chore: snapshot before development sync

backend/api/v1/modules/a76/audit_log/middleware.py

@@ -12,7 +12,7 @@ class UserContextMiddleware(BaseHTTPMiddleware):
             try:
                 # verify_token might raise exception if invalid, we catch it to not block request
                 # but we won't have user context
-                user_info = verify_token(token)
+                user_info = await verify_token(token)
                 set_user_context(user_info)
             except Exception:
                 # Log error or ignore

backend/api/v1/modules/core/auth/dto.py

@@ -34,6 +34,8 @@ class TokenResponseDTO(BaseModel):
     token_type: str = "bearer"
     expires_in: int
     tenant: Optional["TenantInfoDTO"] = None
+    tenant_id: Optional[int] = None
+    tenant_slug: Optional[str] = None
 
     class Config:
         json_schema_extra = {
@@ -196,3 +198,9 @@ class LoginChoiceResponseDTO(BaseModel):
 
     status: str = "choose_tenant"
     tenants: list[TenantInfoDTO]
+
+
+class SSOExchangeRequestDTO(BaseModel):
+    """DTO para canjear el relay token por KC tokens."""
+
+    relay_token: str = Field(..., description="Relay token recibido en la URL")

backend/api/v1/modules/core/auth/routes.py

@@ -17,6 +17,7 @@ from .dto import (
     RegisterRequestDTO,
     RegisterResponseDTO,
     SetCookieRequestDTO,
+    SSOExchangeRequestDTO,
     SwitchTenantRequestDTO,
     TokenResponseDTO,
     UserInfoResponseDTO,
@@ -231,3 +232,39 @@ async def set_cookie(
 
     except Exception as e:
         raise HTTPException(status_code=400, detail=f"Error validando tokens: {str(e)}")
+
+
+@router.post("/sso-exchange", response_model=TokenResponseDTO)
+async def sso_exchange(
+    body: SSOExchangeRequestDTO,
+    response: Response,
+    db: Session = Depends(get_core_db),
+):
+    """
+    Canjea un relay token de un solo uso (generado por el Hub) por KC tokens.
+    Llamado server-side desde la página /auth/sso del frontend de Anexo76.
+    Establece cookies HttpOnly con los tokens y devuelve el resultado.
+    """
+    service = AuthService(db)
+    tokens = await service.sso_exchange(body.relay_token)
+
+    _is_prod = False  # TODO: leer de settings.ENVIRONMENT == "production"
+    response.set_cookie(
+        key="access_token",
+        value=tokens.access_token,
+        httponly=True,
+        secure=_is_prod,
+        samesite="lax",
+        max_age=3600,
+        path="/",
+    )
+    response.set_cookie(
+        key="refresh_token",
+        value=tokens.refresh_token,
+        httponly=True,
+        secure=_is_prod,
+        samesite="lax",
+        max_age=86400,
+        path="/",
+    )
+    return tokens

backend/api/v1/modules/core/auth/service.py

@@ -64,13 +64,17 @@ class AuthService:
 
                 return TokenResponseDTO(**data)
             
-            # Si el Hub falló con error de credenciales
+            # Pasar el mensaje de error real del Hub al cliente
+            try:
+                hub_detail = response.json().get("detail", None)
+            except Exception:
+                hub_detail = None
+
             if response.status_code == 401:
-                raise HTTPException(status_code=401, detail="Invalid credentials")
-            
-            # Otros errores del Hub
+                raise HTTPException(status_code=401, detail=hub_detail or "Credenciales inválidas")
+
             logger.error(f"Hub login failed with status {response.status_code}: {response.text}")
-            raise HTTPException(status_code=response.status_code, detail="Authentication server error")
+            raise HTTPException(status_code=response.status_code, detail=hub_detail or "Error en el servidor de autenticación")
 
         except httpx.HTTPError as e:
             logger.error(f"Hub unreachable during login: {str(e)}")
@@ -175,3 +179,34 @@ class AuthService:
         except Exception as e:
             logger.error(f"Switch tenant error: {str(e)}")
             raise HTTPException(status_code=500, detail="Switch tenant error")
+
+    async def sso_exchange(self, relay_token: str) -> TokenResponseDTO:
+        """
+        Canjea un relay token de un solo uso por KC tokens.
+        Llama al Hub backend (server-to-server), sin Bearer requerido en el Hub.
+        """
+        try:
+            async with httpx.AsyncClient(timeout=10.0) as client:
+                response = await client.post(
+                    f"{settings.HUB_URL}api/v1/auth/sso-exchange",
+                    json={"relay_token": relay_token},
+                )
+            if response.status_code == 200:
+                data = response.json()
+                return TokenResponseDTO(
+                    access_token=data["access_token"],
+                    refresh_token=data["refresh_token"],
+                    token_type=data.get("token_type", "bearer"),
+                    expires_in=data.get("expires_in", 3600),
+                    tenant_id=data.get("tenant_id"),
+                    tenant_slug=data.get("tenant_slug"),
+                )
+            raise HTTPException(
+                status_code=response.status_code,
+                detail=response.json().get("detail", "SSO exchange failed"),
+            )
+        except HTTPException:
+            raise
+        except Exception as e:
+            logger.error(f"SSO exchange error: {str(e)}")
+            raise HTTPException(status_code=500, detail="SSO exchange error")