based on ODS matrix)
+// Roles canónicos de ContractX — codes IDÉNTICOS a `ROLES` de Auth.
 exports.CONTRACTX_ROLES = {
-    // System Roles
-    SUPERADMIN: 'superadmin',
+    // System
+    SUPER_ADMIN: 'super_admin',
     SUPPORT: 'support',
-    // Client-Side Roles
+    // Client-Side
+    CLIENT_SUPERADMIN: 'client_superadmin',
     CLIENT_CONTRACT_ADMIN: 'client_contract_admin',
-    CLIENT_PERFORMANCE_MANAGER: 'client_performance_manager',
-    CLIENT_FINANCE_MANAGER: 'client_finance_manager',
-    CLIENT_REPORTS_MANAGER: 'client_reports_manager',
-    CLIENT_RELATIONSHIP_MANAGER: 'client_relationship_manager',
-    CLIENT_RISK_MANAGER: 'client_risk_manager',
-    // Provider-Side Roles
+    CLIENT_PERFORMANCE_RESP: 'client_performance_resp',
+    CLIENT_FINANCE_RESP: 'client_finance_resp',
+    CLIENT_REPORTS_RESP: 'client_reports_resp',
+    CLIENT_RELATIONSHIP_RESP: 'client_relationship_resp',
+    CLIENT_RISK_RESP: 'client_risk_resp',
+    // Provider-Side
     PROVIDER_CONTRACT_ADMIN: 'provider_contract_admin',
-    PROVIDER_PERFORMANCE_MANAGER: 'provider_performance_manager',
-    PROVIDER_FINANCE_MANAGER: 'provider_finance_manager',
-    PROVIDER_REPORTS_MANAGER: 'provider_reports_manager',
-    PROVIDER_RELATIONSHIP_MANAGER: 'provider_relationship_manager',
-    PROVIDER_RISK_MANAGER: 'provider_risk_manager',
+    PROVIDER_PERFORMANCE_RESP: 'provider_performance_resp',
+    PROVIDER_FINANCE_RESP: 'provider_finance_resp',
+    PROVIDER_REPORTS_RESP: 'provider_reports_resp',
+    PROVIDER_RELATIONSHIP_RESP: 'provider_relationship_resp',
+    PROVIDER_RISK_RESP: 'provider_risk_resp',
 };
 // Role Definitions with metadata
 exports.CONTRACTX_ROLE_DEFINITIONS = {
-    [exports.CONTRACTX_ROLES.SUPERADMIN]: {
+    [exports.CONTRACTX_ROLES.SUPER_ADMIN]: {
         name: 'Super Administrator',
         description: 'Full system access with all permissions',
         type: ContractXRoleType.ADMIN,
@@ -65,6 +74,15 @@ exports.CONTRACTX_ROLE_DEFINITIONS = {
         tenant: 'system'
     },
     // Client Roles
+    [exports.CONTRACTX_ROLES.CLIENT_SUPERADMIN]: {
+        name: 'Super Admin Cliente',
+        description: 'Administrador máximo por cliente (S-CL)',
+        type: ContractXRoleType.ADMIN,
+        scope: ContractXRoleScope.ORGANIZATION,
+        level: 9,
+        isSystem: false,
+        tenant: 'client'
+    },
     [exports.CONTRACTX_ROLES.CLIENT_CONTRACT_ADMIN]: {
         name: 'Client Contract Administrator',
         description: 'Full contract management for client organization',
@@ -74,8 +92,8 @@ exports.CONTRACTX_ROLE_DEFINITIONS = {
         isSystem: false,
         tenant: 'client'
     },
-    [exports.CONTRACTX_ROLES.CLIENT_PERFORMANCE_MANAGER]: {
-        name: 'Client Performance Manager',
+    [exports.CONTRACTX_ROLES.CLIENT_PERFORMANCE_RESP]: {
+        name: 'Client Performance Responsible',
         description: 'Performance monitoring and SLA management',
         type: ContractXRoleType.OPERATOR,
         scope: ContractXRoleScope.PROJECT,
@@ -83,8 +101,8 @@ exports.CONTRACTX_ROLE_DEFINITIONS = {
         isSystem: false,
         tenant: 'client'
     },
-    [exports.CONTRACTX_ROLES.CLIENT_FINANCE_MANAGER]: {
-        name: 'Client Finance Manager',
+    [exports.CONTRACTX_ROLES.CLIENT_FINANCE_RESP]: {
+        name: 'Client Finance Responsible',
         description: 'Financial management and invoice oversight',
         type: ContractXRoleType.OPERATOR,
         scope: ContractXRoleScope.PROJECT,
@@ -92,8 +110,8 @@ exports.CONTRACTX_ROLE_DEFINITIONS = {
         isSystem: false,
         tenant: 'client'
     },
-    [exports.CONTRACTX_ROLES.CLIENT_REPORTS_MANAGER]: {
-        name: 'Client Reports Manager',
+    [exports.CONTRACTX_ROLES.CLIENT_REPORTS_RESP]: {
+        name: 'Client Reports Responsible',
         description: 'Reporting and analytics access',
         type: ContractXRoleType.VIEWER,
         scope: ContractXRoleScope.PROJECT,
@@ -101,8 +119,8 @@ exports.CONTRACTX_ROLE_DEFINITIONS = {
         isSystem: false,
         tenant: 'client'
     },
-    [exports.CONTRACTX_ROLES.CLIENT_RELATIONSHIP_MANAGER]: {
-        name: 'Client Relationship Manager',
+    [exports.CONTRACTX_ROLES.CLIENT_RELATIONSHIP_RESP]: {
+        name: 'Client Relationship Responsible',
         description: 'Relationship management and meeting coordination',
         type: ContractXRoleType.OPERATOR,
         scope: ContractXRoleScope.PROJECT,
@@ -110,8 +128,8 @@ exports.CONTRACTX_ROLE_DEFINITIONS = {
         isSystem: false,
         tenant: 'client'
     },
-    [exports.CONTRACTX_ROLES.CLIENT_RISK_MANAGER]: {
-        name: 'Client Risk Manager',
+    [exports.CONTRACTX_ROLES.CLIENT_RISK_RESP]: {
+        name: 'Client Risk Responsible',
         description: 'Risk assessment and escalation management',
         type: ContractXRoleType.OPERATOR,
         scope: ContractXRoleScope.PROJECT,
@@ -129,8 +147,8 @@ exports.CONTRACTX_ROLE_DEFINITIONS = {
         isSystem: false,
         tenant: 'provider'
     },
-    [exports.CONTRACTX_ROLES.PROVIDER_PERFORMANCE_MANAGER]: {
-        name: 'Provider Performance Manager',
+    [exports.CONTRACTX_ROLES.PROVIDER_PERFORMANCE_RESP]: {
+        name: 'Provider Performance Responsible',
         description: 'Performance delivery and SLA compliance',
         type: ContractXRoleType.OPERATOR,
         scope: ContractXRoleScope.PROJECT,
@@ -138,8 +156,8 @@ exports.CONTRACTX_ROLE_DEFINITIONS = {
         isSystem: false,
         tenant: 'provider'
     },
-    [exports.CONTRACTX_ROLES.PROVIDER_FINANCE_MANAGER]: {
-        name: 'Provider Finance Manager',
+    [exports.CONTRACTX_ROLES.PROVIDER_FINANCE_RESP]: {
+        name: 'Provider Finance Responsible',
         description: 'Financial management from provider side',
         type: ContractXRoleType.OPERATOR,
         scope: ContractXRoleScope.PROJECT,
@@ -147,8 +165,8 @@ exports.CONTRACTX_ROLE_DEFINITIONS = {
         isSystem: false,
         tenant: 'provider'
     },
-    [exports.CONTRACTX_ROLES.PROVIDER_REPORTS_MANAGER]: {
-        name: 'Provider Reports Manager',
+    [exports.CONTRACTX_ROLES.PROVIDER_REPORTS_RESP]: {
+        name: 'Provider Reports Responsible',
         description: 'Provider reporting capabilities',
         type: ContractXRoleType.VIEWER,
         scope: ContractXRoleScope.PROJECT,
@@ -156,8 +174,8 @@ exports.CONTRACTX_ROLE_DEFINITIONS = {
         isSystem: false,
         tenant: 'provider'
     },
-    [exports.CONTRACTX_ROLES.PROVIDER_RELATIONSHIP_MANAGER]: {
-        name: 'Provider Relationship Manager',
+    [exports.CONTRACTX_ROLES.PROVIDER_RELATIONSHIP_RESP]: {
+        name: 'Provider Relationship Responsible',
         description: 'Client relationship management from provider side',
         type: ContractXRoleType.OPERATOR,
         scope: ContractXRoleScope.PROJECT,
@@ -165,8 +183,8 @@ exports.CONTRACTX_ROLE_DEFINITIONS = {
         isSystem: false,
         tenant: 'provider'
     },
-    [exports.CONTRACTX_ROLES.PROVIDER_RISK_MANAGER]: {
-        name: 'Provider Risk Manager',
+    [exports.CONTRACTX_ROLES.PROVIDER_RISK_RESP]: {
+        name: 'Provider Risk Responsible',
         description: 'Risk management from provider perspective',
         type: ContractXRoleType.OPERATOR,
         scope: ContractXRoleScope.PROJECT,
@@ -179,35 +197,37 @@ exports.CONTRACTX_ROLE_DEFINITIONS = {
 exports.VALID_CONTRACTX_ROLES = Object.values(exports.CONTRACTX_ROLES);
 // Role groups for easier management
 exports.CONTRACTX_ROLE_GROUPS = {
-    SYSTEM_ROLES: [exports.CONTRACTX_ROLES.SUPERADMIN, exports.CONTRACTX_ROLES.SUPPORT],
+    SYSTEM_ROLES: [exports.CONTRACTX_ROLES.SUPER_ADMIN, exports.CONTRACTX_ROLES.SUPPORT],
     CLIENT_ROLES: [
+        exports.CONTRACTX_ROLES.CLIENT_SUPERADMIN,
         exports.CONTRACTX_ROLES.CLIENT_CONTRACT_ADMIN,
-        exports.CONTRACTX_ROLES.CLIENT_PERFORMANCE_MANAGER,
-        exports.CONTRACTX_ROLES.CLIENT_FINANCE_MANAGER,
-        exports.CONTRACTX_ROLES.CLIENT_REPORTS_MANAGER,
-        exports.CONTRACTX_ROLES.CLIENT_RELATIONSHIP_MANAGER,
-        exports.CONTRACTX_ROLES.CLIENT_RISK_MANAGER,
+        exports.CONTRACTX_ROLES.CLIENT_PERFORMANCE_RESP,
+        exports.CONTRACTX_ROLES.CLIENT_FINANCE_RESP,
+        exports.CONTRACTX_ROLES.CLIENT_REPORTS_RESP,
+        exports.CONTRACTX_ROLES.CLIENT_RELATIONSHIP_RESP,
+        exports.CONTRACTX_ROLES.CLIENT_RISK_RESP,
     ],
     PROVIDER_ROLES: [
         exports.CONTRACTX_ROLES.PROVIDER_CONTRACT_ADMIN,
-        exports.CONTRACTX_ROLES.PROVIDER_PERFORMANCE_MANAGER,
-        exports.CONTRACTX_ROLES.PROVIDER_FINANCE_MANAGER,
-        exports.CONTRACTX_ROLES.PROVIDER_REPORTS_MANAGER,
-        exports.CONTRACTX_ROLES.PROVIDER_RELATIONSHIP_MANAGER,
-        exports.CONTRACTX_ROLES.PROVIDER_RISK_MANAGER,
+        exports.CONTRACTX_ROLES.PROVIDER_PERFORMANCE_RESP,
+        exports.CONTRACTX_ROLES.PROVIDER_FINANCE_RESP,
+        exports.CONTRACTX_ROLES.PROVIDER_REPORTS_RESP,
+        exports.CONTRACTX_ROLES.PROVIDER_RELATIONSHIP_RESP,
+        exports.CONTRACTX_ROLES.PROVIDER_RISK_RESP,
     ],
     ADMIN_ROLES: [
-        exports.CONTRACTX_ROLES.SUPERADMIN,
+        exports.CONTRACTX_ROLES.SUPER_ADMIN,
+        exports.CONTRACTX_ROLES.CLIENT_SUPERADMIN,
         exports.CONTRACTX_ROLES.CLIENT_CONTRACT_ADMIN,
         exports.CONTRACTX_ROLES.PROVIDER_CONTRACT_ADMIN,
     ],
     MANAGER_ROLES: [
         exports.CONTRACTX_ROLES.CLIENT_CONTRACT_ADMIN,
         exports.CONTRACTX_ROLES.PROVIDER_CONTRACT_ADMIN,
-        exports.CONTRACTX_ROLES.CLIENT_PERFORMANCE_MANAGER,
-        exports.CONTRACTX_ROLES.PROVIDER_PERFORMANCE_MANAGER,
-        exports.CONTRACTX_ROLES.CLIENT_FINANCE_MANAGER,
-        exports.CONTRACTX_ROLES.PROVIDER_FINANCE_MANAGER,
+        exports.CONTRACTX_ROLES.CLIENT_PERFORMANCE_RESP,
+        exports.CONTRACTX_ROLES.PROVIDER_PERFORMANCE_RESP,
+        exports.CONTRACTX_ROLES.CLIENT_FINANCE_RESP,
+        exports.CONTRACTX_ROLES.PROVIDER_FINANCE_RESP,
     ],
 };
 // Helper functions

package/dist/constants/security.constants.js

@@ -19,7 +19,7 @@ exports.MODULE_CONSTANTS = exports.ROLE_GROUPS = exports.PERMISSION_CATEGORIES =
  */
 exports.CONTRACTX_ROLES = {
     // === SYSTEM ROLE ===
-    SUPERADMIN: 'superadmin', // ID: 1 - Full access to all modules
+    SUPERADMIN: 'super_admin', // ID: 1 - Full access to all modules
     // === CLIENT-SIDE ROLES ===
     CLIENT_CONTRACT_ADMIN: 'client_contract_admin', // ID: 2 - Full contract management for assigned client
     CLIENT_PERFORMANCE_RESP: 'client_performance_resp', // ID: 3 - Performance responsibility role

package/dist/decorators/contract-scoped.decorator.d.ts

@@ -0,0 +1,25 @@
+/**
+ * [Permisos por contrato] Marca un endpoint como SCOPED a un contrato.
+ *
+ * El `AuthorizationGuard` exige que el contrato sobre el que opera la petición
+ * coincida con el `currentContractId` del JWT (el contrato activo que el usuario
+ * seleccionó en Auth). Si no coincide → 403. Esto evita usar un token scopeado al
+ * contrato A para operar sobre el contrato B.
+ *
+ * `path` indica de dónde extraer el contractId de la request, en formato
+ * `<fuente>.<campo>` (p. ej. `'params.id'`, `'params.contractId'`,
+ * `'body.contractId'`, `'query.contractId'`). Si se omite, el guard prueba en orden:
+ *   `params.contractId` → `params.id` → `body.contractId` → `query.contractId`.
+ *
+ * Roles de sistema/globales (`tenantContext='system'` o `super_admin`) hacen bypass
+ * del binding (pueden operar sin contrato activo).
+ *
+ * @example
+ *   @RequirePermissions(CONTRATOS_PERMISSIONS.CONTRACTS_APPROVE)
+ *   @ContractScoped('params.id')
+ *   @Patch(':id/approve')
+ *   approve(@Param('id') id: string) { ... }
+ */
+export declare const CONTRACT_SCOPED_KEY = "contract_scoped";
+export declare const ContractScoped: (path?: string) => import("@nestjs/common").CustomDecorator<string>;
+//# sourceMappingURL=contract-scoped.decorator.d.ts.map

package/dist/decorators/contract-scoped.decorator.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"contract-scoped.decorator.d.ts","sourceRoot":"","sources":["../../src/decorators/contract-scoped.decorator.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,eAAO,MAAM,mBAAmB,oBAAoB,CAAC;AAErD,eAAO,MAAM,cAAc,GAAI,OAAO,MAAM,qDAAiD,CAAC"}

package/dist/decorators/contract-scoped.decorator.js

@@ -0,0 +1,29 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ContractScoped = exports.CONTRACT_SCOPED_KEY = void 0;
+const common_1 = require("@nestjs/common");
+/**
+ * [Permisos por contrato] Marca un endpoint como SCOPED a un contrato.
+ *
+ * El `AuthorizationGuard` exige que el contrato sobre el que opera la petición
+ * coincida con el `currentContractId` del JWT (el contrato activo que el usuario
+ * seleccionó en Auth). Si no coincide → 403. Esto evita usar un token scopeado al
+ * contrato A para operar sobre el contrato B.
+ *
+ * `path` indica de dónde extraer el contractId de la request, en formato
+ * `<fuente>.<campo>` (p. ej. `'params.id'`, `'params.contractId'`,
+ * `'body.contractId'`, `'query.contractId'`). Si se omite, el guard prueba en orden:
+ *   `params.contractId` → `params.id` → `body.contractId` → `query.contractId`.
+ *
+ * Roles de sistema/globales (`tenantContext='system'` o `super_admin`) hacen bypass
+ * del binding (pueden operar sin contrato activo).
+ *
+ * @example
+ *   @RequirePermissions(CONTRATOS_PERMISSIONS.CONTRACTS_APPROVE)
+ *   @ContractScoped('params.id')
+ *   @Patch(':id/approve')
+ *   approve(@Param('id') id: string) { ... }
+ */
+exports.CONTRACT_SCOPED_KEY = 'contract_scoped';
+const ContractScoped = (path) => (0, common_1.SetMetadata)(exports.CONTRACT_SCOPED_KEY, path ?? '');
+exports.ContractScoped = ContractScoped;

package/dist/decorators/index.d.ts

@@ -3,4 +3,5 @@ export * from './roles.decorator';
 export * from './permissions.decorator';
 export * from './current-user.decorator';
 export * from './permission-writes.decorator';
+export * from './contract-scoped.decorator';
 //# sourceMappingURL=index.d.ts.map

package/dist/decorators/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/decorators/index.ts"],"names":[],"mappings":"AAAA,cAAc,oBAAoB,CAAC;AACnC,cAAc,mBAAmB,CAAC;AAClC,cAAc,yBAAyB,CAAC;AACxC,cAAc,0BAA0B,CAAC;AACzC,cAAc,+BAA+B,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/decorators/index.ts"],"names":[],"mappings":"AAAA,cAAc,oBAAoB,CAAC;AACnC,cAAc,mBAAmB,CAAC;AAClC,cAAc,yBAAyB,CAAC;AACxC,cAAc,0BAA0B,CAAC;AACzC,cAAc,+BAA+B,CAAC;AAC9C,cAAc,6BAA6B,CAAC"}

package/dist/decorators/index.js

@@ -19,3 +19,4 @@ __exportStar(require("./roles.decorator"), exports);
 __exportStar(require("./permissions.decorator"), exports);
 __exportStar(require("./current-user.decorator"), exports);
 __exportStar(require("./permission-writes.decorator"), exports);
+__exportStar(require("./contract-scoped.decorator"), exports);

package/dist/decorators/roles.decorator.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"roles.decorator.d.ts","sourceRoot":"","sources":["../../src/decorators/roles.decorator.ts"],"names":[],"mappings":"AAEA;;GAEG;AACH,eAAO,MAAM,SAAS,UAAU,CAAC;AAEjC;;;;;;GAMG;AACH,eAAO,MAAM,KAAK,GAAI,GAAG,OAAO,MAAM,EAAE,qDAAkC,CAAC;AAK3E,mDAAmD;AACnD,eAAO,MAAM,SAAS,wDAAgF,CAAC;AAEvG,2CAA2C;AAC3C,eAAO,MAAM,UAAU,wDAQpB,CAAC;AAEJ,6CAA6C;AAC7C,eAAO,MAAM,YAAY,wDAQtB,CAAC;AAEJ,2CAA2C;AAC3C,eAAO,MAAM,cAAc,wDAA4B,CAAC;AAExD;;;GAGG;AACH,eAAO,MAAM,YAAY,aArCO,MAAM,EAAE,qDAqCP,CAAC"}
+{"version":3,"file":"roles.decorator.d.ts","sourceRoot":"","sources":["../../src/decorators/roles.decorator.ts"],"names":[],"mappings":"AAGA;;GAEG;AACH,eAAO,MAAM,SAAS,UAAU,CAAC;AAEjC;;;;;;GAMG;AACH,eAAO,MAAM,KAAK,GAAI,GAAG,OAAO,MAAM,EAAE,qDAAkC,CAAC;AAK3E,mDAAmD;AACnD,eAAO,MAAM,SAAS,wDAAoD,CAAC;AAE3E,2CAA2C;AAC3C,eAAO,MAAM,UAAU,wDAAqD,CAAC;AAE7E,6CAA6C;AAC7C,eAAO,MAAM,YAAY,wDAAuD,CAAC;AAEjF,2CAA2C;AAC3C,eAAO,MAAM,cAAc,wDAA2C,CAAC;AAEvE;;;GAGG;AACH,eAAO,MAAM,YAAY,aArBO,MAAM,EAAE,qDAqBP,CAAC"}

package/dist/decorators/roles.decorator.js

@@ -2,6 +2,7 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.RequireRoles = exports.SuperAdminOnly = exports.ProviderOnly = exports.ClientOnly = exports.AdminOnly = exports.Roles = exports.ROLES_KEY = void 0;
 const common_1 = require("@nestjs/common");
+const contractx_roles_constants_1 = require("../constants/contractx-roles.constants");
 /**
  * Metadata key for required roles
  */
@@ -15,19 +16,19 @@ exports.ROLES_KEY = 'roles';
  */
 const Roles = (...roles) => (0, common_1.SetMetadata)(exports.ROLES_KEY, roles);
 exports.Roles = Roles;
-// NOTA[reconstrucción]: los helpers de abajo hardcodean nombres de rol del vocabulario VIEJO
-// (superadmin, client_performance_manager, ...) → "se reemplaza" al portar al modelo nuevo.
+// Los helpers derivan de CONTRACTX_ROLES / CONTRACTX_ROLE_GROUPS (fuente única reconciliada
+// con los codes de rol de Auth). NO hardcodear literales aquí.
 /** Decorator for ContractX specific admin roles */
-const AdminOnly = () => (0, exports.Roles)('superadmin', 'client_contract_admin', 'provider_contract_admin');
+const AdminOnly = () => (0, exports.Roles)(...contractx_roles_constants_1.CONTRACTX_ROLE_GROUPS.ADMIN_ROLES);
 exports.AdminOnly = AdminOnly;
 /** Decorator for client-side roles only */
-const ClientOnly = () => (0, exports.Roles)('client_contract_admin', 'client_performance_manager', 'client_finance_manager', 'client_reports_manager', 'client_relationship_manager', 'client_risk_manager');
+const ClientOnly = () => (0, exports.Roles)(...contractx_roles_constants_1.CONTRACTX_ROLE_GROUPS.CLIENT_ROLES);
 exports.ClientOnly = ClientOnly;
 /** Decorator for provider-side roles only */
-const ProviderOnly = () => (0, exports.Roles)('provider_contract_admin', 'provider_performance_manager', 'provider_finance_manager', 'provider_reports_manager', 'provider_relationship_manager', 'provider_risk_manager');
+const ProviderOnly = () => (0, exports.Roles)(...contractx_roles_constants_1.CONTRACTX_ROLE_GROUPS.PROVIDER_ROLES);
 exports.ProviderOnly = ProviderOnly;
 /** Decorator for superadmin access only */
-const SuperAdminOnly = () => (0, exports.Roles)('superadmin');
+const SuperAdminOnly = () => (0, exports.Roles)(contractx_roles_constants_1.CONTRACTX_ROLES.SUPER_ADMIN);
 exports.SuperAdminOnly = SuperAdminOnly;
 /**
  * Alias for Roles decorator for backward compatibility

package/dist/guards/authorization.guard.d.ts

@@ -33,5 +33,19 @@ export declare class AuthorizationGuard implements CanActivate {
      * (GET/HEAD/OPTIONS = lectura; el resto = escritura).
      */
     private isWriteRequest;
+    /**
+     * [Permisos por contrato] Verifica que el contrato sobre el que opera la petición
+     * coincida con el `currentContractId` del token. Lanza ForbiddenException si no hay
+     * contrato activo, no se puede resolver el contrato de la request, o no coinciden.
+     */
+    private assertContractBinding;
+    /** Roles de sistema/globales que pueden operar sin contrato activo (bypass del binding). */
+    private isGlobalBypass;
+    /**
+     * Extrae el contractId de la request. `path` en formato '<fuente>.<campo>'
+     * (params/body/query). Si está vacío, prueba ubicaciones comunes en orden:
+     * params.contractId → params.id → body.contractId → query.contractId.
+     */
+    private extractContractId;
 }
 //# sourceMappingURL=authorization.guard.d.ts.map

package/dist/guards/authorization.guard.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"authorization.guard.d.ts","sourceRoot":"","sources":["../../src/guards/authorization.guard.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,WAAW,EACX,gBAAgB,EAGjB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAWzC;;;;;;;;;;;;;;;;GAgBG;AACH,qBACa,kBAAmB,YAAW,WAAW;IAGxC,OAAO,CAAC,SAAS;IAF7B,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAuC;gBAE1C,SAAS,EAAE,SAAS;IAExC,WAAW,CAAC,OAAO,EAAE,gBAAgB,GAAG,OAAO;IA+G/C;;;OAGG;IACH,OAAO,CAAC,sBAAsB;IAK9B;;;;OAIG;IACH,OAAO,CAAC,cAAc;CAUvB"}
+{"version":3,"file":"authorization.guard.d.ts","sourceRoot":"","sources":["../../src/guards/authorization.guard.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,WAAW,EACX,gBAAgB,EAGjB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAazC;;;;;;;;;;;;;;;;GAgBG;AACH,qBACa,kBAAmB,YAAW,WAAW;IAGxC,OAAO,CAAC,SAAS;IAF7B,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAuC;gBAE1C,SAAS,EAAE,SAAS;IAExC,WAAW,CAAC,OAAO,EAAE,gBAAgB,GAAG,OAAO;IA6H/C;;;OAGG;IACH,OAAO,CAAC,sBAAsB;IAK9B;;;;OAIG;IACH,OAAO,CAAC,cAAc;IAWtB;;;;OAIG;IACH,OAAO,CAAC,qBAAqB;IAqB7B,4FAA4F;IAC5F,OAAO,CAAC,cAAc;IAQtB;;;;OAIG;IACH,OAAO,CAAC,iBAAiB;CAe1B"}

package/dist/guards/authorization.guard.js

@@ -14,6 +14,8 @@ exports.AuthorizationGuard = void 0;
 const common_1 = require("@nestjs/common");
 const core_1 = require("@nestjs/core");
 const permission_writes_decorator_1 = require("../decorators/permission-writes.decorator");
+const contract_scoped_decorator_1 = require("../decorators/contract-scoped.decorator");
+const contractx_roles_constants_1 = require("../constants/contractx-roles.constants");
 const READ_METHODS = new Set(['GET', 'HEAD', 'OPTIONS']);
 /**
  * [ADR-004] AuthorizationGuard — guard de 4 estados portado desde Auth.
@@ -46,7 +48,14 @@ let AuthorizationGuard = AuthorizationGuard_1 = class AuthorizationGuard {
             context.getHandler(),
             context.getClass(),
         ]);
-        if ((!requiredRoles || requiredRoles.length === 0) &&
+        // [Permisos por contrato] ¿el endpoint está scopeado a un contrato? (metadata presente)
+        const contractScopedPath = this.reflector.getAllAndOverride(contract_scoped_decorator_1.CONTRACT_SCOPED_KEY, [
+            context.getHandler(),
+            context.getClass(),
+        ]);
+        const isContractScoped = contractScopedPath !== undefined;
+        if (!isContractScoped &&
+            (!requiredRoles || requiredRoles.length === 0) &&
             (!requiredPermissions || requiredPermissions.length === 0)) {
             return true;
         }
@@ -56,6 +65,11 @@ let AuthorizationGuard = AuthorizationGuard_1 = class AuthorizationGuard {
             this.logger.warn('No user found in request context for authorization');
             throw new common_1.ForbiddenException('Authentication required for access');
         }
+        // [Permisos por contrato] Binding síncrono: el contrato de la request debe coincidir
+        // con el contrato activo del token. Roles de sistema/globales (super_admin / system): bypass.
+        if (isContractScoped && !this.isGlobalBypass(user)) {
+            this.assertContractBinding(user, request, contractScopedPath ?? '');
+        }
         const userId = user.sub;
         const userRoles = user.role || [];
         // Dos conjuntos resueltos en la carga del JWT: permissions = acceso pleno;
@@ -142,6 +156,54 @@ let AuthorizationGuard = AuthorizationGuard_1 = class AuthorizationGuard {
         }
         return !READ_METHODS.has((method ?? '').toUpperCase());
     }
+    /**
+     * [Permisos por contrato] Verifica que el contrato sobre el que opera la petición
+     * coincida con el `currentContractId` del token. Lanza ForbiddenException si no hay
+     * contrato activo, no se puede resolver el contrato de la request, o no coinciden.
+     */
+    assertContractBinding(user, request, path) {
+        const tokenContract = typeof user.currentContractId === 'string' ? user.currentContractId : undefined;
+        if (!tokenContract) {
+            this.logger.warn(`Contract-scoped access denied: user ${user.sub} has no active contract in token`);
+            throw new common_1.ForbiddenException('No active contract selected. Select a contract first.');
+        }
+        const reqContract = this.extractContractId(request, path);
+        if (!reqContract) {
+            this.logger.warn(`Contract-scoped access denied: could not resolve contract id from request (path='${path}')`);
+            throw new common_1.ForbiddenException('Could not resolve contract id from request');
+        }
+        if (reqContract !== tokenContract) {
+            this.logger.warn(`Contract-scoped access denied: token scoped to ${tokenContract} but request targets ${reqContract}`);
+            throw new common_1.ForbiddenException('Token is not scoped to the requested contract');
+        }
+    }
+    /** Roles de sistema/globales que pueden operar sin contrato activo (bypass del binding). */
+    isGlobalBypass(user) {
+        if (user.tenantContext === 'system') {
+            return true;
+        }
+        const roles = (user.role || []);
+        return roles.includes(contractx_roles_constants_1.CONTRACTX_ROLES.SUPER_ADMIN);
+    }
+    /**
+     * Extrae el contractId de la request. `path` en formato '<fuente>.<campo>'
+     * (params/body/query). Si está vacío, prueba ubicaciones comunes en orden:
+     * params.contractId → params.id → body.contractId → query.contractId.
+     */
+    extractContractId(request, path) {
+        const candidates = path
+            ? [path]
+            : ['params.contractId', 'params.id', 'body.contractId', 'query.contractId'];
+        const bags = request;
+        for (const candidate of candidates) {
+            const [source, key] = candidate.split('.');
+            const value = source && key ? bags[source]?.[key] : undefined;
+            if (typeof value === 'string' && value.length > 0) {
+                return value;
+            }
+        }
+        return undefined;
+    }
 };
 exports.AuthorizationGuard = AuthorizationGuard;
 exports.AuthorizationGuard = AuthorizationGuard = AuthorizationGuard_1 = __decorate([

package/dist/interfaces/jwt-payload.interface.d.ts

@@ -35,6 +35,15 @@ export interface JwtPayload {
      * no se afectan. El AuthorizationGuard usa este conjunto para bloquear escrituras.
      */
     permissionsView?: string[];
+    /**
+     * [Permisos por contrato] Contrato activo que el usuario seleccionó en Auth. Cuando
+     * está presente, `role`/`permissions`/`permissionsView` reflejan el rol del usuario
+     * EN ese contrato. Ausente ⇒ modo global (retrocompatible). El AuthorizationGuard usa
+     * este valor para el binding de los endpoints marcados con `@ContractScoped`.
+     */
+    currentContractId?: string;
+    /** [Permisos por contrato] Código del rol del usuario en `currentContractId`. */
+    currentContractRoleCode?: string;
     /** User's full name */
     fullName: string;
     /** User's email */

package/dist/interfaces/jwt-payload.interface.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"jwt-payload.interface.d.ts","sourceRoot":"","sources":["../../src/interfaces/jwt-payload.interface.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH;;GAEG;AACH,MAAM,WAAW,UAAU;IACzB,cAAc;IACd,GAAG,EAAE,MAAM,GAAG,MAAM,CAAC;IACrB,gCAAgC;IAChC,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,uBAAuB;IACvB,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,sDAAsD;IACtD,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB;;;;OAIG;IACH,eAAe,CAAC,EAAE,MAAM,EAAE,CAAC;IAC3B,uBAAuB;IACvB,QAAQ,EAAE,MAAM,CAAC;IACjB,mBAAmB;IACnB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;;;OAGG;IACH,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;IACpB,uCAAuC;IACvC,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,kCAAkC;IAClC,aAAa,CAAC,EAAE,QAAQ,GAAG,UAAU,GAAG,QAAQ,CAAC;IACjD,gEAAgE;IAChE,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;IACtB,8BAA8B;IAC9B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,gCAAgC;IAChC,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,iCAAiC;IACjC,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,mBAAmB;IACnB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,qBAAqB;IACrB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,wFAAwF;IACxF,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED;;;GAGG;AACH,MAAM,WAAW,oBAAqB,SAAQ,OAAO;IACnD,IAAI,EAAE,UAAU,CAAC;CAClB;AAED;;;GAGG;AACH,MAAM,WAAW,aAAa;IAC5B,qBAAqB;IACrB,MAAM,EAAE,MAAM,CAAC;IACf,mBAAmB;IACnB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,qBAAqB;IACrB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,4BAA4B;IAC5B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,2BAA2B;IAC3B,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,oCAAoC;IACpC,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,2CAA2C;IAC3C,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,wCAAwC;IACxC,gBAAgB,CAAC,EAAE,OAAO,CAAC;CAC5B;AAED;;;GAGG;AACH,MAAM,WAAW,wBAAwB;IACvC,wBAAwB;IACxB,GAAG,EAAE,aAAa,CAAC;IACnB,kCAAkC;IAClC,MAAM,CAAC,EAAE;QACP,0CAA0C;QAC1C,gBAAgB,CAAC,EAAE,OAAO,CAAC;QAC3B,iCAAiC;QACjC,iBAAiB,CAAC,EAAE,OAAO,CAAC;QAC5B,uCAAuC;QACvC,uBAAuB,CAAC,EAAE,OAAO,CAAC;KACnC,CAAC;IACF,6BAA6B;IAC7B,QAAQ,CAAC,EAAE;QACT,6BAA6B;QAC7B,aAAa,CAAC,EAAE,OAAO,CAAC;QACxB,2BAA2B;QAC3B,eAAe,CAAC,EAAE,OAAO,CAAC;QAC1B,wCAAwC;QACxC,eAAe,CAAC,EAAE,MAAM,CAAC;QACzB,kCAAkC;QAClC,YAAY,CAAC,EAAE,MAAM,CAAC;KACvB,CAAC;IACF,gCAAgC;IAChC,WAAW,CAAC,EAAE;QACZ,4CAA4C;QAC5C,WAAW,CAAC,EAAE,OAAO,CAAC;QACtB,gCAAgC;QAChC,QAAQ,CAAC,EAAE,UAAU,CAAC;KACvB,CAAC;CACH"}
+{"version":3,"file":"jwt-payload.interface.d.ts","sourceRoot":"","sources":["../../src/interfaces/jwt-payload.interface.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH;;GAEG;AACH,MAAM,WAAW,UAAU;IACzB,cAAc;IACd,GAAG,EAAE,MAAM,GAAG,MAAM,CAAC;IACrB,gCAAgC;IAChC,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,uBAAuB;IACvB,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,sDAAsD;IACtD,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB;;;;OAIG;IACH,eAAe,CAAC,EAAE,MAAM,EAAE,CAAC;IAC3B;;;;;OAKG;IACH,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,iFAAiF;IACjF,uBAAuB,CAAC,EAAE,MAAM,CAAC;IACjC,uBAAuB;IACvB,QAAQ,EAAE,MAAM,CAAC;IACjB,mBAAmB;IACnB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;;;OAGG;IACH,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;IACpB,uCAAuC;IACvC,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,kCAAkC;IAClC,aAAa,CAAC,EAAE,QAAQ,GAAG,UAAU,GAAG,QAAQ,CAAC;IACjD,gEAAgE;IAChE,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;IACtB,8BAA8B;IAC9B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,gCAAgC;IAChC,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,iCAAiC;IACjC,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,mBAAmB;IACnB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,qBAAqB;IACrB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,wFAAwF;IACxF,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED;;;GAGG;AACH,MAAM,WAAW,oBAAqB,SAAQ,OAAO;IACnD,IAAI,EAAE,UAAU,CAAC;CAClB;AAED;;;GAGG;AACH,MAAM,WAAW,aAAa;IAC5B,qBAAqB;IACrB,MAAM,EAAE,MAAM,CAAC;IACf,mBAAmB;IACnB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,qBAAqB;IACrB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,4BAA4B;IAC5B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,2BAA2B;IAC3B,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,oCAAoC;IACpC,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,2CAA2C;IAC3C,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,wCAAwC;IACxC,gBAAgB,CAAC,EAAE,OAAO,CAAC;CAC5B;AAED;;;GAGG;AACH,MAAM,WAAW,wBAAwB;IACvC,wBAAwB;IACxB,GAAG,EAAE,aAAa,CAAC;IACnB,kCAAkC;IAClC,MAAM,CAAC,EAAE;QACP,0CAA0C;QAC1C,gBAAgB,CAAC,EAAE,OAAO,CAAC;QAC3B,iCAAiC;QACjC,iBAAiB,CAAC,EAAE,OAAO,CAAC;QAC5B,uCAAuC;QACvC,uBAAuB,CAAC,EAAE,OAAO,CAAC;KACnC,CAAC;IACF,6BAA6B;IAC7B,QAAQ,CAAC,EAAE;QACT,6BAA6B;QAC7B,aAAa,CAAC,EAAE,OAAO,CAAC;QACxB,2BAA2B;QAC3B,eAAe,CAAC,EAAE,OAAO,CAAC;QAC1B,wCAAwC;QACxC,eAAe,CAAC,EAAE,MAAM,CAAC;QACzB,kCAAkC;QAClC,YAAY,CAAC,EAAE,MAAM,CAAC;KACvB,CAAC;IACF,gCAAgC;IAChC,WAAW,CAAC,EAAE;QACZ,4CAA4C;QAC5C,WAAW,CAAC,EAAE,OAAO,CAAC;QACtB,gCAAgC;QAChC,QAAQ,CAAC,EAAE,UAAU,CAAC;KACvB,CAAC;CACH"}

package/dist/services/contractx-authorization.service.js

@@ -89,7 +89,7 @@ let ContractXAuthorizationService = class ContractXAuthorizationService {
      * Check if user has system-level access
      */
     hasSystemLevelAccess(userRoles) {
-        return userRoles.some(role => role === contractx_roles_constants_1.CONTRACTX_ROLES.SUPERADMIN ||
+        return userRoles.some(role => role === contractx_roles_constants_1.CONTRACTX_ROLES.SUPER_ADMIN ||
             role === contractx_roles_constants_1.CONTRACTX_ROLES.SUPPORT ||
             (0, contractx_roles_constants_1.isSystemRole)(role));
     }
@@ -325,14 +325,14 @@ let ContractXAuthorizationService = class ContractXAuthorizationService {
             contracts: {
                 create: [contractx_roles_constants_1.CONTRACTX_ROLES.CLIENT_CONTRACT_ADMIN, contractx_roles_constants_1.CONTRACTX_ROLES.PROVIDER_CONTRACT_ADMIN],
                 delete: [contractx_roles_constants_1.CONTRACTX_ROLES.CLIENT_CONTRACT_ADMIN, contractx_roles_constants_1.CONTRACTX_ROLES.PROVIDER_CONTRACT_ADMIN],
-                admin: [contractx_roles_constants_1.CONTRACTX_ROLES.SUPERADMIN, contractx_roles_constants_1.CONTRACTX_ROLES.SUPPORT],
+                admin: [contractx_roles_constants_1.CONTRACTX_ROLES.SUPER_ADMIN, contractx_roles_constants_1.CONTRACTX_ROLES.SUPPORT],
             },
             projects: {
                 create: [contractx_roles_constants_1.CONTRACTX_ROLES.CLIENT_CONTRACT_ADMIN, contractx_roles_constants_1.CONTRACTX_ROLES.PROVIDER_CONTRACT_ADMIN],
                 delete: [contractx_roles_constants_1.CONTRACTX_ROLES.CLIENT_CONTRACT_ADMIN, contractx_roles_constants_1.CONTRACTX_ROLES.PROVIDER_CONTRACT_ADMIN],
             },
             security_control: {
-                '*': [contractx_roles_constants_1.CONTRACTX_ROLES.SUPERADMIN, contractx_roles_constants_1.CONTRACTX_ROLES.SUPPORT],
+                '*': [contractx_roles_constants_1.CONTRACTX_ROLES.SUPER_ADMIN, contractx_roles_constants_1.CONTRACTX_ROLES.SUPPORT],
             },
         };
         return resourceRoleMap[resource]?.[action] || resourceRoleMap[resource]?.['*'] || [];

package/dist/services/user-context.service.js

@@ -272,7 +272,7 @@ let UserContextService = class UserContextService {
      * Check if user is a superadmin
      */
     isSuperAdmin() {
-        return this.hasRole(contractx_roles_constants_1.CONTRACTX_ROLES.SUPERADMIN);
+        return this.hasRole(contractx_roles_constants_1.CONTRACTX_ROLES.SUPER_ADMIN);
     }
     /**
      * Check if user has admin privileges (superadmin or contract admin)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "permissions-contractx",
-  "version": "1.6.0",
+  "version": "2.0.0",
   "description": "Enterprise-grade authentication and authorization package for NestJS microservices with role-based and permission-based access control",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",