Mejora de seguridad

frontend-client/src/lib/stores/auth.ts

@@ -50,26 +50,26 @@ function createAuthStore() {
   return {
     subscribe,
 
-    // Initialize auth from localStorage
-    init: () => {
+    // Rehidrata sesión desde cookie HttpOnly (no toca localStorage)
+    init: async () => {
       if (typeof window !== 'undefined') {
-        const token = localStorage.getItem('auth_token');
-        const user = localStorage.getItem('auth_user');
-
-        if (token && user) {
-          try {
-            const parsedUser = JSON.parse(user);
+        try {
+          const response = await fetch('/api/v1/auth/me', {
+            credentials: 'include',
+            headers: { 'X-App': 'client' }
+          });
+          if (response.ok) {
+            const user = await response.json();
             set({
-              user: parsedUser,
-              token,
+              user,
+              token: null,
               isAuthenticated: true,
               isLoading: false
             });
-          } catch (error) {
-            console.error('Error parsing stored auth data:', error);
-            localStorage.removeItem('auth_token');
-            localStorage.removeItem('auth_user');
           }
+          // 401/400 es esperado cuando no hay sesión activa — no es un error
+        } catch (error) {
+          // Ignorar errores de red en init
         }
       }
     },
@@ -81,6 +81,7 @@ function createAuthStore() {
       try {
         const response = await fetch('/api/v1/auth/login', {
           method: 'POST',
+          credentials: 'include',
           headers: {
             'Content-Type': 'application/json',
           },
@@ -94,12 +95,6 @@ function createAuthStore() {
 
         const data: LoginResponse = await response.json();
 
-        // Store auth data
-        if (typeof window !== 'undefined') {
-          localStorage.setItem('auth_token', data.access_token);
-          localStorage.setItem('auth_user', JSON.stringify(data.user));
-        }
-
         set({
           user: data.user,
           token: data.access_token,
@@ -113,22 +108,24 @@ function createAuthStore() {
     },
 
     // Logout
-    logout: () => {
+    logout: async () => {
+      // Llamar al backend para que borre la cookie HttpOnly
+      try {
+        await fetch('/api/v1/auth/logout', {
+          method: 'POST',
+          credentials: 'include',
+          headers: { 'X-App': 'client' }
+        });
+      } catch { /* ignorar errores de red */ }
+      set(initialState);
       if (typeof window !== 'undefined') {
-        localStorage.removeItem('auth_token');
-        localStorage.removeItem('auth_user');
-        // Immediate redirect after cleanup
         window.location.href = '/login';
       }
-      set(initialState);
     },
 
     // Update user data
     updateUser: (user: User) => {
       update(state => ({ ...state, user }));
-      if (typeof window !== 'undefined') {
-        localStorage.setItem('auth_user', JSON.stringify(user));
-      }
     },
 
     // Set loading state