Aplicar lógica de validación de tenant y compañía a todos los endpoints relevantes en los módulos: client_and_provider, classes, country_rule_oct, exchange_rate, fraction_rule_octave, package, parts, permission_rule_oct, seal

backend/api/v1/modules/a76/package/routes.py

@@ -21,6 +21,13 @@ async def list_bultos(
     """
     List all GBultos with pagination.
     """
+    # Validate access to the tenant and company
+    tenant_id = current_user.get("tenant_id")
+    company_id = current_user.get("company_id")
+
+    if not tenant_id or not company_id:
+        raise HTTPException(status_code=403, detail="Access denied: Tenant or Company not found")
+
     return db.query(Package).offset(skip).limit(limit).all()
 
 
@@ -33,6 +40,13 @@ async def read_bulto(
     """
     Get a specific Package by its CODE.
     """
+    # Validate access to the tenant and company
+    tenant_id = current_user.get("tenant_id")
+    company_id = current_user.get("company_id")
+
+    if not tenant_id or not company_id:
+        raise HTTPException(status_code=403, detail="Access denied: Tenant or Company not found")
+
     bulto = GBultoService.get_bulto_by_code(db, code)
     if not bulto:
         raise HTTPException(status_code=404, detail="Package not found")
@@ -48,6 +62,13 @@ async def create_gbulto(
     """
     Create a new Package.
     """
+    # Validate access to the tenant and company
+    tenant_id = current_user.get("tenant_id")
+    company_id = current_user.get("company_id")
+
+    if not tenant_id or not company_id:
+        raise HTTPException(status_code=403, detail="Access denied: Tenant or Company not found")
+
     return GBultoService.create_gbulto(db, bulto_data)
 
 
@@ -61,6 +82,13 @@ async def update_bulto(
     """
     Update an existing Package.
     """
+    # Validate access to the tenant and company
+    tenant_id = current_user.get("tenant_id")
+    company_id = current_user.get("company_id")
+
+    if not tenant_id or not company_id:
+        raise HTTPException(status_code=403, detail="Access denied: Tenant or Company not found")
+
     bulto = GBultoService.update_bulto(db, code, bulto_data)
     if not bulto:
         raise HTTPException(status_code=404, detail="Package not found")
@@ -76,6 +104,13 @@ async def delete_bulto(
     """
     Delete a Package by its CODE.
     """
+    # Validate access to the tenant and company
+    tenant_id = current_user.get("tenant_id")
+    company_id = current_user.get("company_id")
+
+    if not tenant_id or not company_id:
+        raise HTTPException(status_code=403, detail="Access denied: Tenant or Company not found")
+
     bulto = GBultoService.delete_bulto(db, code)
     if not bulto:
         raise HTTPException(status_code=404, detail="Package not found")

backend/api/v1/modules/a76/package/test_package.py

@@ -0,0 +1,31 @@
+import pytest
+from fastapi.testclient import TestClient
+from .routes import router
+from fastapi import FastAPI
+
+app = FastAPI()
+app.include_router(router)
+client = TestClient(app)
+
+@pytest.mark.usefixtures("client", "access_token")
+def test_list_packages(client, access_token):
+    headers = {"Authorization": f"Bearer {access_token}"}
+    response = client.get("/bultos/", headers=headers)
+    assert response.status_code == 200
+    assert "items" in response.json()
+    assert "page" in response.json()
+    assert "page_size" in response.json()
+
+@pytest.mark.usefixtures("client", "access_token")
+def test_get_package_not_found(client, access_token):
+    headers = {"Authorization": f"Bearer {access_token}"}
+    response = client.get("/bultos/invalid_id", headers=headers)
+    assert response.status_code == 404
+
+def test_create_package_forbidden():
+    response = client.post("/bultos/", json={"name": "Test Package"})
+    assert response.status_code in (403, 405, 404)
+
+def test_update_package_forbidden():
+    response = client.put("/bultos/1", json={"name": "Updated Package"})
+    assert response.status_code in (403, 405, 404)