refactor: update role handling in security and permissions modules, and change hub-net to non-external in docker-compose

backend/api/v1/modules/core/permissions/routes.py

@@ -8,7 +8,7 @@ from fastapi import APIRouter, Depends, HTTPException, status, Query
 from sqlalchemy.orm import Session
 
 from core.database import get_core_db
-from core.security import get_current_user, validate_access_to_resource
+from core.security import collect_user_role_names, get_current_user, validate_access_to_resource
 from .dependencies import (
     PermissionChecker,
     RequirePermission,
@@ -64,11 +64,8 @@ async def get_my_permissions(
     user_id = current_user.get("sub") or current_user.get("id")
 
     # 2. Determinar si es un admin de Keycloak para forzar bootstrap si es necesario
-    realm_roles = current_user.get("realm_access", {}).get("roles", [])
-    client_roles = []
-    for client in current_user.get("resource_access", {}).values():
-        client_roles.extend(client.get("roles", []))
-    is_keycloak_admin = "admin" in realm_roles or "admin" in client_roles
+    # Roles vienen del Hub (/auth/me vía verify_token); ver collect_user_role_names.
+    is_keycloak_admin = "admin" in collect_user_role_names(current_user)
 
     # 3. Bootstrap: si la compañía no tiene roles, o si el usuario es admin, o si estamos en desarrollo y el usuario no tiene roles
     from .models import CompanyRole, UserCompanyRole