Permisos en progreso

frontend-client/src/lib/stores/auth.ts

@@ -1,5 +1,6 @@
 import type { Writable } from 'svelte/store';
 import { writable } from 'svelte/store';
+
 export interface User {
   id: string;
   email: string;
@@ -11,50 +12,68 @@ export interface User {
   is_two_factor_enabled: boolean;
   created_at: string;
 }
+
 export interface AuthState {
   user: User | null;
   token: string | null;
   isAuthenticated: boolean;
   isLoading: boolean;
 }
+
 export interface LoginRequest {
   email: string;
   password: string;
   tenant_slug: string;
   totp_code?: string;
 }
+
 export interface LoginResponse {
   access_token: string;
   token_type: string;
   expires_in: number;
   user: User;
 }
+
 const initialState: AuthState = {
   user: null,
   token: null,
   isAuthenticated: false,
   isLoading: false
 };
+
 function createAuthStore() {
   const { subscribe, set, update }: Writable<AuthState> = writable(initialState);
   let _state = initialState;
   subscribe(s => { _state = s; });
+
   return {
     subscribe,
+
+    // Verifica sesión activa al cargar la app (cookie HttpOnly)
     init: async () => {
-      if (typeof window !== 'undefined') {
-        try {
-          const response = await fetch('/api/v1/auth/me', {
-            credentials: 'include',
-            headers: { 'X-App': 'client', 'X-Tenant-Slug': 'aduanasoft' }
-          });
-          if (response.ok) {
-            const user = await response.json();
-            set({ user, token: null, isAuthenticated: true, isLoading: false });
+      if (typeof window === 'undefined') return;
+      try {
+        const response = await fetch('/api/v1/auth/me', {
+          credentials: 'include',
+          headers: {
+            'X-App': 'client',
+            // Sin X-Tenant-ID aquí — /auth/me lee el tenant del JWT directamente
           }
-        } catch (error) {}
+        });
+        if (response.ok) {
+          const user = await response.json();
+          // Token es null — la autenticación viaja por cookie HttpOnly
+          // El store solo necesita el user para la UI
+          set({ user, token: null, isAuthenticated: true, isLoading: false });
+        } else {
+          // Cookie expirada o inválida — limpiar estado
+          set(initialState);
+        }
+      } catch {
+        set(initialState);
       }
     },
+
     login: async (credentials: LoginRequest): Promise<void> => {
       update(state => ({ ...state, isLoading: true }));
       try {
@@ -72,12 +91,15 @@ function createAuthStore() {
           throw new Error(error.detail || 'Login failed');
         }
         const data: LoginResponse = await response.json();
+        // Guardamos el token en memoria para requests inmediatos
+        // Si la página se recarga, init() recupera la sesión desde la cookie
         set({ user: data.user, token: data.access_token, isAuthenticated: true, isLoading: false });
       } catch (error) {
         update(state => ({ ...state, isLoading: false }));
         throw error;
       }
     },
+
     logout: async () => {
       try {
         const token = _state.token;
@@ -86,7 +108,6 @@ function createAuthStore() {
           credentials: 'include',
           headers: {
             'X-App': 'client',
-            'X-Tenant-Slug': 'aduanasoft',
             ...(token ? { 'Authorization': `Bearer ${token}` } : {})
           }
         });
@@ -96,9 +117,11 @@ function createAuthStore() {
         window.location.href = '/login';
       }
     },
+
     updateUser: (user: User) => { update(state => ({ ...state, user })); },
     setUser: (user: User) => { set({ user, token: null, isAuthenticated: true, isLoading: false }); },
     setLoading: (isLoading: boolean) => { update(state => ({ ...state, isLoading })); }
   };
 }
+
 export const auth = createAuthStore();