From 990915a05176bebd55ef9296f577c81d4da859af Mon Sep 17 00:00:00 2001
From: 4Ventures <4ventures@MacBook-Air-de-4Ventures.local>
Date: Mon, 28 Sep 2026 18:05:17 +0200
Subject: [PATCH] =?UTF-8?q?fix:=20Superhuman=20sync=20solo=20agencia=20?=
 =?UTF-8?q?=E2=80=94=20mensaje=20claro=20y=20bot=C3=B3n=20oculto=20a=20cli?=
 =?UTF-8?q?ente?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Co-authored-by: Cursor <cursoragent@cursor.com>
---
 src/app/api/admin/superhuman/sync/route.ts | 10 +++++++-
 src/app/api/seguimiento/route.ts           |  1 +
 src/components/SeguimientoBoard.tsx        | 29 ++++++++++++----------
 src/middleware.ts                          |  8 +++++-
 4 files changed, 33 insertions(+), 15 deletions(-)

diff --git a/src/app/api/admin/superhuman/sync/route.ts b/src/app/api/admin/superhuman/sync/route.ts
index 1f498b9..d9680ab 100644
--- a/src/app/api/admin/superhuman/sync/route.ts
+++ b/src/app/api/admin/superhuman/sync/route.ts
@@ -20,7 +20,15 @@ async function requireAgency() {
     data: { user },
   } = await supabase.auth.getUser();
   if (!user || !isAgencyRole(userRole(user))) {
-    return { error: NextResponse.json({ error: 'Forbidden' }, { status: 403 }) };
+    return {
+      error: NextResponse.json(
+        {
+          error:
+            'Forbidden: sincronizar Superhuman requiere rol agencia (admin/team).',
+        },
+        { status: 403 }
+      ),
+    };
   }
   if (!superhumanConfigured()) {
     return {
diff --git a/src/app/api/seguimiento/route.ts b/src/app/api/seguimiento/route.ts
index 7c1dd78..4328613 100644
--- a/src/app/api/seguimiento/route.ts
+++ b/src/app/api/seguimiento/route.ts
@@ -74,6 +74,7 @@ export async function GET() {
     portfolioWide: false,
     tenantId,
     entries,
+    isAgency: agency,
   });
 }
 
diff --git a/src/components/SeguimientoBoard.tsx b/src/components/SeguimientoBoard.tsx
index 7da893e..be3eb4e 100644
--- a/src/components/SeguimientoBoard.tsx
+++ b/src/components/SeguimientoBoard.tsx
@@ -33,6 +33,7 @@ type Payload = {
   tenantId?: string;
   hint?: string;
   entries: Entry[];
+  isAgency?: boolean;
 };
 
 function typeLabel(t: string) {
@@ -237,19 +238,21 @@ export default function SeguimientoBoard() {
             <Send className="w-3.5 h-3.5" />
             {noteBusy ? 'Guardando…' : 'Añadir al seguimiento'}
           </button>
-          <button
-            type="button"
-            disabled={syncBusy || !data.tenantId}
-            onClick={() => void syncSuperhuman()}
-            className="inline-flex items-center gap-2 rounded-xl border border-gray-200 bg-white px-4 py-2 text-sm font-semibold text-gray-800 hover:bg-gray-50 disabled:opacity-50"
-          >
-            {syncBusy ? (
-              <Loader2 className="w-3.5 h-3.5 animate-spin" />
-            ) : (
-              <Radio className="w-3.5 h-3.5 text-emerald-600" />
-            )}
-            Traer notas Superhuman
-          </button>
+          {data.isAgency ? (
+            <button
+              type="button"
+              disabled={syncBusy || !data.tenantId}
+              onClick={() => void syncSuperhuman()}
+              className="inline-flex items-center gap-2 rounded-xl border border-gray-200 bg-white px-4 py-2 text-sm font-semibold text-gray-800 hover:bg-gray-50 disabled:opacity-50"
+            >
+              {syncBusy ? (
+                <Loader2 className="w-3.5 h-3.5 animate-spin" />
+              ) : (
+                <Radio className="w-3.5 h-3.5 text-emerald-600" />
+              )}
+              Traer notas Superhuman
+            </button>
+          ) : null}
           {noteMsg ? (
             <p className="text-xs text-emerald-700">{noteMsg}</p>
           ) : null}
diff --git a/src/middleware.ts b/src/middleware.ts
index afb56bb..9e87f08 100644
--- a/src/middleware.ts
+++ b/src/middleware.ts
@@ -97,7 +97,13 @@ export async function middleware(req: NextRequest) {
 
   if (user && role === 'client' && path.startsWith('/api/admin/')) {
     return withSecurityHeaders(
-      NextResponse.json({ error: 'Forbidden' }, { status: 403 })
+      NextResponse.json(
+        {
+          error:
+            'Forbidden: solo usuarios agencia (admin/team) pueden usar esta acción. Entra con marketing@4ventures.es.',
+        },
+        { status: 403 }
+      )
     );
   }