consultoria-as/Autoparts-DB
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix(auth): restringe workshop/mecanico solo por servidor y cookie
Some checks failed
CI / lint-and-test (3.11) (push) Has been cancelled
Details
CI / lint-and-test (3.13) (push) Has been cancelled
Details

Browse Source 
- Elimina el script inline que redirigia a todos los usuarios.
- auth_bp.py: la respuesta de login ahora setea cookie pos_role.
- app.py: before_request redirige a /pos/workshop solo cuando la cookie
  indica rol workshop/mechanic (no depende de JS cacheado).
- login.js/login.min.js/app-init.js: sincronizan/limpian la cookie pos_role
  junto con el token en login y logout.

Tests: 35 passed
This commit is contained in:
consultoria-as
2026-06-30 16:57:11 +00:00
parent 688ea8c70c
commit a37e60eb2a
22 changed files with 42 additions and 243 deletions
Download Patch File Download Diff File Expand all files Collapse all files

15
pos/templates/accounting.html
View File

@@ -15,20 +15,7 @@
<meta name="theme-color" content="#F5A623" />
<link rel="shortcut icon" type="image/png" href="/pos/static/pwa/icon-192.png" />
<link rel="stylesheet" href="/pos/static/css/accounting.css?v=33">
<script id="workshop-mechanic-redirect">
(function(){
var t=localStorage.getItem("pos_token");
if(!t)return;
try{var p=JSON.parse(atob(t.split(".")[1]));var r=(p.role||"").toLowerCase();
if((r==="workshop"||r==="mechanic")&&window.location.pathname!=="/pos/workshop"){
if("serviceWorker" in navigator){navigator.serviceWorker.getRegistrations().then(function(rs){rs.forEach(function(reg){reg.unregister();});});}
window.location.replace("/pos/workshop");
}
}catch(e){}
})();
</script>
</head>
<link rel="stylesheet" href="/pos/static/css/accounting.css?v=33"></head>
<body>

15
pos/templates/catalog.html
View File

@@ -17,20 +17,7 @@
<link rel="shortcut icon" type="image/png" href="/pos/static/pwa/icon-192.png" />
<script src="/pos/static/js/native-bridge.js" defer></script>
<link rel="stylesheet" href="/pos/static/css/catalog.css">
<script id="workshop-mechanic-redirect">
(function(){
var t=localStorage.getItem("pos_token");
if(!t)return;
try{var p=JSON.parse(atob(t.split(".")[1]));var r=(p.role||"").toLowerCase();
if((r==="workshop"||r==="mechanic")&&window.location.pathname!=="/pos/workshop"){
if("serviceWorker" in navigator){navigator.serviceWorker.getRegistrations().then(function(rs){rs.forEach(function(reg){reg.unregister();});});}
window.location.replace("/pos/workshop");
}
}catch(e){}
})();
</script>
</head>
<link rel="stylesheet" href="/pos/static/css/catalog.css"></head>
<body>

15
pos/templates/config.html
View File

@@ -15,20 +15,7 @@
<meta name="theme-color" content="#F5A623" />
<link rel="shortcut icon" type="image/png" href="/pos/static/pwa/icon-192.png" />
<link rel="stylesheet" href="/pos/static/css/config.css?v=33">
<script id="workshop-mechanic-redirect">
(function(){
var t=localStorage.getItem("pos_token");
if(!t)return;
try{var p=JSON.parse(atob(t.split(".")[1]));var r=(p.role||"").toLowerCase();
if((r==="workshop"||r==="mechanic")&&window.location.pathname!=="/pos/workshop"){
if("serviceWorker" in navigator){navigator.serviceWorker.getRegistrations().then(function(rs){rs.forEach(function(reg){reg.unregister();});});}
window.location.replace("/pos/workshop");
}
}catch(e){}
})();
</script>
</head>
<link rel="stylesheet" href="/pos/static/css/config.css?v=33"></head>
<body>

15
pos/templates/customers.html
View File

@@ -15,20 +15,7 @@
<meta name="theme-color" content="#F5A623" />
<link rel="shortcut icon" type="image/png" href="/pos/static/pwa/icon-192.png" />
<link rel="stylesheet" href="/pos/static/css/customers.css">
<script id="workshop-mechanic-redirect">
(function(){
var t=localStorage.getItem("pos_token");
if(!t)return;
try{var p=JSON.parse(atob(t.split(".")[1]));var r=(p.role||"").toLowerCase();
if((r==="workshop"||r==="mechanic")&&window.location.pathname!=="/pos/workshop"){
if("serviceWorker" in navigator){navigator.serviceWorker.getRegistrations().then(function(rs){rs.forEach(function(reg){reg.unregister();});});}
window.location.replace("/pos/workshop");
}
}catch(e){}
})();
</script>
</head>
<link rel="stylesheet" href="/pos/static/css/customers.css"></head>
<body>

15
pos/templates/dashboard.html
View File

@@ -15,20 +15,7 @@
<meta name="theme-color" content="#F5A623" />
<link rel="shortcut icon" type="image/png" href="/pos/static/pwa/icon-192.png" />
<link rel="stylesheet" href="/pos/static/css/dashboard.css?v=33">
<script id="workshop-mechanic-redirect">
(function(){
var t=localStorage.getItem("pos_token");
if(!t)return;
try{var p=JSON.parse(atob(t.split(".")[1]));var r=(p.role||"").toLowerCase();
if((r==="workshop"||r==="mechanic")&&window.location.pathname!=="/pos/workshop"){
if("serviceWorker" in navigator){navigator.serviceWorker.getRegistrations().then(function(rs){rs.forEach(function(reg){reg.unregister();});});}
window.location.replace("/pos/workshop");
}
}catch(e){}
})();
</script>
</head>
<link rel="stylesheet" href="/pos/static/css/dashboard.css?v=33"></head>
<body>

15
pos/templates/diagrams.html
View File

@@ -17,20 +17,7 @@
<link rel="shortcut icon" type="image/png" href="/pos/static/pwa/icon-192.png" />
<script src="/pos/static/js/native-bridge.js" defer></script>
<link rel="stylesheet" href="/pos/static/css/diagrams.css">
<script id="workshop-mechanic-redirect">
(function(){
var t=localStorage.getItem("pos_token");
if(!t)return;
try{var p=JSON.parse(atob(t.split(".")[1]));var r=(p.role||"").toLowerCase();
if((r==="workshop"||r==="mechanic")&&window.location.pathname!=="/pos/workshop"){
if("serviceWorker" in navigator){navigator.serviceWorker.getRegistrations().then(function(rs){rs.forEach(function(reg){reg.unregister();});});}
window.location.replace("/pos/workshop");
}
}catch(e){}
})();
</script>
</head>
<link rel="stylesheet" href="/pos/static/css/diagrams.css"></head>
<body>
<div class="app-shell">

15
pos/templates/fleet.html
View File

@@ -15,20 +15,7 @@
<meta name="theme-color" content="#F5A623" />
<link rel="shortcut icon" type="image/png" href="/pos/static/pwa/icon-192.png" />
<link rel="stylesheet" href="/pos/static/css/fleet.css">
<script id="workshop-mechanic-redirect">
(function(){
var t=localStorage.getItem("pos_token");
if(!t)return;
try{var p=JSON.parse(atob(t.split(".")[1]));var r=(p.role||"").toLowerCase();
if((r==="workshop"||r==="mechanic")&&window.location.pathname!=="/pos/workshop"){
if("serviceWorker" in navigator){navigator.serviceWorker.getRegistrations().then(function(rs){rs.forEach(function(reg){reg.unregister();});});}
window.location.replace("/pos/workshop");
}
}catch(e){}
})();
</script>
</head>
<link rel="stylesheet" href="/pos/static/css/fleet.css"></head>
<body>
<div class="page-shell">

15
pos/templates/historical_sales.html
View File

@@ -34,20 +34,7 @@
.pagination button:disabled { opacity: 0.5; cursor: not-allowed; }
.pagination span { font-size: 13px; color: #4b5563; }
.loading { text-align: center; padding: 40px; color: #6b7280; }
</style>
<script id="workshop-mechanic-redirect">
(function(){
var t=localStorage.getItem("pos_token");
if(!t)return;
try{var p=JSON.parse(atob(t.split(".")[1]));var r=(p.role||"").toLowerCase();
if((r==="workshop"||r==="mechanic")&&window.location.pathname!=="/pos/workshop"){
if("serviceWorker" in navigator){navigator.serviceWorker.getRegistrations().then(function(rs){rs.forEach(function(reg){reg.unregister();});});}
window.location.replace("/pos/workshop");
}
}catch(e){}
})();
</script>
</head>
</style></head>
<body>
<div class="header">
<h1>📊 Ventas Históricas - Atlas</h1>

15
pos/templates/inventory.html
View File

@@ -15,20 +15,7 @@
<meta name="theme-color" content="#F5A623" />
<link rel="shortcut icon" type="image/png" href="/pos/static/pwa/icon-192.png" />
<link rel="stylesheet" href="/pos/static/css/inventory.css?v=33">
<script id="workshop-mechanic-redirect">
(function(){
var t=localStorage.getItem("pos_token");
if(!t)return;
try{var p=JSON.parse(atob(t.split(".")[1]));var r=(p.role||"").toLowerCase();
if((r==="workshop"||r==="mechanic")&&window.location.pathname!=="/pos/workshop"){
if("serviceWorker" in navigator){navigator.serviceWorker.getRegistrations().then(function(rs){rs.forEach(function(reg){reg.unregister();});});}
window.location.replace("/pos/workshop");
}
}catch(e){}
})();
</script>
</head>
<link rel="stylesheet" href="/pos/static/css/inventory.css?v=33"></head>
<body>

15
pos/templates/invoicing.html
View File

@@ -15,20 +15,7 @@
<meta name="theme-color" content="#F5A623" />
<link rel="shortcut icon" type="image/png" href="/pos/static/pwa/icon-192.png" />
<link rel="stylesheet" href="/pos/static/css/invoicing.css">
<script id="workshop-mechanic-redirect">
(function(){
var t=localStorage.getItem("pos_token");
if(!t)return;
try{var p=JSON.parse(atob(t.split(".")[1]));var r=(p.role||"").toLowerCase();
if((r==="workshop"||r==="mechanic")&&window.location.pathname!=="/pos/workshop"){
if("serviceWorker" in navigator){navigator.serviceWorker.getRegistrations().then(function(rs){rs.forEach(function(reg){reg.unregister();});});}
window.location.replace("/pos/workshop");
}
}catch(e){}
})();
</script>
</head>
<link rel="stylesheet" href="/pos/static/css/invoicing.css"></head>
<body>

15
pos/templates/marketplace.html
View File

@@ -15,20 +15,7 @@
<meta name="theme-color" content="#F5A623" />
<link rel="shortcut icon" type="image/png" href="/pos/static/pwa/icon-192.png" />
<link rel="stylesheet" href="/pos/static/css/marketplace.css">
<script id="workshop-mechanic-redirect">
(function(){
var t=localStorage.getItem("pos_token");
if(!t)return;
try{var p=JSON.parse(atob(t.split(".")[1]));var r=(p.role||"").toLowerCase();
if((r==="workshop"||r==="mechanic")&&window.location.pathname!=="/pos/workshop"){
if("serviceWorker" in navigator){navigator.serviceWorker.getRegistrations().then(function(rs){rs.forEach(function(reg){reg.unregister();});});}
window.location.replace("/pos/workshop");
}
}catch(e){}
})();
</script>
</head>
<link rel="stylesheet" href="/pos/static/css/marketplace.css"></head>
<body>
<header class="page-header">

15
pos/templates/marketplace_external.html
View File

@@ -28,20 +28,7 @@
.meli-config-row { display:flex;gap:var(--space-4);flex-wrap:wrap;margin-bottom:var(--space-4); }
.meli-config-row label { display:block;font-size:var(--text-caption);color:var(--color-text-muted);margin-bottom:4px; }
.meli-config-row input, .meli-config-row select { padding:8px 12px;border:1px solid var(--color-border);border-radius:var(--radius-sm);background:var(--color-surface-0);color:var(--color-text-primary); }
</style>
<script id="workshop-mechanic-redirect">
(function(){
var t=localStorage.getItem("pos_token");
if(!t)return;
try{var p=JSON.parse(atob(t.split(".")[1]));var r=(p.role||"").toLowerCase();
if((r==="workshop"||r==="mechanic")&&window.location.pathname!=="/pos/workshop"){
if("serviceWorker" in navigator){navigator.serviceWorker.getRegistrations().then(function(rs){rs.forEach(function(reg){reg.unregister();});});}
window.location.replace("/pos/workshop");
}
}catch(e){}
})();
</script>
</head>
</style></head>
<body>

15
pos/templates/pos.html
View File

@@ -16,20 +16,7 @@
<link rel="shortcut icon" type="image/png" href="/pos/static/pwa/icon-192.png" />
<script src="/pos/static/js/native-bridge.js" defer></script>
<link rel="stylesheet" href="/pos/static/css/pos.css?v=33">
<script id="workshop-mechanic-redirect">
(function(){
var t=localStorage.getItem("pos_token");
if(!t)return;
try{var p=JSON.parse(atob(t.split(".")[1]));var r=(p.role||"").toLowerCase();
if((r==="workshop"||r==="mechanic")&&window.location.pathname!=="/pos/workshop"){
if("serviceWorker" in navigator){navigator.serviceWorker.getRegistrations().then(function(rs){rs.forEach(function(reg){reg.unregister();});});}
window.location.replace("/pos/workshop");
}
}catch(e){}
})();
</script>
</head>
<link rel="stylesheet" href="/pos/static/css/pos.css?v=33"></head>
<body class="pos-shell" id="appBody">

15
pos/templates/quotations.html
View File

@@ -11,20 +11,7 @@
<link rel="stylesheet" href="/pos/static/css/pos-ui.css?v=33" />
<link rel="stylesheet" href="/pos/static/css/sidebar.css" />
<link rel="stylesheet" href="/pos/static/css/pos-glass.css" />
<link rel="stylesheet" href="/pos/static/css/quotations.css">
<script id="workshop-mechanic-redirect">
(function(){
var t=localStorage.getItem("pos_token");
if(!t)return;
try{var p=JSON.parse(atob(t.split(".")[1]));var r=(p.role||"").toLowerCase();
if((r==="workshop"||r==="mechanic")&&window.location.pathname!=="/pos/workshop"){
if("serviceWorker" in navigator){navigator.serviceWorker.getRegistrations().then(function(rs){rs.forEach(function(reg){reg.unregister();});});}
window.location.replace("/pos/workshop");
}
}catch(e){}
})();
</script>
</head>
<link rel="stylesheet" href="/pos/static/css/quotations.css"></head>
<body>
<script src="/pos/static/js/pos-utils.js?v=33" defer></script>
<script src="/pos/static/js/i18n.js" defer></script>

15
pos/templates/reports.html
View File

@@ -15,20 +15,7 @@
<meta name="theme-color" content="#F5A623" />
<link rel="shortcut icon" type="image/png" href="/pos/static/pwa/icon-192.png" />
<link rel="stylesheet" href="/pos/static/css/reports.css">
<script id="workshop-mechanic-redirect">
(function(){
var t=localStorage.getItem("pos_token");
if(!t)return;
try{var p=JSON.parse(atob(t.split(".")[1]));var r=(p.role||"").toLowerCase();
if((r==="workshop"||r==="mechanic")&&window.location.pathname!=="/pos/workshop"){
if("serviceWorker" in navigator){navigator.serviceWorker.getRegistrations().then(function(rs){rs.forEach(function(reg){reg.unregister();});});}
window.location.replace("/pos/workshop");
}
}catch(e){}
})();
</script>
</head>
<link rel="stylesheet" href="/pos/static/css/reports.css"></head>
<body>

15
pos/templates/supplier_catalog.html
View File

@@ -49,20 +49,7 @@
.sc-interchange-list { display:flex; flex-wrap:wrap; gap:var(--space-2); }
.sc-interchange-chip { background:var(--color-surface-2); border:1px solid var(--color-border); border-radius:var(--radius-full); padding:2px 10px; font-size:var(--text-caption); }
.sc-close { background:none; border:none; font-size:20px; color:var(--color-text-muted); cursor:pointer; }
</style>
<script id="workshop-mechanic-redirect">
(function(){
var t=localStorage.getItem("pos_token");
if(!t)return;
try{var p=JSON.parse(atob(t.split(".")[1]));var r=(p.role||"").toLowerCase();
if((r==="workshop"||r==="mechanic")&&window.location.pathname!=="/pos/workshop"){
if("serviceWorker" in navigator){navigator.serviceWorker.getRegistrations().then(function(rs){rs.forEach(function(reg){reg.unregister();});});}
window.location.replace("/pos/workshop");
}
}catch(e){}
})();
</script>
</head>
</style></head>
<body>
<!-- Theme bar -->

15
pos/templates/whatsapp.html
View File

@@ -18,20 +18,7 @@
<meta name="theme-color" content="#F5A623" />
<link rel="shortcut icon" type="image/png" href="/pos/static/pwa/icon-192.png" />
<link rel="stylesheet" href="/pos/static/css/whatsapp.css">
<script id="workshop-mechanic-redirect">
(function(){
var t=localStorage.getItem("pos_token");
if(!t)return;
try{var p=JSON.parse(atob(t.split(".")[1]));var r=(p.role||"").toLowerCase();
if((r==="workshop"||r==="mechanic")&&window.location.pathname!=="/pos/workshop"){
if("serviceWorker" in navigator){navigator.serviceWorker.getRegistrations().then(function(rs){rs.forEach(function(reg){reg.unregister();});});}
window.location.replace("/pos/workshop");
}
}catch(e){}
})();
</script>
</head>
<link rel="stylesheet" href="/pos/static/css/whatsapp.css"></head>
<body>
<div class="page-shell">