primer commit

mini-backend/docs/auth-flow.md

@@ -11,17 +11,17 @@ sequenceDiagram
     participant SAP as SAP Service Layer
 
     F->>API: POST /api/Login\n{Username, Password}
-    Note over F,API: Username = emp_id\nPassword = LastName
+    Note over F,API: Username = webUser (U_WEB_USER)\nPassword = U_WEB_PASS
 
-    API->>SAP_C: forward_to_sapb1(GET, "EmployeesInfo({empId})")
-    SAP_C->>SAP: GET /b1s/v1/EmployeesInfo({empId})
-    SAP-->>SAP_C: {FirstName, LastName, ...}
-    SAP_C-->>API: Employee data
+    API->>SAP_C: forward_to_sapb1(GET, "EmployeesInfo")\n$filter=U_WEB_USER eq '{webUser}'
+    SAP_C->>SAP: GET /b1s/v1/EmployeesInfo?$filter=...
+    SAP-->>SAP_C: {EmployeeID, FirstName, LastName, Active, U_WEB_PASS, ...}
+    SAP_C-->>API: Employee data (o lista vacía)
 
-    API->>API: ¿Password == LastName?
-    alt Coincide
-        API->>S: create_employee_session(emp_id, first_name, last_name)
-        S->>S: Genera token_urlsafe(32)
+    API->>API: ¿Existe empleado?\n¿Active == "tYES"?\n¿U_WEB_PASS == Password?
+    alt Todo válido
+        API->>S: create_employee_session(webUser, empId, first_name, last_name)
+        S->>S: Genera token_urlsafe(32)\n(invalida token anterior del mismo webUser)
         S-->>API: token
 
         API->>SAP_C: ensure_sap_session()
@@ -29,9 +29,9 @@ sequenceDiagram
         SAP-->>SAP_C: B1SESSION cookie
         SAP_C-->>API: OK
 
-        API-->>F: 200 {message, token, username}
-    else No coincide
-        API-->>F: 401 Invalid credentials
+        API-->>F: 200 {message, token, username: FirstName, company: CompanyDB}
+    else No existe / inactivo / password no coincide
+        API-->>F: 401 (mensaje según el caso: "Usuario no registrado",\n"Usuario inactivo" o "Usuario o contraseña incorrectos")
     end
 ```
 
@@ -68,8 +68,8 @@ sequenceDiagram
 
     alt Token válido
         S->>S: Actualiza last_activity
-        S-->>MW: emp_id
-        MW->>MW: Adjunta emp_id a request.state
+        S-->>MW: webUser
+        MW->>MW: set_current_user(webUser, full_name, emp_id)\nrequest.state.webUser = webUser
         MW->>R: Continúa al router
         R-->>F: 200 Response
     else Token expirado (>30 min)