feat: plantilla base workspace SaaS

Convierte el repositorio de Anexo76 en una plantilla limpia y reutilizable para nuevos proyectos del ecosistema Workspace de Aduanasoft. Cambios principales: - Elimina módulos específicos de Anexo76: a76, a24, sitar, public - Agrega módulo example/ con patrón CRUD de referencia (models/dto/service/routes) - Limpia migraciones Alembic: solo quedan las 6 de core (users, tenants, permissions) - Reemplaza todas las rutas del dashboard con stubs genéricos - Elimina lógica de negocio aduanera: shortcuts, CSV imports, permisos, catálogos - Simplifica variables de entorno: una sola WORKSPACE_URL deriva Hub y Keycloak - Agrega scripts/auth-mode.sh para alternar entre auth local y workspace - Configura docker-compose con nombres genéricos (app-*) - Corrige flujo SSO: elimina system-gate SCAF/SCAII que bloqueaba el login - Modo DEV_LOCAL_AUTH para desarrollo sin Keycloak ni Hub Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-06-04 10:55:17 -05:00
parent 9fae110c11
commit 880999b03a
1979 changed files with 1085 additions and 359149 deletions
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -1,22 +1,25 @@
+name: app
+
 services:
-  # PostgreSQL - Base de datos core (app)
-  postgres-a76:
+
+  # ── Base de datos ────────────────────────────────────────────────────────────
+  postgres:
    image: postgres:18-alpine
-    container_name: anexo76-postgres-a76
+    container_name: app-postgres
    environment:
-      POSTGRES_DB: anexo76_core
-      POSTGRES_USER: postgres
+      POSTGRES_DB: ${CORE_DB_NAME:-app_core}
+      POSTGRES_USER: ${CORE_DB_USER:-postgres}
      POSTGRES_PASSWORD: ${POSTGRES_APP_PASSWORD:-postgres}
      POSTGRES_INITDB_ARGS: "--encoding=UTF8"
    ports:
      - "5432:5432"
    volumes:
-      - postgres_app_data:/var/lib/postgresql
+      - postgres_data:/var/lib/postgresql
    networks:
-      - backend-net
+      - app-backend
    restart: unless-stopped
    healthcheck:
-      test: [ "CMD-SHELL", "pg_isready -U postgres -d anexo76_core || exit 1" ]
+      test: ["CMD-SHELL", "pg_isready -U ${CORE_DB_USER:-postgres} -d ${CORE_DB_NAME:-app_core} || exit 1"]
      interval: 5s
      timeout: 3s
      retries: 10
@@ -34,71 +37,66 @@ services:
          memory: 256M
    shm_size: 128mb

-  # Backend - FastAPI
+  # ── Backend FastAPI ──────────────────────────────────────────────────────────
  backend:
    build:
      context: ./backend
      dockerfile: Dockerfile
      args:
        - BUILDKIT_INLINE_CACHE=1
-    image: anexo76-backend:latest
-    container_name: anexo76-backend
+    image: app-backend:latest
+    container_name: app-backend
    environment:
      - DEBUG=${DEBUG:-True}
      - ENVIRONMENT=${ENVIRONMENT:-development}
      - PYTHONUNBUFFERED=1
      - PYTHONDONTWRITEBYTECODE=1
-      - CORE_DB_HOST=${CORE_DB_HOST:-postgres-a76}
+      - DEV_LOCAL_AUTH=${DEV_LOCAL_AUTH:-False}
+      - DEV_LOCAL_AUTH_EMAIL=${DEV_LOCAL_AUTH_EMAIL:-dev@local.test}
+      - DEV_LOCAL_AUTH_NAME=${DEV_LOCAL_AUTH_NAME:-Dev User}
+      - DEV_LOCAL_AUTH_TENANT_ID=${DEV_LOCAL_AUTH_TENANT_ID:-1}
+      - DEV_LOCAL_AUTH_COMPANY_ID=${DEV_LOCAL_AUTH_COMPANY_ID:-1}
+      - CORE_DB_HOST=${CORE_DB_HOST:-postgres}
      - CORE_DB_PORT=${CORE_DB_PORT:-5432}
-      - CORE_DB_NAME=${CORE_DB_NAME:-anexo76_core}
+      - CORE_DB_NAME=${CORE_DB_NAME:-app_core}
      - CORE_DB_USER=${CORE_DB_USER:-postgres}
      - CORE_DB_PASSWORD=${POSTGRES_APP_PASSWORD:-postgres}
-      # Keycloak — apunta al Keycloak del Hub (ya no tiene Keycloak propio)
-
+      - SECRET_KEY=${SECRET_KEY:-change-this-secret-key-in-production}
      - CORS_ORIGINS=${CORS_ORIGINS:-http://localhost:5173,http://localhost:3000}
-      - SITAR_API_URL=${SITAR_API_URL}
-      - SITAR_API_USER=${SITAR_API_USER}
-      - SITAR_API_PASSWORD=${SITAR_API_PASSWORD}
-      - COVE_FIEL_HASH_KEY=${COVE_FIEL_HASH_KEY}
-      - COVE_FIEL_HASH_IV=${COVE_FIEL_HASH_IV}
-      - COVE_API_URL=${COVE_API_URL:-https://api.vu.aduanasoft.com}
-      - COVE_API_VERIFY_SSL=${COVE_API_VERIFY_SSL:-False}
      - VALKEY_URL=${VALKEY_URL:-redis://valkey:6379/0}
      - CENTRAL_SERVER_URL=${CENTRAL_SERVER_URL:-""}
      - SYNC_SECRET_TOKEN=${SYNC_SECRET_TOKEN:-change-this-sync-token-in-production}
      - SPOKE_URLS=${SPOKE_URLS:-""}
-      # Hub — URL interna para validación de licencias
-      - HUB_URL=${HUB_URL:-http://host.docker.internal:8001}
+      - HUB_URL=${WORKSPACE_URL:-http://host.docker.internal:8001}
      - HUB_ADMIN_EMAIL=${HUB_ADMIN_EMAIL:-}
      - HUB_ADMIN_PASSWORD=${HUB_ADMIN_PASSWORD:-}
-      - APP_PUBLIC_URL=${APP_PUBLIC_URL:-http://localhost:3001}
-      - CSV_IMPORT_STORAGE=${CSV_IMPORT_STORAGE:-minio}
+      - APP_PUBLIC_URL=${APP_PUBLIC_URL:-http://localhost:5173}
      - S3_ENDPOINT_URL=${S3_ENDPOINT_URL:-http://minio:9000}
-      - S3_ACCESS_KEY=${S3_ACCESS_KEY:-${MINIO_ROOT_USER:-minioadmin}}
-      - S3_SECRET_KEY=${S3_SECRET_KEY:-${MINIO_ROOT_PASSWORD:-minioadmin}}
-      - S3_BUCKET=${S3_BUCKET:-anexo76}
+      - S3_ACCESS_KEY=${S3_ACCESS_KEY:-minioadmin}
+      - S3_SECRET_KEY=${S3_SECRET_KEY:-minioadmin}
+      - S3_BUCKET=${S3_BUCKET:-app}
      - S3_REGION=${S3_REGION:-us-east-1}
      - S3_USE_SSL=${S3_USE_SSL:-false}
      - S3_FILE_STORAGE=${S3_FILE_STORAGE:-true}
      - S3_PRESIGNED_EXPIRES_SECONDS=${S3_PRESIGNED_EXPIRES_SECONDS:-3600}
+      - CSV_IMPORT_STORAGE=${CSV_IMPORT_STORAGE:-minio}
    ports:
      - "8000:8000"
    depends_on:
-      postgres-a76:
+      postgres:
        condition: service_healthy
    volumes:
      - ./backend:/app
      - backend_cache:/app/__pycache__
      - backend_uploads:/app/uploads
    networks:
-      - backend-net
-      - frontend-net
-      - hub-net
+      - app-backend
+      - app-frontend
+      - app-hub
    restart: unless-stopped
-    command: [ "uvicorn", "main:app", "--host", "0.0.0.0", "--port", "8000", "--reload", "--log-level", "info" ]
-    # El lifespan corre Alembic antes de servir; 1.ª subida a DB vacía puede tardar varios minutos (E2E/CI)
+    command: ["uvicorn", "main:app", "--host", "0.0.0.0", "--port", "8000", "--reload", "--log-level", "info"]
    healthcheck:
-      test: [ "CMD-SHELL", "curl -f http://localhost:8000/api/health || exit 1" ]
+      test: ["CMD-SHELL", "curl -f http://localhost:8000/api/health || exit 1"]
      interval: 20s
      timeout: 10s
      retries: 20
@@ -115,34 +113,33 @@ services:
        reservations:
          memory: 512M

-  # Frontend - SvelteKit
+  # ── Frontend SvelteKit ───────────────────────────────────────────────────────
  frontend:
    build:
      context: ./frontend
      dockerfile: Dockerfile
      args:
        - BUILDKIT_INLINE_CACHE=1
-    image: anexo76-frontend:latest
-    container_name: anexo76-frontend
+    image: app-frontend:latest
+    container_name: app-frontend
    environment:
      - NODE_ENV=${NODE_ENV:-development}
+      - DEV_LOCAL_AUTH=${DEV_LOCAL_AUTH:-false}
+      - BACKEND_URL=${BACKEND_URL:-http://backend:8000}
      - VITE_API_URL=${VITE_API_URL:-http://localhost:8000/api/}
      - INTERNAL_API_URL=${INTERNAL_API_URL:-http://backend:8000/api/}
-      - VITE_KEYCLOAK_URL=${VITE_KEYCLOAK_URL:-http://localhost:8085/kcauth}
-      - VITE_KEYCLOAK_REALM=${VITE_KEYCLOAK_REALM:-master}
-      - VITE_KEYCLOAK_CLIENT_ID=${VITE_KEYCLOAK_CLIENT_ID:-anexo76-frontend}
-      # SSR server-side — usa URL interna del contenedor Keycloak (más rápido, sin salir a la LAN)
-      - KEYCLOAK_URL=${KEYCLOAK_URL:-http://hub-keycloak:8080/kcauth}
+      # Hub y Keycloak se derivan de WORKSPACE_URL (una sola fuente de verdad)
+      - VITE_HUB_URL=${WORKSPACE_URL:-http://localhost:8001}
+      - HUB_URL=${WORKSPACE_URL:-http://localhost:8001}
+      - INTERNAL_HUB_URL=${WORKSPACE_URL:-http://localhost:8001}
+      - VITE_KEYCLOAK_URL=${WORKSPACE_URL:-http://localhost:8085}/kcauth
+      - KEYCLOAK_URL=${WORKSPACE_URL:-http://localhost:8085}/kcauth
+      - VITE_KEYCLOAK_REALM=${KEYCLOAK_REALM:-master}
      - KEYCLOAK_REALM=${KEYCLOAK_REALM:-master}
-      - KEYCLOAK_CLIENT_ID=${KEYCLOAK_CLIENT_ID:-anexo76-frontend}
-      # Hub — URL pública para el browser y URL interna para server-side
-      - VITE_HUB_URL=${VITE_HUB_URL:-http://localhost:8001}
-      - HUB_URL=${HUB_URL:-http://localhost:8001}
-      - INTERNAL_HUB_URL=${INTERNAL_HUB_URL:-http://host.docker.internal:8001}
-      # CORS / CSRF — trusted origins para svelte.config.js
-      - CORS_ORIGINS=${CORS_ORIGINS:-http://localhost:5173,http://localhost:3001}
+      - VITE_KEYCLOAK_CLIENT_ID=${KEYCLOAK_CLIENT_ID:-app-frontend}
+      - KEYCLOAK_CLIENT_ID=${KEYCLOAK_CLIENT_ID:-app-frontend}
+      - CORS_ORIGINS=${CORS_ORIGINS:-http://localhost:5173}
      - TRUSTED_ORIGINS=${TRUSTED_ORIGINS:-}
-      # SvelteKit ORIGIN — evita que request.url.origin use la IP/puerto interno del contenedor
      - ORIGIN=${ORIGIN:-http://localhost:5173}
    ports:
      - "5173:5173"
@@ -153,12 +150,12 @@ services:
      - ./frontend:/app
      - frontend_node_modules:/app/node_modules
    networks:
-      - frontend-net
-      - hub-net
+      - app-frontend
+      - app-hub
    restart: unless-stopped
-    command: [ "pnpm", "run", "dev", "--", "--host", "0.0.0.0" ]
+    command: ["pnpm", "run", "dev", "--", "--host", "0.0.0.0"]
    healthcheck:
-      test: [ "CMD-SHELL", "wget --no-verbose --tries=1 --spider http://localhost:5173/ || exit 1" ]
+      test: ["CMD-SHELL", "wget --no-verbose --tries=1 --spider http://localhost:5173/ || exit 1"]
      interval: 15s
      timeout: 5s
      retries: 5
@@ -169,42 +166,27 @@ services:
        max-size: "10m"
        max-file: "3"

-  # Celery Worker
+  # ── Celery Worker ────────────────────────────────────────────────────────────
  celery_worker:
    build: ./backend
-    container_name: worker
+    image: app-worker:latest
+    container_name: app-worker
    command: celery -A core.celery_app worker --loglevel=info
    environment:
      - DEBUG=${DEBUG:-True}
      - ENVIRONMENT=${ENVIRONMENT:-development}
      - PYTHONUNBUFFERED=1
-      - PYTHONDONTWRITEBYTECODE=1
-      - VALKEY_URL=${VALKEY_URL:-redis://valkey:6379/0}
-      - CENTRAL_SERVER_URL=${CENTRAL_SERVER_URL:-""}
-      - SYNC_SECRET_TOKEN=${SYNC_SECRET_TOKEN:-change-this-sync-token-in-production}
-      - SPOKE_URLS=${SPOKE_URLS:-""}
-      - CORE_DB_HOST=${CORE_DB_HOST:-postgres-a76}
+      - CORE_DB_HOST=${CORE_DB_HOST:-postgres}
      - CORE_DB_PORT=${CORE_DB_PORT:-5432}
-      - CORE_DB_NAME=${CORE_DB_NAME:-anexo76_core}
+      - CORE_DB_NAME=${CORE_DB_NAME:-app_core}
      - CORE_DB_USER=${CORE_DB_USER:-postgres}
      - CORE_DB_PASSWORD=${POSTGRES_APP_PASSWORD:-postgres}
-      - VALKEY_URL=redis://valkey:6379/0
-      - SITAR_API_URL=${SITAR_API_URL}
-      - SITAR_API_USER=${SITAR_API_USER}
-      - SITAR_API_PASSWORD=${SITAR_API_PASSWORD}
-      - COVE_FIEL_HASH_KEY=${COVE_FIEL_HASH_KEY}
-      - COVE_FIEL_HASH_IV=${COVE_FIEL_HASH_IV}
-      - COVE_API_URL=${COVE_API_URL:-https://api.vu.aduanasoft.com}
-      - DODA_API_BASE_URL=${DODA_API_BASE_URL}
-      - DODA_API_VERIFY_SSL=${DODA_API_VERIFY_SSL:-False}
-      - CSV_IMPORT_STORAGE=${CSV_IMPORT_STORAGE:-minio}
+      - VALKEY_URL=${VALKEY_URL:-redis://valkey:6379/0}
      - S3_ENDPOINT_URL=${S3_ENDPOINT_URL:-http://minio:9000}
-      - S3_ACCESS_KEY=${S3_ACCESS_KEY:-${MINIO_ROOT_USER:-minioadmin}}
-      - S3_SECRET_KEY=${S3_SECRET_KEY:-${MINIO_ROOT_PASSWORD:-minioadmin}}
-      - S3_BUCKET=${S3_BUCKET:-anexo76}
-      - S3_REGION=${S3_REGION:-us-east-1}
-      - S3_USE_SSL=${S3_USE_SSL:-false}
-      - S3_FILE_STORAGE=${S3_FILE_STORAGE:-true}
+      - S3_ACCESS_KEY=${S3_ACCESS_KEY:-minioadmin}
+      - S3_SECRET_KEY=${S3_SECRET_KEY:-minioadmin}
+      - S3_BUCKET=${S3_BUCKET:-app}
+      - CSV_IMPORT_STORAGE=${CSV_IMPORT_STORAGE:-minio}
    depends_on:
      backend:
        condition: service_healthy
@@ -215,39 +197,21 @@ services:
      - backend_cache:/app/__pycache__
      - backend_uploads:/app/uploads
    networks:
-      - backend-net
+      - app-backend

-  # Celery Beat
+  # ── Celery Beat ──────────────────────────────────────────────────────────────
  celery_beat:
    build: ./backend
-    container_name: celery_beat
+    image: app-celery-beat:latest
+    container_name: app-celery-beat
    command: celery -A core.celery_app beat --loglevel=info
    environment:
-      - VALKEY_URL=${VALKEY_URL:-redis://valkey:6379/0}
-      - CENTRAL_SERVER_URL=${CENTRAL_SERVER_URL:-""}
-      - SYNC_SECRET_TOKEN=${SYNC_SECRET_TOKEN:-change-this-sync-token-in-production}
-      - SPOKE_URLS=${SPOKE_URLS:-""}
-      - CORE_DB_HOST=${CORE_DB_HOST:-postgres-a76}
+      - CORE_DB_HOST=${CORE_DB_HOST:-postgres}
      - CORE_DB_PORT=${CORE_DB_PORT:-5432}
-      - CORE_DB_NAME=${CORE_DB_NAME:-anexo76_core}
+      - CORE_DB_NAME=${CORE_DB_NAME:-app_core}
      - CORE_DB_USER=${CORE_DB_USER:-postgres}
      - CORE_DB_PASSWORD=${POSTGRES_APP_PASSWORD:-postgres}
-      - SITAR_API_URL=${SITAR_API_URL}
-      - SITAR_API_USER=${SITAR_API_USER}
-      - SITAR_API_PASSWORD=${SITAR_API_PASSWORD}
-      - COVE_FIEL_HASH_KEY=${COVE_FIEL_HASH_KEY}
-      - COVE_FIEL_HASH_IV=${COVE_FIEL_HASH_IV}
-      - COVE_API_URL=${COVE_API_URL:-https://api.vu.aduanasoft.com}
-      - DODA_API_BASE_URL=${DODA_API_BASE_URL}
-      - DODA_API_VERIFY_SSL=${DODA_API_VERIFY_SSL:-False}
-      - CSV_IMPORT_STORAGE=${CSV_IMPORT_STORAGE:-minio}
-      - S3_ENDPOINT_URL=${S3_ENDPOINT_URL:-http://minio:9000}
-      - S3_ACCESS_KEY=${S3_ACCESS_KEY:-${MINIO_ROOT_USER:-minioadmin}}
-      - S3_SECRET_KEY=${S3_SECRET_KEY:-${MINIO_ROOT_PASSWORD:-minioadmin}}
-      - S3_BUCKET=${S3_BUCKET:-anexo76}
-      - S3_REGION=${S3_REGION:-us-east-1}
-      - S3_USE_SSL=${S3_USE_SSL:-false}
-      - S3_FILE_STORAGE=${S3_FILE_STORAGE:-true}
+      - VALKEY_URL=${VALKEY_URL:-redis://valkey:6379/0}
    depends_on:
      backend:
        condition: service_healthy
@@ -256,22 +220,23 @@ services:
    volumes:
      - ./backend:/app
      - backend_cache:/app/__pycache__
-      - backend_uploads:/app/uploads
    networks:
-      - backend-net
+      - app-backend

+  # ── Valkey (Redis) ───────────────────────────────────────────────────────────
  valkey:
    image: valkey/valkey:7.2
-    container_name: valkey
+    container_name: app-valkey
    restart: always
    ports:
      - "6379:6379"
    networks:
-      - backend-net
+      - app-backend

+  # ── MinIO (object storage) ───────────────────────────────────────────────────
  minio:
    image: minio/minio:RELEASE.2025-09-07T16-13-09Z
-    container_name: anexo76-minio
+    container_name: app-minio
    command: server /data --console-address ":9001"
    environment:
      MINIO_ROOT_USER: ${MINIO_ROOT_USER:-minioadmin}
@@ -282,10 +247,10 @@ services:
    volumes:
      - minio_data:/data
    networks:
-      - backend-net
+      - app-backend
    restart: unless-stopped
    healthcheck:
-      test: [ "CMD-SHELL", "curl -f http://127.0.0.1:9000/minio/health/live || exit 1" ]
+      test: ["CMD-SHELL", "curl -f http://127.0.0.1:9000/minio/health/live || exit 1"]
      interval: 10s
      timeout: 5s
      retries: 5
@@ -297,7 +262,7 @@ services:
        max-file: "3"

 volumes:
-  postgres_app_data:
+  postgres_data:
    driver: local
  frontend_node_modules:
    driver: local
@@ -309,11 +274,10 @@ volumes:
    driver: local

 networks:
-  backend-net:
+  app-backend:
    driver: bridge
-  frontend-net:
+  app-frontend:
    driver: bridge
-
-  hub-net:
+  app-hub:
    external: true
    name: aduanasoft-hub_default