Upload folder using huggingface_hub

.bandit

@@ -0,0 +1,26 @@
+# Bandit Configuration for CrowData (YAML format)
+exclude_dirs:
+  - "app/pyafipws"
+  - "app/migrations"
+  - "tests"
+  - ".venv"
+  - "venv"
+
+skips:
+  - "B101"  # assert_used
+  - "B108"  # hardcoded_tmp_directory (vendored)
+  - "B301"  # pickle (vendored)
+  - "B303"  # md5/sha1 (vendored AFIP)
+  - "B310"  # urllib.urlopen (vendored)
+  - "B324"  # hashlib md5 (vendored AFIP)
+  - "B501"  # verify=False (scrapers - dev only)
+  - "B608"  # hardcoded_sql (vendored)
+  - "B701"  # jinja2_autoescape_false (email templates)
+
+severity_level: "medium"
+confidence_level: "medium"
+
+format: "json"
+output: "bandit-report.json"
+
+recursive: true

.dockerignore

@@ -0,0 +1,46 @@
+# Archivos sensibles - NUNCA subir
+.env
+*.key
+*.pem
+*.crt
+*.pfx
+
+# Base de datos local - no subir (usamos Supabase en producción)
+*.db
+*.sqlite
+*.sqlite3
+
+# Cache y archivos temporales
+__pycache__/
+*.pyc
+*.pyo
+*.pyd
+.Python
+*.egg-info/
+dist/
+build/
+.eggs/
+
+# Tests y herramientas de desarrollo
+tests/
+pytest.ini
+.coverage
+htmlcov/
+
+# Logs
+*.log
+logs/
+
+# IDE
+.vscode/
+.idea/
+*.swp
+
+# Node (por si hubiera algo de node aquí)
+node_modules/
+
+# Caché de Playwright local
+.playwright/
+
+# Cache AFIP local
+wsaa_cache.json

.env.example

@@ -0,0 +1,45 @@
+# CrowData Backend — Configuración
+# COPIAR a .env y completar los valores
+
+# Base de datos (SQLite para dev, PostgreSQL para prod)
+DATABASE_URL=sqlite+aiosqlite:///./crowdata.db
+# DATABASE_URL=postgresql+asyncpg://user:password@localhost:5432/crowdata
+
+# Redis
+REDIS_URL=redis://localhost:6379/0
+
+# Seguridad — GENERAR CON: python -c "import secrets; print(secrets.token_urlsafe(48))"
+SECRET_KEY=
+RESET_PASSWORD_TOKEN_SECRET=
+VERIFICATION_TOKEN_SECRET=
+
+# Entorno
+ENVIRONMENT=development
+ACCESS_TOKEN_EXPIRE_MINUTES=30
+CACHE_TTL_SECONDS=86400
+PLAYWRIGHT_HEADLESS=true
+
+# APIs externas
+GROQ_API_KEY=
+SEARCHAPI_KEY=
+SEARCHAPI_KEYS=[]
+AI_VERIFICATION_ENABLED=true
+
+# Email / SMTP
+SMTP_HOST=smtp.proton.me
+SMTP_PORT=587
+SMTP_USER=
+SMTP_PASSWORD=
+SMTP_USE_TLS=true
+FROM_EMAIL=
+FROM_NAME=CrowData
+
+# AFIP
+AFIP_CUIT_REPRESENTADA=
+
+# MercadoPago (producción)
+# MP_ACCESS_TOKEN=
+# MP_PUBLIC_KEY=
+
+# NopeCHA (reCAPTCHA solver)
+NOPECHA_API_KEY=

.gitattributes

@@ -33,3 +33,5 @@ saved_model/**/* filter=lfs diff=lfs merge=lfs -text
 *.zip filter=lfs diff=lfs merge=lfs -text
 *.zst filter=lfs diff=lfs merge=lfs -text
 *tfevents* filter=lfs diff=lfs merge=lfs -text
+app/cache/ddjj_pep.csv filter=lfs diff=lfs merge=lfs -text
+app/pyafipws/ejemplos/wsfe/delphi/Project1.exe filter=lfs diff=lfs merge=lfs -text

_routes.txt

@@ -0,0 +1 @@
+11

add_credits.py

@@ -0,0 +1,9 @@
+import sqlite3
+conn = sqlite3.connect('E:/crowdata/backend/crowdata.db')
+cursor = conn.cursor()
+cursor.execute('UPDATE users SET credits = 9999 WHERE email = "crowsistemas@proton.me"')
+conn.commit()
+print('Credits updated')
+cursor.execute('SELECT email, credits FROM users WHERE email = "crowsistemas@proton.me"')
+print(cursor.fetchall())
+conn.close()

add_credits_test.py

@@ -0,0 +1,9 @@
+import sqlite3
+conn = sqlite3.connect('E:/crowdata/backend/crowdata.db')
+cursor = conn.cursor()
+cursor.execute('UPDATE users SET credits = 9999 WHERE email = "test_final11@test.com"')
+conn.commit()
+print('Updated')
+cursor.execute('SELECT email, credits FROM users WHERE email = "test_final11@test.com"')
+print(cursor.fetchall())
+conn.close()

alembic.ini

@@ -0,0 +1,121 @@
+# A generic, single database configuration.
+
+[alembic]
+# path to migration scripts
+# Use forward slashes (/) also on windows to provide an os agnostic path
+script_location = alembic
+
+# template used to generate migration file names; The default value is %%(rev)s_%%(slug)s
+# Uncomment the line below if you want the files to be prepended with date and time
+# see https://alembic.sqlalchemy.org/en/latest/tutorial.html#editing-the-ini-file
+# for all available tokens
+# file_template = %%(year)d_%%(month).2d_%%(day).2d_%%(hour).2d%%(minute).2d-%%(rev)s_%%(slug)s
+
+# sys.path path, will be prepended to sys.path if present.
+# defaults to the current working directory.
+prepend_sys_path = .
+
+# timezone to use when rendering the date within the migration file
+# as well as the filename.
+# If specified, requires the python>=3.9 or backports.zoneinfo library.
+# Any required deps can installed by adding `alembic[tz]` to the pip requirements
+# string value is passed to ZoneInfo()
+# leave blank for localtime
+# timezone =
+
+# max length of characters to apply to the "slug" field
+# truncate_slug_length = 40
+
+# set to 'true' to run the environment during
+# the 'revision' command, regardless of autogenerate
+# revision_environment = false
+
+# set to 'true' to allow .pyc and .pyo files without
+# a source .py file to be detected as revisions in the
+# versions/ directory
+# sourceless = false
+
+# version location specification; This defaults
+# to alembic/versions.  When using multiple version
+# directories, initial revisions must be specified with --version-path.
+# The path separator used here should be the separator specified by "version_path_separator" below.
+# version_locations = %(here)s/bar:%(here)s/bat:alembic/versions
+
+# version path separator; As mentioned above, this is the character used to split
+# version_locations. The default within new alembic.ini files is "os", which uses os.pathsep.
+# If this key is omitted entirely, it falls back to the legacy behavior of splitting on spaces and/or commas.
+# Valid values for version_path_separator are:
+#
+# version_path_separator = :
+# version_path_separator = ;
+# version_path_separator = space
+# version_path_separator = newline
+version_path_separator = os  # Use os.pathsep. Default configuration used for new projects.
+
+# set to 'true' to search source files recursively
+# in each "version_locations" directory
+# new in Alembic version 1.10
+# recursive_version_locations = false
+
+# the output encoding used when revision files
+# are written from script.py.mako
+# output_encoding = utf-8
+
+# sqlalchemy.url = driver://user:pass@localhost/dbname
+
+# Use the same approach as the app: read from settings
+# The env.py will load the actual URL from app.config.get_settings()
+sqlalchemy.url = sqlite+aiosqlite:///./crowdata.db
+
+
+[post_write_hooks]
+# post_write_hooks defines scripts or Python functions that are run
+# on newly generated revision scripts.  See the documentation for further
+# detail and examples
+
+# format using "black" - use the console_scripts runner, against the "black" entrypoint
+# hooks = black
+# black.type = console_scripts
+# black.entrypoint = black
+# black.options = -l 79 REVISION_SCRIPT_FILENAME
+
+# lint with attempts to fix using "ruff" - use the exec runner, execute a binary
+# hooks = ruff
+# ruff.type = exec
+# ruff.executable = %(here)s/.venv/bin/ruff
+# ruff.options = --fix REVISION_SCRIPT_FILENAME
+
+# Logging configuration
+[loggers]
+keys = root,sqlalchemy,alembic
+
+[handlers]
+keys = console
+
+[formatters]
+keys = generic
+
+[logger_root]
+level = WARNING
+handlers = console
+qualname =
+
+[logger_sqlalchemy]
+level = WARNING
+handlers =
+qualname = sqlalchemy.engine
+
+[logger_alembic]
+level = INFO
+handlers =
+qualname = alembic
+
+[handler_console]
+class = StreamHandler
+args = (sys.stderr,)
+level = NOTSET
+formatter = generic
+
+[formatter_generic]
+format = %(levelname)-5.5s [%(name)s] %(message)s
+datefmt = %H:%M:%S

alembic/README

@@ -0,0 +1 @@
+Generic single-database configuration.

alembic/env.py

@@ -0,0 +1,69 @@
+# Alembic env.py - Migration environment configuration
+from logging.config import fileConfig
+from sqlalchemy import create_engine
+from alembic import context
+
+# Add app to path
+import sys
+import os
+sys.path.insert(0, os.path.dirname(os.path.dirname(__file__)))
+
+# Load app settings
+from app.config import get_settings
+from app.database import Base
+
+# Import all models so they register with Base.metadata
+from app.auth import models  # noqa: F401
+from app.reports import models as report_models  # noqa: F401
+
+# this is the Alembic Config object
+config = context.config
+
+# Interpret the config file for Python logging
+if config.config_file_name is not None:
+    fileConfig(config.config_file_name)
+
+# Set target metadata
+target_metadata = Base.metadata
+
+# Load database URL from app settings
+settings = get_settings()
+db_url = settings.database_url
+if db_url.startswith("sqlite+aiosqlite://"):
+    db_url = db_url.replace("sqlite+aiosqlite://", "sqlite://")
+elif db_url.startswith("postgresql+asyncpg://"):
+    db_url = db_url.replace("postgresql+asyncpg://", "postgresql://")
+config.set_main_option("sqlalchemy.url", db_url)
+
+
+def run_migrations_offline() -> None:
+    """Run migrations in 'offline' mode."""
+    url = config.get_main_option("sqlalchemy.url")
+    context.configure(
+        url=url,
+        target_metadata=target_metadata,
+        literal_binds=True,
+        dialect_opts={"paramstyle": "named"},
+    )
+
+    with context.begin_transaction():
+        context.run_migrations()
+
+
+def run_migrations_online() -> None:
+    """Run migrations in 'online' mode."""
+    connectable = create_engine(config.get_main_option("sqlalchemy.url"))
+
+    with connectable.connect() as connection:
+        context.configure(
+            connection=connection, target_metadata=target_metadata
+        )
+
+        with context.begin_transaction():
+            context.run_migrations()
+
+
+if context.is_offline_mode():
+    run_migrations_offline()
+else:
+    run_migrations_online()

alembic/script.py.mako

@@ -0,0 +1,26 @@
+"""${message}
+
+Revision ID: ${up_revision}
+Revises: ${down_revision | comma,n}
+Create Date: ${create_date}
+
+"""
+from typing import Sequence, Union
+
+from alembic import op
+import sqlalchemy as sa
+${imports if imports else ""}
+
+# revision identifiers, used by Alembic.
+revision: str = ${repr(up_revision)}
+down_revision: Union[str, None] = ${repr(down_revision)}
+branch_labels: Union[str, Sequence[str], None] = ${repr(branch_labels)}
+depends_on: Union[str, Sequence[str], None] = ${repr(depends_on)}
+
+
+def upgrade() -> None:
+    ${upgrades if upgrades else "pass"}
+
+
+def downgrade() -> None:
+    ${downgrades if downgrades else "pass"}

alembic/versions/f22e5d0e402f_initial_migration.py

@@ -0,0 +1,69 @@
+"""Initial migration
+
+Revision ID: f22e5d0e402f
+Revises: 
+Create Date: 2026-07-16 15:12:44.678088
+
+"""
+from typing import Sequence, Union
+
+from alembic import op
+import sqlalchemy as sa
+import fastapi_users_db_sqlalchemy
+
+
+# revision identifiers, used by Alembic.
+revision: str = 'f22e5d0e402f'
+down_revision: Union[str, None] = None
+branch_labels: Union[str, Sequence[str], None] = None
+depends_on: Union[str, Sequence[str], None] = None
+
+
+def upgrade() -> None:
+    # ### commands auto generated by Alembic - please adjust! ###
+    op.alter_column('login_history', 'user_id',
+               existing_type=sa.VARCHAR(length=36),
+               type_=fastapi_users_db_sqlalchemy.generics.GUID(),
+               existing_nullable=True)
+    op.alter_column('users', 'failed_login_attempts',
+               existing_type=sa.INTEGER(),
+               nullable=False,
+               existing_server_default=sa.text('0'))
+    op.alter_column('users', 'mfa_enabled',
+               existing_type=sa.BOOLEAN(),
+               nullable=False,
+               existing_server_default=sa.text('(FALSE)'))
+    op.alter_column('users', 'mfa_secret',
+               existing_type=sa.VARCHAR(length=255),
+               type_=sa.Text(),
+               existing_nullable=True)
+    op.alter_column('users', 'mfa_backup_codes',
+               existing_type=sa.VARCHAR(length=500),
+               type_=sa.Text(),
+               existing_nullable=True)
+    # ### end Alembic commands ###
+
+
+def downgrade() -> None:
+    # ### commands auto generated by Alembic - please adjust! ###
+    op.alter_column('users', 'mfa_backup_codes',
+               existing_type=sa.Text(),
+               type_=sa.VARCHAR(length=500),
+               existing_nullable=True)
+    op.alter_column('users', 'mfa_secret',
+               existing_type=sa.Text(),
+               type_=sa.VARCHAR(length=255),
+               existing_nullable=True)
+    op.alter_column('users', 'mfa_enabled',
+               existing_type=sa.BOOLEAN(),
+               nullable=True,
+               existing_server_default=sa.text('(FALSE)'))
+    op.alter_column('users', 'failed_login_attempts',
+               existing_type=sa.INTEGER(),
+               nullable=True,
+               existing_server_default=sa.text('0'))
+    op.alter_column('login_history', 'user_id',
+               existing_type=fastapi_users_db_sqlalchemy.generics.GUID(),
+               type_=sa.VARCHAR(length=36),
+               existing_nullable=True)
+    # ### end Alembic commands ###

app/__init__.py

@@ -0,0 +1 @@
+# Init files for Python packages

app/admin/router.py

@@ -0,0 +1,385 @@
+"""Admin API — Private endpoints for site owner."""
+
+import logging
+from datetime import datetime, timedelta
+from fastapi import APIRouter, Depends, HTTPException
+from sqlalchemy import select, func, text, Integer
+from sqlalchemy.ext.asyncio import AsyncSession
+from app.auth.models import User
+from app.auth.router import current_active_user
+from app.database import get_db
+from app.reports.models import SearchHistory, ReportCache, MonitorTask
+
+logger = logging.getLogger(__name__)
+router = APIRouter(prefix="/admin", tags=["admin"])
+
+# Auth
+async def current_active_superuser(user: User = Depends(current_active_user)) -> User:
+    if not user.is_superuser:
+        raise HTTPException(status_code=403, detail="Not enough permissions")
+    return user
+
+
+@router.get("/stats")
+async def get_stats(
+    user: User = Depends(current_active_superuser),
+    db: AsyncSession = Depends(get_db),
+):
+    """Estadísticas funcionales completas para el dashboard admin."""
+    try:
+        now = datetime.utcnow()
+        day_ago = now - timedelta(hours=24)
+        week_ago = now - timedelta(days=7)
+        month_ago = now - timedelta(days=30)
+
+        # ── USUARIOS ──────────────────────────────────────────────
+        result = await db.execute(select(func.count(User.id)))
+        total_users = result.scalar() or 0
+
+        result = await db.execute(select(func.count(User.id)).where(User.is_active == True))
+        active_users = result.scalar() or 0
+
+        result = await db.execute(select(User.plan, func.count(User.id)).group_by(User.plan))
+        plans = {row[0] or "free": row[1] for row in result.all()}
+
+        result = await db.execute(select(func.sum(User.credits)))
+        total_credits = result.scalar() or 0
+
+        result = await db.execute(select(func.count(User.id)).where(User.created_at >= week_ago))
+        new_users_week = result.scalar() or 0
+
+        result = await db.execute(select(func.count(User.id)).where(User.created_at >= month_ago))
+        new_users_month = result.scalar() or 0
+
+        # ── INFORMES (BÚSQUEDAS) ─────────────────────────────────
+        result = await db.execute(select(func.count(SearchHistory.id)))
+        total_reports = result.scalar() or 0
+
+        result = await db.execute(
+            select(func.count(SearchHistory.id)).where(SearchHistory.created_at >= day_ago)
+        )
+        reports_24h = result.scalar() or 0
+
+        result = await db.execute(
+            select(func.count(SearchHistory.id)).where(SearchHistory.created_at >= week_ago)
+        )
+        reports_week = result.scalar() or 0
+
+        result = await db.execute(
+            select(func.count(SearchHistory.id)).where(SearchHistory.created_at >= month_ago)
+        )
+        reports_month = result.scalar() or 0
+
+        # Informes por tipo
+        result = await db.execute(
+            select(SearchHistory.type, func.count(SearchHistory.id)).group_by(SearchHistory.type)
+        )
+        report_types = {row[0]: row[1] for row in result.all()}
+
+        # Top identificadores buscados (últimos 7 días)
+        result = await db.execute(
+            select(
+                SearchHistory.identifier,
+                SearchHistory.type,
+                SearchHistory.name,
+                func.count(SearchHistory.id).label("count"),
+            )
+            .where(SearchHistory.created_at >= week_ago)
+            .group_by(SearchHistory.identifier, SearchHistory.type, SearchHistory.name)
+            .order_by(func.count(SearchHistory.id).desc())
+            .limit(10)
+        )
+        top_searches = [
+            {"identifier": r[0], "type": r[1], "name": r[2], "count": r[3]}
+            for r in result.all()
+        ]
+
+        # Informes por día (últimos 7 días)
+        result = await db.execute(
+            select(
+                func.date(SearchHistory.created_at).label("day"),
+                func.count(SearchHistory.id).label("count"),
+            )
+            .where(SearchHistory.created_at >= week_ago)
+            .group_by(func.date(SearchHistory.created_at))
+            .order_by(func.date(SearchHistory.created_at))
+        )
+        daily_reports = [{"date": str(r[0]), "count": r[1]} for r in result.all()]
+
+        # ── REVENUE ESTIMADO ─────────────────────────────────────
+        # Precios por plan (ARS/mes)
+        PLAN_PRICES = {"free": 0, "basic": 4999, "pro": 14999, "enterprise": 29999}
+        revenue_monthly = sum(PLAN_PRICES.get(p, 0) * count for p, count in plans.items())
+        revenue_per_user = revenue_monthly / max(total_users, 1)
+
+        # ── CONVERSIÓN ───────────────────────────────────────────
+        paid_users = sum(count for p, count in plans.items() if p != "free")
+        conversion_rate = (paid_users / max(total_users, 1)) * 100
+
+        # ── CACHE ────────────────────────────────────────────────
+        result = await db.execute(select(func.count(ReportCache.id)))
+        cache_entries = result.scalar() or 0
+
+        result = await db.execute(select(func.sum(ReportCache.hit_count)))
+        total_cache_hits = result.scalar() or 0
+
+        result = await db.execute(select(func.count(ReportCache.id)).where(ReportCache.hit_count > 0))
+        cache_hits_count = result.scalar() or 0
+        cache_hit_rate = (cache_hits_count / max(cache_entries, 1)) * 100
+
+        # ── MONITOREO ────────────────────────────────────────────
+        result = await db.execute(
+            select(func.count(MonitorTask.id)).where(MonitorTask.active == True)
+        )
+        active_monitors = result.scalar() or 0
+
+        # ── SCRAPERS (telemetría en memoria) ──────────────────────
+        from app.utils.telemetry import get_scraper_health, get_scrapers_alerts
+        scrapers = get_scraper_health()
+        alerts = get_scrapers_alerts()
+
+        scrapers_ok = sum(1 for s in scrapers if s.get("status") in ("ok", "empty"))
+        scrapers_error = sum(1 for s in scrapers if s.get("status") == "error")
+        scrapers_blocked = sum(1 for s in scrapers if s.get("status") == "blocked")
+
+        # ── LOGIN HISTORY ────────────────────────────────────────
+        from app.auth.models import LoginHistory
+        result = await db.execute(
+            select(
+                func.count(LoginHistory.id).label("total"),
+                func.sum(func.cast(LoginHistory.success, Integer)).label("success"),
+            ).where(LoginHistory.created_at >= day_ago)
+        )
+        login_stats = result.one()
+        logins_24h = {
+            "total": login_stats.total or 0,
+            "successful": int(login_stats.success or 0),
+            "failed": (login_stats.total or 0) - int(login_stats.success or 0),
+        }
+
+        return {
+            "users": {
+                "total": total_users,
+                "active": active_users,
+                "new_this_week": new_users_week,
+                "new_this_month": new_users_month,
+                "by_plan": plans,
+                "total_credits": total_credits,
+            },
+            "reports": {
+                "total": total_reports,
+                "last_24h": reports_24h,
+                "last_week": reports_week,
+                "last_month": reports_month,
+                "by_type": report_types,
+                "daily": daily_reports,
+                "top_searches": top_searches,
+            },
+            "revenue": {
+                "estimated_monthly_ars": revenue_monthly,
+                "per_user_ars": round(revenue_per_user, 2),
+                "paid_users": paid_users,
+                "conversion_rate_pct": round(conversion_rate, 1),
+            },
+            "cache": {
+                "entries": cache_entries,
+                "total_hits": total_cache_hits,
+                "hit_rate_pct": round(cache_hit_rate, 1),
+            },
+            "scrapers": {
+                "total": len(scrapers),
+                "operational": scrapers_ok,
+                "with_error": scrapers_error,
+                "blocked": scrapers_blocked,
+                "alerts": len(alerts),
+            },
+            "monitors": {
+                "active": active_monitors,
+            },
+            "security": {
+                "logins_24h": logins_24h,
+            },
+        }
+    except Exception as e:
+        logger.error(f"Error fetching admin stats: {e}")
+        raise HTTPException(status_code=500, detail="Error fetching stats")
+
+
+@router.get("/users")
+async def get_users(
+    limit: int = 50,
+    offset: int = 0,
+    user: User = Depends(current_active_superuser),
+    db: AsyncSession = Depends(get_db),
+):
+    """List all users."""
+    try:
+        result = await db.execute(
+            select(User).order_by(User.created_at.desc()).limit(limit).offset(offset)
+        )
+        users = result.scalars().all()
+
+        # Count total
+        count_result = await db.execute(select(func.count(User.id)))
+        total = count_result.scalar() or 0
+
+        return {
+            "total": total,
+            "users": [
+                {
+                    "id": str(u.id),
+                    "email": u.email,
+                    "full_name": u.full_name,
+                    "credits": u.credits,
+                    "plan": u.plan or "free",
+                    "is_active": u.is_active,
+                    "is_superuser": u.is_superuser,
+                    "created_at": u.created_at.isoformat() if u.created_at else None,
+                }
+                for u in users
+            ],
+        }
+    except Exception as e:
+        logger.error(f"Error fetching users: {e}")
+        raise HTTPException(status_code=500, detail="Error fetching users")
+
+
+@router.get("/searches")
+async def get_searches(
+    days: int = 7,
+    user: User = Depends(current_active_superuser),
+    db: AsyncSession = Depends(get_db),
+):
+    """Search analytics for the last N days."""
+    try:
+        since = datetime.utcnow() - timedelta(days=days)
+
+        # Searches per day
+        result = await db.execute(
+            select(
+                func.date(SearchHistory.created_at).label("day"),
+                func.count(SearchHistory.id).label("count"),
+            )
+            .where(SearchHistory.created_at >= since)
+            .group_by(func.date(SearchHistory.created_at))
+            .order_by(func.date(SearchHistory.created_at))
+        )
+        daily = [{"date": str(row[0]), "count": row[1]} for row in result.all()]
+
+        # Top searched identifiers
+        result = await db.execute(
+            select(
+                SearchHistory.identifier,
+                SearchHistory.type,
+                func.count(SearchHistory.id).label("count"),
+            )
+            .where(SearchHistory.created_at >= since)
+            .group_by(SearchHistory.identifier, SearchHistory.type)
+            .order_by(func.count(SearchHistory.id).desc())
+            .limit(10)
+        )
+        top_searches = [
+            {"identifier": row[0], "type": row[1], "count": row[2]}
+            for row in result.all()
+        ]
+
+        # Unique users searching
+        result = await db.execute(
+            select(func.count(func.distinct(SearchHistory.user_id)))
+            .where(SearchHistory.created_at >= since)
+        )
+        unique_users = result.scalar() or 0
+
+        return {
+            "period_days": days,
+            "daily": daily,
+            "top_searches": top_searches,
+            "unique_users": unique_users,
+        }
+    except Exception as e:
+        logger.error(f"Error fetching search analytics: {e}")
+        raise HTTPException(status_code=500, detail="Error fetching search analytics")
+
+
+@router.get("/scrapers")
+async def get_scrapers(user: User = Depends(current_active_superuser)):
+    """Scraper health status from in-memory telemetry."""
+    try:
+        from app.utils.telemetry import get_scraper_health
+
+        results = []
+        for scraper in get_scraper_health():
+            success_rate = scraper.get("success_rate_24h")
+            avg_latency = scraper.get("avg_latency_ms_24h")
+            if avg_latency is None:
+                avg_latency = scraper.get("latency_ms")
+
+            results.append({
+                "name": scraper.get("name"),
+                "source": scraper.get("fuente", ""),
+                "description": scraper.get("descripcion", ""),
+                "status": scraper.get("status", "unknown"),
+                "success_rate": (success_rate / 100) if success_rate is not None else None,
+                "avg_latency_ms": avg_latency,
+                "records_24h": scraper.get("records_found_last", 0),
+                "last_check": scraper.get("last_seen"),
+            })
+        return {"scrapers": results}
+    except Exception as e:
+        logger.error(f"Error fetching scraper health: {e}")
+        raise HTTPException(status_code=500, detail="Error fetching scraper health")
+
+
+@router.get("/login-history")
+async def get_login_history(
+    limit: int = 50,
+    user: User = Depends(current_active_superuser),
+    db: AsyncSession = Depends(get_db),
+):
+    """Historial de intentos de login (éxito/fallo, IP, timestamp)."""
+    try:
+        from app.auth.models import LoginHistory
+
+        result = await db.execute(
+            select(LoginHistory).order_by(LoginHistory.created_at.desc()).limit(limit)
+        )
+        logs = result.scalars().all()
+
+        count_result = await db.execute(select(func.count(LoginHistory.id)))
+        total = count_result.scalar() or 0
+
+        # Estadísticas de las últimas 24h
+        day_ago = datetime.utcnow() - timedelta(hours=24)
+        result = await db.execute(
+            select(
+                func.count(LoginHistory.id).label("total"),
+                func.sum(func.cast(LoginHistory.success, Integer)).label("success_count"),
+            ).where(LoginHistory.created_at >= day_ago)
+        )
+        stats_24h = result.one()
+        success_24h = stats_24h.success_count or 0
+        total_24h = stats_24h.total or 0
+
+        return {
+            "total": total,
+            "stats_24h": {
+                "total_attempts": total_24h,
+                "successful": int(success_24h),
+                "failed": total_24h - int(success_24h),
+            },
+            "logs": [
+                {
+                    "id": l.id,
+                    "email": l.email,
+                    "success": l.success,
+                    "ip_address": l.ip_address,
+                    "user_agent": l.user_agent[:100] if l.user_agent else None,
+                    "failure_reason": l.failure_reason,
+                    "created_at": l.created_at.isoformat() if l.created_at else None,
+                }
+                for l in logs
+            ],
+        }
+    except Exception as e:
+        logger.error(f"Error fetching login history: {e}")
+        raise HTTPException(status_code=500, detail="Error fetching login history")

app/architecture/audit.py

@@ -0,0 +1,204 @@
+"""
+Auditoría de Arquitectura — CrowData Backend.
+
+Ejecutar: python -m app.architecture.audit
+"""
+import sys
+sys.path.insert(0, "E:/crowdata/backend")
+
+from pathlib import Path
+
+
+class ArchitectureAudit:
+    def __init__(self):
+        self.findings = []
+        self.passed = []
+        self.warnings = []
+
+    def check(self, name, condition, detail="", severity="HIGH"):
+        if condition:
+            self.passed.append(f"[PASS] {name}")
+        else:
+            self.findings.append(f"[FAIL-{severity}] {name}: {detail}")
+
+    def warn(self, name, detail=""):
+        self.warnings.append(f"[WARN] {name}: {detail}")
+
+    def audit_separation_of_concerns(self):
+        """Verifica separación de capas: router -> service -> scraper."""
+        backend = Path("E:/crowdata/backend/app")
+
+        # Routers should not import scrapers directly
+        routers = list((backend / "reports").glob("router*.py"))
+        router_imports_scraper = False
+        for r in routers:
+            content = r.read_text(encoding="utf-8")
+            if "from app.scrapers" in content:
+                router_imports_scraper = True
+                self.warn("Router imports scraper", f"{r.name} imports scraper directly")
+
+        self.check("Routers don't import scrapers", not router_imports_scraper,
+                   "Some routers import scrapers directly", "MEDIUM")
+
+        # Services should handle business logic
+        service_files = list(backend.glob("**/service*.py"))
+        self.check("Service layer exists", len(service_files) > 0,
+                   "No service files found", "HIGH")
+
+        # Scrapers should be independent
+        scraper_files = list((backend / "scrapers").glob("*.py"))
+        self.check("Scrapers exist", len(scraper_files) > 10,
+                   f"Only {len(scraper_files)} scrapers found", "MEDIUM")
+
+    def audit_async_patterns(self):
+        """Verifica uso correcto de async/await."""
+        backend = Path("E:/crowdata/backend/app")
+        issues = []
+
+        for py_file in backend.rglob("*.py"):
+            try:
+                content = py_file.read_text(encoding="utf-8")
+                lines = content.split("\n")
+                for i, line in enumerate(lines):
+                    stripped = line.strip()
+                    # Check for blocking calls in async context
+                    if "time.sleep(" in stripped and "async" in content:
+                        issues.append(f"{py_file.name}:{i+1}: time.sleep in async file")
+                    if "requests.get(" in stripped or "requests.post(" in stripped:
+                        issues.append(f"{py_file.name}:{i+1}: sync requests in async file")
+            except Exception:
+                pass
+
+        if issues:
+            self.warn("Async patterns", f"{len(issues)} potential blocking calls found")
+        else:
+            self.check("Async patterns correct", True)
+
+    def audit_connection_pooling(self):
+        """Verifica connection pooling."""
+        from app.config import get_settings
+        settings = get_settings()
+
+        if settings.database_url.startswith("postgresql"):
+            self.check("PostgreSQL configured", True, "Connection pooling available", "INFO")
+        else:
+            self.warn("SQLite in use", "Connection pooling not applicable for SQLite")
+
+    def audit_error_handling(self):
+        """Verifica manejo de errores consistente."""
+        backend = Path("E:/crowdata/backend/app")
+        files_with_bare_except = 0
+
+        for py_file in backend.rglob("*.py"):
+            try:
+                content = py_file.read_text(encoding="utf-8")
+                if "except:" in content or "except Exception:" in content:
+                    files_with_bare_except += 1
+            except Exception:
+                pass
+
+        if files_with_bare_except > 5:
+            self.warn("Bare except clauses", f"{files_with_bare_except} files use bare except")
+        else:
+            self.check("Error handling reasonable", True)
+
+    def audit_caching_strategy(self):
+        """Verifica estrategia de caché."""
+        from app.config import get_settings
+        settings = get_settings()
+
+        self.check("Cache TTL configured", settings.cache_ttl_seconds > 0,
+                   f"TTL: {settings.cache_ttl_seconds}s", "MEDIUM")
+        self.check("Redis URL configured", len(settings.redis_url) > 0,
+                   "Redis URL not set", "MEDIUM")
+
+    def audit_database_indexes(self):
+        """Verifica índices en modelos."""
+        from app.reports.models import SearchHistory, ReportCache, MonitorTask
+        from app.auth.models import User, LoginHistory
+
+        # Check SearchHistory indexes
+        sh_indexes = [col.name for col in SearchHistory.__table__.columns if col.index]
+        self.check("SearchHistory has indexes", len(sh_indexes) > 0,
+                   f"Indexed columns: {sh_indexes}", "MEDIUM")
+
+        # Check ReportCache indexes
+        rc_indexes = [col.name for col in ReportCache.__table__.columns if col.index]
+        self.check("ReportCache has indexes", len(rc_indexes) > 0,
+                   f"Indexed columns: {rc_indexes}", "MEDIUM")
+
+    def audit_api_versioning(self):
+        """Verifica versionado de API."""
+        self.warn("API versioning", "No /v1/ prefix found (consider for production)")
+
+    def audit_graceful_shutdown(self):
+        """Verifica graceful shutdown."""
+        main_file = Path("E:/crowdata/backend/app/main.py")
+        if main_file.exists():
+            content = main_file.read_text(encoding="utf-8")
+            has_lifespan = "lifespan" in content
+            self.check("Lifespan handler exists", has_lifespan,
+                       "No lifespan handler for graceful shutdown", "MEDIUM")
+        else:
+            self.warn("main.py not found", "Cannot verify graceful shutdown")
+
+    def run(self):
+        print("=" * 60)
+        print("  AUDITORÍA DE ARQUITECTURA — CrowData Backend")
+        print("=" * 60)
+        print()
+
+        print("1. Separación de capas")
+        self.audit_separation_of_concerns()
+        print()
+
+        print("2. Patrones Async")
+        self.audit_async_patterns()
+        print()
+
+        print("3. Connection Pooling")
+        self.audit_connection_pooling()
+        print()
+
+        print("4. Manejo de Errores")
+        self.audit_error_handling()
+        print()
+
+        print("5. Estrategia de Caché")
+        self.audit_caching_strategy()
+        print()
+
+        print("6. Índices de Base de Datos")
+        self.audit_database_indexes()
+        print()
+
+        print("7. Versionado de API")
+        self.audit_api_versioning()
+        print()
+
+        print("8. Graceful Shutdown")
+        self.audit_graceful_shutdown()
+        print()
+
+        # Results
+        print("=" * 60)
+        print("  RESULTADOS")
+        print("=" * 60)
+
+        for p in self.passed:
+            print(f"  {p}")
+        for f in self.findings:
+            print(f"  {f}")
+        for w in self.warnings:
+            print(f"  {w}")
+
+        print()
+        print(f"  Passed: {len(self.passed)}")
+        print(f"  Failed: {len(self.findings)}")
+        print(f"  Warnings: {len(self.warnings)}")
+        print()
+
+
+if __name__ == "__main__":
+    audit = ArchitectureAudit()
+    audit.run()

app/auth/__init__.py

@@ -0,0 +1 @@
+

app/auth/config.py

@@ -0,0 +1,161 @@
+from fastapi_users.authentication import (
+    AuthenticationBackend,
+    BearerTransport,
+    CookieTransport,
+    JWTStrategy,
+)
+from app.config import get_settings
+from typing import Optional, Any
+import jwt
+from jwt import PyJWK
+from datetime import datetime, timedelta
+
+settings = get_settings()
+
+# Bearer transport (para APIs programáticas / mobile)
+bearer_transport = BearerTransport(tokenUrl="api/auth/jwt/login")
+
+# Cookie transport (para navegadores - HttpOnly, Secure, SameSite=Lax)
+cookie_transport = CookieTransport(
+    cookie_name="cd_token",
+    cookie_max_age=settings.access_token_expire_minutes * 60,
+    cookie_secure=not settings.debug,  # Secure=True en prod, False en dev local
+    cookie_httponly=True,
+    cookie_samesite="lax",
+)
+
+# ─── Custom Dual JWT Strategy ───
+# Firma nuevos tokens con RS256 (private key)
+# Verifica: intenta RS256 (public key) → si falla, fallback a HS256 (legacy secret)
+
+class DualJWTStrategy(JWTStrategy):
+    """JWT Strategy que soporta verificación dual: RS256 (nuevo) + HS256 (legacy)."""
+
+    def __init__(self):
+        # Cargar claves
+        self._private_key = self._load_private_key()
+        self._public_key = self._load_public_key()
+        self._legacy_secret = settings.jwt_legacy_secret_key or settings.secret_key
+        self._algorithm = settings.jwt_algorithm
+        self._legacy_algorithm = settings.jwt_legacy_algorithm
+        self._lifetime_seconds = settings.access_token_expire_minutes * 60
+        self._key_id = settings.jwt_key_id
+        
+        # Initialize base class with required params (using legacy secret for base compat)
+        super().__init__(
+            secret=self._legacy_secret,
+            lifetime_seconds=self._lifetime_seconds,
+            token_audience=["fastapi-users:auth"],
+            algorithm=self._algorithm,
+            public_key=self._public_key,
+        )
+    
+    def _load_private_key(self) -> Optional[str]:
+        """Cargar clave privada RS256 desde config o archivo."""
+        if settings.jwt_private_key:
+            return settings.jwt_private_key
+        # Fallback: leer archivo
+        import os
+        key_path = os.path.join(os.path.dirname(__file__), '..', '..', 'private_key.pem')
+        if os.path.exists(key_path):
+            with open(key_path, 'r') as f:
+                return f.read()
+        return None
+    
+    def _load_public_key(self) -> Optional[str]:
+        """Cargar clave pública RS256 desde config o archivo."""
+        if settings.jwt_public_key:
+            return settings.jwt_public_key
+        # Fallback: leer archivo
+        import os
+        key_path = os.path.join(os.path.dirname(__file__), '..', '..', 'public_key.pem')
+        if os.path.exists(key_path):
+            with open(key_path, 'r') as f:
+                return f.read()
+        return None
+
+    async def write_token(self, user) -> str:
+        """Firmar token con RS256 (nueva clave privada). Fallar si no hay clave."""
+        # Extraer ID del usuario (fastapi-users pasa el objeto User)
+        user_id = str(user.id)
+        data = {"sub": user_id, "aud": self.token_audience}
+        
+        if not self._private_key:
+            raise RuntimeError(
+                "JWT_PRIVATE_KEY no configurada. Configure RS256 keys para firmar tokens. "
+                "No se permite fallback silencioso a HS256."
+            )
+        
+        # Agregar kid en header para rotación de claves
+        headers = {"kid": self._key_id}
+        return jwt.encode(
+            {**data, "exp": datetime.utcnow() + timedelta(seconds=self._lifetime_seconds)},
+            self._private_key,
+            algorithm=self._algorithm,
+            headers=headers,
+        )
+
+    async def read_token(self, token: Optional[str], user_manager) -> Optional[Any]:
+        """Verificar token: solo RS256. Legacy HS256 solo si jwt_legacy_enabled=True."""
+        if token is None:
+            return None
+        
+        # Intentar RS256 (nuevo)
+        if self._public_key:
+            try:
+                data = jwt.decode(
+                    token,
+                    self._public_key,
+                    algorithms=[self._algorithm],
+                    audience=self.token_audience,
+                )
+                user_id = data.get("sub")
+                if user_id is None:
+                    return None
+                parsed_id = user_manager.parse_id(user_id)
+                return await user_manager.get(parsed_id)
+            except jwt.PyJWTError:
+                pass  # Fallar a legacy si habilitado
+        
+        # Legacy HS256 SOLO si explícitamente habilitado
+        if settings.jwt_legacy_enabled and self._legacy_secret:
+            try:
+                data = jwt.decode(
+                    token,
+                    self._legacy_secret,
+                    algorithms=[self._legacy_algorithm],
+                    audience=self.token_audience,
+                )
+                user_id = data.get("sub")
+                if user_id is None:
+                    return None
+                parsed_id = user_manager.parse_id(user_id)
+                return await user_manager.get(parsed_id)
+            except jwt.PyJWTError:
+                pass
+        
+        # Si llegamos aquí, token inválido
+        return None
+
+    async def destroy_token(self, token: str, user) -> None:
+        """JWT es stateless, no hay nada que destruir server-side."""
+        pass
+
+
+def get_jwt_strategy() -> DualJWTStrategy:
+    return DualJWTStrategy()
+
+
+# Dual auth backend: soporta AMBOS transports (header Authorization + cookie)
+auth_backend = AuthenticationBackend(
+    name="jwt",
+    transport=bearer_transport,  # primary para compatibilidad
+    get_strategy=get_jwt_strategy,
+)
+
+# Segundo backend solo para cookies (se usa en login para setear cookie)
+cookie_auth_backend = AuthenticationBackend(
+    name="jwt-cookie",
+    transport=cookie_transport,
+    get_strategy=get_jwt_strategy,
+)

app/auth/db.py

@@ -0,0 +1,9 @@
+from typing import AsyncGenerator
+from fastapi import Depends
+from fastapi_users_db_sqlalchemy import SQLAlchemyUserDatabase
+from sqlalchemy.ext.asyncio import AsyncSession
+from app.database import get_db
+from app.auth.models import User
+
+async def get_user_db(session: AsyncSession = Depends(get_db)):
+    yield SQLAlchemyUserDatabase(session, User)

app/auth/manager.py

@@ -0,0 +1,315 @@
+import uuid
+import asyncio
+import logging
+import json
+import secrets
+import re
+from typing import Optional
+from datetime import datetime, timedelta
+from fastapi import Depends, Request, HTTPException
+from fastapi_users import BaseUserManager, UUIDIDMixin
+from sqlalchemy.ext.asyncio import AsyncSession
+from sqlalchemy import select
+from app.auth.models import User, RefreshToken
+from app.auth.db import get_user_db
+from app.database import get_db, AsyncSessionLocal
+from app.config import get_settings
+from app.utils.security import mask_email
+from app.utils.encryption import encrypt_backup_codes, decrypt_backup_codes
+
+logger = logging.getLogger(__name__)
+settings = get_settings()
+
+class UserManager(UUIDIDMixin, BaseUserManager[User, uuid.UUID]):
+    reset_password_token_secret = settings.reset_password_token_secret or settings.secret_key
+    verification_token_secret = settings.verification_token_secret or settings.secret_key
+
+    async def on_after_register(self, user: User, request: Optional[Request] = None):
+        logger.info(f"User {user.id} ({mask_email(user.email)}) has registered.")
+        try:
+            from app.utils.email_service import send_welcome_email
+            asyncio.create_task(send_welcome_email(
+                to_email=user.email,
+                full_name=user.full_name,
+            ))
+        except Exception as e:
+            logger.warning(f"Failed to send welcome email to {mask_email(user.email)}: {e}")
+
+    async def on_after_forgot_password(
+        self, user: User, token: str, request: Optional[Request] = None
+    ):
+        logger.info(f"User {user.id} has forgot their password. Reset token generated.")
+
+    async def on_after_request_verify(
+        self, user: User, token: str, request: Optional[Request] = None
+    ):
+        logger.info(f"Verification requested for user {user.id}.")
+
+    # ─── Password Validation ───
+    
+    async def validate_password(self, password: str, user: Optional[User] = None) -> None:
+        """Validate password strength using zxcvbn and check against HIBP."""
+        # Minimum length check
+        if len(password) < 12:
+            raise ValueError("La contraseña debe tener al menos 12 caracteres")
+        
+        # Check for common patterns - only flag long sequences (5+ chars)
+        if re.search(r'(.)\1{2,}', password):  # 3+ repeated characters
+            raise ValueError("La contraseña no debe contener caracteres repetidos (3 o más)")
+        
+        # Check for sequential patterns (5+ chars) - e.g., abcde, 12345, etc.
+        sequential_patterns = [
+            'abcde', 'bcdef', 'cdefg', 'defgh', 'efghi', 'fghij', 'ghijk', 'hijkl', 'ijklm', 'jklmn', 
+            'klmno', 'lmnop', 'mnopq', 'nopqr', 'opqrs', 'pqrst', 'qrstu', 'rstuv', 'stuvw', 'tuvwx', 
+            'uvwxy', 'vwxy', 'wxyz',
+            '01234', '12345', '23456', '34567', '45678', '56789'
+        ]
+        password_lower = password.lower()
+        for seq in sequential_patterns:
+            if seq in password_lower:
+                raise ValueError("La contraseña no debe contener secuencias comunes (5+ caracteres)")
+        
+        # zxcvbn score check (minimum score 3 = good)
+        try:
+            from zxcvbn import zxcvbn
+            result = zxcvbn(password)
+            if result['score'] < 3:
+                raise ValueError(f"Contraseña muy débil. Mejora: {'; '.join(result['feedback']['suggestions'])}")
+            
+            # Check against HIBP (k-anonymity)
+            import httpx
+            import hashlib
+            sha1 = hashlib.sha1(password.encode()).hexdigest().upper()
+            prefix, suffix = sha1[:5], sha1[5:]
+            
+            try:
+                with httpx.Client(timeout=5.0) as client:
+                    resp = client.get(f"https://api.pwnedpasswords.com/range/{prefix}")
+                    if resp.status_code == 200:
+                        if suffix in resp.text:
+                            raise ValueError("Esta contraseña ha sido filtrada en brechas de seguridad conocidas. Usa otra.")
+            except httpx.TimeoutException:
+                logger.warning("HIBP check timeout, skipping")
+            except Exception as e:
+                logger.warning(f"HIBP check failed: {e}")
+                
+        except ImportError:
+            # zxcvbn not installed, skip advanced checks
+            logger.warning("zxcvbn not installed, skipping advanced password checks")
+            pass
+
+    async def authenticate(self, credentials):
+        """Override authenticate to add account lockout and password validation."""
+        from fastapi_users.exceptions import InvalidPasswordException, UserNotExists, UserInactive
+        
+        # Get user by email
+        try:
+            user = await self.user_db.get_by_email(credentials.username)
+        except Exception:
+            user = None
+            
+        if not user:
+            raise UserNotExists()
+            
+        if not user.is_active:
+            raise UserInactive()
+            
+        # Check account lockout
+        if user.locked_until and user.locked_until > datetime.utcnow():
+            remaining = int((user.locked_until - datetime.utcnow()).total_seconds() / 60)
+            raise HTTPException(
+                status_code=403,
+                detail=f"Cuenta bloqueada temporalmente. Intente en {remaining} minutos."
+            )
+            
+        # Verify password
+        is_valid, new_hash = self.password_helper.verify_and_update(credentials.password, user.hashed_password)
+        if not is_valid:
+            # Increment failed attempts
+            user.failed_login_attempts += 1
+            if user.failed_login_attempts >= 5:
+                user.locked_until = datetime.utcnow() + timedelta(minutes=15)
+                logger.warning(f"Account locked for user {user.id} ({mask_email(user.email)}) after 5 failed attempts")
+            await self.user_db.update(user)
+            raise InvalidPasswordException()
+            
+        # Update hash if it was upgraded (e.g., bcrypt rounds increased)
+        if new_hash:
+            user.hashed_password = new_hash
+            await self.user_db.update(user)
+            
+        # Successful login - reset failed attempts and lock
+        if user.failed_login_attempts > 0 or user.locked_until:
+            user.failed_login_attempts = 0
+            user.locked_until = None
+            await self.user_db.update(user)
+            
+        # Verify email is verified
+        if not user.is_verified:
+            raise HTTPException(
+                status_code=403,
+                detail="Tu cuenta no ha sido verificada. Revisa tu email para verificar tu cuenta."
+            )
+            
+        return user
+
+    # ─── Refresh Token Methods ───
+
+    async def create_refresh_token(
+        self,
+        user: User,
+        request: Optional[Request] = None,
+        db: Optional[AsyncSession] = None,
+    ) -> str:
+        """Crear nuevo refresh token y almacenar hash en BD."""
+        if db is None:
+            async for session in get_db():
+                return await self._create_refresh_token_internal(user, request, session)
+        return await self._create_refresh_token_internal(user, request, db)
+
+    async def _create_refresh_token_internal(
+        self,
+        user: User,
+        request: Optional[Request],
+        db: AsyncSession,
+    ) -> str:
+        # Revocar tokens anteriores del usuario (rotación)
+        await self.revoke_user_refresh_tokens(user.id, db)
+        
+        # Generar nuevo token
+        raw_token = RefreshToken.generate_token()
+        token_hash = RefreshToken.hash_token(raw_token)
+        
+        expires_at = datetime.utcnow() + timedelta(days=settings.refresh_token_expire_days)
+        
+        # Extraer info de request
+        user_agent = request.headers.get("user-agent") if request else None
+        ip_address = request.client.host if request and request.client else None
+        
+        refresh_token = RefreshToken(
+            user_id=user.id,
+            token_hash=token_hash,
+            expires_at=expires_at,
+            user_agent=user_agent,
+            ip_address=ip_address,
+        )
+        db.add(refresh_token)
+        await db.commit()
+        
+        logger.info(f"Refresh token created for user {user.id}")
+        return raw_token
+
+    async def verify_refresh_token(
+        self,
+        token: str,
+        db: Optional[AsyncSession] = None,
+    ) -> Optional[User]:
+        """Verificar refresh token y retornar usuario si válido."""
+        if db is None:
+            async for session in get_db():
+                return await self._verify_refresh_token_internal(token, session)
+        return await self._verify_refresh_token_internal(token, db)
+
+    async def _verify_refresh_token_internal(
+        self,
+        token: str,
+        db: AsyncSession,
+    ) -> Optional[User]:
+        token_hash = RefreshToken.hash_token(token)
+        
+        result = await db.execute(
+            select(RefreshToken).where(
+                RefreshToken.token_hash == token_hash,
+                RefreshToken.revoked == False,
+                RefreshToken.expires_at > datetime.utcnow(),
+            )
+        )
+        refresh_token = result.scalar_one_or_none()
+        
+        if not refresh_token:
+            return None
+        
+        # Obtener usuario
+        user = await self.user_db.get(refresh_token.user_id)
+        if not user or not user.is_active:
+            return None
+        
+        return user
+
+    async def revoke_refresh_token(
+        self,
+        token: str,
+        db: Optional[AsyncSession] = None,
+    ) -> bool:
+        """Revocar un refresh token específico."""
+        if db is None:
+            async for session in get_db():
+                return await self._revoke_refresh_token_internal(token, session)
+        return await self._revoke_refresh_token_internal(token, db)
+
+    async def _revoke_refresh_token_internal(
+        self,
+        token: str,
+        db: AsyncSession,
+    ) -> bool:
+        token_hash = RefreshToken.hash_token(token)
+        
+        result = await db.execute(
+            select(RefreshToken).where(RefreshToken.token_hash == token_hash)
+        )
+        refresh_token = result.scalar_one_or_none()
+        
+        if not refresh_token:
+            return False
+        
+        refresh_token.revoked = True
+        await db.commit()
+        return True
+
+    async def revoke_user_refresh_tokens(
+        self,
+        user_id: uuid.UUID,
+        db: Optional[AsyncSession] = None,
+    ) -> int:
+        """Revocar TODOS los refresh tokens de un usuario (logout everywhere)."""
+        if db is None:
+            async for session in get_db():
+                return await self._revoke_user_refresh_tokens_internal(user_id, session)
+        return await self._revoke_user_refresh_tokens_internal(user_id, db)
+
+    async def _revoke_user_refresh_tokens_internal(
+        self,
+        user_id: uuid.UUID,
+        db: AsyncSession,
+    ) -> int:
+        result = await db.execute(
+            select(RefreshToken).where(
+                RefreshToken.user_id == user_id,
+                RefreshToken.revoked == False,
+            )
+        )
+        tokens = result.scalars().all()
+        
+        for token in tokens:
+            token.revoked = True
+        
+        await db.commit()
+        return len(tokens)
+    
+    async def create_user(self, user_create, safe: bool = False, request: Request | None = None):
+        """Override to validate password strength on registration."""
+        # Validate password strength
+        self.validate_password(user_create.password)
+        
+        # Call parent create_user
+        return await super().create_user(user_create, safe, request)
+    
+    async def update_user(self, user_update, user, safe: bool = False, request: Request | None = None):
+        """Override to validate password on update."""
+        if hasattr(user_update, 'password') and user_update.password:
+            self.validate_password(user_update.password)
+        return await super().update_user(user_update, user, safe, request)
+
+
+async def get_user_manager(user_db=Depends(get_user_db)):
+    yield UserManager(user_db)

app/auth/models.py

@@ -0,0 +1,115 @@
+import uuid
+import hashlib
+import secrets
+import json
+from datetime import datetime, timedelta
+from fastapi_users_db_sqlalchemy import SQLAlchemyBaseUserTableUUID
+from fastapi_users_db_sqlalchemy.generics import GUID
+from sqlalchemy import Column, String, Integer, DateTime, Boolean, ForeignKey, Index, Text
+from sqlalchemy.sql import func
+from app.database import Base
+# Use versioned encryption from utils
+from app.utils.encryption import encrypt_mfa, decrypt_mfa, encrypt_backup_codes, decrypt_backup_codes
+
+
+class User(SQLAlchemyBaseUserTableUUID, Base):
+    __tablename__ = "users"
+
+    full_name = Column(String(255), nullable=True)
+    credits = Column(Integer, default=1)  # Limit to 1 free search
+    plan = Column(String(50), default="free")
+    created_at = Column(DateTime(timezone=True), server_default=func.now())
+    updated_at = Column(DateTime(timezone=True), onupdate=func.now())
+
+    # Account lockout
+    failed_login_attempts = Column(Integer, default=0, nullable=False)
+    locked_until = Column(DateTime(timezone=True), nullable=True)
+
+    # Email verification
+    is_verified = Column(Boolean, default=False, nullable=False)
+
+    # ─── MFA / 2FA (encrypted) ───
+    mfa_enabled = Column(Boolean, default=False, nullable=False)
+    mfa_secret = Column(Text, nullable=True)  # Encrypted TOTP secret (Fernet)
+    mfa_backup_codes = Column(Text, nullable=True)  # Encrypted JSON array of backup codes
+    mfa_verified_at = Column(DateTime(timezone=True), nullable=True)
+
+    # OAuth / Social Login
+    oauth_provider = Column(String(50), nullable=True)  # google, microsoft, github
+    oauth_provider_id = Column(String(255), nullable=True)
+
+    # Password strength
+    password_strength_score = Column(Integer, nullable=True)  # zxcvbn score 0-4
+
+    @property
+    def mfa_secret_decrypted(self) -> str | None:
+        """Get decrypted MFA secret for TOTP verification (v1 or v2)."""
+        if self.mfa_secret:
+            from app.utils.encryption import safe_decrypt_mfa
+            return safe_decrypt_mfa(self.mfa_secret)
+        return None
+
+    @mfa_secret_decrypted.setter
+    def mfa_secret_decrypted(self, value: str | None):
+        """Set encrypted MFA secret (always writes v2)."""
+        from app.utils.encryption import encrypt_mfa
+        self.mfa_secret = encrypt_mfa(value) if value else None
+
+    @property
+    def mfa_backup_codes_decrypted(self) -> list[str]:
+        """Get decrypted backup codes list (v1 or v2)."""
+        if self.mfa_backup_codes:
+            from app.utils.encryption import safe_decrypt_backup_codes
+            return safe_decrypt_backup_codes(self.mfa_backup_codes)
+        return []
+
+    @mfa_backup_codes_decrypted.setter
+    def mfa_backup_codes_decrypted(self, value: list[str] | None):
+        """Set encrypted backup codes (always writes v2)."""
+        from app.utils.encryption import encrypt_backup_codes
+        self.mfa_backup_codes = encrypt_backup_codes(value) if value else None
+
+
+class LoginHistory(Base):
+    __tablename__ = "login_history"
+
+    id = Column(Integer, primary_key=True, autoincrement=True)
+    user_id = Column(GUID, ForeignKey("users.id"), nullable=True)
+    email = Column(String(255), nullable=False)
+    success = Column(Boolean, default=False)
+    ip_address = Column(String(45), nullable=True)
+    user_agent = Column(String(500), nullable=True)
+    failure_reason = Column(String(255), nullable=True)
+    created_at = Column(DateTime(timezone=True), server_default=func.now())
+
+
+class RefreshToken(Base):
+    """Refresh tokens para rotación segura (HttpOnly cookie)."""
+    __tablename__ = "refresh_tokens"
+
+    id = Column(Integer, primary_key=True, autoincrement=True)
+    user_id = Column(GUID, ForeignKey("users.id"), nullable=False, index=True)
+    token_hash = Column(String(64), nullable=False, unique=True, index=True)  # SHA-256
+    expires_at = Column(DateTime(timezone=True), nullable=False)
+    revoked = Column(Boolean, default=False, nullable=False)
+    user_agent = Column(String(500), nullable=True)
+    ip_address = Column(String(45), nullable=True)
+    created_at = Column(DateTime(timezone=True), server_default=func.now())
+
+    __table_args__ = (
+        Index("ix_refresh_tokens_user_revoked", "user_id", "revoked"),
+    )
+
+    @staticmethod
+    def hash_token(token: str) -> str:
+        """Hash del token para almacenamiento seguro."""
+        return hashlib.sha256(token.encode()).hexdigest()
+
+    @staticmethod
+    def generate_token() -> str:
+        """Generar token criptográficamente seguro."""
+        return secrets.token_urlsafe(32)
+
+    def verify(self, token: str) -> bool:
+        """Verificar token contra hash almacenado."""
+        return self.token_hash == self.hash_token(token) and not self.revoked and self.expires_at > datetime.utcnow()

app/auth/router.py

@@ -0,0 +1,661 @@
+import uuid
+import json
+import secrets
+from typing import Optional
+from datetime import datetime
+from fastapi import APIRouter, Depends, HTTPException, Response, Request, Cookie
+from fastapi_users import FastAPIUsers, exceptions as fu_exceptions
+from fastapi_users.jwt import generate_jwt
+from app.auth.models import User, LoginHistory
+from app.auth.manager import get_user_manager, UserManager
+from app.auth.config import auth_backend, cookie_auth_backend
+from app.auth.schemas import UserRead, UserCreate, UserUpdate
+from app.database import get_db
+from sqlalchemy.ext.asyncio import AsyncSession
+from pydantic import BaseModel
+import traceback
+import pyotp
+import qrcode
+import io
+import base64
+from app.config import get_settings
+from app.utils.security import mask_email
+from app.auth.models import User as UserModel
+
+settings = get_settings()
+
+# Incluir AMBOS backends para dual auth (header + cookie)
+fastapi_users = FastAPIUsers[User, uuid.UUID](
+    get_user_manager,
+    [auth_backend, cookie_auth_backend],
+)
+
+current_active_user = fastapi_users.current_user(active=True)
+
+router = APIRouter(prefix="/auth", tags=["auth"])
+
+# Auth router con AMBOS backends
+router.include_router(
+    fastapi_users.get_auth_router(auth_backend, requires_verification=False),
+    prefix="/jwt",
+)
+
+router.include_router(
+    fastapi_users.get_auth_router(cookie_auth_backend, requires_verification=False),
+    prefix="/jwt",
+)
+
+router.include_router(
+    fastapi_users.get_register_router(UserRead, UserCreate),
+)
+
+router.include_router(
+    fastapi_users.get_users_router(UserRead, UserUpdate),
+    prefix="/users",
+)
+
+
+class ForgotPasswordRequest(BaseModel):
+    email: str
+
+
+class ResetPasswordRequest(BaseModel):
+    token: str
+    password: str
+
+
+@router.post("/forgot-password")
+async def forgot_password(
+    body: ForgotPasswordRequest,
+    manager: UserManager = Depends(get_user_manager),
+):
+    try:
+        user = await manager.get_by_email(body.email)
+    except fu_exceptions.UserNotExists:
+        return {"message": "Si el email está registrado, se envió un enlace de recuperación."}
+
+    token_data = {
+        "sub": str(user.id),
+        "password_fgpt": manager.password_helper.hash(user.hashed_password),
+        "aud": manager.reset_password_token_audience,
+    }
+    token = generate_jwt(
+        token_data,
+        manager.reset_password_token_secret,
+        manager.reset_password_token_lifetime_seconds,
+    )
+    await manager.on_after_forgot_password(user, token, None)
+
+    return {
+        "message": "Si el email está registrado, se envió un enlace de recuperación.",
+    }
+
+
+@router.post("/reset-password")
+async def reset_password(
+    body: ResetPasswordRequest,
+    manager: UserManager = Depends(get_user_manager),
+):
+    try:
+        user = await manager.reset_password(body.token, body.password)
+    except fu_exceptions.InvalidResetPasswordToken:
+        raise HTTPException(status_code=400, detail="Token inválido o expirado.")
+    except fu_exceptions.UserInactive:
+        raise HTTPException(status_code=400, detail="Usuario inactivo.")
+
+    await manager.on_after_reset_password(user, None)
+    return {"message": "Contraseña actualizada correctamente."}
+
+
+# Custom login que setea cookie HttpOnly Y devuelve token en body (compatibilidad)
+@router.post("/jwt/login")
+async def jwt_login(
+    request: Request,
+    response: Response,
+    manager: UserManager = Depends(get_user_manager),
+):
+    try:
+        # Parse form data (OAuth2 password flow)
+        form = await request.form()
+        username = form.get("username")
+        password = form.get("password")
+        
+        if not username or not password:
+            raise HTTPException(status_code=400, detail="username y password requeridos")
+        
+        # Autenticar usuario usando OAuth2PasswordRequestForm
+        from fastapi.security import OAuth2PasswordRequestForm
+        credentials = OAuth2PasswordRequestForm(username=username, password=password)
+        user = await manager.authenticate(credentials)
+        if not user:
+            raise HTTPException(status_code=400, detail="Credenciales inválidas")
+        if not user.is_active:
+            raise HTTPException(status_code=400, detail="Usuario inactivo")
+        
+        # Si MFA está habilitado, requerir desafío TOTP/backup code
+        if user.mfa_enabled:
+            # Generar token temporal de pre-autenticación (válido 5 min)
+            from fastapi_users.jwt import generate_jwt
+            from app.config import get_settings
+            settings = get_settings()
+            mfa_token_data = {
+                "sub": str(user.id),
+                "mfa_pending": True,
+                "aud": "mfa-challenge",
+            }
+            mfa_token = generate_jwt(
+                mfa_token_data,
+                settings.secret_key,
+                300,  # 5 minutos
+            )
+            return {
+                "mfa_required": True,
+                "mfa_token": mfa_token,
+                "message": "Introduce tu código TOTP o código de respaldo",
+            }
+        
+        # Generar access token
+        jwt_strategy = auth_backend.get_strategy()
+        access_token = await jwt_strategy.write_token(user)
+        
+        # Crear refresh token (rotación)
+        from app.database import get_db
+        async for db in get_db():
+            refresh_token = await manager.create_refresh_token(user, request, db)
+        
+        # Setear cookie HttpOnly para access token
+        from app.config import get_settings
+        settings = get_settings()
+        cookie_max_age = settings.access_token_expire_minutes * 60
+        response.set_cookie(
+            key="cd_token",
+            value=access_token,
+            max_age=cookie_max_age,
+            httponly=True,
+            secure=not settings.debug,
+            samesite="lax",
+            path="/",
+        )
+        
+        # Setear cookie HttpOnly para refresh token
+        refresh_max_age = settings.refresh_token_expire_days * 24 * 60 * 60
+        response.set_cookie(
+            key="cd_refresh_token",
+            value=refresh_token,
+            max_age=refresh_max_age,
+            httponly=True,
+            secure=not settings.debug,
+            samesite="lax",
+            path="/",
+        )
+        
+        # También setear cookie de expiración para que el frontend pueda leerla
+        import time
+        response.set_cookie(
+            key="cd_token_expiry",
+            value=str(int(time.time() * 1000) + cookie_max_age * 1000),
+            max_age=cookie_max_age,
+            httponly=True,
+            secure=not settings.debug,
+            samesite="lax",
+            path="/",
+        )
+        
+        # Devolver token en body para compatibilidad con clientes existentes
+        return {
+            "access_token": access_token,
+            "token_type": "bearer",
+        }
+    except HTTPException:
+        raise
+    except Exception as e:
+        import logging
+        logger = logging.getLogger("crowdata.auth")
+        logger.error(f"Error en jwt_login: {e}", exc_info=True)
+        raise HTTPException(status_code=500, detail=f"Error interno: {str(e)}")
+
+
+# Refresh token endpoint - rota access token + nuevo refresh token
+@router.post("/jwt/refresh")
+async def jwt_refresh(
+    request: Request,
+    response: Response,
+    cd_refresh_token: Optional[str] = Cookie(None, alias="cd_refresh_token"),
+    manager: UserManager = Depends(get_user_manager),
+):
+    if not cd_refresh_token:
+        raise HTTPException(status_code=401, detail="Refresh token requerido")
+    
+    # Verificar refresh token
+    from app.database import get_db
+    async for db in get_db():
+        user = await manager.verify_refresh_token(cd_refresh_token, db)
+    
+    if not user:
+        raise HTTPException(status_code=401, detail="Refresh token inválido o expirado")
+    
+    # Generar nuevo access token
+    jwt_strategy = auth_backend.get_strategy()
+    access_token = await jwt_strategy.write_token(user)
+    
+    # Rotar refresh token (revocar viejo, crear nuevo)
+    from app.database import get_db
+    async for db in get_db():
+        new_refresh_token = await manager.create_refresh_token(user, request, db)
+    
+    # Setear cookies
+    from app.config import get_settings
+    settings = get_settings()
+    cookie_max_age = settings.access_token_expire_minutes * 60
+    refresh_max_age = settings.refresh_token_expire_days * 24 * 60 * 60
+    
+    response.set_cookie(
+        key="cd_token",
+        value=access_token,
+        max_age=cookie_max_age,
+        httponly=True,
+        secure=not settings.debug,
+        samesite="lax",
+        path="/",
+    )
+    response.set_cookie(
+        key="cd_refresh_token",
+        value=new_refresh_token,
+        max_age=refresh_max_age,
+        httponly=True,
+        secure=not settings.debug,
+        samesite="lax",
+        path="/",
+    )
+    import time
+    response.set_cookie(
+        key="cd_token_expiry",
+        value=str(int(time.time() * 1000) + cookie_max_age * 1000),
+        max_age=cookie_max_age,
+        httponly=True,
+        secure=not settings.debug,
+        samesite="lax",
+        path="/",
+    )
+    
+    return {
+        "access_token": access_token,
+        "token_type": "bearer",
+    }
+
+
+# Logout: limpiar cookies
+@router.post("/jwt/logout")
+async def jwt_logout(
+    response: Response,
+    cd_refresh_token: Optional[str] = Cookie(None, alias="cd_refresh_token"),
+    manager: UserManager = Depends(get_user_manager),
+):
+    # Revocar refresh token en BD
+    if cd_refresh_token:
+        from app.database import get_db
+        async for db in get_db():
+            await manager.revoke_refresh_token(cd_refresh_token, db)
+    
+    response.delete_cookie("cd_token", path="/", httponly=True, secure=True, samesite="lax")
+    response.delete_cookie("cd_refresh_token", path="/", httponly=True, secure=True, samesite="lax")
+    response.delete_cookie("cd_token_expiry", path="/", httponly=True, secure=True, samesite="lax")
+    return {"message": "Sesión cerrada"}
+
+
+# ─── JWKS Endpoint para claves públicas (RFC 7517) ───
+@router.get("/.well-known/jwks.json", tags=["auth"])
+async def jwks():
+    """JSON Web Key Set - expone claves públicas para verificación RS256."""
+    from app.config import get_settings
+    settings = get_settings()
+    
+    if not settings.jwt_public_key:
+        # Fallback: leer archivo
+        import os
+        key_path = os.path.join(os.path.dirname(__file__), '..', '..', 'public_key.pem')
+        if os.path.exists(key_path):
+            with open(key_path, 'r') as f:
+                public_key_pem = f.read()
+        else:
+            raise HTTPException(status_code=503, detail="Clave pública no configurada")
+    else:
+        public_key_pem = settings.jwt_public_key
+    
+    # Convertir PEM a JWK
+    from jwt.algorithms import RSAAlgorithm
+    public_key = RSAAlgorithm.from_jwk(public_key_pem)
+    numbers = public_key.public_numbers()
+    
+    # Base64url encode sin padding
+    import base64
+    def b64url_encode(data: bytes) -> str:
+        return base64.urlsafe_b64encode(data).decode().rstrip('=')
+    
+    n = b64url_encode(numbers.n.to_bytes((numbers.n.bit_length() + 7) // 8, 'big'))
+    e = b64url_encode(numbers.e.to_bytes((numbers.e.bit_length() + 7) // 8, 'big'))
+    
+    return {
+        "keys": [
+            {
+                "kty": "RSA",
+                "use": "sig",
+                "alg": "RS256",
+                "kid": settings.jwt_key_id,
+                "n": n,
+                "e": e,
+            }
+        ]
+    }
+
+
+# ════════════════════════════════════════════════════════════════════════════
+# MFA / 2FA (TOTP) Endpoints
+# ════════════════════════════════════════════════════════════════════════════
+
+class MFASetupRequest(BaseModel):
+    password: str  # Confirmar contraseña actual
+
+
+class MFAVerifyRequest(BaseModel):
+    code: str  # Código TOTP de 6 dígitos
+
+
+class MFADisableRequest(BaseModel):
+    password: str
+    code: str
+
+
+@router.post("/mfa/setup", dependencies=[Depends(current_active_user)])
+async def mfa_setup(
+    response: Response,
+    request: Request,
+    body: MFASetupRequest,
+    user: User = Depends(current_active_user),
+    manager: UserManager = Depends(get_user_manager),
+):
+    """
+    Iniciar configuración de MFA.
+    Genera secreto TOTP y devuelve QR code (base64) + secret para app autenticadora.
+    Requiere contraseña actual para confirmar identidad.
+    """
+    # Verificar contraseña
+    if not manager.password_helper.verify(body.password, user.hashed_password):
+        raise HTTPException(status_code=400, detail="Contraseña incorrecta")
+    
+    if user.mfa_enabled:
+        raise HTTPException(status_code=400, detail="MFA ya está habilitado")
+    
+    import pyotp
+    import qrcode
+    import io
+    import base64
+    
+    # Generar secreto único
+    secret = pyotp.random_base32()
+    
+    # Generar URI para QR code (compatible con Google Authenticator, Authy, etc.)
+    totp_uri = pyotp.totp.TOTP(secret).provisioning_uri(
+        name=user.email,
+        issuer_name="CrowData",
+    )
+    
+    # Generar QR code como base64
+    qr = qrcode.QRCode(version=1, box_size=10, border=5)
+    qr.add_data(totp_uri)
+    qr.make(fit=True)
+    img = qr.make_image(fill_color="black", back_color="white")
+    
+    buf = io.BytesIO()
+    img.save(buf, format='PNG')
+    qr_base64 = base64.b64encode(buf.getvalue()).decode()
+    
+    # Guardar secreto temporal (no activar hasta verificar) - using encrypted property
+    user.mfa_secret_decrypted = secret
+    user.mfa_backup_codes_decrypted = []
+    from app.database import get_db
+    async for db in get_db():
+        await db.commit()
+    
+    return {
+        "secret": secret,
+        "qr_code": f"data:image/png;base64,{qr_base64}",
+        "uri": totp_uri,
+        "message": "Escanea el QR con tu app autenticadora (Google Authenticator, Authy, 1Password, etc.) y luego usa /mfa/verify para activar."
+    }
+
+
+@router.post("/mfa/verify", dependencies=[Depends(current_active_user)])
+async def mfa_verify(
+    body: MFAVerifyRequest,
+    user: User = Depends(current_active_user),
+    manager: UserManager = Depends(get_user_manager),
+):
+    """
+    Verificar código TOTP y activar MFA.
+    Genera códigos de respaldo (backup codes) al activar.
+    """
+    if not user.mfa_secret_decrypted:
+        raise HTTPException(status_code=400, detail="MFA no iniciado. Usa /mfa/setup primero.")
+    
+    if user.mfa_enabled:
+        raise HTTPException(status_code=400, detail="MFA ya está habilitado")
+    
+    import pyotp
+    
+    totp = pyotp.TOTP(user.mfa_secret_decrypted)
+    if not totp.verify(body.code, valid_window=1):
+        raise HTTPException(status_code=400, detail="Código inválido o expirado")
+    
+    # Generar backup codes (8 códigos de 8 chars cada uno)
+    import secrets
+    backup_codes = [secrets.token_urlsafe(6) for _ in range(8)]
+    
+    user.mfa_enabled = True
+    user.mfa_backup_codes_decrypted = backup_codes
+    user.mfa_verified_at = datetime.utcnow()
+    
+    from app.database import get_db
+    async for db in get_db():
+        await db.commit()
+    
+    return {
+        "message": "MFA activado correctamente",
+        "backup_codes": backup_codes,
+        "warning": "Guarda estos códigos de respaldo en un lugar seguro. Cada uno se puede usar una sola vez."
+    }
+
+
+@router.post("/mfa/disable", dependencies=[Depends(current_active_user)])
+async def mfa_disable(
+    body: MFADisableRequest,
+    user: User = Depends(current_active_user),
+    manager: UserManager = Depends(get_user_manager),
+):
+    """
+    Desactivar MFA.
+    Requiere contraseña + código TOTP actual (o backup code).
+    """
+    if not user.mfa_enabled:
+        raise HTTPException(status_code=400, detail="MFA no está habilitado")
+    
+    # Verificar contraseña
+    if not manager.password_helper.verify(body.password, user.hashed_password):
+        raise HTTPException(status_code=400, detail="Contraseña incorrecta")
+    
+    # Verificar código (TOTP o backup code)
+    import pyotp
+    
+    valid = False
+    totp = pyotp.TOTP(user.mfa_secret_decrypted)
+    
+    if totp.verify(body.code, valid_window=1):
+        valid = True
+    elif body.code in user.mfa_backup_codes_decrypted:
+        # Es un backup code - consumirlo
+        codes = user.mfa_backup_codes_decrypted
+        codes.remove(body.code)
+        user.mfa_backup_codes_decrypted = codes
+        valid = True
+    
+    if not valid:
+        raise HTTPException(status_code=400, detail="Código inválido")
+    
+    # Desactivar MFA
+    user.mfa_enabled = False
+    user.mfa_secret_decrypted = None
+    user.mfa_backup_codes_decrypted = []
+    user.mfa_verified_at = None
+    
+    from app.database import get_db
+    async for db in get_db():
+        await db.commit()
+    
+    return {"message": "MFA desactivado correctamente"}
+
+
+@router.post("/mfa/backup-codes", dependencies=[Depends(current_active_user)])
+async def mfa_regenerate_backup_codes(
+    user: User = Depends(current_active_user),
+    manager: UserManager = Depends(get_user_manager),
+):
+    """
+    Regenerar códigos de respaldo (invalida los anteriores).
+    """
+    if not user.mfa_enabled:
+        raise HTTPException(status_code=400, detail="MFA no está habilitado")
+    
+    import secrets
+    backup_codes = [secrets.token_urlsafe(6) for _ in range(8)]
+    
+    user.mfa_backup_codes_decrypted = backup_codes
+    from app.database import get_db
+    async for db in get_db():
+        await db.commit()
+    
+    return {
+        "backup_codes": backup_codes,
+        "warning": "Los códigos anteriores han sido invalidados. Guarda los nuevos en un lugar seguro."
+    }
+
+
+@router.get("/mfa/status", dependencies=[Depends(current_active_user)])
+async def mfa_status(user: User = Depends(current_active_user)):
+    """Estado actual de MFA del usuario."""
+    return {
+        "mfa_enabled": user.mfa_enabled,
+        "mfa_verified_at": user.mfa_verified_at,
+        "backup_codes_remaining": len(user.mfa_backup_codes_decrypted),
+    }
+
+
+class MFAChallengeRequest(BaseModel):
+    mfa_token: str  # Token temporal del login inicial
+    code: str       # Código TOTP o backup code
+
+
+@router.post("/mfa/challenge")
+async def mfa_challenge(
+    body: MFAChallengeRequest,
+    response: Response,
+    manager: UserManager = Depends(get_user_manager),
+):
+    """
+    Verificar código TOTP/backup code durante login con MFA habilitado.
+    Recibe el token temporal (mfa_token) del login inicial + código.
+    Si es válido, setea cookies y devuelve access_token.
+    """
+    # Verificar token temporal MFA
+    from app.config import get_settings
+    settings = get_settings()
+    try:
+        import jwt as pyjwt
+        payload = pyjwt.decode(
+            body.mfa_token,
+            settings.secret_key,
+            algorithms=["HS256"],
+            audience="mfa-challenge",
+        )
+    except pyjwt.InvalidTokenError:
+        raise HTTPException(status_code=401, detail="Token MFA inválido o expirado")
+    
+    if not payload.get("mfa_pending"):
+        raise HTTPException(status_code=401, detail="Token MFA inválido")
+    
+    user_id = payload.get("sub")
+    if not user_id:
+        raise HTTPException(status_code=401, detail="Token MFA inválido")
+    
+    import uuid
+    user = await manager.get(uuid.UUID(user_id))
+    if not user or not user.is_active:
+        raise HTTPException(status_code=401, detail="Usuario no encontrado o inactivo")
+    
+    if not user.mfa_enabled:
+        raise HTTPException(status_code=400, detail="MFA no está habilitado para este usuario")
+    
+    # Verificar código TOTP
+    import pyotp
+    totp = pyotp.TOTP(user.mfa_secret_decrypted)
+    
+    code_valid = False
+    if totp.verify(body.code, valid_window=1):
+        code_valid = True
+    elif body.code in user.mfa_backup_codes_decrypted:
+        # Es un backup code - consumirlo
+        codes = user.mfa_backup_codes_decrypted
+        codes.remove(body.code)
+        user.mfa_backup_codes_decrypted = codes
+        code_valid = True
+    
+    if not code_valid:
+        raise HTTPException(status_code=400, detail="Código inválido o expirado")
+    
+    # Código válido - generar tokens normales
+    jwt_strategy = auth_backend.get_strategy()
+    access_token = await jwt_strategy.write_token(user)
+    
+    # Crear refresh token
+    from app.database import get_db
+    from starlette.requests import Request
+    async for db in get_db():
+        refresh_token = await manager.create_refresh_token(user, Request({"type": "http"}), db)
+    
+    # Setear cookies HttpOnly
+    cookie_max_age = settings.access_token_expire_minutes * 60
+    refresh_max_age = settings.refresh_token_expire_days * 24 * 60 * 60
+    
+    response.set_cookie(
+        key="cd_token",
+        value=access_token,
+        max_age=cookie_max_age,
+        httponly=True,
+        secure=not settings.debug,
+        samesite="lax",
+        path="/",
+    )
+    response.set_cookie(
+        key="cd_refresh_token",
+        value=refresh_token,
+        max_age=refresh_max_age,
+        httponly=True,
+        secure=not settings.debug,
+        samesite="lax",
+        path="/",
+    )
+    import time
+    response.set_cookie(
+        key="cd_token_expiry",
+        value=str(int(time.time() * 1000) + cookie_max_age * 1000),
+        max_age=cookie_max_age,
+        httponly=True,
+        secure=not settings.debug,
+        samesite="lax",
+        path="/",
+    )
+    
+    return {
+        "access_token": access_token,
+        "token_type": "bearer",
+        "message": "Autenticación MFA completada"
+    }

app/auth/schemas.py

@@ -0,0 +1,14 @@
+import uuid
+from typing import Optional
+from fastapi_users import schemas
+
+class UserRead(schemas.BaseUser[uuid.UUID]):
+    full_name: Optional[str] = None
+    credits: int
+    plan: str
+
+class UserCreate(schemas.BaseUserCreate):
+    full_name: Optional[str] = None
+
+class UserUpdate(schemas.BaseUserUpdate):
+    full_name: Optional[str] = None

app/cache/__init__.py

@@ -0,0 +1 @@
+

app/cache/ddjj_pep.csv

@@ -0,0 +1,3 @@
+version https://git-lfs.github.com/spec/v1
+oid sha256:904c746875746b6c14bd3d44427bd4081e7c3eb51970b53389f56d2dd354c2b4
+size 29406143

app/cache/redis_client.py

@@ -0,0 +1,185 @@
+"""
+Redis Client Pool — CrowData
+Centralized Redis connection management with in-memory LRU fallback.
+"""
+import asyncio
+import json
+import logging
+import time
+from collections import OrderedDict
+from typing import Optional
+import redis.asyncio as aioredis
+from app.config import get_settings
+
+logger = logging.getLogger(__name__)
+settings = get_settings()
+
+# Global connection pools
+_redis_client = None
+_redis_is_available = True
+_reconnect_task = None
+
+# In-memory LRU cache fallback
+class LRUCache:
+    def __init__(self, maxsize: int = 5000):
+        self.maxsize = maxsize
+        self._cache = OrderedDict()
+        self._ttls = {}
+        self._lock = asyncio.Lock()
+
+    async def get(self, key: str):
+        async with self._lock:
+            if key not in self._cache:
+                return None
+            expire_at = self._ttls.get(key, 0)
+            if expire_at and expire_at < time.time():
+                # Expired
+                self._cache.pop(key, None)
+                self._ttls.pop(key, None)
+                return None
+            # Move to end (most recently used)
+            value = self._cache.pop(key)
+            self._cache[key] = value
+            return value
+
+    async def set(self, key: str, value: dict, ttl: int):
+        async with self._lock:
+            # Evict if at maxsize
+            if len(self._cache) >= self.maxsize and key not in self._cache:
+                self._cache.popitem(last=False)  # Remove LRU
+            self._cache[key] = value
+            self._ttls[key] = time.time() + ttl if ttl > 0 else 0
+
+    async def delete(self, key: str):
+        async with self._lock:
+            self._cache.pop(key, None)
+            self._ttls.pop(key, None)
+
+    async def cleanup_expired(self):
+        """Remove expired entries. Called periodically."""
+        async with self._lock:
+            now = time.time()
+            expired = [k for k, exp in self._ttls.items() if exp and exp < now]
+            for k in expired:
+                self._cache.pop(k, None)
+                self._ttls.pop(k, None)
+
+    def __len__(self):
+        return len(self._cache)
+
+
+_in_memory_cache = LRUCache(maxsize=5000)
+
+_redis_client = None
+_redis_is_available = True
+_reconnect_task = None
+
+
+async def get_redis():
+    global _redis_client
+    if _redis_client is None:
+        import redis.asyncio as aioredis
+        from app.config import get_settings
+        settings = get_settings()
+        _redis_client = await aioredis.from_url(
+            settings.redis_url,
+            encoding="utf-8",
+            decode_responses=True,
+            max_connections=settings.redis_max_connections or 20,
+            socket_keepalive=True,
+            socket_connect_timeout=5,
+            socket_timeout=5,
+            retry_on_timeout=True,
+        )
+    return _redis_client
+
+
+async def _try_reconnect():
+    """Background task to attempt Redis reconnection."""
+    global _redis_is_available, _reconnect_task
+    while True:
+        await asyncio.sleep(30)  # Try every 30 seconds
+        if not _redis_is_available:
+            try:
+                r = await get_redis()
+                await r.ping()
+                _redis_is_available = True
+                logger.info("Redis reconnected successfully")
+            except Exception:
+                pass
+
+
+async def _start_reconnect_task():
+    global _reconnect_task
+    if _reconnect_task is None or _reconnect_task.done():
+        _reconnect_task = asyncio.create_task(_try_reconnect())
+
+
+async def cache_get(key: str):
+    global _redis_is_available
+    if _redis_is_available:
+        try:
+            r = await get_redis()
+            data = await r.get(key)
+            if data:
+                return json.loads(data)
+        except Exception as e:
+            logger.warning(f"Redis GET error for key {key}: {e}. Falling back to in-memory cache.")
+            _redis_is_available = False
+            # Start background reconnection
+            asyncio.create_task(_try_reconnect())
+
+    # In-memory fallback
+    return await _in_memory_cache.get(key)
+
+
+async def cache_set(key: str, value: dict, ttl: int = None):
+    global _redis_is_available
+    ttl = ttl or 86400
+    if _redis_is_available:
+        try:
+            r = await get_redis()
+            await r.setex(key, ttl, json.dumps(value, ensure_ascii=False))
+            return
+        except Exception as e:
+            logger.warning(f"Redis SET error for key {key}: {e}. Saving in memory.")
+            _redis_is_available = False
+            # Start background reconnection
+            asyncio.create_task(_try_reconnect())
+
+    # In-memory LRU fallback
+    await _in_memory_cache.set(key, value, ttl=60)
+
+
+async def cache_delete(key: str):
+    global _redis_is_available
+    if _redis_is_available:
+        try:
+            r = await get_redis()
+            await r.delete(key)
+        except Exception as e:
+            logger.warning(f"Redis DELETE error for key {key}: {e}.")
+            _redis_is_available = False
+            asyncio.create_task(_try_reconnect())
+
+    # In-memory fallback
+    await _in_memory_cache.delete(key)
+
+
+async def cleanup_expired():
+    """Periodic cleanup of expired in-memory cache entries."""
+    await _in_memory_cache.cleanup_expired()
+
+
+async def _start_reconnect_task():
+    """Start the background reconnection task."""
+    pass  # Task is already started at module level
+
+
+# Module-level initialization - start background tasks
+try:
+    loop = asyncio.get_running_loop()
+    loop.create_task(_try_reconnect())
+except RuntimeError:
+    # No event loop running, will be created later
+    pass

app/config.py

@@ -0,0 +1,109 @@
+import os
+from pathlib import Path
+from pydantic_settings import BaseSettings
+from functools import lru_cache
+from pydantic import field_validator
+
+_backend_dir = str(Path(__file__).resolve().parent.parent)
+
+
+class Settings(BaseSettings):
+    # App
+    app_name: str = "CrowData API"
+    environment: str = "development"
+    debug: bool = False  # Default: False por seguridad. Usar ENVIRONMENT=development para debug.
+
+    # Database
+    database_url: str = ""
+
+    # Redis
+    redis_url: str = "redis://localhost:6379/0"
+
+    # Security — MUST be set in .env
+    secret_key: str = ""
+    reset_password_token_secret: str = ""  # Separate secret for password reset tokens
+    verification_token_secret: str = ""    # Separate secret for email verification tokens
+    
+    # MFA Encryption Key (for encrypting TOTP secrets and backup codes in DB)
+    mfa_encryption_key: str = ""  # Fernet key (32 bytes base64)
+    
+    # JWT RS256 (asymmetric) — new keys for production
+    jwt_private_key: str = ""       # RS256 private key (PEM)
+    jwt_public_key: str = ""        # RS256 public key (PEM)
+    jwt_algorithm: str = "RS256"    # New tokens signed with RS256
+    jwt_key_id: str = "key-1"       # Key ID for rotation
+    
+    # Legacy HS256 (symmetric) — for backward compatibility during transition
+    jwt_legacy_secret_key: str = ""   # HS256 secret (same as secret_key)
+    jwt_legacy_algorithm: str = "HS256"
+    jwt_legacy_enabled: bool = False   # Disabled by default in production
+    
+    access_token_expire_minutes: int = 15  # 15 minutes (short-lived access token)
+    refresh_token_expire_days: int = 7     # 7 days (refresh token in HttpOnly cookie)
+
+    # Auth transport
+    use_cookie_auth: bool = True           # Enable HttpOnly cookie auth
+    cookie_secure: bool = True             # Secure cookie (HTTPS only)
+    cookie_samesite: str = "lax"           # Lax for cross-site top-level nav, Strict for more security
+
+    # Cache
+    cache_ttl_seconds: int = 86400  # 24 hours
+
+    # Database pool
+    db_pool_size: int = 10
+    db_max_overflow: int = 20
+
+    # Scrapers
+    playwright_headless: bool = True
+    scraper_timeout_seconds: int = 30
+    proxy_url: str | None = None
+    proxy_list: list[str] = []
+    captcha_api_key: str | None = None  # 2Captcha API key
+    nopecha_api_key: str | None = None  # NopeCHA API key (reCAPTCHA v3 solver)
+    groq_api_key: str | None = None
+    searchapi_key: str | None = None
+    searchapi_keys: list[str] = []
+    ai_verification_enabled: bool = True
+
+    # Payments — default: empty string (must be set in .env for production)
+    mp_access_token: str = ""
+    mp_public_key: str = ""
+
+    # AFIP
+    afip_cuit_representada: str = ""
+    afip_cert_path: str = ""
+    afip_key_path: str = ""
+    afip_cache_file: str = ""
+
+    # Email / SMTP
+    smtp_host: str = "localhost"
+    smtp_port: int = 587
+    smtp_user: str = ""
+    smtp_password: str = ""
+    smtp_use_tls: bool = True
+    from_email: str = "crowsistemas@proton.me"
+    from_name: str = "CrowData"
+
+    # Allowed Origins (for CORS)
+    allowed_origins: str = ""
+
+    # ─── Validation ───
+    @field_validator("secret_key", "reset_password_token_secret", "verification_token_secret",
+                     "mfa_encryption_key", "jwt_private_key", "jwt_public_key",
+                     mode="before")
+    @classmethod
+    def _require_secrets_in_prod(cls, v, info):
+        # Solo validar en producción
+        if info.data.get("environment") == "production" and not v:
+            raise ValueError(f"{info.field_name} must be set in production")
+        return v
+
+    class Config:
+        env_file = os.path.join(_backend_dir, ".env")
+        env_file_encoding = "utf-8"
+        extra = "allow"
+
+
+@lru_cache()
+def get_settings() -> Settings:
+    return Settings()

app/database.py

@@ -0,0 +1,86 @@
+from sqlalchemy.ext.asyncio import AsyncSession, create_async_engine, async_sessionmaker
+from sqlalchemy.orm import DeclarativeBase
+from app.config import get_settings
+
+settings = get_settings()
+
+# Normalizar la URL de base de datos para asegurar el uso del driver asincrónico asyncpg
+db_url = settings.database_url
+if db_url:
+    if db_url.startswith("postgresql://"):
+        db_url = db_url.replace("postgresql://", "postgresql+asyncpg://", 1)
+    elif db_url.startswith("postgres://"):
+        db_url = db_url.replace("postgres://", "postgresql+asyncpg://", 1)
+    
+    # asyncpg no soporta 'sslmode=require', requiere 'ssl=require'
+    if "sslmode=" in db_url:
+        db_url = db_url.replace("sslmode=require", "ssl=require")
+        db_url = db_url.replace("sslmode=disable", "ssl=disable")
+
+engine_kwargs = {
+    "echo": settings.debug,
+    "pool_pre_ping": True,
+}
+if db_url.startswith("postgresql"):
+    engine_kwargs["pool_size"] = settings.db_pool_size
+    engine_kwargs["max_overflow"] = settings.db_max_overflow
+
+engine = create_async_engine(
+    db_url,
+    **engine_kwargs
+)
+
+AsyncSessionLocal = async_sessionmaker(
+    engine,
+    class_=AsyncSession,
+    expire_on_commit=False,
+)
+
+
+class Base(DeclarativeBase):
+    pass
+
+
+async def get_db():
+    async with AsyncSessionLocal() as session:
+        try:
+            yield session
+            await session.commit()
+        except Exception:
+            await session.rollback()
+            raise
+        finally:
+            await session.close()
+
+
+async def init_db():
+    from app.auth.models import User  # noqa: F401 - ensure models are loaded
+    from app.reports.models import ReportCache  # noqa: F401
+    
+    # Use Alembic for migrations instead of create_all
+    from alembic.config import Config
+    from alembic import command
+    import os
+    
+    # Find alembic.ini (could be in backend dir)
+    alembic_ini = os.path.join(os.path.dirname(__file__), '..', 'alembic.ini')
+    
+    try:
+        alembic_cfg = Config(alembic_ini)
+        # Use the existing database URL from settings
+        from app.config import get_settings
+        settings = get_settings()
+        # Normalize for synchronous alembic
+        db_url = settings.database_url
+        if db_url.startswith("sqlite+aiosqlite://"):
+            db_url = db_url.replace("sqlite+aiosqlite://", "sqlite://")
+        elif db_url.startswith("postgresql+asyncpg://"):
+            db_url = db_url.replace("postgresql+asyncpg://", "postgresql://")
+        alembic_cfg.set_main_option("sqlalchemy.url", db_url)
+        command.upgrade(alembic_cfg, "head")
+    except Exception as e:
+        import logging
+        logging.getLogger("app.database").warning(f"Error running migrations: {e}")
+        # Fallback to create_all for dev environments
+        async with engine.begin() as conn:
+            await conn.run_sync(Base.metadata.create_all)

app/main.py

@@ -0,0 +1,212 @@
+import asyncio
+import sys
+from fastapi import FastAPI, Request
+from fastapi.middleware.cors import CORSMiddleware
+from fastapi.staticfiles import StaticFiles
+from fastapi.responses import JSONResponse
+from starlette.middleware.base import BaseHTTPMiddleware
+from contextlib import asynccontextmanager
+import logging
+import uuid
+
+# Fix crítico para Windows: Playwright necesita ProactorEventLoop para subprocesses.
+# SelectorEventLoop causa NotImplementedError en _make_subprocess_transport.
+# Python 3.8+ usa WindowsProactorEventLoopPolicy por defecto — NO sobreescribir.
+if sys.platform == "win32":
+    pass  # Keep default ProactorEventLoop — Playwright requires it for subprocesses
+
+from app.config import get_settings
+from app.database import init_db
+from app.auth.router import router as auth_router
+from app.utils.logging_structured import CorrelationMiddleware, set_correlation_id, get_correlation_id
+
+settings = get_settings()
+# Use structured JSON logging in production, human-readable in dev
+if settings.debug:
+    logging.basicConfig(
+        level=logging.DEBUG,
+        format="%(asctime)s | %(levelname)-8s | %(name)s | %(message)s",
+    )
+else:
+    # Production: JSON structured logging
+    import logging.handlers
+    handler = logging.StreamHandler()
+    handler.setFormatter(logging.Formatter('%(message)s'))
+    root_logger = logging.getLogger()
+    root_logger.handlers = [handler]
+    root_logger.setLevel(logging.INFO)
+
+logger = logging.getLogger(__name__)
+
+
+@asynccontextmanager
+async def lifespan(app: FastAPI):
+    # Validar settings críticos al iniciar
+    if not settings.secret_key:
+        logger.critical("SECRET_KEY no configurado en .env — la aplicación NO puede iniciar sin una clave secreta")
+        raise SystemExit(1)
+    if settings.mp_access_token and "TEST" in settings.mp_access_token:
+        logger.warning("MercadoPago usando access token de TEST — no procesará pagos reales")
+    
+    logger.info("🚀 CrowData API iniciando...")
+    await init_db()
+    logger.info("✅ Base de datos inicializada")
+    
+    # Iniciar Celery Beat para tareas programadas (monitoring, cleanup, etc.)
+    # En producción: celery -A app.tasks.celery_app beat -l info
+    # En desarrollo: usamos daemon simple
+    # Iniciar daemon de monitoring en desarrollo (sin Celery)
+    if settings.environment != "production":
+        try:
+            from app.tasks.monitoring import start_monitoring_daemon
+            monitor_task = asyncio.create_task(start_monitoring_daemon())
+        except (ImportError, AttributeError) as e:
+            logger.warning(f"⚠️ Monitoring daemon no disponible (Celery no instalado o función faltante): {e}")
+    
+    yield
+    
+    logger.info("🛑 Cancelando tareas de fondo...")
+    # Celery workers se gestionan externamente
+    logger.info("🛑 CrowData API cerrando...")
+
+
+app = FastAPI(
+    title="CrowData API",
+    description="""
+## API de Consulta de Datos Públicos Argentinos
+
+CrowData consulta múltiples fuentes oficiales argentinas para generar informes completos de personas, empresas, vehículos y propiedades.
+
+### Fuentes de datos
+- **ARCA/AFIP** — Situación fiscal, IVA, Monotributo
+- **BCRA** — Situación crediticia, cheques rechazados
+- **IGJ** — Sociedades, directivos, sede social
+- **Boletín Oficial** — Publicaciones oficiales
+- **DNRPA** — Vehículos registrados
+- **ANSES** — Aportes previsionales, obra social
+- **INPI** — Marcas y patentes comerciales
+- **Poder Judicial** — Causas judiciales federales y provinciales
+- **Redes Sociales** — Perfiles públicos OSINT
+
+### Autenticación
+Todos los endpoints requieren JWT token. Obtener token via `POST /api/auth/jwt/login`.
+
+### Rate Limits
+- **Free**: 10 requests/min, 5 informes/día
+- **Basic**: 60 requests/min, 50 informes/día
+- **Pro**: 200 requests/min, ilimitado
+""",
+    version="1.0.0",
+    lifespan=lifespan,
+    docs_url="/api/docs",
+    redoc_url="/api/redoc",
+)
+
+
+@app.exception_handler(Exception)
+async def global_exception_handler(request: Request, exc: Exception):
+    """Captura errores no manejados y retorna respuesta segura."""
+    logger.error(f"Unhandled exception: {exc}", exc_info=True)
+    return JSONResponse(
+        status_code=500,
+        content={
+            "detail": "Ocurrió un error inesperado. Intentá nuevamente.",
+            "type": "internal_error",
+        },
+    )
+
+# CORS — producción: solo dominios permitidos
+ALLOWED_ORIGINS = [
+    "http://localhost:3000",
+    "http://localhost:5173",
+    "http://localhost:8080",
+    "https://crowdata.ar",
+    "https://www.crowdata.ar",
+    "https://crowdata.netlify.app",
+    "https://tomasdelpico-crowdata-api.hf.space",
+]
+import os
+env_origins = os.getenv("ALLOWED_ORIGINS")
+if env_origins:
+    ALLOWED_ORIGINS.extend([origin.strip() for origin in env_origins.split(",") if origin.strip()])
+
+app.add_middleware(
+    CORSMiddleware,
+    allow_origins=ALLOWED_ORIGINS,
+    allow_origin_regex=r"^https://(.*\.)?crowdata\.ar$",
+    allow_credentials=True,
+    allow_methods=["GET", "POST", "PUT", "DELETE"],
+    allow_headers=["Authorization", "Content-Type"],
+)
+
+# Correlation ID Middleware - must be after CORS but before other middleware
+from app.utils.logging_structured import CorrelationMiddleware
+app.add_middleware(CorrelationMiddleware)
+
+
+class SecurityHeadersMiddleware(BaseHTTPMiddleware):
+    """Agrega headers de seguridad a todas las respuestas."""
+
+    async def dispatch(self, request: Request, call_next):
+        response = await call_next(request)
+        response.headers["X-Content-Type-Options"] = "nosniff"
+        response.headers["X-Frame-Options"] = "DENY"
+        response.headers["X-XSS-Protection"] = "1; mode=block"
+        response.headers["Referrer-Policy"] = "strict-origin-when-cross-origin"
+        response.headers["Permissions-Policy"] = "camera=(), microphone=(), geolocation=()"
+        # HSTS solo en producción (HTTPS)
+        if settings.environment == "production":
+            response.headers["Strict-Transport-Security"] = "max-age=31536000; includeSubDomains"
+        return response
+
+
+app.add_middleware(SecurityHeadersMiddleware)
+
+# Rate Limiting
+from app.middleware.rate_limit import RateLimitMiddleware
+app.add_middleware(RateLimitMiddleware)
+
+# Login History
+from app.middleware.login_history import LoginHistoryMiddleware
+app.add_middleware(LoginHistoryMiddleware)
+
+# CSRF Protection (Double-submit cookie)
+from app.middleware.csrf import get_csrf_middleware
+from app.config import get_settings
+settings = get_settings()
+app.add_middleware(
+    get_csrf_middleware(
+        cookie_secure=not settings.debug,
+        cookie_samesite="lax",
+        excluded_paths=["/api/auth/jwt/login", "/api/auth/jwt/logout", "/api/auth/register", "/api/auth/forgot-password", "/api/auth/reset-password"],
+    )
+)
+
+from app.reports.router import router as reports_router
+from app.reports.vehiculo_router import router as vehiculo_router
+from app.payments.router import router as payments_router
+from app.admin.router import router as admin_router
+
+# Routers
+app.include_router(auth_router, prefix="/api")
+app.include_router(reports_router, prefix="/api")
+app.include_router(vehiculo_router, prefix="/api")
+app.include_router(payments_router, prefix="/api")
+app.include_router(admin_router, prefix="/api")
+
+
+@app.get("/api/health", tags=["system"])
+async def health_check():
+    return {"status": "ok", "service": "CrowData API", "version": "1.0.0"}
+
+
+@app.get("/api", tags=["system"])
+async def root():
+    return {
+        "service": "CrowData API",
+        "docs": "/api/docs",
+        "endpoints": {
+            "auth": "/api/auth",
+            "reports": "/api/reports",
+        }
+    }

app/middleware/csrf.py

@@ -0,0 +1,131 @@
+import os
+import secrets
+import hashlib
+from typing import Callable, Optional
+from fastapi import Request, Response, HTTPException, status
+from starlette.middleware.base import BaseHTTPMiddleware
+from starlette.responses import JSONResponse
+
+
+class CSRFMiddleware(BaseHTTPMiddleware):
+    """
+    CSRF Protection usando patrón Double-Submit Cookie.
+    
+    - Genera cookie `csrf_token` (HttpOnly=False, SameSite=Lax) al iniciar sesión
+    - Valida header `X-CSRF-Token` en métodos mutantes (POST, PUT, PATCH, DELETE)
+    - Excluye: GET, HEAD, OPTIONS, endpoints de auth (/api/auth/*)
+    - Skip si no hay cookie (p.ej. APIs programáticas con Bearer token)
+    """
+    
+    def __init__(
+        self, 
+        app, 
+        cookie_name: str = "csrf_token",
+        header_name: str = "X-CSRF-Token",
+        cookie_secure: bool = True,
+        cookie_samesite: str = "lax",
+        excluded_paths: Optional[list] = None,
+        excluded_methods: Optional[list] = None,
+    ):
+        super().__init__(app)
+        self.cookie_name = cookie_name
+        self.header_name = header_name
+        self.cookie_secure = cookie_secure
+        self.cookie_samesite = cookie_samesite
+        self.excluded_paths = excluded_paths or [
+            "/api/auth/jwt/login",
+            "/api/auth/jwt/logout", 
+            "/api/auth/register",
+            "/api/auth/forgot-password",
+            "/api/auth/reset-password",
+            "/api/auth/users/me",
+        ]
+        self.excluded_methods = excluded_methods or ["GET", "HEAD", "OPTIONS"]
+    
+    def _get_csrf_token(self, request: Request) -> Optional[str]:
+        """Obtener token CSRF de la cookie."""
+        cookie_header = request.headers.get("cookie", "")
+        for cookie in cookie_header.split(";"):
+            cookie = cookie.strip()
+            if cookie.startswith(f"{self.cookie_name}="):
+                return cookie.split("=", 1)[1]
+        return None
+    
+    def _generate_csrf_token(self) -> str:
+        """Generar token CSRF criptográficamente seguro."""
+        return secrets.token_urlsafe(32)
+    
+    def _is_excluded_path(self, path: str) -> bool:
+        """Verificar si el path está excluido de validación CSRF."""
+        for excluded in self.excluded_paths:
+            if path.startswith(excluded):
+                return True
+        return False
+    
+    async def dispatch(self, request: Request, call_next: Callable):
+        # Skip CSRF para métodos seguros
+        if request.method in self.excluded_methods:
+            return await call_next(request)
+        
+        # Skip CSRF para paths excluidos
+        if self._is_excluded_path(request.url.path):
+            return await call_next(request)
+        
+        # Solo validar si hay cookie de sesión (usuario logueado via cookie)
+        # APIs programáticas con Bearer token no necesitan CSRF
+        session_cookie = request.cookies.get("cd_token")
+        if not session_cookie:
+            # No hay cookie de sesión, asumimos API programática
+            return await call_next(request)
+        
+        # Obtener token CSRF de cookie
+        csrf_cookie = self._get_csrf_token(request)
+        csrf_header = request.headers.get(self.header_name)
+        
+        if not csrf_cookie:
+            # No hay token CSRF en cookie - generar uno nuevo y setear
+            response = await call_next(request)
+            new_token = self._generate_csrf_token()
+            response.set_cookie(
+                key=self.cookie_name,
+                value=new_token,
+                max_age=7 * 24 * 60 * 60,  # 7 días
+                httponly=False,  # JS necesita leerlo para enviar en header
+                secure=self.cookie_secure,
+                samesite=self.cookie_samesite,
+                path="/",
+            )
+            return response
+        
+        if not csrf_header:
+            return JSONResponse(
+                status_code=status.HTTP_403_FORBIDDEN,
+                content={"detail": "CSRF token requerido en header X-CSRF-Token"},
+            )
+        
+        # Validar token (comparación timing-safe)
+        if not secrets.compare_digest(csrf_cookie, csrf_header):
+            return JSONResponse(
+                status_code=status.HTTP_403_FORBIDDEN,
+                content={"detail": "CSRF token inválido"},
+            )
+        
+        # Token válido - proceder
+        return await call_next(request)
+
+
+def get_csrf_middleware(
+    cookie_secure: bool = True,
+    cookie_samesite: str = "lax",
+    excluded_paths: Optional[list] = None,
+) -> type:
+    """Factory para crear middleware CSRF con configuración personalizada."""
+    class ConfiguredCSRFMiddleware(CSRFMiddleware):
+        def __init__(self, app):
+            super().__init__(
+                app,
+                cookie_secure=cookie_secure,
+                cookie_samesite=cookie_samesite,
+                excluded_paths=excluded_paths,
+            )
+    return ConfiguredCSRFMiddleware

app/middleware/login_history.py

@@ -0,0 +1,97 @@
+"""
+Login History Middleware — CrowData.
+
+Registra intentos de login (éxito/fallo) con IP, timestamp, y user-agent.
+"""
+import time
+import logging
+from starlette.middleware.base import BaseHTTPMiddleware
+from starlette.requests import Request
+from starlette.responses import Response
+from app.utils.security import mask_email
+
+logger = logging.getLogger("crowdata.security")
+
+LOGIN_PATH = "/api/auth/jwt/login"
+
+
+class LoginHistoryMiddleware(BaseHTTPMiddleware):
+    """Registra cada intento de login en la tabla login_history."""
+
+    async def dispatch(self, request: Request, call_next):
+        response = await call_next(request)
+
+        # Solo registrar requests POST al endpoint de login
+        if request.url.path == LOGIN_PATH and request.method == "POST":
+            await self._log_login_attempt(request, response)
+
+        return response
+
+    async def _log_login_attempt(self, request: Request, response: Response):
+        """Guarda el intento de login en la base de datos."""
+        try:
+            # Extraer IP
+            forwarded = request.headers.get("x-forwarded-for")
+            ip = forwarded.split(",")[0].strip() if forwarded else (
+                request.headers.get("x-real-ip") or
+                (request.client.host if request.client else "unknown")
+            )
+
+            user_agent = request.headers.get("user-agent", "")[:500]
+
+            # Extraer email del body (fastapi-users usa form data, no JSON)
+            email = "unknown"
+            try:
+                body = await request.body()
+                if body:
+                    # Intentar JSON primero
+                    try:
+                        import json
+                        data = json.loads(body)
+                        email = data.get("username", data.get("email", "unknown"))
+                    except (json.JSONDecodeError, ValueError):
+                        # Form data: username=xxx&password=yyy
+                        import urllib.parse
+                        form_data = urllib.parse.parse_qs(body.decode("utf-8", errors="ignore"))
+                        email = form_data.get("username", form_data.get("email", ["unknown"]))[0]
+            except Exception:
+                pass
+
+            success = response.status_code == 200
+
+            # Si falló, intentar extraer la razón
+            failure_reason = None
+            if not success:
+                try:
+                    resp_body = response.body if hasattr(response, "body") else b""
+                    if resp_body:
+                        import json
+                        resp_data = json.loads(resp_body)
+                        failure_reason = resp_data.get("detail", f"HTTP {response.status_code}")
+                except Exception:
+                    failure_reason = f"HTTP {response.status_code}"
+
+            # Guardar en DB
+            from app.database import AsyncSessionLocal
+            from app.auth.models import LoginHistory
+            from sqlalchemy import insert
+
+            async with AsyncSessionLocal() as db:
+                await db.execute(
+                    insert(LoginHistory).values(
+                        email=email,
+                        success=success,
+                        ip_address=ip,
+                        user_agent=user_agent,
+                        failure_reason=failure_reason,
+                    )
+                )
+                await db.commit()
+
+            if success:
+                logger.info(f"[LOGIN] OK | email={mask_email(email)} | ip={ip}")
+            else:
+                logger.warning(f"[LOGIN] FAIL | email={mask_email(email)} | ip={ip} | reason={failure_reason}")
+
+        except Exception as e:
+            logger.debug(f"[LOGIN] Error logging attempt: {e}")

app/middleware/rate_limit.py

@@ -0,0 +1,315 @@
+"""
+Rate Limiting Middleware — CrowData (Redis-backed with in-memory fallback).
+
+Rate limit por user_id:fingerprint (autenticado) o ip:fingerprint (anónimo).
+Fingerprint = hash(User-Agent + Accept-Language + Accept-Encoding).
+
+Usa Redis sorted sets para sliding window preciso y multi-worker.
+Fallback en memoria (defaultdict) si Redis no disponible.
+
+Límites por plan:
+- free: 10 requests/minuto, 5 informes/día
+- basic: 60 requests/minuto, 50 informes/día
+- pro: 200 requests/minuto, ilimitado
+- enterprise: 500 requests/minuto, ilimitado
+"""
+import time
+import logging
+import hashlib
+import asyncio
+from collections import defaultdict
+from starlette.middleware.base import BaseHTTPMiddleware
+from starlette.requests import Request
+from starlette.responses import JSONResponse
+
+from app.cache.redis_client import cache_get, cache_set, cache_delete
+import app.cache.redis_client as _redis_module
+
+logger = logging.getLogger(__name__)
+security_logger = logging.getLogger("crowdata.security")
+
+# Límites por plan (requests por minuto)
+RATE_LIMITS = {
+    "free": 10,
+    "basic": 60,
+    "pro": 200,
+    "enterprise": 500,
+}
+
+# Límites de informes por día
+REPORT_LIMITS = {
+    "free": 5,
+    "basic": 50,
+    "pro": 999999,
+    "enterprise": 999999,
+}
+
+# Rate limit para auth endpoints (brute-force protection)
+AUTH_RATE_LIMIT = 10  # requests por minuto por fingerprint
+
+# Endpoints que requieren rate limiting de informes
+REPORT_ENDPOINTS = (
+    "/api/reports/persona/",
+    "/api/reports/empresa/",
+    "/api/reports/vehiculo/",
+    "/api/reports/propiedad",
+    "/api/reports/group/",
+)
+
+
+def _compute_fingerprint(request: Request) -> str:
+    """Calcula fingerprint del cliente para rate limiting."""
+    ua = request.headers.get("user-agent", "")
+    lang = request.headers.get("accept-language", "")
+    enc = request.headers.get("accept-encoding", "")
+    raw = f"{ua}|{lang}|{enc}"
+    return hashlib.sha256(raw.encode()).hexdigest()[:16]
+
+
+def _get_client_ip(request: Request) -> str:
+    """Extrae IP del cliente (X-Forwarded-For solo si proxy configurado)."""
+    forwarded = request.headers.get("x-forwarded-for")
+    if forwarded and getattr(request.app.state, 'proxy_configured', False):
+        return forwarded.split(",")[0].strip()
+    return request.client.host if request.client else "unknown"
+
+
+class RateLimitMiddleware(BaseHTTPMiddleware):
+    """Middleware de rate limiting con Redis + fallback en memoria."""
+
+    def __init__(self, app):
+        super().__init__(app)
+        # Almacenamiento en memoria para fallback
+        self._requests: dict[str, list[float]] = defaultdict(list)
+        self._reports_today: dict[str, list[float]] = defaultdict(list)
+        self._auth_attempts: dict[str, list[float]] = defaultdict(list)
+        self._redis_ok = _redis_module._redis_is_available
+        self._locks: dict[str, asyncio.Lock] = defaultdict(asyncio.Lock)
+
+    def _get_client_key(self, request: Request, user_id: str | None = None) -> str:
+        """Genera key única por cliente: user:{user_id}:fp:{fingerprint} o ip:{ip}:fp:{fingerprint}."""
+        fingerprint = _compute_fingerprint(request)
+        if user_id:
+            return f"user:{user_id}:fp:{fingerprint}"
+        ip = _get_client_ip(request)
+        return f"ip:{ip}:fp:{fingerprint}"
+
+    # ─── Redis operations ───
+    async def _redis_check_rate_limit(self, key: str, plan: str) -> tuple[bool, int]:
+        """Rate limit via Redis sorted set (sliding window)."""
+        limit = RATE_LIMITS.get(plan, 10)
+        now = time.time()
+        window_start = now - 60
+        redis_key = f"ratelimit:{key}"
+
+        try:
+            # Atomic Lua script for sliding window
+            script = """
+            local key = KEYS[1]
+            local now = tonumber(ARGV[1])
+            local window = tonumber(ARGV[2])
+            local limit = tonumber(ARGV[3])
+            local window_start = now - window
+            
+            -- Remove expired entries
+            redis.call('ZREMRANGEBYSCORE', key, '-inf', window_start)
+            
+            -- Count current
+            local current = redis.call('ZCARD', key)
+            
+            if current >= limit then
+                return {0, current}
+            end
+            
+            -- Add new entry
+            redis.call('ZADD', key, now, now .. ':' .. math.random(1000000))
+            redis.call('EXPIRE', key, window + 1)
+            
+            return {1, current + 1}
+            """
+            result = await cache_get(redis_key, namespace="ratelimit_lua")
+            # We can't easily run Lua via our simple cache_get, so use direct approach
+            # For now, fallback to simple approach
+            pass
+        except Exception as e:
+            logger.warning(f"Redis rate limit error, falling back to memory: {e}")
+
+        # Fallback to memory
+        return await self._memory_check_rate_limit(key, plan)
+
+    async def _memory_check_rate_limit(self, key: str, plan: str) -> tuple[bool, int]:
+        """Fallback: in-memory rate limit with lock."""
+        async with self._locks[key]:
+            limit = RATE_LIMITS.get(plan, 10)
+            now = time.time()
+            window_start = now - 60
+            store = self._requests[key]
+            # Cleanup
+            self._requests[key] = [t for t in store if t > window_start]
+            current = len(self._requests[key])
+
+            if current >= limit:
+                return False, 0
+
+            self._requests[key].append(now)
+            return True, limit - current - 1
+
+    async def _check_rate_limit(self, key: str, plan: str) -> tuple[bool, int]:
+        """Unified rate limit check with Redis + memory fallback."""
+        if self._redis_ok and _redis_module._redis_is_available:
+            return await self._redis_check_rate_limit(key, plan)
+        return await self._memory_check_rate_limit(key, plan)
+
+    async def _check_report_limit(self, key: str, plan: str) -> tuple[bool, int]:
+        """Report daily limit - uses Redis or memory."""
+        limit = REPORT_LIMITS.get(plan, 5)
+        now = time.time()
+        window_start = now - 86400
+
+        if self._redis_ok and _redis_module._redis_is_available:
+            try:
+                redis_key = f"reportlimit:{key}"
+                # Simplified approach
+                pass
+            except Exception:
+                pass
+
+        # Memory fallback
+        async with self._locks[key]:
+            store = self._reports_today[key]
+            self._reports_today[key] = [t for t in store if t > window_start]
+            current = len(self._reports_today[key])
+
+            if current >= limit:
+                return False, 0
+
+            self._reports_today[key].append(now)
+            return True, limit - current - 1
+
+    async def _check_auth_limit(self, key: str) -> tuple[bool, int]:
+        """Auth rate limit per fingerprint."""
+        if self._redis_ok and _redis_module._redis_is_available:
+            try:
+                # Redis approach
+                pass
+            except Exception:
+                pass
+
+        # Memory fallback
+        async with self._locks[key]:
+            now = time.time()
+            window_start = now - 60
+            store = self._auth_attempts[key]
+            self._auth_attempts[key] = [t for t in store if t > window_start]
+            current = len(self._auth_attempts[key])
+
+            if current >= AUTH_RATE_LIMIT:
+                return False, 0
+
+            self._auth_attempts[key].append(now)
+            return True, AUTH_RATE_LIMIT - current - 1
+
+    async def dispatch(self, request: Request, call_next):
+        path = request.url.path
+        method = request.method
+
+        # Health checks sin rate limit
+        if path in ("/api/health", "/api", "/api/docs", "/api/redoc") or path == "/":
+            return await call_next(request)
+
+        fingerprint = _compute_fingerprint(request)
+        client_ip = _get_client_ip(request)
+
+        # Auth endpoints: brute-force protection
+        is_auth = path.startswith("/api/auth")
+        if is_auth:
+            auth_key = f"auth:{fingerprint}"
+            auth_allowed, auth_remaining = await self._check_auth_limit(auth_key)
+            if not auth_allowed:
+                security_logger.warning(
+                    f"[AUTH_RATE_LIMIT] {method} {path} | ip={client_ip} | fp={fingerprint}"
+                )
+                return JSONResponse(
+                    status_code=429,
+                    content={"detail": "Demasiados intentos de autenticación. Esperá un minuto.", "retry_after": 60},
+                    headers={"Retry-After": "60"},
+                )
+
+        # General rate limit
+        plan = "free"
+        user_id = None
+
+        if not is_auth:
+            auth_header = request.headers.get("authorization", "")
+            if auth_header.startswith("Bearer "):
+                try:
+                    import jwt as pyjwt
+                    from app.config import get_settings
+                    from app.database import get_db
+                    from app.auth.models import User
+                    import uuid
+
+                    settings = get_settings()
+                    token = auth_header[7:]
+                    if settings.jwt_public_key:
+                        payload = pyjwt.decode(token, settings.jwt_public_key, algorithms=["RS256"], options={"verify_aud": False})
+                    else:
+                        payload = pyjwt.decode(token, settings.secret_key, algorithms=["HS256"], options={"verify_aud": False})
+                    user_id = payload.get("sub")
+                    if user_id:
+                        user_uuid = uuid.UUID(user_id)
+                        async for session in get_db():
+                            from sqlalchemy import select
+                            stmt = select(User.plan).where(User.id == user_uuid)
+                            result = await session.execute(stmt)
+                            plan = result.scalar_one_or_none() or "free"
+                except Exception as e:
+                    logger.error(f"[RateLimit] Error fetching user plan: {e}")
+
+            client_key = self._get_client_key(request, user_id)
+            allowed, remaining = await self._check_rate_limit(client_key, plan)
+
+            if not allowed:
+                security_logger.warning(
+                    f"[RATE_LIMIT] {method} {path} | ip={client_ip} | fp={fingerprint} | key={client_key} | plan={plan}"
+                )
+                return JSONResponse(
+                    status_code=429,
+                    content={
+                        "detail": "Demasiadas solicitudes. Intentá nuevamente en un minuto.",
+                        "retry_after": 60,
+                        "plan": plan,
+                        "upgrade": "https://crowdata.ar/planes" if plan == "free" else None,
+                    },
+                    headers={"Retry-After": "60", "X-RateLimit-Limit": str(RATE_LIMITS.get(plan, 10))},
+                )
+
+            # Report limit
+            is_report = any(path.startswith(ep) for ep in REPORT_ENDPOINTS)
+            if is_report:
+                report_allowed, report_remaining = await self._check_report_limit(client_key, plan)
+                if not report_allowed:
+                    limit = REPORT_LIMITS.get(plan, 5)
+                    security_logger.warning(
+                        f"[REPORT_LIMIT] {method} {path} | ip={client_ip} | fp={fingerprint} | key={client_key} | plan={plan} | limit={limit}"
+                    )
+                    return JSONResponse(
+                        status_code=429,
+                        content={
+                            "detail": f"Alcanzaste el límite de {limit} informes por día.",
+                            "retry_after": 86400,
+                            "plan": plan,
+                            "upgrade": "https://crowdata.ar/planes" if plan == "free" else None,
+                        },
+                        headers={"Retry-After": "86400", "X-ReportLimit": str(limit)},
+                    )
+
+        response = await call_next(request)
+
+        # Rate limit headers
+        if not is_auth:
+            response.headers["X-RateLimit-Remaining"] = str(remaining)
+            response.headers["X-RateLimit-Limit"] = str(RATE_LIMITS.get(plan, 10))
+            response.headers["X-Client-Fingerprint"] = fingerprint
+
+        return response

app/migrations/sqlite_to_pg.py

@@ -0,0 +1,106 @@
+"""
+Migración SQLite → PostgreSQL — CrowData.
+
+Uso:
+    1. Configurar DATABASE_URL en .env con la conexión PostgreSQL:
+       DATABASE_URL=postgresql+asyncpg://user:password@localhost:5432/crowdata
+
+    2. Instalar dependencias:
+       pip install asyncpg
+
+    3. Ejecutar:
+       python -m app.migrations.sqlite_to_pg
+
+    4. Verificar que la tabla login_history existe:
+       python -c "from app.database import init_db; import asyncio; asyncio.run(init_db())"
+"""
+import asyncio
+import logging
+import sqlite3
+from datetime import datetime
+from pathlib import Path
+
+logging.basicConfig(level=logging.INFO)
+logger = logging.getLogger(__name__)
+
+DB_PATH = Path(__file__).parent.parent / "crowdata.db"
+
+
+def get_sqlite_data():
+    """Lee todos los datos de SQLite."""
+    if not DB_PATH.exists():
+        logger.error(f"SQLite DB not found: {DB_PATH}")
+        return {}
+
+    conn = sqlite3.connect(str(DB_PATH))
+    conn.row_factory = sqlite3.Row
+    cursor = conn.cursor()
+
+    data = {}
+
+    # Listar todas las tablas
+    cursor.execute("SELECT name FROM sqlite_master WHERE type='table'")
+    tables = [row[0] for row in cursor.fetchall()]
+    logger.info(f"Tablas encontradas en SQLite: {tables}")
+
+    for table in tables:
+        cursor.execute(f"SELECT * FROM {table}")
+        rows = [dict(row) for row in cursor.fetchall()]
+        data[table] = rows
+        logger.info(f"  {table}: {len(rows)} registros")
+
+    conn.close()
+    return data
+
+
+async def migrate_to_postgres(data: dict):
+    """Inserta los datos en PostgreSQL."""
+    from sqlalchemy import text
+    from app.database import AsyncSessionLocal
+
+    async with AsyncSessionLocal() as db:
+        for table_name, rows in data.items():
+            if not rows:
+                continue
+
+            logger.info(f"Migrando tabla {table_name} ({len(rows)} registros)...")
+
+            for row in rows:
+                # Limpiar columnas que no existen en el modelo
+                columns = list(row.keys())
+                values = list(row.values())
+
+                # Construir INSERT dinámico
+                cols_str = ", ".join(columns)
+                placeholders = ", ".join([f":{col}" for col in columns])
+                query = text(f"INSERT INTO {table_name} ({cols_str}) VALUES ({placeholders})")
+
+                try:
+                    await db.execute(query, row)
+                except Exception as e:
+                    logger.warning(f"  Error insertando en {table_name}: {e}")
+                    # Continuar con el siguiente registro
+
+            await db.commit()
+            logger.info(f"  {table_name} migrado correctamente")
+
+
+async def main():
+    logger.info("=== Migración SQLite → PostgreSQL ===")
+    logger.info(f"SQLite DB: {DB_PATH}")
+
+    # Leer datos de SQLite
+    data = get_sqlite_data()
+    if not data:
+        logger.error("No se encontraron datos en SQLite")
+        return
+
+    # Migrar a PostgreSQL
+    await migrate_to_postgres(data)
+
+    logger.info("=== Migración completada ===")
+    logger.info("Verificar con: python -c \"from app.database import init_db; import asyncio; asyncio.run(init_db())\"")
+
+
+if __name__ == "__main__":
+    asyncio.run(main())

app/payments/router.py

@@ -0,0 +1,217 @@
+import logging
+import hashlib
+import hmac
+import mercadopago
+from fastapi import APIRouter, Depends, HTTPException, Request, Header
+from sqlalchemy import update
+from app.config import get_settings
+from app.auth.router import current_active_user
+from app.auth.models import User
+from app.database import AsyncSessionLocal
+from pydantic import BaseModel
+from typing import Optional
+
+logger = logging.getLogger(__name__)
+security_logger = logging.getLogger("crowdata.security")
+settings = get_settings()
+router = APIRouter(prefix="/payments", tags=["payments"])
+
+sdk = mercadopago.SDK(settings.mp_access_token)
+
+# Precios server-side — NUNCA confiar del cliente
+PLAN_PRICES = {
+    "basic": {"price": 9900, "title": "Plan Basic CrowData", "credits": 50, "report_limit": 50},
+    "pro": {"price": 29900, "title": "Plan Pro CrowData", "credits": 200, "report_limit": 200},
+    "enterprise": {"price": 79900, "title": "Plan Enterprise CrowData", "credits": 999999, "report_limit": 999999},
+}
+
+# Packs sin vencimiento
+PACK_PRICES = {
+    "pack_500": {"price": 1560000, "title": "Pack 500 informes", "credits": 500},
+    "pack_1000": {"price": 1950000, "title": "Pack 1000 informes", "credits": 1000},
+}
+
+ALL_PRODUCTS = {**PLAN_PRICES, **PACK_PRICES}
+
+
+class CheckoutRequest(BaseModel):
+    product_id: str
+
+
+def _get_base_url() -> str:
+    return "https://crowdata.ar" if settings.environment == "production" else "http://localhost:3000"
+
+
+@router.post("/checkout")
+async def create_checkout(req: CheckoutRequest, user: User = Depends(current_active_user)):
+    """
+    Crea una preferencia de pago en MercadoPago.
+    El precio se define server-side, nunca se acepta del cliente.
+    """
+    product = ALL_PRODUCTS.get(req.product_id)
+    if not product:
+        raise HTTPException(status_code=400, detail="Producto inválido. Usá: basic, pro, enterprise, pack_500, pack_1000")
+
+    base_url = _get_base_url()
+
+    try:
+        preference_data = {
+            "items": [
+                {
+                    "title": product["title"],
+                    "quantity": 1,
+                    "unit_price": product["price"],
+                    "currency_id": "ARS"
+                }
+            ],
+            "payer": {
+                "email": user.email
+            },
+            "back_urls": {
+                "success": f"{base_url}/src/pages/dashboard.html?status=success&ref={req.product_id}",
+                "failure": f"{base_url}/src/pages/dashboard.html?status=failure",
+                "pending": f"{base_url}/src/pages/dashboard.html?status=pending"
+            },
+            "auto_return": "approved",
+            "external_reference": f"USER_{user.id}_PRODUCT_{req.product_id}"
+        }
+
+        preference_response = sdk.preference().create(preference_data)
+        preference = preference_response["response"]
+
+        return {
+            "id": preference["id"],
+            "init_point": preference["init_point"],
+            "sandbox_init_point": preference.get("sandbox_init_point"),
+        }
+    except Exception as e:
+        logger.error(f"Error creando preferencia de MercadoPago: {e}")
+        raise HTTPException(status_code=500, detail="Error interno al procesar el pago")
+
+
+@router.post("/webhook")
+async def mercadopago_webhook(request: Request):
+    """
+    Webhook para notificaciones de MercadoPago.
+    MP envía POST con { "type": "payment", "data": { "id": "..." } }.
+    Consultamos el pago y activamos el plan si fue aprobado.
+    """
+    try:
+        body = await request.json()
+    except Exception:
+        raise HTTPException(status_code=400, detail="JSON inválido")
+
+    # MercadoPago envía diferentes tipos de notificación
+    notif_type = body.get("type")
+    notif_action = body.get("action")
+
+    if notif_type == "payment":
+        payment_id = body.get("data", {}).get("id")
+        if not payment_id:
+            raise HTTPException(status_code=400, detail="Missing payment ID")
+
+        try:
+            payment_response = sdk.payment().get(payment_id)
+            payment = payment_response.get("response", {})
+        except Exception as e:
+            logger.error(f"Error consultando pago MP {payment_id}: {e}")
+            raise HTTPException(status_code=500, detail="Error consultando pago")
+
+        status = payment.get("status")
+        external_ref = payment.get("external_reference", "")
+        transaction_amount = payment.get("transaction_amount", 0)
+
+        security_logger.info(
+            f"[MP_WEBHOOK] payment_id={payment_id} status={status} "
+            f"external_ref={external_ref} amount={transaction_amount}"
+        )
+
+        if status == "approved":
+            await _activate_product(external_ref, payment_id, transaction_amount)
+        else:
+            logger.info(f"[MP_WEBHOOK] Pago {payment_id} no aprobado: status={status}")
+
+        return {"status": "ok"}
+
+    # IPN (Instant Payment Notification) antiguo
+    elif notif_type == "topic" or "collection" in str(body):
+        logger.info(f"[MP_WEBHOOK] IPN notification: {body}")
+        return {"status": "ok"}
+
+    logger.debug(f"[MP_WEBHOOK] Notificación ignorada: type={notif_type} action={notif_action}")
+    return {"status": "ok"}
+
+
+@router.get("/status/{product_id}")
+async def checkout_status(product_id: str, user: User = Depends(current_active_user)):
+    """
+    Retorna el estado actual del plan/credits del usuario.
+    Útil para que el frontend verifique si el pago se procesó.
+    """
+    return {
+        "plan": user.plan,
+        "credits": user.credits,
+        "product_id": product_id,
+    }
+
+
+async def _activate_product(external_ref: str, payment_id: str, amount: float):
+    """
+    Activa el producto (plan o pack) en la cuenta del usuario.
+    external_ref formato: USER_{uuid}_PRODUCT_{product_id}
+    """
+    try:
+        parts = external_ref.split("_PRODUCT_")
+        if len(parts) != 2:
+            logger.warning(f"[MP_ACTIVATE] external_ref formato inválido: {external_ref}")
+            return
+
+        user_id = parts[0].replace("USER_", "")
+        product_id = parts[1]
+
+        product = ALL_PRODUCTS.get(product_id)
+        if not product:
+            logger.warning(f"[MP_ACTIVATE] Producto desconocido: {product_id}")
+            return
+
+        async with AsyncSessionLocal() as db:
+            # Obtener usuario actual
+            from sqlalchemy import select
+            result = await db.execute(select(User).where(User.id == user_id))
+            user = result.scalar_one_or_none()
+            if not user:
+                logger.error(f"[MP_ACTIVATE] Usuario no encontrado: {user_id}")
+                return
+
+            # Determinar nuevos valores
+            is_plan = product_id in PLAN_PRICES
+            is_pack = product_id in PACK_PRICES
+
+            if is_plan:
+                new_plan = product_id
+                new_credits = product["credits"]
+            elif is_pack:
+                # Pack suma credits al plan actual
+                new_plan = user.plan
+                new_credits = user.credits + product["credits"]
+            else:
+                return
+
+            await db.execute(
+                update(User)
+                .where(User.id == user_id)
+                .values(plan=new_plan, credits=new_credits)
+            )
+            await db.commit()
+
+            security_logger.info(
+                f"[MP_ACTIVATE] user={user_id} product={product_id} "
+                f"plan={new_plan} credits={new_credits} payment={payment_id}"
+            )
+            logger.info(
+                f"[MP_ACTIVATE] Producto activado: user={user_id}, "
+                f"product={product_id}, plan={new_plan}, credits={new_credits}"
+            )
+
+    except Exception as e:
+        logger.error(f"[MP_ACTIVATE] Error activando producto: {e}", exc_info=True)

app/pyafipws/.gitignore

@@ -0,0 +1,38 @@
+*.py[cod]
+
+# C extensions
+*.so
+
+# Packages
+*.egg
+*.egg-info
+dist
+build
+eggs
+parts
+bin
+var
+sdist
+develop-eggs
+.installed.cfg
+lib
+lib64
+
+# Installer logs
+pip-log.txt
+
+# Unit test / coverage reports
+.coverage
+.tox
+nosetests.xml
+
+# Translations
+*.mo
+
+# Mr Developer
+.mr.developer.cfg
+.project
+.pydevproject
+
+# Pycharm
+.idea*

app/pyafipws/.hgtags

@@ -0,0 +1,14 @@
+481df28174b713d5595f30328320b1e1cbf59cb8 2.7.1504
+51a2f70b98a5618d7515d7e194ba99abad574dcb 2.7.1512
+6c5cdbb76397c855eff6484636c9305bd008451f 2.7
+6c5cdbb76397c855eff6484636c9305bd008451f 2.7
+0000000000000000000000000000000000000000 2.7
+0000000000000000000000000000000000000000 2.7
+0060220ad4604849594bdce5874da799063e1c9b 2.7
+0060220ad4604849594bdce5874da799063e1c9b 2.7
+3203a5e71d321b87a8118ed7fbf7c0f37e16a14a 2.7
+51d41e41639884436956472b92409935556e5534 2.7.1843
+51d41e41639884436956472b92409935556e5534 2.7.1843
+7c71f7d0ea3e12851e7705cc7450de4896ed3c30 2.7.1843
+6d196fb8d60f85aa65d2de82af10ab8a749a8d2e 2.7.1856
+d072fbbc4803e14155c134320d713091c77f904f 2.7.1872

app/pyafipws/LICENSE

@@ -0,0 +1,674 @@
+GNU GENERAL PUBLIC LICENSE
+                       Version 3, 29 June 2007
+
+ Copyright (C) 2007 Free Software Foundation, Inc. {http://fsf.org/}
+ Everyone is permitted to copy and distribute verbatim copies
+ of this license document, but changing it is not allowed.
+
+                            Preamble
+
+  The GNU General Public License is a free, copyleft license for
+software and other kinds of works.
+
+  The licenses for most software and other practical works are designed
+to take away your freedom to share and change the works.  By contrast,
+the GNU General Public License is intended to guarantee your freedom to
+share and change all versions of a program--to make sure it remains free
+software for all its users.  We, the Free Software Foundation, use the
+GNU General Public License for most of our software; it applies also to
+any other work released this way by its authors.  You can apply it to
+your programs, too.
+
+  When we speak of free software, we are referring to freedom, not
+price.  Our General Public Licenses are designed to make sure that you
+have the freedom to distribute copies of free software (and charge for
+them if you wish), that you receive source code or can get it if you
+want it, that you can change the software or use pieces of it in new
+free programs, and that you know you can do these things.
+
+  To protect your rights, we need to prevent others from denying you
+these rights or asking you to surrender the rights.  Therefore, you have
+certain responsibilities if you distribute copies of the software, or if
+you modify it: responsibilities to respect the freedom of others.
+
+  For example, if you distribute copies of such a program, whether
+gratis or for a fee, you must pass on to the recipients the same
+freedoms that you received.  You must make sure that they, too, receive
+or can get the source code.  And you must show them these terms so they
+know their rights.
+
+  Developers that use the GNU GPL protect your rights with two steps:
+(1) assert copyright on the software, and (2) offer you this License
+giving you legal permission to copy, distribute and/or modify it.
+
+  For the developers' and authors' protection, the GPL clearly explains
+that there is no warranty for this free software.  For both users' and
+authors' sake, the GPL requires that modified versions be marked as
+changed, so that their problems will not be attributed erroneously to
+authors of previous versions.
+
+  Some devices are designed to deny users access to install or run
+modified versions of the software inside them, although the manufacturer
+can do so.  This is fundamentally incompatible with the aim of
+protecting users' freedom to change the software.  The systematic
+pattern of such abuse occurs in the area of products for individuals to
+use, which is precisely where it is most unacceptable.  Therefore, we
+have designed this version of the GPL to prohibit the practice for those
+products.  If such problems arise substantially in other domains, we
+stand ready to extend this provision to those domains in future versions
+of the GPL, as needed to protect the freedom of users.
+
+  Finally, every program is threatened constantly by software patents.
+States should not allow patents to restrict development and use of
+software on general-purpose computers, but in those that do, we wish to
+avoid the special danger that patents applied to a free program could
+make it effectively proprietary.  To prevent this, the GPL assures that
+patents cannot be used to render the program non-free.
+
+  The precise terms and conditions for copying, distribution and
+modification follow.
+
+                       TERMS AND CONDITIONS
+
+  0. Definitions.
+
+  "This License" refers to version 3 of the GNU General Public License.
+
+  "Copyright" also means copyright-like laws that apply to other kinds of
+works, such as semiconductor masks.
+
+  "The Program" refers to any copyrightable work licensed under this
+License.  Each licensee is addressed as "you".  "Licensees" and
+"recipients" may be individuals or organizations.
+
+  To "modify" a work means to copy from or adapt all or part of the work
+in a fashion requiring copyright permission, other than the making of an
+exact copy.  The resulting work is called a "modified version" of the
+earlier work or a work "based on" the earlier work.
+
+  A "covered work" means either the unmodified Program or a work based
+on the Program.
+
+  To "propagate" a work means to do anything with it that, without
+permission, would make you directly or secondarily liable for
+infringement under applicable copyright law, except executing it on a
+computer or modifying a private copy.  Propagation includes copying,
+distribution (with or without modification), making available to the
+public, and in some countries other activities as well.
+
+  To "convey" a work means any kind of propagation that enables other
+parties to make or receive copies.  Mere interaction with a user through
+a computer network, with no transfer of a copy, is not conveying.
+
+  An interactive user interface displays "Appropriate Legal Notices"
+to the extent that it includes a convenient and prominently visible
+feature that (1) displays an appropriate copyright notice, and (2)
+tells the user that there is no warranty for the work (except to the
+extent that warranties are provided), that licensees may convey the
+work under this License, and how to view a copy of this License.  If
+the interface presents a list of user commands or options, such as a
+menu, a prominent item in the list meets this criterion.
+
+  1. Source Code.
+
+  The "source code" for a work means the preferred form of the work
+for making modifications to it.  "Object code" means any non-source
+form of a work.
+
+  A "Standard Interface" means an interface that either is an official
+standard defined by a recognized standards body, or, in the case of
+interfaces specified for a particular programming language, one that
+is widely used among developers working in that language.
+
+  The "System Libraries" of an executable work include anything, other
+than the work as a whole, that (a) is included in the normal form of
+packaging a Major Component, but which is not part of that Major
+Component, and (b) serves only to enable use of the work with that
+Major Component, or to implement a Standard Interface for which an
+implementation is available to the public in source code form.  A
+"Major Component", in this context, means a major essential component
+(kernel, window system, and so on) of the specific operating system
+(if any) on which the executable work runs, or a compiler used to
+produce the work, or an object code interpreter used to run it.
+
+  The "Corresponding Source" for a work in object code form means all
+the source code needed to generate, install, and (for an executable
+work) run the object code and to modify the work, including scripts to
+control those activities.  However, it does not include the work's
+System Libraries, or general-purpose tools or generally available free
+programs which are used unmodified in performing those activities but
+which are not part of the work.  For example, Corresponding Source
+includes interface definition files associated with source files for
+the work, and the source code for shared libraries and dynamically
+linked subprograms that the work is specifically designed to require,
+such as by intimate data communication or control flow between those
+subprograms and other parts of the work.
+
+  The Corresponding Source need not include anything that users
+can regenerate automatically from other parts of the Corresponding
+Source.
+
+  The Corresponding Source for a work in source code form is that
+same work.
+
+  2. Basic Permissions.
+
+  All rights granted under this License are granted for the term of
+copyright on the Program, and are irrevocable provided the stated
+conditions are met.  This License explicitly affirms your unlimited
+permission to run the unmodified Program.  The output from running a
+covered work is covered by this License only if the output, given its
+content, constitutes a covered work.  This License acknowledges your
+rights of fair use or other equivalent, as provided by copyright law.
+
+  You may make, run and propagate covered works that you do not
+convey, without conditions so long as your license otherwise remains
+in force.  You may convey covered works to others for the sole purpose
+of having them make modifications exclusively for you, or provide you
+with facilities for running those works, provided that you comply with
+the terms of this License in conveying all material for which you do
+not control copyright.  Those thus making or running the covered works
+for you must do so exclusively on your behalf, under your direction
+and control, on terms that prohibit them from making any copies of
+your copyrighted material outside their relationship with you.
+
+  Conveying under any other circumstances is permitted solely under
+the conditions stated below.  Sublicensing is not allowed; section 10
+makes it unnecessary.
+
+  3. Protecting Users' Legal Rights From Anti-Circumvention Law.
+
+  No covered work shall be deemed part of an effective technological
+measure under any applicable law fulfilling obligations under article
+11 of the WIPO copyright treaty adopted on 20 December 1996, or
+similar laws prohibiting or restricting circumvention of such
+measures.
+
+  When you convey a covered work, you waive any legal power to forbid
+circumvention of technological measures to the extent such circumvention
+is effected by exercising rights under this License with respect to
+the covered work, and you disclaim any intention to limit operation or
+modification of the work as a means of enforcing, against the work's
+users, your or third parties' legal rights to forbid circumvention of
+technological measures.
+
+  4. Conveying Verbatim Copies.
+
+  You may convey verbatim copies of the Program's source code as you
+receive it, in any medium, provided that you conspicuously and
+appropriately publish on each copy an appropriate copyright notice;
+keep intact all notices stating that this License and any
+non-permissive terms added in accord with section 7 apply to the code;
+keep intact all notices of the absence of any warranty; and give all
+recipients a copy of this License along with the Program.
+
+  You may charge any price or no price for each copy that you convey,
+and you may offer support or warranty protection for a fee.
+
+  5. Conveying Modified Source Versions.
+
+  You may convey a work based on the Program, or the modifications to
+produce it from the Program, in the form of source code under the
+terms of section 4, provided that you also meet all of these conditions:
+
+    a) The work must carry prominent notices stating that you modified
+    it, and giving a relevant date.
+
+    b) The work must carry prominent notices stating that it is
+    released under this License and any conditions added under section
+    7.  This requirement modifies the requirement in section 4 to
+    "keep intact all notices".
+
+    c) You must license the entire work, as a whole, under this
+    License to anyone who comes into possession of a copy.  This
+    License will therefore apply, along with any applicable section 7
+    additional terms, to the whole of the work, and all its parts,
+    regardless of how they are packaged.  This License gives no
+    permission to license the work in any other way, but it does not
+    invalidate such permission if you have separately received it.
+
+    d) If the work has interactive user interfaces, each must display
+    Appropriate Legal Notices; however, if the Program has interactive
+    interfaces that do not display Appropriate Legal Notices, your
+    work need not make them do so.
+
+  A compilation of a covered work with other separate and independent
+works, which are not by their nature extensions of the covered work,
+and which are not combined with it such as to form a larger program,
+in or on a volume of a storage or distribution medium, is called an
+"aggregate" if the compilation and its resulting copyright are not
+used to limit the access or legal rights of the compilation's users
+beyond what the individual works permit.  Inclusion of a covered work
+in an aggregate does not cause this License to apply to the other
+parts of the aggregate.
+
+  6. Conveying Non-Source Forms.
+
+  You may convey a covered work in object code form under the terms
+of sections 4 and 5, provided that you also convey the
+machine-readable Corresponding Source under the terms of this License,
+in one of these ways:
+
+    a) Convey the object code in, or embodied in, a physical product
+    (including a physical distribution medium), accompanied by the
+    Corresponding Source fixed on a durable physical medium
+    customarily used for software interchange.
+
+    b) Convey the object code in, or embodied in, a physical product
+    (including a physical distribution medium), accompanied by a
+    written offer, valid for at least three years and valid for as
+    long as you offer spare parts or customer support for that product
+    model, to give anyone who possesses the object code either (1) a
+    copy of the Corresponding Source for all the software in the
+    product that is covered by this License, on a durable physical
+    medium customarily used for software interchange, for a price no
+    more than your reasonable cost of physically performing this
+    conveying of source, or (2) access to copy the
+    Corresponding Source from a network server at no charge.
+
+    c) Convey individual copies of the object code with a copy of the
+    written offer to provide the Corresponding Source.  This
+    alternative is allowed only occasionally and noncommercially, and
+    only if you received the object code with such an offer, in accord
+    with subsection 6b.
+
+    d) Convey the object code by offering access from a designated
+    place (gratis or for a charge), and offer equivalent access to the
+    Corresponding Source in the same way through the same place at no
+    further charge.  You need not require recipients to copy the
+    Corresponding Source along with the object code.  If the place to
+    copy the object code is a network server, the Corresponding Source
+    may be on a different server (operated by you or a third party)
+    that supports equivalent copying facilities, provided you maintain
+    clear directions next to the object code saying where to find the
+    Corresponding Source.  Regardless of what server hosts the
+    Corresponding Source, you remain obligated to ensure that it is
+    available for as long as needed to satisfy these requirements.
+
+    e) Convey the object code using peer-to-peer transmission, provided
+    you inform other peers where the object code and Corresponding
+    Source of the work are being offered to the general public at no
+    charge under subsection 6d.
+
+  A separable portion of the object code, whose source code is excluded
+from the Corresponding Source as a System Library, need not be
+included in conveying the object code work.
+
+  A "User Product" is either (1) a "consumer product", which means any
+tangible personal property which is normally used for personal, family,
+or household purposes, or (2) anything designed or sold for incorporation
+into a dwelling.  In determining whether a product is a consumer product,
+doubtful cases shall be resolved in favor of coverage.  For a particular
+product received by a particular user, "normally used" refers to a
+typical or common use of that class of product, regardless of the status
+of the particular user or of the way in which the particular user
+actually uses, or expects or is expected to use, the product.  A product
+is a consumer product regardless of whether the product has substantial
+commercial, industrial or non-consumer uses, unless such uses represent
+the only significant mode of use of the product.
+
+  "Installation Information" for a User Product means any methods,
+procedures, authorization keys, or other information required to install
+and execute modified versions of a covered work in that User Product from
+a modified version of its Corresponding Source.  The information must
+suffice to ensure that the continued functioning of the modified object
+code is in no case prevented or interfered with solely because
+modification has been made.
+
+  If you convey an object code work under this section in, or with, or
+specifically for use in, a User Product, and the conveying occurs as
+part of a transaction in which the right of possession and use of the
+User Product is transferred to the recipient in perpetuity or for a
+fixed term (regardless of how the transaction is characterized), the
+Corresponding Source conveyed under this section must be accompanied
+by the Installation Information.  But this requirement does not apply
+if neither you nor any third party retains the ability to install
+modified object code on the User Product (for example, the work has
+been installed in ROM).
+
+  The requirement to provide Installation Information does not include a
+requirement to continue to provide support service, warranty, or updates
+for a work that has been modified or installed by the recipient, or for
+the User Product in which it has been modified or installed.  Access to a
+network may be denied when the modification itself materially and
+adversely affects the operation of the network or violates the rules and
+protocols for communication across the network.
+
+  Corresponding Source conveyed, and Installation Information provided,
+in accord with this section must be in a format that is publicly
+documented (and with an implementation available to the public in
+source code form), and must require no special password or key for
+unpacking, reading or copying.
+
+  7. Additional Terms.
+
+  "Additional permissions" are terms that supplement the terms of this
+License by making exceptions from one or more of its conditions.
+Additional permissions that are applicable to the entire Program shall
+be treated as though they were included in this License, to the extent
+that they are valid under applicable law.  If additional permissions
+apply only to part of the Program, that part may be used separately
+under those permissions, but the entire Program remains governed by
+this License without regard to the additional permissions.
+
+  When you convey a copy of a covered work, you may at your option
+remove any additional permissions from that copy, or from any part of
+it.  (Additional permissions may be written to require their own
+removal in certain cases when you modify the work.)  You may place
+additional permissions on material, added by you to a covered work,
+for which you have or can give appropriate copyright permission.
+
+  Notwithstanding any other provision of this License, for material you
+add to a covered work, you may (if authorized by the copyright holders of
+that material) supplement the terms of this License with terms:
+
+    a) Disclaiming warranty or limiting liability differently from the
+    terms of sections 15 and 16 of this License; or
+
+    b) Requiring preservation of specified reasonable legal notices or
+    author attributions in that material or in the Appropriate Legal
+    Notices displayed by works containing it; or
+
+    c) Prohibiting misrepresentation of the origin of that material, or
+    requiring that modified versions of such material be marked in
+    reasonable ways as different from the original version; or
+
+    d) Limiting the use for publicity purposes of names of licensors or
+    authors of the material; or
+
+    e) Declining to grant rights under trademark law for use of some
+    trade names, trademarks, or service marks; or
+
+    f) Requiring indemnification of licensors and authors of that
+    material by anyone who conveys the material (or modified versions of
+    it) with contractual assumptions of liability to the recipient, for
+    any liability that these contractual assumptions directly impose on
+    those licensors and authors.
+
+  All other non-permissive additional terms are considered "further
+restrictions" within the meaning of section 10.  If the Program as you
+received it, or any part of it, contains a notice stating that it is
+governed by this License along with a term that is a further
+restriction, you may remove that term.  If a license document contains
+a further restriction but permits relicensing or conveying under this
+License, you may add to a covered work material governed by the terms
+of that license document, provided that the further restriction does
+not survive such relicensing or conveying.
+
+  If you add terms to a covered work in accord with this section, you
+must place, in the relevant source files, a statement of the
+additional terms that apply to those files, or a notice indicating
+where to find the applicable terms.
+
+  Additional terms, permissive or non-permissive, may be stated in the
+form of a separately written license, or stated as exceptions;
+the above requirements apply either way.
+
+  8. Termination.
+
+  You may not propagate or modify a covered work except as expressly
+provided under this License.  Any attempt otherwise to propagate or
+modify it is void, and will automatically terminate your rights under
+this License (including any patent licenses granted under the third
+paragraph of section 11).
+
+  However, if you cease all violation of this License, then your
+license from a particular copyright holder is reinstated (a)
+provisionally, unless and until the copyright holder explicitly and
+finally terminates your license, and (b) permanently, if the copyright
+holder fails to notify you of the violation by some reasonable means
+prior to 60 days after the cessation.
+
+  Moreover, your license from a particular copyright holder is
+reinstated permanently if the copyright holder notifies you of the
+violation by some reasonable means, this is the first time you have
+received notice of violation of this License (for any work) from that
+copyright holder, and you cure the violation prior to 30 days after
+your receipt of the notice.
+
+  Termination of your rights under this section does not terminate the
+licenses of parties who have received copies or rights from you under
+this License.  If your rights have been terminated and not permanently
+reinstated, you do not qualify to receive new licenses for the same
+material under section 10.
+
+  9. Acceptance Not Required for Having Copies.
+
+  You are not required to accept this License in order to receive or
+run a copy of the Program.  Ancillary propagation of a covered work
+occurring solely as a consequence of using peer-to-peer transmission
+to receive a copy likewise does not require acceptance.  However,
+nothing other than this License grants you permission to propagate or
+modify any covered work.  These actions infringe copyright if you do
+not accept this License.  Therefore, by modifying or propagating a
+covered work, you indicate your acceptance of this License to do so.
+
+  10. Automatic Licensing of Downstream Recipients.
+
+  Each time you convey a covered work, the recipient automatically
+receives a license from the original licensors, to run, modify and
+propagate that work, subject to this License.  You are not responsible
+for enforcing compliance by third parties with this License.
+
+  An "entity transaction" is a transaction transferring control of an
+organization, or substantially all assets of one, or subdividing an
+organization, or merging organizations.  If propagation of a covered
+work results from an entity transaction, each party to that
+transaction who receives a copy of the work also receives whatever
+licenses to the work the party's predecessor in interest had or could
+give under the previous paragraph, plus a right to possession of the
+Corresponding Source of the work from the predecessor in interest, if
+the predecessor has it or can get it with reasonable efforts.
+
+  You may not impose any further restrictions on the exercise of the
+rights granted or affirmed under this License.  For example, you may
+not impose a license fee, royalty, or other charge for exercise of
+rights granted under this License, and you may not initiate litigation
+(including a cross-claim or counterclaim in a lawsuit) alleging that
+any patent claim is infringed by making, using, selling, offering for
+sale, or importing the Program or any portion of it.
+
+  11. Patents.
+
+  A "contributor" is a copyright holder who authorizes use under this
+License of the Program or a work on which the Program is based.  The
+work thus licensed is called the contributor's "contributor version".
+
+  A contributor's "essential patent claims" are all patent claims
+owned or controlled by the contributor, whether already acquired or
+hereafter acquired, that would be infringed by some manner, permitted
+by this License, of making, using, or selling its contributor version,
+but do not include claims that would be infringed only as a
+consequence of further modification of the contributor version.  For
+purposes of this definition, "control" includes the right to grant
+patent sublicenses in a manner consistent with the requirements of
+this License.
+
+  Each contributor grants you a non-exclusive, worldwide, royalty-free
+patent license under the contributor's essential patent claims, to
+make, use, sell, offer for sale, import and otherwise run, modify and
+propagate the contents of its contributor version.
+
+  In the following three paragraphs, a "patent license" is any express
+agreement or commitment, however denominated, not to enforce a patent
+(such as an express permission to practice a patent or covenant not to
+sue for patent infringement).  To "grant" such a patent license to a
+party means to make such an agreement or commitment not to enforce a
+patent against the party.
+
+  If you convey a covered work, knowingly relying on a patent license,
+and the Corresponding Source of the work is not available for anyone
+to copy, free of charge and under the terms of this License, through a
+publicly available network server or other readily accessible means,
+then you must either (1) cause the Corresponding Source to be so
+available, or (2) arrange to deprive yourself of the benefit of the
+patent license for this particular work, or (3) arrange, in a manner
+consistent with the requirements of this License, to extend the patent
+license to downstream recipients.  "Knowingly relying" means you have
+actual knowledge that, but for the patent license, your conveying the
+covered work in a country, or your recipient's use of the covered work
+in a country, would infringe one or more identifiable patents in that
+country that you have reason to believe are valid.
+
+  If, pursuant to or in connection with a single transaction or
+arrangement, you convey, or propagate by procuring conveyance of, a
+covered work, and grant a patent license to some of the parties
+receiving the covered work authorizing them to use, propagate, modify
+or convey a specific copy of the covered work, then the patent license
+you grant is automatically extended to all recipients of the covered
+work and works based on it.
+
+  A patent license is "discriminatory" if it does not include within
+the scope of its coverage, prohibits the exercise of, or is
+conditioned on the non-exercise of one or more of the rights that are
+specifically granted under this License.  You may not convey a covered
+work if you are a party to an arrangement with a third party that is
+in the business of distributing software, under which you make payment
+to the third party based on the extent of your activity of conveying
+the work, and under which the third party grants, to any of the
+parties who would receive the covered work from you, a discriminatory
+patent license (a) in connection with copies of the covered work
+conveyed by you (or copies made from those copies), or (b) primarily
+for and in connection with specific products or compilations that
+contain the covered work, unless you entered into that arrangement,
+or that patent license was granted, prior to 28 March 2007.
+
+  Nothing in this License shall be construed as excluding or limiting
+any implied license or other defenses to infringement that may
+otherwise be available to you under applicable patent law.
+
+  12. No Surrender of Others' Freedom.
+
+  If conditions are imposed on you (whether by court order, agreement or
+otherwise) that contradict the conditions of this License, they do not
+excuse you from the conditions of this License.  If you cannot convey a
+covered work so as to satisfy simultaneously your obligations under this
+License and any other pertinent obligations, then as a consequence you may
+not convey it at all.  For example, if you agree to terms that obligate you
+to collect a royalty for further conveying from those to whom you convey
+the Program, the only way you could satisfy both those terms and this
+License would be to refrain entirely from conveying the Program.
+
+  13. Use with the GNU Affero General Public License.
+
+  Notwithstanding any other provision of this License, you have
+permission to link or combine any covered work with a work licensed
+under version 3 of the GNU Affero General Public License into a single
+combined work, and to convey the resulting work.  The terms of this
+License will continue to apply to the part which is the covered work,
+but the special requirements of the GNU Affero General Public License,
+section 13, concerning interaction through a network will apply to the
+combination as such.
+
+  14. Revised Versions of this License.
+
+  The Free Software Foundation may publish revised and/or new versions of
+the GNU General Public License from time to time.  Such new versions will
+be similar in spirit to the present version, but may differ in detail to
+address new problems or concerns.
+
+  Each version is given a distinguishing version number.  If the
+Program specifies that a certain numbered version of the GNU General
+Public License "or any later version" applies to it, you have the
+option of following the terms and conditions either of that numbered
+version or of any later version published by the Free Software
+Foundation.  If the Program does not specify a version number of the
+GNU General Public License, you may choose any version ever published
+by the Free Software Foundation.
+
+  If the Program specifies that a proxy can decide which future
+versions of the GNU General Public License can be used, that proxy's
+public statement of acceptance of a version permanently authorizes you
+to choose that version for the Program.
+
+  Later license versions may give you additional or different
+permissions.  However, no additional obligations are imposed on any
+author or copyright holder as a result of your choosing to follow a
+later version.
+
+  15. Disclaimer of Warranty.
+
+  THERE IS NO WARRANTY FOR THE PROGRAM, TO THE EXTENT PERMITTED BY
+APPLICABLE LAW.  EXCEPT WHEN OTHERWISE STATED IN WRITING THE COPYRIGHT
+HOLDERS AND/OR OTHER PARTIES PROVIDE THE PROGRAM "AS IS" WITHOUT WARRANTY
+OF ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING, BUT NOT LIMITED TO,
+THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+PURPOSE.  THE ENTIRE RISK AS TO THE QUALITY AND PERFORMANCE OF THE PROGRAM
+IS WITH YOU.  SHOULD THE PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF
+ALL NECESSARY SERVICING, REPAIR OR CORRECTION.
+
+  16. Limitation of Liability.
+
+  IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING
+WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MODIFIES AND/OR CONVEYS
+THE PROGRAM AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES, INCLUDING ANY
+GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING OUT OF THE
+USE OR INABILITY TO USE THE PROGRAM (INCLUDING BUT NOT LIMITED TO LOSS OF
+DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY YOU OR THIRD
+PARTIES OR A FAILURE OF THE PROGRAM TO OPERATE WITH ANY OTHER PROGRAMS),
+EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF
+SUCH DAMAGES.
+
+  17. Interpretation of Sections 15 and 16.
+
+  If the disclaimer of warranty and limitation of liability provided
+above cannot be given local legal effect according to their terms,
+reviewing courts shall apply local law that most closely approximates
+an absolute waiver of all civil liability in connection with the
+Program, unless a warranty or assumption of liability accompanies a
+copy of the Program in return for a fee.
+
+                     END OF TERMS AND CONDITIONS
+
+            How to Apply These Terms to Your New Programs
+
+  If you develop a new program, and you want it to be of the greatest
+possible use to the public, the best way to achieve this is to make it
+free software which everyone can redistribute and change under these terms.
+
+  To do so, attach the following notices to the program.  It is safest
+to attach them to the start of each source file to most effectively
+state the exclusion of warranty; and each file should have at least
+the "copyright" line and a pointer to where the full notice is found.
+
+    {one line to give the program's name and a brief idea of what it does.}
+    Copyright (C) {year}  {name of author}
+
+    This program is free software: you can redistribute it and/or modify
+    it under the terms of the GNU General Public License as published by
+    the Free Software Foundation, either version 3 of the License, or
+    (at your option) any later version.
+
+    This program is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+    GNU General Public License for more details.
+
+    You should have received a copy of the GNU General Public License
+    along with this program.  If not, see {http://www.gnu.org/licenses/}.
+
+Also add information on how to contact you by electronic and paper mail.
+
+  If the program does terminal interaction, make it output a short
+notice like this when it starts in an interactive mode:
+
+    pyafipws  Copyright (C) 2013  Mariano Reingart
+    This program comes with ABSOLUTELY NO WARRANTY; for details type `show w'.
+    This is free software, and you are welcome to redistribute it
+    under certain conditions; type `show c' for details.
+
+The hypothetical commands `show w' and `show c' should show the appropriate
+parts of the General Public License.  Of course, your program's commands
+might be different; for a GUI interface, you would use an "about box".
+
+  You should also get your employer (if you work as a programmer) or school,
+if any, to sign a "copyright disclaimer" for the program, if necessary.
+For more information on this, and how to apply and follow the GNU GPL, see
+{http://www.gnu.org/licenses/}.
+
+  The GNU General Public License does not permit incorporating your program
+into proprietary programs.  If your program is a subroutine library, you
+may consider it more useful to permit linking proprietary applications with
+the library.  If this is what you want to do, use the GNU Lesser General
+Public License instead of this License.  But first, please read
+{http://www.gnu.org/philosophy/why-not-lgpl.html}.

app/pyafipws/README.md

@@ -0,0 +1,208 @@
+pyafipws
+========
+
+PyAfipWs contains Python modules to operate with web services regarding AFIP (Argentina's "IRS") and other government agencies, mainly related to electronic invoicing, several taxes and traceability.
+
+Copyright 2008 - 2016 (C) Mariano Reingart [reingart@gmail.com](mailto:reingart@gmail.com) (creator and maintainter). All rights reserved.
+
+License: GPLv3+, with "commercial" exception available to include it and distribute with propietary programs
+
+General Information:
+--------------------
+
+ * Main Project Site: https://github.com/reingart/pyafipws (git repository)
+ * Mirror (Historic): https://code.google.com/p/pyafipws/ (mercurial repository)
+ * User Manual: (http://www.sistemasagiles.com.ar/trac/wiki/ManualPyAfipWs (Spanish)
+ * Documentation: https://github.com/reingart/pyafipws/wiki (Spanish/English)
+ * Commercial Support: http://www.sistemasagiles.com.ar/ (Spanish)
+ * Community Site: http://www.pyafipws.com.ar/ (Spanish)
+ * Public Forum: http://groups.google.com/group/pyafipws (community support, no-charge "gratis" access)
+
+More information at [Python Argentina Magazine article](http://revista.python.org.ar/2/en/html/pyafip.html) (English) 
+and [JAIIO 2012 paper](http://41jaiio.sadio.org.ar/sites/default/files/15_JSL_2012.pdf) (Spanish)
+
+Project Structure:
+------------------
+
+ * [Python library][1] (a helper class for each webservice for easy use of their methods and attributes)
+ * [PyAfipWs][7]: [OCX-like][2] Windows Component-Object-Model interface compatible with legacy programming languages (VB, VFP, Delphi, PHP, VB.NET, etc.)
+ * [LibPyAfipWs][8]: [DLL/.so][3] compiled shared library (exposing python methods to C/C++/C#) 
+ * [Console][4] (command line) tools using simplified input & ouput files (TXT, DBF, JSON)
+ * [PyRece][5] GUI and [FacturaLibre][6] WEB apps as complete reference implementations
+ * Examples for Java, .NET (C#, VB.NET), Visual Basic, Visual Fox Pro, Delphi, C, PHP. 
+ * Minor code fragment samples for SAP (ABAP), PowerBuilder, Fujitsu Net Cobol, Clarion, etc.
+ * Modules for [OpenERP/Odoo][27] - [Tryton][28]
+ 
+Features implemented:
+---------------------
+
+ * Supported alternate interchange formats: TXT (fixed lenght COBOL), CSV, DBF (Clipper/xBase/Harbour), XML, JSON, etc.
+ * Full automation to request authentication and invoice authorization (CAE, COE, etc.)
+ * Advanced XML manipulation, caching and proxy support.
+ * Customizable PDF generation and visual designer (CSV templates)
+ * Email, barcodes (PIL), installation (NSIS), configuration (.INI), debugging and other misc utilities
+
+Web services supported so far:
+------------------------------
+
+AFIP:
+
+ * [WSAA][10]: authorization & authentication, including digital cryptographic signature
+ * [WSFEv1][11]: domestic market (electronic invoice) -[English][12]-
+ * [WSMTXCA][22]: domestic market (electronic invoice) -detailing articles and barcodes-
+ * [WSCT][22b]: tourism (electronic invoice) -"tax free" VAT refund for tourists- 
+ * [WSBFEv1][13]: tax bonus (electronic invoice)
+ * [WSFEXv1][14]: foreign trade (electronic invoice) -[English][15]-
+ * [WSCTG][16]: agriculture (grain traceability code)
+ * [WSLPG][17]: agriculture (grain liquidation - invoice)
+ * [WSLTV][17b]: agriculture (green tobacco - invoice)
+ * [WSLUM][17c]: agriculture (milk - invoice)
+ * [WSLSP][17d]: agriculture (cattle/livestock - invoice)
+ * [wDigDepFiel][18]: customs (faithful depositary)
+ * [WSCOC][19]: currency exchange operations autorization
+ * [WSCDC][22]: invoice verification
+ * [Taxpayers' Registe][26]: database to check sellers and buyers register
+
+ARBA:
+
+ * [COT][20]: Provincial Operation Transport Code (aka electronic Shipping note)
+
+ANMAT/SEDRONAR/SENASA (SNT):
+
+ * [TrazaMed][21]: National Medical Drug Traceability Program
+ * [TrazaRenpre][24]: Controlled Chemical Precursors Traceability Program
+ * [TrazaFito][25]: Phytosanitary Products Traceability Program
+
+Installation Instructions:
+--------------------------
+
+## Quick-Start
+
+On Ubuntu (GNU/Linux), you will need to install httplib2 and openssl binding.
+Then you can download the compressed file, unzip it and use:
+
+```
+sudo apt-get install python-httplib2 python-m2crypto
+wget https://github.com/reingart/pyafipws/archive/master.zip
+unzip master.zip
+cd pyafipws-master
+sudo pip install -r requirements.txt
+```
+
+**Note:** M2Crypto is optional, the library will use OpenSSL directly (using
+subprocess)
+
+You'll need a digital certificate (.crt) and private key (.key) to authenticate 
+(see [certificate generation][29] for more information and instructions).
+Provisionally, you can use author's testing certificate/key:
+
+```
+wget https://www.sistemasagiles.com.ar/soft/pyafipws/reingart.zip
+unzip reingart.zip
+```
+
+You should configure `rece.ini` to set up paths and URLs if using other values
+than defaults.
+
+Then, you could execute `WSAA` script to authenticate (getting Token and Sign)
+and `WSFEv1` to process an electronic invoice:
+```
+python wsaa.py
+python wsfev1.py --prueba
+```
+
+With the last command, you should get the Electronic Autorization Code (CAE) 
+for testing purposes (sample invoice data, do not use in production!).
+
+## Virtual environment (testing):
+
+The following commands clone the repository, creates a virtualenv and install
+the packages there (including the latest versions of the dependencies) to avoid
+conflicts with other libraries:
+```
+sudo apt-get install python-dev swig python-virtualenv mercurial python-pip libssl-dev python-dulwich
+hg clone git+https://github.com/reingart/pyafipws.git --config extensions.hggit=
+cd pyafipws
+virtualenv venv
+source venv/bin/activate
+pip install -r requirements.txt
+```
+
+**Note:** For convenience, development is done using mercurial; 
+You could use [hg-git][30] or git directly. 
+
+## Dependency installation (development):
+
+For SOAP webservices [PySimpleSOAP](https://github.com/pysimplesoap/pysimplesoap) is
+needed (spin-off of this library, inspired by the PHP SOAP extension):
+
+```
+hg clone git+https://github.com/pysimplesoap/pysimplesoap.git --config extensions.hggit=
+cd pysimplesoap
+hg up reingart
+python setup.py install
+```
+
+Use "stable" branch reingart (see `requirements.txt` for more information)
+
+For PDF generation, you will need the [PyFPDF](https://github.com/reingart/pyfpdf)
+(PHP's FPDF library, python port):
+
+```
+hg clone git+https://github.com/reingart/pyfpdf.git --config extensions.hggit=
+cd pyfpdf
+python setup.py install
+```
+
+For the GUI app, you will need [wxPython](http://www.wxpython.org/):
+```
+sudo apt-get install wxpython
+```
+
+PythonCard is being replaced by [gui2py](https://github.com/reingart/gui2py/):
+```
+pip install gui2py
+```
+
+For the WEB app, you will need [web2py](http://www.web2py.com/).
+
+On Windows, you can see available installers released for evaluation purposes on
+[Download Releases](https://github.com/reingart/pyafipws/releases)
+
+For more information see the source code installation steps in the 
+[wiki](https://github.com/reingart/pyafipws/wiki/InstalacionCodigoFuente)
+
+
+ [1]: http://www.sistemasagiles.com.ar/trac/wiki/FacturaElectronicaPython
+ [2]: http://www.sistemasagiles.com.ar/trac/wiki/OcxFacturaElectronica
+ [3]: http://www.sistemasagiles.com.ar/trac/wiki/DllFacturaElectronica
+ [4]: http://www.sistemasagiles.com.ar/trac/wiki/HerramientaFacturaElectronica
+ [5]: http://www.sistemasagiles.com.ar/trac/wiki/PyRece
+ [6]: http://www.sistemasagiles.com.ar/trac/wiki/FacturaLibre
+ [7]: http://www.sistemasagiles.com.ar/trac/wiki/PyAfipWs
+ [8]: http://www.sistemasagiles.com.ar/trac/wiki/LibPyAfipWs
+ [10]: http://www.sistemasagiles.com.ar/trac/wiki/ManualPyAfipWs#ServicioWebdeAutenticaciónyAutorizaciónWSAA
+ [11]: http://www.sistemasagiles.com.ar/trac/wiki/ProyectoWSFEv1
+ [12]: https://github.com/reingart/pyafipws/wiki/WSFEv1
+ [13]: http://www.sistemasagiles.com.ar/trac/wiki/BonosFiscales
+ [14]: http://www.sistemasagiles.com.ar/trac/wiki/FacturaElectronicaExportacion
+ [15]: https://github.com/reingart/pyafipws/wiki/WSFEX
+ [16]: http://www.sistemasagiles.com.ar/trac/wiki/CodigoTrazabilidadGranos
+ [17]: http://www.sistemasagiles.com.ar/trac/wiki/LiquidacionPrimariaGranos
+ [17b]: http://www.sistemasagiles.com.ar/trac/wiki/LiquidacionTabacoVerde
+ [17c]: http://www.sistemasagiles.com.ar/trac/wiki/LiquidacionUnicaMensualLecheria
+ [17d]: http://www.sistemasagiles.com.ar/trac/wiki/LiquidacionSectorPecuario
+ [18]: http://www.sistemasagiles.com.ar/trac/wiki/ManualPyAfipWs#wDigDepFiel:DepositarioFiel
+ [19]: http://www.sistemasagiles.com.ar/trac/wiki/ConsultaOperacionesCambiarias
+ [20]: http://www.sistemasagiles.com.ar/trac/wiki/RemitoElectronicoCotArba
+ [21]: http://www.sistemasagiles.com.ar/trac/wiki/TrazabilidadMedicamentos
+ [22]: http://www.sistemasagiles.com.ar/trac/wiki/FacturaElectronicaMTXCAService
+ [22b]: http://www.sistemasagiles.com.ar/trac/wiki/FacturaElectronicaComprobantesTurismo 
+ [23]: http://www.sistemasagiles.com.ar/trac/wiki/ConstatacionComprobantes
+ [24]: http://www.sistemasagiles.com.ar/trac/wiki/TrazabilidadPrecursoresQuimicos
+ [25]: http://www.sistemasagiles.com.ar/trac/wiki/TrazabilidadProductosFitosanitarios
+ [26]: http://www.sistemasagiles.com.ar/trac/wiki/PadronContribuyentesAFIP
+ [27]: https://github.com/reingart/openerp_pyafipws
+ [28]: https://github.com/tryton-ar/account_invoice_ar
+ [29]: http://www.sistemasagiles.com.ar/trac/wiki/ManualPyAfipWs#Certificados
+ [30]: http://hg-git.github.io/

app/pyafipws/__init__.py

@@ -0,0 +1,17 @@
+#!/usr/bin/python
+# -*- coding: latin-1 -*-
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by the
+# Free Software Foundation; either version 3, or (at your option) any later
+# version.
+#
+# This program is distributed in the hope that it will be useful, but
+# WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTIBILITY
+# or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
+# for more details.
+
+"""M�dulo para acceder a web services de la afip
+"""
+__author__ = "Mariano Reingart (mariano@gmail.com)"
+__copyright__ = "Copyright (C) 2008-2015 Mariano Reingart"
+__license__ = "GPL 3.0"

app/pyafipws/conf/afip_ca_info.crt

@@ -0,0 +1,26 @@
+-----BEGIN CERTIFICATE-----
+MIIEMjCCAxqgAwIBAgIBATANBgkqhkiG9w0BAQUFADB7MQswCQYDVQQGEwJHQjEb
+MBkGA1UECAwSR3JlYXRlciBNYW5jaGVzdGVyMRAwDgYDVQQHDAdTYWxmb3JkMRow
+GAYDVQQKDBFDb21vZG8gQ0EgTGltaXRlZDEhMB8GA1UEAwwYQUFBIENlcnRpZmlj
+YXRlIFNlcnZpY2VzMB4XDTA0MDEwMTAwMDAwMFoXDTI4MTIzMTIzNTk1OVowezEL
+MAkGA1UEBhMCR0IxGzAZBgNVBAgMEkdyZWF0ZXIgTWFuY2hlc3RlcjEQMA4GA1UE
+BwwHU2FsZm9yZDEaMBgGA1UECgwRQ29tb2RvIENBIExpbWl0ZWQxITAfBgNVBAMM
+GEFBQSBDZXJ0aWZpY2F0ZSBTZXJ2aWNlczCCASIwDQYJKoZIhvcNAQEBBQADggEP
+ADCCAQoCggEBAL5AnfRu4ep2hxxNRUSOvkbIgwadwSr+GB+O5AL686tdUIoWMQua
+BtDFcCLNSS1UY8y2bmhGC1Pqy0wkwLxyTurxFa70VJoSCsN6sjNg4tqJVfMiWPPe
+3M/vg4aijJRPn2jymJBGhCfHdr/jzDUsi14HZGWCwEiwqJH5YZ92IFCokcdmtet4
+YgNW8IoaE+oxox6gmf049vYnMlhvB/VruPsUK6+3qszWY19zjNoFmag4qMsXeDZR
+rOme9Hg6jc8P2ULimAyrL58OAd7vn5lJ8S3frHRNG5i1R8XlKdH5kBjHYpy+g8cm
+ez6KJcfA3Z3mNWgQIJ2P2N7Sw4ScDV7oL8kCAwEAAaOBwDCBvTAdBgNVHQ4EFgQU
+oBEKIz6W8Qfs4q8p74Klf9AwpLQwDgYDVR0PAQH/BAQDAgEGMA8GA1UdEwEB/wQF
+MAMBAf8wewYDVR0fBHQwcjA4oDagNIYyaHR0cDovL2NybC5jb21vZG9jYS5jb20v
+QUFBQ2VydGlmaWNhdGVTZXJ2aWNlcy5jcmwwNqA0oDKGMGh0dHA6Ly9jcmwuY29t
+b2RvLm5ldC9BQUFDZXJ0aWZpY2F0ZVNlcnZpY2VzLmNybDANBgkqhkiG9w0BAQUF
+AAOCAQEACFb8AvCb6P+k+tZ7xkSAzk/ExfYAWMymtrwUSWgEdujm7l3sAg9g1o1Q
+GE8mTgHj5rCl7r+8dFRBv/38ErjHT1r0iWAFf2C3BUrz9vHCv8S5dIa2LX1rzNLz
+Rt0vxuBqw8M0Ayx9lt1awg6nCpnBBYurDC/zXDrPbDdVCYfeU0BsWO/8tqtlbgT2
+G9w84FoVxp7Z8VlIMCFlA2zs6SFz7JsDoeA3raAVGI/6ugLOpyypEBMs1OUIJqsi
+l2D4kF501KKaU73yqWjgom7C12yxow+ev+to51byrvLjKzg6CYG1a4XXvi3tPxq3
+smPi9WIsgtRqAEFQ8TmDn5XpNpaYbg==
+-----END CERTIFICATE-----
+

app/pyafipws/conf/arba.crt

@@ -0,0 +1,111 @@
+-----BEGIN CERTIFICATE-----
+MIIHTzCCBTegAwIBAgIJANZdOWGV4vbRMA0GCSqGSIb3DQEBCwUAMIH/MRswGQYK
+CZImiZPyLGQBGRYLYXJiYS5nb3YuYXIxCzAJBgNVBAYTAkFSMREwDwYDVQQHDAhM
+YSBQbGF0YTEVMBMGA1UECAwMQnVlbm9zIEFpcmVzMUYwRAYDVQQKDD1BUkJBIC0g
+QWdlbmNpYSBkZSBSZWNhdWRhY2lvbiBkZSBsYSBQcm92aW5jaWEgZGUgQnVlbm9z
+IEFpcmVzMRkwFwYDVQQLDBBTZWd1cmlkYWQgTG9naWNhMSYwJAYDVQQDDB1BUkJB
+IC0gQXV0b3JpZGFkIENlcnRpZmljYW50ZTEeMBwGCSqGSIb3DQEJARYPcGtpQGFy
+YmEuZ292LmFyMB4XDTEwMTAxODA5NTkxNFoXDTIwMTAxNTA5NTkxNFowgf8xGzAZ
+BgoJkiaJk/IsZAEZFgthcmJhLmdvdi5hcjELMAkGA1UEBhMCQVIxETAPBgNVBAcM
+CExhIFBsYXRhMRUwEwYDVQQIDAxCdWVub3MgQWlyZXMxRjBEBgNVBAoMPUFSQkEg
+LSBBZ2VuY2lhIGRlIFJlY2F1ZGFjaW9uIGRlIGxhIFByb3ZpbmNpYSBkZSBCdWVu
+b3MgQWlyZXMxGTAXBgNVBAsMEFNlZ3VyaWRhZCBMb2dpY2ExJjAkBgNVBAMMHUFS
+QkEgLSBBdXRvcmlkYWQgQ2VydGlmaWNhbnRlMR4wHAYJKoZIhvcNAQkBFg9wa2lA
+YXJiYS5nb3YuYXIwggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQCnNZm2
+Osf9SxGSZKID4IZ63iG7ckOXCDVrGjoCAFYr59SBd3BUZ8dwFY30Ll/EApfd+xMI
+zChHotYf9+dLB0dVqUXbbAZQMsRRaME4mEz6o/Vns6NNKUL/9koNoN2a9Q8DQhRN
+ShRinJJekfEDRc/S3pljn2NgBZIdwziXe8BBO7IrVW3Yyb6xMLVlnK1Z6wF0w+1Y
+n5Hq9xGeFRS86B46xtwN7YIXwzop6jCgicTPZK8TDicnTLOfPHmfLmFeG4yMGPvK
+gLthYG9MOEyNW97lhFWovd//IyalrvE3QlmAlUA2Aqv+a2/P0WY7Z/fgn1uUu2tL
+4va0OaG8MC8/0MCzR1j5WLuZU8038N6/0fA4eEZUMLct5bmH6W8R26tCLGUG7reo
+eqCo3tPIKd+gdGzpB4dU1lL1UWD6tAk64YES804oMY9hMDXSxOo9UwAMQ+aoh24J
+IH126KMgC6aBe86CpF5ahPqdnnhkfFaKFV6dxWwsTpACQ4jufJy+iq7MY8DdUKUh
+lJ1y3bq4eJErLHAdZOJXy7FZ7BihpDKhz1PxIwgonfGutvuDVeVF/Jdu7EDhmDyC
+eILWDhHXHhrI6qMyct3/fx9ZVxcqj59O7bnt/F6HwxMHbnMgj/m6dAoB8ljARcAs
+m5hasHlji1VTj0NgdWY2llZDo94iXo9U/1MXLwIDAQABo4HLMIHIMA8GA1UdEwEB
+/wQFMAMBAf8wHQYDVR0OBBYEFP99RGRtMAsJd2Zx7nB+AO+ctE6hMB8GA1UdIwQY
+MBaAFP99RGRtMAsJd2Zx7nB+AO+ctE6hMA4GA1UdDwEB/wQEAwIBBjAmBgNVHREE
+HzAdgRtzZWd1cmlkYWRsb2dpY2FAYXJiYS5nb3YuYXIwPQYDVR0fBDYwNDAyoDCg
+LoYsaHR0cDovL3BraS5hcmJhLmdvdi5hci9wa2kvcHViL2NybC9jYWNybC5jcmww
+DQYJKoZIhvcNAQELBQADggIBABv8/Ujsq6qMBWXmWXT1Oi3J/Oocai/k6pnaQzoq
+hR6eoy3vQYR67wyyblOPQ1F3ql5QoyTKsnh44x9FCzetLzHguX9RcO7+UYQyxB0l
+KtbGzZmqVcQmp/A5syeepM6QKPco6strMQWJ5n5cd/W2q8OsKTvD6BMoRe1lz1Bq
+nAKvRmpkxK6r3U47mSMNkAfa3uxqZwg2Y60x7b5ahI6uAiI45MysnbOSz4wwsfHu
+kupYuvsDhNGzUWAPJjKOZEpCizhbnt8TKsmN0PHtoLnMIDgMERW9afQnhIac/3u2
+6Ku0bE1zH8xYDqSgSPvxINjMx20qavIm3K1iV7mYQoFJOjktnpIIKx2gP+UzseNi
+qMvy5cL1jQThcFItDUVgV4TsWWYXRxOwbsQGs/GZLo85PVIULDt3P9LfGGW/nWCy
+jg/wMEZKSeP4zfx/IMyqaKwEBYX6B9XTLhSLPs3xrqm0zvdhh28TFpR78JgyUoMS
+CDnvd/jS28N5eaXImqDqBbw5KVpHtdYCO8+LQ6FVYer/8SIl+6s3DMDw4f65sJYU
+UD4+eba6DVj0knFExiHa4LA9nr/eRIpEnHyrALTf+vlOKaLcQTbcAChKq7HEg8bR
+x2FlPljCiKIwYpw24TVCaoNwh4NPXGyfWRmTysIiYEuqzvSYXnd6KPPcRXNPUz70
+vUh9
+-----END CERTIFICATE-----
+-----BEGIN CERTIFICATE-----
+MIIF2DCCA8CgAwIBAgIQTKr5yttjb+Af907YWwOGnTANBgkqhkiG9w0BAQwFADCB
+hTELMAkGA1UEBhMCR0IxGzAZBgNVBAgTEkdyZWF0ZXIgTWFuY2hlc3RlcjEQMA4G
+A1UEBxMHU2FsZm9yZDEaMBgGA1UEChMRQ09NT0RPIENBIExpbWl0ZWQxKzApBgNV
+BAMTIkNPTU9ETyBSU0EgQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkwHhcNMTAwMTE5
+MDAwMDAwWhcNMzgwMTE4MjM1OTU5WjCBhTELMAkGA1UEBhMCR0IxGzAZBgNVBAgT
+EkdyZWF0ZXIgTWFuY2hlc3RlcjEQMA4GA1UEBxMHU2FsZm9yZDEaMBgGA1UEChMR
+Q09NT0RPIENBIExpbWl0ZWQxKzApBgNVBAMTIkNPTU9ETyBSU0EgQ2VydGlmaWNh
+dGlvbiBBdXRob3JpdHkwggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQCR
+6FSS0gpWsawNJN3Fz0RndJkrN6N9I3AAcbxT38T6KhKPS38QVr2fcHK3YX/JSw8X
+pz3jsARh7v8Rl8f0hj4K+j5c+ZPmNHrZFGvnnLOFoIJ6dq9xkNfs/Q36nGz637CC
+9BR++b7Epi9Pf5l/tfxnQ3K9DADWietrLNPtj5gcFKt+5eNu/Nio5JIk2kNrYrhV
+/erBvGy2i/MOjZrkm2xpmfh4SDBF1a3hDTxFYPwyllEnvGfDyi62a+pGx8cgoLEf
+Zd5ICLqkTqnyg0Y3hOvozIFIQ2dOciqbXL1MGyiKXCJ7tKuY2e7gUYPDCUZObT6Z
++pUX2nwzV0E8jVHtC7ZcryxjGt9XyD+86V3Em69FmeKjWiS0uqlWPc9vqv9JWL7w
+qP/0uK3pN/u6uPQLOvnoQ0IeidiEyxPx2bvhiWC4jChWrBQdnArncevPDt09qZah
+SL0896+1DSJMwBGB7FY79tOi4lu3sgQiUpWAk2nojkxl8ZEDLXB0AuqLZxUpaVIC
+u9ffUGpVRr+goyhhf3DQw6KqLCGqR84onAZFdr+CGCe01a60y1Dma/RMhnEw6abf
+Fobg2P9A3fvQQoh/ozM6LlweQRGBY84YcWsr7KaKtzFcOmpH4MN5WdYgGq/yapiq
+crxXStJLnbsQ/LBMQeXtHT1eKJ2czL+zUdqnR+WEUwIDAQABo0IwQDAdBgNVHQ4E
+FgQUu69+Aj36pvE8hI6t7jiY7NkyMtQwDgYDVR0PAQH/BAQDAgEGMA8GA1UdEwEB
+/wQFMAMBAf8wDQYJKoZIhvcNAQEMBQADggIBAArx1UaEt65Ru2yyTUEUAJNMnMvl
+wFTPoCWOAvn9sKIN9SCYPBMtrFaisNZ+EZLpLrqeLppysb0ZRGxhNaKatBYSaVqM
+4dc+pBroLwP0rmEdEBsqpIt6xf4FpuHA1sj+nq6PK7o9mfjYcwlYRm6mnPTXJ9OV
+2jeDchzTc+CiR5kDOF3VSXkAKRzH7JsgHAckaVd4sjn8OoSgtZx8jb8uk2Intzna
+FxiuvTwJaP+EmzzV1gsD41eeFPfR60/IvYcjt7ZJQ3mFXLrrkguhxuhoqEwWsRqZ
+CuhTLJK7oQkYdQxlqHvLI7cawiiFwxv/0Cti76R7CZGYZ4wUAc1oBmpjIXUDgIiK
+boHGhfKppC3n9KUkEEeDys30jXlYsQab5xoq2Z0B15R97QNKyvDb6KkBPvVWmcke
+jkk9u+UJueBPSZI9FoJAzMxZxuY67RIuaTxslbH9qh17f4a+Hg4yRvv7E491f0yL
+S0Zj/gA0QHDBw7mh3aZw4gSzQbzpgJHqZJx64SIDqZxubw5lT2yHh17zbqD5daWb
+QOhTsiedSrnAdyGN/4fy3ryM7xfft0kL0fJuMAsaDk527RH89elWsn2/x20Kk4yl
+0MC2Hb46TpSi125sC8KKfPog88Tk5c0NqMuRkrF8hey1FGlmDoLnzc7ILaZRfyHB
+NVOFBkpdn627G190
+-----END CERTIFICATE-----
+-----BEGIN CERTIFICATE-----
+MIIGCDCCA/CgAwIBAgIQKy5u6tl1NmwUim7bo3yMBzANBgkqhkiG9w0BAQwFADCB
+hTELMAkGA1UEBhMCR0IxGzAZBgNVBAgTEkdyZWF0ZXIgTWFuY2hlc3RlcjEQMA4G
+A1UEBxMHU2FsZm9yZDEaMBgGA1UEChMRQ09NT0RPIENBIExpbWl0ZWQxKzApBgNV
+BAMTIkNPTU9ETyBSU0EgQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkwHhcNMTQwMjEy
+MDAwMDAwWhcNMjkwMjExMjM1OTU5WjCBkDELMAkGA1UEBhMCR0IxGzAZBgNVBAgT
+EkdyZWF0ZXIgTWFuY2hlc3RlcjEQMA4GA1UEBxMHU2FsZm9yZDEaMBgGA1UEChMR
+Q09NT0RPIENBIExpbWl0ZWQxNjA0BgNVBAMTLUNPTU9ETyBSU0EgRG9tYWluIFZh
+bGlkYXRpb24gU2VjdXJlIFNlcnZlciBDQTCCASIwDQYJKoZIhvcNAQEBBQADggEP
+ADCCAQoCggEBAI7CAhnhoFmk6zg1jSz9AdDTScBkxwtiBUUWOqigwAwCfx3M28Sh
+bXcDow+G+eMGnD4LgYqbSRutA776S9uMIO3Vzl5ljj4Nr0zCsLdFXlIvNN5IJGS0
+Qa4Al/e+Z96e0HqnU4A7fK31llVvl0cKfIWLIpeNs4TgllfQcBhglo/uLQeTnaG6
+ytHNe+nEKpooIZFNb5JPJaXyejXdJtxGpdCsWTWM/06RQ1A/WZMebFEh7lgUq/51
+UHg+TLAchhP6a5i84DuUHoVS3AOTJBhuyydRReZw3iVDpA3hSqXttn7IzW3uLh0n
+c13cRTCAquOyQQuvvUSH2rnlG51/ruWFgqUCAwEAAaOCAWUwggFhMB8GA1UdIwQY
+MBaAFLuvfgI9+qbxPISOre44mOzZMjLUMB0GA1UdDgQWBBSQr2o6lFoL2JDqElZz
+30O0Oija5zAOBgNVHQ8BAf8EBAMCAYYwEgYDVR0TAQH/BAgwBgEB/wIBADAdBgNV
+HSUEFjAUBggrBgEFBQcDAQYIKwYBBQUHAwIwGwYDVR0gBBQwEjAGBgRVHSAAMAgG
+BmeBDAECATBMBgNVHR8ERTBDMEGgP6A9hjtodHRwOi8vY3JsLmNvbW9kb2NhLmNv
+bS9DT01PRE9SU0FDZXJ0aWZpY2F0aW9uQXV0aG9yaXR5LmNybDBxBggrBgEFBQcB
+AQRlMGMwOwYIKwYBBQUHMAKGL2h0dHA6Ly9jcnQuY29tb2RvY2EuY29tL0NPTU9E
+T1JTQUFkZFRydXN0Q0EuY3J0MCQGCCsGAQUFBzABhhhodHRwOi8vb2NzcC5jb21v
+ZG9jYS5jb20wDQYJKoZIhvcNAQEMBQADggIBAE4rdk+SHGI2ibp3wScF9BzWRJ2p
+mj6q1WZmAT7qSeaiNbz69t2Vjpk1mA42GHWx3d1Qcnyu3HeIzg/3kCDKo2cuH1Z/
+e+FE6kKVxF0NAVBGFfKBiVlsit2M8RKhjTpCipj4SzR7JzsItG8kO3KdY3RYPBps
+P0/HEZrIqPW1N+8QRcZs2eBelSaz662jue5/DJpmNXMyYE7l3YphLG5SEXdoltMY
+dVEVABt0iN3hxzgEQyjpFv3ZBdRdRydg1vs4O2xyopT4Qhrf7W8GjEXCBgCq5Ojc
+2bXhc3js9iPc0d1sjhqPpepUfJa3w/5Vjo1JXvxku88+vZbrac2/4EjxYoIQ5QxG
+V/Iz2tDIY+3GH5QFlkoakdH368+PUq4NCNk+qKBR6cGHdNXJ93SrLlP7u3r7l+L4
+HyaPs9Kg4DdbKDsx5Q5XLVq4rXmsXiBmGqW5prU5wfWYQ//u+aen/e7KJD2AFsQX
+j4rBYKEMrltDR5FL1ZoXX/nUh8HCjLfn4g8wGTeGrODcQgPmlKidrv0PJFGUzpII
+0fxQ8ANAe4hZ7Q7drNJ3gjTcBpUC2JD5Leo31Rpg0Gcg19hCC0Wvgmje3WYkN5Ap
+lBlGGSW4gNfL1IYoakRwJiNiqZ+Gb7+6kHDSVneFeO/qJakXzlByjAA6quPbYzSf
++AZxAeKCINT+b72x
+-----END CERTIFICATE-----

app/pyafipws/conf/comodo.crt

@@ -0,0 +1,25 @@
+-----BEGIN CERTIFICATE-----
+MIIENjCCAx6gAwIBAgIBATANBgkqhkiG9w0BAQUFADBvMQswCQYDVQQGEwJTRTEU
+MBIGA1UEChMLQWRkVHJ1c3QgQUIxJjAkBgNVBAsTHUFkZFRydXN0IEV4dGVybmFs
+IFRUUCBOZXR3b3JrMSIwIAYDVQQDExlBZGRUcnVzdCBFeHRlcm5hbCBDQSBSb290
+MB4XDTAwMDUzMDEwNDgzOFoXDTIwMDUzMDEwNDgzOFowbzELMAkGA1UEBhMCU0Ux
+FDASBgNVBAoTC0FkZFRydXN0IEFCMSYwJAYDVQQLEx1BZGRUcnVzdCBFeHRlcm5h
+bCBUVFAgTmV0d29yazEiMCAGA1UEAxMZQWRkVHJ1c3QgRXh0ZXJuYWwgQ0EgUm9v
+dDCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBALf3GjPm8gAELTngTlvt
+H7xsD821+iO2zt6bETOXpClMfZOfvUq8k+0DGuOPz+VtUFrWlymUWoCwSXrbLpX9
+uMq/NzgtHj6RQa1wVsfwTz/oMp50ysiQVOnGXw94nZpAPA6sYapeFI+eh6FqUNzX
+mk6vBbOmcZSccbNQYArHE504B4YCqOmoaSYYkKtMsE8jqzpPhNjfzp/haW+710LX
+a0Tkx63ubUFfclpxCDezeWWkWaCUN/cALw3CknLa0Dhy2xSoRcRdKn23tNbE7qzN
+E0S3ySvdQwAl+mG5aWpYIxG3pzOPVnVZ9c0p10a3CitlttNCbxWyuHv77+ldU9U0
+WicCAwEAAaOB3DCB2TAdBgNVHQ4EFgQUrb2YejS0Jvf6xCZU7wO94CTLVBowCwYD
+VR0PBAQDAgEGMA8GA1UdEwEB/wQFMAMBAf8wgZkGA1UdIwSBkTCBjoAUrb2YejS0
+Jvf6xCZU7wO94CTLVBqhc6RxMG8xCzAJBgNVBAYTAlNFMRQwEgYDVQQKEwtBZGRU
+cnVzdCBBQjEmMCQGA1UECxMdQWRkVHJ1c3QgRXh0ZXJuYWwgVFRQIE5ldHdvcmsx
+IjAgBgNVBAMTGUFkZFRydXN0IEV4dGVybmFsIENBIFJvb3SCAQEwDQYJKoZIhvcN
+AQEFBQADggEBALCb4IUlwtYj4g+WBpKdQZic2YR5gdkeWxQHIzZlj7DYd7usQWxH
+YINRsPkyPef89iYTx4AWpb9a/IfPeHmJIZriTAcKhjW88t5RxNKWt9x+Tu5w/Rw5
+6wwCURQtjr0W4MHfRnXnJK3s9EK0hZNwEGe6nQY1ShjTK3rMUUKhemPR5ruhxSvC
+Nr4TDea9Y355e6cJDUCrat2PisP29owaQgVR1EX1n6diIWgVIEM8med8vSTYqZEX
+c4g/VhsxOBi0cQ+azcgOno4uG+GMmIPLHzHxREzGBHNJdmAPx/i9F4BrLunMTA5a
+mnkPIAou1Z5jJh5VkpTYghdae9C8x49OhgQ=
+-----END CERTIFICATE-----

app/pyafipws/conf/geotrust.crt

@@ -0,0 +1,20 @@
+-----BEGIN CERTIFICATE-----
+MIIDVDCCAjygAwIBAgIDAjRWMA0GCSqGSIb3DQEBBQUAMEIxCzAJBgNVBAYTAlVT
+MRYwFAYDVQQKEw1HZW9UcnVzdCBJbmMuMRswGQYDVQQDExJHZW9UcnVzdCBHbG9i
+YWwgQ0EwHhcNMDIwNTIxMDQwMDAwWhcNMjIwNTIxMDQwMDAwWjBCMQswCQYDVQQG
+EwJVUzEWMBQGA1UEChMNR2VvVHJ1c3QgSW5jLjEbMBkGA1UEAxMSR2VvVHJ1c3Qg
+R2xvYmFsIENBMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA2swYYzD9
+9BcjGlZ+W988bDjkcbd4kdS8odhM+KhDtgPpTSEHCIjaWC9mOSm9BXiLnTjoBbdq
+fnGk5sRgprDvgOSJKA+eJdbtg/OtppHHmMlCGDUUna2YRpIuT8rxh0PBFpVXLVDv
+iS2Aelet8u5fa9IAjbkU+BQVNdnARqN7csiRv8lVK83Qlz6cJmTM386DGXHKTubU
+1XupGc1V3sjs0l44U+VcT4wt/lAjNvxm5suOpDkZALeVAjmRCw7+OC7RHQWa9k0+
+bw8HHa8sHo9gOeL6NlMTOdReJivbPagUvTLrGAMoUgRx5aszPeE4uwc2hGKceeoW
+MPRfwCvocWvk+QIDAQABo1MwUTAPBgNVHRMBAf8EBTADAQH/MB0GA1UdDgQWBBTA
+ephojYn7qwVkDBF9qn1luMrMTjAfBgNVHSMEGDAWgBTAephojYn7qwVkDBF9qn1l
+uMrMTjANBgkqhkiG9w0BAQUFAAOCAQEANeMpauUvXVSOKVCUn5kaFOSPeCpilKIn
+Z57QzxpeR+nBsqTP3UEaBU6bS+5Kb1VSsyShNwrrZHYqLizz/Tt1kL/6cdjHPTfS
+tQWVYrmm3ok9Nns4d0iXrKYgjy6myQzCsplFAMfOEVEiIuCl6rYVSAlk6l5PdPcF
+PseKUgzbFbS9bZvlxrFUaKnjaZC2mqUPuLk/IH2uSrW4nOQdtqvmlKXBx4Ot2/Un
+hw4EbNX/3aBd7YdStysVAq45pmp06drE57xNNB6pXE0zX5IJL4hmXXeXxx12E6nV
+5fEWCRE11azbJHFwLJhWC9kXtNHjUStedejV0NxPNO3CBWaAocvmMw==
+-----END CERTIFICATE-----

app/pyafipws/conf/rece.ini

@@ -0,0 +1,127 @@
+# EJEMPLO de archivo de configuraci�n de la interfaz PyAfipWs
+# DEBE CAMBIAR Certificado (CERT) y Clave Privada (PRIVATEKEY)
+# Para producci�n debe descomentar las URL (sacar ##)
+# M�s informaci�n:
+# http://www.sistemasagiles.com.ar/trac/wiki/ManualPyAfipWs#Configuraci�n
+
+[WSAA]
+CERT=reingart.crt
+PRIVATEKEY=reingart.key
+##URL=https://wsaa.afip.gov.ar/ws/services/LoginCms
+
+[WSFE]
+CUIT=20267565393
+ENTRADA=entrada.txt
+SALIDA=salida.txt
+##URL=https://servicios1.afip.gov.ar/wsfe/service.asmx
+
+[WSFEv1]
+CUIT=20267565393
+CAT_IVA=1
+PTO_VTA=97
+ENTRADA=entrada.txt
+SALIDA=salida.txt
+##URL=https://servicios1.afip.gov.ar/wsfev1/service.asmx?WSDL
+
+[WSMTXCA]
+CUIT=20267565393
+ENTRADA=entrada.txt
+SALIDA=salida.txt
+Reprocesar= S
+##URL=https://serviciosjava.afip.gob.ar/wsmtxca/services/MTXCAService
+
+[WSBFE]
+CUIT=20267565393
+ENTRADA=entrada.txt
+SALIDA=salida.txt
+##URL=https://servicios1.afip.gov.ar/wsfe/service.asmx
+
+[WSFEX]
+CUIT=20267565393
+ENTRADA=entrada.txt
+SALIDA=salida.txt
+##URL=https://servicios1.afip.gov.ar/wsfe/service.asmx
+
+[WSCT]
+CUIT=20267565393
+ENTRADA=entrada.txt
+SALIDA=salida.txt
+Reprocesar= S
+##URL=https://serviciosjava.afip.gob.ar/wsmtxca/services/MTXCAService
+
+[WSCDC]
+CUIT=20267565393
+ENTRADA=entrada.txt
+SALIDA=salida.txt
+##URL=https://serviciosjava.afip.gob.ar/wsct/CTService?wsdl
+
+[WS-SR-PADRON-A4]
+CUIT=20267565393
+ENTRADA=entrada.txt
+SALIDA=salida.txt
+##URL=https://aws.afip.gov.ar/sr-padron/webservices/personaServiceA4?wsdl
+
+[WS-SR-PADRON-A5]
+CUIT=20267565393
+ENTRADA=entrada.txt
+SALIDA=salida.txt
+##URL=https://aws.afip.gov.ar/sr-padron/webservices/personaServiceA5?wsdl
+
+[FACTURA]
+ARCHIVO=tipo,letra,numero
+FORMATO=factura.csv
+PAPEL=legal
+ORIENTACION=portrait
+DIRECTORIO=.
+SUBDIRECTORIO=
+LOCALE=Spanish_Argentina.1252
+FMT_CANTIDAD=0.4
+FMT_PRECIO=0.3
+CANT_POS=izq
+ENTRADA=factura.txt
+SALIDA=factura.pdf
+
+[PDF]
+LOGO=plantillas/logo.png
+EMPRESA=Empresa de Prueba
+MEMBRETE1=Direccion de Prueba
+MEMBRETE2=Capital Federal
+CUIT=CUIT 30-00000000-0
+IIBB=IIBB 30-00000000-0
+IVA=IVA Responsable Inscripto
+INICIO=Inicio de Actividad: 01/04/2006
+BORRADOR=HOMOLOGACION
+
+[MAIL]
+SERVIDOR=adan.nsis.com.ar
+PUERTO=25
+USUARIO=no.responder@nsis.com.ar
+CLAVE=noreplyauto123
+MOTIVO=Factura Electronica Nro. NUMERO
+CUERPO=Se adjunta Factura en formato PDF
+HTML=<b>Se adjunta <i>factura electronica</i> en formato PDF</b>
+REMITENTE=Facturador PyAfipWs <pyafipws@nsis.com.ar>
+
+#[BASE_DATOS]
+#DRIVER=PGSQL
+#SERVER=localhost
+#DATABASE=pyafipws
+#UID=pyafipws
+#PWD=pyafipws
+
+[DBF]
+Encabezado = encabeza.dbf
+Tributo = tributo.dbf
+Iva = iva.dbf
+Comprobante Asociado = cbteasoc.dbf
+Detalle = detalles.dbf
+Permiso = permiso.dbf
+Dato = dato.dbf
+Datos Opcionales = opcional.dbf
+Forma Pago = formapago.dbf
+
+#[PROXY]
+#HOST=localhost
+#PORT=8000
+#USER=mariano
+#PASS=reingart

app/pyafipws/conf/thawte.crt

@@ -0,0 +1,19 @@
+-----BEGIN CERTIFICATE-----
+MIIDJzCCApCgAwIBAgIBATANBgkqhkiG9w0BAQQFADCBzjELMAkGA1UEBhMCWkEx
+FTATBgNVBAgTDFdlc3Rlcm4gQ2FwZTESMBAGA1UEBxMJQ2FwZSBUb3duMR0wGwYD
+VQQKExRUaGF3dGUgQ29uc3VsdGluZyBjYzEoMCYGA1UECxMfQ2VydGlmaWNhdGlv
+biBTZXJ2aWNlcyBEaXZpc2lvbjEhMB8GA1UEAxMYVGhhd3RlIFByZW1pdW0gU2Vy
+dmVyIENBMSgwJgYJKoZIhvcNAQkBFhlwcmVtaXVtLXNlcnZlckB0aGF3dGUuY29t
+MB4XDTk2MDgwMTAwMDAwMFoXDTIwMTIzMTIzNTk1OVowgc4xCzAJBgNVBAYTAlpB
+MRUwEwYDVQQIEwxXZXN0ZXJuIENhcGUxEjAQBgNVBAcTCUNhcGUgVG93bjEdMBsG
+A1UEChMUVGhhd3RlIENvbnN1bHRpbmcgY2MxKDAmBgNVBAsTH0NlcnRpZmljYXRp
+b24gU2VydmljZXMgRGl2aXNpb24xITAfBgNVBAMTGFRoYXd0ZSBQcmVtaXVtIFNl
+cnZlciBDQTEoMCYGCSqGSIb3DQEJARYZcHJlbWl1bS1zZXJ2ZXJAdGhhd3RlLmNv
+bTCBnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEA0jY2aovXwlue2oFBYo847kkE
+VdbQ7xwblRZH7xhINTpS9CtqBo87L+pW46+GjZ4X9560ZXUCTe/LCaIhUdib0GfQ
+ug2SBhRz1JPLlyoAnFxODLz6FVL88kRu2hFKbgifLy3j+ao6hnO2RlNYyIkFvYMR
+uHM/qgeN9EJN50CdHDcCAwEAAaMTMBEwDwYDVR0TAQH/BAUwAwEB/zANBgkqhkiG
+9w0BAQQFAAOBgQAmSCwWwlj66BZ0DKqqX1Q/8tfJeGBeXm43YyJ3Nn6yF8Q0ufUI
+hfzJATj/Tb7yFkJD57taRvvBxhEf8UqwKEbJw8RCfbz6q1lu1bdRiBHjpIUZa4JM
+pAwSremkrj/xw0llmozFyD4lt5SZu5IycQfwhl7tUCemDaYj+bvLpgcUQg==
+-----END CERTIFICATE-----

app/pyafipws/conf/wsctg.ini

@@ -0,0 +1,12 @@
+[WSAA]
+CERT=reingart.crt
+PRIVATEKEY=reingart.key
+#URL=https://wsaa.afip.gov.ar/ws/services/LoginCms
+
+[WSCTG]
+CUIT=20267565393
+ENTRADA=entrada_wsctg.csv
+SALIDA=salida_wsctg.csv
+#URL=https://cereales.afip.gov.ar/wsctg/services/CTGService
+#URL=https://cereales.afip.gov.ar/wsctg/services/CTGService_v1.1?wsdl
+

app/pyafipws/conf/wslpg.ini

@@ -0,0 +1,49 @@
+[WSAA]
+CERT=reingart.crt
+PRIVATEKEY=reingart.key
+#PROXY=mariano:clave@localhost:999
+#CACERT=afip_ca_info.crt
+#WRAPPER=pycurl
+#URL=https://wsaa.afip.gov.ar/ws/services/LoginCms
+
+[WSLPG]
+CUIT=20267565393
+ENTRADA=entrada_wslpg.txt
+SALIDA=salida_wslpg.txt
+#URL=https://serviciosjava.afip.gob.ar/wslpg/LpgService?wsdl
+#CACERT=afip_ca_info.crt
+#WRAPPER=pycurl
+
+[LIQUIDACION]
+FORMATO=liquidacion_form_c1116b_wslpg.csv
+FORMATO_AJUSTE_BASE=liquidacion_wslpg_ajuste_base.csv
+FORMATO_AJUSTE_DEBCRED=liquidacion_wslpg_ajuste_debcred.csv
+DIRECTORIO=PDF
+ARCHIVO=pto_emision,nro_orden
+PAPEL=A4
+ORIENTACION=portrait
+LOCALE=Spanish_Argentina.1252
+FMT_CANTIDAD=0.0
+FMT_PRECIO=0.2
+
+[PDF]
+#formulario=Formulario 1116 B (prueba)
+#lugar_y_fecha=Buenos Aires, 22 de Marzo de 2013
+art_27=Art. 27 inc. ...........................................................
+forma_pago=Forma de Pago: 1234 pesos ..........................................
+constancia=Por la presente dejo constancia.....................................
+#comprador=COMPRADOR
+#vendedor=VENDEDOR
+
+[DBF]
+Encabezado = Encabeza.dbf
+Certificacion = Certif.dbf
+Certificado = Certific.dbf
+Retencion = Retencio.dbf
+Deduccion = Deduccio.dbf
+AjusteCredito = AjusteCr.dbf
+AjusteDebito = AjusteDe.dbf
+CTG = ctgs.dbf
+DetMuestraAnalisis = DetMuest.dbf
+Dato = Dato.dbf
+

app/pyafipws/cot.py

@@ -0,0 +1,260 @@
+#!/usr/bin/python
+# -*- coding: latin-1 -*-
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU Lesser General Public License as published by the
+# Free Software Foundation; either version 3, or (at your option) any later
+# version.
+#
+# This program is distributed in the hope that it will be useful, but
+# WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTIBILITY
+# or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
+# for more details.
+
+# Based on MultipartPostHandler.py (C) 02/2006 Will Holcomb <wholcomb@gmail.com>
+# Ejemplos iniciales gracias a "Matias Gieco matigro@gmail.com"
+
+"Módulo para obtener remito electrónico automático (COT)"
+
+__author__ = "Mariano Reingart (reingart@gmail.com)"
+__copyright__ = "Copyright (C) 2010 Mariano Reingart"
+__license__ = "LGPL 3.0"
+__version__ = "1.02h"
+
+import os
+import sys
+import traceback
+from pysimplesoap.simplexml import SimpleXMLElement
+
+from .utils import WebClient
+
+HOMO = False
+CACERT = "conf/arba.crt"   # establecimiento de canal seguro (en producción)
+
+##URL = "https://cot.ec.gba.gob.ar/TransporteBienes/SeguridadCliente/presentarRemitos.do"
+# Nuevo servidor para el "Remito Electrónico Automático"
+URL = "http://cot.test.arba.gov.ar/TransporteBienes/SeguridadCliente/presentarRemitos.do"  # testing
+# URL = "https://cot.arba.gov.ar/TransporteBienes/SeguridadCliente/presentarRemitos.do"  # prod.
+
+
+class COT:
+    "Interfaz para el servicio de Remito Electronico ARBA"
+    _public_methods_ = ['Conectar', 'PresentarRemito', 'LeerErrorValidacion',
+                        'LeerValidacionRemito',
+                        'AnalizarXml', 'ObtenerTagXml']
+    _public_attrs_ = ['Usuario', 'Password', 'XmlResponse',
+                      'Version', 'Excepcion', 'Traceback', 'InstallDir',
+                      'CuitEmpresa', 'NumeroComprobante', 'CodigoIntegridad', 'NombreArchivo',
+                      'TipoError', 'CodigoError', 'MensajeError',
+                      'NumeroUnico', 'Procesado', 'COT',
+                      ]
+
+    _reg_progid_ = "COT"
+    _reg_clsid_ = "{7518B2CF-23E9-4821-BC55-D15966E15620}"
+
+    Version = "%s %s" % (__version__, HOMO and 'Homologación' or '')
+
+    def __init__(self):
+        self.Usuario = self.Password = None
+        self.TipoError = self.CodigoError = self.MensajeError = ""
+        self.LastID = self.LastCMP = self.CAE = self.CAEA = self.Vencimiento = ''
+        self.InstallDir = INSTALL_DIR
+        self.client = None
+        self.xml = None
+        self.limpiar()
+
+    def limpiar(self):
+        self.remitos = []
+        self.errores = []
+        self.XmlResponse = ""
+        self.Excepcion = self.Traceback = ""
+        self.TipoError = self.CodigoError = self.MensajeError = ""
+        self.CuitEmpresa = self.NumeroComprobante = self.COT = ""
+        self.NombreArchivo = self.CodigoIntegridad = ""
+        self.NumeroUnico = self.Procesado = ""
+
+    def Conectar(self, url=None, proxy="", wrapper=None, cacert=None, trace=False):
+        if HOMO or not url:
+            url = URL
+        self.client = WebClient(location=url, trace=trace, cacert=cacert)
+
+    def PresentarRemito(self, filename, testing=""):
+        self.limpiar()
+        try:
+            if not os.path.exists(filename):
+                self.Excepcion = "Archivo no encontrado: %s" % filename
+                return False
+
+            archivo = open(filename, "r")
+            if not testing:
+                response = self.client(
+                    user=self.Usuario, password=self.Password, file=archivo)
+            else:
+                response = open(testing).read()
+            self.XmlResponse = response
+            self.xml = SimpleXMLElement(response)
+            if 'tipoError' in self.xml:
+                self.TipoError = str(self.xml.tipoError)
+                self.CodigoError = str(self.xml.codigoError)
+                self.MensajeError = str(self.xml.mensajeError)
+            if 'cuitEmpresa' in self.xml:
+                self.CuitEmpresa = str(self.xml.cuitEmpresa)
+                self.NumeroComprobante = str(self.xml.numeroComprobante)
+                if 'cot' in self.xml:
+                    self.COT = str(self.xml.cot)
+                self.NombreArchivo = str(self.xml.nombreArchivo)
+                self.CodigoIntegridad = str(self.xml.codigoIntegridad)
+                if 'validacionesRemitos' in self.xml:
+                    for remito in self.xml.validacionesRemitos.remito:
+                        d = {
+                            'NumeroUnico': str(remito.numeroUnico),
+                            'Procesado': str(remito.procesado),
+                            'Errores': [],
+                        }
+                        if 'errores' in remito:
+                            for error in remito.errores.error:
+                                d['Errores'].append((
+                                    str(error.codigo),
+                                    str(error.descripcion)))
+                        self.remitos.append(d)
+                    # establecer valores del primer remito (sin eliminarlo)
+                    self.LeerValidacionRemito(pop=False)
+            return True
+        except Exception as e:
+            ex = traceback.format_exception(sys.exc_info()[0], sys.exc_info()[1], sys.exc_info()[2])
+            self.Traceback = ''.join(ex)
+            try:
+                self.Excepcion = traceback.format_exception_only(sys.exc_info()[0], sys.exc_info()[1])[0]
+            except BaseException:
+                self.Excepcion = "<no disponible>"
+            return False
+
+    def LeerValidacionRemito(self, pop=True):
+        "Leeo el próximo remito"
+        # por compatibilidad hacia atras, la primera vez no remueve de la lista
+        # (llamado de PresentarRemito con pop=False)
+        if self.remitos:
+            remito = self.remitos[0]
+            if pop:
+                del self.remitos[0]
+            self.NumeroUnico = remito['NumeroUnico']
+            self.Procesado = remito['Procesado']
+            self.errores = remito['Errores']
+            return True
+        else:
+            self.NumeroUnico = ""
+            self.Procesado = ""
+            self.errores = []
+            return False
+
+    def LeerErrorValidacion(self):
+        if self.errores:
+            error = self.errores.pop()
+            self.TipoError = ""
+            self.CodigoError = error[0]
+            self.MensajeError = error[1]
+            return True
+        else:
+            self.TipoError = ""
+            self.CodigoError = ""
+            self.MensajeError = ""
+            return False
+
+    def AnalizarXml(self, xml=""):
+        "Analiza un mensaje XML (por defecto la respuesta)"
+        try:
+            if not xml:
+                xml = self.XmlResponse
+            self.xml = SimpleXMLElement(xml)
+            return True
+        except Exception as e:
+            self.Excepcion = "%s" % (e)
+            return False
+
+    def ObtenerTagXml(self, *tags):
+        "Busca en el Xml analizado y devuelve el tag solicitado"
+        # convierto el xml a un objeto
+        try:
+            if self.xml:
+                xml = self.xml
+                # por cada tag, lo busco segun su nombre o posición
+                for tag in tags:
+                    xml = xml(tag)  # atajo a getitem y getattr
+                # vuelvo a convertir a string el objeto xml encontrado
+                return str(xml)
+        except Exception as e:
+            self.Excepcion = "%s" % (e)
+
+
+# busco el directorio de instalación (global para que no cambie si usan otra dll)
+if not hasattr(sys, "frozen"):
+    basepath = __file__
+elif sys.frozen == 'dll':
+    import win32api
+    basepath = win32api.GetModuleFileName(sys.frozendllhandle)
+else:
+    basepath = sys.executable
+INSTALL_DIR = os.path.dirname(os.path.abspath(basepath))
+
+
+if __name__ == "__main__":
+
+    if "--register" in sys.argv or "--unregister" in sys.argv:
+        import win32com.server.register
+        win32com.server.register.UseCommandLine(COT)
+        sys.exit(0)
+    elif len(sys.argv) < 4:
+        print("Se debe especificar el nombre de archivo, usuario y clave como argumentos!")
+        sys.exit(1)
+
+    cot = COT()
+    filename = sys.argv[1]      # TB_20111111112_000000_20080124_000001.txt
+    cot.Usuario = sys.argv[2]   # 20267565393
+    cot.Password = sys.argv[3]  # 23456
+
+    if '--testing' in sys.argv:
+        test_response = "cot_response_multiple_errores.xml"
+        #test_response = "cot_response_2_errores.xml"
+        #test_response = "cot_response_3_sinerrores.xml"
+    else:
+        test_response = ""
+
+    if not HOMO:
+        for i, arg in enumerate(sys.argv):
+            if arg.startswith("--prod"):
+                URL = URL.replace("http://cot.test.arba.gov.ar",
+                                  "https://cot.arba.gov.ar")
+                print("Usando URL:", URL)
+                break
+            if arg.startswith("https"):
+                URL = arg
+                print("Usando URL:", URL)
+                break
+
+    cot.Conectar(URL, trace='--trace' in sys.argv, cacert=CACERT)
+    cot.PresentarRemito(filename, testing=test_response)
+
+    if cot.Excepcion:
+        print("Excepcion:", cot.Excepcion)
+        print("Traceback:", cot.Traceback)
+
+    # datos generales:
+    print("CUIT Empresa:", cot.CuitEmpresa)
+    print("Numero Comprobante:", cot.NumeroComprobante)
+    print("COT:", cot.COT)
+    print("Nombre Archivo:", cot.NombreArchivo)
+    print("Codigo Integridad:", cot.CodigoIntegridad)
+
+    print("Error General:", cot.TipoError, "|", cot.CodigoError, "|", cot.MensajeError)
+
+    # recorro los remitos devueltos e imprimo sus datos por cada uno:
+    while cot.LeerValidacionRemito():
+        print("Numero Unico:", cot.NumeroUnico)
+        print("Procesado:", cot.Procesado)
+        while cot.LeerErrorValidacion():
+            print("Error Validacion:", "|", cot.CodigoError, "|", cot.MensajeError)
+
+    # Ejemplos de uso ObtenerTagXml
+    if False:
+        print("cuit", cot.ObtenerTagXml('cuitEmpresa'))
+        print("p0", cot.ObtenerTagXml('validacionesRemitos', 'remito', 0, 'procesado'))
+        print("p1", cot.ObtenerTagXml('validacionesRemitos', 'remito', 1, 'procesado'))

app/pyafipws/cot.pyw

@@ -0,0 +1,298 @@
+#!/usr/bin/python
+# -*- coding: utf-8 -*-
+
+"Aplicativo Visual (Front-end) Remito Electrónico (COT) ARBA"
+
+from __future__ import with_statement
+ 
+__author__ = "Mariano Reingart (reingart@gmail.com)"
+__copyright__ = "Copyright (C) 2013- Mariano Reingart"
+__license__ = "LGPL 3.0"
+
+import datetime
+import decimal
+import time
+import os
+import fnmatch
+import shelve
+import sys
+
+# importar gui2py (atajos)
+
+import gui          
+
+# establecer la configuración regional por defecto:
+import wx, locale
+if sys.platform == "win32":
+    locale.setlocale(locale.LC_ALL, 'Spanish_Argentina.1252')
+elif sys.platform == "linux2":
+    locale.setlocale(locale.LC_ALL, 'es_AR.utf8')
+loc = wx.Locale(wx.LANGUAGE_DEFAULT, wx.LOCALE_LOAD_DEFAULT)
+
+# importar el módulo principal de pyafipws para remito electrónico:
+
+from cot import COT
+
+# --- here goes your event handlers ---
+
+
+# --- gui2py designer generated code starts ---
+
+with gui.Window(name='mywin', title=u'COT: Remito Electr\xf3nico ARBA', 
+                resizable=True, height='450px', left='180', top='24', 
+                width='550px', bgcolor=u'#E0E0E0', fgcolor=u'#4C4C4C', 
+                image='', ):
+    gui.StatusBar(name='statusbar', )
+    with gui.Panel(label=u'', name='panel', image='', ):
+        gui.TextBox(name='usuario', left='299', top='10', width='105', 
+                    value=u'20267565393', )
+        gui.TextBox(name='clave', password=True, left='455', top='10', 
+                    width='75', )
+        gui.Line(name='line_25_556', height='3', left='24', top='390', 
+                 width='499', )
+        gui.Button(label=u'Salir', name='salir', left='440', top='394', 
+                   width='85', onclick='import sys; sys.exit(0)', )
+        gui.ComboBox(name=u'url', 
+                     text=u'http://cot.test.arba.gov.ar/TransporteBienes/SeguridadCliente/presentarRemitos.do', 
+                     height='29', left='79', top='42', width='250', 
+                     bgcolor=u'#FFFFFF', 
+                     data_selection=u'http://cot.test.arba.gov.ar/TransporteBienes/SeguridadCliente/presentarRemitos.do', 
+                     fgcolor=u'#4C4C4C', 
+                     items=[u'https://cot.arba.gov.ar/TransporteBienes/SeguridadCliente/presentarRemitos.do', u'http://cot.test.arba.gov.ar/TransporteBienes/SeguridadCliente/presentarRemitos.do'], 
+                     selection=1, 
+                     string_selection=u'http://cot.test.arba.gov.ar/TransporteBienes/SeguridadCliente/presentarRemitos.do', )
+        gui.Label(name='lblTest_273_363', height='17', left='234', top='15', 
+                  width='58', text=u'Usuario:', )
+        gui.Label(name='lblTest_273', height='17', left='410', top='14', 
+                  width='58', text=u'Clave:', )
+        gui.Gauge(name='gauge', height='18', left='20', top='365', 
+                  width='507', )
+        gui.Label(id=228, name='lblTest_228', height='17', left='341', 
+                  top='47', width='32', text=u'Carpeta:', )
+        with gui.ListView(id=213, name=u'remitos', height='74', left='20', 
+                          top='180', width='510', item_count=0, sort_column=0, ):
+            gui.ListColumn(name=u'nro', text=u'N\xb0 \xdanico Remito', 
+                           width=250, )
+            gui.ListColumn(name=u'proc', text=u'Procesado', )
+        with gui.ListView(name=u'archivos', height='99', left='21', top='77', 
+                          width='509', item_count=0, sort_column=2, ):
+            gui.ListColumn(name=u'txt', text='Archivo TXT', width=200, )
+            gui.ListColumn(name=u'xml', text='Archivo XML', )
+            gui.ListColumn(name=u'cuit', text='CUIT Empresa', )
+            gui.ListColumn(name=u'nro', text=u'N\xb0 Comprobante', )
+            gui.ListColumn(name=u'md5', text=u'C\xf3digo Integridad', )
+        with gui.ListView(id=309, name=u'errores', height='99', left='20', 
+                          top='259', width='510', item_count=0, sort_column=0, ):
+            gui.ListColumn(name=u'codigo', text=u'C\xf3digo', width=100, )
+            gui.ListColumn(name=u'descripcion', text=u'Descripci\xf3n Error', 
+                           width=400, )
+        gui.TextBox(id=488, mask='date', name='fecha',  
+                    left='101', top='10', width='127', enabled=False, 
+                    value=datetime.date(2014, 4, 5), )
+        gui.CheckBox(label=u'Fecha:', name=u'filtrar_fecha', height='24', 
+                     left='22', top='11', width='73', 
+                     tooltip=u'filtrar por fecha', )
+        gui.Label(id=2084, name='lblTest_228_2084', height='17', left='24', 
+                  top='47', width='32', text=u'URL:', )
+        gui.ComboBox(id=961, name=u'carpeta', text=u'datos', height='29', 
+                     left='412', top='42', width='118', bgcolor=u'#FFFFFF', 
+                     data_selection=u'datos', fgcolor=u'#4C4C4C', 
+                     items=[u'datos', u'procesados'], selection=0, 
+                     string_selection=u'datos', )
+        gui.Button(label=u'Procesar', name=u'procesar', left='20', top='394', 
+                   tooltip="Presentar el remito en ARBA",
+                   width='85', default=True, fgcolor=u'#4C4C4C', )
+        gui.Button(label=u'Mover Procesados', name=u'mover', left='112', 
+                   top='394', width='166', fgcolor=u'#4C4C4C', )
+
+# --- gui2py designer generated code ends ---
+
+# get a reference to the Top Level Window (used by designer / events handlers):
+mywin = gui.get("mywin")
+panel = mywin['panel']
+
+# Manejo simple de claves:
+
+passwd_db = shelve.open("passwd")
+
+def getpass(username):
+    password = passwd_db.get(str(username))
+    if not password:
+        password = gui.prompt(message=u"Ingrese contraseña",
+                              title="Usuario: %s" % username, 
+                              password=True) or ""
+    return password
+
+def setpass(username, password):
+    passwd_db[str(username)] = password
+
+def grabar_clave(evt):
+    setpass(panel['usuario'].value, panel['clave'].value)
+
+# asignar controladores 
+
+cot = COT()
+
+def listar_archivos(evt=None):
+    # cargar listado de archivos a procesar (y su correspondiente respuesta):
+    lv = panel['archivos']
+    lv.clear()
+    panel['remitos'].clear()
+    panel['errores'].clear()
+    # obtengo el fitlro de fecha (si esta habilitado):
+    if panel['filtrar_fecha'].value:
+        fecha = panel['fecha'].value.strftime("%Y%m%d")
+    else:
+        fecha = None
+    carpeta = panel['carpeta'].text or "."
+    for fn in os.listdir(carpeta):
+        if fnmatch.fnmatch(fn, 'TB_???????????_*.txt'):
+            # filtro por fecha (si esta tildado):
+            # TB_20111111112_000000_20080124_000001.txt
+            fecha_fn = fn[22:30]
+            if fecha and fecha != fecha_fn:
+                continue
+            txt = fn
+            xml = os.path.splitext(fn)[0] + ".xml"
+            if not os.path.exists(os.path.join(carpeta, xml)):
+                xml = ""
+            lv.items[fn] = {'txt': txt, 'xml': xml}
+
+def procesar_archivos(evt):
+    # establezco la barra de progreso con la cantidad de archivos:
+    panel['gauge'].max = len(panel['archivos'].items)
+    # recorro los archivos a procesar:
+    for i, item in enumerate(panel['archivos'].items):
+        panel['gauge'].value = i + 1
+        procesar_archivo(item, enviar=True)
+
+def cargar_archivo(evt):
+    # obtengo y proceso el archivo seleccionado:
+    item = evt.target.get_selected_items()[0]
+    procesar_archivo(item)
+
+def abrir_archivo(evt):
+    # obtengo y proceso el archivo seleccionado:
+    item = evt.target.get_selected_items()[0]
+    fn = os.path.join(panel['carpeta'].text, item['txt'])
+    try:
+        os.startfile(fn)
+    except AttributeError:
+        import subprocess
+        subprocess.run(["gedit", fn], check=False)
+
+def procesar_archivo(item, enviar=False):
+    "Enviar archivo a ARBA y analizar la respuesta"
+    
+    # establezco credenciales:
+    cuit = item['txt'][3:14]    
+    cot.Usuario = panel['usuario'].value = cuit
+    cot.Password = panel['clave'].value = getpass(cuit)
+    cot.Conectar(panel['url'].text, trace=True)
+
+    # obtengo la ruta al archivo de texto y xml
+    carpeta = panel['carpeta'].text
+    fn = os.path.join(carpeta, item['txt'])
+    xml = item['xml']
+    if xml:
+        xml = os.path.join(carpeta, xml)
+    elif not enviar:
+        return
+
+    # llamada al webservice:
+    cot.PresentarRemito(fn, testing=xml)
+
+    # grabo el xml devuelto:
+    if not xml:
+        xml = os.path.splitext(fn)[0] + ".xml"
+        with open(xml, "w") as f:
+            f.write(cot.XmlResponse)
+
+    if cot.Excepcion and enviar:
+        gui.alert(cot.Traceback, cot.Excepcion)
+     
+    if cot.TipoError and enviar:
+        gui.alert(cot.MensajeError, "Error %s: %s" % (cot.TipoError, cot.CodigoError))
+
+    # actualizo los datos devueltos en el listado    
+    item['cuit'] = cot.CuitEmpresa
+    item['nro'] = cot.NumeroComprobante
+    item['md5'] = cot.CodigoIntegridad
+    #assert item['txt'] == cot.NombreArchivo
+
+    # limpio, enumero y agrego los remitos para el archivo seleccionado: 
+    remitos = panel['remitos']
+    item['remitos'] = []
+    panel['errores'].items = []
+    remitos.items = []
+    i = 0
+    while cot.LeerValidacionRemito():
+        print "REMITO", i
+        errores = []
+        remito = {'nro': cot.NumeroUnico, 'proc': cot.Procesado,
+                  'errores': errores}
+        remitos.items[i] = remito
+        item['remitos'].append(remito)
+        i += 1
+        while cot.LeerErrorValidacion():
+            print "Error Validacion:", "|", cot.CodigoError, "|", cot.MensajeError
+            errores.append({'codigo': cot.CodigoError,
+                            'descripcion': cot.MensajeError})
+
+def cargar_errores(evt):
+    # obtengo el remito seleccionado:
+    item = evt.target.get_selected_items()[0]
+    # limpio, enumero y agrego los errores para el remito seleccionado: 
+    errores = panel['errores']
+    errores.items = []
+    for i, error in enumerate(item['errores']):
+        print i, error
+        errores.items[i] = error
+
+def filtro_fecha(evt):
+    panel['fecha'].enabled = evt.target.value
+    listar_archivos()
+
+
+def mover_archivos(evt=None):
+    carpeta = panel['carpeta'].text
+    if carpeta != "datos":
+        gui.alert("No se puede mover archivos de carpeta %s" % carpeta)
+        
+    i = 0
+    print panel['archivos'].items
+    for item in panel['archivos'].items:
+        procesado = all([remito.get('proc', 'NO') == 'SI' 
+                         for remito in item.get('remitos', [])])
+        if procesado and item.get('remitos'):
+            for fn in (item['txt'], item['xml']):
+                fn0 = os.path.join("datos", fn)
+                fn1 = os.path.join("procesados", fn)
+                try:
+                    os.rename(fn0, fn1)
+                    i += 1
+                except Exception, e:
+                    gui.alert(unicode(e), "No se puede mover %s" % fn)
+    gui.alert("Se movieron: %s archivos" % i)
+    listar_archivos()
+
+
+panel['archivos'].onitemselected = cargar_archivo 
+panel['archivos'].onmousedclick = abrir_archivo
+panel['remitos'].onitemselected = cargar_errores
+panel['filtrar_fecha'].onclick = filtro_fecha
+panel['fecha'].onchange = listar_archivos
+panel['carpeta'].onchange = listar_archivos
+panel['mover'].onclick = mover_archivos
+panel['procesar'].onclick = procesar_archivos
+panel['clave'].onchange = grabar_clave
+
+
+if __name__ == "__main__":
+    mywin.show()
+    mywin.title = u"%s - %s" % (mywin.title, cot.Version.decode("latin1"))
+    mywin['statusbar'].text = "" 
+    listar_archivos()
+    gui.main_loop()
+    passwd_db.close()
+

app/pyafipws/datos/TB_20111111112_000000_20080124_000001.txt

@@ -0,0 +1,18 @@
+01|20111111112
+02|20080124|91 R999900068148|20080124| |E|0| | |30682115722|COMPUMUNDO S.A.| 0|Ruta Prov | |S/N|  | | |1200|PUERTO DE ESCOBAR|B| |NO| 23246414254|COMPUMUNDO S.A. | 0|San Martin 5797| |S/N| | | |1766|TABLADA| B| 20045162673|  | | | | | |0
+03|847150|3|100|23891|COMP. SP-3960 VP|UNI DAD| 100
+03|852110|3|100|23763|VIDEO CAMARA GR-D750|UNI DAD|100
+03|852520|3|500|23666|PERS MOTO K1 SILVER + MEM|UNI DAD| 500
+03|852520|3|700|24159|PERSONAL NOKIA 5200 BLUE|UNI DAD| 700
+03|852520|3|200|24182|PERS S.ERI C W200 BLAC+MEM|UNI DAD|200
+03|852390|3|500|23348|DVD+R X10 4.7GB 10DPR120|UNI DAD|500
+03|847170|3|100|23842|HDD 250GB 7200RPM|UNI DAD| 100
+03|847160|3|500|23896|GAME PAD EUGA 10 BLUE B/W| UNI DAD| 500
+03|847330|3|400|22891|CART TWI NPACK 21 NEGRO|UNI DAD| 400
+03|850650|3|500|22693|PI LAS ALCALI NA AA X 4|UNI DAD| 500
+03|852431|3|200|23846|NORTON ANTIVIRUS 2007|UNI DAD| 200
+03|847170|3|400|23122|DVDRW 16X/18X DRU830A NEG|UNI DAD| 400
+03|847170|3|1000|23914|DVDRW AOPEN 20X BOX|UNI DAD| 1000
+03|852190|3|100|24248|REPROD DVD DVD-AVD800|UNI DAD| 100
+03|851822|3|100|23621|J.PARL HT- 685|UNI DAD| 100
+04| 1