feat: implementar pestaña de Gestion de Cuentas y autenticacion global RADIUS con JIT provisioning

backend/app/api/auth.py

@@ -13,27 +13,62 @@ router = APIRouter(prefix="/auth", tags=["Authentication"])
 import logging
 logger = logging.getLogger("uvicorn.error")
 
+from app.core.radius import authenticate_radius
+from app.services.settings_service import get_setting
+
 @router.post("/login", response_model=TokenResponse)
 async def login(credentials: LoginRequest, db: AsyncSession = Depends(get_db)):
     email_clean = credentials.email.strip().lower()
     
-    result = await db.execute(select(User).where(User.email == email_clean))
-    user = result.scalar_one_or_none()
+    auth_mode = await get_setting(db, "auth_mode")
+    radius_host = await get_setting(db, "radius_host")
+    radius_port = await get_setting(db, "radius_port")
+    radius_secret = await get_setting(db, "radius_secret")
     
-    if not user:
-        logger.warning(f"Login failed: User not found with email '{email_clean}'")
+    is_authenticated = False
+    user = None
+    
+    # 1. RADIUS Authentication Path (except for default admin fallback)
+    if auth_mode == "radius" and email_clean != "admin@oneverdrive.local":
+        username_radius = email_clean.split("@")[0] if "@" in email_clean else email_clean
+        try:
+            port_num = int(radius_port) if radius_port else 1812
+        except ValueError:
+            port_num = 1812
+            
+        radius_ok = authenticate_radius(username_radius, credentials.password, radius_host, radius_secret, port=port_num)
+        if radius_ok:
+            result = await db.execute(select(User).where(User.email == email_clean))
+            user = result.scalar_one_or_none()
+            if not user:
+                # Auto-provision (JIT) RADIUS User
+                user = User(
+                    email=email_clean,
+                    hashed_password=get_password_hash(credentials.password),
+                    full_name=username_radius.capitalize(),
+                    role="OPERATOR",
+                    auth_source="radius",
+                    is_active=True
+                )
+                db.add(user)
+                await db.commit()
+                await db.refresh(user)
+            is_authenticated = True
+    else:
+        # 2. Local Authentication Path (or Admin local login fallback)
+        result = await db.execute(select(User).where(User.email == email_clean))
+        user = result.scalar_one_or_none()
+        if user:
+            if verify_password(credentials.password, user.hashed_password):
+                is_authenticated = True
+                
+    if not is_authenticated:
+        logger.warning(f"Login failed: Invalid credentials for '{email_clean}'")
         raise HTTPException(
             status_code=status.HTTP_401_UNAUTHORIZED,
             detail="Incorrect email or password"
         )
         
-    if not verify_password(credentials.password, user.hashed_password):
-        logger.warning(f"Login failed: Password mismatch for email '{email_clean}' (sent password length: {len(credentials.password)})")
-        raise HTTPException(
-            status_code=status.HTTP_401_UNAUTHORIZED,
-            detail="Incorrect email or password"
-        )
-    
     if not user.is_active:
         raise HTTPException(
             status_code=status.HTTP_403_FORBIDDEN,
@@ -57,7 +92,8 @@ async def login(credentials: LoginRequest, db: AsyncSession = Depends(get_db)):
             "id": user.id,
             "email": user.email,
             "full_name": user.full_name,
-            "role": user.role
+            "role": user.role,
+            "auth_source": user.auth_source
         }
     }
 

backend/app/api/users.py

@@ -0,0 +1,130 @@
+from fastapi import APIRouter, Depends, HTTPException, status
+from sqlalchemy.ext.asyncio import AsyncSession
+from sqlalchemy import select
+from typing import List
+
+from app.core.database import get_db
+from app.core.security import get_password_hash
+from app.models.models import User
+from app.schemas.schemas import UserResponse, UserCreate, UserUpdate
+from app.api.deps import get_current_user, require_admin
+
+router = APIRouter(prefix="/users", tags=["Users Management"], dependencies=[Depends(require_admin)])
+
+@router.get("", response_model=List[UserResponse])
+async def list_users(db: AsyncSession = Depends(get_db)):
+    """Lists all user accounts in the database."""
+    result = await db.execute(select(User).order_by(User.id.asc()))
+    users = result.scalars().all()
+    return users
+
+@router.post("", response_model=UserResponse)
+async def create_user(payload: UserCreate, db: AsyncSession = Depends(get_db)):
+    """Creates a new user account (Local or RADIUS)."""
+    # Check if email already registered
+    email_clean = payload.email.strip().lower()
+    result = await db.execute(select(User).where(User.email == email_clean))
+    existing = result.scalar_one_or_none()
+    if existing:
+        raise HTTPException(
+            status_code=status.HTTP_400_BAD_REQUEST,
+            detail="Email address is already registered."
+        )
+
+    user = User(
+        email=email_clean,
+        hashed_password=get_password_hash(payload.password),
+        full_name=payload.full_name,
+        role=payload.role,
+        auth_source=payload.auth_source,
+        is_active=payload.is_active
+    )
+    db.add(user)
+    await db.commit()
+    await db.refresh(user)
+    return user
+
+@router.put("/{user_id}", response_model=UserResponse)
+async def update_user(user_id: int, payload: UserUpdate, db: AsyncSession = Depends(get_db)):
+    """Updates an existing user account."""
+    result = await db.execute(select(User).where(User.id == user_id))
+    user = result.scalar_one_or_none()
+    if not user:
+        raise HTTPException(
+            status_code=status.HTTP_404_NOT_FOUND,
+            detail="User not found."
+        )
+
+    # Prevent changing email of default admin
+    if user.email == "admin@oneverdrive.local" and payload.email and payload.email.strip().lower() != user.email:
+        raise HTTPException(
+            status_code=status.HTTP_400_BAD_REQUEST,
+            detail="Email address of the default system administrator cannot be changed."
+        )
+
+    if payload.email is not None:
+        email_clean = payload.email.strip().lower()
+        if email_clean != user.email:
+            existing_res = await db.execute(select(User).where(User.email == email_clean))
+            if existing_res.scalar_one_or_none():
+                raise HTTPException(
+                    status_code=status.HTTP_400_BAD_REQUEST,
+                    detail="Target email address is already in use."
+                )
+            user.email = email_clean
+
+    if payload.password is not None and payload.password != "":
+        user.hashed_password = get_password_hash(payload.password)
+
+    if payload.full_name is not None:
+        user.full_name = payload.full_name
+
+    if payload.role is not None:
+        # Prevent demoting the main admin
+        if user.email == "admin@oneverdrive.local" and payload.role != "ADMIN":
+            raise HTTPException(
+                status_code=status.HTTP_400_BAD_REQUEST,
+                detail="Default system administrator role cannot be demoted."
+            )
+        user.role = payload.role
+
+    if payload.is_active is not None:
+        # Prevent deactivating the main admin
+        if user.email == "admin@oneverdrive.local" and not payload.is_active:
+            raise HTTPException(
+                status_code=status.HTTP_400_BAD_REQUEST,
+                detail="Default system administrator account cannot be deactivated."
+            )
+        user.is_active = payload.is_active
+
+    db.add(user)
+    await db.commit()
+    await db.refresh(user)
+    return user
+
+@router.delete("/{user_id}")
+async def delete_user(user_id: int, db: AsyncSession = Depends(get_db), current_user: User = Depends(get_current_user)):
+    """Deletes a user account from the system."""
+    if user_id == current_user.id:
+        raise HTTPException(
+            status_code=status.HTTP_400_BAD_REQUEST,
+            detail="You cannot delete your own account."
+        )
+
+    result = await db.execute(select(User).where(User.id == user_id))
+    user = result.scalar_one_or_none()
+    if not user:
+        raise HTTPException(
+            status_code=status.HTTP_404_NOT_FOUND,
+            detail="User not found."
+        )
+
+    if user.email == "admin@oneverdrive.local":
+        raise HTTPException(
+            status_code=status.HTTP_400_BAD_REQUEST,
+            detail="The default system administrator account cannot be deleted."
+        )
+
+    await db.delete(user)
+    await db.commit()
+    return {"message": f"User account '{user.email}' deleted successfully."}

backend/app/core/radius.py

@@ -0,0 +1,112 @@
+import socket
+import hashlib
+import os
+import logging
+
+logger = logging.getLogger("uvicorn.error")
+
+def authenticate_radius(username: str, password: str, server: str, secret: str, port: int = 1812, timeout: float = 3.0) -> bool:
+    """
+    Performs RADIUS Access-Request authentication natively using raw UDP sockets.
+    Conforms to RFC 2865 standard for RADIUS protocol and PAP password encryption.
+    """
+    if not server or not secret:
+        logger.error("RADIUS authentication failed: Server host or Shared Secret is not configured.")
+        return False
+
+    try:
+        secret_bytes = secret.encode('utf-8')
+        
+        # Access-Request Header fields:
+        # Code: 1 (Access-Request)
+        # Identifier: 1 byte (random/sequential)
+        # Length: 2 bytes (20 + attributes length)
+        # Authenticator: 16 bytes (cryptographically strong random value)
+        identifier = os.urandom(1)[0]
+        authenticator = os.urandom(16)
+        
+        # Attribute 1: User-Name (Type 1)
+        user_bytes = username.encode('utf-8')
+        attr_username = bytes([1, len(user_bytes) + 2]) + user_bytes
+        
+        # Attribute 2: User-Password (Type 2, PAP Encryption)
+        # 1. Pad password with null bytes (\x00) to a multiple of 16 bytes
+        password_bytes = password.encode('utf-8')
+        pad_len = 16 - (len(password_bytes) % 16)
+        if pad_len == 16 and len(password_bytes) > 0:
+            pad_len = 0
+        if pad_len > 0:
+            password_bytes += b'\x00' * pad_len
+            
+        # 2. Encrypt password chunks
+        # b(1) = MD5(Secret + Request Authenticator)
+        # c(1) = p(1) XOR b(1)
+        # b(2) = MD5(Secret + c(1))
+        # c(2) = p(2) XOR b(2)
+        # and so on...
+        encrypted_password = b''
+        last_chunk = authenticator
+        for i in range(0, len(password_bytes), 16):
+            chunk = password_bytes[i:i+16]
+            md5_hash = hashlib.md5(secret_bytes + last_chunk).digest()
+            encrypted_chunk = bytes(a ^ b for a, b in zip(chunk, md5_hash))
+            encrypted_password += encrypted_chunk
+            last_chunk = encrypted_chunk
+            
+        attr_password = bytes([2, len(encrypted_password) + 2]) + encrypted_password
+        
+        # Combine attributes
+        attributes = attr_username + attr_password
+        packet_len = 20 + len(attributes)
+        
+        # Assemble complete packet
+        header = bytes([1, identifier, (packet_len >> 8) & 0xff, packet_len & 0xff]) + authenticator
+        packet = header + attributes
+        
+        # UDP Send/Receive
+        sock = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
+        sock.settimeout(timeout)
+        
+        logger.info(f"Sending RADIUS Access-Request to {server}:{port} for user '{username}'...")
+        sock.sendto(packet, (server, port))
+        
+        response, _ = sock.recvfrom(4096)
+        if len(response) < 20:
+            logger.warning("RADIUS response packet is too short.")
+            return False
+            
+        resp_code = response[0]
+        resp_identifier = response[1]
+        resp_length = (response[2] << 8) + response[3]
+        resp_authenticator = response[4:20]
+        
+        # Validate Identifier match
+        if resp_identifier != identifier:
+            logger.warning(f"RADIUS response identifier mismatch (sent {identifier}, received {resp_identifier}).")
+            return False
+
+        # Validate Response Authenticator:
+        # Response Authenticator = MD5(Code + ID + Length + Request Authenticator + Attributes + Secret)
+        resp_attributes = response[20:resp_length]
+        calc_auth = hashlib.md5(response[0:4] + authenticator + resp_attributes + secret_bytes).digest()
+        
+        if calc_auth != resp_authenticator:
+            logger.warning("RADIUS response authenticator signature validation failed (spoofing check).")
+            return False
+            
+        if resp_code == 2:
+            logger.info(f"RADIUS Access-Accept received for user '{username}'. Authentication successful!")
+            return True
+        elif resp_code == 3:
+            logger.warning(f"RADIUS Access-Reject received for user '{username}'.")
+            return False
+        else:
+            logger.warning(f"RADIUS server returned unknown response code: {resp_code}")
+            return False
+            
+    except socket.timeout:
+        logger.error(f"RADIUS authentication timed out (server {server}:{port} unreachable).")
+        return False
+    except Exception as e:
+        logger.error(f"RADIUS authentication system exception: {e}")
+        return False

backend/app/main.py

@@ -15,6 +15,7 @@ from app.api.backups import router as backups_router
 from app.api.events import router as events_router
 from app.api.stats import router as stats_router
 from app.api.settings import router as settings_router
+from app.api.users import router as users_router
 from app.ws.manager import ws_manager
 
 @asynccontextmanager
@@ -85,6 +86,7 @@ app.include_router(backups_router, prefix=settings.API_V1_PREFIX)
 app.include_router(events_router, prefix=settings.API_V1_PREFIX)
 app.include_router(stats_router, prefix=settings.API_V1_PREFIX)
 app.include_router(settings_router, prefix=settings.API_V1_PREFIX)
+app.include_router(users_router, prefix=settings.API_V1_PREFIX)
 
 @app.websocket("/ws/telemetry")
 async def websocket_telemetry(websocket: WebSocket):

backend/app/models/models.py

@@ -19,6 +19,7 @@ class User(Base):
     full_name = Column(String(255), nullable=True)
     role = Column(String(50), default="ADMIN", nullable=False)  # ADMIN, OPERATOR, VIEWER
     is_active = Column(Boolean, default=True, nullable=False)
+    auth_source = Column(String(50), default="local", nullable=False)  # local, radius
     created_at = Column(DateTime(timezone=True), default=utc_now, nullable=False)
 
 class Client(Base):

backend/app/schemas/schemas.py

@@ -18,10 +18,26 @@ class UserResponse(BaseModel):
     full_name: Optional[str]
     role: str
     is_active: bool
+    auth_source: str
     created_at: datetime
 
     model_config = {"from_attributes": True}
 
+class UserCreate(BaseModel):
+    email: str
+    password: str
+    full_name: Optional[str] = None
+    role: str = "OPERATOR"
+    is_active: bool = True
+    auth_source: str = "local"
+
+class UserUpdate(BaseModel):
+    email: Optional[str] = None
+    password: Optional[str] = None
+    full_name: Optional[str] = None
+    role: Optional[str] = None
+    is_active: Optional[bool] = None
+
 # --- Client Schemas ---
 class RegistrationCodeCreate(BaseModel):
     client_name_hint: Optional[str] = None

backend/app/services/settings_service.py

@@ -12,6 +12,10 @@ DEFAULT_SETTINGS = {
     "default_keep_daily": str(settings.DEFAULT_RETENTION_DAILY),
     "default_keep_weekly": str(settings.DEFAULT_RETENTION_WEEKLY),
     "default_keep_monthly": str(settings.DEFAULT_RETENTION_MONTHLY),
+    "auth_mode": "local",
+    "radius_host": "",
+    "radius_port": "1812",
+    "radius_secret": "",
 }
 
 async def get_setting(db: AsyncSession, key: str) -> str:

backend/migrate_users_auth.py

@@ -0,0 +1,23 @@
+import sqlite3
+import os
+
+DB_PATH = os.path.join(os.path.dirname(__file__), "onever_drive.db")
+
+def migrate():
+    print(f"Connecting to database at {DB_PATH}...")
+    conn = sqlite3.connect(DB_PATH)
+    cursor = conn.cursor()
+
+    # Add auth_source column to users table
+    try:
+        cursor.execute("ALTER TABLE users ADD COLUMN auth_source VARCHAR(50) NOT NULL DEFAULT 'local'")
+        print("Column 'auth_source' added successfully to users.")
+    except sqlite3.OperationalError as e:
+        print(f"Column 'auth_source' could not be added (maybe it already exists?): {e}")
+
+    conn.commit()
+    conn.close()
+    print("Migration finished.")
+
+if __name__ == "__main__":
+    migrate()

frontend/src/App.tsx

@@ -8,6 +8,7 @@ import { RestoreView } from './pages/RestoreView';
 import { EventsView } from './pages/EventsView';
 import { LoginView } from './pages/LoginView';
 import { SettingsView } from './pages/SettingsView';
+import { UsersView } from './pages/UsersView';
 import { ActiveUpload } from './components/LiveTransferMeter';
 import { 
   api, 
@@ -152,6 +153,8 @@ export const App: React.FC = () => {
         return 'Explorador & Restore';
       case 'events':
         return 'Auditoría & Logs';
+      case 'users':
+        return 'Gestión de Cuentas';
       case 'settings':
         return 'Configuración Global';
       default:
@@ -214,6 +217,10 @@ export const App: React.FC = () => {
             />
           )}
 
+          {currentTab === 'users' && (
+            <UsersView />
+          )}
+
           {currentTab === 'settings' && (
             <SettingsView
               onRefresh={loadData}

frontend/src/components/Sidebar.tsx

@@ -7,7 +7,8 @@ import {
   FileText, 
   ShieldCheck, 
   Server,
-  Settings
+  Settings,
+  Users
 } from 'lucide-react';
 
 interface SidebarProps {
@@ -22,6 +23,7 @@ export const Sidebar: React.FC<SidebarProps> = ({ currentTab, setCurrentTab, isW
     { id: 'clients', label: 'Clientes Windows', icon: HardDrive },
     { id: 'jobs', label: 'Trabajos de Backup', icon: Layers },
     { id: 'restore', label: 'Explorador & Restore', icon: RotateCcw },
+    { id: 'users', label: 'Gestión de Cuentas', icon: Users },
     { id: 'events', label: 'Auditoría & Logs', icon: FileText },
     { id: 'settings', label: 'Configuración Global', icon: Settings },
   ];

frontend/src/pages/SettingsView.tsx

@@ -34,7 +34,11 @@ export const SettingsView: React.FC<SettingsViewProps> = ({ onRefresh }) => {
     default_client_quota_gb: 100,
     default_keep_daily: 7,
     default_keep_weekly: 4,
-    default_keep_monthly: 12
+    default_keep_monthly: 12,
+    auth_mode: 'local',
+    radius_host: '',
+    radius_port: 1812,
+    radius_secret: ''
   });
 
   const fetchSettings = async () => {
@@ -213,6 +217,66 @@ export const SettingsView: React.FC<SettingsViewProps> = ({ onRefresh }) => {
           </div>
         </div>
 
+        {/* Section 4: RADIUS Authentication Settings */}
+        <div className="glass-card" style={{ padding: '24px' }}>
+          <div style={{ display: 'flex', alignItems: 'center', gap: '10px', marginBottom: '16px' }}>
+            <ShieldCheck size={20} color="var(--accent-cyan)" />
+            <h4 style={{ fontSize: '1rem', fontWeight: 600 }}>4. Autenticación Global y RADIUS</h4>
+          </div>
+          <p style={{ fontSize: '0.8rem', color: 'var(--text-muted)', marginBottom: '16px', lineHeight: '1.4' }}>
+            Elige el mecanismo de autenticación del panel de control. Si seleccionas RADIUS, los usuarios externos podrán loguearse con sus credenciales corporativas (JIT auto-provisioning).
+          </p>
+          
+          <div className="form-group" style={{ marginBottom: '16px' }}>
+            <label>Método de Autenticación Principal:</label>
+            <select
+              className="form-input"
+              value={formData.auth_mode || 'local'}
+              onChange={(e) => setFormData({ ...formData, auth_mode: e.target.value })}
+            >
+              <option value="local">Local (Base de datos del Servidor)</option>
+              <option value="radius">RADIUS (Servidor Centralizado)</option>
+            </select>
+          </div>
+
+          {formData.auth_mode === 'radius' && (
+            <div style={{ display: 'grid', gridTemplateColumns: '2fr 1fr 2fr', gap: '16px', borderTop: '1px dashed rgba(255,255,255,0.08)', paddingTop: '16px' }}>
+              <div className="form-group" style={{ marginBottom: 0 }}>
+                <label>Servidor RADIUS (Host / IP):</label>
+                <input
+                  type="text"
+                  required
+                  className="form-input"
+                  placeholder="ej: 192.168.10.15"
+                  value={formData.radius_host || ''}
+                  onChange={(e) => setFormData({ ...formData, radius_host: e.target.value })}
+                />
+              </div>
+              <div className="form-group" style={{ marginBottom: 0 }}>
+                <label>Puerto RADIUS:</label>
+                <input
+                  type="number"
+                  required
+                  className="form-input"
+                  value={formData.radius_port || 1812}
+                  onChange={(e) => setFormData({ ...formData, radius_port: Number(e.target.value) })}
+                />
+              </div>
+              <div className="form-group" style={{ marginBottom: 0 }}>
+                <label>Secreto Compartido RADIUS:</label>
+                <input
+                  type="password"
+                  required
+                  className="form-input"
+                  placeholder="Secreto compartido"
+                  value={formData.radius_secret || ''}
+                  onChange={(e) => setFormData({ ...formData, radius_secret: e.target.value })}
+                />
+              </div>
+            </div>
+          )}
+        </div>
+
         {/* Form Actions */}
         <div style={{ display: 'flex', justifyContent: 'flex-end', marginTop: '10px' }}>
           <button type="submit" className="btn btn-primary" style={{ padding: '10px 24px' }} disabled={saving}>

frontend/src/pages/UsersView.tsx

@@ -0,0 +1,330 @@
+import React, { useState, useEffect } from 'react';
+import { 
+  UserPlus, 
+  Trash2, 
+  Edit2, 
+  X, 
+  Key, 
+  User, 
+  Check, 
+  AlertTriangle 
+} from 'lucide-react';
+import { api, UserItem } from '../services/api';
+
+export const UsersView: React.FC = () => {
+  const [users, setUsers] = useState<UserItem[]>([]);
+  const [loading, setLoading] = useState(false);
+  const [showModal, setShowModal] = useState(false);
+  const [editingUserId, setEditingUserId] = useState<number | null>(null);
+  
+  const [formData, setFormData] = useState({
+    email: '',
+    password: '',
+    full_name: '',
+    role: 'OPERATOR',
+    is_active: true,
+    auth_source: 'local'
+  });
+
+  const loadUsers = async () => {
+    setLoading(true);
+    try {
+      const data = await api.getUsers();
+      setUsers(data);
+    } catch (err: any) {
+      alert(`Error cargando usuarios: ${err.message}`);
+    } finally {
+      setLoading(false);
+    }
+  };
+
+  useEffect(() => {
+    loadUsers();
+  }, []);
+
+  const handleEditClick = (user: UserItem) => {
+    setEditingUserId(user.id);
+    setFormData({
+      email: user.email,
+      password: '', // Leave blank unless changing
+      full_name: user.full_name || '',
+      role: user.role,
+      is_active: user.is_active,
+      auth_source: user.auth_source
+    });
+    setShowModal(true);
+  };
+
+  const handleCreateClick = () => {
+    setEditingUserId(null);
+    setFormData({
+      email: '',
+      password: '',
+      full_name: '',
+      role: 'OPERATOR',
+      is_active: true,
+      auth_source: 'local'
+    });
+    setShowModal(true);
+  };
+
+  const handleSubmit = async (e: React.FormEvent) => {
+    e.preventDefault();
+    setLoading(true);
+    try {
+      if (editingUserId) {
+        // Edit User
+        const updateData: any = {
+          email: formData.email,
+          full_name: formData.full_name,
+          role: formData.role,
+          is_active: formData.is_active
+        };
+        if (formData.password && formData.password.trim() !== '') {
+          updateData.password = formData.password;
+        }
+        await api.updateUser(editingUserId, updateData);
+      } else {
+        // Create User
+        await api.createUser(formData);
+      }
+      setShowModal(false);
+      loadUsers();
+    } catch (err: any) {
+      alert(`Error al guardar el usuario: ${err.message}`);
+    } finally {
+      setLoading(false);
+    }
+  };
+
+  const handleDelete = async (user: UserItem) => {
+    if (user.email === 'admin@oneverdrive.local') {
+      alert('La cuenta del administrador del sistema no se puede eliminar.');
+      return;
+    }
+    
+    if (confirm(`¿Estás seguro de que deseas eliminar permanentemente al usuario '${user.email}'?`)) {
+      setLoading(true);
+      try {
+        await api.deleteUser(user.id);
+        loadUsers();
+      } catch (err: any) {
+        alert(`Error al eliminar usuario: ${err.message}`);
+      } finally {
+        setLoading(false);
+      }
+    }
+  };
+
+  return (
+    <div className="view-container">
+      <div style={{ display: 'flex', justifyContent: 'space-between', alignItems: 'center', marginBottom: '24px' }}>
+        <div>
+          <h2 style={{ fontSize: '1.4rem', fontWeight: 700, margin: 0 }}>Cuentas de Acceso</h2>
+          <span style={{ fontSize: '0.82rem', color: 'var(--text-dim)' }}>
+            Administración centralizada de usuarios del sistema local y RADIUS.
+          </span>
+        </div>
+        <button className="btn btn-primary" onClick={handleCreateClick}>
+          <UserPlus size={16} style={{ marginRight: '8px' }} />
+          Nuevo Usuario
+        </button>
+      </div>
+
+      {loading && users.length === 0 ? (
+        <div style={{ textAlign: 'center', padding: '40px', color: 'var(--text-dim)' }}>Cargando usuarios...</div>
+      ) : (
+        <div className="table-responsive">
+          <table className="table">
+            <thead>
+              <tr>
+                <th>Email / Nombre</th>
+                <th>Rol</th>
+                <th>Método de Autenticación</th>
+                <th>Estado</th>
+                <th>Fecha de Registro</th>
+                <th style={{ textAlign: 'right' }}>Acciones</th>
+              </tr>
+            </thead>
+            <tbody>
+              {users.map((user) => (
+                <tr key={user.id}>
+                  <td>
+                    <div style={{ display: 'flex', flexDirection: 'column' }}>
+                      <span style={{ fontWeight: 600, fontSize: '0.88rem' }}>{user.email}</span>
+                      <span style={{ fontSize: '0.78rem', color: 'var(--text-dim)' }}>
+                        {user.full_name || 'Sin nombre cargado'}
+                      </span>
+                    </div>
+                  </td>
+                  <td>
+                    <span className="badge" style={{ 
+                      backgroundColor: user.role === 'ADMIN' ? 'rgba(96, 165, 250, 0.15)' : 'rgba(167, 243, 208, 0.15)',
+                      color: user.role === 'ADMIN' ? '#60a5fa' : '#a7f3d0'
+                    }}>
+                      {user.role}
+                    </span>
+                  </td>
+                  <td>
+                    <span className="badge" style={{ 
+                      backgroundColor: user.auth_source === 'radius' ? 'rgba(251, 191, 36, 0.15)' : 'rgba(255, 255, 255, 0.06)',
+                      color: user.auth_source === 'radius' ? '#fbbf24' : 'var(--text-normal)'
+                    }}>
+                      {user.auth_source === 'radius' ? 'RADIUS Externo' : 'Base Local'}
+                    </span>
+                  </td>
+                  <td>
+                    <span className={`badge ${user.is_active ? 'badge-online' : 'badge-offline'}`}>
+                      {user.is_active ? 'Activo' : 'Inactivo'}
+                    </span>
+                  </td>
+                  <td>{new Date(user.created_at).toLocaleDateString()}</td>
+                  <td style={{ textAlign: 'right' }}>
+                    <div style={{ display: 'flex', justifyContent: 'flex-end', gap: '8px' }}>
+                      <button
+                        className="btn btn-secondary"
+                        style={{ padding: '6px 10px', fontSize: '0.78rem', color: 'var(--text-muted)' }}
+                        onClick={() => handleEditClick(user)}
+                        title="Editar parámetros"
+                      >
+                        <Edit2 size={13} />
+                      </button>
+                      <button
+                        className="btn btn-danger"
+                        style={{ padding: '6px 10px', fontSize: '0.78rem' }}
+                        onClick={() => handleDelete(user)}
+                        disabled={user.email === 'admin@oneverdrive.local'}
+                        title="Eliminar usuario"
+                      >
+                        <Trash2 size={13} />
+                      </button>
+                    </div>
+                  </td>
+                </tr>
+              ))}
+            </tbody>
+          </table>
+        </div>
+      )}
+
+      {/* Create / Edit User Modal */}
+      {showModal && (
+        <div className="modal-backdrop">
+          <div className="modal-content" style={{ maxWidth: '520px' }}>
+            <div className="modal-header">
+              <h4 style={{ fontSize: '1.1rem', fontWeight: 700 }}>
+                {editingUserId ? 'Editar Usuario' : 'Crear Nuevo Usuario'}
+              </h4>
+              <button className="modal-close" onClick={() => setShowModal(false)}>
+                <X size={18} />
+              </button>
+            </div>
+            
+            <form onSubmit={handleSubmit}>
+              <div className="modal-body" style={{ display: 'flex', flexDirection: 'column', gap: '16px', padding: '16px 0' }}>
+                <div className="form-group">
+                  <label>Correo Electrónico (Email):</label>
+                  <input
+                    type="email"
+                    required
+                    disabled={!!editingUserId}
+                    className="form-input"
+                    placeholder="ej: operador@empresa.local"
+                    value={formData.email}
+                    onChange={(e) => setFormData({ ...formData, email: e.target.value })}
+                  />
+                </div>
+
+                <div className="form-group">
+                  <label>Nombre Completo:</label>
+                  <input
+                    type="text"
+                    required
+                    className="form-input"
+                    placeholder="ej: Juan Pérez"
+                    value={formData.full_name}
+                    onChange={(e) => setFormData({ ...formData, full_name: e.target.value })}
+                  />
+                </div>
+
+                {!editingUserId && (
+                  <div className="form-group">
+                    <label>Método de Autenticación:</label>
+                    <select
+                      className="form-input"
+                      value={formData.auth_source}
+                      onChange={(e) => setFormData({ ...formData, auth_source: e.target.value })}
+                    >
+                      <option value="local">Local (Base de datos local)</option>
+                      <option value="radius">RADIUS (Autenticación centralizada)</option>
+                    </select>
+                  </div>
+                )}
+
+                {/* Show password field only for local users OR when creating a new user */}
+                {(formData.auth_source === 'local' || !editingUserId) && (
+                  <div className="form-group">
+                    <label>
+                      {editingUserId ? 'Nueva Contraseña (dejar vacío si no cambia):' : 'Contraseña de Acceso:'}
+                    </label>
+                    <input
+                      type="password"
+                      required={!editingUserId && formData.auth_source === 'local'}
+                      className="form-input"
+                      placeholder={editingUserId ? '••••••••' : 'Clave de seguridad'}
+                      value={formData.password}
+                      onChange={(e) => setFormData({ ...formData, password: e.target.value })}
+                    />
+                    {formData.auth_source === 'radius' && (
+                      <span style={{ fontSize: '0.74rem', color: 'var(--text-dim)', marginTop: '4px', display: 'flex', alignItems: 'center', gap: '4px' }}>
+                        <AlertTriangle size={12} color="#fbbf24" />
+                        Para RADIUS, la clave local sólo sirve de respaldo si RADIUS falla.
+                      </span>
+                    )}
+                  </div>
+                )}
+
+                <div style={{ display: 'grid', gridTemplateColumns: '1fr 1fr', gap: '16px' }}>
+                  <div className="form-group">
+                    <label>Rol de Usuario:</label>
+                    <select
+                      className="form-input"
+                      disabled={formData.email === 'admin@oneverdrive.local'}
+                      value={formData.role}
+                      onChange={(e) => setFormData({ ...formData, role: e.target.value })}
+                    >
+                      <option value="ADMIN">ADMINISTRADOR</option>
+                      <option value="OPERATOR">OPERADOR</option>
+                      <option value="VIEWER">AUDITOR (Solo Lectura)</option>
+                    </select>
+                  </div>
+                  <div className="form-group">
+                    <label>Estado de Cuenta:</label>
+                    <select
+                      className="form-input"
+                      disabled={formData.email === 'admin@oneverdrive.local'}
+                      value={formData.is_active ? 'active' : 'inactive'}
+                      onChange={(e) => setFormData({ ...formData, is_active: e.target.value === 'active' })}
+                    >
+                      <option value="active">ACTIVO</option>
+                      <option value="inactive">INACTIVO</option>
+                    </select>
+                  </div>
+                </div>
+              </div>
+
+              <div className="modal-footer" style={{ borderTop: '1px solid rgba(255,255,255,0.08)', paddingTop: '16px' }}>
+                <button type="button" className="btn btn-secondary" onClick={() => setShowModal(false)}>
+                  Cancelar
+                </button>
+                <button type="submit" className="btn btn-primary" disabled={loading}>
+                  {loading ? 'Guardando...' : editingUserId ? 'Actualizar Usuario' : 'Crear Usuario'}
+                </button>
+              </div>
+            </form>
+          </div>
+        </div>
+      )}
+    </div>
+  );
+};

frontend/src/services/api.ts

@@ -109,6 +109,20 @@ export interface SystemSettingsResponse {
   default_keep_daily: number;
   default_keep_weekly: number;
   default_keep_monthly: number;
+  auth_mode?: string;
+  radius_host?: string;
+  radius_port?: number;
+  radius_secret?: string;
+}
+
+export interface UserItem {
+  id: number;
+  email: string;
+  full_name?: string;
+  role: string;
+  is_active: boolean;
+  auth_source: string;
+  created_at: string;
 }
 
 export const getAuthToken = (): string | null => {
@@ -287,4 +301,32 @@ export const api = {
 
   // Events
   getEvents: (limit: number = 50) => request<EventLogItem[]>(`/events?limit=${limit}`),
+
+  // Users Management
+  getUsers: () => request<UserItem[]>('/users'),
+  createUser: (userData: {
+    email: string;
+    password?: string;
+    full_name?: string;
+    role: string;
+    is_active: boolean;
+    auth_source: string;
+  }) =>
+    request<UserItem>('/users', {
+      method: 'POST',
+      body: JSON.stringify(userData),
+    }),
+  updateUser: (userId: number, userData: Partial<{
+    email: string;
+    password?: string;
+    full_name?: string;
+    role: string;
+    is_active: boolean;
+  }>) =>
+    request<UserItem>(`/users/${userId}`, {
+      method: 'PUT',
+      body: JSON.stringify(userData),
+    }),
+  deleteUser: (userId: number) =>
+    request<{ message: string }>(`/users/${userId}`, { method: 'DELETE' }),
 };

tests/test_auth_radius.py

@@ -0,0 +1,140 @@
+import socket
+import threading
+import pytest
+from datetime import datetime, timezone
+import hashlib
+from app.core.radius import authenticate_radius
+from app.core.database import AsyncSessionLocal, init_db
+from app.models.models import User, SystemSetting
+from app.api.auth import login
+from app.schemas.schemas import LoginRequest
+from sqlalchemy import select
+
+class MockRadiusServer:
+    def __init__(self, host="127.0.0.1", port=18120, secret="my-secret"):
+        self.host = host
+        self.port = port
+        self.secret = secret
+        self.sock = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
+        self.sock.bind((self.host, self.port))
+        self.running = False
+        
+    def start(self):
+        self.running = True
+        self.thread = threading.Thread(target=self._run, daemon=True)
+        self.thread.start()
+        
+    def stop(self):
+        self.running = False
+        self.sock.close()
+        
+    def _run(self):
+        while self.running:
+            try:
+                data, addr = self.sock.recvfrom(4096)
+                if len(data) < 20:
+                    continue
+                code = data[0]
+                identifier = data[1]
+                length = (data[2] << 8) + data[3]
+                req_authenticator = data[4:20]
+                attributes = data[20:length]
+                
+                # Parse Attributes
+                idx = 0
+                username = ""
+                password = ""
+                while idx < len(attributes):
+                    attr_type = attributes[idx]
+                    attr_len = attributes[idx+1]
+                    attr_val = attributes[idx+2 : idx+attr_len]
+                    if attr_type == 1:
+                        username = attr_val.decode('utf-8')
+                    elif attr_type == 2:
+                        # Decrypt PAP password
+                        decrypted = b''
+                        last_chunk = req_authenticator
+                        secret_bytes = self.secret.encode('utf-8')
+                        for k in range(0, len(attr_val), 16):
+                            chunk = attr_val[k:k+16]
+                            md5_hash = hashlib.md5(secret_bytes + last_chunk).digest()
+                            dec_chunk = bytes(a ^ b for a, b in zip(chunk, md5_hash))
+                            decrypted += dec_chunk
+                            last_chunk = chunk
+                        password = decrypted.decode('utf-8').rstrip('\x00')
+                    idx += attr_len
+                
+                # Verify password. Let's make "radiuspass" the valid password
+                response_code = 3 # Access-Reject
+                if username == "radiususer" and password == "radiuspass":
+                    response_code = 2 # Access-Accept
+                    
+                # Build response packet
+                # Response Authenticator = MD5(Code + ID + Length + Request Authenticator + Attributes + Secret)
+                resp_length = 20
+                header = bytes([response_code, identifier, (resp_length >> 8) & 0xff, resp_length & 0xff])
+                resp_authenticator = hashlib.md5(header + req_authenticator + self.secret.encode('utf-8')).digest()
+                
+                response_packet = header[0:4] + resp_authenticator
+                self.sock.sendto(response_packet, addr)
+            except Exception:
+                break
+
+def test_radius_authentication_success_and_fail():
+    server = MockRadiusServer(secret="testing-secret")
+    server.start()
+    try:
+        # 1. Access-Accept
+        ok = authenticate_radius("radiususer", "radiuspass", "127.0.0.1", "testing-secret", port=18120, timeout=1.0)
+        assert ok is True
+        
+        # 2. Access-Reject (wrong password)
+        ok = authenticate_radius("radiususer", "wrongpass", "127.0.0.1", "testing-secret", port=18120, timeout=1.0)
+        assert ok is False
+
+        # 3. Access-Reject (wrong secret)
+        ok = authenticate_radius("radiususer", "radiuspass", "127.0.0.1", "bad-secret", port=18120, timeout=1.0)
+        assert ok is False
+    finally:
+        server.stop()
+
+@pytest.mark.asyncio
+async def test_radius_login_jit_provisioning():
+    """
+    Tests RADIUS login flow: JIT creation of a local User when RADIUS Access-Accept succeeds.
+    """
+    await init_db()
+    server = MockRadiusServer(secret="testing-secret")
+    server.start()
+    
+    try:
+        async with AsyncSessionLocal() as db:
+            # Configure global settings to RADIUS authentication
+            db.add(SystemSetting(key="auth_mode", value="radius"))
+            db.add(SystemSetting(key="radius_host", value="127.0.0.1"))
+            db.add(SystemSetting(key="radius_port", value="18120"))
+            db.add(SystemSetting(key="radius_secret", value="testing-secret"))
+            await db.commit()
+
+            # Execute API login for 'radiususer@oneverdrive.local' with 'radiuspass'
+            login_req = LoginRequest(email="radiususer@oneverdrive.local", password="radiuspass")
+            res = await login(credentials=login_req, db=db)
+            
+            assert res["access_token"] is not None
+            assert res["user"]["email"] == "radiususer@oneverdrive.local"
+            assert res["user"]["role"] == "OPERATOR"
+            assert res["user"]["auth_source"] == "radius"
+
+            # Check that user was saved to the SQLite DB
+            stmt = select(User).where(User.email == "radiususer@oneverdrive.local")
+            user_db = (await db.execute(stmt)).scalar_one_or_none()
+            assert user_db is not None
+            assert user_db.auth_source == "radius"
+            assert user_db.is_active is True
+            
+            # Revert global settings by deleting test configuration keys
+            from sqlalchemy import delete
+            await db.execute(delete(SystemSetting).where(SystemSetting.key.in_(["auth_mode", "radius_host", "radius_port", "radius_secret"])))
+            await db.commit()
+    finally:
+        server.stop()

windows-agent/agent/service.py

@@ -436,11 +436,24 @@ class AgentDaemon:
                         
                         if should_copy_local:
                             dest_path.parent.mkdir(parents=True, exist_ok=True)
-                            shutil.copy2(filepath, dest_path)
-                            logger.info(f"Successfully copied {filepath.name} to local dest {dest_path}")
-                            if not cloud_uploaded:
-                                files_copied += 1
-                                bytes_transferred += file_size_bytes
+                            # Robust write pattern inspired by Karen's Replicator 3.5.0
+                            temp_dest = dest_path.with_suffix(dest_path.suffix + ".tmp")
+                            try:
+                                shutil.copy2(filepath, temp_dest)
+                                if dest_path.exists():
+                                    dest_path.unlink()
+                                temp_dest.rename(dest_path)
+                                logger.info(f"Successfully copied {filepath.name} to local dest {dest_path}")
+                                if not cloud_uploaded:
+                                    files_copied += 1
+                                    bytes_transferred += file_size_bytes
+                            except Exception as copy_err:
+                                if temp_dest.exists():
+                                    try:
+                                        temp_dest.unlink()
+                                    except Exception:
+                                        pass
+                                raise copy_err
                     except Exception as ex:
                         logger.error(f"Failed to copy {filepath.name} to local path {dest_dir}: {str(ex)}")
                         errors_count += 1