From 6aaeaa724ffba98b9ac5796aa397f59807faf64b Mon Sep 17 00:00:00 2001
From: edelmezamx <edel.meza@pixir.com.mx>
Date: Sun, 5 Jul 2026 20:57:18 -0600
Subject: [PATCH 1/5] feat: add Empleado CRUD module with tests and security
 validation

---
 .opencode/plans/pipeline-mejoras.md           | 101 +++
 .opencode/skills/crud-module/SKILL.md         | 840 ++++++++++++++++++
 .opencode/skills/crud-pattern/SKILL.md        | 527 +++++++++++
 AGENTS.md                                     |  69 ++
 .../Controllers/EmpleadoController.cs         | 308 +++++++
 WebDevSecOps/Models/EmpCatTipoEmpleado.cs     |  15 +
 WebDevSecOps/Models/Empleado.cs               |  27 +
 .../Models/EmpleadoCreateViewModel.cs         |  33 +
 .../Models/EmpleadoDeleteViewModel.cs         |  31 +
 .../Models/EmpleadoDetailsViewModel.cs        |  34 +
 .../Models/EmpleadoUpdateViewModel.cs         |  42 +
 WebDevSecOps/Models/OperationResult.cs        |  22 +
 WebDevSecOps/Pages/Shared/_Layout.cshtml      |   3 +
 WebDevSecOps/Program.cs                       |  16 +
 WebDevSecOps/Services/EmpleadoService.cs      | 331 +++++++
 WebDevSecOps/Services/IEmpleadoService.cs     |  18 +
 WebDevSecOps/Services/ITipoEmpleadoService.cs |  10 +
 WebDevSecOps/Services/TipoEmpleadoService.cs  | 109 +++
 WebDevSecOps/Views/Empleado/Create.cshtml     | 121 +++
 WebDevSecOps/Views/Empleado/Delete.cshtml     |  79 ++
 WebDevSecOps/Views/Empleado/Details.cshtml    |  52 ++
 WebDevSecOps/Views/Empleado/Index.cshtml      | 129 +++
 WebDevSecOps/Views/Empleado/Update.cshtml     | 124 +++
 .../Services/EmpleadoApiClientTests.cs        | 305 +++++++
 .../Services/TipoEmpleadoApiClientTests.cs    | 142 +++
 .../SAST/EmpleadoSecurityTests.cs             | 161 ++++
 .../Common/ContractTestData.cs                |  93 ++
 .../Pages/Empleados/CreateTests.cs            | 113 +++
 .../Pages/Empleados/DeleteTests.cs            | 112 +++
 .../Pages/Empleados/IndexTests.cs             | 215 +++++
 .../Pages/Empleados/UpdateTests.cs            | 101 +++
 31 files changed, 4283 insertions(+)
 create mode 100644 .opencode/plans/pipeline-mejoras.md
 create mode 100644 .opencode/skills/crud-module/SKILL.md
 create mode 100644 .opencode/skills/crud-pattern/SKILL.md
 create mode 100644 AGENTS.md
 create mode 100644 WebDevSecOps/Controllers/EmpleadoController.cs
 create mode 100644 WebDevSecOps/Models/EmpCatTipoEmpleado.cs
 create mode 100644 WebDevSecOps/Models/Empleado.cs
 create mode 100644 WebDevSecOps/Models/EmpleadoCreateViewModel.cs
 create mode 100644 WebDevSecOps/Models/EmpleadoDeleteViewModel.cs
 create mode 100644 WebDevSecOps/Models/EmpleadoDetailsViewModel.cs
 create mode 100644 WebDevSecOps/Models/EmpleadoUpdateViewModel.cs
 create mode 100644 WebDevSecOps/Models/OperationResult.cs
 create mode 100644 WebDevSecOps/Services/EmpleadoService.cs
 create mode 100644 WebDevSecOps/Services/IEmpleadoService.cs
 create mode 100644 WebDevSecOps/Services/ITipoEmpleadoService.cs
 create mode 100644 WebDevSecOps/Services/TipoEmpleadoService.cs
 create mode 100644 WebDevSecOps/Views/Empleado/Create.cshtml
 create mode 100644 WebDevSecOps/Views/Empleado/Delete.cshtml
 create mode 100644 WebDevSecOps/Views/Empleado/Details.cshtml
 create mode 100644 WebDevSecOps/Views/Empleado/Index.cshtml
 create mode 100644 WebDevSecOps/Views/Empleado/Update.cshtml
 create mode 100644 tests/WebDevSecOps.IntegrationTests/Services/EmpleadoApiClientTests.cs
 create mode 100644 tests/WebDevSecOps.IntegrationTests/Services/TipoEmpleadoApiClientTests.cs
 create mode 100644 tests/WebDevSecOps.SecurityTests/SAST/EmpleadoSecurityTests.cs
 create mode 100644 tests/WebDevSecOps.UnitTests/Pages/Empleados/CreateTests.cs
 create mode 100644 tests/WebDevSecOps.UnitTests/Pages/Empleados/DeleteTests.cs
 create mode 100644 tests/WebDevSecOps.UnitTests/Pages/Empleados/IndexTests.cs
 create mode 100644 tests/WebDevSecOps.UnitTests/Pages/Empleados/UpdateTests.cs

diff --git a/.opencode/plans/pipeline-mejoras.md b/.opencode/plans/pipeline-mejoras.md
new file mode 100644
index 0000000..66a8fc7
--- /dev/null
+++ b/.opencode/plans/pipeline-mejoras.md
@@ -0,0 +1,101 @@
+# Plan de Mejoras — Pipeline CI
+
+## Cambios a realizar en `.github/workflows/ci.yml`
+
+### 1. Actualizar `actions/setup-dotnet` (4 ocurrencias)
+
+Encontrar `uses: actions/setup-dotnet@v4` y reemplazar por `uses: actions/setup-dotnet@v5` en:
+- Línea 36 (job `build`)
+- Línea 114 (job `codeql`)
+- Línea 165 (job `sast`)
+- Línea 200 (job `sca`)
+
+### 2. Actualizar `actions/dependency-review-action`
+
+Línea 148: `uses: actions/dependency-review-action@v4` → `uses: actions/dependency-review-action@v5`
+
+### 3. Actualizar `zaproxy/action-baseline`
+
+Línea 305: `uses: zaproxy/action-baseline@v0.14.0` → `uses: zaproxy/action-baseline@v0.15.0`
+
+### 4. Agregar NuGet caching en 4 jobs
+
+Insertar este bloque después del step `Setup .NET 10.0` en los jobs `build`, `codeql`, `sast`, `sca`:
+
+```yaml
+      - name: Cache NuGet packages
+        uses: actions/cache@v4
+        with:
+          path: ~/.nuget/packages
+          key: nuget-${{ runner.os }}-${{ hashFiles('**/*.csproj', '**/*.props') }}
+```
+
+#### Ubicación exacta para cada job:
+
+**Job `build`** — después de `Setup .NET 10.0`, antes de `Install SonarScanner`:
+```
+      - name: Setup .NET 10.0
+        uses: actions/setup-dotnet@v5
+        with:
+          dotnet-version: 10.0.x
+
+      - name: Cache NuGet packages          <-- INSERTAR AQUÍ
+        uses: actions/cache@v4
+        with:
+          path: ~/.nuget/packages
+          key: nuget-${{ runner.os }}-${{ hashFiles('**/*.csproj', '**/*.props') }}
+
+      - name: Install SonarScanner
+```
+
+**Job `codeql`** — después de `Setup .NET 10.0`, antes de `Initialize CodeQL`:
+```
+      - name: Setup .NET 10.0
+        uses: actions/setup-dotnet@v5
+        with:
+          dotnet-version: 10.0.x
+
+      - name: Cache NuGet packages          <-- INSERTAR AQUÍ
+        uses: actions/cache@v4
+        with:
+          path: ~/.nuget/packages
+          key: nuget-${{ runner.os }}-${{ hashFiles('**/*.csproj', '**/*.props') }}
+
+      - name: Initialize CodeQL
+```
+
+**Job `sast`** — después de `Setup .NET 10.0`, antes de `Restore`:
+```
+      - name: Setup .NET 10.0
+        uses: actions/setup-dotnet@v5
+        with:
+          dotnet-version: 10.0.x
+
+      - name: Cache NuGet packages          <-- INSERTAR AQUÍ
+        uses: actions/cache@v4
+        with:
+          path: ~/.nuget/packages
+          key: nuget-${{ runner.os }}-${{ hashFiles('**/*.csproj', '**/*.props') }}
+
+      - name: Restore
+```
+
+**Job `sca`** — después de `Setup .NET 10.0`, antes de `Restore`:
+```
+      - name: Setup .NET 10.0
+        uses: actions/setup-dotnet@v5
+        with:
+          dotnet-version: 10.0.x
+
+      - name: Cache NuGet packages          <-- INSERTAR AQUÍ
+        uses: actions/cache@v4
+        with:
+          path: ~/.nuget/packages
+          key: nuget-${{ runner.os }}-${{ hashFiles('**/*.csproj', '**/*.props') }}
+
+      - name: Restore
+```
+
+## Verificación
+
+Después de aplicar los cambios, hacer push y revisar que el pipeline pase correctamente.
diff --git a/.opencode/skills/crud-module/SKILL.md b/.opencode/skills/crud-module/SKILL.md
new file mode 100644
index 0000000..8fa815a
--- /dev/null
+++ b/.opencode/skills/crud-module/SKILL.md
@@ -0,0 +1,840 @@
+---
+name: "crud-module"
+description: "Patterns, conventions and file-by-file templates for creating new CRUD modules (like Empleado) following the established Usuario architecture. Use when building a new CRUD resource: controller, service, viewmodels, views, DI registration, and menu integration."
+license: "MIT"
+---
+
+# CRUD Module — Construction Guide
+
+This skill documents the exact file structure, patterns, and conventions used to build the **Usuario** CRUD module. Use it as a blueprint when creating a new CRUD resource (e.g., `Empleado`).
+
+## Project Structure for a CRUD Module
+
+Every CRUD module requires **14 new files** + **2 modifications** to existing files:
+
+```
+WebDevSecOps/
+├── Controllers/
+│   └── {Resource}Controller.cs              ← NEW (1)
+├── Models/
+│   ├── {Resource}.cs                         ← NEW (2) Entity model
+│   ├── {Resource}CreateViewModel.cs          ← NEW (3)
+│   ├── {Resource}UpdateViewModel.cs          ← NEW (4)
+│   ├── {Resource}DetailsViewModel.cs         ← NEW (5)
+│   └── {Resource}DeleteViewModel.cs          ← NEW (6)
+├── Services/
+│   ├── I{Resource}Service.cs                 ← NEW (7) Interface
+│   └── {Resource}Service.cs                  ← NEW (8) Implementation
+├── Views/
+│   └── {Resource}/
+│       ├── Index.cshtml                      ← NEW (9)
+│       ├── Create.cshtml                     ← NEW (10)
+│       ├── Details.cshtml                    ← NEW (11)
+│       ├── Update.cshtml                     ← NEW (12)
+│       └── Delete.cshtml                     ← NEW (13)
+├── Pages/Shared/
+│   └── _Layout.cshtml                        ← MODIFY (14) Add menu item
+└── Program.cs                                ← MODIFY (15) Register service
+```
+
+**Reusable shared files** (already exist, do NOT recreate):
+- `Models/PaginatedResponse<T>` — Generic pagination DTO
+- `Models/OperationResult.cs` — Result pattern for mutations (see below)
+- `Models/ApiErrorResponse.cs` — RFC 7807 error deserialization
+- `Services/SafeResponseLogger.cs` — Sanitized logging helper
+- `Views/_ViewImports.cshtml` — Namespace imports + tag helpers
+- `Views/_ViewStart.cshtml` — Layout reference
+
+## Naming Conventions
+
+| Element | Convention | Example |
+|---------|-----------|---------|
+| Controller | `{Resource}Controller` | `EmpleadoController` |
+| Service interface | `I{Resource}Service` | `IEmpleadoService` |
+| Service impl | `{Resource}Service` | `EmpleadoService` |
+| Entity model | `{Resource}` | `Empleado` |
+| ViewModel | `{Resource}{Action}ViewModel` | `EmpleadoCreateViewModel` |
+| View folder | `Views/{Resource}/` | `Views/Empleado/` |
+| Route segment | `/{Resource}/{action}` | `/Empleado/Index` |
+| API endpoint | `api/v1/{Resource}` | `api/v1/Empleado` |
+| String fields | Prefix `Str` | `StrNombre`, `StrTelefono` |
+| Date fields | Prefix `Dte` | `DteFechaRegistro` |
+| Cancellation token | `ct` | `CancellationToken ct` |
+
+## Controller Pattern (`{Resource}Controller.cs`)
+
+```csharp
+using Microsoft.AspNetCore.Authorization;
+using Microsoft.AspNetCore.Mvc;
+using WebDevSecOps.Models;
+using WebDevSecOps.Services;
+
+namespace WebDevSecOps.Controllers;
+
+[Authorize]
+public class EmpleadoController : Controller
+{
+    private readonly IEmpleadoService _service;
+    private readonly ILogger<EmpleadoController> _logger;
+
+    public EmpleadoController(IEmpleadoService service, ILogger<EmpleadoController> logger)
+    {
+        _service = service;
+        _logger = logger;
+    }
+```
+
+### Actions Checklist
+
+| # | Action | Verb | Parameters | Returns | Caching |
+|---|--------|------|-----------|---------|---------|
+| 1 | `Index` | GET | `int pageNumber = 1, int pageSize = 10` | `View(PaginatedResponse<{Resource}>)` | `[ResponseCache(Duration = 60, Location = ResponseCacheLocation.Client, NoStore = false)]` |
+| 2 | `Details` | GET | `int id, CancellationToken ct, string? returnUrl = null` | `View({Resource}DetailsViewModel)` | `[ResponseCache(Duration = 300, Location = ResponseCacheLocation.Client, NoStore = false)]` |
+| 3 | `Create` | GET | `string? returnUrl = null` | `View()` | None |
+| 4 | `Create` | POST | `{Resource}CreateViewModel model, CancellationToken ct, string? returnUrl = null` | `RedirectToAction("Index")` or `View(model)` | None |
+| 5 | `Update` | GET | `int id, CancellationToken ct, string? returnUrl = null` | `View({Resource}UpdateViewModel)` | None |
+| 6 | `Update` | POST | `{Resource}UpdateViewModel model, CancellationToken ct, string? returnUrl = null` | `RedirectToAction("Index")` or `View(model)` | None |
+| 7 | `Delete` | GET | `int id, CancellationToken ct, string? returnUrl = null` | `View({Resource}DeleteViewModel)` | None |
+| 8 | `Delete` | POST | `{Resource}DeleteViewModel model, CancellationToken ct, string? returnUrl = null` | `RedirectToAction("Index")` or `View(model)` | None |
+
+### Required Attributes on POST actions
+```csharp
+[HttpPost]
+[ValidateAntiForgeryToken]
+```
+
+### Error Handling Pattern (same for Create, Update, Delete POST)
+
+```csharp
+// After calling service method:
+if (result.Success)
+{
+    _logger.LogInformation("{Resource} {Id} created/updated/deleted successfully", id);
+    TempData["Success"] = "{Resource} procesado exitosamente.";
+    if (!string.IsNullOrEmpty(returnUrl) && Url.IsLocalUrl(returnUrl))
+        return Redirect(returnUrl);
+    return RedirectToAction("Index");
+}
+
+// Field errors
+if (result.FieldErrors is not null)
+{
+    foreach (var kvp in result.FieldErrors)
+    {
+        foreach (var msg in kvp.Value)
+        {
+            var key = kvp.Key switch
+            {
+                "strNombre" => nameof({Resource}UpdateViewModel.StrNombre),
+                // ... map other fields
+                _ => kvp.Key
+            };
+            ModelState.AddModelError(key, msg);
+        }
+    }
+}
+
+// General error
+if (result.ErrorMessage is not null)
+    ModelState.AddModelError(string.Empty, result.ErrorMessage);
+
+ViewData["ReturnUrl"] = returnUrl;
+return View(model);
+```
+
+### ReturnUrl Handling
+
+- Always accept `string? returnUrl = null` on every action.
+- Store in `ViewData["ReturnUrl"]` on GET.
+- Pass as hidden field `<input type="hidden" name="returnUrl" value="@ViewData["ReturnUrl"]" />` in forms.
+- On success, validate with `Url.IsLocalUrl(returnUrl)` before redirecting.
+- Pass `asp-route-returnUrl="@(Context.Request.Path + Context.Request.QueryString)"` in action links.
+
+## Entity Model (`Models/{Resource}.cs`)
+
+```csharp
+using System.Text.Json.Serialization;
+
+namespace WebDevSecOps.Models;
+
+public class Empleado
+{
+    [JsonPropertyName("id")]
+    public int Id { get; set; }
+
+    [JsonPropertyName("strNombre")]
+    public string StrNombre { get; set; } = string.Empty;
+
+    [JsonPropertyName("strCorreoElectronico")]
+    public string StrCorreoElectronico { get; set; } = string.Empty;
+
+    [JsonPropertyName("dteFechaRegistro")]
+    public DateTime DteFechaRegistro { get; set; }
+
+    [JsonPropertyName("rowVersion")]
+    public byte[]? RowVersion { get; set; }
+}
+```
+
+**Rules:**
+- `string` defaults to `string.Empty` (never null).
+- `RowVersion` is `byte[]?` on the entity, `byte[]` (non-nullable) on ViewModels.
+- Always use `[JsonPropertyName("snake_case")]` matching the API contract.
+
+## ViewModel Patterns
+
+### CreateViewModel
+
+```csharp
+using System.ComponentModel.DataAnnotations;
+using System.Text.Json.Serialization;
+
+namespace WebDevSecOps.Models;
+
+public class EmpleadoCreateViewModel
+{
+    [Required(ErrorMessage = "El nombre es obligatorio.")]
+    [StringLength(50, ErrorMessage = "El nombre no puede exceder los 50 caracteres.")]
+    [RegularExpression(@"^[a-zA-Z0-9_ ]+$", ErrorMessage = "El nombre solo permite letras, numeros y espacios.")]
+    [JsonPropertyName("strNombre")]
+    [Display(Name = "Nombre")]
+    public string StrNombre { get; set; } = string.Empty;
+
+    [Required(ErrorMessage = "El correo electronico es obligatorio.")]
+    [StringLength(50, ErrorMessage = "El correo no puede exceder los 50 caracteres.")]
+    [EmailAddress(ErrorMessage = "El formato del correo electronico no es valido.")]
+    [JsonPropertyName("strCorreoElectronico")]
+    [Display(Name = "Correo Electronico")]
+    public string StrCorreoElectronico { get; set; } = string.Empty;
+}
+```
+
+### UpdateViewModel — add hidden Id + RowVersion, nullable password
+
+```csharp
+[Required][JsonRequired][JsonPropertyName("id")]
+public int Id { get; set; }
+
+// ... same fields as Create but with RowVersion added:
+
+[Required][JsonPropertyName("rowVersion")]
+public byte[] RowVersion { get; set; } = [];
+
+// Optional password (nullable, not [Required]):
+[MinLength(8, ErrorMessage = "...")]
+[DataType(DataType.Password)]
+[JsonPropertyName("strPWD")]
+[Display(Name = "Contrasena")]
+public string? StrPWD { get; set; }
+```
+
+### DetailsViewModel — include DteFechaRegistro, read-only
+
+```csharp
+[Display(Name = "Nombre Completo")]
+[JsonPropertyName("strNombre")]
+public string StrNombre { get; set; } = string.Empty;
+
+[Display(Name = "Fecha de Registro")]
+[JsonPropertyName("dteFechaRegistro")]
+public DateTime DteFechaRegistro { get; set; }
+
+[Required][JsonPropertyName("rowVersion")]
+public byte[] RowVersion { get; set; } = [];
+```
+
+### DeleteViewModel — display-only fields + concurrency
+
+```csharp
+[Required][JsonRequired][JsonPropertyName("id")]
+public int Id { get; set; }
+
+[Display(Name = "Nombre")]
+public string StrNombre { get; set; } = string.Empty;
+
+[Required][JsonPropertyName("rowVersion")]
+public byte[] RowVersion { get; set; } = [];
+```
+
+## OperationResult (`Models/OperationResult.cs`)
+
+Reuse this pattern instead of creating a per-resource result class:
+
+```csharp
+namespace WebDevSecOps.Models;
+
+public class OperationResult
+{
+    public bool Success { get; }
+    public string? ErrorMessage { get; }
+    public Dictionary<string, string[]>? FieldErrors { get; }
+
+    private OperationResult(bool success, string? errorMessage, Dictionary<string, string[]>? fieldErrors)
+    {
+        Success = success;
+        ErrorMessage = errorMessage;
+        FieldErrors = fieldErrors;
+    }
+
+    public static OperationResult Ok() => new(true, null, null);
+    public static OperationResult Fail(string message) => new(false, message, null);
+    public static OperationResult Fail(Dictionary<string, string[]> fieldErrors, string? message = null)
+        => new(false, message, fieldErrors);
+}
+```
+
+If `CreateUsuarioResult` exists in the project, it can be renamed to `OperationResult` for reuse or kept as-is; either way, use this pattern in the new service.
+
+## Service Layer
+
+### Interface
+
+```csharp
+using WebDevSecOps.Models;
+
+namespace WebDevSecOps.Services;
+
+public interface IEmpleadoService
+{
+    Task<PaginatedResponse<Empleado>?> GetEmpleadosAsync(int pageNumber = 1, int pageSize = 10, CancellationToken ct = default);
+    Task<OperationResult> CreateEmpleadoAsync(EmpleadoCreateViewModel model, CancellationToken ct = default);
+    Task<Empleado?> GetEmpleadoByIdAsync(int id, CancellationToken ct = default);
+    Task<OperationResult> UpdateEmpleadoAsync(int id, EmpleadoUpdateViewModel model, CancellationToken ct = default);
+    Task<OperationResult> DeleteEmpleadoAsync(int id, byte[] rowVersion, CancellationToken ct = default);
+}
+```
+
+### Implementation Template
+
+```csharp
+using System.Net.Http.Json;
+using System.Text.Json;
+using WebDevSecOps.Models;
+
+namespace WebDevSecOps.Services;
+
+public class EmpleadoService : IEmpleadoService
+{
+    private readonly HttpClient _httpClient;
+    private readonly IHttpContextAccessor _httpContextAccessor;
+    private readonly ITokenStore _tokenStore;
+    private readonly ILogger<EmpleadoService> _logger;
+
+    public EmpleadoService(
+        HttpClient httpClient,
+        IHttpContextAccessor httpContextAccessor,
+        ITokenStore tokenStore,
+        ILogger<EmpleadoService> logger)
+    {
+        _httpClient = httpClient;
+        _httpContextAccessor = httpContextAccessor;
+        _tokenStore = tokenStore;
+        _logger = logger;
+    }
+
+    private string? GetToken()
+    {
+        var user = _httpContextAccessor.HttpContext?.User;
+        return user is not null ? _tokenStore.GetTokenFromPrincipal(user) : null;
+    }
+```
+
+#### Method — List (GET)
+
+```csharp
+public async Task<PaginatedResponse<Empleado>?> GetEmpleadosAsync(
+    int pageNumber = 1, int pageSize = 10, CancellationToken ct = default)
+{
+    var token = GetToken();
+    if (token is null) { _logger.LogWarning("No access token found"); return null; }
+
+    try
+    {
+        using var request = new HttpRequestMessage(
+            HttpMethod.Get, $"api/v1/Empleado?PageNumber={pageNumber}&PageSize={pageSize}");
+        request.Headers.Authorization =
+            new System.Net.Http.Headers.AuthenticationHeaderValue("Bearer", token);
+
+        var response = await _httpClient.SendAsync(request, ct);
+        response.EnsureSuccessStatusCode();
+        return await response.Content.ReadFromJsonAsync<PaginatedResponse<Empleado>>(cancellationToken: ct);
+    }
+    catch (OperationCanceledException ex)
+    {
+        _logger.LogWarning(ex, "Request was cancelled");
+        throw new OperationCanceledException("The request was cancelled.", ex);
+    }
+    catch (HttpRequestException ex)
+    {
+        _logger.LogError(ex, "Connection error");
+        return null;
+    }
+    catch (Exception ex)
+    {
+        _logger.LogError(ex, "Unexpected error");
+        return null;
+    }
+}
+```
+
+#### Method — GetById (GET)
+
+```csharp
+public async Task<Empleado?> GetEmpleadoByIdAsync(int id, CancellationToken ct = default)
+{
+    var token = GetToken();
+    if (token is null) { _logger.LogWarning("No access token found"); return null; }
+
+    try
+    {
+        using var request = new HttpRequestMessage(HttpMethod.Get, $"api/v1/Empleado/{id}");
+        request.Headers.Authorization =
+            new System.Net.Http.Headers.AuthenticationHeaderValue("Bearer", token);
+
+        var response = await _httpClient.SendAsync(request, ct);
+
+        if (response.IsSuccessStatusCode)
+            return await response.Content.ReadFromJsonAsync<Empleado>(cancellationToken: ct);
+
+        if (response.StatusCode == System.Net.HttpStatusCode.NotFound)
+        {
+            _logger.LogWarning("Empleado with id {Id} not found", id);
+            return null;
+        }
+
+        _logger.LogWarning("Get by id failed with status {StatusCode}", response.StatusCode);
+        return null;
+    }
+    catch (OperationCanceledException ex) { /* rethrow */ }
+    catch (HttpRequestException ex) { /* return null */ }
+    catch (Exception ex) { /* return null */ }
+}
+```
+
+#### Method — Create (POST)
+
+```csharp
+public async Task<OperationResult> CreateEmpleadoAsync(
+    EmpleadoCreateViewModel model, CancellationToken ct = default)
+{
+    var token = GetToken();
+    if (token is null) return OperationResult.Fail("Error de autenticacion. Inicie sesion nuevamente.");
+
+    try
+    {
+        using var request = new HttpRequestMessage(HttpMethod.Post, "api/v1/Empleado")
+        {
+            Content = JsonContent.Create(model)
+        };
+        request.Headers.Authorization =
+            new System.Net.Http.Headers.AuthenticationHeaderValue("Bearer", token);
+
+        var response = await _httpClient.SendAsync(request, ct);
+
+        if (response.IsSuccessStatusCode)
+        {
+            _logger.LogInformation("Empleado created successfully");
+            return OperationResult.Ok();
+        }
+
+        await SafeResponseLogger.LogResponseFailure(_logger, response, "CreateEmpleado", ct: ct);
+
+        var rawBody = await response.Content.ReadAsStringAsync(ct);
+        var errorResponse = JsonSerializer.Deserialize<ApiErrorResponse>(rawBody);
+
+        if (errorResponse?.Errors is not null && errorResponse.Errors.Count > 0)
+            return OperationResult.Fail(errorResponse.Errors, errorResponse.Title);
+
+        var message = errorResponse?.Detail ?? errorResponse?.Title ?? "Error al crear.";
+        return OperationResult.Fail(message);
+    }
+    catch (OperationCanceledException ex) { /* rethrow */ }
+    catch (HttpRequestException ex) { /* return Fail("Error de conexion...") */ }
+    catch (Exception ex) { /* return Fail("Error inesperado...") */ }
+}
+```
+
+#### Method — Update (PUT)
+
+```csharp
+public async Task<OperationResult> UpdateEmpleadoAsync(
+    int id, EmpleadoUpdateViewModel model, CancellationToken ct = default)
+{
+    // Same pattern as Create but:
+    //   - HttpMethod.Put
+    //   - URL: $"api/v1/Empleado/{id}"
+    //   - Handle 409 Conflict: return OperationResult.Fail("El registro fue modificado...")
+}
+```
+
+#### Method — Delete (DELETE)
+
+```csharp
+public async Task<OperationResult> DeleteEmpleadoAsync(
+    int id, byte[] rowVersion, CancellationToken ct = default)
+{
+    // Same pattern but:
+    //   - HttpMethod.Delete
+    //   - URL: $"api/v1/Empleado/{id}"
+    //   - Content: JsonContent.Create(new { id, rowVersion })
+    //   - Handle 409 Conflict
+}
+```
+
+### Exception Handling Taxonomy
+
+| Exception | Log Level | Behavior |
+|-----------|-----------|----------|
+| `OperationCanceledException` | Warning | Re-throw as `OperationCanceledException` |
+| `HttpRequestException` | Error | Return null (GET) or `OperationResult.Fail("Error de conexion...")` |
+| `Exception` (generic) | Error | Return null (GET) or `OperationResult.Fail("Error inesperado...")` |
+
+## Views
+
+### Index.cshtml — Paginated Table
+
+```razor
+@model PaginatedResponse<Empleado>
+@{
+    ViewData["Title"] = "Empleados";
+}
+
+<div class="container">
+    <div class="d-flex justify-content-between align-items-center mb-4">
+        <h2 class="mb-0">Empleados</h2>
+        <a class="btn btn-primary" asp-action="Create"
+           asp-route-returnUrl="@(Context.Request.Path + Context.Request.QueryString)">
+            + Agregar Empleado
+        </a>
+    </div>
+
+    @if (Model?.Items is null || Model.Items.Count == 0)
+    {
+        <div class="alert alert-info">No se encontraron empleados.</div>
+    }
+    else
+    {
+        <div class="table-responsive">
+            <table class="table table-striped table-hover align-middle">
+                <thead class="table-dark">
+                    <tr>
+                        <th scope="col">Nombre</th>
+                        <th scope="col">Correo Electronico</th>
+                        <th scope="col">Acciones</th>
+                    </tr>
+                </thead>
+                <tbody>
+                    @foreach (var item in Model.Items)
+                    {
+                        <tr>
+                            <td>@item.StrNombre</td>
+                            <td>@item.StrCorreoElectronico</td>
+                            <td>
+                                <a class="btn btn-sm btn-info" asp-action="Details"
+                                   asp-route-id="@item.Id"
+                                   asp-route-returnUrl="@(Context.Request.Path + Context.Request.QueryString)">Detalles</a>
+                                <a class="btn btn-sm btn-warning" asp-action="Update"
+                                   asp-route-id="@item.Id"
+                                   asp-route-returnUrl="@(Context.Request.Path + Context.Request.QueryString)">Actualizar</a>
+                                <a class="btn btn-sm btn-danger" asp-action="Delete"
+                                   asp-route-id="@item.Id"
+                                   asp-route-returnUrl="@(Context.Request.Path + Context.Request.QueryString)">Eliminar</a>
+                            </td>
+                        </tr>
+                    }
+                </tbody>
+            </table>
+        </div>
+
+        <!-- Pagination -->
+        <nav aria-label="Navegacion">
+            <ul class="pagination justify-content-center">
+                @if (Model.PageNumber > 1)
+                {
+                    <li class="page-item">
+                        <a class="page-link" href="/Empleado/Index?pageNumber=@(Model.PageNumber - 1)&amp;pageSize=@Model.PageSize">Anterior</a>
+                    </li>
+                }
+                else
+                {
+                    <li class="page-item disabled"><span class="page-link">Anterior</span></li>
+                }
+
+                @for (int i = 1; i <= Model.TotalPages; i++)
+                {
+                    <li class="page-item @(i == Model.PageNumber ? "active" : "")">
+                        <a class="page-link" href="/Empleado/Index?pageNumber=@i&amp;pageSize=@Model.PageSize">@i</a>
+                    </li>
+                }
+
+                @if (Model.PageNumber < Model.TotalPages)
+                {
+                    <li class="page-item">
+                        <a class="page-link" href="/Empleado/Index?pageNumber=@(Model.PageNumber + 1)&amp;pageSize=@Model.PageSize">Siguiente</a>
+                    </li>
+                }
+                else
+                {
+                    <li class="page-item disabled"><span class="page-link">Siguiente</span></li>
+                }
+            </ul>
+        </nav>
+
+        <p class="text-center text-muted small">
+            Mostrando pagina @Model.PageNumber de @Model.TotalPages (@Model.TotalCount registros)
+        </p>
+    }
+</div>
+```
+
+### Create.cshtml — Form with Validation
+
+```razor
+@model EmpleadoCreateViewModel
+@{
+    ViewData["Title"] = "Agregar Empleado";
+}
+
+<div class="container">
+    <div class="row justify-content-center">
+        <div class="col-md-8 col-lg-6">
+            <h2 class="mb-4">Agregar Empleado</h2>
+
+            @{
+                var generalErrors = ViewData.ModelState[string.Empty]?.Errors;
+            }
+            @if (generalErrors is { Count: > 0 })
+            {
+                <div class="alert alert-danger alert-dismissible fade show" role="alert">
+                    @foreach (var error in generalErrors)
+                    {
+                        <p class="mb-0">@error.ErrorMessage</p>
+                    }
+                    <button type="button" class="btn-close" data-bs-dismiss="alert" aria-label="Close"></button>
+                </div>
+            }
+
+            <form method="post" class="needs-validation" novalidate>
+                @Html.AntiForgeryToken()
+                <input type="hidden" name="returnUrl" value="@ViewData["ReturnUrl"]" />
+
+                @foreach (var prop in new[] { "StrNombre", "StrCorreoElectronico" })
+                {
+                    <div class="mb-3">
+                        <label asp-for="@prop" class="form-label"></label>
+                        <input asp-for="@prop" class="form-control" autocomplete="off"
+                               @(prop == "StrCorreoElectronico" ? @"type=""email""" : "") />
+                        <span asp-validation-for="@prop" class="text-danger"></span>
+                    </div>
+                }
+
+                <div class="d-flex gap-2">
+                    <button type="submit" class="btn btn-primary">Guardar</button>
+                    <a href="@(ViewData["ReturnUrl"] ?? Url.Action("Index"))" class="btn btn-secondary">Cancelar</a>
+                </div>
+            </form>
+        </div>
+    </div>
+</div>
+
+@section Scripts {
+    <partial name="_ValidationScriptsPartial" />
+}
+```
+
+### Client-Side JS Validation Pattern
+
+Always include in `@section Scripts` after `_ValidationScriptsPartial`:
+
+```javascript
+<script nonce="@(ViewContext.HttpContext.Items["ScriptNonce"])">
+(function () {
+    var nombreInput = document.getElementById('StrNombre');
+    if (nombreInput) {
+        nombreInput.addEventListener('input', function () {
+            var val = nombreInput.value;
+            var regex = /^[a-zA-Z0-9_ ]+$/;
+            if (val.length > 0 && !regex.test(val)) {
+                nombreInput.setCustomValidity('Solo letras, numeros, espacios y guion bajo');
+                nombreInput.classList.add('is-invalid');
+            } else {
+                nombreInput.setCustomValidity('');
+                nombreInput.classList.remove('is-invalid');
+                if (val.length > 0) nombreInput.classList.add('is-valid');
+            }
+        });
+    }
+
+    var emailInput = document.getElementById('StrCorreoElectronico');
+    if (emailInput) {
+        emailInput.addEventListener('blur', function () {
+            var val = emailInput.value.trim();
+            if (val.length > 0) {
+                var regex = /^[^\s@@]+@@[^\s@@]+\.[^\s@@]+$/;
+                if (!regex.test(val)) {
+                    emailInput.setCustomValidity('Formato de correo invalido');
+                    emailInput.classList.add('is-invalid');
+                } else {
+                    emailInput.setCustomValidity('');
+                    emailInput.classList.remove('is-invalid');
+                    emailInput.classList.add('is-valid');
+                }
+            }
+        });
+        emailInput.addEventListener('input', function () {
+            emailInput.setCustomValidity('');
+            emailInput.classList.remove('is-invalid');
+            emailInput.classList.remove('is-valid');
+        });
+    }
+
+    var form = document.querySelector('form.needs-validation');
+    if (form) {
+        form.addEventListener('submit', function (event) {
+            if (!form.checkValidity()) {
+                event.preventDefault();
+                event.stopPropagation();
+            }
+            form.classList.add('was-validated');
+        });
+    }
+})();
+</script>
+```
+
+### Details.cshtml — Card Display
+
+```razor
+@model EmpleadoDetailsViewModel
+@{
+    ViewData["Title"] = "Detalles del Empleado";
+}
+
+<div class="container">
+    <div class="row justify-content-center">
+        <div class="col-md-8 col-lg-6">
+            <h2 class="mb-4">Detalles del Empleado</h2>
+
+            @* General errors block (same as Create) *@
+
+            <div class="card">
+                <div class="card-body">
+                    <dl class="row mb-0">
+                        <dt class="col-sm-4">@Html.DisplayNameFor(m => m.StrNombre)</dt>
+                        <dd class="col-sm-8">@Model.StrNombre</dd>
+
+                        <dt class="col-sm-4">@Html.DisplayNameFor(m => m.StrCorreoElectronico)</dt>
+                        <dd class="col-sm-8">@Model.StrCorreoElectronico</dd>
+
+                        <dt class="col-sm-4">@Html.DisplayNameFor(m => m.DteFechaRegistro)</dt>
+                        <dd class="col-sm-8">@Model.DteFechaRegistro.ToString("dd/MM/yyyy HH:mm")</dd>
+                    </dl>
+                </div>
+            </div>
+
+            <div class="d-flex gap-2 mt-4">
+                <a class="btn btn-primary" asp-action="Update"
+                   asp-route-id="@Model.Id"
+                   asp-route-returnUrl="@(Context.Request.Path + Context.Request.QueryString)">Editar</a>
+                <a href="@(ViewData["ReturnUrl"] ?? Url.Action("Index"))" class="btn btn-secondary">Regresar</a>
+            </div>
+        </div>
+    </div>
+</div>
+```
+
+### Update.cshtml — Form with Hidden Fields
+
+Same as Create but with:
+- `<input asp-for="Id" type="hidden" />`
+- `<input asp-for="RowVersion" type="hidden" />`
+- Password field label: `"Contrasena (dejar en blanco para mantener)"`
+- Submit text: "Guardar"
+
+### Delete.cshtml — Confirmation
+
+```razor
+@model EmpleadoDeleteViewModel
+@{
+    ViewData["Title"] = "Eliminar Empleado";
+}
+
+<div class="container">
+    <div class="row justify-content-center">
+        <div class="col-md-8 col-lg-6">
+            <h2 class="mb-4">Eliminar Empleado</h2>
+
+            <div class="alert alert-warning" role="alert">
+                <i class="bi bi-exclamation-triangle"></i>
+                Esta accion no se puede deshacer. Confirme que desea eliminar permanentemente este empleado.
+            </div>
+
+            @* General errors block *@
+
+            <form method="post" class="needs-validation" novalidate>
+                @Html.AntiForgeryToken()
+                <input type="hidden" name="returnUrl" value="@ViewData["ReturnUrl"]" />
+                <input asp-for="Id" type="hidden" />
+                <input asp-for="RowVersion" type="hidden" />
+
+                <dl class="row mb-4">
+                    <dt class="col-sm-4">@Html.DisplayNameFor(m => m.StrNombre)</dt>
+                    <dd class="col-sm-8">@Model.StrNombre</dd>
+
+                    <dt class="col-sm-4">@Html.DisplayNameFor(m => m.StrCorreoElectronico)</dt>
+                    <dd class="col-sm-8">@Model.StrCorreoElectronico</dd>
+                </dl>
+
+                <div class="d-flex gap-2">
+                    <button type="submit" class="btn btn-danger">Confirmar Eliminar</button>
+                    <a href="@(ViewData["ReturnUrl"] ?? Url.Action("Index"))" class="btn btn-secondary">Cancelar</a>
+                </div>
+            </form>
+        </div>
+    </div>
+</div>
+```
+
+## Menu Integration (`_Layout.cshtml`)
+
+Add inside the `@if (User.Identity?.IsAuthenticated == true)` block, **after** the Usuarios `<li>`:
+
+```html
+<li class="nav-item">
+    <a class="nav-link text-dark" href="/Empleado/Index">Empleados</a>
+</li>
+```
+
+## DI Registration (`Program.cs`)
+
+Add after the existing `IUsuarioService` registration:
+
+```csharp
+builder.Services.AddHttpClient<IEmpleadoService, EmpleadoService>(client =>
+{
+    client.BaseAddress = new Uri(builder.Configuration["ApiSettings:BaseUrl"]
+        ?? throw new InvalidOperationException("ApiSettings:BaseUrl is not configured."));
+    client.Timeout = TimeSpan.FromSeconds(30);
+})
+.AddStandardResilienceHandler();
+```
+
+## Quick-Start Checklist
+
+When creating a new CRUD module, follow these steps in order:
+
+- [ ] Create `Models/{Resource}.cs` — entity with `[JsonPropertyName]`
+- [ ] Create `Models/{Resource}CreateViewModel.cs` — validation attributes
+- [ ] Create `Models/{Resource}UpdateViewModel.cs` — add Id, RowVersion, nullable password
+- [ ] Create `Models/{Resource}DetailsViewModel.cs` — include DteFechaRegistro
+- [ ] Create `Models/{Resource}DeleteViewModel.cs` — display fields + RowVersion
+- [ ] Create `Services/I{Resource}Service.cs` — 5 methods
+- [ ] Create `Services/{Resource}Service.cs` — HttpClient implementation
+- [ ] Create `Controllers/{Resource}Controller.cs` — 8 actions
+- [ ] Create `Views/{Resource}/Index.cshtml` — table + pagination
+- [ ] Create `Views/{Resource}/Create.cshtml` — form + JS validation
+- [ ] Create `Views/{Resource}/Details.cshtml` — card display
+- [ ] Create `Views/{Resource}/Update.cshtml` — form + hidden fields
+- [ ] Create `Views/{Resource}/Delete.cshtml` — confirmation
+- [ ] Add `<li>` to `_Layout.cshtml` menu (after Usuarios)
+- [ ] Register `I{Resource}Service` in `Program.cs`
diff --git a/.opencode/skills/crud-pattern/SKILL.md b/.opencode/skills/crud-pattern/SKILL.md
new file mode 100644
index 0000000..ff2ea63
--- /dev/null
+++ b/.opencode/skills/crud-pattern/SKILL.md
@@ -0,0 +1,527 @@
+# Skill: crud-pattern
+
+# CRUD Module Implementation Pattern
+
+Guía paso a paso para implementar un nuevo módulo CRUD en este proyecto, siguiendo el patrón establecido por `Usuario` y `Empleado`.
+
+## Orden de creación
+
+```
+ 1. Models/        → Modelo de dominio + ViewModels por acción + OperationResult (si no existe)
+ 2. Services/      → Interfaz + Implementación (HttpClient)
+ 3. Program.cs     → Registro DI con AddHttpClient + AddStandardResilienceHandler
+ 4. Controllers/   → Controlador con 8 acciones
+ 5. Views/         → Vistas Razor (Index, Create, Details, Update, Delete)
+ 6. _Layout.cshtml → Ítem de menú
+ 7. Unit tests     → IndexTests, CreateTests, UpdateTests, DeleteTests
+ 8. Integration tests → ApiClientTests
+ 9. Security tests → Auth + validación + XSS
+```
+
+---
+
+## 1. Modelos (`Models/`)
+
+### Modelo de dominio
+Clase plana que refleja la respuesta de la API.
+
+```csharp
+namespace WebDevSecOps.Models;
+
+public class MiEntidad
+{
+    public int Id { get; set; }
+    public string StrNombre { get; set; } = string.Empty;
+    public byte[] RowVersion { get; set; } = [];
+}
+```
+
+### ViewModels (uno por acción)
+- `{Entidad}CreateViewModel.cs` — solo campos editables en creación
+- `{Entidad}UpdateViewModel.cs` — mismos campos + `Id` oculto
+- `{Entidad}DetailsViewModel.cs` — campos de solo lectura + `StrValorCatalogo` para catálogos
+- `{Entidad}DeleteViewModel.cs` — confirmación + `RowVersion` (byte[]) para concurrencia
+
+```csharp
+public class MiEntidadCreateViewModel
+{
+    [Required(ErrorMessage = "El campo {0} es obligatorio.")]
+    [StringLength(100)]
+    [Display(Name = "Nombre")]
+    public string StrNombre { get; set; } = string.Empty;
+}
+```
+
+```csharp
+public class MiEntidadDeleteViewModel
+{
+    [HiddenInput]
+    public int Id { get; set; }
+
+    [HiddenInput]
+    public byte[] RowVersion { get; set; } = [];
+}
+```
+
+### OperationResult
+```csharp
+namespace WebDevSecOps.Models;
+
+public class OperationResult
+{
+    public bool Success { get; protected set; }
+    public string Message { get; protected set; } = string.Empty;
+
+    public static OperationResult Ok(string message = "Operación exitosa!!") => new() { Success = true, Message = message };
+    public static OperationResult Fail(string message) => new() { Success = false, Message = message };
+}
+
+public class OperationResult<T> : OperationResult
+{
+    public T? Data { get; private set; }
+
+    public static OperationResult<T> Ok(T data, string message = "Operación exitosa!!") => new() { Success = true, Message = message, Data = data };
+    public static new OperationResult<T> Fail(string message) => new() { Success = false, Message = message };
+}
+```
+
+---
+
+## 2. Servicios (`Services/`)
+
+### Interfaz
+```csharp
+public interface IMiEntidadService
+{
+    Task<PaginatedResponse<MiEntidad>?> GetMiEntidadesAsync(int pageNumber, int pageSize, CancellationToken ct);
+    Task<MiEntidad?> GetMiEntidadByIdAsync(int id, CancellationToken ct);
+    Task<OperationResult> CreateMiEntidadAsync(MiEntidadCreateViewModel model, CancellationToken ct);
+    Task<OperationResult> UpdateMiEntidadAsync(int id, MiEntidadUpdateViewModel model, CancellationToken ct);
+    Task<OperationResult> DeleteMiEntidadAsync(int id, byte[] rowVersion, CancellationToken ct);
+    Task<PaginatedResponse<MiEntidad>?> SearchMiEntidadesAsync(string? texto, int? idCatalogo, int pageNumber, int pageSize, CancellationToken ct);
+}
+```
+
+### Implementación
+```csharp
+public class MiEntidadService : IMiEntidadService
+{
+    private readonly HttpClient _httpClient;
+    private readonly IHttpContextAccessor _httpContextAccessor;
+
+    public MiEntidadService(HttpClient httpClient, IHttpContextAccessor httpContextAccessor)
+    {
+        _httpClient = httpClient;
+        _httpContextAccessor = httpContextAccessor;
+    }
+
+    private void AttachBearerToken(HttpRequestMessage request)
+    {
+        var token = _httpContextAccessor.HttpContext?.User.FindFirst("access_token")?.Value;
+        if (token is not null)
+            request.Headers.Authorization = new AuthenticationHeaderValue("Bearer", token);
+    }
+
+    public async Task<PaginatedResponse<MiEntidad>?> GetMiEntidadesAsync(int pageNumber, int pageSize, CancellationToken ct)
+    {
+        using var request = new HttpRequestMessage(HttpMethod.Get, $"api/v1/MiEntidad?PageNumber={pageNumber}&PageSize={pageSize}");
+        AttachBearerToken(request);
+
+        var response = await _httpClient.SendAsync(request, ct);
+        response.EnsureSuccessStatusCode();
+        return await response.Content.ReadFromJsonAsync<PaginatedResponse<MiEntidad>>(cancellationToken: ct);
+    }
+
+    // ... resto de métodos siguiendo el mismo patrón
+}
+```
+
+### Servicio de catálogo (read-only)
+Si el CRUD necesita un dropdown desde un catálogo:
+
+```csharp
+public interface IMiCatalogoService
+{
+    Task<PaginatedResponse<MiCatalogo>?> GetAllAsync(int pageNumber, int pageSize, CancellationToken ct);
+    Task<MiCatalogo?> GetByIdAsync(int id, CancellationToken ct);
+}
+```
+
+---
+
+## 3. Registro en `Program.cs`
+
+```csharp
+builder.Services.AddHttpClient<IMiEntidadService, MiEntidadService>(client =>
+{
+    client.BaseAddress = new Uri("https://localhost:7227/");
+}).AddStandardResilienceHandler();
+
+builder.Services.AddHttpClient<IMiCatalogoService, MiCatalogoService>(client =>
+{
+    client.BaseAddress = new Uri("https://localhost:7227/");
+}).AddStandardResilienceHandler();
+```
+
+Colocar después de los registros existentes de UsuarioService.
+
+---
+
+## 4. Controlador (`Controllers/{Entidad}Controller.cs`)
+
+### 8 acciones
+
+| Verbo | Ruta | Propósito |
+|-------|------|-----------|
+| GET | `Index?texto=&idTipoEmpleado=&pageNumber=&pageSize=` | Lista paginada con filtros |
+| GET | `Create` | Formulario de creación |
+| POST | `Create` | Procesar creación |
+| GET | `Details/{id}` | Vista de solo lectura |
+| GET | `Update/{id}` | Formulario de edición |
+| POST | `Update` | Procesar edición |
+| GET | `Delete/{id}` | Confirmación de eliminación |
+| POST | `Delete` | Procesar eliminación |
+
+### Filtrado en Index
+```csharp
+[HttpGet]
+[ResponseCache(Duration = 60, Location = ResponseCacheLocation.Client, NoStore = false)]
+public async Task<IActionResult> Index(string? texto = null, int? idTipoEmpleado = null, int pageNumber = 1, int pageSize = 10, CancellationToken ct = default)
+{
+    await CargarCatalogosAsync(ct);
+
+    PaginatedResponse<MiEntidad>? result;
+
+    if (!string.IsNullOrWhiteSpace(texto) || idTipoEmpleado.HasValue)
+        result = await _service.SearchMiEntidadesAsync(texto, idTipoEmpleado, pageNumber, pageSize, ct);
+    else
+        result = await _service.GetMiEntidadesAsync(pageNumber, pageSize, ct);
+
+    if (result is null)
+    {
+        _logger.LogWarning("Failed to load entidades");
+        TempData["Error"] = "No se pudieron cargar los registros.";
+    }
+
+    return View(result);
+}
+```
+
+### Dropdown helper
+```csharp
+private async Task CargarCatalogosAsync(CancellationToken ct)
+{
+    var catalogos = await _catalogoService.GetAllAsync(1, 100, ct);
+    if (catalogos?.Items is not null)
+    {
+        ViewBag.CatalogoList = new SelectList(catalogos.Items, "Id", "StrValor");
+        ViewBag.CatalogoDict = catalogos.Items.ToDictionary(c => c.Id, c => c.StrValor);
+    }
+}
+```
+
+### POST actions — patrón general
+```csharp
+[HttpPost]
+[ValidateAntiForgeryToken]
+public async Task<IActionResult> Create(MiEntidadCreateViewModel model, CancellationToken ct, string? returnUrl = null)
+{
+    if (!ModelState.IsValid)
+    {
+        await CargarCatalogosAsync(ct);
+        return View(model);
+    }
+
+    var result = await _service.CreateMiEntidadAsync(model, ct);
+
+    if (!result.Success)
+    {
+        ModelState.AddModelError("", result.Message);
+        await CargarCatalogosAsync(ct);
+        return View(model);
+    }
+
+    TempData["Success"] = result.Message;
+
+    if (!string.IsNullOrEmpty(returnUrl) && Url.IsLocalUrl(returnUrl))
+        return Redirect(returnUrl);
+
+    return RedirectToAction(nameof(Index));
+}
+```
+
+---
+
+## 5. Vistas (`Views/{Entidad}/`)
+
+### Index.cshtml — Lista paginada con filtros
+```html
+@model PaginatedResponse<MiEntidad>
+
+<form method="get" class="row g-3 mb-3">
+    <div class="col-md-4">
+        <input type="text" name="texto" class="form-control" placeholder="Buscar..." value="@Context.Request.Query["texto"]" />
+    </div>
+    <div class="col-md-3">
+        <select name="idTipoEmpleado" class="form-select" asp-items="ViewBag.CatalogoList">
+            <option value="">— Todos —</option>
+        </select>
+    </div>
+    <div class="col-md-2">
+        <button type="submit" class="btn btn-primary">Buscar</button>
+        <a asp-action="Index" class="btn btn-outline-secondary">Limpiar</a>
+    </div>
+    <div class="col-md-3 text-end">
+        <a asp-action="Create" class="btn btn-success">Nuevo</a>
+    </div>
+</form>
+
+<table class="table">
+    <thead>
+        <tr>
+            <th>Nombre</th>
+            <th>Catálogo</th>
+            <th>Acciones</th>
+        </tr>
+    </thead>
+    <tbody>
+        @if (Model?.Items is not null)
+        {
+            @foreach (var item in Model.Items)
+            {
+                <tr>
+                    <td>@item.StrNombre</td>
+                    <td>@(ViewBag.CatalogoDict?[item.IdTipoEmpleado] ?? "")</td>
+                    <td>
+                        <a asp-action="Details" asp-route-id="@item.Id" class="btn btn-sm btn-info">Detalles</a>
+                        <a asp-action="Update" asp-route-id="@item.Id" class="btn btn-sm btn-warning">Editar</a>
+                        <a asp-action="Delete" asp-route-id="@item.Id" class="btn btn-sm btn-danger">Eliminar</a>
+                    </td>
+                </tr>
+            }
+        }
+    </tbody>
+</table>
+
+@if (Model is not null)
+{
+    <nav>
+        <ul class="pagination">
+            @for (int i = 1; i <= Model.TotalPages; i++)
+            {
+                <li class="page-item @(i == Model.PageNumber ? "active" : "")">
+                    <a class="page-link" asp-action="Index" asp-route-pageNumber="@i" asp-route-texto="@Context.Request.Query["texto"]" asp-route-idTipoEmpleado="@Context.Request.Query["idTipoEmpleado"]">@i</a>
+                </li>
+            }
+        </ul>
+    </nav>
+}
+```
+
+### Create.cshtml / Update.cshtml
+```html
+@model MiEntidadCreateViewModel
+
+<div asp-validation-summary="ModelOnly" class="alert alert-danger" role="alert"></div>
+
+<form method="post">
+    @Html.AntiForgeryToken()
+
+    <div class="mb-3">
+        <label asp-for="StrNombre" class="form-label"></label>
+        <input asp-for="StrNombre" class="form-control" />
+        <span asp-validation-for="StrNombre" class="text-danger"></span>
+    </div>
+
+    <div class="mb-3">
+        <label asp-for="IdTipoEmpleado" class="form-label"></label>
+        <select asp-for="IdTipoEmpleado" class="form-select" asp-items="ViewBag.CatalogoList">
+            <option value="">— Seleccione —</option>
+        </select>
+        <span asp-validation-for="IdTipoEmpleado" class="text-danger"></span>
+    </div>
+
+    <button type="submit" class="btn btn-primary">Guardar</button>
+    <a asp-action="Index" class="btn btn-outline-secondary">Cancelar</a>
+</form>
+```
+
+### Delete.cshtml
+```html
+@model MiEntidadDeleteViewModel
+
+<p>¿Está seguro de eliminar <strong>@Model.StrNombre</strong>?</p>
+
+<form method="post">
+    @Html.AntiForgeryToken()
+    <input type="hidden" asp-for="Id" />
+    <input type="hidden" asp-for="RowVersion" />
+
+    <button type="submit" class="btn btn-danger">Eliminar</button>
+    <a asp-action="Index" class="btn btn-outline-secondary">Cancelar</a>
+</form>
+```
+
+---
+
+## 6. Menú en `_Layout.cshtml`
+
+Agregar después del ítem "Usuarios":
+
+```html
+<li class="nav-item">
+    <a class="nav-link text-dark" asp-area="" asp-controller="MiEntidad" asp-action="Index">MiEntidad</a>
+</li>
+```
+
+---
+
+## 7. Pruebas
+
+### Unit tests — datos de prueba (`ContractTestData.cs`)
+```csharp
+public static readonly PaginatedResponse<MiEntidad> ValidMiEntidadPaginatedResponse = new()
+{
+    Items = [ValidMiEntidad],
+    PageNumber = 1,
+    PageSize = 10,
+    TotalCount = 1,
+    TotalPages = 1
+};
+
+public static readonly MiEntidad ValidMiEntidad = new()
+{
+    Id = 1,
+    StrNombre = "Ejemplo",
+    RowVersion = [0x01, 0x02, 0x03, 0x04]
+};
+
+public static readonly PaginatedResponse<MiCatalogo> ValidCatalogoPaginatedResponse = new()
+{
+    Items = [ValidCatalogo],
+    TotalCount = 1
+};
+
+public static readonly MiCatalogo ValidCatalogo = new()
+{
+    Id = 1,
+    StrValor = "Opción 1"
+};
+```
+
+### Integration tests
+Usar WireMock para simular la API. Ejemplo:
+
+```csharp
+public class MiEntidadApiClientTests : IClassFixture<WireMockFixture>
+{
+    private readonly WireMockFixture _wireMock;
+    private readonly MiEntidadService _service;
+
+    public MiEntidadApiClientTests(WireMockFixture wireMock)
+    {
+        _wireMock = wireMock;
+        var httpContextAccessor = Mock.Of<IHttpContextAccessor>();
+        var httpClient = wireMock.CreateClient();
+        _service = new MiEntidadService(httpClient, httpContextAccessor);
+    }
+
+    [Fact]
+    public async Task GetMiEntidadesAsync_ReturnsData()
+    {
+        _wireMock.Server.Given(
+            RequestBuilder.Create().WithPath("/api/v1/MiEntidad").UsingGet()
+        ).RespondWith(
+            ResponseBuilder.Create().WithStatusCode(200).WithBodyAsJson(ContractTestData.ValidMiEntidadPaginatedResponse)
+        );
+
+        var result = await _service.GetMiEntidadesAsync(1, 10, CancellationToken.None);
+        Assert.NotNull(result);
+        Assert.Single(result.Items);
+    }
+}
+```
+
+### Security tests
+```csharp
+public class MiEntidadSecurityTests
+{
+    private static WebApplicationFactory<Program> CreateFactory()
+    {
+        return new WebApplicationFactory<Program>()
+            .WithWebHostBuilder(builder =>
+            {
+                builder.ConfigureServices(services =>
+                {
+                    services.RemoveAll<IAuthService>();
+                    services.AddSingleton<IAuthService>(new FakeAuthService());
+                    services.PostConfigure<CookieAuthenticationOptions>(
+                        CookieAuthenticationDefaults.AuthenticationScheme,
+                        options => options.Cookie.SecurePolicy = CookieSecurePolicy.SameAsRequest);
+                });
+            });
+    }
+
+    [Fact]
+    public async Task Index_RequiresAuthentication()
+    {
+        var (factory, client) = CreateUnauthenticatedClient();
+        using (factory) using (client)
+        {
+            var (status, _) = await SecurityTestHelpers.GetAsync(client, "/MiEntidad/Index");
+            Assert.Equal((int)HttpStatusCode.Redirect, status);
+        }
+    }
+
+    [Theory]
+    [InlineData("")]
+    [InlineData("   ")]
+    [InlineData(null)]
+    public async Task Create_RejectsEmptyNombre(string? nombre)
+    {
+        using var factory = CreateFactory();
+        using var client = factory.CreateClient(...);
+        await AuthenticateAsync(client);
+        var token = await SecurityTestHelpers.GetAntiForgeryTokenAsync(client, "/MiEntidad/Create");
+        var form = SecurityTestHelpers.ToFormPayload(new Dictionary<string, string>
+        {
+            { "__RequestVerificationToken", token },
+            { "StrNombre", nombre ?? "" },
+        });
+        var (status, body) = await SecurityTestHelpers.PostAsync(client, "/MiEntidad/Create", form);
+        Assert.Equal((int)HttpStatusCode.OK, status);
+        Assert.Contains("obligatorio", body);
+    }
+
+    [Theory]
+    [MemberData(nameof(SecurityTestData.XssPayloads.All), MemberType = typeof(SecurityTestData.XssPayloads))]
+    public async Task Create_RejectsXssInNombre(string xssPayload)
+    {
+        // mismo patrón que arriba, enviar xssPayload en StrNombre
+    }
+}
+```
+
+### Comandos
+```powershell
+dotnet build
+dotnet test tests\WebDevSecOps.UnitTests --filter "FullyQualifiedName~MiEntidad"
+dotnet test tests\WebDevSecOps.IntegrationTests --filter "FullyQualifiedName~MiEntidad"
+dotnet test tests\WebDevSecOps.SecurityTests --filter "FullyQualifiedName~MiEntidad"
+```
+
+---
+
+## Convenciones clave
+
+| Concepto | Detalle |
+|----------|---------|
+| Naming | `Str` prefijo para strings, `Async` sufijo, `ct` para CancellationToken |
+| TempData | `TempData["Success"]`, `TempData["Error"]`, `TempData["Warning"]` |
+| OperationResult | Usar `OperationResult<T>` genérico, no crear tipos resultado específicos |
+| Concurrencia | `RowVersion` (byte[]) en DeleteViewModel, pasado al DELETE de la API |
+| ReturnUrl | Parámetro opcional en POST, validar con `Url.IsLocalUrl()` |
+| Catálogos | `ViewBag.{Nombre}List` (SelectList) + `ViewBag.{Nombre}Dict` (Dictionary), pageSize=100 |
+| Paginación | Default pageNumber=1, pageSize=10 |
+| Filtros | GET form, si hay filtros → `SearchAsync`, si no → `GetAllAsync` |
+| Logger | `_logger.LogWarning(...)` cuando la API retorna null |
diff --git a/AGENTS.md b/AGENTS.md
new file mode 100644
index 0000000..aec1c43
--- /dev/null
+++ b/AGENTS.md
@@ -0,0 +1,69 @@
+# WebDevSecOps — Memoria del proyecto
+
+## Convenciones generales
+- **Idioma**: Código fuente y mensajes UX en español (controladores, vistas, validaciones)
+- **Patrón CRUD**: Controlador → Servicio (HttpClient) → API externa, siguiendo el mismo patrón que `UsuarioController`/`IUsuarioService`
+- **Mensajes al usuario**: Toastr mediante `TempData["Success"]`, `TempData["Error"]`, `TempData["Warning"]`
+- **Resultado de operaciones**: `OperationResult<T>` (genérico) en `Models/OperationResult.cs`
+- **Concurrencia optimista**: `RowVersion` (byte[]) en DeleteViewModel, pasado al servicio para el DELETE de la API
+- **ReturnUrl**: Patrón opcional en acciones POST para redirect condicional
+
+## Módulo Empleado (implementado)
+### Archivos clave
+| Archivo | Propósito |
+|---------|-----------|
+| `Controllers/EmpleadoController.cs` | 8 acciones (Index, Create GET/POST, Details, Update GET/POST, Delete GET/POST) |
+| `Services/IEmpleadoService.cs`, `EmpleadoService.cs` | 6 métodos HttpClient contra `/api/v1/Empleado` |
+| `Services/ITipoEmpleadoService.cs`, `TipoEmpleadoService.cs` | Catálogo read-only (2 métodos) |
+| `Models/Empleado.cs` | Modelo de dominio |
+| `Models/EmpCatTipoEmpleado.cs` | Modelo de catálogo (read-only) |
+| `Models/Empleado{Create,Update,Details,Delete}ViewModel.cs` | ViewModels por acción |
+| `Views/Empleado/{Index,Create,Details,Update,Delete}.cshtml` | Vistas Razor |
+
+### Endpoints API consumidos
+- `GET /api/v1/Empleado?PageNumber=&PageSize=`
+- `POST /api/v1/Empleado`
+- `GET /api/v1/Empleado/{id}`
+- `PUT /api/v1/Empleado/{id}`
+- `DELETE /api/v1/Empleado/{id}`
+- `GET /api/v1/Empleado/buscar?texto=&idTipoEmpleado=`
+- `GET /api/v1/TipoEmpleado?PageNumber=&PageSize=`
+- `GET /api/v1/TipoEmpleado/{id}`
+
+### Filtros en Index
+- **Texto**: búsqueda por nombre/apellido vía `SearchEmpleadosAsync`
+- **TipoEmpleado**: dropdown poblado desde `ViewBag.TipoEmpleadoList` (SelectList)
+- **Paginación**: `pagina` (default 1) y `pageSize` (default 10)
+- El controlador llama a `SearchEmpleadosAsync` si `texto` o `idTipoEmpleado` tienen valor, sino a `GetEmpleadosAsync`
+
+### Dropdown TipoEmpleado
+- Poblado en `CargarTipoEmpleadosAsync()` helper en el controlador
+- Almacenado en `ViewBag.TipoEmpleadoList` como `SelectList` (value=`Id`, text=`StrValor`)
+- También se guarda un `Dictionary<int, string>` en `ViewBag.TipoEmpleadoDict` para resolución en Index sin N+1
+- `pageSize=100` para obtener todos los registros del catálogo
+
+### Pruebas
+| Proyecto | Archivos |
+|----------|----------|
+| `WebDevSecOps.UnitTests` | `Pages/Empleados/{IndexTests,CreateTests,UpdateTests,DeleteTests}.cs` |
+| `WebDevSecOps.IntegrationTests` | `Services/{EmpleadoApiClientTests,TipoEmpleadoApiClientTests}.cs` |
+| `WebDevSecOps.SecurityTests` | `SAST/EmpleadoSecurityTests.cs` |
+
+### Comandos
+```powershell
+dotnet build                           # build completo (0 errors, 0 warnings)
+dotnet test tests\WebDevSecOps.UnitTests
+dotnet test tests\WebDevSecOps.IntegrationTests
+dotnet test tests\WebDevSecOps.SecurityTests
+```
+
+### Patrón para nuevos CRUDs
+1. Crear modelo de dominio en `Models/`
+2. Crear ViewModels en `Models/` por acción
+3. Crear interfaz e implementación de servicio en `Services/`
+4. Registrar en `Program.cs` con `AddHttpClient<IServicio, Servicio>()...AddStandardResilienceHandler()`
+5. Crear controlador en `Controllers/` heredando `Controller` con `[Authorize]`
+6. Crear vistas en `Views/{Nombre}/`
+7. Agregar ítem de menú en `Pages/Shared/_Layout.cshtml` (después de "Usuarios")
+8. Agregar datos de prueba en `tests/WebDevSecOps.UnitTests/Common/ContractTestData.cs`
+9. Crear tests unitarios, de integración y seguridad
diff --git a/WebDevSecOps/Controllers/EmpleadoController.cs b/WebDevSecOps/Controllers/EmpleadoController.cs
new file mode 100644
index 0000000..91000ae
--- /dev/null
+++ b/WebDevSecOps/Controllers/EmpleadoController.cs
@@ -0,0 +1,308 @@
+using Microsoft.AspNetCore.Authorization;
+using Microsoft.AspNetCore.Mvc;
+using Microsoft.AspNetCore.Mvc.Rendering;
+using WebDevSecOps.Models;
+using WebDevSecOps.Services;
+
+namespace WebDevSecOps.Controllers;
+
+[Authorize]
+public class EmpleadoController : Controller
+{
+    private readonly IEmpleadoService _service;
+    private readonly ITipoEmpleadoService _tipoEmpleadoService;
+    private readonly ILogger<EmpleadoController> _logger;
+
+    public EmpleadoController(IEmpleadoService service, ITipoEmpleadoService tipoEmpleadoService, ILogger<EmpleadoController> logger)
+    {
+        _service = service;
+        _tipoEmpleadoService = tipoEmpleadoService;
+        _logger = logger;
+    }
+
+    [HttpGet]
+    [ResponseCache(Duration = 60, Location = ResponseCacheLocation.Client, NoStore = false)]
+    public async Task<IActionResult> Index(string? texto = null, int? idTipoEmpleado = null, int pageNumber = 1, int pageSize = 10, CancellationToken ct = default)
+    {
+        if (!ModelState.IsValid)
+            return BadRequest(ModelState);
+
+        await CargarTipoEmpleadosAsync(ct);
+
+        var result = (!string.IsNullOrEmpty(texto) || idTipoEmpleado.HasValue)
+            ? await _service.SearchEmpleadosAsync(texto, idTipoEmpleado, pageNumber, pageSize, ct)
+            : await _service.GetEmpleadosAsync(pageNumber, pageSize, ct);
+
+        if (result is null)
+        {
+            _logger.LogWarning("Failed to load empleados — service returned null");
+            TempData["Error"] = "No se pudieron cargar los empleados.";
+        }
+
+        return View(result);
+    }
+
+    [HttpGet]
+    [ResponseCache(Duration = 300, Location = ResponseCacheLocation.Client, NoStore = false)]
+    public async Task<IActionResult> Details(int id, CancellationToken ct, string? returnUrl = null)
+    {
+        if (!ModelState.IsValid)
+            return BadRequest(ModelState);
+
+        var empleado = await _service.GetEmpleadoByIdAsync(id, ct);
+
+        if (empleado is null)
+        {
+            _logger.LogWarning("Empleado with id {Id} not found for details", id);
+            TempData["Error"] = "El empleado no existe o no se pudo recuperar la informacion.";
+            if (!string.IsNullOrEmpty(returnUrl) && Url.IsLocalUrl(returnUrl))
+                return Redirect(returnUrl);
+            return Redirect("/Empleado/Index");
+        }
+
+        var strValorTipoEmpleado = await ObtenerValorTipoEmpleado(empleado.IdEmpCatTipoEmpleado, ct);
+
+        ViewData["ReturnUrl"] = returnUrl;
+
+        var model = new EmpleadoDetailsViewModel
+        {
+            Id = empleado.Id,
+            StrNombre = empleado.StrNombre,
+            StrAPaterno = empleado.StrAPaterno,
+            StrAMaterno = empleado.StrAMaterno,
+            StrCURP = empleado.StrCURP,
+            StrValorTipoEmpleado = strValorTipoEmpleado,
+            RowVersion = empleado.RowVersion ?? []
+        };
+
+        return View(model);
+    }
+
+    [HttpGet]
+    public async Task<IActionResult> Create(string? returnUrl = null, CancellationToken ct = default)
+    {
+        await CargarTipoEmpleadosAsync(ct);
+        ViewData["ReturnUrl"] = returnUrl;
+        return View();
+    }
+
+    [HttpPost]
+    [ValidateAntiForgeryToken]
+    public async Task<IActionResult> Create(EmpleadoCreateViewModel model, CancellationToken ct, string? returnUrl = null)
+    {
+        if (!ModelState.IsValid)
+        {
+            await CargarTipoEmpleadosAsync(ct);
+            ViewData["ReturnUrl"] = returnUrl;
+            return View(model);
+        }
+
+        var result = await _service.CreateEmpleadoAsync(model, ct);
+
+        if (result.Success)
+        {
+            _logger.LogInformation("Empleado created successfully");
+            TempData["Success"] = "Empleado creado exitosamente.";
+            if (!string.IsNullOrEmpty(returnUrl) && Url.IsLocalUrl(returnUrl))
+                return Redirect(returnUrl);
+            return RedirectToAction("Index");
+        }
+
+        if (result.FieldErrors is not null)
+        {
+            foreach (var kvp in result.FieldErrors)
+            {
+                foreach (var msg in kvp.Value)
+                    ModelState.AddModelError(kvp.Key, msg);
+            }
+        }
+
+        if (result.ErrorMessage is not null)
+            ModelState.AddModelError(string.Empty, result.ErrorMessage);
+
+        await CargarTipoEmpleadosAsync(ct);
+        ViewData["ReturnUrl"] = returnUrl;
+        return View(model);
+    }
+
+    [HttpGet]
+    public async Task<IActionResult> Update(int id, CancellationToken ct, string? returnUrl = null)
+    {
+        if (!ModelState.IsValid)
+            return BadRequest(ModelState);
+
+        var empleado = await _service.GetEmpleadoByIdAsync(id, ct);
+
+        if (empleado is null)
+        {
+            _logger.LogWarning("Empleado with id {Id} not found for update", id);
+            TempData["Error"] = "Empleado no encontrado.";
+            if (!string.IsNullOrEmpty(returnUrl) && Url.IsLocalUrl(returnUrl))
+                return Redirect(returnUrl);
+            return Redirect("/Empleado/Index");
+        }
+
+        await CargarTipoEmpleadosAsync(ct);
+        ViewData["ReturnUrl"] = returnUrl;
+
+        var model = new EmpleadoUpdateViewModel
+        {
+            Id = empleado.Id,
+            StrNombre = empleado.StrNombre,
+            StrAPaterno = empleado.StrAPaterno,
+            StrAMaterno = empleado.StrAMaterno,
+            StrCURP = empleado.StrCURP,
+            IdEmpCatTipoEmpleado = empleado.IdEmpCatTipoEmpleado,
+            RowVersion = empleado.RowVersion ?? []
+        };
+
+        return View(model);
+    }
+
+    [HttpPost]
+    [ValidateAntiForgeryToken]
+    public async Task<IActionResult> Update(EmpleadoUpdateViewModel model, CancellationToken ct, string? returnUrl = null)
+    {
+        if (!ModelState.IsValid)
+        {
+            await CargarTipoEmpleadosAsync(ct);
+            ViewData["ReturnUrl"] = returnUrl;
+            return View(model);
+        }
+
+        var result = await _service.UpdateEmpleadoAsync(model.Id, model, ct);
+
+        if (result.Success)
+        {
+            _logger.LogInformation("Empleado {Id} updated successfully", model.Id);
+            TempData["Success"] = "Empleado actualizado exitosamente.";
+            if (!string.IsNullOrEmpty(returnUrl) && Url.IsLocalUrl(returnUrl))
+                return Redirect(returnUrl);
+            return RedirectToAction("Index");
+        }
+
+        if (result.FieldErrors is not null)
+        {
+            foreach (var kvp in result.FieldErrors)
+            {
+                foreach (var msg in kvp.Value)
+                {
+                    var key = kvp.Key switch
+                    {
+                        "strNombre" => nameof(EmpleadoUpdateViewModel.StrNombre),
+                        "strAPaterno" => nameof(EmpleadoUpdateViewModel.StrAPaterno),
+                        "strAMaterno" => nameof(EmpleadoUpdateViewModel.StrAMaterno),
+                        "strCURP" => nameof(EmpleadoUpdateViewModel.StrCURP),
+                        "idEmpCatTipoEmpleado" => nameof(EmpleadoUpdateViewModel.IdEmpCatTipoEmpleado),
+                        "rowVersion" => nameof(EmpleadoUpdateViewModel.RowVersion),
+                        _ => kvp.Key
+                    };
+                    ModelState.AddModelError(key, msg);
+                }
+            }
+        }
+
+        if (result.ErrorMessage is not null)
+            ModelState.AddModelError(string.Empty, result.ErrorMessage);
+
+        await CargarTipoEmpleadosAsync(ct);
+        ViewData["ReturnUrl"] = returnUrl;
+        return View(model);
+    }
+
+    [HttpGet]
+    public async Task<IActionResult> Delete(int id, CancellationToken ct, string? returnUrl = null)
+    {
+        if (!ModelState.IsValid)
+            return BadRequest(ModelState);
+
+        var empleado = await _service.GetEmpleadoByIdAsync(id, ct);
+
+        if (empleado is null)
+        {
+            _logger.LogWarning("Empleado with id {Id} not found for delete", id);
+            TempData["Error"] = "Empleado no encontrado.";
+            if (!string.IsNullOrEmpty(returnUrl) && Url.IsLocalUrl(returnUrl))
+                return Redirect(returnUrl);
+            return Redirect("/Empleado/Index");
+        }
+
+        var strValorTipoEmpleado = await ObtenerValorTipoEmpleado(empleado.IdEmpCatTipoEmpleado, ct);
+
+        ViewData["ReturnUrl"] = returnUrl;
+
+        var model = new EmpleadoDeleteViewModel
+        {
+            Id = empleado.Id,
+            StrNombre = empleado.StrNombre,
+            StrAPaterno = empleado.StrAPaterno,
+            StrAMaterno = empleado.StrAMaterno,
+            StrCURP = empleado.StrCURP,
+            StrValorTipoEmpleado = strValorTipoEmpleado,
+            RowVersion = empleado.RowVersion ?? []
+        };
+
+        return View(model);
+    }
+
+    [HttpPost]
+    [ValidateAntiForgeryToken]
+    public async Task<IActionResult> Delete(EmpleadoDeleteViewModel model, CancellationToken ct, string? returnUrl = null)
+    {
+        if (!ModelState.IsValid)
+        {
+            ViewData["ReturnUrl"] = returnUrl;
+            return View(model);
+        }
+
+        var result = await _service.DeleteEmpleadoAsync(model.Id, model.RowVersion, ct);
+
+        if (result.Success)
+        {
+            _logger.LogInformation("Empleado {Id} deleted successfully", model.Id);
+            TempData["Success"] = "Empleado eliminado exitosamente.";
+            if (!string.IsNullOrEmpty(returnUrl) && Url.IsLocalUrl(returnUrl))
+                return Redirect(returnUrl);
+            return RedirectToAction("Index");
+        }
+
+        if (result.FieldErrors is not null)
+        {
+            foreach (var kvp in result.FieldErrors)
+            {
+                foreach (var msg in kvp.Value)
+                {
+                    var key = kvp.Key switch
+                    {
+                        "id" => nameof(EmpleadoDeleteViewModel.Id),
+                        "rowVersion" => nameof(EmpleadoDeleteViewModel.RowVersion),
+                        _ => kvp.Key
+                    };
+                    ModelState.AddModelError(key, msg);
+                }
+            }
+        }
+
+        if (result.ErrorMessage is not null)
+            ModelState.AddModelError(string.Empty, result.ErrorMessage);
+
+        ViewData["ReturnUrl"] = returnUrl;
+        return View(model);
+    }
+
+    private async Task CargarTipoEmpleadosAsync(CancellationToken ct = default)
+    {
+        var tipos = await _tipoEmpleadoService.GetAllAsync(ct: ct);
+        ViewBag.TipoEmpleadoList = new SelectList(tipos?.Items ?? [], "Id", "StrValor");
+        ViewBag.TipoEmpleadoDict = tipos?.Items?.ToDictionary(t => t.Id, t => t.StrValor) ?? [];
+    }
+
+    private async Task<string?> ObtenerValorTipoEmpleado(int? idTipoEmpleado, CancellationToken ct = default)
+    {
+        if (!idTipoEmpleado.HasValue)
+            return null;
+
+        var tipo = await _tipoEmpleadoService.GetByIdAsync(idTipoEmpleado.Value, ct);
+        return tipo?.StrValor;
+    }
+}
diff --git a/WebDevSecOps/Models/EmpCatTipoEmpleado.cs b/WebDevSecOps/Models/EmpCatTipoEmpleado.cs
new file mode 100644
index 0000000..703f224
--- /dev/null
+++ b/WebDevSecOps/Models/EmpCatTipoEmpleado.cs
@@ -0,0 +1,15 @@
+using System.Text.Json.Serialization;
+
+namespace WebDevSecOps.Models;
+
+public class EmpCatTipoEmpleado
+{
+    [JsonPropertyName("id")]
+    public int Id { get; set; }
+
+    [JsonPropertyName("strValor")]
+    public string StrValor { get; set; } = string.Empty;
+
+    [JsonPropertyName("strDescripcion")]
+    public string StrDescripcion { get; set; } = string.Empty;
+}
diff --git a/WebDevSecOps/Models/Empleado.cs b/WebDevSecOps/Models/Empleado.cs
new file mode 100644
index 0000000..6247171
--- /dev/null
+++ b/WebDevSecOps/Models/Empleado.cs
@@ -0,0 +1,27 @@
+using System.Text.Json.Serialization;
+
+namespace WebDevSecOps.Models;
+
+public class Empleado
+{
+    [JsonPropertyName("id")]
+    public int Id { get; set; }
+
+    [JsonPropertyName("strNombre")]
+    public string StrNombre { get; set; } = string.Empty;
+
+    [JsonPropertyName("strAPaterno")]
+    public string? StrAPaterno { get; set; }
+
+    [JsonPropertyName("strAMaterno")]
+    public string? StrAMaterno { get; set; }
+
+    [JsonPropertyName("strCURP")]
+    public string? StrCURP { get; set; }
+
+    [JsonPropertyName("idEmpCatTipoEmpleado")]
+    public int? IdEmpCatTipoEmpleado { get; set; }
+
+    [JsonPropertyName("rowVersion")]
+    public byte[]? RowVersion { get; set; }
+}
diff --git a/WebDevSecOps/Models/EmpleadoCreateViewModel.cs b/WebDevSecOps/Models/EmpleadoCreateViewModel.cs
new file mode 100644
index 0000000..652fad1
--- /dev/null
+++ b/WebDevSecOps/Models/EmpleadoCreateViewModel.cs
@@ -0,0 +1,33 @@
+using System.ComponentModel.DataAnnotations;
+using System.Text.Json.Serialization;
+
+namespace WebDevSecOps.Models;
+
+public class EmpleadoCreateViewModel
+{
+    [Required(ErrorMessage = "El nombre es obligatorio.")]
+    [StringLength(50, ErrorMessage = "El nombre no puede exceder los 50 caracteres.")]
+    [RegularExpression(@"^[a-zA-Z0-9_ ]+$", ErrorMessage = "El nombre solo permite letras, numeros y espacios.")]
+    [JsonPropertyName("strNombre")]
+    [Display(Name = "Nombre")]
+    public string StrNombre { get; set; } = string.Empty;
+
+    [StringLength(50, ErrorMessage = "A. Paterno no puede exceder los 50 caracteres.")]
+    [JsonPropertyName("strAPaterno")]
+    [Display(Name = "A. Paterno")]
+    public string? StrAPaterno { get; set; }
+
+    [StringLength(50, ErrorMessage = "A. Materno no puede exceder los 50 caracteres.")]
+    [JsonPropertyName("strAMaterno")]
+    [Display(Name = "A. Materno")]
+    public string? StrAMaterno { get; set; }
+
+    [StringLength(18, ErrorMessage = "CURP debe tener 18 caracteres.")]
+    [JsonPropertyName("strCURP")]
+    [Display(Name = "CURP")]
+    public string? StrCURP { get; set; }
+
+    [JsonPropertyName("idEmpCatTipoEmpleado")]
+    [Display(Name = "Tipo Empleado")]
+    public int? IdEmpCatTipoEmpleado { get; set; }
+}
diff --git a/WebDevSecOps/Models/EmpleadoDeleteViewModel.cs b/WebDevSecOps/Models/EmpleadoDeleteViewModel.cs
new file mode 100644
index 0000000..5c6cb3c
--- /dev/null
+++ b/WebDevSecOps/Models/EmpleadoDeleteViewModel.cs
@@ -0,0 +1,31 @@
+using System.ComponentModel.DataAnnotations;
+using System.Text.Json.Serialization;
+
+namespace WebDevSecOps.Models;
+
+public class EmpleadoDeleteViewModel
+{
+    [Required]
+    [JsonRequired]
+    [JsonPropertyName("id")]
+    public int Id { get; set; }
+
+    [Display(Name = "Nombre")]
+    public string StrNombre { get; set; } = string.Empty;
+
+    [Display(Name = "A. Paterno")]
+    public string? StrAPaterno { get; set; }
+
+    [Display(Name = "A. Materno")]
+    public string? StrAMaterno { get; set; }
+
+    [Display(Name = "CURP")]
+    public string? StrCURP { get; set; }
+
+    [Display(Name = "Tipo Empleado")]
+    public string? StrValorTipoEmpleado { get; set; }
+
+    [Required]
+    [JsonPropertyName("rowVersion")]
+    public byte[] RowVersion { get; set; } = [];
+}
diff --git a/WebDevSecOps/Models/EmpleadoDetailsViewModel.cs b/WebDevSecOps/Models/EmpleadoDetailsViewModel.cs
new file mode 100644
index 0000000..92f61f9
--- /dev/null
+++ b/WebDevSecOps/Models/EmpleadoDetailsViewModel.cs
@@ -0,0 +1,34 @@
+using System.ComponentModel.DataAnnotations;
+using System.Text.Json.Serialization;
+
+namespace WebDevSecOps.Models;
+
+public class EmpleadoDetailsViewModel
+{
+    [Required]
+    [JsonPropertyName("id")]
+    public int Id { get; set; }
+
+    [Display(Name = "Nombre")]
+    [JsonPropertyName("strNombre")]
+    public string StrNombre { get; set; } = string.Empty;
+
+    [Display(Name = "A. Paterno")]
+    [JsonPropertyName("strAPaterno")]
+    public string? StrAPaterno { get; set; }
+
+    [Display(Name = "A. Materno")]
+    [JsonPropertyName("strAMaterno")]
+    public string? StrAMaterno { get; set; }
+
+    [Display(Name = "CURP")]
+    [JsonPropertyName("strCURP")]
+    public string? StrCURP { get; set; }
+
+    [Display(Name = "Tipo Empleado")]
+    public string? StrValorTipoEmpleado { get; set; }
+
+    [Required]
+    [JsonPropertyName("rowVersion")]
+    public byte[] RowVersion { get; set; } = [];
+}
diff --git a/WebDevSecOps/Models/EmpleadoUpdateViewModel.cs b/WebDevSecOps/Models/EmpleadoUpdateViewModel.cs
new file mode 100644
index 0000000..d52ce7e
--- /dev/null
+++ b/WebDevSecOps/Models/EmpleadoUpdateViewModel.cs
@@ -0,0 +1,42 @@
+using System.ComponentModel.DataAnnotations;
+using System.Text.Json.Serialization;
+
+namespace WebDevSecOps.Models;
+
+public class EmpleadoUpdateViewModel
+{
+    [Required]
+    [JsonRequired]
+    [JsonPropertyName("id")]
+    public int Id { get; set; }
+
+    [Required(ErrorMessage = "El nombre es obligatorio.")]
+    [StringLength(50, ErrorMessage = "El nombre no puede exceder los 50 caracteres.")]
+    [RegularExpression(@"^[a-zA-Z0-9_ ]+$", ErrorMessage = "El nombre solo permite letras, numeros y espacios.")]
+    [JsonPropertyName("strNombre")]
+    [Display(Name = "Nombre")]
+    public string StrNombre { get; set; } = string.Empty;
+
+    [StringLength(50, ErrorMessage = "A. Paterno no puede exceder los 50 caracteres.")]
+    [JsonPropertyName("strAPaterno")]
+    [Display(Name = "A. Paterno")]
+    public string? StrAPaterno { get; set; }
+
+    [StringLength(50, ErrorMessage = "A. Materno no puede exceder los 50 caracteres.")]
+    [JsonPropertyName("strAMaterno")]
+    [Display(Name = "A. Materno")]
+    public string? StrAMaterno { get; set; }
+
+    [StringLength(18, ErrorMessage = "CURP debe tener 18 caracteres.")]
+    [JsonPropertyName("strCURP")]
+    [Display(Name = "CURP")]
+    public string? StrCURP { get; set; }
+
+    [JsonPropertyName("idEmpCatTipoEmpleado")]
+    [Display(Name = "Tipo Empleado")]
+    public int? IdEmpCatTipoEmpleado { get; set; }
+
+    [Required]
+    [JsonPropertyName("rowVersion")]
+    public byte[] RowVersion { get; set; } = [];
+}
diff --git a/WebDevSecOps/Models/OperationResult.cs b/WebDevSecOps/Models/OperationResult.cs
new file mode 100644
index 0000000..1736469
--- /dev/null
+++ b/WebDevSecOps/Models/OperationResult.cs
@@ -0,0 +1,22 @@
+namespace WebDevSecOps.Models;
+
+public class OperationResult
+{
+    public bool Success { get; }
+    public string? ErrorMessage { get; }
+    public Dictionary<string, string[]>? FieldErrors { get; }
+
+    private OperationResult(bool success, string? errorMessage, Dictionary<string, string[]>? fieldErrors)
+    {
+        Success = success;
+        ErrorMessage = errorMessage;
+        FieldErrors = fieldErrors;
+    }
+
+    public static OperationResult Ok() => new(true, null, null);
+
+    public static OperationResult Fail(string message) => new(false, message, null);
+
+    public static OperationResult Fail(Dictionary<string, string[]> fieldErrors, string? message = null)
+        => new(false, message, fieldErrors);
+}
diff --git a/WebDevSecOps/Pages/Shared/_Layout.cshtml b/WebDevSecOps/Pages/Shared/_Layout.cshtml
index cfdf188..3a21f9d 100644
--- a/WebDevSecOps/Pages/Shared/_Layout.cshtml
+++ b/WebDevSecOps/Pages/Shared/_Layout.cshtml
@@ -29,6 +29,9 @@
                             <li class="nav-item">
                                 <a class="nav-link text-dark" href="/Usuario/Index">Usuarios</a>
                             </li>
+                            <li class="nav-item">
+                                <a class="nav-link text-dark" href="/Empleado/Index">Empleados</a>
+                            </li>
                         }
                         <li class="nav-item">
                             <a class="nav-link text-dark" asp-area="" asp-page="/Privacy">Privacy</a>
diff --git a/WebDevSecOps/Program.cs b/WebDevSecOps/Program.cs
index bb40c08..868d668 100644
--- a/WebDevSecOps/Program.cs
+++ b/WebDevSecOps/Program.cs
@@ -77,6 +77,22 @@
 })
 .AddStandardResilienceHandler();
 
+builder.Services.AddHttpClient<ITipoEmpleadoService, TipoEmpleadoService>(client =>
+{
+    client.BaseAddress = new Uri(builder.Configuration["ApiSettings:BaseUrl"]
+        ?? throw new InvalidOperationException("ApiSettings:BaseUrl is not configured."));
+    client.Timeout = TimeSpan.FromSeconds(30);
+})
+.AddStandardResilienceHandler();
+
+builder.Services.AddHttpClient<IEmpleadoService, EmpleadoService>(client =>
+{
+    client.BaseAddress = new Uri(builder.Configuration["ApiSettings:BaseUrl"]
+        ?? throw new InvalidOperationException("ApiSettings:BaseUrl is not configured."));
+    client.Timeout = TimeSpan.FromSeconds(30);
+})
+.AddStandardResilienceHandler();
+
 var app = builder.Build();
 
 if (!app.Environment.IsDevelopment())
diff --git a/WebDevSecOps/Services/EmpleadoService.cs b/WebDevSecOps/Services/EmpleadoService.cs
new file mode 100644
index 0000000..8b39fa5
--- /dev/null
+++ b/WebDevSecOps/Services/EmpleadoService.cs
@@ -0,0 +1,331 @@
+using System.Net.Http.Json;
+using System.Text.Json;
+using WebDevSecOps.Models;
+
+namespace WebDevSecOps.Services;
+
+public class EmpleadoService : IEmpleadoService
+{
+    private readonly HttpClient _httpClient;
+    private readonly IHttpContextAccessor _httpContextAccessor;
+    private readonly ITokenStore _tokenStore;
+    private readonly ILogger<EmpleadoService> _logger;
+
+    public EmpleadoService(HttpClient httpClient, IHttpContextAccessor httpContextAccessor, ITokenStore tokenStore, ILogger<EmpleadoService> logger)
+    {
+        _httpClient = httpClient;
+        _httpContextAccessor = httpContextAccessor;
+        _tokenStore = tokenStore;
+        _logger = logger;
+    }
+
+    private string? GetToken()
+    {
+        var user = _httpContextAccessor.HttpContext?.User;
+        return user is not null ? _tokenStore.GetTokenFromPrincipal(user) : null;
+    }
+
+    public async Task<PaginatedResponse<Empleado>?> GetEmpleadosAsync(int pageNumber = 1, int pageSize = 10, CancellationToken ct = default)
+    {
+        var token = GetToken();
+
+        if (token is null)
+        {
+            _logger.LogWarning("No access token found");
+            return null;
+        }
+
+        try
+        {
+            using var request = new HttpRequestMessage(HttpMethod.Get, $"api/v1/Empleado?PageNumber={pageNumber}&PageSize={pageSize}");
+            request.Headers.Authorization = new System.Net.Http.Headers.AuthenticationHeaderValue("Bearer", token);
+
+            var response = await _httpClient.SendAsync(request, ct);
+            response.EnsureSuccessStatusCode();
+
+            return await response.Content.ReadFromJsonAsync<PaginatedResponse<Empleado>>(cancellationToken: ct);
+        }
+        catch (OperationCanceledException ex)
+        {
+            _logger.LogWarning(ex, "Get empleados request was cancelled");
+            throw new OperationCanceledException("The get empleados request was cancelled.", ex);
+        }
+        catch (HttpRequestException ex)
+        {
+            _logger.LogError(ex, "Connection error fetching empleados");
+            return null;
+        }
+        catch (Exception ex)
+        {
+            _logger.LogError(ex, "Unexpected error fetching empleados");
+            return null;
+        }
+    }
+
+    public async Task<PaginatedResponse<Empleado>?> SearchEmpleadosAsync(string? texto, int? idTipoEmpleado, int pageNumber = 1, int pageSize = 10, CancellationToken ct = default)
+    {
+        var token = GetToken();
+
+        if (token is null)
+        {
+            _logger.LogWarning("No access token found");
+            return null;
+        }
+
+        try
+        {
+            var queryParams = new List<string>
+            {
+                $"PageNumber={pageNumber}",
+                $"PageSize={pageSize}"
+            };
+
+            if (!string.IsNullOrEmpty(texto))
+                queryParams.Add($"texto={Uri.EscapeDataString(texto)}");
+
+            if (idTipoEmpleado.HasValue)
+                queryParams.Add($"idTipoEmpleado={idTipoEmpleado.Value}");
+
+            var queryString = string.Join("&", queryParams);
+
+            using var request = new HttpRequestMessage(HttpMethod.Get, $"api/v1/Empleado/buscar?{queryString}");
+            request.Headers.Authorization = new System.Net.Http.Headers.AuthenticationHeaderValue("Bearer", token);
+
+            var response = await _httpClient.SendAsync(request, ct);
+            response.EnsureSuccessStatusCode();
+
+            return await response.Content.ReadFromJsonAsync<PaginatedResponse<Empleado>>(cancellationToken: ct);
+        }
+        catch (OperationCanceledException ex)
+        {
+            _logger.LogWarning(ex, "Search empleados request was cancelled");
+            throw new OperationCanceledException("The search empleados request was cancelled.", ex);
+        }
+        catch (HttpRequestException ex)
+        {
+            _logger.LogError(ex, "Connection error searching empleados");
+            return null;
+        }
+        catch (Exception ex)
+        {
+            _logger.LogError(ex, "Unexpected error searching empleados");
+            return null;
+        }
+    }
+
+    public async Task<Empleado?> GetEmpleadoByIdAsync(int id, CancellationToken ct = default)
+    {
+        var token = GetToken();
+
+        if (token is null)
+        {
+            _logger.LogWarning("No access token found");
+            return null;
+        }
+
+        try
+        {
+            using var request = new HttpRequestMessage(HttpMethod.Get, $"api/v1/Empleado/{id}");
+            request.Headers.Authorization = new System.Net.Http.Headers.AuthenticationHeaderValue("Bearer", token);
+
+            var response = await _httpClient.SendAsync(request, ct);
+
+            if (response.IsSuccessStatusCode)
+                return await response.Content.ReadFromJsonAsync<Empleado>(cancellationToken: ct);
+
+            if (response.StatusCode == System.Net.HttpStatusCode.NotFound)
+            {
+                _logger.LogWarning("Empleado with id {Id} not found", id);
+                return null;
+            }
+
+            _logger.LogWarning("Get empleado by id failed with status {StatusCode}", response.StatusCode);
+            return null;
+        }
+        catch (OperationCanceledException ex)
+        {
+            _logger.LogWarning(ex, "Get empleado by id request was cancelled");
+            throw new OperationCanceledException("The get empleado by id request was cancelled.", ex);
+        }
+        catch (HttpRequestException ex)
+        {
+            _logger.LogError(ex, "Connection error fetching empleado {Id}", id);
+            return null;
+        }
+        catch (Exception ex)
+        {
+            _logger.LogError(ex, "Unexpected error fetching empleado {Id}", id);
+            return null;
+        }
+    }
+
+    public async Task<OperationResult> CreateEmpleadoAsync(EmpleadoCreateViewModel model, CancellationToken ct = default)
+    {
+        var token = GetToken();
+
+        if (token is null)
+        {
+            _logger.LogWarning("No access token found");
+            return OperationResult.Fail("Error de autenticacion. Inicie sesion nuevamente.");
+        }
+
+        try
+        {
+            using var request = new HttpRequestMessage(HttpMethod.Post, "api/v1/Empleado")
+            {
+                Content = JsonContent.Create(model)
+            };
+            request.Headers.Authorization = new System.Net.Http.Headers.AuthenticationHeaderValue("Bearer", token);
+
+            var response = await _httpClient.SendAsync(request, ct);
+
+            if (response.IsSuccessStatusCode)
+            {
+                _logger.LogInformation("Empleado created successfully");
+                return OperationResult.Ok();
+            }
+
+            await SafeResponseLogger.LogResponseFailure(_logger, response, "CreateEmpleado", ct: ct);
+
+            var rawBody = await response.Content.ReadAsStringAsync(ct);
+            var errorResponse = JsonSerializer.Deserialize<ApiErrorResponse>(rawBody);
+
+            if (errorResponse?.Errors is not null && errorResponse.Errors.Count > 0)
+                return OperationResult.Fail(errorResponse.Errors, errorResponse.Title);
+
+            var message = errorResponse?.Detail ?? errorResponse?.Title ?? "Error al crear el empleado.";
+            return OperationResult.Fail(message);
+        }
+        catch (OperationCanceledException ex)
+        {
+            _logger.LogWarning(ex, "Create empleado request was cancelled");
+            throw new OperationCanceledException("The create empleado request was cancelled.", ex);
+        }
+        catch (HttpRequestException ex)
+        {
+            _logger.LogError(ex, "Connection error while creating empleado");
+            return OperationResult.Fail("Error de conexion con el servidor. Verifique su conexion e intente nuevamente.");
+        }
+        catch (Exception ex)
+        {
+            _logger.LogError(ex, "Unexpected error creating empleado");
+            return OperationResult.Fail("Error inesperado. Intente nuevamente.");
+        }
+    }
+
+    public async Task<OperationResult> UpdateEmpleadoAsync(int id, EmpleadoUpdateViewModel model, CancellationToken ct = default)
+    {
+        var token = GetToken();
+
+        if (token is null)
+        {
+            _logger.LogWarning("No access token found");
+            return OperationResult.Fail("Error de autenticacion. Inicie sesion nuevamente.");
+        }
+
+        try
+        {
+            using var request = new HttpRequestMessage(HttpMethod.Put, $"api/v1/Empleado/{id}")
+            {
+                Content = JsonContent.Create(model)
+            };
+            request.Headers.Authorization = new System.Net.Http.Headers.AuthenticationHeaderValue("Bearer", token);
+
+            var response = await _httpClient.SendAsync(request, ct);
+
+            if (response.IsSuccessStatusCode)
+            {
+                _logger.LogInformation("Empleado {Id} updated successfully", id);
+                return OperationResult.Ok();
+            }
+
+            await SafeResponseLogger.LogResponseFailure(_logger, response, "UpdateEmpleado", id, ct);
+
+            var rawBody = await response.Content.ReadAsStringAsync(ct);
+
+            if (response.StatusCode == System.Net.HttpStatusCode.Conflict)
+                return OperationResult.Fail("El registro fue modificado por otro usuario. Recargue la pagina e intente nuevamente.");
+
+            var errorResponse = JsonSerializer.Deserialize<ApiErrorResponse>(rawBody);
+
+            if (errorResponse?.Errors is not null && errorResponse.Errors.Count > 0)
+                return OperationResult.Fail(errorResponse.Errors, errorResponse.Title);
+
+            var message = errorResponse?.Detail ?? errorResponse?.Title ?? "Error al actualizar el empleado.";
+            return OperationResult.Fail(message);
+        }
+        catch (OperationCanceledException ex)
+        {
+            _logger.LogWarning(ex, "Update empleado request was cancelled");
+            throw new OperationCanceledException("The update empleado request was cancelled.", ex);
+        }
+        catch (HttpRequestException ex)
+        {
+            _logger.LogError(ex, "Connection error while updating empleado {Id}", id);
+            return OperationResult.Fail("Error de conexion con el servidor. Verifique su conexion e intente nuevamente.");
+        }
+        catch (Exception ex)
+        {
+            _logger.LogError(ex, "Unexpected error updating empleado {Id}", id);
+            return OperationResult.Fail("Error inesperado. Intente nuevamente.");
+        }
+    }
+
+    public async Task<OperationResult> DeleteEmpleadoAsync(int id, byte[] rowVersion, CancellationToken ct = default)
+    {
+        var token = GetToken();
+
+        if (token is null)
+        {
+            _logger.LogWarning("No access token found");
+            return OperationResult.Fail("Error de autenticacion. Inicie sesion nuevamente.");
+        }
+
+        try
+        {
+            using var request = new HttpRequestMessage(HttpMethod.Delete, $"api/v1/Empleado/{id}")
+            {
+                Content = JsonContent.Create(new { id, rowVersion })
+            };
+            request.Headers.Authorization = new System.Net.Http.Headers.AuthenticationHeaderValue("Bearer", token);
+
+            var response = await _httpClient.SendAsync(request, ct);
+
+            if (response.IsSuccessStatusCode)
+            {
+                _logger.LogInformation("Empleado {Id} deleted successfully", id);
+                return OperationResult.Ok();
+            }
+
+            await SafeResponseLogger.LogResponseFailure(_logger, response, "DeleteEmpleado", id, ct);
+
+            var rawBody = await response.Content.ReadAsStringAsync(ct);
+
+            if (response.StatusCode == System.Net.HttpStatusCode.Conflict)
+                return OperationResult.Fail("El registro fue modificado por otro usuario. Recargue la pagina e intente nuevamente.");
+
+            var errorResponse = JsonSerializer.Deserialize<ApiErrorResponse>(rawBody);
+
+            if (errorResponse?.Errors is not null && errorResponse.Errors.Count > 0)
+                return OperationResult.Fail(errorResponse.Errors, errorResponse.Title);
+
+            var message = errorResponse?.Detail ?? errorResponse?.Title ?? "Error al eliminar el empleado.";
+            return OperationResult.Fail(message);
+        }
+        catch (OperationCanceledException ex)
+        {
+            _logger.LogWarning(ex, "Delete empleado request was cancelled");
+            throw new OperationCanceledException("The delete empleado request was cancelled.", ex);
+        }
+        catch (HttpRequestException ex)
+        {
+            _logger.LogError(ex, "Connection error while deleting empleado {Id}", id);
+            return OperationResult.Fail("Error de conexion con el servidor. Verifique su conexion e intente nuevamente.");
+        }
+        catch (Exception ex)
+        {
+            _logger.LogError(ex, "Unexpected error deleting empleado {Id}", id);
+            return OperationResult.Fail("Error inesperado. Intente nuevamente.");
+        }
+    }
+}
diff --git a/WebDevSecOps/Services/IEmpleadoService.cs b/WebDevSecOps/Services/IEmpleadoService.cs
new file mode 100644
index 0000000..0507962
--- /dev/null
+++ b/WebDevSecOps/Services/IEmpleadoService.cs
@@ -0,0 +1,18 @@
+using WebDevSecOps.Models;
+
+namespace WebDevSecOps.Services;
+
+public interface IEmpleadoService
+{
+    Task<PaginatedResponse<Empleado>?> GetEmpleadosAsync(int pageNumber = 1, int pageSize = 10, CancellationToken ct = default);
+
+    Task<PaginatedResponse<Empleado>?> SearchEmpleadosAsync(string? texto, int? idTipoEmpleado, int pageNumber = 1, int pageSize = 10, CancellationToken ct = default);
+
+    Task<Empleado?> GetEmpleadoByIdAsync(int id, CancellationToken ct = default);
+
+    Task<OperationResult> CreateEmpleadoAsync(EmpleadoCreateViewModel model, CancellationToken ct = default);
+
+    Task<OperationResult> UpdateEmpleadoAsync(int id, EmpleadoUpdateViewModel model, CancellationToken ct = default);
+
+    Task<OperationResult> DeleteEmpleadoAsync(int id, byte[] rowVersion, CancellationToken ct = default);
+}
diff --git a/WebDevSecOps/Services/ITipoEmpleadoService.cs b/WebDevSecOps/Services/ITipoEmpleadoService.cs
new file mode 100644
index 0000000..dafd27a
--- /dev/null
+++ b/WebDevSecOps/Services/ITipoEmpleadoService.cs
@@ -0,0 +1,10 @@
+using WebDevSecOps.Models;
+
+namespace WebDevSecOps.Services;
+
+public interface ITipoEmpleadoService
+{
+    Task<PaginatedResponse<EmpCatTipoEmpleado>?> GetAllAsync(int pageNumber = 1, int pageSize = 100, CancellationToken ct = default);
+
+    Task<EmpCatTipoEmpleado?> GetByIdAsync(int id, CancellationToken ct = default);
+}
diff --git a/WebDevSecOps/Services/TipoEmpleadoService.cs b/WebDevSecOps/Services/TipoEmpleadoService.cs
new file mode 100644
index 0000000..e0f1366
--- /dev/null
+++ b/WebDevSecOps/Services/TipoEmpleadoService.cs
@@ -0,0 +1,109 @@
+using System.Net.Http.Json;
+using WebDevSecOps.Models;
+
+namespace WebDevSecOps.Services;
+
+public class TipoEmpleadoService : ITipoEmpleadoService
+{
+    private readonly HttpClient _httpClient;
+    private readonly IHttpContextAccessor _httpContextAccessor;
+    private readonly ITokenStore _tokenStore;
+    private readonly ILogger<TipoEmpleadoService> _logger;
+
+    public TipoEmpleadoService(HttpClient httpClient, IHttpContextAccessor httpContextAccessor, ITokenStore tokenStore, ILogger<TipoEmpleadoService> logger)
+    {
+        _httpClient = httpClient;
+        _httpContextAccessor = httpContextAccessor;
+        _tokenStore = tokenStore;
+        _logger = logger;
+    }
+
+    private string? GetToken()
+    {
+        var user = _httpContextAccessor.HttpContext?.User;
+        return user is not null ? _tokenStore.GetTokenFromPrincipal(user) : null;
+    }
+
+    public async Task<PaginatedResponse<EmpCatTipoEmpleado>?> GetAllAsync(int pageNumber = 1, int pageSize = 100, CancellationToken ct = default)
+    {
+        var token = GetToken();
+
+        if (token is null)
+        {
+            _logger.LogWarning("No access token found");
+            return null;
+        }
+
+        try
+        {
+            using var request = new HttpRequestMessage(HttpMethod.Get, $"api/v1/TipoEmpleado?PageNumber={pageNumber}&PageSize={pageSize}");
+            request.Headers.Authorization = new System.Net.Http.Headers.AuthenticationHeaderValue("Bearer", token);
+
+            var response = await _httpClient.SendAsync(request, ct);
+            response.EnsureSuccessStatusCode();
+
+            return await response.Content.ReadFromJsonAsync<PaginatedResponse<EmpCatTipoEmpleado>>(cancellationToken: ct);
+        }
+        catch (OperationCanceledException ex)
+        {
+            _logger.LogWarning(ex, "Get tipos empleado request was cancelled");
+            throw new OperationCanceledException("The get tipos empleado request was cancelled.", ex);
+        }
+        catch (HttpRequestException ex)
+        {
+            _logger.LogError(ex, "Connection error fetching tipos empleado");
+            return null;
+        }
+        catch (Exception ex)
+        {
+            _logger.LogError(ex, "Unexpected error fetching tipos empleado");
+            return null;
+        }
+    }
+
+    public async Task<EmpCatTipoEmpleado?> GetByIdAsync(int id, CancellationToken ct = default)
+    {
+        var token = GetToken();
+
+        if (token is null)
+        {
+            _logger.LogWarning("No access token found");
+            return null;
+        }
+
+        try
+        {
+            using var request = new HttpRequestMessage(HttpMethod.Get, $"api/v1/TipoEmpleado/{id}");
+            request.Headers.Authorization = new System.Net.Http.Headers.AuthenticationHeaderValue("Bearer", token);
+
+            var response = await _httpClient.SendAsync(request, ct);
+
+            if (response.IsSuccessStatusCode)
+                return await response.Content.ReadFromJsonAsync<EmpCatTipoEmpleado>(cancellationToken: ct);
+
+            if (response.StatusCode == System.Net.HttpStatusCode.NotFound)
+            {
+                _logger.LogWarning("TipoEmpleado with id {Id} not found", id);
+                return null;
+            }
+
+            _logger.LogWarning("Get tipo empleado by id failed with status {StatusCode}", response.StatusCode);
+            return null;
+        }
+        catch (OperationCanceledException ex)
+        {
+            _logger.LogWarning(ex, "Get tipo empleado by id request was cancelled");
+            throw new OperationCanceledException("The get tipo empleado by id request was cancelled.", ex);
+        }
+        catch (HttpRequestException ex)
+        {
+            _logger.LogError(ex, "Connection error fetching tipo empleado {Id}", id);
+            return null;
+        }
+        catch (Exception ex)
+        {
+            _logger.LogError(ex, "Unexpected error fetching tipo empleado {Id}", id);
+            return null;
+        }
+    }
+}
diff --git a/WebDevSecOps/Views/Empleado/Create.cshtml b/WebDevSecOps/Views/Empleado/Create.cshtml
new file mode 100644
index 0000000..efe4711
--- /dev/null
+++ b/WebDevSecOps/Views/Empleado/Create.cshtml
@@ -0,0 +1,121 @@
+@model EmpleadoCreateViewModel
+@{
+    ViewData["Title"] = "Agregar Empleado";
+}
+
+<div class="container">
+    <div class="row justify-content-center">
+        <div class="col-md-8 col-lg-6">
+            <h2 class="mb-4">Agregar Empleado</h2>
+
+            @{
+                var generalErrors = ViewData.ModelState[string.Empty]?.Errors;
+            }
+            @if (generalErrors is { Count: > 0 })
+            {
+                <div class="alert alert-danger alert-dismissible fade show" role="alert">
+                    @foreach (var error in generalErrors)
+                    {
+                        <p class="mb-0">@error.ErrorMessage</p>
+                    }
+                    <button type="button" class="btn-close" data-bs-dismiss="alert" aria-label="Close"></button>
+                </div>
+            }
+
+            <form method="post" class="needs-validation" novalidate>
+                @Html.AntiForgeryToken()
+                <input type="hidden" name="returnUrl" value="@ViewData["ReturnUrl"]" />
+
+                <div class="mb-3">
+                    <label asp-for="StrNombre" class="form-label"></label>
+                    <input asp-for="StrNombre" class="form-control" autocomplete="off" />
+                    <span asp-validation-for="StrNombre" class="text-danger"></span>
+                </div>
+
+                <div class="mb-3">
+                    <label asp-for="StrAPaterno" class="form-label"></label>
+                    <input asp-for="StrAPaterno" class="form-control" autocomplete="off" />
+                    <span asp-validation-for="StrAPaterno" class="text-danger"></span>
+                </div>
+
+                <div class="mb-3">
+                    <label asp-for="StrAMaterno" class="form-label"></label>
+                    <input asp-for="StrAMaterno" class="form-control" autocomplete="off" />
+                    <span asp-validation-for="StrAMaterno" class="text-danger"></span>
+                </div>
+
+                <div class="mb-3">
+                    <label asp-for="StrCURP" class="form-label"></label>
+                    <input asp-for="StrCURP" class="form-control" autocomplete="off" maxlength="18" />
+                    <span asp-validation-for="StrCURP" class="text-danger"></span>
+                    <div id="curpFeedback" class="form-text"></div>
+                </div>
+
+                <div class="mb-3">
+                    <label asp-for="IdEmpCatTipoEmpleado" class="form-label"></label>
+                    <select asp-for="IdEmpCatTipoEmpleado" class="form-select" asp-items="ViewBag.TipoEmpleadoList">
+                        <option value="">Seleccione un tipo</option>
+                    </select>
+                    <span asp-validation-for="IdEmpCatTipoEmpleado" class="text-danger"></span>
+                </div>
+
+                <div class="d-flex gap-2">
+                    <button type="submit" class="btn btn-primary">Guardar</button>
+                    <a href="@(ViewData["ReturnUrl"] ?? Url.Action("Index"))" class="btn btn-secondary">Cancelar</a>
+                </div>
+            </form>
+        </div>
+    </div>
+</div>
+
+@section Scripts {
+    <partial name="_ValidationScriptsPartial" />
+    <script nonce="@(ViewContext.HttpContext.Items["ScriptNonce"])">
+        (function () {
+            var nombreInput = document.getElementById('StrNombre');
+            if (nombreInput) {
+                nombreInput.addEventListener('input', function () {
+                    var val = nombreInput.value;
+                    var nombreRegex = /^[a-zA-Z0-9_ ]+$/;
+                    if (val.length > 0 && !nombreRegex.test(val)) {
+                        nombreInput.setCustomValidity('Solo letras, numeros, espacios y guion bajo');
+                        nombreInput.classList.add('is-invalid');
+                    } else {
+                        nombreInput.setCustomValidity('');
+                        nombreInput.classList.remove('is-invalid');
+                        if (val.length > 0) nombreInput.classList.add('is-valid');
+                    }
+                });
+            }
+
+            var curpInput = document.getElementById('StrCURP');
+            var curpFeedback = document.getElementById('curpFeedback');
+            if (curpInput && curpFeedback) {
+                curpInput.addEventListener('input', function () {
+                    var val = curpInput.value;
+                    if (val.length === 0) {
+                        curpFeedback.textContent = '';
+                        curpFeedback.className = 'form-text';
+                    } else if (val.length < 18) {
+                        curpFeedback.textContent = 'CURP debe tener 18 caracteres (faltan ' + (18 - val.length) + ')';
+                        curpFeedback.className = 'form-text text-danger';
+                    } else {
+                        curpFeedback.textContent = 'Longitud correcta';
+                        curpFeedback.className = 'form-text text-success';
+                    }
+                });
+            }
+
+            var form = document.querySelector('form.needs-validation');
+            if (form) {
+                form.addEventListener('submit', function (event) {
+                    if (!form.checkValidity()) {
+                        event.preventDefault();
+                        event.stopPropagation();
+                    }
+                    form.classList.add('was-validated');
+                });
+            }
+        })();
+    </script>
+}
diff --git a/WebDevSecOps/Views/Empleado/Delete.cshtml b/WebDevSecOps/Views/Empleado/Delete.cshtml
new file mode 100644
index 0000000..4389c13
--- /dev/null
+++ b/WebDevSecOps/Views/Empleado/Delete.cshtml
@@ -0,0 +1,79 @@
+@model EmpleadoDeleteViewModel
+@{
+    ViewData["Title"] = "Eliminar Empleado";
+}
+
+<div class="container">
+    <div class="row justify-content-center">
+        <div class="col-md-8 col-lg-6">
+            <h2 class="mb-4">Eliminar Empleado</h2>
+
+            <div class="alert alert-warning" role="alert">
+                <i class="bi bi-exclamation-triangle"></i>
+                Esta accion no se puede deshacer. Confirme que desea eliminar permanentemente este empleado.
+            </div>
+
+            @{
+                var generalErrors = ViewData.ModelState[string.Empty]?.Errors;
+            }
+            @if (generalErrors is { Count: > 0 })
+            {
+                <div class="alert alert-danger alert-dismissible fade show" role="alert">
+                    @foreach (var error in generalErrors)
+                    {
+                        <p class="mb-0">@error.ErrorMessage</p>
+                    }
+                    <button type="button" class="btn-close" data-bs-dismiss="alert" aria-label="Close"></button>
+                </div>
+            }
+
+            <form method="post" class="needs-validation" novalidate>
+                @Html.AntiForgeryToken()
+                <input type="hidden" name="returnUrl" value="@ViewData["ReturnUrl"]" />
+
+                <input asp-for="Id" type="hidden" />
+                <input asp-for="RowVersion" type="hidden" />
+
+                <dl class="row mb-4">
+                    <dt class="col-sm-4">@Html.DisplayNameFor(m => m.StrNombre)</dt>
+                    <dd class="col-sm-8">@Model.StrNombre</dd>
+
+                    <dt class="col-sm-4">@Html.DisplayNameFor(m => m.StrAPaterno)</dt>
+                    <dd class="col-sm-8">@(Model.StrAPaterno ?? "-")</dd>
+
+                    <dt class="col-sm-4">@Html.DisplayNameFor(m => m.StrAMaterno)</dt>
+                    <dd class="col-sm-8">@(Model.StrAMaterno ?? "-")</dd>
+
+                    <dt class="col-sm-4">@Html.DisplayNameFor(m => m.StrCURP)</dt>
+                    <dd class="col-sm-8">@(Model.StrCURP ?? "-")</dd>
+
+                    <dt class="col-sm-4">@Html.DisplayNameFor(m => m.StrValorTipoEmpleado)</dt>
+                    <dd class="col-sm-8">@(Model.StrValorTipoEmpleado ?? "-")</dd>
+                </dl>
+
+                <div class="d-flex gap-2">
+                    <button type="submit" class="btn btn-danger">Confirmar Eliminar</button>
+                    <a href="@(ViewData["ReturnUrl"] ?? Url.Action("Index"))" class="btn btn-secondary">Cancelar</a>
+                </div>
+            </form>
+        </div>
+    </div>
+</div>
+
+@section Scripts {
+    <partial name="_ValidationScriptsPartial" />
+    <script nonce="@(ViewContext.HttpContext.Items["ScriptNonce"])">
+        (function () {
+            var form = document.querySelector('form.needs-validation');
+            if (form) {
+                form.addEventListener('submit', function (event) {
+                    if (!form.checkValidity()) {
+                        event.preventDefault();
+                        event.stopPropagation();
+                    }
+                    form.classList.add('was-validated');
+                });
+            }
+        })();
+    </script>
+}
diff --git a/WebDevSecOps/Views/Empleado/Details.cshtml b/WebDevSecOps/Views/Empleado/Details.cshtml
new file mode 100644
index 0000000..ce44446
--- /dev/null
+++ b/WebDevSecOps/Views/Empleado/Details.cshtml
@@ -0,0 +1,52 @@
+@model EmpleadoDetailsViewModel
+@{
+    ViewData["Title"] = "Detalles del Empleado";
+}
+
+<div class="container">
+    <div class="row justify-content-center">
+        <div class="col-md-8 col-lg-6">
+            <h2 class="mb-4">Detalles del Empleado</h2>
+
+            @{
+                var generalErrors = ViewData.ModelState[string.Empty]?.Errors;
+            }
+            @if (generalErrors is { Count: > 0 })
+            {
+                <div class="alert alert-danger alert-dismissible fade show" role="alert">
+                    @foreach (var error in generalErrors)
+                    {
+                        <p class="mb-0">@error.ErrorMessage</p>
+                    }
+                    <button type="button" class="btn-close" data-bs-dismiss="alert" aria-label="Close"></button>
+                </div>
+            }
+
+            <div class="card">
+                <div class="card-body">
+                    <dl class="row mb-0">
+                        <dt class="col-sm-4">@Html.DisplayNameFor(m => m.StrNombre)</dt>
+                        <dd class="col-sm-8">@Model.StrNombre</dd>
+
+                        <dt class="col-sm-4">@Html.DisplayNameFor(m => m.StrAPaterno)</dt>
+                        <dd class="col-sm-8">@(Model.StrAPaterno ?? "-")</dd>
+
+                        <dt class="col-sm-4">@Html.DisplayNameFor(m => m.StrAMaterno)</dt>
+                        <dd class="col-sm-8">@(Model.StrAMaterno ?? "-")</dd>
+
+                        <dt class="col-sm-4">@Html.DisplayNameFor(m => m.StrCURP)</dt>
+                        <dd class="col-sm-8">@(Model.StrCURP ?? "-")</dd>
+
+                        <dt class="col-sm-4">@Html.DisplayNameFor(m => m.StrValorTipoEmpleado)</dt>
+                        <dd class="col-sm-8">@(Model.StrValorTipoEmpleado ?? "-")</dd>
+                    </dl>
+                </div>
+            </div>
+
+            <div class="d-flex gap-2 mt-4">
+                <a class="btn btn-primary" asp-action="Update" asp-route-id="@Model.Id" asp-route-returnUrl="@(Context.Request.Path + Context.Request.QueryString)">Editar</a>
+                <a href="@(ViewData["ReturnUrl"] ?? Url.Action("Index"))" class="btn btn-secondary">Regresar</a>
+            </div>
+        </div>
+    </div>
+</div>
diff --git a/WebDevSecOps/Views/Empleado/Index.cshtml b/WebDevSecOps/Views/Empleado/Index.cshtml
new file mode 100644
index 0000000..b2ee84f
--- /dev/null
+++ b/WebDevSecOps/Views/Empleado/Index.cshtml
@@ -0,0 +1,129 @@
+@model PaginatedResponse<Empleado>
+@{
+    ViewData["Title"] = "Empleados";
+    var currentQuery = Context.Request.Query;
+    var texto = currentQuery["texto"].FirstOrDefault();
+    var idTipoEmpleado = currentQuery["idTipoEmpleado"].FirstOrDefault();
+}
+
+<div class="container">
+    <div class="d-flex justify-content-between align-items-center mb-4">
+        <h2 class="mb-0">Empleados</h2>
+        <a class="btn btn-primary" asp-action="Create" asp-route-returnUrl="@(Context.Request.Path + Context.Request.QueryString)">+ Agregar Empleado</a>
+    </div>
+
+    <form method="get" action="/Empleado/Index" class="row g-3 mb-4">
+        <div class="col-md-4">
+            <input type="text" name="texto" class="form-control" placeholder="Buscar por nombre..." value="@texto" />
+        </div>
+        <div class="col-md-3">
+            <select name="idTipoEmpleado" class="form-select">
+                <option value="">Todos los tipos</option>
+                @if (ViewBag.TipoEmpleadoList is not null)
+                {
+                    foreach (var item in ViewBag.TipoEmpleadoList)
+                    {
+                        <option value="@item.Value" selected="@(item.Value == idTipoEmpleado)">@item.Text</option>
+                    }
+                }
+            </select>
+        </div>
+        <div class="col-md-2">
+            <button type="submit" class="btn btn-primary w-100">Buscar</button>
+        </div>
+        <div class="col-md-2">
+            <a href="/Empleado/Index" class="btn btn-outline-secondary w-100">Limpiar</a>
+        </div>
+    </form>
+
+    @if (Model?.Items is null || Model.Items.Count == 0)
+    {
+        <div class="alert alert-info">No se encontraron empleados.</div>
+    }
+    else
+    {
+        <div class="table-responsive">
+            <table class="table table-striped table-hover align-middle">
+                <thead class="table-dark">
+                    <tr>
+                        <th scope="col">Nombre</th>
+                        <th scope="col">A. Paterno</th>
+                        <th scope="col">A. Materno</th>
+                        <th scope="col">CURP</th>
+                        <th scope="col">Tipo Empleado</th>
+                        <th scope="col">Acciones</th>
+                    </tr>
+                </thead>
+                <tbody>
+                    @foreach (var empleado in Model.Items)
+                    {
+                        <tr>
+                            <td>@empleado.StrNombre</td>
+                            <td>@empleado.StrAPaterno</td>
+                            <td>@empleado.StrAMaterno</td>
+                            <td>@empleado.StrCURP</td>
+                            @{
+                                var tipoValor = "-";
+                                if (empleado.IdEmpCatTipoEmpleado.HasValue)
+                                {
+                                    var idTipo = empleado.IdEmpCatTipoEmpleado.GetValueOrDefault();
+                                    if (ViewBag.TipoEmpleadoDict.ContainsKey(idTipo))
+                                    {
+                                        tipoValor = ViewBag.TipoEmpleadoDict[idTipo];
+                                    }
+                                }
+                            }
+                            <td>@tipoValor</td>
+                            <td>
+                                <a class="btn btn-sm btn-info" asp-action="Details" asp-route-id="@empleado.Id" asp-route-returnUrl="@(Context.Request.Path + Context.Request.QueryString)">Detalles</a>
+                                <a class="btn btn-sm btn-warning" asp-action="Update" asp-route-id="@empleado.Id" asp-route-returnUrl="@(Context.Request.Path + Context.Request.QueryString)">Actualizar</a>
+                                <a class="btn btn-sm btn-danger" asp-action="Delete" asp-route-id="@empleado.Id" asp-route-returnUrl="@(Context.Request.Path + Context.Request.QueryString)">Eliminar</a>
+                            </td>
+                        </tr>
+                    }
+                </tbody>
+            </table>
+        </div>
+
+        <nav aria-label="Navegacion de empleados">
+            <ul class="pagination justify-content-center">
+                @if (Model.PageNumber > 1)
+                {
+                    <li class="page-item">
+                        <a class="page-link" href="/Empleado/Index?texto=@texto&idTipoEmpleado=@idTipoEmpleado&pageNumber=@(Model.PageNumber - 1)&pageSize=@Model.PageSize">Anterior</a>
+                    </li>
+                }
+                else
+                {
+                    <li class="page-item disabled">
+                        <span class="page-link">Anterior</span>
+                    </li>
+                }
+
+                @for (int i = 1; i <= Model.TotalPages; i++)
+                {
+                    <li class="page-item @(i == Model.PageNumber ? "active" : "")">
+                        <a class="page-link" href="/Empleado/Index?texto=@texto&idTipoEmpleado=@idTipoEmpleado&pageNumber=@i&pageSize=@Model.PageSize">@i</a>
+                    </li>
+                }
+
+                @if (Model.PageNumber < Model.TotalPages)
+                {
+                    <li class="page-item">
+                        <a class="page-link" href="/Empleado/Index?texto=@texto&idTipoEmpleado=@idTipoEmpleado&pageNumber=@(Model.PageNumber + 1)&pageSize=@Model.PageSize">Siguiente</a>
+                    </li>
+                }
+                else
+                {
+                    <li class="page-item disabled">
+                        <span class="page-link">Siguiente</span>
+                    </li>
+                }
+            </ul>
+        </nav>
+
+        <p class="text-center text-muted small">
+            Mostrando pagina @Model.PageNumber de @Model.TotalPages (@Model.TotalCount registros)
+        </p>
+    }
+</div>
diff --git a/WebDevSecOps/Views/Empleado/Update.cshtml b/WebDevSecOps/Views/Empleado/Update.cshtml
new file mode 100644
index 0000000..e7ee125
--- /dev/null
+++ b/WebDevSecOps/Views/Empleado/Update.cshtml
@@ -0,0 +1,124 @@
+@model EmpleadoUpdateViewModel
+@{
+    ViewData["Title"] = "Actualizar Empleado";
+}
+
+<div class="container">
+    <div class="row justify-content-center">
+        <div class="col-md-8 col-lg-6">
+            <h2 class="mb-4">Actualizar Empleado</h2>
+
+            @{
+                var generalErrors = ViewData.ModelState[string.Empty]?.Errors;
+            }
+            @if (generalErrors is { Count: > 0 })
+            {
+                <div class="alert alert-danger alert-dismissible fade show" role="alert">
+                    @foreach (var error in generalErrors)
+                    {
+                        <p class="mb-0">@error.ErrorMessage</p>
+                    }
+                    <button type="button" class="btn-close" data-bs-dismiss="alert" aria-label="Close"></button>
+                </div>
+            }
+
+            <form method="post" class="needs-validation" novalidate>
+                @Html.AntiForgeryToken()
+                <input type="hidden" name="returnUrl" value="@ViewData["ReturnUrl"]" />
+
+                <input asp-for="Id" type="hidden" />
+                <input asp-for="RowVersion" type="hidden" />
+
+                <div class="mb-3">
+                    <label asp-for="StrNombre" class="form-label"></label>
+                    <input asp-for="StrNombre" class="form-control" autocomplete="off" />
+                    <span asp-validation-for="StrNombre" class="text-danger"></span>
+                </div>
+
+                <div class="mb-3">
+                    <label asp-for="StrAPaterno" class="form-label"></label>
+                    <input asp-for="StrAPaterno" class="form-control" autocomplete="off" />
+                    <span asp-validation-for="StrAPaterno" class="text-danger"></span>
+                </div>
+
+                <div class="mb-3">
+                    <label asp-for="StrAMaterno" class="form-label"></label>
+                    <input asp-for="StrAMaterno" class="form-control" autocomplete="off" />
+                    <span asp-validation-for="StrAMaterno" class="text-danger"></span>
+                </div>
+
+                <div class="mb-3">
+                    <label asp-for="StrCURP" class="form-label"></label>
+                    <input asp-for="StrCURP" class="form-control" autocomplete="off" maxlength="18" />
+                    <span asp-validation-for="StrCURP" class="text-danger"></span>
+                    <div id="curpFeedback" class="form-text"></div>
+                </div>
+
+                <div class="mb-3">
+                    <label asp-for="IdEmpCatTipoEmpleado" class="form-label"></label>
+                    <select asp-for="IdEmpCatTipoEmpleado" class="form-select" asp-items="ViewBag.TipoEmpleadoList">
+                        <option value="">Seleccione un tipo</option>
+                    </select>
+                    <span asp-validation-for="IdEmpCatTipoEmpleado" class="text-danger"></span>
+                </div>
+
+                <div class="d-flex gap-2">
+                    <button type="submit" class="btn btn-primary">Guardar</button>
+                    <a href="@(ViewData["ReturnUrl"] ?? Url.Action("Index"))" class="btn btn-secondary">Cancelar</a>
+                </div>
+            </form>
+        </div>
+    </div>
+</div>
+
+@section Scripts {
+    <partial name="_ValidationScriptsPartial" />
+    <script nonce="@(ViewContext.HttpContext.Items["ScriptNonce"])">
+        (function () {
+            var nombreInput = document.getElementById('StrNombre');
+            if (nombreInput) {
+                nombreInput.addEventListener('input', function () {
+                    var val = nombreInput.value;
+                    var nombreRegex = /^[a-zA-Z0-9_ ]+$/;
+                    if (val.length > 0 && !nombreRegex.test(val)) {
+                        nombreInput.setCustomValidity('Solo letras, numeros, espacios y guion bajo');
+                        nombreInput.classList.add('is-invalid');
+                    } else {
+                        nombreInput.setCustomValidity('');
+                        nombreInput.classList.remove('is-invalid');
+                        if (val.length > 0) nombreInput.classList.add('is-valid');
+                    }
+                });
+            }
+
+            var curpInput = document.getElementById('StrCURP');
+            var curpFeedback = document.getElementById('curpFeedback');
+            if (curpInput && curpFeedback) {
+                curpInput.addEventListener('input', function () {
+                    var val = curpInput.value;
+                    if (val.length === 0) {
+                        curpFeedback.textContent = '';
+                        curpFeedback.className = 'form-text';
+                    } else if (val.length < 18) {
+                        curpFeedback.textContent = 'CURP debe tener 18 caracteres (faltan ' + (18 - val.length) + ')';
+                        curpFeedback.className = 'form-text text-danger';
+                    } else {
+                        curpFeedback.textContent = 'Longitud correcta';
+                        curpFeedback.className = 'form-text text-success';
+                    }
+                });
+            }
+
+            var form = document.querySelector('form.needs-validation');
+            if (form) {
+                form.addEventListener('submit', function (event) {
+                    if (!form.checkValidity()) {
+                        event.preventDefault();
+                        event.stopPropagation();
+                    }
+                    form.classList.add('was-validated');
+                });
+            }
+        })();
+    </script>
+}
diff --git a/tests/WebDevSecOps.IntegrationTests/Services/EmpleadoApiClientTests.cs b/tests/WebDevSecOps.IntegrationTests/Services/EmpleadoApiClientTests.cs
new file mode 100644
index 0000000..aa6829b
--- /dev/null
+++ b/tests/WebDevSecOps.IntegrationTests/Services/EmpleadoApiClientTests.cs
@@ -0,0 +1,305 @@
+using System.Net;
+using System.Security.Claims;
+using System.Text.Json;
+using Microsoft.AspNetCore.Http;
+using Microsoft.Extensions.Logging;
+using Moq;
+using WebDevSecOps.Models;
+using WebDevSecOps.Services;
+using WebDevSecOps.UnitTests.Common;
+
+namespace WebDevSecOps.IntegrationTests.Services;
+
+public class EmpleadoApiClientTests
+{
+    private static readonly byte[] _rowVersion = [0x01, 0x02, 0x03, 0x04];
+
+    private (EmpleadoService Service, MockHttpMessageHandler Handler) CreateServiceWithToken(
+        object? responseContent = null, HttpStatusCode? statusCode = null)
+    {
+        var mockHandler = new MockHttpMessageHandler(responseContent, statusCode ?? HttpStatusCode.OK);
+        var httpClient = new HttpClient(mockHandler) { BaseAddress = new Uri(TestConstants.ApiBaseUrl) };
+
+        var httpContextAccessorMock = new Mock<IHttpContextAccessor>();
+        var principal = new ClaimsPrincipal(new ClaimsIdentity([
+            new Claim("token_key", "test-key"),
+            new Claim(ClaimTypes.Name, "test-user")
+        ], "test"));
+        var httpContextMock = new Mock<HttpContext>();
+        httpContextMock.Setup(x => x.User).Returns(principal);
+        httpContextAccessorMock.Setup(x => x.HttpContext).Returns(httpContextMock.Object);
+
+        var tokenStoreMock = new Mock<ITokenStore>();
+        tokenStoreMock.Setup(x => x.GetTokenFromPrincipal(It.IsAny<ClaimsPrincipal>()))
+                      .Returns(ContractTestData.TestToken);
+
+        var loggerMock = new Mock<ILogger<EmpleadoService>>();
+        var service = new EmpleadoService(httpClient, httpContextAccessorMock.Object, tokenStoreMock.Object, loggerMock.Object);
+
+        return (service, mockHandler);
+    }
+
+    private (EmpleadoService Service, MockHttpMessageHandler Handler) CreateServiceWithoutToken()
+    {
+        var mockHandler = new MockHttpMessageHandler(null, HttpStatusCode.OK);
+        var httpClient = new HttpClient(mockHandler) { BaseAddress = new Uri(TestConstants.ApiBaseUrl) };
+
+        var httpContextAccessorMock = new Mock<IHttpContextAccessor>();
+        httpContextAccessorMock.Setup(x => x.HttpContext).Returns((HttpContext?)null);
+
+        var tokenStoreMock = new Mock<ITokenStore>();
+
+        var loggerMock = new Mock<ILogger<EmpleadoService>>();
+        var service = new EmpleadoService(httpClient, httpContextAccessorMock.Object, tokenStoreMock.Object, loggerMock.Object);
+
+        return (service, mockHandler);
+    }
+
+    [Fact]
+    public async Task GetEmpleados_ShouldGetCorrectUrl()
+    {
+        var (service, handler) = CreateServiceWithToken();
+
+        await service.GetEmpleadosAsync(pageNumber: 2, pageSize: 25);
+
+        Assert.Equal(HttpMethod.Get, handler.LastRequest?.Method);
+        Assert.Equal("api/v1/Empleado?PageNumber=2&PageSize=25", handler.LastRequest?.RequestUri?.PathAndQuery.TrimStart('/'));
+    }
+
+    [Fact]
+    public async Task GetEmpleados_ShouldIncludeBearerToken()
+    {
+        var (service, handler) = CreateServiceWithToken();
+
+        await service.GetEmpleadosAsync();
+
+        Assert.NotNull(handler.LastRequest?.Headers.Authorization);
+        Assert.Equal("Bearer", handler.LastRequest.Headers.Authorization.Scheme);
+        Assert.Equal(ContractTestData.TestToken, handler.LastRequest.Headers.Authorization.Parameter);
+    }
+
+    [Fact]
+    public async Task GetEmpleados_ShouldReturnData_WhenApiSucceeds()
+    {
+        var (service, _) = CreateServiceWithToken(ContractTestData.ValidEmpleadoPaginatedResponse, HttpStatusCode.OK);
+
+        var result = await service.GetEmpleadosAsync();
+
+        Assert.NotNull(result);
+        Assert.Single(result.Items);
+        Assert.Equal("Carlos Lopez", result.Items[0].StrNombre);
+    }
+
+    [Fact]
+    public async Task GetEmpleados_ShouldReturnNull_WhenApiReturnsServerError()
+    {
+        var (service, _) = CreateServiceWithToken("", HttpStatusCode.InternalServerError);
+
+        var result = await service.GetEmpleadosAsync();
+
+        Assert.Null(result);
+    }
+
+    [Fact]
+    public async Task GetEmpleados_ShouldReturnNull_WhenMissingToken()
+    {
+        var (service, _) = CreateServiceWithoutToken();
+
+        var result = await service.GetEmpleadosAsync();
+
+        Assert.Null(result);
+    }
+
+    [Fact]
+    public async Task SearchEmpleados_ShouldBuildCorrectUrl_WithTexto()
+    {
+        var (service, handler) = CreateServiceWithToken();
+
+        await service.SearchEmpleadosAsync("Carlos", null, 1, 10);
+
+        var url = handler.LastRequest?.RequestUri?.PathAndQuery.TrimStart('/');
+        Assert.Contains("api/v1/Empleado/buscar", url);
+        Assert.Contains("texto=Carlos", url);
+        Assert.Contains("PageNumber=1", url);
+        Assert.Contains("PageSize=10", url);
+    }
+
+    [Fact]
+    public async Task SearchEmpleados_ShouldBuildCorrectUrl_WithIdTipoEmpleado()
+    {
+        var (service, handler) = CreateServiceWithToken();
+
+        await service.SearchEmpleadosAsync(null, 2, 1, 10);
+
+        var url = handler.LastRequest?.RequestUri?.PathAndQuery.TrimStart('/');
+        Assert.Contains("api/v1/Empleado/buscar", url);
+        Assert.Contains("idTipoEmpleado=2", url);
+    }
+
+    [Fact]
+    public async Task SearchEmpleados_ShouldBuildCorrectUrl_WithAllFilters()
+    {
+        var (service, handler) = CreateServiceWithToken();
+
+        await service.SearchEmpleadosAsync("Maria", 3, 2, 20);
+
+        var url = handler.LastRequest?.RequestUri?.PathAndQuery.TrimStart('/');
+        Assert.Contains("texto=Maria", url);
+        Assert.Contains("idTipoEmpleado=3", url);
+        Assert.Contains("PageNumber=2", url);
+        Assert.Contains("PageSize=20", url);
+    }
+
+    [Fact]
+    public async Task GetEmpleadoById_ShouldGetCorrectUrl()
+    {
+        var (service, handler) = CreateServiceWithToken();
+
+        await service.GetEmpleadoByIdAsync(42);
+
+        Assert.Equal(HttpMethod.Get, handler.LastRequest?.Method);
+        Assert.Equal("api/v1/Empleado/42", handler.LastRequest?.RequestUri?.PathAndQuery.TrimStart('/'));
+    }
+
+    [Fact]
+    public async Task GetEmpleadoById_ShouldReturnEmpleado_WhenFound()
+    {
+        var (service, _) = CreateServiceWithToken(ContractTestData.ValidEmpleado, HttpStatusCode.OK);
+
+        var result = await service.GetEmpleadoByIdAsync(1);
+
+        Assert.NotNull(result);
+        Assert.Equal(1, result.Id);
+        Assert.Equal("Carlos Lopez", result.StrNombre);
+    }
+
+    [Fact]
+    public async Task GetEmpleadoById_ShouldReturnNull_WhenNotFound()
+    {
+        var (service, _) = CreateServiceWithToken(null, HttpStatusCode.NotFound);
+
+        var result = await service.GetEmpleadoByIdAsync(999);
+
+        Assert.Null(result);
+    }
+
+    [Fact]
+    public async Task CreateEmpleado_ShouldPostCorrectData()
+    {
+        var (service, handler) = CreateServiceWithToken(null, HttpStatusCode.Created);
+
+        await service.CreateEmpleadoAsync(ContractTestData.ValidEmpleadoCreateViewModel);
+
+        Assert.Equal(HttpMethod.Post, handler.LastRequest?.Method);
+        Assert.Equal("api/v1/Empleado", handler.LastRequest?.RequestUri?.PathAndQuery.TrimStart('/'));
+    }
+
+    [Fact]
+    public async Task CreateEmpleado_ShouldSerializeRequestBody()
+    {
+        var (service, handler) = CreateServiceWithToken(null, HttpStatusCode.Created);
+
+        await service.CreateEmpleadoAsync(ContractTestData.ValidEmpleadoCreateViewModel);
+
+        Assert.NotNull(handler.LastRequestBody);
+        var json = JsonDocument.Parse(handler.LastRequestBody);
+        Assert.Equal("Nuevo Empleado", json.RootElement.GetProperty("strNombre").GetString());
+    }
+
+    [Fact]
+    public async Task CreateEmpleado_ShouldReturnOk_WhenApiSucceeds()
+    {
+        var (service, _) = CreateServiceWithToken(null, HttpStatusCode.Created);
+
+        var result = await service.CreateEmpleadoAsync(ContractTestData.ValidEmpleadoCreateViewModel);
+
+        Assert.True(result.Success);
+    }
+
+    [Fact]
+    public async Task CreateEmpleado_ShouldReturnFail_WhenApiReturnsError()
+    {
+        var (service, _) = CreateServiceWithToken(ContractTestData.EmpleadoValidationApiError, HttpStatusCode.BadRequest);
+
+        var result = await service.CreateEmpleadoAsync(ContractTestData.ValidEmpleadoCreateViewModel);
+
+        Assert.False(result.Success);
+        Assert.NotNull(result.FieldErrors);
+        Assert.Contains("strNombre", result.FieldErrors.Keys);
+    }
+
+    [Fact]
+    public async Task CreateEmpleado_ShouldReturnFail_WhenMissingToken()
+    {
+        var (service, _) = CreateServiceWithoutToken();
+
+        var result = await service.CreateEmpleadoAsync(ContractTestData.ValidEmpleadoCreateViewModel);
+
+        Assert.False(result.Success);
+        Assert.Equal(ContractTestData.MissingTokenMessage, result.ErrorMessage);
+    }
+
+    [Fact]
+    public async Task UpdateEmpleado_ShouldPutCorrectUrl()
+    {
+        var (service, handler) = CreateServiceWithToken(null, HttpStatusCode.NoContent);
+
+        await service.UpdateEmpleadoAsync(1, ContractTestData.ValidEmpleadoUpdateViewModel);
+
+        Assert.Equal(HttpMethod.Put, handler.LastRequest?.Method);
+        Assert.Equal("api/v1/Empleado/1", handler.LastRequest?.RequestUri?.PathAndQuery.TrimStart('/'));
+    }
+
+    [Fact]
+    public async Task UpdateEmpleado_ShouldReturnOk_WhenApiSucceeds()
+    {
+        var (service, _) = CreateServiceWithToken(null, HttpStatusCode.NoContent);
+
+        var result = await service.UpdateEmpleadoAsync(1, ContractTestData.ValidEmpleadoUpdateViewModel);
+
+        Assert.True(result.Success);
+    }
+
+    [Fact]
+    public async Task UpdateEmpleado_ShouldReturnConflict_WhenConcurrencyError()
+    {
+        var (service, _) = CreateServiceWithToken(ContractTestData.EmpleadoConflictApiError, HttpStatusCode.Conflict);
+
+        var result = await service.UpdateEmpleadoAsync(1, ContractTestData.ValidEmpleadoUpdateViewModel);
+
+        Assert.False(result.Success);
+        Assert.Contains("modificado", result.ErrorMessage);
+    }
+
+    [Fact]
+    public async Task DeleteEmpleado_ShouldDeleteCorrectUrl()
+    {
+        var (service, handler) = CreateServiceWithToken(null, HttpStatusCode.OK);
+
+        await service.DeleteEmpleadoAsync(1, _rowVersion);
+
+        Assert.Equal(HttpMethod.Delete, handler.LastRequest?.Method);
+        Assert.Equal("api/v1/Empleado/1", handler.LastRequest?.RequestUri?.PathAndQuery.TrimStart('/'));
+    }
+
+    [Fact]
+    public async Task DeleteEmpleado_ShouldReturnOk_WhenApiSucceeds()
+    {
+        var (service, _) = CreateServiceWithToken(null, HttpStatusCode.OK);
+
+        var result = await service.DeleteEmpleadoAsync(1, _rowVersion);
+
+        Assert.True(result.Success);
+    }
+
+    [Fact]
+    public async Task DeleteEmpleado_ShouldReturnFail_WhenMissingToken()
+    {
+        var (service, _) = CreateServiceWithoutToken();
+
+        var result = await service.DeleteEmpleadoAsync(1, _rowVersion);
+
+        Assert.False(result.Success);
+        Assert.Equal(ContractTestData.MissingTokenMessage, result.ErrorMessage);
+    }
+}
diff --git a/tests/WebDevSecOps.IntegrationTests/Services/TipoEmpleadoApiClientTests.cs b/tests/WebDevSecOps.IntegrationTests/Services/TipoEmpleadoApiClientTests.cs
new file mode 100644
index 0000000..23570b3
--- /dev/null
+++ b/tests/WebDevSecOps.IntegrationTests/Services/TipoEmpleadoApiClientTests.cs
@@ -0,0 +1,142 @@
+using System.Net;
+using System.Security.Claims;
+using Microsoft.AspNetCore.Http;
+using Microsoft.Extensions.Logging;
+using Moq;
+using WebDevSecOps.Models;
+using WebDevSecOps.Services;
+using WebDevSecOps.UnitTests.Common;
+
+namespace WebDevSecOps.IntegrationTests.Services;
+
+public class TipoEmpleadoApiClientTests
+{
+    private (TipoEmpleadoService Service, MockHttpMessageHandler Handler) CreateServiceWithToken(
+        object? responseContent = null, HttpStatusCode? statusCode = null)
+    {
+        var mockHandler = new MockHttpMessageHandler(responseContent, statusCode ?? HttpStatusCode.OK);
+        var httpClient = new HttpClient(mockHandler) { BaseAddress = new Uri(TestConstants.ApiBaseUrl) };
+
+        var httpContextAccessorMock = new Mock<IHttpContextAccessor>();
+        var principal = new ClaimsPrincipal(new ClaimsIdentity([
+            new Claim("token_key", "test-key"),
+            new Claim(ClaimTypes.Name, "test-user")
+        ], "test"));
+        var httpContextMock = new Mock<HttpContext>();
+        httpContextMock.Setup(x => x.User).Returns(principal);
+        httpContextAccessorMock.Setup(x => x.HttpContext).Returns(httpContextMock.Object);
+
+        var tokenStoreMock = new Mock<ITokenStore>();
+        tokenStoreMock.Setup(x => x.GetTokenFromPrincipal(It.IsAny<ClaimsPrincipal>()))
+                      .Returns(ContractTestData.TestToken);
+
+        var loggerMock = new Mock<ILogger<TipoEmpleadoService>>();
+        var service = new TipoEmpleadoService(httpClient, httpContextAccessorMock.Object, tokenStoreMock.Object, loggerMock.Object);
+
+        return (service, mockHandler);
+    }
+
+    private (TipoEmpleadoService Service, MockHttpMessageHandler Handler) CreateServiceWithoutToken()
+    {
+        var mockHandler = new MockHttpMessageHandler(null, HttpStatusCode.OK);
+        var httpClient = new HttpClient(mockHandler) { BaseAddress = new Uri(TestConstants.ApiBaseUrl) };
+
+        var httpContextAccessorMock = new Mock<IHttpContextAccessor>();
+        httpContextAccessorMock.Setup(x => x.HttpContext).Returns((HttpContext?)null);
+
+        var tokenStoreMock = new Mock<ITokenStore>();
+
+        var loggerMock = new Mock<ILogger<TipoEmpleadoService>>();
+        var service = new TipoEmpleadoService(httpClient, httpContextAccessorMock.Object, tokenStoreMock.Object, loggerMock.Object);
+
+        return (service, mockHandler);
+    }
+
+    [Fact]
+    public async Task GetAllAsync_ShouldGetCorrectUrl()
+    {
+        var (service, handler) = CreateServiceWithToken();
+
+        await service.GetAllAsync();
+
+        Assert.Equal(HttpMethod.Get, handler.LastRequest?.Method);
+        Assert.Equal("api/v1/TipoEmpleado?PageNumber=1&PageSize=100", handler.LastRequest?.RequestUri?.PathAndQuery.TrimStart('/'));
+    }
+
+    [Fact]
+    public async Task GetAllAsync_ShouldIncludeBearerToken()
+    {
+        var (service, handler) = CreateServiceWithToken();
+
+        await service.GetAllAsync();
+
+        Assert.NotNull(handler.LastRequest?.Headers.Authorization);
+        Assert.Equal("Bearer", handler.LastRequest.Headers.Authorization.Scheme);
+        Assert.Equal(ContractTestData.TestToken, handler.LastRequest.Headers.Authorization.Parameter);
+    }
+
+    [Fact]
+    public async Task GetAllAsync_ShouldReturnData_WhenApiSucceeds()
+    {
+        var (service, _) = CreateServiceWithToken(ContractTestData.ValidTipoEmpleadoPaginatedResponse, HttpStatusCode.OK);
+
+        var result = await service.GetAllAsync();
+
+        Assert.NotNull(result);
+        Assert.Single(result.Items);
+        Assert.Equal("Administrativo", result.Items[0].StrValor);
+    }
+
+    [Fact]
+    public async Task GetAllAsync_ShouldReturnNull_WhenMissingToken()
+    {
+        var (service, _) = CreateServiceWithoutToken();
+
+        var result = await service.GetAllAsync();
+
+        Assert.Null(result);
+    }
+
+    [Fact]
+    public async Task GetByIdAsync_ShouldGetCorrectUrl()
+    {
+        var (service, handler) = CreateServiceWithToken();
+
+        await service.GetByIdAsync(5);
+
+        Assert.Equal(HttpMethod.Get, handler.LastRequest?.Method);
+        Assert.Equal("api/v1/TipoEmpleado/5", handler.LastRequest?.RequestUri?.PathAndQuery.TrimStart('/'));
+    }
+
+    [Fact]
+    public async Task GetByIdAsync_ShouldReturnData_WhenFound()
+    {
+        var (service, _) = CreateServiceWithToken(ContractTestData.ValidTipoEmpleado, HttpStatusCode.OK);
+
+        var result = await service.GetByIdAsync(1);
+
+        Assert.NotNull(result);
+        Assert.Equal(1, result.Id);
+        Assert.Equal("Administrativo", result.StrValor);
+    }
+
+    [Fact]
+    public async Task GetByIdAsync_ShouldReturnNull_WhenNotFound()
+    {
+        var (service, _) = CreateServiceWithToken(null, HttpStatusCode.NotFound);
+
+        var result = await service.GetByIdAsync(999);
+
+        Assert.Null(result);
+    }
+
+    [Fact]
+    public async Task GetByIdAsync_ShouldReturnNull_WhenMissingToken()
+    {
+        var (service, _) = CreateServiceWithoutToken();
+
+        var result = await service.GetByIdAsync(1);
+
+        Assert.Null(result);
+    }
+}
diff --git a/tests/WebDevSecOps.SecurityTests/SAST/EmpleadoSecurityTests.cs b/tests/WebDevSecOps.SecurityTests/SAST/EmpleadoSecurityTests.cs
new file mode 100644
index 0000000..59e1f5f
--- /dev/null
+++ b/tests/WebDevSecOps.SecurityTests/SAST/EmpleadoSecurityTests.cs
@@ -0,0 +1,161 @@
+using System.Net;
+using Microsoft.AspNetCore.Authentication.Cookies;
+using Microsoft.AspNetCore.Http;
+using Microsoft.AspNetCore.Mvc.Testing;
+using Microsoft.Extensions.DependencyInjection;
+using Microsoft.Extensions.DependencyInjection.Extensions;
+using WebDevSecOps.SecurityTests.Common;
+using WebDevSecOps.Services;
+
+namespace WebDevSecOps.SecurityTests.SAST;
+
+public class EmpleadoSecurityTests
+{
+    private static WebApplicationFactory<Program> CreateFactory()
+    {
+        return new WebApplicationFactory<Program>()
+            .WithWebHostBuilder(builder =>
+            {
+                builder.ConfigureServices(services =>
+                {
+                    services.RemoveAll<IAuthService>();
+                    services.AddSingleton<IAuthService>(new FakeAuthService());
+
+                    services.PostConfigure<CookieAuthenticationOptions>(
+                        CookieAuthenticationDefaults.AuthenticationScheme,
+                        options => options.Cookie.SecurePolicy = CookieSecurePolicy.SameAsRequest);
+                });
+            });
+    }
+
+    private static (WebApplicationFactory<Program> Factory, HttpClient Client) CreateUnauthenticatedClient()
+    {
+        var factory = new WebApplicationFactory<Program>();
+        var client = factory.CreateClient(new WebApplicationFactoryClientOptions
+        {
+            AllowAutoRedirect = false,
+            HandleCookies = true,
+        });
+        return (factory, client);
+    }
+
+    private static async Task AuthenticateAsync(HttpClient client)
+    {
+        var token = await SecurityTestHelpers.GetAntiForgeryTokenAsync(client, "/Login");
+
+        var form = SecurityTestHelpers.ToFormPayload(new Dictionary<string, string>
+        {
+            { "__RequestVerificationToken", token },
+            { "Input.Username", "admin" },
+            { "Input.Password", "Admin@123!" },
+        });
+
+        await client.PostAsync("/Login", form);
+    }
+
+    [Fact]
+    public async Task EmpleadoIndex_RequiresAuthentication()
+    {
+        var (factory, client) = CreateUnauthenticatedClient();
+        using (factory)
+        using (client)
+        {
+            var (status, _) = await SecurityTestHelpers.GetAsync(client, "/Empleado/Index");
+            Assert.Equal((int)HttpStatusCode.Redirect, status);
+        }
+    }
+
+    [Fact]
+    public async Task EmpleadoCreate_RequiresAuthentication()
+    {
+        var (factory, client) = CreateUnauthenticatedClient();
+        using (factory)
+        using (client)
+        {
+            var (status, _) = await SecurityTestHelpers.GetAsync(client, "/Empleado/Create");
+            Assert.Equal((int)HttpStatusCode.Redirect, status);
+        }
+    }
+
+    [Fact]
+    public async Task EmpleadoUpdate_RequiresAuthentication()
+    {
+        var (factory, client) = CreateUnauthenticatedClient();
+        using (factory)
+        using (client)
+        {
+            var (status, _) = await SecurityTestHelpers.GetAsync(client, "/Empleado/Update/1");
+            Assert.Equal((int)HttpStatusCode.Redirect, status);
+        }
+    }
+
+    [Fact]
+    public async Task EmpleadoDelete_RequiresAuthentication()
+    {
+        var (factory, client) = CreateUnauthenticatedClient();
+        using (factory)
+        using (client)
+        {
+            var (status, _) = await SecurityTestHelpers.GetAsync(client, "/Empleado/Delete/1");
+            Assert.Equal((int)HttpStatusCode.Redirect, status);
+        }
+    }
+
+    [Theory]
+    [InlineData("")]
+    [InlineData("   ")]
+    [InlineData(null)]
+    public async Task EmpleadoCreate_RejectsEmptyNombre(string? nombre)
+    {
+        using var factory = CreateFactory();
+        using var client = factory.CreateClient(new WebApplicationFactoryClientOptions
+        {
+            AllowAutoRedirect = false,
+            HandleCookies = true,
+        });
+
+        await AuthenticateAsync(client);
+        var token = await SecurityTestHelpers.GetAntiForgeryTokenAsync(client, "/Empleado/Create");
+
+        var form = SecurityTestHelpers.ToFormPayload(new Dictionary<string, string>
+        {
+            { "__RequestVerificationToken", token },
+            { "StrNombre", nombre ?? "" },
+            { "StrAPaterno", "" },
+            { "StrAMaterno", "" },
+            { "StrCURP", "" },
+        });
+
+        var (status, body) = await SecurityTestHelpers.PostAsync(client, "/Empleado/Create", form);
+        Assert.Equal((int)HttpStatusCode.OK, status);
+        Assert.Contains("obligatorio", body);
+    }
+
+    [Theory]
+    [MemberData(nameof(SecurityTestData.XssPayloads.All), MemberType = typeof(SecurityTestData.XssPayloads))]
+    public async Task EmpleadoCreate_RejectsXssInNombre(string xssPayload)
+    {
+        using var factory = CreateFactory();
+        using var client = factory.CreateClient(new WebApplicationFactoryClientOptions
+        {
+            AllowAutoRedirect = false,
+            HandleCookies = true,
+        });
+
+        await AuthenticateAsync(client);
+        var token = await SecurityTestHelpers.GetAntiForgeryTokenAsync(client, "/Empleado/Create");
+
+        var form = SecurityTestHelpers.ToFormPayload(new Dictionary<string, string>
+        {
+            { "__RequestVerificationToken", token },
+            { "StrNombre", xssPayload },
+            { "StrAPaterno", "" },
+            { "StrAMaterno", "" },
+            { "StrCURP", "" },
+        });
+
+        var (status, body) = await SecurityTestHelpers.PostAsync(client, "/Empleado/Create", form);
+        Assert.Equal((int)HttpStatusCode.OK, status);
+        Assert.Contains("solo permite letras", body.ToLowerInvariant());
+    }
+}
diff --git a/tests/WebDevSecOps.UnitTests/Common/ContractTestData.cs b/tests/WebDevSecOps.UnitTests/Common/ContractTestData.cs
index 431b7cf..179a71b 100644
--- a/tests/WebDevSecOps.UnitTests/Common/ContractTestData.cs
+++ b/tests/WebDevSecOps.UnitTests/Common/ContractTestData.cs
@@ -201,6 +201,99 @@ public static class ContractTestData
     // Constantes
     // ========================================================================
 
+    // ========================================================================
+    // Empleado domain model
+    // ========================================================================
+
+    public static EmpCatTipoEmpleado ValidTipoEmpleado => new()
+    {
+        Id = 1,
+        StrValor = "Administrativo",
+        StrDescripcion = "Personal administrativo"
+    };
+
+    public static Empleado ValidEmpleado => new()
+    {
+        Id = 1,
+        StrNombre = "Carlos Lopez",
+        StrAPaterno = "Lopez",
+        StrAMaterno = "Garcia",
+        StrCURP = "LOPC800101HDFRRN09",
+        IdEmpCatTipoEmpleado = 1,
+        RowVersion = _rowVersion
+    };
+
+    public static PaginatedResponse<Empleado> ValidEmpleadoPaginatedResponse => new()
+    {
+        Items = [ValidEmpleado],
+        TotalCount = 1,
+        PageNumber = 1,
+        PageSize = 10,
+        TotalPages = 1
+    };
+
+    public static PaginatedResponse<Empleado> EmptyEmpleadoPaginatedResponse => new()
+    {
+        Items = [],
+        TotalCount = 0,
+        PageNumber = 1,
+        PageSize = 10,
+        TotalPages = 0
+    };
+
+    public static PaginatedResponse<EmpCatTipoEmpleado> ValidTipoEmpleadoPaginatedResponse => new()
+    {
+        Items = [ValidTipoEmpleado],
+        TotalCount = 1,
+        PageNumber = 1,
+        PageSize = 100,
+        TotalPages = 1
+    };
+
+    public static EmpleadoCreateViewModel ValidEmpleadoCreateViewModel => new()
+    {
+        StrNombre = "Nuevo Empleado",
+        StrAPaterno = "Paterno",
+        StrAMaterno = "Materno",
+        StrCURP = "XXXX000101HDFRRN09",
+        IdEmpCatTipoEmpleado = 1
+    };
+
+    public static EmpleadoUpdateViewModel ValidEmpleadoUpdateViewModel => new()
+    {
+        Id = 1,
+        StrNombre = "Empleado Actualizado",
+        StrAPaterno = "Paterno",
+        StrAMaterno = "Materno",
+        StrCURP = "XXXX000101HDFRRN09",
+        IdEmpCatTipoEmpleado = 1,
+        RowVersion = _rowVersion
+    };
+
+    public static object ValidEmpleadoDeleteRequestBody => new
+    {
+        id = 1,
+        rowVersion = _rowVersion
+    };
+
+    public static ApiErrorResponse EmpleadoValidationApiError => new()
+    {
+        Title = "Validation Error",
+        Detail = "One or more validation errors occurred.",
+        Status = 400,
+        Errors = new Dictionary<string, string[]>
+        {
+            ["strNombre"] = ["El nombre es obligatorio."]
+        }
+    };
+
+    public static ApiErrorResponse EmpleadoConflictApiError => new()
+    {
+        Title = "Conflict",
+        Detail = "The record was modified by another user.",
+        Status = 409
+    };
+
     public const string TestToken = "eyJhbGciOiJIUzI1NiJ9.dGVzdC1kYXRhLW5vdC1hLXJlYWwtc2VjcmV0";
     public const string ConflictMessage = "El registro fue modificado por otro usuario. Recargue la p\u00e1gina e intente nuevamente.";
     public const string MissingTokenMessage = "Error de autenticaci\u00f3n. Inicie sesi\u00f3n nuevamente.";
diff --git a/tests/WebDevSecOps.UnitTests/Pages/Empleados/CreateTests.cs b/tests/WebDevSecOps.UnitTests/Pages/Empleados/CreateTests.cs
new file mode 100644
index 0000000..04a954b
--- /dev/null
+++ b/tests/WebDevSecOps.UnitTests/Pages/Empleados/CreateTests.cs
@@ -0,0 +1,113 @@
+using Microsoft.AspNetCore.Http;
+using Microsoft.AspNetCore.Mvc;
+using Microsoft.AspNetCore.Mvc.ViewFeatures;
+using Microsoft.Extensions.Logging;
+using Moq;
+using WebDevSecOps.Controllers;
+using WebDevSecOps.Models;
+using WebDevSecOps.Services;
+using WebDevSecOps.UnitTests.Common;
+
+namespace WebDevSecOps.UnitTests;
+
+public class EmpleadoCreateTests
+{
+    private static (EmpleadoController Controller, Mock<IEmpleadoService> ServiceMock, Mock<ITipoEmpleadoService> TipoMock, Mock<ILogger<EmpleadoController>> LoggerMock) CreateController()
+    {
+        var serviceMock = new Mock<IEmpleadoService>();
+        var tipoMock = new Mock<ITipoEmpleadoService>();
+        var loggerMock = new Mock<ILogger<EmpleadoController>>();
+        var controller = new EmpleadoController(serviceMock.Object, tipoMock.Object, loggerMock.Object);
+
+        controller.ControllerContext = new ControllerContext
+        {
+            HttpContext = new DefaultHttpContext()
+        };
+        controller.TempData = new TempDataDictionary(
+            new DefaultHttpContext(),
+            Mock.Of<ITempDataProvider>());
+
+        return (controller, serviceMock, tipoMock, loggerMock);
+    }
+
+    [Fact]
+    public async Task Create_Get_ReturnsView()
+    {
+        var (controller, _, tipoMock, _) = CreateController();
+
+        tipoMock
+            .Setup(x => x.GetAllAsync(It.IsAny<int>(), It.IsAny<int>(), It.IsAny<CancellationToken>()))
+            .ReturnsAsync(ContractTestData.ValidTipoEmpleadoPaginatedResponse);
+
+        var result = await controller.Create();
+
+        var viewResult = Assert.IsType<ViewResult>(result);
+        Assert.Null(viewResult.Model);
+    }
+
+    [Fact]
+    public async Task Create_Get_LoadsTipoEmpleadoList()
+    {
+        var (controller, _, tipoMock, _) = CreateController();
+
+        tipoMock
+            .Setup(x => x.GetAllAsync(It.IsAny<int>(), It.IsAny<int>(), It.IsAny<CancellationToken>()))
+            .ReturnsAsync(ContractTestData.ValidTipoEmpleadoPaginatedResponse);
+
+        await controller.Create();
+
+        Assert.NotNull(controller.ViewBag.TipoEmpleadoList);
+    }
+
+    [Fact]
+    public async Task Create_Post_ReturnsRedirectToIndex_WhenSuccess()
+    {
+        var (controller, serviceMock, tipoMock, _) = CreateController();
+
+        serviceMock
+            .Setup(x => x.CreateEmpleadoAsync(It.IsAny<EmpleadoCreateViewModel>(), It.IsAny<CancellationToken>()))
+            .ReturnsAsync(OperationResult.Ok());
+
+        var result = await controller.Create(ContractTestData.ValidEmpleadoCreateViewModel, CancellationToken.None);
+
+        var redirectResult = Assert.IsType<RedirectToActionResult>(result);
+        Assert.Equal("Index", redirectResult.ActionName);
+        Assert.Equal("Operación exitosa!!", controller.TempData["Success"]);
+    }
+
+    [Fact]
+    public async Task Create_Post_ReturnsViewWithModel_WhenModelInvalid()
+    {
+        var (controller, _, tipoMock, _) = CreateController();
+
+        tipoMock
+            .Setup(x => x.GetAllAsync(It.IsAny<int>(), It.IsAny<int>(), It.IsAny<CancellationToken>()))
+            .ReturnsAsync(ContractTestData.ValidTipoEmpleadoPaginatedResponse);
+
+        controller.ModelState.AddModelError("StrNombre", "Required");
+
+        var result = await controller.Create(ContractTestData.ValidEmpleadoCreateViewModel, CancellationToken.None);
+
+        var viewResult = Assert.IsType<ViewResult>(result);
+        Assert.IsType<EmpleadoCreateViewModel>(viewResult.Model);
+    }
+
+    [Fact]
+    public async Task Create_Post_ReturnsViewWithModel_WhenServiceFails()
+    {
+        var (controller, serviceMock, tipoMock, _) = CreateController();
+
+        tipoMock
+            .Setup(x => x.GetAllAsync(It.IsAny<int>(), It.IsAny<int>(), It.IsAny<CancellationToken>()))
+            .ReturnsAsync(ContractTestData.ValidTipoEmpleadoPaginatedResponse);
+
+        serviceMock
+            .Setup(x => x.CreateEmpleadoAsync(It.IsAny<EmpleadoCreateViewModel>(), It.IsAny<CancellationToken>()))
+            .ReturnsAsync(OperationResult.Fail("Error al crear el empleado."));
+
+        var result = await controller.Create(ContractTestData.ValidEmpleadoCreateViewModel, CancellationToken.None);
+
+        var viewResult = Assert.IsType<ViewResult>(result);
+        Assert.IsType<EmpleadoCreateViewModel>(viewResult.Model);
+    }
+}
diff --git a/tests/WebDevSecOps.UnitTests/Pages/Empleados/DeleteTests.cs b/tests/WebDevSecOps.UnitTests/Pages/Empleados/DeleteTests.cs
new file mode 100644
index 0000000..503155d
--- /dev/null
+++ b/tests/WebDevSecOps.UnitTests/Pages/Empleados/DeleteTests.cs
@@ -0,0 +1,112 @@
+using Microsoft.AspNetCore.Http;
+using Microsoft.AspNetCore.Mvc;
+using Microsoft.AspNetCore.Mvc.ViewFeatures;
+using Microsoft.Extensions.Logging;
+using Moq;
+using WebDevSecOps.Controllers;
+using WebDevSecOps.Models;
+using WebDevSecOps.Services;
+using WebDevSecOps.UnitTests.Common;
+
+namespace WebDevSecOps.UnitTests;
+
+public class EmpleadoDeleteTests
+{
+    private static (EmpleadoController Controller, Mock<IEmpleadoService> ServiceMock, Mock<ITipoEmpleadoService> TipoMock, Mock<ILogger<EmpleadoController>> LoggerMock) CreateController()
+    {
+        var serviceMock = new Mock<IEmpleadoService>();
+        var tipoMock = new Mock<ITipoEmpleadoService>();
+        var loggerMock = new Mock<ILogger<EmpleadoController>>();
+        var controller = new EmpleadoController(serviceMock.Object, tipoMock.Object, loggerMock.Object);
+
+        controller.ControllerContext = new ControllerContext
+        {
+            HttpContext = new DefaultHttpContext()
+        };
+        controller.TempData = new TempDataDictionary(
+            new DefaultHttpContext(),
+            Mock.Of<ITempDataProvider>());
+
+        return (controller, serviceMock, tipoMock, loggerMock);
+    }
+
+    [Fact]
+    public async Task Delete_Get_ReturnsViewWithModel_WhenEmpleadoFound()
+    {
+        var (controller, serviceMock, tipoMock, _) = CreateController();
+
+        tipoMock
+            .Setup(x => x.GetByIdAsync(It.IsAny<int>(), It.IsAny<CancellationToken>()))
+            .ReturnsAsync(ContractTestData.ValidTipoEmpleado);
+
+        serviceMock
+            .Setup(x => x.GetEmpleadoByIdAsync(It.IsAny<int>(), It.IsAny<CancellationToken>()))
+            .ReturnsAsync(ContractTestData.ValidEmpleado);
+
+        var result = await controller.Delete(1, CancellationToken.None);
+
+        var viewResult = Assert.IsType<ViewResult>(result);
+        var model = Assert.IsType<EmpleadoDeleteViewModel>(viewResult.Model);
+        Assert.Equal("Carlos Lopez", model.StrNombre);
+        Assert.Equal("Administrativo", model.StrValorTipoEmpleado);
+    }
+
+    [Fact]
+    public async Task Delete_Get_RedirectsToIndex_WhenEmpleadoNotFound()
+    {
+        var (controller, serviceMock, _, _) = CreateController();
+
+        serviceMock
+            .Setup(x => x.GetEmpleadoByIdAsync(It.IsAny<int>(), It.IsAny<CancellationToken>()))
+            .ReturnsAsync((Empleado?)null);
+
+        var result = await controller.Delete(999, CancellationToken.None);
+
+        var redirectResult = Assert.IsType<RedirectResult>(result);
+        Assert.Equal("/Empleado/Index", redirectResult.Url);
+        Assert.Equal("Empleado no encontrado.", controller.TempData["Error"]);
+    }
+
+    [Fact]
+    public async Task Delete_Post_ReturnsRedirectToIndex_WhenSuccess()
+    {
+        var (controller, serviceMock, _, _) = CreateController();
+
+        serviceMock
+            .Setup(x => x.DeleteEmpleadoAsync(It.IsAny<int>(), It.IsAny<byte[]>(), It.IsAny<CancellationToken>()))
+            .ReturnsAsync(OperationResult.Ok());
+
+        var model = new EmpleadoDeleteViewModel
+        {
+            Id = 1,
+            RowVersion = [0x01, 0x02, 0x03, 0x04]
+        };
+
+        var result = await controller.Delete(model, CancellationToken.None);
+
+        var redirectResult = Assert.IsType<RedirectToActionResult>(result);
+        Assert.Equal("Index", redirectResult.ActionName);
+        Assert.Equal("Operación exitosa!!", controller.TempData["Success"]);
+    }
+
+    [Fact]
+    public async Task Delete_Post_ReturnsView_WhenServiceFails()
+    {
+        var (controller, serviceMock, _, _) = CreateController();
+
+        serviceMock
+            .Setup(x => x.DeleteEmpleadoAsync(It.IsAny<int>(), It.IsAny<byte[]>(), It.IsAny<CancellationToken>()))
+            .ReturnsAsync(OperationResult.Fail("Error al eliminar el empleado."));
+
+        var model = new EmpleadoDeleteViewModel
+        {
+            Id = 1,
+            RowVersion = [0x01, 0x02, 0x03, 0x04]
+        };
+
+        var result = await controller.Delete(model, CancellationToken.None);
+
+        var viewResult = Assert.IsType<ViewResult>(result);
+        Assert.IsType<EmpleadoDeleteViewModel>(viewResult.Model);
+    }
+}
diff --git a/tests/WebDevSecOps.UnitTests/Pages/Empleados/IndexTests.cs b/tests/WebDevSecOps.UnitTests/Pages/Empleados/IndexTests.cs
new file mode 100644
index 0000000..be6f0ec
--- /dev/null
+++ b/tests/WebDevSecOps.UnitTests/Pages/Empleados/IndexTests.cs
@@ -0,0 +1,215 @@
+using Microsoft.AspNetCore.Http;
+using Microsoft.AspNetCore.Mvc;
+using Microsoft.AspNetCore.Mvc.Rendering;
+using Microsoft.AspNetCore.Mvc.ViewFeatures;
+using Microsoft.Extensions.Logging;
+using Moq;
+using WebDevSecOps.Controllers;
+using WebDevSecOps.Models;
+using WebDevSecOps.Services;
+using WebDevSecOps.UnitTests.Common;
+
+namespace WebDevSecOps.UnitTests;
+
+public class EmpleadoIndexTests
+{
+    private static (EmpleadoController Controller, Mock<IEmpleadoService> ServiceMock, Mock<ITipoEmpleadoService> TipoMock, Mock<ILogger<EmpleadoController>> LoggerMock) CreateController()
+    {
+        var serviceMock = new Mock<IEmpleadoService>();
+        var tipoMock = new Mock<ITipoEmpleadoService>();
+        var loggerMock = new Mock<ILogger<EmpleadoController>>();
+        var controller = new EmpleadoController(serviceMock.Object, tipoMock.Object, loggerMock.Object);
+
+        controller.ControllerContext = new ControllerContext
+        {
+            HttpContext = new DefaultHttpContext()
+        };
+        controller.TempData = new TempDataDictionary(
+            new DefaultHttpContext(),
+            Mock.Of<ITempDataProvider>());
+
+        return (controller, serviceMock, tipoMock, loggerMock);
+    }
+
+    [Fact]
+    public async Task Index_ReturnsViewWithPaginatedResponse_WhenServiceReturnsData()
+    {
+        var (controller, serviceMock, tipoMock, _) = CreateController();
+
+        tipoMock
+            .Setup(x => x.GetAllAsync(It.IsAny<int>(), It.IsAny<int>(), It.IsAny<CancellationToken>()))
+            .ReturnsAsync(ContractTestData.ValidTipoEmpleadoPaginatedResponse);
+
+        serviceMock
+            .Setup(x => x.GetEmpleadosAsync(It.IsAny<int>(), It.IsAny<int>(), It.IsAny<CancellationToken>()))
+            .ReturnsAsync(ContractTestData.ValidEmpleadoPaginatedResponse);
+
+        var result = await controller.Index();
+
+        var viewResult = Assert.IsType<ViewResult>(result);
+        var model = Assert.IsType<PaginatedResponse<Empleado>>(viewResult.Model);
+        Assert.Single(model.Items);
+        Assert.Equal("Carlos Lopez", model.Items[0].StrNombre);
+        Assert.Null(controller.TempData["Error"]);
+    }
+
+    [Fact]
+    public async Task Index_ReturnsViewWithNullModel_WhenServiceReturnsNull()
+    {
+        var (controller, serviceMock, tipoMock, _) = CreateController();
+
+        tipoMock
+            .Setup(x => x.GetAllAsync(It.IsAny<int>(), It.IsAny<int>(), It.IsAny<CancellationToken>()))
+            .ReturnsAsync(ContractTestData.ValidTipoEmpleadoPaginatedResponse);
+
+        serviceMock
+            .Setup(x => x.GetEmpleadosAsync(It.IsAny<int>(), It.IsAny<int>(), It.IsAny<CancellationToken>()))
+            .ReturnsAsync((PaginatedResponse<Empleado>?)null);
+
+        var result = await controller.Index();
+
+        var viewResult = Assert.IsType<ViewResult>(result);
+        Assert.Null(viewResult.Model);
+        Assert.Equal("No se pudieron cargar los empleados.", controller.TempData["Error"]);
+    }
+
+    [Fact]
+    public async Task Index_UsesDefaultPagination_WhenNoParametersProvided()
+    {
+        var (controller, serviceMock, tipoMock, _) = CreateController();
+
+        tipoMock
+            .Setup(x => x.GetAllAsync(It.IsAny<int>(), It.IsAny<int>(), It.IsAny<CancellationToken>()))
+            .ReturnsAsync(ContractTestData.ValidTipoEmpleadoPaginatedResponse);
+
+        var capturedPageNumber = 0;
+        var capturedPageSize = 0;
+
+        serviceMock
+            .Setup(x => x.GetEmpleadosAsync(It.IsAny<int>(), It.IsAny<int>(), It.IsAny<CancellationToken>()))
+            .Callback<int, int, CancellationToken>((pn, ps, _) =>
+            {
+                capturedPageNumber = pn;
+                capturedPageSize = ps;
+            })
+            .ReturnsAsync(new PaginatedResponse<Empleado>());
+
+        await controller.Index();
+
+        Assert.Equal(1, capturedPageNumber);
+        Assert.Equal(10, capturedPageSize);
+    }
+
+    [Fact]
+    public async Task Index_CallsSearch_WhenTextoProvided()
+    {
+        var (controller, serviceMock, tipoMock, _) = CreateController();
+
+        tipoMock
+            .Setup(x => x.GetAllAsync(It.IsAny<int>(), It.IsAny<int>(), It.IsAny<CancellationToken>()))
+            .ReturnsAsync(ContractTestData.ValidTipoEmpleadoPaginatedResponse);
+
+        serviceMock
+            .Setup(x => x.SearchEmpleadosAsync(It.IsAny<string?>(), It.IsAny<int?>(), It.IsAny<int>(), It.IsAny<int>(), It.IsAny<CancellationToken>()))
+            .ReturnsAsync(ContractTestData.ValidEmpleadoPaginatedResponse);
+
+        await controller.Index(texto: "Carlos");
+
+        serviceMock.Verify(
+            x => x.SearchEmpleadosAsync("Carlos", null, 1, 10, It.IsAny<CancellationToken>()),
+            Times.Once);
+
+        serviceMock.Verify(
+            x => x.GetEmpleadosAsync(It.IsAny<int>(), It.IsAny<int>(), It.IsAny<CancellationToken>()),
+            Times.Never);
+    }
+
+    [Fact]
+    public async Task Index_CallsSearch_WhenIdTipoEmpleadoProvided()
+    {
+        var (controller, serviceMock, tipoMock, _) = CreateController();
+
+        tipoMock
+            .Setup(x => x.GetAllAsync(It.IsAny<int>(), It.IsAny<int>(), It.IsAny<CancellationToken>()))
+            .ReturnsAsync(ContractTestData.ValidTipoEmpleadoPaginatedResponse);
+
+        serviceMock
+            .Setup(x => x.SearchEmpleadosAsync(It.IsAny<string?>(), It.IsAny<int?>(), It.IsAny<int>(), It.IsAny<int>(), It.IsAny<CancellationToken>()))
+            .ReturnsAsync(ContractTestData.ValidEmpleadoPaginatedResponse);
+
+        await controller.Index(idTipoEmpleado: 2);
+
+        serviceMock.Verify(
+            x => x.SearchEmpleadosAsync(null, 2, 1, 10, It.IsAny<CancellationToken>()),
+            Times.Once);
+    }
+
+    [Fact]
+    public async Task Index_CallsGetAll_WhenNoFiltersProvided()
+    {
+        var (controller, serviceMock, tipoMock, _) = CreateController();
+
+        tipoMock
+            .Setup(x => x.GetAllAsync(It.IsAny<int>(), It.IsAny<int>(), It.IsAny<CancellationToken>()))
+            .ReturnsAsync(ContractTestData.ValidTipoEmpleadoPaginatedResponse);
+
+        serviceMock
+            .Setup(x => x.GetEmpleadosAsync(It.IsAny<int>(), It.IsAny<int>(), It.IsAny<CancellationToken>()))
+            .ReturnsAsync(ContractTestData.ValidEmpleadoPaginatedResponse);
+
+        await controller.Index();
+
+        serviceMock.Verify(
+            x => x.GetEmpleadosAsync(1, 10, It.IsAny<CancellationToken>()),
+            Times.Once);
+
+        serviceMock.Verify(
+            x => x.SearchEmpleadosAsync(It.IsAny<string?>(), It.IsAny<int?>(), It.IsAny<int>(), It.IsAny<int>(), It.IsAny<CancellationToken>()),
+            Times.Never);
+    }
+
+    [Fact]
+    public async Task Index_LogsWarning_WhenServiceReturnsNull()
+    {
+        var (controller, serviceMock, tipoMock, loggerMock) = CreateController();
+
+        tipoMock
+            .Setup(x => x.GetAllAsync(It.IsAny<int>(), It.IsAny<int>(), It.IsAny<CancellationToken>()))
+            .ReturnsAsync(ContractTestData.ValidTipoEmpleadoPaginatedResponse);
+
+        serviceMock
+            .Setup(x => x.GetEmpleadosAsync(It.IsAny<int>(), It.IsAny<int>(), It.IsAny<CancellationToken>()))
+            .ReturnsAsync((PaginatedResponse<Empleado>?)null);
+
+        await controller.Index();
+
+        loggerMock.Verify(
+            x => x.Log(
+                LogLevel.Warning,
+                It.IsAny<EventId>(),
+                It.Is<It.IsAnyType>((v, t) => v!.ToString()!.Contains("Failed to load empleados")),
+                It.IsAny<Exception>(),
+                It.Is<Func<It.IsAnyType, Exception?, string>>((v, t) => true)),
+            Times.Once);
+    }
+
+    [Fact]
+    public async Task Index_LoadsTipoEmpleadoList()
+    {
+        var (controller, serviceMock, tipoMock, _) = CreateController();
+
+        tipoMock
+            .Setup(x => x.GetAllAsync(It.IsAny<int>(), It.IsAny<int>(), It.IsAny<CancellationToken>()))
+            .ReturnsAsync(ContractTestData.ValidTipoEmpleadoPaginatedResponse);
+
+        serviceMock
+            .Setup(x => x.GetEmpleadosAsync(It.IsAny<int>(), It.IsAny<int>(), It.IsAny<CancellationToken>()))
+            .ReturnsAsync(ContractTestData.ValidEmpleadoPaginatedResponse);
+
+        await controller.Index();
+
+        var tipoList = controller.ViewBag.TipoEmpleadoList as SelectList;
+        Assert.NotNull(tipoList);
+        Assert.Single(tipoList);
+    }
+}
diff --git a/tests/WebDevSecOps.UnitTests/Pages/Empleados/UpdateTests.cs b/tests/WebDevSecOps.UnitTests/Pages/Empleados/UpdateTests.cs
new file mode 100644
index 0000000..bd6cef4
--- /dev/null
+++ b/tests/WebDevSecOps.UnitTests/Pages/Empleados/UpdateTests.cs
@@ -0,0 +1,101 @@
+using Microsoft.AspNetCore.Http;
+using Microsoft.AspNetCore.Mvc;
+using Microsoft.AspNetCore.Mvc.ViewFeatures;
+using Microsoft.Extensions.Logging;
+using Moq;
+using WebDevSecOps.Controllers;
+using WebDevSecOps.Models;
+using WebDevSecOps.Services;
+using WebDevSecOps.UnitTests.Common;
+
+namespace WebDevSecOps.UnitTests;
+
+public class EmpleadoUpdateTests
+{
+    private static (EmpleadoController Controller, Mock<IEmpleadoService> ServiceMock, Mock<ITipoEmpleadoService> TipoMock, Mock<ILogger<EmpleadoController>> LoggerMock) CreateController()
+    {
+        var serviceMock = new Mock<IEmpleadoService>();
+        var tipoMock = new Mock<ITipoEmpleadoService>();
+        var loggerMock = new Mock<ILogger<EmpleadoController>>();
+        var controller = new EmpleadoController(serviceMock.Object, tipoMock.Object, loggerMock.Object);
+
+        controller.ControllerContext = new ControllerContext
+        {
+            HttpContext = new DefaultHttpContext()
+        };
+        controller.TempData = new TempDataDictionary(
+            new DefaultHttpContext(),
+            Mock.Of<ITempDataProvider>());
+
+        return (controller, serviceMock, tipoMock, loggerMock);
+    }
+
+    [Fact]
+    public async Task Update_Get_ReturnsViewWithModel_WhenEmpleadoFound()
+    {
+        var (controller, serviceMock, tipoMock, _) = CreateController();
+
+        tipoMock
+            .Setup(x => x.GetAllAsync(It.IsAny<int>(), It.IsAny<int>(), It.IsAny<CancellationToken>()))
+            .ReturnsAsync(ContractTestData.ValidTipoEmpleadoPaginatedResponse);
+
+        serviceMock
+            .Setup(x => x.GetEmpleadoByIdAsync(It.IsAny<int>(), It.IsAny<CancellationToken>()))
+            .ReturnsAsync(ContractTestData.ValidEmpleado);
+
+        var result = await controller.Update(1, CancellationToken.None);
+
+        var viewResult = Assert.IsType<ViewResult>(result);
+        var model = Assert.IsType<EmpleadoUpdateViewModel>(viewResult.Model);
+        Assert.Equal("Carlos Lopez", model.StrNombre);
+    }
+
+    [Fact]
+    public async Task Update_Get_RedirectsToIndex_WhenEmpleadoNotFound()
+    {
+        var (controller, serviceMock, _, _) = CreateController();
+
+        serviceMock
+            .Setup(x => x.GetEmpleadoByIdAsync(It.IsAny<int>(), It.IsAny<CancellationToken>()))
+            .ReturnsAsync((Empleado?)null);
+
+        var result = await controller.Update(999, CancellationToken.None);
+
+        var redirectResult = Assert.IsType<RedirectResult>(result);
+        Assert.Equal("/Empleado/Index", redirectResult.Url);
+        Assert.Equal("Empleado no encontrado.", controller.TempData["Error"]);
+    }
+
+    [Fact]
+    public async Task Update_Post_ReturnsRedirectToIndex_WhenSuccess()
+    {
+        var (controller, serviceMock, _, _) = CreateController();
+
+        serviceMock
+            .Setup(x => x.UpdateEmpleadoAsync(It.IsAny<int>(), It.IsAny<EmpleadoUpdateViewModel>(), It.IsAny<CancellationToken>()))
+            .ReturnsAsync(OperationResult.Ok());
+
+        var result = await controller.Update(ContractTestData.ValidEmpleadoUpdateViewModel, CancellationToken.None);
+
+        var redirectResult = Assert.IsType<RedirectToActionResult>(result);
+        Assert.Equal("Index", redirectResult.ActionName);
+        Assert.Equal("Operación exitosa!!", controller.TempData["Success"]);
+    }
+
+    [Fact]
+    public async Task Update_Post_ReturnsViewWithModel_WhenModelInvalid()
+    {
+        var (controller, _, tipoMock, _) = CreateController();
+
+        tipoMock
+            .Setup(x => x.GetAllAsync(It.IsAny<int>(), It.IsAny<int>(), It.IsAny<CancellationToken>()))
+            .ReturnsAsync(ContractTestData.ValidTipoEmpleadoPaginatedResponse);
+
+        controller.ModelState.AddModelError("StrNombre", "Required");
+
+        var result = await controller.Update(ContractTestData.ValidEmpleadoUpdateViewModel, CancellationToken.None);
+
+        var viewResult = Assert.IsType<ViewResult>(result);
+        Assert.IsType<EmpleadoUpdateViewModel>(viewResult.Model);
+    }
+}

From 5b9f5997c4861057d0cfa281c0841d25ad96c083 Mon Sep 17 00:00:00 2001
From: edelomeza <edelomeza@gmail.com>
Date: Sun, 5 Jul 2026 21:12:54 -0600
Subject: [PATCH 2/5] Potential fix for pull request finding 'CodeQL / Useless
 upcast'

Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
---
 tests/WebDevSecOps.UnitTests/Pages/Empleados/UpdateTests.cs | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/tests/WebDevSecOps.UnitTests/Pages/Empleados/UpdateTests.cs b/tests/WebDevSecOps.UnitTests/Pages/Empleados/UpdateTests.cs
index bd6cef4..72ef46a 100644
--- a/tests/WebDevSecOps.UnitTests/Pages/Empleados/UpdateTests.cs
+++ b/tests/WebDevSecOps.UnitTests/Pages/Empleados/UpdateTests.cs
@@ -57,7 +57,7 @@ public async Task Update_Get_RedirectsToIndex_WhenEmpleadoNotFound()
 
         serviceMock
             .Setup(x => x.GetEmpleadoByIdAsync(It.IsAny<int>(), It.IsAny<CancellationToken>()))
-            .ReturnsAsync((Empleado?)null);
+            .ReturnsAsync(null);
 
         var result = await controller.Update(999, CancellationToken.None);
 

From 1d62520f2cc460685d1d5a78f1b92dcd2bcdb5ba Mon Sep 17 00:00:00 2001
From: edelmezamx <edel.meza@pixir.com.mx>
Date: Sun, 5 Jul 2026 21:22:38 -0600
Subject: [PATCH 3/5] fix: resolve Moq ambiguity with default(Empleado) and
 remove unused tipoMock variable

---
 tests/WebDevSecOps.UnitTests/Pages/Empleados/CreateTests.cs | 2 +-
 tests/WebDevSecOps.UnitTests/Pages/Empleados/UpdateTests.cs | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/tests/WebDevSecOps.UnitTests/Pages/Empleados/CreateTests.cs b/tests/WebDevSecOps.UnitTests/Pages/Empleados/CreateTests.cs
index 04a954b..034c12a 100644
--- a/tests/WebDevSecOps.UnitTests/Pages/Empleados/CreateTests.cs
+++ b/tests/WebDevSecOps.UnitTests/Pages/Empleados/CreateTests.cs
@@ -62,7 +62,7 @@ public async Task Create_Get_LoadsTipoEmpleadoList()
     [Fact]
     public async Task Create_Post_ReturnsRedirectToIndex_WhenSuccess()
     {
-        var (controller, serviceMock, tipoMock, _) = CreateController();
+        var (controller, serviceMock, _, _) = CreateController();
 
         serviceMock
             .Setup(x => x.CreateEmpleadoAsync(It.IsAny<EmpleadoCreateViewModel>(), It.IsAny<CancellationToken>()))
diff --git a/tests/WebDevSecOps.UnitTests/Pages/Empleados/UpdateTests.cs b/tests/WebDevSecOps.UnitTests/Pages/Empleados/UpdateTests.cs
index 72ef46a..e9406f4 100644
--- a/tests/WebDevSecOps.UnitTests/Pages/Empleados/UpdateTests.cs
+++ b/tests/WebDevSecOps.UnitTests/Pages/Empleados/UpdateTests.cs
@@ -57,7 +57,7 @@ public async Task Update_Get_RedirectsToIndex_WhenEmpleadoNotFound()
 
         serviceMock
             .Setup(x => x.GetEmpleadoByIdAsync(It.IsAny<int>(), It.IsAny<CancellationToken>()))
-            .ReturnsAsync(null);
+            .ReturnsAsync(default(Empleado));
 
         var result = await controller.Update(999, CancellationToken.None);
 

From e922bbf17ee7cc384053070dde8fa8d22dfd2152 Mon Sep 17 00:00:00 2001
From: edelmezamx <edel.meza@pixir.com.mx>
Date: Sun, 5 Jul 2026 21:27:37 -0600
Subject: [PATCH 4/5] fix: align TempData assertions with actual controller
 messages

---
 tests/WebDevSecOps.UnitTests/Pages/Empleados/CreateTests.cs | 2 +-
 tests/WebDevSecOps.UnitTests/Pages/Empleados/DeleteTests.cs | 2 +-
 tests/WebDevSecOps.UnitTests/Pages/Empleados/UpdateTests.cs | 2 +-
 3 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/tests/WebDevSecOps.UnitTests/Pages/Empleados/CreateTests.cs b/tests/WebDevSecOps.UnitTests/Pages/Empleados/CreateTests.cs
index 034c12a..2c93220 100644
--- a/tests/WebDevSecOps.UnitTests/Pages/Empleados/CreateTests.cs
+++ b/tests/WebDevSecOps.UnitTests/Pages/Empleados/CreateTests.cs
@@ -72,7 +72,7 @@ public async Task Create_Post_ReturnsRedirectToIndex_WhenSuccess()
 
         var redirectResult = Assert.IsType<RedirectToActionResult>(result);
         Assert.Equal("Index", redirectResult.ActionName);
-        Assert.Equal("Operación exitosa!!", controller.TempData["Success"]);
+        Assert.Equal("Empleado creado exitosamente.", controller.TempData["Success"]);
     }
 
     [Fact]
diff --git a/tests/WebDevSecOps.UnitTests/Pages/Empleados/DeleteTests.cs b/tests/WebDevSecOps.UnitTests/Pages/Empleados/DeleteTests.cs
index 503155d..8a49b80 100644
--- a/tests/WebDevSecOps.UnitTests/Pages/Empleados/DeleteTests.cs
+++ b/tests/WebDevSecOps.UnitTests/Pages/Empleados/DeleteTests.cs
@@ -86,7 +86,7 @@ public async Task Delete_Post_ReturnsRedirectToIndex_WhenSuccess()
 
         var redirectResult = Assert.IsType<RedirectToActionResult>(result);
         Assert.Equal("Index", redirectResult.ActionName);
-        Assert.Equal("Operación exitosa!!", controller.TempData["Success"]);
+        Assert.Equal("Empleado eliminado exitosamente.", controller.TempData["Success"]);
     }
 
     [Fact]
diff --git a/tests/WebDevSecOps.UnitTests/Pages/Empleados/UpdateTests.cs b/tests/WebDevSecOps.UnitTests/Pages/Empleados/UpdateTests.cs
index e9406f4..97ca9c7 100644
--- a/tests/WebDevSecOps.UnitTests/Pages/Empleados/UpdateTests.cs
+++ b/tests/WebDevSecOps.UnitTests/Pages/Empleados/UpdateTests.cs
@@ -79,7 +79,7 @@ public async Task Update_Post_ReturnsRedirectToIndex_WhenSuccess()
 
         var redirectResult = Assert.IsType<RedirectToActionResult>(result);
         Assert.Equal("Index", redirectResult.ActionName);
-        Assert.Equal("Operación exitosa!!", controller.TempData["Success"]);
+        Assert.Equal("Empleado actualizado exitosamente.", controller.TempData["Success"]);
     }
 
     [Fact]

From fed5602e6aa5841ed58f7ac2b0f7eb837921c98c Mon Sep 17 00:00:00 2001
From: edelmezamx <edel.meza@pixir.com.mx>
Date: Sun, 5 Jul 2026 21:39:42 -0600
Subject: [PATCH 5/5] docs: add MemoriaPruebas with CI/CD lessons learned

---
 tests/MemoriaPruebas.md | 84 +++++++++++++++++++++++++++++++++++++++++
 1 file changed, 84 insertions(+)
 create mode 100644 tests/MemoriaPruebas.md

diff --git a/tests/MemoriaPruebas.md b/tests/MemoriaPruebas.md
new file mode 100644
index 0000000..51f6ed9
--- /dev/null
+++ b/tests/MemoriaPruebas.md
@@ -0,0 +1,84 @@
+# Memoria de Pruebas — Lecciones Aprendidas
+
+## 1. Errores Comunes de Compilación
+
+### CS0121: Ambigüedad en Moq ReturnsAsync
+- **Causa**: `.ReturnsAsync(null)` o `.ReturnsAsync((Type?)null)` no resuelve
+  la sobrecarga entre `ReturnsAsync(TResult)` y `ReturnsAsync(Func<TResult>)`
+- **Fix correcto**: `.ReturnsAsync(default(Type))` o `.ReturnsAsync(ItExpr.IsNull<T>())`
+- **Fix incorrecto**: `.ReturnsAsync(null)` — sigue ambiguo
+- **Archivo de ejemplo**: `UpdateTests.cs:60`
+
+### S1481: Variable no usada (SonarQube)
+- **Causa**: Variable desestructura de tupla pero no se usa en el test
+- **Fix**: Reemplazar con `_` en la desestructuración
+- **Archivo de ejemplo**: `CreateTests.cs:65`
+
+## 2. Aserciones de Mensajes TempData
+
+### Patrón correcto
+Los tests deben usar los mensajes **exactos** del controlador:
+- Create: `"Empleado creado exitosamente."`
+- Update: `"Empleado actualizado exitosamente."`
+- Delete: `"Empleado eliminado exitosamente."`
+
+### Error común
+Usar mensajes genéricos como `"Operación exitosa!!"` que no coinciden
+con el controlador.
+
+## 3. Checklist Pre-Push
+
+- [ ] `dotnet build --configuration Release --warnaserror` → 0 errores, 0 warnings
+- [ ] `dotnet test tests/WebDevSecOps.UnitTests` → todos pasan
+- [ ] Verificar que los mensajes en tests coinciden con el controlador
+- [ ] Verificar que no hay variables no usadas (S1481)
+
+## 4. Pipeline CI/CD
+
+### Checks que deben pasar
+| Check | Requisito |
+|-------|-----------|
+| build | Compilación limpia + tests unitarios |
+| codeql | Análisis estático de código |
+| sast | Análisis de seguridad estático |
+| secret-scanning | Sin secrets expuestos |
+| dependency-review | Dependencias sin vulnerabilidades |
+| sca | Análisis de composición de software |
+
+### Checks opcionales (pueden skippear)
+- trivy: Escaneo de contenedores
+- zap-dast: Pruebas de seguridad dinámicas
+
+## 5. Patrones de Fix para Moq
+
+### Retornar null de forma segura
+```csharp
+// CORRECTO
+.ReturnsAsync(default(Empleado));
+.ReturnsAsync((Empleado?)null!);
+
+// INCORRECTO (ambiguo)
+.ReturnsAsync(null);
+.ReturnsAsync((Empleado?)null);
+```
+
+### Mock de servicio no usado
+```csharp
+// CORRECTO
+var (controller, serviceMock, _, _) = CreateController();
+
+// INCORRECTO (warning S1481)
+var (controller, serviceMock, tipoMock, _) = CreateController();
+```
+
+## 6. Commits de Corrección
+
+### Mensajes de commit recomendados
+- `fix: resolve Moq ambiguity with default(Type)`
+- `fix: remove unused variable in tests`
+- `fix: align TempData assertions with controller messages`
+
+### Orden de fixes
+1. Primero corregir errores de compilación
+2. Luego corregir errores de tests
+3. Verificar localmente antes de push