- fixtures/keycloak.ts: Admin REST API helpers (createTestUser, assignRoles,
deleteTestUser) — copia exacta del hub
- global-setup.ts: crea usuario e2e-anexo76 en KC antes de los tests
- global-teardown.ts: elimina el usuario al finalizar
- auth.setup.ts: navega a /login → Workspace → llena form → /dashboard
(ya no usa password grant ni Direct Access Grants)
- playwright.config.ts: agrega globalSetup y globalTeardown
- Jenkinsfile: a76-e2e-credentials ahora son credenciales de KC admin;
usuario de prueba es efímero (creado/borrado por global-setup/teardown)
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Agrega INTERNAL_API_URL, INTERNAL_HUB_URL, HUB_URL, KEYCLOAK_URL y ORIGIN
al ejemplo para que el dev local tenga el mismo conjunto de variables que
usa Docker Compose, evitando que el SSO exchange y el refresh proactivo
fallen silenciosamente por vars indefinidas.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Todos los page.server.ts que hacían throw redirect(302, '/login') ahora
usan redirectToWorkspaceLogin(cookies, url) para enviar al usuario directo
al login del workspace en lugar de pasar por la página /login local de Anexo76.
Archivos actualizados:
- dashboard/pedimentos/+page.server.ts
- dashboard/pedimentos/edit/[id]/+page.server.ts (2 redirects)
- dashboard/invoices/+page.server.ts
- dashboard/invoices/edit/[id]/+page.server.ts
- dashboard/invoices/settings/+page.server.ts
- dashboard/goods/parts/edit/[[id]]/+page.server.ts
- dashboard/general_catalogs/ports/+page.server.ts
- dashboard/general_catalogs/seal/+page.server.ts
- dashboard/reports/vencimiento/+page.server.ts
- dashboard/reports/invoices/+page.server.ts
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
- Reduce ACCESS_TOKEN_MAX_SINGLE y ACCESS_TOKEN_CHUNK_SIZE de 3500 a 2800
para garantizar que cada cookie fragmentada no supere el límite de 4096 bytes
del navegador (incluye overhead del nombre, path, attrs).
- Agrega try/catch alrededor de response.json() en el load de /auth/sso para
evitar SyntaxError no manejado si el body no es JSON.
- Type guards explícitos en tokens.access_token, refresh_token y tenant_id
para detectar respuestas incompletas del hub antes de llamar cookies.set().
- .catch(() => ({})) en refreshRes.json() para que el refresh proactivo nunca
bloquee el flujo SSO aunque el body sea inesperado.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
- Changed the hub-net network configuration to external in docker-compose.
- Removed the Single Sign-On (SSO) service implementation and associated login form component.
- Enhanced authentication callback logic to improve error handling and redirect management.
- Updated various routes to streamline login and authentication processes, ensuring proper redirection to workspace login.
- Cleaned up unused code and improved overall structure for better maintainability.
- Updated sidebar component to merge user data from Keycloak and Workspace, including avatar URLs.
- Refactored nav-user component to utilize new avatar resolution logic and display user information more effectively.
- Introduced a new utility function to resolve user avatar URLs, prioritizing Workspace avatars.
- Implemented backend changes to support synchronization of user profile data, including avatar URLs from Workspace.
- Added database migration to include new fields for Workspace profile synchronization in user_tenants.
- Created a new client for fetching user profiles from Workspace.
- Updated dashboard components to reflect changes in user data structure and avatar handling.
- Removed avatar upload functionality from the profile update process, relying on Workspace for avatar management.
- Added tests for avatar resolution logic to ensure correct prioritization of avatar sources.
- Add InviteToken model and Alembic migration (core.invite_tokens)
- Add invites module: DTOs, service (create/validate/consume), routes
- Register invites router in core router
- Extend auth register endpoint to support invite_token flow:
- Validate local token, create user via Hub admin API (service account),
handle existing user (link instead of duplicate), create UserTenant, consume token
- Add GET /auth/register/check endpoint to validate token without consuming
- Add HUB_ADMIN_EMAIL, HUB_ADMIN_PASSWORD, APP_PUBLIC_URL to config
- Frontend: add invite() method and types to users.ts API client
- Frontend: add invite dialog with real roles dropdown to users page
- Frontend: update register page to handle invite flow and user-exists case
