feature/mercancias-permisos

backend/api/v1/modules/a76/layouts_csv/common/track_commit_dispatch.py

@@ -29,6 +29,9 @@ def dispatch_tracked_layouts_csv_commit(
     """
     Lee tenant_id / company_id del meta en Redis, valida acceso y despacha la tarea Celery
     con un task_id nuevo (commit) para que el polling use commit_job_id.
+
+    Si ``required_permissions`` es None, se normaliza a [] para validar acceso a compañía
+    (``validate_access_to_resource(..., None)`` omitiría esa validación por el atajo tipo /me).
     """
     raw = redis_client.get(meta_redis_key)
     if not raw:
@@ -36,22 +39,29 @@ def dispatch_tracked_layouts_csv_commit(
     meta = json.loads(raw.decode("utf-8"))
     tenant_id = int(meta["tenant_id"])
     company_id = meta.get("company_id")
-    if company_id is not None:
-        try:
-            validate_access_to_resource(
-                db, int(company_id), current_user, required_permissions
-            )
-        except HTTPException:
-            raise
-        except Exception:
-            raise HTTPException(status_code=403, detail="Sin acceso a este job") from None
+    if company_id is None:
+        raise HTTPException(
+            status_code=403,
+            detail="Job sin compañía asociada o meta incompleto",
+        )
+    effective_permissions: list[str] = (
+        [] if required_permissions is None else required_permissions
+    )
+    try:
+        validate_access_to_resource(
+            db, int(company_id), current_user, effective_permissions
+        )
+    except HTTPException:
+        raise
+    except Exception:
+        raise HTTPException(status_code=403, detail="Sin acceso a este job") from None
 
     commit_id = str(uuid4())
     track_and_dispatch(
         db=db,
         task=celery_task,
         tenant_id=tenant_id,
-        company_id=int(company_id) if company_id is not None else None,
+        company_id=int(company_id),
         requested_by_user=current_user.get("preferred_username")
         or current_user.get("email")
         or current_user.get("sub"),