Merge branch 'refactor/integrations' into dev

app/Domains/Integration/Controllers/ClientIntegrationController.php

@@ -4,8 +4,9 @@ namespace App\Domains\Integration\Controllers;
 
 use App\Domains\Client\Models\Client;
 use App\Domains\Integration\Models\Integration;
-use App\Domains\Integration\Requests\StoreClientIntegrationRequest;
+use App\Domains\Integration\Requests\ConfigureIntegrationRequest;
 use App\Domains\Integration\Services\ClientIntegrationService;
+use App\Domains\Integration\Services\IntegrationAssociationService;
 use App\Http\Controllers\Controller;
 use Illuminate\Http\JsonResponse;
 
@@ -35,7 +36,7 @@ class ClientIntegrationController extends Controller
     }
 
     public function store(
-        StoreClientIntegrationRequest $request,
+        ConfigureIntegrationRequest $request,
         Client $client,
         string $integrationCode,
     ): JsonResponse {
@@ -61,4 +62,11 @@ class ClientIntegrationController extends Controller
             ], 400);
         }
     }
+
+    public function destroy(Client $client, string $integrationCode, IntegrationAssociationService $service)
+    {
+        $service->detach($client, $integrationCode);
+
+        return response()->noContent();
+    }
 }

app/Domains/Integration/Controllers/IntegrationController.php

@@ -35,6 +35,7 @@ class IntegrationController extends Controller
 
     public function destroy(Integration $integration)
     {
+        abort_if($integration->instances()->exists(), 409, 'Delete the integration instances first.');
         $integration->delete();
 
         return response()->noContent();

app/Domains/Integration/Controllers/WebsiteTypeIntegrationController.php

@@ -0,0 +1,43 @@
+<?php
+
+namespace App\Domains\Integration\Controllers;
+
+use App\Domains\Integration\Models\Integration;
+use App\Domains\Integration\Requests\ConfigureIntegrationRequest;
+use App\Domains\Integration\Resources\IntegrationAssociationResource;
+use App\Domains\Integration\Services\IntegrationAssociationService;
+use App\Domains\Tenant\Models\WebsiteType;
+use App\Http\Controllers\Controller;
+
+class WebsiteTypeIntegrationController extends Controller
+{
+    public function __construct(private readonly IntegrationAssociationService $service) {}
+
+    public function index(WebsiteType $websiteType)
+    {
+        return IntegrationAssociationResource::collection($websiteType->integrations()->with('integrationInstance')->get());
+    }
+
+    public function show(WebsiteType $websiteType, string $integrationCode)
+    {
+        return new IntegrationAssociationResource($websiteType->integrations()->with('integrationInstance')->where('integration_code', $integrationCode)->firstOrFail());
+    }
+
+    public function store(ConfigureIntegrationRequest $request, WebsiteType $websiteType, string $integrationCode)
+    {
+        $integration = Integration::query()->where('integration_code', $integrationCode)->firstOrFail();
+
+        return new IntegrationAssociationResource($this->service->configure(
+            $websiteType,
+            $integration,
+            $request->validated('integration_data'),
+        ));
+    }
+
+    public function destroy(WebsiteType $websiteType, string $integrationCode)
+    {
+        $this->service->detach($websiteType, $integrationCode);
+
+        return response()->noContent();
+    }
+}

app/Domains/Integration/Models/ClientIntegration.php

@@ -3,22 +3,15 @@
 namespace App\Domains\Integration\Models;
 
 use App\Domains\Client\Models\Client;
-use App\Domains\Integration\Casts\EncryptedIntegrationData;
 use Illuminate\Database\Eloquent\Model;
 use Illuminate\Database\Eloquent\Relations\BelongsTo;
 
 class ClientIntegration extends Model
 {
-    protected $hidden = ['integration_data'];
-
     protected $fillable = [
         'client_id',
         'integration_code',
-        'integration_data',
+        'integration_instance_id',
-    ];
-
-    protected $casts = [
-        'integration_data' => EncryptedIntegrationData::class,
     ];
 
     /** @return BelongsTo<Client, $this> */
@@ -32,4 +25,10 @@ class ClientIntegration extends Model
     {
         return $this->belongsTo(Integration::class, 'integration_code', 'integration_code');
     }
+
+    /** @return BelongsTo<IntegrationInstance, $this> */
+    public function integrationInstance(): BelongsTo
+    {
+        return $this->belongsTo(IntegrationInstance::class);
+    }
 }

app/Domains/Integration/Models/Integration.php

@@ -3,6 +3,7 @@
 namespace App\Domains\Integration\Models;
 
 use Illuminate\Database\Eloquent\Model;
+use Illuminate\Database\Eloquent\Relations\HasMany;
 
 class Integration extends Model
 {
@@ -13,16 +14,29 @@ class Integration extends Model
         'name',
         'url',
         'integration_data_schema',
-        'requires_client_configuration',
+        'requires_configuration',
     ];
 
     protected $casts = [
         'integration_data_schema' => 'array',
-        'requires_client_configuration' => 'boolean',
+        'requires_configuration' => 'boolean',
     ];
 
-    public function clientIntegrations()
+    /** @return HasMany<IntegrationInstance, $this> */
+    public function instances(): HasMany
+    {
+        return $this->hasMany(IntegrationInstance::class, 'integration_code', 'integration_code');
+    }
+
+    /** @return HasMany<ClientIntegration, $this> */
+    public function clientIntegrations(): HasMany
     {
         return $this->hasMany(ClientIntegration::class, 'integration_code', 'integration_code');
     }
+
+    /** @return HasMany<WebsiteTypeIntegration, $this> */
+    public function websiteTypeIntegrations(): HasMany
+    {
+        return $this->hasMany(WebsiteTypeIntegration::class, 'integration_code', 'integration_code');
+    }
 }

app/Domains/Integration/Models/IntegrationInstance.php

@@ -0,0 +1,41 @@
+<?php
+
+namespace App\Domains\Integration\Models;
+
+use App\Domains\Integration\Casts\EncryptedIntegrationData;
+use Illuminate\Database\Eloquent\Model;
+use Illuminate\Database\Eloquent\Relations\BelongsTo;
+use Illuminate\Database\Eloquent\Relations\HasMany;
+
+class IntegrationInstance extends Model
+{
+    // The ciphertext changes whenever credentials are saved, so old tokens cannot be reused.
+    public function tokenCacheKey(): string
+    {
+        return 'integration_token:instance:'.$this->id.':'.hash('sha256', (string) $this->getRawOriginal('integration_data'));
+    }
+
+    protected $fillable = ['integration_code', 'name', 'integration_data'];
+
+    protected $hidden = ['integration_data'];
+
+    protected $casts = ['integration_data' => EncryptedIntegrationData::class];
+
+    /** @return BelongsTo<Integration, $this> */
+    public function integration(): BelongsTo
+    {
+        return $this->belongsTo(Integration::class, 'integration_code', 'integration_code');
+    }
+
+    /** @return HasMany<ClientIntegration, $this> */
+    public function clientIntegrations(): HasMany
+    {
+        return $this->hasMany(ClientIntegration::class);
+    }
+
+    /** @return HasMany<WebsiteTypeIntegration, $this> */
+    public function websiteTypeIntegrations(): HasMany
+    {
+        return $this->hasMany(WebsiteTypeIntegration::class);
+    }
+}

app/Domains/Integration/Models/WebsiteTypeIntegration.php

@@ -0,0 +1,30 @@
+<?php
+
+namespace App\Domains\Integration\Models;
+
+use App\Domains\Tenant\Models\WebsiteType;
+use Illuminate\Database\Eloquent\Model;
+use Illuminate\Database\Eloquent\Relations\BelongsTo;
+
+class WebsiteTypeIntegration extends Model
+{
+    protected $fillable = ['website_type_code', 'integration_code', 'integration_instance_id'];
+
+    /** @return BelongsTo<WebsiteType, $this> */
+    public function websiteType(): BelongsTo
+    {
+        return $this->belongsTo(WebsiteType::class, 'website_type_code', 'codigo');
+    }
+
+    /** @return BelongsTo<Integration, $this> */
+    public function integration(): BelongsTo
+    {
+        return $this->belongsTo(Integration::class, 'integration_code', 'integration_code');
+    }
+
+    /** @return BelongsTo<IntegrationInstance, $this> */
+    public function integrationInstance(): BelongsTo
+    {
+        return $this->belongsTo(IntegrationInstance::class);
+    }
+}

app/Domains/Integration/Policies/IntegrationPolicy.php

@@ -0,0 +1,14 @@
+<?php
+
+namespace App\Domains\Integration\Policies;
+
+use App\Domains\Auth\Models\User;
+use App\Domains\Authorization\Enums\RoleCode;
+
+class IntegrationPolicy
+{
+    public function manage(User $user): bool
+    {
+        return $user->rol_codigo === RoleCode::Admin->value;
+    }
+}

app/Domains/Integration/Requests/ConfigureIntegrationRequest.php

@@ -6,20 +6,19 @@ use App\Domains\Integration\Models\Integration;
 use Illuminate\Foundation\Http\FormRequest;
 use Illuminate\Validation\ValidationException;
 
-class StoreClientIntegrationRequest extends FormRequest
+class ConfigureIntegrationRequest extends FormRequest
 {
     protected ?Integration $integrationModel = null;
 
     public function authorize(): bool
     {
-        return true;
+        return $this->user()?->can('manage', Integration::class) ?? false;
     }
 
     protected function prepareForValidation(): void
     {
-        $integrationCode = $this->route('integration_code');
         $this->integrationModel = Integration::query()
-            ->where('integration_code', $integrationCode)
+            ->where('integration_code', $this->route('integration_code'))
             ->first();
 
         if (! $this->integrationModel) {
@@ -31,7 +30,7 @@ class StoreClientIntegrationRequest extends FormRequest
 
     public function rules(): array
     {
-        $rules = [];
+        $rules = ['integration_data' => ['present', 'array']];
 
         foreach ($this->integrationModel?->integration_data_schema ?? [] as $field => $rule) {
             $rules['integration_data.'.$field] = $rule;

app/Domains/Integration/Requests/StoreIntegrationRequest.php

@@ -18,7 +18,7 @@ class StoreIntegrationRequest extends FormRequest
             'name' => ['required', 'string', 'max:255'],
             'url' => ['nullable', 'url', 'max:255'],
             'integration_data_schema' => ['nullable', 'array'],
-            'requires_client_configuration' => ['sometimes', 'boolean'],
+            'requires_configuration' => ['sometimes', 'boolean'],
         ];
     }
 }

app/Domains/Integration/Requests/UpdateIntegrationRequest.php

@@ -3,6 +3,7 @@
 namespace App\Domains\Integration\Requests;
 
 use Illuminate\Foundation\Http\FormRequest;
+use Illuminate\Validation\Rule;
 
 class UpdateIntegrationRequest extends FormRequest
 {
@@ -19,9 +20,8 @@ class UpdateIntegrationRequest extends FormRequest
             'name' => ['sometimes', 'required', 'string', 'max:255'],
             'url' => ['nullable', 'url', 'max:255'],
             'integration_data_schema' => ['nullable', 'array'],
-            'requires_client_configuration' => ['sometimes', 'boolean'],
+            'requires_configuration' => ['sometimes', 'boolean'],
-            // the code shouldn't ideally be updatable, but if it is:
+            'integration_code' => ['sometimes', 'required', 'string', Rule::in([$integration->integration_code])],
-            'integration_code' => ['sometimes', 'required', 'string', 'unique:integrations,integration_code,'.($integration->id ?? '')],
         ];
     }
 }

app/Domains/Integration/Resources/IntegrationAssociationResource.php

@@ -0,0 +1,21 @@
+<?php
+
+namespace App\Domains\Integration\Resources;
+
+use Illuminate\Http\Request;
+use Illuminate\Http\Resources\Json\JsonResource;
+
+class IntegrationAssociationResource extends JsonResource
+{
+    public function toArray(Request $request): array
+    {
+        return [
+            'id' => $this->id,
+            'client_id' => $this->when(isset($this->client_id), $this->client_id),
+            'website_type_code' => $this->when(isset($this->website_type_code), $this->website_type_code),
+            'integration_code' => $this->integration_code,
+            'integration_instance_id' => $this->integration_instance_id,
+            'integration_instance' => new IntegrationInstanceResource($this->whenLoaded('integrationInstance')),
+        ];
+    }
+}

app/Domains/Integration/Resources/IntegrationInstanceResource.php

@@ -0,0 +1,20 @@
+<?php
+
+namespace App\Domains\Integration\Resources;
+
+use Illuminate\Http\Request;
+use Illuminate\Http\Resources\Json\JsonResource;
+
+class IntegrationInstanceResource extends JsonResource
+{
+    public function toArray(Request $request): array
+    {
+        return [
+            'id' => $this->id,
+            'integration_code' => $this->integration_code,
+            'name' => $this->name,
+            'created_at' => $this->created_at,
+            'updated_at' => $this->updated_at,
+        ];
+    }
+}

app/Domains/Integration/Services/BaseIntegrationService.php

@@ -5,6 +5,8 @@ namespace App\Domains\Integration\Services;
 use App\Domains\Client\Models\Client;
 use App\Domains\Integration\Models\ClientIntegration;
 use App\Domains\Integration\Models\Integration;
+use App\Domains\Integration\Models\IntegrationInstance;
+use App\Domains\Integration\Models\WebsiteTypeIntegration;
 use App\Domains\Tenant\Models\Tenant;
 use Exception;
 use Illuminate\Http\Client\PendingRequest;
@@ -32,9 +34,9 @@ abstract class BaseIntegrationService
     protected ?Integration $integration = null;
 
     /**
-     * The client-owned integration configuration.
+     * The effective integration instance.
      */
-    protected ?ClientIntegration $clientIntegration = null;
+    protected ?IntegrationInstance $integrationInstance = null;
 
     /**
      * Set the integration code.
@@ -85,7 +87,7 @@ abstract class BaseIntegrationService
     }
 
     /**
-     * Load the integration definition and its client-owned configuration.
+     * Load the integration definition and its effective instance configuration.
      *
      * @throws Exception
      */
@@ -95,6 +97,7 @@ abstract class BaseIntegrationService
             throw new Exception('Integration code is not set.');
         }
 
+        $this->integrationInstance = null;
         $this->integration = Integration::where('integration_code', $this->integrationCode)->first();
         if (! $this->integration) {
             throw new Exception("Integration with code '{$this->integrationCode}' not found.");
@@ -104,11 +107,18 @@ abstract class BaseIntegrationService
             throw new Exception('Client context is not set.');
         }
 
-        $this->clientIntegration = ClientIntegration::where('client_id', $this->clientContext->id)
+        $this->integrationInstance = ClientIntegration::with('integrationInstance')->where('client_id', $this->clientContext->id)
             ->where('integration_code', $this->integrationCode)
-            ->first();
+            ->first()?->integrationInstance;
 
-        if (! $this->clientIntegration && $this->integration->requires_client_configuration) {
+        if (! $this->integrationInstance && $this->tenant?->website_type_code) {
+            $this->integrationInstance = WebsiteTypeIntegration::with('integrationInstance')
+                ->where('website_type_code', $this->tenant->website_type_code)
+                ->where('integration_code', $this->integrationCode)
+                ->first()?->integrationInstance;
+        }
+
+        if (! $this->integrationInstance && $this->integration->requires_configuration) {
             throw new Exception("Client '{$this->clientContext->code}' does not have integration '{$this->integrationCode}' configured.");
         }
     }
@@ -131,15 +141,15 @@ abstract class BaseIntegrationService
     }
 
     /**
-     * Get an integration setting from the client-owned configuration.
+     * Get an integration setting from the effective instance configuration.
      */
     protected function getIntegrationSetting(string $key, mixed $default = null): mixed
     {
-        if (! $this->clientIntegration || ! $this->clientIntegration->integration_data) {
+        if (! $this->integrationInstance || ! $this->integrationInstance->integration_data) {
             return $default;
         }
 
-        return $this->clientIntegration->integration_data[$key] ?? $default;
+        return $this->integrationInstance->integration_data[$key] ?? $default;
     }
 
     /**

app/Domains/Integration/Services/ClientIntegrationService.php

@@ -13,6 +13,7 @@ class ClientIntegrationService
     public function getClientIntegration(Client $client, string $integrationCode): ?ClientIntegration
     {
         return $client->integrations()
+            ->with(['integration', 'integrationInstance'])
             ->where('integration_code', $integrationCode)
             ->first();
     }
@@ -20,7 +21,7 @@ class ClientIntegrationService
     /** @return Collection<int, ClientIntegration> */
     public function getAllForClient(Client $client): Collection
     {
-        return $client->integrations()->with('integration')->get();
+        return $client->integrations()->with(['integration', 'integrationInstance'])->get();
     }
 
     public function updateOrCreateIntegration(
@@ -29,13 +30,7 @@ class ClientIntegrationService
         array $data,
     ): ClientIntegration {
         return DB::transaction(function () use ($client, $integration, $data): ClientIntegration {
-            $clientIntegration = ClientIntegration::query()->updateOrCreate(
+            $clientIntegration = app(IntegrationAssociationService::class)->configure($client, $integration, $data);
-                [
-                    'client_id' => $client->id,
-                    'integration_code' => $integration->integration_code,
-                ],
-                ['integration_data' => $data],
-            );
 
             $service = $this->resolveService($integration->integration_code);
             $service?->forClient($client)->onSetup();

app/Domains/Integration/Services/IntegrationAssociationService.php

@@ -0,0 +1,98 @@
+<?php
+
+namespace App\Domains\Integration\Services;
+
+use App\Domains\Client\Models\Client;
+use App\Domains\Integration\Models\ClientIntegration;
+use App\Domains\Integration\Models\Integration;
+use App\Domains\Integration\Models\IntegrationInstance;
+use App\Domains\Integration\Models\WebsiteTypeIntegration;
+use App\Domains\Tenant\Models\WebsiteType;
+use Illuminate\Support\Facades\DB;
+
+class IntegrationAssociationService
+{
+    public function configure(Client|WebsiteType $owner, Integration $integration, array $integrationData): ClientIntegration|WebsiteTypeIntegration
+    {
+        return DB::transaction(function () use ($owner, $integration, $integrationData): ClientIntegration|WebsiteTypeIntegration {
+            $instance = IntegrationInstance::create([
+                'integration_code' => $integration->integration_code,
+                'name' => $integration->name.' / '.$this->ownerName($owner),
+                'integration_data' => $integrationData,
+            ]);
+
+            return $this->associate($owner, $integration->integration_code, $instance);
+        });
+    }
+
+    public function associate(Client|WebsiteType $owner, string $code, IntegrationInstance $instance): ClientIntegration|WebsiteTypeIntegration
+    {
+        return DB::transaction(function () use ($owner, $code, $instance): ClientIntegration|WebsiteTypeIntegration {
+            $association = $owner->integrations()
+                ->where('integration_code', $code)
+                ->lockForUpdate()
+                ->first();
+            $previousInstanceId = $association?->integration_instance_id;
+
+            $instanceIds = array_values(array_unique(array_filter([
+                $previousInstanceId,
+                $instance->id,
+            ])));
+            sort($instanceIds);
+
+            $instances = IntegrationInstance::query()
+                ->whereKey($instanceIds)
+                ->orderBy('id')
+                ->lockForUpdate()
+                ->get()
+                ->keyBy('id');
+            $instance = $instances->get($instance->id) ?? IntegrationInstance::query()->findOrFail($instance->id);
+            abort_unless($instance->integration_code === $code, 422, 'The instance belongs to another integration.');
+
+            $association = $owner->integrations()->updateOrCreate(
+                ['integration_code' => $code],
+                ['integration_instance_id' => $instance->id],
+            );
+
+            if ($previousInstanceId && $previousInstanceId !== $instance->id) {
+                $this->deleteIfUnused($previousInstanceId);
+            }
+
+            return $association->load('integrationInstance');
+        });
+    }
+
+    public function detach(Client|WebsiteType $owner, string $code): void
+    {
+        DB::transaction(function () use ($owner, $code): void {
+            $association = $owner->integrations()
+                ->where('integration_code', $code)
+                ->lockForUpdate()
+                ->first();
+
+            if (! $association) {
+                return;
+            }
+
+            $instanceId = $association->integration_instance_id;
+            $association->delete();
+            $this->deleteIfUnused($instanceId);
+        });
+    }
+
+    private function deleteIfUnused(int $instanceId): void
+    {
+        $instance = IntegrationInstance::query()->lockForUpdate()->find($instanceId);
+
+        if ($instance
+            && ! $instance->clientIntegrations()->exists()
+            && ! $instance->websiteTypeIntegrations()->exists()) {
+            $instance->delete();
+        }
+    }
+
+    private function ownerName(Client|WebsiteType $owner): string
+    {
+        return $owner instanceof Client ? $owner->name : $owner->nombre;
+    }
+}

app/Domains/Integration/Services/IntegrationInstanceService.php

@@ -0,0 +1,40 @@
+<?php
+
+namespace App\Domains\Integration\Services;
+
+use App\Domains\Integration\Models\IntegrationInstance;
+use Illuminate\Support\Facades\Cache;
+use Illuminate\Support\Facades\DB;
+
+class IntegrationInstanceService
+{
+    public function create(array $data): IntegrationInstance
+    {
+        return IntegrationInstance::create($data);
+    }
+
+    public function update(IntegrationInstance $instance, array $data): IntegrationInstance
+    {
+        return DB::transaction(function () use ($instance, $data): IntegrationInstance {
+            $instance = IntegrationInstance::query()->lockForUpdate()->findOrFail($instance->id);
+            $cacheKey = $instance->tokenCacheKey();
+            $instance->update($data);
+            if (array_key_exists('integration_data', $data)) {
+                DB::afterCommit(fn () => Cache::forget($cacheKey));
+            }
+
+            return $instance;
+        });
+    }
+
+    public function delete(IntegrationInstance $instance): void
+    {
+        DB::transaction(function () use ($instance): void {
+            $instance = IntegrationInstance::query()->lockForUpdate()->findOrFail($instance->id);
+            abort_if($instance->clientIntegrations()->exists() || $instance->websiteTypeIntegrations()->exists(), 409, 'Unlink the instance before deleting it.');
+            $cacheKey = $instance->tokenCacheKey();
+            $instance->delete();
+            DB::afterCommit(fn () => Cache::forget($cacheKey));
+        });
+    }
+}

app/Domains/Integration/Services/MailService.php

@@ -29,7 +29,7 @@ class MailService extends BaseIntegrationService
 
     private ?Mailer $mailer = null;
 
-    private bool $usesClientMailer = false;
+    private bool $usesInstanceMailer = false;
 
     public function __construct(?MailFactory $mailFactory = null)
     {
@@ -40,12 +40,12 @@ class MailService extends BaseIntegrationService
     {
         parent::forTenant($tenantCode);
 
-        if ($this->clientIntegration) {
+        if ($this->integrationInstance) {
             $this->mailer = $this->resolveMailer();
-            $this->usesClientMailer = true;
+            $this->usesInstanceMailer = true;
         } else {
             $this->mailer = $this->mailFactory->mailer();
-            $this->usesClientMailer = false;
+            $this->usesInstanceMailer = false;
         }
 
         return $this;
@@ -56,12 +56,12 @@ class MailService extends BaseIntegrationService
         parent::forClient($client);
         $this->tenant = $this->clientContext?->tenants()->first();
 
-        if ($this->clientIntegration) {
+        if ($this->integrationInstance) {
             $this->mailer = $this->resolveMailer();
-            $this->usesClientMailer = true;
+            $this->usesInstanceMailer = true;
         } else {
             $this->mailer = $this->mailFactory->mailer();
-            $this->usesClientMailer = false;
+            $this->usesInstanceMailer = false;
         }
 
         return $this;
@@ -122,8 +122,8 @@ class MailService extends BaseIntegrationService
 
     public function mailerName(): string
     {
-        return $this->usesClientMailer
+        return $this->usesInstanceMailer
-            ? 'client-smtp'
+            ? 'integration-smtp'
             : (string) config('mail.default');
     }
 
@@ -187,7 +187,7 @@ class MailService extends BaseIntegrationService
 
     private function resolveMailer(): Mailer
     {
-        $data = $this->clientIntegration?->integration_data;
+        $data = $this->integrationInstance?->integration_data;
 
         if (! is_array($data)) {
             throw new InvalidArgumentException('La configuración SMTP del cliente no es válida.');
@@ -205,7 +205,7 @@ class MailService extends BaseIntegrationService
         }
 
         $mailer = $this->mailFactory->build([
-            'name' => 'client-smtp-'.$this->clientContext?->id,
+            'name' => 'integration-smtp-'.$this->integrationInstance?->id,
             'transport' => 'smtp',
             'scheme' => $data['MAIL_SCHEME'] ?? null,
             'host' => $data['MAIL_HOST'],

app/Domains/Integration/Services/TelepagosIntegrationService.php

@@ -45,11 +45,11 @@ class TelepagosIntegrationService extends BaseIntegrationService
      */
     public function getToken(): string
     {
-        if (! $this->clientIntegration || ! $this->clientContext) {
+        if (! $this->integrationInstance) {
             throw new Exception('Client integration is not loaded. Call forTenant() or forClient() first.');
         }
 
-        $cacheKey = "integration_token:{$this->clientContext->id}:{$this->integrationCode}";
+        $cacheKey = $this->integrationInstance->tokenCacheKey();
 
         $token = Cache::get($cacheKey);
 
@@ -94,7 +94,7 @@ class TelepagosIntegrationService extends BaseIntegrationService
         // Calculate TTL and subtract a buffer of 60 seconds
         $ttlSeconds = max(1, $expiresAt->diffInSeconds(now()) - 60);
 
-        $cacheKey = "integration_token:{$this->clientContext->id}:{$this->integrationCode}";
+        $cacheKey = $this->integrationInstance->tokenCacheKey();
         Cache::put($cacheKey, $token, $ttlSeconds);
 
         return $token;
@@ -220,11 +220,11 @@ class TelepagosIntegrationService extends BaseIntegrationService
      */
     public function clearToken(): void
     {
-        if (! $this->clientContext) {
+        if (! $this->integrationInstance) {
             return;
         }
 
-        $cacheKey = "integration_token:{$this->clientContext->id}:{$this->integrationCode}";
+        $cacheKey = $this->integrationInstance->tokenCacheKey();
         Cache::forget($cacheKey);
     }
 

app/Domains/Integration/documentacion/README.md

@@ -1,33 +1,48 @@
 # Dominio Integration
 
-## Propósito
+## Modelo
 
-Gestiona integraciones externas disponibles y su configuración por cliente. Un cliente puede agrupar múltiples tenants que comparten las mismas credenciales. Incluye correo y pagos mediante Telepagos.
+- `Integration`: catálogo, URL base, `integration_data_schema` y `requires_configuration`.
+- `IntegrationInstance`: configuración interna concreta con nombre. `integration_data` se cifra con `EncryptedIntegrationData`, se almacena en `longText` y nunca se devuelve en la API.
+- `ClientIntegration` y `WebsiteTypeIntegration`: asociaciones a instancias. La clave compuesta verifica el código de la instancia y la unicidad permite una instancia por integración y propietario.
 
-## Modelo y seguridad
+Las instancias no se administran directamente por HTTP. Cada configuración enviada desde un cliente o tipo de sitio crea una instancia interna nueva y reemplaza únicamente la asociación de ese propietario. Al reemplazar o desvincular una instancia, esta se elimina si ya no tiene asociaciones con ningún cliente ni tipo de sitio; las instancias compartidas se conservan mientras tengan al menos una asociación.
 
-- `Integration`: definición global de una integración.
+## Resolución
-- `ClientIntegration`: configuración y credenciales de una integración para un cliente.
-- `EncryptedIntegrationData`: cast que protege los datos sensibles persistidos.
-- `ClientIntegrationService`: consulta y configura integraciones del cliente.
 
-## Servicios externos
+`BaseIntegrationService::forTenant()` busca primero la asociación del cliente y después la del tipo de sitio del tenant. Selecciona una configuración completa, sin mezclar credenciales entre niveles. Si una configuración está presente pero es inválida, produce un error en vez de recurrir a otra instancia.
 
-- `BaseIntegrationService`: resuelve el cliente desde el tenant operativo y carga exclusivamente la configuración del cliente.
+`forClient()` usa únicamente la asociación del cliente: sin un tenant concreto no se elige un tipo de sitio. Si no existe una instancia y `requires_configuration` es verdadero, se genera un error. Para correo opcional, `MailService` usa el mailer global si no encuentra una instancia; cuando la encuentra, construye un transporte SMTP aislado identificado como `integration-smtp`.
-- `MailService`: envío de correo usando la integración configurada.
-- `TelepagosIntegrationService`: autenticación, caché de token, generación de QR y consulta de cobros.
-- `TelepagosWebhookService`: procesa notificaciones recibidas desde Telepagos.
 
-## Endpoints
+Telepagos utiliza una clave de caché basada en el ID de instancia y una huella del texto cifrado. Volver a configurar el servicio con `forClient()` o `forTenant()` carga la configuración actual.
 
-- CRUD global bajo `/integrations`.
+## Administración
-- Consulta y configuración por cliente bajo `/clients/{client}/integrations`.
-- `POST /webhooks/telepagos/{client}` para notificaciones del proveedor.
 
-## Logging de Telepagos
+Todas estas rutas llevan el prefijo `/api`, requieren `auth:sanctum` y el rol global `admin` mediante `IntegrationPolicy`. Los roles `adminapp`, `scanner` y `user` no administran configuraciones.
 
-Los eventos de autenticación, QR, consultas de cuenta y procesamiento de webhooks se escriben en el canal diario `telepagos`, separado del log general. Los archivos se generan en `storage/logs/telepagos/telepagos-YYYY-MM-DD.log`; el nivel y la retención se configuran con `TELEPAGOS_LOG_LEVEL` y `TELEPAGOS_LOG_DAYS`. Tokens y credenciales se eliminan del contexto antes de registrar respuestas del proveedor.
+| Método | Ruta | Operación |
+| --- | --- | --- |
+| GET | `/clients/{client}/integrations[/{integration_code}]` | Consultar asociaciones directas. |
+| PUT | `/clients/{client}/integrations/{integration_code}` | Configurar: crea una instancia interna nueva y reemplaza solo la asociación del cliente. Ejecuta el hook de configuración existente. |
+| DELETE | `/clients/{client}/integrations/{integration_code}` | Desvincular. |
+| GET | `/website-types/{codigo}/integrations[/{integration_code}]` | Consultar asociaciones del tipo de sitio. |
+| PUT | `/website-types/{codigo}/integrations/{integration_code}` | Configurar: crea una instancia interna nueva y reemplaza solo la asociación del tipo de sitio. |
+| DELETE | `/website-types/{codigo}/integrations/{integration_code}` | Desvincular. |
 
-## Dependencias y reglas
+Los dos `PUT` reciben `integration_data`, un objeto completo validado según el esquema de la integración. La integración debe existir previamente en el catálogo interno. No hay endpoints públicos para administrar el catálogo ni las instancias directamente.
 
-Se integra con `Client`, `Tenant` y con el checkout de `Purchase`. `Notification` utiliza `MailService`. El tenant conserva el contexto operativo y de branding, pero nunca es dueño de credenciales. Las credenciales no se exponen en respuestas ni logs; los webhooks deben validar su contrato antes de alterar una compra.
+Las respuestas y consultas incluyen metadatos de `integration_instance`, pero nunca sus credenciales. La configuración del cliente conserva su mensaje de respuesta histórico; la del tipo de sitio usa un resource con envoltorio `data`.
+
+## Webhooks y contexto operativo
+
+`POST /webhooks/telepagos/{client}` conserva su contrato público con el proveedor y la validación de pertenencia de las compras al cliente. Como no recibe un tenant, requiere una asociación directa al cliente. Para usar una instancia compartida en ese flujo, asociarla también al cliente; la herencia por tipo de sitio no se aplica a esa URL.
+
+`Notification` consume `MailService`; `Purchase` consume Telepagos. Los tenants mantienen el contexto operativo y el branding.
+
+## Despliegue
+
+Ejecutar `php artisan migrate` junto con este código. La migración `2026_09_04_000003` renombra `requires_client_configuration` a `requires_configuration` conservando sus valores. Los payloads del catálogo deben usar el nuevo nombre. Las migraciones previas trasladan el texto cifrado sin descifrarlo y no comparten instancias automáticamente.
+
+## Logging
+
+Telepagos registra eventos en el canal diario `telepagos`. El nivel y la retención se configuran con `TELEPAGOS_LOG_LEVEL` y `TELEPAGOS_LOG_DAYS`. Se eliminan tokens y credenciales de las estructuras registradas.

app/Domains/Integration/routes/api.php

@@ -1,22 +1,25 @@
 <?php
 
 use App\Domains\Integration\Controllers\ClientIntegrationController;
-use App\Domains\Integration\Controllers\IntegrationController;
 use App\Domains\Integration\Controllers\TelepagosWebhookController;
+use App\Domains\Integration\Controllers\WebsiteTypeIntegrationController;
+use App\Domains\Integration\Models\Integration;
 use Illuminate\Support\Facades\Route;
 
-Route::group(['prefix' => 'integrations'], function () {
+Route::middleware(['auth:sanctum', 'can:manage,'.Integration::class])->group(function (): void {
-    Route::get('/', [IntegrationController::class, 'index']);
+    Route::prefix('website-types/{websiteType:codigo}/integrations')->group(function (): void {
-    Route::post('/', [IntegrationController::class, 'store']);
+        Route::get('/', [WebsiteTypeIntegrationController::class, 'index']);
-    Route::get('/{integration}', [IntegrationController::class, 'show']);
+        Route::get('/{integration_code}', [WebsiteTypeIntegrationController::class, 'show']);
-    Route::put('/{integration}', [IntegrationController::class, 'update']);
+        Route::put('/{integration_code}', [WebsiteTypeIntegrationController::class, 'store']);
-    Route::delete('/{integration}', [IntegrationController::class, 'destroy']);
+        Route::delete('/{integration_code}', [WebsiteTypeIntegrationController::class, 'destroy']);
-});
+    });
 
-Route::group(['prefix' => 'clients/{client}/integrations'], function () {
+    Route::group(['prefix' => 'clients/{client}/integrations'], function () {
-    Route::get('/', [ClientIntegrationController::class, 'index']);
+        Route::get('/', [ClientIntegrationController::class, 'index']);
-    Route::get('/{integration_code}', [ClientIntegrationController::class, 'show']);
+        Route::get('/{integration_code}', [ClientIntegrationController::class, 'show']);
-    Route::put('/{integration_code}', [ClientIntegrationController::class, 'store']);
+        Route::put('/{integration_code}', [ClientIntegrationController::class, 'store']);
+        Route::delete('/{integration_code}', [ClientIntegrationController::class, 'destroy']);
+    });
 });
 
 Route::post('webhooks/telepagos/{client}', [TelepagosWebhookController::class, 'handle']);

app/Domains/Tenant/Models/WebsiteType.php

@@ -3,6 +3,7 @@
 namespace App\Domains\Tenant\Models;
 
 use App\Domains\Attachable\Models\Attachment;
+use App\Domains\Integration\Models\WebsiteTypeIntegration;
 use Illuminate\Database\Eloquent\Attributes\Fillable;
 use Illuminate\Database\Eloquent\Factories\HasFactory;
 use Illuminate\Database\Eloquent\Model;
@@ -36,6 +37,12 @@ class WebsiteType extends Model
 
     protected $table = 'website_type';
 
+    /** @return HasMany<WebsiteTypeIntegration, $this> */
+    public function integrations(): HasMany
+    {
+        return $this->hasMany(WebsiteTypeIntegration::class, 'website_type_code', 'codigo');
+    }
+
     /**
      * @return BelongsTo<Attachment, $this>
      */

app/Providers/AppServiceProvider.php

@@ -2,6 +2,8 @@
 
 namespace App\Providers;
 
+use App\Domains\Integration\Models\Integration;
+use App\Domains\Integration\Policies\IntegrationPolicy;
 use App\Domains\Notification\Events\PasswordResetRequested;
 use App\Domains\Notification\Events\UserRegistered;
 use App\Domains\Notification\Listeners\SendPasswordResetEmail;
@@ -13,6 +15,7 @@ use Illuminate\Cache\RateLimiting\Limit;
 use Illuminate\Database\Eloquent\Builder;
 use Illuminate\Http\Request;
 use Illuminate\Support\Facades\Event;
+use Illuminate\Support\Facades\Gate;
 use Illuminate\Support\Facades\RateLimiter;
 use Illuminate\Support\ServiceProvider;
 
@@ -31,6 +34,10 @@ class AppServiceProvider extends ServiceProvider
      */
     public function boot(): void
     {
+        Gate::policy(
+            Integration::class,
+            IntegrationPolicy::class,
+        );
         Event::listen(PurchasePaid::class, GenerateTicketsForPaidPurchase::class);
         Event::listen(PurchasePaid::class, SendPurchaseConfirmedEmail::class);
         Event::listen(UserRegistered::class, SendWelcomeEmail::class);

database/migrations/2026_09_04_000000_create_integration_instances_table.php

@@ -0,0 +1,28 @@
+<?php
+
+use Illuminate\Database\Migrations\Migration;
+use Illuminate\Database\Schema\Blueprint;
+use Illuminate\Support\Facades\Schema;
+
+return new class extends Migration
+{
+    public function up(): void
+    {
+        Schema::create('integration_instances', function (Blueprint $table): void {
+            $table->id();
+            $table->string('integration_code');
+            $table->string('name');
+            $table->longText('integration_data')->nullable(); // Encrypted JSON.
+            $table->timestamps();
+
+            $table->foreign('integration_code')->references('integration_code')->on('integrations')->restrictOnDelete();
+            // Allows associations to enforce one instance per integration and owner.
+            $table->unique(['id', 'integration_code'], 'integration_instances_id_code_unique');
+        });
+    }
+
+    public function down(): void
+    {
+        Schema::dropIfExists('integration_instances');
+    }
+};

database/migrations/2026_09_04_000001_move_client_configuration_to_integration_instances.php

@@ -0,0 +1,81 @@
+<?php
+
+use Illuminate\Database\Migrations\Migration;
+use Illuminate\Database\Schema\Blueprint;
+use Illuminate\Support\Facades\DB;
+use Illuminate\Support\Facades\Schema;
+
+return new class extends Migration
+{
+    public function up(): void
+    {
+        // MySQL commits DDL separately; allow retrying after a partially applied migration.
+        if (! Schema::hasColumn('client_integrations', 'integration_instance_id')) {
+            Schema::table('client_integrations', function (Blueprint $table): void {
+                $table->unsignedBigInteger('integration_instance_id')->nullable();
+            });
+        }
+
+        DB::table('client_integrations')->whereNull('integration_instance_id')->orderBy('id')->chunkById(100, function ($associations): void {
+            foreach ($associations as $association) {
+                DB::transaction(function () use ($association): void {
+                    $instanceId = DB::table('integration_instances')->insertGetId([
+                        'integration_code' => $association->integration_code,
+                        'name' => $association->integration_code.' / client '.$association->client_id,
+                        // Copy ciphertext verbatim: no decryption or re-encryption during migration.
+                        'integration_data' => $association->integration_data,
+                        'created_at' => $association->created_at,
+                        'updated_at' => $association->updated_at,
+                    ]);
+
+                    DB::table('client_integrations')->where('id', $association->id)->update([
+                        'integration_instance_id' => $instanceId,
+                    ]);
+                });
+            }
+        });
+
+        Schema::table('client_integrations', function (Blueprint $table): void {
+            $table->unsignedBigInteger('integration_instance_id')->nullable(false)->change();
+        });
+
+        $hasInstanceForeignKey = collect(Schema::getForeignKeys('client_integrations'))
+            ->contains(fn (array $key): bool => $key['columns'] === ['integration_instance_id', 'integration_code']);
+
+        if (! $hasInstanceForeignKey) {
+            Schema::table('client_integrations', function (Blueprint $table): void {
+                $table->foreign(['integration_instance_id', 'integration_code'], 'client_integrations_instance_code_fk')
+                    ->references(['id', 'integration_code'])->on('integration_instances')->restrictOnDelete();
+            });
+        }
+
+        if (Schema::hasColumn('client_integrations', 'integration_data')) {
+            Schema::table('client_integrations', function (Blueprint $table): void {
+                $table->dropColumn('integration_data');
+            });
+        }
+    }
+
+    public function down(): void
+    {
+        Schema::table('client_integrations', function (Blueprint $table): void {
+            $table->longText('integration_data')->nullable();
+        });
+
+        DB::table('client_integrations')->orderBy('id')->chunkById(100, function ($associations): void {
+            foreach ($associations as $association) {
+                DB::table('client_integrations')->where('id', $association->id)->update([
+                    'integration_data' => DB::table('integration_instances')
+                        ->where('id', $association->integration_instance_id)->value('integration_data'),
+                ]);
+            }
+        });
+
+        Schema::table('client_integrations', function (Blueprint $table): void {
+            // MySQL uses the short name; SQLite needs the columns to rebuild the table.
+            $table->dropForeign('client_integrations_instance_code_fk')
+                ->columns(['integration_instance_id', 'integration_code']);
+            $table->dropColumn('integration_instance_id');
+        });
+    }
+};

database/migrations/2026_09_04_000002_create_website_type_integrations_table.php

@@ -0,0 +1,29 @@
+<?php
+
+use Illuminate\Database\Migrations\Migration;
+use Illuminate\Database\Schema\Blueprint;
+use Illuminate\Support\Facades\Schema;
+
+return new class extends Migration
+{
+    public function up(): void
+    {
+        Schema::create('website_type_integrations', function (Blueprint $table): void {
+            $table->id();
+            $table->string('website_type_code');
+            $table->string('integration_code');
+            $table->unsignedBigInteger('integration_instance_id');
+            $table->timestamps();
+
+            $table->foreign('website_type_code')->references('codigo')->on('website_type')->cascadeOnDelete();
+            $table->foreign(['integration_instance_id', 'integration_code'], 'website_type_integrations_instance_code_fk')
+                ->references(['id', 'integration_code'])->on('integration_instances')->restrictOnDelete();
+            $table->unique(['website_type_code', 'integration_code'], 'website_type_integrations_owner_code_unique');
+        });
+    }
+
+    public function down(): void
+    {
+        Schema::dropIfExists('website_type_integrations');
+    }
+};

database/migrations/2026_09_04_000003_rename_integration_configuration_requirement.php

@@ -0,0 +1,22 @@
+<?php
+
+use Illuminate\Database\Migrations\Migration;
+use Illuminate\Database\Schema\Blueprint;
+use Illuminate\Support\Facades\Schema;
+
+return new class extends Migration
+{
+    public function up(): void
+    {
+        Schema::table('integrations', function (Blueprint $table): void {
+            $table->renameColumn('requires_client_configuration', 'requires_configuration');
+        });
+    }
+
+    public function down(): void
+    {
+        Schema::table('integrations', function (Blueprint $table): void {
+            $table->renameColumn('requires_configuration', 'requires_client_configuration');
+        });
+    }
+};

database/seeders/EmailIntegrationSeeder.php

@@ -17,7 +17,7 @@ class EmailIntegrationSeeder extends Seeder
             [
                 'name' => 'Email',
                 'url' => null,
-                'requires_client_configuration' => false,
+                'requires_configuration' => false,
                 'integration_data_schema' => [
                     'MAIL_MAILER' => 'required|string|in:smtp',
                     'MAIL_SCHEME' => 'required|string|in:smtp',

database/seeders/TelepagosIntegrationSeeder.php

@@ -17,7 +17,7 @@ class TelepagosIntegrationSeeder extends Seeder
             [
                 'name' => 'Telepagos',
                 'url' => 'https://api.telepagos.com.ar',
-                'requires_client_configuration' => true,
+                'requires_configuration' => true,
                 'integration_data_schema' => [
                     'username' => 'required|string',
                     'password' => 'required|string',
@@ -30,7 +30,7 @@ class TelepagosIntegrationSeeder extends Seeder
             [
                 'name' => 'Telepagos Homologación',
                 'url' => 'https://api.homo.telepagos.com.ar',
-                'requires_client_configuration' => true,
+                'requires_configuration' => true,
                 'integration_data_schema' => [
                     'username' => 'required|string',
                     'password' => 'required|string',

postman/generate-shopit-collection.php

@@ -75,9 +75,8 @@ function bodyFor(string $method, string $uri): ?array
         'POST api/clients' => ['code' => 'cliente-demo', 'name' => 'Cliente Demo'],
         'PUT api/clients/{client}' => ['code' => 'cliente-demo', 'name' => 'Cliente Demo Actualizado'],
         'PATCH api/clients/{client}' => ['name' => 'Cliente Demo Actualizado'],
-        'POST api/integrations' => ['integration_code' => 'telepagos', 'name' => 'Telepagos', 'url' => 'https://api.example.com', 'integration_data_schema' => ['api_key' => ['required', 'string']], 'requires_client_configuration' => true],
-        'PUT api/integrations/{integration}' => ['name' => 'Telepagos', 'url' => 'https://api.example.com', 'requires_client_configuration' => true],
         'PUT api/clients/{client}/integrations/{integration_code}' => ['integration_data' => ['api_key' => 'replace-me']],
+        'PUT api/website-types/{websiteType:codigo}/integrations/{integration_code}' => ['integration_data' => ['api_key' => 'replace-me']],
         'POST api/menues' => ['code' => 'demo', 'label' => 'Demo', 'parent_menu_code' => null, 'content_type' => 'static', 'static_content_schema' => ['title' => ['required', 'string']], 'route' => '/demo'],
         'PUT api/menues/{menue}' => ['label' => 'Demo actualizado', 'route' => '/demo'],
         'PATCH api/menues/{menue}' => ['label' => 'Demo actualizado'],
@@ -276,7 +275,8 @@ function requestName(string $method, string $action, bool $multiMethod): string
 function pathFor(string $uri): string
 {
     $variables = [
-        'tenant:codigo' => 'tenant_code', 'tenant' => 'tenant_id', 'client' => 'client_id',
+        'tenant:codigo' => 'tenant_code', 'tenant' => 'tenant_id', 'client' => 'client_code',
+        'websiteType:codigo' => 'website_type_code',
         'integration_code' => 'integration_code', 'integration' => 'integration_id', 'menue' => 'menu_id',
         'menu_code' => 'menu_code', 'tenant_code' => 'tenant_code', 'catalogItem' => 'catalog_item_id',
         'featuredGroup' => 'featured_group_id', 'category' => 'category_id', 'cartItem' => 'cart_item_id',
@@ -331,6 +331,111 @@ function tokenCaptureEvent(string $uri): array
     ];
 }
 
+/** @return array<string, array{name: string, description: string, integration_data: array<string, mixed>}> */
+function integrationConfigurationPresets(): array
+{
+    return [
+        'email' => [
+            'name' => 'Email (SMTP)',
+            'description' => 'Configura el transporte SMTP usado para el envío de correos.',
+            'integration_data' => [
+                'MAIL_MAILER' => 'smtp',
+                'MAIL_SCHEME' => 'smtp',
+                'MAIL_HOST' => 'smtp.example.com',
+                'MAIL_PORT' => 587,
+                'MAIL_USERNAME' => 'usuario@example.com',
+                'MAIL_PASSWORD' => 'replace-me',
+                'MAIL_FROM_ADDRESS' => 'no-reply@example.com',
+                'MAIL_FROM_NAME' => 'ShopIt',
+            ],
+        ],
+        'telepagos' => [
+            'name' => 'Telepagos Producción',
+            'description' => 'Configura las credenciales productivas de Telepagos.',
+            'integration_data' => [
+                'username' => 'replace-me',
+                'password' => 'replace-me',
+            ],
+        ],
+        'telepagos_homo' => [
+            'name' => 'Telepagos Homologación',
+            'description' => 'Configura las credenciales del entorno de homologación de Telepagos.',
+            'integration_data' => [
+                'username' => 'replace-me',
+                'password' => 'replace-me',
+            ],
+        ],
+    ];
+}
+
+/** @param array<int, array<string, mixed>> $requests
+ * @return array<int, array<string, mixed>>
+ */
+function integrationOwnerFolders(array $requests): array
+{
+    $owners = [
+        'Client' => '/api/clients/',
+        'Website Type' => '/api/website-types/',
+    ];
+    $folders = [];
+
+    foreach ($owners as $ownerName => $pathFragment) {
+        $ownerRequests = array_values(array_filter(
+            $requests,
+            fn (array $item): bool => str_contains($item['request']['url']['raw'], $pathFragment),
+        ));
+        $putTemplate = null;
+        foreach ($ownerRequests as $ownerRequest) {
+            if ($ownerRequest['request']['method'] === 'PUT') {
+                $putTemplate = $ownerRequest;
+                break;
+            }
+        }
+
+        if ($putTemplate === null) {
+            continue;
+        }
+
+        foreach ($ownerRequests as &$request) {
+            if ($request['request']['method'] === 'PUT') {
+                $request['name'] = 'Configure Integration (generic)';
+            }
+        }
+        unset($request);
+
+        $ownerItems = [[
+            'name' => 'Management',
+            'description' => 'Consulta, configura o desvincula cualquier integración usando `{{integration_code}}`.',
+            'item' => $ownerRequests,
+        ]];
+
+        foreach (integrationConfigurationPresets() as $integrationCode => $preset) {
+            $request = $putTemplate;
+            $request['name'] = 'Configure '.$preset['name'];
+            $request['request']['description'] .= "\n\nPreset: `{$integrationCode}`. {$preset['description']}";
+            $request['request']['url']['raw'] = str_replace('{{integration_code}}', $integrationCode, $request['request']['url']['raw']);
+            $request['request']['url']['path'] = array_map(
+                fn (string $segment): string => $segment === '{{integration_code}}' ? $integrationCode : $segment,
+                $request['request']['url']['path'],
+            );
+            $request['request']['body'] = jsonBody(['integration_data' => $preset['integration_data']]);
+
+            $ownerItems[] = [
+                'name' => $preset['name'],
+                'description' => $preset['description'],
+                'item' => [$request],
+            ];
+        }
+
+        $folders[] = [
+            'name' => $ownerName,
+            'item' => $ownerItems,
+        ];
+    }
+
+    return $folders;
+}
+
 $tree = [];
 $registeredOperations = 0;
 
@@ -412,7 +517,9 @@ $items = [];
 foreach ($tree as $section => $folders) {
     $children = [];
     foreach ($folders as $folder => $requests) {
-        $children[] = ['name' => humanize($folder), 'item' => $requests];
+        $children[] = $section === 'Platform Management' && $folder === 'Integration'
+            ? ['name' => 'Integration', 'item' => integrationOwnerFolders($requests)]
+            : ['name' => humanize($folder), 'item' => $requests];
     }
 
     $items[] = [
@@ -430,7 +537,8 @@ $variables = [
     'admin_email' => 'admin@example.com', 'admin_password' => 'Password!123',
     'scanner_email' => 'scanner@example.com', 'scanner_password' => 'Password!123',
     'tenant_code' => 'demo', 'tenant_id' => '1', 'tenant_domain' => 'demo.test',
-    'client_id' => '1', 'integration_id' => '1', 'integration_code' => 'telepagos',
+    'client_id' => '1', 'client_code' => 'cliente-demo', 'website_type_code' => 'shopit',
+    'integration_code' => 'telepagos',
     'menu_id' => '1', 'menu_code' => 'demo', 'catalog_item_id' => '1', 'variant_id' => '1',
     'category_id' => '1', 'featured_group_id' => '1', 'cart_id' => '1', 'cart_item_id' => '1',
     'purchase_id' => '1', 'purchase_item_id' => '1', 'sale_id' => '1', 'staff_id' => '1',
@@ -444,7 +552,7 @@ $collection = [
     'info' => [
         '_postman_id' => '76fd6fd2-53b9-4d92-8e02-1ddcc6207fa2',
         'name' => 'ShopIt API — Complete',
-        'description' => "Colección canónica generada desde las rutas reales de Laravel. Incluye {$registeredOperations} operaciones HTTP, ejemplos de payload, filtros, archivos y tokens separados para Storefront, Admin App y Scanner.\n\nUso rápido:\n1. Ajustá `base_url` y las credenciales.\n2. Ejecutá el Login de la aplicación correspondiente; el token se guarda automáticamente.\n3. Ajustá los IDs y códigos de las variables de colección.\n\nRegeneración: `php postman/generate-shopit-collection.php`.",
+        'description' => "Colección canónica generada desde las rutas reales de Laravel. Incluye {$registeredOperations} operaciones HTTP, presets de configuración para cada integración, ejemplos de payload, filtros, archivos y tokens separados para Storefront, Admin App y Scanner.\n\nUso rápido:\n1. Ajustá `base_url` y las credenciales.\n2. Ejecutá el Login de la aplicación correspondiente; el token se guarda automáticamente.\n3. Ajustá los IDs y códigos de las variables de colección.\n\nRegeneración: `php postman/generate-shopit-collection.php`.",
         'schema' => 'https://schema.getpostman.com/json/collection/v2.1.0/collection.json',
     ],
     'item' => $items,

tests/Concerns/CreatesIntegrationInstances.php

@@ -0,0 +1,21 @@
+<?php
+
+namespace Tests\Concerns;
+
+use App\Domains\Integration\Models\ClientIntegration;
+use App\Domains\Integration\Models\IntegrationInstance;
+
+trait CreatesIntegrationInstances
+{
+    private function createClientIntegration(array $attributes): ClientIntegration
+    {
+        $instance = IntegrationInstance::create([
+            'integration_code' => $attributes['integration_code'],
+            'name' => 'Test instance',
+            'integration_data' => $attributes['integration_data'],
+        ]);
+        unset($attributes['integration_data']);
+
+        return ClientIntegration::create($attributes + ['integration_instance_id' => $instance->id]);
+    }
+}

tests/Feature/Integration/ClientIntegrationControllerTest.php

@@ -2,11 +2,13 @@
 
 namespace Tests\Feature\Integration;
 
+use App\Domains\Auth\Models\User;
 use App\Domains\Client\Models\Client;
 use App\Domains\Integration\Models\ClientIntegration;
 use App\Domains\Integration\Models\Integration;
 use App\Domains\Integration\Services\ClientIntegrationService;
 use Illuminate\Foundation\Testing\RefreshDatabase;
+use Laravel\Sanctum\Sanctum;
 use Mockery;
 use Tests\TestCase;
 
@@ -16,6 +18,7 @@ class ClientIntegrationControllerTest extends TestCase
 
     public function test_store_returns_success_message_without_integration_data(): void
     {
+        Sanctum::actingAs(User::factory()->create(['rol_codigo' => 'admin']));
         $integration = Integration::create([
             'integration_code' => 'test_integration',
             'name' => 'Test Integration',
@@ -36,7 +39,7 @@ class ClientIntegrationControllerTest extends TestCase
                 ->andReturn(new ClientIntegration);
         });
 
-        $this->putJson('/api/clients/test-client/integrations/test_integration', [
+        $this->withHeader('Accept-Language', 'es')->putJson('/api/clients/test-client/integrations/test_integration', [
             'integration_data' => [
                 'api_key' => 'secret',
             ],

tests/Feature/Integration/IntegrationInstanceTest.php

@@ -0,0 +1,228 @@
+<?php
+
+namespace Tests\Feature\Integration;
+
+use App\Domains\Attachable\Enums\AttachmentType;
+use App\Domains\Attachable\Models\Attachment;
+use App\Domains\Auth\Models\User;
+use App\Domains\Client\Models\Client;
+use App\Domains\Integration\Models\Integration;
+use App\Domains\Integration\Models\IntegrationInstance;
+use App\Domains\Integration\Services\BaseIntegrationService;
+use App\Domains\Integration\Services\ClientIntegrationService;
+use App\Domains\Integration\Services\IntegrationAssociationService;
+use App\Domains\Integration\Services\IntegrationInstanceService;
+use App\Domains\Integration\Services\TelepagosIntegrationService;
+use App\Domains\Tenant\Models\Tenant;
+use App\Domains\Tenant\Models\WebsiteType;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Support\Facades\Cache;
+use Illuminate\Support\Facades\Http;
+use Laravel\Sanctum\Sanctum;
+use Tests\TestCase;
+
+class IntegrationInstanceTest extends TestCase
+{
+    use RefreshDatabase;
+
+    private Integration $integration;
+
+    protected function setUp(): void
+    {
+        parent::setUp();
+        config(['services.integrations.secret' => 'instance-test-secret']);
+        $this->integration = Integration::create([
+            'integration_code' => 'test', 'name' => 'Test', 'requires_configuration' => false,
+            'integration_data_schema' => ['api_key' => 'required|string'],
+        ]);
+    }
+
+    public function test_management_requires_an_authenticated_global_admin(): void
+    {
+        Client::create(['code' => 'acme', 'name' => 'Acme']);
+        WebsiteType::create(['codigo' => 'demo', 'nombre' => 'Demo']);
+
+        $this->getJson('/api/clients/acme/integrations')->assertUnauthorized();
+        Sanctum::actingAs(User::factory()->create());
+        $this->getJson('/api/clients/acme/integrations')->assertForbidden();
+        $this->getJson('/api/website-types/demo/integrations')->assertForbidden();
+    }
+
+    public function test_only_owner_endpoints_can_manage_configuration(): void
+    {
+        $this->admin();
+        $client = Client::create(['code' => 'acme', 'name' => 'Acme']);
+        $type = WebsiteType::create(['codigo' => 'demo', 'nombre' => 'Demo']);
+
+        $this->getJson('/api/integrations')->assertNotFound();
+        $this->getJson('/api/integration-instances')->assertNotFound();
+        $this->putJson('/api/clients/acme/integrations/test/instance', [])->assertNotFound();
+
+        $this->putJson('/api/clients/acme/integrations/test', ['integration_data' => []])
+            ->assertUnprocessable()->assertJsonValidationErrors('integration_data.api_key');
+        $this->putJson('/api/website-types/demo/integrations/test', ['integration_data' => []])
+            ->assertUnprocessable()->assertJsonValidationErrors('integration_data.api_key');
+
+        $this->putJson('/api/clients/acme/integrations/test', [
+            'integration_data' => ['api_key' => 'client-secret'],
+        ])->assertOk()->assertJsonMissingPath('integration_data');
+        $clientInstanceId = $client->integrations()->firstOrFail()->integration_instance_id;
+        self::assertSame('client-secret', IntegrationInstance::findOrFail($clientInstanceId)->integration_data['api_key']);
+
+        $this->putJson('/api/website-types/demo/integrations/test', [
+            'integration_data' => ['api_key' => 'type-secret'],
+        ])->assertCreated()
+            ->assertJsonPath('data.integration_instance.name', 'Test / Demo')
+            ->assertJsonMissingPath('data.integration_instance.integration_data');
+        $typeInstanceId = $type->integrations()->firstOrFail()->integration_instance_id;
+        $this->getJson('/api/website-types/demo/integrations/test')
+            ->assertOk()->assertJsonPath('data.integration_instance_id', $typeInstanceId);
+
+        $this->deleteJson('/api/clients/acme/integrations/test')->assertNoContent();
+        $this->deleteJson('/api/website-types/demo/integrations/test')->assertNoContent();
+    }
+
+    public function test_tenant_prefers_client_then_type_and_client_context_does_not_inherit(): void
+    {
+        $type = WebsiteType::create(['codigo' => 'demo', 'nombre' => 'Demo']);
+        $tenant = $this->tenantForType($type);
+        $associations = new IntegrationAssociationService;
+        $associations->associate($type, 'test', $this->makeInstance('type'));
+        $service = $this->probe();
+        self::assertSame('type', $service->forTenant($tenant->codigo)->setting());
+        self::assertNull($service->forClient($tenant->client)->setting());
+        $associations->associate($tenant->client, 'test', $this->makeInstance('client'));
+        self::assertSame('client', $service->forTenant($tenant->codigo)->setting());
+        $associations->detach($tenant->client, 'test');
+        self::assertSame('type', $service->forTenant($tenant->codigo)->setting());
+        $associations->detach($type, 'test');
+        self::assertNull($service->forTenant($tenant->codigo)->setting());
+        $this->integration->update(['requires_configuration' => true]);
+        $this->expectException(\Exception::class);
+        $service->forTenant($tenant->codigo);
+    }
+
+    public function test_required_configuration_can_come_from_the_website_type(): void
+    {
+        $this->integration->update(['requires_configuration' => true]);
+        $type = WebsiteType::create(['codigo' => 'demo', 'nombre' => 'Demo']);
+        $tenant = $this->tenantForType($type);
+        (new IntegrationAssociationService)->associate($type, 'test', $this->makeInstance('type'));
+        self::assertSame('type', $this->probe()->forTenant($tenant->codigo)->setting());
+    }
+
+    public function test_legacy_save_does_not_modify_a_shared_instance(): void
+    {
+        $a = Client::create(['code' => 'a', 'name' => 'A']);
+        $b = Client::create(['code' => 'b', 'name' => 'B']);
+        $shared = $this->makeInstance('shared');
+        $associations = new IntegrationAssociationService;
+        $associations->associate($a, 'test', $shared);
+        $associations->associate($b, 'test', $shared);
+        (new ClientIntegrationService)->updateOrCreateIntegration($a, $this->integration, ['api_key' => 'private']);
+        self::assertSame('private', $this->probe()->forClient($a)->setting());
+        self::assertSame('shared', $this->probe()->forClient($b)->setting());
+        (new IntegrationInstanceService)->update($shared, ['integration_data' => ['api_key' => 'changed']]);
+        self::assertSame('changed', $this->probe()->forClient($b)->setting());
+    }
+
+    public function test_reconfiguring_deletes_the_previous_instance_when_it_is_no_longer_used(): void
+    {
+        $client = Client::create(['code' => 'acme', 'name' => 'Acme']);
+        $associations = new IntegrationAssociationService;
+        $previous = $this->makeInstance('previous');
+
+        $associations->associate($client, 'test', $previous);
+        $current = $associations->configure($client, $this->integration, ['api_key' => 'current']);
+
+        $this->assertDatabaseMissing('integration_instances', ['id' => $previous->id]);
+        $this->assertDatabaseHas('integration_instances', ['id' => $current->integration_instance_id]);
+    }
+
+    public function test_an_instance_is_deleted_only_after_its_last_association_is_removed(): void
+    {
+        $client = Client::create(['code' => 'acme', 'name' => 'Acme']);
+        $type = WebsiteType::create(['codigo' => 'demo', 'nombre' => 'Demo']);
+        $shared = $this->makeInstance('shared');
+        $associations = new IntegrationAssociationService;
+
+        $associations->associate($client, 'test', $shared);
+        $associations->associate($type, 'test', $shared);
+
+        $associations->detach($client, 'test');
+        $this->assertDatabaseHas('integration_instances', ['id' => $shared->id]);
+
+        $associations->detach($type, 'test');
+        $this->assertDatabaseMissing('integration_instances', ['id' => $shared->id]);
+    }
+
+    public function test_telepagos_shares_tokens_by_instance_and_refreshes_after_credential_changes(): void
+    {
+        Integration::create(['integration_code' => 'telepagos_homo', 'name' => 'Telepagos', 'url' => 'https://payments.test']);
+        $instance = IntegrationInstance::create([
+            'integration_code' => 'telepagos_homo', 'name' => 'Payments',
+            'integration_data' => ['username' => 'first', 'password' => 'secret'],
+        ]);
+        $a = Client::create(['code' => 'a', 'name' => 'A']);
+        $b = Client::create(['code' => 'b', 'name' => 'B']);
+        $associations = new IntegrationAssociationService;
+        $associations->associate($a, 'telepagos_homo', $instance);
+        $associations->associate($b, 'telepagos_homo', $instance);
+        Cache::flush();
+        Http::fake(['https://payments.test/v2/auth/token' => Http::sequence()
+            ->push(['status' => 'ok', 'token' => 'first-token', 'expires_at' => now()->addHour()->toDateTimeString()])
+            ->push(['status' => 'ok', 'token' => 'new-token', 'expires_at' => now()->addHour()->toDateTimeString()])]);
+        self::assertSame('first-token', (new TelepagosIntegrationService('telepagos_homo'))->forClient($a)->getToken());
+        self::assertSame('first-token', (new TelepagosIntegrationService('telepagos_homo'))->forClient($b)->getToken());
+        Http::assertSentCount(1);
+        (new IntegrationInstanceService)->update($instance, ['integration_data' => ['username' => 'second', 'password' => 'new-secret']]);
+        self::assertSame('new-token', (new TelepagosIntegrationService('telepagos_homo'))->forClient($b)->getToken());
+        Http::assertSentCount(2);
+    }
+
+    private function tenantForType(WebsiteType $type): Tenant
+    {
+        $logo = Attachment::create([
+            'path' => 'tenants/logo.png', 'filename' => 'logo.png',
+            'type' => AttachmentType::Image,
+            'mime_type' => 'image/png',
+        ]);
+
+        return Tenant::create([
+            'codigo' => 'acme', 'nombre' => 'Acme', 'dominio' => 'acme.test',
+            'website_type_code' => $type->codigo,
+            'primary_color' => '#112233', 'secondary_color' => '#445566',
+            'danger_color' => '#ff0000', 'success_color' => '#00ff00',
+            'header_bg_color' => '#112233', 'footer_bg_color' => '#112233',
+            'header_logo_id' => $logo->id, 'footer_logo_id' => $logo->id,
+        ]);
+    }
+
+    private function makeInstance(string $name): IntegrationInstance
+    {
+        return IntegrationInstance::create(['integration_code' => 'test', 'name' => $name, 'integration_data' => ['api_key' => $name]]);
+    }
+
+    private function admin(): void
+    {
+        Sanctum::actingAs(User::factory()->create(['rol_codigo' => 'admin']));
+    }
+
+    private function probe(): BaseIntegrationService
+    {
+        return new class extends BaseIntegrationService
+        {
+            protected string $integrationCode = 'test';
+
+            public function getHeaders(): array
+            {
+                return [];
+            }
+
+            public function setting(): mixed
+            {
+                return $this->getIntegrationSetting('api_key');
+            }
+        };
+    }
+}

tests/Feature/Integration/IntegrationServiceTest.php

@@ -4,7 +4,6 @@ namespace Tests\Feature\Integration;
 
 use App\Domains\Attachable\Enums\AttachmentType;
 use App\Domains\Attachable\Models\Attachment;
-use App\Domains\Integration\Models\ClientIntegration;
 use App\Domains\Integration\Models\Integration;
 use App\Domains\Integration\Services\TelepagosIntegrationService;
 use App\Domains\Tenant\Models\Tenant;
@@ -15,10 +14,12 @@ use Illuminate\Support\Facades\Cache;
 use Illuminate\Support\Facades\Http;
 use Illuminate\Support\Facades\Log;
 use Illuminate\Support\Str;
+use Tests\Concerns\CreatesIntegrationInstances;
 use Tests\TestCase;
 
 class IntegrationServiceTest extends TestCase
 {
+    use CreatesIntegrationInstances;
     use RefreshDatabase;
 
     private Tenant $tenant;
@@ -110,7 +111,7 @@ class IntegrationServiceTest extends TestCase
             ],
         ]);
 
-        ClientIntegration::create([
+        $this->createClientIntegration([
             'client_id' => $this->tenant->client_id,
             'integration_code' => 'telepagos_homo',
             'integration_data' => [
@@ -139,7 +140,7 @@ class IntegrationServiceTest extends TestCase
             ],
         ]);
 
-        ClientIntegration::create([
+        $this->createClientIntegration([
             'client_id' => $this->tenant->client_id,
             'integration_code' => 'telepagos_homo',
             'integration_data' => [
@@ -198,7 +199,7 @@ class IntegrationServiceTest extends TestCase
             ],
         ]);
 
-        ClientIntegration::create([
+        $this->createClientIntegration([
             'client_id' => $this->tenant->client_id,
             'integration_code' => 'telepagos_homo',
             'integration_data' => [
@@ -242,7 +243,7 @@ class IntegrationServiceTest extends TestCase
             ],
         ]);
 
-        ClientIntegration::create([
+        $this->createClientIntegration([
             'client_id' => $this->tenant->client_id,
             'integration_code' => 'telepagos_homo',
             'integration_data' => [
@@ -272,7 +273,7 @@ class IntegrationServiceTest extends TestCase
             ],
         ]);
 
-        ClientIntegration::create([
+        $this->createClientIntegration([
             'client_id' => $this->tenant->client_id,
             'integration_code' => 'telepagos_homo',
             'integration_data' => [
@@ -323,7 +324,7 @@ class IntegrationServiceTest extends TestCase
             ],
         ]);
 
-        ClientIntegration::create([
+        $this->createClientIntegration([
             'client_id' => $this->tenant->client_id,
             'integration_code' => 'telepagos_homo',
             'integration_data' => [
@@ -375,7 +376,7 @@ class IntegrationServiceTest extends TestCase
             ],
         ]);
 
-        ClientIntegration::create([
+        $this->createClientIntegration([
             'client_id' => $this->tenant->client_id,
             'integration_code' => 'telepagos_homo',
             'integration_data' => [
@@ -427,7 +428,7 @@ class IntegrationServiceTest extends TestCase
             ],
         ]);
 
-        ClientIntegration::create([
+        $this->createClientIntegration([
             'client_id' => $this->tenant->client_id,
             'integration_code' => 'telepagos_homo',
             'integration_data' => [
@@ -480,7 +481,7 @@ class IntegrationServiceTest extends TestCase
             ],
         ]);
 
-        ClientIntegration::create([
+        $this->createClientIntegration([
             'client_id' => $this->tenant->client_id,
             'integration_code' => 'telepagos_homo',
             'integration_data' => [
@@ -541,7 +542,7 @@ class IntegrationServiceTest extends TestCase
             ],
         ]);
 
-        ClientIntegration::create([
+        $this->createClientIntegration([
             'client_id' => $this->tenant->client_id,
             'integration_code' => 'telepagos_homo',
             'integration_data' => [
@@ -566,7 +567,7 @@ class IntegrationServiceTest extends TestCase
         Log::shouldReceive('error')
             ->once()
             ->with('Telepagos get cash-in details failed: Cashin no encontrado', \Mockery::on(function ($context) {
-                return $context['cashin_id'] === 6351
+                return $context['cashin_id'] === '6351'
                     && $context['response_status'] === 404
                     && $context['response_body'] === ['status' => 'error', 'message' => 'Cashin no encontrado'];
             }));

tests/Feature/Integration/MailServiceTest.php

@@ -4,28 +4,32 @@ namespace Tests\Feature\Integration;
 
 use App\Domains\Attachable\Enums\AttachmentType;
 use App\Domains\Attachable\Models\Attachment;
-use App\Domains\Integration\Models\ClientIntegration;
 use App\Domains\Integration\Models\Integration;
+use App\Domains\Integration\Models\IntegrationInstance;
 use App\Domains\Integration\Services\ClientIntegrationService;
+use App\Domains\Integration\Services\IntegrationAssociationService;
 use App\Domains\Integration\Services\MailService;
 use App\Domains\Tenant\Models\Tenant;
+use App\Domains\Tenant\Models\WebsiteType;
 use Illuminate\Foundation\Testing\RefreshDatabase;
 use Illuminate\Mail\Mailable;
 use Illuminate\Mail\Mailer;
 use Illuminate\Mail\MailManager;
 use Illuminate\Support\Facades\Mail;
 use Mockery;
+use Tests\Concerns\CreatesIntegrationInstances;
 use Tests\TestCase;
 
 class MailServiceTest extends TestCase
 {
+    use CreatesIntegrationInstances;
     use RefreshDatabase;
 
     public function test_it_builds_an_isolated_smtp_mailer_from_the_client_integration(): void
     {
         $tenant = $this->createTenant();
         $this->createEmailIntegration();
-        ClientIntegration::create([
+        $this->createClientIntegration([
             'client_id' => $tenant->client_id,
             'integration_code' => 'email',
             'integration_data' => $this->emailData(),
@@ -40,7 +44,7 @@ class MailServiceTest extends TestCase
         $manager->shouldReceive('build')
             ->once()
             ->with(Mockery::on(fn (array $config): bool => $config === [
-                'name' => 'client-smtp-'.$tenant->client_id,
+                'name' => 'integration-smtp-'.IntegrationInstance::firstOrFail()->id,
                 'transport' => 'smtp',
                 'scheme' => 'smtp',
                 'host' => 'smtp.example.com',
@@ -54,7 +58,7 @@ class MailServiceTest extends TestCase
 
         $service = (new MailService($manager))->forTenant($tenant->codigo);
 
-        $this->assertSame('client-smtp', $service->mailerName());
+        $this->assertSame('integration-smtp', $service->mailerName());
     }
 
     public function test_it_uses_the_default_mailer_when_client_configuration_is_not_required(): void
@@ -65,7 +69,7 @@ class MailServiceTest extends TestCase
         Integration::create([
             'integration_code' => 'email',
             'name' => 'Email',
-            'requires_client_configuration' => false,
+            'requires_configuration' => false,
         ]);
 
         $service = (new MailService)->forTenant($tenant->codigo);
@@ -84,7 +88,7 @@ class MailServiceTest extends TestCase
         Mail::fake();
         $tenant = $this->createTenant();
         $this->createEmailIntegration();
-        ClientIntegration::create([
+        $this->createClientIntegration([
             'client_id' => $tenant->client_id,
             'integration_code' => 'email',
             'integration_data' => $this->emailData(),
@@ -118,6 +122,24 @@ class MailServiceTest extends TestCase
         Mail::assertSent(Mailable::class, 1);
     }
 
+    public function test_it_uses_the_website_type_smtp_instance_without_a_client_association(): void
+    {
+        Mail::fake();
+        $tenant = $this->createTenant();
+        $this->createEmailIntegration();
+        $type = WebsiteType::create(['codigo' => 'mail-brand', 'nombre' => 'Mail Brand']);
+        $tenant->update(['website_type_code' => $type->codigo]);
+        $instance = IntegrationInstance::create([
+            'integration_code' => 'email', 'name' => 'Brand SMTP', 'integration_data' => $this->emailData(),
+        ]);
+        (new IntegrationAssociationService)->associate($type, 'email', $instance);
+
+        $service = (new MailService)->forTenant($tenant->codigo);
+        self::assertSame('integration-smtp', $service->mailerName());
+        $service->send('customer@example.com', 'Brand mail', '<p>Brand SMTP</p>');
+        Mail::assertSent(Mailable::class, 1);
+    }
+
     private function createTenant(): Tenant
     {
         $logo = Attachment::create([

tests/Feature/Integration/TelepagosWebhookTest.php

@@ -11,7 +11,6 @@ use App\Domains\Catalog\Models\CatalogItem;
 use App\Domains\Catalog\Models\Category;
 use App\Domains\Catalog\Models\Inventory;
 use App\Domains\Catalog\Models\Variant;
-use App\Domains\Integration\Models\ClientIntegration;
 use App\Domains\Integration\Models\Integration;
 use App\Domains\Purchase\Models\Purchase;
 use App\Domains\Purchase\Models\TelepagosPayment;
@@ -22,10 +21,12 @@ use Illuminate\Support\Facades\Cache;
 use Illuminate\Support\Facades\Http;
 use Illuminate\Support\Facades\Queue;
 use Illuminate\Support\Str;
+use Tests\Concerns\CreatesIntegrationInstances;
 use Tests\TestCase;
 
 class TelepagosWebhookTest extends TestCase
 {
+    use CreatesIntegrationInstances;
     use RefreshDatabase;
 
     protected function setUp(): void
@@ -633,7 +634,7 @@ class TelepagosWebhookTest extends TestCase
             ],
         ]);
 
-        ClientIntegration::create([
+        $this->createClientIntegration([
             'client_id' => $tenant->client_id,
             'integration_code' => 'telepagos_homo',
             'integration_data' => [

tests/Feature/MailTest/MailTestControllerTest.php

@@ -4,17 +4,18 @@ namespace Tests\Feature\MailTest;
 
 use App\Domains\Attachable\Enums\AttachmentType;
 use App\Domains\Attachable\Models\Attachment;
-use App\Domains\Integration\Models\ClientIntegration;
 use App\Domains\Integration\Models\Integration;
 use App\Domains\MailTest\Mailables\TestMail;
 use App\Domains\Tenant\Models\Tenant;
 use Illuminate\Foundation\Testing\RefreshDatabase;
 use Illuminate\Mail\Mailable;
 use Illuminate\Support\Facades\Mail;
+use Tests\Concerns\CreatesIntegrationInstances;
 use Tests\TestCase;
 
 class MailTestControllerTest extends TestCase
 {
+    use CreatesIntegrationInstances;
     use RefreshDatabase;
 
     public function test_it_sends_a_test_email(): void
@@ -22,7 +23,7 @@ class MailTestControllerTest extends TestCase
         Mail::fake();
         $tenant = $this->createTenant();
 
-        $response = $this->postJson('/api/acme/mail-test/send', [
+        $response = $this->withHeader('Accept-Language', 'es')->postJson('/api/acme/mail-test/send', [
             'to' => 'recipient@example.com',
             'subject' => 'SMTP test',
             'message' => 'Test message',
@@ -32,7 +33,7 @@ class MailTestControllerTest extends TestCase
             ->assertJsonPath('message', 'Correo de prueba enviado correctamente.')
             ->assertJsonPath('recipient', 'recipient@example.com')
             ->assertJsonPath('tenant_code', 'acme')
-            ->assertJsonPath('mailer', 'tenant-smtp')
+            ->assertJsonPath('mailer', 'integration-smtp')
             ->assertJsonStructure(['sent_at']);
 
         Mail::assertSent(Mailable::class, function (Mailable $mail) use ($tenant): bool {
@@ -48,7 +49,7 @@ class MailTestControllerTest extends TestCase
         Mail::fake();
         $this->createTenant();
 
-        $this->postJson('/api/acme/mail-test/send', [
+        $this->withHeader('Accept-Language', 'es')->postJson('/api/acme/mail-test/send', [
             'to' => 'recipient@example.com',
         ])->assertOk();
 
@@ -63,7 +64,7 @@ class MailTestControllerTest extends TestCase
         Mail::fake();
         $this->createTenant();
 
-        $this->postJson('/api/acme/mail-test/send', [
+        $this->withHeader('Accept-Language', 'es')->postJson('/api/acme/mail-test/send', [
             'to' => 'invalid-email',
         ])->assertUnprocessable()
             ->assertJsonValidationErrors(['to']);
@@ -117,7 +118,7 @@ class MailTestControllerTest extends TestCase
     {
         Mail::fake();
 
-        $this->postJson('/api/unknown/mail-test/send', [
+        $this->withHeader('Accept-Language', 'es')->postJson('/api/unknown/mail-test/send', [
             'to' => 'recipient@example.com',
         ])->assertNotFound();
 
@@ -129,7 +130,7 @@ class MailTestControllerTest extends TestCase
         Mail::fake();
         $tenant = $this->createTenant();
 
-        $this->postJson("/api/{$tenant->id}/mail-test/send", [
+        $this->withHeader('Accept-Language', 'es')->postJson("/api/{$tenant->id}/mail-test/send", [
             'to' => 'recipient@example.com',
         ])->assertNotFound();
 
@@ -171,7 +172,7 @@ class MailTestControllerTest extends TestCase
             'integration_code' => 'email',
             'name' => 'Email',
         ]);
-        ClientIntegration::create([
+        $this->createClientIntegration([
             'client_id' => $tenant->client_id,
             'integration_code' => 'email',
             'integration_data' => [

tests/Feature/Notification/NotificationMailServiceTest.php

@@ -36,7 +36,7 @@ class NotificationMailServiceTest extends TestCase
             'integration_code' => 'email',
             'name' => 'Email',
             'url' => null,
-            'requires_client_configuration' => false,
+            'requires_configuration' => false,
             'integration_data_schema' => [],
         ]);
         $header = Attachment::query()->create([

tests/Unit/IntegrationInstanceSchemaTest.php

@@ -0,0 +1,173 @@
+<?php
+
+namespace Tests\Unit;
+
+use App\Domains\Integration\Models\ClientIntegration;
+use App\Domains\Integration\Models\Integration;
+use App\Domains\Integration\Models\IntegrationInstance;
+use App\Domains\Integration\Models\WebsiteTypeIntegration;
+use App\Domains\Tenant\Models\WebsiteType;
+use Illuminate\Config\Repository;
+use Illuminate\Container\Container;
+use Illuminate\Database\Capsule\Manager;
+use Illuminate\Database\QueryException;
+use Illuminate\Database\Schema\Blueprint;
+use Illuminate\Support\Facades\Facade;
+use PHPUnit\Framework\TestCase;
+
+class IntegrationInstanceSchemaTest extends TestCase
+{
+    private Manager $database;
+
+    private array $migrations;
+
+    private mixed $previousFacadeApplication;
+
+    private Container $previousContainer;
+
+    protected function setUp(): void
+    {
+        parent::setUp();
+        $this->previousFacadeApplication = Facade::getFacadeApplication();
+        $this->previousContainer = Container::getInstance();
+        $container = new Container;
+        Container::setInstance($container);
+        $container->instance('config', new Repository([
+            'services' => ['integrations' => ['secret' => 'schema-test-secret']],
+            'app' => ['cipher' => 'AES-256-CBC'],
+        ]));
+        $this->database = new Manager($container);
+        $this->database->addConnection(['driver' => 'sqlite', 'database' => ':memory:', 'foreign_key_constraints' => true]);
+        $this->database->bootEloquent();
+        $container->instance('db', $this->database->getDatabaseManager());
+        $container->bind('db.schema', fn () => $this->database->getConnection()->getSchemaBuilder());
+        Facade::clearResolvedInstances();
+        Facade::setFacadeApplication($container);
+
+        $schema = $this->database->getConnection()->getSchemaBuilder();
+        $schema->create('clients', function (Blueprint $table): void {
+            $table->id();
+        });
+        $schema->create('website_type', function (Blueprint $table): void {
+            $table->id();
+            $table->string('codigo')->unique();
+        });
+        (require __DIR__.'/../../database/migrations/2026_07_03_000001_create_integrations_table.php')->up();
+        $schema->table('integrations', function (Blueprint $table): void {
+            $table->boolean('requires_client_configuration')->default(true);
+        });
+        $schema->create('client_integrations', function (Blueprint $table): void {
+            $table->id();
+            $table->foreignId('client_id')->constrained('clients')->cascadeOnDelete();
+            $table->string('integration_code');
+            $table->longText('integration_data')->nullable();
+            $table->timestamps();
+            $table->foreign('integration_code')->references('integration_code')->on('integrations')->cascadeOnDelete();
+            $table->unique(['client_id', 'integration_code']);
+        });
+        $db = $this->database->getConnection();
+        $db->table('clients')->insert(['id' => 1]);
+        $db->table('website_type')->insert(['codigo' => 'onticket']);
+        $db->table('integrations')->insert([
+            ['integration_code' => 'email', 'name' => 'Email'],
+            ['integration_code' => 'telepagos', 'name' => 'Telepagos'],
+        ]);
+        $db->table('client_integrations')->insert([
+            'client_id' => 1, 'integration_code' => 'email', 'integration_data' => 'existing-ciphertext',
+        ]);
+        $this->migrations = array_map(fn (string $file) => require $file, glob(__DIR__.'/../../database/migrations/2026_09_04_*.php'));
+        foreach ($this->migrations as $migration) {
+            $migration->up();
+        }
+    }
+
+    protected function tearDown(): void
+    {
+        $this->database->getConnection()->disconnect();
+        Facade::clearResolvedInstances();
+        Facade::setFacadeApplication($this->previousFacadeApplication);
+        Container::setInstance($this->previousContainer);
+        parent::tearDown();
+    }
+
+    public function test_migration_preserves_ciphertext_and_rollback_restores_it(): void
+    {
+        $db = $this->database->getConnection();
+        $association = $db->table('client_integrations')->first();
+        self::assertSame('existing-ciphertext', $db->table('integration_instances')->where('id', $association->integration_instance_id)->value('integration_data'));
+        self::assertFalse($db->getSchemaBuilder()->hasColumn('client_integrations', 'integration_data'));
+
+        foreach (array_reverse($this->migrations) as $migration) {
+            $migration->down();
+        }
+        self::assertSame('existing-ciphertext', $db->table('client_integrations')->value('integration_data'));
+        self::assertFalse($db->getSchemaBuilder()->hasTable('integration_instances'));
+    }
+
+    public function test_instances_encrypt_data_and_can_be_shared_through_relations(): void
+    {
+        $instance = IntegrationInstance::firstOrFail();
+        $instance->update(['integration_data' => ['password' => 'private-value']]);
+        self::assertNotSame('private-value', $instance->getRawOriginal('integration_data'));
+        self::assertSame(['password' => 'private-value'], $instance->fresh()->integration_data);
+        self::assertArrayNotHasKey('integration_data', $instance->toArray());
+        WebsiteTypeIntegration::create([
+            'website_type_code' => 'onticket', 'integration_code' => 'email', 'integration_instance_id' => $instance->id,
+        ]);
+        self::assertTrue(ClientIntegration::firstOrFail()->integrationInstance->is($instance));
+        self::assertTrue(WebsiteType::firstOrFail()->integrations->first()->integrationInstance->is($instance));
+        self::assertSame(1, $instance->clientIntegrations()->count());
+        self::assertSame(1, $instance->websiteTypeIntegrations()->count());
+        self::assertTrue(Integration::where('integration_code', 'email')->firstOrFail()->instances->first()->is($instance));
+    }
+
+    public function test_retry_after_foreign_key_failure_preserves_existing_instances(): void
+    {
+        $db = $this->database->getConnection();
+        $instanceId = $db->table('client_integrations')->value('integration_instance_id');
+        // Reproduce the state left by MySQL when ADD CONSTRAINT fails after the backfill.
+        $db->getSchemaBuilder()->table('client_integrations', function (Blueprint $table): void {
+            $table->dropForeign('client_integrations_instance_code_fk')
+                ->columns(['integration_instance_id', 'integration_code']);
+            $table->longText('integration_data')->nullable();
+        });
+        $db->table('client_integrations')->update(['integration_data' => 'existing-ciphertext']);
+
+        $this->migrations[1]->up();
+        $this->migrations[1]->up();
+
+        self::assertSame(1, $db->table('integration_instances')->count());
+        self::assertSame($instanceId, $db->table('client_integrations')->value('integration_instance_id'));
+        self::assertSame('existing-ciphertext', $db->table('integration_instances')->value('integration_data'));
+        self::assertFalse($db->getSchemaBuilder()->hasColumn('client_integrations', 'integration_data'));
+        $keys = $db->getSchemaBuilder()->getForeignKeys('client_integrations');
+        self::assertCount(1, array_filter($keys, fn (array $key): bool => $key['columns'] === ['integration_instance_id', 'integration_code']));
+    }
+
+    public function test_association_rejects_an_instance_from_another_integration(): void
+    {
+        $this->expectException(QueryException::class);
+        WebsiteTypeIntegration::create([
+            'website_type_code' => 'onticket', 'integration_code' => 'telepagos', 'integration_instance_id' => IntegrationInstance::firstOrFail()->id,
+        ]);
+    }
+
+    public function test_client_cannot_have_two_instances_of_the_same_integration(): void
+    {
+        $instance = IntegrationInstance::create(['integration_code' => 'email', 'name' => 'Second']);
+        $this->expectException(QueryException::class);
+        ClientIntegration::create(['client_id' => 1, 'integration_code' => 'email', 'integration_instance_id' => $instance->id]);
+    }
+
+    public function test_website_type_cannot_have_two_instances_of_the_same_integration(): void
+    {
+        WebsiteTypeIntegration::create([
+            'website_type_code' => 'onticket', 'integration_code' => 'email', 'integration_instance_id' => IntegrationInstance::firstOrFail()->id,
+        ]);
+        $instance = IntegrationInstance::create(['integration_code' => 'email', 'name' => 'Second']);
+        $this->expectException(QueryException::class);
+        WebsiteTypeIntegration::create([
+            'website_type_code' => 'onticket', 'integration_code' => 'email', 'integration_instance_id' => $instance->id,
+        ]);
+    }
+}