Mejora de seguridad

frontend-client/src/lib/utils/api.ts

@@ -0,0 +1,126 @@
+/**
+ * Cliente HTTP centralizado para frontend-client.
+ * Usa cookies HttpOnly (client_access_token) como fuente primaria de auth,
+ * con Bearer token como complemento cuando está disponible en memoria.
+ */
+import { auth } from '$lib/stores/auth';
+import { get } from 'svelte/store';
+
+const API_BASE = '/api/v1';
+
+interface RequestOptions extends RequestInit {
+  params?: Record<string, string>;
+}
+
+async function request<T>(endpoint: string, options: RequestOptions = {}): Promise<T> {
+  const { params, ...init } = options;
+
+  let url = `${API_BASE}${endpoint}`;
+  if (params) {
+    const filteredParams = Object.entries(params)
+      .filter(([, value]) => value !== undefined && value !== null && value !== '')
+      .reduce((acc, [key, value]) => ({ ...acc, [key]: value }), {});
+
+    if (Object.keys(filteredParams).length > 0) {
+      url += `?${new URLSearchParams(filteredParams).toString()}`;
+    }
+  }
+
+  const authState = get(auth);
+  const headers = new Headers(init.headers);
+
+  // Bearer header cuando el token está en memoria (sesión activa sin reload)
+  if (authState.token) {
+    headers.set('Authorization', `Bearer ${authState.token}`);
+  }
+  if (authState.user?.tenant_id && !headers.has('X-Tenant-ID')) {
+    headers.set('X-Tenant-ID', authState.user.tenant_id);
+  }
+  if (!headers.has('Content-Type')) {
+    headers.set('Content-Type', 'application/json');
+  }
+  // Identifica este frontend para que el backend use client_access_token
+  headers.set('X-App', 'client');
+
+  const response = await fetch(url, {
+    ...init,
+    credentials: 'include',
+    headers
+  });
+
+  if (response.status === 401) {
+    if (typeof window !== 'undefined') {
+      window.location.href = '/login';
+    }
+    throw new Error('Unauthorized');
+  }
+
+  if (!response.ok) {
+    const errorData = await response.json().catch(() => ({}));
+    throw new Error(errorData.detail || `API error: ${response.statusText}`);
+  }
+
+  if (response.status === 204) {
+    return {} as T;
+  }
+
+  return response.json();
+}
+
+async function downloadFile(endpoint: string, filename: string): Promise<void> {
+  const authState = get(auth);
+  const headers = new Headers();
+
+  if (authState.token) {
+    headers.set('Authorization', `Bearer ${authState.token}`);
+  }
+  if (authState.user?.tenant_id) {
+    headers.set('X-Tenant-ID', authState.user.tenant_id);
+  }
+  headers.set('X-App', 'client');
+
+  const response = await fetch(`${API_BASE}${endpoint}`, {
+    method: 'GET',
+    credentials: 'include',
+    headers
+  });
+
+  if (response.status === 401) {
+    if (typeof window !== 'undefined') window.location.href = '/login';
+    throw new Error('Unauthorized');
+  }
+  if (!response.ok) {
+    const errorData = await response.json().catch(() => ({}));
+    throw new Error(errorData.detail || `Download error: ${response.statusText}`);
+  }
+
+  const blob = await response.blob();
+  const url = window.URL.createObjectURL(blob);
+  const a = document.createElement('a');
+  a.href = url;
+  a.download = filename;
+  document.body.appendChild(a);
+  a.click();
+  document.body.removeChild(a);
+  window.URL.revokeObjectURL(url);
+}
+
+export const api = {
+  get: <T>(endpoint: string, params?: Record<string, string>) =>
+    request<T>(endpoint, { method: 'GET', params }),
+
+  post: <T>(endpoint: string, body?: any) =>
+    request<T>(endpoint, { method: 'POST', body: body !== undefined ? JSON.stringify(body) : undefined }),
+
+  put: <T>(endpoint: string, body?: any) =>
+    request<T>(endpoint, { method: 'PUT', body: body !== undefined ? JSON.stringify(body) : undefined }),
+
+  patch: <T>(endpoint: string, body?: any) =>
+    request<T>(endpoint, { method: 'PATCH', body: body !== undefined ? JSON.stringify(body) : undefined }),
+
+  delete: <T>(endpoint: string) =>
+    request<T>(endpoint, { method: 'DELETE' }),
+
+  downloadFile: (endpoint: string, filename: string) =>
+    downloadFile(endpoint, filename)
+};