feat(tenant): add site title and favicon support for tenants and website types

- Add footer background image for Desfile Pura Tendencia
- Upload and associate the asset with the tenant during migration
- Extend migration coverage to verify attachment creation and storage

app/Domains/Auth/Controllers/CreateAdminAppResetPasswordAttemptController.php

@@ -0,0 +1,29 @@
+<?php
+
+namespace App\Domains\Auth\Controllers;
+
+use App\Domains\Auth\Models\ResetPasswordAttempt;
+use App\Domains\Auth\Requests\AdminAppCreateResetPasswordAttemptRequest;
+use App\Domains\Auth\Services\ResetPasswordAttemptService;
+use App\Http\Controllers\Controller;
+use Illuminate\Http\JsonResponse;
+
+class CreateAdminAppResetPasswordAttemptController extends Controller
+{
+    public function __construct(
+        private readonly ResetPasswordAttemptService $resetPasswordAttemptService,
+    ) {}
+
+    public function __invoke(AdminAppCreateResetPasswordAttemptRequest $request): JsonResponse
+    {
+        $this->resetPasswordAttemptService->createForAdminAppEmail(
+            $request->validated('email'),
+        );
+
+        return response()->json([
+            'code' => 'auth.password_reset_requested',
+            'message' => __('api.auth.password_reset_requested'),
+            'status' => ResetPasswordAttempt::STATUS_PENDING,
+        ], 202);
+    }
+}

app/Domains/Auth/Controllers/CreateScannerResetPasswordAttemptController.php

@@ -0,0 +1,29 @@
+<?php
+
+namespace App\Domains\Auth\Controllers;
+
+use App\Domains\Auth\Models\ResetPasswordAttempt;
+use App\Domains\Auth\Requests\ScannerCreateResetPasswordAttemptRequest;
+use App\Domains\Auth\Services\ResetPasswordAttemptService;
+use App\Http\Controllers\Controller;
+use Illuminate\Http\JsonResponse;
+
+class CreateScannerResetPasswordAttemptController extends Controller
+{
+    public function __construct(
+        private readonly ResetPasswordAttemptService $resetPasswordAttemptService,
+    ) {}
+
+    public function __invoke(ScannerCreateResetPasswordAttemptRequest $request): JsonResponse
+    {
+        $this->resetPasswordAttemptService->createForScannerEmail(
+            $request->validated('email'),
+        );
+
+        return response()->json([
+            'code' => 'auth.password_reset_requested',
+            'message' => __('api.auth.password_reset_requested'),
+            'status' => ResetPasswordAttempt::STATUS_PENDING,
+        ], 202);
+    }
+}

app/Domains/Auth/Models/ResetPasswordAttempt.php

@@ -11,6 +11,12 @@ use Illuminate\Database\Eloquent\Relations\BelongsTo;
 #[Hidden(['codigo'])]
 class ResetPasswordAttempt extends Model
 {
+    public const REASON_MANUAL = 'manual';
+
+    public const REASON_ACCOUNT_LOCKED = 'account_locked';
+
+    public const REASON_STAFF_CREATED = 'staff_created';
+
     public const STATUS_PENDING = 'pending';
 
     public const STATUS_VALIDATED = 'validated';

app/Domains/Auth/Requests/AdminAppCreateResetPasswordAttemptRequest.php

@@ -0,0 +1,31 @@
+<?php
+
+namespace App\Domains\Auth\Requests;
+
+use Illuminate\Foundation\Http\FormRequest;
+use Illuminate\Support\Str;
+
+class AdminAppCreateResetPasswordAttemptRequest extends FormRequest
+{
+    public function authorize(): bool
+    {
+        return true;
+    }
+
+    protected function prepareForValidation(): void
+    {
+        $email = $this->input('email');
+
+        if (is_string($email)) {
+            $this->merge(['email' => Str::lower(trim($email))]);
+        }
+    }
+
+    /** @return array<string, mixed> */
+    public function rules(): array
+    {
+        return [
+            'email' => ['required', 'string', 'email', 'max:255'],
+        ];
+    }
+}

app/Domains/Auth/Requests/ScannerCreateResetPasswordAttemptRequest.php

@@ -0,0 +1,31 @@
+<?php
+
+namespace App\Domains\Auth\Requests;
+
+use Illuminate\Foundation\Http\FormRequest;
+use Illuminate\Support\Str;
+
+class ScannerCreateResetPasswordAttemptRequest extends FormRequest
+{
+    public function authorize(): bool
+    {
+        return true;
+    }
+
+    protected function prepareForValidation(): void
+    {
+        $email = $this->input('email');
+
+        if (is_string($email)) {
+            $this->merge(['email' => Str::lower(trim($email))]);
+        }
+    }
+
+    /** @return array<string, mixed> */
+    public function rules(): array
+    {
+        return [
+            'email' => ['required', 'string', 'email', 'max:255'],
+        ];
+    }
+}

app/Domains/Auth/Services/PasswordLoginService.php

@@ -4,9 +4,11 @@ namespace App\Domains\Auth\Services;
 
 use App\Domains\Auth\Exceptions\AccountLockedException;
 use App\Domains\Auth\Models\LoginAttempt;
+use App\Domains\Auth\Models\ResetPasswordAttempt;
 use App\Domains\Auth\Models\User;
 use App\Domains\Authorization\Enums\PermissionCode;
 use App\Domains\Authorization\Enums\RoleCode;
+use App\Domains\Notification\Events\PasswordResetRequested;
 use Carbon\CarbonImmutable;
 use Illuminate\Support\Facades\DB;
 use Illuminate\Support\Facades\Hash;
@@ -60,6 +62,8 @@ class PasswordLoginService
             $userAgent,
             RoleCode::AdminApp,
             true,
+            null,
+            PasswordResetRequested::CHANNEL_ADMINAPP,
         );
     }
 
@@ -84,6 +88,7 @@ class PasswordLoginService
             null,
             true,
             PermissionCode::ScanTickets->value,
+            PasswordResetRequested::CHANNEL_SCANNER,
         );
     }
 
@@ -96,6 +101,7 @@ class PasswordLoginService
         ?RoleCode $requiredRole = RoleCode::User,
         bool $requiresTenant = false,
         ?string $requiredPermission = null,
+        string $passwordResetChannel = PasswordResetRequested::CHANNEL_STOREFRONT,
     ): User {
         $normalizedEmail = mb_strtolower(trim($email));
         $now = CarbonImmutable::now();
@@ -111,6 +117,7 @@ class PasswordLoginService
             $requiredRole,
             $requiresTenant,
             $requiredPermission,
+            $passwordResetChannel,
         ): array {
             $user = User::query()
                 ->where('email', $normalizedEmail)
@@ -160,7 +167,12 @@ class PasswordLoginService
 
             if ($user === null || ! Hash::check($password, $user->password)) {
                 if ($user !== null && $attemptTenantCode !== null) {
-                    $this->registerFailure($user, $now, $attemptTenantCode);
+                    $this->registerFailure(
+                        $user,
+                        $now,
+                        $attemptTenantCode,
+                        $passwordResetChannel,
+                    );
                 }
 
                 $outcome = $user?->locked_until?->isFuture()
@@ -219,8 +231,12 @@ class PasswordLoginService
         return $result['user'];
     }
 
-    private function registerFailure(User $user, CarbonImmutable $now, string $tenantCode): void
+    private function registerFailure(
-    {
+        User $user,
+        CarbonImmutable $now,
+        string $tenantCode,
+        string $passwordResetChannel,
+    ): void {
         $windowMinutes = max(1, (int) config('login-security.attempt_window_minutes'));
         $maxAttempts = max(1, (int) config('login-security.max_attempts'));
         $lockMinutes = max(1, (int) config('login-security.lock_minutes'));
@@ -243,7 +259,23 @@ class PasswordLoginService
 
         if ($attempts >= $maxAttempts && $previousAttempts < $maxAttempts) {
             try {
-                $this->resetPasswordAttemptService->createForEmail($user->email, $tenantCode, 'account_locked');
+                if ($passwordResetChannel === PasswordResetRequested::CHANNEL_ADMINAPP) {
+                    $this->resetPasswordAttemptService->createForAdminAppEmail(
+                        $user->email,
+                        ResetPasswordAttempt::REASON_ACCOUNT_LOCKED,
+                    );
+                } elseif ($passwordResetChannel === PasswordResetRequested::CHANNEL_SCANNER) {
+                    $this->resetPasswordAttemptService->createForScannerEmail(
+                        $user->email,
+                        ResetPasswordAttempt::REASON_ACCOUNT_LOCKED,
+                    );
+                } else {
+                    $this->resetPasswordAttemptService->createForEmail(
+                        $user->email,
+                        $tenantCode,
+                        ResetPasswordAttempt::REASON_ACCOUNT_LOCKED,
+                    );
+                }
             } catch (\Throwable $e) {
                 Log::error('Failed to trigger reset password on account lock', [
                     'user_id' => $user->id,

app/Domains/Auth/Services/ResetPasswordAttemptService.php

@@ -4,6 +4,7 @@ namespace App\Domains\Auth\Services;
 
 use App\Domains\Auth\Models\ResetPasswordAttempt;
 use App\Domains\Auth\Models\User;
+use App\Domains\Authorization\Enums\RoleCode;
 use App\Domains\Notification\Events\PasswordResetRequested;
 use Illuminate\Support\Facades\DB;
 use Illuminate\Support\Facades\Log;
@@ -11,8 +12,11 @@ use Throwable;
 
 class ResetPasswordAttemptService
 {
-    public function createForEmail(string $email, string $tenantCode, string $reason = 'manual'): void
+    public function createForEmail(
-    {
+        string $email,
+        string $tenantCode,
+        string $reason = ResetPasswordAttempt::REASON_MANUAL,
+    ): void {
         $emailFingerprint = $this->emailFingerprint($email);
 
         try {
@@ -22,28 +26,12 @@ class ResetPasswordAttemptService
                     ->lockForUpdate()
                     ->first();
 
-                if ($user === null) {
+                return $this->createAttemptForUser(
-                    Log::warning('Password reset attempt was not created because the user was not found.', [
+                    $user,
-                        'email_fingerprint' => $emailFingerprint,
+                    $reason,
-                    ]);
+                    $emailFingerprint,
-
+                    'Password reset attempt was not created because the user was not found.',
-                    return null;
+                );
-                }
-
-                $user->resetPasswordAttempts()
-                    ->whereIn('status', [
-                        ResetPasswordAttempt::STATUS_PENDING,
-                        ResetPasswordAttempt::STATUS_VALIDATED,
-                    ])
-                    ->update(['status' => ResetPasswordAttempt::STATUS_EXPIRED]);
-
-                $attempt = $user->resetPasswordAttempts()->create([
-                    'codigo' => $this->generateCode(),
-                    'reason' => $reason,
-                    'status' => ResetPasswordAttempt::STATUS_PENDING,
-                ]);
-
-                return $attempt->getKey();
             });
         } catch (Throwable $exception) {
             Log::error('Failed to create password reset attempt.', [
@@ -54,20 +42,108 @@ class ResetPasswordAttemptService
             throw $exception;
         }
 
-        if ($attemptId !== null) {
+        $this->dispatchPasswordResetRequested(
-            try {
+            $attemptId,
-                PasswordResetRequested::dispatch($attemptId, $tenantCode);
+            $tenantCode,
-            } catch (Throwable $exception) {
+            PasswordResetRequested::CHANNEL_STOREFRONT,
-                Log::error('Failed to dispatch password reset email.', [
+            $emailFingerprint,
-                    'attempt_id' => $attemptId,
+        );
-                    'tenant_code' => $tenantCode,
+    }
-                    'email_fingerprint' => $emailFingerprint,
-                    'exception' => $exception,
-                ]);
 
-                throw $exception;
+    public function createForAdminAppEmail(
-            }
+        string $email,
+        string $reason = ResetPasswordAttempt::REASON_MANUAL,
+    ): void {
+        $emailFingerprint = $this->emailFingerprint($email);
+
+        try {
+            $result = DB::transaction(function () use ($email, $emailFingerprint, $reason): ?array {
+                $user = User::query()
+                    ->where('email', $email)
+                    ->where('rol_codigo', RoleCode::AdminApp->value)
+                    ->whereNotNull('tenant_codigo')
+                    ->lockForUpdate()
+                    ->first();
+
+                $attemptId = $this->createAttemptForUser(
+                    $user,
+                    $reason,
+                    $emailFingerprint,
+                    'AdminApp password reset attempt was not created because the user was not found.',
+                );
+
+                if ($user === null || $attemptId === null) {
+                    return null;
+                }
+
+                return [
+                    'attempt_id' => $attemptId,
+                    'tenant_code' => $user->tenant_codigo,
+                ];
+            });
+        } catch (Throwable $exception) {
+            Log::error('Failed to create AdminApp password reset attempt.', [
+                'email_fingerprint' => $emailFingerprint,
+                'exception' => $exception,
+            ]);
+
+            throw $exception;
         }
+
+        $this->dispatchPasswordResetRequested(
+            $result['attempt_id'] ?? null,
+            $result['tenant_code'] ?? null,
+            PasswordResetRequested::CHANNEL_ADMINAPP,
+            $emailFingerprint,
+        );
+    }
+
+    public function createForScannerEmail(
+        string $email,
+        string $reason = ResetPasswordAttempt::REASON_MANUAL,
+    ): void {
+        $emailFingerprint = $this->emailFingerprint($email);
+
+        try {
+            $result = DB::transaction(function () use ($email, $emailFingerprint, $reason): ?array {
+                $user = User::query()
+                    ->where('email', $email)
+                    ->where('rol_codigo', RoleCode::Scanner->value)
+                    ->whereNotNull('tenant_codigo')
+                    ->lockForUpdate()
+                    ->first();
+
+                $attemptId = $this->createAttemptForUser(
+                    $user,
+                    $reason,
+                    $emailFingerprint,
+                    'Scanner password reset attempt was not created because the user was not found.',
+                );
+
+                if ($user === null || $attemptId === null) {
+                    return null;
+                }
+
+                return [
+                    'attempt_id' => $attemptId,
+                    'tenant_code' => $user->tenant_codigo,
+                ];
+            });
+        } catch (Throwable $exception) {
+            Log::error('Failed to create Scanner password reset attempt.', [
+                'email_fingerprint' => $emailFingerprint,
+                'exception' => $exception,
+            ]);
+
+            throw $exception;
+        }
+
+        $this->dispatchPasswordResetRequested(
+            $result['attempt_id'] ?? null,
+            $result['tenant_code'] ?? null,
+            PasswordResetRequested::CHANNEL_SCANNER,
+            $emailFingerprint,
+        );
     }
 
     public function validateCode(string $email, string $code): bool
@@ -169,6 +245,61 @@ class ResetPasswordAttemptService
         }
     }
 
+    private function createAttemptForUser(
+        ?User $user,
+        string $reason,
+        string $emailFingerprint,
+        string $userNotFoundMessage,
+    ): ?int {
+        if ($user === null) {
+            Log::warning($userNotFoundMessage, [
+                'email_fingerprint' => $emailFingerprint,
+            ]);
+
+            return null;
+        }
+
+        $user->resetPasswordAttempts()
+            ->whereIn('status', [
+                ResetPasswordAttempt::STATUS_PENDING,
+                ResetPasswordAttempt::STATUS_VALIDATED,
+            ])
+            ->update(['status' => ResetPasswordAttempt::STATUS_EXPIRED]);
+
+        $attempt = $user->resetPasswordAttempts()->create([
+            'codigo' => $this->generateCode(),
+            'reason' => $reason,
+            'status' => ResetPasswordAttempt::STATUS_PENDING,
+        ]);
+
+        return $attempt->getKey();
+    }
+
+    private function dispatchPasswordResetRequested(
+        ?int $attemptId,
+        ?string $tenantCode,
+        string $channel,
+        string $emailFingerprint,
+    ): void {
+        if ($attemptId === null || $tenantCode === null) {
+            return;
+        }
+
+        try {
+            PasswordResetRequested::dispatch($attemptId, $tenantCode, $channel);
+        } catch (Throwable $exception) {
+            Log::error('Failed to dispatch password reset email.', [
+                'attempt_id' => $attemptId,
+                'tenant_code' => $tenantCode,
+                'channel' => $channel,
+                'email_fingerprint' => $emailFingerprint,
+                'exception' => $exception,
+            ]);
+
+            throw $exception;
+        }
+    }
+
     private function generateCode(): string
     {
         return str_pad((string) random_int(0, 9999), 4, '0', STR_PAD_LEFT);

app/Domains/Auth/routes/adminapp.php

@@ -2,10 +2,19 @@
 
 use App\Domains\Auth\Controllers\AdminAppLoginController;
 use App\Domains\Auth\Controllers\AdminAppMeController;
+use App\Domains\Auth\Controllers\CreateAdminAppResetPasswordAttemptController;
+use App\Domains\Auth\Controllers\ResetPasswordController;
+use App\Domains\Auth\Controllers\ValidateResetPasswordAttemptController;
 use Illuminate\Support\Facades\Route;
 
 Route::prefix('v1/adminapp')->group(function (): void {
     Route::post('login', AdminAppLoginController::class)->middleware('throttle:login');
+    Route::post('password/reset-attempts', CreateAdminAppResetPasswordAttemptController::class)
+        ->middleware('throttle:5,1');
+    Route::post('password/reset-attempts/validate', ValidateResetPasswordAttemptController::class)
+        ->middleware('throttle:10,1');
+    Route::post('password/reset', ResetPasswordController::class)
+        ->middleware('throttle:5,1');
     Route::middleware(['auth:sanctum', 'adminapp.tenant'])
         ->get('me', AdminAppMeController::class);
 });

app/Domains/Auth/routes/scanner.php

@@ -1,11 +1,20 @@
 <?php
 
+use App\Domains\Auth\Controllers\CreateScannerResetPasswordAttemptController;
+use App\Domains\Auth\Controllers\ResetPasswordController;
 use App\Domains\Auth\Controllers\ScannerLoginController;
 use App\Domains\Auth\Controllers\ScannerMeController;
+use App\Domains\Auth\Controllers\ValidateResetPasswordAttemptController;
 use Illuminate\Support\Facades\Route;
 
 Route::prefix('v1/scanner')->group(function (): void {
     Route::post('login', ScannerLoginController::class)->middleware('throttle:login');
+    Route::post('password/reset-attempts', CreateScannerResetPasswordAttemptController::class)
+        ->middleware('throttle:5,1');
+    Route::post('password/reset-attempts/validate', ValidateResetPasswordAttemptController::class)
+        ->middleware('throttle:10,1');
+    Route::post('password/reset', ResetPasswordController::class)
+        ->middleware('throttle:5,1');
     Route::middleware(['auth:sanctum', 'scanner.tenant'])
         ->get('me', ScannerMeController::class);
 });

app/Domains/Cart/Resources/CartItemResource.php

@@ -45,7 +45,7 @@ class CartItemResource extends JsonResource
                         'stock_tecnico' => $this->catalogItem->inventory_policy === InventoryPolicy::Unlimited
                             ? null
                             : $variant->inventory->availableStock(),
-                        'values' => $variant->selectionOptions($this->catalogItem->itemAttributes),
+                        'values' => $variant->selectorOptions($this->catalogItem->itemAttributes),
                     ])
                     ->values(),
             ],

app/Domains/Cart/Services/CartService.php

@@ -82,11 +82,11 @@ class CartService
             $guestToken,
             60 * 24 * 180,
             '/',
-            null,
+            config('session.domain'),
-            false,
+            (bool) config('session.secure'),
             true,
             false,
-            'lax',
+            config('session.same_site'),
         );
     }
 

app/Domains/Catalog/Enums/GroupLayout.php

@@ -8,6 +8,7 @@ enum GroupLayout: string
     case Simple = 'simple';
     case SimpleVertical = 'simple_vertical';
     case Carousel = 'carousel';
+    case Single = 'single';
 
     /**
      * @return list<string>

app/Domains/Catalog/Enums/InventorySubject.php

@@ -0,0 +1,16 @@
+<?php
+
+namespace App\Domains\Catalog\Enums;
+
+enum InventorySubject: string
+{
+    case Product = 'product';
+    case Seat = 'seat';
+    case Ticket = 'ticket';
+
+    /** @return array<int, string> */
+    public static function values(): array
+    {
+        return array_column(self::cases(), 'value');
+    }
+}

app/Domains/Catalog/Enums/ProductLayout.php

@@ -7,6 +7,7 @@ enum ProductLayout: string
     case Row = 'row';
     case ColumnWithImage = 'column_with_image';
     case ColumnWithCart = 'column_with_cart';
+    case TicketSelector = 'ticket_selector';
 
     /**
      * @return list<string>

app/Domains/Catalog/Models/CatalogItem.php

@@ -5,6 +5,7 @@ namespace App\Domains\Catalog\Models;
 use App\Domains\Attachable\Models\Attachment;
 use App\Domains\Catalog\Enums\CatalogItemType;
 use App\Domains\Catalog\Enums\InventoryPolicy;
+use App\Domains\Catalog\Enums\InventorySubject;
 use App\Domains\Catalog\Services\CatalogInventoryService;
 use App\Domains\Tenant\Models\Tenant;
 use App\Domains\Ticket\Enums\TicketGenerationPolicy;
@@ -30,6 +31,7 @@ use Illuminate\Support\Collection;
     'descripcion',
     'precio',
     'inventory_policy',
+    'inventory_subject',
     'max_units_per_user',
     'has_tickets',
     'ticket_generation_policy',
@@ -46,6 +48,7 @@ class CatalogItem extends Model
     protected $attributes = [
         'type' => CatalogItemType::Standard->value,
         'inventory_policy' => InventoryPolicy::Tracked->value,
+        'inventory_subject' => InventorySubject::Product->value,
         'has_tickets' => false,
         'ticket_generation_policy' => TicketGenerationPolicy::PerEventDate->value,
     ];
@@ -59,6 +62,7 @@ class CatalogItem extends Model
             'type' => CatalogItemType::class,
             'precio' => 'decimal:2',
             'inventory_policy' => InventoryPolicy::class,
+            'inventory_subject' => InventorySubject::class,
             'max_units_per_user' => 'integer',
             'has_tickets' => 'boolean',
             'ticket_generation_policy' => TicketGenerationPolicy::class,
@@ -208,6 +212,11 @@ class CatalogItem extends Model
         return $this->nombre;
     }
 
+    public function getSelectionLabel(): string
+    {
+        return $this->getName();
+    }
+
     public function getDescription(): ?string
     {
         return $this->descripcion;

app/Domains/Catalog/Models/ItemAttribute.php

@@ -13,6 +13,7 @@ use Illuminate\Database\Eloquent\Relations\HasMany;
     'attribute_id',
     'allow_multi_select',
     'sort_order',
+    'show_in_selector',
 ])]
 class ItemAttribute extends Model
 {
@@ -20,6 +21,10 @@ class ItemAttribute extends Model
 
     protected $table = 'item_attributes';
 
+    protected $attributes = [
+        'show_in_selector' => true,
+    ];
+
     protected function casts(): array
     {
         return [
@@ -27,6 +32,7 @@ class ItemAttribute extends Model
             'attribute_id' => 'integer',
             'allow_multi_select' => 'boolean',
             'sort_order' => 'integer',
+            'show_in_selector' => 'boolean',
         ];
     }
 

app/Domains/Catalog/Models/Variant.php

@@ -12,6 +12,8 @@ use Illuminate\Database\Eloquent\Relations\BelongsTo;
 use Illuminate\Database\Eloquent\Relations\BelongsToMany;
 use Illuminate\Database\Eloquent\Relations\HasMany;
 use Illuminate\Support\Collection;
+use Illuminate\Support\Facades\Lang;
+use Illuminate\Support\Str;
 
 #[Fillable([
     'catalog_item_id',
@@ -113,6 +115,42 @@ class Variant extends Model
         return $this->catalogItem->nombre;
     }
 
+    public function getSelectionLabel(): string
+    {
+        $this->loadMissing([
+            'catalogItem.itemAttributes.attribute.options',
+            'definitions.itemAttribute.attribute.options',
+            'eventDates',
+            'eventDate',
+        ]);
+
+        $itemAttributes = $this->catalogItem->itemAttributes;
+
+        $label = $this->selectionOptions($itemAttributes)
+            ->map(function (array $option, string $attributeCode) use ($itemAttributes): ?string {
+                $itemAttribute = $itemAttributes->first(
+                    fn (ItemAttribute $candidate): bool => $candidate->attribute?->codigo === $attributeCode,
+                );
+                $translationKey = "api.catalog.attribute_labels.{$attributeCode}";
+                $attributeName = Lang::has($translationKey)
+                    ? __($translationKey)
+                    : ($itemAttribute?->attribute?->nombre ?? Str::headline($attributeCode));
+                $selectedOptions = array_is_list($option) ? $option : [$option];
+                $selectedLabels = collect($selectedOptions)
+                    ->pluck('label')
+                    ->filter()
+                    ->implode(', ');
+
+                return $selectedLabels === ''
+                    ? null
+                    : "{$attributeName} {$selectedLabels}";
+            })
+            ->filter()
+            ->implode(' · ');
+
+        return $label !== '' ? $label : $this->getName();
+    }
+
     /** @return Collection<string, string|array<int, string>> */
     public function selectionValues(): Collection
     {
@@ -230,6 +268,25 @@ class Variant extends Model
         });
     }
 
+    /**
+     * @param  Collection<int, ItemAttribute>  $itemAttributes
+     * @return Collection<string, array{value: string, label: string}|array<int, array{value: string, label: string}>>
+     */
+    public function selectorOptions(Collection $itemAttributes): Collection
+    {
+        $visibleAttributeCodes = $itemAttributes
+            ->filter(fn (ItemAttribute $itemAttribute): bool => $itemAttribute->show_in_selector)
+            ->map(fn (ItemAttribute $itemAttribute): ?string => $itemAttribute->attribute?->codigo)
+            ->filter()
+            ->values();
+
+        return $this->selectionOptions($itemAttributes)
+            ->filter(
+                fn (array $option, string $attributeCode): bool => $visibleAttributeCodes
+                    ->contains($attributeCode)
+            );
+    }
+
     /** @return Collection<int, EventDate> */
     public function selectedEventDates(): Collection
     {

app/Domains/Catalog/Requests/StoreCatalogItemRequest.php

@@ -4,6 +4,7 @@ namespace App\Domains\Catalog\Requests;
 
 use App\Domains\Catalog\Enums\CatalogItemType;
 use App\Domains\Catalog\Enums\InventoryPolicy;
+use App\Domains\Catalog\Enums\InventorySubject;
 use App\Domains\Shared\Rules\ImageOrBase64Rule;
 use App\Domains\Ticket\Enums\TicketGenerationPolicy;
 use Illuminate\Foundation\Http\FormRequest;
@@ -54,6 +55,7 @@ class StoreCatalogItemRequest extends FormRequest
             'descripcion' => ['sometimes', 'nullable', 'string'],
             'precio' => ['required', 'numeric', 'min:0'],
             'inventory_policy' => [Rule::prohibitedIf($isBundle), 'sometimes', Rule::enum(InventoryPolicy::class)],
+            'inventory_subject' => ['sometimes', Rule::enum(InventorySubject::class)],
             'max_units_per_user' => ['sometimes', 'nullable', 'integer', 'min:1'],
             'has_tickets' => [Rule::prohibitedIf($isBundle), 'sometimes', 'boolean'],
             'ticket_generation_policy' => [Rule::prohibitedIf($isBundle), 'sometimes', Rule::enum(TicketGenerationPolicy::class)],
@@ -80,6 +82,15 @@ class StoreCatalogItemRequest extends FormRequest
                     fn ($query) => $query->where('tenant_codigo', $tenantCode)
                 ),
             ],
+            'hidden_attribute_codes' => [Rule::prohibitedIf($isBundle), 'sometimes', 'array'],
+            'hidden_attribute_codes.*' => [
+                'required',
+                'string',
+                'distinct',
+                Rule::exists('attribute', 'codigo')->where(
+                    fn ($query) => $query->where('tenant_codigo', $tenantCode)
+                ),
+            ],
             'images' => ['sometimes', 'array'],
             'images.*' => ['required', new ImageOrBase64Rule],
             'variants' => [Rule::prohibitedIf($isBundle), 'sometimes', 'array'],

app/Domains/Catalog/Resources/CatalogFeaturedItemResource.php

@@ -25,7 +25,7 @@ class CatalogFeaturedItemResource extends JsonResource
             return $this->columnWithImageData($catalogItem);
         }
 
-        return [
+        $data = [
             'id' => $catalogItem->id,
             'type' => $catalogItem->type->value,
             'nombre' => $catalogItem->nombre,
@@ -47,20 +47,21 @@ class CatalogFeaturedItemResource extends JsonResource
                     'stock_tecnico' => $catalogItem->inventory_policy === InventoryPolicy::Unlimited
                         ? null
                         : $variant->inventory->availableStock(),
-                    'values' => $variant->selectionOptions($catalogItem->itemAttributes),
+                    'values' => $variant->selectorOptions($catalogItem->itemAttributes),
                 ])
                 ->values(),
         ];
+
+        if ($featuredGroup->product_layout === ProductLayout::TicketSelector) {
+            $data['image'] = $this->firstImageUrl($catalogItem);
+        }
+
+        return $data;
     }
 
     /** @return array<string, mixed> */
     private function columnWithImageData(CatalogItem $catalogItem): array
     {
-        $attachment = $catalogItem->attachments->first()
-            ?? $catalogItem->variants
-                ->flatMap(fn (Variant $variant) => $variant->attachments)
-                ->first();
-
         return [
             'id' => $catalogItem->id,
             'type' => $catalogItem->type->value,
@@ -69,7 +70,17 @@ class CatalogFeaturedItemResource extends JsonResource
             'ticket_generation_policy' => $catalogItem->ticket_generation_policy->value,
             'validity_time_id' => $catalogItem->validity_time_id,
             'validity_time' => ValidityTimeResource::make($catalogItem->validityTime),
-            'image' => $attachment?->getTemporaryUrl(1440),
+            'image' => $this->firstImageUrl($catalogItem),
         ];
     }
+
+    private function firstImageUrl(CatalogItem $catalogItem): ?string
+    {
+        $attachment = $catalogItem->attachments->first()
+            ?? $catalogItem->variants
+                ->flatMap(fn (Variant $variant) => $variant->attachments)
+                ->first();
+
+        return $attachment?->getTemporaryUrl(1440);
+    }
 }

app/Domains/Catalog/Resources/CatalogItemDetailResource.php

@@ -33,6 +33,7 @@ class CatalogItemDetailResource extends JsonResource
             'category' => $this->category?->nombre,
             'brand' => $this->brand?->nombre,
             'inventory_policy' => $this->inventory_policy?->value,
+            'inventory_subject' => $this->inventory_subject->value,
             'max_units_per_user' => $this->max_units_per_user,
             'has_tickets' => $this->has_tickets,
             'ticket_generation_policy' => $this->ticket_generation_policy->value,
@@ -88,6 +89,7 @@ class CatalogItemDetailResource extends JsonResource
             'codigo' => $attribute->codigo,
             'nombre' => $attribute->nombre,
             'sort_order' => $itemAttribute->sort_order,
+            'show_in_selector' => $itemAttribute->show_in_selector,
             'is_required' => $attribute->is_required,
             'allow_multi_select' => $itemAttribute->allow_multi_select,
             'metadata_schema' => $attribute->metadata_schema,

app/Domains/Catalog/Resources/CatalogItemResource.php

@@ -23,6 +23,7 @@ class CatalogItemResource extends JsonResource
             'descripcion' => $this->descripcion,
             'precio' => $this->precio,
             'inventory_policy' => $this->inventory_policy?->value,
+            'inventory_subject' => $this->inventory_subject->value,
             'max_units_per_user' => $this->max_units_per_user,
             'has_tickets' => $this->has_tickets,
             'ticket_generation_policy' => $this->ticket_generation_policy->value,
@@ -45,7 +46,7 @@ class CatalogItemResource extends JsonResource
                     'descripcion' => $variant->getDescription(),
                     'precio' => number_format($variant->getPrice(), 2, '.', ''),
                     'real_stock' => $variant->inventory?->real_stock,
-                    'values' => $variant->selectionOptions($this->itemAttributes),
+                    'values' => $variant->selectorOptions($this->itemAttributes),
                     'images' => $variant->attachments
                         ->map(fn ($attachment) => $attachment->getTemporaryUrl(1440))
                         ->values(),

app/Domains/Catalog/Resources/CatalogSearchItemResource.php

@@ -43,7 +43,7 @@ class CatalogSearchItemResource extends JsonResource
                     'stock_tecnico' => $this->inventory_policy === InventoryPolicy::Unlimited
                         ? null
                         : $variant->inventory?->availableStock(),
-                    'values' => $variant->selectionOptions($this->itemAttributes),
+                    'values' => $variant->selectorOptions($this->itemAttributes),
                 ])
                 ->values(),
         ];

app/Domains/Catalog/Services/CatalogService.php

@@ -37,6 +37,7 @@ class CatalogService
             $images = $data['images'] ?? [];
             $attributeCodes = $data['attribute_codes'] ?? [];
             $multiSelectAttributeCodes = $data['multi_select_attribute_codes'] ?? [];
+            $hiddenAttributeCodes = $data['hidden_attribute_codes'] ?? [];
             $components = $data['components'] ?? [];
             $hasDirectStock = array_key_exists('real_stock', $data);
             $realStock = (int) ($data['real_stock'] ?? 0);
@@ -64,6 +65,14 @@ class CatalogService
                 ]);
             }
 
+            if (array_diff($hiddenAttributeCodes, $attributeCodes) !== []) {
+                throw ValidationException::withMessages([
+                    'hidden_attribute_codes' => [
+                        __('api.catalog.hidden_attribute_not_on_item'),
+                    ],
+                ]);
+            }
+
             $this->validateUniqueVariantCombinations($variants, $attributeCodes);
 
             if ($type === CatalogItemType::Bundle) {
@@ -88,6 +97,7 @@ class CatalogService
                 $data['images'],
                 $data['attribute_codes'],
                 $data['multi_select_attribute_codes'],
+                $data['hidden_attribute_codes'],
                 $data['components'],
                 $data['real_stock'],
                 $data['reserved_stock'],
@@ -109,7 +119,12 @@ class CatalogService
 
             $catalogItem = CatalogItem::query()->create($data);
             $itemAttributes = $type === CatalogItemType::Standard
-                ? $this->createItemAttributes($catalogItem, $attributeCodes, $multiSelectAttributeCodes)
+                ? $this->createItemAttributes(
+                    $catalogItem,
+                    $attributeCodes,
+                    $multiSelectAttributeCodes,
+                    $hiddenAttributeCodes,
+                )
                 : [];
 
             if ($type === CatalogItemType::Bundle) {
@@ -488,12 +503,14 @@ class CatalogService
     /**
      * @param  array<int, string>  $attributeCodes
      * @param  array<int, string>  $multiSelectAttributeCodes
+     * @param  array<int, string>  $hiddenAttributeCodes
      * @return array<string, ItemAttribute>
      */
     private function createItemAttributes(
         CatalogItem $catalogItem,
         array $attributeCodes,
         array $multiSelectAttributeCodes = [],
+        array $hiddenAttributeCodes = [],
     ): array {
         $itemAttributes = [];
         $attributeCodes = array_values(array_unique($attributeCodes));
@@ -517,6 +534,7 @@ class CatalogService
             $itemAttribute = $catalogItem->itemAttributes()->create([
                 'attribute_id' => $attribute->id,
                 'allow_multi_select' => in_array($attributeCode, $multiSelectAttributeCodes, true),
+                'show_in_selector' => ! in_array($attributeCode, $hiddenAttributeCodes, true),
             ]);
 
             $itemAttributes[$attributeCode] = $itemAttribute;

app/Domains/Catalog/Services/FeaturedGroupService.php

@@ -18,7 +18,13 @@ class FeaturedGroupService
     public function itemsResponse(FeaturedGroup $featuredGroup, int $page): array
     {
         if ($featuredGroup->group_layout !== GroupLayout::Paginated) {
-            $items = $this->itemsQuery($featuredGroup)->get();
+            $query = $this->itemsQuery($featuredGroup);
+
+            if ($featuredGroup->group_layout === GroupLayout::Single) {
+                $query->limit(1);
+            }
+
+            $items = $query->get();
             $this->attachGroup($items, $featuredGroup);
 
             return CatalogFeaturedItemResource::collection($items)->resolve();

app/Domains/Desfile/routes/api.php

@@ -0,0 +1,3 @@
+<?php
+
+// Desfile tenant routes will be registered here.

app/Domains/Notification/Events/PasswordResetRequested.php

@@ -9,8 +9,15 @@ class PasswordResetRequested
 {
     use Dispatchable, SerializesModels;
 
+    public const CHANNEL_STOREFRONT = 'storefront';
+
+    public const CHANNEL_ADMINAPP = 'adminapp';
+
+    public const CHANNEL_SCANNER = 'scanner';
+
     public function __construct(
         public readonly int $attemptId,
         public readonly string $tenantCode,
+        public readonly string $channel = self::CHANNEL_STOREFRONT,
     ) {}
 }

app/Domains/Notification/Listeners/SendPasswordResetEmail.php

@@ -26,11 +26,13 @@ class SendPasswordResetEmail implements ShouldQueueAfterCommit
             app(NotificationMailService::class)->sendPasswordResetCode(
                 $event->attemptId,
                 $event->tenantCode,
+                $event->channel,
             );
         } catch (Throwable $exception) {
             Log::error('Failed to send password reset email.', [
                 'attempt_id' => $event->attemptId,
                 'tenant_code' => $event->tenantCode,
+                'channel' => $event->channel,
                 'exception' => $exception,
             ]);
 

app/Domains/Notification/Services/NotificationMailService.php

@@ -5,6 +5,7 @@ namespace App\Domains\Notification\Services;
 use App\Domains\Auth\Models\ResetPasswordAttempt;
 use App\Domains\Auth\Models\User;
 use App\Domains\Integration\Services\MailService;
+use App\Domains\Notification\Events\PasswordResetRequested;
 use App\Domains\Purchase\Models\Purchase;
 use App\Domains\Tenant\Models\Tenant;
 use App\Domains\Ticket\Models\Ticket;
@@ -31,9 +32,15 @@ class NotificationMailService
             );
     }
 
-    public function sendPasswordResetCode(int $attemptId, string $tenantCode): void
+    public function sendPasswordResetCode(
-    {
+        int $attemptId,
-        $tenant = Tenant::query()->where('codigo', $tenantCode)->firstOrFail();
+        string $tenantCode,
+        string $channel = PasswordResetRequested::CHANNEL_STOREFRONT,
+    ): void {
+        $tenant = Tenant::query()
+            ->with('websiteType')
+            ->where('codigo', $tenantCode)
+            ->firstOrFail();
         $attempt = ResetPasswordAttempt::query()
             ->with('user')
             ->findOrFail($attemptId);
@@ -48,12 +55,28 @@ class NotificationMailService
             return;
         }
 
+        $recoveryDomain = match ($channel) {
+            PasswordResetRequested::CHANNEL_ADMINAPP => $tenant->websiteType?->dominio,
+            PasswordResetRequested::CHANNEL_SCANNER => $tenant->websiteType?->scanner_domain,
+            default => $tenant->dominio,
+        };
+        $recoveryQuery = ['email' => $attempt->user->email];
+        if (
+            $channel === PasswordResetRequested::CHANNEL_SCANNER
+            && $attempt->reason === ResetPasswordAttempt::REASON_STAFF_CREATED
+        ) {
+            $recoveryQuery['code'] = $attempt->codigo;
+        }
+        $recoveryUrl = $recoveryDomain === null
+            ? null
+            : 'https://'.$recoveryDomain.'/recuperar-contrasena/codigo?'.http_build_query($recoveryQuery);
+
         $this->mailService
             ->forTenant($tenantCode)
             ->send(
                 $attempt->user->email,
                 "Código para recuperar tu contraseña - {$tenant->nombre}",
-                view('mail.notifications.password-reset', compact('tenant', 'attempt'))->render(),
+                view('mail.notifications.password-reset', compact('tenant', 'attempt', 'recoveryUrl'))->render(),
             );
     }
 

app/Domains/Purchase/Exceptions/InsufficientStockException.php

@@ -0,0 +1,36 @@
+<?php
+
+namespace App\Domains\Purchase\Exceptions;
+
+use RuntimeException;
+
+class InsufficientStockException extends RuntimeException
+{
+    /**
+     * @param  array<int, array{
+     *     index: int,
+     *     catalog_item_id: int,
+     *     variant_id: int|null,
+     *     requested_quantity: int,
+     *     available_quantity: int,
+     *     message: string
+     * }>  $unavailableItems
+     */
+    public function __construct(
+        public readonly array $unavailableItems,
+    ) {
+        parent::__construct(
+            collect($unavailableItems)->pluck('message')->unique()->implode(' '),
+        );
+    }
+
+    /** @return array<string, array<int, string>> */
+    public function errors(): array
+    {
+        return collect($this->unavailableItems)
+            ->mapWithKeys(fn (array $item): array => [
+                "direct_items.{$item['index']}.cantidad" => [$item['message']],
+            ])
+            ->all();
+    }
+}

app/Domains/Purchase/Requests/StartCheckoutRequest.php

@@ -19,29 +19,21 @@ class StartCheckoutRequest extends FormRequest
     {
         return [
             'cart_id' => [
-                'required_without:direct_item',
+                'required_without:direct_items',
-                Rule::prohibitedIf(fn (): bool => $this->has('direct_item')),
+                Rule::prohibitedIf(fn (): bool => $this->has('direct_items')),
                 'integer',
                 'exists:carritos,id',
             ],
-            'direct_item' => [
+            'direct_items' => [
                 'required_without:cart_id',
                 Rule::prohibitedIf(fn (): bool => $this->has('cart_id')),
                 'array',
-            ],
-            'direct_item.catalog_item_id' => [
-                'required_with:direct_item',
-                'integer',
-            ],
-            'direct_item.variant_id' => [
-                'nullable',
-                'integer',
-            ],
-            'direct_item.cantidad' => [
-                'required_with:direct_item',
-                'integer',
                 'min:1',
             ],
+            'direct_items.*' => ['required', 'array'],
+            'direct_items.*.catalog_item_id' => ['required', 'integer'],
+            'direct_items.*.variant_id' => ['nullable', 'integer'],
+            'direct_items.*.cantidad' => ['required', 'integer', 'min:1'],
             'dni' => ['prohibited'],
             'telefono' => ['prohibited'],
             'nombre_apellido' => ['prohibited'],

app/Domains/Purchase/Services/Checkout/CatalogSelectionResolver.php

@@ -16,6 +16,7 @@ class CatalogSelectionResolver
         Tenant $tenant,
         int $catalogItemId,
         ?int $variantId,
+        string $fieldPrefix = 'direct_items',
     ): CatalogItem|Variant {
         /** @var CatalogItem|null $catalogItem */
         $catalogItem = CatalogItem::query()
@@ -31,13 +32,13 @@ class CatalogSelectionResolver
         if ($catalogItem->isBundle()) {
             if ($variantId !== null) {
                 throw ValidationException::withMessages([
-                    'direct_item.variant_id' => __('api.cart.bundle_variant_forbidden'),
+                    "{$fieldPrefix}.variant_id" => __('api.cart.bundle_variant_forbidden'),
                 ]);
             }
 
             if (! $catalogItem->bundleComponents()->exists()) {
                 throw ValidationException::withMessages([
-                    'direct_item.catalog_item_id' => __('api.cart.empty_bundle'),
+                    "{$fieldPrefix}.catalog_item_id" => __('api.cart.empty_bundle'),
                 ]);
             }
 
@@ -47,7 +48,7 @@ class CatalogSelectionResolver
         if ($variantId === null) {
             if ($catalogItem->inventory_id === null) {
                 throw ValidationException::withMessages([
-                    'direct_item.variant_id' => __('api.cart.variant_required'),
+                    "{$fieldPrefix}.variant_id" => __('api.cart.variant_required'),
                 ]);
             }
 

app/Domains/Purchase/Services/Checkout/InsufficientStockMessageBuilder.php

@@ -0,0 +1,43 @@
+<?php
+
+namespace App\Domains\Purchase\Services\Checkout;
+
+use App\Domains\Catalog\Enums\InventorySubject;
+use App\Domains\Catalog\Models\CatalogItem;
+use App\Domains\Catalog\Models\Variant;
+
+class InsufficientStockMessageBuilder
+{
+    public function build(
+        CatalogItem $catalogItem,
+        CatalogItem|Variant $selection,
+        int $availableQuantity,
+    ): string {
+        return match ($catalogItem->inventory_subject) {
+            InventorySubject::Seat => __('api.purchase.stock.seat_unavailable', [
+                'selection' => $selection->getSelectionLabel(),
+            ]),
+            InventorySubject::Ticket => __('api.purchase.stock.ticket_unavailable', [
+                'selection' => $selection->getSelectionLabel(),
+            ]),
+            InventorySubject::Product => __('api.purchase.stock.product_unavailable', [
+                'selection' => $this->productSelectionLabel($catalogItem, $selection),
+                'max' => $availableQuantity,
+            ]),
+        };
+    }
+
+    private function productSelectionLabel(
+        CatalogItem $catalogItem,
+        CatalogItem|Variant $selection,
+    ): string {
+        if ($selection instanceof CatalogItem) {
+            return $selection->getSelectionLabel();
+        }
+
+        return __('api.purchase.stock.product_selection', [
+            'product' => $catalogItem->getName(),
+            'selection' => $selection->getSelectionLabel(),
+        ]);
+    }
+}

app/Domains/Purchase/Services/Checkout/StartCheckoutService.php

@@ -7,6 +7,7 @@ use App\Domains\Cart\Models\CartItem;
 use App\Domains\Catalog\Models\CatalogItem;
 use App\Domains\Catalog\Models\Variant;
 use App\Domains\Catalog\Services\CatalogInventoryService;
+use App\Domains\Purchase\Exceptions\InsufficientStockException;
 use App\Domains\Purchase\Models\Purchase;
 use App\Domains\Purchase\Services\UserPurchaseLimitService;
 use App\Domains\Tenant\Models\Tenant;
@@ -22,6 +23,7 @@ class StartCheckoutService
         private readonly UserPurchaseLimitService $purchaseLimits,
         private readonly CatalogSelectionResolver $selections,
         private readonly PurchaseItemSnapshotFactory $snapshots,
+        private readonly InsufficientStockMessageBuilder $stockMessages,
     ) {}
 
     /** @param array<string, mixed> $purchaseData */
@@ -33,12 +35,17 @@ class StartCheckoutService
                 ->lockForUpdate()
                 ->findOrFail($tenant->getKey());
 
-            $directItem = $purchaseData['direct_item'] ?? null;
+            $directItems = $purchaseData['direct_items'] ?? null;
             $cartId = isset($purchaseData['cart_id']) ? (int) $purchaseData['cart_id'] : null;
-            unset($purchaseData['direct_item'], $purchaseData['cart_id']);
+            unset($purchaseData['direct_items'], $purchaseData['cart_id']);
 
-            if (is_array($directItem)) {
+            if (is_array($directItems)) {
-                return $this->startDirect($tenant, $userId, $purchaseData, $directItem);
+                return $this->startDirectItems(
+                    $tenant,
+                    $userId,
+                    $purchaseData,
+                    $directItems,
+                );
             }
 
             if ($cartId === null) {
@@ -53,63 +60,153 @@ class StartCheckoutService
 
     /**
      * @param  array<string, mixed>  $purchaseData
-     * @param  array<string, mixed>  $directItem
+     * @param  array<int, array<string, mixed>>  $directItems
      */
-    private function startDirect(
+    private function startDirectItems(
         Tenant $tenant,
         int $userId,
         array $purchaseData,
-        array $directItem,
+        array $directItems,
     ): Purchase {
-        $catalogItemId = (int) $directItem['catalog_item_id'];
+        $lines = collect(array_values($directItems))
-        $variantId = isset($directItem['variant_id']) ? (int) $directItem['variant_id'] : null;
+            ->map(function (array $item, int $index): array {
-        $quantity = (int) $directItem['cantidad'];
+                return [
-        $selection = $this->selections->resolve($tenant, $catalogItemId, $variantId);
+                    'index' => $index,
-        $catalogItem = $selection instanceof Variant ? $selection->catalogItem : $selection;
+                    'catalog_item_id' => (int) $item['catalog_item_id'],
+                    'variant_id' => isset($item['variant_id']) ? (int) $item['variant_id'] : null,
+                    'quantity' => (int) $item['cantidad'],
+                    'field' => "direct_items.{$index}",
+                ];
+            })
+            ->groupBy(fn (array $line): string => sprintf(
+                '%d:%s',
+                $line['catalog_item_id'],
+                $line['variant_id'] === null ? 'none' : (string) $line['variant_id'],
+            ))
+            ->map(function (Collection $duplicateLines): array {
+                $line = $duplicateLines->first();
+                $line['quantity'] = (int) $duplicateLines->sum('quantity');
 
-        $this->purchaseLimits->assertCanPurchase(
+                return $line;
-            $catalogItem,
+            })
-            $userId,
+            ->sortBy(fn (array $line): string => sprintf(
-            $quantity,
+                '%020d:%020d',
-            field: 'direct_item.cantidad',
+                $line['catalog_item_id'],
-        );
+                $line['variant_id'] ?? 0,
+            ))
+            ->values();
 
-        $availableQuantity = $this->inventory->availableQuantity($selection);
+        $resolvedLines = $lines->map(function (array $line) use ($tenant): array {
+            $selection = $this->selections->resolve(
+                $tenant,
+                $line['catalog_item_id'],
+                $line['variant_id'],
+                $line['field'],
+            );
 
-        if ($availableQuantity !== null && $availableQuantity < $quantity) {
+            return [
-            throw ValidationException::withMessages([
+                ...$line,
-                'direct_item.cantidad' => __('api.purchase.direct_item_max_stock', ['max' => $availableQuantity]),
+                'selection' => $selection,
-            ]);
+                'catalog_item' => $selection instanceof Variant
+                    ? $selection->catalogItem
+                    : $selection,
+            ];
+        });
+
+        $resolvedLines
+            ->groupBy(fn (array $line): int => $line['catalog_item']->getKey())
+            ->each(function (Collection $catalogLines) use ($userId): void {
+                /** @var CatalogItem $catalogItem */
+                $catalogItem = $catalogLines->first()['catalog_item'];
+                $this->purchaseLimits->assertCanPurchase(
+                    $catalogItem,
+                    $userId,
+                    (int) $catalogLines->sum('quantity'),
+                    field: 'direct_items',
+                );
+            });
+
+        $unavailableItems = $resolvedLines
+            ->map(function (array $line): ?array {
+                $availableQuantity = $this->inventory->availableQuantity($line['selection']);
+
+                if ($availableQuantity === null || $availableQuantity >= $line['quantity']) {
+                    return null;
+                }
+
+                return $this->unavailableItem($line, $availableQuantity);
+            })
+            ->filter()
+            ->values()
+            ->all();
+
+        if ($unavailableItems !== []) {
+            throw new InsufficientStockException($unavailableItems);
         }
 
-        try {
+        foreach ($resolvedLines as $line) {
-            $this->inventory->reserve($selection, $quantity);
+            try {
-        } catch (\InvalidArgumentException) {
+                $this->inventory->reserve($line['selection'], $line['quantity']);
-            throw ValidationException::withMessages([
+            } catch (\InvalidArgumentException) {
-                'direct_item.cantidad' => __('api.purchase.insufficient_stock'),
+                $availableQuantity = $this->inventory->availableQuantity($line['selection']) ?? 0;
-            ]);
+
+                throw new InsufficientStockException([
+                    $this->unavailableItem($line, $availableQuantity),
+                ]);
+            }
         }
 
         $purchase = $this->createPurchase(
             $tenant,
             $userId,
             $purchaseData,
-            $selection->getPrice() * $quantity,
+            (float) $resolvedLines->sum(
+                fn (array $line): float => $line['selection']->getPrice() * $line['quantity'],
+            ),
             null,
         );
-        $directCartItem = $this->makeDirectCartItem(
+
-            $selection,
+        $directCartItems = $resolvedLines->map(fn (array $line): CartItem => $this->makeDirectCartItem(
-            $catalogItemId,
+            $line['selection'],
-            $variantId,
+            $line['catalog_item_id'],
-            $quantity,
+            $line['variant_id'],
-        );
+            $line['quantity'],
+        ));
+
         $purchase->items()->createMany(
-            $this->snapshots->fromCartItems(collect([$directCartItem])),
+            $this->snapshots->fromCartItems($directCartItems),
         );
 
         return $this->loadPurchase($purchase);
     }
 
+    /**
+     * @param  array<string, mixed>  $line
+     * @return array{
+     *     index: int,
+     *     catalog_item_id: int,
+     *     variant_id: int|null,
+     *     requested_quantity: int,
+     *     available_quantity: int,
+     *     message: string
+     * }
+     */
+    private function unavailableItem(array $line, int $availableQuantity): array
+    {
+        return [
+            'index' => $line['index'],
+            'catalog_item_id' => $line['catalog_item_id'],
+            'variant_id' => $line['variant_id'],
+            'requested_quantity' => $line['quantity'],
+            'available_quantity' => $availableQuantity,
+            'message' => $this->stockMessages->build(
+                $line['catalog_item'],
+                $line['selection'],
+                $availableQuantity,
+            ),
+        ];
+    }
+
     /** @param array<string, mixed> $purchaseData */
     private function startFromCart(
         Tenant $tenant,

app/Domains/Staff/Requests/StoreStaffRequest.php

@@ -15,12 +15,17 @@ class StoreStaffRequest extends FormRequest
     /** @return array<string, mixed> */
     public function rules(): array
     {
+        $categoryRules = $this->user()->tenant()->firstOrFail()
+            ->requiresScannerCategoryValidation()
+            ? ['required', 'array', 'min:1']
+            : ['sometimes', 'array'];
+
         return [
             'nombre_apellido' => ['required', 'string', 'max:255'],
             'dni' => ['required', 'string', 'max:50'],
             'email' => ['required', 'email', 'max:255', 'unique:users,email'],
-            'category_ids' => ['required', 'array', 'min:1'],
+            'category_ids' => $categoryRules,
-            'category_ids.*' => ['required', 'integer', 'distinct', Rule::exists('categorias', 'id')],
+            'category_ids.*' => ['integer', 'distinct', Rule::exists('categorias', 'id')],
         ];
     }
 }

app/Domains/Staff/Requests/UpdateStaffRequest.php

@@ -16,6 +16,10 @@ class UpdateStaffRequest extends FormRequest
     public function rules(): array
     {
         $staffId = (int) $this->route('staff');
+        $categoryRules = $this->user()->tenant()->firstOrFail()
+            ->requiresScannerCategoryValidation()
+            ? ['required', 'array', 'min:1']
+            : ['sometimes', 'array'];
 
         return [
             'nombre_apellido' => ['required', 'string', 'max:255'],
@@ -26,8 +30,8 @@ class UpdateStaffRequest extends FormRequest
                 'max:255',
                 Rule::unique('users', 'email')->ignore($staffId),
             ],
-            'category_ids' => ['required', 'array', 'min:1'],
+            'category_ids' => $categoryRules,
-            'category_ids.*' => ['required', 'integer', 'distinct', Rule::exists('categorias', 'id')],
+            'category_ids.*' => ['integer', 'distinct', Rule::exists('categorias', 'id')],
         ];
     }
 }

app/Domains/Staff/Services/StaffService.php

@@ -2,7 +2,9 @@
 
 namespace App\Domains\Staff\Services;
 
+use App\Domains\Auth\Models\ResetPasswordAttempt;
 use App\Domains\Auth\Models\User;
+use App\Domains\Auth\Services\ResetPasswordAttemptService;
 use App\Domains\Authorization\Enums\RoleCode;
 use App\Domains\Catalog\Models\Category;
 use App\Domains\Tenant\Models\Tenant;
@@ -15,6 +17,10 @@ use Illuminate\Validation\ValidationException;
 
 class StaffService
 {
+    public function __construct(
+        private readonly ResetPasswordAttemptService $resetPasswordAttemptService,
+    ) {}
+
     /** @return Collection<int, User> */
     public function list(Tenant $tenant, ?string $search = null): Collection
     {
@@ -48,9 +54,10 @@ class StaffService
     /** @param array<string, mixed> $data */
     public function create(Tenant $tenant, array $data): User
     {
-        $this->assertCategoriesBelongToTenant($tenant, $data['category_ids']);
+        $categoryIds = $this->categoryIdsFor($tenant, $data);
+        $this->assertCategoriesBelongToTenant($tenant, $categoryIds);
 
-        return DB::transaction(function () use ($tenant, $data): User {
+        return DB::transaction(function () use ($tenant, $data, $categoryIds): User {
             $staff = User::query()->create([
                 ...Arr::only($data, ['nombre_apellido', 'dni', 'email']),
                 'email' => mb_strtolower(trim((string) $data['email'])),
@@ -58,7 +65,11 @@ class StaffService
                 'rol_codigo' => RoleCode::Scanner->value,
                 'tenant_codigo' => $tenant->codigo,
             ]);
-            $staff->scanCategories()->sync($data['category_ids']);
+            $staff->scanCategories()->sync($categoryIds);
+            $this->resetPasswordAttemptService->createForScannerEmail(
+                $staff->email,
+                ResetPasswordAttempt::REASON_STAFF_CREATED,
+            );
 
             return $staff->load('role', 'scanCategories');
         });
@@ -68,13 +79,14 @@ class StaffService
     public function update(Tenant $tenant, int $staffId, array $data): User
     {
         $staff = $this->find($tenant, $staffId);
-        $this->assertCategoriesBelongToTenant($tenant, $data['category_ids']);
+        $categoryIds = $this->categoryIdsFor($tenant, $data);
+        $this->assertCategoriesBelongToTenant($tenant, $categoryIds);
 
-        return DB::transaction(function () use ($staff, $data): User {
+        return DB::transaction(function () use ($staff, $data, $categoryIds): User {
             $attributes = Arr::only($data, ['nombre_apellido', 'dni', 'email']);
             $attributes['email'] = mb_strtolower(trim((string) $data['email']));
             $staff->update($attributes);
-            $staff->scanCategories()->sync($data['category_ids']);
+            $staff->scanCategories()->sync($categoryIds);
 
             return $staff->load('role', 'scanCategories');
         });
@@ -97,6 +109,19 @@ class StaffService
             ->where('rol_codigo', RoleCode::Scanner->value);
     }
 
+    /**
+     * @param  array<string, mixed>  $data
+     * @return array<int, int>
+     */
+    private function categoryIdsFor(Tenant $tenant, array $data): array
+    {
+        if (! $tenant->requiresScannerCategoryValidation()) {
+            return [];
+        }
+
+        return $data['category_ids'];
+    }
+
     /** @param array<int, int> $categoryIds */
     private function assertCategoriesBelongToTenant(Tenant $tenant, array $categoryIds): void
     {

app/Domains/Tenant/Models/Tenant.php

@@ -21,6 +21,7 @@ use Illuminate\Database\Eloquent\Relations\HasMany;
     'codigo',
     'nombre',
     'dominio',
+    'site_title',
     'primary_color',
     'secondary_color',
     'danger_color',
@@ -29,12 +30,17 @@ use Illuminate\Database\Eloquent\Relations\HasMany;
     'footer_bg_color',
     'header_logo_id',
     'footer_logo_id',
+    'favicon_id',
+    'header_bg_image_id',
+    'footer_bg_image_id',
     'website_type_code',
     'search_product_layout',
     'search_group_layout',
     'search_items_per_page',
     'display_categories',
     'display_seach_bar',
+    'display_cart',
+    'scanner_category_validation_enabled',
     'event_title',
     'event_location',
     'event_date_text',
@@ -49,6 +55,8 @@ class Tenant extends Model
         'search_items_per_page' => 12,
         'display_categories' => true,
         'display_seach_bar' => true,
+        'display_cart' => true,
+        'scanner_category_validation_enabled' => true,
     ];
 
     public function getRouteKeyName(): string
@@ -56,6 +64,11 @@ class Tenant extends Model
         return 'codigo';
     }
 
+    public function requiresScannerCategoryValidation(): bool
+    {
+        return $this->scanner_category_validation_enabled;
+    }
+
     /**
      * Get the attributes that should be cast.
      *
@@ -69,6 +82,8 @@ class Tenant extends Model
             'search_items_per_page' => 'integer',
             'display_categories' => 'boolean',
             'display_seach_bar' => 'boolean',
+            'display_cart' => 'boolean',
+            'scanner_category_validation_enabled' => 'boolean',
         ];
     }
 
@@ -88,6 +103,30 @@ class Tenant extends Model
         return $this->belongsTo(Attachment::class, 'footer_logo_id');
     }
 
+    /**
+     * @return BelongsTo<Attachment, $this>
+     */
+    public function favicon(): BelongsTo
+    {
+        return $this->belongsTo(Attachment::class, 'favicon_id');
+    }
+
+    /**
+     * @return BelongsTo<Attachment, $this>
+     */
+    public function headerBackgroundImage(): BelongsTo
+    {
+        return $this->belongsTo(Attachment::class, 'header_bg_image_id');
+    }
+
+    /**
+     * @return BelongsTo<Attachment, $this>
+     */
+    public function footerBackgroundImage(): BelongsTo
+    {
+        return $this->belongsTo(Attachment::class, 'footer_bg_image_id');
+    }
+
     /**
      * @return BelongsTo<WebsiteType, $this>
      */

app/Domains/Tenant/Models/WebsiteType.php

@@ -14,6 +14,7 @@ use Illuminate\Database\Eloquent\Relations\HasMany;
     'nombre',
     'dominio',
     'scanner_domain',
+    'site_title',
     'primary_color',
     'secondary_color',
     'danger_color',
@@ -27,6 +28,7 @@ use Illuminate\Database\Eloquent\Relations\HasMany;
     'login_header_footer_color',
     'site_logo',
     'footer_logo',
+    'favicon_id',
 ])]
 class WebsiteType extends Model
 {
@@ -50,6 +52,14 @@ class WebsiteType extends Model
         return $this->belongsTo(Attachment::class, 'footer_logo');
     }
 
+    /**
+     * @return BelongsTo<Attachment, $this>
+     */
+    public function favicon(): BelongsTo
+    {
+        return $this->belongsTo(Attachment::class, 'favicon_id');
+    }
+
     /**
      * @return HasMany<WebsiteTypeExtra, $this>
      */

app/Domains/Tenant/Requests/StoreTenantRequest.php

@@ -55,6 +55,7 @@ class StoreTenantRequest extends FormRequest
                 'max:255',
                 Rule::unique('tenants', 'dominio'),
             ],
+            'site_title' => ['sometimes', 'nullable', 'string', 'max:255'],
             'primary_color' => ['required', 'string', 'regex:/^#([a-fA-F0-9]{3,4}|[a-fA-F0-9]{6}|[a-fA-F0-9]{8})$/'],
             'secondary_color' => ['required', 'string', 'regex:/^#([a-fA-F0-9]{3,4}|[a-fA-F0-9]{6}|[a-fA-F0-9]{8})$/'],
             'danger_color' => ['required', 'string', 'regex:/^#([a-fA-F0-9]{3,4}|[a-fA-F0-9]{6}|[a-fA-F0-9]{8})$/'],
@@ -63,6 +64,9 @@ class StoreTenantRequest extends FormRequest
             'footer_bg_color' => ['required', 'string', 'regex:/^#([a-fA-F0-9]{3,4}|[a-fA-F0-9]{6}|[a-fA-F0-9]{8})$/'],
             'header_logo' => $logoRule,
             'footer_logo' => $logoRule,
+            'favicon' => ['sometimes', 'nullable', new ImageOrBase64Rule],
+            'header_bg_image' => ['sometimes', 'nullable', new ImageOrBase64Rule],
+            'footer_bg_image' => ['sometimes', 'nullable', new ImageOrBase64Rule],
             'social_media' => ['sometimes', 'array'],
             'social_media.*.code' => [
                 'required',
@@ -77,6 +81,8 @@ class StoreTenantRequest extends FormRequest
             'search_items_per_page' => ['sometimes', 'integer', 'min:4', 'max:48'],
             'display_categories' => ['sometimes', 'boolean'],
             'display_seach_bar' => ['sometimes', 'boolean'],
+            'display_cart' => ['sometimes', 'boolean'],
+            'scanner_category_validation_enabled' => ['sometimes', 'boolean'],
             'website_type_code' => [
                 'required_with:extras',
                 'sometimes',

app/Domains/Tenant/Requests/UpdateTenantRequest.php

@@ -65,6 +65,7 @@ class UpdateTenantRequest extends FormRequest
                 'max:255',
                 Rule::unique('tenants', 'dominio')->ignore($tenant?->id),
             ],
+            'site_title' => ['sometimes', 'nullable', 'string', 'max:255'],
             'primary_color' => ['nullable', 'string', 'regex:/^#([a-fA-F0-9]{3,4}|[a-fA-F0-9]{6}|[a-fA-F0-9]{8})$/'],
             'secondary_color' => ['nullable', 'string', 'regex:/^#([a-fA-F0-9]{3,4}|[a-fA-F0-9]{6}|[a-fA-F0-9]{8})$/'],
             'danger_color' => ['nullable', 'string', 'regex:/^#([a-fA-F0-9]{3,4}|[a-fA-F0-9]{6}|[a-fA-F0-9]{8})$/'],
@@ -73,6 +74,9 @@ class UpdateTenantRequest extends FormRequest
             'footer_bg_color' => ['nullable', 'string', 'regex:/^#([a-fA-F0-9]{3,4}|[a-fA-F0-9]{6}|[a-fA-F0-9]{8})$/'],
             'header_logo' => $logoRule,
             'footer_logo' => $logoRule,
+            'favicon' => ['sometimes', 'nullable', new ImageOrBase64Rule],
+            'header_bg_image' => ['sometimes', 'nullable', new ImageOrBase64Rule],
+            'footer_bg_image' => ['sometimes', 'nullable', new ImageOrBase64Rule],
             'social_media' => ['sometimes', 'array'],
             'social_media.*.code' => [
                 'required',
@@ -87,6 +91,8 @@ class UpdateTenantRequest extends FormRequest
             'search_items_per_page' => ['sometimes', 'integer', 'min:4', 'max:48'],
             'display_categories' => ['sometimes', 'boolean'],
             'display_seach_bar' => ['sometimes', 'boolean'],
+            'display_cart' => ['sometimes', 'boolean'],
+            'scanner_category_validation_enabled' => ['sometimes', 'boolean'],
         ];
     }
 }

app/Domains/Tenant/Resources/TenantResource.php

@@ -26,6 +26,11 @@ class TenantResource extends JsonResource
             'codigo' => $this->codigo,
             'nombre' => $this->nombre,
             'dominio' => $this->dominio,
+            'site_title' => $this->site_title
+                ?? $this->websiteType?->site_title
+                ?? 'ShopitFront',
+            'favicon' => ($this->favicon ?? $this->websiteType?->favicon)
+                ?->getTemporaryUrl(1440),
             'primary_color' => $this->primary_color,
             'secondary_color' => $this->secondary_color,
             'danger_color' => $this->danger_color,
@@ -59,11 +64,15 @@ class TenantResource extends JsonResource
             // 1 day
             'header_logo' => $this->headerLogo?->getTemporaryUrl(1440),
             'footer_logo' => $this->footerLogo?->getTemporaryUrl(1440),
+            'header_bg_image' => $this->headerBackgroundImage?->getTemporaryUrl(1440),
+            'footer_bg_image' => $this->footerBackgroundImage?->getTemporaryUrl(1440),
             'search_product_layout' => $this->search_product_layout->value,
             'search_group_layout' => $this->search_group_layout->value,
             'search_items_per_page' => $this->search_items_per_page,
             'display_categories' => $this->display_categories,
             'display_seach_bar' => $this->display_seach_bar,
+            'display_cart' => $this->display_cart,
+            'scanner_category_validation_enabled' => $this->scanner_category_validation_enabled,
             'social_media' => $this->whenLoaded(
                 'socialMedia',
                 fn () => $this->socialMedia

app/Domains/Tenant/Services/TenantInformationService.php

@@ -13,6 +13,10 @@ class TenantInformationService
     private const DEFAULT_RELATIONS = [
         'headerLogo',
         'footerLogo',
+        'favicon',
+        'websiteType.favicon',
+        'headerBackgroundImage',
+        'footerBackgroundImage',
         'socialMedia',
         'websiteExtras.websiteTypeExtra',
         'eventDates',

app/Domains/Tenant/Services/TenantService.php

@@ -25,12 +25,18 @@ class TenantService
         return DB::transaction(function () use ($data): Tenant {
             $headerLogo = $data['header_logo'] ?? null;
             $footerLogo = $data['footer_logo'] ?? null;
+            $favicon = $data['favicon'] ?? null;
+            $headerBackgroundImage = $data['header_bg_image'] ?? null;
+            $footerBackgroundImage = $data['footer_bg_image'] ?? null;
             $socialMedia = $data['social_media'] ?? [];
             $extras = $data['extras'] ?? [];
 
             unset(
                 $data['header_logo'],
                 $data['footer_logo'],
+                $data['favicon'],
+                $data['header_bg_image'],
+                $data['footer_bg_image'],
                 $data['social_media'],
                 $data['extras'],
             );
@@ -59,6 +65,9 @@ class TenantService
 
             $data['header_logo_id'] = $headerAttachmentId;
             $data['footer_logo_id'] = $footerAttachmentId;
+            $data['favicon_id'] = $this->storeTenantImage($favicon);
+            $data['header_bg_image_id'] = $this->storeTenantImage($headerBackgroundImage);
+            $data['footer_bg_image_id'] = $this->storeTenantImage($footerBackgroundImage);
 
             /** @var Tenant $tenant */
             $tenant = Tenant::query()->create($data);
@@ -79,14 +88,23 @@ class TenantService
         return DB::transaction(function () use ($tenant, $data): Tenant {
             $hasHeaderLogoKey = array_key_exists('header_logo', $data);
             $hasFooterLogoKey = array_key_exists('footer_logo', $data);
+            $hasFaviconKey = array_key_exists('favicon', $data);
+            $hasHeaderBackgroundImageKey = array_key_exists('header_bg_image', $data);
+            $hasFooterBackgroundImageKey = array_key_exists('footer_bg_image', $data);
             $hasSocialMediaKey = array_key_exists('social_media', $data);
             $headerLogo = $data['header_logo'] ?? null;
             $footerLogo = $data['footer_logo'] ?? null;
+            $favicon = $data['favicon'] ?? null;
+            $headerBackgroundImage = $data['header_bg_image'] ?? null;
+            $footerBackgroundImage = $data['footer_bg_image'] ?? null;
             $socialMedia = $data['social_media'] ?? [];
 
             unset(
                 $data['header_logo'],
                 $data['footer_logo'],
+                $data['favicon'],
+                $data['header_bg_image'],
+                $data['footer_bg_image'],
                 $data['social_media']
             );
 
@@ -124,6 +142,18 @@ class TenantService
                 }
             }
 
+            if ($hasFaviconKey) {
+                $tenant->favicon_id = $this->storeTenantImage($favicon);
+            }
+
+            if ($hasHeaderBackgroundImageKey) {
+                $tenant->header_bg_image_id = $this->storeTenantImage($headerBackgroundImage);
+            }
+
+            if ($hasFooterBackgroundImageKey) {
+                $tenant->footer_bg_image_id = $this->storeTenantImage($footerBackgroundImage);
+            }
+
             $tenant->save();
 
             if ($hasSocialMediaKey) {
@@ -151,4 +181,17 @@ class TenantService
         $tenant->socialMedia()->sync($associations);
         $tenant->unsetRelation('socialMedia');
     }
+
+    private function storeTenantImage(mixed $image): ?int
+    {
+        if (! $image) {
+            return null;
+        }
+
+        $attachment = is_string($image) && Str::isUuid($image)
+            ? Attachment::query()->where('key', $image)->first()
+            : $this->attachmentService->store($image, 'tenants');
+
+        return $attachment?->id;
+    }
 }

app/Domains/Tenant/Services/WebsiteTypeService.php

@@ -46,14 +46,20 @@ class WebsiteTypeService
         return DB::transaction(function () use ($websiteType, $data): WebsiteType {
             $previousLogos = [];
 
-            foreach (['site_logo' => 'siteLogo', 'footer_logo' => 'footerLogo'] as $field => $relation) {
+            $attachmentFields = [
+                'site_logo' => ['relation' => 'siteLogo', 'column' => 'site_logo'],
+                'footer_logo' => ['relation' => 'footerLogo', 'column' => 'footer_logo'],
+                'favicon' => ['relation' => 'favicon', 'column' => 'favicon_id'],
+            ];
+
+            foreach ($attachmentFields as $field => $attachmentField) {
                 if (! array_key_exists($field, $data)) {
                     continue;
                 }
 
                 $logo = $data[$field];
                 $previousLogos[$field] = $websiteType->exists
-                    ? $websiteType->{$relation}()->first()
+                    ? $websiteType->{$attachmentField['relation']}()->first()
                     : null;
                 unset($data[$field]);
 
@@ -65,17 +71,17 @@ class WebsiteTypeService
                         : $this->attachmentService->store($logo, 'website-types');
                 }
 
-                $data[$field] = $attachment?->id;
+                $data[$attachmentField['column']] = $attachment?->id;
             }
 
             $websiteType->fill($data)->save();
 
-            foreach ($previousLogos as $field => $previousLogo) {
+            foreach ($previousLogos as $previousLogo) {
                 if (
                     $previousLogo instanceof Attachment
-                    && $previousLogo->id !== $websiteType->{$field}
                     && $previousLogo->id !== $websiteType->site_logo
                     && $previousLogo->id !== $websiteType->footer_logo
+                    && $previousLogo->id !== $websiteType->favicon_id
                 ) {
                     $this->attachmentService->delete($previousLogo);
                 }

app/Domains/Ticket/Services/ScannerTicketService.php

@@ -69,12 +69,14 @@ class ScannerTicketService
 
     public function detail(User $scanner, string $ticketUuid): Ticket
     {
-        $categoryIds = $this->scannerCategoryIds($scanner);
+        $query = $this->baseQuery()
-
-        return $this->baseQuery()
             ->where('tenant_code', $scanner->tenant_codigo)
-            ->where('ticket', $ticketUuid)
+            ->where('ticket', $ticketUuid);
-            ->where(function (Builder $query) use ($scanner, $categoryIds): void {
+
+        if ($scanner->tenant()->firstOrFail()->requiresScannerCategoryValidation()) {
+            $categoryIds = $this->scannerCategoryIds($scanner);
+
+            $query->where(function (Builder $query) use ($scanner, $categoryIds): void {
                 $query
                     ->where('scanner_user_id', $scanner->getKey())
                     ->orWhereHas(
@@ -82,8 +84,10 @@ class ScannerTicketService
                         fn (Builder $catalogItemQuery): Builder => $catalogItemQuery
                             ->whereIn('category_id', $categoryIds)
                     );
-            })
+            });
-            ->firstOrFail();
+        }
+
+        return $query->firstOrFail();
     }
 
     public function scan(User $scanner, string $ticketUuid): Ticket
@@ -153,6 +157,10 @@ class ScannerTicketService
 
     private function scannerCanScan(User $scanner, Ticket $ticket): bool
     {
+        if (! $scanner->tenant()->firstOrFail()->requiresScannerCategoryValidation()) {
+            return true;
+        }
+
         $categoryId = $ticket->sourceCatalogItem?->category_id;
 
         return $categoryId !== null

bootstrap/app.php

@@ -1,6 +1,7 @@
 <?php
 
 use App\Domains\Auth\Exceptions\AccountLockedException;
+use App\Domains\Purchase\Exceptions\InsufficientStockException;
 use App\Domains\Ticket\Exceptions\TicketNotAvailableException;
 use App\Http\Middleware\EnsureAdminAppTenant;
 use App\Http\Middleware\EnsureScannerTenant;
@@ -74,6 +75,18 @@ return Application::configure(basePath: dirname(__DIR__))
                 'message' => __('api.errors.forbidden'),
             ], 403);
         });
+        $exceptions->render(function (InsufficientStockException $exception, Request $request) {
+            if (! $request->is('api/*')) {
+                return null;
+            }
+
+            return response()->json([
+                'code' => 'purchase.insufficient_stock',
+                'message' => $exception->getMessage(),
+                'errors' => $exception->errors(),
+                'unavailable_items' => $exception->unavailableItems,
+            ], 422);
+        });
         $exceptions->render(function (ModelNotFoundException $exception, Request $request) {
             if (! $request->is('api/*')) {
                 return null;

database/migrations/2026_08_12_010000_add_ticket_selector_and_single_catalog_layouts.php

@@ -0,0 +1,53 @@
+<?php
+
+use App\Domains\Catalog\Enums\GroupLayout;
+use App\Domains\Catalog\Enums\ProductLayout;
+use Illuminate\Database\Migrations\Migration;
+use Illuminate\Support\Facades\DB;
+
+return new class extends Migration
+{
+    public function up(): void
+    {
+        if (! in_array(DB::getDriverName(), ['mysql', 'mariadb'], true)) {
+            return;
+        }
+
+        $this->alterEnums(ProductLayout::values(), GroupLayout::values());
+    }
+
+    public function down(): void
+    {
+        if (! in_array(DB::getDriverName(), ['mysql', 'mariadb'], true)) {
+            return;
+        }
+
+        $this->alterEnums(
+            ['row', 'column_with_image', 'column_with_cart'],
+            ['paginated', 'simple', 'simple_vertical', 'carousel'],
+        );
+    }
+
+    /**
+     * @param  list<string>  $productLayouts
+     * @param  list<string>  $groupLayouts
+     */
+    private function alterEnums(array $productLayouts, array $groupLayouts): void
+    {
+        $products = $this->enumValues($productLayouts);
+        $groups = $this->enumValues($groupLayouts);
+
+        DB::statement("ALTER TABLE featured_groups MODIFY product_layout ENUM({$products}) NOT NULL");
+        DB::statement("ALTER TABLE featured_groups MODIFY group_layout ENUM({$groups}) NOT NULL DEFAULT 'paginated'");
+        DB::statement("ALTER TABLE tenants MODIFY search_product_layout ENUM({$products}) NOT NULL DEFAULT 'column_with_image'");
+        DB::statement("ALTER TABLE tenants MODIFY search_group_layout ENUM({$groups}) NOT NULL DEFAULT 'paginated'");
+    }
+
+    /** @param list<string> $values */
+    private function enumValues(array $values): string
+    {
+        return collect($values)
+            ->map(fn (string $value): string => DB::getPdo()->quote($value))
+            ->implode(',');
+    }
+};

database/migrations/2026_08_12_020000_create_desfile_pura_tendencia_tenant.php

@@ -0,0 +1,329 @@
+<?php
+
+use Illuminate\Database\Migrations\Migration;
+use Illuminate\Support\Facades\DB;
+use Illuminate\Support\Facades\Storage;
+use Illuminate\Support\Str;
+
+return new class extends Migration
+{
+    private const TENANT_CODE = 'desfile_pura_tendencia';
+
+    private const SOURCE_TENANT_CODE = 'fiesta_futbol_infantil';
+
+    /** @var list<string> */
+    private array $storedPaths = [];
+
+    public function up(): void
+    {
+        if (DB::table('tenants')->where('codigo', self::TENANT_CODE)->exists()) {
+            return;
+        }
+
+        $heroExtraId = DB::table('website_type_extras')
+            ->where('website_type_code', 'onticket')
+            ->where('codigo', 'heroConfig')
+            ->value('id');
+
+        if (
+            $heroExtraId === null
+            || ! DB::table('website_type')->where('codigo', 'onticket')->exists()
+            || ! DB::table('tenants')->where('codigo', self::SOURCE_TENANT_CODE)->exists()
+        ) {
+            // This data migration targets installations whose reference data was
+            // already provisioned. Fresh test databases do not contain seed data.
+            return;
+        }
+
+        try {
+            DB::transaction(function () use ($heroExtraId): void {
+                $headerLogoId = $this->storeImage(
+                    'images/tennants/desfile_pura_tendencia/desfile_pura_tendencia_header.png',
+                    'desfile_pura_tendencia_header.png',
+                    'tenants/'.self::TENANT_CODE,
+                );
+                $footerLogoId = $this->storeImage(
+                    'images/tennants/desfile_pura_tendencia/desfile_pura_tendencia_footer.png',
+                    'desfile_pura_tendencia_footer.png',
+                    'tenants/'.self::TENANT_CODE,
+                );
+                $heroImageId = $this->storeImage(
+                    'images/tennants/desfile_pura_tendencia/desfile_pura_tendencia_hero.png',
+                    'desfile_pura_tendencia_hero.png',
+                    'tenants/'.self::TENANT_CODE.'/extras/heroConfig',
+                );
+
+                $now = now();
+
+                DB::table('tenants')->insert([
+                    'codigo' => self::TENANT_CODE,
+                    'nombre' => 'Desfile Pura Tendencia',
+                    'dominio' => 'desfile-pura-tendencia.localhost',
+                    'event_title' => 'Desfile Pura Tendencia',
+                    'event_location' => 'Salón Centro Recreativo Luz y Fuerza',
+                    'event_date_text' => '16 de Octubre 2026',
+                    'primary_color' => '#BA69A9',
+                    'secondary_color' => '#A0A0A0',
+                    'danger_color' => '#FF8888',
+                    'success_color' => '#198754',
+                    'header_bg_color' => '#ffffff',
+                    'footer_bg_color' => '#D4441C',
+                    'header_logo_id' => $headerLogoId,
+                    'footer_logo_id' => $footerLogoId,
+                    'website_type_code' => 'onticket',
+                    'display_categories' => false,
+                    'display_seach_bar' => false,
+                    'created_at' => $now,
+                    'updated_at' => $now,
+                ]);
+
+                $validityTimeId = DB::table('validity_times')->insertGetId([
+                    'type' => 'fixed_window',
+                    'start_time' => null,
+                    'end_time' => null,
+                    'fixed_starts_at' => '2026-10-16 20:30:00',
+                    'fixed_expires_at' => '2026-10-16 23:59:00',
+                    'created_at' => $now,
+                    'updated_at' => $now,
+                ]);
+
+                DB::table('event_dates')->insert([
+                    'tenant_code' => self::TENANT_CODE,
+                    'validity_time_id' => $validityTimeId,
+                    'date' => '2026-10-16',
+                    'time_start' => '20:30:00',
+                    'time_end' => '23:59:00',
+                ]);
+
+                $this->createEntryCatalog($validityTimeId, $now);
+
+                DB::table('websites_extras')->insert([
+                    'website_code' => self::TENANT_CODE,
+                    'website_type_extra_id' => $heroExtraId,
+                    'config' => json_encode([
+                        'title_html' => '<h1>LA NOCHE DE LA MODA</h1>',
+                        'description_html' => 'Viví una experiencia de <b>Alta Costura con conducción exclusiva de Pampita</b> y las colecciones de Pucheta-Paz.',
+                        'background_image_id' => $heroImageId,
+                    ], JSON_UNESCAPED_UNICODE | JSON_UNESCAPED_SLASHES),
+                    'is_enabled' => true,
+                    'created_at' => $now,
+                    'updated_at' => $now,
+                ]);
+
+                $menuAssignments = DB::table('tenants_menues')
+                    ->where('tenant_code', self::SOURCE_TENANT_CODE)
+                    ->where('menu_code', 'not like', 'adminapp.fiesta-futbol-infantil.%')
+                    ->orderBy('id')
+                    ->get(['menu_code', 'static_content']);
+
+                foreach ($menuAssignments as $assignment) {
+                    DB::table('tenants_menues')->insert([
+                        'tenant_code' => self::TENANT_CODE,
+                        'menu_code' => $assignment->menu_code,
+                        'static_content' => $assignment->static_content,
+                        'created_at' => $now,
+                        'updated_at' => $now,
+                    ]);
+                }
+            });
+        } catch (Throwable $throwable) {
+            Storage::disk('s3')->delete($this->storedPaths);
+
+            throw $throwable;
+        }
+    }
+
+    public function down(): void
+    {
+        // Intentionally irreversible: once active, this tenant can own users,
+        // purchases, tickets and catalog data that a rollback must not delete.
+    }
+
+    private function storeImage(string $relativePath, string $filename, string $directory): int
+    {
+        $sourcePath = public_path($relativePath);
+
+        if (! is_file($sourcePath)) {
+            throw new RuntimeException("Image not found at path: {$sourcePath}");
+        }
+
+        $contents = file_get_contents($sourcePath);
+
+        if ($contents === false) {
+            throw new RuntimeException("Could not read image at path: {$sourcePath}");
+        }
+
+        $key = (string) Str::uuid();
+        $storedPath = trim($directory, '/').'/'.$key.'.png';
+
+        if (! Storage::disk('s3')->put($storedPath, $contents)) {
+            throw new RuntimeException("Could not store image at path: {$storedPath}");
+        }
+
+        $this->storedPaths[] = $storedPath;
+
+        return DB::table('attachments')->insertGetId([
+            'key' => $key,
+            'path' => $storedPath,
+            'filename' => $filename,
+            'type' => 'image',
+            'mime_type' => 'image/png',
+            'extension' => 'png',
+            'size' => strlen($contents),
+            'created_at' => now(),
+            'updated_at' => now(),
+        ]);
+    }
+
+    private function createEntryCatalog(int $validityTimeId, DateTimeInterface $now): void
+    {
+        $attributes = [
+            'tipo' => [
+                'name' => 'Tipo',
+                'options' => ['VIP + LUNCH', 'NORMAL'],
+            ],
+            'sector' => [
+                'name' => 'Sector',
+                'options' => ['A', 'B', 'C', 'D'],
+            ],
+            'fila' => [
+                'name' => 'Fila',
+                'options' => array_map('strval', range(1, 17)),
+            ],
+            'asiento' => [
+                'name' => 'Asiento',
+                'options' => array_map('strval', range(1, 5)),
+            ],
+        ];
+        $attributeIds = [];
+
+        foreach ($attributes as $code => $definition) {
+            $attributeId = DB::table('attribute')->insertGetId([
+                'tenant_codigo' => self::TENANT_CODE,
+                'codigo' => $code,
+                'nombre' => $definition['name'],
+                'is_required' => true,
+                'metadata_schema' => null,
+                'type' => 'select',
+                'created_at' => $now,
+                'updated_at' => $now,
+            ]);
+            $attributeIds[$code] = $attributeId;
+
+            foreach ($definition['options'] as $index => $option) {
+                DB::table('attribute_options')->insert([
+                    'attribute_id' => $attributeId,
+                    'validity_time_id' => null,
+                    'value' => $option,
+                    'label' => $option,
+                    'sort_order' => $index + 1,
+                    'metadata' => null,
+                    'created_at' => $now,
+                    'updated_at' => $now,
+                ]);
+            }
+        }
+
+        $catalogItemId = DB::table('catalog_items')->insertGetId([
+            'tenant_code' => self::TENANT_CODE,
+            'category_id' => null,
+            'brand_id' => null,
+            'inventory_id' => null,
+            'type' => 'standard',
+            'slug' => 'entrada',
+            'nombre' => 'Entrada',
+            'descripcion' => 'Entrada para Desfile Pura Tendencia',
+            'precio' => 40000,
+            'inventory_policy' => 'tracked',
+            'has_tickets' => true,
+            'ticket_generation_policy' => 'one_per_unit',
+            'validity_time_id' => $validityTimeId,
+            'max_units_per_user' => null,
+        ]);
+        $itemAttributeIds = [];
+
+        foreach (array_keys($attributes) as $index => $code) {
+            $itemAttributeIds[$code] = DB::table('item_attributes')->insertGetId([
+                'catalog_item_id' => $catalogItemId,
+                'attribute_id' => $attributeIds[$code],
+                'allow_multi_select' => false,
+                'sort_order' => $index + 1,
+                'created_at' => $now,
+                'updated_at' => $now,
+            ]);
+        }
+
+        foreach (['A', 'B', 'C', 'D'] as $sector) {
+            $lastRow = in_array($sector, ['B', 'D'], true) ? 16 : 17;
+
+            foreach (range(1, $lastRow) as $row) {
+                foreach (range(1, 5) as $seat) {
+                    [$type, $price] = $this->entryTypeAndPrice($sector, $seat);
+                    $inventoryId = DB::table('inventories')->insertGetId([
+                        'sold_units' => 0,
+                        'reserved_stock' => 0,
+                        'real_stock' => 1,
+                    ]);
+                    $variantId = DB::table('variantes')->insertGetId([
+                        'catalog_item_id' => $catalogItemId,
+                        'event_date_id' => null,
+                        'inventory_id' => $inventoryId,
+                        'descripcion' => "Sector {$sector} - Fila {$row} - Asiento {$seat} - {$type}",
+                        'precio' => $price,
+                    ]);
+
+                    foreach ([
+                        'tipo' => $type,
+                        'sector' => $sector,
+                        'fila' => (string) $row,
+                        'asiento' => (string) $seat,
+                    ] as $code => $value) {
+                        DB::table('variant_values')->insert([
+                            'variant_id' => $variantId,
+                            'item_attribute_id' => $itemAttributeIds[$code],
+                            'value' => $value,
+                            'created_at' => $now,
+                            'updated_at' => $now,
+                        ]);
+                    }
+                }
+            }
+        }
+
+        $entryImageId = $this->storeImage(
+            'images/tennants/desfile_pura_tendencia/catalog/entrada_pasarela.png',
+            'entrada_pasarela.png',
+            'catalog-items',
+        );
+
+        DB::table('catalog_items_attachments')->insert([
+            'variant_id' => null,
+            'catalog_item_id' => $catalogItemId,
+            'attachment_id' => $entryImageId,
+            'orden' => 0,
+        ]);
+
+        DB::table('featured_groups')->insert([
+            'tenant_code' => self::TENANT_CODE,
+            'source_type' => 'all',
+            'category_id' => null,
+            'product_layout' => 'ticket_selector',
+            'group_layout' => 'single',
+            'group_name' => 'Entradas',
+            'group_order' => 0,
+        ]);
+    }
+
+    /** @return array{string, int} */
+    private function entryTypeAndPrice(string $sector, int $seat): array
+    {
+        $prices = in_array($sector, ['A', 'C'], true)
+            ? [1 => 250000, 2 => 200000, 3 => 100000, 4 => 75000, 5 => 50000]
+            : [1 => 240000, 2 => 190000, 3 => 90000, 4 => 65000, 5 => 40000];
+
+        return [
+            $seat <= 2 ? 'VIP + LUNCH' : 'NORMAL',
+            $prices[$seat],
+        ];
+    }
+};

database/migrations/2026_08_12_030000_add_show_in_selector_to_item_attributes.php

@@ -0,0 +1,35 @@
+<?php
+
+use Illuminate\Database\Migrations\Migration;
+use Illuminate\Database\Schema\Blueprint;
+use Illuminate\Support\Facades\DB;
+use Illuminate\Support\Facades\Schema;
+
+return new class extends Migration
+{
+    public function up(): void
+    {
+        Schema::table('item_attributes', function (Blueprint $table): void {
+            $table->boolean('show_in_selector')->default(true)->after('sort_order');
+        });
+
+        $abonoDateAttributeIds = DB::table('item_attributes')
+            ->join('catalog_items', 'catalog_items.id', '=', 'item_attributes.catalog_item_id')
+            ->join('attribute', 'attribute.id', '=', 'item_attributes.attribute_id')
+            ->where('catalog_items.tenant_code', 'fiesta_futbol_infantil')
+            ->where('catalog_items.slug', 'abono')
+            ->where('attribute.codigo', 'event_date')
+            ->pluck('item_attributes.id');
+
+        DB::table('item_attributes')
+            ->whereIn('id', $abonoDateAttributeIds)
+            ->update(['show_in_selector' => false]);
+    }
+
+    public function down(): void
+    {
+        Schema::table('item_attributes', function (Blueprint $table): void {
+            $table->dropColumn('show_in_selector');
+        });
+    }
+};

database/migrations/2026_08_12_030000_remove_event_date_from_desfile_entry_variants.php

@@ -0,0 +1,66 @@
+<?php
+
+use Illuminate\Database\Migrations\Migration;
+use Illuminate\Support\Collection;
+use Illuminate\Support\Facades\DB;
+
+return new class extends Migration
+{
+    private const TENANT_CODE = 'desfile_pura_tendencia';
+
+    private const CATALOG_SLUG = 'entrada';
+
+    public function up(): void
+    {
+        $variantIds = $this->variantIds();
+
+        if ($variantIds->isEmpty()) {
+            return;
+        }
+
+        DB::transaction(function () use ($variantIds): void {
+            DB::table('variant_event_dates')
+                ->whereIn('variant_id', $variantIds)
+                ->delete();
+
+            DB::table('variantes')
+                ->whereIn('id', $variantIds)
+                ->update(['event_date_id' => null]);
+        });
+    }
+
+    public function down(): void
+    {
+        $eventDateId = DB::table('event_dates')
+            ->where('tenant_code', self::TENANT_CODE)
+            ->where('date', '2026-10-16')
+            ->value('id');
+        $variantIds = $this->variantIds();
+
+        if ($eventDateId === null || $variantIds->isEmpty()) {
+            return;
+        }
+
+        DB::transaction(function () use ($eventDateId, $variantIds): void {
+            DB::table('variantes')
+                ->whereIn('id', $variantIds)
+                ->update(['event_date_id' => $eventDateId]);
+
+            foreach ($variantIds as $variantId) {
+                DB::table('variant_event_dates')->insertOrIgnore([
+                    'variant_id' => $variantId,
+                    'event_date_id' => $eventDateId,
+                ]);
+            }
+        });
+    }
+
+    private function variantIds(): Collection
+    {
+        return DB::table('variantes')
+            ->join('catalog_items', 'catalog_items.id', '=', 'variantes.catalog_item_id')
+            ->where('catalog_items.tenant_code', self::TENANT_CODE)
+            ->where('catalog_items.slug', self::CATALOG_SLUG)
+            ->pluck('variantes.id');
+    }
+};

database/migrations/2026_08_12_040000_add_display_cart_to_tenants_table.php

@@ -0,0 +1,28 @@
+<?php
+
+use Illuminate\Database\Migrations\Migration;
+use Illuminate\Database\Schema\Blueprint;
+use Illuminate\Support\Facades\DB;
+use Illuminate\Support\Facades\Schema;
+
+return new class extends Migration
+{
+    public function up(): void
+    {
+        Schema::table('tenants', function (Blueprint $table): void {
+            $table->boolean('display_cart')->default(true)->after('display_seach_bar');
+        });
+
+        DB::table('tenants')->update(['display_cart' => true]);
+        DB::table('tenants')
+            ->where('codigo', 'desfile_pura_tendencia')
+            ->update(['display_cart' => false]);
+    }
+
+    public function down(): void
+    {
+        Schema::table('tenants', function (Blueprint $table): void {
+            $table->dropColumn('display_cart');
+        });
+    }
+};

database/migrations/2026_08_12_050000_add_background_images_to_tenants_table.php

@@ -0,0 +1,32 @@
+<?php
+
+use Illuminate\Database\Migrations\Migration;
+use Illuminate\Database\Schema\Blueprint;
+use Illuminate\Support\Facades\Schema;
+
+return new class extends Migration
+{
+    public function up(): void
+    {
+        Schema::table('tenants', function (Blueprint $table): void {
+            $table->foreignId('header_bg_image_id')
+                ->nullable()
+                ->after('footer_logo_id')
+                ->constrained('attachments')
+                ->nullOnDelete();
+            $table->foreignId('footer_bg_image_id')
+                ->nullable()
+                ->after('header_bg_image_id')
+                ->constrained('attachments')
+                ->nullOnDelete();
+        });
+    }
+
+    public function down(): void
+    {
+        Schema::table('tenants', function (Blueprint $table): void {
+            $table->dropConstrainedForeignId('footer_bg_image_id');
+            $table->dropConstrainedForeignId('header_bg_image_id');
+        });
+    }
+};

database/migrations/2026_08_12_060000_set_desfile_footer_background_image.php

@@ -0,0 +1,78 @@
+<?php
+
+use Illuminate\Database\Migrations\Migration;
+use Illuminate\Support\Facades\DB;
+use Illuminate\Support\Facades\Storage;
+use Illuminate\Support\Str;
+
+return new class extends Migration
+{
+    private const TENANT_CODE = 'desfile_pura_tendencia';
+
+    private const FILENAME = 'desfile_pura_tendencia_footer_background.png';
+
+    public function up(): void
+    {
+        $tenant = DB::table('tenants')
+            ->where('codigo', self::TENANT_CODE)
+            ->first(['id', 'footer_bg_image_id']);
+
+        if ($tenant === null || $tenant->footer_bg_image_id !== null) {
+            return;
+        }
+
+        $sourcePath = public_path(
+            'images/tennants/desfile_pura_tendencia/'.self::FILENAME
+        );
+
+        if (! is_file($sourcePath)) {
+            throw new RuntimeException("Image not found at path: {$sourcePath}");
+        }
+
+        $contents = file_get_contents($sourcePath);
+
+        if ($contents === false) {
+            throw new RuntimeException("Could not read image at path: {$sourcePath}");
+        }
+
+        $key = (string) Str::uuid();
+        $storedPath = 'tenants/'.self::TENANT_CODE.'/'.$key.'.png';
+
+        if (! Storage::disk('s3')->put($storedPath, $contents)) {
+            throw new RuntimeException("Could not store image at path: {$storedPath}");
+        }
+
+        try {
+            DB::transaction(function () use ($contents, $key, $storedPath): void {
+                $attachmentId = DB::table('attachments')->insertGetId([
+                    'key' => $key,
+                    'path' => $storedPath,
+                    'filename' => self::FILENAME,
+                    'type' => 'image',
+                    'mime_type' => 'image/png',
+                    'extension' => 'png',
+                    'size' => strlen($contents),
+                    'created_at' => now(),
+                    'updated_at' => now(),
+                ]);
+
+                DB::table('tenants')
+                    ->where('codigo', self::TENANT_CODE)
+                    ->update([
+                        'footer_bg_image_id' => $attachmentId,
+                        'updated_at' => now(),
+                    ]);
+            });
+        } catch (Throwable $throwable) {
+            Storage::disk('s3')->delete($storedPath);
+
+            throw $throwable;
+        }
+    }
+
+    public function down(): void
+    {
+        // The attachment may already be referenced externally; keep this data
+        // migration irreversible instead of deleting a potentially active asset.
+    }
+};

database/migrations/2026_08_12_070000_add_inventory_subject_to_catalog_items.php

@@ -0,0 +1,31 @@
+<?php
+
+use App\Domains\Catalog\Enums\InventorySubject;
+use Illuminate\Database\Migrations\Migration;
+use Illuminate\Database\Schema\Blueprint;
+use Illuminate\Support\Facades\DB;
+use Illuminate\Support\Facades\Schema;
+
+return new class extends Migration
+{
+    public function up(): void
+    {
+        Schema::table('catalog_items', function (Blueprint $table): void {
+            $table->enum('inventory_subject', InventorySubject::values())
+                ->default(InventorySubject::Product->value)
+                ->after('inventory_policy');
+        });
+
+        DB::table('catalog_items')
+            ->where('tenant_code', 'desfile_pura_tendencia')
+            ->where('slug', 'entrada')
+            ->update(['inventory_subject' => InventorySubject::Seat->value]);
+    }
+
+    public function down(): void
+    {
+        Schema::table('catalog_items', function (Blueprint $table): void {
+            $table->dropColumn('inventory_subject');
+        });
+    }
+};

database/migrations/2026_08_13_000000_add_desfile_entries_adminapp_menu.php

@@ -0,0 +1,78 @@
+<?php
+
+use Illuminate\Database\Migrations\Migration;
+use Illuminate\Support\Facades\DB;
+
+return new class extends Migration
+{
+    private const MENU_CODE = 'adminapp.desfile.entradas';
+
+    private const TENANT_CODE = 'desfile_pura_tendencia';
+
+    public function up(): void
+    {
+        if (! DB::table('menues')->where('code', 'main.adminapp')->exists()) {
+            // Reference data is added by seeders on fresh installations.
+            return;
+        }
+
+        $now = now();
+
+        DB::transaction(function () use ($now): void {
+            DB::table('menues')->updateOrInsert(
+                ['code' => self::MENU_CODE],
+                [
+                    'label' => 'Entradas',
+                    'parent_menu_code' => 'main.adminapp',
+                    'content_type' => 'dynamic',
+                    'static_content_schema' => null,
+                    'route' => '/admin/desfile/entradas',
+                    'created_at' => $now,
+                    'updated_at' => $now,
+                ],
+            );
+
+            if (DB::table('tenants')->where('codigo', self::TENANT_CODE)->exists()) {
+                DB::table('tenants_menues')->updateOrInsert(
+                    [
+                        'tenant_code' => self::TENANT_CODE,
+                        'menu_code' => self::MENU_CODE,
+                    ],
+                    [
+                        'static_content' => null,
+                        'created_at' => $now,
+                        'updated_at' => $now,
+                    ],
+                );
+            }
+
+            DB::table('roles')
+                ->whereIn('codigo', ['admin', 'adminapp'])
+                ->pluck('codigo')
+                ->each(function (string $roleCode): void {
+                    DB::table('roles_menues')->updateOrInsert([
+                        'rol_codigo' => $roleCode,
+                        'menu_codigo' => self::MENU_CODE,
+                    ]);
+                });
+        });
+    }
+
+    public function down(): void
+    {
+        DB::transaction(function (): void {
+            DB::table('tenants_menues')
+                ->where('tenant_code', self::TENANT_CODE)
+                ->where('menu_code', self::MENU_CODE)
+                ->delete();
+
+            DB::table('roles_menues')
+                ->where('menu_codigo', self::MENU_CODE)
+                ->delete();
+
+            DB::table('menues')
+                ->where('code', self::MENU_CODE)
+                ->delete();
+        });
+    }
+};

database/migrations/2026_08_13_010000_fix_desfile_entries_adminapp_menu_route.php

@@ -0,0 +1,29 @@
+<?php
+
+use Illuminate\Database\Migrations\Migration;
+use Illuminate\Support\Facades\DB;
+
+return new class extends Migration
+{
+    private const MENU_CODE = 'adminapp.desfile.entradas';
+
+    public function up(): void
+    {
+        DB::table('menues')
+            ->where('code', self::MENU_CODE)
+            ->update([
+                'route' => '/admin/desfile/entradas',
+                'updated_at' => now(),
+            ]);
+    }
+
+    public function down(): void
+    {
+        DB::table('menues')
+            ->where('code', self::MENU_CODE)
+            ->update([
+                'route' => '/admin/entradas',
+                'updated_at' => now(),
+            ]);
+    }
+};

database/migrations/2026_08_13_020000_add_scanner_category_validation_to_tenants_table.php

@@ -0,0 +1,31 @@
+<?php
+
+use Illuminate\Database\Migrations\Migration;
+use Illuminate\Database\Schema\Blueprint;
+use Illuminate\Support\Facades\DB;
+use Illuminate\Support\Facades\Schema;
+
+return new class extends Migration
+{
+    private const DESFILE_TENANT_CODE = 'desfile_pura_tendencia';
+
+    public function up(): void
+    {
+        Schema::table('tenants', function (Blueprint $table): void {
+            $table->boolean('scanner_category_validation_enabled')
+                ->default(true)
+                ->after('display_cart');
+        });
+
+        DB::table('tenants')
+            ->where('codigo', self::DESFILE_TENANT_CODE)
+            ->update(['scanner_category_validation_enabled' => false]);
+    }
+
+    public function down(): void
+    {
+        Schema::table('tenants', function (Blueprint $table): void {
+            $table->dropColumn('scanner_category_validation_enabled');
+        });
+    }
+};

database/migrations/2026_08_14_000000_add_browser_branding_to_tenants_and_website_type.php

@@ -0,0 +1,55 @@
+<?php
+
+use Illuminate\Database\Migrations\Migration;
+use Illuminate\Database\Schema\Blueprint;
+use Illuminate\Support\Facades\DB;
+use Illuminate\Support\Facades\Schema;
+
+return new class extends Migration
+{
+    public function up(): void
+    {
+        Schema::table('website_type', function (Blueprint $table): void {
+            $table->string('site_title')->nullable()->after('scanner_domain');
+            $table->unsignedBigInteger('favicon_id')->nullable()->after('footer_logo');
+
+            $table->foreign('favicon_id')
+                ->references('id')
+                ->on('attachments')
+                ->nullOnDelete();
+        });
+
+        Schema::table('tenants', function (Blueprint $table): void {
+            $table->string('site_title')->nullable()->after('dominio');
+            $table->unsignedBigInteger('favicon_id')->nullable()->after('footer_logo_id');
+
+            $table->foreign('favicon_id')
+                ->references('id')
+                ->on('attachments')
+                ->nullOnDelete();
+        });
+
+        DB::table('website_type')
+            ->whereNull('site_title')
+            ->update(['site_title' => DB::raw('nombre')]);
+    }
+
+    public function down(): void
+    {
+        Schema::table('tenants', function (Blueprint $table): void {
+            if (Schema::getConnection()->getDriverName() !== 'sqlite') {
+                $table->dropForeign(['favicon_id']);
+            }
+
+            $table->dropColumn(['site_title', 'favicon_id']);
+        });
+
+        Schema::table('website_type', function (Blueprint $table): void {
+            if (Schema::getConnection()->getDriverName() !== 'sqlite') {
+                $table->dropForeign(['favicon_id']);
+            }
+
+            $table->dropColumn(['site_title', 'favicon_id']);
+        });
+    }
+};

database/migrations/2026_08_14_010000_set_seeded_tenant_browser_branding.php

@@ -0,0 +1,134 @@
+<?php
+
+use Illuminate\Database\Migrations\Migration;
+use Illuminate\Support\Facades\DB;
+use Illuminate\Support\Facades\Storage;
+use Illuminate\Support\Str;
+
+return new class extends Migration
+{
+    /** @var array<string, array{title: string, image: string, filename: string}> */
+    private const BRANDING = [
+        'fiesta_futbol_infantil' => [
+            'title' => 'Fiesta Fútbol Infantil',
+            'image' => 'images/tennants/fiesta_futbol_infantil/futbol_infantil_favicon.png',
+            'filename' => 'futbol_infantil_favicon.png',
+        ],
+        'desfile_pura_tendencia' => [
+            'title' => 'Desfile Pura Tendencia',
+            'image' => 'images/tennants/desfile_pura_tendencia/pura_tendencia_favicon.png',
+            'filename' => 'pura_tendencia_favicon.png',
+        ],
+    ];
+
+    /** @var list<string> */
+    private array $storedPaths = [];
+
+    public function up(): void
+    {
+        try {
+            DB::transaction(function (): void {
+                foreach (self::BRANDING as $tenantCode => $branding) {
+                    $tenant = DB::table('tenants')
+                        ->where('codigo', $tenantCode)
+                        ->first(['id', 'favicon_id']);
+
+                    if ($tenant === null) {
+                        continue;
+                    }
+
+                    $faviconId = $tenant->favicon_id;
+                    $currentFilename = $faviconId === null
+                        ? null
+                        : DB::table('attachments')->where('id', $faviconId)->value('filename');
+
+                    if ($currentFilename !== $branding['filename']) {
+                        $faviconId = $this->storeFavicon(
+                            $tenantCode,
+                            $branding['image'],
+                            $branding['filename'],
+                        );
+                    }
+
+                    DB::table('tenants')
+                        ->where('id', $tenant->id)
+                        ->update([
+                            'site_title' => $branding['title'],
+                            'favicon_id' => $faviconId,
+                            'updated_at' => now(),
+                        ]);
+                }
+            });
+        } catch (Throwable $throwable) {
+            Storage::disk('s3')->delete($this->storedPaths);
+
+            throw $throwable;
+        }
+    }
+
+    public function down(): void
+    {
+        foreach (self::BRANDING as $tenantCode => $branding) {
+            $tenant = DB::table('tenants')
+                ->where('codigo', $tenantCode)
+                ->first(['id', 'site_title', 'favicon_id']);
+
+            if ($tenant === null) {
+                continue;
+            }
+
+            $favicon = $tenant->favicon_id === null
+                ? null
+                : DB::table('attachments')->where('id', $tenant->favicon_id)->first();
+
+            DB::table('tenants')
+                ->where('id', $tenant->id)
+                ->update([
+                    'site_title' => $tenant->site_title === $branding['title'] ? null : $tenant->site_title,
+                    'favicon_id' => $favicon?->filename === $branding['filename'] ? null : $tenant->favicon_id,
+                    'updated_at' => now(),
+                ]);
+
+            if ($favicon?->filename === $branding['filename']) {
+                Storage::disk('s3')->delete($favicon->path);
+                DB::table('attachments')->where('id', $favicon->id)->delete();
+            }
+        }
+    }
+
+    private function storeFavicon(string $tenantCode, string $relativePath, string $filename): int
+    {
+        $sourcePath = public_path($relativePath);
+
+        if (! is_file($sourcePath)) {
+            throw new RuntimeException("Favicon not found at path: {$sourcePath}");
+        }
+
+        $contents = file_get_contents($sourcePath);
+
+        if ($contents === false) {
+            throw new RuntimeException("Could not read favicon at path: {$sourcePath}");
+        }
+
+        $key = (string) Str::uuid();
+        $storedPath = "tenants/{$tenantCode}/{$key}.png";
+
+        if (! Storage::disk('s3')->put($storedPath, $contents)) {
+            throw new RuntimeException("Could not store favicon at path: {$storedPath}");
+        }
+
+        $this->storedPaths[] = $storedPath;
+
+        return DB::table('attachments')->insertGetId([
+            'key' => $key,
+            'path' => $storedPath,
+            'filename' => $filename,
+            'type' => 'image',
+            'mime_type' => 'image/png',
+            'extension' => 'png',
+            'size' => strlen($contents),
+            'created_at' => now(),
+            'updated_at' => now(),
+        ]);
+    }
+};

database/seeders/FiestaFutbolInfantilProductSeeder.php

@@ -132,6 +132,7 @@ class FiestaFutbolInfantilProductSeeder extends Seeder
             'has_tickets' => true,
             'attribute_codes' => ['event_date'],
             'multi_select_attribute_codes' => ['event_date'],
+            'hidden_attribute_codes' => ['event_date'],
             'variants' => [[
                 'real_stock' => 120,
                 'event_date_ids' => $dateIds->all(),

database/seeders/MenuSeeder.php

@@ -102,6 +102,12 @@ class MenuSeeder extends Seeder
                 'parent_menu_code' => 'main.adminapp',
                 'route' => '/admin/comidas',
             ],
+            [
+                'code' => 'adminapp.desfile.entradas',
+                'label' => 'Entradas',
+                'parent_menu_code' => 'main.adminapp',
+                'route' => '/admin/desfile/entradas',
+            ],
             [
                 'code' => 'account',
                 'label' => 'Mi cuenta',
@@ -272,6 +278,9 @@ class MenuSeeder extends Seeder
             'adminapp.categories',
             'adminapp.combos',
         ];
+        $desfileMenuCodes = [
+            'adminapp.desfile.entradas',
+        ];
         $frequentlyAskedQuestions = [
             [
                 'pregunta' => '¿Hay algún límite de compra?',
@@ -335,6 +344,10 @@ class MenuSeeder extends Seeder
                 $menuCodes = array_diff($menuCodes, $fiestaExcludedAdminMenuCodes);
             }
 
+            if ($tenant->codigo !== 'desfile_pura_tendencia') {
+                $menuCodes = array_diff($menuCodes, $desfileMenuCodes);
+            }
+
             // Usar sync para asociar los menues al tenant
             $tenant->menues()->sync($menuCodes);
 

database/seeders/TenantSeeder.php

@@ -58,6 +58,7 @@ class TenantSeeder extends Seeder
             'footer_bg_color' => '#313131',
             'display_categories' => true,
             'display_seach_bar' => true,
+            'display_cart' => true,
             'header_logo' => $this->uploadedImage('images/tennants/sonder/sonder_header.png', 'sonder_header.png'),
             'footer_logo' => $this->uploadedImage('images/tennants/sonder/sonder_footer.png', 'sonder_footer.png'),
             'social_media' => self::SOCIAL_MEDIA,
@@ -103,6 +104,7 @@ class TenantSeeder extends Seeder
             'codigo' => 'fiesta_futbol_infantil',
             'nombre' => 'Fiesta Fútbol Infantil',
             'dominio' => $fiestaDomain,
+            'site_title' => 'Fiesta Fútbol Infantil',
             'primary_color' => '#00973F',
             'secondary_color' => '#A0A0A0',
             'danger_color' => '#FF8888',
@@ -111,6 +113,7 @@ class TenantSeeder extends Seeder
             'footer_bg_color' => '#015327',
             'display_categories' => false,
             'display_seach_bar' => false,
+            'display_cart' => true,
             'header_logo' => $this->uploadedImage(
                 'images/tennants/fiesta_futbol_infantil/futbol_infantil_header.png',
                 'futbol_infantil_header.png',
@@ -119,6 +122,10 @@ class TenantSeeder extends Seeder
                 'images/tennants/fiesta_futbol_infantil/futbol_infantil_footer.png',
                 'futbol_infantil_footer.png',
             ),
+            'favicon' => $this->uploadedImage(
+                'images/tennants/fiesta_futbol_infantil/futbol_infantil_favicon.png',
+                'futbol_infantil_favicon.png',
+            ),
             'social_media' => self::SOCIAL_MEDIA,
             'website_type_code' => 'onticket',
             'extras' => [
@@ -227,6 +234,18 @@ class TenantSeeder extends Seeder
             }
         }
 
+        if (
+            $tenant->favicon
+            && $tenant->favicon_id !== $tenant->header_logo_id
+            && $tenant->favicon_id !== $tenant->footer_logo_id
+        ) {
+            try {
+                $attachmentService->delete($tenant->favicon);
+            } catch (Throwable) {
+                // Ignore cleanup errors while recreating demo data.
+            }
+        }
+
         $tenant->delete();
     }
 

database/seeders/WebsiteTypeSeeder.php

@@ -32,6 +32,7 @@ class WebsiteTypeSeeder extends Seeder
                 'nombre' => 'ShopIt',
                 'dominio' => 'localhost',
                 'scanner_domain' => 'scanner.localhost',
+                'site_title' => 'ShopIt',
                 ...self::PRESENTATION,
                 'site_logo' => $this->onTicketLogo(),
                 'footer_logo' => $this->onTicketFooterLogo(),
@@ -65,6 +66,7 @@ class WebsiteTypeSeeder extends Seeder
                 'nombre' => 'OnTicket',
                 'dominio' => 'onticket.localhost',
                 'scanner_domain' => 'scanner.onticket.localhost',
+                'site_title' => 'OnTicket',
                 ...self::PRESENTATION,
                 'site_logo' => $this->onTicketLogo(),
                 'footer_logo' => $this->onTicketFooterLogo(),

lang/en/api.php

@@ -42,7 +42,12 @@ return [
         'cannot_confirm' => 'A cancelled, rejected, or expired purchase cannot be confirmed.',
         'inconsistent_reservation' => 'The purchase has an inconsistent stock reservation.',
         'paid_cannot_cancel' => 'A paid purchase cannot be cancelled.',
-        'direct_item_max_stock' => 'There is not enough stock. Maximum available: :max.',
+        'stock' => [
+            'seat_unavailable' => 'Seat :selection is no longer available.',
+            'ticket_unavailable' => 'Ticket :selection is no longer available.',
+            'product_unavailable' => 'There is not enough stock for :selection. Maximum available: :max.',
+            'product_selection' => ':product (:selection)',
+        ],
         'empty_cart' => 'The selected cart does not contain items.',
         'catalog_item_missing' => 'One or more catalog items could not be loaded.',
         'catalog_item_wrong_tenant' => 'One or more catalog items do not belong to the tenant.',
@@ -80,6 +85,13 @@ return [
         'test_sent' => 'Test email sent successfully.',
     ],
     'catalog' => [
+        'attribute_labels' => [
+            'tipo' => 'Type',
+            'sector' => 'Sector',
+            'fila' => 'Row',
+            'asiento' => 'Seat',
+            'event_date' => 'Date',
+        ],
         'standard_with_components' => 'A standard item cannot have components.',
         'duplicate_component' => 'The component is duplicated.',
         'component_wrong_tenant' => 'The item does not belong to the bundle tenant.',
@@ -99,6 +111,7 @@ return [
         'direct_inventory_forbidden' => 'An item with variants cannot have direct inventory.',
         'event_date_attribute_required' => 'The event_date attribute is required for event date variants.',
         'multi_select_attribute_not_on_item' => 'Multi-select attributes must also be present in attribute_codes.',
+        'hidden_attribute_not_on_item' => 'Hidden attributes must also be present in attribute_codes.',
         'event_date_selection_required' => 'At least one event date must be selected.',
         'single_event_date_required' => 'Exactly one event date must be selected.',
         'event_date_wrong_tenant' => 'Every event date must belong to the catalog item tenant.',

lang/es/api.php

@@ -42,7 +42,12 @@ return [
         'cannot_confirm' => 'Una compra cancelada, rechazada o vencida no se puede confirmar.',
         'inconsistent_reservation' => 'La compra tiene una reserva de stock inconsistente.',
         'paid_cannot_cancel' => 'Una compra pagada no se puede cancelar.',
-        'direct_item_max_stock' => 'Stock insuficiente. Máximo disponible: :max.',
+        'stock' => [
+            'seat_unavailable' => 'El asiento :selection ya no está disponible.',
+            'ticket_unavailable' => 'La entrada :selection ya no está disponible.',
+            'product_unavailable' => 'No hay stock suficiente de :selection. Máximo disponible: :max.',
+            'product_selection' => ':product (:selection)',
+        ],
         'empty_cart' => 'El carrito seleccionado no contiene productos.',
         'catalog_item_missing' => 'No se pudieron cargar uno o más productos del catálogo.',
         'catalog_item_wrong_tenant' => 'Uno o más productos no pertenecen al tenant.',
@@ -80,6 +85,13 @@ return [
         'test_sent' => 'Correo de prueba enviado correctamente.',
     ],
     'catalog' => [
+        'attribute_labels' => [
+            'tipo' => 'Tipo',
+            'sector' => 'Sector',
+            'fila' => 'Fila',
+            'asiento' => 'Asiento',
+            'event_date' => 'Fecha',
+        ],
         'standard_with_components' => 'Un ítem standard no puede tener componentes.',
         'duplicate_component' => 'El componente está duplicado.',
         'component_wrong_tenant' => 'El ítem no pertenece al tenant del bundle.',
@@ -99,6 +111,7 @@ return [
         'direct_inventory_forbidden' => 'Un ítem con variantes no puede tener inventario directo.',
         'event_date_attribute_required' => 'El atributo event_date es obligatorio para las variantes con fecha de evento.',
         'multi_select_attribute_not_on_item' => 'Los atributos multiselección también deben estar incluidos en attribute_codes.',
+        'hidden_attribute_not_on_item' => 'Los atributos ocultos también deben estar incluidos en attribute_codes.',
         'event_date_selection_required' => 'Debe seleccionar al menos una fecha de evento.',
         'single_event_date_required' => 'Debe seleccionar exactamente una fecha de evento.',
         'event_date_wrong_tenant' => 'Todas las fechas del evento deben pertenecer al tenant del ítem de catálogo.',

resources/views/mail/notifications/password-reset.blade.php

@@ -2,7 +2,11 @@
     Recuperá tu contraseña
 </h1>
 
-@if($attempt->reason === 'account_locked')
+@if($attempt->reason === \App\Domains\Auth\Models\ResetPasswordAttempt::REASON_STAFF_CREATED)
+<p>
+    Hola {{ $attempt->user->nombre_apellido }}, creamos tu cuenta de scanner en {{ $tenant->nombre }}. Utilizá este código para crear tu contraseña y comenzar a usarla.
+</p>
+@elseif($attempt->reason === \App\Domains\Auth\Models\ResetPasswordAttempt::REASON_ACCOUNT_LOCKED)
 <p>
     Hola {{ $attempt->user->nombre_apellido }}, registramos varios intentos fallidos de inicio de sesión en tu cuenta. Por seguridad, hemos bloqueado el acceso temporalmente. Puedes utilizar este código para cambiar tu contraseña y desbloquearla inmediatamente.
 </p>
@@ -21,20 +25,20 @@
     </span>
 </div>
 
-@php
+@if($recoveryUrl)
-    $recoveryUrl = 'https://' . $tenant->dominio . '/recuperar-contrasena/codigo?email=' . urlencode($attempt->user->email);
-@endphp
-
 <div style="text-align: center; margin-bottom: 28px;">
     <a href="{{ $recoveryUrl }}" 
        style="display: inline-block; padding: 12px 24px; background-color: {{ $tenant->primary_color }}; color: #ffffff; text-decoration: none; border-radius: 6px; font-weight: bold;">
-        Ingresar código ahora
+        {{ $attempt->reason === \App\Domains\Auth\Models\ResetPasswordAttempt::REASON_STAFF_CREATED ? 'Crear mi contraseña' : 'Ingresar código ahora' }}
     </a>
 </div>
+@endif
 
 <p style="color: #64748b; font-size: 14px;">
-@if($attempt->reason === 'account_locked')
+@if($attempt->reason === \App\Domains\Auth\Models\ResetPasswordAttempt::REASON_ACCOUNT_LOCKED)
     Si no fuiste vos, por favor desestimá y borrá este correo. Tu cuenta seguirá protegida.
+@elseif($attempt->reason === \App\Domains\Auth\Models\ResetPasswordAttempt::REASON_STAFF_CREATED)
+    Si no esperabas recibir una cuenta de scanner, podés ignorar este mensaje.
 @else
     Si no solicitaste recuperar tu contraseña, podés ignorar este mensaje.
 @endif

routes/api.php

@@ -16,3 +16,4 @@ require __DIR__.'/../app/Domains/Bootstrap/routes/api.php';
 require __DIR__.'/../app/Domains/Forms/routes/api.php';
 require __DIR__.'/../app/Domains/Staff/routes/api.php';
 require __DIR__.'/../app/Domains/FiestaFutbolInfantil/routes/api.php';
+require __DIR__.'/../app/Domains/Desfile/routes/api.php';

tests/Feature/Auth/AdminAppResetPasswordControllerTest.php

@@ -0,0 +1,61 @@
+<?php
+
+namespace Tests\Feature\Auth;
+
+use App\Domains\Auth\Models\ResetPasswordAttempt;
+use App\Domains\Auth\Models\User;
+use App\Domains\Authorization\Enums\RoleCode;
+use App\Domains\Authorization\Models\Role;
+use App\Domains\Notification\Events\PasswordResetRequested;
+use App\Domains\Tenant\Models\Tenant;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Support\Facades\Event;
+use Tests\TestCase;
+
+class AdminAppResetPasswordControllerTest extends TestCase
+{
+    use RefreshDatabase;
+
+    public function test_it_creates_an_attempt_for_a_tenant_bound_adminapp_user(): void
+    {
+        Event::fake([PasswordResetRequested::class]);
+        Role::query()->create([
+            'codigo' => RoleCode::AdminApp->value,
+            'nombre' => 'AdminApp',
+        ]);
+        $tenant = Tenant::query()->create([
+            'codigo' => 'acme',
+            'nombre' => 'Acme',
+            'dominio' => 'store.acme.test',
+        ]);
+        $user = User::factory()->create([
+            'email' => 'admin@example.com',
+            'rol_codigo' => RoleCode::AdminApp->value,
+            'tenant_codigo' => $tenant->codigo,
+        ]);
+
+        $this->postJson('/api/v1/adminapp/password/reset-attempts', [
+            'email' => ' ADMIN@EXAMPLE.COM ',
+        ])->assertAccepted()->assertJsonPath('status', ResetPasswordAttempt::STATUS_PENDING);
+
+        $attempt = $user->resetPasswordAttempts()->sole();
+        Event::assertDispatched(
+            PasswordResetRequested::class,
+            fn (PasswordResetRequested $event): bool => $event->attemptId === $attempt->id
+                && $event->tenantCode === $tenant->codigo
+                && $event->channel === PasswordResetRequested::CHANNEL_ADMINAPP,
+        );
+    }
+
+    public function test_it_does_not_create_an_attempt_for_a_non_adminapp_user(): void
+    {
+        Event::fake([PasswordResetRequested::class]);
+
+        $this->postJson('/api/v1/adminapp/password/reset-attempts', [
+            'email' => User::factory()->create()->email,
+        ])->assertAccepted()->assertJsonPath('status', ResetPasswordAttempt::STATUS_PENDING);
+
+        $this->assertDatabaseCount('reset_password_attempts', 0);
+        Event::assertNotDispatched(PasswordResetRequested::class);
+    }
+}

tests/Feature/Auth/ScannerLoginControllerTest.php

@@ -3,13 +3,16 @@
 namespace Tests\Feature\Auth;
 
 use App\Domains\Auth\Models\LoginAttempt;
+use App\Domains\Auth\Models\ResetPasswordAttempt;
 use App\Domains\Auth\Models\User;
 use App\Domains\Authorization\Enums\PermissionCode;
 use App\Domains\Authorization\Enums\RoleCode;
 use App\Domains\Authorization\Models\Permission;
 use App\Domains\Authorization\Models\Role;
+use App\Domains\Notification\Events\PasswordResetRequested;
 use App\Domains\Tenant\Models\Tenant;
 use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Support\Facades\Event;
 use Illuminate\Support\Facades\Hash;
 use Tests\TestCase;
 
@@ -113,4 +116,51 @@ class ScannerLoginControllerTest extends TestCase
             'outcome' => LoginAttempt::OUTCOME_INVALID_CREDENTIALS,
         ]);
     }
+
+    public function test_locking_a_scanner_sends_the_scanner_password_reset_flow(): void
+    {
+        Event::fake([PasswordResetRequested::class]);
+        config([
+            'login-security.max_attempts' => 3,
+            'login-security.rate_limit_per_minute' => 100,
+            'login-security.ip_rate_limit_per_minute' => 100,
+        ]);
+        $role = Role::query()->create([
+            'codigo' => RoleCode::Scanner->value,
+            'nombre' => 'Scanner',
+        ]);
+        $permission = Permission::query()->create([
+            'codigo' => PermissionCode::ScanTickets->value,
+            'nombre' => 'Escanear tickets',
+        ]);
+        $role->permissions()->attach($permission->codigo);
+        $tenant = Tenant::query()->create([
+            'codigo' => 'acme',
+            'nombre' => 'Acme',
+            'dominio' => 'acme.test',
+        ]);
+        $user = User::factory()->create([
+            'email' => 'scanner@example.com',
+            'password' => Hash::make('correct-password'),
+            'rol_codigo' => $role->codigo,
+            'tenant_codigo' => $tenant->codigo,
+        ]);
+        $payload = [
+            'email' => $user->email,
+            'password' => 'wrong-password',
+        ];
+
+        $this->postJson('/api/v1/scanner/login', $payload)->assertUnprocessable();
+        $this->postJson('/api/v1/scanner/login', $payload)->assertUnprocessable();
+        $this->postJson('/api/v1/scanner/login', $payload)->assertTooManyRequests();
+
+        $attempt = $user->resetPasswordAttempts()->sole();
+        $this->assertSame(ResetPasswordAttempt::REASON_ACCOUNT_LOCKED, $attempt->reason);
+        Event::assertDispatched(
+            PasswordResetRequested::class,
+            fn (PasswordResetRequested $event): bool => $event->attemptId === $attempt->id
+                && $event->tenantCode === $tenant->codigo
+                && $event->channel === PasswordResetRequested::CHANNEL_SCANNER,
+        );
+    }
 }

tests/Feature/Auth/ScannerResetPasswordControllerTest.php

@@ -0,0 +1,100 @@
+<?php
+
+namespace Tests\Feature\Auth;
+
+use App\Domains\Auth\Models\ResetPasswordAttempt;
+use App\Domains\Auth\Models\User;
+use App\Domains\Authorization\Enums\RoleCode;
+use App\Domains\Authorization\Models\Role;
+use App\Domains\Notification\Events\PasswordResetRequested;
+use App\Domains\Tenant\Models\Tenant;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Support\Facades\Event;
+use Illuminate\Support\Facades\Hash;
+use Tests\TestCase;
+
+class ScannerResetPasswordControllerTest extends TestCase
+{
+    use RefreshDatabase;
+
+    public function test_it_creates_an_attempt_for_a_tenant_bound_scanner_user(): void
+    {
+        Event::fake([PasswordResetRequested::class]);
+        Role::query()->create([
+            'codigo' => RoleCode::Scanner->value,
+            'nombre' => 'Scanner',
+        ]);
+        $tenant = Tenant::query()->create([
+            'codigo' => 'acme',
+            'nombre' => 'Acme',
+            'dominio' => 'store.acme.test',
+        ]);
+        $user = User::factory()->create([
+            'email' => 'scanner@example.com',
+            'rol_codigo' => RoleCode::Scanner->value,
+            'tenant_codigo' => $tenant->codigo,
+        ]);
+
+        $this->postJson('/api/v1/scanner/password/reset-attempts', [
+            'email' => ' SCANNER@EXAMPLE.COM ',
+        ])->assertAccepted()->assertJsonPath('status', ResetPasswordAttempt::STATUS_PENDING);
+
+        $attempt = $user->resetPasswordAttempts()->sole();
+        Event::assertDispatched(
+            PasswordResetRequested::class,
+            fn (PasswordResetRequested $event): bool => $event->attemptId === $attempt->id
+                && $event->tenantCode === $tenant->codigo
+                && $event->channel === PasswordResetRequested::CHANNEL_SCANNER,
+        );
+    }
+
+    public function test_it_does_not_create_an_attempt_for_a_non_scanner_user(): void
+    {
+        Event::fake([PasswordResetRequested::class]);
+
+        $this->postJson('/api/v1/scanner/password/reset-attempts', [
+            'email' => User::factory()->create()->email,
+        ])->assertAccepted()->assertJsonPath('status', ResetPasswordAttempt::STATUS_PENDING);
+
+        $this->assertDatabaseCount('reset_password_attempts', 0);
+        Event::assertNotDispatched(PasswordResetRequested::class);
+    }
+
+    public function test_scanner_can_complete_the_password_reset_flow(): void
+    {
+        Event::fake([PasswordResetRequested::class]);
+        Role::query()->create([
+            'codigo' => RoleCode::Scanner->value,
+            'nombre' => 'Scanner',
+        ]);
+        $tenant = Tenant::query()->create([
+            'codigo' => 'acme',
+            'nombre' => 'Acme',
+            'dominio' => 'store.acme.test',
+        ]);
+        $user = User::factory()->create([
+            'email' => 'scanner@example.com',
+            'rol_codigo' => RoleCode::Scanner->value,
+            'tenant_codigo' => $tenant->codigo,
+        ]);
+
+        $this->postJson('/api/v1/scanner/password/reset-attempts', [
+            'email' => $user->email,
+        ])->assertAccepted();
+
+        $attempt = $user->resetPasswordAttempts()->sole();
+        $this->postJson('/api/v1/scanner/password/reset-attempts/validate', [
+            'email' => $user->email,
+            'codigo' => $attempt->codigo,
+        ])->assertOk()->assertJsonPath('status', ResetPasswordAttempt::STATUS_VALIDATED);
+
+        $this->postJson('/api/v1/scanner/password/reset', [
+            'email' => $user->email,
+            'codigo' => $attempt->codigo,
+            'password' => 'NewScanner!123',
+            'password_confirmation' => 'NewScanner!123',
+        ])->assertOk()->assertJsonPath('status', ResetPasswordAttempt::STATUS_USED);
+
+        $this->assertTrue(Hash::check('NewScanner!123', $user->fresh()->password));
+    }
+}