From 417b53528becc814e87345693ae680426cef2298 Mon Sep 17 00:00:00 2001
From: Lizandro Guarnizo <77708265+lizandrogd@users.noreply.github.com>
Date: Thu, 9 Jul 2026 13:27:21 -0500
Subject: [PATCH] fix: detect device by token (cookie) before IP fallback in
 sidebar menu
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

For recepcionista and bacteriologo roles, module.php now checks the
turnero_token cookie first — same order as recepcion.php — so token-
registered devices show only their assigned desk/lugar in the menu.
IP fallback now requires token IS NULL to avoid ambiguous matches.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
---
 modules/turnero/module.php | 49 ++++++++++++++++++++++++++++----------
 1 file changed, 36 insertions(+), 13 deletions(-)

diff --git a/modules/turnero/module.php b/modules/turnero/module.php
index 44bbe45..81e1053 100644
--- a/modules/turnero/module.php
+++ b/modules/turnero/module.php
@@ -34,16 +34,28 @@ if ($_trIsRecep) {
     $_trLinks[] = ['name' => 'Verificar Paciente', 'icon' => 'fas fa-id-card',   'route' => '/erp.php?m=turnero&v=verificar_paciente'];
     $_trLinks[] = ['name' => 'Pantalla TV',        'icon' => 'fas fa-tv',        'route' => '/erp.php?m=turnero&v=display_global'];
 
-    // Detectar si la IP está asignada a un desk de recepción
+    // Detectar escritorio de recepción: primero por token, luego por IP
     $_trRecepIpDesk = null;
     try {
-        $_trRecepIpRow = $_trPdo->prepare(
-            "SELECT d.lugar_id FROM turnero_dispositivos d
-             JOIN turnero_lugares l ON l.id = d.lugar_id
-             WHERE d.ip = ? AND d.activo = 1 AND l.tipo = 'recepcion' LIMIT 1"
-        );
-        $_trRecepIpRow->execute([$_trClientIp]);
-        $_trRecepIpDesk = $_trRecepIpRow->fetchColumn() ?: null;
+        $_trDevToken = trim($_COOKIE['turnero_token'] ?? '');
+        if ($_trDevToken) {
+            $_trTokRow = $_trPdo->prepare(
+                "SELECT d.lugar_id FROM turnero_dispositivos d
+                 JOIN turnero_lugares l ON l.id = d.lugar_id
+                 WHERE d.token = ? AND d.activo = 1 AND l.tipo = 'recepcion' LIMIT 1"
+            );
+            $_trTokRow->execute([$_trDevToken]);
+            $_trRecepIpDesk = $_trTokRow->fetchColumn() ?: null;
+        }
+        if (!$_trRecepIpDesk) {
+            $_trRecepIpRow = $_trPdo->prepare(
+                "SELECT d.lugar_id FROM turnero_dispositivos d
+                 JOIN turnero_lugares l ON l.id = d.lugar_id
+                 WHERE d.ip = ? AND d.token IS NULL AND d.activo = 1 AND l.tipo = 'recepcion' LIMIT 1"
+            );
+            $_trRecepIpRow->execute([$_trClientIp]);
+            $_trRecepIpDesk = $_trRecepIpRow->fetchColumn() ?: null;
+        }
     } catch (\Throwable $_) {}
 
     if ($_trRecepIpDesk) {
@@ -73,13 +85,24 @@ if ($_trIsRecep) {
 
 // ── Bacteriólogo: sin dashboard ni historial; vista según IP ──
 } elseif ($_trIsBacte) {
+    // Detectar lugar de muestras: primero por token, luego por IP
     $_trIpLugar = null;
     try {
-        $_trIpRow = $_trPdo->prepare(
-            "SELECT lugar_id FROM turnero_dispositivos WHERE ip = ? AND activo = 1 LIMIT 1"
-        );
-        $_trIpRow->execute([$_trClientIp]);
-        $_trIpLugar = $_trIpRow->fetchColumn() ?: null;
+        $_trDevToken = trim($_COOKIE['turnero_token'] ?? '');
+        if ($_trDevToken) {
+            $_trTokRow2 = $_trPdo->prepare(
+                "SELECT lugar_id FROM turnero_dispositivos WHERE token = ? AND activo = 1 LIMIT 1"
+            );
+            $_trTokRow2->execute([$_trDevToken]);
+            $_trIpLugar = $_trTokRow2->fetchColumn() ?: null;
+        }
+        if (!$_trIpLugar) {
+            $_trIpRow = $_trPdo->prepare(
+                "SELECT lugar_id FROM turnero_dispositivos WHERE ip = ? AND token IS NULL AND activo = 1 LIMIT 1"
+            );
+            $_trIpRow->execute([$_trClientIp]);
+            $_trIpLugar = $_trIpRow->fetchColumn() ?: null;
+        }
     } catch (\Throwable $_) {}
 
     if ($_trIpLugar) {