Sesiones correctas

frontend-client/src/lib/stores/auth.ts

@@ -1,7 +1,5 @@
 import type { Writable } from 'svelte/store';
 import { writable } from 'svelte/store';
-
-// Types
 export interface User {
   id: string;
   email: string;
@@ -13,131 +11,94 @@ export interface User {
   is_two_factor_enabled: boolean;
   created_at: string;
 }
-
 export interface AuthState {
   user: User | null;
   token: string | null;
   isAuthenticated: boolean;
   isLoading: boolean;
 }
-
 export interface LoginRequest {
   email: string;
   password: string;
   tenant_slug: string;
   totp_code?: string;
 }
-
 export interface LoginResponse {
   access_token: string;
   token_type: string;
   expires_in: number;
   user: User;
 }
-
-// Initial state
 const initialState: AuthState = {
   user: null,
   token: null,
   isAuthenticated: false,
   isLoading: false
 };
-
-// Create auth store
 function createAuthStore() {
   const { subscribe, set, update }: Writable<AuthState> = writable(initialState);
-
+  let _state = initialState;
+  subscribe(s => { _state = s; });
   return {
     subscribe,
-
-    // Rehidrata sesión desde cookie HttpOnly (no toca localStorage)
     init: async () => {
       if (typeof window !== 'undefined') {
         try {
           const response = await fetch('/api/v1/auth/me', {
             credentials: 'include',
-            headers: { 'X-App': 'client' }
+            headers: { 'X-App': 'client', 'X-Tenant-Slug': 'aduanasoft' }
           });
           if (response.ok) {
             const user = await response.json();
-            set({
-              user,
-              token: null,
-              isAuthenticated: true,
-              isLoading: false
-            });
+            set({ user, token: null, isAuthenticated: true, isLoading: false });
           }
-          // 401/400 es esperado cuando no hay sesión activa — no es un error
-        } catch (error) {
-          // Ignorar errores de red en init
-        }
+        } catch (error) {}
       }
     },
-
-    // Login
     login: async (credentials: LoginRequest): Promise<void> => {
       update(state => ({ ...state, isLoading: true }));
-
       try {
         const response = await fetch('/api/v1/auth/login', {
           method: 'POST',
           credentials: 'include',
           headers: {
             'Content-Type': 'application/json',
+            'X-Tenant-Slug': credentials.tenant_slug,
           },
           body: JSON.stringify(credentials)
         });
-
         if (!response.ok) {
           const error = await response.json();
           throw new Error(error.detail || 'Login failed');
         }
-
         const data: LoginResponse = await response.json();
-
-        set({
-          user: data.user,
-          token: data.access_token,
-          isAuthenticated: true,
-          isLoading: false
-        });
+        set({ user: data.user, token: data.access_token, isAuthenticated: true, isLoading: false });
       } catch (error) {
         update(state => ({ ...state, isLoading: false }));
         throw error;
       }
     },
-
-    // Logout
     logout: async () => {
-      // Llamar al backend para que borre la cookie HttpOnly
       try {
+        const token = _state.token;
         await fetch('/api/v1/auth/logout', {
           method: 'POST',
           credentials: 'include',
-          headers: { 'X-App': 'client' }
+          headers: {
+            'X-App': 'client',
+            'X-Tenant-Slug': 'aduanasoft',
+            ...(token ? { 'Authorization': `Bearer ${token}` } : {})
+          }
         });
-      } catch { /* ignorar errores de red */ }
+      } catch {}
       set(initialState);
       if (typeof window !== 'undefined') {
         window.location.href = '/login';
       }
     },
-
-    // Update user data
-    updateUser: (user: User) => {
-      update(state => ({ ...state, user }));
-    },
-
-    // Set user from SSR pre-load (no fetch required)
-    setUser: (user: User) => {
-      set({ user, token: null, isAuthenticated: true, isLoading: false });
-    },
-
-    // Set loading state
-    setLoading: (isLoading: boolean) => {
-      update(state => ({ ...state, isLoading }));
-    }
+    updateUser: (user: User) => { update(state => ({ ...state, user })); },
+    setUser: (user: User) => { set({ user, token: null, isAuthenticated: true, isLoading: false }); },
+    setLoading: (isLoading: boolean) => { update(state => ({ ...state, isLoading })); }
   };
 }
-
 export const auth = createAuthStore();

frontend-client/src/lib/utils/api.ts

@@ -1,12 +1,8 @@
-/**
- * Cliente HTTP centralizado para frontend-client.
- * Usa cookies HttpOnly (client_access_token) como fuente primaria de auth,
- * con Bearer token como complemento cuando está disponible en memoria.
- */
 import { auth } from '$lib/stores/auth';
 import { get } from 'svelte/store';
 
 const API_BASE = '/api/v1';
+const TENANT_SLUG = 'aduanasoft';
 
 interface RequestOptions extends RequestInit {
   params?: Record<string, string>;
@@ -20,7 +16,6 @@ async function request<T>(endpoint: string, options: RequestOptions = {}): Promi
     const filteredParams = Object.entries(params)
       .filter(([, value]) => value !== undefined && value !== null && value !== '')
       .reduce((acc, [key, value]) => ({ ...acc, [key]: value }), {});
-
     if (Object.keys(filteredParams).length > 0) {
       url += `?${new URLSearchParams(filteredParams).toString()}`;
     }
@@ -29,7 +24,6 @@ async function request<T>(endpoint: string, options: RequestOptions = {}): Promi
   const authState = get(auth);
   const headers = new Headers(init.headers);
 
-  // Bearer header cuando el token está en memoria (sesión activa sin reload)
   if (authState.token) {
     headers.set('Authorization', `Bearer ${authState.token}`);
   }
@@ -39,8 +33,8 @@ async function request<T>(endpoint: string, options: RequestOptions = {}): Promi
   if (!headers.has('Content-Type')) {
     headers.set('Content-Type', 'application/json');
   }
-  // Identifica este frontend para que el backend use client_access_token
   headers.set('X-App', 'client');
+  headers.set('X-Tenant-Slug', TENANT_SLUG);
 
   const response = await fetch(url, {
     ...init,
@@ -78,6 +72,7 @@ async function downloadFile(endpoint: string, filename: string): Promise<void> {
     headers.set('X-Tenant-ID', authState.user.tenant_id);
   }
   headers.set('X-App', 'client');
+  headers.set('X-Tenant-Slug', TENANT_SLUG);
 
   const response = await fetch(`${API_BASE}${endpoint}`, {
     method: 'GET',
@@ -108,19 +103,14 @@ async function downloadFile(endpoint: string, filename: string): Promise<void> {
 export const api = {
   get: <T>(endpoint: string, params?: Record<string, string>) =>
     request<T>(endpoint, { method: 'GET', params }),
-
   post: <T>(endpoint: string, body?: any) =>
     request<T>(endpoint, { method: 'POST', body: body !== undefined ? JSON.stringify(body) : undefined }),
-
   put: <T>(endpoint: string, body?: any) =>
     request<T>(endpoint, { method: 'PUT', body: body !== undefined ? JSON.stringify(body) : undefined }),
-
   patch: <T>(endpoint: string, body?: any) =>
     request<T>(endpoint, { method: 'PATCH', body: body !== undefined ? JSON.stringify(body) : undefined }),
-
   delete: <T>(endpoint: string) =>
     request<T>(endpoint, { method: 'DELETE' }),
-
   downloadFile: (endpoint: string, filename: string) =>
     downloadFile(endpoint, filename)
-};
+};