feat: version 4.3.0 -- Sesiones activas y pagina Mi cuenta

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

backend/src/middleware/auth.js

@@ -3,6 +3,7 @@ import { env } from '../config/env.js';
 import { pool } from '../config/db.js';
 import { fail } from '../utils/http.js';
 import { loadModules } from './modules.js';
+import { validateSession } from '../modules/auth/sessions-service.js';
 
 export async function requireAuth(req, res, next) {
   const header = req.headers.authorization || '';
@@ -18,21 +19,30 @@ export async function requireAuth(req, res, next) {
 
   // Revalidar en cada request que la cuenta siga activa (un JWT firmado no basta).
   const [rows] = await pool.query(
-    `SELECT u.id, u.name, u.email, u.is_active, u.session_version, u.department_id, r.code AS role_code
+    `SELECT u.id, u.name, u.email, u.is_active, u.session_version, u.department_id, d.name AS department_name, r.code AS role_code, r.name AS role_name
      FROM users u JOIN roles r ON r.id = u.role_id
+     LEFT JOIN departments d ON d.id = u.department_id
      WHERE u.id = ? LIMIT 1`,
     [payload.sub]
   );
   const user = rows[0];
-  if (!user || !user.is_active || payload.sv !== user.session_version) return fail(res, 401, 'Sesion invalida o revocada');
+  if (!user || !user.is_active || payload.sv !== user.session_version) return fail(res, 401, 'Sesion invalida o revocada', 'SESSION_REVOKED');
+  // Token emitido antes de las sesiones registradas (sin sid): se trata como vencido, no como cerrado.
+  if (!payload.sid) return fail(res, 401, 'Sesion vencida');
+  const session = await validateSession(payload.sid, user.id);
+  if (!session) return fail(res, 401, 'Sesion cerrada o vencida', 'SESSION_REVOKED');
 
   req.currentUser = {
     id: user.id,
     name: user.name,
     email: user.email,
     roleCode: user.role_code,
+    roleName: user.role_name,
     departmentId: user.department_id,
+    departmentName: user.department_name,
     modules: await loadModules(user.id, user.role_code),
+    sessionId: session.id,
+    sessionPublicId: payload.sid,
   };
   next();
 }