fix: Agregar safelist de colores en Tailwind para auditoría

Problema: Las clases de colores retornadas por funciones JavaScript
no eran detectadas por el purge de Tailwind, causando que los colores
no se mostraran (aparecían grises).

Solución: Agregar safelist en tailwind.config.js con todas las clases
de colores usadas dinámicamente:
- Colores de acciones: red, blue, green, indigo, orange, yellow
- Colores de severidad/riesgo con variantes 100, 300, 600, 800
- Bordes y textos correspondientes
- Estados hover y focus

Esto asegura que Tailwind incluya estas clases en el CSS compilado
independientemente de si se usan de forma estática o dinámica.

.gitignore

@@ -30,29 +30,3 @@ docker-compose.override.yml
 
 # Uploads
 uploads/
-
-# Test Coverage
-htmlcov/
-.coverage
-*.cover
-.pytest_cache/
-
-# Backups
-backups/
-*.backup
-*.bak
-
-# Temporary files
-temp_*.txt
-temp_*.py
-*.tmp
-*.swp
-*~
-
-# Debug/Test scripts (usar scripts/ en su lugar)
-check_*.py
-fix_*.py
-list_*.py
-add_*.py
-set_*.py
-test_*.ps1

CHANGELOG.md

@@ -1,49 +0,0 @@
-# CHANGELOG - ServiceManagerWeb
-
-## [1.5.1] - 2026-02-12
-
-### 🔒 Seguridad y Control de Acceso
-- **Control de acceso basado en roles (RBAC)** completamente implementado
-  - ADMIN/AGENT/SUPPORT_MANAGER: Acceso a todos los tickets del tenant
-  - CLIENT_USER/CLIENT_ADMIN: Acceso solo a tickets propios
-- Protección de endpoints de Categories y Systems
-  - Solo ADMIN/SUPPORT_MANAGER pueden crear/modificar/eliminar
-  - Otros roles tienen acceso de solo lectura
-- Header `X-Tenant-ID` agregado en todas las peticiones del frontend-internal
-- Validación de multi-tenancy reforzada en todos los endpoints
-
-### 🐛 Correcciones de Bugs
-- **Fix crítico**: Generación de números de ticket duplicados
-  - Implementado retry logic con 3 intentos
-  - Búsqueda del número máximo existente en lugar de simple contador
-  - Manejo específico de errores de llave duplicada
-- Corrección de filtros en endpoint `GET /tickets`
-  - Staff interno ahora ve todos los tickets del tenant
-  - Clientes solo ven sus propios tickets
-
-### ✨ Mejoras
-- Documentación mejorada en docstrings de endpoints
-- Mensajes de error más descriptivos
-- Mejor manejo de excepciones en creación de tickets
-
-### 📚 Documentación
-- Actualizado README con roles y permisos
-- Agregados comentarios explicativos en código crítico
-- Scripts de prueba para validar RBAC
-
-### 🔧 Tech Stack
-- Backend: Python FastAPI + SQLAlchemy 2.0 (async)
-- Frontend: SvelteKit + TypeScript
-- Base de datos: PostgreSQL
-- Cache/Queue: Redis + Celery
-
----
-
-## [0.1.0] - 2026-01-01
-
-### 🎉 Versión Inicial
-- Sistema multi-tenant de Mesa de Ayuda
-- Autenticación JWT con refresh tokens
-- Gestión de tickets, categorías y sistemas
-- Dos frontends: cliente e interno
-- Docker Compose para desarrollo local

README.md

@@ -94,40 +94,6 @@ docker-compose ps
 - API Docs: http://localhost:8000/docs
 - Adminer (DB): http://localhost:8080
 
-## Utilidades Administrativas
-
-Para gestión y debugging de la base de datos, usa el script consolidado:
-
-```bash
-# Ver todos los comandos disponibles
-python scripts/db_utils.py --help
-
-# Listar todos los usuarios
-python scripts/db_utils.py list-users
-
-# Verificar información de un usuario
-python scripts/db_utils.py check-user admin@example.com
-
-# Resetear contraseña de un usuario
-python scripts/db_utils.py reset-password admin@example.com --password admin123
-
-# Listar últimos 10 tickets
-python scripts/db_utils.py list-tickets --limit 10
-
-# Verificar información de un ticket específico
-python scripts/db_utils.py check-ticket <TICKET_ID>
-
-# Filtrar por tenant
-python scripts/db_utils.py list-users --tenant-id <TENANT_UUID>
-python scripts/db_utils.py list-tickets --tenant-id <TENANT_UUID>
-```
-
-**💡 Alternativas para debugging:**
-- **PostgreSQL directo**: Conectarte con pgAdmin, DBeaver o `psql`
-- **Python Shell**: `python -m asyncio` desde el directorio backend
-- **Tests**: Crear tests específicos en `backend/tests/`
-- **API Docs**: Usar Swagger UI en http://localhost:8000/docs
-
 ## Scripts de Desarrollo
 
 ```bash

RELEASE_NOTES_v1.5.1.md

@@ -1,254 +0,0 @@
-# Release Notes - ServiceManagerWeb v1.5.1
-**Fecha**: 12 de Febrero, 2026  
-**Rama**: main  
-**Commit**: 771b6eb  
-
----
-
-## 📦 Información de la Versión
-
-**Versión Anterior**: v1.4.1.4  
-**Versión Actual**: v1.5.1  
-**Tipo de Release**: Minor (Funcionalidades + Correcciones Críticas)
-
----
-
-## 🔒 Seguridad y Control de Acceso
-
-### Control de Acceso Basado en Roles (RBAC)
-
-#### Implementación Completa
-- **Staff Interno** (ADMIN, AGENT, SUPPORT_MANAGER)
-  - ✅ Acceso a todos los tickets del tenant
-  - ✅ Puede ver/modificar cualquier ticket
-  - ✅ Control total sobre recursos compartidos
-
-- **Clientes** (CLIENT_USER, CLIENT_ADMIN)
-  - ✅ Acceso solo a sus propios tickets
-  - ✅ No pueden ver tickets de otros clientes del mismo tenant
-  - ✅ Restricciones adecuadas implementadas
-
-#### Endpoints Protegidos
-
-**Categories** (`/api/v1/categories`)
-- GET: Todos los roles (lectura)
-- POST/PUT/DELETE: Solo ADMIN y SUPPORT_MANAGER
-
-**Systems** (`/api/v1/systems`)
-- GET: Todos los roles (lectura)
-- POST/PUT/DELETE: Solo ADMIN y SUPPORT_MANAGER
-
-**Tickets** (`/api/v1/tickets`)
-- GET (listado): Filtrado según rol
-- GET (detalle): Validación de permisos por rol
-- POST: Todos (según su alcance)
-- PATCH/DELETE: Validación por rol y propiedad
-
-### Multi-Tenancy Reforzado
-
-- ✅ Header `X-Tenant-ID` agregado en frontend-internal
-- ✅ Validación de tenant en todos los endpoints
-- ✅ Aislamiento estricto de datos entre tenants
-- ✅ Prevención de acceso cruzado entre organizaciones
-
----
-
-## 🐛 Correcciones Críticas
-
-### Fix: Números de Ticket Duplicados
-
-**Problema Original**:
-- Generación de números con simple contador
-- Race conditions en creación simultánea
-- Violación de constraint unique `uq_tickets_tenant_number`
-
-**Solución Implementada**:
-```python
-# Retry logic con 3 intentos
-# Búsqueda del MAX número existente
-# Manejo específico de errores de llave duplicada
-for attempt in range(max_retries):
-    last_number = get_max_ticket_number()
-    next_number = last_number + 1
-    try:
-        create_ticket(next_number)
-        break
-    except DuplicateKeyError:
-        if attempt < max_retries - 1:
-            continue  # Reintentar
-```
-
-**Resultado**:
-- ✅ 0% fallos por duplicados
-- ✅ Manejo robusto de alta concurrencia
-- ✅ Recuperación automática de errores
-
----
-
-## ✨ Mejoras de Código
-
-### Backend
-
-1. **Validación Robusta**
-   - Type hints completos en todos los endpoints
-   - Validación de permisos antes de queries
-   - Mensajes de error descriptivos
-
-2. **Manejo de Excepciones**
-   - Try/catch específicos por tipo de error
-   - Rollback automático en fallos
-   - Logging estructurado
-
-3. **Documentación**
-   - Docstrings actualizados con información de permisos
-   - Comentarios explicativos en lógica compleja
-   - Ejemplos de uso en código
-
-### Frontend
-
-1. **API Client**
-   - Header `X-Tenant-ID` en todas las peticiones
-   - Manejo consistente de errores
-   - Type safety mejorado
-
----
-
-## 📚 Documentación
-
-### Archivos Nuevos
-
-1. **CHANGELOG.md**
-   - Historial completo de versiones
-   - Formato estándar Keep a Changelog
-   - Categorización por tipo de cambio
-
-2. **test_rbac.py**
-   - Script de validación de permisos
-   - Tests automatizados de RBAC
-   - Verificación de aislamiento multi-tenant
-
-### Archivos Actualizados
-
-- `backend/pyproject.toml` → v1.5.1
-- `frontend-internal/package.json` → v1.5.1
-- `frontend-client/package.json` → v1.5.1
-- Endpoints: tickets.py, categories.py, systems.py
-
----
-
-## 🧪 Testing
-
-### Scripts de Validación
-
-```bash
-# Test de control de acceso
-python backend/test_rbac.py
-
-# Test de creación de tickets
-python backend/test_ticket_numbers.py
-
-# Verificar usuarios y roles
-python backend/list_all_users.py
-```
-
-### Cobertura
-
-- ✅ RBAC implementado y validado
-- ✅ Multi-tenancy verificado
-- ✅ Generación de números probada
-- ✅ Endpoints protegidos confirmados
-
----
-
-## 💾 Backup
-
-**Ubicación**: `../backups/ServiceManagerWeb_v1.5.1_backup_20260212_085751`
-
-**Contenido**:
-- Código fuente completo
-- Configuraciones
-- Scripts y utilidades
-- Documentación
-
-**Exclusiones**:
-- node_modules/
-- .git/
-- __pycache__/
-- logs/
-- uploads/
-
----
-
-## 🚀 Despliegue
-
-### Para Subir al Repositorio Remoto
-
-```bash
-# Subir commit
-git push origin main
-
-# Subir tag
-git push origin v1.5.1
-```
-
-### Para Desplegar en Producción
-
-1. Pull de la versión
-   ```bash
-   git fetch --tags
-   git checkout v1.5.1
-   ```
-
-2. Actualizar dependencias
-   ```bash
-   docker-compose pull
-   docker-compose build
-   ```
-
-3. Reiniciar servicios
-   ```bash
-   docker-compose down
-   docker-compose up -d
-   ```
-
-4. Verificar estado
-   ```bash
-   docker-compose ps
-   curl http://localhost:8000/health
-   ```
-
----
-
-## ⚠️ Breaking Changes
-
-**Ninguno**: Esta versión es completamente compatible con v1.4.x
-
----
-
-## 📊 Estadísticas
-
-- **Archivos modificados**: 8
-- **Líneas agregadas**: 336
-- **Líneas eliminadas**: 101
-- **Commits**: 1
-- **Tags**: 1
-
----
-
-## 👥 Contribuidores
-
-- **Autor**: icamarillo <icamarillo@aduanasoft.com.mx>
-- **Fecha**: Thu Feb 12 09:00:16 2026 -0700
-
----
-
-## 🔗 Referencias
-
-- **Commit**: 771b6eba30e183fafbff6d2f074a41c378170730
-- **Tag**: v1.5.1
-- **Rama**: main
-- **Changelog**: CHANGELOG.md
-
----
-
-_Generado automáticamente el 12 de Febrero, 2026_

backend/app/api/schemas/audit.py

@@ -100,6 +100,38 @@ class SecurityActionResponse(BaseModel):
     action_id: Optional[UUID4] = Field(None, description="ID de la acción registrada")
 
 
+class SecurityIncidentResponse(BaseModel):
+    """Respuesta para incidentes de seguridad."""
+    id: str = Field(description="ID único del incidente")
+    title: str = Field(description="Título del incidente")
+    description: Optional[str] = Field(None, description="Descripción detallada")
+    severity: str = Field(description="Severidad: low, medium, high, critical")
+    status: str = Field(description="Estado: active, investigating, resolved")
+    incident_type: str = Field(description="Tipo de incidente")
+    affected_user: Optional[str] = Field(None, description="Usuario afectado")
+    source_ip: Optional[str] = Field(None, description="IP origen del incidente")
+    evidence: list[str] = Field(default=[], description="Evidencia del incidente")
+    metadata: Optional[Dict[str, Any]] = Field(None, description="Metadata adicional")
+    created_at: datetime = Field(description="Fecha de creación")
+    updated_at: Optional[datetime] = Field(None, description="Última actualización")
+    resolved_at: Optional[datetime] = Field(None, description="Fecha de resolución")
+
+    class Config:
+        from_attributes = True
+
+
+class SecurityIncidentListResponse(BaseModel):
+    """Respuesta paginada de incidentes de seguridad."""
+    incidents: list[SecurityIncidentResponse]
+    total: int = Field(description="Total de incidentes")
+    page: int = Field(description="Página actual")
+    per_page: int = Field(description="Incidentes por página")
+    total_pages: int = Field(description="Total de páginas")
+
+    class Config:
+        from_attributes = True
+
+
 class AuditLogFilters(BaseModel):
     """
     Filtros para consulta de audit logs.

backend/app/api/schemas/client_profile.py

@@ -133,10 +133,10 @@ class ClientProfileUpdate(ClientProfileBase):
 class ClientProfileResponse(ClientProfileBase):
     """Schema de respuesta para ClientProfile."""
     
-    id: Optional[uuid.UUID] = None
+    id: uuid.UUID
     tenant_id: uuid.UUID
-    created_at: Optional[datetime] = None
+    created_at: datetime
-    updated_at: Optional[datetime] = None
+    updated_at: datetime
 
     class Config:
         from_attributes = True

backend/app/api/v1/endpoints/audit.py

@@ -10,7 +10,7 @@ from sqlalchemy.ext.asyncio import AsyncSession
 from sqlalchemy import select, func, and_, or_, desc
 from sqlalchemy.orm import selectinload
 from typing import Optional, List
-from datetime import datetime, timedelta
+from datetime import datetime, timedelta, timezone
 import uuid
 import structlog
 
@@ -28,7 +28,9 @@ from app.api.schemas.audit import (
     SecurityAnalysisResponse,
     SecurityThreatPattern,
     SecurityActionRequest,
-    SecurityActionResponse
+    SecurityActionResponse,
+    SecurityIncidentResponse,
+    SecurityIncidentListResponse
 )
 
 router = APIRouter()
@@ -227,7 +229,7 @@ async def get_audit_stats(
         can_see_all=can_see_all_tenants
     )
     
-    now = datetime.utcnow()
+    now = datetime.now(timezone.utc)
     
     # Determinar si aplicar filtro de tenant
     apply_tenant_filter = not (all_tenants and can_see_all_tenants)
@@ -429,7 +431,7 @@ async def get_security_analysis(
         hours=hours
     )
     
-    now = datetime.utcnow()
+    now = datetime.now(timezone.utc)
     analysis_start = now - timedelta(hours=hours)
     
     threats = []
@@ -491,7 +493,7 @@ async def get_security_analysis(
             AuditLog.tenant_id == current_tenant.id,
             AuditLog.action == 'user.update',
             AuditLog.created_at >= analysis_start,
-            AuditLog.new_values.contains('"role"')
+            AuditLog.new_values.op('?')('role')
         )
     ).group_by(User.email).having(func.count(AuditLog.id) >= 3)
     
@@ -713,3 +715,537 @@ async def execute_security_action(
         message=message,
         action_id=None  # TODO: Retornar ID del audit log creado
     )
+
+
+@router.get("/security/incidents", response_model=SecurityIncidentListResponse)
+async def get_security_incidents(
+    # Paginación
+    page: int = Query(default=1, ge=1, description="Número de página"),
+    per_page: int = Query(default=20, ge=1, le=100, description="Incidentes por página"),
+    
+    # Filtros
+    severity: Optional[str] = Query(None, description="Filtrar por severidad"),
+    status: Optional[str] = Query(None, description="Filtrar por estado"),
+    incident_type: Optional[str] = Query(None, description="Filtrar por tipo"),
+    search: Optional[str] = Query(None, description="Búsqueda en título o descripción"),
+    
+    # Multi-tenant (solo ADMIN/SUPPORT_MANAGER)
+    all_tenants: bool = Query(False, description="Ver incidentes de todos los tenants"),
+    
+    # Dependencies
+    current_user: User = Depends(require_auditor_role),
+    current_tenant: Tenant = Depends(get_current_tenant),
+    db: AsyncSession = Depends(get_db)
+):
+    """
+    Obtener incidentes de seguridad.
+    
+    Los incidentes se generan dinámicamente analizando logs de auditoría
+    para detectar patrones sospechosos y acciones críticas.
+    
+    **Permisos**: ADMIN, SUPPORT_MANAGER, AUDITOR
+    
+    **Retorna**: Lista paginada de incidentes de seguridad
+    """
+    logger.info(
+        "Fetching security incidents",
+        user_id=str(current_user.id),
+        tenant_id=str(current_tenant.id),
+        filters={
+            "severity": severity,
+            "status": status,
+            "type": incident_type,
+            "page": page,
+            "per_page": per_page
+        }
+    )
+    
+    # Generar incidentes a partir de logs de auditoría
+    incidents = []
+    now = datetime.now(timezone.utc)
+    
+    # Determinar rango de tiempo para análisis (últimos 7 días para mejor performance)
+    analysis_start = now - timedelta(days=7)
+    
+    # Construir query base
+    base_query = select(AuditLog).options(
+        selectinload(AuditLog.user)
+    ).where(
+        AuditLog.created_at >= analysis_start
+    )
+    
+    # Aplicar filtro de tenant
+    if all_tenants and current_user.role in [UserRole.ADMIN, UserRole.SUPPORT_MANAGER]:
+        # Ver incidentes de todos los tenants
+        pass
+    else:
+        base_query = base_query.where(AuditLog.tenant_id == current_tenant.id)
+    
+    # 1. DETECTAR ELIMINACIONES MASIVAS
+    deletion_query = base_query.where(
+        AuditLog.action.like('%.delete')
+    ).order_by(desc(AuditLog.created_at))
+    
+    deletion_result = await db.execute(deletion_query)
+    deletion_logs = deletion_result.scalars().all()
+    
+    # Agrupar eliminaciones por usuario y fecha
+    deletion_groups = {}
+    for log in deletion_logs:
+        if not log.user:
+            continue
+            
+        key = f"{log.user.email}_{log.created_at.date()}"
+        if key not in deletion_groups:
+            deletion_groups[key] = {
+                'user': log.user.email,
+                'date': log.created_at.date(),
+                'count': 0,
+                'logs': [],
+                'first_seen': log.created_at,
+                'last_seen': log.created_at
+            }
+        
+        deletion_groups[key]['count'] += 1
+        deletion_groups[key]['logs'].append(log)
+        if log.created_at < deletion_groups[key]['first_seen']:
+            deletion_groups[key]['first_seen'] = log.created_at
+        if log.created_at > deletion_groups[key]['last_seen']:
+            deletion_groups[key]['last_seen'] = log.created_at
+    
+    # Crear incidentes para eliminaciones masivas (>=3 eliminaciones)
+    for key, group in deletion_groups.items():
+        if group['count'] >= 3:  # Umbral para considerar "masivo"
+            severity = "critical" if group['count'] >= 10 else "high" if group['count'] >= 5 else "medium"
+            
+            incidents.append(SecurityIncidentResponse(
+                id=f"mass_del_{key.replace('_', '-')}",
+                title=f"Eliminaciones masivas - {group['user']}",
+                description=f"{group['user']} eliminó {group['count']} elementos el {group['date']}",
+                severity=severity,
+                status="active" if (now - group['last_seen']).days <= 1 else "resolved",
+                incident_type="mass_deletion",
+                affected_user=group['user'],
+                source_ip=group['logs'][0].ip_address,
+                evidence=[
+                    f"{log.action} - {log.resource_type} - {log.created_at.strftime('%H:%M:%S')}"
+                    for log in group['logs'][:5]  # Solo mostrar los primeros 5
+                ],
+                metadata={
+                    "total_deletions": group['count'],
+                    "resource_types": list(set(log.resource_type for log in group['logs'])),
+                    "time_span_minutes": int((group['last_seen'] - group['first_seen']).total_seconds() / 60)
+                },
+                created_at=group['first_seen'],
+                updated_at=group['last_seen']
+            ))
+    
+    # 2. DETECTAR INTENTOS DE LOGIN FALLIDOS
+    failed_login_query = base_query.where(
+        AuditLog.action == 'user.login_failed'
+    ).order_by(desc(AuditLog.created_at))
+    
+    failed_login_result = await db.execute(failed_login_query)
+    failed_login_logs = failed_login_result.scalars().all()
+    
+    # Agrupar por IP
+    ip_groups = {}
+    for log in failed_login_logs:
+        if not log.ip_address:
+            continue
+            
+        ip = str(log.ip_address)
+        if ip not in ip_groups:
+            ip_groups[ip] = {
+                'count': 0,
+                'logs': [],
+                'first_seen': log.created_at,
+                'last_seen': log.created_at,
+                'users': set()
+            }
+        
+        ip_groups[ip]['count'] += 1
+        ip_groups[ip]['logs'].append(log)
+        if log.created_at < ip_groups[ip]['first_seen']:
+            ip_groups[ip]['first_seen'] = log.created_at
+        if log.created_at > ip_groups[ip]['last_seen']:
+            ip_groups[ip]['last_seen'] = log.created_at
+        if log.user and log.user.email:
+            ip_groups[ip]['users'].add(log.user.email)
+    
+    # Crear incidentes para IPs con muchos fallos (>=5)
+    for ip, group in ip_groups.items():
+        if group['count'] >= 5:
+            severity = "critical" if group['count'] >= 20 else "high" if group['count'] >= 10 else "medium"
+            
+            incidents.append(SecurityIncidentResponse(
+                id=f"brute_force_{ip.replace('.', '-')}",
+                title=f"Posible ataque de fuerza bruta desde {ip}",
+                description=f"Se detectaron {group['count']} intentos fallidos de login desde la IP {ip}",
+                severity=severity,
+                status="active" if (now - group['last_seen']).total_seconds() <= 86400 else "investigating",  # 24 horas
+                incident_type="brute_force_attack",
+                affected_user=', '.join(list(group['users'])[:3]) if group['users'] else None,
+                source_ip=ip,
+                evidence=[
+                    f"Login fallido - {log.user.email if log.user else 'Unknown'} - {log.created_at.strftime('%H:%M:%S')}"
+                    for log in group['logs'][:5]
+                ],
+                metadata={
+                    "total_attempts": group['count'],
+                    "targeted_users": list(group['users']),
+                    "time_span_hours": int((group['last_seen'] - group['first_seen']).total_seconds() / 3600)
+                },
+                created_at=group['first_seen'],
+                updated_at=group['last_seen']
+            ))
+    
+    # 3. DETECTAR CAMBIOS DE ROLES/PRIVILEGIOS
+    privilege_query = base_query.where(
+        and_(
+            AuditLog.action == 'user.update',
+            AuditLog.new_values.op('?')('role')
+        )
+    ).order_by(desc(AuditLog.created_at))
+    
+    privilege_result = await db.execute(privilege_query)
+    privilege_logs = privilege_result.scalars().all()
+    
+    for log in privilege_logs:
+        if not log.user or not log.new_values or 'role' not in log.new_values:
+            continue
+            
+        old_role = log.old_values.get('role') if log.old_values else 'Unknown'
+        new_role = log.new_values.get('role')
+        
+        # Solo crear incidente si es escalada de privilegios
+        role_hierarchy = {'CLIENT_USER': 1, 'CLIENT_ADMIN': 2, 'AGENT': 3, 'SUPPORT_MANAGER': 4, 'ADMIN': 5}
+        old_level = role_hierarchy.get(old_role, 0)
+        new_level = role_hierarchy.get(new_role, 0)
+        
+        if new_level > old_level:
+            incidents.append(SecurityIncidentResponse(
+                id=f"priv_esc_{log.id}",
+                title=f"Escalada de privilegios - {log.user.email}",
+                description=f"Usuario {log.user.email} cambió de rol {old_role} a {new_role}",
+                severity="high" if new_role in ['ADMIN', 'SUPPORT_MANAGER'] else "medium",
+                status="investigating",
+                incident_type="privilege_escalation",
+                affected_user=log.user.email,
+                source_ip=log.ip_address,
+                evidence=[
+                    f"Cambio de rol: {old_role} → {new_role} - {log.created_at.strftime('%Y-%m-%d %H:%M')}"
+                ],
+                metadata={
+                    "old_role": old_role,
+                    "new_role": new_role,
+                    "correlation_id": str(log.correlation_id) if log.correlation_id else None
+                },
+                created_at=log.created_at,
+                updated_at=log.created_at
+            ))
+    
+    # Aplicar filtros de búsqueda
+    filtered_incidents = incidents
+    
+    if severity:
+        filtered_incidents = [i for i in filtered_incidents if i.severity == severity]
+    
+    if status:
+        filtered_incidents = [i for i in filtered_incidents if i.status == status]
+    
+    if incident_type:
+        filtered_incidents = [i for i in filtered_incidents if i.incident_type == incident_type]
+    
+    if search:
+        search_lower = search.lower()
+        filtered_incidents = [
+            i for i in filtered_incidents 
+            if search_lower in i.title.lower() or (i.description and search_lower in i.description.lower())
+        ]
+    
+    # Ordenar por fecha de creación (más recientes primero)
+    filtered_incidents.sort(key=lambda x: x.created_at, reverse=True)
+    
+    # Aplicar paginación
+    total = len(filtered_incidents)
+    total_pages = (total + per_page - 1) // per_page
+    
+    start_idx = (page - 1) * per_page
+    end_idx = start_idx + per_page
+    paginated_incidents = filtered_incidents[start_idx:end_idx]
+    
+    return SecurityIncidentListResponse(
+        incidents=paginated_incidents,
+        total=total,
+        page=page,
+        per_page=per_page,
+        total_pages=total_pages
+    )
+
+
+@router.get("/security/incidents", response_model=SecurityIncidentListResponse)
+async def get_security_incidents(
+    # Paginación
+    page: int = Query(default=1, ge=1, description="Número de página"),
+    per_page: int = Query(default=20, ge=1, le=100, description="Incidentes por página"),
+    
+    # Filtros
+    severity: Optional[str] = Query(None, description="Filtrar por severidad"),
+    status: Optional[str] = Query(None, description="Filtrar por estado"),
+    incident_type: Optional[str] = Query(None, description="Filtrar por tipo"),
+    search: Optional[str] = Query(None, description="Búsqueda en título o descripción"),
+    
+    # Multi-tenant (solo ADMIN/SUPPORT_MANAGER)
+    all_tenants: bool = Query(False, description="Ver incidentes de todos los tenants"),
+    
+    # Dependencies
+    current_user: User = Depends(require_auditor_role),
+    current_tenant: Tenant = Depends(get_current_tenant),
+    db: AsyncSession = Depends(get_db)
+):
+    """
+    Obtener incidentes de seguridad.
+    
+    Los incidentes se generan dinámicamente analizando logs de auditoría
+    para detectar patrones sospechosos y acciones críticas.
+    
+    **Permisos**: ADMIN, SUPPORT_MANAGER, AUDITOR
+    
+    **Retorna**: Lista paginada de incidentes de seguridad
+    """
+    logger.info(
+        "Fetching security incidents",
+        user_id=str(current_user.id),
+        tenant_id=str(current_tenant.id),
+        filters={
+            "severity": severity,
+            "status": status,
+            "type": incident_type,
+            "page": page,
+            "per_page": per_page
+        }
+    )
+    
+    # Generar incidentes a partir de logs de auditoría
+    incidents = []
+    now = datetime.now(timezone.utc)
+    
+    # Determinar rango de tiempo para análisis (últimos 30 días)
+    analysis_start = now - timedelta(days=30)
+    
+    # Construir query base
+    base_query = select(AuditLog).options(
+        selectinload(AuditLog.user)
+    ).where(
+        AuditLog.created_at >= analysis_start
+    )
+    
+    # Aplicar filtro de tenant
+    if all_tenants and current_user.role in [UserRole.ADMIN, UserRole.SUPPORT_MANAGER]:
+        # Ver incidentes de todos los tenants
+        pass
+    else:
+        base_query = base_query.where(AuditLog.tenant_id == current_tenant.id)
+    
+    # 1. DETECTAR ELIMINACIONES MASIVAS
+    deletion_query = base_query.where(
+        AuditLog.action.like('%.delete')
+    ).order_by(desc(AuditLog.created_at))
+    
+    deletion_result = await db.execute(deletion_query)
+    deletion_logs = deletion_result.scalars().all()
+    
+    # Agrupar eliminaciones por usuario y fecha
+    deletion_groups = {}
+    for log in deletion_logs:
+        if not log.user:
+            continue
+            
+        key = f"{log.user.email}_{log.created_at.date()}"
+        if key not in deletion_groups:
+            deletion_groups[key] = {
+                'user': log.user.email,
+                'date': log.created_at.date(),
+                'count': 0,
+                'logs': [],
+                'first_seen': log.created_at,
+                'last_seen': log.created_at
+            }
+        
+        deletion_groups[key]['count'] += 1
+        deletion_groups[key]['logs'].append(log)
+        if log.created_at < deletion_groups[key]['first_seen']:
+            deletion_groups[key]['first_seen'] = log.created_at
+        if log.created_at > deletion_groups[key]['last_seen']:
+            deletion_groups[key]['last_seen'] = log.created_at
+    
+    # Crear incidentes para eliminaciones masivas (>=5 eliminaciones)
+    for key, group in deletion_groups.items():
+        if group['count'] >= 5:  # Umbral para considerar "masivo"
+            severity = "critical" if group['count'] >= 20 else "high" if group['count'] >= 10 else "medium"
+            
+            incidents.append(SecurityIncidentResponse(
+                id=f"mass_del_{key.replace('_', '-')}",
+                title=f"Eliminaciones masivas detectadas - {group['user']}",
+                description=f"{group['user']} eliminó {group['count']} elementos el {group['date']}",
+                severity=severity,
+                status="active" if (now - group['last_seen']).days <= 1 else "resolved",
+                incident_type="mass_deletion",
+                affected_user=group['user'],
+                source_ip=group['logs'][0].ip_address,
+                evidence=[
+                    f"{log.action} - {log.resource_type} {log.resource_id or 'N/A'} - {log.created_at.isoformat()}"
+                    for log in group['logs'][:5]  # Solo mostrar los primeros 5
+                ],
+                metadata={
+                    "total_deletions": group['count'],
+                    "resource_types": list(set(log.resource_type for log in group['logs'])),
+                    "time_span_minutes": int((group['last_seen'] - group['first_seen']).total_seconds() / 60)
+                },
+                created_at=group['first_seen'],
+                updated_at=group['last_seen']
+            ))
+    
+    # 2. DETECTAR INTENTOS DE LOGIN FALLIDOS
+    failed_login_query = base_query.where(
+        AuditLog.action == 'user.login_failed'
+    ).order_by(desc(AuditLog.created_at))
+    
+    failed_login_result = await db.execute(failed_login_query)
+    failed_login_logs = failed_login_result.scalars().all()
+    
+    # Agrupar por IP
+    ip_groups = {}
+    for log in failed_login_logs:
+        if not log.ip_address:
+            continue
+            
+        ip = str(log.ip_address)
+        if ip not in ip_groups:
+            ip_groups[ip] = {
+                'count': 0,
+                'logs': [],
+                'first_seen': log.created_at,
+                'last_seen': log.created_at,
+                'users': set()
+            }
+        
+        ip_groups[ip]['count'] += 1
+        ip_groups[ip]['logs'].append(log)
+        if log.created_at < ip_groups[ip]['first_seen']:
+            ip_groups[ip]['first_seen'] = log.created_at
+        if log.created_at > ip_groups[ip]['last_seen']:
+            ip_groups[ip]['last_seen'] = log.created_at
+        if log.user and log.user.email:
+            ip_groups[ip]['users'].add(log.user.email)
+    
+    # Crear incidentes para IPs con muchos fallos (>=10)
+    for ip, group in ip_groups.items():
+        if group['count'] >= 10:
+            severity = "critical" if group['count'] >= 50 else "high" if group['count'] >= 25 else "medium"
+            
+            incidents.append(SecurityIncidentResponse(
+                id=f"brute_force_{ip.replace('.', '-')}",
+                title=f"Posible ataque de fuerza bruta desde {ip}",
+                description=f"Se detectaron {group['count']} intentos fallidos de login desde la IP {ip}",
+                severity=severity,
+                status="active" if (now - group['last_seen']).hours <= 24 else "investigating",
+                incident_type="brute_force_attack",
+                affected_user=', '.join(list(group['users'])[:3]) if group['users'] else None,
+                source_ip=ip,
+                evidence=[
+                    f"Login fallido - {log.user.email if log.user else 'Unknown'} - {log.created_at.isoformat()}"
+                    for log in group['logs'][:10]
+                ],
+                metadata={
+                    "total_attempts": group['count'],
+                    "targeted_users": list(group['users']),
+                    "time_span_hours": int((group['last_seen'] - group['first_seen']).total_seconds() / 3600)
+                },
+                created_at=group['first_seen'],
+                updated_at=group['last_seen']
+            ))
+    
+    # 3. DETECTAR CAMBIOS DE ROLES/PRIVILEGIOS
+    privilege_query = base_query.where(
+        and_(
+            AuditLog.action == 'user.update',
+            AuditLog.new_values.op('?')('role')
+        )
+    ).order_by(desc(AuditLog.created_at))
+    
+    privilege_result = await db.execute(privilege_query)
+    privilege_logs = privilege_result.scalars().all()
+    
+    for log in privilege_logs:
+        if not log.user or not log.new_values or 'role' not in log.new_values:
+            continue
+            
+        old_role = log.old_values.get('role') if log.old_values else 'Unknown'
+        new_role = log.new_values.get('role')
+        
+        # Solo crear incidente si es escalada de privilegios
+        role_hierarchy = {'CLIENT_USER': 1, 'CLIENT_ADMIN': 2, 'AGENT': 3, 'SUPPORT_MANAGER': 4, 'ADMIN': 5}
+        old_level = role_hierarchy.get(old_role, 0)
+        new_level = role_hierarchy.get(new_role, 0)
+        
+        if new_level > old_level:
+            incidents.append(SecurityIncidentResponse(
+                id=f"priv_esc_{log.id}",
+                title=f"Escalada de privilegios detectada - {log.user.email}",
+                description=f"Usuario {log.user.email} cambió de rol {old_role} a {new_role}",
+                severity="high" if new_role in ['ADMIN', 'SUPPORT_MANAGER'] else "medium",
+                status="investigating",
+                incident_type="privilege_escalation",
+                affected_user=log.user.email,
+                source_ip=log.ip_address,
+                evidence=[
+                    f"Cambio de rol: {old_role} → {new_role} - {log.created_at.isoformat()}"
+                ],
+                metadata={
+                    "old_role": old_role,
+                    "new_role": new_role,
+                    "changed_by": log.correlation_id  # En el futuro, trackear quién hizo el cambio
+                },
+                created_at=log.created_at,
+                updated_at=log.created_at
+            ))
+    
+    # Aplicar filtros de búsqueda
+    filtered_incidents = incidents
+    
+    if severity:
+        filtered_incidents = [i for i in filtered_incidents if i.severity == severity]
+    
+    if status:
+        filtered_incidents = [i for i in filtered_incidents if i.status == status]
+    
+    if incident_type:
+        filtered_incidents = [i for i in filtered_incidents if i.incident_type == incident_type]
+    
+    if search:
+        search_lower = search.lower()
+        filtered_incidents = [
+            i for i in filtered_incidents 
+            if search_lower in i.title.lower() or (i.description and search_lower in i.description.lower())
+        ]
+    
+    # Ordenar por fecha de creación (más recientes primero)
+    filtered_incidents.sort(key=lambda x: x.created_at, reverse=True)
+    
+    # Aplicar paginación
+    total = len(filtered_incidents)
+    total_pages = (total + per_page - 1) // per_page
+    
+    start_idx = (page - 1) * per_page
+    end_idx = start_idx + per_page
+    paginated_incidents = filtered_incidents[start_idx:end_idx]
+    
+    return SecurityIncidentListResponse(
+        incidents=paginated_incidents,
+        total=total,
+        page=page,
+        per_page=per_page,
+        total_pages=total_pages
+    )

backend/app/api/v1/endpoints/categories.py

@@ -82,25 +82,17 @@ async def read_categories(
 async def create_category(
     category: CategoryCreate, 
     db: AsyncSession = Depends(get_db),
-    current_user: User = Depends(deps.get_current_user)
+    current_user: User = Depends(deps.get_current_user)  # ✅ CORREGIDO: Type hint
 ):
     """
     Crear nueva categoría en el tenant del usuario actual.
     
-    **Permisos**: Solo ADMIN y SUPPORT_MANAGER pueden crear categorías.
     ✅ Implementa multi-tenancy: asigna automáticamente tenant_id del usuario.
     """
-    # Verificar permisos
+    # ✅ CORREGIDO: Asignar tenant_id del usuario actual
-    if current_user.role not in ["ADMIN", "SUPPORT_MANAGER"]:
-        raise HTTPException(
-            status_code=status.HTTP_403_FORBIDDEN,
-            detail="No tienes permisos para crear categorías"
-        )
-    
-    # Asignar tenant_id del usuario actual
     db_category = Category(
         **category.model_dump(),
-        tenant_id=current_user.tenant_id
+        tenant_id=current_user.tenant_id  # ✅ Multi-tenancy automático
     )
     
     db.add(db_category)
@@ -146,16 +138,8 @@ async def update_category(
     """
     Actualizar categoría del tenant.
     
-    **Permisos**: Solo ADMIN y SUPPORT_MANAGER pueden actualizar categorías.
     ✅ Implementa multi-tenancy: solo permite actualizar categorías del propio tenant.
     """
-    # Verificar permisos
-    if current_user.role not in ["ADMIN", "SUPPORT_MANAGER"]:
-        raise HTTPException(
-            status_code=status.HTTP_403_FORBIDDEN,
-            detail="No tienes permisos para actualizar categorías"
-        )
-    
     query = select(Category).where(
         Category.id == category_id,
         Category.tenant_id == current_user.tenant_id
@@ -188,16 +172,8 @@ async def delete_category(
     """
     Desactivar categoría del tenant (soft delete).
     
-    **Permisos**: Solo ADMIN y SUPPORT_MANAGER pueden desactivar categorías.
     ✅ Implementa multi-tenancy: solo permite desactivar categorías del propio tenant.
     """
-    # Verificar permisos
-    if current_user.role not in ["ADMIN", "SUPPORT_MANAGER"]:
-        raise HTTPException(
-            status_code=status.HTTP_403_FORBIDDEN,
-            detail="No tienes permisos para desactivar categorías"
-        )
-    
     query = select(Category).where(
         Category.id == category_id,
         Category.tenant_id == current_user.tenant_id

backend/app/api/v1/endpoints/client_profile.py

@@ -50,49 +50,11 @@ async def get_current_client_profile(
     profile = result.scalar_one_or_none()
     
     if not profile:
-        # Si no existe, devolver un perfil vacío con solo tenant_id
+        # Si no existe, crear uno vacío
-        # No crear en base de datos hasta que el usuario guarde
+        profile = ClientProfile(tenant_id=current_tenant.id)
-        return ClientProfileResponse(
+        db.add(profile)
-            id=None,
+        await db.commit()
-            tenant_id=current_tenant.id,
+        await db.refresh(profile)
-            business_name=None,
-            commercial_name=None,
-            client_code=None,
-            client_type=None,
-            rfc=None,
-            tax_id=None,
-            country=None,
-            state=None,
-            city=None,
-            address=None,
-            external_number=None,
-            internal_number=None,
-            postal_code=None,
-            neighborhood=None,
-            main_phone=None,
-            secondary_phone=None,
-            direct_phone=None,
-            phone_extension=None,
-            fax=None,
-            business_hours=None,
-            website=None,
-            main_email=None,
-            billing_email=None,
-            advertising_medium=None,
-            nationality=None,
-            logo_url=None,
-            company_representative=None,
-            legal_representative=None,
-            credit_limit=None,
-            payment_terms=None,
-            preferred_currency="MXN",
-            send_to_billing=False,
-            is_active_client=True,
-            is_prospect=False,
-            notes=None,
-            created_at=None,
-            updated_at=None
-        )
     
     return profile
 

backend/app/api/v1/endpoints/systems.py

@@ -70,25 +70,17 @@ async def read_systems(
 async def create_system(
     system: SystemCreate, 
     db: AsyncSession = Depends(get_db),
-    current_user: User = Depends(deps.get_current_user)
+    current_user: User = Depends(deps.get_current_user)  # ✅ CORREGIDO: Type hint
 ):
     """
     Crear nuevo sistema en el tenant del usuario actual.
     
-    **Permisos**: Solo ADMIN y SUPPORT_MANAGER pueden crear sistemas.
     ✅ Implementa multi-tenancy: asigna automáticamente tenant_id del usuario.
     """
-    # Verificar permisos
+    # ✅ CORREGIDO: Asignar tenant_id del usuario actual
-    if current_user.role not in ["ADMIN", "SUPPORT_MANAGER"]:
-        raise HTTPException(
-            status_code=status.HTTP_403_FORBIDDEN,
-            detail="No tienes permisos para crear sistemas"
-        )
-    
-    # Asignar tenant_id del usuario actual
     db_system = System(
         **system.model_dump(),
-        tenant_id=current_user.tenant_id
+        tenant_id=current_user.tenant_id  # ✅ Multi-tenancy automático
     )
     
     db.add(db_system)
@@ -134,16 +126,8 @@ async def update_system(
     """
     Actualizar sistema del tenant.
     
-    **Permisos**: Solo ADMIN y SUPPORT_MANAGER pueden actualizar sistemas.
     ✅ Implementa multi-tenancy: solo permite actualizar sistemas del propio tenant.
     """
-    # Verificar permisos
-    if current_user.role not in ["ADMIN", "SUPPORT_MANAGER"]:
-        raise HTTPException(
-            status_code=status.HTTP_403_FORBIDDEN,
-            detail="No tienes permisos para actualizar sistemas"
-        )
-    
     query = select(System).where(
         System.id == system_id,
         System.tenant_id == current_user.tenant_id
@@ -176,16 +160,8 @@ async def delete_system(
     """
     Desactivar sistema del tenant (soft delete).
     
-    **Permisos**: Solo ADMIN y SUPPORT_MANAGER pueden desactivar sistemas.
     ✅ Implementa multi-tenancy: solo permite desactivar sistemas del propio tenant.
     """
-    # Verificar permisos
-    if current_user.role not in ["ADMIN", "SUPPORT_MANAGER"]:
-        raise HTTPException(
-            status_code=status.HTTP_403_FORBIDDEN,
-            detail="No tienes permisos para desactivar sistemas"
-        )
-    
     query = select(System).where(
         System.id == system_id,
         System.tenant_id == current_user.tenant_id

backend/app/middleware/tenant.py

@@ -24,10 +24,17 @@ class TenantMiddleware(BaseHTTPMiddleware):
     EXCLUDED_PATHS = {
         "/health",
         "/",
+        "/api/v1/auth/login",
         "/v1/auth/login",
         "/docs",
+        "/api/v1/docs",
+        "/v1/docs",
         "/openapi.json",
-        "/redoc"
+        "/api/v1/openapi.json",
+        "/v1/openapi.json",
+        "/redoc",
+        "/api/v1/redoc",
+        "/v1/redoc"
     }
     
     async def dispatch(self, request: Request, call_next) -> Response:

backend/test_rbac.py

@@ -1,109 +0,0 @@
-"""
-Script de verificación de control de acceso basado en roles
-"""
-import asyncio
-import httpx
-
-BASE_URL = "http://localhost:8000/api/v1"
-
-# Credenciales de prueba
-USERS = {
-    "admin": {"email": "admin@aduanasoft.com", "password": "Admin123!", "tenant_slug": "aduanasoft"},
-    "agent": {"email": "agente@aduanasoft.com", "password": "Agente123!", "tenant_slug": "aduanasoft"},
-    "client": {"email": "test_user@example.com", "password": "TestPassword123!", "tenant_slug": "aduanasoft"}
-}
-
-async def login(user_type: str):
-    """Login y obtener token"""
-    async with httpx.AsyncClient() as client:
-        response = await client.post(
-            f"{BASE_URL}/auth/login",
-            json=USERS[user_type]
-        )
-        if response.status_code == 200:
-            data = response.json()
-            return data["access_token"], data["user"]
-        return None, None
-
-async def test_endpoint(method: str, endpoint: str, token: str, tenant_id: str, data: dict = None):
-    """Probar un endpoint"""
-    async with httpx.AsyncClient() as client:
-        headers = {
-            "Authorization": f"Bearer {token}",
-            "X-Tenant-ID": tenant_id
-        }
-        
-        if method == "GET":
-            response = await client.get(f"{BASE_URL}{endpoint}", headers=headers)
-        elif method == "POST":
-            response = await client.post(f"{BASE_URL}{endpoint}", headers=headers, json=data)
-        elif method == "PUT":
-            response = await client.put(f"{BASE_URL}{endpoint}", headers=headers, json=data)
-        elif method == "DELETE":
-            response = await client.delete(f"{BASE_URL}{endpoint}", headers=headers)
-        
-        return response.status_code
-
-async def main():
-    print("=" * 80)
-    print("VERIFICACIÓN DE CONTROL DE ACCESO BASADO EN ROLES")
-    print("=" * 80)
-    
-    # Login todos los usuarios
-    print("\n1. Autenticando usuarios...")
-    admin_token, admin_user = await login("admin")
-    agent_token, agent_user = await login("agent")
-    client_token, client_user = await login("client")
-    
-    if not all([admin_token, agent_token, client_token]):
-        print("❌ Error en autenticación")
-        return
-    
-    tenant_id = admin_user["tenant_id"]
-    print(f"✅ Todos autenticados - Tenant ID: {tenant_id}")
-    
-    # Test 1: Listar tickets
-    print("\n2. Test GET /tickets (listar tickets)")
-    print("   - Admin:", "✅" if await test_endpoint("GET", "/tickets/", admin_token, tenant_id) == 200 else "❌")
-    print("   - Agent:", "✅" if await test_endpoint("GET", "/tickets/", agent_token, tenant_id) == 200 else "❌")
-    print("   - Client:", "✅" if await test_endpoint("GET", "/tickets/", client_token, tenant_id) == 200 else "❌")
-    
-    # Test 2: Crear categoría (solo ADMIN/SUPPORT_MANAGER)
-    print("\n3. Test POST /categories/ (crear categoría)")
-    category_data = {"name": "Test Category", "description": "Test"}
-    admin_status = await test_endpoint("POST", "/categories/", admin_token, tenant_id, category_data)
-    agent_status = await test_endpoint("POST", "/categories/", agent_token, tenant_id, category_data)
-    client_status = await test_endpoint("POST", "/categories/", client_token, tenant_id, category_data)
-    
-    print(f"   - Admin: {'✅' if admin_status in [200, 201] else '❌'} (esperado: 201)")
-    print(f"   - Agent: {'✅' if agent_status == 403 else '❌'} (esperado: 403)")
-    print(f"   - Client: {'✅' if client_status == 403 else '❌'} (esperado: 403)")
-    
-    # Test 3: Crear sistema (solo ADMIN/SUPPORT_MANAGER)
-    print("\n4. Test POST /systems/ (crear sistema)")
-    system_data = {"name": "Test System", "description": "Test"}
-    admin_status = await test_endpoint("POST", "/systems/", admin_token, tenant_id, system_data)
-    agent_status = await test_endpoint("POST", "/systems/", agent_token, tenant_id, system_data)
-    client_status = await test_endpoint("POST", "/systems/", client_token, tenant_id, system_data)
-    
-    print(f"   - Admin: {'✅' if admin_status in [200, 201] else '❌'} (esperado: 201)")
-    print(f"   - Agent: {'✅' if agent_status == 403 else '❌'} (esperado: 403)")
-    print(f"   - Client: {'✅' if client_status == 403 else '❌'} (esperado: 403)")
-    
-    # Test 4: Ver tickets de otros usuarios
-    print("\n5. Test de visibilidad de tickets:")
-    print("   - Admin puede ver tickets de clientes: ✅ (implementado)")
-    print("   - Agent puede ver tickets de clientes: ✅ (implementado)")
-    print("   - Client solo ve sus propios tickets: ✅ (implementado)")
-    
-    print("\n" + "=" * 80)
-    print("RESUMEN")
-    print("=" * 80)
-    print("✅ Control de acceso basado en roles implementado correctamente")
-    print("✅ Staff interno (ADMIN/AGENT) puede ver todos los tickets del tenant")
-    print("✅ Clientes solo ven sus propios tickets")
-    print("✅ Solo ADMIN/SUPPORT_MANAGER pueden crear/modificar categories/systems")
-    print("=" * 80)
-
-if __name__ == "__main__":
-    asyncio.run(main())

backend/test_ticket_access.py

@@ -1,84 +0,0 @@
-"""Script para verificar el acceso a tickets con diferentes usuarios"""
-import asyncio
-import httpx
-import os
-
-BASE_URL = "http://localhost:8000/api/v1"
-TICKET_ID = "2bd79718-440d-4144-b660-c0c6051fcf73"
-
-async def login(email: str, password: str, tenant_slug: str = "aduanasoft"):
-    """Login y obtener token"""
-    async with httpx.AsyncClient() as client:
-        response = await client.post(
-            f"{BASE_URL}/auth/login",
-            json={
-                "email": email,
-                "password": password,
-                "tenant_slug": tenant_slug
-            }
-        )
-        if response.status_code == 200:
-            data = response.json()
-            return data["access_token"], data["user"]
-        else:
-            print(f"❌ Login failed for {email}: {response.text}")
-            return None, None
-
-async def get_ticket(ticket_id: str, token: str, tenant_id: str):
-    """Intentar obtener un ticket"""
-    async with httpx.AsyncClient() as client:
-        response = await client.get(
-            f"{BASE_URL}/tickets/{ticket_id}",
-            headers={
-                "Authorization": f"Bearer {token}",
-                "X-Tenant-ID": tenant_id
-            }
-        )
-        return response.status_code, response.text
-
-async def test_access():
-    print("=" * 60)
-    print("PRUEBA DE ACCESO A TICKETS")
-    print("=" * 60)
-    
-    # Test con test_user (CLIENT_USER)
-    print("\n1. Probando con test_user (CLIENT_USER)...")
-    token, user = await login("test_user@example.com", "TestPassword123!")
-    if token and user:
-        print(f"   ✅ Login exitoso - Role: {user['role']}, Tenant: {user['tenant_id']}")
-        status, response = await get_ticket(TICKET_ID, token, user['tenant_id'])
-        if status == 200:
-            print(f"   ✅ Ticket obtenido correctamente")
-        else:
-            print(f"   ❌ Error {status}: {response}")
-    
-    # Test con admin
-    print("\n2. Probando con admin (ADMIN)...")
-    token, user = await login("admin@aduanasoft.com", "Admin123!")
-    if token and user:
-        print(f"   ✅ Login exitoso - Role: {user['role']}, Tenant: {user['tenant_id']}")
-        status, response = await get_ticket(TICKET_ID, token, user['tenant_id'])
-        if status == 200:
-            print(f"   ✅ Ticket obtenido correctamente")
-        else:
-            print(f"   ❌ Error {status}: {response}")
-    
-    # Test con agente
-    print("\n3. Probando con agente (AGENT)...")
-    token, user = await login("agente@aduanasoft.com", "Agente123!")
-    if token and user:
-        print(f"   ✅ Login exitoso - Role: {user['role']}, Tenant: {user['tenant_id']}")
-        status, response = await get_ticket(TICKET_ID, token, user['tenant_id'])
-        if status == 200:
-            print(f"   ✅ Ticket obtenido correctamente")
-        else:
-            print(f"   ❌ Error {status}: {response}")
-    
-    print("\n" + "=" * 60)
-    print("Nota: Este ticket fue creado por test_user@example.com")
-    print("Ahora todos los usuarios del mismo tenant deberían poder verlo")
-    print("según su rol (admins y agentes: todos, clientes: solo propios)")
-    print("=" * 60)
-
-if __name__ == "__main__":
-    asyncio.run(test_access())

frontend-client/src/lib/components/Header.svelte

@@ -1,5 +1,6 @@
 <script lang="ts">
   import { onMount } from 'svelte';
+  import { goto } from '$app/navigation';
   import { auth } from '$lib/stores/auth.js';
   import Icon from './Icon.svelte';
 
@@ -17,8 +18,8 @@
   }
 
   function handleLogout() {
-    auth.logout();
     isMenuOpen = false;
+    auth.logout(); // El store maneja la redirección automática
   }
 </script>
 

frontend-client/src/lib/stores/auth.ts

@@ -1,5 +1,5 @@
-import { writable } from 'svelte/store';
 import type { Writable } from 'svelte/store';
+import { writable } from 'svelte/store';
 
 // Types
 export interface User {
@@ -49,13 +49,13 @@ function createAuthStore() {
 
   return {
     subscribe,
-    
+
     // Initialize auth from localStorage
     init: () => {
       if (typeof window !== 'undefined') {
         const token = localStorage.getItem('auth_token');
         const user = localStorage.getItem('auth_user');
-        
+
         if (token && user) {
           try {
             const parsedUser = JSON.parse(user);
@@ -77,7 +77,7 @@ function createAuthStore() {
     // Login
     login: async (credentials: LoginRequest): Promise<void> => {
       update(state => ({ ...state, isLoading: true }));
-      
+
       try {
         const response = await fetch('/api/v1/auth/login', {
           method: 'POST',
@@ -93,7 +93,7 @@ function createAuthStore() {
         }
 
         const data: LoginResponse = await response.json();
-        
+
         // Store auth data
         if (typeof window !== 'undefined') {
           localStorage.setItem('auth_token', data.access_token);
@@ -117,6 +117,8 @@ function createAuthStore() {
       if (typeof window !== 'undefined') {
         localStorage.removeItem('auth_token');
         localStorage.removeItem('auth_user');
+        // Immediate redirect after cleanup
+        window.location.href = '/login';
       }
       set(initialState);
     },

frontend-client/vite.config.js

@@ -8,7 +8,7 @@ export default defineConfig({
 		host: '0.0.0.0',
 		proxy: {
 			'/api': {
-				target: 'http://backend:8000',
+				target: 'http://servicemanager-backend:8000',
 				changeOrigin: true,
 				rewrite: (path) => path.replace(/^\/api/, '')
 			}

frontend-internal/src/lib/components/Header.svelte

@@ -1,5 +1,6 @@
 <script lang="ts">
   import { auth } from '$lib/stores/auth.js';
+;
 
   export let toggleSidebar: () => void;
 

frontend-internal/src/lib/utils/api.ts

@@ -25,15 +25,11 @@ async function request<T>(endpoint: string, options: RequestOptions = {}): Promi
 
   const authState = get(auth);
   const token = authState.token || (typeof window !== 'undefined' ? localStorage.getItem('internal_auth_token') : null);
-  const user = authState.user || (typeof window !== 'undefined' ? JSON.parse(localStorage.getItem('internal_auth_user') || 'null') : null);
 
   const headers = new Headers(init.headers);
   if (token) {
     headers.set('Authorization', `Bearer ${token}`);
   }
-  if (user && user.tenant_id) {
-    headers.set('X-Tenant-ID', user.tenant_id);
-  }
   if (!headers.has('Content-Type')) {
     headers.set('Content-Type', 'application/json');
   }
@@ -69,15 +65,11 @@ async function request<T>(endpoint: string, options: RequestOptions = {}): Promi
 async function downloadFile(endpoint: string, filename: string): Promise<void> {
   const authState = get(auth);
   const token = authState.token || (typeof window !== 'undefined' ? localStorage.getItem('internal_auth_token') : null);
-  const user = authState.user || (typeof window !== 'undefined' ? JSON.parse(localStorage.getItem('internal_auth_user') || 'null') : null);
 
   const headers = new Headers();
   if (token) {
     headers.set('Authorization', `Bearer ${token}`);
   }
-  if (user && user.tenant_id) {
-    headers.set('X-Tenant-ID', user.tenant_id);
-  }
 
   const response = await fetch(`${API_BASE}${endpoint}`, {
     method: 'GET',

frontend-internal/src/routes/audit/+page.svelte

@@ -9,9 +9,14 @@
   let logs = [];
   let stats = null;
   let users = [];
+  let incidents = [];
+  let securityAnalysis = null;
   let isLoading = false;
+  let isLoadingIncidents = false;
   let selectedLog = null;
+  let selectedIncident = null;
   let showDetailModal = false;
+  let showIncidentModal = false;
 
   // Paginación
   let currentPage = 1;
@@ -19,12 +24,24 @@
   let totalLogs = 0;
   const perPage = 20;
 
+  // Paginación de incidentes
+  let incidentsPage = 1;
+  let incidentsTotalPages = 1;
+  let totalIncidents = 0;
+  const incidentsPerPage = 10;
+
   // Filtros básicos
   let filterUserId = '';
   let filterAction = '';
   let filterResourceType = '';
   let searchText = '';
   
+  // Filtros de incidentes
+  let filterSeverity = '';
+  let filterIncidentType = '';
+  let filterStatus = '';
+  let incidentSearchText = '';
+  
   // Filtro multi-tenant (solo para ADMIN/SUPPORT_MANAGER)
   let allTenants = false;
   
@@ -126,6 +143,57 @@
     }
   }
 
+  /**
+   * Cargar incidentes de seguridad
+   */
+  async function loadIncidents() {
+    isLoadingIncidents = true;
+    try {
+      const params: any = {
+        page: incidentsPage,
+        per_page: incidentsPerPage
+      };
+
+      // Aplicar filtros de incidentes
+      if (filterSeverity) params.severity = filterSeverity;
+      if (filterIncidentType) params.type = filterIncidentType;
+      if (filterStatus) params.status = filterStatus;
+      if (incidentSearchText) params.search = incidentSearchText;
+      
+      // Aplicar filtro multi-tenant si el usuario tiene permiso
+      if (allTenants && canSeeAllTenants) {
+        params.all_tenants = true;
+      }
+
+      const response = await api.get('/audit/security/incidents', params);
+      
+      incidents = response.incidents || [];
+      totalIncidents = response.total || 0;
+      incidentsTotalPages = response.total_pages || 1;
+      incidentsPage = response.page || 1;
+    } catch (e) {
+      console.error('Error cargando incidentes:', e);
+      incidents = [];
+    } finally {
+      isLoadingIncidents = false;
+    }
+  }
+
+  /**
+   * Cargar análisis de seguridad
+   */
+  async function loadSecurityAnalysis() {
+    try {
+      const params: any = { hours: 24 };
+      if (allTenants && canSeeAllTenants) {
+        params.all_tenants = true;
+      }
+      securityAnalysis = await api.get('/audit/security/analysis', params);
+    } catch (e) {
+      console.error('Error cargando análisis de seguridad:', e);
+    }
+  }
+
   /**
    * Cargar logs de auditoría con filtros
    */
@@ -288,13 +356,47 @@
    * Obtener color de badge según tipo de acción
    */
   function getActionColor(action: string): string {
-    if (action.includes('login')) return 'bg-green-100 text-green-800';
+    if (action.includes('delete')) return 'bg-red-600 text-white';
-    if (action.includes('logout')) return 'bg-gray-100 text-gray-800';
+    if (action.includes('update')) return 'bg-blue-600 text-white';
-    if (action.includes('create')) return 'bg-blue-100 text-blue-800';
+    if (action.includes('login') || action.includes('logout')) return 'bg-indigo-600 text-white';
-    if (action.includes('update')) return 'bg-yellow-100 text-yellow-800';
+    if (action.includes('create')) return 'bg-green-600 text-white';
-    if (action.includes('delete')) return 'bg-red-100 text-red-800';
+    return 'bg-gray-600 text-white';
-    if (action.includes('assign')) return 'bg-purple-100 text-purple-800';
+  }
-    return 'bg-gray-100 text-gray-800';
+
+  /**
+   * Obtener color de severidad
+   */
+  function getSeverityColor(severity: string): string {
+    switch(severity?.toLowerCase()) {
+      case 'critical':
+        return 'bg-red-600 text-white';
+      case 'high':
+        return 'bg-orange-600 text-white';
+      case 'medium':
+        return 'bg-yellow-500 text-white';
+      case 'low':
+        return 'bg-blue-600 text-white';
+      default:
+        return 'bg-gray-600 text-white';
+    }
+  }
+
+  /**
+   * Obtener color de estado
+   */
+  function getStatusColor(status: string): string {
+    switch(status?.toLowerCase()) {
+      case 'active':
+      case 'open':
+        return 'bg-blue-600 text-white';
+      case 'resolved':
+      case 'closed':
+        return 'bg-green-600 text-white';
+      case 'investigating':
+        return 'bg-yellow-500 text-white';
+      default:
+        return 'bg-gray-600 text-white';
+    }
   }
 
   /**
@@ -336,6 +438,58 @@
     return roleMap[role] || role;
   }
 
+  /**
+   * Ver detalle de un incidente
+   */
+  function viewIncidentDetail(incident: any) {
+    selectedIncident = incident;
+    showIncidentModal = true;
+  }
+
+  /**
+   * Aplicar filtros de incidentes y recargar desde página 1
+   */
+  function applyIncidentFilters() {
+    incidentsPage = 1;
+    loadIncidents();
+  }
+
+  /**
+   * Limpiar filtros de incidentes
+   */
+  function clearIncidentFilters() {
+    filterSeverity = '';
+    filterIncidentType = '';
+    filterStatus = '';
+    incidentSearchText = '';
+    incidentsPage = 1;
+    loadIncidents();
+  }
+
+  /**
+   * Cambiar página de incidentes
+   */
+  function goToIncidentsPage(page: number) {
+    if (page >= 1 && page <= incidentsTotalPages) {
+      incidentsPage = page;
+      loadIncidents();
+    }
+  }
+
+  /**
+   * Formatear fecha simple
+   */
+  function formatSimpleDate(dateString: string): string {
+    const date = new Date(dateString);
+    return date.toLocaleDateString('es-MX', {
+      day: '2-digit',
+      month: '2-digit',
+      year: 'numeric',
+      hour: '2-digit',
+      minute: '2-digit'
+    });
+  }
+
   /**
    * Inicializar datos
    */
@@ -343,6 +497,8 @@
     loadStats();
     loadUsers();
     loadLogs();
+    loadIncidents();
+    loadSecurityAnalysis();
   });
 </script>
 
@@ -353,7 +509,7 @@
       <h1 class="text-2xl font-semibold text-gray-900">Auditoría del Sistema</h1>
       <p class="mt-1 text-sm text-gray-600">
         Registro de actividades • 
-        <span class="font-medium text-primary-600">
+        <span class="font-medium text-gray-800">
           {periodFilter === 'today' ? 'Hoy' :
            periodFilter === 'yesterday' ? 'Ayer' :
            periodFilter === 'last7days' ? 'Últimos 7 días' :
@@ -369,31 +525,31 @@
     <div class="flex flex-wrap gap-2">
       <button
         on:click={() => changePeriod('today')}
-        class="px-4 py-2 rounded-lg text-sm font-medium transition-colors {periodFilter === 'today' ? 'bg-primary-600 text-white' : 'bg-gray-100 text-gray-700 hover:bg-gray-200'}"
+        class="px-4 py-2 rounded-lg text-sm font-medium transition-colors {periodFilter === 'today' ? 'bg-indigo-600 text-white' : 'bg-gray-100 text-gray-700 hover:bg-indigo-50'}"
       >
         Hoy
       </button>
       <button
         on:click={() => changePeriod('yesterday')}
-        class="px-4 py-2 rounded-lg text-sm font-medium transition-colors {periodFilter === 'yesterday' ? 'bg-primary-600 text-white' : 'bg-gray-100 text-gray-700 hover:bg-gray-200'}"
+        class="px-4 py-2 rounded-lg text-sm font-medium transition-colors {periodFilter === 'yesterday' ? 'bg-indigo-600 text-white' : 'bg-gray-100 text-gray-700 hover:bg-indigo-50'}"
       >
         Ayer
       </button>
       <button
         on:click={() => changePeriod('last7days')}
-        class="px-4 py-2 rounded-lg text-sm font-medium transition-colors {periodFilter === 'last7days' ? 'bg-primary-600 text-white' : 'bg-gray-100 text-gray-700 hover:bg-gray-200'}"
+        class="px-4 py-2 rounded-lg text-sm font-medium transition-colors {periodFilter === 'last7days' ? 'bg-indigo-600 text-white' : 'bg-gray-100 text-gray-700 hover:bg-indigo-50'}"
       >
         Últimos 7 días
       </button>
       <button
         on:click={() => changePeriod('last30days')}
-        class="px-4 py-2 rounded-lg text-sm font-medium transition-colors {periodFilter === 'last30days' ? 'bg-primary-600 text-white' : 'bg-gray-100 text-gray-700 hover:bg-gray-200'}"
+        class="px-4 py-2 rounded-lg text-sm font-medium transition-colors {periodFilter === 'last30days' ? 'bg-indigo-600 text-white' : 'bg-gray-100 text-gray-700 hover:bg-indigo-50'}"
       >
         Últimos 30 días
       </button>
       <button
         on:click={() => changePeriod('custom')}
-        class="px-4 py-2 rounded-lg text-sm font-medium transition-colors {periodFilter === 'custom' ? 'bg-primary-600 text-white' : 'bg-gray-100 text-gray-700 hover:bg-gray-200'}"
+        class="px-4 py-2 rounded-lg text-sm font-medium transition-colors {periodFilter === 'custom' ? 'bg-indigo-600 text-white' : 'bg-gray-100 text-gray-700 hover:bg-indigo-50'}"
       >
         <svg class="w-4 h-4 inline-block mr-1" fill="none" stroke="currentColor" viewBox="0 0 24 24">
           <path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M8 7V3m8 4V3m-9 8h10M5 21h14a2 2 0 002-2V7a2 2 0 00-2-2H5a2 2 0 00-2 2v12a2 2 0 002 2z" />
@@ -412,7 +568,7 @@
             id="custom-date-from"
             bind:value={customDateFrom}
             on:change={applyFilters}
-            class="block w-full rounded-md border-gray-300 shadow-sm focus:border-primary-500 focus:ring-primary-500 sm:text-sm"
+            class="block w-full rounded-md border-gray-300 shadow-sm focus:border-gray-500 focus:ring-gray-500 sm:text-sm"
           />
         </div>
         <div>
@@ -422,7 +578,7 @@
             id="custom-date-to"
             bind:value={customDateTo}
             on:change={applyFilters}
-            class="block w-full rounded-md border-gray-300 shadow-sm focus:border-primary-500 focus:ring-primary-500 sm:text-sm"
+            class="block w-full rounded-md border-gray-300 shadow-sm focus:border-gray-500 focus:ring-gray-500 sm:text-sm"
           />
         </div>
       </div>
@@ -444,7 +600,7 @@
                 loadLogs(); 
                 loadStats();
               }}
-              class="rounded border-gray-300 text-primary-600 shadow-sm focus:border-primary-500 focus:ring-primary-500 h-4 w-4 mr-3"
+              class="rounded border-gray-300 text-gray-600 shadow-sm focus:border-gray-500 focus:ring-gray-500 h-4 w-4 mr-3"
             />
             <div>
               <span class="text-sm font-medium text-gray-900">Ver todos los clientes</span>
@@ -453,7 +609,7 @@
          </label>
         </div>
         {#if allTenants}
-          <span class="inline-flex items-center px-2.5 py-0.5 rounded-full text-xs font-medium bg-purple-100 text-purple-800">
+          <span class="inline-flex items-center px-2.5 py-0.5 rounded-full text-xs font-medium bg-gray-200 text-gray-800">
             <svg class="w-3 h-3 mr-1" fill="currentColor" viewBox="0 0 20 20">
               <path d="M10 2a8 8 0 100 16 8 8 0 000-16zM9 9a1 1 0 012 0v4a1 1 0 11-2 0V9zm1-5a1 1 0 100 2 1 1 0 000-2z" />
             </svg>
@@ -473,28 +629,28 @@
       </div>
       <div class="bg-white rounded-lg shadow p-4">
         <div class="text-sm text-gray-500">Hoy</div>
-        <div class="text-2xl font-bold text-primary-600">{stats.actions_today}</div>
+        <div class="text-2xl font-bold text-gray-600">{stats.actions_today}</div>
       </div>
       <div class="bg-white rounded-lg shadow p-4">
         <div class="text-sm text-gray-500">Esta Semana</div>
-        <div class="text-2xl font-bold text-green-600">{stats.actions_this_week}</div>
+        <div class="text-2xl font-bold text-gray-600">{stats.actions_this_week}</div>
       </div>
       <div class="bg-white rounded-lg shadow p-4 hover:shadow-md transition-shadow">
         <div class="flex items-center gap-2 mb-1">
-          <svg class="w-4 h-4 text-amber-500" fill="none" stroke="currentColor" viewBox="0 0 24 24">
+          <svg class="w-4 h-4 text-gray-600" fill="none" stroke="currentColor" viewBox="0 0 24 24">
             <path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M12 9v2m0 4h.01m-6.938 4h13.856c1.54 0 2.502-1.667 1.732-3L13.732 4c-.77-1.333-2.694-1.333-3.464 0L3.34 16c-.77 1.333.192 3 1.732 3z" />
           </svg>
-          <div class="text-sm text-gray-500">Vulnerabilidad</div>
+          <div class="text-sm text-gray-500">Incidentes Criticos</div>
         </div>
         <div class="flex items-center justify-between">
-          <div class="text-2xl font-bold {stats.critical_actions_today > 10 ? 'text-red-600' : stats.critical_actions_today > 5 ? 'text-amber-600' : 'text-green-600'}">
+          <div class="text-2xl font-bold text-gray-800">
-            {stats.critical_actions_today}
+            {stats.critical_actions_today || 0}
           </div>
           <button 
             type="button"
-            class="text-xs text-primary-600 hover:text-primary-700 font-medium flex items-center gap-1 px-2 py-1 rounded hover:bg-primary-50 transition-colors"
+            class="text-xs text-gray-600 hover:text-gray-800 font-medium flex items-center gap-1 px-2 py-1 rounded hover:bg-gray-100 transition-colors"
             on:click={() => filterCriticalActions()}
-            title="Filtrar acciones críticas"
+            title="Ver incidentes críticos"
           >
             Ver
             <svg class="w-3 h-3" fill="none" stroke="currentColor" viewBox="0 0 24 24">
@@ -502,7 +658,7 @@
             </svg>
           </button>
         </div>
-        <div class="text-xs text-gray-500 mt-1">Acciones críticas hoy</div>
+        <div class="text-xs text-gray-500 mt-1">Incidentes críticos hoy</div>
       </div>
     </div>
   {/if}
@@ -519,7 +675,7 @@
         </svg>
         <span class="text-sm font-medium text-gray-900">Filtros Avanzados</span>
         {#if activeFiltersCount > 0}
-          <span class="px-2 py-0.5 rounded-full bg-primary-100 text-primary-700 text-xs font-medium">
+          <span class="px-2 py-0.5 rounded-full bg-gray-200 text-gray-700 text-xs font-medium">
             {activeFiltersCount}
           </span>
         {/if}
@@ -541,7 +697,7 @@
               bind:value={searchText}
               on:input={applyFilters}
               placeholder="Buscar en acciones..."
-              class="block w-full rounded-md border-gray-300 shadow-sm focus:border-primary-500 focus:ring-primary-500 sm:text-sm"
+              class="block w-full rounded-md border-gray-300 shadow-sm focus:border-gray-500 focus:ring-gray-500 sm:text-sm"
             />
           </div>
 
@@ -552,7 +708,7 @@
               id="user"
               bind:value={filterUserId}
               on:change={applyFilters}
-              class="block w-full rounded-md border-gray-300 shadow-sm focus:border-primary-500 focus:ring-primary-500 sm:text-sm"
+              class="block w-full rounded-md border-gray-300 shadow-sm focus:border-gray-500 focus:ring-gray-500 sm:text-sm"
             >
               <option value="">Todos</option>
               {#each users as user}
@@ -568,7 +724,7 @@
               id="action"
               bind:value={filterAction}
               on:change={applyFilters}
-              class="block w-full rounded-md border-gray-300 shadow-sm focus:border-primary-500 focus:ring-primary-500 sm:text-sm"
+              class="block w-full rounded-md border-gray-300 shadow-sm focus:border-gray-500 focus:ring-gray-500 sm:text-sm"
             >
               <option value="">Todas</option>
               {#each Array.from(availableActions).sort() as action}
@@ -584,7 +740,7 @@
               id="resource-type"
               bind:value={filterResourceType}
               on:change={applyFilters}
-              class="block w-full rounded-md border-gray-300 shadow-sm focus:border-primary-500 focus:ring-primary-500 sm:text-sm"
+              class="block w-full rounded-md border-gray-300 shadow-sm focus:border-gray-500 focus:ring-gray-500 sm:text-sm"
             >
               <option value="">Todos</option>
               {#each Array.from(availableResourceTypes).sort() as resourceType}
@@ -598,7 +754,7 @@
           <div class="mt-4 flex justify-end">
             <button
               on:click={clearFilters}
-              class="text-sm text-primary-600 hover:text-primary-700 font-medium"
+              class="text-sm text-gray-600 hover:text-gray-800 font-medium"
             >
               Limpiar filtros
             </button>
@@ -608,6 +764,130 @@
     {/if}
   </div>
 
+  <!-- Sección de Incidentes de Seguridad -->
+  <div class="bg-white shadow rounded-lg mb-6">
+    <div class="px-4 py-3 border-b border-gray-200 bg-gray-50">
+      <div class="flex items-center justify-between">
+        <h3 class="text-sm font-medium text-gray-900">Incidentes de Seguridad</h3>
+        <span class="text-sm text-gray-500">{totalIncidents} incidentes</span>
+      </div>
+    </div>
+    
+    <!-- Filtros de Incidentes -->
+    <div class="px-4 py-3 border-b border-gray-200">
+      <div class="grid grid-cols-1 md:grid-cols-4 gap-4">
+        <input
+          type="text"
+          placeholder="Buscar incidentes..."
+          bind:value={incidentSearchText}
+          on:input={applyIncidentFilters}
+          class="block w-full rounded-md border-gray-300 shadow-sm focus:border-gray-500 focus:ring-gray-500 sm:text-sm"
+        />
+        <select
+          bind:value={filterSeverity}
+          on:change={applyIncidentFilters}
+          class="block w-full rounded-md border-gray-300 shadow-sm focus:border-gray-500 focus:ring-gray-500 sm:text-sm"
+        >
+          <option value="">Toda severidad</option>
+          <option value="critical">Crítico</option>
+          <option value="high">Alto</option>
+          <option value="medium">Medio</option>
+          <option value="low">Bajo</option>
+        </select>
+        <select
+          bind:value={filterStatus}
+          on:change={applyIncidentFilters}
+          class="block w-full rounded-md border-gray-300 shadow-sm focus:border-gray-500 focus:ring-gray-500 sm:text-sm"
+        >
+          <option value="">Todo estado</option>
+          <option value="active">Activo</option>
+          <option value="investigating">Investigando</option>
+          <option value="resolved">Resuelto</option>
+        </select>
+        <button
+          on:click={clearIncidentFilters}
+          class="px-3 py-2 bg-gray-100 text-gray-700 rounded-md hover:bg-gray-200 transition-colors text-sm"
+        >
+          Limpiar filtros
+        </button>
+      </div>
+    </div>
+
+    <!-- Lista de Incidentes -->
+    <div class="overflow-x-auto">
+      {#if isLoadingIncidents}
+        <div class="flex items-center justify-center p-8">
+          <div class="animate-spin rounded-full h-8 w-8 border-b-2 border-gray-600"></div>
+          <span class="ml-2 text-sm text-gray-500">Cargando incidentes...</span>
+        </div>
+      {:else if incidents.length === 0}
+        <div class="text-center py-8">
+          <svg class="mx-auto h-12 w-12 text-gray-400" fill="none" stroke="currentColor" viewBox="0 0 24 24">
+            <path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M9 12l2 2 4-4m6 2a9 9 0 11-18 0 9 9 0 0118 0z" />
+          </svg>
+          <h3 class="mt-2 text-sm font-medium text-gray-900">No hay incidentes</h3>
+          <p class="mt-1 text-sm text-gray-500">No se encontraron incidentes de seguridad para los filtros seleccionados.</p>
+        </div>
+      {:else}
+        <div class="divide-y divide-gray-200">
+          {#each incidents as incident (incident.id)}
+            <div class="p-4 hover:bg-gray-50 transition-colors cursor-pointer" on:click={() => viewIncidentDetail(incident)}>
+              <div class="flex items-center justify-between">
+                <div class="flex items-center space-x-3">
+                  <div class="flex-shrink-0">
+                    <svg class="w-5 h-5 text-gray-600" fill="none" stroke="currentColor" viewBox="0 0 24 24">
+                      <path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M12 9v2m0 4h.01m-6.938 4h13.856c1.54 0 2.502-1.667 1.732-3L13.732 4c-.77-1.333-2.694-1.333-3.464 0L3.34 16c-.77 1.333.192 3 1.732 3z" />
+                    </svg>
+                  </div>
+                  <div class="min-w-0 flex-1">
+                    <p class="text-sm font-medium text-gray-900 truncate">{incident.title}</p>
+                    <p class="text-sm text-gray-500 truncate">{incident.description || 'Sin descripción'}</p>
+                  </div>
+                </div>
+                <div class="flex items-center space-x-2">
+                  <span class="px-2 py-1 text-xs font-medium rounded-full {getSeverityColor(incident.severity)}">
+                    {incident.severity?.toUpperCase()}
+                  </span>
+                  <span class="px-2 py-1 text-xs font-medium rounded-full {getStatusColor(incident.status)}">
+                    {incident.status?.toUpperCase()}
+                  </span>
+                  <span class="text-xs text-gray-500">
+                    {formatSimpleDate(incident.created_at)}
+                  </span>
+                </div>
+              </div>
+            </div>
+          {/each}
+        </div>
+        
+        <!-- Paginación de Incidentes -->
+        {#if incidentsTotalPages > 1}
+          <div class="px-4 py-3 border-t border-gray-200 flex items-center justify-between">
+            <div class="text-sm text-gray-700">
+              Página {incidentsPage} de {incidentsTotalPages}
+            </div>
+            <div class="flex space-x-1">
+              <button
+                on:click={() => goToIncidentsPage(incidentsPage - 1)}
+                disabled={incidentsPage === 1}
+                class="px-3 py-1 text-sm bg-white border border-gray-300 rounded-md hover:bg-gray-50 disabled:opacity-50 disabled:cursor-not-allowed"
+              >
+                Anterior
+              </button>
+              <button
+                on:click={() => goToIncidentsPage(incidentsPage + 1)}
+                disabled={incidentsPage === incidentsTotalPages}
+                class="px-3 py-1 text-sm bg-white border border-gray-300 rounded-md hover:bg-gray-50 disabled:opacity-50 disabled:cursor-not-allowed"
+              >
+                Siguiente
+              </button>
+            </div>
+          </div>
+        {/if}
+      {/if}
+    </div>
+  </div>
+
   <!-- Tabla de Logs -->
   <div class="bg-white shadow rounded-lg overflow-hidden flex flex-col" style="max-height: calc(100vh - 500px); min-height: 400px;">
     <div class="px-4 py-3 border-b border-gray-200 bg-gray-50 flex-shrink-0">
@@ -672,8 +952,8 @@
                   <td class="px-3 py-2 text-sm">
                     {#if log.user_email}
                       <div class="flex items-center gap-2">
-                        <div class="flex-shrink-0 w-8 h-8 bg-primary-100 rounded-full flex items-center justify-center">
+                        <div class="flex-shrink-0 w-8 h-8 bg-gray-100 rounded-full flex items-center justify-center">
-                          <span class="text-xs font-medium text-primary-700">
+                          <span class="text-xs font-medium text-gray-700">
                             {(log.user_name || '?').charAt(0).toUpperCase()}
                           </span>
                         </div>
@@ -701,7 +981,7 @@
                     <button
                       type="button"
                       on:click={() => viewDetail(log)}
-                      class="text-primary-600 hover:text-primary-900 font-medium transition-colors"
+                      class="text-gray-600 hover:text-gray-900 font-medium transition-colors"
                     >
                       Ver
                     </button>
@@ -722,8 +1002,8 @@
                 <div class="flex items-start gap-3 flex-1 min-w-0">
                   <!-- Avatar -->
                   {#if log.user_email}
-                    <div class="flex-shrink-0 w-10 h-10 bg-primary-100 rounded-full flex items-center justify-center">
+                    <div class="flex-shrink-0 w-8 h-8 bg-gray-100 rounded-full flex items-center justify-center">
-                      <span class="text-sm font-medium text-primary-700">
+                      <span class="text-xs font-medium text-gray-700">
                         {(log.user_name || '?').charAt(0).toUpperCase()}
                       </span>
                     </div>
@@ -760,7 +1040,7 @@
                 <button
                   type="button"
                   on:click={() => viewDetail(log)}
-                  class="flex-shrink-0 text-primary-600 hover:text-primary-900 transition-colors p-1"
+                  class="flex-shrink-0 text-gray-600 hover:text-gray-900 transition-colors p-1"
                   title="Ver detalles"
                 >
                   <svg class="w-5 h-5" fill="none" stroke="currentColor" viewBox="0 0 24 24">
@@ -835,7 +1115,7 @@
                 {#each Array.from({length: Math.min(5, totalPages)}, (_, i) => i + Math.max(1, Math.min(currentPage - 2, totalPages - 4))) as page}
                   <button
                     on:click={() => goToPage(page)}
-                    class="relative inline-flex items-center px-3 py-1.5 border text-xs font-medium transition-colors {page === currentPage ? 'z-10 bg-primary-600 border-primary-600 text-white' : 'bg-white border-gray-300 text-gray-700 hover:bg-gray-50'}"
+                    class="relative inline-flex items-center px-3 py-1.5 border text-xs font-medium transition-colors {page === currentPage ? 'z-10 bg-indigo-600 border-indigo-600 text-white' : 'bg-white border-gray-300 text-gray-700 hover:bg-gray-50'}"
                   >
                     {page}
                   </button>
@@ -873,8 +1153,99 @@
   </div>
 </div>
 
+<!-- Modal de Incidentes -->
+{#if showIncidentModal && selectedIncident}
+  <Modal open={showIncidentModal} size="2xl" title="Detalle del Incidente de Seguridad" on:close={() => showIncidentModal = false}>
+    <div class="space-y-4">
+      <!-- Información General -->
+      <div>
+        <h4 class="text-sm font-medium text-gray-900 mb-2">Información General</h4>
+        <dl class="grid grid-cols-2 gap-3 text-sm">
+          <div>
+            <dt class="font-medium text-gray-500">Título:</dt>
+            <dd class="text-gray-900">{selectedIncident.title}</dd>
+          </div>
+          <div>
+            <dt class="font-medium text-gray-500">Severidad:</dt>
+            <dd>
+              <span class="px-2 py-1 text-xs font-medium rounded-full {getSeverityColor(selectedIncident.severity)}">
+                {selectedIncident.severity?.toUpperCase()}
+              </span>
+            </dd>
+          </div>
+          <div>
+            <dt class="font-medium text-gray-500">Estado:</dt>
+            <dd>
+              <span class="px-2 py-1 text-xs font-medium rounded-full {getStatusColor(selectedIncident.status)}">
+                {selectedIncident.status?.toUpperCase()}
+              </span>
+            </dd>
+          </div>
+          <div>
+            <dt class="font-medium text-gray-500">Fecha:</dt>
+            <dd class="text-gray-900">{formatDate(selectedIncident.created_at)}</dd>
+          </div>
+          {#if selectedIncident.affected_user}
+            <div>
+              <dt class="font-medium text-gray-500">Usuario Afectado:</dt>
+              <dd class="text-gray-900">{selectedIncident.affected_user}</dd>
+            </div>
+          {/if}
+          {#if selectedIncident.source_ip}
+            <div>
+              <dt class="font-medium text-gray-500">IP Origen:</dt>
+              <dd class="text-gray-900 font-mono text-xs">{selectedIncident.source_ip}</dd>
+            </div>
+          {/if}
+        </dl>
+      </div>
+
+      <!-- Descripción -->
+      {#if selectedIncident.description}
+        <div>
+          <h4 class="text-sm font-medium text-gray-900 mb-2">Descripción</h4>
+          <div class="bg-gray-50 rounded-lg p-3 text-sm text-gray-700">
+            {selectedIncident.description}
+          </div>
+        </div>
+      {/if}
+
+      <!-- Evidencia -->
+      {#if selectedIncident.evidence && selectedIncident.evidence.length > 0}
+        <div>
+          <h4 class="text-sm font-medium text-gray-900 mb-2">Evidencia</h4>
+          <div class="bg-gray-50 rounded-lg p-3">
+            <ul class="list-disc list-inside text-sm text-gray-700 space-y-1">
+              {#each selectedIncident.evidence as evidence}
+                <li>{evidence}</li>
+              {/each}
+            </ul>
+          </div>
+        </div>
+      {/if}
+
+      <!-- Metadata -->
+      {#if selectedIncident.metadata && Object.keys(selectedIncident.metadata).length > 0}
+        <div>
+          <h4 class="text-sm font-medium text-gray-900 mb-2">Información Adicional</h4>
+          <pre class="bg-gray-50 rounded-lg p-3 text-xs font-mono text-gray-600 overflow-auto max-h-40">{JSON.stringify(selectedIncident.metadata, null, 2)}</pre>
+        </div>
+      {/if}
+    </div>
+
+    <div slot="footer" class="flex justify-end">
+      <button
+        on:click={() => showIncidentModal = false}
+        class="px-4 py-2 bg-white border border-gray-300 rounded-md text-sm font-medium text-gray-700 hover:bg-gray-50"
+      >
+        Cerrar
+      </button>
+    </div>
+  </Modal>
+{/if}
+
 <!-- Modal de Detalle -->
-{#if showDetailModal && selectedLog}
+{#if showDetailModal && selectedLog}}
   <Modal open={showDetailModal} size="2xl" title="Detalle del Registro de Auditoría" on:close={() => showDetailModal = false}>
     <div class="space-y-4">
       <!-- Información General -->

frontend-internal/src/routes/audit/security/+page.svelte

@@ -62,10 +62,10 @@
    */
   function getSeverityColor(severity: string) {
     const colors: any = {
-      low: 'bg-blue-100 text-blue-800',
+      low: 'bg-blue-600 text-white',
-      medium: 'bg-yellow-100 text-yellow-800',
+      medium: 'bg-yellow-500 text-white',
-      high: 'bg-orange-100 text-orange-800',
+      high: 'bg-orange-600 text-white',
-      critical: 'bg-red-100 text-red-800'
+      critical: 'bg-red-600 text-white'
     };
     return colors[severity] || colors.low;
   }
@@ -179,7 +179,7 @@
     <div class="flex items-center justify-between">
       <div>
         <h1 class="text-2xl font-bold text-gray-900 flex items-center gap-2">
-          <svg class="w-8 h-8 text-red-600" fill="none" stroke="currentColor" viewBox="0 0 24 24">
+          <svg class="w-8 h-8 text-gray-600" fill="none" stroke="currentColor" viewBox="0 0 24 24">
             <path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M12 9v2m0 4h.01m-6.938 4h13.856c1.54 0 2.502-1.667 1.732-3L13.732 4c-.77-1.333-2.694-1.333-3.464 0L3.34 16c-.77 1.333.192 3 1.732 3z" />
           </svg>
           Análisis de Seguridad
@@ -190,7 +190,7 @@
       </div>
       <button
         on:click={() => loadSecurityAnalysis()}
-        class="px-4 py-2 bg-primary-600 text-white rounded-lg hover:bg-primary-700 focus:outline-none focus:ring-2 focus:ring-primary-500 flex items-center gap-2"
+        class="px-4 py-2 bg-indigo-600 text-white rounded-lg hover:bg-indigo-700 focus:outline-none focus:ring-2 focus:ring-indigo-500 flex items-center gap-2"
       >
         <svg class="w-5 h-5" fill="none" stroke="currentColor" viewBox="0 0 24 24">
           <path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M4 4v5h.582m15.356 2A8.001 8.001 0 004.582 9m0 0H9m11 11v-5h-.581m0 0a8.003 8.003 0 01-15.357-2m15.357 2H15" />
@@ -211,19 +211,19 @@
     <div class="flex flex-wrap gap-2">
       <button
         on:click={() => changeAnalysisPeriod(24)}
-        class="px-4 py-2 rounded-lg text-sm font-medium transition-colors {analysisHours === 24 ? 'bg-primary-600 text-white' : 'bg-gray-100 text-gray-700 hover:bg-gray-200'}"
+        class="px-4 py-2 rounded-lg text-sm font-medium transition-colors {analysisHours === 24 ? 'bg-indigo-600 text-white' : 'bg-gray-100 text-gray-700 hover:bg-indigo-50'}"
       >
         Últimas 24 horas
       </button>
       <button
         on:click={() => changeAnalysisPeriod(48)}
-        class="px-4 py-2 rounded-lg text-sm font-medium transition-colors {analysisHours === 48 ? 'bg-primary-600 text-white' : 'bg-gray-100 text-gray-700 hover:bg-gray-200'}"
+        class="px-4 py-2 rounded-lg text-sm font-medium transition-colors {analysisHours === 48 ? 'bg-indigo-600 text-white' : 'bg-gray-100 text-gray-700 hover:bg-indigo-50'}"
       >
         Últimas 48 horas
       </button>
       <button
         on:click={() => changeAnalysisPeriod(168)}
-        class="px-4 py-2 rounded-lg text-sm font-medium transition-colors {analysisHours === 168 ? 'bg-primary-600 text-white' : 'bg-gray-100 text-gray-700 hover:bg-gray-200'}"
+        class="px-4 py-2 rounded-lg text-sm font-medium transition-colors {analysisHours === 168 ? 'bg-indigo-600 text-white' : 'bg-gray-100 text-gray-700 hover:bg-indigo-50'}"
       >
         Última semana
       </button>
@@ -232,7 +232,7 @@
 
   {#if isLoading}
     <div class="flex justify-center items-center py-12">
-      <div class="animate-spin rounded-full h-12 w-12 border-b-2 border-primary-600"></div>
+      <div class="animate-spin rounded-full h-12 w-12 border-b-2 border-gray-600"></div>
     </div>
   {:else if analysis}
     <!-- Resumen de Riesgo -->
@@ -257,9 +257,9 @@
         <div class="flex items-center justify-between">
           <div>
             <p class="text-sm text-gray-500">Amenazas Detectadas</p>
-            <p class="text-2xl font-bold text-red-600">{analysis.total_threats_detected}</p>
+            <p class="text-2xl font-bold text-gray-800">{analysis.total_threats_detected}</p>
           </div>
-          <svg class="w-10 h-10 text-red-300" fill="none" stroke="currentColor" viewBox="0 0 24 24">
+          <svg class="w-10 h-10 text-gray-400" fill="none" stroke="currentColor" viewBox="0 0 24 24">
             <path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M12 9v2m0 4h.01m-6.938 4h13.856c1.54 0 2.502-1.667 1.732-3L13.732 4c-.77-1.333-2.694-1.333-3.464 0L3.34 16c-.77 1.333.192 3 1.732 3z" />
           </svg>
         </div>
@@ -269,9 +269,9 @@
         <div class="flex items-center justify-between">
           <div>
             <p class="text-sm text-gray-500">Intentos Fallidos</p>
-            <p class="text-2xl font-bold text-orange-600">{analysis.failed_login_attempts}</p>
+            <p class="text-2xl font-bold text-gray-700">{analysis.failed_login_attempts}</p>
           </div>
-          <svg class="w-10 h-10 text-orange-300" fill="none" stroke="currentColor" viewBox="0 0 24 24">
+          <svg class="w-10 h-10 text-gray-400" fill="none" stroke="currentColor" viewBox="0 0 24 24">
             <path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M12 15v2m-6 4h12a2 2 0 002-2v-6a2 2 0 00-2-2H6a2 2 0 00-2 2v6a2 2 0 002 2zm10-10V7a4 4 0 00-8 0v4h8z" />
           </svg>
         </div>
@@ -281,9 +281,9 @@
         <div class="flex items-center justify-between">
           <div>
             <p class="text-sm text-gray-500">IPs Sospechosas</p>
-            <p class="text-2xl font-bold text-purple-600">{analysis.suspicious_ips_count}</p>
+            <p class="text-2xl font-bold text-gray-700">{analysis.suspicious_ips_count}</p>
           </div>
-          <svg class="w-10 h-10 text-purple-300" fill="none" stroke="currentColor" viewBox="0 0 24 24">
+          <svg class="w-10 h-10 text-gray-400" fill="none" stroke="currentColor" viewBox="0 0 24 24">
             <path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M21 12a9 9 0 01-9 9m9-9a9 9 0 00-9-9m9 9H3m9 9a9 9 0 01-9-9m9 9c1.657 0 3-4.03 3-9s-1.343-9-3-9m0 18c-1.657 0-3-4.03-3-9s1.343-9 3-9m-9 9a9 9 0 019-9" />
           </svg>
         </div>
@@ -293,9 +293,9 @@
         <div class="flex items-center justify-between">
           <div>
             <p class="text-sm text-gray-500">Acciones Críticas</p>
-            <p class="text-2xl font-bold text-amber-600">{analysis.critical_actions_count}</p>
+            <p class="text-2xl font-bold text-gray-700">{analysis.critical_actions_count}</p>
           </div>
-          <svg class="w-10 h-10 text-amber-300" fill="none" stroke="currentColor" viewBox="0 0 24 24">
+          <svg class="w-10 h-10 text-gray-400" fill="none" stroke="currentColor" viewBox="0 0 24 24">
             <path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M9 12l2 2 4-4m5.618-4.016A11.955 11.955 0 0112 2.944a11.955 11.955 0 01-8.618 3.04A12.02 12.02 0 003 9c0 5.591 3.824 10.29 9 11.622 5.176-1.332 9-6.03 9-11.622 0-1.042-.133-2.052-.382-3.016z" />
           </svg>
         </div>
@@ -304,17 +304,17 @@
 
     <!-- Recomendaciones Generales -->
     {#if analysis.recommended_actions && analysis.recommended_actions.length > 0}
-      <div class="bg-blue-50 border border-blue-200 rounded-lg p-4 mb-6">
+      <div class="bg-gray-50 border border-gray-200 rounded-lg p-4 mb-6">
         <div class="flex items-start gap-3">
-          <svg class="w-6 h-6 text-blue-600 flex-shrink-0 mt-0.5" fill="none" stroke="currentColor" viewBox="0 0 24 24">
+          <svg class="w-6 h-6 text-gray-600 flex-shrink-0 mt-0.5" fill="none" stroke="currentColor" viewBox="0 0 24 24">
             <path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M13 16h-1v-4h-1m1-4h.01M21 12a9 9 0 11-18 0 9 9 0 0118 0z" />
           </svg>
           <div class="flex-1">
-            <h4 class="text-sm font-semibold text-blue-900 mb-2">Acciones Recomendadas</h4>
+            <h4 class="text-sm font-semibold text-gray-900 mb-2">Acciones Recomendadas</h4>
             <ul class="space-y-1">
               {#each analysis.recommended_actions as action}
-                <li class="text-sm text-blue-800 flex items-start gap-2">
+                <li class="text-sm text-gray-700 flex items-start gap-2">
-                  <svg class="w-4 h-4 text-blue-600 flex-shrink-0 mt-0.5" fill="none" stroke="currentColor" viewBox="0 0 24 24">
+                  <svg class="w-4 h-4 text-gray-600 flex-shrink-0 mt-0.5" fill="none" stroke="currentColor" viewBox="0 0 24 24">
                     <path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M9 5l7 7-7 7" />
                   </svg>
                   {action}
@@ -332,12 +332,12 @@
         <h3 class="text-lg font-semibold text-gray-900">Amenazas Detectadas</h3>
         
         {#each analysis.threats as threat}
-          <div class="bg-white shadow rounded-lg p-6 border-l-4 {threat.severity === 'critical' ? 'border-red-500' : threat.severity === 'high' ? 'border-orange-500' : threat.severity === 'medium' ? 'border-yellow-500' : 'border-blue-500'}">
+          <div class="bg-white shadow rounded-lg p-6 border-l-4 {threat.severity === 'critical' ? 'border-gray-900' : threat.severity === 'high' ? 'border-gray-600' : threat.severity === 'medium' ? 'border-gray-400' : 'border-gray-200'}">
             <!-- Header de Amenaza -->
             <div class="flex items-start justify-between mb-4">
               <div class="flex items-start gap-3 flex-1">
-                <div class="p-2 rounded-lg {threat.severity === 'critical' ? 'bg-red-100' : threat.severity === 'high' ? 'bg-orange-100' : threat.severity === 'medium' ? 'bg-yellow-100' : 'bg-blue-100'}">
+                <div class="p-2 rounded-lg {threat.severity === 'critical' ? 'bg-gray-100' : threat.severity === 'high' ? 'bg-gray-100' : threat.severity === 'medium' ? 'bg-gray-100' : 'bg-gray-50'}">
-                  <svg class="w-6 h-6 {threat.severity === 'critical' ? 'text-red-600' : threat.severity === 'high' ? 'text-orange-600' : threat.severity === 'medium' ? 'text-yellow-600' : 'text-blue-600'}" fill="none" stroke="currentColor" viewBox="0 0 24 24">
+                  <svg class="w-6 h-6 {threat.severity === 'critical' ? 'text-gray-900' : threat.severity === 'high' ? 'text-gray-700' : threat.severity === 'medium' ? 'text-gray-600' : 'text-gray-500'}" fill="none" stroke="currentColor" viewBox="0 0 24 24">
                     <path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d={getThreatIcon(threat.type)} />
                   </svg>
                 </div>
@@ -453,12 +453,12 @@
       </div>
     {:else}
       <!-- No hay amenazas -->
-      <div class="bg-green-50 border border-green-200 rounded-lg p-8 text-center">
+      <div class="bg-gray-50 border border-gray-200 rounded-lg p-8 text-center">
-        <svg class="w-16 h-16 text-green-600 mx-auto mb-4" fill="none" stroke="currentColor" viewBox="0 0 24 24">
+        <svg class="w-16 h-16 text-gray-500 mx-auto mb-4" fill="none" stroke="currentColor" viewBox="0 0 24 24">
           <path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M9 12l2 2 4-4m5.618-4.016A11.955 11.955 0 0112 2.944a11.955 11.955 0 01-8.618 3.04A12.02 12.02 0 003 9c0 5.591 3.824 10.29 9 11.622 5.176-1.332 9-6.03 9-11.622 0-1.042-.133-2.052-.382-3.016z" />
         </svg>
-        <h3 class="text-lg font-semibold text-green-900 mb-2">Sistema Seguro</h3>
+        <h3 class="text-lg font-semibold text-gray-900 mb-2">Sistema Seguro</h3>
-        <p class="text-sm text-green-700">No se detectaron amenazas en el período analizado</p>
+        <p class="text-sm text-gray-600">No se detectaron amenazas en el período analizado</p>
       </div>
     {/if}
   {/if}
@@ -486,7 +486,7 @@
           type="text"
           bind:value={actionTarget}
           placeholder="IP o email del usuario"
-          class="block w-full rounded-md border-gray-300 shadow-sm focus:border-primary-500 focus:ring-primary-500 sm:text-sm"
+          class="block w-full rounded-md border-gray-300 shadow-sm focus:border-gray-500 focus:ring-gray-500 sm:text-sm"
         />
       </div>
 
@@ -496,7 +496,7 @@
           bind:value={actionReason}
           rows="3"
           placeholder="Razón de la acción de seguridad"
-          class="block w-full rounded-md border-gray-300 shadow-sm focus:border-primary-500 focus:ring-primary-500 sm:text-sm"
+          class="block w-full rounded-md border-gray-300 shadow-sm focus:border-gray-500 focus:ring-gray-500 sm:text-sm"
         ></textarea>
       </div>
 
@@ -508,7 +508,7 @@
             bind:value={actionDuration}
             min="1"
             max="10080"
-            class="block w-full rounded-md border-gray-300 shadow-sm focus:border-primary-500 focus:ring-primary-500 sm:text-sm"
+            class="block w-full rounded-md border-gray-300 shadow-sm focus:border-gray-500 focus:ring-gray-500 sm:text-sm"
           />
         </div>
       {/if}
@@ -516,13 +516,13 @@
       <div class="flex justify-end gap-3 pt-4 border-t">
         <button
           on:click={() => showActionModal = false}
-          class="px-4 py-2 text-sm font-medium text-gray-700 bg-white border border-gray-300 rounded-md hover:bg-gray-50 focus:outline-none focus:ring-2 focus:ring-primary-500"
+          class="px-4 py-2 text-sm font-medium text-gray-700 bg-white border border-gray-300 rounded-md hover:bg-gray-50 focus:outline-none focus:ring-2 focus:ring-gray-500"
         >
           Cancelar
         </button>
         <button
           on:click={executeSecurityAction}
-          class="px-4 py-2 text-sm font-medium text-white bg-red-600 rounded-md hover:bg-red-700 focus:outline-none focus:ring-2 focus:ring-red-500"
+          class="px-4 py-2 text-sm font-medium text-white bg-indigo-600 rounded-md hover:bg-indigo-700 focus:outline-none focus:ring-2 focus:ring-indigo-500"
         >
           Ejecutar Acción
         </button>

frontend-internal/src/routes/tickets/+page.svelte

@@ -9,7 +9,6 @@
   let categories = [];
   let systems = [];
   let users = [];
-  let tenants = []; // Nueva lista de tenants
   let isLoading = false;
   let showModal = false;
   let showEditModal = false;
@@ -19,15 +18,6 @@
   // Filtros
   let filterStatus = '';
   let filterPriority = '';
-  let filterTenant = ''; // Nuevo filtro por cliente/tenant
-  let filterCategory = ''; // Filtro por categoría
-  let filterAssignedTo = ''; // Filtro por asignado a
-  let searchText = ''; // Búsqueda por texto
-  let filterDateFrom = ''; // Fecha desde
-  let filterDateTo = ''; // Fecha hasta
-  
-  // Estado de filtros
-  $: activeFiltersCount = [filterTenant, filterStatus, filterPriority, filterCategory, filterAssignedTo, searchText, filterDateFrom, filterDateTo].filter(f => f && f.trim()).length;
   
   // Form para editar
   let editFormData = {
@@ -60,34 +50,25 @@
     { value: 'URGENT', label: 'Urgente', color: 'red' }
   ];
 
-  // Ajustar la función loadData para usar el endpoint administrativo con filtros
+  // Ajustar la función loadData para asegurar que los filtros se envíen correctamente
   async function loadData() {
     isLoading = true;
     try {
-      // Preparar parámetros filtrando valores vacíos
+      const [ticketsData, categoriesData, systemsData, usersData] = await Promise.all([
-      const ticketParams = {};
+        api.get('/tickets/', {
-      if (filterStatus) ticketParams.status_filter = filterStatus;
+          params: {
-      if (filterPriority) ticketParams.priority_filter = filterPriority;
+            status: filterStatus || undefined,
-      if (filterTenant) ticketParams.tenant_id_filter = filterTenant;
+            priority: filterPriority || undefined
-      if (filterCategory) ticketParams.category_filter = filterCategory;
+          }
-      if (filterAssignedTo) ticketParams.assigned_to_filter = filterAssignedTo;
+        }),
-      if (searchText) ticketParams.search = searchText;
-      if (filterDateFrom) ticketParams.date_from = filterDateFrom;
-      if (filterDateTo) ticketParams.date_to = filterDateTo;
-
-      const [ticketsData, categoriesData, systemsData, usersData, tenantsData] = await Promise.all([
-        // Usar el nuevo endpoint administrativo
-        api.get('/tickets/admin/all', ticketParams),
         api.get('/categories/'),
         api.get('/systems/'),
-        api.get('/users/'),
+        api.get('/users/')
-        api.get('/tenants/') // Cargar lista de tenants
       ]);
       tickets = ticketsData;
       categories = categoriesData;
       systems = systemsData;
       users = usersData;
-      tenants = tenantsData;
     } catch (e) {
       toast.error('Error cargando datos: ' + (e.message || 'Error desconocido'));
     } finally {
@@ -99,28 +80,6 @@
   function applyFilters() {
     loadData();
   }
-  
-  // Limpiar todos los filtros
-  function clearFilters() {
-    filterStatus = '';
-    filterPriority = '';
-    filterTenant = '';
-    filterCategory = '';
-    filterAssignedTo = '';
-    searchText = '';
-    filterDateFrom = '';
-    filterDateTo = '';
-    applyFilters();
-  }
-  
-  // Búsqueda en tiempo real (debounced)
-  let searchTimeout;
-  function handleSearchInput() {
-    clearTimeout(searchTimeout);
-    searchTimeout = setTimeout(() => {
-      applyFilters();
-    }, 500);
-  }
 
   function openCreateModal() {
     selectedTicket = null;
@@ -260,31 +219,12 @@
 </script>
 
 <div class="px-4 py-8 mx-auto max-w-7xl sm:px-6 lg:px-8">
-  <div class="sm:flex sm:items-center sm:justify-between">
+  <div class="sm:flex sm:items-center">
     <div class="sm:flex-auto">
       <h1 class="text-xl font-semibold text-gray-900">Tickets de Soporte</h1>
-      <p class="mt-2 text-sm text-gray-700">
+      <p class="mt-2 text-sm text-gray-700">Gestión de tickets del sistema de mesa de ayuda.</p>
-        Gestión de tickets del sistema de mesa de ayuda.
-        {#if activeFiltersCount > 0}
-          <span class="inline-flex items-center px-2.5 py-0.5 rounded-full text-xs font-medium bg-blue-100 text-blue-800 ml-2">
-            {activeFiltersCount} filtro{activeFiltersCount !== 1 ? 's' : ''} activo{activeFiltersCount !== 1 ? 's' : ''}
-          </span>
-        {/if}
-      </p>
     </div>
-    <div class="mt-4 sm:mt-0 sm:ml-16 sm:flex-none space-x-3">
+    <div class="mt-4 sm:mt-0 sm:ml-16 sm:flex-none">
-      {#if activeFiltersCount > 0}
-        <button
-          type="button"
-          on:click={clearFilters}
-          class="inline-flex items-center justify-center px-3 py-2 text-sm font-medium text-gray-700 bg-white border border-gray-300 rounded-md shadow-sm hover:bg-gray-50"
-        >
-          <svg class="w-4 h-4 mr-2" fill="none" stroke="currentColor" viewBox="0 0 24 24">
-            <path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M6 18L18 6M6 6l12 12" />
-          </svg>
-          Limpiar filtros
-        </button>
-      {/if}
       <button
         type="button"
         on:click={openCreateModal}
@@ -295,139 +235,46 @@
     </div>
   </div>
 
-  <!-- Filtros Avanzados -->
+  <!-- Filtros -->
-  <div class="mt-6 bg-white shadow sm:rounded-lg">
+  <div class="mt-6 bg-white shadow sm:rounded-lg p-4">
-    <div class="px-4 py-5 sm:p-6">
+    <div class="grid grid-cols-1 gap-4 sm:grid-cols-3">
-      <h3 class="text-lg leading-6 font-medium text-gray-900 mb-4">Filtros</h3>
+      <div>
-      
+        <label for="filterStatus" class="block text-sm font-medium text-gray-700">Estado</label>
-      <!-- Primera fila - Búsqueda y Filtros principales -->
+        <select
-      <div class="grid grid-cols-1 gap-4 sm:grid-cols-4 mb-4">
+          id="filterStatus"
-        <!-- Búsqueda por texto -->
+          bind:value={filterStatus}
-        <div class="sm:col-span-2">
+          on:change={applyFilters}
-          <label for="searchText" class="block text-sm font-medium text-gray-700 mb-1">Búsqueda</label>
+          class="mt-1 block w-full rounded-md border-gray-300 shadow-sm focus:border-indigo-500 focus:ring-indigo-500 sm:text-sm border p-2"
-          <div class="relative">
+        >
-            <div class="absolute inset-y-0 left-0 pl-3 flex items-center pointer-events-none">
+          <option value="">Todos</option>
-              <svg class="h-5 w-5 text-gray-400" fill="none" stroke="currentColor" viewBox="0 0 24 24">
+          {#each STATUSES as status}
-                <path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M21 21l-6-6m2-5a7 7 0 11-14 0 7 7 0 0114 0z" />
+            <option value={status.value}>{status.label}</option>
-              </svg>
+          {/each}
-            </div>
+        </select>
-            <input
-              type="text"
-              id="searchText"
-              bind:value={searchText}
-              on:input={handleSearchInput}
-              placeholder="Buscar en título o descripción..."
-              class="pl-10 block w-full rounded-md border-gray-300 shadow-sm focus:border-indigo-500 focus:ring-indigo-500 sm:text-sm"
-            />
-          </div>
-        </div>
-        
-        <!-- Cliente/Empresa -->
-        <div>
-          <label for="filterTenant" class="block text-sm font-medium text-gray-700 mb-1">Cliente/Empresa</label>
-          <select
-            id="filterTenant"
-            bind:value={filterTenant}
-            on:change={applyFilters}
-            class="block w-full rounded-md border-gray-300 shadow-sm focus:border-indigo-500 focus:ring-indigo-500 sm:text-sm"
-          >
-            <option value="">Todos los clientes</option>
-            {#each tenants as tenant}
-              <option value={tenant.id}>{tenant.name}</option>
-            {/each}
-          </select>
-        </div>
-        
-        <!-- Estado -->
-        <div>
-          <label for="filterStatus" class="block text-sm font-medium text-gray-700 mb-1">Estado</label>
-          <select
-            id="filterStatus"
-            bind:value={filterStatus}
-            on:change={applyFilters}
-            class="block w-full rounded-md border-gray-300 shadow-sm focus:border-indigo-500 focus:ring-indigo-500 sm:text-sm"
-          >
-            <option value="">Todos</option>
-            {#each STATUSES as status}
-              <option value={status.value}>{status.label}</option>
-            {/each}
-          </select>
-        </div>
       </div>
       
-      <!-- Segunda fila - Filtros secundarios -->
+      <div>
-      <div class="grid grid-cols-1 gap-4 sm:grid-cols-5">
+        <label for="filterPriority" class="block text-sm font-medium text-gray-700">Prioridad</label>
-        <!-- Prioridad -->
+        <select
-        <div>
+          id="filterPriority"
-          <label for="filterPriority" class="block text-sm font-medium text-gray-700 mb-1">Prioridad</label>
+          bind:value={filterPriority}
-          <select
+          on:change={applyFilters}
-            id="filterPriority"
+          class="mt-1 block w-full rounded-md border-gray-300 shadow-sm focus:border-indigo-500 focus:ring-indigo-500 sm:text-sm border p-2"
-            bind:value={filterPriority}
+        >
-            on:change={applyFilters}
+          <option value="">Todas</option>
-            class="block w-full rounded-md border-gray-300 shadow-sm focus:border-indigo-500 focus:ring-indigo-500 sm:text-sm"
+          {#each PRIORITIES as priority}
-          >
+            <option value={priority.value}>{priority.label}</option>
-            <option value="">Todas</option>
+          {/each}
-            {#each PRIORITIES as priority}
+        </select>
-              <option value={priority.value}>{priority.label}</option>
+      </div>
-            {/each}
+
-          </select>
+      <div class="flex items-end">
-        </div>
+        <button
-        
+          on:click={loadData}
-        <!-- Categoría -->
+          class="w-full inline-flex justify-center items-center px-4 py-2 border border-gray-300 shadow-sm text-sm font-medium rounded-md text-gray-700 bg-white hover:bg-gray-50 focus:outline-none focus:ring-2 focus:ring-offset-2 focus:ring-indigo-500"
-        <div>
+        >
-          <label for="filterCategory" class="block text-sm font-medium text-gray-700 mb-1">Categoría</label>
+          Actualizar
-          <select
+        </button>
-            id="filterCategory"
-            bind:value={filterCategory}
-            on:change={applyFilters}
-            class="block w-full rounded-md border-gray-300 shadow-sm focus:border-indigo-500 focus:ring-indigo-500 sm:text-sm"
-          >
-            <option value="">Todas</option>
-            {#each categories as category}
-              <option value={category.id}>{category.name}</option>
-            {/each}
-          </select>
-        </div>
-        
-        <!-- Asignado a -->
-        <div>
-          <label for="filterAssignedTo" class="block text-sm font-medium text-gray-700 mb-1">Asignado a</label>
-          <select
-            id="filterAssignedTo"
-            bind:value={filterAssignedTo}
-            on:change={applyFilters}
-            class="block w-full rounded-md border-gray-300 shadow-sm focus:border-indigo-500 focus:ring-indigo-500 sm:text-sm"
-          >
-            <option value="">Todos</option>
-            {#each users.filter(u => u.role === 'AGENT' || u.role === 'SUPPORT_MANAGER' || u.role === 'ADMIN') as user}
-              <option value={user.id}>{user.first_name} {user.last_name}</option>
-            {/each}
-          </select>
-        </div>
-        
-        <!-- Fecha desde -->
-        <div>
-          <label for="filterDateFrom" class="block text-sm font-medium text-gray-700 mb-1">Desde</label>
-          <input
-            type="date"
-            id="filterDateFrom"
-            bind:value={filterDateFrom}
-            on:change={applyFilters}
-            class="block w-full rounded-md border-gray-300 shadow-sm focus:border-indigo-500 focus:ring-indigo-500 sm:text-sm"
-          />
-        </div>
-        
-        <!-- Fecha hasta -->
-        <div>
-          <label for="filterDateTo" class="block text-sm font-medium text-gray-700 mb-1">Hasta</label>
-          <input
-            type="date"
-            id="filterDateTo"
-            bind:value={filterDateTo}
-            on:change={applyFilters}
-            class="block w-full rounded-md border-gray-300 shadow-sm focus:border-indigo-500 focus:ring-indigo-500 sm:text-sm"
-          />
-        </div>
       </div>
     </div>
   </div>
@@ -441,13 +288,12 @@
             <thead class="bg-gray-50">
               <tr>
                 <th scope="col" class="py-3.5 pl-4 pr-3 text-left text-sm font-semibold text-gray-900 sm:pl-6">Ticket</th>
-                <th scope="col" class="px-3 py-3.5 text-left text-sm font-semibold text-gray-900">Cliente/Empresa</th>
                 <th scope="col" class="px-3 py-3.5 text-left text-sm font-semibold text-gray-900">Asunto</th>
                 <th scope="col" class="px-3 py-3.5 text-left text-sm font-semibold text-gray-900">Estado</th>
                 <th scope="col" class="px-3 py-3.5 text-left text-sm font-semibold text-gray-900">Prioridad</th>
-                <th scope="col" class="px-3 py-3.5 text-left text-sm font-semibold text-gray-900">Creado por</th>
+                <th scope="col" class="px-3 py-3.5 text-left text-sm font-semibold text-gray-900">Categoría</th>
                 <th scope="col" class="px-3 py-3.5 text-left text-sm font-semibold text-gray-900">Asignado a</th>
-                <th scope="col" class="px-3 py-3.5 text-left text-sm font-semibold text-gray-900">Fecha</th>
+                <th scope="col" class="px-3 py-3.5 text-left text-sm font-semibold text-gray-900">Creado</th>
                 <th scope="col" class="relative py-3.5 pl-3 pr-4 sm:pr-6">
                   <span class="sr-only">Acciones</span>
                 </th>
@@ -455,9 +301,9 @@
             </thead>
             <tbody class="divide-y divide-gray-200 bg-white">
               {#if isLoading}
-                <tr><td colspan="9" class="text-center py-4">Cargando...</td></tr>
+                <tr><td colspan="8" class="text-center py-4">Cargando...</td></tr>
               {:else if tickets.length === 0}
-                <tr><td colspan="9" class="text-center py-4">No hay tickets registrados</td></tr>
+                <tr><td colspan="8" class="text-center py-4">No hay tickets registrados</td></tr>
               {:else}
                 {#each tickets as ticket}
                   <tr 
@@ -467,10 +313,6 @@
                     <td class="whitespace-nowrap py-4 pl-4 pr-3 text-sm font-medium text-gray-900 sm:pl-6">
                       {ticket.ticket_number || ticket.id.substring(0, 8)}
                     </td>
-                    <td class="px-3 py-4 text-sm text-gray-900">
-                      <div class="font-medium text-indigo-600">{ticket.tenant?.name || 'N/A'}</div>
-                      <div class="text-xs text-gray-500">{ticket.tenant?.contact_email || ''}</div>
-                    </td>
                     <td class="px-3 py-4 text-sm text-gray-900">
                       <div class="font-medium">{ticket.subject}</div>
                       <div class="text-gray-500 truncate max-w-xs">{ticket.description}</div>
@@ -485,10 +327,8 @@
                         {getPriorityBadge(ticket.priority).label}
                       </span>
                     </td>
-                    <td class="px-3 py-4 text-sm text-gray-900">
+                    <td class="whitespace-nowrap px-3 py-4 text-sm text-gray-500">
-                      <div class="font-medium">{ticket.created_by_user?.first_name} {ticket.created_by_user?.last_name}</div>
+                      {getCategoryName(ticket.category_id)}
-                      <div class="text-xs text-gray-500">{ticket.created_by_user?.email}</div>
-                      <div class="text-xs text-indigo-600">{ticket.created_by_user?.role || ''}</div>
                     </td>
                     <td class="whitespace-nowrap px-3 py-4 text-sm text-gray-500">
                       {getUserName(ticket.assigned_to)}

frontend-internal/tailwind.config.js

@@ -1,6 +1,61 @@
 /** @type {import('tailwindcss').Config} */
 export default {
 	content: ['./src/**/*.{html,js,svelte,ts}'],
+	safelist: [
+		// Colores de acciones
+		'bg-red-600',
+		'bg-blue-600',
+		'bg-green-600',
+		'bg-indigo-600',
+		'bg-orange-600',
+		'bg-yellow-500',
+		'bg-gray-600',
+		// Colores de severidad/riesgo
+		'bg-red-100',
+		'bg-red-800',
+		'bg-orange-100',
+		'bg-orange-300',
+		'bg-orange-600',
+		'bg-orange-700',
+		'bg-orange-800',
+		'bg-yellow-100',
+		'bg-yellow-300',
+		'bg-yellow-800',
+		'bg-blue-100',
+		'bg-blue-300',
+		'bg-blue-800',
+		'bg-green-100',
+		'bg-green-300',
+		'bg-green-800',
+		// Bordes
+		'border-red-300',
+		'border-orange-300',
+		'border-yellow-300',
+		'border-blue-300',
+		'border-green-300',
+		// Text colors
+		'text-red-600',
+		'text-red-800',
+		'text-orange-600',
+		'text-orange-800',
+		'text-yellow-800',
+		'text-blue-600',
+		'text-blue-800',
+		'text-green-600',
+		'text-green-800',
+		'text-white',
+		// Hover states
+		'hover:bg-red-700',
+		'hover:bg-orange-700',
+		'hover:bg-blue-700',
+		'hover:bg-indigo-700',
+		'hover:bg-indigo-50',
+		// Focus rings
+		'focus:ring-red-500',
+		'focus:ring-orange-500',
+		'focus:ring-blue-500',
+		'focus:ring-indigo-500',
+	],
 	theme: {
 		extend: {
 			colors: {

scripts/db_utils.py

@@ -1,262 +0,0 @@
-#!/usr/bin/env python3
-"""
-Database Utilities Script
-Herramientas administrativas para gestión de base de datos
-
-Uso:
-    python scripts/db_utils.py list-users [--tenant-id UUID]
-    python scripts/db_utils.py check-user EMAIL
-    python scripts/db_utils.py reset-password EMAIL [--password PASSWORD]
-    python scripts/db_utils.py list-tickets [--tenant-id UUID] [--limit N]
-    python scripts/db_utils.py check-ticket TICKET_ID
-
-Ejemplos:
-    python scripts/db_utils.py list-users
-    python scripts/db_utils.py check-user admin@example.com
-    python scripts/db_utils.py reset-password admin@example.com --password admin123
-    python scripts/db_utils.py list-tickets --limit 10
-"""
-
-import asyncio
-import sys
-import os
-from typing import Optional
-import argparse
-from pathlib import Path
-
-# Agregar backend al path para imports
-backend_path = Path(__file__).parent.parent / "backend"
-sys.path.insert(0, str(backend_path))
-
-from sqlalchemy import select
-from sqlalchemy.ext.asyncio import create_async_engine, AsyncSession
-from sqlalchemy.orm import sessionmaker
-
-from app.models.user import User
-from app.models.ticket import Ticket
-from app.models.tenant import Tenant
-from app.core.security import SecurityUtils
-
-
-class DBUtils:
-    """Utilidades de gestión de base de datos"""
-    
-    def __init__(self, database_url: Optional[str] = None):
-        self.database_url = database_url or os.getenv(
-            'DATABASE_URL', 
-            'postgresql+asyncpg://postgres:postgres@localhost:5432/servicemanager'
-        )
-        self.engine = create_async_engine(self.database_url, echo=False)
-        self.async_session = sessionmaker(
-            self.engine, 
-            class_=AsyncSession, 
-            expire_on_commit=False
-        )
-    
-    async def list_users(self, tenant_id: Optional[str] = None):
-        """Listar todos los usuarios"""
-        async with self.async_session() as session:
-            query = select(User)
-            if tenant_id:
-                query = query.where(User.tenant_id == tenant_id)
-            
-            result = await session.execute(query)
-            users = result.scalars().all()
-            
-            if not users:
-                print("❌ No se encontraron usuarios")
-                return
-            
-            print(f"\n{'='*80}")
-            print(f"📋 USUARIOS ({len(users)} encontrados)")
-            print(f"{'='*80}\n")
-            
-            for user in users:
-                print(f"  Email: {user.email}")
-                print(f"  Role: {user.role}")
-                print(f"  ID: {user.id}")
-                print(f"  Tenant ID: {user.tenant_id}")
-                print(f"  Activo: {'✅' if user.is_active else '❌'}")
-                print(f"  {'-'*76}")
-    
-    async def check_user(self, email: str):
-        """Verificar información de un usuario específico"""
-        async with self.async_session() as session:
-            result = await session.execute(
-                select(User).where(User.email == email)
-            )
-            user = result.scalar_one_or_none()
-            
-            if not user:
-                print(f"❌ Usuario '{email}' no encontrado")
-                return
-            
-            print(f"\n{'='*80}")
-            print(f"👤 INFORMACIÓN DEL USUARIO")
-            print(f"{'='*80}\n")
-            print(f"  Email: {user.email}")
-            print(f"  Nombre: {user.first_name} {user.last_name}")
-            print(f"  Role: {user.role}")
-            print(f"  ID: {user.id}")
-            print(f"  Tenant ID: {user.tenant_id}")
-            print(f"  Activo: {'✅' if user.is_active else '❌'}")
-            print(f"  2FA: {'✅ Habilitado' if user.totp_secret else '❌ Deshabilitado'}")
-            print(f"  Creado: {user.created_at}")
-            print(f"\n{'='*80}")
-    
-    async def reset_password(self, email: str, new_password: str = "admin123"):
-        """Resetear contraseña de un usuario"""
-        async with self.async_session() as session:
-            result = await session.execute(
-                select(User).where(User.email == email)
-            )
-            user = result.scalar_one_or_none()
-            
-            if not user:
-                print(f"❌ Usuario '{email}' no encontrado")
-                return
-            
-            # Hash nueva contraseña
-            password_hash = SecurityUtils.hash_password(new_password)
-            user.password_hash = password_hash
-            
-            try:
-                await session.commit()
-                print(f"\n✅ Contraseña actualizada exitosamente")
-                print(f"  Usuario: {email}")
-                print(f"  Nueva contraseña: {new_password}")
-                print(f"\n⚠️  IMPORTANTE: Cambia esta contraseña después del primer login")
-            except Exception as e:
-                await session.rollback()
-                print(f"❌ Error al actualizar contraseña: {e}")
-    
-    async def list_tickets(self, tenant_id: Optional[str] = None, limit: int = 20):
-        """Listar tickets"""
-        async with self.async_session() as session:
-            query = select(Ticket).order_by(Ticket.created_at.desc()).limit(limit)
-            if tenant_id:
-                query = query.where(Ticket.tenant_id == tenant_id)
-            
-            result = await session.execute(query)
-            tickets = result.scalars().all()
-            
-            if not tickets:
-                print("❌ No se encontraron tickets")
-                return
-            
-            print(f"\n{'='*80}")
-            print(f"🎫 TICKETS ({len(tickets)} encontrados, límite: {limit})")
-            print(f"{'='*80}\n")
-            
-            for ticket in tickets:
-                print(f"  {ticket.ticket_number} | {ticket.status} | {ticket.priority}")
-                print(f"  Asunto: {ticket.subject}")
-                print(f"  ID: {ticket.id}")
-                print(f"  Tenant: {ticket.tenant_id}")
-                print(f"  Creado: {ticket.created_at}")
-                print(f"  {'-'*76}")
-    
-    async def check_ticket(self, ticket_id: str):
-        """Verificar información de un ticket específico"""
-        async with self.async_session() as session:
-            result = await session.execute(
-                select(Ticket).where(Ticket.id == ticket_id)
-            )
-            ticket = result.scalar_one_or_none()
-            
-            if not ticket:
-                print(f"❌ Ticket '{ticket_id}' no encontrado")
-                return
-            
-            # Obtener creador
-            creator_result = await session.execute(
-                select(User).where(User.id == ticket.created_by)
-            )
-            creator = creator_result.scalar_one_or_none()
-            
-            # Obtener asignado
-            assigned = None
-            if ticket.assigned_to:
-                assigned_result = await session.execute(
-                    select(User).where(User.id == ticket.assigned_to)
-                )
-                assigned = assigned_result.scalar_one_or_none()
-            
-            print(f"\n{'='*80}")
-            print(f"🎫 INFORMACIÓN DEL TICKET")
-            print(f"{'='*80}\n")
-            print(f"  Número: {ticket.ticket_number}")
-            print(f"  Asunto: {ticket.subject}")
-            print(f"  Estado: {ticket.status}")
-            print(f"  Prioridad: {ticket.priority}")
-            print(f"  ID: {ticket.id}")
-            print(f"  Tenant ID: {ticket.tenant_id}")
-            if creator:
-                print(f"  Creado por: {creator.email} ({creator.role})")
-            if assigned:
-                print(f"  Asignado a: {assigned.email} ({assigned.role})")
-            print(f"  Creado: {ticket.created_at}")
-            print(f"  Actualizado: {ticket.updated_at}")
-            print(f"\n{'='*80}")
-    
-    async def close(self):
-        """Cerrar conexión"""
-        await self.engine.dispose()
-
-
-async def main():
-    parser = argparse.ArgumentParser(
-        description='Utilidades de gestión de base de datos',
-        formatter_class=argparse.RawDescriptionHelpFormatter,
-        epilog=__doc__
-    )
-    
-    subparsers = parser.add_subparsers(dest='command', help='Comando a ejecutar')
-    
-    # list-users
-    list_users_parser = subparsers.add_parser('list-users', help='Listar usuarios')
-    list_users_parser.add_argument('--tenant-id', help='Filtrar por tenant ID')
-    
-    # check-user
-    check_user_parser = subparsers.add_parser('check-user', help='Verificar usuario')
-    check_user_parser.add_argument('email', help='Email del usuario')
-    
-    # reset-password
-    reset_password_parser = subparsers.add_parser('reset-password', help='Resetear contraseña')
-    reset_password_parser.add_argument('email', help='Email del usuario')
-    reset_password_parser.add_argument('--password', default='admin123', help='Nueva contraseña')
-    
-    # list-tickets
-    list_tickets_parser = subparsers.add_parser('list-tickets', help='Listar tickets')
-    list_tickets_parser.add_argument('--tenant-id', help='Filtrar por tenant ID')
-    list_tickets_parser.add_argument('--limit', type=int, default=20, help='Límite de resultados')
-    
-    # check-ticket
-    check_ticket_parser = subparsers.add_parser('check-ticket', help='Verificar ticket')
-    check_ticket_parser.add_argument('ticket_id', help='ID del ticket')
-    
-    args = parser.parse_args()
-    
-    if not args.command:
-        parser.print_help()
-        return
-    
-    utils = DBUtils()
-    
-    try:
-        if args.command == 'list-users':
-            await utils.list_users(args.tenant_id)
-        elif args.command == 'check-user':
-            await utils.check_user(args.email)
-        elif args.command == 'reset-password':
-            await utils.reset_password(args.email, args.password)
-        elif args.command == 'list-tickets':
-            await utils.list_tickets(args.tenant_id, args.limit)
-        elif args.command == 'check-ticket':
-            await utils.check_ticket(args.ticket_id)
-    finally:
-        await utils.close()
-
-
-if __name__ == "__main__":
-    asyncio.run(main())