- workspace-auth.ts: reemplaza isInternalOnlyHost por isDevOnlyUrl que
incluye localhost/127.0.0.1 e IPs LAN además de hostnames Docker.
getWorkspaceBaseUrl() y getPublicKeycloakBaseUrl() ya ignoran valores
dev-only; no usan VITE_KEYCLOAK_URL=http://localhost:... en prod.
- Nuevo resolveSystemBaseUrl(): cuando url.origin es localhost porque
ORIGIN env var apunta a localhost en producción, busca SITE_URL/APP_URL
como fallback para construir redirect_uri seguros.
- buildKeycloakAuthorizationUrl() y buildKeycloakLoginUrl() usan
resolveSystemBaseUrl() para el redirect_uri (evita localhost:5173).
- auth/callback/+page.server.ts: idem para el redirectUri del token exchange.
- auth.ts (cliente): resolveKeycloakUrl() detecta en runtime si
VITE_KEYCLOAK_URL bakeado apunta a localhost pero el browser NO está
en localhost → deriva la URL del hostname real del browser.
- .env.example: documenta vars de producción recomendadas (SITE_URL,
ORIGIN, VITE_HUB_URL) con advertencias sobre el efecto de ORIGIN.
Root cause: el .env de dev (ORIGIN=http://localhost:5173,
VITE_KEYCLOAK_URL=http://localhost:8085/kcauth) se usaba en producción
sin sobrescribir estas variables, causando que KC generara URLs con
localhost como redirect_uri y KC URL.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
- Introduced `permissionsHydrated` writable store to track if RBAC permissions are loaded for the active company.
- Added `markPermissionsHydrated` function to set the hydration state.
- Updated dashboard components to wait for permissions to be hydrated before rendering restricted content, enhancing user experience by avoiding "Access Denied" flashes.
- Refactored permission checks in `pedimento-permissions.ts` to consistently use `userHasPermission` for clarity and maintainability.
- Updated sidebar component to merge user data from Keycloak and Workspace, including avatar URLs.
- Refactored nav-user component to utilize new avatar resolution logic and display user information more effectively.
- Introduced a new utility function to resolve user avatar URLs, prioritizing Workspace avatars.
- Implemented backend changes to support synchronization of user profile data, including avatar URLs from Workspace.
- Added database migration to include new fields for Workspace profile synchronization in user_tenants.
- Created a new client for fetching user profiles from Workspace.
- Updated dashboard components to reflect changes in user data structure and avatar handling.
- Removed avatar upload functionality from the profile update process, relying on Workspace for avatar management.
- Added tests for avatar resolution logic to ensure correct prioritization of avatar sources.
- Introduced utility functions for managing access tokens in cookies, including setting, getting, and clearing tokens.
- Updated various components and server routes to utilize the new access token functions for better consistency and maintainability.
- Removed redundant cookie handling code across the application, streamlining the authentication process.
- Added session manager to handle token refresh and user activity tracking.
- Introduced session timeout warning dialog for user inactivity.
- Updated authentication token handling in cookies with security policies.
- Created server-side endpoint for silent refresh of access tokens using HttpOnly cookies.
- Added silent check SSO HTML page for Keycloak integration.
- Enhanced TenantMiddleware to validate tenant information from JWT tokens.
- Added LicenseValidationMiddleware to check tenant licenses before processing requests.
- Updated security utilities to extract tenant information from tokens and validate company access.
- Introduced CompanyStore to manage active company state and handle company switching in the frontend.
- Modified API routes to include company_id in requests for better resource management.
- Improved logging and error handling throughout the middleware and API layers.
- Updated frontend components to reflect changes in company management and selection.
- Added new API route for fetching user's companies with proper authentication handling.
refactor(dashboard): create dynamic columns for CodePedimentoRegimen with onSuccess callback
feat(dashboard): implement create, edit, and delete dialogs for CodePedimentoRegimen
feat(dialogs): add reusable dialog components for confirmation and details display
style(alert-dialog): improve styling and structure for alert dialog components
style(dialog): enhance styling and structure for dialog components
- Added sidebar menu components including sidebar-menu-item, sidebar-menu-skeleton, sidebar-menu-sub-button, sidebar-menu-sub-item, sidebar-menu-sub, sidebar-menu, sidebar-provider, sidebar-rail, sidebar-separator, sidebar-trigger, and sidebar.
- Introduced skeleton loading states for sidebar items.
- Integrated tooltip components for enhanced user interaction.
- Developed mobile responsiveness using media queries.
- Established authentication flow with Keycloak, including login, logout, and token management.
- Implemented server-side redirection based on authentication status.
- Enhanced error handling and logging for authentication processes.
