Mejora de seguridad

backend/app/api/deps.py

@@ -1,3 +1,4 @@
+from typing import Optional
 from fastapi import Depends, HTTPException, status
 from starlette.requests import Request
 from fastapi.security import OAuth2PasswordBearer
@@ -15,7 +16,48 @@ from app.models.tenant import Tenant
 settings = get_settings()
 
 # Esquema OAuth2 centralizado — auth.py importa desde aquí
-oauth2_scheme = OAuth2PasswordBearer(tokenUrl=f"/{settings.API_VERSION}/auth/login")
+# Soporta: 1) Authorization: Bearer header (Swagger/API clients)
+#           2) Cookie access_token HttpOnly (apps web)
+_bearer_scheme = OAuth2PasswordBearer(
+    tokenUrl=f"/{settings.API_VERSION}/auth/login",
+    auto_error=False,
+)
+
+
+async def oauth2_scheme(
+    request: Request,
+    bearer_token: Optional[str] = Depends(_bearer_scheme),
+) -> str:
+    """Extrae JWT desde header Authorization (prioridad) o cookie del frontend correcto.
+    
+    Usa el header X-App para seleccionar la cookie:
+      - X-App: internal  → solo 'internal_access_token'
+      - X-App: client    → solo 'client_access_token'
+      - sin header       → prueba ambas (compatibilidad con Swagger/CLI)
+    """
+    if bearer_token:
+        return bearer_token
+
+    app_hint = request.headers.get("X-App", "").lower()
+    if app_hint == "internal":
+        token = request.cookies.get("internal_access_token")
+    elif app_hint == "client":
+        token = request.cookies.get("client_access_token")
+    else:
+        # Fallback para Swagger, tests y clientes sin header
+        token = (
+            request.cookies.get("internal_access_token")
+            or request.cookies.get("client_access_token")
+        )
+
+    if not token:
+        raise HTTPException(
+            status_code=status.HTTP_401_UNAUTHORIZED,
+            detail="Not authenticated",
+            headers={"WWW-Authenticate": "Bearer"},
+        )
+    return token
+
 
 async def get_current_user(
     request: Request,