feat(authorization): implement WebsiteExtra management with controller, request, resource, service, routes, middleware, and tests

app/Domains/Auth/Models/User.php

@@ -2,6 +2,7 @@
 
 namespace App\Domains\Auth\Models;
 
+use App\Domains\Authorization\Enums\RoleCode;
 use App\Domains\Authorization\Models\Role;
 use App\Domains\Tenant\Models\Tenant;
 use Database\Factories\UserFactory;
@@ -13,7 +14,6 @@ use Illuminate\Database\Eloquent\Relations\HasMany;
 use Illuminate\Foundation\Auth\User as Authenticatable;
 use Illuminate\Notifications\Notifiable;
 use Laravel\Sanctum\HasApiTokens;
-use LogicException;
 
 #[Fillable(['nombre_apellido', 'email', 'password', 'dni', 'telefono', 'google_id', 'rol_codigo', 'tenant_codigo'])]
 #[Hidden(['password', 'remember_token'])]
@@ -23,7 +23,7 @@ class User extends Authenticatable
     use HasApiTokens, HasFactory, Notifiable;
 
     protected $attributes = [
-        'rol_codigo' => 'user',
+        'rol_codigo' => RoleCode::User->value,
     ];
 
     protected static function newFactory(): UserFactory
@@ -31,20 +31,6 @@ class User extends Authenticatable
         return UserFactory::new();
     }
 
-    protected static function booted(): void
-    {
-        static::saving(function (User $user): void {
-            $hasTenant = $user->tenant_codigo !== null;
-            $isTenantAdmin = $user->rol_codigo === 'tenant_admin';
-
-            if ($hasTenant !== $isTenantAdmin) {
-                throw new LogicException(
-                    'tenant_codigo debe estar informado únicamente para usuarios con rol tenant_admin.'
-                );
-            }
-        });
-    }
-
     /** @return HasMany<ResetPasswordAttempt, $this> */
     public function resetPasswordAttempts(): HasMany
     {

app/Domains/Authorization/Enums/RoleCode.php

@@ -0,0 +1,10 @@
+<?php
+
+namespace App\Domains\Authorization\Enums;
+
+enum RoleCode: string
+{
+    case Admin = 'admin';
+    case AdminApp = 'adminapp';
+    case User = 'user';
+}

app/Domains/Authorization/Models/Role.php

@@ -49,7 +49,7 @@ class Role extends Model
     {
         return $this->belongsToMany(
             Menu::class,
-            'menues_roles',
+            'roles_menues',
             'rol_codigo',
             'menu_codigo',
             'codigo',

app/Domains/Menu/Models/Menu.php

@@ -84,7 +84,7 @@ class Menu extends Model
     {
         return $this->belongsToMany(
             Role::class,
-            'menues_roles',
+            'roles_menues',
             'menu_codigo',
             'rol_codigo',
             'code',

app/Domains/Menu/Models/MenuRole.php

@@ -8,7 +8,7 @@ use Illuminate\Database\Eloquent\Relations\Pivot;
 
 class MenuRole extends Pivot
 {
-    protected $table = 'menues_roles';
+    protected $table = 'roles_menues';
 
     public $incrementing = true;
 

app/Domains/Tenant/Controllers/AdminApp/WebsiteExtraController.php

@@ -0,0 +1,50 @@
+<?php
+
+namespace App\Domains\Tenant\Controllers\AdminApp;
+
+use App\Domains\Auth\Models\User;
+use App\Domains\Tenant\Models\Tenant;
+use App\Domains\Tenant\Requests\AdminApp\UpdateWebsiteExtrasRequest;
+use App\Domains\Tenant\Resources\AdminApp\WebsiteExtrasResource;
+use App\Domains\Tenant\Services\TenantInformationService;
+use App\Domains\Tenant\Services\WebsiteExtraService;
+use App\Http\Controllers\Controller;
+use Illuminate\Http\Request;
+
+class WebsiteExtraController extends Controller
+{
+    public function __construct(
+        protected WebsiteExtraService $websiteExtraService,
+        protected TenantInformationService $tenantInformationService,
+    ) {}
+
+    public function show(Request $request): WebsiteExtrasResource
+    {
+        return WebsiteExtrasResource::make(
+            $this->loadTenant($request->user())
+        );
+    }
+
+    public function update(UpdateWebsiteExtrasRequest $request): WebsiteExtrasResource
+    {
+        $tenant = $request->user()->tenant()->firstOrFail();
+
+        $this->websiteExtraService->replaceForTenant(
+            $tenant,
+            $request->validated('extras', [])
+        );
+
+        return WebsiteExtrasResource::make(
+            $this->loadTenant($request->user())
+        );
+    }
+
+    private function loadTenant(User $user): Tenant
+    {
+        $tenant = $user->tenant()->firstOrFail();
+
+        return $this->tenantInformationService->load($tenant, [
+            'websiteType.extras',
+        ]);
+    }
+}

app/Domains/Tenant/Controllers/BootstrapTenantController.php

@@ -2,6 +2,7 @@
 
 namespace App\Domains\Tenant\Controllers;
 
+use App\Domains\Authorization\Enums\RoleCode;
 use App\Domains\Tenant\Models\Tenant;
 use App\Domains\Tenant\Requests\BootstrapTenantRequest;
 use App\Domains\Tenant\Resources\TenantResource;
@@ -25,7 +26,10 @@ class BootstrapTenantController extends Controller
                     ->where('dominio', $dominio)
                     ->firstOrFail(),
                 [
-                    'menues',
+                    'menues' => fn ($query) => $query->whereHas(
+                        'roles',
+                        fn ($query) => $query->where('codigo', RoleCode::User->value)
+                    ),
                     'categories' => fn ($query) => $query->orderBy('nombre'),
                 ]
             )

app/Domains/Tenant/Requests/AdminApp/UpdateWebsiteExtrasRequest.php

@@ -0,0 +1,24 @@
+<?php
+
+namespace App\Domains\Tenant\Requests\AdminApp;
+
+use App\Domains\Tenant\Services\WebsiteExtraService;
+use Illuminate\Foundation\Http\FormRequest;
+
+class UpdateWebsiteExtrasRequest extends FormRequest
+{
+    public function authorize(): bool
+    {
+        return true;
+    }
+
+    /**
+     * @return array<string, mixed>
+     */
+    public function rules(): array
+    {
+        return app(WebsiteExtraService::class)->requestRules(
+            $this->user()?->tenant?->website_type_code
+        );
+    }
+}

app/Domains/Tenant/Resources/AdminApp/WebsiteExtrasResource.php

@@ -0,0 +1,67 @@
+<?php
+
+namespace App\Domains\Tenant\Resources\AdminApp;
+
+use App\Domains\Attachable\Models\Attachment;
+use App\Domains\Tenant\Models\Tenant;
+use Illuminate\Http\Request;
+use Illuminate\Http\Resources\Json\JsonResource;
+
+/**
+ * @mixin Tenant
+ */
+class WebsiteExtrasResource extends JsonResource
+{
+    /**
+     * @return array<string, mixed>
+     */
+    public function toArray(Request $request): array
+    {
+        $websiteExtras = $this->websiteExtras->keyBy(
+            fn ($extra) => $extra->websiteTypeExtra->nombre
+        );
+
+        return [
+            'website_type' => $this->websiteType ? [
+                'codigo' => $this->websiteType->codigo,
+                'nombre' => $this->websiteType->nombre,
+            ] : null,
+            'definitions' => $this->websiteType?->extras
+                ->mapWithKeys(fn ($definition) => [
+                    $definition->nombre => [
+                        'descripcion' => $definition->descripcion,
+                        'is_required' => $definition->is_required,
+                        'request_rules' => $definition->config_schema['request_rules'] ?? [],
+                    ],
+                ]) ?? [],
+            'extras' => $websiteExtras->mapWithKeys(fn ($extra) => [
+                $extra->websiteTypeExtra->nombre => $this->formatConfig(
+                    $extra->resolvedConfig(),
+                    fn (Attachment $attachment): string => $attachment->key
+                ),
+            ]),
+            'resolved_extras' => $websiteExtras->mapWithKeys(fn ($extra) => [
+                $extra->websiteTypeExtra->nombre => $this->formatConfig(
+                    $extra->resolvedConfig(),
+                    fn (Attachment $attachment): string => $attachment->getTemporaryUrl(1440)
+                ),
+            ]),
+        ];
+    }
+
+    private function formatConfig(mixed $value, callable $formatAttachment): mixed
+    {
+        if ($value instanceof Attachment) {
+            return $formatAttachment($value);
+        }
+
+        if (! is_array($value)) {
+            return $value;
+        }
+
+        return array_map(
+            fn (mixed $item): mixed => $this->formatConfig($item, $formatAttachment),
+            $value
+        );
+    }
+}

app/Domains/Tenant/Services/WebsiteExtraService.php

@@ -10,6 +10,7 @@ use App\Domains\Tenant\Models\Tenant;
 use App\Domains\Tenant\Models\WebsiteType;
 use App\Domains\Tenant\Models\WebsiteTypeExtra;
 use Illuminate\Support\Collection;
+use Illuminate\Support\Facades\DB;
 use Illuminate\Support\Facades\Validator;
 use Illuminate\Support\Str;
 use Illuminate\Validation\ValidationException;
@@ -118,6 +119,21 @@ class WebsiteExtraService
         $tenant->unsetRelation('websiteExtras');
     }
 
+    /**
+     * Replace all configured extras for a tenant.
+     *
+     * @param  array<string, mixed>  $extras
+     */
+    public function replaceForTenant(Tenant $tenant, array $extras): void
+    {
+        DB::transaction(function () use ($tenant, $extras): void {
+            $tenant->websiteExtras()->delete();
+            $this->createForTenant($tenant, $extras);
+        });
+
+        $tenant->unsetRelation('websiteExtras');
+    }
+
     /**
      * @return Collection<int, WebsiteTypeExtra>
      */

app/Domains/Tenant/routes/adminapp.php

@@ -0,0 +1,13 @@
+<?php
+
+use App\Domains\Tenant\Controllers\AdminApp\WebsiteExtraController;
+use Illuminate\Support\Facades\Route;
+
+Route::prefix('v1/adminapp/tenant')
+    ->middleware(['auth:sanctum', 'adminapp.tenant'])
+    ->group(function (): void {
+        Route::get('website-extras', [WebsiteExtraController::class, 'show'])
+            ->name('adminapp.tenant.website-extras.show');
+        Route::put('website-extras', [WebsiteExtraController::class, 'update'])
+            ->name('adminapp.tenant.website-extras.update');
+    });

app/Domains/Tenant/routes/api.php

@@ -8,3 +8,5 @@ Route::get('tenants/bootstrap/{dominio}', BootstrapTenantController::class)
     ->where('dominio', '.*');
 
 Route::apiResource('tenants', TenantController::class);
+
+require __DIR__.'/adminapp.php';

app/Http/Middleware/EnsureAdminAppTenant.php

@@ -0,0 +1,30 @@
+<?php
+
+namespace App\Http\Middleware;
+
+use App\Domains\Authorization\Enums\RoleCode;
+use Closure;
+use Illuminate\Auth\Access\AuthorizationException;
+use Illuminate\Http\Request;
+use Symfony\Component\HttpFoundation\Response;
+
+class EnsureAdminAppTenant
+{
+    /**
+     * Ensure the authenticated user is an AdminApp user bound to a tenant.
+     */
+    public function handle(Request $request, Closure $next): Response
+    {
+        $user = $request->user();
+
+        if (
+            ! $user
+            || $user->rol_codigo !== RoleCode::AdminApp->value
+            || ! $user->tenant_codigo
+        ) {
+            throw new AuthorizationException;
+        }
+
+        return $next($request);
+    }
+}

bootstrap/app.php

@@ -2,6 +2,7 @@
 
 use App\Domains\Auth\Exceptions\AccountLockedException;
 use App\Domains\Ticket\Exceptions\TicketNotAvailableException;
+use App\Http\Middleware\EnsureAdminAppTenant;
 use App\Http\Middleware\SetApiLocale;
 use Illuminate\Auth\Access\AuthorizationException;
 use Illuminate\Auth\AuthenticationException;
@@ -21,6 +22,9 @@ return Application::configure(basePath: dirname(__DIR__))
         health: '/up',
     )
     ->withMiddleware(function (Middleware $middleware): void {
+        $middleware->alias([
+            'adminapp.tenant' => EnsureAdminAppTenant::class,
+        ]);
         $middleware->encryptCookies(except: [
             'guest_token',
         ]);

database/migrations/2026_07_28_000100_add_role_and_tenant_codes_to_users_table.php

@@ -1,5 +1,6 @@
 <?php
 
+use App\Domains\Authorization\Enums\RoleCode;
 use Illuminate\Database\Migrations\Migration;
 use Illuminate\Database\Schema\Blueprint;
 use Illuminate\Support\Facades\DB;
@@ -13,21 +14,14 @@ return new class extends Migration
 
         DB::table('roles')->insertOrIgnore([
             [
-                'codigo' => 'admin',
+                'codigo' => RoleCode::Admin->value,
                 'nombre' => 'Administrador general',
                 'descripcion' => 'Administra la plataforma y todos sus tenants.',
                 'created_at' => $now,
                 'updated_at' => $now,
             ],
             [
-                'codigo' => 'tenant_admin',
+                'codigo' => RoleCode::User->value,
-                'nombre' => 'Administrador del tenant',
-                'descripcion' => 'Administra la operación de su propio tenant.',
-                'created_at' => $now,
-                'updated_at' => $now,
-            ],
-            [
-                'codigo' => 'user',
                 'nombre' => 'Usuario',
                 'descripcion' => 'Cliente final limitado a sus propios datos y operaciones.',
                 'created_at' => $now,
@@ -36,7 +30,7 @@ return new class extends Migration
         ]);
 
         Schema::table('users', function (Blueprint $table): void {
-            $table->string('rol_codigo')->default('user')->after('id');
+            $table->string('rol_codigo')->default(RoleCode::User->value)->after('id');
             $table->string('tenant_codigo')->nullable()->after('rol_codigo');
 
             $table->foreign('rol_codigo')

database/migrations/2026_07_30_000000_create_menues_roles_table.php

@@ -8,7 +8,7 @@ return new class extends Migration
 {
     public function up(): void
     {
-        Schema::create('menues_roles', function (Blueprint $table): void {
+        Schema::create('roles_menues', function (Blueprint $table): void {
             $table->id();
             $table->string('rol_codigo');
             $table->string('menu_codigo');
@@ -30,6 +30,6 @@ return new class extends Migration
 
     public function down(): void
     {
-        Schema::dropIfExists('menues_roles');
+        Schema::dropIfExists('roles_menues');
     }
 };

database/migrations/2026_07_31_000000_remove_tenant_admin_role.php

@@ -0,0 +1,35 @@
+<?php
+
+use App\Domains\Authorization\Enums\RoleCode;
+use Illuminate\Database\Migrations\Migration;
+use Illuminate\Support\Facades\DB;
+
+return new class extends Migration
+{
+    private const REMOVED_ROLE_CODE = 'tenant_admin';
+
+    public function up(): void
+    {
+        DB::table('users')
+            ->where('rol_codigo', self::REMOVED_ROLE_CODE)
+            ->update([
+                'rol_codigo' => RoleCode::User->value,
+                'tenant_codigo' => null,
+            ]);
+
+        DB::table('roles')
+            ->where('codigo', self::REMOVED_ROLE_CODE)
+            ->delete();
+    }
+
+    public function down(): void
+    {
+        DB::table('roles')->insertOrIgnore([
+            'codigo' => self::REMOVED_ROLE_CODE,
+            'nombre' => 'Administrador del tenant',
+            'descripcion' => 'Administra la operación de su propio tenant.',
+            'created_at' => now(),
+            'updated_at' => now(),
+        ]);
+    }
+};

database/migrations/2026_07_31_000100_rename_menues_roles_table.php

@@ -0,0 +1,21 @@
+<?php
+
+use Illuminate\Database\Migrations\Migration;
+use Illuminate\Support\Facades\Schema;
+
+return new class extends Migration
+{
+    public function up(): void
+    {
+        if (Schema::hasTable('menues_roles') && ! Schema::hasTable('roles_menues')) {
+            Schema::rename('menues_roles', 'roles_menues');
+        }
+    }
+
+    public function down(): void
+    {
+        if (Schema::hasTable('roles_menues') && ! Schema::hasTable('menues_roles')) {
+            Schema::rename('roles_menues', 'menues_roles');
+        }
+    }
+};

database/seeders/AuthorizationSeeder.php

@@ -2,6 +2,7 @@
 
 namespace Database\Seeders;
 
+use App\Domains\Authorization\Enums\RoleCode;
 use App\Domains\Authorization\Models\Permission;
 use App\Domains\Authorization\Models\Role;
 use Illuminate\Database\Seeder;
@@ -106,44 +107,17 @@ class AuthorizationSeeder extends Seeder
      * @var array<string, array{nombre: string, descripcion: string, permisos: list<string>}>
      */
     private const ROLES = [
-        'admin' => [
+        RoleCode::Admin->value => [
             'nombre' => 'Administrador general',
             'descripcion' => 'Administra la plataforma y todos sus tenants.',
             'permisos' => [],
         ],
-        'adminapp' => [
+        RoleCode::AdminApp->value => [
             'nombre' => 'Administrador de la aplicación',
             'descripcion' => 'Accede a los menús administrativos de la aplicación.',
             'permisos' => [],
         ],
-        'tenant_admin' => [
+        RoleCode::User->value => [
-            'nombre' => 'Administrador del tenant',
-            'descripcion' => 'Administra la operación de su propio tenant.',
-            'permisos' => [
-                'tenant.ver',
-                'tenant.editar',
-                'usuarios.ver',
-                'usuarios.gestionar',
-                'roles.ver',
-                'catalogo.ver',
-                'catalogo.gestionar',
-                'inventario.ver',
-                'inventario.ajustar',
-                'pedidos.ver',
-                'pedidos.gestionar',
-                'pedidos.cancelar',
-                'pagos.ver',
-                'pagos.gestionar',
-                'tickets.ver',
-                'tickets.gestionar',
-                'contenido.gestionar',
-                'integraciones.ver',
-                'integraciones.gestionar',
-                'reportes.ver',
-                'reportes.exportar',
-            ],
-        ],
-        'user' => [
             'nombre' => 'Usuario',
             'descripcion' => 'Cliente final limitado a sus propios datos y operaciones.',
             'permisos' => [],
@@ -168,7 +142,7 @@ class AuthorizationSeeder extends Seeder
                 ]
             );
 
-            $permissionCodes = $code === 'admin'
+            $permissionCodes = $code === RoleCode::Admin->value
                 ? array_keys(self::PERMISSIONS)
                 : $attributes['permisos'];
 

database/seeders/MenuSeeder.php

@@ -2,6 +2,7 @@
 
 namespace Database\Seeders;
 
+use App\Domains\Authorization\Enums\RoleCode;
 use App\Domains\Authorization\Models\Role;
 use App\Domains\Menu\Models\Menu;
 use App\Domains\Tenant\Models\Tenant;
@@ -140,11 +141,11 @@ class MenuSeeder extends Seeder
             ->pluck('code');
 
         Role::query()
-            ->whereIn('codigo', ['admin', 'adminapp'])
+            ->whereIn('codigo', [RoleCode::Admin->value, RoleCode::AdminApp->value])
             ->each(fn (Role $role) => $role->menus()->sync($allRoleMenuCodes));
 
         Role::query()
-            ->where('codigo', 'user')
+            ->where('codigo', RoleCode::User->value)
             ->each(fn (Role $role) => $role->menus()->sync($userMenuCodes));
 
         $tenants = Tenant::all();

tests/Feature/Auth/UserAuthorizationRelationsTest.php

@@ -2,14 +2,10 @@
 
 namespace Tests\Feature\Auth;
 
-use App\Domains\Attachable\Enums\AttachmentType;
-use App\Domains\Attachable\Models\Attachment;
 use App\Domains\Auth\Models\User;
-use App\Domains\Authorization\Models\Role;
+use App\Domains\Authorization\Enums\RoleCode;
-use App\Domains\Tenant\Models\Tenant;
 use Illuminate\Foundation\Testing\RefreshDatabase;
 use Illuminate\Support\Facades\Schema;
-use LogicException;
 use Tests\TestCase;
 
 class UserAuthorizationRelationsTest extends TestCase
@@ -28,79 +24,9 @@ class UserAuthorizationRelationsTest extends TestCase
     {
         $user = User::factory()->create();
 
-        $this->assertSame('user', $user->rol_codigo);
+        $this->assertSame(RoleCode::User->value, $user->rol_codigo);
         $this->assertNull($user->tenant_codigo);
-        $this->assertSame('user', $user->role->codigo);
+        $this->assertSame(RoleCode::User->value, $user->role->codigo);
         $this->assertNull($user->tenant);
     }
-
-    public function test_a_tenant_admin_belongs_to_its_role_and_tenant(): void
-    {
-        $tenant = $this->createTenant();
-        $user = User::factory()->create([
-            'rol_codigo' => 'tenant_admin',
-            'tenant_codigo' => $tenant->codigo,
-        ]);
-
-        $this->assertSame('tenant_admin', $user->role->codigo);
-        $this->assertTrue($user->tenant->is($tenant));
-        $this->assertTrue(
-            Role::query()
-                ->where('codigo', 'tenant_admin')
-                ->firstOrFail()
-                ->users
-                ->contains($user)
-        );
-    }
-
-    public function test_only_a_tenant_admin_can_have_a_tenant_code(): void
-    {
-        $tenant = $this->createTenant();
-
-        $this->expectException(LogicException::class);
-
-        User::factory()->create([
-            'rol_codigo' => 'user',
-            'tenant_codigo' => $tenant->codigo,
-        ]);
-    }
-
-    public function test_a_tenant_admin_must_have_a_tenant_code(): void
-    {
-        $this->expectException(LogicException::class);
-
-        User::factory()->create([
-            'rol_codigo' => 'tenant_admin',
-        ]);
-    }
-
-    private function createTenant(): Tenant
-    {
-        $headerLogo = $this->createAttachment('header.png');
-        $footerLogo = $this->createAttachment('footer.png');
-
-        return Tenant::query()->create([
-            'codigo' => 'acme',
-            'nombre' => 'Acme',
-            'dominio' => 'acme.test',
-            'primary_color' => '#111111',
-            'secondary_color' => '#222222',
-            'danger_color' => '#333333',
-            'success_color' => '#444444',
-            'header_bg_color' => '#ffffff',
-            'footer_bg_color' => '#ffffff',
-            'header_logo_id' => $headerLogo->id,
-            'footer_logo_id' => $footerLogo->id,
-        ]);
-    }
-
-    private function createAttachment(string $filename): Attachment
-    {
-        return Attachment::query()->create([
-            'path' => "test/{$filename}",
-            'filename' => $filename,
-            'type' => AttachmentType::Image,
-            'mime_type' => 'image/png',
-        ]);
-    }
 }

tests/Feature/Seeders/AuthorizationSeederTest.php

@@ -2,6 +2,7 @@
 
 namespace Tests\Feature\Seeders;
 
+use App\Domains\Authorization\Enums\RoleCode;
 use App\Domains\Authorization\Models\Permission;
 use App\Domains\Authorization\Models\Role;
 use Database\Seeders\AuthorizationSeeder;
@@ -17,7 +18,11 @@ class AuthorizationSeederTest extends TestCase
         $this->seed(AuthorizationSeeder::class);
 
         $this->assertSame(
-            ['admin', 'adminapp', 'tenant_admin', 'user'],
+            [
+                RoleCode::Admin->value,
+                RoleCode::AdminApp->value,
+                RoleCode::User->value,
+            ],
             Role::query()->orderBy('codigo')->pluck('codigo')->all()
         );
         $this->assertCount(22, Permission::query()->get());
@@ -27,15 +32,12 @@ class AuthorizationSeederTest extends TestCase
     {
         $this->seed(AuthorizationSeeder::class);
 
-        $admin = Role::query()->where('codigo', 'admin')->firstOrFail();
+        $admin = Role::query()->where('codigo', RoleCode::Admin->value)->firstOrFail();
-        $appAdmin = Role::query()->where('codigo', 'adminapp')->firstOrFail();
+        $appAdmin = Role::query()->where('codigo', RoleCode::AdminApp->value)->firstOrFail();
-        $tenantAdmin = Role::query()->where('codigo', 'tenant_admin')->firstOrFail();
+        $user = Role::query()->where('codigo', RoleCode::User->value)->firstOrFail();
-        $user = Role::query()->where('codigo', 'user')->firstOrFail();
 
         $this->assertCount(22, $admin->permissions);
         $this->assertCount(0, $appAdmin->permissions);
-        $this->assertCount(21, $tenantAdmin->permissions);
-        $this->assertFalse($tenantAdmin->permissions->contains('codigo', 'roles.gestionar'));
         $this->assertCount(0, $user->permissions);
     }
 
@@ -44,8 +46,8 @@ class AuthorizationSeederTest extends TestCase
         $this->seed(AuthorizationSeeder::class);
         $this->seed(AuthorizationSeeder::class);
 
-        $this->assertCount(4, Role::query()->get());
+        $this->assertCount(3, Role::query()->get());
         $this->assertCount(22, Permission::query()->get());
-        $this->assertDatabaseCount('roles_permisos', 43);
+        $this->assertDatabaseCount('roles_permisos', 22);
     }
 }

tests/Feature/Seeders/MenuSeederTest.php

@@ -4,6 +4,7 @@ namespace Tests\Feature\Seeders;
 
 use App\Domains\Attachable\Enums\AttachmentType;
 use App\Domains\Attachable\Models\Attachment;
+use App\Domains\Authorization\Enums\RoleCode;
 use App\Domains\Authorization\Models\Role;
 use App\Domains\Menu\Models\Menu;
 use App\Domains\Tenant\Models\Tenant;
@@ -62,7 +63,7 @@ class MenuSeederTest extends TestCase
             ->pluck('code')
             ->all();
 
-        foreach (['admin', 'adminapp'] as $roleCode) {
+        foreach ([RoleCode::Admin->value, RoleCode::AdminApp->value] as $roleCode) {
             $roleMenuCodes = Role::query()
                 ->where('codigo', $roleCode)
                 ->firstOrFail()
@@ -75,7 +76,7 @@ class MenuSeederTest extends TestCase
         }
 
         $userRoleMenuCodes = Role::query()
-            ->where('codigo', 'user')
+            ->where('codigo', RoleCode::User->value)
             ->firstOrFail()
             ->menus()
             ->orderBy('menues.code')
@@ -84,7 +85,7 @@ class MenuSeederTest extends TestCase
 
         $this->assertSame($userMenuCodes, $userRoleMenuCodes);
         $this->assertDatabaseCount(
-            'menues_roles',
+            'roles_menues',
             (count($allMenuCodes) * 2) + count($userMenuCodes)
         );
     }

tests/Feature/Tenant/AdminAppWebsiteExtraControllerTest.php

@@ -0,0 +1,155 @@
+<?php
+
+namespace Tests\Feature\Tenant;
+
+use App\Domains\Auth\Models\User;
+use App\Domains\Authorization\Enums\RoleCode;
+use App\Domains\Tenant\Models\Tenant;
+use App\Domains\Tenant\Models\WebsiteType;
+use Database\Seeders\AuthorizationSeeder;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Laravel\Sanctum\Sanctum;
+use Tests\TestCase;
+
+class AdminAppWebsiteExtraControllerTest extends TestCase
+{
+    use RefreshDatabase;
+
+    private WebsiteType $websiteType;
+
+    protected function setUp(): void
+    {
+        parent::setUp();
+
+        $this->seed(AuthorizationSeeder::class);
+
+        $this->websiteType = WebsiteType::query()->create([
+            'codigo' => 'test-store',
+            'nombre' => 'Test Store',
+        ]);
+
+        $this->websiteType->extras()->create([
+            'nombre' => 'contactConfig',
+            'descripcion' => 'Datos de contacto visibles en la tienda.',
+            'is_required' => false,
+            'config_schema' => [
+                'request_rules' => [
+                    '$' => 'required|array',
+                    'phone' => 'required|string|max:30',
+                ],
+                'transforms' => [],
+                'database_rules' => [
+                    '$' => 'required|array',
+                    'phone' => 'required|string|max:30',
+                ],
+            ],
+        ]);
+    }
+
+    public function test_authentication_is_required(): void
+    {
+        $this->getJson('/api/v1/adminapp/tenant/website-extras')
+            ->assertUnauthorized();
+    }
+
+    public function test_a_customer_cannot_access_adminapp_website_extras(): void
+    {
+        $customer = User::factory()->create([
+            'rol_codigo' => RoleCode::User->value,
+            'tenant_codigo' => null,
+        ]);
+
+        Sanctum::actingAs($customer);
+
+        $this->getJson('/api/v1/adminapp/tenant/website-extras')
+            ->assertForbidden();
+    }
+
+    public function test_adminapp_user_can_read_definitions_and_current_values(): void
+    {
+        $tenant = $this->createTenant('acme');
+        $definition = $this->websiteType->extras()->firstOrFail();
+        $tenant->websiteExtras()->create([
+            'website_type_extra_id' => $definition->id,
+            'config' => ['phone' => '+54 341 555 0101'],
+        ]);
+
+        Sanctum::actingAs($this->createAdminAppUser($tenant));
+
+        $this->getJson('/api/v1/adminapp/tenant/website-extras')
+            ->assertOk()
+            ->assertJsonPath('data.website_type.codigo', 'test-store')
+            ->assertJsonPath('data.definitions.contactConfig.is_required', false)
+            ->assertJsonPath('data.extras.contactConfig.phone', '+54 341 555 0101')
+            ->assertJsonPath('data.resolved_extras.contactConfig.phone', '+54 341 555 0101');
+    }
+
+    public function test_adminapp_user_replaces_only_its_tenant_extras(): void
+    {
+        $tenant = $this->createTenant('acme');
+        $otherTenant = $this->createTenant('other');
+        $definition = $this->websiteType->extras()->firstOrFail();
+
+        $tenant->websiteExtras()->create([
+            'website_type_extra_id' => $definition->id,
+            'config' => ['phone' => 'old'],
+        ]);
+        $otherTenant->websiteExtras()->create([
+            'website_type_extra_id' => $definition->id,
+            'config' => ['phone' => 'untouched'],
+        ]);
+
+        Sanctum::actingAs($this->createAdminAppUser($tenant));
+
+        $this->putJson('/api/v1/adminapp/tenant/website-extras', [
+            'extras' => [
+                'contactConfig' => [
+                    'phone' => '+54 341 555 9999',
+                ],
+            ],
+        ])
+            ->assertOk()
+            ->assertJsonPath('data.extras.contactConfig.phone', '+54 341 555 9999');
+
+        $this->assertSame(
+            ['phone' => '+54 341 555 9999'],
+            $tenant->websiteExtras()->firstOrFail()->config
+        );
+        $this->assertSame(
+            ['phone' => 'untouched'],
+            $otherTenant->websiteExtras()->firstOrFail()->config
+        );
+    }
+
+    public function test_update_rejects_extras_not_supported_by_the_website_type(): void
+    {
+        $tenant = $this->createTenant('acme');
+        Sanctum::actingAs($this->createAdminAppUser($tenant));
+
+        $this->putJson('/api/v1/adminapp/tenant/website-extras', [
+            'extras' => [
+                'unknown' => ['enabled' => true],
+            ],
+        ])
+            ->assertUnprocessable()
+            ->assertJsonValidationErrors('extras');
+    }
+
+    private function createTenant(string $code): Tenant
+    {
+        return Tenant::query()->create([
+            'codigo' => $code,
+            'nombre' => ucfirst($code),
+            'dominio' => "{$code}.test",
+            'website_type_code' => $this->websiteType->codigo,
+        ]);
+    }
+
+    private function createAdminAppUser(Tenant $tenant): User
+    {
+        return User::factory()->create([
+            'rol_codigo' => RoleCode::AdminApp->value,
+            'tenant_codigo' => $tenant->codigo,
+        ]);
+    }
+}

tests/Feature/Tenant/BootstrapTenantControllerTest.php

@@ -4,6 +4,8 @@ namespace Tests\Feature\Tenant;
 
 use App\Domains\Attachable\Enums\AttachmentType;
 use App\Domains\Attachable\Models\Attachment;
+use App\Domains\Authorization\Enums\RoleCode;
+use App\Domains\Authorization\Models\Role;
 use App\Domains\Catalog\Models\Category;
 use App\Domains\Menu\Models\Menu;
 use App\Domains\Tenant\Models\Tenant;
@@ -145,6 +147,10 @@ class BootstrapTenantControllerTest extends TestCase
     public function test_it_returns_tenant_menus_as_a_clean_hierarchy(): void
     {
         $tenant = $this->createTenant();
+        $userRole = Role::query()->create([
+            'codigo' => RoleCode::User->value,
+            'nombre' => 'Usuario',
+        ]);
         $parent = Menu::query()->create([
             'code' => 'help',
             'label' => 'Ayuda',
@@ -181,6 +187,11 @@ class BootstrapTenantControllerTest extends TestCase
             $staticChild->code => ['static_content' => $staticContent],
             $dynamicChild->code,
         ]);
+        $userRole->menus()->sync([
+            $parent->code,
+            $staticChild->code,
+            $dynamicChild->code,
+        ]);
 
         $response = $this->getJson('/api/tenants/bootstrap/acme.com');
 
@@ -214,6 +225,38 @@ class BootstrapTenantControllerTest extends TestCase
         $this->assertArrayNotHasKey('static_content', $menus[0]['submenues'][1]);
     }
 
+    public function test_it_returns_only_menus_assigned_to_the_user_role(): void
+    {
+        $tenant = $this->createTenant();
+        $userRole = Role::query()->create([
+            'codigo' => RoleCode::User->value,
+            'nombre' => 'Usuario',
+        ]);
+        $adminRole = Role::query()->create([
+            'codigo' => RoleCode::Admin->value,
+            'nombre' => 'Administrador',
+        ]);
+        $userMenu = Menu::query()->create([
+            'code' => 'account',
+            'label' => 'Mi cuenta',
+            'route' => '/mi-cuenta',
+        ]);
+        $adminMenu = Menu::query()->create([
+            'code' => 'admin.catalog',
+            'label' => 'Catálogo',
+            'route' => '/admin/catalog',
+        ]);
+
+        $tenant->menues()->sync([$userMenu->code, $adminMenu->code]);
+        $userRole->menus()->sync([$userMenu->code]);
+        $adminRole->menus()->sync([$adminMenu->code]);
+
+        $this->getJson('/api/tenants/bootstrap/acme.com')
+            ->assertOk()
+            ->assertJsonPath('data.menues.0.code', 'account')
+            ->assertJsonMissing(['code' => 'admin.catalog']);
+    }
+
     public function test_it_rejects_duplicate_domains_after_normalization_when_storing(): void
     {
         $base64Image = 'data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAADUlEQVR42mNk+M9QDwADhgGAWjR9awAAAABJRU5ErkJggg==';