feature/app-selector

backend/core/security.py

@@ -33,6 +33,17 @@ _tenant_id_hub_by_local: Dict[int, int] = {}
 # Security scheme
 security = HTTPBearer()
 
+# Sistemas válidos del selector de app (SCAF / SCAII)
+_VALID_SYSTEMS = frozenset(("fixed_asset", "inventory"))
+
+
+def get_active_system(request: Request) -> Optional[str]:
+    """Sistema activo (SCAF/SCAII): header ``X-Active-System`` (autoritativo del cliente)
+    con fallback a la cookie ``active_system``. No depende de ``request.state`` porque
+    ``TenantMiddleware`` hace short-circuit en rutas ``/api/``."""
+    value = request.headers.get("x-active-system") or request.cookies.get("active_system")
+    return value if value in _VALID_SYSTEMS else None
+
 
 async def verify_token(token: str, tenant_id_override: str = None) -> Dict[str, Any]:
     """