Elimina la dependencia de HUB_ADMIN_EMAIL/HUB_ADMIN_PASSWORD del flujo
de invitaciones. Ahora se usa el Bearer token del usuario autenticado,
que debe tener role='admin' en su tenant dentro del Hub.
Esto hace el flujo compatible con instalaciones self-hosted donde el
cliente no debe tener acceso a credenciales del Workspace Hub.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Antes los fallos del Hub login y invite creation eran silenciosos o con
warning genérico. Ahora loguea status code, body y nombre de campo para
facilitar diagnóstico en producción.
- Detecta HUB_ADMIN_EMAIL/PASSWORD vacíos con error explícito
- Loguea status+body cuando login falla (401/403)
- Loguea status+body+tenant/email cuando invite falla (404/403)
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Restaura la construcción correcta de URLSearchParams en getSignatures,
eliminando el spread de filters inválido y el cierre de objeto roto.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
- Add is_hub_admin() and resolve_tenant_id_required() to core/security
- hub_admin resolves tenant from company or uses None as global sentinel
- Update routes and services to skip tenant filter when tenant_id is None
- UserService accepts is_hub_admin flag for cross-tenant user management
- get_my_companies returns all companies for hub_admin without tenant restriction
- Updated sidebar component to merge user data from Keycloak and Workspace, including avatar URLs.
- Refactored nav-user component to utilize new avatar resolution logic and display user information more effectively.
- Introduced a new utility function to resolve user avatar URLs, prioritizing Workspace avatars.
- Implemented backend changes to support synchronization of user profile data, including avatar URLs from Workspace.
- Added database migration to include new fields for Workspace profile synchronization in user_tenants.
- Created a new client for fetching user profiles from Workspace.
- Updated dashboard components to reflect changes in user data structure and avatar handling.
- Removed avatar upload functionality from the profile update process, relying on Workspace for avatar management.
- Added tests for avatar resolution logic to ensure correct prioritization of avatar sources.
