mgonzalez/project.linkedcorp.net
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat: version 3.0.0 -- Correcciones de auditoria de seguridad, accesibilidad y redundancia

Browse Source 
Permisos (superadmin, viewer, busqueda, tareas recurrentes), bootstrap atomico,
revocacion de JWT por version de sesion (028), control optimista de edicion (029),
logo sin SVG + CSP, ingesta endurecida, correos escapados, borradores, paginacion
de proyectos, accesibilidad de dialogos/controles e i18n.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This commit is contained in:
Milton Gonzalez
2026-10-23 11:36:02 -05:00
parent 8ed1d63505
commit e65111a7f4
112 changed files with 2285 additions and 651 deletions
Download Patch File Download Diff File Expand all files Collapse all files
backend/src/modules/search/repository.js
+13 -10
View File
@@ -4,14 +4,17 @@ const RESULT_LIMIT = 20;
// Busqueda global (menu Proyectos): proyectos, actividades (con su proyecto) y tareas (con su
// actividad y proyecto) — para armar la migaja de pan "Proyecto - Actividad - Tarea" en el cliente.
export async function searchGlobal(term) {
export async function searchGlobal(term, user) {
const like = `%${term}%`;
const fullAccess = ['superadmin', 'admin', 'it_manager'].includes(user.roleCode);
const scope = fullAccess ? '' : ' AND EXISTS (SELECT 1 FROM project_members pm WHERE pm.project_id = p.id AND pm.user_id = ?)';
const scopeParams = fullAccess ? [] : [user.id];
const [projects] = await pool.query(
`SELECT id, code, name FROM projects
WHERE deleted_at IS NULL AND (code LIKE ? OR name LIKE ?)
`SELECT p.id, p.code, p.name FROM projects p
WHERE p.deleted_at IS NULL AND (p.code LIKE ? OR p.name LIKE ?)${scope}
ORDER BY name LIMIT ?`,
[like, like, RESULT_LIMIT]
[like, like, ...scopeParams, RESULT_LIMIT]
);
const [activities] = await pool.query(
@@ -19,9 +22,9 @@ export async function searchGlobal(term) {
p.id AS project_id, p.code AS project_code, p.name AS project_name
FROM activities a
JOIN projects p ON p.id = a.project_id
WHERE p.deleted_at IS NULL AND (a.code LIKE ? OR a.name LIKE ?)
WHERE p.deleted_at IS NULL AND a.deleted_at IS NULL AND (a.code LIKE ? OR a.name LIKE ?)${scope}
ORDER BY a.name LIMIT ?`,
[like, like, RESULT_LIMIT]
[like, like, ...scopeParams, RESULT_LIMIT]
);
const [tasks] = await pool.query(
@@ -31,9 +34,9 @@ export async function searchGlobal(term) {
FROM tasks t
JOIN activities a ON a.id = t.activity_id
JOIN projects p ON p.id = a.project_id
WHERE p.deleted_at IS NULL AND t.name LIKE ?
WHERE p.deleted_at IS NULL AND a.deleted_at IS NULL AND t.deleted_at IS NULL AND t.name LIKE ?${scope}
ORDER BY t.name LIMIT ?`,
[like, RESULT_LIMIT]
[like, ...scopeParams, RESULT_LIMIT]
);
return { projects, activities, tasks };
@@ -46,7 +49,7 @@ export async function searchInProject(projectId, term) {
const [activities] = await pool.query(
`SELECT id, code, name FROM activities
WHERE project_id = ? AND (code LIKE ? OR name LIKE ?)
WHERE project_id = ? AND deleted_at IS NULL AND (code LIKE ? OR name LIKE ?)
ORDER BY name LIMIT ?`,
[projectId, like, like, RESULT_LIMIT]
);
@@ -55,7 +58,7 @@ export async function searchInProject(projectId, term) {
`SELECT t.id, t.name, a.id AS activity_id, a.code AS activity_code, a.name AS activity_name
FROM tasks t
JOIN activities a ON a.id = t.activity_id
WHERE a.project_id = ? AND t.name LIKE ?
WHERE a.project_id = ? AND a.deleted_at IS NULL AND t.deleted_at IS NULL AND t.name LIKE ?
ORDER BY t.name LIMIT ?`,
[projectId, like, RESULT_LIMIT]
);