Improve onboarding

frontend/src/router/ProtectedRoute.tsx

@@ -177,11 +177,24 @@ export const ProtectedRoute: React.FC<ProtectedRouteProps> = ({
     return <>{children}</>;
   }
 
+  // CRITICAL: If tenant access is still loading (undefined vs null), show loading state
+  // This prevents showing "unauthorized" during the async load of tenant permissions
+  const isTenantAccessLoading = currentTenant && currentTenantAccess === undefined;
+
+  if (isTenantAccessLoading) {
+    console.log('⏳ [ProtectedRoute] Waiting for tenant access to load...', {
+      hasTenant: !!currentTenant,
+      tenantId: currentTenant?.id,
+      accessIsUndefined: currentTenantAccess === undefined
+    });
+    return fallback || <LoadingSpinner message="Cargando permisos..." />;
+  }
+
   // Get user roles and permissions
   const globalUserRoles = user?.role ? [user.role] : [];
   const tenantRole = currentTenantAccess?.role;
   const tenantRoles = tenantRole ? [tenantRole] : [];
-  
+
   // Combine global and tenant roles for comprehensive access control
   const allUserRoles = [...globalUserRoles, ...tenantRoles];
   const tenantPermissions = currentTenantAccess?.permissions || [];
@@ -189,11 +202,28 @@ export const ProtectedRoute: React.FC<ProtectedRouteProps> = ({
   // Check if user can access this route
   const canAccess = canAccessRoute(route, isAuthenticated, allUserRoles, tenantPermissions);
 
+  console.log('🔐 [ProtectedRoute] Access check:', {
+    route: route.path,
+    canAccess,
+    globalUserRoles,
+    tenantRoles,
+    allUserRoles,
+    tenantPermissions,
+    currentTenantAccess
+  });
+
   if (!canAccess) {
     // Check if it's a permission issue or role issue
-    const hasRequiredRoles = !route.requiredRoles || 
+    const hasRequiredRoles = !route.requiredRoles ||
       route.requiredRoles.some(role => allUserRoles.includes(role as string));
-    
+
+    console.error('❌ [ProtectedRoute] Access denied:', {
+      route: route.path,
+      hasRequiredRoles,
+      requiredRoles: route.requiredRoles,
+      userRoles: allUserRoles
+    });
+
     if (!hasRequiredRoles) {
       return <UnauthorizedPage />;
     } else {