fix: ADMIN puede ver tickets de cualquier tenant, fixes seguridad tickets.py, logout interno

This commit is contained in:
2026-03-19 08:55:08 -06:00
parent b76fcb1390
commit 6687802f19
3 changed files with 301 additions and 212 deletions

View File

@@ -54,13 +54,13 @@ function createAuthStore() {
try {
const response = await fetch('/api/v1/auth/me', {
credentials: 'include',
headers: { 'X-App': 'client' }
headers: { 'X-App': 'internal' }
});
if (response.ok) {
const user = await response.json();
set({ user, token: null, isAuthenticated: true, isLoading: false });
}
} catch (error) {}
} catch (error) { }
}
},
login: async (credentials: LoginRequest): Promise<void> => {
@@ -94,12 +94,12 @@ function createAuthStore() {
method: 'POST',
credentials: 'include',
headers: {
'X-App': 'client',
'X-App': 'internal',
'X-Tenant-Slug': slug,
...(token ? { 'Authorization': `Bearer ${token}` } : {})
}
});
} catch {}
} catch { }
set(initialState);
if (typeof window !== 'undefined') {
window.location.href = '/login';

View File

@@ -1,35 +1,36 @@
import { sveltekit } from '@sveltejs/kit/vite';
import { defineConfig } from 'vite';
export default defineConfig({
plugins: [sveltekit()],
server: {
port: parseInt(process.env.PORT || '3001'),
host: '0.0.0.0',
watch: {
usePolling: true,
interval: 500
},
hmr: {
host: 'localhost',
clientPort: parseInt(process.env.HMR_CLIENT_PORT || '3001')
},
fs: {
allow: ['/app', '.'],
strict: false
},
proxy: {
'/api': {
target: process.env.PUBLIC_API_URL || 'http://backend:8000',
changeOrigin: true,
rewrite: (path) => path.replace(/^\/api/, '')
}
}
plugins: [sveltekit()],
server: {
port: parseInt(process.env.PORT || '3001'),
host: '0.0.0.0',
watch: {
usePolling: true,
interval: 500
},
preview: {
port: parseInt(process.env.PORT || '3001'),
host: '0.0.0.0'
hmr: {
host: 'localhost',
clientPort: parseInt(process.env.HMR_CLIENT_PORT || '3001')
},
build: {
target: 'esnext'
fs: {
allow: ['/app', '.'],
strict: false
},
proxy: {
'/api': {
target: process.env.PUBLIC_API_URL || 'http://backend:8000',
changeOrigin: true,
rewrite: (path) => path.replace(/^\/api/, '')
}
}
});
},
preview: {
port: parseInt(process.env.PORT || '3001'),
host: '0.0.0.0'
},
build: {
target: 'esnext'
}
});