fix: solución de bloqueos y estandarización de permisos

backend/api/v1/modules/a76/app_settings/routes.py

@@ -4,6 +4,7 @@ from typing import Optional, Dict, Any
 from core.database import get_core_db
 from .service import AppSettingsService
 from .schemas import AppSettingRequest, AppSettingResponse
+from core.security import get_current_user, validate_access_to_resource
 
 router = APIRouter(prefix="/a76/app-settings", tags=["a76 / app_settings"])
 
@@ -16,14 +17,20 @@ logger = logging.getLogger(__name__)
 def get_resolved_settings(
     tenant_id: int = Query(...),
     company_id: int = Query(...),
-    db: Session = Depends(get_core_db)
+    db: Session = Depends(get_core_db),
+    current_user: Dict[str, Any] = Depends(get_current_user)
 ):
     """
     Returns the final merged configuration for a company.
     Merges Global -> Tenant -> Company levels.
     """
     try:
+        # Validar permisos
+        validate_access_to_resource(db, company_id, current_user, ["settings_general.view"])
+        
         return AppSettingsService.get_resolved_settings(db, tenant_id, company_id)
+    except HTTPException:
+        raise
     except Exception as e:
         logger.error(f"RESOLVE ERROR: {str(e)}", exc_info=True)
         raise HTTPException(status_code=500, detail=str(e))
@@ -31,12 +38,16 @@ def get_resolved_settings(
 @router.post("/upsert")
 def upsert_settings(
     payload: AppSettingRequest,
-    db: Session = Depends(get_core_db)
+    db: Session = Depends(get_core_db),
+    current_user: Dict[str, Any] = Depends(get_current_user)
 ):
     """
     Creates or updates an override for a specific level (Global, Tenant, or Company).
     """
     try:
+        # Validar permisos
+        validate_access_to_resource(db, payload.company_id, current_user, ["settings_general.edit"])
+        
         data = payload.settings.model_dump(exclude_unset=True)
         return AppSettingsService.upsert_settings(
             db, 
@@ -44,6 +55,8 @@ def upsert_settings(
             payload.company_id, 
             data
         )
+    except HTTPException:
+        raise
     except Exception as e:
         logger.error(f"UPSERT ERROR: {str(e)}", exc_info=True)
         raise HTTPException(status_code=500, detail=str(e))
@@ -51,9 +64,10 @@ def upsert_settings(
 @router.put("/upsert")
 def update_settings(
     payload: AppSettingRequest,
-    db: Session = Depends(get_core_db)
+    db: Session = Depends(get_core_db),
+    current_user: Dict[str, Any] = Depends(get_current_user)
 ):
     """
     Alias for upsert_settings.
     """
-    return upsert_settings(payload, db)
+    return upsert_settings(payload, db, current_user)