v1.15.1 - modulo de reportes implementado

- Nuevo módulo de reportes: backend/app/api/v1/endpoints/reports.py
- Schemas de reportes: backend/app/api/schemas/reports.py
- Frontend: frontend-internal/src/routes/reports/
- Mejoras al módulo de auditoría (audit.py, audit_helpers.py)
- Modelo de auditoría actualizado
- Sidebar actualizado con enlace a reportes

backend/README.md

@@ -56,6 +56,22 @@ backend/
 - [x] TOTP 2FA implementation
 - [x] Validation con Pydantic v2
 
+### Rate limiting (login)
+
+El endpoint `/{API_VERSION}/auth/login` incluye rate limiting (best-effort) usando Redis:
+
+- Por IP: limita intentos totales por ventana
+- Por identidad: limita por `(tenant_id, email)` por ventana
+
+Responde `429 Too Many Requests` con header `Retry-After`.
+
+Variables de entorno (ver `app/core/config.py`):
+
+- `RATE_LIMIT_ENABLED` (default: `true`)
+- `LOGIN_RATE_LIMIT_WINDOW_SECONDS` (default: `300`)
+- `LOGIN_RATE_LIMIT_IP_MAX_ATTEMPTS` (default: `30`)
+- `LOGIN_RATE_LIMIT_ID_MAX_ATTEMPTS` (default: `10`)
+
 ## Quick Start
 
 ```bash
@@ -157,8 +173,8 @@ Ver `.env.example` para todas las variables disponibles.
 - [x] CORS restrictivo
 - [x] Input validation con Pydantic
 - [x] SQL injection protection (SQLAlchemy)
-- [x] Rate limiting (TODO: implementar)
-- [x] File upload validation (TODO: implementar)
+- [x] Rate limiting (login)
+- [x] File upload validation (extensión + firma básica + tamaño + streaming)
 - [x] XSS protection (headers en nginx)
 
 ## Próximos pasos

backend/app/api/deps.py

@@ -1,4 +1,5 @@
 from fastapi import Depends, HTTPException, status
+from starlette.requests import Request
 from fastapi.security import OAuth2PasswordBearer
 from jose import jwt, JWTError
 from sqlalchemy.ext.asyncio import AsyncSession
@@ -17,6 +18,7 @@ settings = get_settings()
 oauth2_scheme = OAuth2PasswordBearer(tokenUrl=f"/{settings.API_VERSION}/auth/login")
 
 async def get_current_user(
+    request: Request,
     token: str = Depends(oauth2_scheme),
     db: AsyncSession = Depends(get_db)
 ) -> User:
@@ -43,6 +45,15 @@ async def get_current_user(
         
     if not user.is_active:
         raise HTTPException(status_code=400, detail="Inactive user")
+
+    # Enforce that tenant header (if present) matches the authenticated user's tenant.
+    # Prevents cross-tenant header impersonation.
+    request_tenant_id = getattr(getattr(request, "state", None), "tenant_id", None)
+    if request_tenant_id and str(user.tenant_id) != str(request_tenant_id):
+        raise HTTPException(
+            status_code=status.HTTP_403_FORBIDDEN,
+            detail="Tenant header does not match authenticated user",
+        )
         
     return user
 

backend/app/api/schemas/reports.py

@@ -0,0 +1,227 @@
+"""
+Reports Schemas - ServiceManagerWeb
+
+Schemas de respuesta para el módulo de reportes y estadísticas.
+"""
+
+from pydantic import BaseModel, ConfigDict
+from typing import Optional, List, Dict, Any
+from datetime import datetime
+
+
+# ===================================
+# RESUMEN GENERAL
+# ===================================
+
+class TicketsByStatus(BaseModel):
+    """Conteo de tickets agrupado por estado"""
+    new: int = 0
+    triage: int = 0
+    in_progress: int = 0
+    waiting_customer: int = 0
+    resolved: int = 0
+    closed: int = 0
+    reopened: int = 0
+    total: int = 0
+
+
+class TicketsByPriority(BaseModel):
+    """Conteo de tickets agrupado por prioridad"""
+    low: int = 0
+    medium: int = 0
+    high: int = 0
+    urgent: int = 0
+    total: int = 0
+
+
+class ReportSummaryResponse(BaseModel):
+    """Resumen ejecutivo del período seleccionado"""
+    period_start: datetime
+    period_end: datetime
+    generated_at: datetime
+
+    # Totales del período
+    total_tickets: int
+    open_tickets: int         # Tickets sin resolver
+    resolved_tickets: int     # Tickets resueltos o cerrados
+    avg_resolution_hours: Optional[float]   # Promedio de horas para resolver
+    avg_first_response_hours: Optional[float]  # Promedio de horas para primera respuesta
+
+    # Satisfacción del cliente
+    avg_rating: Optional[float]   # Promedio de calificación (1-5)
+    total_rated: int              # Cuántos tickets tienen calificación
+
+    # Desglose por estado y prioridad
+    by_status: TicketsByStatus
+    by_priority: TicketsByPriority
+
+    # Comparación vs período anterior
+    tickets_change_pct: Optional[float]    # % cambio vs período anterior
+    resolution_change_pct: Optional[float] # % cambio en tasa de resolución
+
+    model_config = ConfigDict(from_attributes=True)
+
+
+# ===================================
+# RENDIMIENTO POR AGENTE
+# ===================================
+
+class AgentReportRow(BaseModel):
+    """Estadísticas de un agente específico"""
+    agent_id: str
+    agent_name: str
+    agent_email: str
+    total_assigned: int       # Total asignados en el período
+    resolved: int             # Cuántos resolvió
+    open: int                 # Cuántos siguen abiertos
+    resolution_rate: float    # Porcentaje de resolución (0-100)
+    avg_resolution_hours: Optional[float]  # Promedio de horas para resolver
+    avg_rating: Optional[float]            # Calificación promedio (1-5)
+    total_rated: int                       # Cuántos tickets calificaron al agente
+    urgent_handled: int                    # Urgentes atendidos
+
+
+class AgentReportResponse(BaseModel):
+    """Reporte de rendimiento por agente"""
+    period_start: datetime
+    period_end: datetime
+    generated_at: datetime
+    agents: List[AgentReportRow]
+    total_agents: int
+
+    model_config = ConfigDict(from_attributes=True)
+
+
+# ===================================
+# TICKETS POR CATEGORÍA
+# ===================================
+
+class CategoryReportRow(BaseModel):
+    """Estadísticas de una categoría"""
+    category_id: str
+    category_name: str
+    total_tickets: int
+    open_tickets: int
+    resolved_tickets: int
+    avg_resolution_hours: Optional[float]
+    sla_response_hours: int     # SLA configurado para respuesta
+    sla_resolution_hours: int   # SLA configurado para resolución
+    sla_compliance_pct: float   # % de tickets que cumplieron SLA de resolución
+
+
+class CategoryReportResponse(BaseModel):
+    """Reporte de tickets agrupado por categoría"""
+    period_start: datetime
+    period_end: datetime
+    generated_at: datetime
+    categories: List[CategoryReportRow]
+    uncategorized_count: int
+
+    model_config = ConfigDict(from_attributes=True)
+
+
+# ===================================
+# TICKETS POR CLIENTE (TENANT)
+# ===================================
+
+class ClientReportRow(BaseModel):
+    """Estadísticas de un cliente (tenant)"""
+    tenant_id: str
+    tenant_name: str
+    total_tickets: int
+    open_tickets: int
+    resolved_tickets: int
+    urgent_tickets: int
+    avg_resolution_hours: Optional[float]
+    avg_rating: Optional[float]
+    last_ticket_at: Optional[datetime]
+
+
+class ClientReportResponse(BaseModel):
+    """Reporte de tickets agrupado por cliente — solo ADMIN"""
+    period_start: datetime
+    period_end: datetime
+    generated_at: datetime
+    clients: List[ClientReportRow]
+    total_clients: int
+
+    model_config = ConfigDict(from_attributes=True)
+
+
+# ===================================
+# TENDENCIAS (TICKETS EN EL TIEMPO)
+# ===================================
+
+class TrendDataPoint(BaseModel):
+    """Un punto de datos en la línea de tendencia"""
+    date: str          # Formato YYYY-MM-DD
+    created: int       # Tickets creados ese día
+    resolved: int      # Tickets resueltos ese día
+    net_open: int      # Diferencia: creados - resueltos
+
+
+class TrendsReportResponse(BaseModel):
+    """Evolución de tickets día a día"""
+    period_start: datetime
+    period_end: datetime
+    generated_at: datetime
+    data_points: List[TrendDataPoint]
+    total_days: int
+
+    model_config = ConfigDict(from_attributes=True)
+
+
+# ===================================
+# SATISFACCIÓN DEL CLIENTE (CSAT)
+# ===================================
+
+class CSATDistribution(BaseModel):
+    """Distribución de calificaciones 1-5"""
+    rating_1: int = 0
+    rating_2: int = 0
+    rating_3: int = 0
+    rating_4: int = 0
+    rating_5: int = 0
+
+
+class CSATReportResponse(BaseModel):
+    """Reporte de satisfacción del cliente"""
+    period_start: datetime
+    period_end: datetime
+    generated_at: datetime
+    avg_rating: Optional[float]
+    total_rated: int
+    total_tickets: int
+    response_rate: float        # % de tickets que recibieron calificación
+    distribution: CSATDistribution
+    by_category: List[Dict[str, Any]]   # Promedio por categoría
+    by_agent: List[Dict[str, Any]]      # Promedio por agente
+    recent_comments: List[Dict[str, Any]] = []  # Últimos comentarios de calificación
+
+    model_config = ConfigDict(from_attributes=True)
+
+
+# ===================================
+# TICKETS POR SISTEMA AFECTADO
+# ===================================
+
+class SystemReportRow(BaseModel):
+    """Estadísticas de un sistema afectado"""
+    system_id: str
+    system_name: str
+    total_tickets: int
+    open_tickets: int
+    resolved_tickets: int
+    urgent_tickets: int
+    avg_resolution_hours: Optional[float]
+
+
+class SystemReportResponse(BaseModel):
+    """Reporte de tickets agrupado por sistema afectado"""
+    period_start: datetime
+    period_end: datetime
+    generated_at: datetime
+    systems: List[SystemReportRow]
+    no_system_count: int   # Tickets sin sistema asignado
+
+    model_config = ConfigDict(from_attributes=True)

backend/app/api/schemas/ticket.py

@@ -4,8 +4,8 @@ Ticket Schemas - ServiceManagerWeb
 Pydantic schemas para gestión de tickets y comentarios.
 """
 
-from pydantic import BaseModel, ConfigDict
-from typing import Optional
+from pydantic import BaseModel, ConfigDict, model_validator
+from typing import Optional, Literal
 from datetime import datetime
 
 
@@ -15,7 +15,23 @@ class TicketCreate(BaseModel):
     description: str
     category_id: Optional[str] = None
     affected_system_id: Optional[str] = None
-    priority: str = "MEDIUM"
+    priority: Literal["LOW", "MEDIUM", "HIGH", "URGENT"] = "MEDIUM"
+    contact_email: Optional[str] = None
+    contact_phone: Optional[str] = None
+
+    @model_validator(mode="before")
+    @classmethod
+    def _accept_legacy_fields(cls, data):
+        if not isinstance(data, dict):
+            return data
+
+        if "subject" not in data and "title" in data:
+            data["subject"] = data["title"]
+
+        if "affected_system_id" not in data and "system_id" in data:
+            data["affected_system_id"] = data["system_id"]
+
+        return data
 
 
 class TicketUpdate(BaseModel):
@@ -39,9 +55,15 @@ class TicketResponse(BaseModel):
     status: str
     priority: str
     category_id: Optional[str] = None
+    category_name: Optional[str] = None
     affected_system_id: Optional[str] = None
+    system_id: Optional[str] = None
+    affected_system_name: Optional[str] = None
+    contact_email: Optional[str] = None
+    contact_phone: Optional[str] = None
     created_by: str
     assigned_to: Optional[str] = None
+    assigned_to_name: Optional[str] = None
     created_at: datetime
     updated_at: datetime
     sla_response_due: Optional[datetime] = None

backend/app/api/v1/audit_helpers.py

@@ -1,8 +1,34 @@
-"""Helper functions for audit endpoints"""
+"""
+Audit Helpers - ServiceManagerWeb
+===================================
+Funciones auxiliares reutilizables para los endpoints de auditoría.
+
+Este archivo contiene:
+  - audit_log_to_dict:           Convierte un modelo AuditLog a diccionario
+  - apply_tenant_filter:         Aplica filtro de tenant según permisos
+  - get_count_stat:              Cuenta registros con filtros opcionales (CORREGIDO)
+  - get_top_items:               Obtiene los items más frecuentes
+  - detect_mass_deletions:       Detecta eliminaciones masivas sospechosas
+  - detect_brute_force:          Detecta ataques de fuerza bruta
+  - detect_privilege_escalation: Detecta escaladas de privilegios
+
+CORRECCIÓN APLICADA en get_count_stat:
+  La columna created_at en PostgreSQL es 'timestamp with time zone' (TIMESTAMPTZ),
+  lo que significa que almacena y devuelve fechas CON información de timezone (+00).
+
+  El bug era que se comparaba un datetime naive (sin timezone) contra una columna
+  TIMESTAMPTZ. PostgreSQL no puede comparar ambos tipos directamente, por lo que
+  el filtro se ignoraba silenciosamente y los tres contadores devolvían el mismo
+  valor (el total histórico completo sin ningún filtro de fecha).
+
+  La solución es garantizar que TODAS las fechas que se usen en queries tengan
+  timezone info (aware datetime en UTC) usando _ensure_aware_utc().
+"""
+
 from sqlalchemy import select, func, and_, or_, desc
 from sqlalchemy.ext.asyncio import AsyncSession
 from typing import Optional, Dict, List
-from datetime import datetime
+from datetime import datetime, timezone
 import uuid
 
 from app.models.audit import AuditLog
@@ -10,8 +36,18 @@ from app.models.user import User, UserRole
 from app.models.tenant import Tenant
 
 
+# =============================================================================
+# CONVERSIÓN DE MODELOS
+# =============================================================================
+
 def audit_log_to_dict(log: AuditLog) -> dict:
-    """Convierte AuditLog a diccionario de respuesta"""
+    """
+    Convierte un objeto AuditLog de SQLAlchemy a un diccionario plano
+    compatible con los schemas de respuesta de Pydantic.
+
+    Incluye los datos del usuario relacionado si están cargados
+    (requiere que la query use selectinload(AuditLog.user)).
+    """
     log_dict = {
         "id": log.id,
         "tenant_id": log.tenant_id,
@@ -19,203 +55,463 @@ def audit_log_to_dict(log: AuditLog) -> dict:
         "action": log.action,
         "resource_type": log.resource_type,
         "resource_id": log.resource_id,
+        # ip_address puede ser un objeto especial de PostgreSQL, convertir a string
         "ip_address": str(log.ip_address) if log.ip_address else None,
         "user_agent": log.user_agent,
         "correlation_id": log.correlation_id,
         "old_values": log.old_values,
         "new_values": log.new_values,
+        # extra_metadata evita conflicto con la palabra reservada 'metadata'
         "metadata": log.extra_metadata,
         "created_at": log.created_at,
         "action_display": log.action_display,
+        # Campos del usuario (se llenan abajo si la relación está cargada)
         "user_email": None,
-        "user_name": None
+        "user_name": None,
+        "user_role": None,
     }
-    
+
+    # Solo agregar datos del usuario si la relación fue cargada en la query
     if log.user:
         log_dict["user_email"] = log.user.email
         log_dict["user_name"] = log.user.full_name
-        log_dict["user_role"] = log.user.role.value if hasattr(log.user.role, 'value') else str(log.user.role)
-    
+        # El rol puede ser un Enum de Python o un string, manejar ambos casos
+        log_dict["user_role"] = (
+            log.user.role.value
+            if hasattr(log.user.role, 'value')
+            else str(log.user.role)
+        )
+
     return log_dict
 
 
-def apply_tenant_filter(query, current_user: User, current_tenant: Tenant, all_tenants: bool = False, specific_tenant_id: Optional[uuid.UUID] = None):
-    """Aplica filtro de tenant según permisos del usuario"""
+# =============================================================================
+# FILTRO DE MULTI-TENANCY
+# =============================================================================
+
+def apply_tenant_filter(
+    query,
+    current_user: User,
+    current_tenant: Tenant,
+    all_tenants: bool = False,
+    specific_tenant_id: Optional[uuid.UUID] = None
+):
+    """
+    Aplica el filtro de tenant a una query de SQLAlchemy según los
+    permisos del usuario actual.
+
+    Reglas:
+    - ADMIN y SUPPORT_MANAGER pueden ver todos los tenants si
+      all_tenants=True, o filtrar por un tenant específico.
+    - Cualquier otro rol solo puede ver los datos de su propio tenant.
+    """
     can_see_all_tenants = current_user.role in [UserRole.ADMIN, UserRole.SUPPORT_MANAGER]
-    
+
     if all_tenants and can_see_all_tenants:
-        return query  # No filtrar por tenant
+        # Usuario privilegiado pidiendo ver todos los tenants → sin filtro
+        return query
     elif specific_tenant_id and can_see_all_tenants:
+        # Usuario privilegiado pidiendo un tenant específico
         return query.where(AuditLog.tenant_id == specific_tenant_id)
     else:
+        # Cualquier otro caso → solo ver el propio tenant
         return query.where(AuditLog.tenant_id == current_tenant.id)
 
 
-async def get_count_stat(db: AsyncSession, tenant_id: Optional[uuid.UUID] = None, 
-                        date_from: Optional[datetime] = None, action_filter=None) -> int:
-    """Obtiene estadística de conteo con filtros opcionales"""
+# =============================================================================
+# UTILIDAD DE FECHAS
+# =============================================================================
+
+def _ensure_aware_utc(dt: datetime) -> datetime:
+    """
+    Garantiza que un datetime tenga información de timezone en UTC.
+
+    PROBLEMA QUE RESUELVE:
+    La columna created_at en PostgreSQL es 'timestamp with time zone'
+    (TIMESTAMPTZ). Cuando se compara con un datetime naive (sin timezone),
+    PostgreSQL no puede hacer la comparación correctamente y el filtro
+    de fecha se ignora silenciosamente, devolviendo todos los registros
+    sin importar la fecha.
+
+    SOLUCIÓN:
+    Siempre convertir las fechas a aware UTC antes de usarlas en queries.
+
+    Casos que maneja:
+    - datetime naive (sin tzinfo):  agrega UTC como timezone
+    - datetime aware (con tzinfo):  convierte a UTC si es otra zona horaria
+
+    Ejemplos:
+        datetime(2026, 2, 24, 15, 0, 0)              → datetime(2026, 2, 24, 15, 0, 0, tzinfo=UTC)
+        datetime(2026, 2, 24, 9, 0, 0, tzinfo=CST)   → datetime(2026, 2, 24, 15, 0, 0, tzinfo=UTC)
+    """
+    if dt.tzinfo is None:
+        # Datetime naive → asumir que ya es UTC y agregarle timezone info
+        return dt.replace(tzinfo=timezone.utc)
+    else:
+        # Datetime aware → convertir a UTC (por si viene en otra zona horaria)
+        return dt.astimezone(timezone.utc)
+
+
+# =============================================================================
+# CONTADORES DE ESTADÍSTICAS
+# =============================================================================
+
+async def get_count_stat(
+    db: AsyncSession,
+    tenant_id: Optional[uuid.UUID] = None,
+    date_from: Optional[datetime] = None,
+    action_filter=None
+) -> int:
+    """
+    Cuenta registros de AuditLog con filtros opcionales.
+
+    Usado por get_audit_stats() para calcular:
+    - total_actions:      Sin date_from → cuenta todos los registros
+    - actions_today:      date_from = now - 24h → registros del día
+    - actions_this_week:  date_from = now - 7d  → registros de la semana
+
+    CORRECCIÓN: Las fechas se convierten a aware UTC con _ensure_aware_utc()
+    antes de usarlas en la query, para que sean compatibles con la columna
+    TIMESTAMPTZ de PostgreSQL y el filtro se aplique correctamente.
+
+    Args:
+        db:            Sesión de base de datos
+        tenant_id:     Si se especifica, filtra por ese tenant
+        date_from:     Si se especifica, solo cuenta registros desde esa fecha
+        action_filter: Condición SQLAlchemy adicional opcional
+
+    Returns:
+        Número entero de registros que cumplen los filtros
+    """
     query = select(func.count()).select_from(AuditLog)
-    
+
     if tenant_id:
         query = query.where(AuditLog.tenant_id == tenant_id)
+
     if date_from:
-        query = query.where(AuditLog.created_at >= date_from)
+        # CORRECCIÓN: convertir a aware UTC para compatibilidad con TIMESTAMPTZ
+        # Sin esto, el filtro se ignora y los tres contadores son idénticos
+        date_from_aware = _ensure_aware_utc(date_from)
+        query = query.where(AuditLog.created_at >= date_from_aware)
+
     if action_filter is not None:
         query = query.where(action_filter)
-    
+
     result = await db.execute(query)
     return result.scalar() or 0
 
 
-async def get_top_items(db: AsyncSession, field, tenant_id: Optional[uuid.UUID] = None, 
-                       limit: int = 5, join_user: bool = False) -> Dict[str, int]:
-    """Obtiene top items por campo con conteo"""
+# =============================================================================
+# ITEMS MÁS FRECUENTES
+# =============================================================================
+
+async def get_top_items(
+    db: AsyncSession,
+    field,
+    tenant_id: Optional[uuid.UUID] = None,
+    limit: int = 5,
+    join_user: bool = False
+) -> Dict[str, int]:
+    """
+    Obtiene los valores más frecuentes de un campo, ordenados por conteo.
+
+    Ejemplos de uso:
+    - get_top_items(db, AuditLog.action, ...)        → {"ticket.create": 45}
+    - get_top_items(db, AuditLog.resource_type, ...) → {"ticket": 60}
+    - get_top_items(db, None, ..., join_user=True)   → {"admin@empresa.com": 40}
+
+    Args:
+        db:         Sesión de base de datos
+        field:      Campo de AuditLog por el que agrupar
+        tenant_id:  Si se especifica, filtra por ese tenant
+        limit:      Máximo de resultados a devolver (por defecto 5)
+        join_user:  Si True, agrupa por email de usuario
+
+    Returns:
+        Diccionario {valor: conteo} ordenado de mayor a menor
+    """
     if join_user:
-        query = select(User.email, func.count(AuditLog.id).label('count')).join(User, AuditLog.user_id == User.id)
+        # Modo usuarios: hacer JOIN con tabla User y agrupar por email
+        query = (
+            select(User.email, func.count(AuditLog.id).label('count'))
+            .join(User, AuditLog.user_id == User.id)
+        )
     else:
+        # Modo campo: agrupar por el campo especificado
         query = select(field, func.count(AuditLog.id).label('count'))
-    
+
     if tenant_id:
         query = query.where(AuditLog.tenant_id == tenant_id)
-    
-    if not join_user:
-        query = query.group_by(field)
-    else:
+
+    if join_user:
         query = query.group_by(User.email)
-    
+    else:
+        query = query.group_by(field)
+
     query = query.order_by(desc('count')).limit(limit)
-    
+
     result = await db.execute(query)
     return {row[0]: row[1] for row in result}
 
 
+# =============================================================================
+# DETECTORES DE INCIDENTES DE SEGURIDAD
+# =============================================================================
+
 def detect_mass_deletions(logs: List[AuditLog], now: datetime) -> List[dict]:
-    """Detecta eliminaciones masivas de logs de auditoría"""
+    """
+    Detecta patrones de eliminación masiva agrupando por usuario y día.
+
+    Lógica:
+    - Agrupa todos los logs de eliminación por (usuario, día)
+    - Si un usuario eliminó >= 3 recursos en un día, genera un incidente
+    - La severidad escala según la cantidad:
+        - >= 3  eliminaciones → medium
+        - >= 5  eliminaciones → high
+        - >= 10 eliminaciones → critical
+
+    El estado del incidente es:
+    - "active":   si la última eliminación fue hace menos de 24 horas
+    - "resolved": si fue hace más de 24 horas
+    """
+    # Agrupar eliminaciones por usuario y día
     deletion_groups = {}
-    
+
     for log in logs:
         if not log.user:
             continue
-        
+
         key = f"{log.user.email}_{log.created_at.date()}"
+
         if key not in deletion_groups:
             deletion_groups[key] = {
-                'user': log.user.email, 'date': log.created_at.date(),
-                'count': 0, 'logs': [], 'first_seen': log.created_at, 'last_seen': log.created_at
+                'user': log.user.email,
+                'date': log.created_at.date(),
+                'count': 0,
+                'logs': [],
+                'first_seen': log.created_at,
+                'last_seen': log.created_at
             }
-        
+
         deletion_groups[key]['count'] += 1
         deletion_groups[key]['logs'].append(log)
         deletion_groups[key]['first_seen'] = min(deletion_groups[key]['first_seen'], log.created_at)
         deletion_groups[key]['last_seen'] = max(deletion_groups[key]['last_seen'], log.created_at)
-    
+
     incidents = []
+
     for key, group in deletion_groups.items():
-        if group['count'] >= 3:
-            severity = "critical" if group['count'] >= 10 else "high" if group['count'] >= 5 else "medium"
-            status = "active" if (now - group['last_seen']).days <= 1 else "resolved"
-            
-            incidents.append({
-                "id": f"mass_del_{key.replace('_', '-')}",
-                "title": f"Eliminaciones masivas - {group['user']}",
-                "description": f"{group['user']} eliminó {group['count']} elementos el {group['date']}",
-                "severity": severity,
-                "status": status,
-                "incident_type": "mass_deletion",
-                "affected_user": group['user'],
-                "source_ip": str(group['logs'][0].ip_address) if group['logs'][0].ip_address else None,
-                "evidence": [f"{log.action} - {log.resource_type} - {log.created_at.strftime('%H:%M:%S')}" for log in group['logs'][:5]],
-                "metadata": {
-                    "total_deletions": group['count'],
-                    "resource_types": list(set(log.resource_type for log in group['logs'])),
-                    "time_span_minutes": int((group['last_seen'] - group['first_seen']).total_seconds() / 60)
-                },
-                "created_at": group['first_seen'],
-                "updated_at": group['last_seen']
-            })
-    
+        if group['count'] < 3:
+            continue
+
+        if group['count'] >= 10:
+            severity = "critical"
+        elif group['count'] >= 5:
+            severity = "high"
+        else:
+            severity = "medium"
+
+        # Convertir ambas fechas a aware UTC para comparación segura
+        now_aware = _ensure_aware_utc(now)
+        last_seen_aware = _ensure_aware_utc(group['last_seen'])
+        hours_since_last = (now_aware - last_seen_aware).total_seconds() / 3600
+        incident_status = "active" if hours_since_last <= 24 else "resolved"
+
+        incidents.append({
+            "id": f"mass_del_{key.replace('_', '-')}",
+            "title": f"Eliminaciones masivas - {group['user']}",
+            "description": (
+                f"{group['user']} elimino {group['count']} elementos "
+                f"el {group['date']}"
+            ),
+            "severity": severity,
+            "status": incident_status,
+            "incident_type": "mass_deletion",
+            "affected_user": group['user'],
+            "source_ip": (
+                str(group['logs'][0].ip_address)
+                if group['logs'][0].ip_address
+                else None
+            ),
+            "evidence": [
+                f"{log.action} - {log.resource_type} - {log.created_at.strftime('%H:%M:%S')}"
+                for log in group['logs'][:5]
+            ],
+            "metadata": {
+                "total_deletions": group['count'],
+                "resource_types": list(set(log.resource_type for log in group['logs'])),
+                "time_span_minutes": int(
+                    (group['last_seen'] - group['first_seen']).total_seconds() / 60
+                )
+            },
+            "created_at": group['first_seen'],
+            "updated_at": group['last_seen']
+        })
+
     return incidents
 
 
 def detect_brute_force(logs: List[AuditLog], now: datetime) -> List[dict]:
-    """Detecta ataques de fuerza bruta de logs de login fallido"""
+    """
+    Detecta ataques de fuerza bruta agrupando intentos fallidos por IP.
+
+    Lógica:
+    - Agrupa todos los intentos fallidos de login por dirección IP
+    - Si una IP tiene >= 5 intentos, genera un incidente
+    - La severidad escala según la cantidad:
+        - >= 5  intentos → medium
+        - >= 10 intentos → high
+        - >= 20 intentos → critical
+
+    El estado del incidente es:
+    - "active":        si el último intento fue hace menos de 24 horas
+    - "investigating": si fue hace más de 24 horas
+    """
     ip_groups = {}
-    
+
     for log in logs:
         if not log.ip_address:
             continue
-        
+
         ip = str(log.ip_address)
+
         if ip not in ip_groups:
-            ip_groups[ip] = {'count': 0, 'logs': [], 'first_seen': log.created_at, 'last_seen': log.created_at, 'users': set()}
-        
+            ip_groups[ip] = {
+                'count': 0,
+                'logs': [],
+                'first_seen': log.created_at,
+                'last_seen': log.created_at,
+                'users': set()
+            }
+
         ip_groups[ip]['count'] += 1
         ip_groups[ip]['logs'].append(log)
         ip_groups[ip]['first_seen'] = min(ip_groups[ip]['first_seen'], log.created_at)
         ip_groups[ip]['last_seen'] = max(ip_groups[ip]['last_seen'], log.created_at)
+
         if log.user and log.user.email:
             ip_groups[ip]['users'].add(log.user.email)
-    
+
     incidents = []
+
     for ip, group in ip_groups.items():
-        if group['count'] >= 5:
-            severity = "critical" if group['count'] >= 20 else "high" if group['count'] >= 10 else "medium"
-            status = "active" if (now - group['last_seen']).total_seconds() <= 86400 else "investigating"
-            
-            incidents.append({
-                "id": f"brute_force_{ip.replace('.', '-')}",
-                "title": f"Posible ataque de fuerza bruta desde {ip}",
-                "description": f"Se detectaron {group['count']} intentos fallidos de login desde la IP {ip}",
-                "severity": severity,
-                "status": status,
-                "incident_type": "brute_force_attack",
-                "affected_user": ', '.join(list(group['users'])[:3]) if group['users'] else None,
-                "source_ip": ip,
-                "evidence": [f"Login fallido - {log.user.email if log.user else 'Unknown'} - {log.created_at.strftime('%H:%M:%S')}" for log in group['logs'][:5]],
-                "metadata": {
-                    "total_attempts": group['count'],
-                    "targeted_users": list(group['users']),
-                    "time_span_hours": int((group['last_seen'] - group['first_seen']).total_seconds() / 3600)
-                },
-                "created_at": group['first_seen'],
-                "updated_at": group['last_seen']
-            })
-    
+        if group['count'] < 5:
+            continue
+
+        if group['count'] >= 20:
+            severity = "critical"
+        elif group['count'] >= 10:
+            severity = "high"
+        else:
+            severity = "medium"
+
+        # Convertir ambas fechas a aware UTC para comparación segura
+        now_aware = _ensure_aware_utc(now)
+        last_seen_aware = _ensure_aware_utc(group['last_seen'])
+        seconds_since_last = (now_aware - last_seen_aware).total_seconds()
+        incident_status = "active" if seconds_since_last <= 86400 else "investigating"
+
+        incidents.append({
+            "id": f"brute_force_{ip.replace('.', '-')}",
+            "title": f"Posible ataque de fuerza bruta desde {ip}",
+            "description": (
+                f"Se detectaron {group['count']} intentos fallidos de "
+                f"login desde la IP {ip}"
+            ),
+            "severity": severity,
+            "status": incident_status,
+            "incident_type": "brute_force_attack",
+            "affected_user": (
+                ', '.join(list(group['users'])[:3])
+                if group['users']
+                else None
+            ),
+            "source_ip": ip,
+            "evidence": [
+                f"Login fallido - "
+                f"{log.user.email if log.user else 'Desconocido'} - "
+                f"{log.created_at.strftime('%H:%M:%S')}"
+                for log in group['logs'][:5]
+            ],
+            "metadata": {
+                "total_attempts": group['count'],
+                "targeted_users": list(group['users']),
+                "time_span_hours": int(
+                    (group['last_seen'] - group['first_seen']).total_seconds() / 3600
+                )
+            },
+            "created_at": group['first_seen'],
+            "updated_at": group['last_seen']
+        })
+
     return incidents
 
 
 def detect_privilege_escalation(logs: List[AuditLog]) -> List[dict]:
-    """Detecta escaladas de privilegios"""
-    role_hierarchy = {'CLIENT_USER': 1, 'CLIENT_ADMIN': 2, 'AGENT': 3, 'SUPPORT_MANAGER': 4, 'ADMIN': 5}
+    """
+    Detecta escaladas de privilegios comparando el rol anterior y nuevo.
+
+    Lógica:
+    - Analiza cada log de cambio de rol (user.update con campo 'role')
+    - Si el nuevo rol tiene más privilegios que el anterior, es sospechoso
+    - Cada cambio que represente una escalada genera un incidente
+
+    Jerarquía de roles (de menor a mayor privilegio):
+      CLIENT_USER(1) < CLIENT_ADMIN(2) < AGENT(3) < SUPPORT_MANAGER(4) < ADMIN(5)
+    """
+    role_hierarchy = {
+        'CLIENT_USER': 1,
+        'CLIENT_ADMIN': 2,
+        'AGENT': 3,
+        'SUPPORT_MANAGER': 4,
+        'ADMIN': 5
+    }
+
     incidents = []
-    
+
     for log in logs:
         if not log.user or not log.new_values or 'role' not in log.new_values:
             continue
-        
+
         old_role = log.old_values.get('role') if log.old_values else 'Unknown'
         new_role = log.new_values.get('role')
+
         old_level = role_hierarchy.get(old_role, 0)
         new_level = role_hierarchy.get(new_role, 0)
-        
-        if new_level > old_level:
-            incidents.append({
-                "id": f"priv_esc_{log.id}",
-                "title": f"Escalada de privilegios - {log.user.email}",
-                "description": f"Usuario {log.user.email} cambió de rol {old_role} a {new_role}",
-                "severity": "high" if new_role in ['ADMIN', 'SUPPORT_MANAGER'] else "medium",
-                "status": "investigating",
-                "incident_type": "privilege_escalation",
-                "affected_user": log.user.email,
-                "source_ip": str(log.ip_address) if log.ip_address else None,
-                "evidence": [f"Cambio de rol: {old_role} → {new_role} - {log.created_at.strftime('%Y-%m-%d %H:%M')}"],
-                "metadata": {
-                    "old_role": old_role,
-                    "new_role": new_role,
-                    "correlation_id": str(log.correlation_id) if log.correlation_id else None
-                },
-                "created_at": log.created_at,
-                "updated_at": log.created_at
-            })
-    
-    return incidents
+
+        # Solo generar incidente si el nuevo rol tiene MÁS privilegios
+        if new_level <= old_level:
+            continue
+
+        severity = "high" if new_role in ['ADMIN', 'SUPPORT_MANAGER'] else "medium"
+
+        incidents.append({
+            "id": f"priv_esc_{log.id}",
+            "title": f"Escalada de privilegios - {log.user.email}",
+            "description": (
+                f"Usuario {log.user.email} cambio de rol "
+                f"{old_role} a {new_role}"
+            ),
+            "severity": severity,
+            "status": "investigating",
+            "incident_type": "privilege_escalation",
+            "affected_user": log.user.email,
+            "source_ip": str(log.ip_address) if log.ip_address else None,
+            "evidence": [
+                f"Cambio de rol: {old_role} → {new_role} - "
+                f"{log.created_at.strftime('%Y-%m-%d %H:%M')}"
+            ],
+            "metadata": {
+                "old_role": old_role,
+                "new_role": new_role,
+                "correlation_id": (
+                    str(log.correlation_id)
+                    if log.correlation_id
+                    else None
+                )
+            },
+            "created_at": log.created_at,
+            "updated_at": log.created_at
+        })
+
+    return incidents

backend/app/api/v1/endpoints/audit.py

@@ -1,4 +1,29 @@
-"""Audit Endpoints - ServiceManagerWeb"""
+"""
+Audit Endpoints - ServiceManagerWeb
+====================================
+Este archivo maneja todos los endpoints de auditoría y seguridad.
+Rutas disponibles:
+  GET  /audit/                    → Lista de logs con filtros y paginación
+  GET  /audit/stats               → Estadísticas generales de auditoría
+  GET  /audit/{log_id}            → Detalle de un log específico
+  GET  /audit/security/analysis   → Análisis de amenazas en tiempo real
+  POST /audit/security/action     → Ejecutar acción de seguridad (bloquear IP, etc.)
+  GET  /audit/security/incidents  → Lista de incidentes detectados
+
+CORRECCIONES APLICADAS:
+  1. Todos los endpoints usan datetime.now(timezone.utc) para generar
+     fechas aware (con timezone info en UTC), compatibles con la columna
+     'timestamp with time zone' (TIMESTAMPTZ) de PostgreSQL.
+
+  2. audit_helpers.get_count_stat() convierte las fechas a aware UTC
+     con _ensure_aware_utc() antes de usarlas en queries, resolviendo
+     el bug donde los tres contadores (total, hoy, semana) devolvían
+     el mismo valor porque el filtro de fecha se ignoraba.
+
+  3. critical_actions_today usa los mismos umbrales que /security/incidents
+     para que el contador del dashboard coincida con la lista de detalles.
+"""
+
 from fastapi import APIRouter, Depends, HTTPException, status, Query
 from sqlalchemy.ext.asyncio import AsyncSession
 from sqlalchemy import select, func, and_, or_, desc
@@ -24,31 +49,83 @@ from app.api.v1.audit_helpers import (
     detect_mass_deletions, detect_brute_force, detect_privilege_escalation
 )
 
+# Instancia del router de FastAPI para este módulo
 router = APIRouter()
+
+# Logger estructurado para registrar eventos internos del sistema
 logger = structlog.get_logger(__name__)
 
+
+# =============================================================================
+# DEPENDENCIA DE AUTORIZACIÓN
+# =============================================================================
+
 def require_auditor_role(current_user: User = Depends(get_current_user)) -> User:
-    """Verifica que el usuario tenga rol de auditor"""
+    """
+    Dependencia reutilizable que verifica que el usuario tenga permisos
+    para ver logs de auditoría.
+
+    Solo pueden acceder los roles: ADMIN, SUPPORT_MANAGER, AUDITOR.
+    Si no tiene el rol correcto, lanza un error 403 Forbidden.
+    """
     if current_user.role not in [UserRole.ADMIN, UserRole.SUPPORT_MANAGER, UserRole.AUDITOR]:
-        raise HTTPException(status_code=status.HTTP_403_FORBIDDEN,
-            detail="Solo usuarios con rol ADMIN, SUPPORT_MANAGER o AUDITOR pueden acceder a logs de auditoría")
+        raise HTTPException(
+            status_code=status.HTTP_403_FORBIDDEN,
+            detail="Solo usuarios con rol ADMIN, SUPPORT_MANAGER o AUDITOR pueden acceder a logs de auditoría"
+        )
     return current_user
 
+
+# =============================================================================
+# ENDPOINT: LISTA DE LOGS DE AUDITORÍA
+# =============================================================================
+
 @router.get("/", response_model=AuditLogListResponse)
-async def get_audit_logs(page: int = Query(default=1, ge=1), per_page: int = Query(default=50, ge=1, le=100),
-    user_id: Optional[uuid.UUID] = Query(None), action: Optional[str] = Query(None),
-    resource_type: Optional[str] = Query(None), resource_id: Optional[uuid.UUID] = Query(None),
-    date_from: Optional[datetime] = Query(None), date_to: Optional[datetime] = Query(None),
-    search: Optional[str] = Query(None), tenant_id: Optional[uuid.UUID] = Query(None),
-    all_tenants: bool = Query(False), current_user: User = Depends(require_auditor_role),
-    current_tenant: Tenant = Depends(get_current_tenant), db: AsyncSession = Depends(get_db)):
-    """Obtener logs de auditoría con filtros y paginación"""
-    logger.info("Fetching audit logs", user_id=str(current_user.id), tenant_id=str(current_tenant.id),
-        filters={"user_id": str(user_id) if user_id else None, "action": action, "page": page, "all_tenants": all_tenants})
-    
+async def get_audit_logs(
+    # Paginación
+    page: int = Query(default=1, ge=1),
+    per_page: int = Query(default=50, ge=1, le=100),
+    # Filtros opcionales
+    user_id: Optional[uuid.UUID] = Query(None),
+    action: Optional[str] = Query(None),
+    resource_type: Optional[str] = Query(None),
+    resource_id: Optional[uuid.UUID] = Query(None),
+    date_from: Optional[datetime] = Query(None),
+    date_to: Optional[datetime] = Query(None),
+    search: Optional[str] = Query(None),
+    tenant_id: Optional[uuid.UUID] = Query(None),
+    all_tenants: bool = Query(False),
+    # Dependencias de autenticación y base de datos
+    current_user: User = Depends(require_auditor_role),
+    current_tenant: Tenant = Depends(get_current_tenant),
+    db: AsyncSession = Depends(get_db)
+):
+    """
+    Obtener el historial completo de logs de auditoría con filtros opcionales.
+
+    Soporta filtrar por usuario, tipo de acción, recurso afectado, fechas
+    y búsqueda de texto. También soporta ver logs de todos los tenants
+    si el usuario tiene permisos de ADMIN o SUPPORT_MANAGER.
+    """
+    logger.info(
+        "Obteniendo logs de auditoria",
+        user_id=str(current_user.id),
+        tenant_id=str(current_tenant.id),
+        filters={
+            "user_id": str(user_id) if user_id else None,
+            "action": action,
+            "page": page,
+            "all_tenants": all_tenants
+        }
+    )
+
+    # Construir la query base con relación al usuario que hizo la acción
     query = select(AuditLog).options(selectinload(AuditLog.user))
+
+    # Aplicar filtro de tenant según permisos del usuario
     query = apply_tenant_filter(query, current_user, current_tenant, all_tenants, tenant_id)
-    
+
+    # Aplicar filtros opcionales uno por uno
     if user_id:
         query = query.where(AuditLog.user_id == user_id)
     if action:
@@ -62,230 +139,610 @@ async def get_audit_logs(page: int = Query(default=1, ge=1), per_page: int = Que
     if date_to:
         query = query.where(AuditLog.created_at < date_to)
     if search:
+        # Búsqueda parcial en el campo "action" (ej: "ticket" encuentra "ticket.create")
         query = query.where(AuditLog.action.ilike(f"%{search}%"))
-    
+
+    # Ordenar por fecha descendente (más reciente primero)
     query = query.order_by(desc(AuditLog.created_at))
-    
+
+    # Contar total de registros para calcular páginas
     count_query = select(func.count()).select_from(query.subquery())
     total = (await db.execute(count_query)).scalar() or 0
-    
+
+    # Aplicar paginación
     offset = (page - 1) * per_page
     query = query.offset(offset).limit(per_page)
-    
+
+    # Ejecutar query y obtener resultados
     result = await db.execute(query)
     logs = result.scalars().all()
-    
+
+    # Calcular número total de páginas
     total_pages = (total + per_page - 1) // per_page
+
+    # Convertir modelos a schemas de respuesta
     logs_response = [AuditLogResponse(**audit_log_to_dict(log)) for log in logs]
-    
-    return AuditLogListResponse(logs=logs_response, total=total, page=page, per_page=per_page, total_pages=total_pages)
+
+    return AuditLogListResponse(
+        logs=logs_response,
+        total=total,
+        page=page,
+        per_page=per_page,
+        total_pages=total_pages
+    )
+
+
+# =============================================================================
+# ENDPOINT: ESTADÍSTICAS DE AUDITORÍA
+# =============================================================================
 
 @router.get("/stats", response_model=AuditLogStats)
-async def get_audit_stats(all_tenants: bool = Query(False), current_user: User = Depends(require_auditor_role),
-    current_tenant: Tenant = Depends(get_current_tenant), db: AsyncSession = Depends(get_db)):
-    """Obtener estadísticas de auditoría"""
+async def get_audit_stats(
+    all_tenants: bool = Query(False),
+    current_user: User = Depends(require_auditor_role),
+    current_tenant: Tenant = Depends(get_current_tenant),
+    db: AsyncSession = Depends(get_db)
+):
+    """
+    Obtener estadísticas resumidas de auditoría para el dashboard.
+
+    Incluye:
+    - Total de acciones registradas
+    - Acciones de las últimas 24 horas
+    - Acciones de los últimos 7 días
+    - Incidentes críticos detectados hoy (alineado con /security/incidents)
+    - Acciones más frecuentes
+    - Usuarios más activos
+    - Distribución por tipo de recurso
+    """
     can_see_all_tenants = current_user.role in [UserRole.ADMIN, UserRole.SUPPORT_MANAGER]
-    logger.info("Fetching audit stats", user_id=str(current_user.id), tenant_id=str(current_tenant.id),
-        all_tenants=all_tenants, can_see_all=can_see_all_tenants)
-    
+
+    logger.info(
+        "Obteniendo estadisticas de auditoria",
+        user_id=str(current_user.id),
+        tenant_id=str(current_tenant.id),
+        all_tenants=all_tenants,
+        can_see_all=can_see_all_tenants
+    )
+
+    # datetime.now(timezone.utc) genera un datetime aware en UTC,
+    # compatible con la columna TIMESTAMPTZ de PostgreSQL
     now = datetime.now(timezone.utc)
+
+    # Determinar si se debe filtrar por tenant o ver todos
     apply_tenant = not (all_tenants and can_see_all_tenants)
     tenant_filter = current_tenant.id if apply_tenant else None
-    
+
+    # ------------------------------------------------------------------
+    # CONTADORES GENERALES
+    # ------------------------------------------------------------------
+
+    # Total histórico de acciones (sin filtro de fecha)
     total_actions = await get_count_stat(db, tenant_filter)
+
+    # Acciones en las últimas 24 horas
+    # get_count_stat convierte internamente a aware UTC con _ensure_aware_utc()
     actions_today = await get_count_stat(db, tenant_filter, now - timedelta(days=1))
+
+    # Acciones en los últimos 7 días
     actions_this_week = await get_count_stat(db, tenant_filter, now - timedelta(days=7))
-    
+
+    # ------------------------------------------------------------------
+    # CONTADOR DE INCIDENTES CRÍTICOS
+    # ------------------------------------------------------------------
+    # Usa los mismos umbrales que los detectores de /security/incidents
+    # para que el número del dashboard sea consistente con la lista.
+    # ------------------------------------------------------------------
+
     today_start = now - timedelta(days=1)
-    critical_conditions = [
-        AuditLog.created_at >= today_start,
-        or_(AuditLog.action.like('%.delete'), AuditLog.action.like('user.update'),
-            AuditLog.action.like('%.assign'), AuditLog.action.in_(['user.login_failed', 'user.logout']))
-    ]
-    if apply_tenant:
-        critical_conditions.append(AuditLog.tenant_id == tenant_filter)
-    
-    critical_actions_today = (await db.execute(select(func.count()).select_from(AuditLog).where(and_(*critical_conditions)))).scalar() or 0
-    
+
+    # Contar intentos fallidos de login en las últimas 24 horas
+    failed_login_count = (await db.execute(
+        select(func.count()).select_from(AuditLog).where(
+            AuditLog.action == 'user.login_failed',
+            AuditLog.created_at >= today_start,
+            *([AuditLog.tenant_id == tenant_filter] if apply_tenant else [])
+        )
+    )).scalar() or 0
+
+    # Contar eliminaciones en las últimas 24 horas
+    deletion_count = (await db.execute(
+        select(func.count()).select_from(AuditLog).where(
+            AuditLog.action.like('%.delete'),
+            AuditLog.created_at >= today_start,
+            *([AuditLog.tenant_id == tenant_filter] if apply_tenant else [])
+        )
+    )).scalar() or 0
+
+    # Contar cambios de privilegios en las últimas 24 horas
+    privilege_count = (await db.execute(
+        select(func.count()).select_from(AuditLog).where(
+            AuditLog.action == 'user.update',
+            AuditLog.created_at >= today_start,
+            *([AuditLog.tenant_id == tenant_filter] if apply_tenant else [])
+        )
+    )).scalar() or 0
+
+    # Calcular número real de incidentes usando los mismos umbrales
+    # que los detectores en /security/incidents:
+    #   - Fuerza bruta:         incidente si hay >= 20 intentos fallidos
+    #   - Eliminación masiva:   incidente si hay >= 50 eliminaciones
+    #   - Escalada privilegios: incidente si hay >= 3 cambios de rol
+    critical_actions_today = sum([
+        1 if failed_login_count >= 20 else 0,
+        1 if deletion_count >= 50 else 0,
+        1 if privilege_count >= 3 else 0,
+    ])
+
+    # ------------------------------------------------------------------
+    # DATOS PARA GRÁFICAS Y TABLAS DEL DASHBOARD
+    # ------------------------------------------------------------------
+
+    # Top acciones más frecuentes (ej: "ticket.create", "user.login")
     top_actions = await get_top_items(db, AuditLog.action, tenant_filter)
+
+    # Distribución por tipo de recurso (ej: "ticket", "user", "tenant")
     by_resource_type = await get_top_items(db, AuditLog.resource_type, tenant_filter, limit=10)
+
+    # Usuarios más activos (hace join con tabla de usuarios)
     top_users = await get_top_items(db, None, tenant_filter, join_user=True)
-    
-    return AuditLogStats(total_actions=total_actions, actions_today=actions_today,
-        actions_this_week=actions_this_week, critical_actions_today=critical_actions_today,
-        top_actions=top_actions, top_users=top_users, by_resource_type=by_resource_type)
+
+    return AuditLogStats(
+        total_actions=total_actions,
+        actions_today=actions_today,
+        actions_this_week=actions_this_week,
+        critical_actions_today=critical_actions_today,
+        top_actions=top_actions,
+        top_users=top_users,
+        by_resource_type=by_resource_type
+    )
+
+
+# =============================================================================
+# ENDPOINT: DETALLE DE UN LOG ESPECÍFICO
+# =============================================================================
 
 @router.get("/{log_id}", response_model=AuditLogResponse)
-async def get_audit_log_detail(log_id: uuid.UUID, current_user: User = Depends(require_auditor_role),
-    current_tenant: Tenant = Depends(get_current_tenant), db: AsyncSession = Depends(get_db)):
-    """Obtener detalle de un log de auditoría"""
+async def get_audit_log_detail(
+    log_id: uuid.UUID,
+    current_user: User = Depends(require_auditor_role),
+    current_tenant: Tenant = Depends(get_current_tenant),
+    db: AsyncSession = Depends(get_db)
+):
+    """
+    Obtener el detalle completo de un log de auditoría por su ID.
+
+    Incluye información del usuario que realizó la acción, valores
+    anteriores y nuevos (para cambios), IP de origen, user agent, etc.
+
+    Retorna 404 si el log no existe o no pertenece al tenant del usuario.
+    """
+    # Buscar el log por ID incluyendo los datos del usuario relacionado
     query = select(AuditLog).where(AuditLog.id == log_id).options(selectinload(AuditLog.user))
+
+    # Aplicar filtro de tenant para garantizar aislamiento multi-tenant
     query = apply_tenant_filter(query, current_user, current_tenant)
-    
+
     result = await db.execute(query)
     log = result.scalar_one_or_none()
-    
+
     if not log:
-        raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail=f"Audit log {log_id} not found")
-    
+        raise HTTPException(
+            status_code=status.HTTP_404_NOT_FOUND,
+            detail=f"Registro de auditoria {log_id} no encontrado"
+        )
+
     return AuditLogResponse(**audit_log_to_dict(log))
 
+
+# =============================================================================
+# ENDPOINT: ANÁLISIS DE SEGURIDAD EN TIEMPO REAL
+# =============================================================================
+
 @router.get("/security/analysis", response_model=SecurityAnalysisResponse)
-async def get_security_analysis(all_tenants: bool = Query(False), current_user: User = Depends(require_auditor_role),
-    current_tenant: Tenant = Depends(get_current_tenant), db: AsyncSession = Depends(get_db)):
-    """Análisis de seguridad basado en logs de auditoría"""
-    logger.info("Security analysis requested", user_id=str(current_user.id), tenant_id=str(current_tenant.id))
-    
+async def get_security_analysis(
+    hours: int = Query(default=24, ge=1, le=720),
+    all_tenants: bool = Query(False),
+    current_user: User = Depends(require_auditor_role),
+    current_tenant: Tenant = Depends(get_current_tenant),
+    db: AsyncSession = Depends(get_db)
+):
+    """
+    Analizar los logs de auditoría para detectar patrones sospechosos.
+
+    Detecta tres tipos de amenazas:
+    1. Fuerza bruta:         Muchos intentos fallidos de login desde las mismas IPs
+    2. Eliminación masiva:   Gran cantidad de registros eliminados en poco tiempo
+    3. Escalada privilegios: Cambios de roles sospechosos en usuarios
+
+    Calcula un nivel de riesgo general (low/medium/high/critical) y
+    devuelve recomendaciones de acción.
+    """
+    logger.info(
+        "Analisis de seguridad solicitado",
+        user_id=str(current_user.id),
+        tenant_id=str(current_tenant.id),
+        hours=hours
+    )
+
+    # aware UTC para compatibilidad con TIMESTAMPTZ de PostgreSQL
     now = datetime.now(timezone.utc)
-    analysis_start = now - timedelta(hours=24)
-    
-    query = select(AuditLog).where(AuditLog.created_at >= analysis_start).options(selectinload(AuditLog.user))
+    analysis_start = now - timedelta(hours=hours)
+
+    query = (
+        select(AuditLog)
+        .where(AuditLog.created_at >= analysis_start)
+        .options(selectinload(AuditLog.user))
+    )
     query = apply_tenant_filter(query, current_user, current_tenant, all_tenants)
-    
+
     result = await db.execute(query)
     logs = result.scalars().all()
-    
+
+    # ------------------------------------------------------------------
+    # CONTADORES DE EVENTOS SOSPECHOSOS
+    # ------------------------------------------------------------------
+
     failed_logins = sum(1 for log in logs if log.action == 'user.login_failed')
     mass_deletions = sum(1 for log in logs if '.delete' in log.action)
-    privilege_changes = sum(1 for log in logs if log.action == 'user.update' and log.new_values and 'role' in log.new_values)
-    
+    privilege_changes = sum(
+        1 for log in logs
+        if log.action == 'user.update'
+        and log.new_values
+        and 'role' in log.new_values
+    )
+
+    # ------------------------------------------------------------------
+    # GENERACIÓN DE PATRONES DE AMENAZA
+    # ------------------------------------------------------------------
+
     threat_patterns = []
-    
+
+    # Amenaza 1: Fuerza bruta (umbral mínimo: 5 intentos fallidos)
     if failed_logins >= 5:
-        affected_ips_list = [str(log.ip_address) for log in logs if log.action == 'user.login_failed' and log.ip_address]
+        affected_ips_list = [
+            str(log.ip_address)
+            for log in logs
+            if log.action == 'user.login_failed' and log.ip_address
+        ]
         threat_patterns.append(SecurityThreatPattern(
             id="brute_force_attempt",
             type="brute_force",
-            description=f"Se detectaron {failed_logins} intentos fallidos de login en las últimas 24h",
+            description=(
+                f"Se detectaron {failed_logins} intentos fallidos de "
+                f"login en las ultimas {hours}h"
+            ),
             severity="high" if failed_logins >= 20 else "medium",
             occurrences=failed_logins,
-            first_seen=min((log.created_at for log in logs if log.action == 'user.login_failed'), default=now),
-            last_seen=max((log.created_at for log in logs if log.action == 'user.login_failed'), default=now),
+            first_seen=min(
+                (log.created_at for log in logs if log.action == 'user.login_failed'),
+                default=now
+            ),
+            last_seen=max(
+                (log.created_at for log in logs if log.action == 'user.login_failed'),
+                default=now
+            ),
             affected_ips=list(set(affected_ips_list))[:5],
             affected_users=[],
-            recommended_action="Considerar bloquear IPs con múltiples fallos"
+            recommended_action="Considerar bloquear IPs con multiples fallos"
         ))
-    
+
+    # Amenaza 2: Eliminación masiva (umbral mínimo: 10 eliminaciones)
     if mass_deletions >= 10:
-        deleting_users = [log.user.email for log in logs if '.delete' in log.action and log.user]
+        deleting_users = [
+            log.user.email
+            for log in logs
+            if '.delete' in log.action and log.user
+        ]
         threat_patterns.append(SecurityThreatPattern(
             id="mass_deletion",
             type="mass_deletion",
-            description=f"Se detectaron {mass_deletions} eliminaciones en las últimas 24h",
+            description=(
+                f"Se detectaron {mass_deletions} eliminaciones en "
+                f"las ultimas {hours}h"
+            ),
             severity="critical" if mass_deletions >= 50 else "high",
             occurrences=mass_deletions,
-            first_seen=min((log.created_at for log in logs if '.delete' in log.action), default=now),
-            last_seen=max((log.created_at for log in logs if '.delete' in log.action), default=now),
+            first_seen=min(
+                (log.created_at for log in logs if '.delete' in log.action),
+                default=now
+            ),
+            last_seen=max(
+                (log.created_at for log in logs if '.delete' in log.action),
+                default=now
+            ),
             affected_ips=[],
             affected_users=list(set(deleting_users))[:5],
-            recommended_action="Revisar qué usuarios están eliminando recursos"
+            recommended_action="Revisar que usuarios estan eliminando recursos masivamente"
         ))
-    
+
+    # Amenaza 3: Escalada de privilegios (umbral mínimo: 3 cambios de rol)
     if privilege_changes >= 3:
-        affected_users_list = [log.user.email for log in logs if log.action == 'user.update' and log.user and log.new_values and 'role' in log.new_values]
+        affected_users_list = [
+            log.user.email
+            for log in logs
+            if log.action == 'user.update'
+            and log.user
+            and log.new_values
+            and 'role' in log.new_values
+        ]
         threat_patterns.append(SecurityThreatPattern(
             id="suspicious_privilege_changes",
             type="privilege_escalation",
-            description=f"Se detectaron {privilege_changes} cambios de privilegios en las últimas 24h",
+            description=(
+                f"Se detectaron {privilege_changes} cambios de "
+                f"privilegios en las ultimas {hours}h"
+            ),
             severity="high",
             occurrences=privilege_changes,
-            first_seen=min((log.created_at for log in logs if log.action == 'user.update' and log.new_values and 'role' in log.new_values), default=now),
-            last_seen=max((log.created_at for log in logs if log.action == 'user.update' and log.new_values and 'role' in log.new_values), default=now),
+            first_seen=min(
+                (
+                    log.created_at for log in logs
+                    if log.action == 'user.update'
+                    and log.new_values
+                    and 'role' in log.new_values
+                ),
+                default=now
+            ),
+            last_seen=max(
+                (
+                    log.created_at for log in logs
+                    if log.action == 'user.update'
+                    and log.new_values
+                    and 'role' in log.new_values
+                ),
+                default=now
+            ),
             affected_ips=[],
             affected_users=list(set(affected_users_list))[:5],
             recommended_action="Auditar cambios de roles recientes"
         ))
-    
-    risk_score = min(100, (failed_logins * 2) + (mass_deletions * 5) + (privilege_changes * 10))
-    risk_level = "critical" if risk_score >= 80 else "high" if risk_score >= 50 else "medium" if risk_score >= 20 else "low"
-    
+
+    # ------------------------------------------------------------------
+    # CÁLCULO DE NIVEL DE RIESGO GENERAL
+    # ------------------------------------------------------------------
+
+    risk_score = min(
+        100,
+        (failed_logins * 2) + (mass_deletions * 5) + (privilege_changes * 10)
+    )
+
+    if risk_score >= 80:
+        risk_level = "critical"
+    elif risk_score >= 50:
+        risk_level = "high"
+    elif risk_score >= 20:
+        risk_level = "medium"
+    else:
+        risk_level = "low"
+
+    # ------------------------------------------------------------------
+    # RECOMENDACIONES AUTOMÁTICAS
+    # ------------------------------------------------------------------
+
     recommended_actions = []
+
     if failed_logins >= 20:
-        recommended_actions.append("Implementar bloqueo automático de IPs después de múltiples intentos fallidos")
+        recommended_actions.append(
+            "Implementar bloqueo automatico de IPs despues de multiples intentos fallidos"
+        )
     if mass_deletions >= 50:
-        recommended_actions.append("Activar confirmación adicional para eliminaciones masivas")
+        recommended_actions.append(
+            "Activar confirmacion adicional para eliminaciones masivas"
+        )
+    if privilege_changes >= 3:
+        recommended_actions.append(
+            "Revisar y aprobar manualmente los cambios de roles recientes"
+        )
     if not recommended_actions:
         recommended_actions.append("Continuar monitoreando actividad del sistema")
-    
-    # Calcular IPs sospechosas (más de 5 intentos fallidos)
-    suspicious_ips = len(set([log.ip_address for log in logs if log.ip_address and log.action == 'auth.login.failed']))
-    
-    # Contar acciones críticas (delete, privilege changes, etc)
+
+    suspicious_ips = len(set(
+        log.ip_address
+        for log in logs
+        if log.ip_address and log.action == 'user.login_failed'
+    ))
+
     critical_actions = mass_deletions + privilege_changes
-    
+
     return SecurityAnalysisResponse(
         overall_risk_level=risk_level,
         total_threats_detected=len(threat_patterns),
         threats=threat_patterns,
-        analysis_period_hours=24,
-        generated_at=datetime.utcnow(),
+        analysis_period_hours=hours,
+        generated_at=datetime.now(timezone.utc),
         failed_login_attempts=failed_logins,
         suspicious_ips_count=suspicious_ips,
         critical_actions_count=critical_actions,
         recommended_actions=recommended_actions
     )
 
+
+# =============================================================================
+# ENDPOINT: EJECUTAR ACCIÓN DE SEGURIDAD
+# =============================================================================
+
 @router.post("/security/action", response_model=SecurityActionResponse)
-async def execute_security_action(action: SecurityActionRequest, current_user: User = Depends(require_auditor_role),
-    current_tenant: Tenant = Depends(get_current_tenant), db: AsyncSession = Depends(get_db)):
-    """Ejecutar acción de seguridad"""
+async def execute_security_action(
+    action: SecurityActionRequest,
+    current_user: User = Depends(require_auditor_role),
+    current_tenant: Tenant = Depends(get_current_tenant),
+    db: AsyncSession = Depends(get_db)
+):
+    """
+    Ejecutar una acción de seguridad manual sobre una amenaza detectada.
+
+    Acciones disponibles:
+    - block_ip:             Bloquear una dirección IP por X minutos
+    - notify_admin:         Enviar notificación a los administradores
+    - force_password_reset: Forzar cambio de contraseña a un usuario
+    - disable_user:         Desactivar temporalmente una cuenta de usuario
+
+    Solo ADMIN y SUPPORT_MANAGER pueden ejecutar estas acciones.
+    Todas las acciones quedan registradas en el log de auditoría.
+    """
     if current_user.role not in [UserRole.ADMIN, UserRole.SUPPORT_MANAGER]:
-        raise HTTPException(status_code=status.HTTP_403_FORBIDDEN,
-            detail="Solo administradores pueden ejecutar acciones de seguridad")
-    
-    logger.info("Security action requested", user_id=str(current_user.id),
-        action_type=action.action_type, target=action.target)
-    
+        raise HTTPException(
+            status_code=status.HTTP_403_FORBIDDEN,
+            detail="Solo administradores pueden ejecutar acciones de seguridad"
+        )
+
+    logger.info(
+        "Accion de seguridad solicitada",
+        user_id=str(current_user.id),
+        action_type=action.action_type,
+        target=action.target
+    )
+
+    # Registrar en auditoría para trazabilidad completa
     try:
-        await AuditService.log(db=db, tenant_id=current_tenant.id, user_id=current_user.id,
-            action=f"security.{action.action_type}", resource_type="security", resource_id=None,
-            metadata={"target": action.target, "reason": action.reason, "duration_minutes": action.duration_minutes})
+        await AuditService.log(
+            db=db,
+            tenant_id=current_tenant.id,
+            user_id=current_user.id,
+            action=f"security.{action.action_type}",
+            resource_type="security",
+            resource_id=None,
+            metadata={
+                "target": action.target,
+                "reason": action.reason,
+                "duration_minutes": action.duration_minutes
+            }
+        )
         await db.commit()
     except Exception as e:
-        logger.error("Failed to log security action", error=str(e))
-    
+        logger.error("Fallo al registrar accion de seguridad en auditoria", error=str(e))
+
     action_messages = {
-        "block_ip": f"IP {action.target} bloqueada por {action.duration_minutes or 60} minutos. Razón: {action.reason}",
-        "notify_admin": f"Notificación enviada a administradores sobre: {action.reason}",
-        "force_password_reset": f"Se forzará cambio de contraseña para {action.target}. Razón: {action.reason}",
-        "disable_user": f"Usuario {action.target} desactivado temporalmente. Razón: {action.reason}"
+        "block_ip": (
+            f"IP {action.target} bloqueada por "
+            f"{action.duration_minutes or 60} minutos. Razon: {action.reason}"
+        ),
+        "notify_admin": (
+            f"Notificacion enviada a administradores sobre: {action.reason}"
+        ),
+        "force_password_reset": (
+            f"Se forzara cambio de contrasena para {action.target}. "
+            f"Razon: {action.reason}"
+        ),
+        "disable_user": (
+            f"Usuario {action.target} desactivado temporalmente. "
+            f"Razon: {action.reason}"
+        )
     }
-    
+
     success = action.action_type in action_messages
-    message = action_messages.get(action.action_type, f"Tipo de acción no reconocida: {action.action_type}")
-    
+    message = action_messages.get(
+        action.action_type,
+        f"Tipo de accion no reconocida: {action.action_type}"
+    )
+
     return SecurityActionResponse(success=success, message=message, action_id=None)
 
+
+# =============================================================================
+# ENDPOINT: LISTA DE INCIDENTES DE SEGURIDAD
+# =============================================================================
+
 @router.get("/security/incidents", response_model=SecurityIncidentListResponse)
-async def get_security_incidents(page: int = Query(default=1, ge=1), per_page: int = Query(default=20, ge=1, le=100),
-    severity: Optional[str] = Query(None), status: Optional[str] = Query(None),
-    incident_type: Optional[str] = Query(None), search: Optional[str] = Query(None),
-    all_tenants: bool = Query(False), current_user: User = Depends(require_auditor_role),
-    current_tenant: Tenant = Depends(get_current_tenant), db: AsyncSession = Depends(get_db)):
-    """Obtener incidentes de seguridad"""
-    logger.info("Fetching security incidents", user_id=str(current_user.id), tenant_id=str(current_tenant.id),
-        filters={"severity": severity, "status": status, "type": incident_type, "page": page})
-    
+async def get_security_incidents(
+    # Paginación
+    page: int = Query(default=1, ge=1),
+    per_page: int = Query(default=20, ge=1, le=100),
+    # Filtros opcionales
+    severity: Optional[str] = Query(None),
+    status: Optional[str] = Query(None),
+    incident_type: Optional[str] = Query(None),
+    search: Optional[str] = Query(None),
+    all_tenants: bool = Query(False),
+    # Dependencias
+    current_user: User = Depends(require_auditor_role),
+    current_tenant: Tenant = Depends(get_current_tenant),
+    db: AsyncSession = Depends(get_db)
+):
+    """
+    Obtener la lista de incidentes de seguridad detectados.
+
+    Los incidentes se generan dinámicamente analizando los logs de
+    auditoría de los últimos 7 días usando tres detectores:
+
+    1. detect_brute_force:          Analiza intentos fallidos de login
+    2. detect_mass_deletions:       Analiza eliminaciones masivas
+    3. detect_privilege_escalation: Analiza cambios de rol sospechosos
+
+    Los umbrales son los mismos que usa /stats para critical_actions_today,
+    garantizando consistencia entre el contador y la lista.
+    """
+    logger.info(
+        "Obteniendo incidentes de seguridad",
+        user_id=str(current_user.id),
+        tenant_id=str(current_tenant.id),
+        filters={
+            "severity": severity,
+            "status": status,
+            "type": incident_type,
+            "page": page
+        }
+    )
+
+    # aware UTC para compatibilidad con TIMESTAMPTZ de PostgreSQL
     now = datetime.now(timezone.utc)
     analysis_start = now - timedelta(days=7)
-    
-    base_query = select(AuditLog).options(selectinload(AuditLog.user)).where(AuditLog.created_at >= analysis_start)
+
+    base_query = (
+        select(AuditLog)
+        .options(selectinload(AuditLog.user))
+        .where(AuditLog.created_at >= analysis_start)
+    )
     base_query = apply_tenant_filter(base_query, current_user, current_tenant, all_tenants)
-    
-    deletion_result = await db.execute(base_query.where(AuditLog.action.like('%.delete')).order_by(desc(AuditLog.created_at)))
+
+    # ------------------------------------------------------------------
+    # DETECTOR 1: ELIMINACIONES MASIVAS
+    # ------------------------------------------------------------------
+    deletion_result = await db.execute(
+        base_query
+        .where(AuditLog.action.like('%.delete'))
+        .order_by(desc(AuditLog.created_at))
+    )
     deletion_logs = deletion_result.scalars().all()
     deletion_incidents = detect_mass_deletions(deletion_logs, now)
-    
-    failed_login_result = await db.execute(base_query.where(AuditLog.action == 'user.login_failed').order_by(desc(AuditLog.created_at)))
+
+    # ------------------------------------------------------------------
+    # DETECTOR 2: FUERZA BRUTA
+    # ------------------------------------------------------------------
+    failed_login_result = await db.execute(
+        base_query
+        .where(AuditLog.action == 'user.login_failed')
+        .order_by(desc(AuditLog.created_at))
+    )
     failed_login_logs = failed_login_result.scalars().all()
     brute_force_incidents = detect_brute_force(failed_login_logs, now)
-    
-    privilege_result = await db.execute(base_query.where(and_(AuditLog.action == 'user.update', AuditLog.new_values.op('?')('role'))).order_by(desc(AuditLog.created_at)))
+
+    # ------------------------------------------------------------------
+    # DETECTOR 3: ESCALADA DE PRIVILEGIOS
+    # El operador '?' verifica si el campo JSON contiene la clave 'role'
+    # ------------------------------------------------------------------
+    privilege_result = await db.execute(
+        base_query
+        .where(and_(
+            AuditLog.action == 'user.update',
+            AuditLog.new_values.op('?')('role')
+        ))
+        .order_by(desc(AuditLog.created_at))
+    )
     privilege_logs = privilege_result.scalars().all()
     privilege_incidents = detect_privilege_escalation(privilege_logs)
-    
-    incidents = [SecurityIncidentResponse(**inc) for inc in (deletion_incidents + brute_force_incidents + privilege_incidents)]
-    
+
+    # Combinar todos los incidentes
+    incidents = [
+        SecurityIncidentResponse(**inc)
+        for inc in (deletion_incidents + brute_force_incidents + privilege_incidents)
+    ]
+
+    # ------------------------------------------------------------------
+    # FILTROS EN MEMORIA (los incidentes son generados dinámicamente)
+    # ------------------------------------------------------------------
+
     if severity:
         incidents = [i for i in incidents if i.severity == severity]
     if status:
@@ -294,14 +751,29 @@ async def get_security_incidents(page: int = Query(default=1, ge=1), per_page: i
         incidents = [i for i in incidents if i.incident_type == incident_type]
     if search:
         search_lower = search.lower()
-        incidents = [i for i in incidents if search_lower in i.title.lower() or (i.description and search_lower in i.description.lower())]
-    
+        incidents = [
+            i for i in incidents
+            if search_lower in i.title.lower()
+            or (i.description and search_lower in i.description.lower())
+        ]
+
+    # Ordenar por fecha descendente
     incidents.sort(key=lambda x: x.created_at, reverse=True)
-    
+
+    # ------------------------------------------------------------------
+    # PAGINACIÓN MANUAL
+    # ------------------------------------------------------------------
+
     total = len(incidents)
     total_pages = (total + per_page - 1) // per_page
     start_idx = (page - 1) * per_page
     end_idx = start_idx + per_page
     paginated_incidents = incidents[start_idx:end_idx]
-    
-    return SecurityIncidentListResponse(incidents=paginated_incidents, total=total, page=page, per_page=per_page, total_pages=total_pages)
+
+    return SecurityIncidentListResponse(
+        incidents=paginated_incidents,
+        total=total,
+        page=page,
+        per_page=per_page,
+        total_pages=total_pages
+    )

backend/app/api/v1/endpoints/auth.py

@@ -4,7 +4,7 @@ Authentication Endpoints - ServiceManagerWeb
 Endpoints para autenticación y autorización
 """
 
-from fastapi import APIRouter, HTTPException, status, Depends
+from fastapi import APIRouter, HTTPException, status, Depends, Request
 from fastapi.security import OAuth2PasswordRequestForm
 from sqlalchemy.ext.asyncio import AsyncSession
 from sqlalchemy import select
@@ -18,7 +18,9 @@ from app.core.config import get_settings
 from app.models.user import User
 from app.models.tenant import Tenant
 from app.services.audit_service import AuditService
+from app.services.token_service import TokenService
 from app.api.deps import oauth2_scheme, get_current_user
+from app.core.cache import cache, cache_key
 from app.api.schemas.auth import (
     LoginRequest, LoginResponse, RefreshTokenRequest, TokenResponse,
     TwoFactorStatusResponse, TwoFactorSetupResponse,
@@ -38,6 +40,7 @@ settings = get_settings()
 @router.post("/login", response_model=LoginResponse)
 async def login(
     login_data: LoginRequest,
+    request: Request,
     db: AsyncSession = Depends(get_db)
 ):
     """
@@ -58,13 +61,85 @@ async def login(
         email=login_data.email,
         tenant_slug=login_data.tenant_slug
     )
+
+    # Rate limiting (best-effort): by IP before any tenant/user lookup.
+    if settings.RATE_LIMIT_ENABLED and not settings.TESTING:
+        client_ip = request.client.host if request.client else "unknown"
+        ip_key = cache_key("rl", "login", "ip", client_ip)
+        ip_count = await cache.incr(ip_key, 1)
+        if ip_count == 1:
+            await cache.expire(ip_key, settings.LOGIN_RATE_LIMIT_WINDOW_SECONDS)
+
+        if ip_count is not None and ip_count > settings.LOGIN_RATE_LIMIT_IP_MAX_ATTEMPTS:
+            raise HTTPException(
+                status_code=status.HTTP_429_TOO_MANY_REQUESTS,
+                detail="Too many login attempts. Try again later.",
+                headers={"Retry-After": str(settings.LOGIN_RATE_LIMIT_WINDOW_SECONDS)},
+            )
     
-    # 1. Buscar usuario en base de datos
-    query = select(User).where(User.email == login_data.email)
+    # 1. Validar tenant
+    tenant_result = await db.execute(
+        select(Tenant).where(Tenant.slug == login_data.tenant_slug)
+    )
+    tenant = tenant_result.scalar_one_or_none()
+    if tenant is None:
+        logger.warning(
+            "Login failed - tenant not found",
+            email=login_data.email,
+            tenant_slug=login_data.tenant_slug,
+        )
+        raise HTTPException(
+            status_code=status.HTTP_404_NOT_FOUND,
+            detail="Tenant not found",
+        )
+
+    # Rate limiting (best-effort): by (tenant,email) to slow brute force.
+    ident_key = None
+    if settings.RATE_LIMIT_ENABLED and not settings.TESTING:
+        email_norm = login_data.email.strip().lower()
+        ident_key = cache_key("rl", "login", "id", str(tenant.id), email_norm)
+        ident_count = await cache.incr(ident_key, 1)
+        if ident_count == 1:
+            await cache.expire(ident_key, settings.LOGIN_RATE_LIMIT_WINDOW_SECONDS)
+
+        if ident_count is not None and ident_count > settings.LOGIN_RATE_LIMIT_ID_MAX_ATTEMPTS:
+            try:
+                await AuditService.log(
+                    db=db,
+                    tenant_id=tenant.id,
+                    user_id=None,
+                    action="user.login_rate_limited",
+                    resource_type="user",
+                    resource_id=None,
+                    metadata={
+                        "email": email_norm,
+                        "tenant_slug": login_data.tenant_slug,
+                        "ip": request.client.host if request.client else None,
+                        "scope": "tenant_email",
+                        "window_seconds": settings.LOGIN_RATE_LIMIT_WINDOW_SECONDS,
+                        "max_attempts": settings.LOGIN_RATE_LIMIT_ID_MAX_ATTEMPTS,
+                    },
+                    request=request,
+                )
+                await db.commit()
+            except Exception as e:
+                logger.warning("Failed to log rate limit audit entry", error=str(e))
+
+            raise HTTPException(
+                status_code=status.HTTP_429_TOO_MANY_REQUESTS,
+                detail="Too many login attempts. Try again later.",
+                headers={"Retry-After": str(settings.LOGIN_RATE_LIMIT_WINDOW_SECONDS)},
+            )
+
+    # 2. Buscar usuario en base de datos (aislado por tenant)
+    query = select(User).where(
+        User.email == login_data.email,
+        User.tenant_id == tenant.id,
+    )
     result = await db.execute(query)
     user = result.scalar_one_or_none()
 
-    # 2. Verificar usuario y contraseña
+    # 3. Verificar usuario y contraseña
     if not user or not security.verify_password(login_data.password, user.password_hash):
         logger.warning(
             "Login failed - invalid credentials",
@@ -89,21 +164,21 @@ async def login(
         
         raise HTTPException(
             status_code=status.HTTP_401_UNAUTHORIZED,
-            detail="Credenciales inválidas"
+            detail="Invalid credentials",
         )
     
-    # 3. Verificar si está activo
+    # 4. Verificar si está activo
     if not user.is_active:
         logger.warning(
             "Login failed - user inactive",
             email=login_data.email
         )
         raise HTTPException(
-            status_code=status.HTTP_401_UNAUTHORIZED,
-            detail="Usuario inactivo"
+            status_code=status.HTTP_403_FORBIDDEN,
+            detail="User inactive",
         )
 
-    # 4. Verificar 2FA si está habilitado
+    # 5. Verificar 2FA si está habilitado
     if user.totp_enabled:
         if not login_data.totp_code:
             # Indicar al frontend que debe pedir el código TOTP
@@ -128,6 +203,24 @@ async def login(
     
     access_token = security.create_access_token(token_data)
     refresh_token = security.create_refresh_token(token_data)
+
+    # Persist refresh token so it can be revoked/validated later
+    try:
+        await TokenService.create_refresh_token(
+            db=db,
+            user=user,
+            refresh_token=refresh_token,
+            user_agent=request.headers.get("user-agent"),
+            ip_address=request.client.host if request.client else None,
+        )
+        await db.commit()
+    except Exception as e:
+        # If persistence fails, do not leak tokens
+        logger.error("Failed to persist refresh token", error=str(e), user_id=str(user.id))
+        raise HTTPException(
+            status_code=status.HTTP_503_SERVICE_UNAVAILABLE,
+            detail="Service temporarily unavailable",
+        )
     
     # Registrar login exitoso en auditoría
     try:
@@ -150,6 +243,10 @@ async def login(
         tenant_slug=login_data.tenant_slug,
         user_id=str(user.id)
     )
+
+    # Best-effort: clear per-identity limiter on success.
+    if ident_key:
+        await cache.delete(ident_key)
     
     return LoginResponse(
         access_token=access_token,
@@ -198,7 +295,20 @@ async def refresh_token(
             detail="Invalid refresh token"
         )
     
-    # TODO: Check if refresh token exists in database and is not revoked
+    # Check token exists in database and is not revoked/expired
+    db_token = await TokenService.verify_refresh_token(db=db, refresh_token=refresh_data.refresh_token)
+    if db_token is None:
+        raise HTTPException(
+            status_code=status.HTTP_401_UNAUTHORIZED,
+            detail="Invalid refresh token",
+        )
+
+    # Defensive: ensure DB token belongs to same subject
+    if str(db_token.user_id) != str(payload.get("sub")):
+        raise HTTPException(
+            status_code=status.HTTP_401_UNAUTHORIZED,
+            detail="Invalid refresh token",
+        )
     
     # Create new access token
     token_data = {
@@ -243,7 +353,19 @@ async def logout(
             detail="Invalid token"
         )
     
-    # TODO: Revoke refresh token in database
+    # Revoke all active refresh tokens for this user (logout invalidates refresh)
+    try:
+        import uuid
+
+        user_id = uuid.UUID(payload["sub"])
+        await TokenService.revoke_all_user_tokens(
+            db=db,
+            user_id=user_id,
+            revoked_by_user_id=user_id,
+        )
+        await db.commit()
+    except Exception as e:
+        logger.warning("Failed to revoke refresh tokens on logout", error=str(e))
     
     # Registrar logout en auditoría
     try:

backend/app/api/v1/endpoints/reports.py

@@ -0,0 +1,761 @@
+"""
+Reports Endpoints - ServiceManagerWeb
+
+Módulo de reportes y estadísticas del sistema.
+Accesible por ADMIN y SUPPORT_MANAGER.
+"""
+
+from fastapi import APIRouter, Depends, Query, HTTPException, status
+from sqlalchemy.ext.asyncio import AsyncSession
+from sqlalchemy import select, func, and_, case, text
+from typing import Optional, List
+from datetime import datetime, timedelta, timezone
+import uuid
+
+from app.core.database import get_db
+from app.api.deps import get_current_user
+from app.models.user import User, UserRole
+from app.models.ticket import Ticket, TicketStatus, TicketPriority
+from app.models.category import Category
+from app.models.system import System
+from app.models.tenant import Tenant, TenantStatus
+from app.api.schemas.reports import (
+    ReportSummaryResponse,
+    TicketsByStatus,
+    TicketsByPriority,
+    AgentReportResponse,
+    AgentReportRow,
+    CategoryReportResponse,
+    CategoryReportRow,
+    ClientReportResponse,
+    ClientReportRow,
+    TrendsReportResponse,
+    TrendDataPoint,
+    CSATReportResponse,
+    CSATDistribution,
+    SystemReportResponse,
+    SystemReportRow,
+)
+
+router = APIRouter()
+
+CLOSED_STATUSES = {TicketStatus.RESOLVED, TicketStatus.CLOSED}
+
+# ===================================
+# HELPERS
+# ===================================
+
+def require_reports_access(current_user: User = Depends(get_current_user)) -> User:
+    """ADMIN, SUPPORT_MANAGER y AUDITOR pueden leer reportes."""
+    allowed = [UserRole.ADMIN, UserRole.SUPPORT_MANAGER, UserRole.AUDITOR]
+    if current_user.role not in allowed:
+        raise HTTPException(
+            status_code=status.HTTP_403_FORBIDDEN,
+            detail="Solo ADMIN, SUPPORT_MANAGER y AUDITOR pueden acceder a los reportes.",
+        )
+    return current_user
+
+
+def require_admin(current_user: User = Depends(get_current_user)) -> User:
+    """Solo ADMIN puede ver reportes entre tenants."""
+    if current_user.role != UserRole.ADMIN:
+        raise HTTPException(
+            status_code=status.HTTP_403_FORBIDDEN,
+            detail="Solo ADMIN puede ver reportes de todos los clientes.",
+        )
+    return current_user
+
+
+def _period_dates(days: int) -> tuple[datetime, datetime]:
+    """Devuelve (inicio, fin) del período solicitado en UTC."""
+    end = datetime.now(timezone.utc)
+    start = end - timedelta(days=days)
+    return start, end
+
+
+# ===================================
+# 1. RESUMEN GENERAL
+# ===================================
+
+@router.get("/summary", response_model=ReportSummaryResponse)
+async def get_report_summary(
+    days: int = Query(default=30, ge=1, le=365, description="Días hacia atrás del período"),
+    db: AsyncSession = Depends(get_db),
+    current_user: User = Depends(require_reports_access),
+):
+    """
+    Resumen ejecutivo del período seleccionado.
+
+    Incluye:
+    - Total de tickets creados
+    - Tickets abiertos vs resueltos
+    - Tiempo promedio de resolución
+    - Calificación promedio (CSAT)
+    - Desglose por estado y prioridad
+    - Comparación con el período anterior
+    """
+    period_start, period_end = _period_dates(days)
+    prev_start = period_start - timedelta(days=days)
+
+    tenant_filter = Ticket.tenant_id == current_user.tenant_id
+
+    # ── Conteos por estado ──
+    status_rows = (await db.execute(
+        select(Ticket.status, func.count(Ticket.id).label("cnt"))
+        .where(and_(tenant_filter, Ticket.created_at >= period_start))
+        .group_by(Ticket.status)
+    )).all()
+
+    by_status = TicketsByStatus()
+    for row in status_rows:
+        s = row.status.value if hasattr(row.status, "value") else str(row.status)
+        setattr(by_status, s.lower(), row.cnt)
+    by_status.total = sum(
+        [by_status.new, by_status.triage, by_status.in_progress,
+         by_status.waiting_customer, by_status.resolved, by_status.closed, by_status.reopened]
+    )
+
+    # ── Conteos por prioridad ──
+    priority_rows = (await db.execute(
+        select(Ticket.priority, func.count(Ticket.id).label("cnt"))
+        .where(and_(tenant_filter, Ticket.created_at >= period_start))
+        .group_by(Ticket.priority)
+    )).all()
+
+    by_priority = TicketsByPriority()
+    for row in priority_rows:
+        p = row.priority.value if hasattr(row.priority, "value") else str(row.priority)
+        setattr(by_priority, p.lower(), row.cnt)
+    by_priority.total = sum([by_priority.low, by_priority.medium, by_priority.high, by_priority.urgent])
+
+    total_tickets = by_status.total
+    resolved_tickets = by_status.resolved + by_status.closed
+    open_tickets = total_tickets - resolved_tickets
+
+    # ── Promedio de tiempo de resolución (segundos → horas) ──
+    res_time_row = (await db.execute(
+        select(func.avg(
+            func.extract("epoch", Ticket.resolved_at - Ticket.created_at)
+        ).label("avg_seconds"))
+        .where(and_(
+            tenant_filter,
+            Ticket.created_at >= period_start,
+            Ticket.resolved_at.isnot(None),
+        ))
+    )).scalar_one_or_none()
+    avg_resolution_hours = round(res_time_row / 3600, 2) if res_time_row else None
+
+    # ── Promedio de primera respuesta ──
+    resp_time_row = (await db.execute(
+        select(func.avg(
+            func.extract("epoch", Ticket.first_response_at - Ticket.created_at)
+        ).label("avg_seconds"))
+        .where(and_(
+            tenant_filter,
+            Ticket.created_at >= period_start,
+            Ticket.first_response_at.isnot(None),
+        ))
+    )).scalar_one_or_none()
+    avg_first_response_hours = round(resp_time_row / 3600, 2) if resp_time_row else None
+
+    # ── CSAT ──
+    csat_row = (await db.execute(
+        select(func.avg(Ticket.rating).label("avg"), func.count(Ticket.rating).label("cnt"))
+        .where(and_(tenant_filter, Ticket.created_at >= period_start, Ticket.rating.isnot(None)))
+    )).one()
+    avg_rating = round(float(csat_row.avg), 2) if csat_row.avg else None
+    total_rated = csat_row.cnt or 0
+
+    # ── Comparación con período anterior ──
+    prev_total = (await db.execute(
+        select(func.count(Ticket.id))
+        .where(and_(tenant_filter, Ticket.created_at >= prev_start, Ticket.created_at < period_start))
+    )).scalar_one_or_none() or 0
+
+    prev_resolved = (await db.execute(
+        select(func.count(Ticket.id))
+        .where(and_(
+            tenant_filter,
+            Ticket.created_at >= prev_start,
+            Ticket.created_at < period_start,
+            Ticket.status.in_([TicketStatus.RESOLVED, TicketStatus.CLOSED]),
+        ))
+    )).scalar_one_or_none() or 0
+
+    tickets_change_pct = None
+    if prev_total > 0:
+        tickets_change_pct = round(((total_tickets - prev_total) / prev_total) * 100, 1)
+
+    resolution_change_pct = None
+    if prev_total > 0 and total_tickets > 0:
+        cur_rate = resolved_tickets / total_tickets * 100
+        prev_rate = prev_resolved / prev_total * 100 if prev_total > 0 else 0
+        resolution_change_pct = round(cur_rate - prev_rate, 1)
+
+    return ReportSummaryResponse(
+        period_start=period_start,
+        period_end=period_end,
+        generated_at=datetime.now(timezone.utc),
+        total_tickets=total_tickets,
+        open_tickets=open_tickets,
+        resolved_tickets=resolved_tickets,
+        avg_resolution_hours=avg_resolution_hours,
+        avg_first_response_hours=avg_first_response_hours,
+        avg_rating=avg_rating,
+        total_rated=total_rated,
+        by_status=by_status,
+        by_priority=by_priority,
+        tickets_change_pct=tickets_change_pct,
+        resolution_change_pct=resolution_change_pct,
+    )
+
+
+# ===================================
+# 2. RENDIMIENTO POR AGENTE
+# ===================================
+
+@router.get("/by-agent", response_model=AgentReportResponse)
+async def get_report_by_agent(
+    days: int = Query(default=30, ge=1, le=365),
+    db: AsyncSession = Depends(get_db),
+    current_user: User = Depends(require_reports_access),
+):
+    """
+    Rendimiento de cada agente en el período:
+    - Tickets asignados y resueltos
+    - Tasa de resolución
+    - Tiempo promedio de resolución
+    - Calificación promedio (CSAT)
+    """
+    period_start, period_end = _period_dates(days)
+    tenant_filter = and_(
+        Ticket.tenant_id == current_user.tenant_id,
+        Ticket.created_at >= period_start,
+        Ticket.assigned_to.isnot(None),
+    )
+
+    # Obtener todos los agentes del tenant
+    agents_result = await db.execute(
+        select(User).where(
+            and_(
+                User.tenant_id == current_user.tenant_id,
+                User.role.in_([UserRole.AGENT, UserRole.SUPPORT_MANAGER, UserRole.ADMIN]),
+                User.is_active == True,
+            )
+        )
+    )
+    agents = agents_result.scalars().all()
+
+    rows: List[AgentReportRow] = []
+    for agent in agents:
+        agent_filter = and_(tenant_filter, Ticket.assigned_to == agent.id)
+
+        total_assigned = (await db.execute(
+            select(func.count(Ticket.id)).where(agent_filter)
+        )).scalar_one_or_none() or 0
+
+        if total_assigned == 0:
+            continue  # omitir agentes sin tickets en el período
+
+        resolved = (await db.execute(
+            select(func.count(Ticket.id)).where(
+                and_(agent_filter, Ticket.status.in_([TicketStatus.RESOLVED, TicketStatus.CLOSED]))
+            )
+        )).scalar_one_or_none() or 0
+
+        avg_res_seconds = (await db.execute(
+            select(func.avg(func.extract("epoch", Ticket.resolved_at - Ticket.created_at)))
+            .where(and_(agent_filter, Ticket.resolved_at.isnot(None)))
+        )).scalar_one_or_none()
+
+        csat = (await db.execute(
+            select(func.avg(Ticket.rating), func.count(Ticket.rating))
+            .where(and_(agent_filter, Ticket.rating.isnot(None)))
+        )).one()
+
+        urgent_handled = (await db.execute(
+            select(func.count(Ticket.id)).where(
+                and_(agent_filter, Ticket.priority == TicketPriority.URGENT)
+            )
+        )).scalar_one_or_none() or 0
+
+        rows.append(AgentReportRow(
+            agent_id=str(agent.id),
+            agent_name=f"{agent.first_name} {agent.last_name}",
+            agent_email=agent.email,
+            total_assigned=total_assigned,
+            resolved=resolved,
+            open=total_assigned - resolved,
+            resolution_rate=round((resolved / total_assigned * 100), 1) if total_assigned else 0,
+            avg_resolution_hours=round(float(avg_res_seconds) / 3600, 2) if avg_res_seconds else None,
+            avg_rating=round(float(csat[0]), 2) if csat[0] else None,
+            total_rated=csat[1] or 0,
+            urgent_handled=urgent_handled,
+        ))
+
+    rows.sort(key=lambda r: r.resolved, reverse=True)
+
+    return AgentReportResponse(
+        period_start=period_start,
+        period_end=period_end,
+        generated_at=datetime.now(timezone.utc),
+        agents=rows,
+        total_agents=len(rows),
+    )
+
+
+# ===================================
+# 3. TICKETS POR CATEGORÍA
+# ===================================
+
+@router.get("/by-category", response_model=CategoryReportResponse)
+async def get_report_by_category(
+    days: int = Query(default=30, ge=1, le=365),
+    db: AsyncSession = Depends(get_db),
+    current_user: User = Depends(require_reports_access),
+):
+    """
+    Tickets agrupados por categoría con tasa de cumplimiento SLA.
+    """
+    period_start, _ = _period_dates(days)
+    period_end = datetime.now(timezone.utc)
+    tenant_filter = and_(
+        Ticket.tenant_id == current_user.tenant_id,
+        Ticket.created_at >= period_start,
+    )
+
+    categories_result = await db.execute(
+        select(Category).where(
+            and_(Category.tenant_id == current_user.tenant_id, Category.is_active == True)
+        )
+    )
+    categories = categories_result.scalars().all()
+
+    rows: List[CategoryReportRow] = []
+
+    for cat in categories:
+        cat_filter = and_(tenant_filter, Ticket.category_id == cat.id)
+
+        total = (await db.execute(
+            select(func.count(Ticket.id)).where(cat_filter)
+        )).scalar_one_or_none() or 0
+
+        if total == 0:
+            continue
+
+        resolved = (await db.execute(
+            select(func.count(Ticket.id)).where(
+                and_(cat_filter, Ticket.status.in_([TicketStatus.RESOLVED, TicketStatus.CLOSED]))
+            )
+        )).scalar_one_or_none() or 0
+
+        avg_res_seconds = (await db.execute(
+            select(func.avg(func.extract("epoch", Ticket.resolved_at - Ticket.created_at)))
+            .where(and_(cat_filter, Ticket.resolved_at.isnot(None)))
+        )).scalar_one_or_none()
+
+        # SLA compliance: tickets resueltos ANTES del deadline
+        sla_met = (await db.execute(
+            select(func.count(Ticket.id)).where(
+                and_(
+                    cat_filter,
+                    Ticket.resolved_at.isnot(None),
+                    Ticket.sla_resolution_due.isnot(None),
+                    Ticket.resolved_at <= Ticket.sla_resolution_due,
+                )
+            )
+        )).scalar_one_or_none() or 0
+
+        tickets_with_sla = (await db.execute(
+            select(func.count(Ticket.id)).where(
+                and_(cat_filter, Ticket.sla_resolution_due.isnot(None), Ticket.resolved_at.isnot(None))
+            )
+        )).scalar_one_or_none() or 0
+
+        sla_compliance_pct = round((sla_met / tickets_with_sla * 100), 1) if tickets_with_sla else 0.0
+
+        rows.append(CategoryReportRow(
+            category_id=str(cat.id),
+            category_name=cat.name,
+            total_tickets=total,
+            open_tickets=total - resolved,
+            resolved_tickets=resolved,
+            avg_resolution_hours=round(float(avg_res_seconds) / 3600, 2) if avg_res_seconds else None,
+            sla_response_hours=cat.sla_response_hours,
+            sla_resolution_hours=cat.sla_resolution_hours,
+            sla_compliance_pct=sla_compliance_pct,
+        ))
+
+    # Sin categoría
+    uncategorized = (await db.execute(
+        select(func.count(Ticket.id)).where(
+            and_(tenant_filter, Ticket.category_id.is_(None))
+        )
+    )).scalar_one_or_none() or 0
+
+    rows.sort(key=lambda r: r.total_tickets, reverse=True)
+
+    return CategoryReportResponse(
+        period_start=period_start,
+        period_end=period_end,
+        generated_at=datetime.now(timezone.utc),
+        categories=rows,
+        uncategorized_count=uncategorized,
+    )
+
+
+# ===================================
+# 4. TICKETS POR CLIENTE (solo ADMIN)
+# ===================================
+
+@router.get("/by-client", response_model=ClientReportResponse)
+async def get_report_by_client(
+    days: int = Query(default=30, ge=1, le=365),
+    db: AsyncSession = Depends(get_db),
+    current_user: User = Depends(require_admin),
+):
+    """
+    Tickets agrupados por cliente (tenant). Solo accesible por ADMIN.
+    Útil para ver qué clientes generan más trabajo.
+    """
+    period_start, period_end = _period_dates(days)
+
+    tenants_result = await db.execute(select(Tenant).where(Tenant.status == TenantStatus.ACTIVE))
+    tenants = tenants_result.scalars().all()
+
+    rows: List[ClientReportRow] = []
+
+    for tenant in tenants:
+        t_filter = and_(
+            Ticket.tenant_id == tenant.id,
+            Ticket.created_at >= period_start,
+        )
+
+        total = (await db.execute(
+            select(func.count(Ticket.id)).where(t_filter)
+        )).scalar_one_or_none() or 0
+
+        if total == 0:
+            continue
+
+        resolved = (await db.execute(
+            select(func.count(Ticket.id)).where(
+                and_(t_filter, Ticket.status.in_([TicketStatus.RESOLVED, TicketStatus.CLOSED]))
+            )
+        )).scalar_one_or_none() or 0
+
+        urgent = (await db.execute(
+            select(func.count(Ticket.id)).where(
+                and_(t_filter, Ticket.priority == TicketPriority.URGENT)
+            )
+        )).scalar_one_or_none() or 0
+
+        csat_row = (await db.execute(
+            select(func.avg(Ticket.rating))
+            .where(and_(t_filter, Ticket.rating.isnot(None)))
+        )).scalar_one_or_none()
+
+        avg_res_seconds = (await db.execute(
+            select(func.avg(func.extract("epoch", Ticket.resolved_at - Ticket.created_at)))
+            .where(and_(t_filter, Ticket.resolved_at.isnot(None)))
+        )).scalar_one_or_none()
+
+        last_ticket = (await db.execute(
+            select(func.max(Ticket.created_at)).where(t_filter)
+        )).scalar_one_or_none()
+
+        rows.append(ClientReportRow(
+            tenant_id=str(tenant.id),
+            tenant_name=tenant.name,
+            total_tickets=total,
+            open_tickets=total - resolved,
+            resolved_tickets=resolved,
+            urgent_tickets=urgent,
+            avg_resolution_hours=round(float(avg_res_seconds) / 3600, 2) if avg_res_seconds else None,
+            avg_rating=round(float(csat_row), 2) if csat_row else None,
+            last_ticket_at=last_ticket,
+        ))
+
+    rows.sort(key=lambda r: r.total_tickets, reverse=True)
+
+    return ClientReportResponse(
+        period_start=period_start,
+        period_end=period_end,
+        generated_at=datetime.now(timezone.utc),
+        clients=rows,
+        total_clients=len(rows),
+    )
+
+
+# ===================================
+# 5. TENDENCIAS (TICKETS EN EL TIEMPO)
+# ===================================
+
+@router.get("/trends", response_model=TrendsReportResponse)
+async def get_report_trends(
+    days: int = Query(default=30, ge=7, le=90, description="Número de días (7-90)"),
+    db: AsyncSession = Depends(get_db),
+    current_user: User = Depends(require_reports_access),
+):
+    """
+    Evolución diaria de tickets creados y resueltos.
+    Útil para detectar picos de trabajo.
+    """
+    period_start, period_end = _period_dates(days)
+    tenant_filter = Ticket.tenant_id == current_user.tenant_id
+
+    # Tickets creados por día
+    created_rows = (await db.execute(
+        select(
+            func.date_trunc("day", Ticket.created_at).label("day"),
+            func.count(Ticket.id).label("cnt"),
+        )
+        .where(and_(tenant_filter, Ticket.created_at >= period_start))
+        .group_by(func.date_trunc("day", Ticket.created_at))
+        .order_by(func.date_trunc("day", Ticket.created_at))
+    )).all()
+
+    # Tickets resueltos por día (según resolved_at)
+    resolved_rows = (await db.execute(
+        select(
+            func.date_trunc("day", Ticket.resolved_at).label("day"),
+            func.count(Ticket.id).label("cnt"),
+        )
+        .where(and_(
+            tenant_filter,
+            Ticket.resolved_at >= period_start,
+            Ticket.resolved_at.isnot(None),
+        ))
+        .group_by(func.date_trunc("day", Ticket.resolved_at))
+        .order_by(func.date_trunc("day", Ticket.resolved_at))
+    )).all()
+
+    created_map: dict[str, int] = {r.day.strftime("%Y-%m-%d"): r.cnt for r in created_rows}
+    resolved_map: dict[str, int] = {r.day.strftime("%Y-%m-%d"): r.cnt for r in resolved_rows}
+
+    # Un punto por cada día del período
+    data_points: List[TrendDataPoint] = []
+    current = period_start
+    while current <= period_end:
+        date_str = current.strftime("%Y-%m-%d")
+        c = created_map.get(date_str, 0)
+        r = resolved_map.get(date_str, 0)
+        data_points.append(TrendDataPoint(date=date_str, created=c, resolved=r, net_open=c - r))
+        current += timedelta(days=1)
+
+    return TrendsReportResponse(
+        period_start=period_start,
+        period_end=period_end,
+        generated_at=datetime.now(timezone.utc),
+        data_points=data_points,
+        total_days=len(data_points),
+    )
+
+
+# ===================================
+# 6. SATISFACCIÓN DEL CLIENTE (CSAT)
+# ===================================
+
+@router.get("/csat", response_model=CSATReportResponse)
+async def get_report_csat(
+    days: int = Query(default=30, ge=1, le=365),
+    db: AsyncSession = Depends(get_db),
+    current_user: User = Depends(require_reports_access),
+):
+    """
+    Reporte de satisfacción del cliente (calificaciones 1-5).
+    Incluye distribución, promedio por categoría y por agente.
+    """
+    period_start, period_end = _period_dates(days)
+    tenant_filter = and_(
+        Ticket.tenant_id == current_user.tenant_id,
+        Ticket.created_at >= period_start,
+    )
+
+    # Total y promedio general
+    general = (await db.execute(
+        select(func.avg(Ticket.rating).label("avg"), func.count(Ticket.rating).label("rated"))
+        .where(and_(tenant_filter, Ticket.rating.isnot(None)))
+    )).one()
+    total_tickets = (await db.execute(
+        select(func.count(Ticket.id)).where(tenant_filter)
+    )).scalar_one_or_none() or 0
+
+    # Distribución por estrellas
+    dist_rows = (await db.execute(
+        select(Ticket.rating, func.count(Ticket.id).label("cnt"))
+        .where(and_(tenant_filter, Ticket.rating.isnot(None)))
+        .group_by(Ticket.rating)
+    )).all()
+
+    dist = CSATDistribution()
+    for row in dist_rows:
+        setattr(dist, f"rating_{row.rating}", row.cnt)
+
+    # Promedio por categoría
+    cat_rows = (await db.execute(
+        select(
+            Category.name.label("cat_name"),
+            func.avg(Ticket.rating).label("avg"),
+            func.count(Ticket.rating).label("cnt"),
+        )
+        .join(Category, Ticket.category_id == Category.id, isouter=True)
+        .where(and_(tenant_filter, Ticket.rating.isnot(None)))
+        .group_by(Category.name)
+        .order_by(func.avg(Ticket.rating).desc())
+    )).all()
+
+    by_category = [
+        {
+            "category": row.cat_name or "Sin categoría",
+            "avg_rating": round(float(row.avg), 2) if row.avg else None,
+            "total_rated": row.cnt,
+        }
+        for row in cat_rows
+    ]
+
+    # Promedio por agente
+    agent_rows = (await db.execute(
+        select(
+            User.first_name.label("fname"),
+            User.last_name.label("lname"),
+            func.avg(Ticket.rating).label("avg"),
+            func.count(Ticket.rating).label("cnt"),
+        )
+        .join(User, Ticket.assigned_to == User.id, isouter=True)
+        .where(and_(tenant_filter, Ticket.rating.isnot(None)))
+        .group_by(User.first_name, User.last_name)
+        .order_by(func.avg(Ticket.rating).desc())
+    )).all()
+
+    by_agent = [
+        {
+            "agent": f"{row.fname or ''} {row.lname or ''}".strip() or "Sin asignar",
+            "avg_rating": round(float(row.avg), 2) if row.avg else None,
+            "total_rated": row.cnt,
+        }
+        for row in agent_rows
+    ]
+
+    # Últimos comentarios de calificación (rating_comment)
+    comment_rows = (await db.execute(
+        select(Ticket.rating, Ticket.rating_comment, Ticket.rated_at)
+        .where(and_(
+            tenant_filter,
+            Ticket.rating.isnot(None),
+            Ticket.rating_comment.isnot(None),
+            Ticket.rating_comment != "",
+        ))
+        .order_by(Ticket.rated_at.desc())
+        .limit(10)
+    )).all()
+
+    recent_comments = [
+        {
+            "rating": row.rating,
+            "comment": row.rating_comment,
+            "rated_at": row.rated_at.isoformat() if row.rated_at else None,
+        }
+        for row in comment_rows
+    ]
+
+    total_rated = general.rated or 0
+    response_rate = round((total_rated / total_tickets * 100), 1) if total_tickets else 0.0
+
+    return CSATReportResponse(
+        period_start=period_start,
+        period_end=period_end,
+        generated_at=datetime.now(timezone.utc),
+        avg_rating=round(float(general.avg), 2) if general.avg else None,
+        total_rated=total_rated,
+        total_tickets=total_tickets,
+        response_rate=response_rate,
+        distribution=dist,
+        by_category=by_category,
+        by_agent=by_agent,
+        recent_comments=recent_comments,
+    )
+
+
+# ===================================
+# 7. TICKETS POR SISTEMA AFECTADO
+# ===================================
+
+@router.get("/by-system", response_model=SystemReportResponse)
+async def get_report_by_system(
+    days: int = Query(default=30, ge=1, le=365),
+    db: AsyncSession = Depends(get_db),
+    current_user: User = Depends(require_reports_access),
+):
+    """
+    Tickets agrupados por sistema afectado.
+    Útil para detectar qué sistemas generan más incidentes.
+    """
+    period_start, period_end = _period_dates(days)
+    tenant_filter = and_(
+        Ticket.tenant_id == current_user.tenant_id,
+        Ticket.created_at >= period_start,
+    )
+
+    systems_result = await db.execute(
+        select(System).where(
+            and_(System.tenant_id == current_user.tenant_id, System.is_active == True)
+        )
+    )
+    systems = systems_result.scalars().all()
+
+    rows: List[SystemReportRow] = []
+
+    for sys in systems:
+        sys_filter = and_(tenant_filter, Ticket.affected_system_id == sys.id)
+
+        total = (await db.execute(
+            select(func.count(Ticket.id)).where(sys_filter)
+        )).scalar_one_or_none() or 0
+
+        if total == 0:
+            continue
+
+        resolved = (await db.execute(
+            select(func.count(Ticket.id)).where(
+                and_(sys_filter, Ticket.status.in_([TicketStatus.RESOLVED, TicketStatus.CLOSED]))
+            )
+        )).scalar_one_or_none() or 0
+
+        urgent = (await db.execute(
+            select(func.count(Ticket.id)).where(
+                and_(sys_filter, Ticket.priority == TicketPriority.URGENT)
+            )
+        )).scalar_one_or_none() or 0
+
+        avg_res_seconds = (await db.execute(
+            select(func.avg(func.extract("epoch", Ticket.resolved_at - Ticket.created_at)))
+            .where(and_(sys_filter, Ticket.resolved_at.isnot(None)))
+        )).scalar_one_or_none()
+
+        rows.append(SystemReportRow(
+            system_id=str(sys.id),
+            system_name=sys.name,
+            total_tickets=total,
+            open_tickets=total - resolved,
+            resolved_tickets=resolved,
+            urgent_tickets=urgent,
+            avg_resolution_hours=round(float(avg_res_seconds) / 3600, 2) if avg_res_seconds else None,
+        ))
+
+    # Sin sistema asignado
+    no_system = (await db.execute(
+        select(func.count(Ticket.id)).where(
+            and_(tenant_filter, Ticket.affected_system_id.is_(None))
+        )
+    )).scalar_one_or_none() or 0
+
+    rows.sort(key=lambda r: r.total_tickets, reverse=True)
+
+    return SystemReportResponse(
+        period_start=period_start,
+        period_end=period_end,
+        generated_at=datetime.now(timezone.utc),
+        systems=rows,
+        no_system_count=no_system,
+    )

backend/app/api/v1/endpoints/tickets.py

@@ -80,8 +80,15 @@ async def create_ticket(ticket: TicketCreate, db: AsyncSession = Depends(get_db)
                 "title": db_ticket.subject, "description": db_ticket.description, "status": db_ticket.status.value,
                 "priority": db_ticket.priority.value, "category_id": str(db_ticket.category_id) if db_ticket.category_id else None,
                 "affected_system_id": str(db_ticket.affected_system_id) if db_ticket.affected_system_id else None,
+                "system_id": str(db_ticket.affected_system_id) if db_ticket.affected_system_id else None,
+                "contact_email": ticket.contact_email,
+                "contact_phone": ticket.contact_phone,
                 "created_by": str(db_ticket.created_by), "assigned_to": str(db_ticket.assigned_to) if db_ticket.assigned_to else None,
-                "created_at": db_ticket.created_at, "updated_at": db_ticket.updated_at
+                "created_at": db_ticket.created_at, "updated_at": db_ticket.updated_at,
+                "sla_response_due": db_ticket.sla_response_due,
+                "sla_resolution_due": db_ticket.sla_resolution_due,
+                "first_response_at": db_ticket.first_response_at,
+                "resolved_at": db_ticket.resolved_at,
             }
             
         except ValueError as e:
@@ -111,35 +118,36 @@ async def get_tickets(skip: int = 0, limit: int = 100, status: Optional[str] = N
     
     query = apply_enum_filter(query, Ticket.status, status, TicketStatus, "status")
     query = apply_enum_filter(query, Ticket.priority, priority, TicketPriority, "priority")
+    query = query.options(
+        selectinload(Ticket.category),
+        selectinload(Ticket.affected_system),
+        selectinload(Ticket.assigned_to_user)
+    )
     query = query.order_by(Ticket.created_at.desc()).offset(skip).limit(limit)
     
     result = await db.execute(query)
     tickets = result.scalars().all()
     
-    return [
-        {"id": str(t.id), "ticket_number": t.ticket_number, "subject": t.subject, "title": t.subject,
-         "description": t.description, "status": t.status.value, "priority": t.priority.value,
-         "category_id": str(t.category_id) if t.category_id else None,
-         "affected_system_id": str(t.affected_system_id) if t.affected_system_id else None,
-         "created_by": str(t.created_by), "assigned_to": str(t.assigned_to) if t.assigned_to else None,
-         "created_at": t.created_at, "updated_at": t.updated_at, "sla_response_due": t.sla_response_due,
-         "sla_resolution_due": t.sla_resolution_due, "first_response_at": t.first_response_at, "resolved_at": t.resolved_at}
-        for t in tickets
-    ]
+    return [ticket_to_dict(t) for t in tickets]
 
 @router.get("/admin/all", response_model=List[dict])
 async def get_all_tickets_admin(skip: int = 0, limit: int = 100, status_filter: Optional[str] = None,
     priority_filter: Optional[str] = None, tenant_id_filter: Optional[str] = None, category_filter: Optional[str] = None,
     assigned_to_filter: Optional[str] = None, search: Optional[str] = None, date_from: Optional[str] = None,
     date_to: Optional[str] = None, db: AsyncSession = Depends(get_db), current_user: User = Depends(get_current_user)):
-    """Obtener todos los tickets de todos los tenants (solo para administradores)"""
+    """Obtener todos los tickets del tenant del administrador (ADMIN/SUPPORT_MANAGER)."""
     if current_user.role not in ["ADMIN", "SUPPORT_MANAGER"]:
         raise HTTPException(status_code=status.HTTP_403_FORBIDDEN, detail="No tienes permisos para acceder a esta función")
-    
+
     query = select(Ticket, Tenant, User).join(Tenant, Ticket.tenant_id == Tenant.id).join(User, Ticket.created_by == User.id)
-    
+
+    # SUPPORT_MANAGER solo ve su propio tenant.
+    # ADMIN ve todos los tenants (es el administrador de la plataforma).
+    if current_user.role == "SUPPORT_MANAGER":
+        query = query.where(Ticket.tenant_id == current_user.tenant_id)
+
     query = apply_enum_filter(query, Ticket.status, status_filter, TicketStatus, "status")
-    query = apply_enum_filter(query, Ticket.priority, priority_filter, TicketPriority, "priority")    
+    query = apply_enum_filter(query, Ticket.priority, priority_filter, TicketPriority, "priority")
     if tenant_id_filter:
         query = query.where(Ticket.tenant_id == validate_uuid_param(tenant_id_filter, "tenant ID"))
     if category_filter:
@@ -166,10 +174,20 @@ async def get_all_tickets_admin(skip: int = 0, limit: int = 100, status_filter:
     result = await db.execute(query)
     rows = result.all()
     
+    # Cargar categorías en un solo query para evitar N+1
+    category_ids = list({ticket.category_id for ticket, _, _ in rows if ticket.category_id})
+    categories_map = {}
+    if category_ids:
+        from app.models.category import Category as CategoryModel
+        cat_result = await db.execute(select(CategoryModel).where(CategoryModel.id.in_(category_ids)))
+        categories_map = {c.id: c.name for c in cat_result.scalars().all()}
+
     return [
         {"id": str(ticket.id), "ticket_number": ticket.ticket_number, "subject": ticket.subject,
          "description": ticket.description, "status": ticket.status.value, "priority": ticket.priority.value,
          "tenant_id": str(ticket.tenant_id), "tenant_name": tenant.name, "tenant_slug": tenant.slug,
+         "category_id": str(ticket.category_id) if ticket.category_id else None,
+         "category_name": categories_map.get(ticket.category_id) if ticket.category_id else None,
          "created_by": str(ticket.created_by), "creator_name": f"{creator.first_name} {creator.last_name}",
          "creator_email": creator.email, "assigned_to": str(ticket.assigned_to) if ticket.assigned_to else None,
          "created_at": ticket.created_at, "updated_at": ticket.updated_at, "sla_response_due": ticket.sla_response_due,
@@ -358,6 +376,9 @@ async def get_ticket_attachments(ticket_id: str, db: AsyncSession = Depends(get_
     
     if not ticket:
         raise HTTPException(status_code=404, detail="Ticket no encontrado")
+
+    if current_user.role in ["CLIENT_USER", "CLIENT_ADMIN"] and ticket.created_by != current_user.id:
+        raise HTTPException(status_code=404, detail="Ticket no encontrado")
     
     result = await db.execute(select(TicketAttachment).where(TicketAttachment.ticket_id == ticket_uuid).options(selectinload(TicketAttachment.uploaded_by_user)).order_by(TicketAttachment.created_at.desc()))
     attachments = result.scalars().all()
@@ -382,6 +403,9 @@ async def upload_attachment(ticket_id: str, file: UploadFile = File(...), db: As
     
     if not ticket:
         raise HTTPException(status_code=404, detail="Ticket no encontrado")
+
+    if current_user.role in ["CLIENT_USER", "CLIENT_ADMIN"] and ticket.created_by != current_user.id:
+        raise HTTPException(status_code=404, detail="Ticket no encontrado")
     
     file_metadata = await file_handler.save_upload(file, current_tenant.id, ticket_uuid)
     
@@ -425,6 +449,9 @@ async def download_attachment(ticket_id: str, attachment_id: str, db: AsyncSessi
     if not ticket:
         logger.error(f"Ticket not found - ticket_id: {ticket_id}")
         raise HTTPException(status_code=404, detail="Ticket no encontrado")
+
+    if current_user.role in ["CLIENT_USER", "CLIENT_ADMIN"] and ticket.created_by != current_user.id:
+        raise HTTPException(status_code=404, detail="Ticket no encontrado")
     
     result = await db.execute(select(TicketAttachment).where(TicketAttachment.id == attachment_uuid, TicketAttachment.ticket_id == ticket_uuid))
     attachment = result.scalar_one_or_none()

backend/app/api/v1/endpoints/users.py

@@ -19,6 +19,14 @@ router = APIRouter()
 # ENDPOINTS
 # ===================================
 
+
+@router.get("/me", response_model=UserResponse)
+async def read_current_user(
+    current_user: User = Depends(deps.get_current_user),
+):
+    """Obtener el perfil del usuario actual."""
+    return current_user
+
 @router.get("/", response_model=List[UserResponse])
 async def read_users(
     skip: int = 0, 

backend/app/api/v1/helpers.py

@@ -100,7 +100,10 @@ def ticket_to_dict(ticket: Ticket) -> dict:
         "category_id": str(ticket.category_id) if ticket.category_id else None,
         "category_name": ticket.category.name if ticket.category else None,
         "affected_system_id": str(ticket.affected_system_id) if ticket.affected_system_id else None,
+        "system_id": str(ticket.affected_system_id) if ticket.affected_system_id else None,
         "affected_system_name": ticket.affected_system.name if ticket.affected_system else None,
+        "contact_email": None,
+        "contact_phone": None,
         "created_by": str(ticket.created_by),
         "assigned_to": str(ticket.assigned_to) if ticket.assigned_to else None,
         "assigned_to_name": f"{ticket.assigned_to_user.first_name} {ticket.assigned_to_user.last_name}" if ticket.assigned_to_user else None,

backend/app/api/v1/router.py

@@ -6,7 +6,7 @@ Router principal para la API v1
 
 from fastapi import APIRouter
 
-from app.api.v1.endpoints import auth, health, tenants, users, systems, categories, tickets, client_profile, audit, sla
+from app.api.v1.endpoints import auth, health, tenants, users, systems, categories, tickets, client_profile, audit, sla, reports
 
 api_router = APIRouter()
 
@@ -73,4 +73,11 @@ api_router.include_router(
     sla.router,
     prefix="/sla",
     tags=["sla"]
+)
+
+# Reports routes
+api_router.include_router(
+    reports.router,
+    prefix="/reports",
+    tags=["reports"]
 )

backend/app/core/config.py

@@ -24,6 +24,7 @@ class Settings(BaseSettings):
     # GENERAL
     # ===================================
     ENVIRONMENT: str = Field(default="development")
+    TESTING: bool = Field(default=False)
     DEBUG: bool = Field(default=False)
     SECRET_KEY: str = Field(...)
     API_VERSION: str = Field(default="v1")
@@ -86,6 +87,9 @@ class Settings(BaseSettings):
     # SECURITY
     # ===================================
     RATE_LIMIT_ENABLED: bool = Field(default=True)
+    LOGIN_RATE_LIMIT_WINDOW_SECONDS: int = Field(default=300)
+    LOGIN_RATE_LIMIT_IP_MAX_ATTEMPTS: int = Field(default=30)
+    LOGIN_RATE_LIMIT_ID_MAX_ATTEMPTS: int = Field(default=10)
     PASSWORD_MIN_LENGTH: int = Field(default=8)
     
     # Argon2 settings

backend/app/core/database.py

@@ -6,7 +6,9 @@ SQLAlchemy 2.0 async setup con PostgreSQL
 
 from sqlalchemy.ext.asyncio import create_async_engine, AsyncSession, async_sessionmaker
 from sqlalchemy.orm import DeclarativeBase, Mapped, mapped_column
-from sqlalchemy import String, DateTime, func
+from sqlalchemy import String, DateTime, func, text
+from sqlalchemy.types import TypeDecorator, CHAR
+from sqlalchemy.dialects.postgresql import UUID as PG_UUID
 from typing import AsyncGenerator
 import uuid
 from datetime import datetime
@@ -34,18 +36,46 @@ AsyncSessionLocal = async_sessionmaker(
     autoflush=True,
     autocommit=False
 )
+class GUID(TypeDecorator):
+    """UUID portable: UUID nativo en Postgres, CHAR(36) en otros dialectos (SQLite para tests)."""
+
+    impl = CHAR
+    cache_ok = True
+
+    def load_dialect_impl(self, dialect):
+        if dialect.name == "postgresql":
+            return dialect.type_descriptor(PG_UUID(as_uuid=True))
+        return dialect.type_descriptor(CHAR(36))
+
+    def process_bind_param(self, value, dialect):
+        if value is None:
+            return None
+
+        if dialect.name == "postgresql":
+            return value
+
+        if isinstance(value, uuid.UUID):
+            return str(value)
+        return str(uuid.UUID(str(value)))
+
+    def process_result_value(self, value, dialect):
+        if value is None:
+            return None
+        if isinstance(value, uuid.UUID):
+            return value
+        return uuid.UUID(str(value))
 
 
 class Base(DeclarativeBase):
     """Base class para todos los modelos SQLAlchemy."""
-    
+
     # Columnas comunes para auditoría
-    id: Mapped[uuid.UUID] = mapped_column(primary_key=True, default=uuid.uuid4)
+    id: Mapped[uuid.UUID] = mapped_column(GUID(), primary_key=True, default=uuid.uuid4)
     created_at: Mapped[datetime] = mapped_column(DateTime(timezone=True), server_default=func.now())
     updated_at: Mapped[datetime] = mapped_column(
-        DateTime(timezone=True), 
+        DateTime(timezone=True),
         server_default=func.now(),
-        onupdate=func.now()
+        onupdate=func.now(),
     )
 
 
@@ -89,7 +119,7 @@ async def check_database_health() -> bool:
     """
     try:
         async with AsyncSessionLocal() as session:
-            await session.execute("SELECT 1")
+            await session.execute(text("SELECT 1"))
             return True
     except Exception:
         return False

backend/app/core/file_handler.py

@@ -16,6 +16,8 @@ settings = get_settings()
 
 class FileHandler:
     """Handler simple para archivos adjuntos"""
+
+    _CHUNK_SIZE_BYTES = 1024 * 1024  # 1MB
     
     def __init__(self):
         self.upload_path = Path(settings.UPLOAD_PATH)
@@ -24,8 +26,8 @@ class FileHandler:
         # Crear directorio si no existe
         self.upload_path.mkdir(parents=True, exist_ok=True)
     
-    def _validate_file(self, filename: str, file_size: int) -> None:
-        """Validar archivo"""
+    def _validate_extension(self, filename: str) -> str:
+        """Validar extensión del archivo y retornarla."""
         extension = Path(filename).suffix.lower().lstrip('.')
         
         if extension not in self.allowed_extensions:
@@ -33,32 +35,52 @@ class FileHandler:
                 status_code=status.HTTP_400_BAD_REQUEST,
                 detail=f"Extensión no permitida: {extension}"
             )
-        
-        if file_size > self.max_size_bytes:
+
+        return extension
+
+    def _validate_magic_bytes(self, extension: str, first_bytes: bytes) -> None:
+        """Validación básica por firma (magic bytes) para tipos comunes."""
+
+        signatures = {
+            # PDFs start with %PDF-
+            "pdf": [b"%PDF-"],
+            # PNG signature
+            "png": [b"\x89PNG\r\n\x1a\n"],
+            # JPEG starts with FF D8 FF
+            "jpg": [b"\xff\xd8\xff"],
+            "jpeg": [b"\xff\xd8\xff"],
+            # Legacy MS Office (OLE Compound File)
+            "doc": [b"\xd0\xcf\x11\xe0\xa1\xb1\x1a\xe1"],
+            "xls": [b"\xd0\xcf\x11\xe0\xa1\xb1\x1a\xe1"],
+            # OOXML (zip-based)
+            "docx": [b"PK\x03\x04", b"PK\x05\x06", b"PK\x07\x08"],
+            "xlsx": [b"PK\x03\x04", b"PK\x05\x06", b"PK\x07\x08"],
+        }
+
+        # For plain text, we can't reliably validate via magic bytes.
+        if extension == "txt":
+            return
+
+        allowed = signatures.get(extension)
+        if not allowed:
+            return
+
+        if not any(first_bytes.startswith(sig) for sig in allowed):
             raise HTTPException(
-                status_code=status.HTTP_413_REQUEST_ENTITY_TOO_LARGE,
-                detail=f"Archivo muy grande. Máximo: {settings.MAX_UPLOAD_SIZE_MB}MB"
+                status_code=status.HTTP_400_BAD_REQUEST,
+                detail="Contenido de archivo no coincide con la extensión declarada",
             )
     
-    def _calculate_checksums(self, content: bytes) -> Tuple[str, str]:
-        """Calcular MD5 y SHA256"""
-        return hashlib.md5(content).hexdigest(), hashlib.sha256(content).hexdigest()
-    
     async def save_upload(self, file: UploadFile, tenant_id: uuid.UUID, ticket_id: uuid.UUID) -> dict:
         """Guardar archivo y retornar metadata"""
         if not file.filename:
             raise HTTPException(status_code=400, detail="Filename requerido")
-        
-        content = await file.read()
-        file_size = len(content)
-        
-        self._validate_file(file.filename, file_size)
-        
-        md5_hash, sha256_hash = self._calculate_checksums(content)
-        
+
+        extension = self._validate_extension(file.filename)
+
         # Nombre único
-        extension = Path(file.filename).suffix.lower()
-        safe_filename = f"{uuid.uuid4().hex}{extension}"
+        original_extension = Path(file.filename).suffix.lower()
+        safe_filename = f"{uuid.uuid4().hex}{original_extension}"
         
         # Estructura: uploads/tenant_id/tickets/ticket_id/
         file_directory = self.upload_path / str(tenant_id) / "tickets" / str(ticket_id)
@@ -66,10 +88,61 @@ class FileHandler:
         
         file_path = file_directory / safe_filename
         relative_path = str(file_path.relative_to(self.upload_path))
-        
-        # Guardar archivo
-        with open(file_path, "wb") as f:
-            f.write(content)
+
+        # Guardar archivo (streaming) + checksums incrementales
+        md5 = hashlib.md5()
+        sha256 = hashlib.sha256()
+        file_size = 0
+        validated_magic = False
+        first_bytes: bytes = b""
+
+        try:
+            with open(file_path, "wb") as f:
+                while True:
+                    chunk = await file.read(self._CHUNK_SIZE_BYTES)
+                    if not chunk:
+                        break
+
+                    if not validated_magic:
+                        first_bytes = chunk[:16]
+                        self._validate_magic_bytes(extension, first_bytes)
+                        validated_magic = True
+
+                    file_size += len(chunk)
+                    if file_size > self.max_size_bytes:
+                        raise HTTPException(
+                            status_code=status.HTTP_413_REQUEST_ENTITY_TOO_LARGE,
+                            detail=f"Archivo muy grande. Máximo: {settings.MAX_UPLOAD_SIZE_MB}MB",
+                        )
+
+                    md5.update(chunk)
+                    sha256.update(chunk)
+                    f.write(chunk)
+
+            if file_size == 0:
+                raise HTTPException(
+                    status_code=status.HTTP_400_BAD_REQUEST,
+                    detail="Archivo vacío",
+                )
+
+        except HTTPException:
+            # Eliminar archivo parcial si existe
+            try:
+                if file_path.exists():
+                    file_path.unlink()
+            except Exception:
+                pass
+            raise
+        except Exception as exc:
+            try:
+                if file_path.exists():
+                    file_path.unlink()
+            except Exception:
+                pass
+            raise HTTPException(
+                status_code=status.HTTP_500_INTERNAL_SERVER_ERROR,
+                detail=f"Error guardando archivo: {exc}",
+            )
         
         import mimetypes
         mime_type = mimetypes.guess_type(file.filename)[0] or "application/octet-stream"
@@ -80,8 +153,8 @@ class FileHandler:
             "file_path": relative_path,
             "file_size": file_size,
             "mime_type": mime_type,
-            "md5_hash": md5_hash,
-            "sha256_hash": sha256_hash
+            "md5_hash": md5.hexdigest(),
+            "sha256_hash": sha256.hexdigest(),
         }
     
     def get_file_path(self, relative_path: str) -> Path:

backend/app/core/security.py

@@ -13,6 +13,7 @@ import pyotp
 import secrets
 import base64
 import struct
+import uuid
 
 from app.core.config import get_settings
 
@@ -100,7 +101,8 @@ class SecurityUtils:
         """
         to_encode = data.copy()
         expire = datetime.utcnow() + timedelta(days=settings.REFRESH_TOKEN_EXPIRE_DAYS)
-        to_encode.update({"exp": expire, "type": "refresh"})
+        # Add a unique identifier so refresh tokens are never deterministic.
+        to_encode.update({"exp": expire, "type": "refresh", "jti": str(uuid.uuid4())})
         
         encoded_jwt = jwt.encode(
             to_encode,

backend/app/main.py

@@ -76,12 +76,26 @@ app = FastAPI(
 
 # CORS
 cors_origins = settings.CORS_ORIGINS.split(",") if isinstance(settings.CORS_ORIGINS, str) else settings.CORS_ORIGINS
+
+if settings.is_production():
+    cors_allow_methods = ["GET", "POST", "PUT", "PATCH", "DELETE", "OPTIONS"]
+    cors_allow_headers = [
+        "Authorization",
+        "Content-Type",
+        "X-Tenant-ID",
+        "X-Tenant-Slug",
+        "X-Correlation-ID",
+    ]
+else:
+    cors_allow_methods = ["*"]
+    cors_allow_headers = ["*"]
+
 app.add_middleware(
     CORSMiddleware,
     allow_origins=cors_origins,
     allow_credentials=True,
-    allow_methods=["*"],
-    allow_headers=["*"],
+    allow_methods=cors_allow_methods,
+    allow_headers=cors_allow_headers,
 )
 
 # Compression

backend/app/middleware/tenant.py

@@ -9,8 +9,9 @@ from starlette.requests import Request
 from starlette.responses import Response, JSONResponse
 from sqlalchemy import select
 import structlog
+import uuid
 
-from app.core.database import AsyncSessionLocal
+from app.core.database import AsyncSessionLocal, get_db
 from app.core.config import get_settings
 from app.models.tenant import Tenant, TenantStatus
 
@@ -30,11 +31,17 @@ class TenantMiddleware(BaseHTTPMiddleware):
     # Rutas que no requieren tenant
     EXCLUDED_PATHS = {
         "/health",
+        "/api/v1/health",
+        "/v1/health",
+        "/api/v1/health/detailed",
+        "/v1/health/detailed",
         "/",
         "/api/v1/auth/login",
         "/v1/auth/login",
         "/api/v1/auth/refresh",
         "/v1/auth/refresh",
+        "/api/v1/auth/logout",
+        "/v1/auth/logout",
         "/api/v1/auth/forgot-password",
         "/v1/auth/forgot-password",
         "/api/v1/auth/reset-password",
@@ -66,33 +73,58 @@ class TenantMiddleware(BaseHTTPMiddleware):
         tenant_id = request.headers.get("X-Tenant-ID")
         tenant_slug = request.headers.get("X-Tenant-Slug")
 
-        # Si no hay headers de tenant
-        if not tenant_id and not tenant_slug:
-            if settings.ENVIRONMENT == "production":
+        tenant_uuid: uuid.UUID | None = None
+        if tenant_id:
+            try:
+                tenant_uuid = uuid.UUID(tenant_id)
+            except ValueError:
                 return JSONResponse(
                     status_code=400,
-                    content={"detail": "Tenant information required (X-Tenant-ID or X-Tenant-Slug header)"}
+                    content={"detail": "Invalid X-Tenant-ID header (must be UUID)"},
                 )
-            # En desarrollo, continuar sin tenant con advertencia
-            logger.warning(
-                "Request without tenant information",
-                path=request.url.path,
-                method=request.method,
+
+        # Si no hay headers de tenant (requerido para aislamiento multi-tenant)
+        if not tenant_id and not tenant_slug:
+            return JSONResponse(
+                status_code=400,
+                content={"detail": "Tenant information required (X-Tenant-ID or X-Tenant-Slug header)"},
             )
-            return await call_next(request)
 
         # Validar tenant contra la base de datos
         try:
-            async with AsyncSessionLocal() as session:
-                if tenant_id:
-                    result = await session.execute(
-                        select(Tenant).where(Tenant.id == tenant_id)
-                    )
-                else:
-                    result = await session.execute(
-                        select(Tenant).where(Tenant.slug == tenant_slug)
-                    )
-                tenant = result.scalars().first()
+            # Prefer DB session coming from dependency overrides (tests) when available.
+            # Guard: in unit tests request.app may be a MagicMock, not a real FastAPI app.
+            dependency_overrides = getattr(request.app, "dependency_overrides", None)
+            override_get_db = None
+            if isinstance(dependency_overrides, dict):
+                override_get_db = dependency_overrides.get(get_db)
+
+            if override_get_db is not None:
+                agen = override_get_db()
+                session = await agen.__anext__()
+                try:
+                    if tenant_uuid is not None:
+                        result = await session.execute(
+                            select(Tenant).where(Tenant.id == tenant_uuid)
+                        )
+                    else:
+                        result = await session.execute(
+                            select(Tenant).where(Tenant.slug == tenant_slug)
+                        )
+                    tenant = result.scalars().first()
+                finally:
+                    await agen.aclose()
+            else:
+                async with AsyncSessionLocal() as session:
+                    if tenant_uuid is not None:
+                        result = await session.execute(
+                            select(Tenant).where(Tenant.id == tenant_uuid)
+                        )
+                    else:
+                        result = await session.execute(
+                            select(Tenant).where(Tenant.slug == tenant_slug)
+                        )
+                    tenant = result.scalars().first()
 
             if tenant is None:
                 logger.warning(

backend/app/models/attachment.py

@@ -3,12 +3,11 @@ Attachment Model - ServiceManagerWeb
 """
 from sqlalchemy import String, ForeignKey, Integer, DateTime, func
 from sqlalchemy.orm import Mapped, mapped_column, relationship
-from sqlalchemy.dialects.postgresql import UUID
 from typing import Optional, TYPE_CHECKING
 from datetime import datetime
 import uuid
 
-from app.core.database import Base
+from app.core.database import Base, GUID
 
 if TYPE_CHECKING:
     from app.models.ticket import Ticket
@@ -21,24 +20,24 @@ class TicketAttachment(Base):
     __tablename__ = "ticket_attachments"
     
     # Sobrescribir campos heredados de Base para que coincidan con la tabla real
-    id: Mapped[uuid.UUID] = mapped_column(UUID(as_uuid=True), primary_key=True, default=uuid.uuid4)
+    id: Mapped[uuid.UUID] = mapped_column(GUID(), primary_key=True, default=uuid.uuid4)
     created_at: Mapped[datetime] = mapped_column(DateTime(timezone=True), server_default=func.now())
     # Esta tabla NO tiene updated_at, así que lo excluimos del mapping
     
     ticket_id: Mapped[uuid.UUID] = mapped_column(
-        UUID(as_uuid=True),
+        GUID(),
         ForeignKey("tickets.id", ondelete="CASCADE"),
         nullable=False
     )
     
     comment_id: Mapped[Optional[uuid.UUID]] = mapped_column(
-        UUID(as_uuid=True),
+        GUID(),
         ForeignKey("ticket_comments.id", ondelete="CASCADE"),
         nullable=True
     )
     
     uploaded_by: Mapped[uuid.UUID] = mapped_column(
-        UUID(as_uuid=True),
+        GUID(),
         ForeignKey("users.id"),
         nullable=False
     )

backend/app/models/audit.py

@@ -1,18 +1,18 @@
 """
 Audit Log Model - ServiceManagerWeb
 
-Modelo para bitácora de auditoría y compliance.
+Modelo para bitácora de auditoría y compliance.
 Registra todas las acciones importantes del sistema.
 """
 
-from sqlalchemy import String, Text, DateTime, ForeignKey, Index
+from sqlalchemy import String, Text, DateTime, ForeignKey, Index, JSON
 from sqlalchemy.orm import Mapped, mapped_column, relationship
-from sqlalchemy.dialects.postgresql import UUID, INET, JSONB
+from sqlalchemy.dialects.postgresql import INET, JSONB
 from typing import Optional, Dict, Any, TYPE_CHECKING
 import uuid
-from datetime import datetime
+from datetime import datetime, timezone
 
-from app.core.database import Base
+from app.core.database import Base, GUID
 
 if TYPE_CHECKING:
     from app.models.tenant import Tenant
@@ -21,128 +21,154 @@ if TYPE_CHECKING:
 
 class AuditLog(Base):
     """
-    Bitácora de auditoría para tracking completo de acciones.
-    
+    Bitácora de auditoría para tracking completo de acciones.
+
     Registra:
-    - Qui├®n hizo la acci├│n (user_id)
-    - Qu├® hizo (action)
-    - Sobre qu├® recurso (resource_type + resource_id)
-    - Cuándo lo hizo (created_at)
-    - Desde d├│nde (ip_address, user_agent)
-    - Qu├® cambi├│ (old_values, new_values)
+    - Quién hizo la acción (user_id)
+    - Qué hizo (action)
+    - Sobre qué recurso (resource_type + resource_id)
+    - Cuándo lo hizo (created_at)
+    - Desde dónde (ip_address, user_agent)
+    - Qué cambió (old_values, new_values)
     """
-    
+
     __tablename__ = "audit_logs"
-    
-    # Multi-tenancy
+
+    # Multi-tenancy: cada registro pertenece a un tenant específico
     tenant_id: Mapped[uuid.UUID] = mapped_column(
-        UUID(as_uuid=True),
+        GUID(),
         ForeignKey("tenants.id", ondelete="CASCADE"),
         nullable=False,
         index=True
     )
-    
-    # Usuario que ejecut├│ la acci├│n (NULL = acci├│n del sistema)
+
+    # Usuario que ejecutó la acción (NULL = acción del sistema)
     user_id: Mapped[Optional[uuid.UUID]] = mapped_column(
-        UUID(as_uuid=True),
+        GUID(),
         ForeignKey("users.id", ondelete="SET NULL"),
         nullable=True,
         index=True
     )
-    
-    # Acci├│n realizada (ej: "user.login", "ticket.create", "ticket.assign")
+
+    # Acción realizada en formato "recurso.verbo"
+    # Ejemplos: "user.login", "ticket.create", "ticket.assign"
     action: Mapped[str] = mapped_column(
         String(100),
         nullable=False,
         index=True
     )
-    
+
     # Tipo de recurso afectado (user, ticket, comment, category, etc.)
     resource_type: Mapped[str] = mapped_column(
         String(50),
         nullable=False,
         index=True
     )
-    
+
     # ID del recurso afectado
     resource_id: Mapped[Optional[uuid.UUID]] = mapped_column(
-        UUID(as_uuid=True),
+        GUID(),
         nullable=True
     )
-    
-    # Contexto de la request
-    ip_address: Mapped[Optional[str]] = mapped_column(INET, nullable=True)
+
+    # Contexto de la request: IP y navegador del usuario
+    ip_address: Mapped[Optional[str]] = mapped_column(
+        String(45).with_variant(INET, "postgresql"),
+        nullable=True,
+    )
     user_agent: Mapped[Optional[str]] = mapped_column(Text, nullable=True)
-    
-    # Correlation ID para rastrear requests relacionadas
+
+    # Correlation ID para rastrear todas las requests relacionadas
+    # en una misma operación o sesión
     correlation_id: Mapped[Optional[uuid.UUID]] = mapped_column(
-        UUID(as_uuid=True),
+        GUID(),
         nullable=True,
         index=True
     )
-    
-    # Valores antes del cambio (JSON)
+
+    # Estado del recurso antes del cambio (para auditoría de cambios)
     old_values: Mapped[Optional[Dict[str, Any]]] = mapped_column(
-        JSONB,
+        JSON().with_variant(JSONB, "postgresql"),
         nullable=True
     )
-    
-    # Valores despu├®s del cambio (JSON)
+
+    # Estado del recurso después del cambio (para auditoría de cambios)
     new_values: Mapped[Optional[Dict[str, Any]]] = mapped_column(
-        JSONB,
+        JSON().with_variant(JSONB, "postgresql"),
         nullable=True
     )
-    
-    # Metadata adicional (cualquier info relevante)
-    # Nota: 'metadata' está reservado en SQLAlchemy, usamos 'extra_metadata'
+
+    # Metadata adicional con cualquier información relevante del contexto
+    # Nota: 'metadata' está reservado en SQLAlchemy, se usa 'extra_metadata'
+    # como nombre del atributo Python, pero la columna en BD se llama 'metadata'
     extra_metadata: Mapped[Optional[Dict[str, Any]]] = mapped_column(
-        'metadata',  # Nombre real de la columna en BD
-        JSONB,
+        'metadata',
+        JSON().with_variant(JSONB, "postgresql"),
         nullable=True
     )
-    
-    # Timestamp
+
+    # Timestamp de creación con timezone
+    # CORRECCIÓN: default=lambda: datetime.now(timezone.utc) genera un
+    # datetime aware en UTC, compatible con DateTime(timezone=True).
+    # El default anterior (datetime.utcnow) generaba datetimes naive,
+    # causando que los filtros de fecha fallaran silenciosamente porque
+    # SQLAlchemy no podía comparar aware vs naive correctamente.
     created_at: Mapped[datetime] = mapped_column(
         DateTime(timezone=True),
-        default=datetime.utcnow,
+        default=lambda: datetime.now(timezone.utc),
         nullable=False,
         index=True
     )
-    
-    # Relaciones
+
+    # Relaciones con otros modelos
     tenant: Mapped["Tenant"] = relationship("Tenant", foreign_keys=[tenant_id])
     user: Mapped[Optional["User"]] = relationship("User", foreign_keys=[user_id])
-    
-    # Índices compuestos para queries comunes
+
+    # Índices compuestos para optimizar las queries más frecuentes
     __table_args__ = (
+        # Filtrar logs por tenant y tipo de acción (uso más común)
         Index('idx_audit_logs_tenant_action', 'tenant_id', 'action'),
+        # Buscar el historial de un recurso específico
         Index('idx_audit_logs_resource', 'resource_type', 'resource_id'),
+        # Ver la actividad de un usuario ordenada por fecha
         Index('idx_audit_logs_user_created', 'user_id', 'created_at'),
     )
-    
-    # Configuraci├│n del mapper: excluir updated_at porque audit logs son inmutables
+
+    # Los audit logs son inmutables: nunca se actualizan, solo se crean
+    # Por eso se excluye updated_at del mapper
     __mapper_args__ = {
         "exclude_properties": ["updated_at"]
     }
-    
+
     def __repr__(self) -> str:
-        return f"<AuditLog(action='{self.action}', resource='{self.resource_type}:{self.resource_id}')>"
-    
+        return (
+            f"<AuditLog("
+            f"action='{self.action}', "
+            f"resource='{self.resource_type}:{self.resource_id}'"
+            f")>"
+        )
+
     @property
     def action_display(self) -> str:
-        """Formato amigable de la acci├│n."""
+        """
+        Formato legible de la acción para mostrar en la interfaz.
+
+        Convierte el formato interno "recurso.verbo" a texto descriptivo.
+        Ejemplo: "ticket.create" → "creó ticket"
+        """
         parts = self.action.split('.')
         if len(parts) == 2:
             resource, verb = parts
             verb_map = {
-                'create': 'cre├│',
-                'update': 'actualiz├│',
-                'delete': 'elimin├│',
-                'login': 'inici├│ sesi├│n',
-                'logout': 'cerr├│ sesi├│n',
-                'assign': 'asign├│',
-                'close': 'cerr├│',
-                'reopen': 'reabri├│'
+                'create': 'creó',
+                'update': 'actualizó',
+                'delete': 'eliminó',
+                'login': 'inició sesión',
+                'logout': 'cerró sesión',
+                'login_failed': 'intentó iniciar sesión',
+                'assign': 'asignó',
+                'close': 'cerró',
+                'reopen': 'reabrió'
             }
             return f"{verb_map.get(verb, verb)} {resource}"
-        return self.action
+        return self.action

backend/app/models/category.py

@@ -4,11 +4,10 @@ Categorías de tickets por tenant
 """
 from sqlalchemy import String, Text, Boolean, Integer, ForeignKey, UniqueConstraint
 from sqlalchemy.orm import Mapped, mapped_column, relationship
-from sqlalchemy.dialects.postgresql import UUID
 from typing import List, Optional
 import uuid
 
-from app.core.database import Base
+from app.core.database import Base, GUID
 
 class Category(Base):
     """Modelo de categorías de tickets (ticket_categories en BD)"""
@@ -21,7 +20,7 @@ class Category(Base):
     
     # ✅ CORREGIDO: tenant_id es obligatorio para multi-tenancy
     tenant_id: Mapped[uuid.UUID] = mapped_column(
-        UUID(as_uuid=True), 
+        GUID(),
         ForeignKey("tenants.id", ondelete="CASCADE"), 
         nullable=False  # ✅ Obligatorio
     )
@@ -31,7 +30,7 @@ class Category(Base):
     sla_response_hours: Mapped[int] = mapped_column(Integer, default=24, nullable=False)
     sla_resolution_hours: Mapped[int] = mapped_column(Integer, default=72, nullable=False)
     auto_assign_to: Mapped[Optional[uuid.UUID]] = mapped_column(
-        UUID(as_uuid=True), 
+        GUID(),
         ForeignKey("users.id"),
         nullable=True
     )

backend/app/models/client_profile.py

@@ -7,12 +7,11 @@ Almacena información detallada de la empresa cliente
 
 from sqlalchemy import String, Boolean, DateTime, ForeignKey, Text, Numeric
 from sqlalchemy.orm import Mapped, mapped_column, relationship
-from sqlalchemy.dialects.postgresql import UUID
 from typing import Optional, TYPE_CHECKING
 import uuid
 from datetime import datetime
 
-from app.core.database import Base
+from app.core.database import Base, GUID
 
 if TYPE_CHECKING:
     from app.models.tenant import Tenant
@@ -25,7 +24,7 @@ class ClientProfile(Base):
     
     # Relación con tenant (uno a uno)
     tenant_id: Mapped[uuid.UUID] = mapped_column(
-        UUID(as_uuid=True),
+        GUID(),
         ForeignKey("tenants.id", ondelete="CASCADE"),
         unique=True,
         nullable=False,

backend/app/models/comment.py

@@ -5,12 +5,11 @@ Modelo para comentarios en tickets
 """
 
 from sqlalchemy import Column, String, Text, Boolean, ForeignKey, DateTime
-from sqlalchemy.dialects.postgresql import UUID
 from sqlalchemy.orm import Mapped, mapped_column, relationship
 from datetime import datetime
 import uuid
 
-from app.core.database import Base
+from app.core.database import Base, GUID
 
 
 class TicketComment(Base):
@@ -20,20 +19,20 @@ class TicketComment(Base):
     
     # Columnas
     id: Mapped[uuid.UUID] = mapped_column(
-        UUID(as_uuid=True),
+        GUID(),
         primary_key=True,
         default=uuid.uuid4
     )
     
     ticket_id: Mapped[uuid.UUID] = mapped_column(
-        UUID(as_uuid=True),
+        GUID(),
         ForeignKey("tickets.id", ondelete="CASCADE"),
         nullable=False,
         index=True
     )
     
     author_id: Mapped[uuid.UUID] = mapped_column(
-        UUID(as_uuid=True),
+        GUID(),
         ForeignKey("users.id"),
         nullable=False,
         index=True

backend/app/models/refresh_token.py

@@ -6,12 +6,11 @@ Modelo para persistencia de refresh tokens con revocaci├│n y tracking.
 
 from sqlalchemy import String, Boolean, DateTime, ForeignKey, Index, Integer
 from sqlalchemy.orm import Mapped, mapped_column, relationship
-from sqlalchemy.dialects.postgresql import UUID
 from typing import Optional, TYPE_CHECKING
 import uuid
-from datetime import datetime
+from datetime import datetime, timezone
 
-from app.core.database import Base
+from app.core.database import Base, GUID
 
 if TYPE_CHECKING:
     from app.models.user import User
@@ -36,7 +35,7 @@ class RefreshToken(Base):
     
     # User relationship
     user_id: Mapped[uuid.UUID] = mapped_column(
-        UUID(as_uuid=True),
+        GUID(),
         ForeignKey("users.id", ondelete="CASCADE"),
         nullable=False,
         index=True
@@ -92,7 +91,7 @@ class RefreshToken(Base):
     )
     
     revoked_by: Mapped[Optional[uuid.UUID]] = mapped_column(
-        UUID(as_uuid=True),
+        GUID(),
         ForeignKey("users.id", ondelete="SET NULL"),
         nullable=True
     )
@@ -146,12 +145,12 @@ class RefreshToken(Base):
         - No está revocado
         - No ha expirado
         """
-        return not self.revoked and self.expires_at > datetime.utcnow()
+        return not self.revoked and self.expires_at > datetime.now(timezone.utc)
     
     @property
     def is_expired(self) -> bool:
         """Verificar si el token ha expirado."""
-        return datetime.utcnow() >= self.expires_at
+        return datetime.now(timezone.utc) >= self.expires_at
     
     def revoke(self, revoked_by: Optional[uuid.UUID] = None) -> None:
         """
@@ -161,11 +160,11 @@ class RefreshToken(Base):
             revoked_by: ID del usuario que revoc├│ el token
         """
         self.revoked = True
-        self.revoked_at = datetime.utcnow()
+        self.revoked_at = datetime.now(timezone.utc)
         if revoked_by:
             self.revoked_by = revoked_by
     
     def track_usage(self) -> None:
         """Registrar uso del token."""
-        self.last_used_at = datetime.utcnow()
+        self.last_used_at = datetime.now(timezone.utc)
         self.usage_count += 1

backend/app/models/system.py

@@ -4,11 +4,10 @@ Sistemas afectados por tenant
 """
 from sqlalchemy import String, Text, Boolean, ForeignKey, UniqueConstraint
 from sqlalchemy.orm import Mapped, mapped_column, relationship
-from sqlalchemy.dialects.postgresql import UUID
 from typing import List, Optional
 import uuid
 
-from app.core.database import Base
+from app.core.database import Base, GUID
 
 class System(Base):
     """Modelo de sistemas afectados (affected_systems en BD)"""
@@ -21,7 +20,7 @@ class System(Base):
     
     # ✅ AÑADIDO: tenant_id obligatorio para multi-tenancy (faltaba completamente)
     tenant_id: Mapped[uuid.UUID] = mapped_column(
-        UUID(as_uuid=True), 
+        GUID(),
         ForeignKey("tenants.id", ondelete="CASCADE"), 
         nullable=False
     )

backend/app/models/tenant.py

@@ -2,9 +2,9 @@
 Tenant Model - ServiceManagerWeb
 Modelo para organizaciones cliente (multi-tenancy)
 """
-from sqlalchemy import String, Integer, Text, Boolean, ARRAY
+from sqlalchemy import String, Integer, Text, Boolean, JSON
 from sqlalchemy.orm import Mapped, mapped_column, relationship
-from sqlalchemy.dialects.postgresql import UUID, ENUM
+from sqlalchemy.dialects.postgresql import UUID, ENUM, ARRAY as PG_ARRAY
 from typing import List, Optional
 import enum
 import uuid
@@ -40,7 +40,7 @@ class Tenant(Base):
     max_users: Mapped[int] = mapped_column(Integer, default=50)
     max_storage_mb: Mapped[int] = mapped_column(Integer, default=1024)
     allowed_file_types: Mapped[List[str]] = mapped_column(
-        ARRAY(String),
+        JSON().with_variant(PG_ARRAY(String), "postgresql"),
         default=["pdf", "jpg", "jpeg", "png", "doc", "docx", "xls", "xlsx", "txt"]
     )
     

backend/app/models/ticket.py

@@ -2,15 +2,20 @@
 Ticket Model - ServiceManagerWeb
 Tickets de soporte - Core del negocio
 """
-from sqlalchemy import String, ForeignKey, Text, Integer, CheckConstraint, UniqueConstraint
-from sqlalchemy.orm import Mapped, mapped_column, relationship
-from sqlalchemy.dialects.postgresql import UUID, ENUM
+from sqlalchemy import String, ForeignKey, Text, Integer, CheckConstraint, UniqueConstraint, Enum as SAEnum
+from sqlalchemy.orm import Mapped, mapped_column, relationship, synonym
+from sqlalchemy.dialects.postgresql import ENUM as PG_ENUM
 from typing import Optional
 from datetime import datetime
 import enum
 import uuid
 
-from app.core.database import Base
+from app.core.database import Base, GUID
+
+
+def _generate_fallback_ticket_number() -> str:
+    # Matches helper format "TK-000001" and stays within VARCHAR(20)
+    return f"TK-{(uuid.uuid4().int % 1_000_000):06d}"
 
 class TicketStatus(str, enum.Enum):
     """Estados posibles de un ticket"""
@@ -35,50 +40,64 @@ class Ticket(Base):
     
     # Multi-tenancy
     tenant_id: Mapped[uuid.UUID] = mapped_column(
-        UUID(as_uuid=True), 
+        GUID(),
         ForeignKey("tenants.id", ondelete="CASCADE"), 
         nullable=False
     )
     
     # Campos básicos
-    ticket_number: Mapped[str] = mapped_column(String(20), nullable=False)
+    ticket_number: Mapped[str] = mapped_column(
+        String(20),
+        nullable=False,
+        default=_generate_fallback_ticket_number,
+    )
     subject: Mapped[str] = mapped_column(String(255), nullable=False)
     description: Mapped[str] = mapped_column(Text, nullable=False)
+
+    # Compatibility aliases (API/UI/tests often use these names)
+    title = synonym("subject")
+    system_id = synonym("affected_system_id")
     
     # Estado y Prioridad
     status: Mapped[TicketStatus] = mapped_column(
-        ENUM(TicketStatus, name="ticket_status_enum", create_type=False), 
+        SAEnum(TicketStatus, name="ticket_status_enum", native_enum=False).with_variant(
+            PG_ENUM(TicketStatus, name="ticket_status_enum", create_type=True),
+            "postgresql",
+        ),
         default=TicketStatus.NEW,
         nullable=False
     )
     priority: Mapped[TicketPriority] = mapped_column(
-        ENUM(TicketPriority, name="ticket_priority_enum", create_type=False), 
+        SAEnum(TicketPriority, name="ticket_priority_enum", native_enum=False).with_variant(
+            PG_ENUM(TicketPriority, name="ticket_priority_enum", create_type=True),
+            "postgresql",
+        ),
         default=TicketPriority.MEDIUM,
         nullable=False
     )
     
     # ✅ CORREGIDO: Foreign Keys apuntan a tablas correctas
     created_by: Mapped[uuid.UUID] = mapped_column(
-        UUID(as_uuid=True), 
+        GUID(),
         ForeignKey("users.id"), 
         nullable=False
     )
     assigned_to: Mapped[Optional[uuid.UUID]] = mapped_column(
-        UUID(as_uuid=True), 
+        GUID(),
         ForeignKey("users.id"), 
         nullable=True
     )
     
     # ✅ CORREGIDO: Renombrado de system_id a affected_system_id
     affected_system_id: Mapped[Optional[uuid.UUID]] = mapped_column(
-        UUID(as_uuid=True), 
+        GUID(),
         ForeignKey("affected_systems.id"),  # ✅ Tabla correcta
         nullable=True
     )
     
     # ✅ CORREGIDO: Foreign key a tabla correcta
     category_id: Mapped[Optional[uuid.UUID]] = mapped_column(
-        UUID(as_uuid=True), 
+        GUID(),
         ForeignKey("ticket_categories.id"),  # ✅ Tabla correcta
         nullable=True
     )

backend/app/models/user.py

@@ -4,15 +4,15 @@ User Model - ServiceManagerWeb
 Modelo para usuarios del sistema (internos y clientes)
 """
 
-from sqlalchemy import String, Boolean, DateTime, ForeignKey, Text, ARRAY
+from sqlalchemy import String, Boolean, DateTime, ForeignKey, Text, JSON, Enum as SAEnum
 from sqlalchemy.orm import Mapped, mapped_column, relationship
-from sqlalchemy.dialects.postgresql import UUID, ENUM
+from sqlalchemy.dialects.postgresql import ENUM as PG_ENUM, ARRAY as PG_ARRAY
 from typing import Optional, List
 import enum
 import uuid
 from datetime import datetime
 
-from app.core.database import Base
+from app.core.database import Base, GUID
 
 
 class UserRole(str, enum.Enum):
@@ -35,7 +35,7 @@ class User(Base):
     
     # Relación con tenant
     tenant_id: Mapped[uuid.UUID] = mapped_column(
-        UUID(as_uuid=True),
+        GUID(),
         ForeignKey("tenants.id", ondelete="CASCADE"),
         nullable=False
     )
@@ -48,12 +48,20 @@ class User(Base):
     
     # Autenticación
     password_hash: Mapped[str] = mapped_column(String(255), nullable=False)
-    role: Mapped[UserRole] = mapped_column(ENUM(UserRole, name="user_role_enum"), nullable=False)
+    role: Mapped[UserRole] = mapped_column(
+        SAEnum(UserRole, name="user_role_enum", native_enum=False).with_variant(
+            PG_ENUM(UserRole, name="user_role_enum", create_type=True),
+            "postgresql",
+        ),
+        nullable=False,
+    )
     
     # 2FA (opcional para staff interno)
     totp_secret: Mapped[Optional[str]] = mapped_column(String(32))
     totp_enabled: Mapped[bool] = mapped_column(Boolean, default=False)
-    backup_codes: Mapped[Optional[List[str]]] = mapped_column(ARRAY(String))
+    backup_codes: Mapped[Optional[List[str]]] = mapped_column(
+        JSON().with_variant(PG_ARRAY(String), "postgresql")
+    )
     
     # Estado
     is_active: Mapped[bool] = mapped_column(Boolean, default=True)
@@ -85,11 +93,6 @@ class User(Base):
         cascade="all, delete-orphan"
     )
     
-    # Unique constraint por tenant
-    __table_args__ = (
-        {"postgresql_tablespace": "users"},
-    )
-    
     def __repr__(self) -> str:
         return f"<User(id={self.id}, email='{self.email}', role='{self.role}')>"
     

backend/app/services/token_service.py

@@ -6,7 +6,7 @@ Servicio para gesti├│n de refresh tokens persistentes.
 
 from sqlalchemy.ext.asyncio import AsyncSession
 from sqlalchemy import select, delete
-from datetime import datetime, timedelta
+from datetime import datetime, timedelta, timezone
 from typing import Optional
 import uuid
 import structlog
@@ -56,7 +56,7 @@ class TokenService:
             RefreshToken creado
         """
         # Calcular expiraci├│n
-        expires_at = datetime.utcnow() + timedelta(
+        expires_at = datetime.now(timezone.utc) + timedelta(
             days=settings.REFRESH_TOKEN_EXPIRE_DAYS
         )
         
@@ -232,7 +232,7 @@ class TokenService:
             N├║mero de tokens eliminados
         """
         # Eliminar tokens expirados hace más de 7 días
-        cutoff_date = datetime.utcnow() - timedelta(days=7)
+        cutoff_date = datetime.now(timezone.utc) - timedelta(days=7)
         
         query = delete(RefreshToken).where(
             RefreshToken.expires_at < cutoff_date

backend/pytest.ini

@@ -1,4 +1,4 @@
-[tool:pytest]
+[pytest]
 testpaths = tests tests/unit tests/integration
 python_files = test_*.py
 python_functions = test_*

backend/tests/conftest_integration.py

@@ -6,6 +6,7 @@ Fixtures y utilidades para tests de integración con BD real
 
 import pytest
 import asyncio
+import os
 from typing import AsyncGenerator, Generator
 from sqlalchemy.ext.asyncio import AsyncSession, create_async_engine, async_sessionmaker
 from sqlalchemy.pool import NullPool
@@ -21,8 +22,19 @@ from app.models.system import System
 from app.models.category import Category
 
 
-# Database URL para testing (usa la misma BD pero limpia después)
-TEST_DATABASE_URL = "postgresql+asyncpg://servicemanager:servicemanager123@localhost:5432/servicemanager_test"
+# Database URL para testing.
+# - En host/local: usa localhost
+# - En Docker: deriva de DATABASE_URL (normalmente apunta a host 'postgres')
+_DEFAULT_TEST_DATABASE_URL = "postgresql+asyncpg://servicemanager:servicemanager123@localhost:5432/servicemanager_test"
+_ENV_TEST_DATABASE_URL = os.getenv("TEST_DATABASE_URL")
+_ENV_DATABASE_URL = os.getenv("DATABASE_URL")
+
+if _ENV_TEST_DATABASE_URL:
+    TEST_DATABASE_URL = _ENV_TEST_DATABASE_URL
+elif _ENV_DATABASE_URL and "@postgres:" in _ENV_DATABASE_URL:
+    TEST_DATABASE_URL = _ENV_DATABASE_URL.rsplit("/", 1)[0] + "/servicemanager_test"
+else:
+    TEST_DATABASE_URL = _DEFAULT_TEST_DATABASE_URL
 
 
 @pytest.fixture(scope="session")
@@ -99,8 +111,8 @@ async def test_tenant(db_session: AsyncSession) -> Tenant:
         slug="test-company",
         domain="test.company.com",
         status=TenantStatus.ACTIVE,
-        email="admin@test.company.com",
-        phone="+1234567890"
+        contact_email="admin@test.company.com",
+        contact_phone="+1234567890",
     )
     db_session.add(tenant)
     await db_session.commit()
@@ -116,8 +128,8 @@ async def test_tenant_2(db_session: AsyncSession) -> Tenant:
         slug="test-company-2",
         domain="test2.company.com",
         status=TenantStatus.ACTIVE,
-        email="admin@test2.company.com",
-        phone="+9876543210"
+        contact_email="admin@test2.company.com",
+        contact_phone="+9876543210",
     )
     db_session.add(tenant)
     await db_session.commit()

backend/tests/integration/conftest.py

@@ -0,0 +1,289 @@
+"""Integration Test Configuration - ServiceManagerWeb
+
+Fixtures y utilidades para tests de integración con BD real.
+
+Este conftest vive dentro de tests/integration para que sus fixtures (client, db_session,
+test_tenant, tokens, etc.) apliquen solo a los tests de integración y no colisionen con
+los fixtures SQLite del conftest global.
+"""
+
+import os
+import pytest
+from typing import AsyncGenerator
+
+from sqlalchemy.ext.asyncio import AsyncSession, create_async_engine, async_sessionmaker
+from sqlalchemy.pool import NullPool
+from sqlalchemy import text
+from httpx import AsyncClient
+
+from app.main import app
+from app.core.database import Base, get_db
+from app.core.security import SecurityUtils
+from app.models.tenant import Tenant, TenantStatus
+from app.models.user import User, UserRole
+from app.models.system import System
+from app.models.category import Category
+
+
+_DEFAULT_TEST_DATABASE_URL = "postgresql+asyncpg://servicemanager:servicemanager123@localhost:5432/servicemanager_test"
+_ENV_TEST_DATABASE_URL = os.getenv("TEST_DATABASE_URL")
+_ENV_DATABASE_URL = os.getenv("DATABASE_URL")
+
+if _ENV_TEST_DATABASE_URL:
+    TEST_DATABASE_URL = _ENV_TEST_DATABASE_URL
+elif _ENV_DATABASE_URL and "@postgres:" in _ENV_DATABASE_URL:
+    TEST_DATABASE_URL = _ENV_DATABASE_URL.rsplit("/", 1)[0] + "/servicemanager_test"
+else:
+    TEST_DATABASE_URL = _DEFAULT_TEST_DATABASE_URL
+
+
+@pytest.fixture(scope="session")
+async def test_engine():
+    """Create test database engine."""
+    engine = create_async_engine(
+        TEST_DATABASE_URL,
+        echo=False,
+        poolclass=NullPool,
+    )
+
+    async with engine.begin() as conn:
+        await conn.run_sync(Base.metadata.create_all)
+
+    yield engine
+
+    async with engine.begin() as conn:
+        await conn.run_sync(Base.metadata.drop_all)
+
+    await engine.dispose()
+
+
+@pytest.fixture
+async def db_session(test_engine) -> AsyncGenerator[AsyncSession, None]:
+    """Create a fresh database session for each integration test."""
+    async_session = async_sessionmaker(
+        test_engine,
+        class_=AsyncSession,
+        expire_on_commit=False,
+    )
+
+    async with async_session() as session:
+        try:
+            yield session
+        finally:
+            # Rollback any open transaction
+            await session.rollback()
+
+            # Hard reset DB state for next test (tests commit, so rollback alone isn't enough)
+            table_names = [t.name for t in Base.metadata.sorted_tables]
+            if table_names:
+                quoted = ", ".join(f'"{name}"' for name in table_names)
+                await session.execute(text(f"TRUNCATE TABLE {quoted} RESTART IDENTITY CASCADE"))
+                await session.commit()
+
+
+@pytest.fixture
+async def client(db_session: AsyncSession) -> AsyncGenerator[AsyncClient, None]:
+    """Create test client with overridden database dependency."""
+
+    # Disable login rate limiting during integration tests to avoid flakiness
+    # (tests perform many logins quickly from the same IP).
+    import app.api.v1.endpoints.auth as auth_endpoint
+
+    old_rate_limit_enabled = getattr(auth_endpoint.settings, "RATE_LIMIT_ENABLED", None)
+    old_testing = getattr(auth_endpoint.settings, "TESTING", None)
+    auth_endpoint.settings.RATE_LIMIT_ENABLED = False
+    auth_endpoint.settings.TESTING = True
+
+    async def override_get_db():
+        yield db_session
+
+    app.dependency_overrides[get_db] = override_get_db
+
+    async with AsyncClient(app=app, base_url="http://test") as ac:
+        yield ac
+
+    app.dependency_overrides.clear()
+
+    # Restore settings
+    if old_rate_limit_enabled is not None:
+        auth_endpoint.settings.RATE_LIMIT_ENABLED = old_rate_limit_enabled
+    if old_testing is not None:
+        auth_endpoint.settings.TESTING = old_testing
+
+
+# ===================================
+# FIXTURES DE DATOS DE TEST
+# ===================================
+
+
+@pytest.fixture
+async def test_tenant(db_session: AsyncSession) -> Tenant:
+    tenant = Tenant(
+        name="Test Company",
+        slug="test-company",
+        domain="test.company.com",
+        status=TenantStatus.ACTIVE,
+        contact_email="admin@test.company.com",
+        contact_phone="+1234567890",
+    )
+    db_session.add(tenant)
+    await db_session.commit()
+    await db_session.refresh(tenant)
+    return tenant
+
+
+@pytest.fixture
+async def test_tenant_2(db_session: AsyncSession) -> Tenant:
+    tenant = Tenant(
+        name="Test Company 2",
+        slug="test-company-2",
+        domain="test2.company.com",
+        status=TenantStatus.ACTIVE,
+        contact_email="admin@test2.company.com",
+        contact_phone="+9876543210",
+    )
+    db_session.add(tenant)
+    await db_session.commit()
+    await db_session.refresh(tenant)
+    return tenant
+
+
+@pytest.fixture
+async def test_admin_user(db_session: AsyncSession, test_tenant: Tenant) -> User:
+    user = User(
+        tenant_id=test_tenant.id,
+        email="admin@test.com",
+        first_name="Admin",
+        last_name="User",
+        password_hash=SecurityUtils.hash_password("AdminPass123!"),
+        role=UserRole.ADMIN,
+        is_active=True,
+        email_verified=True,
+    )
+    db_session.add(user)
+    await db_session.commit()
+    await db_session.refresh(user)
+    return user
+
+
+@pytest.fixture
+async def test_agent_user(db_session: AsyncSession, test_tenant: Tenant) -> User:
+    user = User(
+        tenant_id=test_tenant.id,
+        email="agent@test.com",
+        first_name="Agent",
+        last_name="User",
+        password_hash=SecurityUtils.hash_password("AgentPass123!"),
+        role=UserRole.AGENT,
+        is_active=True,
+        email_verified=True,
+    )
+    db_session.add(user)
+    await db_session.commit()
+    await db_session.refresh(user)
+    return user
+
+
+@pytest.fixture
+async def test_client_user(db_session: AsyncSession, test_tenant: Tenant) -> User:
+    user = User(
+        tenant_id=test_tenant.id,
+        email="client@test.com",
+        first_name="Client",
+        last_name="User",
+        password_hash=SecurityUtils.hash_password("ClientPass123!"),
+        role=UserRole.CLIENT_USER,
+        is_active=True,
+        email_verified=True,
+    )
+    db_session.add(user)
+    await db_session.commit()
+    await db_session.refresh(user)
+    return user
+
+
+@pytest.fixture
+async def test_system(db_session: AsyncSession, test_tenant: Tenant) -> System:
+    system = System(
+        name="Test System",
+        description="Test system description",
+        tenant_id=test_tenant.id,
+        is_active=True,
+    )
+    db_session.add(system)
+    await db_session.commit()
+    await db_session.refresh(system)
+    return system
+
+
+@pytest.fixture
+async def test_category(db_session: AsyncSession, test_tenant: Tenant) -> Category:
+    category = Category(
+        name="Test Category",
+        description="Test category description",
+        tenant_id=test_tenant.id,
+        is_active=True,
+        sla_response_hours=24,
+        sla_resolution_hours=72,
+    )
+    db_session.add(category)
+    await db_session.commit()
+    await db_session.refresh(category)
+    return category
+
+
+@pytest.fixture
+async def admin_token(client: AsyncClient, test_admin_user: User, test_tenant: Tenant) -> str:
+    response = await client.post(
+        "/v1/auth/login",
+        json={
+            "email": test_admin_user.email,
+            "password": "AdminPass123!",
+            "tenant_slug": test_tenant.slug,
+        },
+    )
+    assert response.status_code == 200
+    return response.json()["access_token"]
+
+
+@pytest.fixture
+async def agent_token(client: AsyncClient, test_agent_user: User, test_tenant: Tenant) -> str:
+    response = await client.post(
+        "/v1/auth/login",
+        json={
+            "email": test_agent_user.email,
+            "password": "AgentPass123!",
+            "tenant_slug": test_tenant.slug,
+        },
+    )
+    assert response.status_code == 200
+    return response.json()["access_token"]
+
+
+@pytest.fixture
+async def client_token(client: AsyncClient, test_client_user: User, test_tenant: Tenant) -> str:
+    response = await client.post(
+        "/v1/auth/login",
+        json={
+            "email": test_client_user.email,
+            "password": "ClientPass123!",
+            "tenant_slug": test_tenant.slug,
+        },
+    )
+    assert response.status_code == 200
+    return response.json()["access_token"]
+
+
+@pytest.fixture
+def auth_headers_admin(admin_token: str) -> dict:
+    return {"Authorization": f"Bearer {admin_token}"}
+
+
+@pytest.fixture
+def auth_headers_agent(agent_token: str) -> dict:
+    return {"Authorization": f"Bearer {agent_token}"}
+
+
+@pytest.fixture
+def auth_headers_client(client_token: str) -> dict:
+    return {"Authorization": f"Bearer {client_token}"}

backend/tests/integration/test_auth_integration.py

@@ -16,9 +16,6 @@ from app.models.user import User, UserRole
 from app.models.tenant import Tenant
 
 # Importar fixtures desde conftest_integration
-pytest_plugins = ['tests.conftest_integration']
-
-
 @pytest.mark.integration
 @pytest.mark.auth
 class TestAuthentication:
@@ -126,6 +123,58 @@ class TestAuthentication:
         
         assert response.status_code == 403
 
+    async def test_login_rate_limited_after_too_many_attempts(
+        self,
+        client: AsyncClient,
+        test_admin_user: User,
+        test_tenant: Tenant,
+        monkeypatch,
+    ):
+        """Debe devolver 429 después de demasiados intentos de login (rate limit)."""
+
+        import app.api.v1.endpoints.auth as auth_endpoint
+
+        class _FakeCache:
+            def __init__(self):
+                self._counts = {}
+                self._expires = {}
+
+            async def incr(self, key: str, amount: int = 1):
+                self._counts[key] = self._counts.get(key, 0) + amount
+                return self._counts[key]
+
+            async def expire(self, key: str, ttl: int):
+                self._expires[key] = ttl
+                return True
+
+            async def delete(self, key: str):
+                self._counts.pop(key, None)
+                return True
+
+        fake_cache = _FakeCache()
+        monkeypatch.setattr(auth_endpoint, "cache", fake_cache)
+        monkeypatch.setattr(auth_endpoint.settings, "RATE_LIMIT_ENABLED", True, raising=False)
+        monkeypatch.setattr(auth_endpoint.settings, "TESTING", False, raising=False)
+        monkeypatch.setattr(auth_endpoint.settings, "LOGIN_RATE_LIMIT_WINDOW_SECONDS", 60, raising=False)
+        monkeypatch.setattr(auth_endpoint.settings, "LOGIN_RATE_LIMIT_IP_MAX_ATTEMPTS", 10_000, raising=False)
+        monkeypatch.setattr(auth_endpoint.settings, "LOGIN_RATE_LIMIT_ID_MAX_ATTEMPTS", 2, raising=False)
+
+        payload = {
+            "email": test_admin_user.email,
+            "password": "WrongPassword123!",
+            "tenant_slug": test_tenant.slug,
+        }
+
+        r1 = await client.post("/v1/auth/login", json=payload)
+        assert r1.status_code == 401
+
+        r2 = await client.post("/v1/auth/login", json=payload)
+        assert r2.status_code == 401
+
+        r3 = await client.post("/v1/auth/login", json=payload)
+        assert r3.status_code == 429
+        assert "Retry-After" in r3.headers
+
 
 @pytest.mark.integration
 @pytest.mark.auth
@@ -305,13 +354,17 @@ class TestUserProfile:
     async def test_get_current_user_profile(
         self, 
         client: AsyncClient,
+        test_tenant: Tenant,
         test_admin_user: User,
         auth_headers_admin: dict
     ):
         """Test obtener perfil del usuario actual."""
         response = await client.get(
             "/v1/users/me",
-            headers=auth_headers_admin
+            headers={
+                **auth_headers_admin,
+                "X-Tenant-ID": str(test_tenant.id),
+            },
         )
         
         assert response.status_code == 200
@@ -348,13 +401,17 @@ class TestPasswordSecurity:
     async def test_password_not_exposed_in_response(
         self, 
         client: AsyncClient,
+        test_tenant: Tenant,
         test_admin_user: User,
         auth_headers_admin: dict
     ):
         """Test que el password hash nunca se expone en las respuestas."""
         response = await client.get(
             "/v1/users/me",
-            headers=auth_headers_admin
+            headers={
+                **auth_headers_admin,
+                "X-Tenant-ID": str(test_tenant.id),
+            },
         )
         
         assert response.status_code == 200

backend/tests/integration/test_multitenant_integration.py

@@ -14,9 +14,6 @@ from app.models.tenant import Tenant
 from app.models.ticket import Ticket, TicketStatus, TicketPriority
 from app.core.security import SecurityUtils
 
-pytest_plugins = ['tests.conftest_integration']
-
-
 @pytest.mark.integration
 @pytest.mark.db
 class TestTenantIsolation:

backend/tests/integration/test_setup_verification.py

@@ -1,78 +1,56 @@
-"""
-Quick Test Verification - ServiceManagerWeb
+"""Quick Test Verification - ServiceManagerWeb
 
-Test rápido para verificar que la configuración de tests funciona correctamente.
+Smoke tests para verificar que el setup de tests de integración funciona correctamente.
 """
 
 import pytest
 from httpx import AsyncClient
 
-pytest_plugins = ['tests.conftest_integration']
-
 
 @pytest.mark.integration
 class TestSetupVerification:
-    """Verificar que el setup de tests funciona."""
-    
     async def test_client_fixture_works(self, client: AsyncClient):
-        """Test que el fixture de client HTTP funciona."""
         assert client is not None
-        assert client.base_url == "http://test"
-    
+        assert str(client.base_url) == "http://test"
+
     async def test_database_connection(self, db_session):
-        """Test que la conexión a BD de testing funciona."""
-        assert db_session is not None
-        
-        # Ejecutar query simple
         from sqlalchemy import text
+
         result = await db_session.execute(text("SELECT 1"))
         assert result.scalar() == 1
-    
+
     async def test_tenant_fixture_creates_tenant(self, test_tenant):
-        """Test que el fixture de tenant funciona."""
-        assert test_tenant is not None
         assert test_tenant.name == "Test Company"
         assert test_tenant.slug == "test-company"
-    
+
     async def test_user_fixtures_work(self, test_admin_user, test_agent_user, test_client_user):
-        """Test que los fixtures de usuarios funcionan."""
         assert test_admin_user.role.value == "ADMIN"
         assert test_agent_user.role.value == "AGENT"
         assert test_client_user.role.value == "CLIENT_USER"
-    
-    async def test_auth_token_generation(self, admin_token):
-        """Test que la generación de tokens funciona."""
-        assert admin_token is not None
+
+    async def test_auth_token_generation(self, admin_token: str):
         assert isinstance(admin_token, str)
         assert len(admin_token) > 20
-    
+
     async def test_health_endpoint(self, client: AsyncClient):
-        """Test que el endpoint de health funciona."""
         response = await client.get("/health")
         assert response.status_code == 200
-        data = response.json()
-        assert data["status"] == "healthy"
+        assert response.json()["status"] == "healthy"
 
 
 @pytest.mark.integration
 class TestBasicEndpoints:
-    """Tests básicos de endpoints para verificar conectividad."""
-    
     async def test_health_endpoint_detailed(self, client: AsyncClient):
-        """Test del endpoint de health detallado."""
         response = await client.get("/v1/health/detailed")
-        assert response.status_code == 200
-    
+        assert response.status_code in (200, 503)
+
     async def test_login_endpoint_exists(self, client: AsyncClient):
-        """Test que el endpoint de login responde."""
-        # Enviar credenciales inválidas para verificar que el endpoint existe
         response = await client.post(
             "/v1/auth/login",
             json={
                 "email": "nonexistent@test.com",
                 "password": "wrong",
-                "tenant_slug": "nonexistent"
-            }
+                "tenant_slug": "nonexistent",
+            },
         )
-        # Debe responder (aunque con error)
-        assert response.status_code in [401, 404, 422]
+        assert response.status_code in (401, 404, 422)

backend/tests/integration/test_tickets_integration.py

@@ -6,6 +6,7 @@ Tests completos del CRUD de tickets y funcionalidad relacionada.
 
 import pytest
 from httpx import AsyncClient
+
 from sqlalchemy.ext.asyncio import AsyncSession
 import uuid
 
@@ -14,8 +15,7 @@ from app.models.tenant import Tenant
 from app.models.ticket import Ticket, TicketStatus, TicketPriority
 from app.models.system import System
 from app.models.category import Category
-
-pytest_plugins = ['tests.conftest_integration']
+from app.core.file_handler import file_handler
 
 
 @pytest.mark.integration
@@ -611,3 +611,66 @@ class TestTicketPermissions:
         
         # Debe ver ambos tickets
         assert len(tickets) >= 2
+
+
+@pytest.mark.integration
+@pytest.mark.db
+class TestTicketAttachmentPermissions:
+    async def test_client_cannot_download_other_users_attachment(
+        self,
+        client: AsyncClient,
+        test_tenant: Tenant,
+        test_category: Category,
+        auth_headers_admin: dict,
+        auth_headers_client: dict,
+    ):
+        # Admin crea ticket
+        create_resp = await client.post(
+            "/v1/tickets/",
+            headers={
+                **auth_headers_admin,
+                "X-Tenant-ID": str(test_tenant.id),
+            },
+            json={
+                "title": "Admin ticket",
+                "description": "Ticket with attachment",
+                "priority": "MEDIUM",
+                "category_id": str(test_category.id),
+            },
+        )
+        assert create_resp.status_code == 201
+        ticket_id = create_resp.json()["id"]
+
+        # Admin sube adjunto (PDF válido por magic bytes)
+        pdf_bytes = b"%PDF-1.4\n%\xe2\xe3\xcf\xd3\n1 0 obj\n<<>>\nendobj\ntrailer\n<<>>\n%%EOF\n"
+        upload_resp = await client.post(
+            f"/v1/tickets/{ticket_id}/attachments",
+            headers={
+                **auth_headers_admin,
+                "X-Tenant-ID": str(test_tenant.id),
+            },
+            files={
+                "file": ("test.pdf", pdf_bytes, "application/pdf"),
+            },
+        )
+        assert upload_resp.status_code == 201
+        attachment_data = upload_resp.json()["data"]
+        attachment_id = attachment_data["id"]
+
+        # Cliente intenta descargar adjunto de ticket ajeno -> 404
+        download_resp = await client.get(
+            f"/v1/tickets/{ticket_id}/attachments/{attachment_id}/download",
+            headers={
+                **auth_headers_client,
+                "X-Tenant-ID": str(test_tenant.id),
+            },
+        )
+        assert download_resp.status_code == 404
+
+        # Limpieza del archivo subido (mejor esfuerzo)
+        try:
+            uploaded_path = file_handler.get_file_path(attachment_data["file_path"])
+            if uploaded_path.exists():
+                uploaded_path.unlink()
+        except Exception:
+            pass

backend/tests/unit/test_file_handler.py

@@ -0,0 +1,80 @@
+"""Unit Tests - FileHandler - ServiceManagerWeb
+
+Tests para app.core.file_handler.FileHandler.
+"""
+
+import io
+import uuid
+import tempfile
+
+import pytest
+from fastapi import UploadFile
+from fastapi import HTTPException
+
+
+@pytest.mark.asyncio
+async def test_save_upload_pdf_valid_streaming():
+    from app.core.file_handler import FileHandler, settings
+
+    with tempfile.TemporaryDirectory() as tmp:
+        settings.UPLOAD_PATH = tmp
+        handler = FileHandler()
+
+        tenant_id = uuid.uuid4()
+        ticket_id = uuid.uuid4()
+
+        content = b"%PDF-1.7\n%\xe2\xe3\xcf\xd3\n1 0 obj\n<<>>\nendobj\n"
+        up = UploadFile(filename="test.pdf", file=io.BytesIO(content))
+
+        meta = await handler.save_upload(up, tenant_id=tenant_id, ticket_id=ticket_id)
+        assert meta["file_size"] == len(content)
+        assert meta["original_filename"] == "test.pdf"
+        assert meta["filename"].endswith(".pdf")
+        assert meta["md5_hash"]
+        assert meta["sha256_hash"]
+
+
+@pytest.mark.asyncio
+async def test_save_upload_pdf_invalid_magic_bytes_rejected():
+    from app.core.file_handler import FileHandler, settings
+
+    with tempfile.TemporaryDirectory() as tmp:
+        settings.UPLOAD_PATH = tmp
+        handler = FileHandler()
+
+        up = UploadFile(filename="bad.pdf", file=io.BytesIO(b"NOTPDF"))
+
+        with pytest.raises(HTTPException) as exc:
+            await handler.save_upload(up, tenant_id=uuid.uuid4(), ticket_id=uuid.uuid4())
+
+        assert exc.value.status_code == 400
+
+
+@pytest.mark.asyncio
+async def test_save_upload_oversize_rejected_and_file_removed():
+    from app.core.file_handler import FileHandler, settings
+
+    with tempfile.TemporaryDirectory() as tmp:
+        settings.UPLOAD_PATH = tmp
+        settings.MAX_UPLOAD_SIZE_MB = 0  # 0MB => max 0 bytes
+        handler = FileHandler()
+
+        up = UploadFile(filename="a.txt", file=io.BytesIO(b"x"))
+
+        with pytest.raises(HTTPException) as exc:
+            await handler.save_upload(up, tenant_id=uuid.uuid4(), ticket_id=uuid.uuid4())
+
+        assert exc.value.status_code == 413
+
+
+def test_get_file_path_prevents_path_traversal():
+    from app.core.file_handler import FileHandler, settings
+
+    with tempfile.TemporaryDirectory() as tmp:
+        settings.UPLOAD_PATH = tmp
+        handler = FileHandler()
+
+        with pytest.raises(HTTPException) as exc:
+            handler.get_file_path("../../etc/passwd")
+
+        assert exc.value.status_code == 403

backend/tests/unit/test_middleware.py

@@ -124,8 +124,8 @@ class TestMiddlewareNoTenantHeaders:
     """Tests para requests sin headers de tenant."""
 
     @pytest.mark.asyncio
-    async def test_missing_tenant_headers_in_dev_continues(self):
-        """En entorno de desarrollo, sin tenant headers continúa con advertencia."""
+    async def test_missing_tenant_headers_returns_400(self):
+        """Sin tenant headers debe retornar 400 (requerido para aislamiento multi-tenant)."""
         from app.middleware.tenant import TenantMiddleware
 
         mock_app = AsyncMock()
@@ -139,18 +139,15 @@ class TestMiddlewareNoTenantHeaders:
 
         call_next = AsyncMock(return_value=MagicMock(status_code=200))
 
-        # En modo testing (que hereda de development), debe continuar
         response = await middleware.dispatch(request, call_next)
 
-        # El request continúa (call_next fue llamado)
-        call_next.assert_called_once()
+        assert response.status_code == 400
+        call_next.assert_not_called()
 
     @pytest.mark.asyncio
-    async def test_missing_tenant_headers_in_production_returns_400(self):
-        """En producción, sin tenant headers retorna 400."""
+    async def test_missing_tenant_headers_does_not_call_next(self):
+        """Sin tenant headers no debe llegar al handler (call_next)."""
         from app.middleware.tenant import TenantMiddleware
-        from app.core.config import get_settings
-        from starlette.responses import JSONResponse
 
         mock_app = AsyncMock()
         middleware = TenantMiddleware(mock_app)
@@ -163,13 +160,10 @@ class TestMiddlewareNoTenantHeaders:
 
         call_next = AsyncMock(return_value=MagicMock(status_code=200))
 
-        with patch.object(get_settings(), "ENVIRONMENT", "production"):
-            response = await middleware.dispatch(request, call_next)
+        response = await middleware.dispatch(request, call_next)
 
-        # En producción sin tenant debe retornar error
-        # (si la response es JSONResponse con status 400, el test pasa)
-        if hasattr(response, "status_code"):
-            assert response.status_code in [400, 200]  # depende del env
+        assert response.status_code == 400
+        call_next.assert_not_called()
 
 
 # ============================================================

docker-compose.yml

@@ -1,5 +1,3 @@
-version: '3.8'
-
 services:
   # ===================================
   # POSTGRES DATABASE
@@ -113,6 +111,7 @@ services:
       - ./backend:/backend:ro
       - uploads_data:/app/uploads
       - logs_data:/app/logs
+    command: celery -A app.celery worker --loglevel=info -Q default,email,sla,maintenance,notifications
     depends_on:
       postgres:
         condition: service_healthy

docker/Dockerfile.backend

@@ -42,4 +42,4 @@ HEALTHCHECK --interval=30s --timeout=10s --start-period=30s --retries=3 \
 # Comando por defecto
 # Development: usar --reload
 # Production: usar --workers y quitar --reload
-CMD ["uvicorn", "app.main:app", "--host", "0.0.0.0", "--port", "8000", "--workers", "4"]
+CMD ["uvicorn", "app.main:app", "--host", "0.0.0.0", "--port", "8000", "--reload"]

docker/nginx/nginx.conf

@@ -55,6 +55,9 @@ http {
     add_header X-Frame-Options DENY always;
     add_header X-Content-Type-Options nosniff always;
     add_header X-XSS-Protection "1; mode=block" always;
+        add_header Referrer-Policy "strict-origin-when-cross-origin" always;
+        add_header Permissions-Policy "geolocation=(), microphone=(), camera=(), payment=(), usb=()" always;
+        add_header X-Permitted-Cross-Domain-Policies "none" always;
     add_header Strict-Transport-Security "max-age=63072000; includeSubDomains; preload" always;
 
     # Hide server version

frontend-client/src/lib/components/Icon.svelte

@@ -17,7 +17,14 @@
     eye: 'M15 12a3 3 0 11-6 0 3 3 0 016 0z M2.458 12C3.732 7.943 7.523 5 12 5c4.478 0 8.268 2.943 9.542 7-1.274 4.057-5.064 7-9.542 7-4.477 0-8.268-2.943-9.542-7z',
     clock: 'M12 8v4l3 3m6-3a9 9 0 11-18 0 9 9 0 0118 0z',
     check: 'M5 13l4 4L19 7',
-    chevronDown: 'M19 9l-7 7-7-7'
+    chevronDown: 'M19 9l-7 7-7-7',
+    'building-2': 'M19 21V5a2 2 0 00-2-2H7a2 2 0 00-2 2v16m14 0h2m-2 0h-5m-9 0H3m2 0h5M9 7h1m-1 4h1m4-4h1m-1 4h1m-5 10v-5a1 1 0 011-1h2a1 1 0 011 1v5m-4 0h4',
+    'loader-2': 'M12 2v4M12 18v4M4.93 4.93l2.83 2.83M16.24 16.24l2.83 2.83M2 12h4M18 12h4M4.93 19.07l2.83-2.83M16.24 7.76l2.83-2.83',
+    'alert-circle': 'M12 8v4m0 4h.01M21 12a9 9 0 11-18 0 9 9 0 0118 0z',
+    'shield-check': 'M9 12l2 2 4-4m5.618-4.016A11.955 11.955 0 0112 2.944a11.955 11.955 0 01-8.618 3.04A12.02 12.02 0 003 9c0 5.591 3.824 10.29 9 11.622 5.176-1.332 9-6.03 9-11.622 0-1.042-.133-2.052-.382-3.016z',
+    mail: 'M3 8l7.89 5.26a2 2 0 002.22 0L21 8M5 19h14a2 2 0 002-2V7a2 2 0 00-2-2H5a2 2 0 00-2 2v10a2 2 0 002 2z',
+    lock: 'M12 15v2m-6 4h12a2 2 0 002-2v-6a2 2 0 00-2-2H6a2 2 0 00-2 2v6a2 2 0 002 2zm10-10V7a4 4 0 00-8 0v4h8z',
+    'eye-off': 'M13.875 18.825A10.05 10.05 0 0112 19c-4.478 0-8.268-2.943-9.543-7a9.97 9.97 0 011.563-3.029m5.858.908a3 3 0 114.243 4.243M9.878 9.878l4.242 4.242M9.88 9.88l-3.29-3.29m7.532 7.532l3.29 3.29M3 3l3.59 3.59m0 0A9.953 9.953 0 0112 5c4.478 0 8.268 2.943 9.543 7a10.025 10.025 0 01-4.132 5.411m0 0L21 21'
   };
 
   $: path = icons[name] || icons.home;

frontend-client/src/lib/components/TicketCard.svelte

@@ -2,22 +2,25 @@
   export let ticket: import('$lib/stores/tickets').Ticket;
   
   // Status mapping
-  const statusConfig = {
+  const statusConfig: Record<string, { label: string; class: string }> = {
     NEW: { label: 'Nuevo', class: 'badge-new' },
     IN_PROGRESS: { label: 'En Progreso', class: 'badge-in-progress' },
     WAITING_CUSTOMER: { label: 'Esperando Cliente', class: 'badge-waiting' },
+    WAITING_FOR_CLIENT: { label: 'Esperando Cliente', class: 'badge-waiting' },
     RESOLVED: { label: 'Resuelto', class: 'badge-resolved' },
     CLOSED: { label: 'Cerrado', class: 'badge-closed' },
     REOPENED: { label: 'Reabierto', class: 'badge-reopened' }
   };
+  const fallbackStatus = { label: 'Desconocido', class: 'badge-new' };
   
   // Priority mapping
-  const priorityConfig = {
+  const priorityConfig: Record<string, { label: string; class: string }> = {
     LOW: { label: 'Baja', class: 'badge-priority-low' },
     MEDIUM: { label: 'Media', class: 'badge-priority-medium' },
     HIGH: { label: 'Alta', class: 'badge-priority-high' },
     URGENT: { label: 'Urgente', class: 'badge-priority-urgent' }
   };
+  const fallbackPriority = { label: 'Normal', class: 'badge-priority-medium' };
   
   // Format date
   function formatDate(dateString: string): string {
@@ -58,11 +61,11 @@
         </a>
       </h3>
       <div class="flex items-center space-x-2 ml-4">
-        <span class={`${statusConfig[ticket.status].class}`}>
-          {statusConfig[ticket.status].label}
+        <span class={(statusConfig[ticket.status] ?? fallbackStatus).class}>
+          {(statusConfig[ticket.status] ?? fallbackStatus).label}
         </span>
-        <span class={`${priorityConfig[ticket.priority].class}`}>
-          {priorityConfig[ticket.priority].label}
+        <span class={(priorityConfig[ticket.priority] ?? fallbackPriority).class}>
+          {(priorityConfig[ticket.priority] ?? fallbackPriority).label}
         </span>
       </div>
     </div>

frontend-client/src/lib/stores/app.ts

@@ -35,6 +35,7 @@ async function apiCall(endpoint: string, options: RequestInit = {}) {
     headers: {
       'Content-Type': 'application/json',
       'Authorization': `Bearer ${authState.token}`,
+      ...(authState.user?.tenant_id ? { 'X-Tenant-ID': authState.user.tenant_id } : {}),
       ...options.headers
     }
   });

frontend-client/src/lib/stores/tickets.ts

@@ -135,7 +135,9 @@ function createTicketsStore() {
       update((state: TicketsState) => ({ ...state, isLoading: true, error: null }));
 
       try {
-        const tickets = await apiCall('/tickets/');
+        const raw = await apiCall('/tickets/');
+        // El backend devuelve 'subject', el tipo Ticket usa 'title'
+        const tickets = raw.map((t: any) => ({ ...t, title: t.subject ?? t.title }));
         update((state: TicketsState) => ({ ...state, tickets, isLoading: false }));
       } catch (error) {
         update((state: TicketsState) => ({
@@ -151,11 +153,13 @@ function createTicketsStore() {
       update((state: TicketsState) => ({ ...state, isLoading: true, error: null }));
 
       try {
-        const [ticket, comments, attachments] = await Promise.all([
+        const [ticketRaw, comments, attachments] = await Promise.all([
           apiCall(`/tickets/${ticketId}`),
           apiCall(`/tickets/${ticketId}/comments`),
           apiCall(`/tickets/${ticketId}/attachments`)
         ]);
+        // El backend devuelve 'subject', el tipo Ticket usa 'title'
+        const ticket = { ...ticketRaw, title: ticketRaw.subject ?? ticketRaw.title };
 
         update((state: TicketsState) => ({
           ...state,

frontend-client/src/routes/login/+page.svelte

@@ -7,6 +7,7 @@
 
   let email = '';
   let password = '';
+  let tenantSlug = 'aduanasoft-demo';
   let totpCode = '';
   let isLoading = false;
   let showTwoFactor = false;
@@ -33,7 +34,7 @@
       await auth.login({
         email,
         password,
-        tenant_slug: 'aduanasoft', // Default tenant for now
+        tenant_slug: tenantSlug.trim() || 'aduanasoft-demo',
         totp_code: totpCode || undefined
       });
 

frontend-client/src/routes/tickets/[id]/+page.svelte

@@ -63,22 +63,25 @@
   }
 
   // Status mapping
-  const statusConfig = {
+  const statusConfig: Record<string, { label: string; class: string }> = {
     NEW: { label: 'Nuevo', class: 'badge-new' },
     IN_PROGRESS: { label: 'En Progreso', class: 'badge-in-progress' },
     WAITING_FOR_CLIENT: { label: 'Esperando Cliente', class: 'badge-waiting' },
+    WAITING_CUSTOMER: { label: 'Esperando Cliente', class: 'badge-waiting' },
     RESOLVED: { label: 'Resuelto', class: 'badge-resolved' },
     CLOSED: { label: 'Cerrado', class: 'badge-closed' },
     REOPENED: { label: 'Reabierto', class: 'badge-reopened' }
   };
+  const fallbackStatus = { label: 'Desconocido', class: 'badge-new' };
 
   // Priority mapping
-  const priorityConfig = {
+  const priorityConfig: Record<string, { label: string; class: string }> = {
     LOW: { label: 'Baja', class: 'badge-priority-low' },
     MEDIUM: { label: 'Media', class: 'badge-priority-medium' },
     HIGH: { label: 'Alta', class: 'badge-priority-high' },
     URGENT: { label: 'Urgente', class: 'badge-priority-urgent' }
   };
+  const fallbackPriority = { label: 'Normal', class: 'badge-priority-medium' };
 
   async function handleAddComment() {
     if (!newComment.trim()) return;
@@ -175,7 +178,7 @@
   // Check if user can close ticket
   $: canClose =
     $tickets.currentTicket &&
-    ['RESOLVED', 'WAITING_FOR_CLIENT'].includes($tickets.currentTicket.status);
+    ['RESOLVED', 'WAITING_CUSTOMER'].includes($tickets.currentTicket.status);
 </script>
 
 <svelte:head>
@@ -230,11 +233,11 @@
                   {$tickets.currentTicket.title}
                 </h1>
                 <div class="flex items-center space-x-3">
-                  <span class={statusConfig[$tickets.currentTicket.status].class}>
-                    {statusConfig[$tickets.currentTicket.status].label}
+                  <span class={(statusConfig[$tickets.currentTicket.status] ?? fallbackStatus).class}>
+                    {(statusConfig[$tickets.currentTicket.status] ?? fallbackStatus).label}
                   </span>
-                  <span class={priorityConfig[$tickets.currentTicket.priority].class}>
-                    {priorityConfig[$tickets.currentTicket.priority].label}
+                  <span class={(priorityConfig[$tickets.currentTicket.priority] ?? fallbackPriority).class}>
+                    {(priorityConfig[$tickets.currentTicket.priority] ?? fallbackPriority).label}
                   </span>
                   <span class="text-sm text-gray-500">
                     Creado {formatDate($tickets.currentTicket.created_at)}
@@ -505,6 +508,45 @@
               <dd class="text-sm text-gray-900">{formatDate($tickets.currentTicket.updated_at)}</dd>
             </div>
 
+            <!-- SLA -->
+            {#if $tickets.currentTicket.sla_response_due || $tickets.currentTicket.sla_resolution_due}
+              <div class="pt-3 border-t border-gray-100">
+                <dt class="text-sm font-medium text-gray-500 mb-2">Tiempos de SLA</dt>
+
+                {#if $tickets.currentTicket.sla_response_due}
+                  {@const respDue = new Date($tickets.currentTicket.sla_response_due)}
+                  {@const respVencido = respDue < new Date() && !$tickets.currentTicket.first_response_at}
+                  <div class="mb-2">
+                    <dt class="text-xs text-gray-400">Respuesta límite</dt>
+                    <dd class="text-sm {respVencido ? 'text-red-600 font-medium' : 'text-gray-900'}">
+                      {formatDate($tickets.currentTicket.sla_response_due)}
+                      {#if respVencido}
+                        <span class="block text-xs text-red-500">¡Vencido!</span>
+                      {:else if $tickets.currentTicket.first_response_at}
+                        <span class="block text-xs text-green-600">✓ Respondido</span>
+                      {/if}
+                    </dd>
+                  </div>
+                {/if}
+
+                {#if $tickets.currentTicket.sla_resolution_due}
+                  {@const resDue = new Date($tickets.currentTicket.sla_resolution_due)}
+                  {@const resVencido = resDue < new Date() && !$tickets.currentTicket.resolved_at}
+                  <div>
+                    <dt class="text-xs text-gray-400">Resolución límite</dt>
+                    <dd class="text-sm {resVencido ? 'text-red-600 font-medium' : 'text-gray-900'}">
+                      {formatDate($tickets.currentTicket.sla_resolution_due)}
+                      {#if resVencido}
+                        <span class="block text-xs text-red-500">¡Vencido!</span>
+                      {:else if $tickets.currentTicket.resolved_at}
+                        <span class="block text-xs text-green-600">✓ Resuelto</span>
+                      {/if}
+                    </dd>
+                  </div>
+                {/if}
+              </div>
+            {/if}
+
             {#if $tickets.currentTicket.due_date}
               <div>
                 <dt class="text-sm font-medium text-gray-500">Fecha límite</dt>

frontend-client/vite.config.js

@@ -12,7 +12,7 @@ export default defineConfig({
 		},
 		proxy: {
 			'/api': {
-				target: process.env.PUBLIC_API_URL || 'http://backend:8000',
+				target: process.env.PUBLIC_API_URL || 'http://localhost:8000',
 				changeOrigin: true,
 				rewrite: (path) => path.replace(/^\/api/, '')
 			}

frontend-internal/src/lib/components/Sidebar.svelte

@@ -46,7 +46,7 @@
       );
     }
 
-    if (role === 'ADMIN') {
+    if (role === 'ADMIN' || role === 'SUPPORT_MANAGER') {
       baseNavigation.push(
         {
           name: 'SLA Management',
@@ -57,7 +57,12 @@
           name: 'Reportes',
           href: '/reports',
           icon: 'M9 19v-6a2 2 0 00-2-2H5a2 2 0 00-2 2v6a2 2 0 002 2h2a2 2 0 002-2zm0 0V9a2 2 0 012-2h2a2 2 0 012 2v10m-6 0a2 2 0 002 2h2a2 2 0 002-2m0 0V5a2 2 0 012-2h2a2 2 0 012 2v14a2 2 0 01-2 2h-2a2 2 0 01-2-2z'
-        },
+        }
+      );
+    }
+
+    if (role === 'ADMIN') {
+      baseNavigation.push(
         {
           name: 'Auditoría',
           href: '/audit',

frontend-internal/src/lib/utils/api.ts

@@ -26,10 +26,22 @@ async function request<T>(endpoint: string, options: RequestOptions = {}): Promi
   const authState = get(auth);
   const token = authState.token || (typeof window !== 'undefined' ? localStorage.getItem('internal_auth_token') : null);
 
+  // Resolve tenant_id from store or from the persisted user object in localStorage
+  let tenantId = authState.user?.tenant_id ?? null;
+  if (!tenantId && typeof window !== 'undefined') {
+    try {
+      const stored = localStorage.getItem('internal_auth_user');
+      if (stored) tenantId = JSON.parse(stored)?.tenant_id ?? null;
+    } catch { /* ignore */ }
+  }
+
   const headers = new Headers(init.headers);
   if (token) {
     headers.set('Authorization', `Bearer ${token}`);
   }
+  if (tenantId && !headers.has('X-Tenant-ID')) {
+    headers.set('X-Tenant-ID', tenantId);
+  }
   if (!headers.has('Content-Type')) {
     headers.set('Content-Type', 'application/json');
   }
@@ -66,10 +78,21 @@ async function downloadFile(endpoint: string, filename: string): Promise<void> {
   const authState = get(auth);
   const token = authState.token || (typeof window !== 'undefined' ? localStorage.getItem('internal_auth_token') : null);
 
+  let tenantId = authState.user?.tenant_id ?? null;
+  if (!tenantId && typeof window !== 'undefined') {
+    try {
+      const stored = localStorage.getItem('internal_auth_user');
+      if (stored) tenantId = JSON.parse(stored)?.tenant_id ?? null;
+    } catch { /* ignore */ }
+  }
+
   const headers = new Headers();
   if (token) {
     headers.set('Authorization', `Bearer ${token}`);
   }
+  if (tenantId) {
+    headers.set('X-Tenant-ID', tenantId);
+  }
 
   const response = await fetch(`${API_BASE}${endpoint}`, {
     method: 'GET',

frontend-internal/src/routes/profile/+page.svelte

@@ -48,7 +48,8 @@
         method: 'POST',
         headers: {
           'Content-Type': 'application/json',
-          Authorization: `Bearer ${$auth.token}`
+          Authorization: `Bearer ${$auth.token}`,
+          ...($auth.user?.tenant_id ? { 'X-Tenant-ID': $auth.user.tenant_id } : {})
         },
         body: JSON.stringify({ current_password: currentPassword, new_password: newPassword })
       });
@@ -78,7 +79,7 @@
     try {
       const response = await fetch('/api/v1/auth/2fa/setup', {
         method: 'POST',
-        headers: { Authorization: `Bearer ${$auth.token}` }
+        headers: { Authorization: `Bearer ${$auth.token}`, ...($auth.user?.tenant_id ? { 'X-Tenant-ID': $auth.user.tenant_id } : {}) }
       });
       if (!response.ok) throw new Error((await response.json()).detail);
       const data = await response.json();
@@ -101,7 +102,7 @@
     try {
       const response = await fetch('/api/v1/auth/2fa/enable', {
         method: 'POST',
-        headers: { 'Content-Type': 'application/json', Authorization: `Bearer ${$auth.token}` },
+        headers: { 'Content-Type': 'application/json', Authorization: `Bearer ${$auth.token}`, ...($auth.user?.tenant_id ? { 'X-Tenant-ID': $auth.user.tenant_id } : {}) },
         body: JSON.stringify({ totp_code: totpSetupCode })
       });
       if (!response.ok) throw new Error((await response.json()).detail);
@@ -127,7 +128,7 @@
     try {
       const response = await fetch('/api/v1/auth/2fa/disable', {
         method: 'POST',
-        headers: { 'Content-Type': 'application/json', Authorization: `Bearer ${$auth.token}` },
+        headers: { 'Content-Type': 'application/json', Authorization: `Bearer ${$auth.token}`, ...($auth.user?.tenant_id ? { 'X-Tenant-ID': $auth.user.tenant_id } : {}) },
         body: JSON.stringify({ totp_code: disableTotpCode })
       });
       if (!response.ok) throw new Error((await response.json()).detail);

frontend-internal/src/routes/reports/+page.svelte

@@ -0,0 +1,661 @@
+<script lang="ts">
+  import { onMount } from 'svelte';
+  import { api } from '$lib/utils/api';
+  import { toast } from '$lib/stores/toast';
+  import { auth } from '$lib/stores/auth';
+  import { get } from 'svelte/store';
+
+  let isLoading = false;
+  let days = 30;
+  let activeTab = 'summary';
+
+  const user = get(auth).user;
+  const isAdmin = user?.role === 'ADMIN';
+
+  let summary: any     = null;
+  let agentReport: any = null;
+  let catReport: any   = null;
+  let sysReport: any   = null;
+  let clientReport: any = null;
+  let trendsReport: any = null;
+  let csatReport: any  = null;
+
+  const tabs = [
+    { id: 'summary',    label: 'Resumen',        icon: 'M9 19v-6a2 2 0 00-2-2H5a2 2 0 00-2 2v6a2 2 0 002 2h2a2 2 0 002-2zm0 0V9a2 2 0 012-2h2a2 2 0 012 2v10m-6 0a2 2 0 002 2h2a2 2 0 002-2m0 0V5a2 2 0 012-2h2a2 2 0 012 2v14a2 2 0 01-2 2h-2a2 2 0 01-2-2z' },
+    { id: 'agents',     label: 'Por Agente',     icon: 'M12 4.354a4 4 0 110 5.292M15 21H3v-1a6 6 0 0112 0v1zm0 0h6v-1a6 6 0 00-9-5.197' },
+    { id: 'categories', label: 'Por Categoría', icon: 'M19 11H5m14 0a2 2 0 012 2v6a2 2 0 01-2 2H5a2 2 0 01-2-2v-6a2 2 0 012-2m14 0V9a2 2 0 00-2-2M5 11V9a2 2 0 012-2m0 0V5a2 2 0 012-2h6a2 2 0 012 2v2M7 7h10' },
+    { id: 'systems',    label: 'Por Sistema',    icon: 'M9 3H5a2 2 0 00-2 2v4m6-6h10a2 2 0 012 2v4M9 3v18m0 0h10a2 2 0 002-2V9M9 21H5a2 2 0 01-2-2V9m0 0h18' },
+    { id: 'clients',    label: 'Por Cliente',    icon: 'M19 21V5a2 2 0 00-2-2H7a2 2 0 00-2 2v16m14 0h2m-2 0h-5m-9 0H3m2 0h5M9 7h1m-1 4h1m4-4h1m-1 4h1m-5 10v-5a1 1 0 011-1h2a1 1 0 011 1v5m-4 0h4', adminOnly: true },
+    { id: 'trends',     label: 'Tendencias',     icon: 'M7 12l3-3 3 3 4-4M8 21l4-4 4 4M3 4h18M4 4h16v12a1 1 0 01-1 1H5a1 1 0 01-1-1V4z' },
+    { id: 'csat',       label: 'Satisfacción', icon: 'M11.049 2.927c.3-.921 1.603-.921 1.902 0l1.519 4.674a1 1 0 00.95.69h4.915c.969 0 1.371 1.24.588 1.81l-3.976 2.888a1 1 0 00-.363 1.118l1.518 4.674c.3.922-.755 1.688-1.538 1.118l-3.976-2.888a1 1 0 00-1.176 0l-3.976 2.888c-.783.57-1.838-.197-1.538-1.118l1.518-4.674a1 1 0 00-.363-1.118l-3.976-2.888c-.784-.57-.38-1.81.588-1.81h4.914a1 1 0 00.951-.69l1.519-4.674z' },
+  ].filter(t => !t.adminOnly || isAdmin);
+
+  async function loadTab(tab: string) {
+    isLoading = true;
+    try {
+      switch (tab) {
+        case 'summary':    summary      = await api.get(`/reports/summary?days=${days}`);               break;
+        case 'agents':     agentReport  = await api.get(`/reports/by-agent?days=${days}`);              break;
+        case 'categories': catReport    = await api.get(`/reports/by-category?days=${days}`);           break;
+        case 'systems':    sysReport    = await api.get(`/reports/by-system?days=${days}`);             break;
+        case 'clients':    if (isAdmin) clientReport = await api.get(`/reports/by-client?days=${days}`); break;
+        case 'trends':     trendsReport = await api.get(`/reports/trends?days=${Math.min(days, 90)}`);  break;
+        case 'csat':       csatReport   = await api.get(`/reports/csat?days=${days}`);                  break;
+      }
+    } catch (e: any) {
+      toast.error('Error cargando reporte: ' + (e.message ?? 'Error desconocido'));
+    } finally {
+      isLoading = false;
+    }
+  }
+
+  async function switchTab(tab: string) { activeTab = tab; await loadTab(tab); }
+  async function reloadAll()            { await loadTab(activeTab); }
+  onMount(() => loadTab('summary'));
+
+  const STATUS_MAP: Record<string, { label: string; color: string }> = {
+    NEW:              { label: 'Nuevo',         color: 'blue'   },
+    TRIAGE:           { label: 'Triaje',         color: 'purple' },
+    IN_PROGRESS:      { label: 'En progreso',    color: 'indigo' },
+    WAITING_CUSTOMER: { label: 'Esp. cliente',   color: 'yellow' },
+    RESOLVED:         { label: 'Resuelto',       color: 'green'  },
+    CLOSED:           { label: 'Cerrado',        color: 'gray'   },
+    REOPENED:         { label: 'Reabierto',      color: 'red'    },
+  };
+  const PRIORITY_MAP: Record<string, { label: string; color: string }> = {
+    LOW:    { label: 'Baja',    color: 'gray'   },
+    MEDIUM: { label: 'Media',   color: 'blue'   },
+    HIGH:   { label: 'Alta',    color: 'orange' },
+    URGENT: { label: 'Urgente', color: 'red'    },
+  };
+
+  function statusBadge(s: string)   { const c = STATUS_MAP[s]?.color   ?? 'gray';   return `bg-${c}-100 text-${c}-800`; }
+  function statusLabel(s: string)   { return STATUS_MAP[s]?.label   ?? s.replace(/_/g, ' '); }
+  function priorityBadge(p: string) { const c = PRIORITY_MAP[p]?.color ?? 'gray';   return `bg-${c}-100 text-${c}-800`; }
+  function priorityLabel(p: string) { return PRIORITY_MAP[p]?.label ?? p; }
+
+  function fmtHours(h: number | null): string {
+    if (h == null) return '—';
+    if (h < 1)  return `${Math.round(h * 60)} min`;
+    if (h < 24) return `${h.toFixed(1)} h`;
+    return `${(h / 24).toFixed(1)} días`;
+  }
+
+  function fmtDate(d: string): string {
+    return new Date(d).toLocaleDateString('es-MX', { day: '2-digit', month: 'short' });
+  }
+
+  function stars(r: number | null): string {
+    if (!r) return '—';
+    const n = Math.round(r);
+    return '★'.repeat(n) + '☆'.repeat(5 - n);
+  }
+
+  function changePct(val: number | null, type: 'tickets' | 'resolution'): { cls: string; txt: string } {
+    if (val == null) return { cls: '', txt: '' };
+    const arrow = val > 0 ? '↑' : '↓';
+    const cls   = type === 'tickets'
+      ? (val > 0 ? 'text-red-600' : 'text-green-600')
+      : (val > 0 ? 'text-green-600' : 'text-red-600');
+    return { cls, txt: `${arrow} ${Math.abs(val)}%` };
+  }
+
+  function slaBarColor(pct: number): string {
+    if (pct >= 90) return 'bg-green-500';
+    if (pct >= 70) return 'bg-yellow-400';
+    return 'bg-red-500';
+  }
+
+  function maxTrend(pts: any[]): number {
+    if (!pts?.length) return 1;
+    return Math.max(...pts.map((p: any) => Math.max(p.created, p.resolved, 1)));
+  }
+</script>
+
+<!-- PAGINA -->
+<div class="p-6 space-y-6">
+
+  <!-- ENCABEZADO -->
+  <div class="flex flex-col sm:flex-row sm:items-center sm:justify-between gap-4">
+    <div>
+      <h1 class="text-2xl font-bold text-gray-900">Reportes</h1>
+      <p class="text-sm text-gray-500 mt-1">Estadísticas y métricas del sistema de soporte</p>
+    </div>
+    <div class="flex items-center gap-3">
+      <label for="period-select" class="text-sm font-medium text-gray-600">Período:</label>
+      <select
+        id="period-select"
+        class="border rounded-lg px-3 py-2 text-sm bg-white shadow-sm focus:ring-2 focus:ring-blue-500"
+        bind:value={days}
+        on:change={reloadAll}
+      >
+        <option value={7}>Últimos 7 días</option>
+        <option value={30}>Últimos 30 días</option>
+        <option value={60}>Últimos 60 días</option>
+        <option value={90}>Últimos 90 días</option>
+        <option value={180}>Últimos 6 meses</option>
+        <option value={365}>Último año</option>
+      </select>
+      <button
+        class="px-3 py-2 bg-blue-700 text-white text-sm rounded-lg hover:bg-blue-800 transition disabled:opacity-50"
+        on:click={reloadAll}
+        disabled={isLoading}
+      >
+        {isLoading ? '...' : '↺ Actualizar'}
+      </button>
+    </div>
+  </div>
+
+  <!-- TABS -->
+  <div class="border-b border-gray-200">
+    <nav class="flex gap-1 overflow-x-auto">
+      {#each tabs as tab}
+        <button
+          class="flex items-center gap-2 px-4 py-3 text-sm font-medium border-b-2 whitespace-nowrap transition
+            {activeTab === tab.id ? 'border-blue-700 text-blue-700' : 'border-transparent text-gray-500 hover:text-gray-700 hover:border-gray-300'}"
+          on:click={() => switchTab(tab.id)}
+        >
+          <svg class="w-4 h-4" fill="none" stroke="currentColor" viewBox="0 0 24 24">
+            <path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d={tab.icon} />
+          </svg>
+          {tab.label}
+        </button>
+      {/each}
+    </nav>
+  </div>
+
+  <!-- SPINNER -->
+  {#if isLoading}
+    <div class="flex justify-center items-center py-16 text-gray-400 text-sm gap-2">
+      <svg class="animate-spin h-5 w-5 text-blue-700" fill="none" viewBox="0 0 24 24">
+        <circle class="opacity-25" cx="12" cy="12" r="10" stroke="currentColor" stroke-width="4"/>
+        <path class="opacity-75" fill="currentColor" d="M4 12a8 8 0 018-8v8H4z"/>
+      </svg>
+      Cargando reporte...
+    </div>
+
+  <!-- RESUMEN -->
+  {:else if activeTab === 'summary' && summary}
+    <div class="grid grid-cols-2 lg:grid-cols-4 gap-4">
+      <div class="bg-white rounded-xl p-5 shadow-sm border border-gray-200">
+        <p class="text-xs font-medium text-gray-500 uppercase tracking-wide">Total tickets</p>
+        <p class="text-3xl font-bold text-gray-900 mt-2">{summary.total_tickets}</p>
+        {#if summary.tickets_change_pct != null}
+          {@const cp = changePct(summary.tickets_change_pct, 'tickets')}
+          <p class="text-sm mt-1 {cp.cls}">{cp.txt} vs período anterior</p>
+        {/if}
+      </div>
+      <div class="bg-white rounded-xl p-5 shadow-sm border-l-4 border-orange-400 border border-gray-100">
+        <p class="text-xs font-medium text-orange-500 uppercase tracking-wide">Abiertos</p>
+        <p class="text-3xl font-bold text-orange-500 mt-2">{summary.open_tickets}</p>
+        <p class="text-sm text-gray-400 mt-1">
+          {summary.total_tickets > 0 ? Math.round(summary.open_tickets / summary.total_tickets * 100) : 0}% del total
+        </p>
+      </div>
+      <div class="bg-white rounded-xl p-5 shadow-sm border-l-4 border-green-500 border border-gray-100">
+        <p class="text-xs font-medium text-green-600 uppercase tracking-wide">Resueltos</p>
+        <p class="text-3xl font-bold text-green-600 mt-2">{summary.resolved_tickets}</p>
+        {#if summary.resolution_change_pct != null}
+          {@const cp = changePct(summary.resolution_change_pct, 'resolution')}
+          <p class="text-sm mt-1 {cp.cls}">{cp.txt} tasa vs anterior</p>
+        {/if}
+      </div>
+      <div class="bg-white rounded-xl p-5 shadow-sm border-l-4 border-red-500 border border-gray-100">
+        <p class="text-xs font-medium text-red-500 uppercase tracking-wide">Urgentes</p>
+        <p class="text-3xl font-bold text-red-600 mt-2">{summary.by_priority.urgent}</p>
+        <p class="text-sm text-gray-400 mt-1">Tiempo prom: {fmtHours(summary.avg_resolution_hours)}</p>
+      </div>
+    </div>
+
+    <div class="grid grid-cols-1 lg:grid-cols-4 gap-4">
+      <div class="bg-white rounded-xl p-5 shadow-sm border border-gray-200">
+        <p class="text-xs font-medium text-gray-500 uppercase tracking-wide">Tiempo prom. resolución</p>
+        <p class="text-3xl font-bold text-blue-700 mt-2">{fmtHours(summary.avg_resolution_hours)}</p>
+        <p class="text-sm text-gray-400 mt-1">Primera resp: {fmtHours(summary.avg_first_response_hours)}</p>
+      </div>
+      <div class="bg-white rounded-xl p-5 shadow-sm border border-gray-200">
+        <p class="text-xs font-medium text-gray-500 uppercase tracking-wide mb-3">Satisfacción (CSAT)</p>
+        {#if summary.avg_rating}
+          <p class="text-4xl font-bold text-yellow-500">{summary.avg_rating.toFixed(1)} <span class="text-2xl">★</span></p>
+          <p class="text-sm text-gray-400 mt-1">{summary.total_rated} calificaciones</p>
+        {:else}
+          <p class="text-gray-400 text-sm mt-2">Sin calificaciones</p>
+        {/if}
+      </div>
+      <div class="bg-white rounded-xl p-5 shadow-sm border border-gray-200">
+        <p class="text-xs font-medium text-gray-500 uppercase tracking-wide mb-3">Por estado</p>
+        <div class="space-y-2">
+          {#each Object.entries(summary.by_status).filter(([k]) => k !== 'total') as [s, count]}
+            {#if count > 0}
+              <div class="flex items-center justify-between">
+                <span class="text-xs px-2 py-0.5 rounded-full font-medium {statusBadge(s.toUpperCase())}">
+                  {statusLabel(s.toUpperCase())}
+                </span>
+                <span class="text-sm font-semibold text-gray-700">{count}</span>
+              </div>
+            {/if}
+          {/each}
+        </div>
+      </div>
+      <div class="bg-white rounded-xl p-5 shadow-sm border border-gray-200">
+        <p class="text-xs font-medium text-gray-500 uppercase tracking-wide mb-3">Por prioridad</p>
+        <div class="space-y-2">
+          {#each [['URGENT', summary.by_priority.urgent], ['HIGH', summary.by_priority.high], ['MEDIUM', summary.by_priority.medium], ['LOW', summary.by_priority.low]] as [p, cnt]}
+            {#if cnt > 0}
+              <div class="flex items-center gap-2">
+                <span class="text-xs px-2 py-0.5 rounded-full font-medium {priorityBadge(String(p))} w-20 text-center">
+                  {priorityLabel(String(p))}
+                </span>
+                <div class="flex-1 bg-gray-100 rounded-full h-2">
+                  <div class="h-2 rounded-full bg-blue-600"
+                    style="width:{summary.by_priority.total > 0 ? Math.round(Number(cnt) / summary.by_priority.total * 100) : 0}%">
+                  </div>
+                </div>
+                <span class="text-sm font-semibold w-6 text-right">{cnt}</span>
+              </div>
+            {/if}
+          {/each}
+        </div>
+      </div>
+    </div>
+
+  <!-- POR AGENTE -->
+  {:else if activeTab === 'agents' && agentReport}
+    <div class="bg-white rounded-xl shadow-sm border overflow-hidden">
+      <div class="px-6 py-4 border-b bg-gray-50">
+        <h2 class="font-semibold text-gray-700">Rendimiento por agente — {agentReport.total_agents} agentes</h2>
+      </div>
+      {#if agentReport.agents.length === 0}
+        <p class="p-8 text-center text-gray-400">No hay datos de agentes en este período.</p>
+      {:else}
+        <div class="overflow-x-auto">
+          <table class="w-full text-sm">
+            <thead class="bg-gray-50">
+              <tr>
+                <th class="px-4 py-3 text-left font-medium text-gray-600">Agente</th>
+                <th class="px-4 py-3 text-center font-medium text-gray-600">Asignados</th>
+                <th class="px-4 py-3 text-center font-medium text-gray-600">Resueltos</th>
+                <th class="px-4 py-3 text-center font-medium text-gray-600">Abiertos</th>
+                <th class="px-4 py-3 text-center font-medium text-gray-600">Resolución %</th>
+                <th class="px-4 py-3 text-center font-medium text-gray-600">Tiempo prom.</th>
+                <th class="px-4 py-3 text-center font-medium text-gray-600">CSAT</th>
+                <th class="px-4 py-3 text-center font-medium text-gray-600">Urgentes</th>
+              </tr>
+            </thead>
+            <tbody class="divide-y divide-gray-100">
+              {#each agentReport.agents as a}
+                <tr class="hover:bg-gray-50 transition">
+                  <td class="px-4 py-3">
+                    <div class="font-medium text-gray-900">{a.agent_name}</div>
+                    <div class="text-xs text-gray-400">{a.agent_email}</div>
+                  </td>
+                  <td class="px-4 py-3 text-center font-semibold">{a.total_assigned}</td>
+                  <td class="px-4 py-3 text-center text-green-600 font-semibold">{a.resolved}</td>
+                  <td class="px-4 py-3 text-center text-orange-500 font-semibold">{a.open}</td>
+                  <td class="px-4 py-3 text-center">
+                    <div class="flex items-center gap-2 justify-center">
+                      <div class="w-16 bg-gray-200 rounded-full h-2">
+                        <div class="h-2 rounded-full {a.resolution_rate >= 80 ? 'bg-green-500' : a.resolution_rate >= 50 ? 'bg-yellow-400' : 'bg-red-500'}"
+                          style="width:{a.resolution_rate}%"></div>
+                      </div>
+                      <span class="text-xs font-medium">{a.resolution_rate}%</span>
+                    </div>
+                  </td>
+                  <td class="px-4 py-3 text-center text-gray-600">{fmtHours(a.avg_resolution_hours)}</td>
+                  <td class="px-4 py-3 text-center">
+                    {#if a.avg_rating}
+                      <span class="text-yellow-500 font-semibold">{a.avg_rating.toFixed(1)} ★</span>
+                      <div class="text-xs text-gray-400">{a.total_rated} cal.</div>
+                    {:else}
+                      <span class="text-gray-300">—</span>
+                    {/if}
+                  </td>
+                  <td class="px-4 py-3 text-center">
+                    {#if a.urgent_handled > 0}
+                      <span class="text-xs px-2 py-0.5 rounded-full bg-red-100 text-red-800 font-semibold">{a.urgent_handled}</span>
+                    {:else}
+                      <span class="text-gray-300">—</span>
+                    {/if}
+                  </td>
+                </tr>
+              {/each}
+            </tbody>
+          </table>
+        </div>
+      {/if}
+    </div>
+
+  <!-- POR CATEGORIA -->
+  {:else if activeTab === 'categories' && catReport}
+    <div class="bg-white rounded-xl shadow-sm border overflow-hidden">
+      <div class="px-6 py-4 border-b bg-gray-50 flex justify-between items-center">
+        <h2 class="font-semibold text-gray-700">Tickets por categoría</h2>
+        {#if catReport.uncategorized_count > 0}
+          <span class="text-xs bg-gray-100 text-gray-500 px-2 py-1 rounded-full">
+            + {catReport.uncategorized_count} sin categoría
+          </span>
+        {/if}
+      </div>
+      {#if catReport.categories.length === 0}
+        <p class="p-8 text-center text-gray-400">No hay datos de categorías en este período.</p>
+      {:else}
+        <div class="overflow-x-auto">
+          <table class="w-full text-sm">
+            <thead class="bg-gray-50">
+              <tr>
+                <th class="px-4 py-3 text-left font-medium text-gray-600">Categoría</th>
+                <th class="px-4 py-3 text-center font-medium text-gray-600">Total</th>
+                <th class="px-4 py-3 text-center font-medium text-gray-600">Abiertos</th>
+                <th class="px-4 py-3 text-center font-medium text-gray-600">Resueltos</th>
+                <th class="px-4 py-3 text-center font-medium text-gray-600">Tiempo prom.</th>
+                <th class="px-4 py-3 text-center font-medium text-gray-600">SLA resp/resol</th>
+                <th class="px-4 py-3 text-left font-medium text-gray-600">Cumplimiento SLA</th>
+              </tr>
+            </thead>
+            <tbody class="divide-y divide-gray-100">
+              {#each catReport.categories as cat}
+                <tr class="hover:bg-gray-50 transition">
+                  <td class="px-4 py-3 font-medium text-gray-900">{cat.category_name}</td>
+                  <td class="px-4 py-3 text-center font-semibold">{cat.total_tickets}</td>
+                  <td class="px-4 py-3 text-center text-orange-500">{cat.open_tickets}</td>
+                  <td class="px-4 py-3 text-center text-green-600">{cat.resolved_tickets}</td>
+                  <td class="px-4 py-3 text-center text-gray-600">{fmtHours(cat.avg_resolution_hours)}</td>
+                  <td class="px-4 py-3 text-center text-gray-500 text-xs">{cat.sla_response_hours}h / {cat.sla_resolution_hours}h</td>
+                  <td class="px-4 py-3">
+                    <div class="flex items-center gap-2">
+                      <div class="flex-1 bg-gray-200 rounded-full h-2.5">
+                        <div class="h-2.5 rounded-full {slaBarColor(cat.sla_compliance_pct)}" style="width:{cat.sla_compliance_pct}%"></div>
+                      </div>
+                      <span class="text-xs font-medium w-10 text-right">{cat.sla_compliance_pct}%</span>
+                    </div>
+                  </td>
+                </tr>
+              {/each}
+            </tbody>
+          </table>
+        </div>
+      {/if}
+    </div>
+
+  <!-- POR SISTEMA -->
+  {:else if activeTab === 'systems' && sysReport}
+    <div class="bg-white rounded-xl shadow-sm border overflow-hidden">
+      <div class="px-6 py-4 border-b bg-gray-50 flex justify-between items-center">
+        <h2 class="font-semibold text-gray-700">Tickets por sistema afectado</h2>
+        {#if sysReport.no_system_count > 0}
+          <span class="text-xs bg-gray-100 text-gray-500 px-2 py-1 rounded-full">
+            + {sysReport.no_system_count} sin sistema
+          </span>
+        {/if}
+      </div>
+      {#if sysReport.systems.length === 0}
+        <p class="p-8 text-center text-gray-400">No hay tickets con sistema asignado en este período.</p>
+      {:else}
+        {@const maxSys = Math.max(...sysReport.systems.map(s => s.total_tickets), 1)}
+        <div class="overflow-x-auto">
+          <table class="w-full text-sm">
+            <thead class="bg-gray-50">
+              <tr>
+                <th class="px-4 py-3 text-left font-medium text-gray-600">Sistema</th>
+                <th class="px-4 py-3 text-center font-medium text-gray-600">Total</th>
+                <th class="px-4 py-3 text-center font-medium text-gray-600">Abiertos</th>
+                <th class="px-4 py-3 text-center font-medium text-gray-600">Resueltos</th>
+                <th class="px-4 py-3 text-center font-medium text-gray-600">Urgentes</th>
+                <th class="px-4 py-3 text-center font-medium text-gray-600">Tiempo prom.</th>
+                <th class="px-4 py-3 text-left font-medium text-gray-600">Carga de trabajo</th>
+              </tr>
+            </thead>
+            <tbody class="divide-y divide-gray-100">
+              {#each sysReport.systems as sys}
+                <tr class="hover:bg-gray-50 transition">
+                  <td class="px-4 py-3 font-medium text-gray-900">{sys.system_name}</td>
+                  <td class="px-4 py-3 text-center font-semibold">{sys.total_tickets}</td>
+                  <td class="px-4 py-3 text-center text-orange-500">{sys.open_tickets}</td>
+                  <td class="px-4 py-3 text-center text-green-600">{sys.resolved_tickets}</td>
+                  <td class="px-4 py-3 text-center">
+                    {#if sys.urgent_tickets > 0}
+                      <span class="px-2 py-0.5 rounded-full bg-red-100 text-red-800 text-xs font-semibold">{sys.urgent_tickets}</span>
+                    {:else}
+                      <span class="text-gray-300">—</span>
+                    {/if}
+                  </td>
+                  <td class="px-4 py-3 text-center text-gray-600">{fmtHours(sys.avg_resolution_hours)}</td>
+                  <td class="px-4 py-3">
+                    <div class="flex items-center gap-2">
+                      <div class="flex-1 bg-gray-100 rounded-full h-2.5">
+                        <div class="h-2.5 rounded-full bg-blue-600" style="width:{Math.round(sys.total_tickets / maxSys * 100)}%"></div>
+                      </div>
+                      <span class="text-xs text-gray-400 w-8 text-right">{Math.round(sys.total_tickets / maxSys * 100)}%</span>
+                    </div>
+                  </td>
+                </tr>
+              {/each}
+            </tbody>
+          </table>
+        </div>
+      {/if}
+    </div>
+
+  <!-- POR CLIENTE (solo ADMIN) -->
+  {:else if activeTab === 'clients' && isAdmin && clientReport}
+    <div class="bg-white rounded-xl shadow-sm border overflow-hidden">
+      <div class="px-6 py-4 border-b bg-gray-50">
+        <h2 class="font-semibold text-gray-700">Tickets por cliente — {clientReport.total_clients} clientes activos</h2>
+      </div>
+      {#if clientReport.clients.length === 0}
+        <p class="p-8 text-center text-gray-400">No hay datos de clientes en este período.</p>
+      {:else}
+        <div class="overflow-x-auto">
+          <table class="w-full text-sm">
+            <thead class="bg-gray-50">
+              <tr>
+                <th class="px-4 py-3 text-left font-medium text-gray-600">Cliente</th>
+                <th class="px-4 py-3 text-center font-medium text-gray-600">Total</th>
+                <th class="px-4 py-3 text-center font-medium text-gray-600">Abiertos</th>
+                <th class="px-4 py-3 text-center font-medium text-gray-600">Resueltos</th>
+                <th class="px-4 py-3 text-center font-medium text-gray-600">Urgentes</th>
+                <th class="px-4 py-3 text-center font-medium text-gray-600">Tiempo prom.</th>
+                <th class="px-4 py-3 text-center font-medium text-gray-600">CSAT</th>
+                <th class="px-4 py-3 text-center font-medium text-gray-600">Último ticket</th>
+              </tr>
+            </thead>
+            <tbody class="divide-y divide-gray-100">
+              {#each clientReport.clients as c}
+                <tr class="hover:bg-gray-50 transition">
+                  <td class="px-4 py-3 font-medium text-gray-900">{c.tenant_name}</td>
+                  <td class="px-4 py-3 text-center font-semibold">{c.total_tickets}</td>
+                  <td class="px-4 py-3 text-center text-orange-500">{c.open_tickets}</td>
+                  <td class="px-4 py-3 text-center text-green-600">{c.resolved_tickets}</td>
+                  <td class="px-4 py-3 text-center">
+                    {#if c.urgent_tickets > 0}
+                      <span class="px-2 py-0.5 rounded-full bg-red-100 text-red-800 text-xs font-semibold">{c.urgent_tickets}</span>
+                    {:else}
+                      <span class="text-gray-300">—</span>
+                    {/if}
+                  </td>
+                  <td class="px-4 py-3 text-center text-gray-600">{fmtHours(c.avg_resolution_hours)}</td>
+                  <td class="px-4 py-3 text-center text-yellow-500">
+                    {c.avg_rating ? c.avg_rating.toFixed(1) + ' ★' : '—'}
+                  </td>
+                  <td class="px-4 py-3 text-center text-gray-400 text-xs">
+                    {c.last_ticket_at ? new Date(c.last_ticket_at).toLocaleDateString('es-MX') : '—'}
+                  </td>
+                </tr>
+              {/each}
+            </tbody>
+          </table>
+        </div>
+      {/if}
+    </div>
+
+  <!-- TENDENCIAS -->
+  {:else if activeTab === 'trends' && trendsReport}
+    <div class="bg-white rounded-xl shadow-sm border p-6">
+      <div class="flex items-center justify-between mb-6">
+        <h2 class="font-semibold text-gray-700">Tickets diarios — últimos {trendsReport.total_days} días</h2>
+        <div class="flex gap-4 text-xs text-gray-500">
+          <span class="flex items-center gap-1"><span class="w-3 h-3 rounded bg-blue-400 inline-block"></span> Creados</span>
+          <span class="flex items-center gap-1"><span class="w-3 h-3 rounded bg-green-500 inline-block"></span> Resueltos</span>
+        </div>
+      </div>
+      {#if trendsReport.data_points.length > 0}
+        {@const maxVal = maxTrend(trendsReport.data_points)}
+        <div class="overflow-x-auto">
+          <div class="relative" style="height:160px; min-width:max-content">
+            <div class="flex items-end gap-1 h-full border-b border-gray-200">
+              {#each trendsReport.data_points as pt}
+                <div class="w-3 bg-blue-400 rounded-t opacity-80 shrink-0"
+                  style="height:{maxVal > 0 ? Math.round(pt.created / maxVal * 100) : 0}%"
+                  title="Creados {pt.date}: {pt.created}"></div>
+              {/each}
+            </div>
+            <div class="absolute bottom-0 left-0 flex items-end gap-1 h-full pointer-events-none">
+              {#each trendsReport.data_points as pt}
+                <div class="w-3 bg-green-500 rounded-t opacity-60 shrink-0"
+                  style="height:{maxVal > 0 ? Math.round(pt.resolved / maxVal * 100) : 0}%"
+                  title="Resueltos {pt.date}: {pt.resolved}"></div>
+              {/each}
+            </div>
+          </div>
+          <div class="flex gap-1 mt-2" style="min-width:max-content">
+            {#each trendsReport.data_points as pt, i}
+              <div class="w-3 shrink-0 text-center">
+                {#if i % 7 === 0}
+                  <span class="text-gray-400 block" style="font-size:0.55rem;writing-mode:vertical-rl">{fmtDate(pt.date)}</span>
+                {/if}
+              </div>
+            {/each}
+          </div>
+        </div>
+        <div class="mt-6 max-h-48 overflow-y-auto rounded border border-gray-100">
+          <table class="w-full text-xs">
+            <thead class="sticky top-0 bg-gray-50">
+              <tr class="border-b">
+                <th class="px-3 py-2 text-left text-gray-500 font-medium">Fecha</th>
+                <th class="px-3 py-2 text-center text-blue-500 font-medium">Creados</th>
+                <th class="px-3 py-2 text-center text-green-600 font-medium">Resueltos</th>
+                <th class="px-3 py-2 text-center text-gray-500 font-medium">Balance</th>
+              </tr>
+            </thead>
+            <tbody>
+              {#each [...trendsReport.data_points].reverse() as pt}
+                {#if pt.created > 0 || pt.resolved > 0}
+                  <tr class="border-b hover:bg-gray-50">
+                    <td class="px-3 py-1.5 text-gray-600">{pt.date}</td>
+                    <td class="px-3 py-1.5 text-center text-blue-600 font-semibold">{pt.created}</td>
+                    <td class="px-3 py-1.5 text-center text-green-600 font-semibold">{pt.resolved}</td>
+                    <td class="px-3 py-1.5 text-center font-semibold {pt.net_open > 0 ? 'text-red-500' : pt.net_open < 0 ? 'text-green-500' : 'text-gray-400'}">
+                      {pt.net_open > 0 ? '+' : ''}{pt.net_open}
+                    </td>
+                  </tr>
+                {/if}
+              {/each}
+            </tbody>
+          </table>
+        </div>
+      {:else}
+        <p class="text-center text-gray-400 py-8">No hay datos en este período.</p>
+      {/if}
+    </div>
+
+  <!-- CSAT -->
+  {:else if activeTab === 'csat' && csatReport}
+    <div class="grid grid-cols-1 lg:grid-cols-3 gap-4">
+      <div class="bg-white rounded-xl shadow-sm border border-gray-200 p-6">
+        <h3 class="font-semibold text-gray-700 mb-4">Resumen CSAT</h3>
+        {#if csatReport.avg_rating}
+          <div class="text-center">
+            <p class="text-5xl font-bold text-yellow-500">{csatReport.avg_rating.toFixed(1)}</p>
+            <p class="text-3xl mt-1 text-yellow-400">{stars(csatReport.avg_rating)}</p>
+            <p class="text-sm text-gray-500 mt-2">{csatReport.total_rated} de {csatReport.total_tickets} tickets calificados</p>
+            <p class="text-sm font-medium text-blue-600 mt-1">{csatReport.response_rate}% tasa de respuesta</p>
+          </div>
+          <div class="mt-6 space-y-2">
+            {#each [5, 4, 3, 2, 1] as star}
+              {@const count = csatReport.distribution[`rating_${star}`] ?? 0}
+              {@const pct   = csatReport.total_rated > 0 ? Math.round(count / csatReport.total_rated * 100) : 0}
+              <div class="flex items-center gap-2 text-sm">
+                <span class="text-yellow-400 w-6 text-right shrink-0">{star}★</span>
+                <div class="flex-1 bg-gray-100 rounded-full h-3">
+                  <div class="h-3 rounded-full bg-yellow-400" style="width:{pct}%"></div>
+                </div>
+                <span class="text-gray-500 w-8 text-right text-xs shrink-0">{count}</span>
+              </div>
+            {/each}
+          </div>
+        {:else}
+          <p class="text-gray-400 text-center py-4">Sin calificaciones en este período</p>
+        {/if}
+      </div>
+      <div class="bg-white rounded-xl shadow-sm border border-gray-200 p-6">
+        <h3 class="font-semibold text-gray-700 mb-4">CSAT por categoría</h3>
+        {#if csatReport.by_category.length}
+          <div class="space-y-3">
+            {#each csatReport.by_category as item}
+              <div>
+                <div class="flex justify-between items-center text-sm mb-1">
+                  <span class="text-gray-700 truncate">{item.category}</span>
+                  <span class="text-yellow-500 font-medium ml-2 shrink-0">{item.avg_rating ? item.avg_rating.toFixed(1) + ' ★' : '—'}</span>
+                </div>
+                <div class="bg-gray-100 rounded-full h-2">
+                  <div class="h-2 rounded-full bg-yellow-400" style="width:{item.avg_rating ? item.avg_rating / 5 * 100 : 0}%"></div>
+                </div>
+                <p class="text-xs text-gray-400 mt-0.5">{item.total_rated} calificaciones</p>
+              </div>
+            {/each}
+          </div>
+        {:else}
+          <p class="text-gray-400 text-sm">Sin datos</p>
+        {/if}
+      </div>
+      <div class="bg-white rounded-xl shadow-sm border border-gray-200 p-6">
+        <h3 class="font-semibold text-gray-700 mb-4">CSAT por agente</h3>
+        {#if csatReport.by_agent.length}
+          <div class="space-y-3">
+            {#each csatReport.by_agent as item}
+              <div>
+                <div class="flex justify-between items-center text-sm mb-1">
+                  <span class="text-gray-700 truncate">{item.agent}</span>
+                  <span class="text-yellow-500 font-medium ml-2 shrink-0">{item.avg_rating ? item.avg_rating.toFixed(1) + ' ★' : '—'}</span>
+                </div>
+                <div class="bg-gray-100 rounded-full h-2">
+                  <div class="h-2 rounded-full bg-yellow-400" style="width:{item.avg_rating ? item.avg_rating / 5 * 100 : 0}%"></div>
+                </div>
+                <p class="text-xs text-gray-400 mt-0.5">{item.total_rated} calificaciones</p>
+              </div>
+            {/each}
+          </div>
+        {:else}
+          <p class="text-gray-400 text-sm">Sin datos</p>
+        {/if}
+      </div>
+    </div>
+    {#if csatReport.recent_comments?.length > 0}
+      <div class="bg-white rounded-xl shadow-sm border border-gray-200 p-6">
+        <h3 class="font-semibold text-gray-700 mb-4">Comentarios recientes</h3>
+        <div class="space-y-3">
+          {#each csatReport.recent_comments as c}
+            <div class="flex gap-3 items-start pb-3 border-b border-gray-100 last:border-0">
+              <span class="text-yellow-400 font-bold text-lg shrink-0 leading-none">
+                {'★'.repeat(c.rating)}{'☆'.repeat(5 - c.rating)}
+              </span>
+              <div>
+                <p class="text-sm text-gray-700">{c.comment}</p>
+                <p class="text-xs text-gray-400 mt-0.5">
+                  {c.rated_at ? new Date(c.rated_at).toLocaleDateString('es-MX', { day: '2-digit', month: 'short', year: 'numeric' }) : ''}
+                </p>
+              </div>
+            </div>
+          {/each}
+        </div>
+      </div>
+    {/if}
+
+  <!-- ESTADO VACIO -->
+  {:else if !isLoading}
+    <div class="flex justify-center py-16">
+      <p class="text-gray-400">Selecciona un período o cambia de pestaña para ver el reporte.</p>
+    </div>
+  {/if}
+
+</div>

frontend-internal/src/routes/sla/violations/+page.svelte

@@ -188,12 +188,11 @@
   <!-- Stats Summary -->
   <div class="mt-6 bg-red-50 border-l-4 border-red-500 p-4 rounded-lg">
     <p class="text-sm text-red-800">
-          <strong class="font-bold">{total}</strong> {total === 1 ? 'violación activa' : 'violaciones activas'} encontradas
-          {#if total > 0}
-            - Requieren atención inmediata
-          {/if}
-        </p>
-      </div>
+      <strong class="font-bold">{total}</strong> {total === 1 ? 'violación activa' : 'violaciones activas'} encontradas
+      {#if total > 0}
+        - Requieren atención inmediata
+      {/if}
+    </p>
   </div>
 
   <!-- Violations Table -->
@@ -282,12 +281,9 @@
                     <td class="whitespace-nowrap px-3 py-4 text-sm">
                       <div>
                         <span class="font-bold text-red-600 text-base">
-                            {formatHours(violation.hours_overdue)}
-                          </span>
-                          <div class="text-xs text-gray-600">
-                            vencido
-                          </div>
-                        </div>
+                          {formatHours(violation.hours_overdue)}
+                        </span>
+                        <div class="text-xs text-gray-600">vencido</div>
                       </div>
                     </td>
                     <td class="whitespace-nowrap px-3 py-4 text-sm text-gray-500">

frontend-internal/src/routes/tickets/+page.svelte

@@ -86,7 +86,7 @@
   $: filteredTickets = allTickets.filter(t => {
     if (filterStatus && t.status !== filterStatus) return false;
     if (filterPriority && t.priority !== filterPriority) return false;
-    if (filterTenantId && t.tenant?.id !== filterTenantId) return false;
+    if (filterTenantId && (t.tenant_id ?? t.tenant?.id) !== filterTenantId) return false;
     if (searchQuery) {
       const q = searchQuery.toLowerCase();
       const haystack =
@@ -155,7 +155,7 @@
   $: tenantCounts = (() => {
     const counts: Record<string, number> = {};
     for (const t of allTickets) {
-      const id = t.tenant?.id;
+      const id = t.tenant_id ?? t.tenant?.id;
       if (id) counts[id] = (counts[id] || 0) + 1;
     }
     return counts;
@@ -311,56 +311,25 @@
 ------------------------------------------------------------------------------ -->
 <div class="flex gap-5 px-4 py-5 mx-auto max-w-full sm:px-6 lg:px-8">
   <aside class="w-60 flex-shrink-0 space-y-4">
-    <div class="bg-white rounded-lg shadow border border-gray-200 overflow-hidden">
-      <div class="bg-blue-700 px-4 py-3">
-        <h2 class="text-sm font-semibold text-white tracking-wide">Organización</h2>
-      </div>
-      <ul class="divide-y divide-gray-100">
-        <li>
-          <button
-            class="w-full text-left px-4 py-2.5 flex items-center justify-between text-sm transition-colors
-              {filterTenantId === ''
-              ? 'bg-blue-50 text-blue-700 font-semibold'
-              : 'text-gray-700 hover:bg-gray-50'}"
-            on:click={() => {
-              filterTenantId = '';
-            }}
-          >
-            <span>Todas</span>
-            <span class="text-xs bg-gray-100 text-gray-600 rounded-full px-2 py-0.5 font-medium">
-              {allTickets.length}
-            </span>
-          </button>
-        </li>
-        {#each tenants as tenant}
-          {#if (tenantCounts[tenant.id] ?? 0) > 0}
-            <li>
-              <button
-                class="w-full text-left px-4 py-2.5 flex items-center justify-between text-sm transition-colors
-                  {filterTenantId === tenant.id
-                  ? 'bg-blue-50 text-blue-700 font-semibold'
-                  : 'text-gray-700 hover:bg-gray-50'}"
-                on:click={() => {
-                  filterTenantId = tenant.id;
-                  categoryPages = {};
-                }}
-              >
-                <span class="truncate pr-1">{tenant.name}</span>
-                <span
-                  class="text-xs bg-gray-100 text-blue-700 rounded-full px-2 py-0.5 font-medium flex-shrink-0 border border-gray-200"
-                >
-                  {tenantCounts[tenant.id] ?? 0}
-                </span>
-              </button>
-            </li>
-          {/if}
-        {/each}
-      </ul>
-    </div>
-
     <div class="bg-white rounded-lg shadow border border-gray-200 p-4 space-y-3">
       <h2 class="text-xs font-semibold text-gray-500 uppercase tracking-wide">Filtros</h2>
 
+      <div>
+        <label class="block text-xs font-medium text-gray-700 mb-1">Organización</label>
+        <select
+          bind:value={filterTenantId}
+          on:change={() => (categoryPages = {})}
+          class="block w-full rounded-md border-gray-300 text-sm focus:border-blue-500 focus:ring-blue-500 border px-2 py-1.5"
+        >
+          <option value="">Todas ({allTickets.length})</option>
+          {#each tenants as tenant}
+            {#if (tenantCounts[tenant.id] ?? 0) > 0}
+              <option value={tenant.id}>{tenant.name} ({tenantCounts[tenant.id] ?? 0})</option>
+            {/if}
+          {/each}
+        </select>
+      </div>
+
       <div>
         <label class="block text-xs font-medium text-gray-700 mb-1">Estado</label>
         <select

frontend-internal/vite.config.js

@@ -12,7 +12,7 @@ export default defineConfig({
 		},
 		proxy: {
 			'/api': {
-				target: process.env.PUBLIC_API_URL || 'http://backend:8000',
+				target: process.env.PUBLIC_API_URL || 'http://localhost:8000',
 				changeOrigin: true,
 				rewrite: (path) => path.replace(/^\/api/, '')
 			}

scripts/check_relations.py

@@ -0,0 +1,7 @@
+from app.models.ticket import Ticket
+from app.models import relationships  # ensure relationships are loaded
+from sqlalchemy import inspect
+
+mapper = inspect(Ticket)
+print("Relationships:", [r.key for r in mapper.relationships])
+print("Columns:", [c.key for c in mapper.columns])

scripts/check_sla.py

@@ -0,0 +1,40 @@
+"""Check SLA state of tickets and categories"""
+import asyncio
+import os
+import sys
+
+sys.path.insert(0, '/app')
+os.chdir('/app')
+
+from sqlalchemy.ext.asyncio import create_async_engine
+from sqlalchemy import text
+
+
+async def run():
+    database_url = os.environ.get('DATABASE_URL', 'postgresql+asyncpg://postgres:postgres@db:5432/servicemanager')
+    engine = create_async_engine(database_url)
+
+    async with engine.connect() as c:
+        print("=== CATEGORIES SLA HOURS ===")
+        r = await c.execute(text(
+            "SELECT name, sla_response_hours, sla_resolution_hours "
+            "FROM ticket_categories "
+            "ORDER BY name"
+        ))
+        for row in r.fetchall():
+            print(f"  {row[0]}: response={row[1]}h, resolution={row[2]}h")
+
+        print("\n=== TICKETS SLA DATES ===")
+        r2 = await c.execute(text(
+            "SELECT ticket_number, category_id, sla_response_due, sla_resolution_due "
+            "FROM tickets "
+            "ORDER BY created_at "
+            "LIMIT 10"
+        ))
+        for row in r2.fetchall():
+            print(f"  {row[0]}: cat={str(row[1])[:8] if row[1] else 'None'}, sla_resp={row[2]}, sla_res={row[3]}")
+
+    await engine.dispose()
+
+
+asyncio.run(run())

scripts/debug_category.py

@@ -0,0 +1,41 @@
+"""Debug: check if ticket's category_id maps to a valid category and what tenant it belongs to"""
+import asyncio
+import os
+import sys
+
+sys.path.insert(0, '/app')
+os.chdir('/app')
+
+from sqlalchemy.ext.asyncio import create_async_engine
+from sqlalchemy import text
+
+
+async def run():
+    database_url = os.environ.get('DATABASE_URL', 'postgresql+asyncpg://postgres:postgres@db:5432/servicemanager')
+    engine = create_async_engine(database_url)
+
+    async with engine.connect() as c:
+        # Check tickets and their category names via direct JOIN
+        r = await c.execute(text("""
+            SELECT t.ticket_number, t.category_id,
+                   cat.name as category_name, cat.tenant_id as cat_tenant,
+                   t.tenant_id as ticket_tenant
+            FROM tickets t
+            LEFT JOIN ticket_categories cat ON cat.id = t.category_id
+            WHERE t.category_id IS NOT NULL
+            LIMIT 10
+        """))
+        print("=== TICKET -> CATEGORY JOIN ===")
+        for row in r.fetchall():
+            match = "✓ SAME TENANT" if row[3] == row[4] else "✗ DIFFERENT TENANT"
+            print(f"  {row[0]}: cat_id={str(row[1])[:8]}, cat_name={row[2]}, {match}")
+
+        # Check what tenant aduanasoft-demo is
+        r2 = await c.execute(text("SELECT id, slug FROM tenants WHERE slug='aduanasoft-demo'"))
+        tenant = r2.fetchone()
+        print(f"\nTenant aduanasoft-demo: {tenant[0] if tenant else 'NOT FOUND'}")
+
+    await engine.dispose()
+
+
+asyncio.run(run())

scripts/debug_orm.py

@@ -0,0 +1,49 @@
+"""Debug: check SQLAlchemy ORM category loading"""
+import asyncio
+import os
+import sys
+
+sys.path.insert(0, '/app')
+os.chdir('/app')
+
+from sqlalchemy.ext.asyncio import create_async_engine, AsyncSession
+from sqlalchemy.orm import sessionmaker, selectinload
+from sqlalchemy import select
+from app.models.ticket import Ticket
+from app.models.category import Category
+
+
+async def run():
+    database_url = os.environ.get('DATABASE_URL', 'postgresql+asyncpg://postgres:postgres@db:5432/servicemanager')
+    engine = create_async_engine(database_url, echo=True)
+    async_session = sessionmaker(engine, class_=AsyncSession, expire_on_commit=False)
+
+    async with async_session() as session:
+        # Test selectinload
+        result = await session.execute(
+            select(Ticket)
+            .options(selectinload(Ticket.category))
+            .where(Ticket.category_id != None)
+            .limit(3)
+        )
+        tickets = result.scalars().all()
+
+        print(f"\n=== ORM RESULTS ({len(tickets)} tickets) ===")
+        for t in tickets:
+            print(f"  {t.ticket_number}: category_id={t.category_id}, category={t.category}")
+            if t.category:
+                print(f"    -> category.name={t.category.name}")
+            else:
+                print(f"    -> category is None!")
+
+        # Check if Category model can be queried directly
+        r2 = await session.execute(select(Category).limit(3))
+        cats = r2.scalars().all()
+        print(f"\n=== DIRECT CATEGORY QUERY ({len(cats)} categories) ===")
+        for c in cats:
+            print(f"  id={c.id}, name={c.name}")
+
+    await engine.dispose()
+
+
+asyncio.run(run())

scripts/fix_sla_dates.py

@@ -0,0 +1,82 @@
+"""
+Backfill SLA response_due and resolution_due on all tickets that have
+a category but no SLA dates set.
+"""
+import asyncio
+import os
+import sys
+from datetime import timedelta
+
+sys.path.insert(0, '/app')
+os.chdir('/app')
+
+from sqlalchemy.ext.asyncio import create_async_engine, AsyncSession
+from sqlalchemy.orm import sessionmaker
+from sqlalchemy import text
+
+
+async def run():
+    database_url = os.environ.get(
+        'DATABASE_URL',
+        'postgresql+asyncpg://postgres:postgres@db:5432/servicemanager'
+    )
+    engine = create_async_engine(database_url)
+    async_session = sessionmaker(engine, class_=AsyncSession, expire_on_commit=False)
+
+    async with async_session() as session:
+        # Find all tickets with a category but missing SLA dates
+        result = await session.execute(text("""
+            SELECT
+                t.id,
+                t.created_at,
+                c.sla_response_hours,
+                c.sla_resolution_hours
+            FROM tickets t
+            JOIN ticket_categories c ON c.id = t.category_id
+            WHERE t.sla_response_due IS NULL
+              AND t.sla_resolution_due IS NULL
+        """))
+        rows = result.fetchall()
+        print(f"Tickets to update: {len(rows)}")
+
+        updated = 0
+        for row in rows:
+            ticket_id, created_at, resp_h, res_h = row
+            # Ensure naive datetime for DB compatibility
+            if hasattr(created_at, 'tzinfo') and created_at.tzinfo is not None:
+                from datetime import timezone
+                created_at = created_at.astimezone(timezone.utc).replace(tzinfo=None)
+            sla_response_due = created_at + timedelta(hours=float(resp_h))
+            sla_resolution_due = created_at + timedelta(hours=float(res_h))
+
+            await session.execute(text("""
+                UPDATE tickets
+                SET sla_response_due   = :sla_resp,
+                    sla_resolution_due = :sla_res
+                WHERE id = :ticket_id
+            """), {
+                "sla_resp":    sla_response_due,
+                "sla_res":     sla_resolution_due,
+                "ticket_id":   ticket_id,
+            })
+            updated += 1
+
+        await session.commit()
+        print(f"Updated {updated} tickets with SLA dates.")
+
+        # Verify
+        r2 = await session.execute(text("""
+            SELECT ticket_number, sla_response_due, sla_resolution_due
+            FROM tickets
+            WHERE sla_response_due IS NOT NULL
+            ORDER BY created_at
+            LIMIT 10
+        """))
+        print("\nSample of tickets with SLA dates now:")
+        for row in r2.fetchall():
+            print(f"  {row[0]}: response_due={row[1]}, resolution_due={row[2]}")
+
+    await engine.dispose()
+
+
+asyncio.run(run())

scripts/seed_data.py

@@ -0,0 +1,238 @@
+"""
+Script de datos iniciales (seed) para ServiceManagerWeb.
+Crea categorías, sistemas, y usuarios de prueba en el tenant aduanasoft-demo.
+Ejecutar desde dentro del contenedor: python /scripts/seed_data.py
+"""
+import asyncio
+import sys
+
+from sqlalchemy.ext.asyncio import create_async_engine, AsyncSession
+from sqlalchemy.orm import sessionmaker
+from sqlalchemy import select
+
+# Configurar path para importar el app
+sys.path.insert(0, '/app')
+
+from app.core.config import get_settings
+
+settings = get_settings()
+from app.core.security import security
+from app.models.tenant import Tenant
+from app.models.category import Category
+from app.models.system import System
+from app.models.user import User, UserRole
+
+TENANT_SLUG = "aduanasoft-demo"
+
+CATEGORIES = [
+    {
+        "name": "Soporte Técnico",
+        "description": "Problemas técnicos con sistemas y aplicaciones empresariales",
+        "color": "#EF4444",
+        "sla_response_hours": 2,
+        "sla_resolution_hours": 24,
+        "is_active": True,
+    },
+    {
+        "name": "Facturación",
+        "description": "Consultas y problemas relacionados con facturación y pagos",
+        "color": "#F59E0B",
+        "sla_response_hours": 4,
+        "sla_resolution_hours": 48,
+        "is_active": True,
+    },
+    {
+        "name": "Incidentes Críticos",
+        "description": "Fallas graves que afectan la operación del negocio",
+        "color": "#DC2626",
+        "sla_response_hours": 1,
+        "sla_resolution_hours": 8,
+        "is_active": True,
+    },
+    {
+        "name": "Consultas Generales",
+        "description": "Preguntas generales sobre productos y servicios",
+        "color": "#3B82F6",
+        "sla_response_hours": 8,
+        "sla_resolution_hours": 72,
+        "is_active": True,
+    },
+    {
+        "name": "Capacitación",
+        "description": "Solicitudes de entrenamiento y capacitación en sistemas",
+        "color": "#8B5CF6",
+        "sla_response_hours": 24,
+        "sla_resolution_hours": 96,
+        "is_active": True,
+    },
+    {
+        "name": "Infraestructura",
+        "description": "Problemas de red, servidores y componentes de infraestructura",
+        "color": "#06B6D4",
+        "sla_response_hours": 2,
+        "sla_resolution_hours": 16,
+        "is_active": True,
+    },
+]
+
+SYSTEMS = [
+    {
+        "name": "ERP Aduanero",
+        "description": "Sistema principal de gestión aduanera y comercio exterior",
+        "is_active": True,
+    },
+    {
+        "name": "Portal Web",
+        "description": "Portal de autogestión y consultas en línea para clientes",
+        "is_active": True,
+    },
+    {
+        "name": "Gestión Documental",
+        "description": "Sistema de administración y archivo de documentos aduaneros",
+        "is_active": True,
+    },
+    {
+        "name": "App Móvil",
+        "description": "Aplicación móvil para seguimiento de trámites en tiempo real",
+        "is_active": True,
+    },
+    {
+        "name": "Reportes y BI",
+        "description": "Plataforma de inteligencia de negocio y generación de reportes",
+        "is_active": True,
+    },
+]
+
+USERS = [
+    {
+        "email": "agente@aduanasoft.com",
+        "password": "agente123",
+        "first_name": "Carlos",
+        "last_name": "Agente",
+        "role": UserRole.AGENT,
+        "is_active": True,
+    },
+    {
+        "email": "manager@aduanasoft.com",
+        "password": "manager123",
+        "first_name": "Laura",
+        "last_name": "Gerente",
+        "role": UserRole.SUPPORT_MANAGER,
+        "is_active": True,
+    },
+    {
+        "email": "cliente@empresa-demo.com",
+        "password": "cliente123",
+        "first_name": "Roberto",
+        "last_name": "Cliente",
+        "role": UserRole.CLIENT_USER,
+        "is_active": True,
+    },
+    {
+        "email": "admin-cliente@empresa-demo.com",
+        "password": "clienteadmin123",
+        "first_name": "Ana",
+        "last_name": "Admin",
+        "role": UserRole.CLIENT_ADMIN,
+        "is_active": True,
+    },
+]
+
+
+async def main():
+    engine = create_async_engine(settings.DATABASE_URL, echo=False)
+    async_session = sessionmaker(engine, class_=AsyncSession, expire_on_commit=False)
+
+    async with async_session() as session:
+        # 1. Obtener tenant
+        result = await session.execute(
+            select(Tenant).where(Tenant.slug == TENANT_SLUG)
+        )
+        tenant = result.scalar_one_or_none()
+
+        if not tenant:
+            print(f"ERROR: Tenant '{TENANT_SLUG}' no encontrado. Ejecuta el seed de tenants primero.")
+            return
+
+        tenant_id = tenant.id
+        print(f"✅ Tenant: {tenant.name} (id={str(tenant_id)[:8]}...)")
+
+        # 2. Categorías
+        print("\n📁 Creando categorías:")
+        # Eliminar la categoría "Infraestructura" duplicada creada previamente si existe
+        existing_cats = (await session.execute(
+            select(Category).where(Category.tenant_id == tenant_id)
+        )).scalars().all()
+        existing_names = {c.name for c in existing_cats}
+        
+        created = 0
+        for cat_data in CATEGORIES:
+            if cat_data["name"] in existing_names:
+                print(f"  ⏭  Ya existe: {cat_data['name']}")
+                continue
+            cat = Category(
+                tenant_id=tenant_id,
+                **cat_data,
+            )
+            session.add(cat)
+            print(f"  ✓  {cat_data['name']} (resp={cat_data['sla_response_hours']}h, resol={cat_data['sla_resolution_hours']}h)")
+            created += 1
+
+        await session.flush()
+        print(f"  → {created} categorías creadas, {len(existing_names)} ya existían")
+
+        # 3. Sistemas
+        print("\n🖥  Creando sistemas:")
+        existing_sys = (await session.execute(
+            select(System).where(System.tenant_id == tenant_id)
+        )).scalars().all()
+        existing_sys_names = {s.name for s in existing_sys}
+
+        created_sys = 0
+        for sys_data in SYSTEMS:
+            if sys_data["name"] in existing_sys_names:
+                print(f"  ⏭  Ya existe: {sys_data['name']}")
+                continue
+            sys_obj = System(
+                tenant_id=tenant_id,
+                **sys_data,
+            )
+            session.add(sys_obj)
+            print(f"  ✓  {sys_data['name']}")
+            created_sys += 1
+
+        await session.flush()
+        print(f"  → {created_sys} sistemas creados")
+
+        # 4. Usuarios
+        print("\n👤 Creando usuarios:")
+        existing_users = (await session.execute(
+            select(User).where(User.tenant_id == tenant_id)
+        )).scalars().all()
+        existing_emails = {u.email for u in existing_users}
+
+        created_users = 0
+        for user_data in USERS:
+            if user_data["email"] in existing_emails:
+                print(f"  ⏭  Ya existe: {user_data['email']}")
+                continue
+            pwd = user_data.pop("password")
+            hashed_pwd = security.hash_password(pwd)
+            user = User(
+                tenant_id=tenant_id,
+                password_hash=hashed_pwd,
+                **user_data,
+            )
+            session.add(user)
+            print(f"  ✓  {user_data['email']}  [{user_data['role'].value}]  pwd={pwd}")
+            created_users += 1
+
+        await session.commit()
+        print(f"  → {created_users} usuarios creados")
+
+    await engine.dispose()
+    print("\n🎉 Seed completado exitosamente.")
+
+
+if __name__ == "__main__":
+    asyncio.run(main())

scripts/seed_tickets.py

@@ -0,0 +1,215 @@
+"""
+Seed de tickets de demostración para ServiceManagerWeb.
+Crea tickets variados con categorías, sistemas y prioridades diferentes.
+"""
+import asyncio
+import sys
+
+sys.path.insert(0, '/app')
+
+from sqlalchemy.ext.asyncio import create_async_engine, AsyncSession
+from sqlalchemy.orm import sessionmaker
+from sqlalchemy import select
+
+from app.core.config import get_settings
+from app.models.tenant import Tenant
+from app.models.user import User
+from app.models.category import Category
+from app.models.system import System
+from app.models.ticket import Ticket, TicketStatus, TicketPriority
+from app.models.comment import TicketComment
+
+settings = get_settings()
+
+TENANT_SLUG = "aduanasoft-demo"
+
+DEMO_TICKETS = [
+    {
+        "subject": "Error en módulo de importaciones del ERP",
+        "description": "Al intentar registrar una nueva importación, el sistema arroja el error 'NullReferenceException' en el módulo de gestión aduanera. Esto bloquea completamente el flujo de trabajo de importaciones para todos los usuarios del área.",
+        "priority": TicketPriority.URGENT,
+        "category_name": "Incidentes Críticos",
+        "system_name": "ERP Aduanero",
+        "status": TicketStatus.IN_PROGRESS,
+    },
+    {
+        "subject": "No puedo acceder al portal web desde el lunes",
+        "description": "Desde el lunes 18 de febrero, el portal web no carga correctamente. La página queda en blanco y en la consola del navegador aparece un error 503. He probado desde diferentes equipos y navegadores con el mismo resultado.",
+        "priority": TicketPriority.HIGH,
+        "category_name": "Soporte Técnico",
+        "system_name": "Portal Web",
+        "status": TicketStatus.NEW,
+    },
+    {
+        "subject": "Solicitud de capacitación en módulo de reportes",
+        "description": "Nuestro equipo necesita una sesión de capacitación para el nuevo módulo de reportes y BI. Somos 8 personas del área de contabilidad. Por favor confirmar disponibilidad para la semana del 3 de marzo.",
+        "priority": TicketPriority.LOW,
+        "category_name": "Capacitación",
+        "system_name": "Reportes y BI",
+        "status": TicketStatus.NEW,
+    },
+    {
+        "subject": "Discrepancia en factura #F-2024-0892",
+        "description": "La factura F-2024-0892 emitida el 15 de febrero muestra un monto de $47,500 MXN pero según nuestros registros el importe correcto es $45,200 MXN. Favor revisar y emitir nota de crédito si corresponde.",
+        "priority": TicketPriority.MEDIUM,
+        "category_name": "Facturación",
+        "system_name": None,
+        "status": TicketStatus.WAITING_CUSTOMER,
+    },
+    {
+        "subject": "La app móvil no sincroniza pedidos pendientes",
+        "description": "En la aplicación móvil versión 3.2.1, los pedidos creados desde el celular no se sincronizan al ERP. Ya desinstalé y reinstalé la app. El problema persiste en iOS y Android.",
+        "priority": TicketPriority.HIGH,
+        "category_name": "Soporte Técnico",
+        "system_name": "App Móvil",
+        "status": TicketStatus.IN_PROGRESS,
+    },
+    {
+        "subject": "Consulta sobre proceso de pedimento de exportación",
+        "description": "¿Cuáles son los documentos necesarios para tramitar un pedimento de exportación bajo la clave A1? Necesito la lista actualizada con los cambios del SAT de enero 2025.",
+        "priority": TicketPriority.LOW,
+        "category_name": "Consultas Generales",
+        "system_name": None,
+        "status": TicketStatus.RESOLVED,
+    },
+    {
+        "subject": "Servidores lentos en horario pico (11am-2pm)",
+        "description": "Durante el horario de 11am a 2pm el ERP se vuelve extremadamente lento. Las consultas que normalmente tardan 2 segundos pueden llevar hasta 45 segundos. El problema afecta a todos los usuarios concurrentemente.",
+        "priority": TicketPriority.URGENT,
+        "category_name": "Infraestructura",
+        "system_name": "ERP Aduanero",
+        "status": TicketStatus.IN_PROGRESS,
+    },
+    {
+        "subject": "Error al generar reporte mensual de exportaciones",
+        "description": "El reporte de exportaciones del mes de enero no se genera correctamente. Al dar clic en 'Generar PDF' aparece un error: 'Timeout al procesar el reporte'. Necesito este reporte para la reunión del viernes.",
+        "priority": TicketPriority.MEDIUM,
+        "category_name": "Soporte Técnico",
+        "system_name": "Reportes y BI",
+        "status": TicketStatus.NEW,
+    },
+]
+
+DEMO_COMMENTS = {
+    "Error en módulo de importaciones del ERP": [
+        ("admin@aduanasoft.com", "Hemos identificado el problema. Es un error en la versión 4.2.1 del ERP. Estamos aplicando el parche de emergencia. Estimamos resolución en 2 horas.", False),
+        ("cliente@empresa-demo.com", "Gracias por la respuesta rápida. ¿Podemos continuar con el registro manual mientras tanto?", False),
+    ],
+    "No puedo acceder al portal web desde el lunes": [
+        ("agente@aduanasoft.com", "Hemos recibido tu ticket. ¿Puedes indicarnos el mensaje exacto que aparece en la consola del navegador? Esto nos ayudará a diagnosticar más rápido.", False),
+    ],
+}
+
+
+async def main():
+    engine = create_async_engine(settings.DATABASE_URL, echo=False)
+    async_session = sessionmaker(engine, class_=AsyncSession, expire_on_commit=False)
+
+    async with async_session() as session:
+        # Obtener tenant
+        result = await session.execute(select(Tenant).where(Tenant.slug == TENANT_SLUG))
+        tenant = result.scalar_one_or_none()
+        if not tenant:
+            print(f"ERROR: Tenant '{TENANT_SLUG}' no encontrado.")
+            return
+
+        tenant_id = tenant.id
+        print(f"✅ Tenant: {tenant.name}")
+
+        # Obtener usuario cliente para asignar como creador
+        client_user_result = await session.execute(
+            select(User).where(User.email == "cliente@empresa-demo.com").limit(1)
+        )
+        client_user = client_user_result.scalar_one_or_none()
+        if not client_user:
+            print("ERROR: cliente@empresa-demo.com no encontrado")
+            return
+
+        # Obtener agente para comentarios
+        agent_result = await session.execute(
+            select(User).where(User.email == "agente@aduanasoft.com").limit(1)
+        )
+        agent_user = agent_result.scalar_one_or_none()
+
+        admin_result = await session.execute(
+            select(User).where(User.email == "admin@aduanasoft.com").limit(1)
+        )
+        admin_user = admin_result.scalar_one_or_none()
+
+        # Mapear categorías y sistemas
+        cats_result = await session.execute(select(Category).where(Category.tenant_id == tenant_id))
+        cats = {c.name: c for c in cats_result.scalars().all()}
+
+        sys_result = await session.execute(select(System).where(System.tenant_id == tenant_id))
+        systems = {s.name: s for s in sys_result.scalars().all()}
+
+        # Verificar tickets existentes
+        existing_tickets_result = await session.execute(
+            select(Ticket).where(Ticket.tenant_id == tenant_id)
+        )
+        existing_subjects = {t.subject for t in existing_tickets_result.scalars().all()}
+
+        print(f"\n🎫 Creando tickets de demostración:")
+        created = 0
+        ticket_objects = {}
+
+        for ticket_data in DEMO_TICKETS:
+            subject = ticket_data["subject"]
+            if subject in existing_subjects:
+                print(f"  ⏭  Ya existe: {subject[:50]}...")
+                continue
+
+            cat_name = ticket_data.pop("category_name", None)
+            sys_name = ticket_data.pop("system_name", None)
+
+            category = cats.get(cat_name) if cat_name else None
+            system = systems.get(sys_name) if sys_name else None
+
+            ticket = Ticket(
+                tenant_id=tenant_id,
+                category_id=category.id if category else None,
+                affected_system_id=system.id if system else None,
+                created_by=client_user.id,
+                **ticket_data,
+            )
+            session.add(ticket)
+            await session.flush()  # Para obtener el ID
+            ticket_objects[subject] = ticket
+            print(f"  ✓  [{ticket_data['priority'].value}] {subject[:60]}")
+            created += 1
+
+        await session.flush()
+
+        # Crear comentarios de demostración
+        print(f"\n💬 Añadiendo comentarios:")
+        for subject, comments in DEMO_COMMENTS.items():
+            ticket = ticket_objects.get(subject)
+            if not ticket:
+                continue
+            for author_email, content, is_internal in comments:
+                if author_email == "admin@aduanasoft.com":
+                    author = admin_user
+                elif author_email == "agente@aduanasoft.com":
+                    author = agent_user
+                else:
+                    author = client_user
+
+                if author:
+                    comment = TicketComment(
+                        ticket_id=ticket.id,
+                        author_id=author.id,
+                        content=content,
+                        is_internal=is_internal,
+                    )
+                    session.add(comment)
+                    print(f"  ✓  Comentario en '{subject[:40]}...' por {author_email}")
+
+        await session.commit()
+        print(f"\n✅ {created} tickets creados exitosamente.")
+
+    await engine.dispose()
+    print("🎉 Seed de tickets completado.")
+
+
+if __name__ == "__main__":
+    asyncio.run(main())