GeorgeandClaude Sonnet 5
ab3c613165
Base para el flujo de ramas por cliente. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
109 lines
2.9 KiB
Markdown
109 lines
2.9 KiB
Markdown
# Flujo de Autenticación
|
|
|
|
## Login
|
|
|
|
```mermaid
|
|
sequenceDiagram
|
|
participant F as Frontend
|
|
participant API as FastAPI
|
|
participant S as core/session.py
|
|
participant SAP_C as core/sap.py
|
|
participant SAP as SAP Service Layer
|
|
|
|
F->>API: POST /api/Login\n{Username, Password}
|
|
Note over F,API: Username = emp_id\nPassword = LastName
|
|
|
|
API->>SAP_C: forward_to_sapb1(GET, "EmployeesInfo({empId})")
|
|
SAP_C->>SAP: GET /b1s/v1/EmployeesInfo({empId})
|
|
SAP-->>SAP_C: {FirstName, LastName, ...}
|
|
SAP_C-->>API: Employee data
|
|
|
|
API->>API: ¿Password == LastName?
|
|
alt Coincide
|
|
API->>S: create_employee_session(emp_id, first_name, last_name)
|
|
S->>S: Genera token_urlsafe(32)
|
|
S-->>API: token
|
|
|
|
API->>SAP_C: ensure_sap_session()
|
|
SAP_C->>SAP: POST /Login (manager creds)
|
|
SAP-->>SAP_C: B1SESSION cookie
|
|
SAP_C-->>API: OK
|
|
|
|
API-->>F: 200 {message, token, username}
|
|
else No coincide
|
|
API-->>F: 401 Invalid credentials
|
|
end
|
|
```
|
|
|
|
## Logout
|
|
|
|
```mermaid
|
|
sequenceDiagram
|
|
participant F as Frontend
|
|
participant API as FastAPI
|
|
participant S as core/session.py
|
|
|
|
F->>API: POST /api/Logout\nX-Session-Token: <token>
|
|
API->>S: remove_employee_session_by_token(token)
|
|
S->>S: Elimina active_tokens[token]\ny employee_sessions[emp_id]
|
|
S-->>API: OK
|
|
API-->>F: 200 {message: "Sesión cerrada"}
|
|
```
|
|
|
|
## Validación de Sesión (Middleware)
|
|
|
|
Cada petición a `/api/*` (excepto `/api/Login`) pasa por el `session_middleware`:
|
|
|
|
```mermaid
|
|
sequenceDiagram
|
|
participant F as Frontend
|
|
participant MW as session_middleware
|
|
participant S as core/session.py
|
|
participant R as Router
|
|
|
|
F->>MW: Request /api/Items\nX-Session-Token: <token>
|
|
|
|
MW->>S: validate_and_refresh_session(token)
|
|
S->>S: Busca token en active_tokens
|
|
|
|
alt Token válido
|
|
S->>S: Actualiza last_activity
|
|
S-->>MW: emp_id
|
|
MW->>MW: Adjunta emp_id a request.state
|
|
MW->>R: Continúa al router
|
|
R-->>F: 200 Response
|
|
else Token expirado (>30 min)
|
|
S->>S: Elimina token y sesión
|
|
S-->>MW: None
|
|
MW-->>F: 401 Token expirado
|
|
else Token no existe
|
|
S-->>MW: None
|
|
MW-->>F: 401 No autorizado
|
|
end
|
|
```
|
|
|
|
## Ciclo de Vida de la Sesión de Empleado
|
|
|
|
```mermaid
|
|
stateDiagram-v2
|
|
[*] --> Activa: Login exitoso\ngenera token
|
|
Activa --> Expirada: 30 min sin actividad
|
|
Activa --> Cerrada: Logout explícito
|
|
Expirada --> [*]
|
|
Cerrada --> [*]
|
|
|
|
note right of Activa
|
|
Se refresca last_activity
|
|
en cada petición válida
|
|
end note
|
|
```
|
|
|
|
## Mecanismo de Renovación
|
|
|
|
La sesión del empleado se renueva automáticamente en **cada petición válida**:
|
|
|
|
1. El frontend envía `X-Session-Token` en el header
|
|
2. `validate_and_refresh_session()` actualiza `last_activity` al timestamp actual
|
|
3. El timeout de 30 minutos se mide desde la última actividad
|
|
4. Si pasan 30 min sin peticiones, el token se invalida automáticamente
|