refactor: update role handling in security and permissions modules, and change hub-net to non-external in docker-compose

backend/api/v1/modules/a76/invoices/routes.py

@@ -1,6 +1,6 @@
 from typing import Dict, Any, Optional
 from core.database import get_core_db
-from core.security import get_current_user, validate_access_to_resource
+from core.security import collect_user_role_names, get_current_user, validate_access_to_resource
 from fastapi import APIRouter, Depends, HTTPException, Query, Path
 from sqlalchemy import func, or_, and_
 from sqlalchemy.orm import Session
@@ -201,8 +201,9 @@ def list_invoices(
     List invoices with optional filters and granular permission enforcement.
     """
     tenant_id = validate_access_to_resource(db, company_id, current_user)
-    user_roles = current_user.get("realm_access", {}).get("roles", [])
-    allowed_filters = [] 
+    # Roles vienen del Hub (/auth/me), no de realm_access del JWT crudo.
+    is_hub_admin = "admin" in collect_user_role_names(current_user)
+    allowed_filters = []
 
     # Información del usuario para debugging (se ve en los logs del servidor)
     user_name = current_user.get('preferred_username') or current_user.get('email', 'Desconocido')
@@ -246,8 +247,8 @@ def list_invoices(
 
         if not allowed_filters:
             # Si no tiene ningún permiso de factura, bloqueamos
-            # Excepto si es un admin de Keycloak, le damos el beneficio de la duda pero logeamos
-            if "admin" in user_roles:
+            # Excepto si es admin (Hub roles / Keycloak), fallback a ver todo.
+            if is_hub_admin:
                 print(f"[AUTH] Keycloak Admin {user_name} has no app permissions. Granting view_all as fallback.")
                 allowed_filters = None
             else: