From a445935d8b80b5147b198acf45aaaee9d103efd3 Mon Sep 17 00:00:00 2001
From: Galindo97 <agalindo@aduanasoft.com.mx>
Date: Wed, 29 Apr 2026 12:58:08 -0500
Subject: [PATCH] chore: update sso flow, logout, dashboard layout and
 docker-compose

---
 docker-compose.yml                              |  1 +
 frontend/src/routes/auth/sso/+page.server.ts    | 10 ++++++++++
 frontend/src/routes/dashboard/+layout.server.ts |  1 +
 frontend/src/routes/logout/+server.ts           | 17 ++++++++++++-----
 4 files changed, 24 insertions(+), 5 deletions(-)

diff --git a/docker-compose.yml b/docker-compose.yml
index ba92c75a..fd2a0777 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -123,6 +123,7 @@ services:
       - KEYCLOAK_CLIENT_ID=${KEYCLOAK_CLIENT_ID:-anexo76-frontend}
       # Hub — URL pública para el browser y URL interna para server-side
       - VITE_HUB_URL=${VITE_HUB_URL:-http://localhost:8001}
+      - HUB_URL=${HUB_URL:-http://localhost:8001}
       - INTERNAL_HUB_URL=${INTERNAL_HUB_URL:-http://host.docker.internal:8001}
       # CORS / CSRF — trusted origins para svelte.config.js
       - CORS_ORIGINS=${CORS_ORIGINS:-http://localhost:5173,http://localhost:3001}
diff --git a/frontend/src/routes/auth/sso/+page.server.ts b/frontend/src/routes/auth/sso/+page.server.ts
index f19f0ada..c6709f2b 100644
--- a/frontend/src/routes/auth/sso/+page.server.ts
+++ b/frontend/src/routes/auth/sso/+page.server.ts
@@ -9,6 +9,7 @@ import type { PageServerLoad } from './$types';
 
 export const load: PageServerLoad = async ({ url, cookies }) => {
 	const relayToken = url.searchParams.get('relay');
+	console.log('[SSO] relay token presente:', !!relayToken);
 
 	if (!relayToken) {
 		throw redirect(303, '/login?error=sso_missing_token');
@@ -42,8 +43,16 @@ export const load: PageServerLoad = async ({ url, cookies }) => {
 	}
 
 	const tokens = await response.json();
+	console.log('[SSO] exchange exitoso, tokens recibidos:', {
+		hasAccessToken: !!tokens.access_token,
+		accessTokenLen: tokens.access_token?.length,
+		hasRefreshToken: !!tokens.refresh_token,
+		tenant_id: tokens.tenant_id,
+		tenant_slug: tokens.tenant_slug,
+	});
 
 	const isProduction = process.env.NODE_ENV === 'production';
+	console.log('[SSO] NODE_ENV:', process.env.NODE_ENV, '→ isProduction:', isProduction);
 
 	// access_token — NO HttpOnly (client JS reads it for Bearer headers)
 	cookies.set('access_token', tokens.access_token, {
@@ -87,5 +96,6 @@ export const load: PageServerLoad = async ({ url, cookies }) => {
 			maxAge: 60 * 60 * 24 * 7,
 		});
 	}
+	console.log('[SSO] cookies configuradas, redirigiendo a /dashboard');
 	throw redirect(303, '/dashboard');
 };
diff --git a/frontend/src/routes/dashboard/+layout.server.ts b/frontend/src/routes/dashboard/+layout.server.ts
index c793cb29..3650c091 100644
--- a/frontend/src/routes/dashboard/+layout.server.ts
+++ b/frontend/src/routes/dashboard/+layout.server.ts
@@ -11,6 +11,7 @@ import {
 export const load: LayoutServerLoad = async ({ cookies, url, fetch }) => {
 	// Verificar si existe el token en las cookies
 	const { accessToken } = getAuthTokens(cookies);
+	console.log('[dashboard layout] access_token presente:', !!accessToken, '| url:', url.pathname);
 
 	// Si no hay token, redirigir al login
 	if (!accessToken) {
diff --git a/frontend/src/routes/logout/+server.ts b/frontend/src/routes/logout/+server.ts
index 9c1b10ed..07bab424 100644
--- a/frontend/src/routes/logout/+server.ts
+++ b/frontend/src/routes/logout/+server.ts
@@ -4,8 +4,15 @@ import type { RequestHandler } from './$types';
 
 export const POST: RequestHandler = async ({ cookies, request }) => {
 	const refreshToken = cookies.get('refresh_token');
-	const appOrigin = new URL(request.url).origin;
-	const loginUrl = `${appOrigin}/login`;
+
+	// Post-logout siempre va al workspace login, no al login local de Anexo76.
+	// Desde el workspace el usuario puede volver a autenticarse con Microsoft
+	// y el relay lo traerá de vuelta automáticamente.
+	// HUB_URL es la URL pública del workspace (ej: https://workspace.aduanasoft.com)
+	const hubPublicUrl = (env.HUB_URL || '').replace(/\/+$/, '');
+	const workspaceLoginUrl = hubPublicUrl
+		? `${hubPublicUrl}/login`
+		: `${new URL(request.url).origin}/login`;
 
 	// Eliminar todas las cookies de autenticación
 	cookies.delete('access_token', { path: '/' });
@@ -26,7 +33,7 @@ export const POST: RequestHandler = async ({ cookies, request }) => {
 				headers: { 'Content-Type': 'application/json' },
 				body: JSON.stringify({
 					refresh_token: refreshToken,
-					post_logout_redirect_uri: loginUrl,
+					post_logout_redirect_uri: workspaceLoginUrl,
 				}),
 			});
 
@@ -34,9 +41,9 @@ export const POST: RequestHandler = async ({ cookies, request }) => {
 				await res.json().catch(() => ({}));
 			}
 		} catch (err: any) {
-			// Si falla la llamada al Hub, caer al login local
+			// Si falla la llamada al Hub, caer al workspace login de todos modos
 		}
 	}
 
-	throw redirect(303, loginUrl);
+	throw redirect(303, workspaceLoginUrl);
 };