diff --git a/backend/app/routes/admin.py b/backend/app/routes/admin.py index eea708f..c0121f6 100644 --- a/backend/app/routes/admin.py +++ b/backend/app/routes/admin.py @@ -1454,8 +1454,11 @@ def global_settings(): }, 'auth_providers': { 'local': SystemSetting.get_value('auth_local_enabled', 'true') in ['true', 'True', '1', True], + 'local_enabled': SystemSetting.get_value('auth_local_enabled', 'true') in ['true', 'True', '1', True], 'google': SystemSetting.get_value('auth_google_enabled', 'false') in ['true', 'True', '1', True], - 'moodle': SystemSetting.get_value('auth_moodle_enabled', 'false') in ['true', 'True', '1', True] + 'google_enabled': SystemSetting.get_value('auth_google_enabled', 'false') in ['true', 'True', '1', True], + 'moodle': SystemSetting.get_value('auth_moodle_enabled', 'false') in ['true', 'True', '1', True], + 'moodle_enabled': SystemSetting.get_value('auth_moodle_enabled', 'false') in ['true', 'True', '1', True] }, 'google_oauth': { 'client_id': SystemSetting.get_value('google_client_id', ''), @@ -1555,3 +1558,61 @@ def toggle_demo_mode(): flash(_(msg_detail), 'success' if not target_state else 'info') return redirect(url_for('admin.global_settings')) + +@admin_bp.route('/settings/auth-providers', methods=['POST']) +@login_required +def update_auth_providers_web(): + """Actualiza los métodos de autenticación habilitados desde la interfaz de administración.""" + if not (current_user.is_admin() or (current_user.role and current_user.role.upper() == 'ADMIN')): + if request.is_json or request.headers.get('X-Requested-With') == 'XMLHttpRequest': + return jsonify({'status': 'error', 'message': 'Acción no autorizada'}), 403 + abort(403) + + from app.models.setting import SystemSetting + from app.models.audit_log import AuditLog + + data = request.get_json(silent=True) or request.form.to_dict() or {} + local_input = data.get('local_enabled') if 'local_enabled' in data else data.get('local', True) + google_input = data.get('google_enabled') if 'google_enabled' in data else data.get('google', False) + moodle_input = data.get('moodle_enabled') if 'moodle_enabled' in data else data.get('moodle', False) + + local_val = 'true' if local_input in [True, 'true', '1', 'on'] else 'false' + google_val = 'true' if google_input in [True, 'true', '1', 'on'] else 'false' + moodle_val = 'true' if moodle_input in [True, 'true', '1', 'on'] else 'false' + + SystemSetting.set_value('auth_local_enabled', local_val, 'Habilitar login nativo con usuario/contraseña', category='sso') + SystemSetting.set_value('auth_google_enabled', google_val, 'Habilitar login SSO con Google Workspace', category='sso') + SystemSetting.set_value('auth_moodle_enabled', moodle_val, 'Habilitar login delegado con Moodle', category='sso') + + try: + audit = AuditLog( + user_id=current_user.id, + user_email=current_user.email, + action='UPDATE_AUTH_PROVIDERS', + module='settings', + details=f"Métodos de login actualizados: Local={local_val}, Google={google_val}, Moodle={moodle_val}" + ) + db.session.add(audit) + db.session.commit() + except Exception: + pass + + resp_data = { + 'status': 'success', + 'message': 'Métodos de autenticación actualizados correctamente.', + 'auth_providers': { + 'local': local_val == 'true', + 'local_enabled': local_val == 'true', + 'google': google_val == 'true', + 'google_enabled': google_val == 'true', + 'moodle': moodle_val == 'true', + 'moodle_enabled': moodle_val == 'true' + } + } + + if request.is_json or request.headers.get('X-Requested-With') == 'XMLHttpRequest': + return jsonify(resp_data), 200 + + flash(_('Métodos de autenticación actualizados correctamente.'), 'success') + return redirect(url_for('admin.global_settings')) + diff --git a/backend/app/routes/api/admin.py b/backend/app/routes/api/admin.py index a90cca6..18a67b5 100644 --- a/backend/app/routes/api/admin.py +++ b/backend/app/routes/api/admin.py @@ -1746,8 +1746,11 @@ def get_all_settings(): } auth_providers = { + 'local': SystemSetting.get_value('auth_local_enabled', 'true') in ['true', 'True', '1', True], 'local_enabled': SystemSetting.get_value('auth_local_enabled', 'true') in ['true', 'True', '1', True], + 'google': SystemSetting.get_value('auth_google_enabled', 'false') in ['true', 'True', '1', True], 'google_enabled': SystemSetting.get_value('auth_google_enabled', 'false') in ['true', 'True', '1', True], + 'moodle': SystemSetting.get_value('auth_moodle_enabled', 'false') in ['true', 'True', '1', True], 'moodle_enabled': SystemSetting.get_value('auth_moodle_enabled', 'false') in ['true', 'True', '1', True] } @@ -1914,9 +1917,15 @@ def update_auth_providers(): return jsonify({'error': 'Forbidden', 'message': 'Solo administradores pueden modificar los métodos de autenticación.'}), 403 data = request.get_json(silent=True) or request.form.to_dict() or {} - local_val = 'true' if data.get('local_enabled', True) in [True, 'true', '1', 'on'] else 'false' - google_val = 'true' if data.get('google_enabled', False) in [True, 'true', '1', 'on'] else 'false' - moodle_val = 'true' if data.get('moodle_enabled', False) in [True, 'true', '1', 'on'] else 'false' + + # Soporte para claves tanto cortas (local) como largas (local_enabled) + local_input = data.get('local_enabled') if 'local_enabled' in data else data.get('local', True) + google_input = data.get('google_enabled') if 'google_enabled' in data else data.get('google', False) + moodle_input = data.get('moodle_enabled') if 'moodle_enabled' in data else data.get('moodle', False) + + local_val = 'true' if local_input in [True, 'true', '1', 'on'] else 'false' + google_val = 'true' if google_input in [True, 'true', '1', 'on'] else 'false' + moodle_val = 'true' if moodle_input in [True, 'true', '1', 'on'] else 'false' SystemSetting.set_value('auth_local_enabled', local_val, 'Habilitar login nativo con usuario/contraseña', category='sso') SystemSetting.set_value('auth_google_enabled', google_val, 'Habilitar login SSO con Google Workspace', category='sso') @@ -1937,7 +1946,15 @@ def update_auth_providers(): return jsonify({ 'status': 'success', - 'message': 'Métodos de autenticación actualizados correctamente.' + 'message': 'Métodos de autenticación actualizados correctamente.', + 'auth_providers': { + 'local': local_val == 'true', + 'local_enabled': local_val == 'true', + 'google': google_val == 'true', + 'google_enabled': google_val == 'true', + 'moodle': moodle_val == 'true', + 'moodle_enabled': moodle_val == 'true' + } }), 200 diff --git a/frontend/src/app.js b/frontend/src/app.js index 6ab0beb..bda26f6 100644 --- a/frontend/src/app.js +++ b/frontend/src/app.js @@ -218,6 +218,7 @@ app.use('/api/v1', async (req, res) => { const targetUrl = `${process.env.FLASK_API_URL || 'http://localhost:5000/api/v1'}${req.url}`; const headers = { ...req.headers }; delete headers.host; + delete headers['content-length']; if (token && !headers.authorization) { headers.authorization = `Bearer ${token}`; } diff --git a/frontend/src/routes/admin.js b/frontend/src/routes/admin.js index 5a5c41e..d5294a9 100644 --- a/frontend/src/routes/admin.js +++ b/frontend/src/routes/admin.js @@ -1321,6 +1321,43 @@ const handleGlobalSettings = async (req, res) => { console.warn('Global settings fetch notice:', e.message); } + // Normalización robusta de auth_providers para asegurar compatibilidad total con Nunjucks + if (settings && settings.auth_providers) { + const ap = settings.auth_providers; + const isLocal = ap.local !== undefined ? Boolean(ap.local) : (ap.local_enabled !== undefined ? Boolean(ap.local_enabled) : true); + const isGoogle = ap.google !== undefined ? Boolean(ap.google) : (ap.google_enabled !== undefined ? Boolean(ap.google_enabled) : false); + const isMoodle = ap.moodle !== undefined ? Boolean(ap.moodle) : (ap.moodle_enabled !== undefined ? Boolean(ap.moodle_enabled) : false); + settings.auth_providers = { + local: isLocal, + local_enabled: isLocal, + google: isGoogle, + google_enabled: isGoogle, + moodle: isMoodle, + moodle_enabled: isMoodle + }; + } else { + settings.auth_providers = { + local: true, + local_enabled: true, + google: false, + google_enabled: false, + moodle: false, + moodle_enabled: false + }; + } + + if (settings && settings.smtp) { + settings.smtp.password_masked = settings.smtp.password_masked || settings.smtp.password || ''; + settings.smtp.from_email = settings.smtp.from_email || settings.smtp.sender_email || ''; + settings.smtp.from_name = settings.smtp.from_name || settings.smtp.sender_name || 'Admin Edu-Space'; + } + if (settings && settings.google_oauth) { + settings.google_oauth.client_secret_masked = settings.google_oauth.client_secret_masked || settings.google_oauth.client_secret || ''; + } + if (settings && settings.moodle) { + settings.moodle.ws_token_masked = settings.moodle.ws_token_masked || settings.moodle.ws_token || ''; + } + try { const demoResp = await req.apiClient.get('/settings/demo-mode'); if (demoResp.data) { @@ -1359,6 +1396,37 @@ router.post('/settings/demo-mode', async (req, res) => { } }); +// Endpoint explícito para consultar y actualizar métodos de autenticación +router.get('/settings/auth-providers', async (req, res) => { + try { + const resp = await req.apiClient.get('/settings/all'); + const ap = resp.data?.settings?.auth_providers || resp.data?.data?.auth_providers || {}; + return res.json({ + status: 'success', + auth_providers: { + local: ap.local !== undefined ? Boolean(ap.local) : (ap.local_enabled !== undefined ? Boolean(ap.local_enabled) : true), + google: ap.google !== undefined ? Boolean(ap.google) : (ap.google_enabled !== undefined ? Boolean(ap.google_enabled) : false), + moodle: ap.moodle !== undefined ? Boolean(ap.moodle) : (ap.moodle_enabled !== undefined ? Boolean(ap.moodle_enabled) : false) + } + }); + } catch (err) { + return res.status(500).json({ status: 'error', message: err.message }); + } +}); + +router.post('/settings/auth-providers', async (req, res) => { + try { + const resp = await req.apiClient.post('/settings/auth-providers', req.body); + return res.status(resp.status || 200).json(resp.data); + } catch (err) { + console.error('Error in POST /admin/settings/auth-providers:', err.response?.data || err.message); + return res.status(err.response?.status || 500).json(err.response?.data || { + status: 'error', + message: 'Error al actualizar métodos de autenticación: ' + (err.response?.data?.message || err.message) + }); + } +}); + // Función forwarder para acciones de configuración hacia Flask const forwardSettingsAction = async (req, res) => { try { @@ -1381,7 +1449,6 @@ const forwardSettingsAction = async (req, res) => { router.post('/settings/smtp', forwardSettingsAction); router.post('/settings/smtp/test', forwardSettingsAction); -router.post('/settings/auth-providers', forwardSettingsAction); router.post('/settings/google-oauth', forwardSettingsAction); router.post('/settings/moodle', forwardSettingsAction); router.post('/settings/moodle/test', forwardSettingsAction); diff --git a/frontend/views/admin/settings/global_config.html b/frontend/views/admin/settings/global_config.html index eb41ca2..8bccba9 100644 --- a/frontend/views/admin/settings/global_config.html +++ b/frontend/views/admin/settings/global_config.html @@ -186,44 +186,90 @@
+ {% set is_local_active = (not settings or not settings.auth_providers or settings.auth_providers.local or settings.auth_providers.local_enabled) %} + {% set is_google_active = (settings and settings.auth_providers and (settings.auth_providers.google or settings.auth_providers.google_enabled)) %} + {% set is_moodle_active = (settings and settings.auth_providers and (settings.auth_providers.moodle or settings.auth_providers.moodle_enabled)) %}
-
- Métodos de Autenticación Habilitados -
+
+
+ Métodos de Autenticación Habilitados +
+ + Políticas de Acceso + +
-
-
-
Login Nativo con Contraseña
- Permite inicio de sesión local. Si se desactiva, queda reservado exclusivamente para rol ADMIN como contingencia. -
-
- + +
+
+
+ + Login Nativo con Contraseña +
+
+ + {% if is_local_active %}Habilitado{% else %}Desactivado{% endif %} + +
+ +
+
+ Permite inicio de sesión local para alumnos, docentes y bedelía. Si se desactiva, queda reservado exclusivamente para rol ADMIN como contingencia.
-
-
-
Google OAuth 2.0 (Google Workspace)
- Inicio de sesión con cuentas institucionales @unicaba.edu.ar mediante SSO. -
-
- + +
+
+
+ + Google OAuth 2.0 (Google Workspace) +
+
+ + {% if is_google_active %}Habilitado{% else %}Desactivado{% endif %} + +
+ +
+
+ Inicio de sesión con cuentas institucionales @unicaba.edu.ar mediante Single Sign-On (SSO).
-
-
-
Moodle SSO Delegado
- Valida credenciales contra el servidor de Moodle 4.1 y aprovisiona perfil. -
-
- + +
+
+
+ + Moodle SSO Delegado +
+
+ + {% if is_moodle_active %}Habilitado{% else %}Desactivado{% endif %} + +
+ +
+
+ Valida credenciales contra el servidor de Moodle 4.1 y auto-aprovisiona perfiles.
- + +
+ + Atención de Contingencia: Al apagar el Login Nativo, solo los usuarios con rol ADMIN podrán iniciar sesión con usuario y contraseña local. +
+ +
+ + +
@@ -569,6 +615,79 @@ async function runSmtpTest() { } } +// ------------------------------------------------------------- +// Reactividad Dinámica de Badges de Métodos de Autenticación +// ------------------------------------------------------------- +function updateProviderStatusBadges() { + const localCheck = document.getElementById('auth_local_enabled'); + const googleCheck = document.getElementById('auth_google_enabled'); + const moodleCheck = document.getElementById('auth_moodle_enabled'); + + const badgeLocal = document.getElementById('badgeLocalStatus'); + const badgeGoogle = document.getElementById('badgeGoogleStatus'); + const badgeMoodle = document.getElementById('badgeMoodleStatus'); + const alertLocal = document.getElementById('alertLocalDisabled'); + + if (localCheck && badgeLocal) { + if (localCheck.checked) { + badgeLocal.className = 'badge bg-success-subtle text-success border border-success-subtle'; + badgeLocal.textContent = 'Habilitado'; + if (alertLocal) alertLocal.classList.add('d-none'); + } else { + badgeLocal.className = 'badge bg-danger-subtle text-danger border border-danger-subtle'; + badgeLocal.textContent = 'Desactivado'; + if (alertLocal) alertLocal.classList.remove('d-none'); + } + } + + if (googleCheck && badgeGoogle) { + if (googleCheck.checked) { + badgeGoogle.className = 'badge bg-success-subtle text-success border border-success-subtle'; + badgeGoogle.textContent = 'Habilitado'; + } else { + badgeGoogle.className = 'badge bg-secondary-subtle text-secondary border border-secondary-subtle'; + badgeGoogle.textContent = 'Desactivado'; + } + } + + if (moodleCheck && badgeMoodle) { + if (moodleCheck.checked) { + badgeMoodle.className = 'badge bg-success-subtle text-success border border-success-subtle'; + badgeMoodle.textContent = 'Habilitado'; + } else { + badgeMoodle.className = 'badge bg-secondary-subtle text-secondary border border-secondary-subtle'; + badgeMoodle.textContent = 'Desactivado'; + } + } +} + +// ------------------------------------------------------------- +// Sincronización en Vivo de Métodos de Autenticación desde API +// ------------------------------------------------------------- +async function refreshAuthProvidersLive() { + try { + const res = await fetch('/admin/settings/auth-providers'); + if (res.ok) { + const data = await res.json(); + if (data && data.auth_providers) { + const ap = data.auth_providers; + const localCheck = document.getElementById('auth_local_enabled'); + const googleCheck = document.getElementById('auth_google_enabled'); + const moodleCheck = document.getElementById('auth_moodle_enabled'); + + if (localCheck && ap.local !== undefined) localCheck.checked = Boolean(ap.local); + if (googleCheck && ap.google !== undefined) googleCheck.checked = Boolean(ap.google); + if (moodleCheck && ap.moodle !== undefined) moodleCheck.checked = Boolean(ap.moodle); + + updateProviderStatusBadges(); + showAlert('Estados de métodos de autenticación sincronizados con el servidor.', 'info'); + } + } + } catch (e) { + console.warn('Error al sincronizar auth providers en vivo:', e.message); + } +} + // ------------------------------------------------------------- // Guardar Métodos de Autenticación // ------------------------------------------------------------- @@ -580,19 +699,42 @@ async function saveAuthProviders(e) { const payload = { local_enabled: document.getElementById('auth_local_enabled').checked, + local: document.getElementById('auth_local_enabled').checked, google_enabled: document.getElementById('auth_google_enabled').checked, - moodle_enabled: document.getElementById('auth_moodle_enabled').checked + google: document.getElementById('auth_google_enabled').checked, + moodle_enabled: document.getElementById('auth_moodle_enabled').checked, + moodle: document.getElementById('auth_moodle_enabled').checked }; try { - const res = await fetch('/api/v1/admin/settings/auth-providers', { + let res = await fetch('/admin/settings/auth-providers', { method: 'POST', - headers: { 'Content-Type': 'application/json' }, + headers: { + 'Content-Type': 'application/json', + 'X-Requested-With': 'XMLHttpRequest' + }, body: JSON.stringify(payload) }); + + if (!res.ok) { + // Reintento por endpoint API directo + res = await fetch('/api/v1/admin/settings/auth-providers', { + method: 'POST', + headers: { 'Content-Type': 'application/json' }, + body: JSON.stringify(payload) + }); + } + const data = await res.json(); if (res.ok) { - showAlert(data.message || 'Métodos de acceso actualizados.', 'success'); + if (data.auth_providers) { + const ap = data.auth_providers; + if (ap.local !== undefined) document.getElementById('auth_local_enabled').checked = Boolean(ap.local); + if (ap.google !== undefined) document.getElementById('auth_google_enabled').checked = Boolean(ap.google); + if (ap.moodle !== undefined) document.getElementById('auth_moodle_enabled').checked = Boolean(ap.moodle); + } + updateProviderStatusBadges(); + showAlert(data.message || 'Métodos de autenticación actualizados y guardados exitosamente.', 'success'); } else { showAlert(data.message || 'Error al actualizar métodos de acceso.', 'danger'); } @@ -600,10 +742,14 @@ async function saveAuthProviders(e) { showAlert('Error de comunicación: ' + err.message, 'danger'); } finally { btn.disabled = false; - btn.innerHTML = 'Actualizar Métodos de Login'; + btn.innerHTML = 'Guardar Métodos de Autenticación'; } } +document.addEventListener('DOMContentLoaded', () => { + updateProviderStatusBadges(); +}); + // ------------------------------------------------------------- // Alternar Modo Demo y Cuentas de Prueba Default // -------------------------------------------------------------