refactor: update role handling in security and permissions modules, and change hub-net to non-external in docker-compose

backend/api/v1/modules/a76/invoices/routes.py

@@ -1,6 +1,6 @@
 from typing import Dict, Any, Optional
 from core.database import get_core_db
-from core.security import get_current_user, validate_access_to_resource
+from core.security import collect_user_role_names, get_current_user, validate_access_to_resource
 from fastapi import APIRouter, Depends, HTTPException, Query, Path
 from sqlalchemy import func, or_, and_
 from sqlalchemy.orm import Session
@@ -201,8 +201,9 @@ def list_invoices(
     List invoices with optional filters and granular permission enforcement.
     """
     tenant_id = validate_access_to_resource(db, company_id, current_user)
-    user_roles = current_user.get("realm_access", {}).get("roles", [])
-    allowed_filters = [] 
+    # Roles vienen del Hub (/auth/me), no de realm_access del JWT crudo.
+    is_hub_admin = "admin" in collect_user_role_names(current_user)
+    allowed_filters = []
 
     # Información del usuario para debugging (se ve en los logs del servidor)
     user_name = current_user.get('preferred_username') or current_user.get('email', 'Desconocido')
@@ -246,8 +247,8 @@ def list_invoices(
 
         if not allowed_filters:
             # Si no tiene ningún permiso de factura, bloqueamos
-            # Excepto si es un admin de Keycloak, le damos el beneficio de la duda pero logeamos
-            if "admin" in user_roles:
+            # Excepto si es admin (Hub roles / Keycloak), fallback a ver todo.
+            if is_hub_admin:
                 print(f"[AUTH] Keycloak Admin {user_name} has no app permissions. Granting view_all as fallback.")
                 allowed_filters = None
             else:

backend/api/v1/modules/core/permissions/routes.py

@@ -8,7 +8,7 @@ from fastapi import APIRouter, Depends, HTTPException, status, Query
 from sqlalchemy.orm import Session
 
 from core.database import get_core_db
-from core.security import get_current_user, validate_access_to_resource
+from core.security import collect_user_role_names, get_current_user, validate_access_to_resource
 from .dependencies import (
     PermissionChecker,
     RequirePermission,
@@ -64,11 +64,8 @@ async def get_my_permissions(
     user_id = current_user.get("sub") or current_user.get("id")
 
     # 2. Determinar si es un admin de Keycloak para forzar bootstrap si es necesario
-    realm_roles = current_user.get("realm_access", {}).get("roles", [])
-    client_roles = []
-    for client in current_user.get("resource_access", {}).values():
-        client_roles.extend(client.get("roles", []))
-    is_keycloak_admin = "admin" in realm_roles or "admin" in client_roles
+    # Roles vienen del Hub (/auth/me vía verify_token); ver collect_user_role_names.
+    is_keycloak_admin = "admin" in collect_user_role_names(current_user)
 
     # 3. Bootstrap: si la compañía no tiene roles, o si el usuario es admin, o si estamos en desarrollo y el usuario no tiene roles
     from .models import CompanyRole, UserCompanyRole