feature/optimizacion-de-permisos

backend/api/v1/modules/a76/invoice_settings/routes.py

@@ -2,7 +2,12 @@ from typing import List, Dict, Any
 from fastapi import APIRouter, Depends, HTTPException, Query
 from sqlalchemy.orm import Session
 from core.database import get_core_db
-from core.security import get_current_user, validate_access_to_resource
+from core.security import (
+    get_current_user,
+    validate_access_to_resource,
+    is_hub_admin,
+    _has_local_super_admin_role,
+)
 from api.v1.modules.a76.invoice_settings import services
 from api.v1.modules.a76.invoice_settings.dto import InvoiceSettingsRequest, InvoiceSettingsResponse, OperationType
 from api.v1.modules.core.permissions.service import PermissionService
@@ -30,10 +35,11 @@ def _can_read_invoice_settings_row(
     Ver configuración por tipo/op: settings_general.view O ver facturas de ese mismo contexto
     (para cargar defaults en alta/edición sin abrir la pantalla de parámetros).
     """
-    user_roles = current_user.get("realm_access", {}).get("roles", [])
-    if "admin" in user_roles:
-        return True
+    # Bypass de checks: hub_admin (atestado por el Hub) o super_admin local en
+    # la compañía. La autorización NO se decide por claims del JWT.
     user_id = current_user.get("sub") or current_user.get("id")
+    if is_hub_admin(current_user) or _has_local_super_admin_role(db, user_id, company_id):
+        return True
     if not user_id:
         return False
     ps = PermissionService(db)