feat(authorization): implement WebsiteExtra management with controller, request, resource, service, routes, middleware, and tests

app/Domains/Auth/Models/User.php

@@ -2,22 +2,30 @@
 
 namespace App\Domains\Auth\Models;
 
+use App\Domains\Authorization\Enums\RoleCode;
+use App\Domains\Authorization\Models\Role;
+use App\Domains\Tenant\Models\Tenant;
 use Database\Factories\UserFactory;
 use Illuminate\Database\Eloquent\Attributes\Fillable;
 use Illuminate\Database\Eloquent\Attributes\Hidden;
 use Illuminate\Database\Eloquent\Factories\HasFactory;
+use Illuminate\Database\Eloquent\Relations\BelongsTo;
 use Illuminate\Database\Eloquent\Relations\HasMany;
 use Illuminate\Foundation\Auth\User as Authenticatable;
 use Illuminate\Notifications\Notifiable;
 use Laravel\Sanctum\HasApiTokens;
 
-#[Fillable(['nombre_apellido', 'email', 'password', 'dni', 'telefono', 'google_id'])]
+#[Fillable(['nombre_apellido', 'email', 'password', 'dni', 'telefono', 'google_id', 'rol_codigo', 'tenant_codigo'])]
 #[Hidden(['password', 'remember_token'])]
 class User extends Authenticatable
 {
     /** @use HasFactory<UserFactory> */
     use HasApiTokens, HasFactory, Notifiable;
 
+    protected $attributes = [
+        'rol_codigo' => RoleCode::User->value,
+    ];
+
     protected static function newFactory(): UserFactory
     {
         return UserFactory::new();
@@ -35,6 +43,22 @@ class User extends Authenticatable
         return $this->hasMany(LoginAttempt::class);
     }
 
+    /**
+     * @return BelongsTo<Role, $this>
+     */
+    public function role(): BelongsTo
+    {
+        return $this->belongsTo(Role::class, 'rol_codigo', 'codigo');
+    }
+
+    /**
+     * @return BelongsTo<Tenant, $this>
+     */
+    public function tenant(): BelongsTo
+    {
+        return $this->belongsTo(Tenant::class, 'tenant_codigo', 'codigo');
+    }
+
     /**
      * @return array<string, string>
      */

app/Domains/Auth/Resources/UserResource.php

@@ -2,11 +2,12 @@
 
 namespace App\Domains\Auth\Resources;
 
+use App\Domains\Auth\Models\User;
 use Illuminate\Http\Request;
 use Illuminate\Http\Resources\Json\JsonResource;
 
 /**
- * @mixin \App\Domains\Auth\Models\User
+ * @mixin User
  */
 class UserResource extends JsonResource
 {
@@ -21,6 +22,8 @@ class UserResource extends JsonResource
             'email' => $this->email,
             'dni' => $this->dni,
             'telefono' => $this->telefono,
+            'rol_codigo' => $this->rol_codigo,
+            'tenant_codigo' => $this->tenant_codigo,
         ];
     }
 }

app/Domains/Authorization/Enums/RoleCode.php

@@ -0,0 +1,10 @@
+<?php
+
+namespace App\Domains\Authorization\Enums;
+
+enum RoleCode: string
+{
+    case Admin = 'admin';
+    case AdminApp = 'adminapp';
+    case User = 'user';
+}

app/Domains/Authorization/Models/Permission.php

@@ -0,0 +1,32 @@
+<?php
+
+namespace App\Domains\Authorization\Models;
+
+use Illuminate\Database\Eloquent\Model;
+use Illuminate\Database\Eloquent\Relations\BelongsToMany;
+
+class Permission extends Model
+{
+    protected $table = 'permisos';
+
+    protected $fillable = [
+        'codigo',
+        'nombre',
+        'descripcion',
+    ];
+
+    /**
+     * @return BelongsToMany<Role, $this>
+     */
+    public function roles(): BelongsToMany
+    {
+        return $this->belongsToMany(
+            Role::class,
+            'roles_permisos',
+            'codigo_permiso',
+            'rol_codigo',
+            'codigo',
+            'codigo'
+        )->withTimestamps();
+    }
+}

app/Domains/Authorization/Models/Role.php

@@ -0,0 +1,59 @@
+<?php
+
+namespace App\Domains\Authorization\Models;
+
+use App\Domains\Auth\Models\User;
+use App\Domains\Menu\Models\Menu;
+use App\Domains\Menu\Models\MenuRole;
+use Illuminate\Database\Eloquent\Model;
+use Illuminate\Database\Eloquent\Relations\BelongsToMany;
+use Illuminate\Database\Eloquent\Relations\HasMany;
+
+class Role extends Model
+{
+    protected $table = 'roles';
+
+    protected $fillable = [
+        'codigo',
+        'nombre',
+        'descripcion',
+    ];
+
+    /**
+     * @return BelongsToMany<Permission, $this>
+     */
+    public function permissions(): BelongsToMany
+    {
+        return $this->belongsToMany(
+            Permission::class,
+            'roles_permisos',
+            'rol_codigo',
+            'codigo_permiso',
+            'codigo',
+            'codigo'
+        )->withTimestamps();
+    }
+
+    /**
+     * @return HasMany<User, $this>
+     */
+    public function users(): HasMany
+    {
+        return $this->hasMany(User::class, 'rol_codigo', 'codigo');
+    }
+
+    /**
+     * @return BelongsToMany<Menu, $this>
+     */
+    public function menus(): BelongsToMany
+    {
+        return $this->belongsToMany(
+            Menu::class,
+            'roles_menues',
+            'rol_codigo',
+            'menu_codigo',
+            'codigo',
+            'code'
+        )->using(MenuRole::class);
+    }
+}

app/Domains/Authorization/Models/RolePermission.php

@@ -0,0 +1,32 @@
+<?php
+
+namespace App\Domains\Authorization\Models;
+
+use Illuminate\Database\Eloquent\Model;
+use Illuminate\Database\Eloquent\Relations\BelongsTo;
+
+class RolePermission extends Model
+{
+    protected $table = 'roles_permisos';
+
+    protected $fillable = [
+        'codigo_permiso',
+        'rol_codigo',
+    ];
+
+    /**
+     * @return BelongsTo<Permission, $this>
+     */
+    public function permission(): BelongsTo
+    {
+        return $this->belongsTo(Permission::class, 'codigo_permiso', 'codigo');
+    }
+
+    /**
+     * @return BelongsTo<Role, $this>
+     */
+    public function role(): BelongsTo
+    {
+        return $this->belongsTo(Role::class, 'rol_codigo', 'codigo');
+    }
+}

app/Domains/Menu/Models/Menu.php

@@ -2,6 +2,7 @@
 
 namespace App\Domains\Menu\Models;
 
+use App\Domains\Authorization\Models\Role;
 use App\Domains\Tenant\Models\Tenant;
 use Illuminate\Database\Eloquent\Factories\HasFactory;
 use Illuminate\Database\Eloquent\Model;
@@ -78,4 +79,16 @@ class Menu extends Model
             ->withPivot('static_content')
             ->withTimestamps();
     }
+
+    public function roles(): BelongsToMany
+    {
+        return $this->belongsToMany(
+            Role::class,
+            'roles_menues',
+            'menu_codigo',
+            'rol_codigo',
+            'code',
+            'codigo'
+        )->using(MenuRole::class);
+    }
 }

app/Domains/Menu/Models/MenuRole.php

@@ -0,0 +1,31 @@
+<?php
+
+namespace App\Domains\Menu\Models;
+
+use App\Domains\Authorization\Models\Role;
+use Illuminate\Database\Eloquent\Relations\BelongsTo;
+use Illuminate\Database\Eloquent\Relations\Pivot;
+
+class MenuRole extends Pivot
+{
+    protected $table = 'roles_menues';
+
+    public $incrementing = true;
+
+    public $timestamps = false;
+
+    protected $fillable = [
+        'rol_codigo',
+        'menu_codigo',
+    ];
+
+    public function role(): BelongsTo
+    {
+        return $this->belongsTo(Role::class, 'rol_codigo', 'codigo');
+    }
+
+    public function menu(): BelongsTo
+    {
+        return $this->belongsTo(Menu::class, 'menu_codigo', 'code');
+    }
+}

app/Domains/Tenant/Controllers/AdminApp/WebsiteExtraController.php

@@ -0,0 +1,50 @@
+<?php
+
+namespace App\Domains\Tenant\Controllers\AdminApp;
+
+use App\Domains\Auth\Models\User;
+use App\Domains\Tenant\Models\Tenant;
+use App\Domains\Tenant\Requests\AdminApp\UpdateWebsiteExtrasRequest;
+use App\Domains\Tenant\Resources\AdminApp\WebsiteExtrasResource;
+use App\Domains\Tenant\Services\TenantInformationService;
+use App\Domains\Tenant\Services\WebsiteExtraService;
+use App\Http\Controllers\Controller;
+use Illuminate\Http\Request;
+
+class WebsiteExtraController extends Controller
+{
+    public function __construct(
+        protected WebsiteExtraService $websiteExtraService,
+        protected TenantInformationService $tenantInformationService,
+    ) {}
+
+    public function show(Request $request): WebsiteExtrasResource
+    {
+        return WebsiteExtrasResource::make(
+            $this->loadTenant($request->user())
+        );
+    }
+
+    public function update(UpdateWebsiteExtrasRequest $request): WebsiteExtrasResource
+    {
+        $tenant = $request->user()->tenant()->firstOrFail();
+
+        $this->websiteExtraService->replaceForTenant(
+            $tenant,
+            $request->validated('extras', [])
+        );
+
+        return WebsiteExtrasResource::make(
+            $this->loadTenant($request->user())
+        );
+    }
+
+    private function loadTenant(User $user): Tenant
+    {
+        $tenant = $user->tenant()->firstOrFail();
+
+        return $this->tenantInformationService->load($tenant, [
+            'websiteType.extras',
+        ]);
+    }
+}

app/Domains/Tenant/Controllers/BootstrapTenantController.php

@@ -2,6 +2,7 @@
 
 namespace App\Domains\Tenant\Controllers;
 
+use App\Domains\Authorization\Enums\RoleCode;
 use App\Domains\Tenant\Models\Tenant;
 use App\Domains\Tenant\Requests\BootstrapTenantRequest;
 use App\Domains\Tenant\Resources\TenantResource;
@@ -25,7 +26,10 @@ class BootstrapTenantController extends Controller
                     ->where('dominio', $dominio)
                     ->firstOrFail(),
                 [
-                    'menues',
+                    'menues' => fn ($query) => $query->whereHas(
+                        'roles',
+                        fn ($query) => $query->where('codigo', RoleCode::User->value)
+                    ),
                     'categories' => fn ($query) => $query->orderBy('nombre'),
                 ]
             )

app/Domains/Tenant/Requests/AdminApp/UpdateWebsiteExtrasRequest.php

@@ -0,0 +1,24 @@
+<?php
+
+namespace App\Domains\Tenant\Requests\AdminApp;
+
+use App\Domains\Tenant\Services\WebsiteExtraService;
+use Illuminate\Foundation\Http\FormRequest;
+
+class UpdateWebsiteExtrasRequest extends FormRequest
+{
+    public function authorize(): bool
+    {
+        return true;
+    }
+
+    /**
+     * @return array<string, mixed>
+     */
+    public function rules(): array
+    {
+        return app(WebsiteExtraService::class)->requestRules(
+            $this->user()?->tenant?->website_type_code
+        );
+    }
+}

app/Domains/Tenant/Resources/AdminApp/WebsiteExtrasResource.php

@@ -0,0 +1,67 @@
+<?php
+
+namespace App\Domains\Tenant\Resources\AdminApp;
+
+use App\Domains\Attachable\Models\Attachment;
+use App\Domains\Tenant\Models\Tenant;
+use Illuminate\Http\Request;
+use Illuminate\Http\Resources\Json\JsonResource;
+
+/**
+ * @mixin Tenant
+ */
+class WebsiteExtrasResource extends JsonResource
+{
+    /**
+     * @return array<string, mixed>
+     */
+    public function toArray(Request $request): array
+    {
+        $websiteExtras = $this->websiteExtras->keyBy(
+            fn ($extra) => $extra->websiteTypeExtra->nombre
+        );
+
+        return [
+            'website_type' => $this->websiteType ? [
+                'codigo' => $this->websiteType->codigo,
+                'nombre' => $this->websiteType->nombre,
+            ] : null,
+            'definitions' => $this->websiteType?->extras
+                ->mapWithKeys(fn ($definition) => [
+                    $definition->nombre => [
+                        'descripcion' => $definition->descripcion,
+                        'is_required' => $definition->is_required,
+                        'request_rules' => $definition->config_schema['request_rules'] ?? [],
+                    ],
+                ]) ?? [],
+            'extras' => $websiteExtras->mapWithKeys(fn ($extra) => [
+                $extra->websiteTypeExtra->nombre => $this->formatConfig(
+                    $extra->resolvedConfig(),
+                    fn (Attachment $attachment): string => $attachment->key
+                ),
+            ]),
+            'resolved_extras' => $websiteExtras->mapWithKeys(fn ($extra) => [
+                $extra->websiteTypeExtra->nombre => $this->formatConfig(
+                    $extra->resolvedConfig(),
+                    fn (Attachment $attachment): string => $attachment->getTemporaryUrl(1440)
+                ),
+            ]),
+        ];
+    }
+
+    private function formatConfig(mixed $value, callable $formatAttachment): mixed
+    {
+        if ($value instanceof Attachment) {
+            return $formatAttachment($value);
+        }
+
+        if (! is_array($value)) {
+            return $value;
+        }
+
+        return array_map(
+            fn (mixed $item): mixed => $this->formatConfig($item, $formatAttachment),
+            $value
+        );
+    }
+}

app/Domains/Tenant/Services/WebsiteExtraService.php

@@ -10,6 +10,7 @@ use App\Domains\Tenant\Models\Tenant;
 use App\Domains\Tenant\Models\WebsiteType;
 use App\Domains\Tenant\Models\WebsiteTypeExtra;
 use Illuminate\Support\Collection;
+use Illuminate\Support\Facades\DB;
 use Illuminate\Support\Facades\Validator;
 use Illuminate\Support\Str;
 use Illuminate\Validation\ValidationException;
@@ -118,6 +119,21 @@ class WebsiteExtraService
         $tenant->unsetRelation('websiteExtras');
     }
 
+    /**
+     * Replace all configured extras for a tenant.
+     *
+     * @param  array<string, mixed>  $extras
+     */
+    public function replaceForTenant(Tenant $tenant, array $extras): void
+    {
+        DB::transaction(function () use ($tenant, $extras): void {
+            $tenant->websiteExtras()->delete();
+            $this->createForTenant($tenant, $extras);
+        });
+
+        $tenant->unsetRelation('websiteExtras');
+    }
+
     /**
      * @return Collection<int, WebsiteTypeExtra>
      */

app/Domains/Tenant/routes/adminapp.php

@@ -0,0 +1,13 @@
+<?php
+
+use App\Domains\Tenant\Controllers\AdminApp\WebsiteExtraController;
+use Illuminate\Support\Facades\Route;
+
+Route::prefix('v1/adminapp/tenant')
+    ->middleware(['auth:sanctum', 'adminapp.tenant'])
+    ->group(function (): void {
+        Route::get('website-extras', [WebsiteExtraController::class, 'show'])
+            ->name('adminapp.tenant.website-extras.show');
+        Route::put('website-extras', [WebsiteExtraController::class, 'update'])
+            ->name('adminapp.tenant.website-extras.update');
+    });

app/Domains/Tenant/routes/api.php

@@ -8,3 +8,5 @@ Route::get('tenants/bootstrap/{dominio}', BootstrapTenantController::class)
     ->where('dominio', '.*');
 
 Route::apiResource('tenants', TenantController::class);
+
+require __DIR__.'/adminapp.php';

app/Http/Middleware/EnsureAdminAppTenant.php

@@ -0,0 +1,30 @@
+<?php
+
+namespace App\Http\Middleware;
+
+use App\Domains\Authorization\Enums\RoleCode;
+use Closure;
+use Illuminate\Auth\Access\AuthorizationException;
+use Illuminate\Http\Request;
+use Symfony\Component\HttpFoundation\Response;
+
+class EnsureAdminAppTenant
+{
+    /**
+     * Ensure the authenticated user is an AdminApp user bound to a tenant.
+     */
+    public function handle(Request $request, Closure $next): Response
+    {
+        $user = $request->user();
+
+        if (
+            ! $user
+            || $user->rol_codigo !== RoleCode::AdminApp->value
+            || ! $user->tenant_codigo
+        ) {
+            throw new AuthorizationException;
+        }
+
+        return $next($request);
+    }
+}

bootstrap/app.php

@@ -2,6 +2,7 @@
 
 use App\Domains\Auth\Exceptions\AccountLockedException;
 use App\Domains\Ticket\Exceptions\TicketNotAvailableException;
+use App\Http\Middleware\EnsureAdminAppTenant;
 use App\Http\Middleware\SetApiLocale;
 use Illuminate\Auth\Access\AuthorizationException;
 use Illuminate\Auth\AuthenticationException;
@@ -21,6 +22,9 @@ return Application::configure(basePath: dirname(__DIR__))
         health: '/up',
     )
     ->withMiddleware(function (Middleware $middleware): void {
+        $middleware->alias([
+            'adminapp.tenant' => EnsureAdminAppTenant::class,
+        ]);
         $middleware->encryptCookies(except: [
             'guest_token',
         ]);

database/migrations/2026_07_28_000000_create_roles_and_permissions_tables.php

@@ -0,0 +1,53 @@
+<?php
+
+use Illuminate\Database\Migrations\Migration;
+use Illuminate\Database\Schema\Blueprint;
+use Illuminate\Support\Facades\Schema;
+
+return new class extends Migration
+{
+    public function up(): void
+    {
+        Schema::create('permisos', function (Blueprint $table): void {
+            $table->id();
+            $table->string('codigo')->unique();
+            $table->string('nombre');
+            $table->text('descripcion')->nullable();
+            $table->timestamps();
+        });
+
+        Schema::create('roles', function (Blueprint $table): void {
+            $table->id();
+            $table->string('codigo')->unique();
+            $table->string('nombre');
+            $table->text('descripcion')->nullable();
+            $table->timestamps();
+        });
+
+        Schema::create('roles_permisos', function (Blueprint $table): void {
+            $table->id();
+            $table->string('codigo_permiso');
+            $table->string('rol_codigo');
+            $table->timestamps();
+
+            $table->foreign('codigo_permiso')
+                ->references('codigo')
+                ->on('permisos')
+                ->cascadeOnUpdate()
+                ->cascadeOnDelete();
+            $table->foreign('rol_codigo')
+                ->references('codigo')
+                ->on('roles')
+                ->cascadeOnUpdate()
+                ->cascadeOnDelete();
+            $table->unique(['rol_codigo', 'codigo_permiso']);
+        });
+    }
+
+    public function down(): void
+    {
+        Schema::dropIfExists('roles_permisos');
+        Schema::dropIfExists('roles');
+        Schema::dropIfExists('permisos');
+    }
+};

database/migrations/2026_07_28_000100_add_role_and_tenant_codes_to_users_table.php

@@ -0,0 +1,57 @@
+<?php
+
+use App\Domains\Authorization\Enums\RoleCode;
+use Illuminate\Database\Migrations\Migration;
+use Illuminate\Database\Schema\Blueprint;
+use Illuminate\Support\Facades\DB;
+use Illuminate\Support\Facades\Schema;
+
+return new class extends Migration
+{
+    public function up(): void
+    {
+        $now = now();
+
+        DB::table('roles')->insertOrIgnore([
+            [
+                'codigo' => RoleCode::Admin->value,
+                'nombre' => 'Administrador general',
+                'descripcion' => 'Administra la plataforma y todos sus tenants.',
+                'created_at' => $now,
+                'updated_at' => $now,
+            ],
+            [
+                'codigo' => RoleCode::User->value,
+                'nombre' => 'Usuario',
+                'descripcion' => 'Cliente final limitado a sus propios datos y operaciones.',
+                'created_at' => $now,
+                'updated_at' => $now,
+            ],
+        ]);
+
+        Schema::table('users', function (Blueprint $table): void {
+            $table->string('rol_codigo')->default(RoleCode::User->value)->after('id');
+            $table->string('tenant_codigo')->nullable()->after('rol_codigo');
+
+            $table->foreign('rol_codigo')
+                ->references('codigo')
+                ->on('roles')
+                ->cascadeOnUpdate()
+                ->restrictOnDelete();
+            $table->foreign('tenant_codigo')
+                ->references('codigo')
+                ->on('tenants')
+                ->cascadeOnUpdate()
+                ->restrictOnDelete();
+        });
+    }
+
+    public function down(): void
+    {
+        Schema::table('users', function (Blueprint $table): void {
+            $table->dropForeign(['tenant_codigo']);
+            $table->dropForeign(['rol_codigo']);
+            $table->dropColumn(['tenant_codigo', 'rol_codigo']);
+        });
+    }
+};

database/migrations/2026_07_30_000000_create_menues_roles_table.php

@@ -0,0 +1,35 @@
+<?php
+
+use Illuminate\Database\Migrations\Migration;
+use Illuminate\Database\Schema\Blueprint;
+use Illuminate\Support\Facades\Schema;
+
+return new class extends Migration
+{
+    public function up(): void
+    {
+        Schema::create('roles_menues', function (Blueprint $table): void {
+            $table->id();
+            $table->string('rol_codigo');
+            $table->string('menu_codigo');
+
+            $table->foreign('rol_codigo')
+                ->references('codigo')
+                ->on('roles')
+                ->cascadeOnUpdate()
+                ->cascadeOnDelete();
+            $table->foreign('menu_codigo')
+                ->references('code')
+                ->on('menues')
+                ->cascadeOnUpdate()
+                ->cascadeOnDelete();
+
+            $table->unique(['rol_codigo', 'menu_codigo']);
+        });
+    }
+
+    public function down(): void
+    {
+        Schema::dropIfExists('roles_menues');
+    }
+};

database/migrations/2026_07_31_000000_remove_tenant_admin_role.php

@@ -0,0 +1,35 @@
+<?php
+
+use App\Domains\Authorization\Enums\RoleCode;
+use Illuminate\Database\Migrations\Migration;
+use Illuminate\Support\Facades\DB;
+
+return new class extends Migration
+{
+    private const REMOVED_ROLE_CODE = 'tenant_admin';
+
+    public function up(): void
+    {
+        DB::table('users')
+            ->where('rol_codigo', self::REMOVED_ROLE_CODE)
+            ->update([
+                'rol_codigo' => RoleCode::User->value,
+                'tenant_codigo' => null,
+            ]);
+
+        DB::table('roles')
+            ->where('codigo', self::REMOVED_ROLE_CODE)
+            ->delete();
+    }
+
+    public function down(): void
+    {
+        DB::table('roles')->insertOrIgnore([
+            'codigo' => self::REMOVED_ROLE_CODE,
+            'nombre' => 'Administrador del tenant',
+            'descripcion' => 'Administra la operación de su propio tenant.',
+            'created_at' => now(),
+            'updated_at' => now(),
+        ]);
+    }
+};

database/migrations/2026_07_31_000100_rename_menues_roles_table.php

@@ -0,0 +1,21 @@
+<?php
+
+use Illuminate\Database\Migrations\Migration;
+use Illuminate\Support\Facades\Schema;
+
+return new class extends Migration
+{
+    public function up(): void
+    {
+        if (Schema::hasTable('menues_roles') && ! Schema::hasTable('roles_menues')) {
+            Schema::rename('menues_roles', 'roles_menues');
+        }
+    }
+
+    public function down(): void
+    {
+        if (Schema::hasTable('roles_menues') && ! Schema::hasTable('menues_roles')) {
+            Schema::rename('roles_menues', 'menues_roles');
+        }
+    }
+};

database/seeders/AuthorizationSeeder.php

@@ -0,0 +1,152 @@
+<?php
+
+namespace Database\Seeders;
+
+use App\Domains\Authorization\Enums\RoleCode;
+use App\Domains\Authorization\Models\Permission;
+use App\Domains\Authorization\Models\Role;
+use Illuminate\Database\Seeder;
+
+class AuthorizationSeeder extends Seeder
+{
+    /**
+     * @var array<string, array{nombre: string, descripcion: string}>
+     */
+    private const PERMISSIONS = [
+        'tenant.ver' => [
+            'nombre' => 'Ver configuración del tenant',
+            'descripcion' => 'Permite consultar la configuración general de un tenant.',
+        ],
+        'tenant.editar' => [
+            'nombre' => 'Editar configuración del tenant',
+            'descripcion' => 'Permite modificar los datos generales, dominio, colores y recursos visuales del tenant.',
+        ],
+        'usuarios.ver' => [
+            'nombre' => 'Ver usuarios',
+            'descripcion' => 'Permite consultar los usuarios asociados al tenant.',
+        ],
+        'usuarios.gestionar' => [
+            'nombre' => 'Gestionar usuarios',
+            'descripcion' => 'Permite invitar, editar, desactivar y asignar roles permitidos a los usuarios del tenant.',
+        ],
+        'roles.ver' => [
+            'nombre' => 'Ver roles',
+            'descripcion' => 'Permite consultar los roles y sus permisos.',
+        ],
+        'roles.gestionar' => [
+            'nombre' => 'Gestionar roles',
+            'descripcion' => 'Permite crear, modificar y asignar permisos a roles.',
+        ],
+        'catalogo.ver' => [
+            'nombre' => 'Ver catálogo',
+            'descripcion' => 'Permite consultar administrativamente productos, variantes, categorías, marcas y bundles.',
+        ],
+        'catalogo.gestionar' => [
+            'nombre' => 'Gestionar catálogo',
+            'descripcion' => 'Permite crear, modificar, archivar y eliminar productos, variantes, categorías, marcas y bundles.',
+        ],
+        'inventario.ver' => [
+            'nombre' => 'Ver inventario',
+            'descripcion' => 'Permite consultar el stock y la información de inventario.',
+        ],
+        'inventario.ajustar' => [
+            'nombre' => 'Ajustar inventario',
+            'descripcion' => 'Permite modificar el stock disponible.',
+        ],
+        'pedidos.ver' => [
+            'nombre' => 'Ver pedidos',
+            'descripcion' => 'Permite consultar los pedidos del tenant.',
+        ],
+        'pedidos.gestionar' => [
+            'nombre' => 'Gestionar pedidos',
+            'descripcion' => 'Permite modificar estados y datos operativos de los pedidos.',
+        ],
+        'pedidos.cancelar' => [
+            'nombre' => 'Cancelar pedidos',
+            'descripcion' => 'Permite cancelar pedidos y liberar sus reservas de inventario.',
+        ],
+        'pagos.ver' => [
+            'nombre' => 'Ver pagos',
+            'descripcion' => 'Permite consultar el estado y la información de los pagos.',
+        ],
+        'pagos.gestionar' => [
+            'nombre' => 'Gestionar pagos',
+            'descripcion' => 'Permite confirmar, rechazar o devolver pagos.',
+        ],
+        'tickets.ver' => [
+            'nombre' => 'Ver tickets',
+            'descripcion' => 'Permite consultar los tickets emitidos.',
+        ],
+        'tickets.gestionar' => [
+            'nombre' => 'Gestionar tickets',
+            'descripcion' => 'Permite emitir, invalidar o regenerar tickets.',
+        ],
+        'contenido.gestionar' => [
+            'nombre' => 'Gestionar contenido',
+            'descripcion' => 'Permite administrar menús, carruseles, destacados y redes sociales.',
+        ],
+        'integraciones.ver' => [
+            'nombre' => 'Ver integraciones',
+            'descripcion' => 'Permite consultar la configuración y el estado de las integraciones.',
+        ],
+        'integraciones.gestionar' => [
+            'nombre' => 'Gestionar integraciones',
+            'descripcion' => 'Permite configurar credenciales y proveedores de integraciones.',
+        ],
+        'reportes.ver' => [
+            'nombre' => 'Ver reportes',
+            'descripcion' => 'Permite consultar reportes de ventas y métricas.',
+        ],
+        'reportes.exportar' => [
+            'nombre' => 'Exportar reportes',
+            'descripcion' => 'Permite descargar reportes e información comercial.',
+        ],
+    ];
+
+    /**
+     * @var array<string, array{nombre: string, descripcion: string, permisos: list<string>}>
+     */
+    private const ROLES = [
+        RoleCode::Admin->value => [
+            'nombre' => 'Administrador general',
+            'descripcion' => 'Administra la plataforma y todos sus tenants.',
+            'permisos' => [],
+        ],
+        RoleCode::AdminApp->value => [
+            'nombre' => 'Administrador de la aplicación',
+            'descripcion' => 'Accede a los menús administrativos de la aplicación.',
+            'permisos' => [],
+        ],
+        RoleCode::User->value => [
+            'nombre' => 'Usuario',
+            'descripcion' => 'Cliente final limitado a sus propios datos y operaciones.',
+            'permisos' => [],
+        ],
+    ];
+
+    public function run(): void
+    {
+        foreach (self::PERMISSIONS as $code => $attributes) {
+            Permission::query()->updateOrCreate(
+                ['codigo' => $code],
+                $attributes
+            );
+        }
+
+        foreach (self::ROLES as $code => $attributes) {
+            $role = Role::query()->updateOrCreate(
+                ['codigo' => $code],
+                [
+                    'nombre' => $attributes['nombre'],
+                    'descripcion' => $attributes['descripcion'],
+                ]
+            );
+
+            $permissionCodes = $code === RoleCode::Admin->value
+                ? array_keys(self::PERMISSIONS)
+                : $attributes['permisos'];
+
+            $role->permissions()->sync($permissionCodes);
+        }
+    }
+}

database/seeders/DatabaseSeeder.php

@@ -24,6 +24,7 @@ class DatabaseSeeder extends Seeder
 
         $this->call([
             WebsiteTypeSeeder::class,
+            AuthorizationSeeder::class,
             SocialMediaSeeder::class,
             TenantSeeder::class,
             AttributeSeeder::class,

database/seeders/MenuSeeder.php

@@ -2,6 +2,8 @@
 
 namespace Database\Seeders;
 
+use App\Domains\Authorization\Enums\RoleCode;
+use App\Domains\Authorization\Models\Role;
 use App\Domains\Menu\Models\Menu;
 use App\Domains\Tenant\Models\Tenant;
 use Illuminate\Database\Seeder;
@@ -133,6 +135,19 @@ class MenuSeeder extends Seeder
             ->whereIn('code', ['profile', 'purchases', 'tickets'])
             ->delete();
 
+        $allRoleMenuCodes = Menu::query()->pluck('code');
+        $userMenuCodes = Menu::query()
+            ->where('code', 'not like', 'admin.%')
+            ->pluck('code');
+
+        Role::query()
+            ->whereIn('codigo', [RoleCode::Admin->value, RoleCode::AdminApp->value])
+            ->each(fn (Role $role) => $role->menus()->sync($allRoleMenuCodes));
+
+        Role::query()
+            ->where('codigo', RoleCode::User->value)
+            ->each(fn (Role $role) => $role->menus()->sync($userMenuCodes));
+
         $tenants = Tenant::all();
 
         $allMenus = Menu::pluck('code')->toArray();

docs/authorization.md

@@ -0,0 +1,91 @@
+# Roles y permisos
+
+El sistema utiliza control de acceso basado en roles. Los códigos son identificadores
+estables para uso interno; los nombres y las descripciones pueden modificarse sin
+afectar las reglas de autorización.
+
+Los permisos administrativos deben evaluarse siempre dentro del tenant correspondiente.
+El rol `admin` es la única excepción porque su alcance es toda la plataforma.
+
+Cada registro de `users` contiene:
+
+- `rol_codigo`: código obligatorio del rol. Su valor predeterminado es `user`.
+- `tenant_codigo`: código nullable del tenant. Solamente se utiliza para usuarios con
+  rol `tenant_admin`; para `admin` y `user` debe permanecer en `null`.
+
+## Roles
+
+| Código | Nombre | Alcance |
+| --- | --- | --- |
+| `admin` | Administrador general | Administra la plataforma, todos los tenants, roles y permisos. Tiene todos los permisos. |
+| `tenant_admin` | Administrador del tenant | Administra usuarios y la operación de su tenant. No puede gestionar la definición de roles. |
+| `user` | Usuario | Cliente final. No tiene permisos administrativos y solamente puede operar sobre sus propios datos, carrito, pedidos y tickets. |
+
+## Permisos
+
+| Código | Nombre | Descripción |
+| --- | --- | --- |
+| `tenant.ver` | Ver configuración del tenant | Consultar la configuración general de un tenant. |
+| `tenant.editar` | Editar configuración del tenant | Modificar datos generales, dominio, colores y recursos visuales. |
+| `usuarios.ver` | Ver usuarios | Consultar los usuarios asociados al tenant. |
+| `usuarios.gestionar` | Gestionar usuarios | Invitar, editar, desactivar y asignar roles permitidos a usuarios del tenant. |
+| `roles.ver` | Ver roles | Consultar los roles y sus permisos. |
+| `roles.gestionar` | Gestionar roles | Crear, modificar y asignar permisos a roles. |
+| `catalogo.ver` | Ver catálogo | Consultar productos, variantes, categorías, marcas y bundles administrativamente. |
+| `catalogo.gestionar` | Gestionar catálogo | Crear, modificar, archivar y eliminar productos, variantes, categorías, marcas y bundles. |
+| `inventario.ver` | Ver inventario | Consultar stock e información de inventario. |
+| `inventario.ajustar` | Ajustar inventario | Modificar el stock disponible. |
+| `pedidos.ver` | Ver pedidos | Consultar los pedidos del tenant. |
+| `pedidos.gestionar` | Gestionar pedidos | Modificar estados y datos operativos de pedidos. |
+| `pedidos.cancelar` | Cancelar pedidos | Cancelar pedidos y liberar sus reservas de inventario. |
+| `pagos.ver` | Ver pagos | Consultar el estado y la información de pagos. |
+| `pagos.gestionar` | Gestionar pagos | Confirmar, rechazar o devolver pagos. |
+| `tickets.ver` | Ver tickets | Consultar tickets emitidos. |
+| `tickets.gestionar` | Gestionar tickets | Emitir, invalidar o regenerar tickets. |
+| `contenido.gestionar` | Gestionar contenido | Administrar menús, carruseles, destacados y redes sociales. |
+| `integraciones.ver` | Ver integraciones | Consultar la configuración y el estado de integraciones. |
+| `integraciones.gestionar` | Gestionar integraciones | Configurar credenciales y proveedores de integraciones. |
+| `reportes.ver` | Ver reportes | Consultar reportes de ventas y métricas. |
+| `reportes.exportar` | Exportar reportes | Descargar reportes e información comercial. |
+
+## Matriz de asignación
+
+| Permiso | `admin` | `tenant_admin` | `user` |
+| --- | :---: | :---: | :---: |
+| `tenant.ver` | Sí | Sí | No |
+| `tenant.editar` | Sí | Sí | No |
+| `usuarios.ver` | Sí | Sí | No |
+| `usuarios.gestionar` | Sí | Sí | No |
+| `roles.ver` | Sí | Sí | No |
+| `roles.gestionar` | Sí | No | No |
+| `catalogo.ver` | Sí | Sí | No |
+| `catalogo.gestionar` | Sí | Sí | No |
+| `inventario.ver` | Sí | Sí | No |
+| `inventario.ajustar` | Sí | Sí | No |
+| `pedidos.ver` | Sí | Sí | No |
+| `pedidos.gestionar` | Sí | Sí | No |
+| `pedidos.cancelar` | Sí | Sí | No |
+| `pagos.ver` | Sí | Sí | No |
+| `pagos.gestionar` | Sí | Sí | No |
+| `tickets.ver` | Sí | Sí | No |
+| `tickets.gestionar` | Sí | Sí | No |
+| `contenido.gestionar` | Sí | Sí | No |
+| `integraciones.ver` | Sí | Sí | No |
+| `integraciones.gestionar` | Sí | Sí | No |
+| `reportes.ver` | Sí | Sí | No |
+| `reportes.exportar` | Sí | Sí | No |
+
+## Carga inicial
+
+El seeder `Database\Seeders\AuthorizationSeeder` crea o actualiza este catálogo y
+sincroniza sus asignaciones. Puede ejecutarse de manera independiente:
+
+```bash
+php artisan db:seed --class=AuthorizationSeeder
+```
+
+También se ejecuta como parte de `DatabaseSeeder`.
+
+Las acciones del rol `user` no se representan como permisos administrativos. El
+acceso al perfil, carrito, pedidos y tickets se autoriza comprobando que el recurso
+pertenezca al usuario autenticado y al tenant actual.

tests/Feature/Auth/UserAuthorizationRelationsTest.php

@@ -0,0 +1,32 @@
+<?php
+
+namespace Tests\Feature\Auth;
+
+use App\Domains\Auth\Models\User;
+use App\Domains\Authorization\Enums\RoleCode;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Support\Facades\Schema;
+use Tests\TestCase;
+
+class UserAuthorizationRelationsTest extends TestCase
+{
+    use RefreshDatabase;
+
+    public function test_users_table_has_role_and_tenant_codes(): void
+    {
+        $this->assertTrue(Schema::hasColumns('users', [
+            'rol_codigo',
+            'tenant_codigo',
+        ]));
+    }
+
+    public function test_a_new_user_has_the_user_role_and_no_tenant_by_default(): void
+    {
+        $user = User::factory()->create();
+
+        $this->assertSame(RoleCode::User->value, $user->rol_codigo);
+        $this->assertNull($user->tenant_codigo);
+        $this->assertSame(RoleCode::User->value, $user->role->codigo);
+        $this->assertNull($user->tenant);
+    }
+}

tests/Feature/Authorization/RolePermissionModelTest.php

@@ -0,0 +1,126 @@
+<?php
+
+namespace Tests\Feature\Authorization;
+
+use App\Domains\Authorization\Models\Permission;
+use App\Domains\Authorization\Models\Role;
+use App\Domains\Authorization\Models\RolePermission;
+use Illuminate\Database\QueryException;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Support\Facades\Schema;
+use Tests\TestCase;
+
+class RolePermissionModelTest extends TestCase
+{
+    use RefreshDatabase;
+
+    public function test_authorization_tables_have_the_expected_columns(): void
+    {
+        $this->assertEqualsCanonicalizing([
+            'id',
+            'codigo',
+            'nombre',
+            'descripcion',
+            'created_at',
+            'updated_at',
+        ], Schema::getColumnListing('permisos'));
+
+        $this->assertEqualsCanonicalizing([
+            'id',
+            'codigo',
+            'nombre',
+            'descripcion',
+            'created_at',
+            'updated_at',
+        ], Schema::getColumnListing('roles'));
+
+        $this->assertEqualsCanonicalizing([
+            'id',
+            'codigo_permiso',
+            'rol_codigo',
+            'created_at',
+            'updated_at',
+        ], Schema::getColumnListing('roles_permisos'));
+    }
+
+    public function test_a_role_and_permission_can_be_related_by_their_codes(): void
+    {
+        $role = Role::query()->create([
+            'codigo' => 'administrador',
+            'nombre' => 'Administrador',
+            'descripcion' => 'Administra la tienda.',
+        ]);
+        $permission = Permission::query()->create([
+            'codigo' => 'catalogo.editar',
+            'nombre' => 'Editar catálogo',
+        ]);
+
+        $role->permissions()->attach($permission->codigo);
+
+        $this->assertTrue($role->permissions()->firstOrFail()->is($permission));
+        $this->assertTrue($permission->roles()->firstOrFail()->is($role));
+        $this->assertDatabaseHas('roles_permisos', [
+            'rol_codigo' => $role->codigo,
+            'codigo_permiso' => $permission->codigo,
+        ]);
+    }
+
+    public function test_the_pivot_model_exposes_its_role_and_permission(): void
+    {
+        $role = Role::query()->create([
+            'codigo' => 'editor',
+            'nombre' => 'Editor',
+        ]);
+        $permission = Permission::query()->create([
+            'codigo' => 'catalogo.editar',
+            'nombre' => 'Editar catálogo',
+        ]);
+        $assignment = RolePermission::query()->create([
+            'rol_codigo' => $role->codigo,
+            'codigo_permiso' => $permission->codigo,
+        ]);
+
+        $this->assertTrue($assignment->role->is($role));
+        $this->assertTrue($assignment->permission->is($permission));
+    }
+
+    public function test_a_permission_cannot_be_assigned_twice_to_the_same_role(): void
+    {
+        $role = Role::query()->create([
+            'codigo' => 'editor',
+            'nombre' => 'Editor',
+        ]);
+        $permission = Permission::query()->create([
+            'codigo' => 'catalogo.editar',
+            'nombre' => 'Editar catálogo',
+        ]);
+        $role->permissions()->attach($permission->codigo);
+
+        $this->expectException(QueryException::class);
+
+        $role->permissions()->attach($permission->codigo);
+    }
+
+    public function test_deleting_a_role_removes_its_permission_assignments(): void
+    {
+        $role = Role::query()->create([
+            'codigo' => 'editor',
+            'nombre' => 'Editor',
+        ]);
+        $permission = Permission::query()->create([
+            'codigo' => 'catalogo.editar',
+            'nombre' => 'Editar catálogo',
+        ]);
+        $role->permissions()->attach($permission->codigo);
+
+        $role->delete();
+
+        $this->assertDatabaseMissing('roles_permisos', [
+            'rol_codigo' => $role->codigo,
+            'codigo_permiso' => $permission->codigo,
+        ]);
+        $this->assertDatabaseHas('permisos', [
+            'codigo' => $permission->codigo,
+        ]);
+    }
+}

tests/Feature/Seeders/AuthorizationSeederTest.php

@@ -0,0 +1,53 @@
+<?php
+
+namespace Tests\Feature\Seeders;
+
+use App\Domains\Authorization\Enums\RoleCode;
+use App\Domains\Authorization\Models\Permission;
+use App\Domains\Authorization\Models\Role;
+use Database\Seeders\AuthorizationSeeder;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Tests\TestCase;
+
+class AuthorizationSeederTest extends TestCase
+{
+    use RefreshDatabase;
+
+    public function test_it_creates_the_initial_roles_and_permissions(): void
+    {
+        $this->seed(AuthorizationSeeder::class);
+
+        $this->assertSame(
+            [
+                RoleCode::Admin->value,
+                RoleCode::AdminApp->value,
+                RoleCode::User->value,
+            ],
+            Role::query()->orderBy('codigo')->pluck('codigo')->all()
+        );
+        $this->assertCount(22, Permission::query()->get());
+    }
+
+    public function test_it_assigns_the_expected_permissions_to_each_role(): void
+    {
+        $this->seed(AuthorizationSeeder::class);
+
+        $admin = Role::query()->where('codigo', RoleCode::Admin->value)->firstOrFail();
+        $appAdmin = Role::query()->where('codigo', RoleCode::AdminApp->value)->firstOrFail();
+        $user = Role::query()->where('codigo', RoleCode::User->value)->firstOrFail();
+
+        $this->assertCount(22, $admin->permissions);
+        $this->assertCount(0, $appAdmin->permissions);
+        $this->assertCount(0, $user->permissions);
+    }
+
+    public function test_it_can_run_more_than_once_without_creating_duplicates(): void
+    {
+        $this->seed(AuthorizationSeeder::class);
+        $this->seed(AuthorizationSeeder::class);
+
+        $this->assertCount(3, Role::query()->get());
+        $this->assertCount(22, Permission::query()->get());
+        $this->assertDatabaseCount('roles_permisos', 22);
+    }
+}

tests/Feature/Seeders/MenuSeederTest.php

@@ -4,8 +4,11 @@ namespace Tests\Feature\Seeders;
 
 use App\Domains\Attachable\Enums\AttachmentType;
 use App\Domains\Attachable\Models\Attachment;
+use App\Domains\Authorization\Enums\RoleCode;
+use App\Domains\Authorization\Models\Role;
 use App\Domains\Menu\Models\Menu;
 use App\Domains\Tenant\Models\Tenant;
+use Database\Seeders\AuthorizationSeeder;
 use Database\Seeders\MenuSeeder;
 use Illuminate\Foundation\Testing\RefreshDatabase;
 use Tests\TestCase;
@@ -45,6 +48,48 @@ class MenuSeederTest extends TestCase
         }
     }
 
+    public function test_it_assigns_menus_to_the_expected_roles(): void
+    {
+        $this->seed(AuthorizationSeeder::class);
+        $this->seed(MenuSeeder::class);
+
+        $allMenuCodes = Menu::query()
+            ->orderBy('code')
+            ->pluck('code')
+            ->all();
+        $userMenuCodes = Menu::query()
+            ->where('code', 'not like', 'admin.%')
+            ->orderBy('code')
+            ->pluck('code')
+            ->all();
+
+        foreach ([RoleCode::Admin->value, RoleCode::AdminApp->value] as $roleCode) {
+            $roleMenuCodes = Role::query()
+                ->where('codigo', $roleCode)
+                ->firstOrFail()
+                ->menus()
+                ->orderBy('menues.code')
+                ->pluck('menues.code')
+                ->all();
+
+            $this->assertSame($allMenuCodes, $roleMenuCodes);
+        }
+
+        $userRoleMenuCodes = Role::query()
+            ->where('codigo', RoleCode::User->value)
+            ->firstOrFail()
+            ->menus()
+            ->orderBy('menues.code')
+            ->pluck('menues.code')
+            ->all();
+
+        $this->assertSame($userMenuCodes, $userRoleMenuCodes);
+        $this->assertDatabaseCount(
+            'roles_menues',
+            (count($allMenuCodes) * 2) + count($userMenuCodes)
+        );
+    }
+
     public function test_it_seeds_the_account_menu_hierarchy(): void
     {
         $tenant = $this->createTenant('account_tenant');

tests/Feature/Tenant/AdminAppWebsiteExtraControllerTest.php

@@ -0,0 +1,155 @@
+<?php
+
+namespace Tests\Feature\Tenant;
+
+use App\Domains\Auth\Models\User;
+use App\Domains\Authorization\Enums\RoleCode;
+use App\Domains\Tenant\Models\Tenant;
+use App\Domains\Tenant\Models\WebsiteType;
+use Database\Seeders\AuthorizationSeeder;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Laravel\Sanctum\Sanctum;
+use Tests\TestCase;
+
+class AdminAppWebsiteExtraControllerTest extends TestCase
+{
+    use RefreshDatabase;
+
+    private WebsiteType $websiteType;
+
+    protected function setUp(): void
+    {
+        parent::setUp();
+
+        $this->seed(AuthorizationSeeder::class);
+
+        $this->websiteType = WebsiteType::query()->create([
+            'codigo' => 'test-store',
+            'nombre' => 'Test Store',
+        ]);
+
+        $this->websiteType->extras()->create([
+            'nombre' => 'contactConfig',
+            'descripcion' => 'Datos de contacto visibles en la tienda.',
+            'is_required' => false,
+            'config_schema' => [
+                'request_rules' => [
+                    '$' => 'required|array',
+                    'phone' => 'required|string|max:30',
+                ],
+                'transforms' => [],
+                'database_rules' => [
+                    '$' => 'required|array',
+                    'phone' => 'required|string|max:30',
+                ],
+            ],
+        ]);
+    }
+
+    public function test_authentication_is_required(): void
+    {
+        $this->getJson('/api/v1/adminapp/tenant/website-extras')
+            ->assertUnauthorized();
+    }
+
+    public function test_a_customer_cannot_access_adminapp_website_extras(): void
+    {
+        $customer = User::factory()->create([
+            'rol_codigo' => RoleCode::User->value,
+            'tenant_codigo' => null,
+        ]);
+
+        Sanctum::actingAs($customer);
+
+        $this->getJson('/api/v1/adminapp/tenant/website-extras')
+            ->assertForbidden();
+    }
+
+    public function test_adminapp_user_can_read_definitions_and_current_values(): void
+    {
+        $tenant = $this->createTenant('acme');
+        $definition = $this->websiteType->extras()->firstOrFail();
+        $tenant->websiteExtras()->create([
+            'website_type_extra_id' => $definition->id,
+            'config' => ['phone' => '+54 341 555 0101'],
+        ]);
+
+        Sanctum::actingAs($this->createAdminAppUser($tenant));
+
+        $this->getJson('/api/v1/adminapp/tenant/website-extras')
+            ->assertOk()
+            ->assertJsonPath('data.website_type.codigo', 'test-store')
+            ->assertJsonPath('data.definitions.contactConfig.is_required', false)
+            ->assertJsonPath('data.extras.contactConfig.phone', '+54 341 555 0101')
+            ->assertJsonPath('data.resolved_extras.contactConfig.phone', '+54 341 555 0101');
+    }
+
+    public function test_adminapp_user_replaces_only_its_tenant_extras(): void
+    {
+        $tenant = $this->createTenant('acme');
+        $otherTenant = $this->createTenant('other');
+        $definition = $this->websiteType->extras()->firstOrFail();
+
+        $tenant->websiteExtras()->create([
+            'website_type_extra_id' => $definition->id,
+            'config' => ['phone' => 'old'],
+        ]);
+        $otherTenant->websiteExtras()->create([
+            'website_type_extra_id' => $definition->id,
+            'config' => ['phone' => 'untouched'],
+        ]);
+
+        Sanctum::actingAs($this->createAdminAppUser($tenant));
+
+        $this->putJson('/api/v1/adminapp/tenant/website-extras', [
+            'extras' => [
+                'contactConfig' => [
+                    'phone' => '+54 341 555 9999',
+                ],
+            ],
+        ])
+            ->assertOk()
+            ->assertJsonPath('data.extras.contactConfig.phone', '+54 341 555 9999');
+
+        $this->assertSame(
+            ['phone' => '+54 341 555 9999'],
+            $tenant->websiteExtras()->firstOrFail()->config
+        );
+        $this->assertSame(
+            ['phone' => 'untouched'],
+            $otherTenant->websiteExtras()->firstOrFail()->config
+        );
+    }
+
+    public function test_update_rejects_extras_not_supported_by_the_website_type(): void
+    {
+        $tenant = $this->createTenant('acme');
+        Sanctum::actingAs($this->createAdminAppUser($tenant));
+
+        $this->putJson('/api/v1/adminapp/tenant/website-extras', [
+            'extras' => [
+                'unknown' => ['enabled' => true],
+            ],
+        ])
+            ->assertUnprocessable()
+            ->assertJsonValidationErrors('extras');
+    }
+
+    private function createTenant(string $code): Tenant
+    {
+        return Tenant::query()->create([
+            'codigo' => $code,
+            'nombre' => ucfirst($code),
+            'dominio' => "{$code}.test",
+            'website_type_code' => $this->websiteType->codigo,
+        ]);
+    }
+
+    private function createAdminAppUser(Tenant $tenant): User
+    {
+        return User::factory()->create([
+            'rol_codigo' => RoleCode::AdminApp->value,
+            'tenant_codigo' => $tenant->codigo,
+        ]);
+    }
+}

tests/Feature/Tenant/BootstrapTenantControllerTest.php

@@ -4,6 +4,8 @@ namespace Tests\Feature\Tenant;
 
 use App\Domains\Attachable\Enums\AttachmentType;
 use App\Domains\Attachable\Models\Attachment;
+use App\Domains\Authorization\Enums\RoleCode;
+use App\Domains\Authorization\Models\Role;
 use App\Domains\Catalog\Models\Category;
 use App\Domains\Menu\Models\Menu;
 use App\Domains\Tenant\Models\Tenant;
@@ -145,6 +147,10 @@ class BootstrapTenantControllerTest extends TestCase
     public function test_it_returns_tenant_menus_as_a_clean_hierarchy(): void
     {
         $tenant = $this->createTenant();
+        $userRole = Role::query()->create([
+            'codigo' => RoleCode::User->value,
+            'nombre' => 'Usuario',
+        ]);
         $parent = Menu::query()->create([
             'code' => 'help',
             'label' => 'Ayuda',
@@ -181,6 +187,11 @@ class BootstrapTenantControllerTest extends TestCase
             $staticChild->code => ['static_content' => $staticContent],
             $dynamicChild->code,
         ]);
+        $userRole->menus()->sync([
+            $parent->code,
+            $staticChild->code,
+            $dynamicChild->code,
+        ]);
 
         $response = $this->getJson('/api/tenants/bootstrap/acme.com');
 
@@ -214,6 +225,38 @@ class BootstrapTenantControllerTest extends TestCase
         $this->assertArrayNotHasKey('static_content', $menus[0]['submenues'][1]);
     }
 
+    public function test_it_returns_only_menus_assigned_to_the_user_role(): void
+    {
+        $tenant = $this->createTenant();
+        $userRole = Role::query()->create([
+            'codigo' => RoleCode::User->value,
+            'nombre' => 'Usuario',
+        ]);
+        $adminRole = Role::query()->create([
+            'codigo' => RoleCode::Admin->value,
+            'nombre' => 'Administrador',
+        ]);
+        $userMenu = Menu::query()->create([
+            'code' => 'account',
+            'label' => 'Mi cuenta',
+            'route' => '/mi-cuenta',
+        ]);
+        $adminMenu = Menu::query()->create([
+            'code' => 'admin.catalog',
+            'label' => 'Catálogo',
+            'route' => '/admin/catalog',
+        ]);
+
+        $tenant->menues()->sync([$userMenu->code, $adminMenu->code]);
+        $userRole->menus()->sync([$userMenu->code]);
+        $adminRole->menus()->sync([$adminMenu->code]);
+
+        $this->getJson('/api/tenants/bootstrap/acme.com')
+            ->assertOk()
+            ->assertJsonPath('data.menues.0.code', 'account')
+            ->assertJsonMissing(['code' => 'admin.catalog']);
+    }
+
     public function test_it_rejects_duplicate_domains_after_normalization_when_storing(): void
     {
         $base64Image = 'data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAADUlEQVR42mNk+M9QDwADhgGAWjR9awAAAABJRU5ErkJggg==';