From b84b2f37a2494f253782decd4ed6f28d0fc20370 Mon Sep 17 00:00:00 2001
From: Carlos Narro <carlos@relabtive.com>
Date: Sat, 30 May 2026 20:02:02 +0200
Subject: [PATCH] =?UTF-8?q?Fijar=20trial=20a=2014=20d=C3=ADas=20en=20alta?=
 =?UTF-8?q?=20de=20tenant=20y=20reforzar=20filtro=20por=20tenant=20en=20es?=
 =?UTF-8?q?crituras?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 mvp/b2c/src/app/panel/actions.ts  |  7 +++++--
 mvp/b2c/src/app/signup/actions.ts | 12 +-----------
 mvp/b2c/src/db/auth-queries.ts    |  5 +++--
 3 files changed, 9 insertions(+), 15 deletions(-)

diff --git a/mvp/b2c/src/app/panel/actions.ts b/mvp/b2c/src/app/panel/actions.ts
index 9ca1346..b320385 100644
--- a/mvp/b2c/src/app/panel/actions.ts
+++ b/mvp/b2c/src/app/panel/actions.ts
@@ -45,7 +45,10 @@ export async function marcarGanado(leadId: string, precioFinalEuros: number) {
   const finalCents = Math.round(precioFinalEuros * 100);
   const deltaPct = ((finalCents - lead.presupuestoEstimado) / lead.presupuestoEstimado) * 100;
 
-  await db.update(leads).set({ estado: 'ganado', updatedAt: new Date() }).where(eq(leads.id, leadId));
+  await db
+    .update(leads)
+    .set({ estado: 'ganado', updatedAt: new Date() })
+    .where(and(eq(leads.id, leadId), eq(leads.tenantId, tenantId)));
   await db.insert(leadEstadoHistory).values({ leadId, estado: 'ganado' });
   await db.insert(precisionHistory).values({
     leadId,
@@ -88,7 +91,7 @@ export async function recalcularPresupuesto(leadId: string) {
       desgloseSnapshot: { stage: lead.pipelineStage, result },
       updatedAt: new Date(),
     })
-    .where(eq(leads.id, leadId));
+    .where(and(eq(leads.id, leadId), eq(leads.tenantId, tenantId)));
 
   await db.insert(leadPipelineEventos).values({
     leadId,
diff --git a/mvp/b2c/src/app/signup/actions.ts b/mvp/b2c/src/app/signup/actions.ts
index def78d2..fe1a3c2 100644
--- a/mvp/b2c/src/app/signup/actions.ts
+++ b/mvp/b2c/src/app/signup/actions.ts
@@ -1,16 +1,11 @@
 'use server';
 
 import { redirect } from 'next/navigation';
-import { eq } from 'drizzle-orm';
-import { db } from '@/db';
-import { tenants } from '@/db/schema';
 import { signupSchema, slugify } from '@/lib/validation/signup';
 import { getUserByEmail, createTenantWithOwner, slugDisponible } from '@/db/auth-queries';
 import { hashPassword } from '@/lib/auth/password';
 import { createSession } from '@/lib/auth/session';
 
-const TRIAL_MS = 14 * 24 * 60 * 60 * 1000;
-
 export async function signup(_prev: string | null, formData: FormData): Promise<string | null> {
   const parsed = signupSchema.safeParse(Object.fromEntries(formData));
   if (!parsed.success) return parsed.error.issues[0]?.message ?? 'Datos no válidos.';
@@ -23,7 +18,7 @@ export async function signup(_prev: string | null, formData: FormData): Promise<
   while (!(await slugDisponible(slug))) slug = `${slugify(data.empresa)}-${++n}`;
 
   const passwordHash = await hashPassword(data.password);
-  const { tenant, user } = await createTenantWithOwner({
+  const { user } = await createTenantWithOwner({
     nombreEmpresa: data.empresa,
     slug,
     provincia: data.provincia,
@@ -32,11 +27,6 @@ export async function signup(_prev: string | null, formData: FormData): Promise<
     nombre: data.nombre,
   });
 
-  await db
-    .update(tenants)
-    .set({ trialEndsAt: new Date(Date.now() + TRIAL_MS) })
-    .where(eq(tenants.id, tenant.id));
-
   await createSession(user.id);
   redirect('/panel');
 }
diff --git a/mvp/b2c/src/db/auth-queries.ts b/mvp/b2c/src/db/auth-queries.ts
index fb60eee..3afd43d 100644
--- a/mvp/b2c/src/db/auth-queries.ts
+++ b/mvp/b2c/src/db/auth-queries.ts
@@ -1,7 +1,8 @@
 import { eq } from 'drizzle-orm';
 import { db } from './index';
 import { users, tenants } from './schema';
-import { sessionExpiry } from '@/lib/auth/tokens';
+
+const TRIAL_MS = 14 * 24 * 60 * 60 * 1000;
 
 export async function getUserByEmail(email: string) {
   const [row] = await db.select().from(users).where(eq(users.email, email)).limit(1);
@@ -28,7 +29,7 @@ export async function createTenantWithOwner(input: {
       nombreEmpresa: input.nombreEmpresa,
       provincia: input.provincia,
       subscriptionStatus: 'trial',
-      trialEndsAt: sessionExpiry(new Date()),
+      trialEndsAt: new Date(Date.now() + TRIAL_MS),
     })
     .returning();