ADUANASOFT/plantillas-proyectos
13
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Merge pull request 'fix/logout-anexo' (#392) from fix/logout-anexo into development

Browse Source 
Reviewed-on: ADUANASOFT/anexo76#392
This commit is contained in:
acazares
2026-05-12 22:46:49 +00:00
parent cf27f6103d 35c47e32df
commit 6f2ce605a8
9 changed files with 51 additions and 15 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
frontend/src/routes/api-sveltekit/auth/switch-tenant/+server.ts
View File

@@ -40,7 +40,8 @@ export const POST = async ({ request, cookies, fetch }: RequestEvent) => {
if (!hasAccess) {
return json({ error: 'Access denied to tenant' }, { status: 403 });
}
const isProduction = process.env.NODE_ENV === 'production';
const { isSecureContext } = await import('$lib/server/workspace-auth');
const isProduction = isSecureContext();
cookies.set('sso_tenant_id', String(tenant_id), {
path: '/',
httpOnly: true,

3
frontend/src/routes/auth/callback/+page.server.ts
View File

@@ -77,7 +77,8 @@ export const load: PageServerLoad = async ({ url, cookies, fetch }) => {
// Establecer las cookies en el servidor
// access_token → NO HttpOnly (el cliente JS lo usa para el header Authorization)
// refresh_token → HttpOnly (el JS nunca lo lee; el servidor lo gestiona)
const isProduction = process.env.NODE_ENV === 'production';
const { isSecureContext } = await import('$lib/server/workspace-auth');
const isProduction = isSecureContext();
setAccessTokenCookies(cookies, tokens.access_token, {
secure: isProduction,

13
frontend/src/routes/auth/post-logout/+server.ts Normal file
View File

@@ -0,0 +1,13 @@
import { redirect } from '@sveltejs/kit';
import type { RequestHandler } from './$types';
import { getWorkspaceLoginUrl } from '$lib/server/workspace-auth';
/**
* KC redirects here after completing the logout flow.
* This URL is covered by the app's registered wildcard in KC (e.g. anexo76-dev.aduanasoft.com/*).
* We then send the user to workspace login so it can apply myApps() launcher logic.
*/
export const GET: RequestHandler = async ({ request, url }) => {
const systemBaseUrl = url.origin;
throw redirect(303, getWorkspaceLoginUrl(systemBaseUrl, { forPostLogout: true }));
};

5
frontend/src/routes/auth/sso/+page.server.ts
View File

@@ -115,8 +115,9 @@ export const load: PageServerLoad = async ({ url, cookies }) => {
}
}
const isProduction = process.env.NODE_ENV === 'production';
console.log('[SSO] NODE_ENV:', process.env.NODE_ENV, '→ isProduction:', isProduction);
const { isSecureContext } = await import('$lib/server/workspace-auth');
const isProduction = isSecureContext();
console.log('[SSO] ORIGIN-based secure context:', isProduction);
// access_token — NO HttpOnly (Bearer desde JS); fragmentado si el JWT supera ~4KB
setAccessTokenCookies(cookies, tokens.access_token, {

4
frontend/src/routes/logout/+server.ts
View File

@@ -3,8 +3,8 @@ import type { RequestHandler } from './$types';
import { clearAccessTokenCookies } from '$lib/server/access-token-cookie';
import { buildKeycloakLogoutUrl, clearWorkspaceReturnPath } from '$lib/server/workspace-auth';
export const POST: RequestHandler = async ({ cookies, request }) => {
const systemBaseUrl = new URL(request.url).origin;
export const POST: RequestHandler = async ({ cookies, request, url }) => {
const systemBaseUrl = url.origin;
// Eliminar todas las cookies de autenticación (access_token puede estar fragmentado)
clearAccessTokenCookies(cookies);