feat(scanner): add scanner category validation logic and related tests

tests/Feature/Migrations/AddScannerCategoryValidationToTenantsTest.php

@@ -0,0 +1,38 @@
+<?php
+
+namespace Tests\Feature\Migrations;
+
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Support\Facades\DB;
+use Tests\TestCase;
+
+class AddScannerCategoryValidationToTenantsTest extends TestCase
+{
+    use RefreshDatabase;
+
+    public function test_it_disables_scanner_category_validation_only_for_desfile(): void
+    {
+        $migration = require database_path(
+            'migrations/2026_08_13_020000_add_scanner_category_validation_to_tenants_table.php'
+        );
+
+        $migration->down();
+        $migration->up();
+
+        $this->assertDatabaseHas('tenants', [
+            'codigo' => 'desfile_pura_tendencia',
+            'scanner_category_validation_enabled' => false,
+        ]);
+
+        DB::table('tenants')->insert([
+            'codigo' => 'scanner-validation-default',
+            'nombre' => 'Scanner validation default',
+            'dominio' => 'scanner-validation-default.test',
+        ]);
+
+        $this->assertDatabaseHas('tenants', [
+            'codigo' => 'scanner-validation-default',
+            'scanner_category_validation_enabled' => true,
+        ]);
+    }
+}

tests/Feature/Staff/StaffControllerTest.php

@@ -119,6 +119,47 @@ class StaffControllerTest extends TestCase
             ->assertJsonValidationErrors('category_ids');
     }
 
+    public function test_categories_are_required_by_default_for_scanner_staff(): void
+    {
+        Sanctum::actingAs($this->admin);
+
+        $this->postJson('/api/v1/adminapp/tenant/staff', [
+            'nombre_apellido' => 'Grace Hopper',
+            'dni' => '87654321',
+            'email' => 'grace@example.test',
+            'category_ids' => [],
+        ])->assertUnprocessable()
+            ->assertJsonValidationErrors('category_ids');
+    }
+
+    public function test_admin_can_manage_staff_without_categories_when_tenant_disables_validation(): void
+    {
+        $this->tenant->update(['scanner_category_validation_enabled' => false]);
+        Sanctum::actingAs($this->admin);
+
+        $response = $this->postJson('/api/v1/adminapp/tenant/staff', [
+            'nombre_apellido' => 'Grace Hopper',
+            'dni' => '87654321',
+            'email' => 'grace@example.test',
+        ])->assertCreated()
+            ->assertJsonCount(0, 'data.categories');
+
+        $staffId = $response->json('data.id');
+        $category = $this->createCategory('Entradas');
+
+        $this->putJson("/api/v1/adminapp/tenant/staff/{$staffId}", [
+            'nombre_apellido' => 'Grace Murray Hopper',
+            'dni' => '87654321',
+            'email' => 'grace@example.test',
+            'category_ids' => [$category->id],
+        ])->assertOk()
+            ->assertJsonCount(0, 'data.categories');
+
+        $this->assertDatabaseMissing('category_scanners', [
+            'user_id' => $staffId,
+        ]);
+    }
+
     public function test_customer_cannot_manage_staff(): void
     {
         Sanctum::actingAs(User::factory()->create([

tests/Feature/Ticket/ScannerTicketControllerTest.php

@@ -254,6 +254,52 @@ class ScannerTicketControllerTest extends TestCase
         $this->assertNull($ticket->fresh()->used_at);
     }
 
+    public function test_scanner_can_read_and_scan_any_category_when_tenant_disables_validation(): void
+    {
+        $this->tenant->update(['scanner_category_validation_enabled' => false]);
+        $this->scanner->scanCategories()->detach();
+        $otherCategory = Category::query()->create([
+            'tenant_code' => $this->tenant->codigo,
+            'nombre' => 'Comidas',
+        ]);
+        $ticket = $this->createTicket(
+            'aaaaaaaa-1111-4111-8111-aaaaaaaaaaaa',
+            [],
+            $otherCategory,
+        );
+        Sanctum::actingAs($this->scanner);
+
+        $this->getJson("/api/v1/scanner/tickets/{$ticket->ticket}")
+            ->assertOk()
+            ->assertJsonPath('data.id', $ticket->id);
+
+        $this->postJson("/api/v1/scanner/tickets/{$ticket->ticket}/scan")
+            ->assertOk()
+            ->assertJsonPath('data.scanner_user_id', $this->scanner->id);
+    }
+
+    public function test_disabled_category_validation_does_not_allow_scanning_another_tenant(): void
+    {
+        $this->tenant->update(['scanner_category_validation_enabled' => false]);
+        $otherTenant = $this->createTenant('other');
+        $foreignCategory = Category::query()->create([
+            'tenant_code' => $otherTenant->codigo,
+            'nombre' => 'Externas',
+        ]);
+        $foreignTicket = $this->createTicket(
+            'bbbbbbbb-1111-4111-8111-bbbbbbbbbbbb',
+            [],
+            $foreignCategory,
+            $otherTenant,
+        );
+        Sanctum::actingAs($this->scanner);
+
+        $this->getJson("/api/v1/scanner/tickets/{$foreignTicket->ticket}")
+            ->assertNotFound();
+        $this->postJson("/api/v1/scanner/tickets/{$foreignTicket->ticket}/scan")
+            ->assertNotFound();
+    }
+
     /** @param array<string, mixed> $attributes */
     private function createTicket(
         string $uuid,