fix(auth): restringe workshop/mecanico solo por servidor y cookie

- Elimina el script inline que redirigia a todos los usuarios. - auth_bp.py: la respuesta de login ahora setea cookie pos_role. - app.py: before_request redirige a /pos/workshop solo cuando la cookie indica rol workshop/mechanic (no depende de JS cacheado). - login.js/login.min.js/app-init.js: sincronizan/limpian la cookie pos_role junto con el token en login y logout. Tests: 35 passed
2026-06-30 16:57:11 +00:00
parent 688ea8c70c
commit a37e60eb2a
22 changed files with 42 additions and 243 deletions
--- a/pos/templates/customers.html
+++ b/pos/templates/customers.html
@@ -15,20 +15,7 @@
  <meta name="theme-color" content="#F5A623" />
  <link rel="shortcut icon" type="image/png" href="/pos/static/pwa/icon-192.png" />

-  <link rel="stylesheet" href="/pos/static/css/customers.css">
-    <script id="workshop-mechanic-redirect">
-    (function(){
-      var t=localStorage.getItem("pos_token");
-      if(!t)return;
-      try{var p=JSON.parse(atob(t.split(".")[1]));var r=(p.role||"").toLowerCase();
-      if((r==="workshop"||r==="mechanic")&&window.location.pathname!=="/pos/workshop"){
-        if("serviceWorker" in navigator){navigator.serviceWorker.getRegistrations().then(function(rs){rs.forEach(function(reg){reg.unregister();});});}
-        window.location.replace("/pos/workshop");
-      }
-      }catch(e){}
-    })();
-  </script>
-</head>
+  <link rel="stylesheet" href="/pos/static/css/customers.css"></head>

 <body>