chore: update sso flow, logout, dashboard layout and docker-compose

docker-compose.yml

@@ -123,6 +123,7 @@ services:
       - KEYCLOAK_CLIENT_ID=${KEYCLOAK_CLIENT_ID:-anexo76-frontend}
       # Hub — URL pública para el browser y URL interna para server-side
       - VITE_HUB_URL=${VITE_HUB_URL:-http://localhost:8001}
+      - HUB_URL=${HUB_URL:-http://localhost:8001}
       - INTERNAL_HUB_URL=${INTERNAL_HUB_URL:-http://host.docker.internal:8001}
       # CORS / CSRF — trusted origins para svelte.config.js
       - CORS_ORIGINS=${CORS_ORIGINS:-http://localhost:5173,http://localhost:3001}

frontend/src/routes/auth/sso/+page.server.ts

@@ -9,6 +9,7 @@ import type { PageServerLoad } from './$types';
 
 export const load: PageServerLoad = async ({ url, cookies }) => {
 	const relayToken = url.searchParams.get('relay');
+	console.log('[SSO] relay token presente:', !!relayToken);
 
 	if (!relayToken) {
 		throw redirect(303, '/login?error=sso_missing_token');
@@ -42,8 +43,16 @@ export const load: PageServerLoad = async ({ url, cookies }) => {
 	}
 
 	const tokens = await response.json();
+	console.log('[SSO] exchange exitoso, tokens recibidos:', {
+		hasAccessToken: !!tokens.access_token,
+		accessTokenLen: tokens.access_token?.length,
+		hasRefreshToken: !!tokens.refresh_token,
+		tenant_id: tokens.tenant_id,
+		tenant_slug: tokens.tenant_slug,
+	});
 
 	const isProduction = process.env.NODE_ENV === 'production';
+	console.log('[SSO] NODE_ENV:', process.env.NODE_ENV, '→ isProduction:', isProduction);
 
 	// access_token — NO HttpOnly (client JS reads it for Bearer headers)
 	cookies.set('access_token', tokens.access_token, {
@@ -87,5 +96,6 @@ export const load: PageServerLoad = async ({ url, cookies }) => {
 			maxAge: 60 * 60 * 24 * 7,
 		});
 	}
+	console.log('[SSO] cookies configuradas, redirigiendo a /dashboard');
 	throw redirect(303, '/dashboard');
 };

frontend/src/routes/dashboard/+layout.server.ts

@@ -11,6 +11,7 @@ import {
 export const load: LayoutServerLoad = async ({ cookies, url, fetch }) => {
 	// Verificar si existe el token en las cookies
 	const { accessToken } = getAuthTokens(cookies);
+	console.log('[dashboard layout] access_token presente:', !!accessToken, '| url:', url.pathname);
 
 	// Si no hay token, redirigir al login
 	if (!accessToken) {

frontend/src/routes/logout/+server.ts

@@ -4,8 +4,15 @@ import type { RequestHandler } from './$types';
 
 export const POST: RequestHandler = async ({ cookies, request }) => {
 	const refreshToken = cookies.get('refresh_token');
-	const appOrigin = new URL(request.url).origin;
-	const loginUrl = `${appOrigin}/login`;
+
+	// Post-logout siempre va al workspace login, no al login local de Anexo76.
+	// Desde el workspace el usuario puede volver a autenticarse con Microsoft
+	// y el relay lo traerá de vuelta automáticamente.
+	// HUB_URL es la URL pública del workspace (ej: https://workspace.aduanasoft.com)
+	const hubPublicUrl = (env.HUB_URL || '').replace(/\/+$/, '');
+	const workspaceLoginUrl = hubPublicUrl
+		? `${hubPublicUrl}/login`
+		: `${new URL(request.url).origin}/login`;
 
 	// Eliminar todas las cookies de autenticación
 	cookies.delete('access_token', { path: '/' });
@@ -26,7 +33,7 @@ export const POST: RequestHandler = async ({ cookies, request }) => {
 				headers: { 'Content-Type': 'application/json' },
 				body: JSON.stringify({
 					refresh_token: refreshToken,
-					post_logout_redirect_uri: loginUrl,
+					post_logout_redirect_uri: workspaceLoginUrl,
 				}),
 			});
 
@@ -34,9 +41,9 @@ export const POST: RequestHandler = async ({ cookies, request }) => {
 				await res.json().catch(() => ({}));
 			}
 		} catch (err: any) {
-			// Si falla la llamada al Hub, caer al login local
+			// Si falla la llamada al Hub, caer al workspace login de todos modos
 		}
 	}
 
-	throw redirect(303, loginUrl);
+	throw redirect(303, workspaceLoginUrl);
 };