Puestas de seguridad y limpieza de codigo

frontend/src/lib/api/help.ts

@@ -1,14 +1,27 @@
-import { authStore } from '$lib/auth';
+import { getToken, authStore } from '$lib/auth';
 import { get } from 'svelte/store';
 
 const api_url = import.meta.env.VITE_API_URL;
 const BASE_URL = `${api_url.endsWith('/') ? api_url : api_url + '/'}v1/core/help-center`;
 
+function getAuthToken(): string | null {
+    // 1. First try getToken() which checks Keycloak and localStorage
+    let token = getToken();
+
+    // 2. If somehow empty, explicitly check authStore value
+    if (!token) {
+        const auth = get(authStore);
+        token = auth.token;
+    }
+
+    return token;
+}
+
 function getHeaders() {
-    const auth = get(authStore);
+    const token = getAuthToken();
     return {
         'Content-Type': 'application/json',
-        ...(auth.token ? { 'Authorization': `Bearer ${auth.token}` } : {})
+        ...(token ? { 'Authorization': `Bearer ${token}` } : {})
     };
 }
 
@@ -29,13 +42,13 @@ export interface HelpArticle {
 
 export const helpApi = {
     async listArticles(): Promise<HelpArticle[]> {
-        const response = await fetch(`${BASE_URL}/articles/`);
+        const response = await fetch(`${BASE_URL}/articles/`, { headers: getHeaders() });
         if (!response.ok) throw new Error('Failed to fetch articles');
         return response.json();
     },
 
     async getArticle(uuid: string): Promise<HelpArticle> {
-        const response = await fetch(`${BASE_URL}/articles/${uuid}/`);
+        const response = await fetch(`${BASE_URL}/articles/${uuid}/`, { headers: getHeaders() });
         if (!response.ok) throw new Error('Failed to fetch article');
         return response.json();
     },
@@ -46,7 +59,8 @@ export const helpApi = {
             headers: getHeaders(),
             body: JSON.stringify(data)
         });
-        if (!response.ok) throw new Error('Failed to update article');
+        if (response.status === 403) throw new Error('No tienes permisos para editar artículos (Requiere rol Admin)');
+        if (!response.ok) throw new Error('Error al guardar cambios');
         return response.json();
     },
 
@@ -56,7 +70,8 @@ export const helpApi = {
             headers: getHeaders(),
             body: JSON.stringify(data)
         });
-        if (!response.ok) throw new Error('Failed to create article');
+        if (response.status === 403) throw new Error('No tienes permisos para crear artículos (Requiere rol Admin)');
+        if (!response.ok) throw new Error('Error al crear el artículo');
         return response.json();
     },
 
@@ -65,7 +80,8 @@ export const helpApi = {
             method: 'DELETE',
             headers: getHeaders()
         });
-        if (!response.ok) throw new Error('Failed to delete article');
+        if (response.status === 403) throw new Error('No tienes permisos para eliminar (Requiere rol Admin)');
+        if (!response.ok) throw new Error('Error al eliminar');
     },
 
     async triggerSync(): Promise<void> {
@@ -76,15 +92,17 @@ export const helpApi = {
         const formData = new FormData();
         formData.append('file', file);
 
+        const token = getAuthToken();
         const response = await fetch(`${BASE_URL}/upload-image/`, {
             method: 'POST',
             // No Content-Type header for FormData, browser sets it with boundary
             headers: {
-                ...(get(authStore).token ? { 'Authorization': `Bearer ${get(authStore).token}` } : {})
+                ...(token ? { 'Authorization': `Bearer ${token}` } : {})
             },
             body: formData
         });
-        if (!response.ok) throw new Error('Failed to upload image');
+        if (response.status === 403) throw new Error('No tienes permisos para subir imágenes (Requiere rol Admin)');
+        if (!response.ok) throw new Error('Error al subir imagen');
         return response.json();
     },
 
@@ -92,14 +110,16 @@ export const helpApi = {
         const formData = new FormData();
         formData.append('file', file);
 
+        const token = getAuthToken();
         const response = await fetch(`${BASE_URL}/upload-asset/`, {
             method: 'POST',
             headers: {
-                ...(get(authStore).token ? { 'Authorization': `Bearer ${get(authStore).token}` } : {})
+                ...(token ? { 'Authorization': `Bearer ${token}` } : {})
             },
             body: formData
         });
-        if (!response.ok) throw new Error('Failed to upload asset');
+        if (response.status === 403) throw new Error('No tienes permisos para subir archivos (Requiere rol Admin)');
+        if (!response.ok) throw new Error('Error al subir archivo');
         return response.json();
     }
 };