feature/app-selector

frontend/src/lib/auth.ts

@@ -35,6 +35,7 @@ export interface User {
 	tenantId?: number;
 	roles: string[];
 	permissions: string[];
+	allowedSystems: string[]; // sistemas a los que tiene acceso: "fixed_asset" | "inventory"
 	// Cache management
 	profileSyncedAt?: number; // timestamp en ms para cache TTL
 }
@@ -346,6 +347,7 @@ const updateAuthState = async () => {
 			tenantId,
 			roles,
 			permissions: parsed?.permissions?.length ? parsed.permissions : currentPerms,
+			allowedSystems: previousUser?.allowedSystems ?? [],
 			profileSyncedAt: previousUser?.profileSyncedAt
 		};
 
@@ -481,7 +483,7 @@ export async function syncCompanyPermissions(companyId: number): Promise<void> {
 	if (!browser || !Number.isFinite(companyId)) return;
 	try {
 		const { api } = await import('./api');
-		const res = await api.get<{ permissions: string[] }>(
+		const res = await api.get<{ permissions: string[]; allowed_systems?: string[] }>(
 			`/v1/core/permissions/me?company_id=${companyId}`
 		);
 		if (res.error || res.data === undefined) return;
@@ -489,10 +491,24 @@ export async function syncCompanyPermissions(companyId: number): Promise<void> {
 		if (!Array.isArray(perms)) return;
 		const state = get(authStore);
 		if (!state.user) return;
+		const { systemStore } = await import('./stores/system.svelte');
+		const allowedSystems = (res.data.allowed_systems ?? []) as import('./stores/system.svelte').SystemType[];
+
 		authStore.setUser({
 			...state.user,
-			permissions: perms
+			permissions: perms,
+			// Preservar allowedSystems del SSR si el API no los retorna (JWT sin claim, seed pendiente)
+			allowedSystems: allowedSystems.length > 0 ? allowedSystems : (state.user.allowedSystems ?? [])
 		});
+
+		// Solo reinicializar el systemStore si el API retorna sistemas explícitos.
+		// Si está vacío, preservar el estado establecido por SSR para evitar resetear activeSystem a null.
+		if (allowedSystems.length > 0) {
+			const cookieSystem = typeof document !== 'undefined'
+				? document.cookie.match(/(?:^|;\s*)active_system=([^;]+)/)?.[1] ?? null
+				: null;
+			systemStore.initialize(allowedSystems, cookieSystem);
+		}
 	} catch (e) {
 		console.warn('[auth] syncCompanyPermissions:', e);
 	} finally {
@@ -591,6 +607,7 @@ const loadUserInfo = async (token: string) => {
 				tenantId: d.tenant_id ?? previousUser?.tenantId,
 				roles: d.roles ?? previousUser?.roles ?? [],
 				permissions: d.permissions ?? previousUser?.permissions ?? [],
+				allowedSystems: previousUser?.allowedSystems ?? [],
 				profileSyncedAt: Date.now()
 			});
 		}