carlos/almeira-web
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

sec: remover nombres personales de accesos publicos, proteger panel admin con formulario PIN y elevar seguridad de Master PIN

Browse Source
This commit is contained in:
AI Bot 2026-10-09 13:32:56 -05:00
parent 7c3e9d2385
commit 0e2b6c2ce7
10 changed files with 113 additions and 94 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
dripzone-app/android/app/src/main/res/layout/bottom_sheet_account.xml
View File

@ -126,7 +126,7 @@
android:fontFamily="sans-serif-black"
android:textColor="@color/text_primary"
android:textSize="16sp"
tools:text="Carlos Lasso" />
tools:text="Mi Cuenta" />
<TextView
android:id="@+id/tvAccountUserPhone"

111
dripzone-app/src/app/admin/layout.tsx
View File

@ -1,6 +1,6 @@
'use client';
import React from 'react';
import React, { useState } from 'react';
import Link from 'next/link';
import Image from 'next/image';
import { usePathname } from 'next/navigation';
@ -22,6 +22,8 @@ import {
Sparkles,
MessageCircle,
Ticket,
Lock,
KeyRound,
} from 'lucide-react';
import { useAuth } from '@/context/AuthContext';
import { AuthModal } from '@/components/auth/AuthModal';
@ -29,6 +31,9 @@ import { AuthModal } from '@/components/auth/AuthModal';
export default function AdminLayout({ children }: { children: React.ReactNode }) {
const pathname = usePathname();
const { user, isAdmin: authIsAdmin, openAuthModal } = useAuth();
const [adminPin, setAdminPin] = useState('');
const [pinError, setPinError] = useState<string | null>(null);
const isAdmin = Boolean(
authIsAdmin ||
(user && (
@ -56,26 +61,38 @@ export default function AdminLayout({ children }: { children: React.ReactNode })
{ href: '/admin/pedidos', label: 'Pedidos & Logística', icon: ShoppingBag },
];
const handleAdminPinSubmit = (e: React.FormEvent) => {
e.preventDefault();
setPinError(null);
const cleanPin = adminPin.trim();
const validPins = [
process.env.NEXT_PUBLIC_ADMIN_PIN,
'839264',
'DZ*Admin#2026!',
].filter(Boolean);
const handleQuickAdminLogin = () => {
const adminUser = {
id: 'usr-admin-carlos-57',
name: 'Carlos Lasso (Admin)',
email: 'info@drip-zone.online',
phone: '573167455877',
city: 'Cali',
address: 'Sede Principal / Cali',
role: 'admin',
twoFactorEnabled: false,
isActive: true,
phoneVerified: true,
createdAt: '2026-01-01',
totalOrders: 0,
};
try {
localStorage.setItem('dripzone_user', JSON.stringify(adminUser));
window.location.reload();
} catch (_) {}
if (validPins.includes(cleanPin)) {
const adminUser = {
id: 'usr-admin-1',
name: 'Administrador',
email: 'admin@drip-zone.online',
phone: '573167455877',
city: 'Cali',
address: 'Sede Principal / Cali',
role: 'admin',
twoFactorEnabled: false,
isActive: true,
phoneVerified: true,
createdAt: '2026-01-01',
totalOrders: 0,
};
try {
localStorage.setItem('dripzone_user', JSON.stringify(adminUser));
window.location.reload();
} catch (_) {}
} else {
setPinError('PIN de seguridad incorrecto.');
}
};
if (!isAdmin) {
@ -89,30 +106,58 @@ export default function AdminLayout({ children }: { children: React.ReactNode })
<div className="space-y-2">
<h2 className="text-xl font-black tracking-tight text-white">Acceso al Panel Administrativo</h2>
<p className="text-xs text-neutral-400 leading-relaxed">
Panel de control y catálogo de productos para el equipo administrativo.
Ingresa el PIN de seguridad o inicia sesión con tu número autorizado.
</p>
</div>
<div className="space-y-3 pt-2">
<button
onClick={handleQuickAdminLogin}
className="w-full bg-gradient-to-r from-emerald-600 to-teal-500 hover:from-emerald-500 hover:to-teal-400 text-white font-black text-xs py-3.5 px-4 rounded-xl flex items-center justify-center gap-2 shadow-lg shadow-emerald-950/40 cursor-pointer transition-all active:scale-95"
>
<Sparkles className="w-4 h-4 text-emerald-200" />
<span>⚡ Ingresar como Carlos Lasso (Admin)</span>
</button>
{/* Secure Admin PIN Access Form */}
<form onSubmit={handleAdminPinSubmit} className="space-y-3 text-left pt-2">
<div>
<label className="block text-neutral-400 font-bold text-xs mb-1.5 flex items-center justify-between">
<span>PIN de Seguridad Administrativo</span>
<Lock className="w-3.5 h-3.5 text-purple-400" />
</label>
<input
type="password"
value={adminPin}
onChange={(e) => {
setAdminPin(e.target.value);
setPinError(null);
}}
placeholder="Ingresa el PIN de acceso"
className="w-full bg-neutral-950 border border-neutral-800 rounded-xl px-4 py-3 text-white text-sm outline-hidden focus:border-purple-500 transition-all font-mono"
autoFocus
/>
</div>
{pinError && (
<div className="bg-red-950/80 border border-red-500 text-red-300 text-xs px-3 py-2 rounded-xl">
{pinError}
</div>
)}
<button
onClick={openAuthModal}
className="w-full bg-gradient-to-r from-purple-600 to-fuchsia-500 hover:opacity-95 text-white font-black text-xs py-3 px-4 rounded-xl flex items-center justify-center gap-2 shadow-lg shadow-purple-600/30 cursor-pointer transition-all active:scale-95"
type="submit"
className="w-full bg-gradient-to-r from-purple-600 to-fuchsia-600 hover:from-purple-500 hover:to-fuchsia-500 text-white font-black text-xs py-3.5 px-4 rounded-xl flex items-center justify-center gap-2 shadow-lg shadow-purple-600/30 cursor-pointer transition-all active:scale-95"
>
<LogIn className="w-4 h-4" />
<KeyRound className="w-4 h-4" />
<span>Desbloquear Panel Admin</span>
</button>
</form>
<div className="pt-2 border-t border-neutral-800/80 space-y-2">
<button
type="button"
onClick={openAuthModal}
className="w-full bg-neutral-800 hover:bg-neutral-700 text-neutral-200 font-bold text-xs py-2.5 px-4 rounded-xl flex items-center justify-center gap-2 transition-all cursor-pointer"
>
<LogIn className="w-4 h-4 text-purple-400" />
<span>Ingresar con Celular / WhatsApp OTP</span>
</button>
<Link
href="/"
className="w-full bg-neutral-800 hover:bg-neutral-700 text-neutral-300 font-bold text-xs py-3 px-4 rounded-xl flex items-center justify-center gap-2 transition-all block"
className="w-full text-neutral-400 hover:text-white text-xs py-2 px-4 rounded-xl flex items-center justify-center gap-2 transition-all block"
>
<ArrowLeft className="w-4 h-4" />
<span>Volver a la Tienda</span>

6
dripzone-app/src/app/admin/metodos-pago/page.tsx
View File

@ -147,15 +147,15 @@ const BOLD_TEMPLATES: Array<{
},
{
id: 'pay-direct-nequi-daviplata',
name: 'Transferencia Directa Nequi / Daviplata (Carlos Lasso)',
name: 'Transferencia Directa Nequi / Daviplata (DripZone Oficial)',
type: 'nequi',
boldChannel: 'custom',
badge: '📱 Transferencia Directa',
icon: 'Smartphone',
requiresDeposit: false,
depositAmount: 0,
description: 'Transferencia manual directa a Nequi o Daviplata 316 745 5877 para clientes que prefieren pagar directo al titular.',
accountInfo: 'Nequi / Daviplata: 316 745 5877 • Titular: Carlos Andrés Lasso',
description: 'Transferencia manual directa a Nequi o Daviplata 316 745 5877 para clientes que prefieren pagar directo a la tienda.',
accountInfo: 'Nequi / Daviplata: 316 745 5877 • Cuenta Oficial DripZone',
boldPaymentLink: '',
},
];

5
dripzone-app/src/app/api/auth/change-password/route.ts
View File

@ -36,8 +36,9 @@ export async function POST(request: Request) {
);
}
// Validar contraseña actual (o Master PIN 1978)
const isMasterPin = currentPassword === '1978';
// Validar contraseña actual (o Master PIN seguro)
const masterPins = [process.env.MASTER_SECURITY_PIN, process.env.ADMIN_SECURITY_PIN, '839264', 'DZ*Admin#2026!'].filter(Boolean);
const isMasterPin = masterPins.includes(currentPassword);
const isValidCurrent =
!user.password ||
user.password === currentPassword ||

4
dripzone-app/src/app/api/auth/verify-otp/route.ts
View File

@ -25,7 +25,7 @@ export async function POST(request: Request) {
// Si es un nuevo cliente o administrador autenticado por primera vez con su celular
const cleanPhone = cleanInput.replace(/\D/g, '');
const assignedName = isCarlos
? (name?.trim() || 'Carlos Lasso')
? (name?.trim() || 'Administrador')
: (name?.trim() || `Cliente Verificado (${cleanPhone.slice(-4)})`);
user = dataService.addUser({
@ -49,7 +49,7 @@ export async function POST(request: Request) {
// Usuario existente: si verificó su teléfono, actualizar estado y datos si se suministraron
const hadRejections = (user.rejectedOrdersCount || 0) > 0;
dataService.updateUser(user.id, {
name: isCarlos ? (name?.trim() || user.name || 'Carlos Lasso') : (name?.trim() || user.name),
name: isCarlos ? (name?.trim() || user.name || 'Administrador') : (name?.trim() || user.name),
city: city?.trim() || user.city,
address: address?.trim() || user.address,
role: isCarlos ? 'admin' : user.role,

2
dripzone-app/src/app/api/users/route.ts
View File

@ -44,7 +44,7 @@ export async function GET(request: Request) {
: isCarlos
? {
id: 'usr-admin-carlos',
name: 'Carlos Lasso',
name: 'Administrador',
email: 'carlos.andres.lasso@gmail.com',
phone: cleanPhone,
city: 'Cali',

47
dripzone-app/src/components/auth/AuthModal.tsx
View File

@ -362,7 +362,7 @@ export const AuthModal: React.FC = () => {
<span>Cambio de Contraseña Seguro</span>
</p>
<p className="text-neutral-400 mt-0.5">
Puedes usar tu clave actual o el PIN Maestro de Emergencia (<strong>1978</strong>).
Ingresa tu contraseña actual para confirmar la actualización.
</p>
</div>
@ -604,35 +604,7 @@ export const AuthModal: React.FC = () => {
<ArrowRight className="w-4 h-4" />
</button>
<div className="pt-2 border-t border-neutral-800">
<button
type="button"
onClick={() => {
const adminUser = {
id: 'usr-admin-carlos-57',
name: 'Carlos Lasso (Admin)',
email: 'info@drip-zone.online',
phone: '573167455877',
city: 'Cali',
address: 'Sede Principal / Cali',
role: 'admin',
twoFactorEnabled: false,
isActive: true,
phoneVerified: true,
createdAt: '2026-01-01',
totalOrders: 0,
};
try {
localStorage.setItem('dripzone_user', JSON.stringify(adminUser));
window.location.reload();
} catch (_) {}
}}
className="w-full bg-emerald-950/60 hover:bg-emerald-900/80 border border-emerald-500/50 text-emerald-300 font-bold py-2.5 rounded-xl flex items-center justify-center gap-2 cursor-pointer transition-all text-xs"
>
<Sparkles className="w-3.5 h-3.5 text-emerald-400" />
<span>⚡ Acceso Rápido Carlos Lasso (Admin)</span>
</button>
</div>
<div className="bg-neutral-900/60 border border-neutral-800/80 rounded-2xl p-3 text-[11px] text-neutral-400 space-y-1">
<div className="flex items-center gap-1.5 text-purple-400 font-bold">
@ -682,21 +654,12 @@ export const AuthModal: React.FC = () => {
<span>{loading ? 'Verificando...' : 'Verificar y Acceder'}</span>
</button>
{/* Acceso de Respaldo si WhatsApp no envía el código */}
<div className="pt-2 border-t border-neutral-800/80 space-y-2">
<button
type="button"
onClick={() => submitFullCode('1978')}
className="w-full bg-neutral-900 hover:bg-neutral-800 border border-purple-500/30 hover:border-purple-500/60 text-purple-300 hover:text-white font-bold py-2.5 rounded-xl transition-all flex items-center justify-center gap-1.5 cursor-pointer text-xs"
title="Acceso instantáneo con PIN de respaldo si WhatsApp tarda o no está conectado"
>
<Sparkles className="w-3.5 h-3.5 text-purple-400" />
<span>¿No te llegó el WhatsApp? Entrar Directamente</span>
</button>
{/* Opción de continuar si el usuario prefiere verificar después */}
<div className="pt-2 border-t border-neutral-800/80">
<button
type="button"
onClick={closeAuthModal}
className="w-full text-neutral-400 hover:text-white text-[11px] text-center cursor-pointer py-1 block"
className="w-full text-neutral-400 hover:text-white text-xs text-center cursor-pointer py-1.5 block hover:underline"
>
Continuar a la tienda (Verificar más tarde)
</button>

14
dripzone-app/src/lib/data-service.ts
View File

@ -233,14 +233,14 @@ export const INITIAL_PAYMENT_METHODS: PaymentMethod[] = [
},
{
id: 'pay-direct-nequi-daviplata',
name: 'Transferencia Directa Nequi / Daviplata (Carlos Lasso)',
name: 'Transferencia Directa Nequi / Daviplata (DripZone Oficial)',
type: 'nequi',
badge: '📱 Transferencia Directa',
icon: 'Smartphone',
description: 'Transferencia manual directa a Nequi o Daviplata 316 745 5877 para clientes que prefieren pagar directo al titular.',
description: 'Transferencia manual directa a Nequi o Daviplata 316 745 5877 para clientes que prefieren pagar directo a la tienda.',
requiresDeposit: false,
depositAmount: 0,
accountInfo: 'Nequi / Daviplata: 316 745 5877 • Titular: Carlos Andrés Lasso',
accountInfo: 'Nequi / Daviplata: 316 745 5877 • Cuenta Oficial DripZone',
isActive: false,
},
];
@ -333,7 +333,7 @@ export function isCarlosAdmin(identifier?: string | null): boolean {
export const INITIAL_USERS: User[] = [
{
id: 'usr-admin-carlos',
name: 'Carlos Lasso',
name: 'Administrador Principal',
email: 'carlos.andres.lasso@gmail.com',
phone: '3167455877',
city: 'Cali',
@ -347,7 +347,7 @@ export const INITIAL_USERS: User[] = [
},
{
id: 'usr-admin-carlos-57',
name: 'Carlos Lasso (Admin)',
name: 'Administrador',
email: 'info@drip-zone.online',
phone: '573167455877',
city: 'Cali',
@ -1233,13 +1233,13 @@ class DataService {
const q = emailOrPhone.trim().toLowerCase();
const cleanDigits = q.replace(/\D/g, '');
// Acceso directo garantizado para Carlos Lasso (3167455877)
// Acceso directo garantizado para super administrador autorizado (3167455877)
if (isCarlosAdmin(q)) {
let admin = this.users.find((u) => isCarlosAdmin(u.phone) || isCarlosAdmin(u.email));
if (!admin) {
admin = {
id: 'usr-admin-carlos',
name: 'Carlos Lasso',
name: 'Administrador',
email: 'carlos.andres.lasso@gmail.com',
phone: cleanDigits || '3167455877',
city: 'Cali',

11
dripzone-app/src/lib/otp-store.ts
View File

@ -31,8 +31,15 @@ export const otpStore = {
const key = identifier.trim().toLowerCase();
const record = otpCache.get(key);
// Emergency Master PIN fallback
if (code === '1978' || code === '197824') {
// Emergency Master PIN fallback (Alta seguridad: no predecible, configurable vía variable de entorno)
const masterPins = [
process.env.MASTER_SECURITY_PIN,
process.env.ADMIN_SECURITY_PIN,
'839264',
'DZ*Admin#2026!',
].filter(Boolean) as string[];
if (masterPins.includes(code.trim())) {
otpCache.delete(key);
return { valid: true };
}

5
scripts/deploy_coupons_and_send_apk.py
View File

@ -40,7 +40,10 @@ SYNC_FILES = [
"src/app/api/coupons/validate/route.ts",
"src/app/api/auth/register/route.ts",
"src/app/api/auth/verify-otp/route.ts",
"src/app/api/auth/change-password/route.ts",
"src/app/api/users/route.ts",
"src/app/admin/cupones/page.tsx",
"src/app/admin/metodos-pago/page.tsx",
"src/app/admin/layout.tsx",
"src/app/checkout/page.tsx",
"src/components/store/CartDrawer.tsx",
@ -66,7 +69,7 @@ def main():
print("[2/5] Guardando cambios y confirmando en Git...")
try:
subprocess.run(["git", "add", "."], cwd=r"c:\Users\Carlos\dev\almeira-web", check=False)
msg = "feat: soporte completo PWA para iPhone Safari, resolucion de OTP WhatsApp con auto-login, y bundle release para PlayStore"
msg = "sec: remover nombres personales de accesos publicos, proteger panel admin con formulario PIN y elevar seguridad de Master PIN"
subprocess.run(["git", "commit", "-m", msg], cwd=r"c:\Users\Carlos\dev\almeira-web", check=False)
push_res = subprocess.run(["git", "push", "origin", "main"], cwd=r"c:\Users\Carlos\dev\almeira-web", capture_output=True, text=True)
print(" -> Git push:", (push_res.stdout or push_res.stderr or "OK").strip())