Merge branch 'refactor/integrations' into dev

Documenta la prioridad cliente a tipo de sitio, la edicion compartida, los permisos y los contratos de la API. Aclara la migracion del requisito de configuracion y la asociacion directa requerida por el webhook de Telepagos.

app/Domains/Administrator/Controllers/AdminAppAdministratorController.php

@@ -0,0 +1,49 @@
+<?php
+
+namespace App\Domains\Administrator\Controllers;
+
+use App\Domains\Administrator\Requests\StoreAdministratorRequest;
+use App\Domains\Administrator\Requests\UpdateAdministratorRequest;
+use App\Domains\Administrator\Resources\AdministratorResource;
+use App\Domains\Administrator\Services\AdministratorService;
+use App\Http\Controllers\Controller;
+use Illuminate\Http\Request;
+use Illuminate\Http\Resources\Json\AnonymousResourceCollection;
+use Symfony\Component\HttpFoundation\Response;
+
+class AdminAppAdministratorController extends Controller
+{
+    public function __construct(private readonly AdministratorService $administratorService) {}
+
+    public function index(Request $request): AnonymousResourceCollection
+    {
+        return AdministratorResource::collection($this->administratorService->list(
+            $request->user()->tenant()->firstOrFail(),
+            $request->string('search')->trim()->toString() ?: null,
+        ));
+    }
+
+    public function store(StoreAdministratorRequest $request): AdministratorResource
+    {
+        return AdministratorResource::make($this->administratorService->create(
+            $request->user()->tenant()->firstOrFail(),
+            $request->validated(),
+        ));
+    }
+
+    public function update(UpdateAdministratorRequest $request, int $administrator): AdministratorResource
+    {
+        return AdministratorResource::make($this->administratorService->update(
+            $request->user()->tenant()->firstOrFail(),
+            $administrator,
+            $request->validated(),
+        ));
+    }
+
+    public function destroy(Request $request, int $administrator): Response
+    {
+        $this->administratorService->delete($request->user()->tenant()->firstOrFail(), $administrator, $request->user());
+
+        return response()->noContent();
+    }
+}

app/Domains/Administrator/Requests/StoreAdministratorRequest.php

@@ -0,0 +1,38 @@
+<?php
+
+namespace App\Domains\Administrator\Requests;
+
+use App\Domains\Authorization\Enums\RoleCode;
+use Illuminate\Foundation\Http\FormRequest;
+use Illuminate\Validation\Rule;
+
+class StoreAdministratorRequest extends FormRequest
+{
+    public function authorize(): bool
+    {
+        return $this->user()?->rol_codigo === RoleCode::AdminApp->value;
+    }
+
+    protected function prepareForValidation(): void
+    {
+        if (is_string($this->input('email'))) {
+            $this->merge(['email' => mb_strtolower(trim($this->input('email')))]);
+        }
+    }
+
+    /** @return array<string, mixed> */
+    public function rules(): array
+    {
+
+        return [
+            'nombre_apellido' => ['required', 'string', 'max:255'],
+            'dni' => ['required', 'string', 'max:50'],
+            'email' => [
+                'required',
+                'email',
+                'max:255',
+                Rule::unique('users', 'active_email')->where('rol_codigo', RoleCode::AdminApp->value)->whereNull('deleted_at'),
+            ],
+        ];
+    }
+}

app/Domains/Administrator/Requests/UpdateAdministratorRequest.php

@@ -0,0 +1,41 @@
+<?php
+
+namespace App\Domains\Administrator\Requests;
+
+use App\Domains\Authorization\Enums\RoleCode;
+use Illuminate\Foundation\Http\FormRequest;
+use Illuminate\Validation\Rule;
+
+class UpdateAdministratorRequest extends FormRequest
+{
+    public function authorize(): bool
+    {
+        return $this->user()?->rol_codigo === RoleCode::AdminApp->value;
+    }
+
+    protected function prepareForValidation(): void
+    {
+        if (is_string($this->input('email'))) {
+            $this->merge(['email' => mb_strtolower(trim($this->input('email')))]);
+        }
+    }
+
+    /** @return array<string, mixed> */
+    public function rules(): array
+    {
+        $administratorId = (int) $this->route('administrator');
+
+        return [
+            'nombre_apellido' => ['required', 'string', 'max:255'],
+            'dni' => ['required', 'string', 'max:50'],
+            'email' => [
+                'required',
+                'email',
+                'max:255',
+                Rule::unique('users', 'active_email')->where('rol_codigo', RoleCode::AdminApp->value)
+                    ->whereNull('deleted_at')
+                    ->ignore($administratorId),
+            ],
+        ];
+    }
+}

app/Domains/Administrator/Resources/AdministratorResource.php

@@ -0,0 +1,27 @@
+<?php
+
+namespace App\Domains\Administrator\Resources;
+
+use App\Domains\Auth\Models\User;
+use Illuminate\Http\Request;
+use Illuminate\Http\Resources\Json\JsonResource;
+
+/** @mixin User */
+class AdministratorResource extends JsonResource
+{
+    /** @return array<string, mixed> */
+    public function toArray(Request $request): array
+    {
+        return [
+            'id' => $this->id,
+            'nombre_apellido' => $this->nombre_apellido,
+            'dni' => $this->dni,
+            'email' => $this->email,
+            'rol_codigo' => $this->rol_codigo,
+            'role' => $this->whenLoaded('role', fn () => [
+                'codigo' => $this->role?->codigo,
+                'nombre' => $this->role?->nombre,
+            ]),
+        ];
+    }
+}

app/Domains/Administrator/Services/AdministratorService.php

@@ -0,0 +1,99 @@
+<?php
+
+namespace App\Domains\Administrator\Services;
+
+use App\Domains\Auth\Models\ResetPasswordAttempt;
+use App\Domains\Auth\Models\User;
+use App\Domains\Auth\Services\ResetPasswordAttemptService;
+use App\Domains\Authorization\Enums\RoleCode;
+use App\Domains\Tenant\Models\Tenant;
+use Illuminate\Database\Eloquent\Builder;
+use Illuminate\Database\Eloquent\Collection;
+use Illuminate\Support\Arr;
+use Illuminate\Support\Facades\DB;
+use Illuminate\Support\Str;
+use Illuminate\Validation\ValidationException;
+
+class AdministratorService
+{
+    public function __construct(private readonly ResetPasswordAttemptService $resetPasswordAttemptService) {}
+
+    /** @return Collection<int, User> */
+    public function list(Tenant $tenant, ?string $search = null): Collection
+    {
+        return $this->query($tenant)->with('role')
+            ->when($search, fn (Builder $query, string $search) => $query->where(function (Builder $query) use ($search): void {
+                $query->where('nombre_apellido', 'like', "%{$search}%")
+                    ->orWhere('dni', 'like', "%{$search}%")
+                    ->orWhere('email', 'like', "%{$search}%");
+            }))
+            ->orderBy('nombre_apellido')->get();
+    }
+
+    /** @param array<string, mixed> $data */
+    public function create(Tenant $tenant, array $data): User
+    {
+        return DB::transaction(function () use ($tenant, $data): User {
+            $administrator = User::query()->create([
+                ...$this->attributes($data),
+                'password' => Str::random(64),
+                'rol_codigo' => RoleCode::AdminApp->value,
+                'tenant_codigo' => $tenant->codigo,
+            ]);
+            $this->resetPasswordAttemptService->createForAdminAppEmail(
+                $administrator->email,
+                ResetPasswordAttempt::REASON_ADMINISTRATOR_CREATED,
+            );
+
+            return $administrator->load('role');
+        });
+    }
+
+    /** @param array<string, mixed> $data */
+    public function update(Tenant $tenant, int $administratorId, array $data): User
+    {
+        return DB::transaction(function () use ($tenant, $administratorId, $data): User {
+            $administrator = $this->query($tenant)->lockForUpdate()->findOrFail($administratorId);
+            $administrator->update($this->attributes($data));
+
+            return $administrator->load('role');
+        });
+    }
+
+    public function delete(Tenant $tenant, int $administratorId, User $actor): void
+    {
+        DB::transaction(function () use ($tenant, $administratorId, $actor): void {
+            // Serialize deletions for this tenant, including requests already authenticated
+            // when another administrator removes their account.
+            Tenant::query()->whereKey($tenant->getKey())->lockForUpdate()->firstOrFail();
+            $administrator = $this->query($tenant)->lockForUpdate()->findOrFail($administratorId);
+            if ($administrator->is($actor)) {
+                throw ValidationException::withMessages(['administrator' => 'No podés eliminar tu propio usuario.']);
+            }
+            $activeAdministrators = $this->query($tenant)->lockForUpdate()->get();
+            if ($activeAdministrators->count() <= 1) {
+                throw ValidationException::withMessages(['administrator' => 'El tenant debe conservar al menos un administrador.']);
+            }
+            abort_unless($activeAdministrators->contains('id', $actor->id), 403);
+            $administrator->tokens()->delete();
+            $administrator->delete();
+        });
+    }
+
+    private function query(Tenant $tenant): Builder
+    {
+        return User::query()->where('tenant_codigo', $tenant->codigo)
+            ->where('rol_codigo', RoleCode::AdminApp->value);
+    }
+
+    /** @param array<string, mixed> $data
+     * @return array<string, mixed>
+     */
+    private function attributes(array $data): array
+    {
+        return [
+            ...Arr::only($data, ['nombre_apellido', 'dni']),
+            'email' => mb_strtolower(trim((string) $data['email'])),
+        ];
+    }
+}

app/Domains/Administrator/documentacion/README.md

@@ -0,0 +1,63 @@
+# Administradores de AdminApp
+
+CRUD de usuarios con rol `adminapp`, limitado al tenant del usuario autenticado.
+Todos los administradores del tenant pueden gestionar esta sección.
+
+## Endpoints
+
+Base: `/api/v1/adminapp/tenant/administrators`.
+Requieren `auth:sanctum` y `adminapp.tenant`.
+
+- `GET /`: listado ordenado por nombre; acepta `search` por nombre, DNI o email.
+- `POST /`: alta; responde `201` con `data`.
+- `PUT /{administrator}`: actualización de los tres campos; responde `200` con `data`.
+- `DELETE /{administrator}`: baja lógica; responde `204`.
+
+Alta y actualización reciben:
+
+```json
+{
+  "nombre_apellido": "Ada Lovelace",
+  "dni": "12345678",
+  "email": "ada@example.test"
+}
+```
+
+Nombre (hasta 255 caracteres), DNI (hasta 50) y email (hasta 255) son obligatorios.
+El email se normaliza a minúsculas antes de validar y debe ser único entre
+usuarios activos, sin importar su tenant o rol. Se permite reutilizar el email
+de un usuario eliminado. Rol y tenant no son editables desde esta API.
+
+Las respuestas incluyen `id`, `nombre_apellido`, `dni`, `email`, `rol_codigo`
+y `role` (`codigo`, `nombre`). Nunca incluyen contraseña ni datos de escaneo.
+
+## Alta y acceso
+
+Se genera una contraseña aleatoria y un intento de establecimiento de contraseña
+con motivo `administrator_created`, reutilizando `createForAdminAppEmail`.
+El evento usa el canal `adminapp`; el listener existente envía el email después
+del commit mediante la cola `emails`. Requiere la configuración de correo,
+dominio AdminApp y worker existentes. No se envían contraseñas en texto plano.
+
+## Eliminación y aislamiento
+
+Las consultas de usuarios se limitan por tenant y rol `adminapp`. IDs ajenos,
+usuarios eliminados y usuarios de otros roles devuelven `404`.
+La validación de campos devuelve `422`; falta de autenticación, `401`, y rol
+no autorizado, `403`.
+
+No se permite eliminar al propio usuario ni dejar al tenant sin administradores
+(`422`, error `administrator`). La eliminación bloquea la fila del tenant dentro
+de una transacción para serializar bajas concurrentes. También verifica que el
+actor siga activo, revoca tokens y aplica el borrado lógico existente en `users`.
+
+No agrega tablas ni migraciones. No modifica el CRUD de escáneres ni el frontend.
+
+## Verificación
+
+`php artisan test tests/Feature/Administrator/AdministratorControllerTest.php`
+
+Las pruebas cubren CRUD, normalización y unicidad del email, establecimiento de
+contraseña, restricciones de rol y tenant, baja lógica, tokens y protecciones de
+eliminación. El caso de petición autenticada antes de la baja del actor se simula;
+no es una prueba con conexiones concurrentes reales.

app/Domains/Administrator/routes/api.php

@@ -0,0 +1,10 @@
+<?php
+
+use App\Domains\Administrator\Controllers\AdminAppAdministratorController;
+use Illuminate\Support\Facades\Route;
+
+Route::prefix('v1/adminapp/tenant')
+    ->middleware(['auth:sanctum', 'adminapp.tenant'])
+    ->group(function (): void {
+        Route::apiResource('administrators', AdminAppAdministratorController::class)->except('show');
+    });

app/Domains/Auth/Controllers/ResetPasswordController.php

@@ -5,6 +5,7 @@ namespace App\Domains\Auth\Controllers;
 use App\Domains\Auth\Models\ResetPasswordAttempt;
 use App\Domains\Auth\Requests\ResetPasswordRequest;
 use App\Domains\Auth\Services\ResetPasswordAttemptService;
+use App\Domains\Authorization\Enums\RoleCode;
 use App\Http\Controllers\Controller;
 use Illuminate\Http\JsonResponse;
 use Illuminate\Validation\ValidationException;
@@ -26,6 +27,7 @@ class ResetPasswordController extends Controller
             $data['email'],
             $data['codigo'],
             $data['password'],
+            RoleCode::from($request->route('reset_role', RoleCode::User->value)),
         )) {
             throw ValidationException::withMessages([
                 'codigo' => __('api.auth.password_reset_invalid'),

app/Domains/Auth/Controllers/ValidateResetPasswordAttemptController.php

@@ -5,6 +5,7 @@ namespace App\Domains\Auth\Controllers;
 use App\Domains\Auth\Models\ResetPasswordAttempt;
 use App\Domains\Auth\Requests\ValidateResetPasswordAttemptRequest;
 use App\Domains\Auth\Services\ResetPasswordAttemptService;
+use App\Domains\Authorization\Enums\RoleCode;
 use App\Http\Controllers\Controller;
 use Illuminate\Http\JsonResponse;
 use Illuminate\Validation\ValidationException;
@@ -25,6 +26,7 @@ class ValidateResetPasswordAttemptController extends Controller
         $result = $this->resetPasswordAttemptService->validateCode(
             $data['email'],
             $data['codigo'],
+            RoleCode::from($request->route('reset_role', RoleCode::User->value)),
         );
 
         if ($result === ResetPasswordAttemptService::CODE_EXPIRED) {

app/Domains/Auth/Models/ResetPasswordAttempt.php

@@ -17,6 +17,8 @@ class ResetPasswordAttempt extends Model
 
     public const REASON_STAFF_CREATED = 'staff_created';
 
+    public const REASON_ADMINISTRATOR_CREATED = 'administrator_created';
+
     public const STATUS_PENDING = 'pending';
 
     public const STATUS_VALIDATED = 'validated';

app/Domains/Auth/Models/User.php

@@ -13,16 +13,17 @@ use Illuminate\Database\Eloquent\Factories\HasFactory;
 use Illuminate\Database\Eloquent\Relations\BelongsTo;
 use Illuminate\Database\Eloquent\Relations\BelongsToMany;
 use Illuminate\Database\Eloquent\Relations\HasMany;
+use Illuminate\Database\Eloquent\SoftDeletes;
 use Illuminate\Foundation\Auth\User as Authenticatable;
 use Illuminate\Notifications\Notifiable;
 use Laravel\Sanctum\HasApiTokens;
 
 #[Fillable(['nombre_apellido', 'email', 'password', 'dni', 'telefono', 'google_id', 'rol_codigo', 'tenant_codigo'])]
-#[Hidden(['password', 'remember_token'])]
+#[Hidden(['password', 'remember_token', 'active_email', 'active_google_id'])]
 class User extends Authenticatable
 {
     /** @use HasFactory<UserFactory> */
-    use HasApiTokens, HasFactory, Notifiable;
+    use HasApiTokens, HasFactory, Notifiable, SoftDeletes;
 
     protected $attributes = [
         'rol_codigo' => RoleCode::User->value,

app/Domains/Auth/Requests/RegisterUserRequest.php

@@ -2,6 +2,7 @@
 
 namespace App\Domains\Auth\Requests;
 
+use App\Domains\Authorization\Enums\RoleCode;
 use Illuminate\Foundation\Http\FormRequest;
 use Illuminate\Validation\Rule;
 use Illuminate\Validation\Rules\Password;
@@ -13,15 +14,26 @@ class RegisterUserRequest extends FormRequest
         return true;
     }
 
-    /**
-     * @return array<string, mixed>
-     */
+    protected function prepareForValidation(): void
+    {
+        if (is_string($this->input('email'))) {
+            $this->merge(['email' => mb_strtolower(trim($this->input('email')))]);
+        }
+    }
+
+    /** @return array<string, mixed> */
     public function rules(): array
     {
         return [
             'tenant_codigo' => ['nullable', 'string', Rule::exists('tenants', 'codigo')],
             'nombre_apellido' => ['required', 'string', 'max:255'],
-            'email' => ['required', 'string', 'email', 'max:255', Rule::unique('users', 'email')],
+            'email' => [
+                'required',
+                'string',
+                'email',
+                'max:255',
+                Rule::unique('users', 'active_email')->where('rol_codigo', RoleCode::User->value)->whereNull('deleted_at'),
+            ],
             'password' => ['required', 'string', 'confirmed', Password::min(8)->mixedCase()->symbols()],
             'dni' => ['nullable', 'string', 'max:255'],
             'telefono' => ['nullable', 'string', 'max:255'],

app/Domains/Auth/Requests/UpdateProfileRequest.php

@@ -4,6 +4,7 @@ namespace App\Domains\Auth\Requests;
 
 use Illuminate\Foundation\Http\FormRequest;
 use Illuminate\Validation\Rule;
+use Illuminate\Validation\Rules\Password;
 
 class UpdateProfileRequest extends FormRequest
 {
@@ -12,6 +13,13 @@ class UpdateProfileRequest extends FormRequest
         return true;
     }
 
+    protected function prepareForValidation(): void
+    {
+        if (is_string($this->input('email'))) {
+            $this->merge(['email' => mb_strtolower(trim($this->input('email')))]);
+        }
+    }
+
     public function rules(): array
     {
         return [
@@ -19,11 +27,13 @@ class UpdateProfileRequest extends FormRequest
             'email' => [
                 'required',
                 'email',
-                Rule::unique('users', 'email')->ignore($this->user()->id),
+                Rule::unique('users', 'active_email')->where('rol_codigo', $this->user()->rol_codigo)
+                    ->whereNull('deleted_at')
+                    ->ignore($this->user()->id),
             ],
             'dni' => ['nullable', 'string', 'regex:/^[0-9]{7,8}$/'],
             'telefono' => ['nullable', 'string', 'regex:/^\+?[0-9\s\-]+$/'],
-            'password' => ['nullable', 'string', \Illuminate\Validation\Rules\Password::min(8)->mixedCase()->symbols()],
+            'password' => ['nullable', 'string', Password::min(8)->mixedCase()->symbols()],
         ];
     }
 }

app/Domains/Auth/Services/AdminCredentialVerifier.php

@@ -11,7 +11,7 @@ class AdminCredentialVerifier
     public function verify(string $email, string $password): bool
     {
         $admin = User::query()
-            ->where('email', mb_strtolower(trim($email)))
+            ->where('active_email', mb_strtolower(trim($email)))
             ->where('rol_codigo', RoleCode::Admin->value)
             ->first();
 

app/Domains/Auth/Services/GoogleAuthService.php

@@ -3,6 +3,7 @@
 namespace App\Domains\Auth\Services;
 
 use App\Domains\Auth\Models\User;
+use App\Domains\Authorization\Enums\RoleCode;
 use App\Domains\Notification\Events\UserRegistered;
 use App\Domains\Tenant\Models\Tenant;
 use App\Domains\Tenant\Support\TenantDomainNormalizer;
@@ -124,12 +125,12 @@ class GoogleAuthService
             ]);
         }
 
-        $user = User::query()->where('google_id', $googleId)->first();
+        $user = User::query()->where('rol_codigo', RoleCode::User->value)->where('google_id', $googleId)->first();
         if ($user) {
             return $user;
         }
 
-        $user = User::query()->where('email', $email)->first();
+        $user = User::query()->where('rol_codigo', RoleCode::User->value)->where('active_email', mb_strtolower(trim($email)))->first();
         if ($user) {
             $user->forceFill(['google_id' => $googleId])->save();
 

app/Domains/Auth/Services/PasswordLoginService.php

@@ -85,7 +85,7 @@ class PasswordLoginService
             null,
             $ipAddress,
             $userAgent,
-            null,
+            RoleCode::Scanner,
             true,
             PermissionCode::ScanTickets->value,
             PasswordResetRequested::CHANNEL_SCANNER,
@@ -120,7 +120,7 @@ class PasswordLoginService
             $passwordResetChannel,
         ): array {
             $user = User::query()
-                ->where('email', $normalizedEmail)
+                ->where('active_email', $normalizedEmail)
                 ->when(
                     $requiredRole !== null,
                     fn ($query) => $query->where('rol_codigo', $requiredRole->value),

app/Domains/Auth/Services/ResetPasswordAttemptService.php

@@ -28,7 +28,8 @@ class ResetPasswordAttemptService
         try {
             $attemptId = DB::transaction(function () use ($email, $emailFingerprint, $reason): ?int {
                 $user = User::query()
-                    ->where('email', $email)
+                    ->where('active_email', mb_strtolower(trim($email)))
+                    ->where('rol_codigo', RoleCode::User->value)
                     ->lockForUpdate()
                     ->first();
 
@@ -65,7 +66,7 @@ class ResetPasswordAttemptService
         try {
             $result = DB::transaction(function () use ($email, $emailFingerprint, $reason): ?array {
                 $user = User::query()
-                    ->where('email', $email)
+                    ->where('active_email', mb_strtolower(trim($email)))
                     ->where('rol_codigo', RoleCode::AdminApp->value)
                     ->whereNotNull('tenant_codigo')
                     ->lockForUpdate()
@@ -113,7 +114,7 @@ class ResetPasswordAttemptService
         try {
             $result = DB::transaction(function () use ($email, $emailFingerprint, $reason): ?array {
                 $user = User::query()
-                    ->where('email', $email)
+                    ->where('active_email', mb_strtolower(trim($email)))
                     ->where('rol_codigo', RoleCode::Scanner->value)
                     ->whereNotNull('tenant_codigo')
                     ->lockForUpdate()
@@ -152,14 +153,15 @@ class ResetPasswordAttemptService
         );
     }
 
-    public function validateCode(string $email, string $code): string
+    public function validateCode(string $email, string $code, RoleCode $role = RoleCode::User): string
     {
         $emailFingerprint = $this->emailFingerprint($email);
 
         try {
-            return DB::transaction(function () use ($email, $code, $emailFingerprint): string {
+            return DB::transaction(function () use ($email, $code, $emailFingerprint, $role): string {
                 $user = User::query()
-                    ->where('email', $email)
+                    ->where('active_email', mb_strtolower(trim($email)))
+                    ->where('rol_codigo', $role->value)
                     ->lockForUpdate()
                     ->first();
 
@@ -207,14 +209,15 @@ class ResetPasswordAttemptService
         }
     }
 
-    public function resetPassword(string $email, string $code, string $password): bool
+    public function resetPassword(string $email, string $code, string $password, RoleCode $role = RoleCode::User): bool
     {
         $emailFingerprint = $this->emailFingerprint($email);
 
         try {
-            return DB::transaction(function () use ($email, $code, $password, $emailFingerprint): bool {
+            return DB::transaction(function () use ($email, $code, $password, $emailFingerprint, $role): bool {
                 $user = User::query()
-                    ->where('email', $email)
+                    ->where('active_email', mb_strtolower(trim($email)))
+                    ->where('rol_codigo', $role->value)
                     ->lockForUpdate()
                     ->first();
 

app/Domains/Auth/routes/adminapp.php

@@ -12,8 +12,10 @@ Route::prefix('v1/adminapp')->group(function (): void {
     Route::post('password/reset-attempts', CreateAdminAppResetPasswordAttemptController::class)
         ->middleware('throttle:5,1');
     Route::post('password/reset-attempts/validate', ValidateResetPasswordAttemptController::class)
+        ->defaults('reset_role', 'adminapp')
         ->middleware('throttle:10,1');
     Route::post('password/reset', ResetPasswordController::class)
+        ->defaults('reset_role', 'adminapp')
         ->middleware('throttle:5,1');
     Route::middleware(['auth:sanctum', 'adminapp.tenant'])
         ->get('me', AdminAppMeController::class);

app/Domains/Auth/routes/scanner.php

@@ -12,8 +12,10 @@ Route::prefix('v1/scanner')->group(function (): void {
     Route::post('password/reset-attempts', CreateScannerResetPasswordAttemptController::class)
         ->middleware('throttle:5,1');
     Route::post('password/reset-attempts/validate', ValidateResetPasswordAttemptController::class)
+        ->defaults('reset_role', 'scanner')
         ->middleware('throttle:10,1');
     Route::post('password/reset', ResetPasswordController::class)
+        ->defaults('reset_role', 'scanner')
         ->middleware('throttle:5,1');
     Route::middleware(['auth:sanctum', 'scanner.tenant'])
         ->get('me', ScannerMeController::class);

app/Domains/Desfile/Services/InvitationPurchaseProvisioner.php

@@ -104,7 +104,11 @@ class InvitationPurchaseProvisioner
 
     private function userId(DateTimeInterface $now): int
     {
-        $user = DB::table('users')->where('email', self::USER_EMAIL)->first();
+        $user = DB::table('users')
+            ->where('active_email', self::USER_EMAIL)
+            ->where('rol_codigo', 'user')
+            ->whereNull('deleted_at')
+            ->first();
 
         if ($user !== null) {
             if ($user->tenant_codigo !== self::TENANT_CODE) {

app/Domains/Integration/Controllers/ClientIntegrationController.php

@@ -4,8 +4,9 @@ namespace App\Domains\Integration\Controllers;
 
 use App\Domains\Client\Models\Client;
 use App\Domains\Integration\Models\Integration;
-use App\Domains\Integration\Requests\StoreClientIntegrationRequest;
+use App\Domains\Integration\Requests\ConfigureIntegrationRequest;
 use App\Domains\Integration\Services\ClientIntegrationService;
+use App\Domains\Integration\Services\IntegrationAssociationService;
 use App\Http\Controllers\Controller;
 use Illuminate\Http\JsonResponse;
 
@@ -35,7 +36,7 @@ class ClientIntegrationController extends Controller
     }
 
     public function store(
-        StoreClientIntegrationRequest $request,
+        ConfigureIntegrationRequest $request,
         Client $client,
         string $integrationCode,
     ): JsonResponse {
@@ -61,4 +62,11 @@ class ClientIntegrationController extends Controller
             ], 400);
         }
     }
+
+    public function destroy(Client $client, string $integrationCode, IntegrationAssociationService $service)
+    {
+        $service->detach($client, $integrationCode);
+
+        return response()->noContent();
+    }
 }

app/Domains/Integration/Controllers/IntegrationController.php

@@ -35,6 +35,7 @@ class IntegrationController extends Controller
 
     public function destroy(Integration $integration)
     {
+        abort_if($integration->instances()->exists(), 409, 'Delete the integration instances first.');
         $integration->delete();
 
         return response()->noContent();

app/Domains/Integration/Controllers/WebsiteTypeIntegrationController.php

@@ -0,0 +1,43 @@
+<?php
+
+namespace App\Domains\Integration\Controllers;
+
+use App\Domains\Integration\Models\Integration;
+use App\Domains\Integration\Requests\ConfigureIntegrationRequest;
+use App\Domains\Integration\Resources\IntegrationAssociationResource;
+use App\Domains\Integration\Services\IntegrationAssociationService;
+use App\Domains\Tenant\Models\WebsiteType;
+use App\Http\Controllers\Controller;
+
+class WebsiteTypeIntegrationController extends Controller
+{
+    public function __construct(private readonly IntegrationAssociationService $service) {}
+
+    public function index(WebsiteType $websiteType)
+    {
+        return IntegrationAssociationResource::collection($websiteType->integrations()->with('integrationInstance')->get());
+    }
+
+    public function show(WebsiteType $websiteType, string $integrationCode)
+    {
+        return new IntegrationAssociationResource($websiteType->integrations()->with('integrationInstance')->where('integration_code', $integrationCode)->firstOrFail());
+    }
+
+    public function store(ConfigureIntegrationRequest $request, WebsiteType $websiteType, string $integrationCode)
+    {
+        $integration = Integration::query()->where('integration_code', $integrationCode)->firstOrFail();
+
+        return new IntegrationAssociationResource($this->service->configure(
+            $websiteType,
+            $integration,
+            $request->validated('integration_data'),
+        ));
+    }
+
+    public function destroy(WebsiteType $websiteType, string $integrationCode)
+    {
+        $this->service->detach($websiteType, $integrationCode);
+
+        return response()->noContent();
+    }
+}

app/Domains/Integration/Models/ClientIntegration.php

@@ -3,22 +3,15 @@
 namespace App\Domains\Integration\Models;
 
 use App\Domains\Client\Models\Client;
-use App\Domains\Integration\Casts\EncryptedIntegrationData;
 use Illuminate\Database\Eloquent\Model;
 use Illuminate\Database\Eloquent\Relations\BelongsTo;
 
 class ClientIntegration extends Model
 {
-    protected $hidden = ['integration_data'];
-
     protected $fillable = [
         'client_id',
         'integration_code',
-        'integration_data',
-    ];
-
-    protected $casts = [
-        'integration_data' => EncryptedIntegrationData::class,
+        'integration_instance_id',
     ];
 
     /** @return BelongsTo<Client, $this> */
@@ -32,4 +25,10 @@ class ClientIntegration extends Model
     {
         return $this->belongsTo(Integration::class, 'integration_code', 'integration_code');
     }
+
+    /** @return BelongsTo<IntegrationInstance, $this> */
+    public function integrationInstance(): BelongsTo
+    {
+        return $this->belongsTo(IntegrationInstance::class);
+    }
 }

app/Domains/Integration/Models/Integration.php

@@ -3,6 +3,7 @@
 namespace App\Domains\Integration\Models;
 
 use Illuminate\Database\Eloquent\Model;
+use Illuminate\Database\Eloquent\Relations\HasMany;
 
 class Integration extends Model
 {
@@ -13,16 +14,29 @@ class Integration extends Model
         'name',
         'url',
         'integration_data_schema',
-        'requires_client_configuration',
+        'requires_configuration',
     ];
 
     protected $casts = [
         'integration_data_schema' => 'array',
-        'requires_client_configuration' => 'boolean',
+        'requires_configuration' => 'boolean',
     ];
 
-    public function clientIntegrations()
+    /** @return HasMany<IntegrationInstance, $this> */
+    public function instances(): HasMany
+    {
+        return $this->hasMany(IntegrationInstance::class, 'integration_code', 'integration_code');
+    }
+
+    /** @return HasMany<ClientIntegration, $this> */
+    public function clientIntegrations(): HasMany
     {
         return $this->hasMany(ClientIntegration::class, 'integration_code', 'integration_code');
     }
+
+    /** @return HasMany<WebsiteTypeIntegration, $this> */
+    public function websiteTypeIntegrations(): HasMany
+    {
+        return $this->hasMany(WebsiteTypeIntegration::class, 'integration_code', 'integration_code');
+    }
 }

app/Domains/Integration/Models/IntegrationInstance.php

@@ -0,0 +1,41 @@
+<?php
+
+namespace App\Domains\Integration\Models;
+
+use App\Domains\Integration\Casts\EncryptedIntegrationData;
+use Illuminate\Database\Eloquent\Model;
+use Illuminate\Database\Eloquent\Relations\BelongsTo;
+use Illuminate\Database\Eloquent\Relations\HasMany;
+
+class IntegrationInstance extends Model
+{
+    // The ciphertext changes whenever credentials are saved, so old tokens cannot be reused.
+    public function tokenCacheKey(): string
+    {
+        return 'integration_token:instance:'.$this->id.':'.hash('sha256', (string) $this->getRawOriginal('integration_data'));
+    }
+
+    protected $fillable = ['integration_code', 'name', 'integration_data'];
+
+    protected $hidden = ['integration_data'];
+
+    protected $casts = ['integration_data' => EncryptedIntegrationData::class];
+
+    /** @return BelongsTo<Integration, $this> */
+    public function integration(): BelongsTo
+    {
+        return $this->belongsTo(Integration::class, 'integration_code', 'integration_code');
+    }
+
+    /** @return HasMany<ClientIntegration, $this> */
+    public function clientIntegrations(): HasMany
+    {
+        return $this->hasMany(ClientIntegration::class);
+    }
+
+    /** @return HasMany<WebsiteTypeIntegration, $this> */
+    public function websiteTypeIntegrations(): HasMany
+    {
+        return $this->hasMany(WebsiteTypeIntegration::class);
+    }
+}

app/Domains/Integration/Models/WebsiteTypeIntegration.php

@@ -0,0 +1,30 @@
+<?php
+
+namespace App\Domains\Integration\Models;
+
+use App\Domains\Tenant\Models\WebsiteType;
+use Illuminate\Database\Eloquent\Model;
+use Illuminate\Database\Eloquent\Relations\BelongsTo;
+
+class WebsiteTypeIntegration extends Model
+{
+    protected $fillable = ['website_type_code', 'integration_code', 'integration_instance_id'];
+
+    /** @return BelongsTo<WebsiteType, $this> */
+    public function websiteType(): BelongsTo
+    {
+        return $this->belongsTo(WebsiteType::class, 'website_type_code', 'codigo');
+    }
+
+    /** @return BelongsTo<Integration, $this> */
+    public function integration(): BelongsTo
+    {
+        return $this->belongsTo(Integration::class, 'integration_code', 'integration_code');
+    }
+
+    /** @return BelongsTo<IntegrationInstance, $this> */
+    public function integrationInstance(): BelongsTo
+    {
+        return $this->belongsTo(IntegrationInstance::class);
+    }
+}

app/Domains/Integration/Policies/IntegrationPolicy.php

@@ -0,0 +1,14 @@
+<?php
+
+namespace App\Domains\Integration\Policies;
+
+use App\Domains\Auth\Models\User;
+use App\Domains\Authorization\Enums\RoleCode;
+
+class IntegrationPolicy
+{
+    public function manage(User $user): bool
+    {
+        return $user->rol_codigo === RoleCode::Admin->value;
+    }
+}

app/Domains/Integration/Requests/ConfigureIntegrationRequest.php

@@ -6,20 +6,19 @@ use App\Domains\Integration\Models\Integration;
 use Illuminate\Foundation\Http\FormRequest;
 use Illuminate\Validation\ValidationException;
 
-class StoreClientIntegrationRequest extends FormRequest
+class ConfigureIntegrationRequest extends FormRequest
 {
     protected ?Integration $integrationModel = null;
 
     public function authorize(): bool
     {
-        return true;
+        return $this->user()?->can('manage', Integration::class) ?? false;
     }
 
     protected function prepareForValidation(): void
     {
-        $integrationCode = $this->route('integration_code');
         $this->integrationModel = Integration::query()
-            ->where('integration_code', $integrationCode)
+            ->where('integration_code', $this->route('integration_code'))
             ->first();
 
         if (! $this->integrationModel) {
@@ -31,7 +30,7 @@ class StoreClientIntegrationRequest extends FormRequest
 
     public function rules(): array
     {
-        $rules = [];
+        $rules = ['integration_data' => ['present', 'array']];
 
         foreach ($this->integrationModel?->integration_data_schema ?? [] as $field => $rule) {
             $rules['integration_data.'.$field] = $rule;

app/Domains/Integration/Requests/StoreIntegrationRequest.php

@@ -18,7 +18,7 @@ class StoreIntegrationRequest extends FormRequest
             'name' => ['required', 'string', 'max:255'],
             'url' => ['nullable', 'url', 'max:255'],
             'integration_data_schema' => ['nullable', 'array'],
-            'requires_client_configuration' => ['sometimes', 'boolean'],
+            'requires_configuration' => ['sometimes', 'boolean'],
         ];
     }
 }

app/Domains/Integration/Requests/UpdateIntegrationRequest.php

@@ -3,6 +3,7 @@
 namespace App\Domains\Integration\Requests;
 
 use Illuminate\Foundation\Http\FormRequest;
+use Illuminate\Validation\Rule;
 
 class UpdateIntegrationRequest extends FormRequest
 {
@@ -19,9 +20,8 @@ class UpdateIntegrationRequest extends FormRequest
             'name' => ['sometimes', 'required', 'string', 'max:255'],
             'url' => ['nullable', 'url', 'max:255'],
             'integration_data_schema' => ['nullable', 'array'],
-            'requires_client_configuration' => ['sometimes', 'boolean'],
-            // the code shouldn't ideally be updatable, but if it is:
-            'integration_code' => ['sometimes', 'required', 'string', 'unique:integrations,integration_code,'.($integration->id ?? '')],
+            'requires_configuration' => ['sometimes', 'boolean'],
+            'integration_code' => ['sometimes', 'required', 'string', Rule::in([$integration->integration_code])],
         ];
     }
 }

app/Domains/Integration/Resources/IntegrationAssociationResource.php

@@ -0,0 +1,21 @@
+<?php
+
+namespace App\Domains\Integration\Resources;
+
+use Illuminate\Http\Request;
+use Illuminate\Http\Resources\Json\JsonResource;
+
+class IntegrationAssociationResource extends JsonResource
+{
+    public function toArray(Request $request): array
+    {
+        return [
+            'id' => $this->id,
+            'client_id' => $this->when(isset($this->client_id), $this->client_id),
+            'website_type_code' => $this->when(isset($this->website_type_code), $this->website_type_code),
+            'integration_code' => $this->integration_code,
+            'integration_instance_id' => $this->integration_instance_id,
+            'integration_instance' => new IntegrationInstanceResource($this->whenLoaded('integrationInstance')),
+        ];
+    }
+}

app/Domains/Integration/Resources/IntegrationInstanceResource.php

@@ -0,0 +1,20 @@
+<?php
+
+namespace App\Domains\Integration\Resources;
+
+use Illuminate\Http\Request;
+use Illuminate\Http\Resources\Json\JsonResource;
+
+class IntegrationInstanceResource extends JsonResource
+{
+    public function toArray(Request $request): array
+    {
+        return [
+            'id' => $this->id,
+            'integration_code' => $this->integration_code,
+            'name' => $this->name,
+            'created_at' => $this->created_at,
+            'updated_at' => $this->updated_at,
+        ];
+    }
+}

app/Domains/Integration/Services/BaseIntegrationService.php

@@ -5,6 +5,8 @@ namespace App\Domains\Integration\Services;
 use App\Domains\Client\Models\Client;
 use App\Domains\Integration\Models\ClientIntegration;
 use App\Domains\Integration\Models\Integration;
+use App\Domains\Integration\Models\IntegrationInstance;
+use App\Domains\Integration\Models\WebsiteTypeIntegration;
 use App\Domains\Tenant\Models\Tenant;
 use Exception;
 use Illuminate\Http\Client\PendingRequest;
@@ -32,9 +34,9 @@ abstract class BaseIntegrationService
     protected ?Integration $integration = null;
 
     /**
-     * The client-owned integration configuration.
+     * The effective integration instance.
      */
-    protected ?ClientIntegration $clientIntegration = null;
+    protected ?IntegrationInstance $integrationInstance = null;
 
     /**
      * Set the integration code.
@@ -85,7 +87,7 @@ abstract class BaseIntegrationService
     }
 
     /**
-     * Load the integration definition and its client-owned configuration.
+     * Load the integration definition and its effective instance configuration.
      *
      * @throws Exception
      */
@@ -95,6 +97,7 @@ abstract class BaseIntegrationService
             throw new Exception('Integration code is not set.');
         }
 
+        $this->integrationInstance = null;
         $this->integration = Integration::where('integration_code', $this->integrationCode)->first();
         if (! $this->integration) {
             throw new Exception("Integration with code '{$this->integrationCode}' not found.");
@@ -104,11 +107,18 @@ abstract class BaseIntegrationService
             throw new Exception('Client context is not set.');
         }
 
-        $this->clientIntegration = ClientIntegration::where('client_id', $this->clientContext->id)
+        $this->integrationInstance = ClientIntegration::with('integrationInstance')->where('client_id', $this->clientContext->id)
             ->where('integration_code', $this->integrationCode)
-            ->first();
+            ->first()?->integrationInstance;
 
-        if (! $this->clientIntegration && $this->integration->requires_client_configuration) {
+        if (! $this->integrationInstance && $this->tenant?->website_type_code) {
+            $this->integrationInstance = WebsiteTypeIntegration::with('integrationInstance')
+                ->where('website_type_code', $this->tenant->website_type_code)
+                ->where('integration_code', $this->integrationCode)
+                ->first()?->integrationInstance;
+        }
+
+        if (! $this->integrationInstance && $this->integration->requires_configuration) {
             throw new Exception("Client '{$this->clientContext->code}' does not have integration '{$this->integrationCode}' configured.");
         }
     }
@@ -131,15 +141,15 @@ abstract class BaseIntegrationService
     }
 
     /**
-     * Get an integration setting from the client-owned configuration.
+     * Get an integration setting from the effective instance configuration.
      */
     protected function getIntegrationSetting(string $key, mixed $default = null): mixed
     {
-        if (! $this->clientIntegration || ! $this->clientIntegration->integration_data) {
+        if (! $this->integrationInstance || ! $this->integrationInstance->integration_data) {
             return $default;
         }
 
-        return $this->clientIntegration->integration_data[$key] ?? $default;
+        return $this->integrationInstance->integration_data[$key] ?? $default;
     }
 
     /**

app/Domains/Integration/Services/ClientIntegrationService.php

@@ -13,6 +13,7 @@ class ClientIntegrationService
     public function getClientIntegration(Client $client, string $integrationCode): ?ClientIntegration
     {
         return $client->integrations()
+            ->with(['integration', 'integrationInstance'])
             ->where('integration_code', $integrationCode)
             ->first();
     }
@@ -20,7 +21,7 @@ class ClientIntegrationService
     /** @return Collection<int, ClientIntegration> */
     public function getAllForClient(Client $client): Collection
     {
-        return $client->integrations()->with('integration')->get();
+        return $client->integrations()->with(['integration', 'integrationInstance'])->get();
     }
 
     public function updateOrCreateIntegration(
@@ -29,13 +30,7 @@ class ClientIntegrationService
         array $data,
     ): ClientIntegration {
         return DB::transaction(function () use ($client, $integration, $data): ClientIntegration {
-            $clientIntegration = ClientIntegration::query()->updateOrCreate(
-                [
-                    'client_id' => $client->id,
-                    'integration_code' => $integration->integration_code,
-                ],
-                ['integration_data' => $data],
-            );
+            $clientIntegration = app(IntegrationAssociationService::class)->configure($client, $integration, $data);
 
             $service = $this->resolveService($integration->integration_code);
             $service?->forClient($client)->onSetup();

app/Domains/Integration/Services/IntegrationAssociationService.php

@@ -0,0 +1,98 @@
+<?php
+
+namespace App\Domains\Integration\Services;
+
+use App\Domains\Client\Models\Client;
+use App\Domains\Integration\Models\ClientIntegration;
+use App\Domains\Integration\Models\Integration;
+use App\Domains\Integration\Models\IntegrationInstance;
+use App\Domains\Integration\Models\WebsiteTypeIntegration;
+use App\Domains\Tenant\Models\WebsiteType;
+use Illuminate\Support\Facades\DB;
+
+class IntegrationAssociationService
+{
+    public function configure(Client|WebsiteType $owner, Integration $integration, array $integrationData): ClientIntegration|WebsiteTypeIntegration
+    {
+        return DB::transaction(function () use ($owner, $integration, $integrationData): ClientIntegration|WebsiteTypeIntegration {
+            $instance = IntegrationInstance::create([
+                'integration_code' => $integration->integration_code,
+                'name' => $integration->name.' / '.$this->ownerName($owner),
+                'integration_data' => $integrationData,
+            ]);
+
+            return $this->associate($owner, $integration->integration_code, $instance);
+        });
+    }
+
+    public function associate(Client|WebsiteType $owner, string $code, IntegrationInstance $instance): ClientIntegration|WebsiteTypeIntegration
+    {
+        return DB::transaction(function () use ($owner, $code, $instance): ClientIntegration|WebsiteTypeIntegration {
+            $association = $owner->integrations()
+                ->where('integration_code', $code)
+                ->lockForUpdate()
+                ->first();
+            $previousInstanceId = $association?->integration_instance_id;
+
+            $instanceIds = array_values(array_unique(array_filter([
+                $previousInstanceId,
+                $instance->id,
+            ])));
+            sort($instanceIds);
+
+            $instances = IntegrationInstance::query()
+                ->whereKey($instanceIds)
+                ->orderBy('id')
+                ->lockForUpdate()
+                ->get()
+                ->keyBy('id');
+            $instance = $instances->get($instance->id) ?? IntegrationInstance::query()->findOrFail($instance->id);
+            abort_unless($instance->integration_code === $code, 422, 'The instance belongs to another integration.');
+
+            $association = $owner->integrations()->updateOrCreate(
+                ['integration_code' => $code],
+                ['integration_instance_id' => $instance->id],
+            );
+
+            if ($previousInstanceId && $previousInstanceId !== $instance->id) {
+                $this->deleteIfUnused($previousInstanceId);
+            }
+
+            return $association->load('integrationInstance');
+        });
+    }
+
+    public function detach(Client|WebsiteType $owner, string $code): void
+    {
+        DB::transaction(function () use ($owner, $code): void {
+            $association = $owner->integrations()
+                ->where('integration_code', $code)
+                ->lockForUpdate()
+                ->first();
+
+            if (! $association) {
+                return;
+            }
+
+            $instanceId = $association->integration_instance_id;
+            $association->delete();
+            $this->deleteIfUnused($instanceId);
+        });
+    }
+
+    private function deleteIfUnused(int $instanceId): void
+    {
+        $instance = IntegrationInstance::query()->lockForUpdate()->find($instanceId);
+
+        if ($instance
+            && ! $instance->clientIntegrations()->exists()
+            && ! $instance->websiteTypeIntegrations()->exists()) {
+            $instance->delete();
+        }
+    }
+
+    private function ownerName(Client|WebsiteType $owner): string
+    {
+        return $owner instanceof Client ? $owner->name : $owner->nombre;
+    }
+}

app/Domains/Integration/Services/IntegrationInstanceService.php

@@ -0,0 +1,40 @@
+<?php
+
+namespace App\Domains\Integration\Services;
+
+use App\Domains\Integration\Models\IntegrationInstance;
+use Illuminate\Support\Facades\Cache;
+use Illuminate\Support\Facades\DB;
+
+class IntegrationInstanceService
+{
+    public function create(array $data): IntegrationInstance
+    {
+        return IntegrationInstance::create($data);
+    }
+
+    public function update(IntegrationInstance $instance, array $data): IntegrationInstance
+    {
+        return DB::transaction(function () use ($instance, $data): IntegrationInstance {
+            $instance = IntegrationInstance::query()->lockForUpdate()->findOrFail($instance->id);
+            $cacheKey = $instance->tokenCacheKey();
+            $instance->update($data);
+            if (array_key_exists('integration_data', $data)) {
+                DB::afterCommit(fn () => Cache::forget($cacheKey));
+            }
+
+            return $instance;
+        });
+    }
+
+    public function delete(IntegrationInstance $instance): void
+    {
+        DB::transaction(function () use ($instance): void {
+            $instance = IntegrationInstance::query()->lockForUpdate()->findOrFail($instance->id);
+            abort_if($instance->clientIntegrations()->exists() || $instance->websiteTypeIntegrations()->exists(), 409, 'Unlink the instance before deleting it.');
+            $cacheKey = $instance->tokenCacheKey();
+            $instance->delete();
+            DB::afterCommit(fn () => Cache::forget($cacheKey));
+        });
+    }
+}

app/Domains/Integration/Services/MailService.php

@@ -29,7 +29,7 @@ class MailService extends BaseIntegrationService
 
     private ?Mailer $mailer = null;
 
-    private bool $usesClientMailer = false;
+    private bool $usesInstanceMailer = false;
 
     public function __construct(?MailFactory $mailFactory = null)
     {
@@ -40,12 +40,12 @@ class MailService extends BaseIntegrationService
     {
         parent::forTenant($tenantCode);
 
-        if ($this->clientIntegration) {
+        if ($this->integrationInstance) {
             $this->mailer = $this->resolveMailer();
-            $this->usesClientMailer = true;
+            $this->usesInstanceMailer = true;
         } else {
             $this->mailer = $this->mailFactory->mailer();
-            $this->usesClientMailer = false;
+            $this->usesInstanceMailer = false;
         }
 
         return $this;
@@ -56,12 +56,12 @@ class MailService extends BaseIntegrationService
         parent::forClient($client);
         $this->tenant = $this->clientContext?->tenants()->first();
 
-        if ($this->clientIntegration) {
+        if ($this->integrationInstance) {
             $this->mailer = $this->resolveMailer();
-            $this->usesClientMailer = true;
+            $this->usesInstanceMailer = true;
         } else {
             $this->mailer = $this->mailFactory->mailer();
-            $this->usesClientMailer = false;
+            $this->usesInstanceMailer = false;
         }
 
         return $this;
@@ -122,8 +122,8 @@ class MailService extends BaseIntegrationService
 
     public function mailerName(): string
     {
-        return $this->usesClientMailer
-            ? 'client-smtp'
+        return $this->usesInstanceMailer
+            ? 'integration-smtp'
             : (string) config('mail.default');
     }
 
@@ -187,7 +187,7 @@ class MailService extends BaseIntegrationService
 
     private function resolveMailer(): Mailer
     {
-        $data = $this->clientIntegration?->integration_data;
+        $data = $this->integrationInstance?->integration_data;
 
         if (! is_array($data)) {
             throw new InvalidArgumentException('La configuración SMTP del cliente no es válida.');
@@ -205,7 +205,7 @@ class MailService extends BaseIntegrationService
         }
 
         $mailer = $this->mailFactory->build([
-            'name' => 'client-smtp-'.$this->clientContext?->id,
+            'name' => 'integration-smtp-'.$this->integrationInstance?->id,
             'transport' => 'smtp',
             'scheme' => $data['MAIL_SCHEME'] ?? null,
             'host' => $data['MAIL_HOST'],

app/Domains/Integration/Services/TelepagosIntegrationService.php

@@ -45,11 +45,11 @@ class TelepagosIntegrationService extends BaseIntegrationService
      */
     public function getToken(): string
     {
-        if (! $this->clientIntegration || ! $this->clientContext) {
+        if (! $this->integrationInstance) {
             throw new Exception('Client integration is not loaded. Call forTenant() or forClient() first.');
         }
 
-        $cacheKey = "integration_token:{$this->clientContext->id}:{$this->integrationCode}";
+        $cacheKey = $this->integrationInstance->tokenCacheKey();
 
         $token = Cache::get($cacheKey);
 
@@ -94,7 +94,7 @@ class TelepagosIntegrationService extends BaseIntegrationService
         // Calculate TTL and subtract a buffer of 60 seconds
         $ttlSeconds = max(1, $expiresAt->diffInSeconds(now()) - 60);
 
-        $cacheKey = "integration_token:{$this->clientContext->id}:{$this->integrationCode}";
+        $cacheKey = $this->integrationInstance->tokenCacheKey();
         Cache::put($cacheKey, $token, $ttlSeconds);
 
         return $token;
@@ -220,11 +220,11 @@ class TelepagosIntegrationService extends BaseIntegrationService
      */
     public function clearToken(): void
     {
-        if (! $this->clientContext) {
+        if (! $this->integrationInstance) {
             return;
         }
 
-        $cacheKey = "integration_token:{$this->clientContext->id}:{$this->integrationCode}";
+        $cacheKey = $this->integrationInstance->tokenCacheKey();
         Cache::forget($cacheKey);
     }
 

app/Domains/Integration/documentacion/README.md

@@ -1,33 +1,48 @@
 # Dominio Integration
 
-## Propósito
+## Modelo
 
-Gestiona integraciones externas disponibles y su configuración por cliente. Un cliente puede agrupar múltiples tenants que comparten las mismas credenciales. Incluye correo y pagos mediante Telepagos.
+- `Integration`: catálogo, URL base, `integration_data_schema` y `requires_configuration`.
+- `IntegrationInstance`: configuración interna concreta con nombre. `integration_data` se cifra con `EncryptedIntegrationData`, se almacena en `longText` y nunca se devuelve en la API.
+- `ClientIntegration` y `WebsiteTypeIntegration`: asociaciones a instancias. La clave compuesta verifica el código de la instancia y la unicidad permite una instancia por integración y propietario.
 
-## Modelo y seguridad
+Las instancias no se administran directamente por HTTP. Cada configuración enviada desde un cliente o tipo de sitio crea una instancia interna nueva y reemplaza únicamente la asociación de ese propietario. Al reemplazar o desvincular una instancia, esta se elimina si ya no tiene asociaciones con ningún cliente ni tipo de sitio; las instancias compartidas se conservan mientras tengan al menos una asociación.
 
-- `Integration`: definición global de una integración.
-- `ClientIntegration`: configuración y credenciales de una integración para un cliente.
-- `EncryptedIntegrationData`: cast que protege los datos sensibles persistidos.
-- `ClientIntegrationService`: consulta y configura integraciones del cliente.
+## Resolución
 
-## Servicios externos
+`BaseIntegrationService::forTenant()` busca primero la asociación del cliente y después la del tipo de sitio del tenant. Selecciona una configuración completa, sin mezclar credenciales entre niveles. Si una configuración está presente pero es inválida, produce un error en vez de recurrir a otra instancia.
 
-- `BaseIntegrationService`: resuelve el cliente desde el tenant operativo y carga exclusivamente la configuración del cliente.
-- `MailService`: envío de correo usando la integración configurada.
-- `TelepagosIntegrationService`: autenticación, caché de token, generación de QR y consulta de cobros.
-- `TelepagosWebhookService`: procesa notificaciones recibidas desde Telepagos.
+`forClient()` usa únicamente la asociación del cliente: sin un tenant concreto no se elige un tipo de sitio. Si no existe una instancia y `requires_configuration` es verdadero, se genera un error. Para correo opcional, `MailService` usa el mailer global si no encuentra una instancia; cuando la encuentra, construye un transporte SMTP aislado identificado como `integration-smtp`.
 
-## Endpoints
+Telepagos utiliza una clave de caché basada en el ID de instancia y una huella del texto cifrado. Volver a configurar el servicio con `forClient()` o `forTenant()` carga la configuración actual.
 
-- CRUD global bajo `/integrations`.
-- Consulta y configuración por cliente bajo `/clients/{client}/integrations`.
-- `POST /webhooks/telepagos/{client}` para notificaciones del proveedor.
+## Administración
 
-## Logging de Telepagos
+Todas estas rutas llevan el prefijo `/api`, requieren `auth:sanctum` y el rol global `admin` mediante `IntegrationPolicy`. Los roles `adminapp`, `scanner` y `user` no administran configuraciones.
 
-Los eventos de autenticación, QR, consultas de cuenta y procesamiento de webhooks se escriben en el canal diario `telepagos`, separado del log general. Los archivos se generan en `storage/logs/telepagos/telepagos-YYYY-MM-DD.log`; el nivel y la retención se configuran con `TELEPAGOS_LOG_LEVEL` y `TELEPAGOS_LOG_DAYS`. Tokens y credenciales se eliminan del contexto antes de registrar respuestas del proveedor.
+| Método | Ruta | Operación |
+| --- | --- | --- |
+| GET | `/clients/{client}/integrations[/{integration_code}]` | Consultar asociaciones directas. |
+| PUT | `/clients/{client}/integrations/{integration_code}` | Configurar: crea una instancia interna nueva y reemplaza solo la asociación del cliente. Ejecuta el hook de configuración existente. |
+| DELETE | `/clients/{client}/integrations/{integration_code}` | Desvincular. |
+| GET | `/website-types/{codigo}/integrations[/{integration_code}]` | Consultar asociaciones del tipo de sitio. |
+| PUT | `/website-types/{codigo}/integrations/{integration_code}` | Configurar: crea una instancia interna nueva y reemplaza solo la asociación del tipo de sitio. |
+| DELETE | `/website-types/{codigo}/integrations/{integration_code}` | Desvincular. |
 
-## Dependencias y reglas
+Los dos `PUT` reciben `integration_data`, un objeto completo validado según el esquema de la integración. La integración debe existir previamente en el catálogo interno. No hay endpoints públicos para administrar el catálogo ni las instancias directamente.
 
-Se integra con `Client`, `Tenant` y con el checkout de `Purchase`. `Notification` utiliza `MailService`. El tenant conserva el contexto operativo y de branding, pero nunca es dueño de credenciales. Las credenciales no se exponen en respuestas ni logs; los webhooks deben validar su contrato antes de alterar una compra.
+Las respuestas y consultas incluyen metadatos de `integration_instance`, pero nunca sus credenciales. La configuración del cliente conserva su mensaje de respuesta histórico; la del tipo de sitio usa un resource con envoltorio `data`.
+
+## Webhooks y contexto operativo
+
+`POST /webhooks/telepagos/{client}` conserva su contrato público con el proveedor y la validación de pertenencia de las compras al cliente. Como no recibe un tenant, requiere una asociación directa al cliente. Para usar una instancia compartida en ese flujo, asociarla también al cliente; la herencia por tipo de sitio no se aplica a esa URL.
+
+`Notification` consume `MailService`; `Purchase` consume Telepagos. Los tenants mantienen el contexto operativo y el branding.
+
+## Despliegue
+
+Ejecutar `php artisan migrate` junto con este código. La migración `2026_09_04_000003` renombra `requires_client_configuration` a `requires_configuration` conservando sus valores. Los payloads del catálogo deben usar el nuevo nombre. Las migraciones previas trasladan el texto cifrado sin descifrarlo y no comparten instancias automáticamente.
+
+## Logging
+
+Telepagos registra eventos en el canal diario `telepagos`. El nivel y la retención se configuran con `TELEPAGOS_LOG_LEVEL` y `TELEPAGOS_LOG_DAYS`. Se eliminan tokens y credenciales de las estructuras registradas.

app/Domains/Integration/routes/api.php

@@ -1,22 +1,25 @@
 <?php
 
 use App\Domains\Integration\Controllers\ClientIntegrationController;
-use App\Domains\Integration\Controllers\IntegrationController;
 use App\Domains\Integration\Controllers\TelepagosWebhookController;
+use App\Domains\Integration\Controllers\WebsiteTypeIntegrationController;
+use App\Domains\Integration\Models\Integration;
 use Illuminate\Support\Facades\Route;
 
-Route::group(['prefix' => 'integrations'], function () {
-    Route::get('/', [IntegrationController::class, 'index']);
-    Route::post('/', [IntegrationController::class, 'store']);
-    Route::get('/{integration}', [IntegrationController::class, 'show']);
-    Route::put('/{integration}', [IntegrationController::class, 'update']);
-    Route::delete('/{integration}', [IntegrationController::class, 'destroy']);
-});
+Route::middleware(['auth:sanctum', 'can:manage,'.Integration::class])->group(function (): void {
+    Route::prefix('website-types/{websiteType:codigo}/integrations')->group(function (): void {
+        Route::get('/', [WebsiteTypeIntegrationController::class, 'index']);
+        Route::get('/{integration_code}', [WebsiteTypeIntegrationController::class, 'show']);
+        Route::put('/{integration_code}', [WebsiteTypeIntegrationController::class, 'store']);
+        Route::delete('/{integration_code}', [WebsiteTypeIntegrationController::class, 'destroy']);
+    });
 
-Route::group(['prefix' => 'clients/{client}/integrations'], function () {
+    Route::group(['prefix' => 'clients/{client}/integrations'], function () {
         Route::get('/', [ClientIntegrationController::class, 'index']);
         Route::get('/{integration_code}', [ClientIntegrationController::class, 'show']);
         Route::put('/{integration_code}', [ClientIntegrationController::class, 'store']);
+        Route::delete('/{integration_code}', [ClientIntegrationController::class, 'destroy']);
+    });
 });
 
 Route::post('webhooks/telepagos/{client}', [TelepagosWebhookController::class, 'handle']);

app/Domains/Notification/Services/NotificationMailService.php

@@ -32,13 +32,14 @@ class NotificationMailService
             $tenant = Tenant::query()->with('websiteType')->where('codigo', $tenantCode)->firstOrFail();
             $user = User::query()->findOrFail($userId);
             $brand = $tenant->websiteType ?? $tenant;
+            $tenantUrl = 'https://'.$tenant->dominio.$tenant->base_path;
 
             $this->mailService
                 ->forTenant($tenantCode)
                 ->send(
                     $user->email,
                     "Bienvenido a {$brand->nombre}",
-                    view('mail.notifications.welcome', compact('brand', 'user'))->render(),
+                    view('mail.notifications.welcome', compact('brand', 'user', 'tenantUrl'))->render(),
                     $brand,
                 );
 
@@ -99,12 +100,25 @@ class NotificationMailService
                 : 'https://'.$recoveryDomain.$recoveryBasePath.'/recuperar-contrasena/codigo?'.http_build_query($recoveryQuery);
             $brand = $tenant->websiteType ?? $tenant;
 
+            [$subject, $template] = match ($attempt->reason) {
+                ResetPasswordAttempt::REASON_STAFF_CREATED => [
+                    'Tu cuenta de escáner está lista', 'scanner-created',
+                ],
+                ResetPasswordAttempt::REASON_ADMINISTRATOR_CREATED => [
+                    'Tu cuenta de administrador está lista', 'administrator-created',
+                ],
+                ResetPasswordAttempt::REASON_ACCOUNT_LOCKED => [
+                    'Desbloqueá tu cuenta', 'account-locked',
+                ],
+                default => ['Código para recuperar tu contraseña', 'password-reset'],
+            };
+
             $this->mailService
                 ->forTenant($tenantCode)
                 ->send(
                     $attempt->user->email,
-                    "Código para recuperar tu contraseña - {$brand->nombre}",
-                    view('mail.notifications.password-reset', [
+                    "{$subject} - {$brand->nombre}",
+                    view("mail.notifications.{$template}", [
                         'attempt' => $attempt,
                         'recoveryUrl' => $recoveryUrl,
                         'brand' => $brand,

app/Domains/Staff/Requests/StoreStaffRequest.php

@@ -2,6 +2,7 @@
 
 namespace App\Domains\Staff\Requests;
 
+use App\Domains\Authorization\Enums\RoleCode;
 use Illuminate\Foundation\Http\FormRequest;
 use Illuminate\Validation\Rule;
 
@@ -12,6 +13,13 @@ class StoreStaffRequest extends FormRequest
         return true;
     }
 
+    protected function prepareForValidation(): void
+    {
+        if (is_string($this->input('email'))) {
+            $this->merge(['email' => mb_strtolower(trim($this->input('email')))]);
+        }
+    }
+
     /** @return array<string, mixed> */
     public function rules(): array
     {
@@ -23,7 +31,12 @@ class StoreStaffRequest extends FormRequest
         return [
             'nombre_apellido' => ['required', 'string', 'max:255'],
             'dni' => ['required', 'string', 'max:50'],
-            'email' => ['required', 'email', 'max:255', 'unique:users,email'],
+            'email' => [
+                'required',
+                'email',
+                'max:255',
+                Rule::unique('users', 'active_email')->where('rol_codigo', RoleCode::Scanner->value)->whereNull('deleted_at'),
+            ],
             'category_ids' => $categoryRules,
             'category_ids.*' => ['integer', 'distinct', Rule::exists('categorias', 'id')],
         ];

app/Domains/Staff/Requests/UpdateStaffRequest.php

@@ -2,6 +2,7 @@
 
 namespace App\Domains\Staff\Requests;
 
+use App\Domains\Authorization\Enums\RoleCode;
 use Illuminate\Foundation\Http\FormRequest;
 use Illuminate\Validation\Rule;
 
@@ -12,6 +13,13 @@ class UpdateStaffRequest extends FormRequest
         return true;
     }
 
+    protected function prepareForValidation(): void
+    {
+        if (is_string($this->input('email'))) {
+            $this->merge(['email' => mb_strtolower(trim($this->input('email')))]);
+        }
+    }
+
     /** @return array<string, mixed> */
     public function rules(): array
     {
@@ -28,7 +36,9 @@ class UpdateStaffRequest extends FormRequest
                 'required',
                 'email',
                 'max:255',
-                Rule::unique('users', 'email')->ignore($staffId),
+                Rule::unique('users', 'active_email')->where('rol_codigo', RoleCode::Scanner->value)
+                    ->whereNull('deleted_at')
+                    ->ignore($staffId),
             ],
             'category_ids' => $categoryRules,
             'category_ids.*' => ['integer', 'distinct', Rule::exists('categorias', 'id')],

app/Domains/Staff/Services/StaffService.php

@@ -94,7 +94,12 @@ class StaffService
 
     public function delete(Tenant $tenant, int $staffId): void
     {
-        $this->find($tenant, $staffId)->delete();
+        $staff = $this->find($tenant, $staffId);
+
+        DB::transaction(function () use ($staff): void {
+            $staff->tokens()->delete();
+            $staff->delete();
+        });
     }
 
     public function find(Tenant $tenant, int $staffId): User

app/Domains/Tenant/Models/WebsiteType.php

@@ -3,6 +3,7 @@
 namespace App\Domains\Tenant\Models;
 
 use App\Domains\Attachable\Models\Attachment;
+use App\Domains\Integration\Models\WebsiteTypeIntegration;
 use Illuminate\Database\Eloquent\Attributes\Fillable;
 use Illuminate\Database\Eloquent\Factories\HasFactory;
 use Illuminate\Database\Eloquent\Model;
@@ -36,6 +37,12 @@ class WebsiteType extends Model
 
     protected $table = 'website_type';
 
+    /** @return HasMany<WebsiteTypeIntegration, $this> */
+    public function integrations(): HasMany
+    {
+        return $this->hasMany(WebsiteTypeIntegration::class, 'website_type_code', 'codigo');
+    }
+
     /**
      * @return BelongsTo<Attachment, $this>
      */

app/Domains/Tenant/Resources/TenantResource.php

@@ -32,6 +32,7 @@ class TenantResource extends JsonResource
             'site_title' => $this->site_title
                 ?? $this->websiteType?->site_title
                 ?? 'ShopitFront',
+            'asset_url' => config('filesystems.disks.s3.url'),
             'address' => $this->address,
             'phone' => $this->phone,
             'favicon' => ($this->favicon ?? $this->websiteType?->favicon)

app/Domains/Ticket/Models/Ticket.php

@@ -78,7 +78,7 @@ class Ticket extends Model
     /** @return BelongsTo<User, $this> */
     public function scannerUser(): BelongsTo
     {
-        return $this->belongsTo(User::class, 'scanner_user_id');
+        return $this->belongsTo(User::class, 'scanner_user_id')->withTrashed();
     }
 
     /** @return BelongsTo<PurchaseItem, $this> */

app/Domains/Ticket/Services/AdminAppTicketService.php

@@ -293,6 +293,7 @@ class AdminAppTicketService
             'id' => 'tickets.id',
             'amount' => $this->purchaseItemColumnQuery('precio_unitario'),
             'scanned_by' => User::query()
+                ->withTrashed()
                 ->select('nombre_apellido')
                 ->whereColumn('users.id', 'tickets.scanner_user_id'),
             'product' => $tenant->codigo === 'fiesta_futbol_infantil'

app/Domains/Ticket/Services/LoadTestTicketDatasetService.php

@@ -0,0 +1,229 @@
+<?php
+
+namespace App\Domains\Ticket\Services;
+
+use App\Domains\Auth\Models\User;
+use App\Domains\Authorization\Enums\RoleCode;
+use App\Domains\Catalog\Enums\CatalogItemType;
+use App\Domains\Catalog\Models\CatalogItem;
+use App\Domains\Catalog\Models\Variant;
+use App\Domains\Tenant\Models\Tenant;
+use Illuminate\Support\Collection;
+use Illuminate\Support\Str;
+use InvalidArgumentException;
+
+class LoadTestTicketDatasetService
+{
+    public function __construct(
+        private readonly TicketGeneratorService $ticketGenerator,
+        private readonly TicketValidityResolver $validityResolver,
+    ) {}
+
+    /**
+     * @return array{
+     *     run_id: string,
+     *     tenant_code: string,
+     *     catalog_item_id: int,
+     *     variant_id: int|null,
+     *     tickets: int,
+     *     scanners: int,
+     *     owners: int,
+     *     rows: array<int, array{scanner_token: string, ticket_uuid: string, expected_status: int}>
+     * }
+     */
+    public function prepare(
+        string $tenantCode,
+        int $ticketCount,
+        int $scannerCount,
+        int $ownerCount,
+        ?int $catalogItemId = null,
+        ?int $variantId = null,
+        ?string $runId = null,
+    ): array {
+        $this->validateInput($tenantCode, $ticketCount, $scannerCount, $ownerCount);
+
+        $tenant = Tenant::query()->where('codigo', $tenantCode)->firstOrFail();
+        $catalogItem = $this->resolveCatalogItem($tenant, $catalogItemId);
+        $variant = $this->resolveVariant($catalogItem, $variantId);
+        $runId ??= now()->format('Ymd-His').'-'.Str::lower(Str::random(6));
+
+        if (preg_match('/\A[a-zA-Z0-9][a-zA-Z0-9._-]{0,63}\z/', $runId) !== 1) {
+            throw new InvalidArgumentException('run_id contiene caracteres inválidos o es demasiado largo.');
+        }
+
+        if ($variant !== null && ! $this->validityResolver->resolveVariant($variant)->isValid()) {
+            throw new InvalidArgumentException(
+                'La variante seleccionada no tiene una vigencia activa y resoluble.'
+            );
+        }
+
+        $scanners = $this->scanners($tenant, $catalogItem, $scannerCount);
+        $owners = $this->owners($tenant, $ownerCount);
+        $tokens = $scanners->map(function (User $scanner): string {
+            $scanner->tokens()->where('name', 'load-test-scanner')->delete();
+
+            return $scanner->createToken(
+                'load-test-scanner',
+                ['scanner'],
+                now()->addMinutes((int) config('sanctum.expiration', 720)),
+            )->plainTextToken;
+        })->values();
+
+        $rows = [];
+        $remaining = $ticketCount;
+        $ownerIndex = 0;
+        $scannerIndex = 0;
+        $batchSize = min(500, max(1, (int) ceil($ticketCount / $ownerCount)));
+
+        while ($remaining > 0) {
+            $quantity = min($batchSize, $remaining);
+            $owner = $owners[$ownerIndex % $owners->count()];
+            $tickets = $this->ticketGenerator->generate(
+                $catalogItem,
+                $owner,
+                $quantity,
+                $variant?->getKey(),
+            );
+
+            foreach ($tickets as $ticket) {
+                if (! $ticket->is_valid) {
+                    throw new InvalidArgumentException(
+                        'La configuración seleccionada genera tickets que no están vigentes.'
+                    );
+                }
+
+                $rows[] = [
+                    'scanner_token' => $tokens[$scannerIndex % $tokens->count()],
+                    'ticket_uuid' => $ticket->ticket,
+                    'expected_status' => 200,
+                ];
+                $scannerIndex++;
+            }
+
+            $remaining -= $quantity;
+            $ownerIndex++;
+        }
+
+        return [
+            'run_id' => $runId,
+            'tenant_code' => $tenant->codigo,
+            'catalog_item_id' => $catalogItem->getKey(),
+            'variant_id' => $variant?->getKey(),
+            'tickets' => count($rows),
+            'scanners' => $scanners->count(),
+            'owners' => $owners->count(),
+            'rows' => $rows,
+        ];
+    }
+
+    private function validateInput(
+        string $tenantCode,
+        int $ticketCount,
+        int $scannerCount,
+        int $ownerCount,
+    ): void {
+        foreach ([
+            'tickets' => [$ticketCount, 100_000],
+            'scanners' => [$scannerCount, 10_000],
+            'owners' => [$ownerCount, 100_000],
+        ] as $name => [$value, $maximum]) {
+            if ($value < 1 || $value > $maximum) {
+                throw new InvalidArgumentException("{$name} debe estar entre 1 y {$maximum}.");
+            }
+        }
+
+        if ($scannerCount > $ticketCount || $ownerCount > $ticketCount) {
+            throw new InvalidArgumentException(
+                'La cantidad de scanners y propietarios no puede superar la cantidad de tickets.'
+            );
+        }
+    }
+
+    private function resolveCatalogItem(Tenant $tenant, ?int $catalogItemId): CatalogItem
+    {
+        $query = $tenant->catalogItems()
+            ->where('has_tickets', true)
+            ->where('type', CatalogItemType::Standard->value);
+
+        if ($catalogItemId !== null) {
+            $query->whereKey($catalogItemId);
+        }
+
+        $catalogItem = $query->first();
+
+        if ($catalogItem === null) {
+            throw new InvalidArgumentException(
+                'No se encontró un producto estándar con tickets habilitados para el tenant.'
+            );
+        }
+
+        if ($tenant->requiresScannerCategoryValidation() && $catalogItem->category_id === null) {
+            throw new InvalidArgumentException(
+                'El producto debe tener una categoría para autorizar a los scanners.'
+            );
+        }
+
+        return $catalogItem;
+    }
+
+    private function resolveVariant(CatalogItem $catalogItem, ?int $variantId): ?Variant
+    {
+        if ($variantId === null) {
+            return null;
+        }
+
+        $variant = $catalogItem->variants()->whereKey($variantId)->first();
+
+        if ($variant === null) {
+            throw new InvalidArgumentException('La variante no pertenece al producto seleccionado.');
+        }
+
+        return $variant;
+    }
+
+    /** @return Collection<int, User> */
+    private function scanners(Tenant $tenant, CatalogItem $catalogItem, int $count): Collection
+    {
+        return Collection::times($count, function (int $number) use ($tenant, $catalogItem): User {
+            $scanner = User::query()->updateOrCreate(
+                ['email' => $this->email($tenant, 'scanner', $number)],
+                [
+                    'nombre_apellido' => "Load test scanner {$number}",
+                    'password' => Str::password(32),
+                    'rol_codigo' => RoleCode::Scanner->value,
+                    'tenant_codigo' => $tenant->codigo,
+                ],
+            );
+            if ($tenant->requiresScannerCategoryValidation()) {
+                $scanner->scanCategories()->syncWithoutDetaching([$catalogItem->category_id]);
+            }
+
+            return $scanner;
+        });
+    }
+
+    /** @return Collection<int, User> */
+    private function owners(Tenant $tenant, int $count): Collection
+    {
+        return Collection::times($count, function (int $number) use ($tenant): User {
+            $owner = User::query()->updateOrCreate(
+                ['email' => $this->email($tenant, 'owner', $number)],
+                [
+                    'nombre_apellido' => "Load test owner {$number}",
+                    'password' => Str::password(32),
+                    'rol_codigo' => RoleCode::User->value,
+                    'tenant_codigo' => $tenant->codigo,
+                ],
+            );
+
+            return $owner;
+        });
+    }
+
+    private function email(Tenant $tenant, string $kind, int $number): string
+    {
+        $tenantSlug = Str::lower(preg_replace('/[^a-z0-9]+/i', '-', $tenant->codigo));
+
+        return "loadtest+{$tenantSlug}.{$kind}.{$number}@shopit.test";
+    }
+}

app/Domains/Ticket/Services/ScannerTicketService.php

@@ -73,7 +73,7 @@ class ScannerTicketService
             ->where('tenant_code', $scanner->tenant_codigo)
             ->where('ticket', $ticketUuid);
 
-        if ($scanner->tenant()->firstOrFail()->requiresScannerCategoryValidation()) {
+        if ($this->requiresCategoryValidation($scanner)) {
             $categoryIds = $this->scannerCategoryIds($scanner);
 
             $query->where(function (Builder $query) use ($scanner, $categoryIds): void {
@@ -158,7 +158,7 @@ class ScannerTicketService
 
     private function scannerCanScan(User $scanner, Ticket $ticket): bool
     {
-        if (! $scanner->tenant()->firstOrFail()->requiresScannerCategoryValidation()) {
+        if (! $this->requiresCategoryValidation($scanner)) {
             return true;
         }
 
@@ -169,4 +169,9 @@ class ScannerTicketService
                 ->where('categorias.id', $categoryId)
                 ->exists();
     }
+
+    private function requiresCategoryValidation(User $scanner): bool
+    {
+        return $scanner->tenant()->firstOrFail()->requiresScannerCategoryValidation();
+    }
 }

app/Domains/Ticket/documentacion/README.md

@@ -24,6 +24,33 @@ vigente, vencido o usado, y resuelve sus fechas efectivas de inicio y fin sin pe
 3. `TicketGeneratorService` crea los tickets requeridos según ítems, cantidades y vigencia.
 4. `Notification` envía la confirmación de compra después de la generación y adjunta los tickets cuando existen.
 
+## Datos descartables para pruebas de carga
+
+En ambientes `local`, `testing`, `staging`, `homo` u `homologation`, el comando siguiente crea tickets
+válidos, identidades scanner con tokens Sanctum y un dataset JSON importable por Postman:
+
+```bash
+php artisan load-test:tickets:prepare loadtest-evento \
+    --tickets=40000 \
+    --scanners=100 \
+    --owners=1000 \
+    --catalog-item=123 \
+    --run=evento-001
+```
+
+El tenant debe existir y se recomienda que sea exclusivo para carga. Si no se indica `--catalog-item`,
+se usa el primer producto estándar del tenant con tickets habilitados. `--variant`
+es opcional; al indicarlo, su configuración de vigencia debe estar activa y ser resoluble. Sin variante,
+los tickets tienen vigencia irrestricta.
+
+El archivo se escribe por defecto en `storage/app/private/load-tests/` y contiene tokens secretos, por
+lo que no debe versionarse. Para limpiar el tenant después de la ejecución:
+
+```bash
+php artisan tenants:reset-transactions loadtest-evento --dry-run
+php artisan tenants:reset-transactions loadtest-evento
+```
+
 ## Endpoints
 
 Bajo `/tenants/{tenant:codigo}`, protegidos por `auth:sanctum`:

app/Http/Middleware/EnsureScannerTenant.php

@@ -3,6 +3,7 @@
 namespace App\Http\Middleware;
 
 use App\Domains\Authorization\Enums\PermissionCode;
+use App\Domains\Authorization\Enums\RoleCode;
 use Closure;
 use Illuminate\Auth\Access\AuthorizationException;
 use Illuminate\Http\Request;
@@ -19,6 +20,7 @@ class EnsureScannerTenant
 
         if (
             ! $user
+            || $user->rol_codigo !== RoleCode::Scanner->value
             || ! $user->tenant_codigo
             || ! $user->hasPermission(PermissionCode::ScanTickets->value)
         ) {

app/Providers/AppServiceProvider.php

@@ -2,6 +2,8 @@
 
 namespace App\Providers;
 
+use App\Domains\Integration\Models\Integration;
+use App\Domains\Integration\Policies\IntegrationPolicy;
 use App\Domains\Notification\Events\PasswordResetRequested;
 use App\Domains\Notification\Events\UserRegistered;
 use App\Domains\Notification\Listeners\SendPasswordResetEmail;
@@ -13,6 +15,7 @@ use Illuminate\Cache\RateLimiting\Limit;
 use Illuminate\Database\Eloquent\Builder;
 use Illuminate\Http\Request;
 use Illuminate\Support\Facades\Event;
+use Illuminate\Support\Facades\Gate;
 use Illuminate\Support\Facades\RateLimiter;
 use Illuminate\Support\ServiceProvider;
 
@@ -31,6 +34,10 @@ class AppServiceProvider extends ServiceProvider
      */
     public function boot(): void
     {
+        Gate::policy(
+            Integration::class,
+            IntegrationPolicy::class,
+        );
         Event::listen(PurchasePaid::class, GenerateTicketsForPaidPurchase::class);
         Event::listen(PurchasePaid::class, SendPurchaseConfirmedEmail::class);
         Event::listen(UserRegistered::class, SendWelcomeEmail::class);

database/migrations/2026_09_03_000000_add_soft_deletes_to_users_table.php

@@ -0,0 +1,23 @@
+<?php
+
+use Illuminate\Database\Migrations\Migration;
+use Illuminate\Database\Schema\Blueprint;
+use Illuminate\Support\Facades\Schema;
+
+return new class extends Migration
+{
+    public function up(): void
+    {
+        Schema::table('users', function (Blueprint $table): void {
+            $table->softDeletes();
+        });
+
+    }
+
+    public function down(): void
+    {
+        Schema::table('users', function (Blueprint $table): void {
+            $table->dropSoftDeletes();
+        });
+    }
+};

database/migrations/2026_09_03_000100_scope_user_email_unique_to_active_accounts.php

@@ -0,0 +1,28 @@
+<?php
+
+use Illuminate\Database\Migrations\Migration;
+use Illuminate\Database\Schema\Blueprint;
+use Illuminate\Support\Facades\Schema;
+
+return new class extends Migration
+{
+    public function up(): void
+    {
+        Schema::table('users', function (Blueprint $table): void {
+            $table->dropUnique(['email']);
+            $table->string('active_email')
+                ->nullable()
+                ->storedAs('CASE WHEN `deleted_at` IS NULL THEN LOWER(`email`) ELSE NULL END');
+            $table->unique('active_email');
+        });
+    }
+
+    public function down(): void
+    {
+        Schema::table('users', function (Blueprint $table): void {
+            $table->dropUnique(['active_email']);
+            $table->dropColumn('active_email');
+            $table->unique('email');
+        });
+    }
+};

database/migrations/2026_09_03_000200_scope_google_id_unique_to_active_accounts.php

@@ -0,0 +1,28 @@
+<?php
+
+use Illuminate\Database\Migrations\Migration;
+use Illuminate\Database\Schema\Blueprint;
+use Illuminate\Support\Facades\Schema;
+
+return new class extends Migration
+{
+    public function up(): void
+    {
+        Schema::table('users', function (Blueprint $table): void {
+            $table->dropUnique(['google_id']);
+            $table->string('active_google_id')
+                ->nullable()
+                ->storedAs('CASE WHEN `deleted_at` IS NULL THEN `google_id` ELSE NULL END');
+            $table->unique('active_google_id');
+        });
+    }
+
+    public function down(): void
+    {
+        Schema::table('users', function (Blueprint $table): void {
+            $table->dropUnique(['active_google_id']);
+            $table->dropColumn('active_google_id');
+            $table->unique('google_id');
+        });
+    }
+};

database/migrations/2026_09_04_000000_create_integration_instances_table.php

@@ -0,0 +1,28 @@
+<?php
+
+use Illuminate\Database\Migrations\Migration;
+use Illuminate\Database\Schema\Blueprint;
+use Illuminate\Support\Facades\Schema;
+
+return new class extends Migration
+{
+    public function up(): void
+    {
+        Schema::create('integration_instances', function (Blueprint $table): void {
+            $table->id();
+            $table->string('integration_code');
+            $table->string('name');
+            $table->longText('integration_data')->nullable(); // Encrypted JSON.
+            $table->timestamps();
+
+            $table->foreign('integration_code')->references('integration_code')->on('integrations')->restrictOnDelete();
+            // Allows associations to enforce one instance per integration and owner.
+            $table->unique(['id', 'integration_code'], 'integration_instances_id_code_unique');
+        });
+    }
+
+    public function down(): void
+    {
+        Schema::dropIfExists('integration_instances');
+    }
+};

database/migrations/2026_09_04_000000_rename_adminapp_staff_menu_label.php

@@ -0,0 +1,29 @@
+<?php
+
+use Illuminate\Database\Migrations\Migration;
+use Illuminate\Support\Facades\DB;
+
+return new class extends Migration
+{
+    private const MENU_CODE = 'adminapp.staff';
+
+    public function up(): void
+    {
+        DB::table('menues')
+            ->where('code', self::MENU_CODE)
+            ->update([
+                'label' => 'Usuarios',
+                'updated_at' => now(),
+            ]);
+    }
+
+    public function down(): void
+    {
+        DB::table('menues')
+            ->where('code', self::MENU_CODE)
+            ->update([
+                'label' => 'Staff',
+                'updated_at' => now(),
+            ]);
+    }
+};

database/migrations/2026_09_04_000000_scope_active_email_unique_per_role.php

@@ -0,0 +1,24 @@
+<?php
+
+use Illuminate\Database\Migrations\Migration;
+use Illuminate\Database\Schema\Blueprint;
+use Illuminate\Support\Facades\Schema;
+
+return new class extends Migration
+{
+    public function up(): void
+    {
+        Schema::table('users', function (Blueprint $table): void {
+            $table->unique(['active_email', 'rol_codigo']);
+            $table->dropUnique(['active_email']);
+        });
+    }
+
+    public function down(): void
+    {
+        Schema::table('users', function (Blueprint $table): void {
+            $table->unique('active_email');
+            $table->dropUnique(['active_email', 'rol_codigo']);
+        });
+    }
+};

database/migrations/2026_09_04_000001_move_client_configuration_to_integration_instances.php

@@ -0,0 +1,81 @@
+<?php
+
+use Illuminate\Database\Migrations\Migration;
+use Illuminate\Database\Schema\Blueprint;
+use Illuminate\Support\Facades\DB;
+use Illuminate\Support\Facades\Schema;
+
+return new class extends Migration
+{
+    public function up(): void
+    {
+        // MySQL commits DDL separately; allow retrying after a partially applied migration.
+        if (! Schema::hasColumn('client_integrations', 'integration_instance_id')) {
+            Schema::table('client_integrations', function (Blueprint $table): void {
+                $table->unsignedBigInteger('integration_instance_id')->nullable();
+            });
+        }
+
+        DB::table('client_integrations')->whereNull('integration_instance_id')->orderBy('id')->chunkById(100, function ($associations): void {
+            foreach ($associations as $association) {
+                DB::transaction(function () use ($association): void {
+                    $instanceId = DB::table('integration_instances')->insertGetId([
+                        'integration_code' => $association->integration_code,
+                        'name' => $association->integration_code.' / client '.$association->client_id,
+                        // Copy ciphertext verbatim: no decryption or re-encryption during migration.
+                        'integration_data' => $association->integration_data,
+                        'created_at' => $association->created_at,
+                        'updated_at' => $association->updated_at,
+                    ]);
+
+                    DB::table('client_integrations')->where('id', $association->id)->update([
+                        'integration_instance_id' => $instanceId,
+                    ]);
+                });
+            }
+        });
+
+        Schema::table('client_integrations', function (Blueprint $table): void {
+            $table->unsignedBigInteger('integration_instance_id')->nullable(false)->change();
+        });
+
+        $hasInstanceForeignKey = collect(Schema::getForeignKeys('client_integrations'))
+            ->contains(fn (array $key): bool => $key['columns'] === ['integration_instance_id', 'integration_code']);
+
+        if (! $hasInstanceForeignKey) {
+            Schema::table('client_integrations', function (Blueprint $table): void {
+                $table->foreign(['integration_instance_id', 'integration_code'], 'client_integrations_instance_code_fk')
+                    ->references(['id', 'integration_code'])->on('integration_instances')->restrictOnDelete();
+            });
+        }
+
+        if (Schema::hasColumn('client_integrations', 'integration_data')) {
+            Schema::table('client_integrations', function (Blueprint $table): void {
+                $table->dropColumn('integration_data');
+            });
+        }
+    }
+
+    public function down(): void
+    {
+        Schema::table('client_integrations', function (Blueprint $table): void {
+            $table->longText('integration_data')->nullable();
+        });
+
+        DB::table('client_integrations')->orderBy('id')->chunkById(100, function ($associations): void {
+            foreach ($associations as $association) {
+                DB::table('client_integrations')->where('id', $association->id)->update([
+                    'integration_data' => DB::table('integration_instances')
+                        ->where('id', $association->integration_instance_id)->value('integration_data'),
+                ]);
+            }
+        });
+
+        Schema::table('client_integrations', function (Blueprint $table): void {
+            // MySQL uses the short name; SQLite needs the columns to rebuild the table.
+            $table->dropForeign('client_integrations_instance_code_fk')
+                ->columns(['integration_instance_id', 'integration_code']);
+            $table->dropColumn('integration_instance_id');
+        });
+    }
+};

database/migrations/2026_09_04_000002_create_website_type_integrations_table.php

@@ -0,0 +1,29 @@
+<?php
+
+use Illuminate\Database\Migrations\Migration;
+use Illuminate\Database\Schema\Blueprint;
+use Illuminate\Support\Facades\Schema;
+
+return new class extends Migration
+{
+    public function up(): void
+    {
+        Schema::create('website_type_integrations', function (Blueprint $table): void {
+            $table->id();
+            $table->string('website_type_code');
+            $table->string('integration_code');
+            $table->unsignedBigInteger('integration_instance_id');
+            $table->timestamps();
+
+            $table->foreign('website_type_code')->references('codigo')->on('website_type')->cascadeOnDelete();
+            $table->foreign(['integration_instance_id', 'integration_code'], 'website_type_integrations_instance_code_fk')
+                ->references(['id', 'integration_code'])->on('integration_instances')->restrictOnDelete();
+            $table->unique(['website_type_code', 'integration_code'], 'website_type_integrations_owner_code_unique');
+        });
+    }
+
+    public function down(): void
+    {
+        Schema::dropIfExists('website_type_integrations');
+    }
+};

database/migrations/2026_09_04_000003_rename_integration_configuration_requirement.php

@@ -0,0 +1,22 @@
+<?php
+
+use Illuminate\Database\Migrations\Migration;
+use Illuminate\Database\Schema\Blueprint;
+use Illuminate\Support\Facades\Schema;
+
+return new class extends Migration
+{
+    public function up(): void
+    {
+        Schema::table('integrations', function (Blueprint $table): void {
+            $table->renameColumn('requires_client_configuration', 'requires_configuration');
+        });
+    }
+
+    public function down(): void
+    {
+        Schema::table('integrations', function (Blueprint $table): void {
+            $table->renameColumn('requires_configuration', 'requires_client_configuration');
+        });
+    }
+};

database/migrations/2026_09_04_010000_remove_scan_permission_from_adminapp_role.php

@@ -0,0 +1,42 @@
+<?php
+
+use App\Domains\Authorization\Enums\PermissionCode;
+use App\Domains\Authorization\Enums\RoleCode;
+use Illuminate\Database\Migrations\Migration;
+use Illuminate\Support\Facades\DB;
+
+return new class extends Migration
+{
+    public function up(): void
+    {
+        DB::table('roles_permisos')
+            ->where('rol_codigo', RoleCode::AdminApp->value)
+            ->where('codigo_permiso', PermissionCode::ScanTickets->value)
+            ->delete();
+    }
+
+    public function down(): void
+    {
+        $roleExists = DB::table('roles')
+            ->where('codigo', RoleCode::AdminApp->value)
+            ->exists();
+        $permissionExists = DB::table('permisos')
+            ->where('codigo', PermissionCode::ScanTickets->value)
+            ->exists();
+
+        if (! $roleExists || ! $permissionExists) {
+            return;
+        }
+
+        DB::table('roles_permisos')->updateOrInsert(
+            [
+                'rol_codigo' => RoleCode::AdminApp->value,
+                'codigo_permiso' => PermissionCode::ScanTickets->value,
+            ],
+            [
+                'created_at' => now(),
+                'updated_at' => now(),
+            ],
+        );
+    }
+};

database/seeders/AuthorizationSeeder.php

@@ -120,7 +120,7 @@ class AuthorizationSeeder extends Seeder
         RoleCode::AdminApp->value => [
             'nombre' => 'Administrador de la aplicación',
             'descripcion' => 'Accede a los menús administrativos de la aplicación.',
-            'permisos' => [PermissionCode::ScanTickets->value],
+            'permisos' => [],
         ],
         RoleCode::Scanner->value => [
             'nombre' => 'Scanner',

database/seeders/EmailIntegrationSeeder.php

@@ -17,7 +17,7 @@ class EmailIntegrationSeeder extends Seeder
             [
                 'name' => 'Email',
                 'url' => null,
-                'requires_client_configuration' => false,
+                'requires_configuration' => false,
                 'integration_data_schema' => [
                     'MAIL_MAILER' => 'required|string|in:smtp',
                     'MAIL_SCHEME' => 'required|string|in:smtp',

database/seeders/MenuSeeder.php

@@ -74,7 +74,7 @@ class MenuSeeder extends Seeder
             ],
             [
                 'code' => 'adminapp.staff',
-                'label' => 'Staff',
+                'label' => 'Usuarios',
                 'parent_menu_code' => 'main.adminapp',
                 'route' => '/admin/staff',
             ],

database/seeders/TelepagosIntegrationSeeder.php

@@ -17,7 +17,7 @@ class TelepagosIntegrationSeeder extends Seeder
             [
                 'name' => 'Telepagos',
                 'url' => 'https://api.telepagos.com.ar',
-                'requires_client_configuration' => true,
+                'requires_configuration' => true,
                 'integration_data_schema' => [
                     'username' => 'required|string',
                     'password' => 'required|string',
@@ -30,7 +30,7 @@ class TelepagosIntegrationSeeder extends Seeder
             [
                 'name' => 'Telepagos Homologación',
                 'url' => 'https://api.homo.telepagos.com.ar',
-                'requires_client_configuration' => true,
+                'requires_configuration' => true,
                 'integration_data_schema' => [
                     'username' => 'required|string',
                     'password' => 'required|string',

docs/email-identity.md

@@ -0,0 +1,31 @@
+# Identidad por email y rol
+
+Cada cuenta activa se identifica por `LOWER(email)` + `rol_codigo`, globalmente,
+sin incluir el tenant. Un mismo correo puede tener una cuenta `user`, otra
+`adminapp`, otra `scanner` y otra `admin`. Dos cuentas activas del mismo rol
+no pueden compartir correo, incluso si pertenecen a distintos tenants.
+
+La base lo garantiza con el índice único `(active_email, rol_codigo)`.
+`active_email` es una columna generada: vale `LOWER(email)` cuando `deleted_at`
+es NULL y NULL para cuentas eliminadas. El soft delete libera el correo para
+ese rol; registrarlo nuevamente crea una cuenta independiente.
+
+Registro, perfil, administradores y staff validan el correo normalizado contra
+el rol de destino. Cambiar de rol o restaurar una cuenta también queda sujeto
+al índice único de la base.
+
+Login y recuperación seleccionan la identidad de la aplicación:
+
+- Tienda y Google: `user`.
+- AdminApp: `adminapp`.
+- Scanner: `scanner`. Sólo las identidades con ese rol pueden autenticarse y
+  consumir los endpoints del scanner.
+- Verificación administrativa de plataforma: `admin`.
+
+Los endpoints de validación de código y cambio de contraseña toman el rol de
+la ruta, nunca del cuerpo enviado por el cliente. Los intentos y cambios de
+contraseña pertenecen a una cuenta concreta, aunque otra comparta su email.
+
+Aplicar `php artisan migrate` antes de habilitar correos compartidos por rol.
+Para revertir esta migración hay que resolver primero los correos compartidos
+entre cuentas activas: el índice global anterior no los admite.

postman/generate-shopit-collection.php

@@ -11,7 +11,7 @@ declare(strict_types=1);
 $root = dirname(__DIR__);
 chdir($root);
 
-$command = escapeshellarg(PHP_BINARY).' artisan route:list --path=api --json';
+$command = escapeshellarg(PHP_BINARY).' artisan route:list --json';
 $routeJson = shell_exec($command);
 
 if (! is_string($routeJson) || trim($routeJson) === '') {
@@ -20,6 +20,11 @@ if (! is_string($routeJson) || trim($routeJson) === '') {
 }
 
 $routes = json_decode($routeJson, true, flags: JSON_THROW_ON_ERROR);
+$routes = array_values(array_filter(
+    $routes,
+    fn (array $route): bool => str_starts_with($route['uri'], 'api/')
+        || $route['uri'] === 'auth/google/redirect',
+));
 
 const TINY_PNG = 'data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAADUlEQVR42mNk+M9QDwADhgGAWjR9awAAAABJRU5ErkJggg==';
 
@@ -70,9 +75,8 @@ function bodyFor(string $method, string $uri): ?array
         'POST api/clients' => ['code' => 'cliente-demo', 'name' => 'Cliente Demo'],
         'PUT api/clients/{client}' => ['code' => 'cliente-demo', 'name' => 'Cliente Demo Actualizado'],
         'PATCH api/clients/{client}' => ['name' => 'Cliente Demo Actualizado'],
-        'POST api/integrations' => ['integration_code' => 'telepagos', 'name' => 'Telepagos', 'url' => 'https://api.example.com', 'integration_data_schema' => ['api_key' => ['required', 'string']], 'requires_client_configuration' => true],
-        'PUT api/integrations/{integration}' => ['name' => 'Telepagos', 'url' => 'https://api.example.com', 'requires_client_configuration' => true],
         'PUT api/clients/{client}/integrations/{integration_code}' => ['integration_data' => ['api_key' => 'replace-me']],
+        'PUT api/website-types/{websiteType:codigo}/integrations/{integration_code}' => ['integration_data' => ['api_key' => 'replace-me']],
         'POST api/menues' => ['code' => 'demo', 'label' => 'Demo', 'parent_menu_code' => null, 'content_type' => 'static', 'static_content_schema' => ['title' => ['required', 'string']], 'route' => '/demo'],
         'PUT api/menues/{menue}' => ['label' => 'Demo actualizado', 'route' => '/demo'],
         'PATCH api/menues/{menue}' => ['label' => 'Demo actualizado'],
@@ -177,6 +181,10 @@ function bodyFor(string $method, string $uri): ?array
 function queryFor(string $uri): array
 {
     return match ($uri) {
+        'auth/google/redirect' => [
+            ['key' => 'tenant', 'value' => '{{tenant_code}}'],
+            ['key' => 'return_url', 'value' => '{{storefront_url}}'],
+        ],
         'api/tenants/bootstrap' => [['key' => 'dominio', 'value' => '{{tenant_domain}}'], ['key' => 'path', 'value' => '/']],
         'api/v1/adminapp/bootstrap/{dominio}', 'api/v1/scanner/bootstrap/{dominio}' => [['key' => 'path', 'value' => '/']],
         'api/tenants/{tenant:codigo}/catalog-items' => [['key' => 'q', 'value' => 'demo'], ['key' => 'page', 'value' => '1']],
@@ -267,7 +275,8 @@ function requestName(string $method, string $action, bool $multiMethod): string
 function pathFor(string $uri): string
 {
     $variables = [
-        'tenant:codigo' => 'tenant_code', 'tenant' => 'tenant_id', 'client' => 'client_id',
+        'tenant:codigo' => 'tenant_code', 'tenant' => 'tenant_id', 'client' => 'client_code',
+        'websiteType:codigo' => 'website_type_code',
         'integration_code' => 'integration_code', 'integration' => 'integration_id', 'menue' => 'menu_id',
         'menu_code' => 'menu_code', 'tenant_code' => 'tenant_code', 'catalogItem' => 'catalog_item_id',
         'featuredGroup' => 'featured_group_id', 'category' => 'category_id', 'cartItem' => 'cart_item_id',
@@ -322,6 +331,111 @@ function tokenCaptureEvent(string $uri): array
     ];
 }
 
+/** @return array<string, array{name: string, description: string, integration_data: array<string, mixed>}> */
+function integrationConfigurationPresets(): array
+{
+    return [
+        'email' => [
+            'name' => 'Email (SMTP)',
+            'description' => 'Configura el transporte SMTP usado para el envío de correos.',
+            'integration_data' => [
+                'MAIL_MAILER' => 'smtp',
+                'MAIL_SCHEME' => 'smtp',
+                'MAIL_HOST' => 'smtp.example.com',
+                'MAIL_PORT' => 587,
+                'MAIL_USERNAME' => 'usuario@example.com',
+                'MAIL_PASSWORD' => 'replace-me',
+                'MAIL_FROM_ADDRESS' => 'no-reply@example.com',
+                'MAIL_FROM_NAME' => 'ShopIt',
+            ],
+        ],
+        'telepagos' => [
+            'name' => 'Telepagos Producción',
+            'description' => 'Configura las credenciales productivas de Telepagos.',
+            'integration_data' => [
+                'username' => 'replace-me',
+                'password' => 'replace-me',
+            ],
+        ],
+        'telepagos_homo' => [
+            'name' => 'Telepagos Homologación',
+            'description' => 'Configura las credenciales del entorno de homologación de Telepagos.',
+            'integration_data' => [
+                'username' => 'replace-me',
+                'password' => 'replace-me',
+            ],
+        ],
+    ];
+}
+
+/** @param array<int, array<string, mixed>> $requests
+ * @return array<int, array<string, mixed>>
+ */
+function integrationOwnerFolders(array $requests): array
+{
+    $owners = [
+        'Client' => '/api/clients/',
+        'Website Type' => '/api/website-types/',
+    ];
+    $folders = [];
+
+    foreach ($owners as $ownerName => $pathFragment) {
+        $ownerRequests = array_values(array_filter(
+            $requests,
+            fn (array $item): bool => str_contains($item['request']['url']['raw'], $pathFragment),
+        ));
+        $putTemplate = null;
+        foreach ($ownerRequests as $ownerRequest) {
+            if ($ownerRequest['request']['method'] === 'PUT') {
+                $putTemplate = $ownerRequest;
+                break;
+            }
+        }
+
+        if ($putTemplate === null) {
+            continue;
+        }
+
+        foreach ($ownerRequests as &$request) {
+            if ($request['request']['method'] === 'PUT') {
+                $request['name'] = 'Configure Integration (generic)';
+            }
+        }
+        unset($request);
+
+        $ownerItems = [[
+            'name' => 'Management',
+            'description' => 'Consulta, configura o desvincula cualquier integración usando `{{integration_code}}`.',
+            'item' => $ownerRequests,
+        ]];
+
+        foreach (integrationConfigurationPresets() as $integrationCode => $preset) {
+            $request = $putTemplate;
+            $request['name'] = 'Configure '.$preset['name'];
+            $request['request']['description'] .= "\n\nPreset: `{$integrationCode}`. {$preset['description']}";
+            $request['request']['url']['raw'] = str_replace('{{integration_code}}', $integrationCode, $request['request']['url']['raw']);
+            $request['request']['url']['path'] = array_map(
+                fn (string $segment): string => $segment === '{{integration_code}}' ? $integrationCode : $segment,
+                $request['request']['url']['path'],
+            );
+            $request['request']['body'] = jsonBody(['integration_data' => $preset['integration_data']]);
+
+            $ownerItems[] = [
+                'name' => $preset['name'],
+                'description' => $preset['description'],
+                'item' => [$request],
+            ];
+        }
+
+        $folders[] = [
+            'name' => $ownerName,
+            'item' => $ownerItems,
+        ];
+    }
+
+    return $folders;
+}
+
 $tree = [];
 $registeredOperations = 0;
 
@@ -403,7 +517,9 @@ $items = [];
 foreach ($tree as $section => $folders) {
     $children = [];
     foreach ($folders as $folder => $requests) {
-        $children[] = ['name' => humanize($folder), 'item' => $requests];
+        $children[] = $section === 'Platform Management' && $folder === 'Integration'
+            ? ['name' => 'Integration', 'item' => integrationOwnerFolders($requests)]
+            : ['name' => humanize($folder), 'item' => $requests];
     }
 
     $items[] = [
@@ -415,12 +531,14 @@ foreach ($tree as $section => $folders) {
 
 $variables = [
     'base_url' => 'http://localhost:8000',
+    'storefront_url' => 'http://localhost:4200',
     'token' => '', 'admin_token' => '', 'scanner_token' => '',
     'user_email' => 'usuario@example.com', 'user_password' => 'Password!123',
     'admin_email' => 'admin@example.com', 'admin_password' => 'Password!123',
     'scanner_email' => 'scanner@example.com', 'scanner_password' => 'Password!123',
     'tenant_code' => 'demo', 'tenant_id' => '1', 'tenant_domain' => 'demo.test',
-    'client_id' => '1', 'integration_id' => '1', 'integration_code' => 'telepagos',
+    'client_id' => '1', 'client_code' => 'cliente-demo', 'website_type_code' => 'shopit',
+    'integration_code' => 'telepagos',
     'menu_id' => '1', 'menu_code' => 'demo', 'catalog_item_id' => '1', 'variant_id' => '1',
     'category_id' => '1', 'featured_group_id' => '1', 'cart_id' => '1', 'cart_item_id' => '1',
     'purchase_id' => '1', 'purchase_item_id' => '1', 'sale_id' => '1', 'staff_id' => '1',
@@ -434,7 +552,7 @@ $collection = [
     'info' => [
         '_postman_id' => '76fd6fd2-53b9-4d92-8e02-1ddcc6207fa2',
         'name' => 'ShopIt API — Complete',
-        'description' => "Colección canónica generada desde las rutas reales de Laravel. Incluye {$registeredOperations} operaciones HTTP, ejemplos de payload, filtros, archivos y tokens separados para Storefront, Admin App y Scanner.\n\nUso rápido:\n1. Ajustá `base_url` y las credenciales.\n2. Ejecutá el Login de la aplicación correspondiente; el token se guarda automáticamente.\n3. Ajustá los IDs y códigos de las variables de colección.\n\nRegeneración: `php postman/generate-shopit-collection.php`.",
+        'description' => "Colección canónica generada desde las rutas reales de Laravel. Incluye {$registeredOperations} operaciones HTTP, presets de configuración para cada integración, ejemplos de payload, filtros, archivos y tokens separados para Storefront, Admin App y Scanner.\n\nUso rápido:\n1. Ajustá `base_url` y las credenciales.\n2. Ejecutá el Login de la aplicación correspondiente; el token se guarda automáticamente.\n3. Ajustá los IDs y códigos de las variables de colección.\n\nRegeneración: `php postman/generate-shopit-collection.php`.",
         'schema' => 'https://schema.getpostman.com/json/collection/v2.1.0/collection.json',
     ],
     'item' => $items,

resources/views/mail/notifications/account-locked.blade.php

@@ -0,0 +1,6 @@
+@include('mail.notifications.partials.password-action', [
+    'title' => 'Desbloqueá tu cuenta',
+    'description' => 'registramos varios intentos fallidos de inicio de sesión en tu cuenta. Por seguridad, bloqueamos el acceso temporalmente. Utilizá este código para cambiar tu contraseña y desbloquearla.',
+    'buttonLabel' => 'Ingresar código ahora',
+    'footer' => 'Si no fuiste vos, por favor desestimá y borrá este correo. Tu cuenta seguirá protegida.',
+])

resources/views/mail/notifications/administrator-created.blade.php

@@ -0,0 +1,6 @@
+@include('mail.notifications.partials.password-action', [
+    'title' => 'Tu cuenta de administrador está lista',
+    'description' => 'creamos tu cuenta de administrador en '.$brand->nombre.'. Creá tu contraseña con este código para ingresar al panel de administración.',
+    'buttonLabel' => 'Crear mi contraseña',
+    'footer' => 'Si no esperabas recibir una cuenta de administrador, podés ignorar este mensaje.',
+])

resources/views/mail/notifications/partials/password-action.blade.php

@@ -0,0 +1,24 @@
+<h1 style="margin: 0 0 20px; color: {{ $brand->primary_color }};">
+    {{ $title }}
+</h1>
+
+<p>Hola {{ $attempt->user->nombre_apellido }}, {{ $description }}</p>
+
+<p>Ingresá este código en {{ $brand->nombre }}:</p>
+
+<div style="margin: 28px 0; padding: 20px; border: 2px solid {{ $brand->primary_color }}; border-radius: 8px; text-align: center;">
+    <span style="color: {{ $brand->primary_color }}; font-size: 36px; font-weight: 700; letter-spacing: 12px;">
+        {{ $attempt->codigo }}
+    </span>
+</div>
+
+@if($recoveryUrl)
+<div style="text-align: center; margin-bottom: 28px;">
+    <a href="{{ $recoveryUrl }}"
+       style="display: inline-block; padding: 12px 24px; background-color: {{ $brand->primary_color }}; color: #ffffff; text-decoration: none; border-radius: 6px; font-weight: bold;">
+        {{ $buttonLabel }}
+    </a>
+</div>
+@endif
+
+<p style="color: #64748b; font-size: 14px;">{{ $footer }}</p>

resources/views/mail/notifications/password-reset.blade.php

@@ -1,45 +1,6 @@
-<h1 style="margin: 0 0 20px; color: {{ $brand->primary_color }};">
-    Recuperá tu contraseña
-</h1>
-
-@if($attempt->reason === \App\Domains\Auth\Models\ResetPasswordAttempt::REASON_STAFF_CREATED)
-<p>
-    Hola {{ $attempt->user->nombre_apellido }}, creamos tu cuenta de scanner en {{ $brand->nombre }}. Utilizá este código para crear tu contraseña y comenzar a usarla.
-</p>
-@elseif($attempt->reason === \App\Domains\Auth\Models\ResetPasswordAttempt::REASON_ACCOUNT_LOCKED)
-<p>
-    Hola {{ $attempt->user->nombre_apellido }}, registramos varios intentos fallidos de inicio de sesión en tu cuenta. Por seguridad, hemos bloqueado el acceso temporalmente. Puedes utilizar este código para cambiar tu contraseña y desbloquearla inmediatamente.
-</p>
-@else
-<p>
-    Hola {{ $attempt->user->nombre_apellido }}, recibimos una solicitud para restablecer
-    la contraseña de tu cuenta.
-</p>
-@endif
-
-<p>Ingresá este código en {{ $brand->nombre }}:</p>
-
-<div style="margin: 28px 0; padding: 20px; border: 2px solid {{ $brand->primary_color }}; border-radius: 8px; text-align: center;">
-    <span style="color: {{ $brand->primary_color }}; font-size: 36px; font-weight: 700; letter-spacing: 12px;">
-        {{ $attempt->codigo }}
-    </span>
-</div>
-
-@if($recoveryUrl)
-<div style="text-align: center; margin-bottom: 28px;">
-    <a href="{{ $recoveryUrl }}" 
-       style="display: inline-block; padding: 12px 24px; background-color: {{ $brand->primary_color }}; color: #ffffff; text-decoration: none; border-radius: 6px; font-weight: bold;">
-        {{ $attempt->reason === \App\Domains\Auth\Models\ResetPasswordAttempt::REASON_STAFF_CREATED ? 'Crear mi contraseña' : 'Ingresar código ahora' }}
-    </a>
-</div>
-@endif
-
-<p style="color: #64748b; font-size: 14px;">
-@if($attempt->reason === \App\Domains\Auth\Models\ResetPasswordAttempt::REASON_ACCOUNT_LOCKED)
-    Si no fuiste vos, por favor desestimá y borrá este correo. Tu cuenta seguirá protegida.
-@elseif($attempt->reason === \App\Domains\Auth\Models\ResetPasswordAttempt::REASON_STAFF_CREATED)
-    Si no esperabas recibir una cuenta de scanner, podés ignorar este mensaje.
-@else
-    Si no solicitaste recuperar tu contraseña, podés ignorar este mensaje.
-@endif
-</p>
+@include('mail.notifications.partials.password-action', [
+    'title' => 'Recuperá tu contraseña',
+    'description' => 'recibimos una solicitud para restablecer la contraseña de tu cuenta.',
+    'buttonLabel' => 'Ingresar código ahora',
+    'footer' => 'Si no solicitaste recuperar tu contraseña, podés ignorar este mensaje.',
+])

resources/views/mail/notifications/scanner-created.blade.php

@@ -0,0 +1,6 @@
+@include('mail.notifications.partials.password-action', [
+    'title' => 'Tu cuenta de escáner está lista',
+    'description' => 'creamos tu cuenta de escáner en '.$brand->nombre.'. Creá tu contraseña con este código para ingresar y comenzar a escanear entradas.',
+    'buttonLabel' => 'Crear mi contraseña',
+    'footer' => 'Si no esperabas recibir una cuenta de escáner, podés ignorar este mensaje.',
+])

resources/views/mail/notifications/welcome.blade.php

@@ -1,3 +1,8 @@
 <h1 style="margin: 0 0 20px;">¡Bienvenido a {{ $brand->nombre }}!</h1>
 <p>Hola {{ $user->nombre_apellido }}, tu cuenta fue creada correctamente.</p>
-<p>Ya podés ingresar y comenzar a comprar.</p>
+<div style="text-align: center; margin-bottom: 28px;">
+    <a href="{{ $tenantUrl }}"
+       style="display: inline-block; padding: 12px 24px; background-color: {{ $brand->primary_color }}; color: #ffffff; text-decoration: none; border-radius: 6px; font-weight: bold;">
+        Encendé tu experiencia
+    </a>
+</div>

routes/api.php

@@ -16,5 +16,6 @@ require __DIR__.'/../app/Domains/Ticket/routes/api.php';
 require __DIR__.'/../app/Domains/Event/routes/api.php';
 require __DIR__.'/../app/Domains/Forms/routes/api.php';
 require __DIR__.'/../app/Domains/Staff/routes/api.php';
+require __DIR__.'/../app/Domains/Administrator/routes/api.php';
 require __DIR__.'/../app/Domains/FiestaFutbolInfantil/routes/api.php';
 require __DIR__.'/../app/Domains/Desfile/routes/api.php';

routes/console.php

@@ -3,9 +3,11 @@
 use App\Domains\Auth\Services\AdminCredentialVerifier;
 use App\Domains\Catalog\Services\ExpireStockReservationsService;
 use App\Domains\Purchase\Services\TenantTransactionResetService;
+use App\Domains\Ticket\Services\LoadTestTicketDatasetService;
 use Illuminate\Foundation\Inspiring;
 use Illuminate\Support\Facades\Artisan;
 use Illuminate\Support\Facades\Schedule;
+use Illuminate\Support\Facades\Storage;
 
 Artisan::command('inspire', function () {
     $this->comment(Inspiring::quote());
@@ -24,6 +26,79 @@ Schedule::command('reservations:expire')
     ->everyMinute()
     ->withoutOverlapping();
 
+Artisan::command(
+    'load-test:tickets:prepare
+        {tenant : Código del tenant que recibirá los datos de carga}
+        {--tickets=1000 : Cantidad de tickets válidos}
+        {--scanners=10 : Cantidad de identidades scanner}
+        {--owners=100 : Cantidad de propietarios de tickets}
+        {--catalog-item= : Producto estándar con tickets habilitados}
+        {--variant= : Variante opcional que define la vigencia}
+        {--run= : Identificador opcional de la ejecución}
+        {--output= : Ruta relativa dentro del disco local}',
+    function (LoadTestTicketDatasetService $datasetService): int {
+        if (! app()->environment(['local', 'testing', 'staging', 'homo', 'homologation'])) {
+            $this->error('Este comando sólo puede ejecutarse en local u homologación.');
+
+            return self::FAILURE;
+        }
+
+        $requestedOutput = filled($this->option('output'))
+            ? ltrim((string) $this->option('output'), '/\\')
+            : null;
+
+        if ($requestedOutput !== null
+            && ($requestedOutput === '' || str_contains(str_replace('\\', '/', $requestedOutput), '../'))) {
+            $this->error('La ruta de salida debe permanecer dentro del disco local.');
+
+            return self::FAILURE;
+        }
+
+        try {
+            $dataset = $datasetService->prepare(
+                (string) $this->argument('tenant'),
+                (int) $this->option('tickets'),
+                (int) $this->option('scanners'),
+                (int) $this->option('owners'),
+                filled($this->option('catalog-item')) ? (int) $this->option('catalog-item') : null,
+                filled($this->option('variant')) ? (int) $this->option('variant') : null,
+                filled($this->option('run')) ? (string) $this->option('run') : null,
+            );
+        } catch (Throwable $exception) {
+            $this->error($exception->getMessage());
+
+            return self::FAILURE;
+        }
+
+        $relativePath = $requestedOutput !== null
+            ? $requestedOutput
+            : "load-tests/{$dataset['run_id']}.postman.json";
+        $payload = json_encode($dataset['rows'], JSON_PRETTY_PRINT | JSON_UNESCAPED_SLASHES);
+
+        if (! is_string($payload) || ! Storage::disk('local')->put($relativePath, $payload.PHP_EOL)) {
+            $this->error('No se pudo escribir el dataset.');
+
+            return self::FAILURE;
+        }
+
+        $this->info('Dataset de carga generado.');
+        $this->table(['Dato', 'Valor'], [
+            ['run_id', $dataset['run_id']],
+            ['tenant', $dataset['tenant_code']],
+            ['catalog_item_id', $dataset['catalog_item_id']],
+            ['variant_id', $dataset['variant_id'] ?? 'sin variante (vigencia irrestricta)'],
+            ['tickets', $dataset['tickets']],
+            ['scanners', $dataset['scanners']],
+            ['owners', $dataset['owners']],
+            ['archivo', Storage::disk('local')->path($relativePath)],
+        ]);
+        $this->warn('El archivo contiene tokens secretos. No lo subas al repositorio.');
+        $this->comment("Limpieza: php artisan tenants:reset-transactions {$dataset['tenant_code']}");
+
+        return self::SUCCESS;
+    },
+)->purpose('Prepare disposable scanner tickets and a Postman performance dataset');
+
 Artisan::command(
     'tenants:reset-transactions
         {tenant : Código del tenant que se limpiará}

tests/Concerns/CreatesIntegrationInstances.php

@@ -0,0 +1,21 @@
+<?php
+
+namespace Tests\Concerns;
+
+use App\Domains\Integration\Models\ClientIntegration;
+use App\Domains\Integration\Models\IntegrationInstance;
+
+trait CreatesIntegrationInstances
+{
+    private function createClientIntegration(array $attributes): ClientIntegration
+    {
+        $instance = IntegrationInstance::create([
+            'integration_code' => $attributes['integration_code'],
+            'name' => 'Test instance',
+            'integration_data' => $attributes['integration_data'],
+        ]);
+        unset($attributes['integration_data']);
+
+        return ClientIntegration::create($attributes + ['integration_instance_id' => $instance->id]);
+    }
+}

tests/Feature/Administrator/AdministratorControllerTest.php

@@ -0,0 +1,159 @@
+<?php
+
+namespace Tests\Feature\Administrator;
+
+use App\Domains\Attachable\Enums\AttachmentType;
+use App\Domains\Attachable\Models\Attachment;
+use App\Domains\Auth\Models\ResetPasswordAttempt;
+use App\Domains\Auth\Models\User;
+use App\Domains\Authorization\Enums\RoleCode;
+use App\Domains\Notification\Events\PasswordResetRequested;
+use App\Domains\Tenant\Models\Tenant;
+use App\Domains\Tenant\Models\WebsiteType;
+use Database\Seeders\AuthorizationSeeder;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Support\Facades\Event;
+use Laravel\Sanctum\Sanctum;
+use Tests\TestCase;
+
+class AdministratorControllerTest extends TestCase
+{
+    use RefreshDatabase;
+
+    private Tenant $tenant;
+
+    private User $admin;
+
+    protected function setUp(): void
+    {
+        parent::setUp();
+
+        Event::fake([PasswordResetRequested::class]);
+        $this->seed(AuthorizationSeeder::class);
+        WebsiteType::query()->create(['codigo' => 'onticket', 'nombre' => 'OnTicket']);
+        $headerLogo = $this->createAttachment('header.png');
+        $footerLogo = $this->createAttachment('footer.png');
+        $this->tenant = Tenant::query()->create([
+            'codigo' => 'acme',
+            'nombre' => 'Acme',
+            'dominio' => 'acme.test',
+            'website_type_code' => 'onticket',
+            'primary_color' => '#111111',
+            'secondary_color' => '#222222',
+            'danger_color' => '#cc0000',
+            'success_color' => '#008800',
+            'header_bg_color' => '#ffffff',
+            'footer_bg_color' => '#ffffff',
+            'header_logo_id' => $headerLogo->id,
+            'footer_logo_id' => $footerLogo->id,
+        ]);
+        $this->admin = User::factory()->create([
+            'rol_codigo' => RoleCode::AdminApp->value,
+            'tenant_codigo' => $this->tenant->codigo,
+        ]);
+    }
+
+    private const URL = '/api/v1/adminapp/tenant/administrators';
+
+    private function payload(): array
+    {
+        return ['nombre_apellido' => 'Ada Lovelace', 'dni' => '12345678', 'email' => 'ada@example.test'];
+    }
+
+    public function test_email_can_be_shared_with_customers_and_scanners(): void
+    {
+        Sanctum::actingAs($this->admin);
+        foreach (['user', 'scanner'] as $role) {
+            User::factory()->create(['email' => 'ada@example.test', 'rol_codigo' => $role]);
+        }
+        $response = $this->postJson(self::URL, $this->payload())->assertCreated();
+        $this->putJson(self::URL.'/'.$response->json('data.id'), $this->payload())->assertOk();
+        $this->postJson(self::URL, $this->payload())->assertUnprocessable()->assertJsonValidationErrors('email');
+    }
+
+    public function test_crud_and_password_setup_and_token_revocation(): void
+    {
+        Sanctum::actingAs($this->admin);
+        $response = $this->postJson(self::URL, [...$this->payload(), 'email' => ' ADA@example.test ', 'rol_codigo' => 'admin', 'tenant_codigo' => 'other'])
+            ->assertCreated()->assertJsonPath('data.email', 'ada@example.test')
+            ->assertJsonPath('data.rol_codigo', 'adminapp')->assertJsonMissingPath('data.password');
+        $id = $response->json('data.id');
+        $this->assertDatabaseHas('users', ['id' => $id, 'tenant_codigo' => $this->tenant->codigo, 'rol_codigo' => 'adminapp']);
+        $this->assertDatabaseHas('reset_password_attempts', ['user_id' => $id, 'reason' => ResetPasswordAttempt::REASON_ADMINISTRATOR_CREATED, 'status' => ResetPasswordAttempt::STATUS_PENDING]);
+        Event::assertDispatched(PasswordResetRequested::class, fn ($event) => $event->channel === PasswordResetRequested::CHANNEL_ADMINAPP && $event->tenantCode === $this->tenant->codigo);
+        $this->getJson(self::URL.'?search=Ada')->assertOk()->assertJsonCount(1, 'data');
+        $this->putJson(self::URL."/{$id}", [...$this->payload(), 'nombre_apellido' => 'Ada Byron', 'rol_codigo' => 'scanner'])
+            ->assertOk()->assertJsonPath('data.nombre_apellido', 'Ada Byron')->assertJsonPath('data.rol_codigo', 'adminapp');
+        $token = User::findOrFail($id)->createToken('adminapp')->accessToken;
+        $this->deleteJson(self::URL."/{$id}")->assertNoContent();
+        $this->assertSoftDeleted('users', ['id' => $id]);
+        $this->assertDatabaseMissing('personal_access_tokens', ['id' => $token->id]);
+        $this->getJson(self::URL.'?search=Ada')->assertOk()->assertJsonCount(0, 'data');
+        $this->postJson(self::URL, $this->payload())->assertCreated();
+    }
+
+    public function test_validation_and_case_insensitive_active_email_uniqueness(): void
+    {
+        Sanctum::actingAs($this->admin);
+        $this->postJson(self::URL, [])->assertUnprocessable()->assertJsonValidationErrors(['nombre_apellido', 'dni', 'email']);
+        $this->postJson(self::URL, [...$this->payload(), 'email' => 'invalid'])->assertUnprocessable()->assertJsonValidationErrors('email');
+        $this->postJson(self::URL, [...$this->payload(), 'email' => strtoupper($this->admin->email)])->assertUnprocessable()->assertJsonValidationErrors('email');
+        $target = User::factory()->create(['rol_codigo' => 'adminapp', 'tenant_codigo' => $this->tenant->codigo]);
+        $this->putJson(self::URL."/{$target->id}", [...$this->payload(), 'email' => strtoupper($this->admin->email)])->assertUnprocessable()->assertJsonValidationErrors('email');
+    }
+
+    public function test_other_tenants_and_roles_are_excluded(): void
+    {
+        Sanctum::actingAs($this->admin);
+        $otherTenant = $this->tenant->replicate();
+        $otherTenant->codigo = 'other';
+        $otherTenant->dominio = 'other.test';
+        $otherTenant->save();
+        $targets = [
+            User::factory()->create(['rol_codigo' => 'adminapp', 'tenant_codigo' => $otherTenant->codigo]),
+            User::factory()->create(['rol_codigo' => 'scanner', 'tenant_codigo' => $this->tenant->codigo]),
+            User::factory()->create(['rol_codigo' => 'admin', 'tenant_codigo' => $this->tenant->codigo]),
+        ];
+        $this->getJson(self::URL)->assertOk()->assertJsonCount(1, 'data')->assertJsonPath('data.0.id', $this->admin->id);
+        foreach ($targets as $target) {
+            $this->putJson(self::URL."/{$target->id}", $this->payload())->assertNotFound();
+            $this->deleteJson(self::URL."/{$target->id}")->assertNotFound();
+            $this->assertNotSoftDeleted($target);
+        }
+    }
+
+    public function test_cannot_delete_self_even_with_another_administrator(): void
+    {
+        Sanctum::actingAs($this->admin);
+        $this->deleteJson(self::URL."/{$this->admin->id}")->assertUnprocessable()->assertJsonValidationErrors('administrator');
+        User::factory()->create(['rol_codigo' => 'adminapp', 'tenant_codigo' => $this->tenant->codigo]);
+        $this->deleteJson(self::URL."/{$this->admin->id}")->assertUnprocessable();
+        $this->assertNotSoftDeleted($this->admin);
+    }
+
+    public function test_in_flight_request_from_deleted_actor_cannot_remove_last_administrator(): void
+    {
+        $remaining = User::factory()->create(['rol_codigo' => 'adminapp', 'tenant_codigo' => $this->tenant->codigo]);
+        $this->admin->delete();
+        Sanctum::actingAs($this->admin);
+        $this->deleteJson(self::URL."/{$remaining->id}")->assertUnprocessable()->assertJsonValidationErrors('administrator');
+        $this->assertNotSoftDeleted($remaining);
+    }
+
+    public function test_authentication_and_role_are_required_for_all_operations(): void
+    {
+        $this->getJson(self::URL)->assertUnauthorized();
+        foreach (['user', 'scanner', 'admin'] as $role) {
+            Sanctum::actingAs(User::factory()->create(['rol_codigo' => $role, 'tenant_codigo' => $this->tenant->codigo]));
+            $this->getJson(self::URL)->assertForbidden();
+            $this->postJson(self::URL, $this->payload())->assertForbidden();
+            $this->putJson(self::URL."/{$this->admin->id}", $this->payload())->assertForbidden();
+            $this->deleteJson(self::URL."/{$this->admin->id}")->assertForbidden();
+        }
+    }
+
+    private function createAttachment(string $filename): Attachment
+    {
+        return Attachment::query()->create(['path' => "test/{$filename}", 'filename' => $filename, 'type' => AttachmentType::Image, 'mime_type' => 'image/png']);
+    }
+}

tests/Feature/Auth/EmailUniquenessPerRoleTest.php

@@ -0,0 +1,133 @@
+<?php
+
+namespace Tests\Feature\Auth;
+
+use App\Domains\Attachable\Enums\AttachmentType;
+use App\Domains\Attachable\Models\Attachment;
+use App\Domains\Auth\Models\ResetPasswordAttempt;
+use App\Domains\Auth\Models\User;
+use App\Domains\Authorization\Enums\RoleCode;
+use App\Domains\Notification\Events\PasswordResetRequested;
+use App\Domains\Tenant\Models\Tenant;
+use Database\Seeders\AuthorizationSeeder;
+use Illuminate\Database\UniqueConstraintViolationException;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Routing\Middleware\ThrottleRequests;
+use Illuminate\Support\Facades\Event;
+use Illuminate\Support\Facades\Hash;
+use Tests\TestCase;
+
+class EmailUniquenessPerRoleTest extends TestCase
+{
+    use RefreshDatabase;
+
+    protected function setUp(): void
+    {
+        parent::setUp();
+        $this->withoutMiddleware(ThrottleRequests::class);
+        $this->seed(AuthorizationSeeder::class);
+        Event::fake([PasswordResetRequested::class]);
+    }
+
+    public function test_database_allows_different_roles_and_reuse_after_soft_delete(): void
+    {
+        foreach (RoleCode::cases() as $role) {
+            User::factory()->create(['email' => 'Shared@example.com', 'rol_codigo' => $role->value]);
+        }
+        $user = User::where('rol_codigo', 'user')->sole();
+        $user->delete();
+        $replacement = User::factory()->create(['email' => 'shared@example.com']);
+        $this->assertNotSame($user->id, $replacement->id);
+        $this->assertSame(4, User::where('active_email', 'shared@example.com')->count());
+    }
+
+    public function test_database_rejects_same_role_case_insensitively_across_tenants(): void
+    {
+        foreach (['one', 'two'] as $code) {
+            $this->createTenant($code);
+        }
+        User::factory()->create(['email' => 'Shared@example.com', 'tenant_codigo' => 'one']);
+        $this->expectException(UniqueConstraintViolationException::class);
+        User::factory()->create(['email' => 'shared@example.com', 'tenant_codigo' => 'two']);
+    }
+
+    public function test_role_change_cannot_create_a_duplicate_active_identity(): void
+    {
+        User::factory()->create(['email' => 'shared@example.com']);
+        $admin = User::factory()->create(['email' => 'shared@example.com', 'rol_codigo' => 'adminapp']);
+        $this->expectException(UniqueConstraintViolationException::class);
+        $admin->update(['rol_codigo' => 'user']);
+    }
+
+    public function test_registration_accepts_another_role_but_rejects_same_role(): void
+    {
+        User::factory()->create(['email' => 'SHARED@example.com', 'rol_codigo' => 'adminapp']);
+        $payload = ['nombre_apellido' => 'Shared', 'email' => ' Shared@Example.com ',
+            'password' => 'Secret!123', 'password_confirmation' => 'Secret!123'];
+        $this->postJson('/api/register', $payload)->assertCreated()->assertJsonPath('data.email', 'shared@example.com');
+        $this->postJson('/api/register', $payload)->assertUnprocessable()->assertJsonValidationErrors('email');
+    }
+
+    public function test_login_and_password_reset_select_the_role_from_each_application(): void
+    {
+        $tenant = $this->createTenant('acme');
+        $users = [];
+        // Create staff first so an email-only lookup would select the wrong account.
+        foreach (['adminapp', 'scanner', 'user'] as $role) {
+            $users[$role] = User::factory()->create([
+                'email' => 'Shared@example.com', 'rol_codigo' => $role,
+                'tenant_codigo' => $tenant->codigo, 'password' => 'Old!'.$role,
+            ]);
+        }
+        foreach (['user' => '/api', 'adminapp' => '/api/v1/adminapp', 'scanner' => '/api/v1/scanner'] as $role => $base) {
+            $this->postJson($base.'/login', [
+                'email' => 'SHARED@example.com', 'password' => 'Old!'.$role, 'tenant_codigo' => 'acme',
+            ])->assertOk()->assertJsonPath('user.id', $users[$role]->id);
+            $this->postJson($base.'/password/reset-attempts', [
+                'email' => 'shared@example.com', 'tenant_codigo' => 'acme',
+            ])->assertAccepted();
+        }
+        // Identical codes across roles must still only change the intended account.
+        ResetPasswordAttempt::query()->update(['codigo' => '1234']);
+        foreach (['user' => '/api', 'adminapp' => '/api/v1/adminapp', 'scanner' => '/api/v1/scanner'] as $role => $base) {
+            $this->postJson($base.'/password/reset-attempts/validate', [
+                'email' => 'shared@example.com', 'codigo' => '1234',
+            ])->assertOk();
+            $this->postJson($base.'/password/reset', [
+                'email' => 'shared@example.com', 'codigo' => '1234',
+                'password' => 'New!'.$role, 'password_confirmation' => 'New!'.$role,
+            ])->assertOk();
+            $this->assertTrue(Hash::check('New!'.$role, $users[$role]->fresh()->password));
+        }
+    }
+
+    private function createTenant(string $code): Tenant
+    {
+        $headerLogo = $this->createAttachment("{$code}-header");
+        $footerLogo = $this->createAttachment("{$code}-footer");
+
+        return Tenant::query()->create([
+            'codigo' => $code,
+            'nombre' => ucfirst($code),
+            'dominio' => "{$code}.local",
+            'primary_color' => '#000000',
+            'secondary_color' => '#000000',
+            'danger_color' => '#000000',
+            'success_color' => '#000000',
+            'header_bg_color' => '#000000',
+            'footer_bg_color' => '#000000',
+            'header_logo_id' => $headerLogo->id,
+            'footer_logo_id' => $footerLogo->id,
+        ]);
+    }
+
+    private function createAttachment(string $name): Attachment
+    {
+        return Attachment::query()->create([
+            'path' => "test/{$name}.png",
+            'filename' => "{$name}.png",
+            'type' => AttachmentType::Image,
+            'mime_type' => 'image/png',
+        ]);
+    }
+}

tests/Feature/Auth/RegisterControllerTest.php

@@ -135,4 +135,36 @@ class RegisterControllerTest extends TestCase
             'password',
         ]);
     }
+
+    public function test_it_can_reuse_the_email_of_a_soft_deleted_user(): void
+    {
+        $deletedUser = User::factory()->create([
+            'email' => 'reused@example.com',
+        ]);
+        $deletedUser->delete();
+
+        $response = $this->postJson('/api/register', [
+            'nombre_apellido' => 'New Account',
+            'email' => 'reused@example.com',
+            'password' => 'Secret!123',
+            'password_confirmation' => 'Secret!123',
+        ])->assertCreated();
+
+        $newUserId = $response->json('data.id');
+
+        $this->assertNotSame($deletedUser->id, $newUserId);
+        $this->assertSame(
+            2,
+            User::withTrashed()->where('email', 'reused@example.com')->count(),
+        );
+        $this->assertDatabaseHas('users', [
+            'id' => $deletedUser->id,
+            'active_email' => null,
+        ]);
+        $this->assertDatabaseHas('users', [
+            'id' => $newUserId,
+            'active_email' => 'reused@example.com',
+            'deleted_at' => null,
+        ]);
+    }
 }

tests/Feature/Auth/ScannerLoginControllerTest.php

@@ -2,6 +2,7 @@
 
 namespace Tests\Feature\Auth;
 
+use App\Domains\Attachable\Models\Attachment;
 use App\Domains\Auth\Models\LoginAttempt;
 use App\Domains\Auth\Models\ResetPasswordAttempt;
 use App\Domains\Auth\Models\User;
@@ -14,6 +15,7 @@ use App\Domains\Tenant\Models\Tenant;
 use Illuminate\Foundation\Testing\RefreshDatabase;
 use Illuminate\Support\Facades\Event;
 use Illuminate\Support\Facades\Hash;
+use Illuminate\Support\Str;
 use Tests\TestCase;
 
 class ScannerLoginControllerTest extends TestCase
@@ -23,19 +25,15 @@ class ScannerLoginControllerTest extends TestCase
     public function test_it_logs_in_a_tenant_bound_user_with_scan_permission(): void
     {
         $role = Role::query()->create([
-            'codigo' => RoleCode::AdminApp->value,
-            'nombre' => 'Operador',
+            'codigo' => RoleCode::Scanner->value,
+            'nombre' => 'Scanner',
         ]);
         $permission = Permission::query()->create([
             'codigo' => PermissionCode::ScanTickets->value,
             'nombre' => 'Escanear tickets',
         ]);
         $role->permissions()->attach($permission->codigo);
-        $tenant = Tenant::query()->create([
-            'codigo' => 'acme',
-            'nombre' => 'Acme',
-            'dominio' => 'acme.test',
-        ]);
+        $tenant = $this->createTenant();
         $user = User::factory()->create([
             'email' => 'scanner@example.com',
             'password' => Hash::make('secret123'),
@@ -51,23 +49,85 @@ class ScannerLoginControllerTest extends TestCase
         $response
             ->assertOk()
             ->assertJsonPath('user.id', $user->id)
-            ->assertJsonPath('user.rol_codigo', RoleCode::AdminApp->value)
+            ->assertJsonPath('user.rol_codigo', RoleCode::Scanner->value)
             ->assertJsonPath('token_type', 'Bearer');
 
         $this->assertSame(['scanner'], $user->tokens()->sole()->abilities);
     }
 
+    public function test_it_rejects_adminapp_credentials_even_when_the_role_has_scan_permission(): void
+    {
+        $role = Role::query()->create([
+            'codigo' => RoleCode::AdminApp->value,
+            'nombre' => 'Administrador',
+        ]);
+        $permission = Permission::query()->create([
+            'codigo' => PermissionCode::ScanTickets->value,
+            'nombre' => 'Escanear tickets',
+        ]);
+        $role->permissions()->attach($permission->codigo);
+        $tenant = $this->createTenant();
+        $adminApp = User::factory()->create([
+            'email' => 'shared@example.com',
+            'password' => Hash::make('admin-password'),
+            'rol_codigo' => $role->codigo,
+            'tenant_codigo' => $tenant->codigo,
+        ]);
+
+        $this->postJson('/api/v1/scanner/login', [
+            'email' => $adminApp->email,
+            'password' => 'admin-password',
+            'rol_codigo' => RoleCode::AdminApp->value,
+        ])->assertUnprocessable()->assertJsonValidationErrors(['email']);
+
+        $this->assertDatabaseCount('personal_access_tokens', 0);
+    }
+
+    public function test_shared_email_authenticates_the_scanner_identity_only(): void
+    {
+        $scannerRole = Role::query()->create([
+            'codigo' => RoleCode::Scanner->value,
+            'nombre' => 'Scanner',
+        ]);
+        $adminAppRole = Role::query()->create([
+            'codigo' => RoleCode::AdminApp->value,
+            'nombre' => 'Administrador',
+        ]);
+        $permission = Permission::query()->create([
+            'codigo' => PermissionCode::ScanTickets->value,
+            'nombre' => 'Escanear tickets',
+        ]);
+        $scannerRole->permissions()->attach($permission->codigo);
+        $tenant = $this->createTenant();
+        User::factory()->create([
+            'email' => 'shared@example.com',
+            'password' => Hash::make('admin-password'),
+            'rol_codigo' => $adminAppRole->codigo,
+            'tenant_codigo' => $tenant->codigo,
+        ]);
+        $scanner = User::factory()->create([
+            'email' => 'shared@example.com',
+            'password' => Hash::make('scanner-password'),
+            'rol_codigo' => $scannerRole->codigo,
+            'tenant_codigo' => $tenant->codigo,
+        ]);
+
+        $this->postJson('/api/v1/scanner/login', [
+            'email' => 'shared@example.com',
+            'password' => 'scanner-password',
+        ])
+            ->assertOk()
+            ->assertJsonPath('user.id', $scanner->id)
+            ->assertJsonPath('user.rol_codigo', RoleCode::Scanner->value);
+    }
+
     public function test_it_rejects_a_user_without_scan_permission(): void
     {
         $role = Role::query()->create([
             'codigo' => RoleCode::Scanner->value,
             'nombre' => 'Scanner sin permiso',
         ]);
-        $tenant = Tenant::query()->create([
-            'codigo' => 'acme',
-            'nombre' => 'Acme',
-            'dominio' => 'acme.test',
-        ]);
+        $tenant = $this->createTenant();
         $user = User::factory()->create([
             'email' => 'customer@example.com',
             'password' => Hash::make('secret123'),
@@ -92,11 +152,7 @@ class ScannerLoginControllerTest extends TestCase
             'nombre' => 'Escanear tickets',
         ]);
         $role->permissions()->attach($permission->codigo);
-        $tenant = Tenant::query()->create([
-            'codigo' => 'acme',
-            'nombre' => 'Acme',
-            'dominio' => 'acme.test',
-        ]);
+        $tenant = $this->createTenant();
         $user = User::factory()->create([
             'email' => 'scanner@example.com',
             'password' => Hash::make('correct-password'),
@@ -134,11 +190,7 @@ class ScannerLoginControllerTest extends TestCase
             'nombre' => 'Escanear tickets',
         ]);
         $role->permissions()->attach($permission->codigo);
-        $tenant = Tenant::query()->create([
-            'codigo' => 'acme',
-            'nombre' => 'Acme',
-            'dominio' => 'acme.test',
-        ]);
+        $tenant = $this->createTenant();
         $user = User::factory()->create([
             'email' => 'scanner@example.com',
             'password' => Hash::make('correct-password'),
@@ -163,4 +215,30 @@ class ScannerLoginControllerTest extends TestCase
                 && $event->channel === PasswordResetRequested::CHANNEL_SCANNER,
         );
     }
+
+    private function createTenant(): Tenant
+    {
+        $logo = Attachment::query()->create([
+            'key' => (string) Str::uuid(),
+            'path' => 'tests/scanner-login-logo.png',
+            'filename' => 'scanner-login-logo.png',
+            'type' => 'image',
+            'mime_type' => 'image/png',
+            'extension' => 'png',
+            'size' => 1,
+        ]);
+
+        return Tenant::query()->create([
+            'codigo' => 'acme',
+            'nombre' => 'Acme',
+            'dominio' => 'acme.test',
+            'primary_color' => '#000000',
+            'secondary_color' => '#000000',
+            'danger_color' => '#000000',
+            'header_bg_color' => '#000000',
+            'footer_bg_color' => '#000000',
+            'header_logo_id' => $logo->id,
+            'footer_logo_id' => $logo->id,
+        ]);
+    }
 }

tests/Feature/Auth/ScannerMeControllerTest.php

@@ -2,6 +2,7 @@
 
 namespace Tests\Feature\Auth;
 
+use App\Domains\Attachable\Models\Attachment;
 use App\Domains\Auth\Models\User;
 use App\Domains\Authorization\Enums\PermissionCode;
 use App\Domains\Authorization\Enums\RoleCode;
@@ -10,6 +11,7 @@ use App\Domains\Authorization\Models\Role;
 use App\Domains\Menu\Models\Menu;
 use App\Domains\Tenant\Models\Tenant;
 use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Support\Str;
 use Laravel\Sanctum\Sanctum;
 use Tests\TestCase;
 
@@ -28,11 +30,7 @@ class ScannerMeControllerTest extends TestCase
             'nombre' => 'Escanear tickets',
         ]);
         $scannerRole->permissions()->attach($permission->codigo);
-        $tenant = Tenant::query()->create([
-            'codigo' => 'acme',
-            'nombre' => 'Acme',
-            'dominio' => 'acme.test',
-        ]);
+        $tenant = $this->createTenant();
         $home = Menu::query()->create([
             'code' => 'scanner.inicio',
             'label' => 'Inicio',
@@ -65,4 +63,51 @@ class ScannerMeControllerTest extends TestCase
             ->assertJsonCount(2, 'data.tenant.menues')
             ->assertJsonMissing(['code' => $foreign->code]);
     }
+
+    public function test_it_rejects_an_adminapp_user_even_with_scan_permission(): void
+    {
+        $adminAppRole = Role::query()->create([
+            'codigo' => RoleCode::AdminApp->value,
+            'nombre' => 'Administrador',
+        ]);
+        $permission = Permission::query()->create([
+            'codigo' => PermissionCode::ScanTickets->value,
+            'nombre' => 'Escanear tickets',
+        ]);
+        $adminAppRole->permissions()->attach($permission->codigo);
+        $tenant = $this->createTenant();
+        $adminApp = User::factory()->create([
+            'rol_codigo' => $adminAppRole->codigo,
+            'tenant_codigo' => $tenant->codigo,
+        ]);
+        Sanctum::actingAs($adminApp);
+
+        $this->getJson('/api/v1/scanner/me')->assertForbidden();
+    }
+
+    private function createTenant(): Tenant
+    {
+        $logo = Attachment::query()->create([
+            'key' => (string) Str::uuid(),
+            'path' => 'tests/scanner-me-logo.png',
+            'filename' => 'scanner-me-logo.png',
+            'type' => 'image',
+            'mime_type' => 'image/png',
+            'extension' => 'png',
+            'size' => 1,
+        ]);
+
+        return Tenant::query()->create([
+            'codigo' => 'acme',
+            'nombre' => 'Acme',
+            'dominio' => 'acme.test',
+            'primary_color' => '#000000',
+            'secondary_color' => '#000000',
+            'danger_color' => '#000000',
+            'header_bg_color' => '#000000',
+            'footer_bg_color' => '#000000',
+            'header_logo_id' => $logo->id,
+            'footer_logo_id' => $logo->id,
+        ]);
+    }
 }

tests/Feature/Integration/ClientIntegrationControllerTest.php

@@ -2,11 +2,13 @@
 
 namespace Tests\Feature\Integration;
 
+use App\Domains\Auth\Models\User;
 use App\Domains\Client\Models\Client;
 use App\Domains\Integration\Models\ClientIntegration;
 use App\Domains\Integration\Models\Integration;
 use App\Domains\Integration\Services\ClientIntegrationService;
 use Illuminate\Foundation\Testing\RefreshDatabase;
+use Laravel\Sanctum\Sanctum;
 use Mockery;
 use Tests\TestCase;
 
@@ -16,6 +18,7 @@ class ClientIntegrationControllerTest extends TestCase
 
     public function test_store_returns_success_message_without_integration_data(): void
     {
+        Sanctum::actingAs(User::factory()->create(['rol_codigo' => 'admin']));
         $integration = Integration::create([
             'integration_code' => 'test_integration',
             'name' => 'Test Integration',
@@ -36,7 +39,7 @@ class ClientIntegrationControllerTest extends TestCase
                 ->andReturn(new ClientIntegration);
         });
 
-        $this->putJson('/api/clients/test-client/integrations/test_integration', [
+        $this->withHeader('Accept-Language', 'es')->putJson('/api/clients/test-client/integrations/test_integration', [
             'integration_data' => [
                 'api_key' => 'secret',
             ],

tests/Feature/Integration/IntegrationInstanceTest.php

@@ -0,0 +1,228 @@
+<?php
+
+namespace Tests\Feature\Integration;
+
+use App\Domains\Attachable\Enums\AttachmentType;
+use App\Domains\Attachable\Models\Attachment;
+use App\Domains\Auth\Models\User;
+use App\Domains\Client\Models\Client;
+use App\Domains\Integration\Models\Integration;
+use App\Domains\Integration\Models\IntegrationInstance;
+use App\Domains\Integration\Services\BaseIntegrationService;
+use App\Domains\Integration\Services\ClientIntegrationService;
+use App\Domains\Integration\Services\IntegrationAssociationService;
+use App\Domains\Integration\Services\IntegrationInstanceService;
+use App\Domains\Integration\Services\TelepagosIntegrationService;
+use App\Domains\Tenant\Models\Tenant;
+use App\Domains\Tenant\Models\WebsiteType;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Support\Facades\Cache;
+use Illuminate\Support\Facades\Http;
+use Laravel\Sanctum\Sanctum;
+use Tests\TestCase;
+
+class IntegrationInstanceTest extends TestCase
+{
+    use RefreshDatabase;
+
+    private Integration $integration;
+
+    protected function setUp(): void
+    {
+        parent::setUp();
+        config(['services.integrations.secret' => 'instance-test-secret']);
+        $this->integration = Integration::create([
+            'integration_code' => 'test', 'name' => 'Test', 'requires_configuration' => false,
+            'integration_data_schema' => ['api_key' => 'required|string'],
+        ]);
+    }
+
+    public function test_management_requires_an_authenticated_global_admin(): void
+    {
+        Client::create(['code' => 'acme', 'name' => 'Acme']);
+        WebsiteType::create(['codigo' => 'demo', 'nombre' => 'Demo']);
+
+        $this->getJson('/api/clients/acme/integrations')->assertUnauthorized();
+        Sanctum::actingAs(User::factory()->create());
+        $this->getJson('/api/clients/acme/integrations')->assertForbidden();
+        $this->getJson('/api/website-types/demo/integrations')->assertForbidden();
+    }
+
+    public function test_only_owner_endpoints_can_manage_configuration(): void
+    {
+        $this->admin();
+        $client = Client::create(['code' => 'acme', 'name' => 'Acme']);
+        $type = WebsiteType::create(['codigo' => 'demo', 'nombre' => 'Demo']);
+
+        $this->getJson('/api/integrations')->assertNotFound();
+        $this->getJson('/api/integration-instances')->assertNotFound();
+        $this->putJson('/api/clients/acme/integrations/test/instance', [])->assertNotFound();
+
+        $this->putJson('/api/clients/acme/integrations/test', ['integration_data' => []])
+            ->assertUnprocessable()->assertJsonValidationErrors('integration_data.api_key');
+        $this->putJson('/api/website-types/demo/integrations/test', ['integration_data' => []])
+            ->assertUnprocessable()->assertJsonValidationErrors('integration_data.api_key');
+
+        $this->putJson('/api/clients/acme/integrations/test', [
+            'integration_data' => ['api_key' => 'client-secret'],
+        ])->assertOk()->assertJsonMissingPath('integration_data');
+        $clientInstanceId = $client->integrations()->firstOrFail()->integration_instance_id;
+        self::assertSame('client-secret', IntegrationInstance::findOrFail($clientInstanceId)->integration_data['api_key']);
+
+        $this->putJson('/api/website-types/demo/integrations/test', [
+            'integration_data' => ['api_key' => 'type-secret'],
+        ])->assertCreated()
+            ->assertJsonPath('data.integration_instance.name', 'Test / Demo')
+            ->assertJsonMissingPath('data.integration_instance.integration_data');
+        $typeInstanceId = $type->integrations()->firstOrFail()->integration_instance_id;
+        $this->getJson('/api/website-types/demo/integrations/test')
+            ->assertOk()->assertJsonPath('data.integration_instance_id', $typeInstanceId);
+
+        $this->deleteJson('/api/clients/acme/integrations/test')->assertNoContent();
+        $this->deleteJson('/api/website-types/demo/integrations/test')->assertNoContent();
+    }
+
+    public function test_tenant_prefers_client_then_type_and_client_context_does_not_inherit(): void
+    {
+        $type = WebsiteType::create(['codigo' => 'demo', 'nombre' => 'Demo']);
+        $tenant = $this->tenantForType($type);
+        $associations = new IntegrationAssociationService;
+        $associations->associate($type, 'test', $this->makeInstance('type'));
+        $service = $this->probe();
+        self::assertSame('type', $service->forTenant($tenant->codigo)->setting());
+        self::assertNull($service->forClient($tenant->client)->setting());
+        $associations->associate($tenant->client, 'test', $this->makeInstance('client'));
+        self::assertSame('client', $service->forTenant($tenant->codigo)->setting());
+        $associations->detach($tenant->client, 'test');
+        self::assertSame('type', $service->forTenant($tenant->codigo)->setting());
+        $associations->detach($type, 'test');
+        self::assertNull($service->forTenant($tenant->codigo)->setting());
+        $this->integration->update(['requires_configuration' => true]);
+        $this->expectException(\Exception::class);
+        $service->forTenant($tenant->codigo);
+    }
+
+    public function test_required_configuration_can_come_from_the_website_type(): void
+    {
+        $this->integration->update(['requires_configuration' => true]);
+        $type = WebsiteType::create(['codigo' => 'demo', 'nombre' => 'Demo']);
+        $tenant = $this->tenantForType($type);
+        (new IntegrationAssociationService)->associate($type, 'test', $this->makeInstance('type'));
+        self::assertSame('type', $this->probe()->forTenant($tenant->codigo)->setting());
+    }
+
+    public function test_legacy_save_does_not_modify_a_shared_instance(): void
+    {
+        $a = Client::create(['code' => 'a', 'name' => 'A']);
+        $b = Client::create(['code' => 'b', 'name' => 'B']);
+        $shared = $this->makeInstance('shared');
+        $associations = new IntegrationAssociationService;
+        $associations->associate($a, 'test', $shared);
+        $associations->associate($b, 'test', $shared);
+        (new ClientIntegrationService)->updateOrCreateIntegration($a, $this->integration, ['api_key' => 'private']);
+        self::assertSame('private', $this->probe()->forClient($a)->setting());
+        self::assertSame('shared', $this->probe()->forClient($b)->setting());
+        (new IntegrationInstanceService)->update($shared, ['integration_data' => ['api_key' => 'changed']]);
+        self::assertSame('changed', $this->probe()->forClient($b)->setting());
+    }
+
+    public function test_reconfiguring_deletes_the_previous_instance_when_it_is_no_longer_used(): void
+    {
+        $client = Client::create(['code' => 'acme', 'name' => 'Acme']);
+        $associations = new IntegrationAssociationService;
+        $previous = $this->makeInstance('previous');
+
+        $associations->associate($client, 'test', $previous);
+        $current = $associations->configure($client, $this->integration, ['api_key' => 'current']);
+
+        $this->assertDatabaseMissing('integration_instances', ['id' => $previous->id]);
+        $this->assertDatabaseHas('integration_instances', ['id' => $current->integration_instance_id]);
+    }
+
+    public function test_an_instance_is_deleted_only_after_its_last_association_is_removed(): void
+    {
+        $client = Client::create(['code' => 'acme', 'name' => 'Acme']);
+        $type = WebsiteType::create(['codigo' => 'demo', 'nombre' => 'Demo']);
+        $shared = $this->makeInstance('shared');
+        $associations = new IntegrationAssociationService;
+
+        $associations->associate($client, 'test', $shared);
+        $associations->associate($type, 'test', $shared);
+
+        $associations->detach($client, 'test');
+        $this->assertDatabaseHas('integration_instances', ['id' => $shared->id]);
+
+        $associations->detach($type, 'test');
+        $this->assertDatabaseMissing('integration_instances', ['id' => $shared->id]);
+    }
+
+    public function test_telepagos_shares_tokens_by_instance_and_refreshes_after_credential_changes(): void
+    {
+        Integration::create(['integration_code' => 'telepagos_homo', 'name' => 'Telepagos', 'url' => 'https://payments.test']);
+        $instance = IntegrationInstance::create([
+            'integration_code' => 'telepagos_homo', 'name' => 'Payments',
+            'integration_data' => ['username' => 'first', 'password' => 'secret'],
+        ]);
+        $a = Client::create(['code' => 'a', 'name' => 'A']);
+        $b = Client::create(['code' => 'b', 'name' => 'B']);
+        $associations = new IntegrationAssociationService;
+        $associations->associate($a, 'telepagos_homo', $instance);
+        $associations->associate($b, 'telepagos_homo', $instance);
+        Cache::flush();
+        Http::fake(['https://payments.test/v2/auth/token' => Http::sequence()
+            ->push(['status' => 'ok', 'token' => 'first-token', 'expires_at' => now()->addHour()->toDateTimeString()])
+            ->push(['status' => 'ok', 'token' => 'new-token', 'expires_at' => now()->addHour()->toDateTimeString()])]);
+        self::assertSame('first-token', (new TelepagosIntegrationService('telepagos_homo'))->forClient($a)->getToken());
+        self::assertSame('first-token', (new TelepagosIntegrationService('telepagos_homo'))->forClient($b)->getToken());
+        Http::assertSentCount(1);
+        (new IntegrationInstanceService)->update($instance, ['integration_data' => ['username' => 'second', 'password' => 'new-secret']]);
+        self::assertSame('new-token', (new TelepagosIntegrationService('telepagos_homo'))->forClient($b)->getToken());
+        Http::assertSentCount(2);
+    }
+
+    private function tenantForType(WebsiteType $type): Tenant
+    {
+        $logo = Attachment::create([
+            'path' => 'tenants/logo.png', 'filename' => 'logo.png',
+            'type' => AttachmentType::Image,
+            'mime_type' => 'image/png',
+        ]);
+
+        return Tenant::create([
+            'codigo' => 'acme', 'nombre' => 'Acme', 'dominio' => 'acme.test',
+            'website_type_code' => $type->codigo,
+            'primary_color' => '#112233', 'secondary_color' => '#445566',
+            'danger_color' => '#ff0000', 'success_color' => '#00ff00',
+            'header_bg_color' => '#112233', 'footer_bg_color' => '#112233',
+            'header_logo_id' => $logo->id, 'footer_logo_id' => $logo->id,
+        ]);
+    }
+
+    private function makeInstance(string $name): IntegrationInstance
+    {
+        return IntegrationInstance::create(['integration_code' => 'test', 'name' => $name, 'integration_data' => ['api_key' => $name]]);
+    }
+
+    private function admin(): void
+    {
+        Sanctum::actingAs(User::factory()->create(['rol_codigo' => 'admin']));
+    }
+
+    private function probe(): BaseIntegrationService
+    {
+        return new class extends BaseIntegrationService
+        {
+            protected string $integrationCode = 'test';
+
+            public function getHeaders(): array
+            {
+                return [];
+            }
+
+            public function setting(): mixed
+            {
+                return $this->getIntegrationSetting('api_key');
+            }
+        };
+    }
+}

tests/Feature/Integration/IntegrationServiceTest.php

@@ -4,7 +4,6 @@ namespace Tests\Feature\Integration;
 
 use App\Domains\Attachable\Enums\AttachmentType;
 use App\Domains\Attachable\Models\Attachment;
-use App\Domains\Integration\Models\ClientIntegration;
 use App\Domains\Integration\Models\Integration;
 use App\Domains\Integration\Services\TelepagosIntegrationService;
 use App\Domains\Tenant\Models\Tenant;
@@ -15,10 +14,12 @@ use Illuminate\Support\Facades\Cache;
 use Illuminate\Support\Facades\Http;
 use Illuminate\Support\Facades\Log;
 use Illuminate\Support\Str;
+use Tests\Concerns\CreatesIntegrationInstances;
 use Tests\TestCase;
 
 class IntegrationServiceTest extends TestCase
 {
+    use CreatesIntegrationInstances;
     use RefreshDatabase;
 
     private Tenant $tenant;
@@ -110,7 +111,7 @@ class IntegrationServiceTest extends TestCase
             ],
         ]);
 
-        ClientIntegration::create([
+        $this->createClientIntegration([
             'client_id' => $this->tenant->client_id,
             'integration_code' => 'telepagos_homo',
             'integration_data' => [
@@ -139,7 +140,7 @@ class IntegrationServiceTest extends TestCase
             ],
         ]);
 
-        ClientIntegration::create([
+        $this->createClientIntegration([
             'client_id' => $this->tenant->client_id,
             'integration_code' => 'telepagos_homo',
             'integration_data' => [
@@ -198,7 +199,7 @@ class IntegrationServiceTest extends TestCase
             ],
         ]);
 
-        ClientIntegration::create([
+        $this->createClientIntegration([
             'client_id' => $this->tenant->client_id,
             'integration_code' => 'telepagos_homo',
             'integration_data' => [
@@ -242,7 +243,7 @@ class IntegrationServiceTest extends TestCase
             ],
         ]);
 
-        ClientIntegration::create([
+        $this->createClientIntegration([
             'client_id' => $this->tenant->client_id,
             'integration_code' => 'telepagos_homo',
             'integration_data' => [
@@ -272,7 +273,7 @@ class IntegrationServiceTest extends TestCase
             ],
         ]);
 
-        ClientIntegration::create([
+        $this->createClientIntegration([
             'client_id' => $this->tenant->client_id,
             'integration_code' => 'telepagos_homo',
             'integration_data' => [
@@ -323,7 +324,7 @@ class IntegrationServiceTest extends TestCase
             ],
         ]);
 
-        ClientIntegration::create([
+        $this->createClientIntegration([
             'client_id' => $this->tenant->client_id,
             'integration_code' => 'telepagos_homo',
             'integration_data' => [
@@ -375,7 +376,7 @@ class IntegrationServiceTest extends TestCase
             ],
         ]);
 
-        ClientIntegration::create([
+        $this->createClientIntegration([
             'client_id' => $this->tenant->client_id,
             'integration_code' => 'telepagos_homo',
             'integration_data' => [
@@ -427,7 +428,7 @@ class IntegrationServiceTest extends TestCase
             ],
         ]);
 
-        ClientIntegration::create([
+        $this->createClientIntegration([
             'client_id' => $this->tenant->client_id,
             'integration_code' => 'telepagos_homo',
             'integration_data' => [
@@ -480,7 +481,7 @@ class IntegrationServiceTest extends TestCase
             ],
         ]);
 
-        ClientIntegration::create([
+        $this->createClientIntegration([
             'client_id' => $this->tenant->client_id,
             'integration_code' => 'telepagos_homo',
             'integration_data' => [
@@ -541,7 +542,7 @@ class IntegrationServiceTest extends TestCase
             ],
         ]);
 
-        ClientIntegration::create([
+        $this->createClientIntegration([
             'client_id' => $this->tenant->client_id,
             'integration_code' => 'telepagos_homo',
             'integration_data' => [
@@ -566,7 +567,7 @@ class IntegrationServiceTest extends TestCase
         Log::shouldReceive('error')
             ->once()
             ->with('Telepagos get cash-in details failed: Cashin no encontrado', \Mockery::on(function ($context) {
-                return $context['cashin_id'] === 6351
+                return $context['cashin_id'] === '6351'
                     && $context['response_status'] === 404
                     && $context['response_body'] === ['status' => 'error', 'message' => 'Cashin no encontrado'];
             }));

tests/Feature/Integration/MailServiceTest.php

@@ -4,28 +4,32 @@ namespace Tests\Feature\Integration;
 
 use App\Domains\Attachable\Enums\AttachmentType;
 use App\Domains\Attachable\Models\Attachment;
-use App\Domains\Integration\Models\ClientIntegration;
 use App\Domains\Integration\Models\Integration;
+use App\Domains\Integration\Models\IntegrationInstance;
 use App\Domains\Integration\Services\ClientIntegrationService;
+use App\Domains\Integration\Services\IntegrationAssociationService;
 use App\Domains\Integration\Services\MailService;
 use App\Domains\Tenant\Models\Tenant;
+use App\Domains\Tenant\Models\WebsiteType;
 use Illuminate\Foundation\Testing\RefreshDatabase;
 use Illuminate\Mail\Mailable;
 use Illuminate\Mail\Mailer;
 use Illuminate\Mail\MailManager;
 use Illuminate\Support\Facades\Mail;
 use Mockery;
+use Tests\Concerns\CreatesIntegrationInstances;
 use Tests\TestCase;
 
 class MailServiceTest extends TestCase
 {
+    use CreatesIntegrationInstances;
     use RefreshDatabase;
 
     public function test_it_builds_an_isolated_smtp_mailer_from_the_client_integration(): void
     {
         $tenant = $this->createTenant();
         $this->createEmailIntegration();
-        ClientIntegration::create([
+        $this->createClientIntegration([
             'client_id' => $tenant->client_id,
             'integration_code' => 'email',
             'integration_data' => $this->emailData(),
@@ -40,7 +44,7 @@ class MailServiceTest extends TestCase
         $manager->shouldReceive('build')
             ->once()
             ->with(Mockery::on(fn (array $config): bool => $config === [
-                'name' => 'client-smtp-'.$tenant->client_id,
+                'name' => 'integration-smtp-'.IntegrationInstance::firstOrFail()->id,
                 'transport' => 'smtp',
                 'scheme' => 'smtp',
                 'host' => 'smtp.example.com',
@@ -54,7 +58,7 @@ class MailServiceTest extends TestCase
 
         $service = (new MailService($manager))->forTenant($tenant->codigo);
 
-        $this->assertSame('client-smtp', $service->mailerName());
+        $this->assertSame('integration-smtp', $service->mailerName());
     }
 
     public function test_it_uses_the_default_mailer_when_client_configuration_is_not_required(): void
@@ -65,7 +69,7 @@ class MailServiceTest extends TestCase
         Integration::create([
             'integration_code' => 'email',
             'name' => 'Email',
-            'requires_client_configuration' => false,
+            'requires_configuration' => false,
         ]);
 
         $service = (new MailService)->forTenant($tenant->codigo);
@@ -84,7 +88,7 @@ class MailServiceTest extends TestCase
         Mail::fake();
         $tenant = $this->createTenant();
         $this->createEmailIntegration();
-        ClientIntegration::create([
+        $this->createClientIntegration([
             'client_id' => $tenant->client_id,
             'integration_code' => 'email',
             'integration_data' => $this->emailData(),
@@ -118,6 +122,24 @@ class MailServiceTest extends TestCase
         Mail::assertSent(Mailable::class, 1);
     }
 
+    public function test_it_uses_the_website_type_smtp_instance_without_a_client_association(): void
+    {
+        Mail::fake();
+        $tenant = $this->createTenant();
+        $this->createEmailIntegration();
+        $type = WebsiteType::create(['codigo' => 'mail-brand', 'nombre' => 'Mail Brand']);
+        $tenant->update(['website_type_code' => $type->codigo]);
+        $instance = IntegrationInstance::create([
+            'integration_code' => 'email', 'name' => 'Brand SMTP', 'integration_data' => $this->emailData(),
+        ]);
+        (new IntegrationAssociationService)->associate($type, 'email', $instance);
+
+        $service = (new MailService)->forTenant($tenant->codigo);
+        self::assertSame('integration-smtp', $service->mailerName());
+        $service->send('customer@example.com', 'Brand mail', '<p>Brand SMTP</p>');
+        Mail::assertSent(Mailable::class, 1);
+    }
+
     private function createTenant(): Tenant
     {
         $logo = Attachment::create([

tests/Feature/Integration/TelepagosWebhookTest.php

@@ -11,7 +11,6 @@ use App\Domains\Catalog\Models\CatalogItem;
 use App\Domains\Catalog\Models\Category;
 use App\Domains\Catalog\Models\Inventory;
 use App\Domains\Catalog\Models\Variant;
-use App\Domains\Integration\Models\ClientIntegration;
 use App\Domains\Integration\Models\Integration;
 use App\Domains\Purchase\Models\Purchase;
 use App\Domains\Purchase\Models\TelepagosPayment;
@@ -22,10 +21,12 @@ use Illuminate\Support\Facades\Cache;
 use Illuminate\Support\Facades\Http;
 use Illuminate\Support\Facades\Queue;
 use Illuminate\Support\Str;
+use Tests\Concerns\CreatesIntegrationInstances;
 use Tests\TestCase;
 
 class TelepagosWebhookTest extends TestCase
 {
+    use CreatesIntegrationInstances;
     use RefreshDatabase;
 
     protected function setUp(): void
@@ -633,7 +634,7 @@ class TelepagosWebhookTest extends TestCase
             ],
         ]);
 
-        ClientIntegration::create([
+        $this->createClientIntegration([
             'client_id' => $tenant->client_id,
             'integration_code' => 'telepagos_homo',
             'integration_data' => [

tests/Feature/MailTest/MailTestControllerTest.php

@@ -4,17 +4,18 @@ namespace Tests\Feature\MailTest;
 
 use App\Domains\Attachable\Enums\AttachmentType;
 use App\Domains\Attachable\Models\Attachment;
-use App\Domains\Integration\Models\ClientIntegration;
 use App\Domains\Integration\Models\Integration;
 use App\Domains\MailTest\Mailables\TestMail;
 use App\Domains\Tenant\Models\Tenant;
 use Illuminate\Foundation\Testing\RefreshDatabase;
 use Illuminate\Mail\Mailable;
 use Illuminate\Support\Facades\Mail;
+use Tests\Concerns\CreatesIntegrationInstances;
 use Tests\TestCase;
 
 class MailTestControllerTest extends TestCase
 {
+    use CreatesIntegrationInstances;
     use RefreshDatabase;
 
     public function test_it_sends_a_test_email(): void
@@ -22,7 +23,7 @@ class MailTestControllerTest extends TestCase
         Mail::fake();
         $tenant = $this->createTenant();
 
-        $response = $this->postJson('/api/acme/mail-test/send', [
+        $response = $this->withHeader('Accept-Language', 'es')->postJson('/api/acme/mail-test/send', [
             'to' => 'recipient@example.com',
             'subject' => 'SMTP test',
             'message' => 'Test message',
@@ -32,7 +33,7 @@ class MailTestControllerTest extends TestCase
             ->assertJsonPath('message', 'Correo de prueba enviado correctamente.')
             ->assertJsonPath('recipient', 'recipient@example.com')
             ->assertJsonPath('tenant_code', 'acme')
-            ->assertJsonPath('mailer', 'tenant-smtp')
+            ->assertJsonPath('mailer', 'integration-smtp')
             ->assertJsonStructure(['sent_at']);
 
         Mail::assertSent(Mailable::class, function (Mailable $mail) use ($tenant): bool {
@@ -48,7 +49,7 @@ class MailTestControllerTest extends TestCase
         Mail::fake();
         $this->createTenant();
 
-        $this->postJson('/api/acme/mail-test/send', [
+        $this->withHeader('Accept-Language', 'es')->postJson('/api/acme/mail-test/send', [
             'to' => 'recipient@example.com',
         ])->assertOk();
 
@@ -63,7 +64,7 @@ class MailTestControllerTest extends TestCase
         Mail::fake();
         $this->createTenant();
 
-        $this->postJson('/api/acme/mail-test/send', [
+        $this->withHeader('Accept-Language', 'es')->postJson('/api/acme/mail-test/send', [
             'to' => 'invalid-email',
         ])->assertUnprocessable()
             ->assertJsonValidationErrors(['to']);
@@ -117,7 +118,7 @@ class MailTestControllerTest extends TestCase
     {
         Mail::fake();
 
-        $this->postJson('/api/unknown/mail-test/send', [
+        $this->withHeader('Accept-Language', 'es')->postJson('/api/unknown/mail-test/send', [
             'to' => 'recipient@example.com',
         ])->assertNotFound();
 
@@ -129,7 +130,7 @@ class MailTestControllerTest extends TestCase
         Mail::fake();
         $tenant = $this->createTenant();
 
-        $this->postJson("/api/{$tenant->id}/mail-test/send", [
+        $this->withHeader('Accept-Language', 'es')->postJson("/api/{$tenant->id}/mail-test/send", [
             'to' => 'recipient@example.com',
         ])->assertNotFound();
 
@@ -171,7 +172,7 @@ class MailTestControllerTest extends TestCase
             'integration_code' => 'email',
             'name' => 'Email',
         ]);
-        ClientIntegration::create([
+        $this->createClientIntegration([
             'client_id' => $tenant->client_id,
             'integration_code' => 'email',
             'integration_data' => [

tests/Feature/Notification/NotificationMailServiceTest.php

@@ -4,6 +4,7 @@ namespace Tests\Feature\Notification;
 
 use App\Domains\Attachable\Enums\AttachmentType;
 use App\Domains\Attachable\Models\Attachment;
+use App\Domains\Auth\Models\ResetPasswordAttempt;
 use App\Domains\Auth\Models\User;
 use App\Domains\Catalog\Models\CatalogItem;
 use App\Domains\Integration\Models\Integration;
@@ -35,7 +36,7 @@ class NotificationMailServiceTest extends TestCase
             'integration_code' => 'email',
             'name' => 'Email',
             'url' => null,
-            'requires_client_configuration' => false,
+            'requires_configuration' => false,
             'integration_data_schema' => [],
         ]);
         $header = Attachment::query()->create([
@@ -133,15 +134,64 @@ class NotificationMailServiceTest extends TestCase
         );
 
         Mail::assertSent(Mailable::class, function (Mailable $mail): bool {
+            $mail->assertHasSubject('Tu cuenta de escáner está lista - Scanner Mail');
             $rendered = $mail->render();
 
             return str_contains($rendered, 'https://scanner.mail.local/recuperar-contrasena/codigo')
+                && str_contains($rendered, 'Tu cuenta de escáner está lista')
+                && str_contains($rendered, 'comenzar a escanear entradas')
+                && ! str_contains($rendered, 'Recuperá tu contraseña')
                 && str_contains($rendered, 'email=ada%40example.com')
                 && str_contains($rendered, 'code=0123')
                 && str_contains($rendered, 'Crear mi');
         });
     }
 
+    public function test_administrator_creation_has_custom_copy_and_the_existing_code_and_link(): void
+    {
+        $websiteType = WebsiteType::query()->create([
+            'codigo' => 'admin-mail', 'nombre' => 'Admin Mail',
+            'dominio' => 'admin.mail.local', 'scanner_domain' => 'scanner.mail.local',
+        ]);
+        $this->tenant->update(['website_type_code' => $websiteType->codigo]);
+        $attempt = $this->user->resetPasswordAttempts()->create([
+            'codigo' => '0456', 'reason' => ResetPasswordAttempt::REASON_ADMINISTRATOR_CREATED,
+        ]);
+        app(NotificationMailService::class)->sendPasswordResetCode($attempt->id, $this->tenant->codigo, PasswordResetRequested::CHANNEL_ADMINAPP);
+        Mail::assertSent(Mailable::class, function (Mailable $mail): bool {
+            $mail->assertHasSubject('Tu cuenta de administrador está lista - Admin Mail');
+            $html = $mail->render();
+
+            return str_contains($html, 'Tu cuenta de administrador está lista')
+                && str_contains($html, 'ingresar al panel de administración')
+                && str_contains($html, '0456')
+                && str_contains($html, 'Crear mi contraseña')
+                && str_contains($html, 'https://admin.mail.local/recuperar-contrasena/codigo?email=ada%40example.com')
+                && ! str_contains($html, 'scanner.mail.local')
+                && ! str_contains($html, 'administrator_created')
+                && ! str_contains($html, 'Recuperá tu contraseña');
+        });
+    }
+
+    public function test_locked_account_has_its_own_copy_and_the_shared_code_action(): void
+    {
+        $attempt = $this->user->resetPasswordAttempts()->create([
+            'codigo' => '0789', 'reason' => ResetPasswordAttempt::REASON_ACCOUNT_LOCKED,
+        ]);
+        app(NotificationMailService::class)->sendPasswordResetCode($attempt->id, $this->tenant->codigo);
+        Mail::assertSent(Mailable::class, function (Mailable $mail): bool {
+            $mail->assertHasSubject('Desbloqueá tu cuenta - Mail Tenant');
+            $html = $mail->render();
+
+            return str_contains($html, 'Desbloqueá tu cuenta')
+                && str_contains($html, 'bloqueamos el acceso temporalmente')
+                && str_contains($html, '0789')
+                && str_contains($html, 'Ingresar código ahora')
+                && str_contains($html, 'https://mail.local/recuperar-contrasena/codigo')
+                && ! str_contains($html, 'account_locked');
+        });
+    }
+
     public function test_it_sends_one_purchase_confirmation_with_generated_tickets_attached(): void
     {
         $this->useWebsiteTypeBranding();

tests/Feature/Seeders/AuthorizationSeederTest.php

@@ -27,7 +27,7 @@ class AuthorizationSeederTest extends TestCase
             ],
             Role::query()->orderBy('codigo')->pluck('codigo')->all()
         );
-        $this->assertCount(22, Permission::query()->get());
+        $this->assertCount(23, Permission::query()->get());
     }
 
     public function test_it_assigns_the_expected_permissions_to_each_role(): void
@@ -39,7 +39,7 @@ class AuthorizationSeederTest extends TestCase
         $scanner = Role::query()->where('codigo', RoleCode::Scanner->value)->firstOrFail();
         $user = Role::query()->where('codigo', RoleCode::User->value)->firstOrFail();
 
-        $this->assertCount(22, $admin->permissions);
+        $this->assertCount(23, $admin->permissions);
         $this->assertCount(0, $appAdmin->permissions);
         $this->assertSame(
             [PermissionCode::ScanTickets->value],
@@ -54,7 +54,7 @@ class AuthorizationSeederTest extends TestCase
         $this->seed(AuthorizationSeeder::class);
 
         $this->assertCount(4, Role::query()->get());
-        $this->assertCount(22, Permission::query()->get());
-        $this->assertDatabaseCount('roles_permisos', 23);
+        $this->assertCount(23, Permission::query()->get());
+        $this->assertDatabaseCount('roles_permisos', 24);
     }
 }

tests/Feature/Staff/StaffControllerTest.php

@@ -2,6 +2,8 @@
 
 namespace Tests\Feature\Staff;
 
+use App\Domains\Attachable\Enums\AttachmentType;
+use App\Domains\Attachable\Models\Attachment;
 use App\Domains\Auth\Models\ResetPasswordAttempt;
 use App\Domains\Auth\Models\User;
 use App\Domains\Authorization\Enums\RoleCode;
@@ -9,9 +11,11 @@ use App\Domains\Catalog\Models\Category;
 use App\Domains\Notification\Events\PasswordResetRequested;
 use App\Domains\Tenant\Models\Tenant;
 use App\Domains\Tenant\Models\WebsiteType;
+use App\Domains\Ticket\Models\Ticket;
 use Database\Seeders\AuthorizationSeeder;
 use Illuminate\Foundation\Testing\RefreshDatabase;
 use Illuminate\Support\Facades\Event;
+use Illuminate\Support\Str;
 use Laravel\Sanctum\Sanctum;
 use Tests\TestCase;
 
@@ -30,11 +34,21 @@ class StaffControllerTest extends TestCase
         Event::fake([PasswordResetRequested::class]);
         $this->seed(AuthorizationSeeder::class);
         WebsiteType::query()->create(['codigo' => 'onticket', 'nombre' => 'OnTicket']);
+        $headerLogo = $this->createAttachment('header.png');
+        $footerLogo = $this->createAttachment('footer.png');
         $this->tenant = Tenant::query()->create([
             'codigo' => 'acme',
             'nombre' => 'Acme',
             'dominio' => 'acme.test',
             'website_type_code' => 'onticket',
+            'primary_color' => '#111111',
+            'secondary_color' => '#222222',
+            'danger_color' => '#cc0000',
+            'success_color' => '#008800',
+            'header_bg_color' => '#ffffff',
+            'footer_bg_color' => '#ffffff',
+            'header_logo_id' => $headerLogo->id,
+            'footer_logo_id' => $footerLogo->id,
         ]);
         $this->admin = User::factory()->create([
             'rol_codigo' => RoleCode::AdminApp->value,
@@ -42,6 +56,17 @@ class StaffControllerTest extends TestCase
         ]);
     }
 
+    public function test_staff_email_can_be_shared_with_adminapp_and_customers(): void
+    {
+        Sanctum::actingAs($this->admin);
+        User::factory()->create(['email' => $this->admin->email]);
+        $payload = ['nombre_apellido' => 'Shared', 'dni' => '12345678',
+            'email' => strtoupper($this->admin->email), 'category_ids' => [$this->createCategory('Tickets')->id]];
+        $response = $this->postJson('/api/v1/adminapp/tenant/staff', $payload)->assertSuccessful();
+        $this->putJson('/api/v1/adminapp/tenant/staff/'.$response->json('data.id'), $payload)->assertOk();
+        $this->postJson('/api/v1/adminapp/tenant/staff', $payload)->assertUnprocessable()->assertJsonValidationErrors('email');
+    }
+
     public function test_adminapp_can_create_update_list_and_delete_staff_with_categories(): void
     {
         Sanctum::actingAs($this->admin);
@@ -92,8 +117,56 @@ class StaffControllerTest extends TestCase
             'categoria_id' => $firstCategory->id,
         ]);
 
+        $ticket = Ticket::query()->create([
+            'tenant_code' => $this->tenant->codigo,
+            'ticket' => (string) Str::uuid(),
+            'user_id' => $this->admin->id,
+            'used_at' => now(),
+            'scanner_user_id' => $staffId,
+        ]);
+        $accessTokenId = User::query()
+            ->findOrFail($staffId)
+            ->createToken('scanner', ['scanner'])
+            ->accessToken
+            ->getKey();
+
         $this->deleteJson("/api/v1/adminapp/tenant/staff/{$staffId}")->assertNoContent();
-        $this->assertDatabaseMissing('users', ['id' => $staffId]);
+        $this->assertSoftDeleted('users', ['id' => $staffId]);
+        $this->assertDatabaseHas('users', [
+            'id' => $staffId,
+            'email' => 'ada@example.test',
+            'active_email' => null,
+        ]);
+        $this->assertDatabaseMissing('personal_access_tokens', ['id' => $accessTokenId]);
+        $this->assertDatabaseHas('category_scanners', [
+            'user_id' => $staffId,
+            'categoria_id' => $secondCategory->id,
+        ]);
+        $this->assertSame($staffId, $ticket->fresh()->scanner_user_id);
+        $this->assertSame('Ada Byron', $ticket->fresh()->scannerUser?->nombre_apellido);
+
+        $this->getJson('/api/v1/adminapp/tenant/staff')
+            ->assertOk()
+            ->assertJsonCount(0, 'data');
+
+        $replacementResponse = $this->postJson('/api/v1/adminapp/tenant/staff', [
+            'nombre_apellido' => 'Nueva Ada',
+            'dni' => '11223344',
+            'email' => 'ADA@example.test',
+            'category_ids' => [$firstCategory->id],
+        ])->assertSuccessful()
+            ->assertJsonPath('data.email', 'ada@example.test');
+
+        $replacementStaffId = $replacementResponse->json('data.id');
+        $this->assertNotSame($staffId, $replacementStaffId);
+        $this->assertSame('Ada Byron', $ticket->fresh()->scannerUser?->nombre_apellido);
+        $this->assertDatabaseHas('users', [
+            'id' => $replacementStaffId,
+            'email' => 'ada@example.test',
+            'active_email' => 'ada@example.test',
+            'deleted_at' => null,
+        ]);
+
     }
 
     public function test_admin_cannot_assign_another_tenants_category(): void
@@ -104,6 +177,14 @@ class StaffControllerTest extends TestCase
             'nombre' => 'Other',
             'dominio' => 'other.test',
             'website_type_code' => 'onticket',
+            'primary_color' => '#111111',
+            'secondary_color' => '#222222',
+            'danger_color' => '#cc0000',
+            'success_color' => '#008800',
+            'header_bg_color' => '#ffffff',
+            'footer_bg_color' => '#ffffff',
+            'header_logo_id' => $this->tenant->header_logo_id,
+            'footer_logo_id' => $this->tenant->footer_logo_id,
         ]);
         $foreignCategory = Category::query()->create([
             'tenant_code' => $otherTenant->codigo,
@@ -183,6 +264,16 @@ class StaffControllerTest extends TestCase
         $this->getJson('/api/v1/adminapp/tenant/staff')->assertForbidden();
     }
 
+    private function createAttachment(string $filename): Attachment
+    {
+        return Attachment::query()->create([
+            'path' => "test/{$filename}",
+            'filename' => $filename,
+            'type' => AttachmentType::Image,
+            'mime_type' => 'image/png',
+        ]);
+    }
+
     private function createCategory(string $name): Category
     {
         return Category::query()->create([

tests/Feature/Tenant/BootstrapTenantControllerTest.php

@@ -128,6 +128,16 @@ class BootstrapTenantControllerTest extends TestCase
         $this->assertArrayNotHasKey('props', $response->json('data'));
     }
 
+    public function test_it_returns_the_configured_asset_url_in_the_bootstrap(): void
+    {
+        config()->set('filesystems.disks.s3.url', 'https://s3.shopit.com.ar/shopit-local');
+        $this->createTenant();
+
+        $this->getJson('/api/tenants/bootstrap?dominio=acme.com&path=%2F')
+            ->assertOk()
+            ->assertJsonPath('data.asset_url', 'https://s3.shopit.com.ar/shopit-local');
+    }
+
     public function test_it_bootstraps_a_tenant_from_a_full_url(): void
     {
         $this->createTenant([

tests/Feature/Ticket/PrepareLoadTestTicketsCommandTest.php

@@ -0,0 +1,107 @@
+<?php
+
+namespace Tests\Feature\Ticket;
+
+use App\Domains\Attachable\Models\Attachment;
+use App\Domains\Catalog\Models\CatalogItem;
+use App\Domains\Catalog\Models\Category;
+use App\Domains\Tenant\Models\Tenant;
+use App\Domains\Tenant\Models\WebsiteType;
+use App\Domains\Ticket\Models\Ticket;
+use Database\Seeders\AuthorizationSeeder;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Support\Facades\Artisan;
+use Illuminate\Support\Facades\Storage;
+use Illuminate\Support\Str;
+use Tests\TestCase;
+
+class PrepareLoadTestTicketsCommandTest extends TestCase
+{
+    use RefreshDatabase;
+
+    public function test_it_generates_a_postman_dataset_that_can_scan_the_tickets(): void
+    {
+        Storage::fake('local');
+        $this->seed(AuthorizationSeeder::class);
+        WebsiteType::query()->create(['codigo' => 'onticket', 'nombre' => 'OnTicket']);
+        $tenant = $this->createTenant('acme');
+        $category = Category::query()->create([
+            'tenant_code' => $tenant->codigo,
+            'nombre' => 'Entradas de carga',
+        ]);
+        $catalogItem = CatalogItem::query()->create([
+            'tenant_code' => $tenant->codigo,
+            'category_id' => $category->id,
+            'slug' => 'entrada-load-test',
+            'nombre' => 'Entrada load test',
+            'descripcion' => 'Ticket descartable',
+            'precio' => 100,
+            'has_tickets' => true,
+        ]);
+
+        $exitCode = Artisan::call('load-test:tickets:prepare', [
+            'tenant' => $tenant->codigo,
+            '--tickets' => 4,
+            '--scanners' => 2,
+            '--owners' => 2,
+            '--catalog-item' => $catalogItem->id,
+            '--run' => 'test-run',
+            '--output' => 'load-tests/test-run.postman.json',
+        ]);
+
+        $this->assertSame(0, $exitCode, Artisan::output());
+
+        Storage::disk('local')->assertExists('load-tests/test-run.postman.json');
+        $rows = json_decode(
+            Storage::disk('local')->get('load-tests/test-run.postman.json'),
+            true,
+            flags: JSON_THROW_ON_ERROR,
+        );
+
+        $this->assertCount(4, $rows);
+        $this->assertCount(4, collect($rows)->pluck('ticket_uuid')->unique());
+        $this->assertCount(2, collect($rows)->pluck('scanner_token')->unique());
+        $this->assertSame([200], collect($rows)->pluck('expected_status')->unique()->values()->all());
+        $this->assertDatabaseCount('tickets', 4);
+        $this->assertCount(2, Ticket::query()->distinct()->pluck('user_id'));
+        $this->assertDatabaseCount('category_scanners', 2);
+
+        $first = $rows[0];
+        $this->withToken($first['scanner_token'])
+            ->postJson("/api/v1/scanner/tickets/{$first['ticket_uuid']}/scan")
+            ->assertOk()
+            ->assertJsonPath('data.ticket', $first['ticket_uuid']);
+
+        $this->assertNotNull(
+            Ticket::query()->where('ticket', $first['ticket_uuid'])->firstOrFail()->used_at
+        );
+    }
+
+    private function createTenant(string $code): Tenant
+    {
+        $logo = Attachment::query()->create([
+            'key' => (string) Str::uuid(),
+            'path' => "tests/{$code}-logo.png",
+            'filename' => "{$code}-logo.png",
+            'type' => 'image',
+            'mime_type' => 'image/png',
+            'extension' => 'png',
+            'size' => 1,
+        ]);
+
+        return Tenant::query()->create([
+            'codigo' => $code,
+            'nombre' => ucfirst($code),
+            'dominio' => "{$code}.test",
+            'primary_color' => '#ff7006',
+            'secondary_color' => '#777777',
+            'danger_color' => '#e04a4a',
+            'success_color' => '#81bc73',
+            'header_bg_color' => '#313131',
+            'footer_bg_color' => '#313131',
+            'header_logo_id' => $logo->id,
+            'footer_logo_id' => $logo->id,
+            'website_type_code' => 'onticket',
+        ]);
+    }
+}

tests/Feature/Ticket/ScannerTicketControllerTest.php

@@ -4,6 +4,7 @@ namespace Tests\Feature\Ticket;
 
 use App\Domains\Attachable\Models\Attachment;
 use App\Domains\Auth\Models\User;
+use App\Domains\Authorization\Enums\PermissionCode;
 use App\Domains\Authorization\Enums\RoleCode;
 use App\Domains\Catalog\Models\CatalogItem;
 use App\Domains\Catalog\Models\Category;
@@ -52,7 +53,7 @@ class ScannerTicketControllerTest extends TestCase
         $this->getJson('/api/v1/scanner/tickets')->assertUnauthorized();
 
         Sanctum::actingAs(User::factory()->create([
-            'rol_codigo' => RoleCode::AdminApp->value,
+            'rol_codigo' => RoleCode::User->value,
             'tenant_codigo' => $this->tenant->codigo,
         ]));
 
@@ -300,6 +301,22 @@ class ScannerTicketControllerTest extends TestCase
             ->assertNotFound();
     }
 
+    public function test_adminapp_cannot_access_scanner_routes_even_with_scan_permission(): void
+    {
+        $admin = User::factory()->create([
+            'rol_codigo' => RoleCode::AdminApp->value,
+            'tenant_codigo' => $this->tenant->codigo,
+        ]);
+        $admin->role()->firstOrFail()->permissions()->attach(PermissionCode::ScanTickets->value);
+        $ticket = $this->createTicket((string) Str::uuid());
+        Sanctum::actingAs($admin);
+
+        $this->getJson('/api/v1/scanner/tickets')->assertForbidden();
+        $this->getJson("/api/v1/scanner/tickets/{$ticket->ticket}")->assertForbidden();
+        $this->postJson("/api/v1/scanner/tickets/{$ticket->ticket}/scan")->assertForbidden();
+        $this->assertNull($ticket->fresh()->used_at);
+    }
+
     /** @param array<string, mixed> $attributes */
     private function createTicket(
         string $uuid,

tests/Unit/IntegrationInstanceSchemaTest.php

@@ -0,0 +1,173 @@
+<?php
+
+namespace Tests\Unit;
+
+use App\Domains\Integration\Models\ClientIntegration;
+use App\Domains\Integration\Models\Integration;
+use App\Domains\Integration\Models\IntegrationInstance;
+use App\Domains\Integration\Models\WebsiteTypeIntegration;
+use App\Domains\Tenant\Models\WebsiteType;
+use Illuminate\Config\Repository;
+use Illuminate\Container\Container;
+use Illuminate\Database\Capsule\Manager;
+use Illuminate\Database\QueryException;
+use Illuminate\Database\Schema\Blueprint;
+use Illuminate\Support\Facades\Facade;
+use PHPUnit\Framework\TestCase;
+
+class IntegrationInstanceSchemaTest extends TestCase
+{
+    private Manager $database;
+
+    private array $migrations;
+
+    private mixed $previousFacadeApplication;
+
+    private Container $previousContainer;
+
+    protected function setUp(): void
+    {
+        parent::setUp();
+        $this->previousFacadeApplication = Facade::getFacadeApplication();
+        $this->previousContainer = Container::getInstance();
+        $container = new Container;
+        Container::setInstance($container);
+        $container->instance('config', new Repository([
+            'services' => ['integrations' => ['secret' => 'schema-test-secret']],
+            'app' => ['cipher' => 'AES-256-CBC'],
+        ]));
+        $this->database = new Manager($container);
+        $this->database->addConnection(['driver' => 'sqlite', 'database' => ':memory:', 'foreign_key_constraints' => true]);
+        $this->database->bootEloquent();
+        $container->instance('db', $this->database->getDatabaseManager());
+        $container->bind('db.schema', fn () => $this->database->getConnection()->getSchemaBuilder());
+        Facade::clearResolvedInstances();
+        Facade::setFacadeApplication($container);
+
+        $schema = $this->database->getConnection()->getSchemaBuilder();
+        $schema->create('clients', function (Blueprint $table): void {
+            $table->id();
+        });
+        $schema->create('website_type', function (Blueprint $table): void {
+            $table->id();
+            $table->string('codigo')->unique();
+        });
+        (require __DIR__.'/../../database/migrations/2026_07_03_000001_create_integrations_table.php')->up();
+        $schema->table('integrations', function (Blueprint $table): void {
+            $table->boolean('requires_client_configuration')->default(true);
+        });
+        $schema->create('client_integrations', function (Blueprint $table): void {
+            $table->id();
+            $table->foreignId('client_id')->constrained('clients')->cascadeOnDelete();
+            $table->string('integration_code');
+            $table->longText('integration_data')->nullable();
+            $table->timestamps();
+            $table->foreign('integration_code')->references('integration_code')->on('integrations')->cascadeOnDelete();
+            $table->unique(['client_id', 'integration_code']);
+        });
+        $db = $this->database->getConnection();
+        $db->table('clients')->insert(['id' => 1]);
+        $db->table('website_type')->insert(['codigo' => 'onticket']);
+        $db->table('integrations')->insert([
+            ['integration_code' => 'email', 'name' => 'Email'],
+            ['integration_code' => 'telepagos', 'name' => 'Telepagos'],
+        ]);
+        $db->table('client_integrations')->insert([
+            'client_id' => 1, 'integration_code' => 'email', 'integration_data' => 'existing-ciphertext',
+        ]);
+        $this->migrations = array_map(fn (string $file) => require $file, glob(__DIR__.'/../../database/migrations/2026_09_04_*.php'));
+        foreach ($this->migrations as $migration) {
+            $migration->up();
+        }
+    }
+
+    protected function tearDown(): void
+    {
+        $this->database->getConnection()->disconnect();
+        Facade::clearResolvedInstances();
+        Facade::setFacadeApplication($this->previousFacadeApplication);
+        Container::setInstance($this->previousContainer);
+        parent::tearDown();
+    }
+
+    public function test_migration_preserves_ciphertext_and_rollback_restores_it(): void
+    {
+        $db = $this->database->getConnection();
+        $association = $db->table('client_integrations')->first();
+        self::assertSame('existing-ciphertext', $db->table('integration_instances')->where('id', $association->integration_instance_id)->value('integration_data'));
+        self::assertFalse($db->getSchemaBuilder()->hasColumn('client_integrations', 'integration_data'));
+
+        foreach (array_reverse($this->migrations) as $migration) {
+            $migration->down();
+        }
+        self::assertSame('existing-ciphertext', $db->table('client_integrations')->value('integration_data'));
+        self::assertFalse($db->getSchemaBuilder()->hasTable('integration_instances'));
+    }
+
+    public function test_instances_encrypt_data_and_can_be_shared_through_relations(): void
+    {
+        $instance = IntegrationInstance::firstOrFail();
+        $instance->update(['integration_data' => ['password' => 'private-value']]);
+        self::assertNotSame('private-value', $instance->getRawOriginal('integration_data'));
+        self::assertSame(['password' => 'private-value'], $instance->fresh()->integration_data);
+        self::assertArrayNotHasKey('integration_data', $instance->toArray());
+        WebsiteTypeIntegration::create([
+            'website_type_code' => 'onticket', 'integration_code' => 'email', 'integration_instance_id' => $instance->id,
+        ]);
+        self::assertTrue(ClientIntegration::firstOrFail()->integrationInstance->is($instance));
+        self::assertTrue(WebsiteType::firstOrFail()->integrations->first()->integrationInstance->is($instance));
+        self::assertSame(1, $instance->clientIntegrations()->count());
+        self::assertSame(1, $instance->websiteTypeIntegrations()->count());
+        self::assertTrue(Integration::where('integration_code', 'email')->firstOrFail()->instances->first()->is($instance));
+    }
+
+    public function test_retry_after_foreign_key_failure_preserves_existing_instances(): void
+    {
+        $db = $this->database->getConnection();
+        $instanceId = $db->table('client_integrations')->value('integration_instance_id');
+        // Reproduce the state left by MySQL when ADD CONSTRAINT fails after the backfill.
+        $db->getSchemaBuilder()->table('client_integrations', function (Blueprint $table): void {
+            $table->dropForeign('client_integrations_instance_code_fk')
+                ->columns(['integration_instance_id', 'integration_code']);
+            $table->longText('integration_data')->nullable();
+        });
+        $db->table('client_integrations')->update(['integration_data' => 'existing-ciphertext']);
+
+        $this->migrations[1]->up();
+        $this->migrations[1]->up();
+
+        self::assertSame(1, $db->table('integration_instances')->count());
+        self::assertSame($instanceId, $db->table('client_integrations')->value('integration_instance_id'));
+        self::assertSame('existing-ciphertext', $db->table('integration_instances')->value('integration_data'));
+        self::assertFalse($db->getSchemaBuilder()->hasColumn('client_integrations', 'integration_data'));
+        $keys = $db->getSchemaBuilder()->getForeignKeys('client_integrations');
+        self::assertCount(1, array_filter($keys, fn (array $key): bool => $key['columns'] === ['integration_instance_id', 'integration_code']));
+    }
+
+    public function test_association_rejects_an_instance_from_another_integration(): void
+    {
+        $this->expectException(QueryException::class);
+        WebsiteTypeIntegration::create([
+            'website_type_code' => 'onticket', 'integration_code' => 'telepagos', 'integration_instance_id' => IntegrationInstance::firstOrFail()->id,
+        ]);
+    }
+
+    public function test_client_cannot_have_two_instances_of_the_same_integration(): void
+    {
+        $instance = IntegrationInstance::create(['integration_code' => 'email', 'name' => 'Second']);
+        $this->expectException(QueryException::class);
+        ClientIntegration::create(['client_id' => 1, 'integration_code' => 'email', 'integration_instance_id' => $instance->id]);
+    }
+
+    public function test_website_type_cannot_have_two_instances_of_the_same_integration(): void
+    {
+        WebsiteTypeIntegration::create([
+            'website_type_code' => 'onticket', 'integration_code' => 'email', 'integration_instance_id' => IntegrationInstance::firstOrFail()->id,
+        ]);
+        $instance = IntegrationInstance::create(['integration_code' => 'email', 'name' => 'Second']);
+        $this->expectException(QueryException::class);
+        WebsiteTypeIntegration::create([
+            'website_type_code' => 'onticket', 'integration_code' => 'email', 'integration_instance_id' => $instance->id,
+        ]);
+    }
+}