feature/app-selector

backend/core/middleware.py

@@ -8,7 +8,7 @@ from fastapi.responses import JSONResponse
 from starlette.middleware.base import BaseHTTPMiddleware
 
 from .config import settings
-from .security import get_tenant_from_token, verify_token
+from .security import get_tenant_from_token, verify_token, get_active_system
 
 logger = logging.getLogger(__name__)
 
@@ -53,6 +53,7 @@ def _extract_company_id(request: Request) -> Optional[int]:
     except (TypeError, ValueError):
         return None
 
+
 class TenantMiddleware(BaseHTTPMiddleware):
     """
     Middleware original para extraer tenant_id y user_info del token.
@@ -96,6 +97,7 @@ class TenantMiddleware(BaseHTTPMiddleware):
             request.state.tenant_id = tenant_id
             request.state.user_info = user_info
             request.state.company_id = _extract_company_id(request)
+            request.state.active_system = get_active_system(request)
         except Exception as e:
             logger.error(f"❌ Tenant validation error: {str(e)}")
             return JSONResponse(

backend/core/security.py

@@ -33,6 +33,17 @@ _tenant_id_hub_by_local: Dict[int, int] = {}
 # Security scheme
 security = HTTPBearer()
 
+# Sistemas válidos del selector de app (SCAF / SCAII)
+_VALID_SYSTEMS = frozenset(("fixed_asset", "inventory"))
+
+
+def get_active_system(request: Request) -> Optional[str]:
+    """Sistema activo (SCAF/SCAII): header ``X-Active-System`` (autoritativo del cliente)
+    con fallback a la cookie ``active_system``. No depende de ``request.state`` porque
+    ``TenantMiddleware`` hace short-circuit en rutas ``/api/``."""
+    value = request.headers.get("x-active-system") or request.cookies.get("active_system")
+    return value if value in _VALID_SYSTEMS else None
+
 
 async def verify_token(token: str, tenant_id_override: str = None) -> Dict[str, Any]:
     """