fix(ci): timeout de Trivy insuficiente en el scan de imagen del frontend

El default de Trivy (5m) dejó de alcanzar para escanear la imagen del
frontend, igual que ya le había pasado a commerce-backend el
2026-08-16 ("context deadline exceeded" ~4m45s, justo tras terminar
el docker build). Se aplica el mismo fix ya validado en
build-medusa.yaml: --timeout 15m0s en ambos scans de imagen (CRITICAL
y HIGH), y se sube timeout-minutes del job de 20 a 30 para que quepan.

.gitea/workflows/build.yaml

@@ -122,7 +122,7 @@ jobs:
     needs: gitleaks
     if: github.event_name == 'push'
     runs-on: ubuntu-latest
-    timeout-minutes: 20
+    timeout-minutes: 30
 
     env:
       APP_DIR: workloads/ecommerce
@@ -367,6 +367,12 @@ jobs:
 
       # CRITICAL bloquea el pipeline: no se sube una imagen con una CVE
       # crítica conocida y con fix disponible.
+      # --timeout 15m0s: el default de Trivy (5m) dejó de alcanzar también
+      # para el frontend (visto en vivo: "context deadline exceeded" a los
+      # ~4m45s, en un run justo después de terminar el docker build, con
+      # el host bajo la misma inestabilidad de nodo vista ese día). Mismo
+      # fix ya aplicado en build-medusa.yaml el 2026-08-16 -- el supuesto
+      # de que el frontend era más liviano y no lo necesitaba ya no vale.
       - name: Escanear imagen (Trivy) — CRITICAL bloquea
         shell: bash
         run: |
@@ -375,6 +381,7 @@ jobs:
             --severity CRITICAL \
             --exit-code 1 \
             --ignore-unfixed \
+            --timeout 15m0s \
             "${IMAGE_NAME}:${{ steps.vars.outputs.VERSION }}"
 
       # HIGH solo informa por ahora — no bloquea mientras aprendemos a leer
@@ -387,6 +394,7 @@ jobs:
             --severity HIGH \
             --exit-code 0 \
             --ignore-unfixed \
+            --timeout 15m0s \
             "${IMAGE_NAME}:${{ steps.vars.outputs.VERSION }}"
 
       # SBOM de la imagen que ya pasó el gate de CRITICAL — describe

workloads/commerce-backend/src/api/middlewares.ts

@@ -0,0 +1,22 @@
+import { defineMiddlewares } from "@medusajs/medusa"
+
+// GET /store/products descarta en silencio la relacion `categories`
+// aunque `/admin/products` si la expone -- confirmado en vivo en la
+// auditoria de Fase 5 (ver docs/decisiones/0004-evaluacion-stack-multi-categoria.md).
+// Este es el patron oficial de Medusa v2 para ampliar los campos
+// permitidos de una ruta core restringida (middleware global sobre
+// req.allowed), no un query-config custom:
+// https://docs.medusajs.com/learn/fundamentals/api-routes/retrieve-custom-links
+export default defineMiddlewares({
+  routes: [
+    {
+      matcher: "/store/products",
+      middlewares: [
+        (req, res, next) => {
+          ;(req.allowed ??= []).push("categories")
+          next()
+        },
+      ],
+    },
+  ],
+})

workloads/docs-portal/patches/deployment.yaml

@@ -25,7 +25,7 @@ spec:
         runAsNonRoot: false
       containers:
         - name: app
-          image: gitea.cruzcloud.net/devops/docs-portal:v1.0.123
+          image: gitea.cruzcloud.net/devops/docs-portal:v1.0.125
           # El base saca TODAS las capabilities. Probado en vivo y
           # revertido: con drop: ALL (aunque se agregue NET_BIND_SERVICE
           # de vuelta) el propio entrypoint de nginx:1.27-alpine falla al

workloads/ecommerce/commerce/medusa/patches/deployment.yaml

@@ -65,7 +65,7 @@ spec:
               memory: 64Mi
 
         - name: migrations
-          image: gitea.cruzcloud.net/devops/ecommerce-medusa:v1.0.121
+          image: gitea.cruzcloud.net/devops/ecommerce-medusa:v1.0.127
           imagePullPolicy: IfNotPresent
           command:
             - node
@@ -86,7 +86,7 @@ spec:
 
       containers:
         - name: app
-          image: gitea.cruzcloud.net/devops/ecommerce-medusa:v1.0.121
+          image: gitea.cruzcloud.net/devops/ecommerce-medusa:v1.0.127
           imagePullPolicy: IfNotPresent
           envFrom:
             - configMapRef:

workloads/ecommerce/frontend/patches/deployment.yaml

@@ -25,7 +25,7 @@ spec:
         runAsUser: 1001
       containers:
         - name: app
-          image: gitea.cruzcloud.net/devops/ecommerce-frontend:v1.0.122
+          image: gitea.cruzcloud.net/devops/ecommerce-frontend:v1.0.129
           env:
             - name: HEADLESS_PROVIDER
               value: medusa

workloads/ecommerce/lib/headless/providers/medusa.ts

@@ -66,190 +66,6 @@ type MedusaProductsResponse = {
   offset?: number;
 };
 
-type LegacyMeta = {
-  category: string;
-  collection: string;
-  brand: string;
-  ageRange: string;
-  featured: boolean;
-  isNew: boolean;
-  fallbackImage: string;
-  fallbackThumbnail: string;
-};
-
-const legacyProductMeta: Record<string, LegacyMeta> = {
-  "toy-story-5-rex": {
-    "category": "Figuras",
-    "collection": "Toy Story",
-    "brand": "Disney Pixar",
-    "ageRange": "3+",
-    "featured": true,
-    "isNew": true,
-    "fallbackImage": "https://shop.cruzcloud.net/images/products/ari-001-toy-story-5-rex.webp",
-    "fallbackThumbnail": "https://shop.cruzcloud.net/images/thumbnails/ari-001-toy-story-5-rex.webp"
-  },
-  "toy-story-5-buzz-lightyear": {
-    "category": "Figuras",
-    "collection": "Toy Story",
-    "brand": "Disney Pixar",
-    "ageRange": "3+",
-    "featured": true,
-    "isNew": true,
-    "fallbackImage": "https://shop.cruzcloud.net/images/products/ari-002-toy-story-5-buzz-lightyear.webp",
-    "fallbackThumbnail": "https://shop.cruzcloud.net/images/thumbnails/ari-002-toy-story-5-buzz-lightyear.webp"
-  },
-  "toy-story-5-jessie": {
-    "category": "Figuras",
-    "collection": "Toy Story",
-    "brand": "Disney Pixar",
-    "ageRange": "3+",
-    "featured": true,
-    "isNew": true,
-    "fallbackImage": "https://shop.cruzcloud.net/images/products/ari-003-toy-story-5-jessie.webp",
-    "fallbackThumbnail": "https://shop.cruzcloud.net/images/thumbnails/ari-003-toy-story-5-jessie.webp"
-  },
-  "toy-story-5-woody": {
-    "category": "Figuras",
-    "collection": "Toy Story",
-    "brand": "Disney Pixar",
-    "ageRange": "3+",
-    "featured": true,
-    "isNew": true,
-    "fallbackImage": "https://shop.cruzcloud.net/images/products/ari-004-toy-story-5-woody.webp",
-    "fallbackThumbnail": "https://shop.cruzcloud.net/images/thumbnails/ari-004-toy-story-5-woody.webp"
-  },
-  "intensamente-furia": {
-    "category": "Peluches",
-    "collection": "Intensamente",
-    "brand": "Disney",
-    "ageRange": "3+",
-    "featured": true,
-    "isNew": true,
-    "fallbackImage": "https://shop.cruzcloud.net/images/products/ari-005-intensamente-furia.webp",
-    "fallbackThumbnail": "https://shop.cruzcloud.net/images/thumbnails/ari-005-intensamente-furia.webp"
-  },
-  "intensamente-tristeza": {
-    "category": "Peluches",
-    "collection": "Intensamente",
-    "brand": "Disney",
-    "ageRange": "3+",
-    "featured": true,
-    "isNew": true,
-    "fallbackImage": "https://shop.cruzcloud.net/images/products/ari-006-intensamente-tristeza.webp",
-    "fallbackThumbnail": "https://shop.cruzcloud.net/images/thumbnails/ari-006-intensamente-tristeza.webp"
-  },
-  "minnie-y-mickey-mouse": {
-    "category": "Peluches",
-    "collection": "Mickey & Minnie",
-    "brand": "Disney",
-    "ageRange": "3+",
-    "featured": true,
-    "isNew": false,
-    "fallbackImage": "https://shop.cruzcloud.net/images/products/ari-007-minnie-y-mickey-mouse.webp",
-    "fallbackThumbnail": "https://shop.cruzcloud.net/images/thumbnails/ari-007-minnie-y-mickey-mouse.webp"
-  },
-  "angel-lilo-y-stitch": {
-    "category": "Peluches",
-    "collection": "Lilo & Stitch",
-    "brand": "Disney",
-    "ageRange": "3+",
-    "featured": true,
-    "isNew": false,
-    "fallbackImage": "https://shop.cruzcloud.net/images/products/ari-008-angel-lilo-y-stitch.webp",
-    "fallbackThumbnail": "https://shop.cruzcloud.net/images/thumbnails/ari-008-angel-lilo-y-stitch.webp"
-  },
-  "mochilas-disney-coleccion-marvel": {
-    "category": "Mochilas",
-    "collection": "Marvel",
-    "brand": "Marvel",
-    "ageRange": "6+",
-    "featured": false,
-    "isNew": false,
-    "fallbackImage": "https://shop.cruzcloud.net/images/products/ari-009-mochilas-disney-coleccion-marvel.webp",
-    "fallbackThumbnail": "https://shop.cruzcloud.net/images/thumbnails/ari-009-mochilas-disney-coleccion-marvel.webp"
-  },
-  "mochila-ligera-y-resistente-al-agua-de-disney-frozen-mochila-escolar-y-de-viaje-con-multiples-compa": {
-    "category": "Mochilas",
-    "collection": "Frozen",
-    "brand": "Disney",
-    "ageRange": "6+",
-    "featured": false,
-    "isNew": false,
-    "fallbackImage": "https://shop.cruzcloud.net/images/products/ari-010-mochila-ligera-y-resistente-al-agua-de-d.webp",
-    "fallbackThumbnail": "https://shop.cruzcloud.net/images/thumbnails/ari-010-mochila-ligera-y-resistente-al-agua-de-d.webp"
-  },
-  "mochila-escolar-de-spider-man-de-disney-moda-estudiantil-libro-de-gran-capacidad-mochila-ligera": {
-    "category": "Mochilas",
-    "collection": "Marvel",
-    "brand": "Marvel",
-    "ageRange": "6+",
-    "featured": false,
-    "isNew": false,
-    "fallbackImage": "https://shop.cruzcloud.net/images/products/ari-011-mochila-escolar-de-spider-man-de-disney-.webp",
-    "fallbackThumbnail": "https://shop.cruzcloud.net/images/thumbnails/ari-011-mochila-escolar-de-spider-man-de-disney-.webp"
-  },
-  "disney-mochila-de-poliester-ultraligera-y-transpirable-de-gran-tamano-y-multiples-colores-dimension": {
-    "category": "Mochilas",
-    "collection": "Disney",
-    "brand": "Disney",
-    "ageRange": "6+",
-    "featured": false,
-    "isNew": false,
-    "fallbackImage": "https://shop.cruzcloud.net/images/products/ari-012-disney-mochila-de-poliester-ultraligera-.webp",
-    "fallbackThumbnail": "https://shop.cruzcloud.net/images/thumbnails/ari-012-disney-mochila-de-poliester-ultraligera-.webp"
-  },
-  "mochila-pequena-bob-esponja": {
-    "category": "Mochilas",
-    "collection": "Bob Esponja",
-    "brand": "Disney",
-    "ageRange": "6+",
-    "featured": false,
-    "isNew": false,
-    "fallbackImage": "https://shop.cruzcloud.net/images/products/ari-013-mochila-pequena-bob-esponja.webp",
-    "fallbackThumbnail": "https://shop.cruzcloud.net/images/thumbnails/ari-013-mochila-pequena-bob-esponja.webp"
-  },
-  "mochila-casual-de-gran-capacidad-con-estampado-de-bob-esponja-unisex-bolsa-escolar-de-dibujos-anim": {
-    "category": "Mochilas",
-    "collection": "Bob Esponja",
-    "brand": "Disney",
-    "ageRange": "6+",
-    "featured": false,
-    "isNew": false,
-    "fallbackImage": "https://shop.cruzcloud.net/images/products/ari-014-mochila-casual-de-gran-capacidad-con-est.webp",
-    "fallbackThumbnail": "https://shop.cruzcloud.net/images/thumbnails/ari-014-mochila-casual-de-gran-capacidad-con-est.webp"
-  },
-  "mochila-escolar-estilo-britanico-de-disney-con-proteccion-de-la-columna-vertebral-nueva-mochila-de": {
-    "category": "Mochilas",
-    "collection": "Disney",
-    "brand": "Disney",
-    "ageRange": "6+",
-    "featured": false,
-    "isNew": false,
-    "fallbackImage": "https://shop.cruzcloud.net/images/products/ari-015-mochila-escolar-estilo-britanico-de-disn.webp",
-    "fallbackThumbnail": "https://shop.cruzcloud.net/images/thumbnails/ari-015-mochila-escolar-estilo-britanico-de-disn.webp"
-  },
-  "disney-mochila-iron-man-de-poliester-ultraligera-y-transpirable-de-gran-tamano-dimensiones-46-cm-x": {
-    "category": "Mochilas",
-    "collection": "Marvel",
-    "brand": "Marvel",
-    "ageRange": "6+",
-    "featured": false,
-    "isNew": false,
-    "fallbackImage": "https://shop.cruzcloud.net/images/products/ari-016-disney-mochila-iron-man-de-poliester-ult.webp",
-    "fallbackThumbnail": "https://shop.cruzcloud.net/images/thumbnails/ari-016-disney-mochila-iron-man-de-poliester-ult.webp"
-  },
-  "mochila-de-disney-marvel-capitan-america-de-gran-capacidad-ligera-y-resistente-a-salpicaduras-par": {
-    "category": "Mochilas",
-    "collection": "Marvel",
-    "brand": "Marvel",
-    "ageRange": "6+",
-    "featured": false,
-    "isNew": false,
-    "fallbackImage": "https://shop.cruzcloud.net/images/products/ari-017-mochila-de-disney-marvel-capitan-america.webp",
-    "fallbackThumbnail": "https://shop.cruzcloud.net/images/thumbnails/ari-017-mochila-de-disney-marvel-capitan-america.webp"
-  }
-};
-
 function backendUrl(): string {
   const value = process.env.MEDUSA_BACKEND_URL;
   if (!value) {
@@ -338,7 +154,6 @@ function mapVariant(variant: MedusaVariant): ProductVariant {
 
 function mapProduct(product: MedusaProduct): Product {
   const slug = product.handle || product.id;
-  const legacy = legacyProductMeta[slug];
 
   const variant = product.variants?.[0];
   const calculated = variant?.calculated_price;
@@ -346,24 +161,16 @@ function mapProduct(product: MedusaProduct): Product {
   const category =
     product.categories?.[0]?.name ||
     stringMetadata(product.metadata, "category") ||
-    legacy?.category ||
     "Variedades";
 
   const collection =
     product.collection?.title ||
     stringMetadata(product.metadata, "collection") ||
-    legacy?.collection ||
     "";
 
-  const brand =
+  const brand = stringMetadata(product.metadata, "brand") || "ARI Shopping";
-    stringMetadata(product.metadata, "brand") ||
-    legacy?.brand ||
-    "ARI Shopping";
 
-  const ageRange =
+  const ageRange = stringMetadata(product.metadata, "ageRange") || "Todas";
-    stringMetadata(product.metadata, "ageRange") ||
-    legacy?.ageRange ||
-    "Todas";
 
   const images = [
     ...(product.images || [])
@@ -371,15 +178,8 @@ function mapProduct(product: MedusaProduct): Product {
       .filter(Boolean),
   ];
 
-  if (images.length === 0 && legacy?.fallbackImage) {
-    images.push(legacy.fallbackImage);
-  }
-
   const thumbnail =
-    product.thumbnail ||
+    product.thumbnail || images[0] || "/images/brand/logo-ari.png";
-    images[0] ||
-    legacy?.fallbackThumbnail ||
-    "/images/brand/logo-ari.png";
 
   const price =
     typeof calculated?.calculated_amount === "number"
@@ -426,14 +226,8 @@ function mapProduct(product: MedusaProduct): Product {
     currency: normalizeCurrency(calculated?.currency_code),
     priceLabel: price === null ? "Consultar disponibilidad" : "",
     available,
-    featured:
+    featured: booleanMetadata(product.metadata, "featured"),
-      booleanMetadata(product.metadata, "featured") ||
+    isNew: booleanMetadata(product.metadata, "isNew"),
-      legacy?.featured ||
-      false,
-    isNew:
-      booleanMetadata(product.metadata, "isNew") ||
-      legacy?.isNew ||
-      false,
     image: images[0] || thumbnail,
     thumbnail,
     images: images.length > 0 ? images : [thumbnail],
@@ -528,7 +322,7 @@ async function fetchProducts(
     // region_id.
     region_id: regionId(),
     fields:
-      "+metadata,+images,+tags,+categories,+collection,+variants.inventory_quantity,+variants.calculated_price,+variants.options",
+      "+metadata,+images,+tags,+categories.*,+collection,+variants.inventory_quantity,+variants.calculated_price,+variants.options",
   });
 
   if (filters?.query) {
@@ -559,7 +353,7 @@ export const medusaCatalogProvider: CatalogProvider = {
       // region_id.
       region_id: regionId(),
       fields:
-        "+metadata,+images,+tags,+categories,+collection,+variants.inventory_quantity,+variants.calculated_price,+variants.options",
+        "+metadata,+images,+tags,+categories.*,+collection,+variants.inventory_quantity,+variants.calculated_price,+variants.options",
     });
 
     const response = await medusaFetch<MedusaProductsResponse>(