fix: tenant dinamico desde BD - sin hardcodeo en frontend cliente

backend/app/api/v1/endpoints/auth.py

@@ -284,6 +284,7 @@ async def login(
             "last_name": user.last_name,
             "role": user.role,
             "tenant_id": str(user.tenant_id),
+            "tenant_slug": tenant.slug if tenant else str(user.tenant_id),
             "is_active": user.is_active,
             "is_two_factor_enabled": user.totp_enabled or False,
             "created_at": user.created_at.isoformat() if user.created_at else None

backend/app/api/v1/endpoints/users.py

@@ -148,10 +148,13 @@ async def read_user(
     
     ✅ Implementa multi-tenancy: solo permite acceso a usuarios del propio tenant.
     """
-    query = select(User).where(
+    if current_user.role.value == 'ADMIN':
-        User.id == user_id,
+        query = select(User).where(User.id == user_id)
-        User.tenant_id == current_user.tenant_id  # ✅ Seguridad multi-tenant
+    else:
-    )
+        query = select(User).where(
+            User.id == user_id,
+            User.tenant_id == current_user.tenant_id
+        )
     result = await db.execute(query)
     user = result.scalar_one_or_none()
     
@@ -187,11 +190,14 @@ async def update_user(
             detail="You don't have permission to update users"
         )
     
-    # Buscar usuario
+    # Buscar usuario - ADMIN global puede editar cualquier tenant
-    query = select(User).where(
+    if current_user.role.value == "ADMIN":
-        User.id == user_id,
+        query = select(User).where(User.id == user_id)
-        User.tenant_id == current_user.tenant_id
+    else:
-    )
+        query = select(User).where(
+            User.id == user_id,
+            User.tenant_id == current_user.tenant_id
+        )
     result = await db.execute(query)
     db_user = result.scalar_one_or_none()
     
@@ -294,11 +300,14 @@ async def delete_user(
             detail="You cannot delete yourself"
         )
     
-    # Buscar usuario
+    # Buscar usuario - ADMIN global puede editar cualquier tenant
-    query = select(User).where(
+    if current_user.role.value == "ADMIN":
-        User.id == user_id,
+        query = select(User).where(User.id == user_id)
-        User.tenant_id == current_user.tenant_id
+    else:
-    )
+        query = select(User).where(
+            User.id == user_id,
+            User.tenant_id == current_user.tenant_id
+        )
     result = await db.execute(query)
     db_user = result.scalar_one_or_none()
     
@@ -371,11 +380,14 @@ async def activate_user(
             detail="You don't have permission to activate users"
         )
     
-    # Buscar usuario
+    # Buscar usuario - ADMIN global puede editar cualquier tenant
-    query = select(User).where(
+    if current_user.role.value == "ADMIN":
-        User.id == user_id,
+        query = select(User).where(User.id == user_id)
-        User.tenant_id == current_user.tenant_id
+    else:
-    )
+        query = select(User).where(
+            User.id == user_id,
+            User.tenant_id == current_user.tenant_id
+        )
     result = await db.execute(query)
     db_user = result.scalar_one_or_none()
     

frontend-client/src/lib/utils/api.ts

@@ -2,8 +2,6 @@ import { auth } from '$lib/stores/auth';
 import { get } from 'svelte/store';
 
 const API_BASE = '/api/v1';
-const TENANT_SLUG = 'aduanasoft';
-
 interface RequestOptions extends RequestInit {
   params?: Record<string, string>;
 }
@@ -34,7 +32,8 @@ async function request<T>(endpoint: string, options: RequestOptions = {}): Promi
     headers.set('Content-Type', 'application/json');
   }
   headers.set('X-App', 'client');
-  headers.set('X-Tenant-Slug', TENANT_SLUG);
+  const slug = get(authStore)?.user?.tenant_slug || get(authStore)?.user?.tenant_id || '';
+  headers.set('X-Tenant-Slug', slug);
 
   const response = await fetch(url, {
     ...init,
@@ -72,7 +71,8 @@ async function downloadFile(endpoint: string, filename: string): Promise<void> {
     headers.set('X-Tenant-ID', authState.user.tenant_id);
   }
   headers.set('X-App', 'client');
-  headers.set('X-Tenant-Slug', TENANT_SLUG);
+  const slug = get(authStore)?.user?.tenant_slug || get(authStore)?.user?.tenant_id || '';
+  headers.set('X-Tenant-Slug', slug);
 
   const response = await fetch(`${API_BASE}${endpoint}`, {
     method: 'GET',