refactor(auth): remove role-based logic from scanner authentication and permissions

Reviewed-on: https://gitea.quo.ar/tbianchini/shopit-back/pulls/4

app/Domains/Administrator/Controllers/AdminAppAdministratorController.php

@@ -0,0 +1,49 @@
+<?php
+
+namespace App\Domains\Administrator\Controllers;
+
+use App\Domains\Administrator\Requests\StoreAdministratorRequest;
+use App\Domains\Administrator\Requests\UpdateAdministratorRequest;
+use App\Domains\Administrator\Resources\AdministratorResource;
+use App\Domains\Administrator\Services\AdministratorService;
+use App\Http\Controllers\Controller;
+use Illuminate\Http\Request;
+use Illuminate\Http\Resources\Json\AnonymousResourceCollection;
+use Symfony\Component\HttpFoundation\Response;
+
+class AdminAppAdministratorController extends Controller
+{
+    public function __construct(private readonly AdministratorService $administratorService) {}
+
+    public function index(Request $request): AnonymousResourceCollection
+    {
+        return AdministratorResource::collection($this->administratorService->list(
+            $request->user()->tenant()->firstOrFail(),
+            $request->string('search')->trim()->toString() ?: null,
+        ));
+    }
+
+    public function store(StoreAdministratorRequest $request): AdministratorResource
+    {
+        return AdministratorResource::make($this->administratorService->create(
+            $request->user()->tenant()->firstOrFail(),
+            $request->validated(),
+        ));
+    }
+
+    public function update(UpdateAdministratorRequest $request, int $administrator): AdministratorResource
+    {
+        return AdministratorResource::make($this->administratorService->update(
+            $request->user()->tenant()->firstOrFail(),
+            $administrator,
+            $request->validated(),
+        ));
+    }
+
+    public function destroy(Request $request, int $administrator): Response
+    {
+        $this->administratorService->delete($request->user()->tenant()->firstOrFail(), $administrator, $request->user());
+
+        return response()->noContent();
+    }
+}

app/Domains/Administrator/Requests/StoreAdministratorRequest.php

@@ -0,0 +1,38 @@
+<?php
+
+namespace App\Domains\Administrator\Requests;
+
+use App\Domains\Authorization\Enums\RoleCode;
+use Illuminate\Foundation\Http\FormRequest;
+use Illuminate\Validation\Rule;
+
+class StoreAdministratorRequest extends FormRequest
+{
+    public function authorize(): bool
+    {
+        return $this->user()?->rol_codigo === RoleCode::AdminApp->value;
+    }
+
+    protected function prepareForValidation(): void
+    {
+        if (is_string($this->input('email'))) {
+            $this->merge(['email' => mb_strtolower(trim($this->input('email')))]);
+        }
+    }
+
+    /** @return array<string, mixed> */
+    public function rules(): array
+    {
+
+        return [
+            'nombre_apellido' => ['required', 'string', 'max:255'],
+            'dni' => ['required', 'string', 'max:50'],
+            'email' => [
+                'required',
+                'email',
+                'max:255',
+                Rule::unique('users', 'active_email')->where('rol_codigo', RoleCode::AdminApp->value)->whereNull('deleted_at'),
+            ],
+        ];
+    }
+}

app/Domains/Administrator/Requests/UpdateAdministratorRequest.php

@@ -0,0 +1,41 @@
+<?php
+
+namespace App\Domains\Administrator\Requests;
+
+use App\Domains\Authorization\Enums\RoleCode;
+use Illuminate\Foundation\Http\FormRequest;
+use Illuminate\Validation\Rule;
+
+class UpdateAdministratorRequest extends FormRequest
+{
+    public function authorize(): bool
+    {
+        return $this->user()?->rol_codigo === RoleCode::AdminApp->value;
+    }
+
+    protected function prepareForValidation(): void
+    {
+        if (is_string($this->input('email'))) {
+            $this->merge(['email' => mb_strtolower(trim($this->input('email')))]);
+        }
+    }
+
+    /** @return array<string, mixed> */
+    public function rules(): array
+    {
+        $administratorId = (int) $this->route('administrator');
+
+        return [
+            'nombre_apellido' => ['required', 'string', 'max:255'],
+            'dni' => ['required', 'string', 'max:50'],
+            'email' => [
+                'required',
+                'email',
+                'max:255',
+                Rule::unique('users', 'active_email')->where('rol_codigo', RoleCode::AdminApp->value)
+                    ->whereNull('deleted_at')
+                    ->ignore($administratorId),
+            ],
+        ];
+    }
+}

app/Domains/Administrator/Resources/AdministratorResource.php

@@ -0,0 +1,27 @@
+<?php
+
+namespace App\Domains\Administrator\Resources;
+
+use App\Domains\Auth\Models\User;
+use Illuminate\Http\Request;
+use Illuminate\Http\Resources\Json\JsonResource;
+
+/** @mixin User */
+class AdministratorResource extends JsonResource
+{
+    /** @return array<string, mixed> */
+    public function toArray(Request $request): array
+    {
+        return [
+            'id' => $this->id,
+            'nombre_apellido' => $this->nombre_apellido,
+            'dni' => $this->dni,
+            'email' => $this->email,
+            'rol_codigo' => $this->rol_codigo,
+            'role' => $this->whenLoaded('role', fn () => [
+                'codigo' => $this->role?->codigo,
+                'nombre' => $this->role?->nombre,
+            ]),
+        ];
+    }
+}

app/Domains/Administrator/Services/AdministratorService.php

@@ -0,0 +1,99 @@
+<?php
+
+namespace App\Domains\Administrator\Services;
+
+use App\Domains\Auth\Models\ResetPasswordAttempt;
+use App\Domains\Auth\Models\User;
+use App\Domains\Auth\Services\ResetPasswordAttemptService;
+use App\Domains\Authorization\Enums\RoleCode;
+use App\Domains\Tenant\Models\Tenant;
+use Illuminate\Database\Eloquent\Builder;
+use Illuminate\Database\Eloquent\Collection;
+use Illuminate\Support\Arr;
+use Illuminate\Support\Facades\DB;
+use Illuminate\Support\Str;
+use Illuminate\Validation\ValidationException;
+
+class AdministratorService
+{
+    public function __construct(private readonly ResetPasswordAttemptService $resetPasswordAttemptService) {}
+
+    /** @return Collection<int, User> */
+    public function list(Tenant $tenant, ?string $search = null): Collection
+    {
+        return $this->query($tenant)->with('role')
+            ->when($search, fn (Builder $query, string $search) => $query->where(function (Builder $query) use ($search): void {
+                $query->where('nombre_apellido', 'like', "%{$search}%")
+                    ->orWhere('dni', 'like', "%{$search}%")
+                    ->orWhere('email', 'like', "%{$search}%");
+            }))
+            ->orderBy('nombre_apellido')->get();
+    }
+
+    /** @param array<string, mixed> $data */
+    public function create(Tenant $tenant, array $data): User
+    {
+        return DB::transaction(function () use ($tenant, $data): User {
+            $administrator = User::query()->create([
+                ...$this->attributes($data),
+                'password' => Str::random(64),
+                'rol_codigo' => RoleCode::AdminApp->value,
+                'tenant_codigo' => $tenant->codigo,
+            ]);
+            $this->resetPasswordAttemptService->createForAdminAppEmail(
+                $administrator->email,
+                ResetPasswordAttempt::REASON_ADMINISTRATOR_CREATED,
+            );
+
+            return $administrator->load('role');
+        });
+    }
+
+    /** @param array<string, mixed> $data */
+    public function update(Tenant $tenant, int $administratorId, array $data): User
+    {
+        return DB::transaction(function () use ($tenant, $administratorId, $data): User {
+            $administrator = $this->query($tenant)->lockForUpdate()->findOrFail($administratorId);
+            $administrator->update($this->attributes($data));
+
+            return $administrator->load('role');
+        });
+    }
+
+    public function delete(Tenant $tenant, int $administratorId, User $actor): void
+    {
+        DB::transaction(function () use ($tenant, $administratorId, $actor): void {
+            // Serialize deletions for this tenant, including requests already authenticated
+            // when another administrator removes their account.
+            Tenant::query()->whereKey($tenant->getKey())->lockForUpdate()->firstOrFail();
+            $administrator = $this->query($tenant)->lockForUpdate()->findOrFail($administratorId);
+            if ($administrator->is($actor)) {
+                throw ValidationException::withMessages(['administrator' => 'No podés eliminar tu propio usuario.']);
+            }
+            $activeAdministrators = $this->query($tenant)->lockForUpdate()->get();
+            if ($activeAdministrators->count() <= 1) {
+                throw ValidationException::withMessages(['administrator' => 'El tenant debe conservar al menos un administrador.']);
+            }
+            abort_unless($activeAdministrators->contains('id', $actor->id), 403);
+            $administrator->tokens()->delete();
+            $administrator->delete();
+        });
+    }
+
+    private function query(Tenant $tenant): Builder
+    {
+        return User::query()->where('tenant_codigo', $tenant->codigo)
+            ->where('rol_codigo', RoleCode::AdminApp->value);
+    }
+
+    /** @param array<string, mixed> $data
+     * @return array<string, mixed>
+     */
+    private function attributes(array $data): array
+    {
+        return [
+            ...Arr::only($data, ['nombre_apellido', 'dni']),
+            'email' => mb_strtolower(trim((string) $data['email'])),
+        ];
+    }
+}

app/Domains/Administrator/documentacion/README.md

@@ -0,0 +1,63 @@
+# Administradores de AdminApp
+
+CRUD de usuarios con rol `adminapp`, limitado al tenant del usuario autenticado.
+Todos los administradores del tenant pueden gestionar esta sección.
+
+## Endpoints
+
+Base: `/api/v1/adminapp/tenant/administrators`.
+Requieren `auth:sanctum` y `adminapp.tenant`.
+
+- `GET /`: listado ordenado por nombre; acepta `search` por nombre, DNI o email.
+- `POST /`: alta; responde `201` con `data`.
+- `PUT /{administrator}`: actualización de los tres campos; responde `200` con `data`.
+- `DELETE /{administrator}`: baja lógica; responde `204`.
+
+Alta y actualización reciben:
+
+```json
+{
+  "nombre_apellido": "Ada Lovelace",
+  "dni": "12345678",
+  "email": "ada@example.test"
+}
+```
+
+Nombre (hasta 255 caracteres), DNI (hasta 50) y email (hasta 255) son obligatorios.
+El email se normaliza a minúsculas antes de validar y debe ser único entre
+usuarios activos, sin importar su tenant o rol. Se permite reutilizar el email
+de un usuario eliminado. Rol y tenant no son editables desde esta API.
+
+Las respuestas incluyen `id`, `nombre_apellido`, `dni`, `email`, `rol_codigo`
+y `role` (`codigo`, `nombre`). Nunca incluyen contraseña ni datos de escaneo.
+
+## Alta y acceso
+
+Se genera una contraseña aleatoria y un intento de establecimiento de contraseña
+con motivo `administrator_created`, reutilizando `createForAdminAppEmail`.
+El evento usa el canal `adminapp`; el listener existente envía el email después
+del commit mediante la cola `emails`. Requiere la configuración de correo,
+dominio AdminApp y worker existentes. No se envían contraseñas en texto plano.
+
+## Eliminación y aislamiento
+
+Las consultas de usuarios se limitan por tenant y rol `adminapp`. IDs ajenos,
+usuarios eliminados y usuarios de otros roles devuelven `404`.
+La validación de campos devuelve `422`; falta de autenticación, `401`, y rol
+no autorizado, `403`.
+
+No se permite eliminar al propio usuario ni dejar al tenant sin administradores
+(`422`, error `administrator`). La eliminación bloquea la fila del tenant dentro
+de una transacción para serializar bajas concurrentes. También verifica que el
+actor siga activo, revoca tokens y aplica el borrado lógico existente en `users`.
+
+No agrega tablas ni migraciones. No modifica el CRUD de escáneres ni el frontend.
+
+## Verificación
+
+`php artisan test tests/Feature/Administrator/AdministratorControllerTest.php`
+
+Las pruebas cubren CRUD, normalización y unicidad del email, establecimiento de
+contraseña, restricciones de rol y tenant, baja lógica, tokens y protecciones de
+eliminación. El caso de petición autenticada antes de la baja del actor se simula;
+no es una prueba con conexiones concurrentes reales.

app/Domains/Administrator/routes/api.php

@@ -0,0 +1,10 @@
+<?php
+
+use App\Domains\Administrator\Controllers\AdminAppAdministratorController;
+use Illuminate\Support\Facades\Route;
+
+Route::prefix('v1/adminapp/tenant')
+    ->middleware(['auth:sanctum', 'adminapp.tenant'])
+    ->group(function (): void {
+        Route::apiResource('administrators', AdminAppAdministratorController::class)->except('show');
+    });

app/Domains/Auth/Controllers/ResetPasswordController.php

@@ -5,6 +5,7 @@ namespace App\Domains\Auth\Controllers;
 use App\Domains\Auth\Models\ResetPasswordAttempt;
 use App\Domains\Auth\Requests\ResetPasswordRequest;
 use App\Domains\Auth\Services\ResetPasswordAttemptService;
+use App\Domains\Authorization\Enums\RoleCode;
 use App\Http\Controllers\Controller;
 use Illuminate\Http\JsonResponse;
 use Illuminate\Validation\ValidationException;
@@ -26,6 +27,7 @@ class ResetPasswordController extends Controller
             $data['email'],
             $data['codigo'],
             $data['password'],
+            RoleCode::from($request->route('reset_role', RoleCode::User->value)),
         )) {
             throw ValidationException::withMessages([
                 'codigo' => __('api.auth.password_reset_invalid'),

app/Domains/Auth/Controllers/ValidateResetPasswordAttemptController.php

@@ -5,6 +5,7 @@ namespace App\Domains\Auth\Controllers;
 use App\Domains\Auth\Models\ResetPasswordAttempt;
 use App\Domains\Auth\Requests\ValidateResetPasswordAttemptRequest;
 use App\Domains\Auth\Services\ResetPasswordAttemptService;
+use App\Domains\Authorization\Enums\RoleCode;
 use App\Http\Controllers\Controller;
 use Illuminate\Http\JsonResponse;
 use Illuminate\Validation\ValidationException;
@@ -25,6 +26,7 @@ class ValidateResetPasswordAttemptController extends Controller
         $result = $this->resetPasswordAttemptService->validateCode(
             $data['email'],
             $data['codigo'],
+            RoleCode::from($request->route('reset_role', RoleCode::User->value)),
         );
 
         if ($result === ResetPasswordAttemptService::CODE_EXPIRED) {

app/Domains/Auth/Models/ResetPasswordAttempt.php

@@ -17,6 +17,8 @@ class ResetPasswordAttempt extends Model
 
     public const REASON_STAFF_CREATED = 'staff_created';
 
+    public const REASON_ADMINISTRATOR_CREATED = 'administrator_created';
+
     public const STATUS_PENDING = 'pending';
 
     public const STATUS_VALIDATED = 'validated';

app/Domains/Auth/Models/User.php

@@ -13,16 +13,17 @@ use Illuminate\Database\Eloquent\Factories\HasFactory;
 use Illuminate\Database\Eloquent\Relations\BelongsTo;
 use Illuminate\Database\Eloquent\Relations\BelongsToMany;
 use Illuminate\Database\Eloquent\Relations\HasMany;
+use Illuminate\Database\Eloquent\SoftDeletes;
 use Illuminate\Foundation\Auth\User as Authenticatable;
 use Illuminate\Notifications\Notifiable;
 use Laravel\Sanctum\HasApiTokens;
 
 #[Fillable(['nombre_apellido', 'email', 'password', 'dni', 'telefono', 'google_id', 'rol_codigo', 'tenant_codigo'])]
-#[Hidden(['password', 'remember_token'])]
+#[Hidden(['password', 'remember_token', 'active_email', 'active_google_id'])]
 class User extends Authenticatable
 {
     /** @use HasFactory<UserFactory> */
-    use HasApiTokens, HasFactory, Notifiable;
+    use HasApiTokens, HasFactory, Notifiable, SoftDeletes;
 
     protected $attributes = [
         'rol_codigo' => RoleCode::User->value,

app/Domains/Auth/Requests/RegisterUserRequest.php

@@ -2,6 +2,7 @@
 
 namespace App\Domains\Auth\Requests;
 
+use App\Domains\Authorization\Enums\RoleCode;
 use Illuminate\Foundation\Http\FormRequest;
 use Illuminate\Validation\Rule;
 use Illuminate\Validation\Rules\Password;
@@ -13,15 +14,26 @@ class RegisterUserRequest extends FormRequest
         return true;
     }
 
-    /**
+    protected function prepareForValidation(): void
-     * @return array<string, mixed>
+    {
-     */
+        if (is_string($this->input('email'))) {
+            $this->merge(['email' => mb_strtolower(trim($this->input('email')))]);
+        }
+    }
+
+    /** @return array<string, mixed> */
     public function rules(): array
     {
         return [
             'tenant_codigo' => ['nullable', 'string', Rule::exists('tenants', 'codigo')],
             'nombre_apellido' => ['required', 'string', 'max:255'],
-            'email' => ['required', 'string', 'email', 'max:255', Rule::unique('users', 'email')],
+            'email' => [
+                'required',
+                'string',
+                'email',
+                'max:255',
+                Rule::unique('users', 'active_email')->where('rol_codigo', RoleCode::User->value)->whereNull('deleted_at'),
+            ],
             'password' => ['required', 'string', 'confirmed', Password::min(8)->mixedCase()->symbols()],
             'dni' => ['nullable', 'string', 'max:255'],
             'telefono' => ['nullable', 'string', 'max:255'],

app/Domains/Auth/Requests/UpdateProfileRequest.php

@@ -4,6 +4,7 @@ namespace App\Domains\Auth\Requests;
 
 use Illuminate\Foundation\Http\FormRequest;
 use Illuminate\Validation\Rule;
+use Illuminate\Validation\Rules\Password;
 
 class UpdateProfileRequest extends FormRequest
 {
@@ -12,6 +13,13 @@ class UpdateProfileRequest extends FormRequest
         return true;
     }
 
+    protected function prepareForValidation(): void
+    {
+        if (is_string($this->input('email'))) {
+            $this->merge(['email' => mb_strtolower(trim($this->input('email')))]);
+        }
+    }
+
     public function rules(): array
     {
         return [
@@ -19,11 +27,13 @@ class UpdateProfileRequest extends FormRequest
             'email' => [
                 'required',
                 'email',
-                Rule::unique('users', 'email')->ignore($this->user()->id),
+                Rule::unique('users', 'active_email')->where('rol_codigo', $this->user()->rol_codigo)
+                    ->whereNull('deleted_at')
+                    ->ignore($this->user()->id),
             ],
             'dni' => ['nullable', 'string', 'regex:/^[0-9]{7,8}$/'],
             'telefono' => ['nullable', 'string', 'regex:/^\+?[0-9\s\-]+$/'],
-            'password' => ['nullable', 'string', \Illuminate\Validation\Rules\Password::min(8)->mixedCase()->symbols()],
+            'password' => ['nullable', 'string', Password::min(8)->mixedCase()->symbols()],
         ];
     }
 }

app/Domains/Auth/Services/AdminCredentialVerifier.php

@@ -11,7 +11,7 @@ class AdminCredentialVerifier
     public function verify(string $email, string $password): bool
     {
         $admin = User::query()
-            ->where('email', mb_strtolower(trim($email)))
+            ->where('active_email', mb_strtolower(trim($email)))
             ->where('rol_codigo', RoleCode::Admin->value)
             ->first();
 

app/Domains/Auth/Services/GoogleAuthService.php

@@ -3,6 +3,7 @@
 namespace App\Domains\Auth\Services;
 
 use App\Domains\Auth\Models\User;
+use App\Domains\Authorization\Enums\RoleCode;
 use App\Domains\Notification\Events\UserRegistered;
 use App\Domains\Tenant\Models\Tenant;
 use App\Domains\Tenant\Support\TenantDomainNormalizer;
@@ -124,12 +125,12 @@ class GoogleAuthService
             ]);
         }
 
-        $user = User::query()->where('google_id', $googleId)->first();
+        $user = User::query()->where('rol_codigo', RoleCode::User->value)->where('google_id', $googleId)->first();
         if ($user) {
             return $user;
         }
 
-        $user = User::query()->where('email', $email)->first();
+        $user = User::query()->where('rol_codigo', RoleCode::User->value)->where('active_email', mb_strtolower(trim($email)))->first();
         if ($user) {
             $user->forceFill(['google_id' => $googleId])->save();
 

app/Domains/Auth/Services/PasswordLoginService.php

@@ -85,7 +85,7 @@ class PasswordLoginService
             null,
             $ipAddress,
             $userAgent,
-            null,
+            RoleCode::Scanner,
             true,
             PermissionCode::ScanTickets->value,
             PasswordResetRequested::CHANNEL_SCANNER,
@@ -120,7 +120,7 @@ class PasswordLoginService
             $passwordResetChannel,
         ): array {
             $user = User::query()
-                ->where('email', $normalizedEmail)
+                ->where('active_email', $normalizedEmail)
                 ->when(
                     $requiredRole !== null,
                     fn ($query) => $query->where('rol_codigo', $requiredRole->value),

app/Domains/Auth/Services/ResetPasswordAttemptService.php

@@ -28,7 +28,8 @@ class ResetPasswordAttemptService
         try {
             $attemptId = DB::transaction(function () use ($email, $emailFingerprint, $reason): ?int {
                 $user = User::query()
-                    ->where('email', $email)
+                    ->where('active_email', mb_strtolower(trim($email)))
+                    ->where('rol_codigo', RoleCode::User->value)
                     ->lockForUpdate()
                     ->first();
 
@@ -65,7 +66,7 @@ class ResetPasswordAttemptService
         try {
             $result = DB::transaction(function () use ($email, $emailFingerprint, $reason): ?array {
                 $user = User::query()
-                    ->where('email', $email)
+                    ->where('active_email', mb_strtolower(trim($email)))
                     ->where('rol_codigo', RoleCode::AdminApp->value)
                     ->whereNotNull('tenant_codigo')
                     ->lockForUpdate()
@@ -113,7 +114,7 @@ class ResetPasswordAttemptService
         try {
             $result = DB::transaction(function () use ($email, $emailFingerprint, $reason): ?array {
                 $user = User::query()
-                    ->where('email', $email)
+                    ->where('active_email', mb_strtolower(trim($email)))
                     ->where('rol_codigo', RoleCode::Scanner->value)
                     ->whereNotNull('tenant_codigo')
                     ->lockForUpdate()
@@ -152,14 +153,15 @@ class ResetPasswordAttemptService
         );
     }
 
-    public function validateCode(string $email, string $code): string
+    public function validateCode(string $email, string $code, RoleCode $role = RoleCode::User): string
     {
         $emailFingerprint = $this->emailFingerprint($email);
 
         try {
-            return DB::transaction(function () use ($email, $code, $emailFingerprint): string {
+            return DB::transaction(function () use ($email, $code, $emailFingerprint, $role): string {
                 $user = User::query()
-                    ->where('email', $email)
+                    ->where('active_email', mb_strtolower(trim($email)))
+                    ->where('rol_codigo', $role->value)
                     ->lockForUpdate()
                     ->first();
 
@@ -207,14 +209,15 @@ class ResetPasswordAttemptService
         }
     }
 
-    public function resetPassword(string $email, string $code, string $password): bool
+    public function resetPassword(string $email, string $code, string $password, RoleCode $role = RoleCode::User): bool
     {
         $emailFingerprint = $this->emailFingerprint($email);
 
         try {
-            return DB::transaction(function () use ($email, $code, $password, $emailFingerprint): bool {
+            return DB::transaction(function () use ($email, $code, $password, $emailFingerprint, $role): bool {
                 $user = User::query()
-                    ->where('email', $email)
+                    ->where('active_email', mb_strtolower(trim($email)))
+                    ->where('rol_codigo', $role->value)
                     ->lockForUpdate()
                     ->first();
 

app/Domains/Auth/routes/adminapp.php

@@ -12,8 +12,10 @@ Route::prefix('v1/adminapp')->group(function (): void {
     Route::post('password/reset-attempts', CreateAdminAppResetPasswordAttemptController::class)
         ->middleware('throttle:5,1');
     Route::post('password/reset-attempts/validate', ValidateResetPasswordAttemptController::class)
+        ->defaults('reset_role', 'adminapp')
         ->middleware('throttle:10,1');
     Route::post('password/reset', ResetPasswordController::class)
+        ->defaults('reset_role', 'adminapp')
         ->middleware('throttle:5,1');
     Route::middleware(['auth:sanctum', 'adminapp.tenant'])
         ->get('me', AdminAppMeController::class);

app/Domains/Auth/routes/scanner.php

@@ -12,8 +12,10 @@ Route::prefix('v1/scanner')->group(function (): void {
     Route::post('password/reset-attempts', CreateScannerResetPasswordAttemptController::class)
         ->middleware('throttle:5,1');
     Route::post('password/reset-attempts/validate', ValidateResetPasswordAttemptController::class)
+        ->defaults('reset_role', 'scanner')
         ->middleware('throttle:10,1');
     Route::post('password/reset', ResetPasswordController::class)
+        ->defaults('reset_role', 'scanner')
         ->middleware('throttle:5,1');
     Route::middleware(['auth:sanctum', 'scanner.tenant'])
         ->get('me', ScannerMeController::class);

app/Domains/Desfile/Services/InvitationPurchaseProvisioner.php

@@ -5,6 +5,7 @@ namespace App\Domains\Desfile\Services;
 use DateTimeInterface;
 use Illuminate\Support\Facades\DB;
 use Illuminate\Support\Facades\Hash;
+use Illuminate\Support\Facades\Schema;
 use Illuminate\Support\Str;
 use RuntimeException;
 
@@ -58,7 +59,7 @@ class InvitationPurchaseProvisioner
                         $allocation['type'],
                     );
 
-                    $this->createPurchaseItem(
+                    $purchaseItemId = $this->createPurchaseItem(
                         $purchaseId,
                         $catalogItem,
                         $variant,
@@ -70,6 +71,7 @@ class InvitationPurchaseProvisioner
                     );
                     $this->createTicketAndCommitStock(
                         $purchaseId,
+                        $purchaseItemId,
                         $userId,
                         (int) $catalogItem->id,
                         $variant,
@@ -102,7 +104,11 @@ class InvitationPurchaseProvisioner
 
     private function userId(DateTimeInterface $now): int
     {
-        $user = DB::table('users')->where('email', self::USER_EMAIL)->first();
+        $user = DB::table('users')
+            ->where('active_email', self::USER_EMAIL)
+            ->where('rol_codigo', 'user')
+            ->whereNull('deleted_at')
+            ->first();
 
         if ($user !== null) {
             if ($user->tenant_codigo !== self::TENANT_CODE) {
@@ -326,12 +332,13 @@ class InvitationPurchaseProvisioner
         int $seat,
         string $type,
         DateTimeInterface $now,
-    ): void {
+    ): int {
-        if (DB::table('compra_items')
+        $existingId = DB::table('compra_items')
             ->where('compra_id', $purchaseId)
             ->where('source_variant_id', $variant->id)
-            ->exists()) {
+            ->value('id');
-            return;
+        if ($existingId !== null) {
+            return (int) $existingId;
         }
 
         $attributes = [
@@ -341,7 +348,7 @@ class InvitationPurchaseProvisioner
             ['name' => 'Asiento', 'value' => (string) $seat],
         ];
 
-        DB::table('compra_items')->insert([
+        return DB::table('compra_items')->insertGetId([
             'compra_id' => $purchaseId,
             'source_catalog_item_id' => $catalogItem->id,
             'source_variant_id' => $variant->id,
@@ -367,13 +374,18 @@ class InvitationPurchaseProvisioner
 
     private function createTicketAndCommitStock(
         int $purchaseId,
+        int $purchaseItemId,
         int $userId,
         int $catalogItemId,
         object $variant,
         DateTimeInterface $now,
     ): void {
+        $purchaseReference = Schema::hasColumn('tickets', 'source_purchase_item_id')
+            ? ['source_purchase_item_id' => $purchaseItemId]
+            : ['source_purchase_id' => $purchaseId];
+
         if (DB::table('tickets')
-            ->where('source_purchase_id', $purchaseId)
+            ->where($purchaseReference)
             ->where('source_variant_id', $variant->id)
             ->exists()) {
             return;
@@ -420,7 +432,7 @@ class InvitationPurchaseProvisioner
             'ticket' => (string) Str::uuid(),
             'name' => null,
             'description' => null,
-            'source_purchase_id' => $purchaseId,
+            ...$purchaseReference,
             'source_catalog_item_id' => $catalogItemId,
             'source_variant_id' => $variant->id,
             'used_at' => null,

app/Domains/Forms/Controllers/AdminApp/TicketFilterFormController.php

@@ -0,0 +1,20 @@
+<?php
+
+namespace App\Domains\Forms\Controllers\AdminApp;
+
+use App\Domains\Forms\Resources\TicketFilterFormResource;
+use App\Domains\Forms\Services\TicketFilterFormService;
+use App\Http\Controllers\Controller;
+use Illuminate\Http\Request;
+
+class TicketFilterFormController extends Controller
+{
+    public function __construct(private readonly TicketFilterFormService $formService) {}
+
+    public function __invoke(Request $request): TicketFilterFormResource
+    {
+        $tenant = $request->user('sanctum')->tenant()->firstOrFail();
+
+        return TicketFilterFormResource::make($this->formService->get($tenant));
+    }
+}

app/Domains/Forms/Controllers/AdminApp/TicketFormController.php

@@ -0,0 +1,22 @@
+<?php
+
+namespace App\Domains\Forms\Controllers\AdminApp;
+
+use App\Domains\Forms\Resources\TicketFormResource;
+use App\Domains\Forms\Services\TicketFormService;
+use App\Http\Controllers\Controller;
+use Illuminate\Http\Request;
+
+class TicketFormController extends Controller
+{
+    public function __construct(protected TicketFormService $ticketFormService) {}
+
+    public function __invoke(Request $request): TicketFormResource
+    {
+        return TicketFormResource::make(
+            $this->ticketFormService->get(
+                $request->user('sanctum')->tenant()->firstOrFail()
+            )
+        );
+    }
+}

app/Domains/Forms/Resources/TicketFilterFormResource.php

@@ -0,0 +1,21 @@
+<?php
+
+namespace App\Domains\Forms\Resources;
+
+use Illuminate\Http\Request;
+use Illuminate\Http\Resources\Json\JsonResource;
+
+class TicketFilterFormResource extends JsonResource
+{
+    /** @return array<string, mixed> */
+    public function toArray(Request $request): array
+    {
+        return [
+            'code' => $this->resource['code'],
+            'action' => $this->resource['action'],
+            'method' => $this->resource['method'],
+            'fields' => $this->resource['fields'],
+            'columns' => $this->resource['columns'],
+        ];
+    }
+}

app/Domains/Forms/Resources/TicketFormResource.php

@@ -0,0 +1,18 @@
+<?php
+
+namespace App\Domains\Forms\Resources;
+
+use Illuminate\Http\Request;
+use Illuminate\Http\Resources\Json\JsonResource;
+
+class TicketFormResource extends JsonResource
+{
+    /** @return array<string, mixed> */
+    public function toArray(Request $request): array
+    {
+        return [
+            'statuses' => $this->resource['statuses'],
+            'categories' => $this->resource['categories'],
+        ];
+    }
+}

app/Domains/Forms/Services/SaleFormService.php

@@ -6,27 +6,18 @@ use App\Domains\Purchase\Models\Purchase;
 
 class SaleFormService
 {
-    /** @return array{statuses: list<array{code: string, name: string}>} */
+    /** @return array{statuses: list<array{value: string, label: string, real_statuses: list<string>}>} */
     public function get(): array
     {
-        $names = [
-            Purchase::STATUS_CREATED => 'Creada',
-            Purchase::STATUS_PENDING_PAYMENT => 'Esperando pago',
-            Purchase::STATUS_IN_REVIEW => 'En revisión',
-            Purchase::STATUS_PAID => 'Confirmada',
-            Purchase::STATUS_CANCELLED => 'Cancelada',
-            Purchase::STATUS_REJECTED => 'Rechazada',
-            Purchase::STATUS_EXPIRED => 'Vencida',
-            Purchase::STATUS_SUPERSEDED => 'Reemplazada',
-        ];
-
         return [
             'statuses' => array_map(
-                fn (string $status): array => [
+                fn (string $code, array $definition): array => [
-                    'code' => $status,
+                    'value' => $code,
-                    'name' => $names[$status],
+                    'label' => $definition['name'],
+                    'real_statuses' => $definition['statuses'],
                 ],
-                Purchase::statuses(),
+                array_keys(Purchase::adminStatuses()),
+                array_values(Purchase::adminStatuses()),
             ),
         ];
     }

app/Domains/Forms/Services/TicketFilterFormService.php

@@ -0,0 +1,152 @@
+<?php
+
+namespace App\Domains\Forms\Services;
+
+use App\Domains\Tenant\Models\Tenant;
+use App\Domains\Ticket\Models\Ticket;
+use App\Domains\Ticket\Services\AdminAppTicketColumnService;
+
+class TicketFilterFormService
+{
+    private const FIESTA_FUTBOL_INFANTIL = 'fiesta_futbol_infantil';
+
+    public function __construct(
+        private readonly TicketFormService $ticketFormService,
+        private readonly AdminAppTicketColumnService $columnService,
+    ) {}
+
+    /** @return array<string, mixed> */
+    public function get(Tenant $tenant): array
+    {
+        $fields = $this->commonFields();
+
+        if ($tenant->codigo === self::FIESTA_FUTBOL_INFANTIL) {
+            $fields = [
+                ...$this->fiestaFutbolInfantilFields($tenant),
+                ...$this->commonFields(includeDate: false),
+            ];
+        }
+
+        return [
+            'code' => 'tickets_filter',
+            'action' => '/api/v1/adminapp/tenant/tickets',
+            'method' => 'GET',
+            'fields' => $fields,
+            'columns' => $this->columnService->publicColumns($tenant),
+        ];
+    }
+
+    /** @return list<array<string, mixed>> */
+    private function fiestaFutbolInfantilFields(Tenant $tenant): array
+    {
+        $form = $this->ticketFormService->getForFilters($tenant);
+
+        return [
+            [
+                'name' => 'category',
+                'query_param' => 'category',
+                'label' => 'Categoría',
+                'type' => 'select',
+                'required' => false,
+                'default' => null,
+                'placeholder' => 'Categoría',
+                'options' => array_map(
+                    fn (array $category): array => [
+                        'value' => $category['value'],
+                        'label' => $category['label'],
+                        'children' => [
+                            [
+                                'field' => 'product',
+                                'disabled' => $category['products'] === [],
+                                'options' => array_map(
+                                    fn (array $product): array => [
+                                        'value' => $product['value'],
+                                        'label' => $product['label'],
+                                        'children' => [
+                                            [
+                                                'field' => 'type',
+                                                'disabled' => $product['types'] === [],
+                                                'options' => array_map(
+                                                    fn (array $type): array => [
+                                                        'value' => $type['value'],
+                                                        'label' => $type['label'],
+                                                        'children' => [[
+                                                            'field' => 'size',
+                                                            'disabled' => ($type['sizes'] ?? []) === [],
+                                                            'options' => $type['sizes'] ?? [],
+                                                        ]],
+                                                    ],
+                                                    $product['types'],
+                                                ),
+                                            ],
+                                        ],
+                                    ],
+                                    $category['products'],
+                                ),
+                            ],
+                            [
+                                'field' => 'date',
+                                'disabled' => ! in_array($category['value'], ['comidas', 'comida'], true),
+                                'options' => [],
+                            ],
+                        ],
+                    ],
+                    $form['categories'],
+                ),
+            ],
+            $this->dependentSelect('product', 'Producto', 'category'),
+            $this->dependentSelect('type', 'Tipo', 'product'),
+            $this->dependentSelect('size', 'Talle', 'type'),
+            [
+                ...$this->dependentSelect('date', 'Fecha', 'category'),
+                'type' => 'date',
+            ],
+        ];
+    }
+
+    /** @return list<array<string, mixed>> */
+    private function commonFields(bool $includeDate = true): array
+    {
+        return [
+            ...($includeDate ? [[
+                'name' => 'date',
+                'query_param' => 'date',
+                'label' => 'Fecha',
+                'type' => 'date',
+                'required' => false,
+                'default' => null,
+            ]] : []),
+            [
+                'name' => 'status',
+                'query_param' => 'status',
+                'label' => 'Estado',
+                'type' => 'select',
+                'required' => false,
+                'default' => null,
+                'placeholder' => 'Estado',
+                'options' => [
+                    ['value' => Ticket::STATUS_ACTIVE, 'label' => 'Activo'],
+                    ['value' => Ticket::STATUS_USED, 'label' => 'Usado'],
+                    ['value' => Ticket::STATUS_EXPIRED, 'label' => 'Vencido'],
+                ],
+            ],
+        ];
+    }
+
+    /** @return array<string, mixed> */
+    private function dependentSelect(string $name, string $label, string $dependency): array
+    {
+        return [
+            'name' => $name,
+            'query_param' => $name,
+            'label' => $label,
+            'type' => 'select',
+            'required' => false,
+            'default' => null,
+            'placeholder' => $label,
+            'depends_on' => $dependency,
+            'disabled' => true,
+            'options' => [],
+        ];
+    }
+}

app/Domains/Forms/Services/TicketFormService.php

@@ -0,0 +1,400 @@
+<?php
+
+namespace App\Domains\Forms\Services;
+
+use App\Domains\Catalog\Models\CatalogItem;
+use App\Domains\Catalog\Models\Variant;
+use App\Domains\Tenant\Models\Tenant;
+use App\Domains\Ticket\Models\Ticket;
+use Illuminate\Database\Eloquent\Collection;
+
+class TicketFormService
+{
+    private const PRODUCT = 'product';
+
+    /**
+     * @var array<string, array{label: string|null, product: string, type: string|null, order: int}>
+     */
+    private const CATEGORY_PRESENTATIONS = [
+        'entradas' => [
+            'label' => null,
+            'product' => self::PRODUCT,
+            'type' => null,
+            'order' => 1,
+        ],
+        'alojamientos' => [
+            'label' => 'Camping',
+            'product' => 'tipo_alojamiento',
+            'type' => null,
+            'order' => 2,
+        ],
+        'camping' => [
+            'label' => null,
+            'product' => 'tipo_alojamiento',
+            'type' => null,
+            'order' => 2,
+        ],
+        'comidas' => [
+            'label' => 'Comida',
+            'product' => 'event_date',
+            'type' => 'horario',
+            'order' => 3,
+        ],
+        'comida' => [
+            'label' => null,
+            'product' => 'event_date',
+            'type' => 'horario',
+            'order' => 3,
+        ],
+        'merchandising' => [
+            'label' => null,
+            'product' => self::PRODUCT,
+            'type' => 'color',
+            'order' => 4,
+        ],
+    ];
+
+    /**
+     * @var array<string, array{label: string|null, product: string, type: string|null, size: string|null, order: int}>
+     */
+    private const FILTER_CATEGORY_PRESENTATIONS = [
+        'entradas' => ['label' => null, 'product' => self::PRODUCT, 'type' => null, 'size' => null, 'order' => 1],
+        'alojamientos' => ['label' => 'Camping', 'product' => 'tipo_alojamiento', 'type' => null, 'size' => null, 'order' => 2],
+        'camping' => ['label' => null, 'product' => 'tipo_alojamiento', 'type' => null, 'size' => null, 'order' => 2],
+        'comidas' => ['label' => 'Comida', 'product' => 'horario', 'type' => 'servicio', 'size' => null, 'order' => 3],
+        'comida' => ['label' => null, 'product' => 'horario', 'type' => 'servicio', 'size' => null, 'order' => 3],
+        'merchandising' => ['label' => null, 'product' => self::PRODUCT, 'type' => 'color', 'size' => 'talle', 'order' => 4],
+    ];
+
+    /**
+     * @return array{
+     *     statuses: list<array{value: string, label: string}>,
+     *     categories: list<array{
+     *         value: string,
+     *         label: string,
+     *         products: list<array{
+     *             value: string,
+     *             label: string,
+     *             types: list<array{value: string, label: string}>
+     *         }>
+     *     }>
+     * }
+     */
+    public function get(Tenant $tenant): array
+    {
+        $items = CatalogItem::query()
+            ->where('tenant_code', $tenant->codigo)
+            ->where('has_tickets', true)
+            ->whereHas('category')
+            ->with($this->relations())
+            ->orderBy('group_order')
+            ->orderBy('nombre')
+            ->get();
+
+        return $this->build($items, self::CATEGORY_PRESENTATIONS);
+    }
+
+    /**
+     * Return active catalog options plus soft-deleted sources still referenced by
+     * tickets, so historical tickets never become impossible to filter.
+     *
+     * @return array{
+     *     statuses: list<array{value: string, label: string}>,
+     *     categories: list<array{
+     *         value: string,
+     *         label: string,
+     *         products: list<array{
+     *             value: string,
+     *             label: string,
+     *             types: list<array{value: string, label: string}>
+     *         }>
+     *     }>
+     * }
+     */
+    public function getForFilters(Tenant $tenant): array
+    {
+        $historicalVariantIds = Ticket::query()
+            ->where('tenant_code', $tenant->codigo)
+            ->whereNotNull('source_variant_id')
+            ->distinct()
+            ->pluck('source_variant_id')
+            ->map(fn ($id): int => (int) $id)
+            ->all();
+        $historicalCatalogItemIds = Ticket::query()
+            ->where('tenant_code', $tenant->codigo)
+            ->whereNotNull('source_catalog_item_id')
+            ->distinct()
+            ->pluck('source_catalog_item_id')
+            ->map(fn ($id): int => (int) $id)
+            ->merge(
+                Variant::withTrashed()
+                    ->whereKey($historicalVariantIds)
+                    ->pluck('catalog_item_id')
+                    ->map(fn ($id): int => (int) $id),
+            )
+            ->unique()
+            ->values()
+            ->all();
+
+        $items = CatalogItem::withTrashed()
+            ->where('tenant_code', $tenant->codigo)
+            ->whereHas('category')
+            ->where(function ($query) use ($historicalCatalogItemIds): void {
+                $query
+                    ->where(function ($activeQuery): void {
+                        $activeQuery
+                            ->whereNull('catalog_items.deleted_at')
+                            ->where('has_tickets', true);
+                    })
+                    ->orWhereIn('catalog_items.id', $historicalCatalogItemIds);
+            })
+            ->with([
+                'category',
+                'itemAttributes.attribute.options',
+                'variants' => fn ($query) => $query
+                    ->withTrashed()
+                    ->where(function ($variantQuery) use ($historicalVariantIds): void {
+                        $variantQuery
+                            ->whereNull('variantes.deleted_at')
+                            ->orWhereIn('variantes.id', $historicalVariantIds);
+                    }),
+                'variants.definitions.itemAttribute.attribute.options',
+                'variants.eventDates',
+                'variants.eventDate',
+            ])
+            ->orderBy('group_order')
+            ->orderBy('nombre')
+            ->get();
+
+        return $this->build($items, self::FILTER_CATEGORY_PRESENTATIONS, includeSizes: true);
+    }
+
+    /**
+     * @param  Collection<int, CatalogItem>  $items
+     * @return array{
+     *     statuses: list<array{value: string, label: string}>,
+     *     categories: list<array{
+     *         value: string,
+     *         label: string,
+     *         products: list<array{
+     *             value: string,
+     *             label: string,
+     *             types: list<array{value: string, label: string}>
+     *         }>
+     *     }>
+     * }
+     */
+    private function build(Collection $items, array $presentations, bool $includeSizes = false): array
+    {
+        $categories = [];
+
+        foreach ($items as $item) {
+            $sourceCategory = trim((string) $item->category?->nombre);
+            $categoryValue = mb_strtolower($sourceCategory);
+            $presentation = $presentations[$categoryValue] ?? [
+                'label' => null,
+                'product' => self::PRODUCT,
+                'type' => null,
+                'size' => null,
+                'order' => PHP_INT_MAX,
+            ];
+
+            $categories[$categoryValue] ??= [
+                'value' => $categoryValue,
+                'label' => $presentation['label'] ?? $sourceCategory,
+                'order' => $presentation['order'],
+                'products' => [],
+            ];
+
+            foreach ($this->products(
+                $item,
+                $presentation['product'],
+                $presentation['type'],
+                $presentation['size'] ?? null,
+            ) as $product) {
+                $productValue = $product['value'];
+                $existingProduct = $categories[$categoryValue]['products'][$productValue] ?? [
+                    'value' => $productValue,
+                    'label' => $product['label'],
+                    'types' => [],
+                    'sizes' => [],
+                ];
+
+                foreach ($product['types'] as $type) {
+                    $existingProduct['types'][$type['value']] = $type;
+                }
+
+                foreach ($product['sizes'] as $size) {
+                    $existingProduct['sizes'][$size['value']] = $size;
+                }
+
+                $categories[$categoryValue]['products'][$productValue] = $existingProduct;
+            }
+        }
+
+        uasort($categories, fn (array $left, array $right): int => $left['order'] <=> $right['order']
+            ?: $left['label'] <=> $right['label']);
+
+        return [
+            'statuses' => [
+                ['value' => Ticket::STATUS_ACTIVE, 'label' => 'Activo'],
+                ['value' => Ticket::STATUS_USED, 'label' => 'Usado'],
+                ['value' => Ticket::STATUS_EXPIRED, 'label' => 'Vencido'],
+            ],
+            'categories' => array_values(array_map(
+                fn (array $category): array => [
+                    'value' => $category['value'],
+                    'label' => $category['label'],
+                    'products' => array_values(array_map(
+                        fn (array $product): array => [
+                            'value' => $product['value'],
+                            'label' => $product['label'],
+                            'types' => array_values($product['types']),
+                            ...($includeSizes ? ['sizes' => array_values($product['sizes'])] : []),
+                        ],
+                        $category['products'],
+                    )),
+                ],
+                $categories,
+            )),
+        ];
+    }
+
+    /** @return list<string> */
+    private function relations(): array
+    {
+        return [
+            'category',
+            'itemAttributes.attribute.options',
+            'variants.definitions.itemAttribute.attribute.options',
+            'variants.eventDates',
+            'variants.eventDate',
+        ];
+    }
+
+    /**
+     * @return list<array{
+     *     value: string,
+     *     label: string,
+     *     types: list<array{value: string, label: string}>,
+     *     sizes: list<array{value: string, label: string}>
+     * }>
+     */
+    private function products(CatalogItem $item, string $productCode, ?string $typeCode, ?string $sizeCode): array
+    {
+        if ($productCode === self::PRODUCT) {
+            return [[
+                'value' => $item->slug,
+                'label' => $item->nombre,
+                'types' => $this->types($item, $typeCode, $sizeCode),
+                'sizes' => $this->types($item, $sizeCode),
+            ]];
+        }
+
+        $products = [];
+
+        foreach ($item->variants as $variant) {
+            foreach ($this->variantOptions($variant, $productCode) as $productOption) {
+                $productValue = $productOption['value'];
+                $products[$productValue] ??= [
+                    'value' => $productValue,
+                    'label' => $this->optionLabel($productOption['label'], $productCode),
+                    'types' => [],
+                    'sizes' => [],
+                ];
+
+                foreach ($this->variantOptions($variant, $typeCode) as $typeOption) {
+                    $this->mergeTypeOption(
+                        $products[$productValue]['types'],
+                        $typeOption,
+                        $variant,
+                        $sizeCode,
+                    );
+                }
+
+                foreach ($this->variantOptions($variant, $sizeCode) as $sizeOption) {
+                    $products[$productValue]['sizes'][$sizeOption['value']] = $sizeOption;
+                }
+            }
+        }
+
+        return array_values(array_map(
+            fn (array $product): array => [
+                'value' => $product['value'],
+                'label' => $product['label'],
+                'types' => array_values($product['types']),
+                'sizes' => array_values($product['sizes']),
+            ],
+            $products,
+        ));
+    }
+
+    /** @return list<array<string, mixed>> */
+    private function types(CatalogItem $item, ?string $typeCode, ?string $sizeCode = null): array
+    {
+        $types = [];
+
+        foreach ($item->variants as $variant) {
+            foreach ($this->variantOptions($variant, $typeCode) as $typeOption) {
+                $this->mergeTypeOption($types, $typeOption, $variant, $sizeCode);
+            }
+        }
+
+        return array_values(array_map(function (array $type) use ($sizeCode): array {
+            if ($sizeCode !== null) {
+                $type['sizes'] = array_values($type['sizes']);
+            }
+
+            return $type;
+        }, $types));
+    }
+
+    /**
+     * @param  array<string, array<string, mixed>>  $types
+     * @param  array{value: string, label: string}  $typeOption
+     */
+    private function mergeTypeOption(
+        array &$types,
+        array $typeOption,
+        Variant $variant,
+        ?string $sizeCode,
+    ): void {
+        $typeValue = $typeOption['value'];
+        $types[$typeValue] ??= [
+            ...$typeOption,
+            ...($sizeCode !== null ? ['sizes' => []] : []),
+        ];
+
+        foreach ($this->variantOptions($variant, $sizeCode) as $sizeOption) {
+            $types[$typeValue]['sizes'][$sizeOption['value']] = $sizeOption;
+        }
+    }
+
+    /** @return list<array{value: string, label: string}> */
+    private function variantOptions(Variant $variant, ?string $attributeCode): array
+    {
+        if ($attributeCode === null) {
+            return [];
+        }
+
+        $selection = $variant->selectionOptions($variant->catalogItem->itemAttributes)
+            ->get($attributeCode);
+
+        if ($selection === null) {
+            return [];
+        }
+
+        return array_is_list($selection) ? $selection : [$selection];
+    }
+
+    private function optionLabel(string $label, string $attributeCode): string
+    {
+        if ($attributeCode !== 'event_date') {
+            return $label;
+        }
+
+        [$day, $month] = array_pad(explode('/', $label), 2, null);
+
+        return $day !== null && $month !== null ? "{$day}/{$month}" : $label;
+    }
+}

app/Domains/Forms/documentacion/README.md

@@ -9,6 +9,7 @@ Provee catálogos y opciones auxiliares para construir formularios del panel adm
 - `EventFormService`: devuelve redes sociales disponibles y las URL configuradas para el tenant.
 - `SaleFormService`: expone los estados admitidos para compras con sus etiquetas de presentación.
 - `StaffFormService`: lista categorías raíz que pueden asignarse al personal del tenant.
+- `TicketFormService`: expone estados y opciones anidadas de categoría, producto y tipo para los tickets de Fiesta Fútbol Infantil.
 
 Cada servicio tiene un controlador invocable y un `JsonResource` específico. `SocialMediaOptionResource` representa las opciones de redes sociales.
 
@@ -19,6 +20,7 @@ Bajo `/v1/adminapp/forms`, con `auth:sanctum` y `adminapp.tenant`:
 - `GET /event`.
 - `GET /sale`.
 - `GET /staff`.
+- `GET /fiesta-futbol-infantil/ticket`: estados y jerarquía categoría → producto → tipo para filtros de tickets.
 - `GET /fiesta-futbol-infantil/merchandise`: opciones de color y talle del tenant para merchandising.
 
 ## Dependencias

app/Domains/Forms/routes/adminapp.php

@@ -5,6 +5,8 @@ use App\Domains\Forms\Controllers\AdminApp\FoodFormController;
 use App\Domains\Forms\Controllers\AdminApp\MerchandiseFormController;
 use App\Domains\Forms\Controllers\AdminApp\SaleFormController;
 use App\Domains\Forms\Controllers\AdminApp\StaffFormController;
+use App\Domains\Forms\Controllers\AdminApp\TicketFilterFormController;
+use App\Domains\Forms\Controllers\AdminApp\TicketFormController;
 use Illuminate\Support\Facades\Route;
 
 Route::prefix('v1/adminapp/forms')
@@ -13,6 +15,13 @@ Route::prefix('v1/adminapp/forms')
         Route::get('event', EventFormController::class);
         Route::get('sale', SaleFormController::class);
         Route::get('staff', StaffFormController::class);
+        Route::get('tickets-filter', TicketFilterFormController::class)
+            ->middleware('tenant.menu:adminapp.tickets')
+            ->name('adminapp.forms.tickets-filter');
+        Route::get(
+            'fiesta-futbol-infantil/ticket',
+            TicketFormController::class
+        );
         Route::get(
             'fiesta-futbol-infantil/merchandise',
             MerchandiseFormController::class

app/Domains/Notification/Services/NotificationMailService.php

@@ -32,13 +32,14 @@ class NotificationMailService
             $tenant = Tenant::query()->with('websiteType')->where('codigo', $tenantCode)->firstOrFail();
             $user = User::query()->findOrFail($userId);
             $brand = $tenant->websiteType ?? $tenant;
+            $tenantUrl = 'https://'.$tenant->dominio.$tenant->base_path;
 
             $this->mailService
                 ->forTenant($tenantCode)
                 ->send(
                     $user->email,
                     "Bienvenido a {$brand->nombre}",
-                    view('mail.notifications.welcome', compact('brand', 'user'))->render(),
+                    view('mail.notifications.welcome', compact('brand', 'user', 'tenantUrl'))->render(),
                     $brand,
                 );
 
@@ -99,12 +100,25 @@ class NotificationMailService
                 : 'https://'.$recoveryDomain.$recoveryBasePath.'/recuperar-contrasena/codigo?'.http_build_query($recoveryQuery);
             $brand = $tenant->websiteType ?? $tenant;
 
+            [$subject, $template] = match ($attempt->reason) {
+                ResetPasswordAttempt::REASON_STAFF_CREATED => [
+                    'Tu cuenta de escáner está lista', 'scanner-created',
+                ],
+                ResetPasswordAttempt::REASON_ADMINISTRATOR_CREATED => [
+                    'Tu cuenta de administrador está lista', 'administrator-created',
+                ],
+                ResetPasswordAttempt::REASON_ACCOUNT_LOCKED => [
+                    'Desbloqueá tu cuenta', 'account-locked',
+                ],
+                default => ['Código para recuperar tu contraseña', 'password-reset'],
+            };
+
             $this->mailService
                 ->forTenant($tenantCode)
                 ->send(
                     $attempt->user->email,
-                    "Código para recuperar tu contraseña - {$brand->nombre}",
+                    "{$subject} - {$brand->nombre}",
-                    view('mail.notifications.password-reset', [
+                    view("mail.notifications.{$template}", [
                         'attempt' => $attempt,
                         'recoveryUrl' => $recoveryUrl,
                         'brand' => $brand,
@@ -138,8 +152,7 @@ class NotificationMailService
             }
 
             /** @var Collection<int, Ticket> $tickets */
-            $tickets = Ticket::query()
+            $tickets = $purchase->tickets()
-                ->where('source_purchase_id', $purchase->getKey())
                 ->where('tenant_code', $purchase->tenant_codigo)
                 ->with(TicketPresentationResolver::RELATIONS)
                 ->get();

app/Domains/Purchase/Models/Purchase.php

@@ -14,6 +14,7 @@ use Illuminate\Database\Eloquent\Factories\HasFactory;
 use Illuminate\Database\Eloquent\Model;
 use Illuminate\Database\Eloquent\Relations\BelongsTo;
 use Illuminate\Database\Eloquent\Relations\HasMany;
+use Illuminate\Database\Eloquent\Relations\HasManyThrough;
 use Illuminate\Database\Eloquent\Relations\HasOne;
 use Illuminate\Support\Facades\DB;
 
@@ -51,6 +52,14 @@ class Purchase extends Model
 
     public const STATUS_SUPERSEDED = 'superseded';
 
+    public const ADMIN_STATUS_INCOMPLETE = 'incomplete';
+
+    public const ADMIN_STATUS_AWAITING_PAYMENT = 'awaiting_payment';
+
+    public const ADMIN_STATUS_CONFIRMED = 'confirmed';
+
+    public const ADMIN_STATUS_CANCELLED = 'cancelled';
+
     /** @return list<string> */
     public static function statuses(): array
     {
@@ -66,6 +75,68 @@ class Purchase extends Model
         ];
     }
 
+    /**
+     * @return array<string, array{name: string, statuses: list<string>}>
+     */
+    public static function adminStatuses(): array
+    {
+        return [
+            self::ADMIN_STATUS_INCOMPLETE => [
+                'name' => 'Por completar datos',
+                'statuses' => [self::STATUS_CREATED],
+            ],
+            self::ADMIN_STATUS_AWAITING_PAYMENT => [
+                'name' => 'Esperando pago',
+                'statuses' => [self::STATUS_PENDING_PAYMENT, self::STATUS_IN_REVIEW],
+            ],
+            self::ADMIN_STATUS_CONFIRMED => [
+                'name' => 'Confirmado',
+                'statuses' => [self::STATUS_PAID],
+            ],
+            self::ADMIN_STATUS_CANCELLED => [
+                'name' => 'Anulado',
+                'statuses' => [
+                    self::STATUS_CANCELLED,
+                    self::STATUS_REJECTED,
+                    self::STATUS_EXPIRED,
+                    self::STATUS_SUPERSEDED,
+                ],
+            ],
+        ];
+    }
+
+    /** @return list<string> */
+    public static function adminStatusCodes(): array
+    {
+        return array_keys(self::adminStatuses());
+    }
+
+    /** @return list<string> */
+    public static function realStatusesForAdminStatus(string $adminStatus): array
+    {
+        return self::adminStatuses()[$adminStatus]['statuses'] ?? [];
+    }
+
+    public static function adminStatusFor(string $realStatus): ?string
+    {
+        foreach (self::adminStatuses() as $adminStatus => $definition) {
+            if (in_array($realStatus, $definition['statuses'], true)) {
+                return $adminStatus;
+            }
+        }
+
+        return null;
+    }
+
+    public static function adminStatusNameFor(string $realStatus): ?string
+    {
+        $adminStatus = self::adminStatusFor($realStatus);
+
+        return $adminStatus === null
+            ? null
+            : self::adminStatuses()[$adminStatus]['name'];
+    }
+
     protected $table = 'compras';
 
     /** @var array<int, string> */
@@ -115,12 +186,15 @@ class Purchase extends Model
         return $this->hasMany(PurchaseItem::class, 'compra_id');
     }
 
-    /**
+    /** @return HasManyThrough<Ticket, PurchaseItem, $this> */
-     * @return HasMany<Ticket, $this>
+    public function tickets(): HasManyThrough
-     */
-    public function tickets(): HasMany
     {
-        return $this->hasMany(Ticket::class, 'source_purchase_id');
+        return $this->hasManyThrough(
+            Ticket::class,
+            PurchaseItem::class,
+            'compra_id',
+            'source_purchase_item_id',
+        );
     }
 
     /** @return BelongsTo<StockReservation, $this> */

app/Domains/Purchase/Models/PurchaseItem.php

@@ -5,10 +5,12 @@ namespace App\Domains\Purchase\Models;
 use App\Domains\Attachable\Models\Attachment;
 use App\Domains\Catalog\Models\CatalogItem;
 use App\Domains\Catalog\Models\Variant;
+use App\Domains\Ticket\Models\Ticket;
 use Illuminate\Database\Eloquent\Attributes\Fillable;
 use Illuminate\Database\Eloquent\Factories\HasFactory;
 use Illuminate\Database\Eloquent\Model;
 use Illuminate\Database\Eloquent\Relations\BelongsTo;
+use Illuminate\Database\Eloquent\Relations\HasMany;
 
 #[Fillable([
     'compra_id',
@@ -56,6 +58,12 @@ class PurchaseItem extends Model
         return $this->belongsTo(Purchase::class, 'compra_id');
     }
 
+    /** @return HasMany<Ticket, $this> */
+    public function tickets(): HasMany
+    {
+        return $this->hasMany(Ticket::class, 'source_purchase_item_id');
+    }
+
     /** @return BelongsTo<Attachment, $this> */
     public function imageAttachment(): BelongsTo
     {

app/Domains/Purchase/Services/Checkout/ReleaseCheckoutService.php

@@ -43,6 +43,11 @@ class ReleaseCheckoutService
         ): Purchase {
             $purchase = $this->lockPurchase($purchase);
 
+            if ($purchase->status === Purchase::STATUS_EXPIRED
+                && $targetStatus === Purchase::STATUS_CANCELLED) {
+                return $this->loadPurchase($purchase);
+            }
+
             if ($purchase->status === Purchase::STATUS_EXPIRED
                 && $targetStatus !== Purchase::STATUS_EXPIRED) {
                 throw new PurchaseExpiredException;
@@ -72,6 +77,14 @@ class ReleaseCheckoutService
 
             $cart = $purchase->cart()->withTrashed()->lockForUpdate()->first();
 
+            // Leaving checkout is allowed at the exact instant the reservation
+            // expires. Finish the expiration while holding the purchase lock so
+            // the request is idempotent with the scheduled expiration job.
+            if ($targetStatus === Purchase::STATUS_CANCELLED
+                && $this->hasOverdueActiveReservation($purchase)) {
+                $targetStatus = Purchase::STATUS_EXPIRED;
+            }
+
             if ($targetStatus === Purchase::STATUS_CANCELLED
                 && $cart?->status === 'active'
                 && in_array($purchase->status, [

app/Domains/Sale/Controllers/AdminApp/SaleController.php

@@ -3,6 +3,7 @@
 namespace App\Domains\Sale\Controllers\AdminApp;
 
 use App\Domains\Sale\Requests\AdminAppSaleIndexRequest;
+use App\Domains\Sale\Requests\AdminAppSaleModificationIndexRequest;
 use App\Domains\Sale\Requests\AdminAppSaleModificationPdfRequest;
 use App\Domains\Sale\Requests\AdminAppSalePdfRequest;
 use App\Domains\Sale\Resources\AdminApp\SaleDetailResource;
@@ -67,11 +68,13 @@ class SaleController extends Controller
         return new SaleResource($this->saleService->cancel($tenant, $sale));
     }
 
-    public function modifications(Request $request): AnonymousResourceCollection
+    public function modifications(
-    {
+        AdminAppSaleModificationIndexRequest $request,
+    ): AnonymousResourceCollection {
         return SaleModificationResource::collection(
             $this->saleService->modifications(
-                $request->user()->tenant()->firstOrFail()
+                $request->user()->tenant()->firstOrFail(),
+                $request->validated(),
             )
         );
     }
@@ -93,7 +96,7 @@ class SaleController extends Controller
 
         return $this->salePdfService->downloadModifications(
             $tenant,
-            $this->saleService->modificationsForExport($tenant),
+            $this->saleService->modificationsForExport($tenant, $request->validated()),
             $request->validated('timezone'),
         );
     }
@@ -116,7 +119,7 @@ class SaleController extends Controller
 
         return $this->saleExcelService->downloadModifications(
             $tenant,
-            $this->saleService->modificationsForExport($tenant),
+            $this->saleService->modificationsForExport($tenant, $request->validated()),
             $request->validated('timezone'),
         );
     }

app/Domains/Sale/Requests/AdminAppSaleIndexRequest.php

@@ -20,7 +20,7 @@ class AdminAppSaleIndexRequest extends FormRequest
             'q' => ['sometimes', 'nullable', 'string', 'max:255'],
             'id' => ['sometimes', 'nullable', 'integer', 'min:1'],
             'sale_date' => ['sometimes', 'nullable', 'date_format:Y-m-d'],
-            'status' => ['sometimes', 'nullable', 'string', Rule::in(Purchase::statuses())],
+            'status' => ['sometimes', 'nullable', 'string', Rule::in(Purchase::adminStatusCodes())],
             'sort_by' => ['sometimes', 'string', 'in:id,date,customer_name,quantity,status,total'],
             'sort_direction' => ['sometimes', 'string', 'in:asc,desc'],
             'page' => ['sometimes', 'integer', 'min:1'],

app/Domains/Sale/Requests/AdminAppSaleModificationIndexRequest.php

@@ -0,0 +1,16 @@
+<?php
+
+namespace App\Domains\Sale\Requests;
+
+class AdminAppSaleModificationIndexRequest extends AdminAppSaleIndexRequest
+{
+    /** @return array<string, list<string>> */
+    public function rules(): array
+    {
+        $rules = parent::rules();
+
+        unset($rules['sort_by'], $rules['sort_direction']);
+
+        return $rules;
+    }
+}

app/Domains/Sale/Requests/AdminAppSaleModificationPdfRequest.php

@@ -3,19 +3,14 @@
 namespace App\Domains\Sale\Requests;
 
 use App\Domains\Shared\Rules\ValidTimezone;
-use Illuminate\Foundation\Http\FormRequest;
 
-class AdminAppSaleModificationPdfRequest extends FormRequest
+class AdminAppSaleModificationPdfRequest extends AdminAppSaleModificationIndexRequest
 {
-    public function authorize(): bool
-    {
-        return true;
-    }
-
     /** @return array<string, list<string>> */
     public function rules(): array
     {
         return [
+            ...parent::rules(),
             'timezone' => ['required', 'string', new ValidTimezone],
         ];
     }

app/Domains/Sale/Resources/AdminApp/SaleModificationResource.php

@@ -23,6 +23,12 @@ class SaleModificationResource extends JsonResource
             'attribute' => $this->attribute,
             'old_value' => $this->old_value,
             'new_value' => $this->new_value,
+            'admin_status' => is_string($this->new_value)
+                ? Purchase::adminStatusFor($this->new_value)
+                : null,
+            'status_label' => is_string($this->new_value)
+                ? Purchase::adminStatusNameFor($this->new_value)
+                : null,
             'changed_at' => $this->changed_at->utc()->toIso8601String(),
             'date' => $this->changed_at->format('Y-m-d'),
             'time' => $this->changed_at->format('H:i:s'),
@@ -31,6 +37,8 @@ class SaleModificationResource extends JsonResource
                 'id' => $sale->id,
                 'customer_name' => $sale->nombre_apellido,
                 'status' => $sale->status,
+                'admin_status' => Purchase::adminStatusFor($sale->status),
+                'status_label' => Purchase::adminStatusNameFor($sale->status),
             ] : null,
             'modified_by' => $user ? [
                 'id' => $user->id,

app/Domains/Sale/Resources/AdminApp/SaleResource.php

@@ -20,6 +20,8 @@ class SaleResource extends JsonResource
             'customer_name' => $this->nombre_apellido,
             'quantity' => (int) ($this->quantity ?? 0),
             'status' => $this->status,
+            'admin_status' => Purchase::adminStatusFor($this->status),
+            'status_label' => Purchase::adminStatusNameFor($this->status),
             'total' => number_format((float) $this->total, 2, '.', ''),
             'tickets_count' => $ticketsCount,
             'has_generated_tickets' => $ticketsCount > 0,

app/Domains/Sale/Services/AdminAppSaleExcelService.php

@@ -201,11 +201,6 @@ class AdminAppSaleExcelService
 
     private function saleStatus(string $status): string
     {
-        return match ($status) {
+        return Purchase::adminStatusNameFor($status) ?? $status;
-            Purchase::STATUS_PAID => 'Confirmado',
-            Purchase::STATUS_CREATED => 'Por completar datos',
-            Purchase::STATUS_PENDING_PAYMENT, Purchase::STATUS_IN_REVIEW => 'Esperando pago',
-            default => 'Anulado',
-        };
     }
 }

app/Domains/Sale/Services/AdminAppSaleService.php

@@ -92,18 +92,24 @@ class AdminAppSaleService
         return $this->salesQuery($tenant, $filters)->get();
     }
 
-    /** @return LengthAwarePaginator<ValueChange> */
+    /**
-    public function modifications(Tenant $tenant): LengthAwarePaginator
+     * @param  array<string, mixed>  $filters
+     * @return LengthAwarePaginator<ValueChange>
+     */
+    public function modifications(Tenant $tenant, array $filters = []): LengthAwarePaginator
     {
-        return $this->modificationsQuery($tenant)
+        return $this->modificationsQuery($tenant, $filters)
             ->paginateFromRequest()
             ->withQueryString();
     }
 
-    /** @return Collection<int, ValueChange> */
+    /**
-    public function modificationsForExport(Tenant $tenant): Collection
+     * @param  array<string, mixed>  $filters
+     * @return Collection<int, ValueChange>
+     */
+    public function modificationsForExport(Tenant $tenant, array $filters = []): Collection
     {
-        return $this->modificationsQuery($tenant)->get();
+        return $this->modificationsQuery($tenant, $filters)->get();
     }
 
     /** @param array<string, mixed> $filters */
@@ -126,7 +132,6 @@ class AdminAppSaleService
 
         return Purchase::query()
             ->where('tenant_codigo', $tenant->codigo)
-            ->where('status', '!=', Purchase::STATUS_SUPERSEDED)
             ->when($filters['q'] ?? null, function (Builder $query, string $search): void {
                 $term = trim($search);
 
@@ -144,12 +149,10 @@ class AdminAppSaleService
             )
             ->when(
                 $filters['status'] ?? null,
-                fn (Builder $query, string $status): Builder => $status === Purchase::STATUS_PENDING_PAYMENT
+                fn (Builder $query, string $status): Builder => $query->whereIn(
-                    ? $query->whereIn('status', [
+                    'status',
-                        Purchase::STATUS_PENDING_PAYMENT,
+                    Purchase::realStatusesForAdminStatus($status),
-                        Purchase::STATUS_IN_REVIEW,
+                )
-                    ])
-                    : $query->where('status', $status)
             )
             ->select('compras.*')
             ->selectRaw(
@@ -162,12 +165,50 @@ class AdminAppSaleService
             ->when($sortBy !== 'id', fn (Builder $query): Builder => $query->orderByDesc('id'));
     }
 
-    /** @return Builder<ValueChange> */
+    /**
-    protected function modificationsQuery(Tenant $tenant): Builder
+     * @param  array<string, mixed>  $filters
+     * @return Builder<ValueChange>
+     */
+    protected function modificationsQuery(Tenant $tenant, array $filters): Builder
     {
         return ValueChange::query()
             ->where('tenant_code', $tenant->codigo)
             ->where('trackable_type', (new Purchase)->getMorphClass())
+            ->when($filters['q'] ?? null, function (Builder $query, string $search): void {
+                $term = trim($search);
+
+                $query->where(function (Builder $query) use ($term): void {
+                    $query
+                        ->where('trackable_id', 'like', "%{$term}%")
+                        ->orWhereHasMorph(
+                            'trackable',
+                            [Purchase::class],
+                            function (Builder $sales) use ($term): void {
+                                $sales
+                                    ->where('nombre_apellido', 'like', "%{$term}%")
+                                    ->orWhere('created_at', 'like', "%{$term}%");
+                            },
+                        );
+                });
+            })
+            ->when(
+                $filters['id'] ?? null,
+                fn (Builder $query, int $id): Builder => $query->where('trackable_id', $id)
+            )
+            ->when(
+                $filters['sale_date'] ?? null,
+                fn (Builder $query, string $date): Builder => $query->whereHasMorph(
+                    'trackable',
+                    [Purchase::class],
+                    fn (Builder $sales): Builder => $sales->whereDate('created_at', $date),
+                )
+            )
+            ->when(
+                $filters['status'] ?? null,
+                fn (Builder $query, string $status): Builder => $query
+                    ->where('attribute', 'status')
+                    ->whereIn('new_value', Purchase::realStatusesForAdminStatus($status))
+            )
             ->with(['trackable', 'user'])
             ->orderByDesc('changed_at')
             ->orderByDesc('id');

app/Domains/Sale/documentacion/README.md

@@ -9,7 +9,8 @@ Provee consultas administrativas y exportaciones de ventas confirmadas, además
 - `AdminAppSaleService`: pagina ventas, calcula totales y obtiene colecciones para exportación; también consulta modificaciones.
 - `AdminAppSalePdfService`: genera descargas PDF de ventas y de cambios.
 - `AdminAppSaleExcelService`: genera descargas Excel de ventas y de cambios.
-- `AdminAppSaleIndexRequest`: valida filtros del listado y la exportación.
+- `AdminAppSaleIndexRequest`: valida filtros del listado y la exportación de ventas.
+- `AdminAppSaleModificationIndexRequest`: valida los filtros compartidos por el historial y sus exportaciones.
 - `SaleResource` y `SaleModificationResource`: representan ventas e historial para AdminApp.
 - `SaleController`: entrada HTTP del panel.
 
@@ -27,3 +28,5 @@ Consume compras de `Purchase`, datos del tenant y entradas de `Logging`. No es d
 ## Consideraciones
 
 La consulta paginada y la colección de exportación deben aplicar los mismos filtros para evitar diferencias entre pantalla, PDF y Excel.
+
+El historial comparte con ventas los filtros de búsqueda, ID, fecha de venta y estado. En el historial, el estado se evalúa sobre `ValueChange.new_value`: representa el resultado de esa modificación y no el estado actual de la venta.

app/Domains/Staff/Requests/StoreStaffRequest.php

@@ -2,6 +2,7 @@
 
 namespace App\Domains\Staff\Requests;
 
+use App\Domains\Authorization\Enums\RoleCode;
 use Illuminate\Foundation\Http\FormRequest;
 use Illuminate\Validation\Rule;
 
@@ -12,6 +13,13 @@ class StoreStaffRequest extends FormRequest
         return true;
     }
 
+    protected function prepareForValidation(): void
+    {
+        if (is_string($this->input('email'))) {
+            $this->merge(['email' => mb_strtolower(trim($this->input('email')))]);
+        }
+    }
+
     /** @return array<string, mixed> */
     public function rules(): array
     {
@@ -23,7 +31,12 @@ class StoreStaffRequest extends FormRequest
         return [
             'nombre_apellido' => ['required', 'string', 'max:255'],
             'dni' => ['required', 'string', 'max:50'],
-            'email' => ['required', 'email', 'max:255', 'unique:users,email'],
+            'email' => [
+                'required',
+                'email',
+                'max:255',
+                Rule::unique('users', 'active_email')->where('rol_codigo', RoleCode::Scanner->value)->whereNull('deleted_at'),
+            ],
             'category_ids' => $categoryRules,
             'category_ids.*' => ['integer', 'distinct', Rule::exists('categorias', 'id')],
         ];

app/Domains/Staff/Requests/UpdateStaffRequest.php

@@ -2,6 +2,7 @@
 
 namespace App\Domains\Staff\Requests;
 
+use App\Domains\Authorization\Enums\RoleCode;
 use Illuminate\Foundation\Http\FormRequest;
 use Illuminate\Validation\Rule;
 
@@ -12,6 +13,13 @@ class UpdateStaffRequest extends FormRequest
         return true;
     }
 
+    protected function prepareForValidation(): void
+    {
+        if (is_string($this->input('email'))) {
+            $this->merge(['email' => mb_strtolower(trim($this->input('email')))]);
+        }
+    }
+
     /** @return array<string, mixed> */
     public function rules(): array
     {
@@ -28,7 +36,9 @@ class UpdateStaffRequest extends FormRequest
                 'required',
                 'email',
                 'max:255',
-                Rule::unique('users', 'email')->ignore($staffId),
+                Rule::unique('users', 'active_email')->where('rol_codigo', RoleCode::Scanner->value)
+                    ->whereNull('deleted_at')
+                    ->ignore($staffId),
             ],
             'category_ids' => $categoryRules,
             'category_ids.*' => ['integer', 'distinct', Rule::exists('categorias', 'id')],

app/Domains/Staff/Services/StaffService.php

@@ -94,7 +94,12 @@ class StaffService
 
     public function delete(Tenant $tenant, int $staffId): void
     {
-        $this->find($tenant, $staffId)->delete();
+        $staff = $this->find($tenant, $staffId);
+
+        DB::transaction(function () use ($staff): void {
+            $staff->tokens()->delete();
+            $staff->delete();
+        });
     }
 
     public function find(Tenant $tenant, int $staffId): User

app/Domains/Ticket/Controllers/AdminApp/TicketController.php

@@ -0,0 +1,53 @@
+<?php
+
+namespace App\Domains\Ticket\Controllers\AdminApp;
+
+use App\Domains\Ticket\Requests\AdminAppTicketExportRequest;
+use App\Domains\Ticket\Requests\AdminAppTicketIndexRequest;
+use App\Domains\Ticket\Resources\AdminApp\AdminAppTicketCollection;
+use App\Domains\Ticket\Services\AdminAppTicketExcelService;
+use App\Domains\Ticket\Services\AdminAppTicketPdfService;
+use App\Domains\Ticket\Services\AdminAppTicketService;
+use App\Http\Controllers\Controller;
+use Illuminate\Http\Response;
+use Symfony\Component\HttpFoundation\StreamedResponse;
+
+class TicketController extends Controller
+{
+    public function __construct(
+        private readonly AdminAppTicketService $ticketService,
+        private readonly AdminAppTicketPdfService $ticketPdfService,
+        private readonly AdminAppTicketExcelService $ticketExcelService,
+    ) {}
+
+    public function index(AdminAppTicketIndexRequest $request): AdminAppTicketCollection
+    {
+        $tenant = $request->user()->tenant()->firstOrFail();
+
+        return new AdminAppTicketCollection(
+            $this->ticketService->search($tenant, $request->validated())
+        );
+    }
+
+    public function downloadPdf(AdminAppTicketExportRequest $request): Response
+    {
+        $tenant = $request->user()->tenant()->firstOrFail();
+
+        return $this->ticketPdfService->download(
+            $tenant,
+            $this->ticketService->ticketsForExport($tenant, $request->validated()),
+            $request->validated('timezone'),
+        );
+    }
+
+    public function downloadExcel(AdminAppTicketExportRequest $request): StreamedResponse
+    {
+        $tenant = $request->user()->tenant()->firstOrFail();
+
+        return $this->ticketExcelService->download(
+            $tenant,
+            $this->ticketService->ticketsForExport($tenant, $request->validated()),
+            $request->validated('timezone'),
+        );
+    }
+}

app/Domains/Ticket/Listeners/GenerateTicketsForPaidPurchase.php

@@ -42,7 +42,7 @@ class GenerateTicketsForPaidPurchase
                 $user,
                 $purchaseItem->cantidad,
                 $purchaseItem->source_variant_id,
-                $purchase->getKey(),
+                $purchaseItem->getKey(),
             );
         }
     }

app/Domains/Ticket/Models/Ticket.php

@@ -5,7 +5,7 @@ namespace App\Domains\Ticket\Models;
 use App\Domains\Auth\Models\User;
 use App\Domains\Catalog\Models\CatalogItem;
 use App\Domains\Catalog\Models\Variant;
-use App\Domains\Purchase\Models\Purchase;
+use App\Domains\Purchase\Models\PurchaseItem;
 use App\Domains\Tenant\Models\Tenant;
 use App\Domains\Ticket\Services\ResolvedTicketValidity;
 use App\Domains\Ticket\Services\ResolvedValidityGroup;
@@ -21,7 +21,7 @@ use Illuminate\Support\Collection;
 #[Fillable([
     'tenant_code',
     'ticket',
-    'source_purchase_id',
+    'source_purchase_item_id',
     'source_catalog_item_id',
     'source_variant_id',
     'used_at',
@@ -56,7 +56,7 @@ class Ticket extends Model
         return [
             'source_catalog_item_id' => 'integer',
             'source_variant_id' => 'integer',
-            'source_purchase_id' => 'integer',
+            'source_purchase_item_id' => 'integer',
             'used_at' => 'datetime',
             'scanner_user_id' => 'integer',
             'user_id' => 'integer',
@@ -78,13 +78,13 @@ class Ticket extends Model
     /** @return BelongsTo<User, $this> */
     public function scannerUser(): BelongsTo
     {
-        return $this->belongsTo(User::class, 'scanner_user_id');
+        return $this->belongsTo(User::class, 'scanner_user_id')->withTrashed();
     }
 
-    /** @return BelongsTo<Purchase, $this> */
+    /** @return BelongsTo<PurchaseItem, $this> */
-    public function sourcePurchase(): BelongsTo
+    public function sourcePurchaseItem(): BelongsTo
     {
-        return $this->belongsTo(Purchase::class, 'source_purchase_id');
+        return $this->belongsTo(PurchaseItem::class, 'source_purchase_item_id');
     }
 
     /** @return BelongsTo<CatalogItem, $this> */

app/Domains/Ticket/Requests/AdminAppTicketExportRequest.php

@@ -0,0 +1,17 @@
+<?php
+
+namespace App\Domains\Ticket\Requests;
+
+use App\Domains\Shared\Rules\ValidTimezone;
+
+class AdminAppTicketExportRequest extends AdminAppTicketIndexRequest
+{
+    /** @return array<string, mixed> */
+    public function rules(): array
+    {
+        return [
+            ...parent::rules(),
+            'timezone' => ['required', 'string', new ValidTimezone],
+        ];
+    }
+}

app/Domains/Ticket/Requests/AdminAppTicketIndexRequest.php

@@ -0,0 +1,47 @@
+<?php
+
+namespace App\Domains\Ticket\Requests;
+
+use App\Domains\Ticket\Models\Ticket;
+use App\Domains\Ticket\Services\AdminAppTicketColumnService;
+use Illuminate\Foundation\Http\FormRequest;
+use Illuminate\Validation\Rule;
+
+class AdminAppTicketIndexRequest extends FormRequest
+{
+    public function authorize(): bool
+    {
+        return true;
+    }
+
+    /** @return array<string, list<string>> */
+    public function rules(): array
+    {
+        $tenant = $this->user()?->tenant()->first();
+        $sortableKeys = $tenant === null
+            ? []
+            : app(AdminAppTicketColumnService::class)->sortableKeys($tenant);
+
+        return [
+            'q' => ['sometimes', 'nullable', 'string', 'max:255'],
+            'category' => ['sometimes', 'nullable', 'string', 'max:255'],
+            'product' => ['sometimes', 'nullable', 'string', 'max:255'],
+            'type' => ['sometimes', 'nullable', 'string', 'max:255'],
+            'date' => ['sometimes', 'nullable', 'date_format:Y-m-d'],
+            'size' => ['sometimes', 'nullable', 'string', 'max:255'],
+            'status' => [
+                'sometimes',
+                'nullable',
+                Rule::in([
+                    Ticket::STATUS_ACTIVE,
+                    Ticket::STATUS_USED,
+                    Ticket::STATUS_EXPIRED,
+                ]),
+            ],
+            'page' => ['sometimes', 'integer', 'min:1'],
+            'per_page' => ['sometimes', 'integer', 'min:1', 'max:100'],
+            'sort_by' => ['sometimes', 'nullable', 'string', Rule::in($sortableKeys)],
+            'sort_direction' => ['sometimes', 'nullable', 'string', Rule::in(['asc', 'desc'])],
+        ];
+    }
+}

app/Domains/Ticket/Resources/AdminApp/AdminAppTicketCollection.php

@@ -0,0 +1,34 @@
+<?php
+
+namespace App\Domains\Ticket\Resources\AdminApp;
+
+use App\Domains\Ticket\Services\AdminAppTicketResult;
+use Illuminate\Http\Request;
+use Illuminate\Http\Resources\Json\ResourceCollection;
+
+class AdminAppTicketCollection extends ResourceCollection
+{
+    /** @var class-string<AdminAppTicketResource> */
+    public $collects = AdminAppTicketResource::class;
+
+    private readonly int $scannedTickets;
+
+    private readonly int $totalTickets;
+
+    public function __construct(AdminAppTicketResult $result)
+    {
+        parent::__construct($result->tickets);
+
+        $this->scannedTickets = $result->scannedTickets;
+        $this->totalTickets = $result->totalTickets;
+    }
+
+    /** @return array{scanned_tickets: int, total_tickets: int} */
+    public function with(Request $request): array
+    {
+        return [
+            'scanned_tickets' => $this->scannedTickets,
+            'total_tickets' => $this->totalTickets,
+        ];
+    }
+}

app/Domains/Ticket/Resources/AdminApp/AdminAppTicketResource.php

@@ -0,0 +1,25 @@
+<?php
+
+namespace App\Domains\Ticket\Resources\AdminApp;
+
+use App\Domains\Ticket\Models\Ticket;
+use App\Domains\Ticket\Resources\TicketResource;
+use App\Domains\Ticket\Services\AdminAppTicketRowService;
+use Illuminate\Http\Request;
+
+/** @mixin Ticket */
+class AdminAppTicketResource extends TicketResource
+{
+    /** @return array<string, mixed> */
+    public function toArray(Request $request): array
+    {
+        $rowService = app(AdminAppTicketRowService::class);
+        $details = $rowService->details($this->resource);
+
+        return [
+            ...parent::toArray($request),
+            ...$details,
+            'values' => $rowService->values($this->resource, $details),
+        ];
+    }
+}

app/Domains/Ticket/Services/AdminAppTicketColumnService.php

@@ -0,0 +1,103 @@
+<?php
+
+namespace App\Domains\Ticket\Services;
+
+use App\Domains\Tenant\Models\Tenant;
+
+class AdminAppTicketColumnService
+{
+    private const FIESTA_FUTBOL_INFANTIL = 'fiesta_futbol_infantil';
+
+    /** @return list<array{key: string, label: string, type: string, sortable: bool, sort_param: string, width: string, excel_width: int}> */
+    public function columns(Tenant $tenant): array
+    {
+        $keys = $tenant->codigo === self::FIESTA_FUTBOL_INFANTIL
+            ? ['order_number', 'category', 'product', 'type', 'date', 'size', 'amount', 'client', 'id', 'status', 'scanned_by']
+            : ['order_number', 'product', 'amount', 'client', 'id', 'status', 'scanned_by'];
+
+        $columns = array_map(fn (string $key): array => $this->definitions()[$key], $keys);
+
+        if ($tenant->codigo === self::FIESTA_FUTBOL_INFANTIL) {
+            $columns = array_map(function (array $column): array {
+                if (in_array($column['key'], ['product', 'type', 'date', 'size'], true)) {
+                    $column['sortable'] = false;
+                }
+
+                return $column;
+            }, $columns);
+        } else {
+            $widths = [
+                'order_number' => '11%',
+                'product' => '15%',
+                'amount' => '10%',
+                'client' => '15%',
+                'id' => '8%',
+                'status' => '8%',
+                'scanned_by' => '11%',
+            ];
+            $columns = array_map(function (array $column) use ($widths): array {
+                $column['width'] = $widths[$column['key']];
+
+                return $column;
+            }, $columns);
+        }
+
+        return $columns;
+    }
+
+    /** @return list<array{key: string, label: string, type: string, sortable: bool, sort_param: string, width: string}> */
+    public function publicColumns(Tenant $tenant): array
+    {
+        return array_map(function (array $column): array {
+            unset($column['excel_width']);
+
+            return $column;
+        }, $this->columns($tenant));
+    }
+
+    /** @return list<string> */
+    public function sortableKeys(Tenant $tenant): array
+    {
+        return array_values(array_map(
+            fn (array $column): string => $column['sort_param'],
+            array_filter($this->columns($tenant), fn (array $column): bool => $column['sortable']),
+        ));
+    }
+
+    /** @return array<string, array{key: string, label: string, type: string, sortable: bool, sort_param: string, width: string, excel_width: int}> */
+    private function definitions(): array
+    {
+        return [
+            'order_number' => $this->column('order_number', 'N° de orden', 'order_number', '10.5%', 14),
+            'category' => $this->column('category', 'Categoría', 'text', '11%', 18),
+            'product' => $this->column('product', 'Producto', 'text', '11%', 22),
+            'type' => $this->column('type', 'Tipo', 'text', '8%', 18),
+            'date' => $this->column('date', 'Fecha', 'text', '7%', 14),
+            'size' => $this->column('size', 'Talle', 'text', '6%', 12),
+            'amount' => $this->column('amount', 'Importe', 'currency', '8%', 15),
+            'client' => $this->column('client', 'Cliente', 'text', '11%', 30),
+            'id' => $this->column('id', 'ID', 'text', '6%', 12),
+            'status' => $this->column('status', 'Estado', 'status', '7%', 13),
+            'scanned_by' => $this->column('scanned_by', 'Escaneado por', 'text', '8%', 28),
+        ];
+    }
+
+    /** @return array{key: string, label: string, type: string, sortable: bool, sort_param: string, width: string, excel_width: int} */
+    private function column(
+        string $key,
+        string $label,
+        string $type,
+        string $width,
+        int $excelWidth,
+    ): array {
+        return [
+            'key' => $key,
+            'label' => $label,
+            'type' => $type,
+            'sortable' => true,
+            'sort_param' => $key,
+            'width' => $width,
+            'excel_width' => $excelWidth,
+        ];
+    }
+}

app/Domains/Ticket/Services/AdminAppTicketExcelService.php

@@ -0,0 +1,105 @@
+<?php
+
+namespace App\Domains\Ticket\Services;
+
+use App\Domains\Tenant\Models\Tenant;
+use App\Domains\Ticket\Models\Ticket;
+use Carbon\CarbonInterface;
+use Illuminate\Support\Collection;
+use PhpOffice\PhpSpreadsheet\Cell\Coordinate;
+use PhpOffice\PhpSpreadsheet\Cell\DataType;
+use PhpOffice\PhpSpreadsheet\Shared\Date;
+use PhpOffice\PhpSpreadsheet\Spreadsheet;
+use PhpOffice\PhpSpreadsheet\Style\Alignment;
+use PhpOffice\PhpSpreadsheet\Style\Fill;
+use PhpOffice\PhpSpreadsheet\Writer\Xlsx;
+use Symfony\Component\HttpFoundation\StreamedResponse;
+
+class AdminAppTicketExcelService
+{
+    public function __construct(
+        private readonly AdminAppTicketReportService $reportService,
+        private readonly AdminAppTicketColumnService $columnService,
+    ) {}
+
+    /** @param Collection<int, Ticket> $tickets */
+    public function download(Tenant $tenant, Collection $tickets, string $timeZone): StreamedResponse
+    {
+        $generatedAt = now();
+        $rows = $this->reportService->rows($tickets);
+        $columns = $this->columnService->columns($tenant);
+        $spreadsheet = new Spreadsheet;
+        $spreadsheet->getProperties()
+            ->setCreator('Shopit')
+            ->setTitle('Listado de tickets')
+            ->setSubject($tenant->nombre);
+        $sheet = $spreadsheet->getActiveSheet();
+        $sheet->setTitle('Tickets');
+        $sheet->fromArray([array_column($columns, 'label')], null, 'A1');
+
+        foreach ($rows as $index => $ticket) {
+            $row = $index + 2;
+            foreach ($columns as $columnIndex => $column) {
+                $coordinate = Coordinate::stringFromColumnIndex($columnIndex + 1).$row;
+                $value = $ticket[$column['key']] ?? null;
+
+                if ($column['type'] === 'currency' && $value !== null) {
+                    $sheet->setCellValue($coordinate, (float) $value);
+
+                    continue;
+                }
+
+                if ($column['type'] === 'date' && $value instanceof CarbonInterface) {
+                    $sheet->setCellValue(
+                        $coordinate,
+                        Date::dateTimeToExcel($value->copy()->timezone($timeZone)),
+                    );
+
+                    continue;
+                }
+
+                $sheet->setCellValueExplicit(
+                    $coordinate,
+                    $this->reportService->displayValue($value, $column['type'], $timeZone),
+                    DataType::TYPE_STRING,
+                );
+            }
+        }
+
+        $lastRow = max(2, $rows->count() + 1);
+        $lastColumn = Coordinate::stringFromColumnIndex(count($columns));
+        foreach ($columns as $columnIndex => $column) {
+            $letter = Coordinate::stringFromColumnIndex($columnIndex + 1);
+            if ($column['type'] === 'currency') {
+                $sheet->getStyle("{$letter}2:{$letter}{$lastRow}")
+                    ->getNumberFormat()->setFormatCode('$ #,##0.00');
+            }
+            if ($column['type'] === 'date') {
+                $sheet->getStyle("{$letter}2:{$letter}{$lastRow}")
+                    ->getNumberFormat()->setFormatCode('dd/mm/yyyy hh:mm');
+            }
+            $sheet->getColumnDimension($letter)->setWidth($column['excel_width']);
+        }
+        $sheet->getStyle("A1:{$lastColumn}1")->applyFromArray([
+            'font' => ['bold' => true, 'color' => ['rgb' => 'FFFFFF']],
+            'fill' => [
+                'fillType' => Fill::FILL_SOLID,
+                'startColor' => ['rgb' => '26382E'],
+            ],
+            'alignment' => ['vertical' => Alignment::VERTICAL_CENTER],
+        ]);
+        $sheet->getRowDimension(1)->setRowHeight(24);
+        $sheet->freezePane('A2');
+        $sheet->setAutoFilter("A1:{$lastColumn}{$lastRow}");
+
+        $filename = 'tickets_'.$tenant->codigo.'_'
+            .$generatedAt->copy()->timezone($timeZone)->format('Ymd_His').'.xlsx';
+
+        return response()->streamDownload(function () use ($spreadsheet): void {
+            (new Xlsx($spreadsheet))->save('php://output');
+            $spreadsheet->disconnectWorksheets();
+        }, $filename, [
+            'Content-Type' => 'application/vnd.openxmlformats-officedocument.spreadsheetml.sheet',
+        ]);
+    }
+}

app/Domains/Ticket/Services/AdminAppTicketPdfService.php

@@ -0,0 +1,56 @@
+<?php
+
+namespace App\Domains\Ticket\Services;
+
+use App\Domains\Tenant\Models\Tenant;
+use App\Domains\Ticket\Models\Ticket;
+use Barryvdh\DomPDF\Facade\Pdf;
+use Barryvdh\DomPDF\PDF as DomPdf;
+use Illuminate\Http\Response;
+use Illuminate\Support\Collection;
+
+class AdminAppTicketPdfService
+{
+    public function __construct(
+        private readonly AdminAppTicketReportService $reportService,
+        private readonly AdminAppTicketColumnService $columnService,
+    ) {}
+
+    /** @param Collection<int, Ticket> $tickets */
+    public function download(Tenant $tenant, Collection $tickets, string $timeZone): Response
+    {
+        $generatedAt = now();
+        $columns = $this->columnService->columns($tenant);
+        $rows = $this->reportService->rows($tickets);
+        $pdf = Pdf::loadView('pdf.adminapp.tickets', [
+            'tenant' => $tenant,
+            'columns' => $columns,
+            'tickets' => $this->reportService->displayRows($rows, $columns, $timeZone),
+            'generatedAt' => $generatedAt,
+            'timeZone' => $timeZone,
+        ])->setPaper('a3', 'landscape');
+
+        $this->addPageNumbers($pdf);
+
+        return $pdf->download(
+            'tickets_'.$tenant->codigo.'_'
+            .$generatedAt->copy()->timezone($timeZone)->format('Ymd_His').'.pdf'
+        );
+    }
+
+    private function addPageNumbers(DomPdf $pdf): void
+    {
+        $pdf->render();
+        $domPdf = $pdf->getDomPDF();
+        $font = $domPdf->getFontMetrics()->getFont('DejaVu Sans');
+
+        $domPdf->getCanvas()->page_text(
+            565,
+            805,
+            'Página {PAGE_NUM} de {PAGE_COUNT}',
+            $font,
+            7,
+            [0.48, 0.52, 0.49],
+        );
+    }
+}

app/Domains/Ticket/Services/AdminAppTicketReportService.php

@@ -0,0 +1,35 @@
+<?php
+
+namespace App\Domains\Ticket\Services;
+
+use App\Domains\Ticket\Models\Ticket;
+use Illuminate\Support\Collection;
+
+class AdminAppTicketReportService
+{
+    public function __construct(private readonly AdminAppTicketRowService $rowService) {}
+
+    /**
+     * @param  Collection<int, Ticket>  $tickets
+     * @return Collection<int, array<string, mixed>>
+     */
+    public function rows(Collection $tickets): Collection
+    {
+        return $this->rowService->rows($tickets);
+    }
+
+    /**
+     * @param  Collection<int, array<string, mixed>>  $rows
+     * @param  list<array<string, mixed>>  $columns
+     * @return Collection<int, array<string, string>>
+     */
+    public function displayRows(Collection $rows, array $columns, string $timeZone): Collection
+    {
+        return $this->rowService->displayRows($rows, $columns, $timeZone);
+    }
+
+    public function displayValue(mixed $value, string $type, string $timeZone): string
+    {
+        return $this->rowService->displayValue($value, $type, $timeZone);
+    }
+}

app/Domains/Ticket/Services/AdminAppTicketResult.php

@@ -0,0 +1,16 @@
+<?php
+
+namespace App\Domains\Ticket\Services;
+
+use App\Domains\Ticket\Models\Ticket;
+use Illuminate\Pagination\LengthAwarePaginator;
+
+final readonly class AdminAppTicketResult
+{
+    /** @param LengthAwarePaginator<Ticket> $tickets */
+    public function __construct(
+        public LengthAwarePaginator $tickets,
+        public int $scannedTickets,
+        public int $totalTickets,
+    ) {}
+}

app/Domains/Ticket/Services/AdminAppTicketRowService.php

@@ -0,0 +1,210 @@
+<?php
+
+namespace App\Domains\Ticket\Services;
+
+use App\Domains\Catalog\Models\ItemAttribute;
+use App\Domains\Ticket\Models\Ticket;
+use Illuminate\Support\Collection;
+
+class AdminAppTicketRowService
+{
+    private const FIESTA_FUTBOL_INFANTIL = 'fiesta_futbol_infantil';
+
+    private const CATEGORY_PRESENTATIONS = [
+        'alojamientos' => ['category' => 'Camping', 'product' => 'tipo_alojamiento', 'type' => null, 'date' => null, 'size' => null],
+        'camping' => ['category' => null, 'product' => 'tipo_alojamiento', 'type' => null, 'date' => null, 'size' => null],
+        'entradas' => ['category' => null, 'product' => 'product', 'type' => null, 'date' => null, 'size' => null],
+        'comidas' => ['category' => 'Comida', 'product' => 'horario', 'type' => 'servicio', 'date' => 'event_date', 'size' => null],
+        'comida' => ['category' => null, 'product' => 'horario', 'type' => 'servicio', 'date' => 'event_date', 'size' => null],
+        'merchandising' => ['category' => null, 'product' => 'product', 'type' => 'color', 'date' => null, 'size' => 'talle'],
+    ];
+
+    /** @return array<string, mixed> */
+    public function details(Ticket $ticket): array
+    {
+        $purchaseItem = $ticket->sourcePurchaseItem;
+
+        return [
+            'source_purchase_item_id' => $ticket->source_purchase_item_id,
+            'order_number' => $purchaseItem?->compra_id,
+            'product' => $purchaseItem?->item_nombre
+                ?? $ticket->sourceCatalogItem?->nombre
+                ?? $ticket->name,
+            'amount' => $purchaseItem?->precio_unitario,
+            'client' => $purchaseItem?->purchase?->nombre_apellido ?? $ticket->user?->nombre_apellido,
+            'status' => $ticket->status,
+            'scanned_by' => $ticket->scannerUser?->nombre_apellido,
+            'variant_properties' => $this->variantProperties($ticket),
+        ];
+    }
+
+    /** @param array<string, mixed>|null $details */
+    public function values(Ticket $ticket, ?array $details = null): array
+    {
+        $details ??= $this->details($ticket);
+        $presentation = $this->presentation($ticket, $details);
+
+        return [
+            'order_number' => $details['order_number'],
+            'category' => $presentation['category'],
+            'product' => $presentation['product'],
+            'type' => $presentation['type'],
+            'date' => $presentation['date'],
+            'size' => $presentation['size'],
+            'amount' => $details['amount'] === null ? null : (float) $details['amount'],
+            'client' => $details['client'] ?? 'Sin nombre',
+            'id' => $ticket->id,
+            'status' => $details['status'],
+            'scanned_by' => $details['scanned_by'] ?? '-',
+        ];
+    }
+
+    /**
+     * @param  Collection<int, Ticket>  $tickets
+     * @return Collection<int, array<string, mixed>>
+     */
+    public function rows(Collection $tickets): Collection
+    {
+        return $tickets->values()->map(fn (Ticket $ticket): array => $this->values($ticket));
+    }
+
+    /**
+     * @param  Collection<int, array<string, mixed>>  $rows
+     * @param  list<array<string, mixed>>  $columns
+     * @return Collection<int, array<string, string>>
+     */
+    public function displayRows(Collection $rows, array $columns, string $timeZone): Collection
+    {
+        return $rows->map(fn (array $row): array => collect($columns)
+            ->mapWithKeys(fn (array $column): array => [
+                $column['key'] => $this->displayValue(
+                    $row[$column['key']] ?? null,
+                    $column['type'],
+                    $timeZone,
+                ),
+            ])
+            ->all());
+    }
+
+    public function displayValue(mixed $value, string $type, string $timeZone): string
+    {
+        if ($value === null || $value === '') {
+            return '-';
+        }
+
+        return match ($type) {
+            'order_number' => '#'.$value,
+            'currency' => '$'.number_format((float) $value, 2, ',', '.'),
+            'status' => match ((string) $value) {
+                Ticket::STATUS_USED => 'Usado',
+                Ticket::STATUS_EXPIRED => 'Vencido',
+                default => 'Activo',
+            },
+            default => (string) $value,
+        };
+    }
+
+    /** @param array<string, mixed> $details */
+    private function presentation(Ticket $ticket, array $details): array
+    {
+        $sourceCategory = trim((string) ($ticket->sourceCatalogItem?->category?->nombre ?? '')) ?: '-';
+
+        if ($ticket->tenant_code !== self::FIESTA_FUTBOL_INFANTIL) {
+            return [
+                'category' => $sourceCategory,
+                'product' => (string) ($details['product'] ?: $ticket->name ?: '-'),
+                'type' => $this->allPropertyLabels($details) ?: '-',
+                'date' => '-',
+                'size' => '-',
+            ];
+        }
+
+        $configuration = self::CATEGORY_PRESENTATIONS[mb_strtolower($sourceCategory)] ?? null;
+        if ($configuration === null) {
+            return [
+                'category' => $sourceCategory,
+                'product' => (string) ($details['product'] ?: $ticket->name ?: '-'),
+                'type' => $this->allPropertyLabels($details) ?: '-',
+                'date' => '-',
+                'size' => '-',
+            ];
+        }
+
+        return [
+            'category' => $configuration['category'] ?? $sourceCategory,
+            'product' => $configuration['product'] === 'product'
+                ? (string) ($details['product'] ?: $ticket->name ?: '-')
+                : ($this->propertyLabels($details, $configuration['product']) ?: '-'),
+            'type' => $configuration['type'] === null
+                ? '-'
+                : ($this->propertyLabels($details, $configuration['type']) ?: '-'),
+            'date' => $configuration['date'] === null
+                ? '-'
+                : ($this->propertyLabels($details, $configuration['date']) ?: '-'),
+            'size' => $configuration['size'] === null
+                ? '-'
+                : ($this->propertyLabels($details, $configuration['size']) ?: '-'),
+        ];
+    }
+
+    /** @param array<string, mixed> $details */
+    private function propertyLabels(array $details, string $code): string
+    {
+        $property = collect($details['variant_properties'] ?? [])->firstWhere('code', $code);
+        $labels = collect($property['values'] ?? [])->pluck('label')->filter();
+
+        if ($code === 'event_date') {
+            $labels = $labels->map(function (string $label): string {
+                [$day, $month] = array_pad(explode('/', $label), 2, null);
+
+                return $day !== null && $month !== null ? "{$day}/{$month}" : $label;
+            });
+        }
+
+        return $labels->implode(', ');
+    }
+
+    /** @param array<string, mixed> $details */
+    private function allPropertyLabels(array $details): string
+    {
+        return collect($details['variant_properties'] ?? [])
+            ->flatMap(fn (array $property): array => $property['values'] ?? [])
+            ->pluck('label')
+            ->filter()
+            ->implode(', ');
+    }
+
+    /** @return list<array{code: string, label: string, values: list<array{value: string, label: string}>}> */
+    private function variantProperties(Ticket $ticket): array
+    {
+        $variant = $ticket->sourceVariant;
+        if ($variant === null) {
+            return [];
+        }
+
+        $itemAttributes = $variant->definitions
+            ->map(fn ($definition) => $definition->itemAttribute)
+            ->filter()
+            ->merge($variant->catalogItem?->itemAttributes ?? collect())
+            ->unique('id')
+            ->values();
+
+        return $variant->selectionOptions($itemAttributes)
+            ->map(function (array $selection, string $attributeCode) use ($itemAttributes): array {
+                $itemAttribute = $itemAttributes->first(
+                    fn (ItemAttribute $itemAttribute): bool => $itemAttribute->attribute?->codigo
+                        === $attributeCode,
+                );
+                $values = array_is_list($selection) ? $selection : [$selection];
+
+                return [
+                    'code' => $attributeCode,
+                    'label' => $itemAttribute?->attribute?->nombre
+                        ?? ($attributeCode === 'event_date' ? 'Fecha' : $attributeCode),
+                    'values' => array_values($values),
+                ];
+            })
+            ->values()
+            ->all();
+    }
+}

app/Domains/Ticket/Services/AdminAppTicketService.php

@@ -0,0 +1,404 @@
+<?php
+
+namespace App\Domains\Ticket\Services;
+
+use App\Domains\Auth\Models\User;
+use App\Domains\Purchase\Models\PurchaseItem;
+use App\Domains\Tenant\Models\Tenant;
+use App\Domains\Ticket\Models\Ticket;
+use Illuminate\Database\Eloquent\Builder;
+use Illuminate\Pagination\LengthAwarePaginator;
+use Illuminate\Support\Collection;
+
+class AdminAppTicketService
+{
+    private const RELATIONS = [
+        ...TicketValidityResolver::RELATIONS,
+        ...TicketPresentationResolver::RELATIONS,
+        'user',
+        'scannerUser',
+        'sourceCatalogItem.category',
+        'sourcePurchaseItem.purchase',
+    ];
+
+    public function __construct(
+        private readonly AdminAppTicketColumnService $columnService,
+        private readonly AdminAppTicketRowService $rowService,
+    ) {}
+
+    /**
+     * @param  array{q?: string|null, category?: string|null, product?: string|null, type?: string|null, date?: string|null, size?: string|null, status?: string|null, page?: int, per_page?: int, sort_by?: string|null, sort_direction?: string|null}  $filters
+     */
+    public function search(Tenant $tenant, array $filters = []): AdminAppTicketResult
+    {
+        $query = $this->baseQuery($tenant, $filters);
+        $countQuery = clone $query;
+
+        $databaseSorted = $this->applyDatabaseSort($query, $tenant, $filters);
+
+        if (($filters['sort_by'] ?? null) && ! $databaseSorted) {
+            $matchingTickets = (clone $query)
+                ->with(self::RELATIONS)
+                ->get();
+            $matchingTickets = $this->sortTickets($matchingTickets, $tenant, $filters);
+            $tickets = $this->paginate($matchingTickets, $filters);
+            $scannedTickets = $matchingTickets->whereNotNull('used_at')->count();
+        } else {
+            $tickets = (clone $query)
+                ->with(self::RELATIONS)
+                ->when(! $databaseSorted, fn (Builder $query): Builder => $query->orderByDesc('id'))
+                ->paginateFromRequest()
+                ->withQueryString();
+            $scannedTickets = $countQuery->whereNotNull('used_at')->count();
+        }
+
+        return new AdminAppTicketResult(
+            tickets: $tickets,
+            scannedTickets: $scannedTickets,
+            totalTickets: $tickets->total(),
+        );
+    }
+
+    /**
+     * @param  array{q?: string|null, category?: string|null, product?: string|null, type?: string|null, date?: string|null, size?: string|null, status?: string|null, sort_by?: string|null, sort_direction?: string|null}  $filters
+     * @return Collection<int, Ticket>
+     */
+    public function ticketsForExport(Tenant $tenant, array $filters = []): Collection
+    {
+        $query = $this->baseQuery($tenant, $filters);
+        $databaseSorted = $this->applyDatabaseSort($query, $tenant, $filters);
+        $tickets = $query
+            ->with(self::RELATIONS)
+            ->when(! $databaseSorted, fn (Builder $query): Builder => $query->orderByDesc('id'))
+            ->get();
+
+        return $databaseSorted ? $tickets : $this->sortTickets($tickets, $tenant, $filters);
+    }
+
+    /**
+     * @param  array{q?: string|null, category?: string|null, product?: string|null, type?: string|null, date?: string|null, size?: string|null, status?: string|null, page?: int, per_page?: int}  $filters
+     * @return Builder<Ticket>
+     */
+    private function baseQuery(Tenant $tenant, array $filters): Builder
+    {
+        $search = trim((string) ($filters['q'] ?? ''));
+
+        $query = Ticket::query()
+            ->where('tenant_code', $tenant->codigo)
+            ->when($search !== '', function (Builder $query) use ($search): void {
+                $this->applySearchFilter($query, $search);
+            })
+            ->when($filters['category'] ?? null, function (Builder $query, string $category): void {
+                $query->whereHas('sourceCatalogItem.category', fn (Builder $categoryQuery): Builder => $categoryQuery
+                    ->whereRaw('LOWER(nombre) = ?', [mb_strtolower(trim($category))]));
+            })
+            ->when($filters['product'] ?? null, function (Builder $query, string $product) use ($filters): void {
+                $this->applyProductFilter($query, (string) ($filters['category'] ?? ''), $product);
+            })
+            ->when($filters['type'] ?? null, function (Builder $query, string $type) use ($filters): void {
+                $this->applyTypeFilter($query, (string) ($filters['category'] ?? ''), $type);
+            })
+            ->when($filters['date'] ?? null, function (Builder $query, string $date) use ($tenant): void {
+                if ($tenant->codigo === 'fiesta_futbol_infantil') {
+                    $this->applyEventDateFilter($query, $date);
+
+                    return;
+                }
+
+                $query->whereHas('sourcePurchaseItem.purchase', fn (Builder $purchaseQuery): Builder => $purchaseQuery
+                    ->whereDate('created_at', $date));
+            })
+            ->when($filters['size'] ?? null, function (Builder $query, string $size) use ($filters): void {
+                $this->applySizeFilter($query, (string) ($filters['category'] ?? ''), $size);
+            });
+
+        $this->applyStatusFilter($query, $filters['status'] ?? null);
+
+        return $query;
+    }
+
+    /** @param Builder<Ticket> $query */
+    private function applySearchFilter(Builder $query, string $search): void
+    {
+        $containsPattern = '%'.mb_strtolower($search).'%';
+        $amount = $this->searchAmount($search);
+
+        $query->where(function (Builder $searchQuery) use ($search, $containsPattern, $amount): void {
+            $searchQuery
+                ->where(function (Builder $clientQuery) use ($containsPattern): void {
+                    $clientQuery
+                        ->whereHas('sourcePurchaseItem.purchase', fn (Builder $purchaseQuery): Builder => $purchaseQuery
+                            ->whereRaw('LOWER(nombre_apellido) LIKE ?', [$containsPattern]))
+                        ->orWhere(function (Builder $fallbackClientQuery) use ($containsPattern): void {
+                            $fallbackClientQuery
+                                ->where(function (Builder $missingPurchaseClientQuery): void {
+                                    $missingPurchaseClientQuery
+                                        ->whereDoesntHave('sourcePurchaseItem.purchase')
+                                        ->orWhereHas('sourcePurchaseItem.purchase', fn (Builder $purchaseQuery): Builder => $purchaseQuery
+                                            ->whereNull('nombre_apellido'));
+                                })
+                                ->whereHas('user', fn (Builder $userQuery): Builder => $userQuery
+                                    ->whereRaw('LOWER(nombre_apellido) LIKE ?', [$containsPattern]));
+                        });
+                })
+                ->orWhereHas('scannerUser', fn (Builder $scannerQuery): Builder => $scannerQuery
+                    ->whereRaw('LOWER(nombre_apellido) LIKE ?', [$containsPattern]));
+
+            if (ctype_digit($search)) {
+                $searchQuery
+                    ->orWhere('tickets.id', (int) $search)
+                    ->orWhereHas('sourcePurchaseItem', fn (Builder $purchaseItemQuery): Builder => $purchaseItemQuery
+                        ->where('compra_id', (int) $search));
+            }
+
+            if ($amount !== null) {
+                $searchQuery->orWhereHas('sourcePurchaseItem', fn (Builder $purchaseItemQuery): Builder => $purchaseItemQuery
+                    ->where('precio_unitario', $amount));
+            }
+        });
+    }
+
+    private function searchAmount(string $search): ?string
+    {
+        $value = preg_replace('/[\s$]/u', '', trim($search));
+        if ($value === null || $value === '') {
+            return null;
+        }
+
+        if (preg_match('/^\d{1,3}(?:\.\d{3})+(?:,\d{1,2})?$/', $value) === 1) {
+            $value = str_replace(['.', ','], ['', '.'], $value);
+        } elseif (preg_match('/^\d{1,3}(?:,\d{3})+(?:\.\d{1,2})?$/', $value) === 1) {
+            $value = str_replace(',', '', $value);
+        } elseif (preg_match('/^\d+(?:[.,]\d{1,2})?$/', $value) === 1) {
+            $value = str_replace(',', '.', $value);
+        } else {
+            return null;
+        }
+
+        return number_format((float) $value, 2, '.', '');
+    }
+
+    /** @param Builder<Ticket> $query */
+    private function applyProductFilter(Builder $query, string $category, string $product): void
+    {
+        $category = $this->normalizedCategory($category);
+
+        if (in_array($category, ['alojamientos', 'camping'], true)) {
+            $this->whereVariantDefinition($query, 'tipo_alojamiento', $product);
+
+            return;
+        }
+
+        if (in_array($category, ['comidas', 'comida'], true)) {
+            $this->whereVariantDefinition($query, 'horario', $product);
+
+            return;
+        }
+
+        $query->whereHas('sourceCatalogItem', fn (Builder $itemQuery): Builder => $itemQuery
+            ->where('slug', $product));
+    }
+
+    /** @param Builder<Ticket> $query */
+    private function applyTypeFilter(Builder $query, string $category, string $type): void
+    {
+        $attribute = match ($this->normalizedCategory($category)) {
+            'comidas', 'comida' => 'servicio',
+            'merchandising' => 'color',
+            default => null,
+        };
+
+        if ($attribute !== null) {
+            $this->whereVariantDefinition($query, $attribute, $type);
+        }
+    }
+
+    /** @param Builder<Ticket> $query */
+    private function applyEventDateFilter(Builder $query, string $date): void
+    {
+        $query
+            ->whereHas('sourceCatalogItem.category', fn (Builder $categoryQuery): Builder => $categoryQuery
+                ->whereRaw('LOWER(nombre) IN (?, ?)', ['comidas', 'comida']))
+            ->whereHas('sourceVariant', function (Builder $variantQuery) use ($date): void {
+                $variantQuery->where(function (Builder $dateQuery) use ($date): void {
+                    $dateQuery
+                        ->whereHas('eventDate', fn (Builder $eventDateQuery): Builder => $eventDateQuery
+                            ->whereDate('date', $date))
+                        ->orWhereHas('eventDates', fn (Builder $eventDateQuery): Builder => $eventDateQuery
+                            ->whereDate('date', $date));
+                });
+            });
+    }
+
+    /** @param Builder<Ticket> $query */
+    private function applySizeFilter(Builder $query, string $category, string $size): void
+    {
+        if ($this->normalizedCategory($category) === 'merchandising') {
+            $this->whereVariantDefinition($query, 'talle', $size);
+        }
+    }
+
+    /** @param Builder<Ticket> $query */
+    private function whereVariantDefinition(Builder $query, string $attribute, string $value): void
+    {
+        $query->whereHas('sourceVariant.definitions', fn (Builder $definitionQuery): Builder => $definitionQuery
+            ->where('value', $value)
+            ->whereHas('itemAttribute.attribute', fn (Builder $attributeQuery): Builder => $attributeQuery
+                ->where('codigo', $attribute)));
+    }
+
+    /** @param Builder<Ticket> $query */
+    private function applyStatusFilter(Builder $query, ?string $status): void
+    {
+        if ($status === null || $status === '') {
+            return;
+        }
+
+        if ($status === Ticket::STATUS_USED) {
+            $query->whereNotNull('used_at');
+
+            return;
+        }
+
+        $matchingIds = (clone $query)
+            ->whereNull('used_at')
+            ->with(TicketValidityResolver::RELATIONS)
+            ->get()
+            ->filter(fn (Ticket $ticket): bool => $ticket->status === $status)
+            ->pluck('id');
+
+        $query->whereIn('tickets.id', $matchingIds);
+    }
+
+    private function normalizedCategory(string $category): string
+    {
+        return mb_strtolower(trim($category));
+    }
+
+    /**
+     * @param  Builder<Ticket>  $query
+     * @param  array{sort_by?: string|null, sort_direction?: string|null}  $filters
+     */
+    private function applyDatabaseSort(Builder $query, Tenant $tenant, array $filters): bool
+    {
+        $sortBy = (string) ($filters['sort_by'] ?? '');
+        if ($sortBy === '') {
+            return false;
+        }
+
+        $direction = ($filters['sort_direction'] ?? 'asc') === 'desc' ? 'desc' : 'asc';
+
+        $sortExpression = match ($sortBy) {
+            'order_number' => $this->purchaseItemColumnQuery('compra_id'),
+            'id' => 'tickets.id',
+            'amount' => $this->purchaseItemColumnQuery('precio_unitario'),
+            'scanned_by' => User::query()
+                ->withTrashed()
+                ->select('nombre_apellido')
+                ->whereColumn('users.id', 'tickets.scanner_user_id'),
+            'product' => $tenant->codigo === 'fiesta_futbol_infantil'
+                ? null
+                : $this->purchaseItemColumnQuery('item_nombre'),
+            default => null,
+        };
+
+        if ($sortExpression === null) {
+            return false;
+        }
+
+        $query->orderBy($sortExpression, $direction)->orderByDesc('tickets.id');
+
+        return true;
+    }
+
+    /** @return Builder<PurchaseItem> */
+    private function purchaseItemColumnQuery(string $column): Builder
+    {
+        return PurchaseItem::query()
+            ->select($column)
+            ->whereColumn('compra_items.id', 'tickets.source_purchase_item_id')
+            ->limit(1);
+    }
+
+    /**
+     * @param  Collection<int, Ticket>  $tickets
+     * @param  array{sort_by?: string|null, sort_direction?: string|null}  $filters
+     * @return Collection<int, Ticket>
+     */
+    private function sortTickets(Collection $tickets, Tenant $tenant, array $filters): Collection
+    {
+        $sortBy = (string) ($filters['sort_by'] ?? '');
+        if ($sortBy === '') {
+            return $tickets;
+        }
+
+        $column = collect($this->columnService->columns($tenant))
+            ->firstWhere('sort_param', $sortBy);
+        if ($column === null) {
+            return $tickets;
+        }
+
+        $direction = ($filters['sort_direction'] ?? 'asc') === 'desc' ? -1 : 1;
+        $values = $tickets->mapWithKeys(fn (Ticket $ticket): array => [
+            $ticket->getKey() => $this->rowService->values($ticket)[$column['key']] ?? null,
+        ]);
+
+        return $tickets->sort(function (Ticket $left, Ticket $right) use ($column, $direction, $values): int {
+            $leftValue = $values->get($left->getKey());
+            $rightValue = $values->get($right->getKey());
+
+            if ($leftValue === null || $leftValue === '') {
+                return $rightValue === null || $rightValue === '' ? $right->id <=> $left->id : 1;
+            }
+            if ($rightValue === null || $rightValue === '') {
+                return -1;
+            }
+
+            $comparison = $this->compareValues($leftValue, $rightValue, $column['type']);
+
+            return $comparison === 0
+                ? $right->id <=> $left->id
+                : $comparison * $direction;
+        })->values();
+    }
+
+    private function compareValues(mixed $left, mixed $right, string $type): int
+    {
+        if (in_array($type, ['currency', 'order_number'], true)) {
+            return (float) $left <=> (float) $right;
+        }
+
+        if ($type === 'date') {
+            $leftTimestamp = $left instanceof \DateTimeInterface ? $left->getTimestamp() : strtotime((string) $left);
+            $rightTimestamp = $right instanceof \DateTimeInterface ? $right->getTimestamp() : strtotime((string) $right);
+
+            return $leftTimestamp <=> $rightTimestamp;
+        }
+
+        if ($type === 'status') {
+            $left = $this->rowService->displayValue($left, $type, 'UTC');
+            $right = $this->rowService->displayValue($right, $type, 'UTC');
+        }
+
+        return strnatcasecmp((string) $left, (string) $right);
+    }
+
+    /**
+     * @param  Collection<int, Ticket>  $tickets
+     * @param  array{page?: int, per_page?: int}  $filters
+     * @return LengthAwarePaginator<Ticket>
+     */
+    private function paginate(Collection $tickets, array $filters): LengthAwarePaginator
+    {
+        $page = (int) ($filters['page'] ?? 1);
+        $perPage = (int) ($filters['per_page'] ?? 15);
+
+        return (new LengthAwarePaginator(
+            $tickets->forPage($page, $perPage)->values(),
+            $tickets->count(),
+            $perPage,
+            $page,
+            ['path' => request()->url()],
+        ))->withQueryString();
+    }
+}

app/Domains/Ticket/Services/ScannerTicketService.php

@@ -73,7 +73,7 @@ class ScannerTicketService
             ->where('tenant_code', $scanner->tenant_codigo)
             ->where('ticket', $ticketUuid);
 
-        if ($scanner->tenant()->firstOrFail()->requiresScannerCategoryValidation()) {
+        if ($this->requiresCategoryValidation($scanner)) {
             $categoryIds = $this->scannerCategoryIds($scanner);
 
             $query->where(function (Builder $query) use ($scanner, $categoryIds): void {
@@ -158,7 +158,7 @@ class ScannerTicketService
 
     private function scannerCanScan(User $scanner, Ticket $ticket): bool
     {
-        if (! $scanner->tenant()->firstOrFail()->requiresScannerCategoryValidation()) {
+        if (! $this->requiresCategoryValidation($scanner)) {
             return true;
         }
 
@@ -169,4 +169,9 @@ class ScannerTicketService
                 ->where('categorias.id', $categoryId)
                 ->exists();
     }
+
+    private function requiresCategoryValidation(User $scanner): bool
+    {
+        return $scanner->tenant()->firstOrFail()->requiresScannerCategoryValidation();
+    }
 }

app/Domains/Ticket/Services/TicketGeneratorService.php

@@ -23,13 +23,13 @@ class TicketGeneratorService
         User $user,
         int $quantity = 1,
         ?int $sourceVariantId = null,
-        ?int $sourcePurchaseId = null,
+        ?int $sourcePurchaseItemId = null,
     ): Collection {
         if ($quantity < 1) {
             throw TicketGenerationException::invalidQuantity();
         }
 
-        return DB::transaction(function () use ($catalogItem, $user, $quantity, $sourceVariantId, $sourcePurchaseId): Collection {
+        return DB::transaction(function () use ($catalogItem, $user, $quantity, $sourceVariantId, $sourcePurchaseItemId): Collection {
             $targets = $this->resolveTargets(
                 $catalogItem,
                 $quantity,
@@ -37,7 +37,7 @@ class TicketGeneratorService
             );
 
             return $targets->map(function (array $target) use (
-                $sourcePurchaseId,
+                $sourcePurchaseItemId,
                 $user,
             ): Ticket {
                 $item = $target['catalog_item'];
@@ -45,7 +45,7 @@ class TicketGeneratorService
                 $ticket = Ticket::query()->create([
                     'tenant_code' => $item->tenant_code,
                     'ticket' => (string) Str::uuid(),
-                    'source_purchase_id' => $sourcePurchaseId,
+                    'source_purchase_item_id' => $sourcePurchaseItemId,
                     'source_catalog_item_id' => $item->getKey(),
                     'source_variant_id' => $variant?->getKey(),
                     'used_at' => null,

app/Domains/Ticket/documentacion/README.md

@@ -6,7 +6,8 @@ Genera, valida, consulta y exporta entradas asociadas a compras pagadas de produ
 
 ## Modelo
 
-- `Ticket`: pertenece a tenant y usuario, y conserva referencias a compra, producto, variante y usuario escáner.
+- `Ticket`: pertenece a tenant y usuario, y conserva referencias al ítem de compra que lo generó, producto,
+  variante y usuario escáner. La compra se obtiene a través de su ítem.
 - El nombre y la descripción se calculan dinámicamente desde el producto y la variante; los tickets no
   persisten una copia de esos textos.
 - `ValidityTime`: define ventanas absolutas o relativas de vigencia para fechas de evento y opciones de atributos.
@@ -57,6 +58,12 @@ Bajo `/tenants/{tenant:codigo}`, protegidos por `auth:sanctum`:
 - `GET /tickets`.
 - `POST /tickets/pdf`.
 
+Bajo `/v1/adminapp/tenant`, protegido por `auth:sanctum`, `adminapp.tenant` y el menú
+`adminapp.tickets`:
+
+- `GET /tickets`, paginado y con búsqueda opcional mediante `q`. La respuesta incluye
+  `scanned_tickets` y `total_tickets` para el tenant autenticado.
+
 `TicketPdfService` genera la descarga y `TicketResource`/`ValidityTimeResource` definen las respuestas.
 
 ## Dependencias y reglas

app/Domains/Ticket/routes/adminapp.php

@@ -0,0 +1,18 @@
+<?php
+
+use App\Domains\Ticket\Controllers\AdminApp\TicketController;
+use Illuminate\Support\Facades\Route;
+
+Route::prefix('v1/adminapp/tenant')
+    ->middleware(['auth:sanctum', 'adminapp.tenant'])
+    ->group(function (): void {
+        Route::get('tickets', [TicketController::class, 'index'])
+            ->middleware('tenant.menu:adminapp.tickets')
+            ->name('adminapp.tickets.index');
+        Route::get('tickets/pdf', [TicketController::class, 'downloadPdf'])
+            ->middleware('tenant.menu:adminapp.tickets')
+            ->name('adminapp.tickets.pdf');
+        Route::get('tickets/excel', [TicketController::class, 'downloadExcel'])
+            ->middleware('tenant.menu:adminapp.tickets')
+            ->name('adminapp.tickets.excel');
+    });

app/Domains/Ticket/routes/api.php

@@ -11,3 +11,4 @@ Route::prefix('tenants/{tenant:codigo}')
     });
 
 require __DIR__.'/scanner.php';
+require __DIR__.'/adminapp.php';

app/Http/Middleware/EnsureScannerTenant.php

@@ -3,6 +3,7 @@
 namespace App\Http\Middleware;
 
 use App\Domains\Authorization\Enums\PermissionCode;
+use App\Domains\Authorization\Enums\RoleCode;
 use Closure;
 use Illuminate\Auth\Access\AuthorizationException;
 use Illuminate\Http\Request;
@@ -19,6 +20,7 @@ class EnsureScannerTenant
 
         if (
             ! $user
+            || $user->rol_codigo !== RoleCode::Scanner->value
             || ! $user->tenant_codigo
             || ! $user->hasPermission(PermissionCode::ScanTickets->value)
         ) {

database/migrations/2026_08_28_000000_add_fiesta_futbol_infantil_tickets_adminapp_menu.php

@@ -0,0 +1,82 @@
+<?php
+
+use Illuminate\Database\Migrations\Migration;
+use Illuminate\Support\Facades\DB;
+
+return new class extends Migration
+{
+    private const MENU_CODE = 'adminapp.tickets';
+
+    private const TENANT_CODE = 'fiesta_futbol_infantil';
+
+    public function up(): void
+    {
+        if (! DB::table('menues')->where('code', 'main.adminapp')->exists()) {
+            // Reference data is added by seeders on fresh installations.
+            return;
+        }
+
+        $now = now();
+
+        DB::transaction(function () use ($now): void {
+            DB::table('menues')->updateOrInsert(
+                ['code' => self::MENU_CODE],
+                [
+                    'label' => 'Tickets',
+                    'parent_menu_code' => 'main.adminapp',
+                    'content_type' => 'dynamic',
+                    'static_content_schema' => null,
+                    'route' => '/admin/tickets',
+                    'created_at' => $now,
+                    'updated_at' => $now,
+                ],
+            );
+
+            DB::table('tenants_menues')
+                ->where('menu_code', self::MENU_CODE)
+                ->where('tenant_code', '!=', self::TENANT_CODE)
+                ->delete();
+
+            if (DB::table('tenants')->where('codigo', self::TENANT_CODE)->exists()) {
+                DB::table('tenants_menues')->updateOrInsert(
+                    [
+                        'tenant_code' => self::TENANT_CODE,
+                        'menu_code' => self::MENU_CODE,
+                    ],
+                    [
+                        'static_content' => null,
+                        'created_at' => $now,
+                        'updated_at' => $now,
+                    ],
+                );
+            }
+
+            DB::table('roles')
+                ->whereIn('codigo', ['admin', 'adminapp'])
+                ->pluck('codigo')
+                ->each(function (string $roleCode): void {
+                    DB::table('roles_menues')->updateOrInsert([
+                        'rol_codigo' => $roleCode,
+                        'menu_codigo' => self::MENU_CODE,
+                    ]);
+                });
+        });
+    }
+
+    public function down(): void
+    {
+        DB::transaction(function (): void {
+            DB::table('tenants_menues')
+                ->where('menu_code', self::MENU_CODE)
+                ->delete();
+
+            DB::table('roles_menues')
+                ->where('menu_codigo', self::MENU_CODE)
+                ->delete();
+
+            DB::table('menues')
+                ->where('code', self::MENU_CODE)
+                ->delete();
+        });
+    }
+};

database/migrations/2026_09_02_000000_add_source_purchase_item_id_to_tickets.php

@@ -0,0 +1,94 @@
+<?php
+
+use Illuminate\Database\Migrations\Migration;
+use Illuminate\Database\Schema\Blueprint;
+use Illuminate\Support\Collection;
+use Illuminate\Support\Facades\DB;
+use Illuminate\Support\Facades\Schema;
+
+return new class extends Migration
+{
+    public function up(): void
+    {
+        Schema::table('tickets', function (Blueprint $table): void {
+            $table->foreignId('source_purchase_item_id')
+                ->nullable()
+                ->after('source_purchase_id')
+                ->constrained('compra_items')
+                ->cascadeOnUpdate()
+                ->nullOnDelete();
+        });
+
+        DB::table('tickets')
+            ->whereNotNull('source_purchase_id')
+            ->whereNull('source_purchase_item_id')
+            ->orderBy('id')
+            ->chunkById(500, function (Collection $tickets): void {
+                $purchaseIds = $tickets->pluck('source_purchase_id')->unique()->values();
+                $itemsByPurchase = DB::table('compra_items')
+                    ->whereIn('compra_id', $purchaseIds)
+                    ->get(['id', 'compra_id', 'source_catalog_item_id', 'source_variant_id'])
+                    ->groupBy('compra_id');
+                $bundleIds = $itemsByPurchase->flatten(1)
+                    ->pluck('source_catalog_item_id')
+                    ->filter()
+                    ->unique()
+                    ->values();
+                $componentsByBundle = DB::table('bundle_components')
+                    ->whereIn('bundle_catalog_item_id', $bundleIds)
+                    ->get([
+                        'bundle_catalog_item_id',
+                        'component_catalog_item_id',
+                        'component_variant_id',
+                    ])
+                    ->groupBy('bundle_catalog_item_id');
+
+                foreach ($tickets as $ticket) {
+                    $candidates = collect($itemsByPurchase->get($ticket->source_purchase_id, []))
+                        ->filter(function (object $item) use ($ticket, $componentsByBundle): bool {
+                            if ($this->sameCatalogTarget($item, $ticket)) {
+                                return true;
+                            }
+
+                            return collect($componentsByBundle->get($item->source_catalog_item_id, []))
+                                ->contains(fn (object $component): bool => $this->sameBundleTarget($component, $ticket));
+                        })
+                        ->pluck('id')
+                        ->unique()
+                        ->values();
+
+                    if ($candidates->count() === 1) {
+                        DB::table('tickets')->where('id', $ticket->id)->update([
+                            'source_purchase_item_id' => $candidates->sole(),
+                        ]);
+                    }
+                }
+            });
+    }
+
+    public function down(): void
+    {
+        Schema::table('tickets', function (Blueprint $table): void {
+            $table->dropConstrainedForeignId('source_purchase_item_id');
+        });
+    }
+
+    private function sameCatalogTarget(object $item, object $ticket): bool
+    {
+        return (int) $item->source_catalog_item_id === (int) $ticket->source_catalog_item_id
+            && $this->sameNullableId($item->source_variant_id, $ticket->source_variant_id);
+    }
+
+    private function sameBundleTarget(object $component, object $ticket): bool
+    {
+        return (int) $component->component_catalog_item_id === (int) $ticket->source_catalog_item_id
+            && $this->sameNullableId($component->component_variant_id, $ticket->source_variant_id);
+    }
+
+    private function sameNullableId(mixed $left, mixed $right): bool
+    {
+        return $left === null || $right === null
+            ? $left === null && $right === null
+            : (int) $left === (int) $right;
+    }
+};

database/migrations/2026_09_02_010000_remove_source_purchase_id_from_tickets.php

@@ -0,0 +1,73 @@
+<?php
+
+use Illuminate\Database\Migrations\Migration;
+use Illuminate\Database\Schema\Blueprint;
+use Illuminate\Support\Collection;
+use Illuminate\Support\Facades\DB;
+use Illuminate\Support\Facades\Schema;
+
+return new class extends Migration
+{
+    public function up(): void
+    {
+        $unresolved = DB::table('tickets')
+            ->whereNotNull('source_purchase_id')
+            ->whereNull('source_purchase_item_id')
+            ->orderBy('id')
+            ->limit(20)
+            ->pluck('id');
+
+        if ($unresolved->isNotEmpty()) {
+            throw new RuntimeException(
+                'No se puede eliminar tickets.source_purchase_id: hay tickets sin un compra_item inequívoco. '
+                .'IDs: '.$unresolved->implode(', ')
+            );
+        }
+
+        $inconsistent = DB::table('tickets')
+            ->join('compra_items', 'compra_items.id', '=', 'tickets.source_purchase_item_id')
+            ->whereNotNull('tickets.source_purchase_id')
+            ->whereColumn('tickets.source_purchase_id', '!=', 'compra_items.compra_id')
+            ->orderBy('tickets.id')
+            ->limit(20)
+            ->pluck('tickets.id');
+
+        if ($inconsistent->isNotEmpty()) {
+            throw new RuntimeException(
+                'No se puede eliminar tickets.source_purchase_id: hay referencias de compra inconsistentes. '
+                .'IDs: '.$inconsistent->implode(', ')
+            );
+        }
+
+        Schema::table('tickets', function (Blueprint $table): void {
+            $table->dropConstrainedForeignId('source_purchase_id');
+        });
+    }
+
+    public function down(): void
+    {
+        Schema::table('tickets', function (Blueprint $table): void {
+            $table->foreignId('source_purchase_id')
+                ->nullable()
+                ->after('description')
+                ->constrained('compras')
+                ->cascadeOnUpdate()
+                ->nullOnDelete();
+        });
+
+        DB::table('tickets')
+            ->whereNotNull('source_purchase_item_id')
+            ->orderBy('id')
+            ->chunkById(500, function (Collection $tickets): void {
+                $purchaseIdsByItem = DB::table('compra_items')
+                    ->whereIn('id', $tickets->pluck('source_purchase_item_id'))
+                    ->pluck('compra_id', 'id');
+
+                foreach ($tickets as $ticket) {
+                    DB::table('tickets')->where('id', $ticket->id)->update([
+                        'source_purchase_id' => $purchaseIdsByItem->get($ticket->source_purchase_item_id),
+                    ]);
+                }
+            });
+    }
+};

database/migrations/2026_09_02_020000_restrict_deletion_of_purchase_items_with_tickets.php

@@ -0,0 +1,38 @@
+<?php
+
+use Illuminate\Database\Migrations\Migration;
+use Illuminate\Database\Schema\Blueprint;
+use Illuminate\Support\Facades\Schema;
+
+return new class extends Migration
+{
+    public function up(): void
+    {
+        Schema::table('tickets', function (Blueprint $table): void {
+            $table->dropForeign(['source_purchase_item_id']);
+        });
+
+        Schema::table('tickets', function (Blueprint $table): void {
+            $table->foreign('source_purchase_item_id')
+                ->references('id')
+                ->on('compra_items')
+                ->cascadeOnUpdate()
+                ->restrictOnDelete();
+        });
+    }
+
+    public function down(): void
+    {
+        Schema::table('tickets', function (Blueprint $table): void {
+            $table->dropForeign(['source_purchase_item_id']);
+        });
+
+        Schema::table('tickets', function (Blueprint $table): void {
+            $table->foreign('source_purchase_item_id')
+                ->references('id')
+                ->on('compra_items')
+                ->cascadeOnUpdate()
+                ->nullOnDelete();
+        });
+    }
+};

database/migrations/2026_09_03_000000_add_soft_deletes_to_users_table.php

@@ -0,0 +1,23 @@
+<?php
+
+use Illuminate\Database\Migrations\Migration;
+use Illuminate\Database\Schema\Blueprint;
+use Illuminate\Support\Facades\Schema;
+
+return new class extends Migration
+{
+    public function up(): void
+    {
+        Schema::table('users', function (Blueprint $table): void {
+            $table->softDeletes();
+        });
+
+    }
+
+    public function down(): void
+    {
+        Schema::table('users', function (Blueprint $table): void {
+            $table->dropSoftDeletes();
+        });
+    }
+};

database/migrations/2026_09_03_000100_scope_user_email_unique_to_active_accounts.php

@@ -0,0 +1,28 @@
+<?php
+
+use Illuminate\Database\Migrations\Migration;
+use Illuminate\Database\Schema\Blueprint;
+use Illuminate\Support\Facades\Schema;
+
+return new class extends Migration
+{
+    public function up(): void
+    {
+        Schema::table('users', function (Blueprint $table): void {
+            $table->dropUnique(['email']);
+            $table->string('active_email')
+                ->nullable()
+                ->storedAs('CASE WHEN `deleted_at` IS NULL THEN LOWER(`email`) ELSE NULL END');
+            $table->unique('active_email');
+        });
+    }
+
+    public function down(): void
+    {
+        Schema::table('users', function (Blueprint $table): void {
+            $table->dropUnique(['active_email']);
+            $table->dropColumn('active_email');
+            $table->unique('email');
+        });
+    }
+};

database/migrations/2026_09_03_000200_scope_google_id_unique_to_active_accounts.php

@@ -0,0 +1,28 @@
+<?php
+
+use Illuminate\Database\Migrations\Migration;
+use Illuminate\Database\Schema\Blueprint;
+use Illuminate\Support\Facades\Schema;
+
+return new class extends Migration
+{
+    public function up(): void
+    {
+        Schema::table('users', function (Blueprint $table): void {
+            $table->dropUnique(['google_id']);
+            $table->string('active_google_id')
+                ->nullable()
+                ->storedAs('CASE WHEN `deleted_at` IS NULL THEN `google_id` ELSE NULL END');
+            $table->unique('active_google_id');
+        });
+    }
+
+    public function down(): void
+    {
+        Schema::table('users', function (Blueprint $table): void {
+            $table->dropUnique(['active_google_id']);
+            $table->dropColumn('active_google_id');
+            $table->unique('google_id');
+        });
+    }
+};

database/migrations/2026_09_04_000000_rename_adminapp_staff_menu_label.php

@@ -0,0 +1,29 @@
+<?php
+
+use Illuminate\Database\Migrations\Migration;
+use Illuminate\Support\Facades\DB;
+
+return new class extends Migration
+{
+    private const MENU_CODE = 'adminapp.staff';
+
+    public function up(): void
+    {
+        DB::table('menues')
+            ->where('code', self::MENU_CODE)
+            ->update([
+                'label' => 'Usuarios',
+                'updated_at' => now(),
+            ]);
+    }
+
+    public function down(): void
+    {
+        DB::table('menues')
+            ->where('code', self::MENU_CODE)
+            ->update([
+                'label' => 'Staff',
+                'updated_at' => now(),
+            ]);
+    }
+};

database/migrations/2026_09_04_000000_scope_active_email_unique_per_role.php

@@ -0,0 +1,24 @@
+<?php
+
+use Illuminate\Database\Migrations\Migration;
+use Illuminate\Database\Schema\Blueprint;
+use Illuminate\Support\Facades\Schema;
+
+return new class extends Migration
+{
+    public function up(): void
+    {
+        Schema::table('users', function (Blueprint $table): void {
+            $table->unique(['active_email', 'rol_codigo']);
+            $table->dropUnique(['active_email']);
+        });
+    }
+
+    public function down(): void
+    {
+        Schema::table('users', function (Blueprint $table): void {
+            $table->unique('active_email');
+            $table->dropUnique(['active_email', 'rol_codigo']);
+        });
+    }
+};

database/migrations/2026_09_04_010000_remove_scan_permission_from_adminapp_role.php

@@ -0,0 +1,42 @@
+<?php
+
+use App\Domains\Authorization\Enums\PermissionCode;
+use App\Domains\Authorization\Enums\RoleCode;
+use Illuminate\Database\Migrations\Migration;
+use Illuminate\Support\Facades\DB;
+
+return new class extends Migration
+{
+    public function up(): void
+    {
+        DB::table('roles_permisos')
+            ->where('rol_codigo', RoleCode::AdminApp->value)
+            ->where('codigo_permiso', PermissionCode::ScanTickets->value)
+            ->delete();
+    }
+
+    public function down(): void
+    {
+        $roleExists = DB::table('roles')
+            ->where('codigo', RoleCode::AdminApp->value)
+            ->exists();
+        $permissionExists = DB::table('permisos')
+            ->where('codigo', PermissionCode::ScanTickets->value)
+            ->exists();
+
+        if (! $roleExists || ! $permissionExists) {
+            return;
+        }
+
+        DB::table('roles_permisos')->updateOrInsert(
+            [
+                'rol_codigo' => RoleCode::AdminApp->value,
+                'codigo_permiso' => PermissionCode::ScanTickets->value,
+            ],
+            [
+                'created_at' => now(),
+                'updated_at' => now(),
+            ],
+        );
+    }
+};

database/seeders/AuthorizationSeeder.php

@@ -120,7 +120,7 @@ class AuthorizationSeeder extends Seeder
         RoleCode::AdminApp->value => [
             'nombre' => 'Administrador de la aplicación',
             'descripcion' => 'Accede a los menús administrativos de la aplicación.',
-            'permisos' => [PermissionCode::ScanTickets->value],
+            'permisos' => [],
         ],
         RoleCode::Scanner->value => [
             'nombre' => 'Scanner',

database/seeders/MenuSeeder.php

@@ -74,10 +74,16 @@ class MenuSeeder extends Seeder
             ],
             [
                 'code' => 'adminapp.staff',
-                'label' => 'Staff',
+                'label' => 'Usuarios',
                 'parent_menu_code' => 'main.adminapp',
                 'route' => '/admin/staff',
             ],
+            [
+                'code' => 'adminapp.tickets',
+                'label' => 'Tickets',
+                'parent_menu_code' => 'main.adminapp',
+                'route' => '/admin/tickets',
+            ],
             [
                 'code' => 'adminapp.fiesta-futbol-infantil.entradas',
                 'label' => 'Entradas',
@@ -270,6 +276,7 @@ class MenuSeeder extends Seeder
             'fiesta_futbol_infantil',
         ];
         $fiestaCategoryMenuCodes = [
+            'adminapp.tickets',
             'adminapp.fiesta-futbol-infantil.entradas',
             'adminapp.fiesta-futbol-infantil.alojamientos',
             'adminapp.fiesta-futbol-infantil.merchandising',

docs/email-identity.md

@@ -0,0 +1,31 @@
+# Identidad por email y rol
+
+Cada cuenta activa se identifica por `LOWER(email)` + `rol_codigo`, globalmente,
+sin incluir el tenant. Un mismo correo puede tener una cuenta `user`, otra
+`adminapp`, otra `scanner` y otra `admin`. Dos cuentas activas del mismo rol
+no pueden compartir correo, incluso si pertenecen a distintos tenants.
+
+La base lo garantiza con el índice único `(active_email, rol_codigo)`.
+`active_email` es una columna generada: vale `LOWER(email)` cuando `deleted_at`
+es NULL y NULL para cuentas eliminadas. El soft delete libera el correo para
+ese rol; registrarlo nuevamente crea una cuenta independiente.
+
+Registro, perfil, administradores y staff validan el correo normalizado contra
+el rol de destino. Cambiar de rol o restaurar una cuenta también queda sujeto
+al índice único de la base.
+
+Login y recuperación seleccionan la identidad de la aplicación:
+
+- Tienda y Google: `user`.
+- AdminApp: `adminapp`.
+- Scanner: `scanner`. Sólo las identidades con ese rol pueden autenticarse y
+  consumir los endpoints del scanner.
+- Verificación administrativa de plataforma: `admin`.
+
+Los endpoints de validación de código y cambio de contraseña toman el rol de
+la ruta, nunca del cuerpo enviado por el cliente. Los intentos y cambios de
+contraseña pertenecen a una cuenta concreta, aunque otra comparta su email.
+
+Aplicar `php artisan migrate` antes de habilitar correos compartidos por rol.
+Para revertir esta migración hay que resolver primero los correos compartidos
+entre cuentas activas: el índice global anterior no los admite.

phpunit.xml

@@ -18,7 +18,7 @@
         </include>
     </source>
     <php>
-        <env name="APP_ENV" value="testing"/>
+        <env name="APP_ENV" value="testing" force="true"/>
         <env name="DB_DATABASE" value="shopit_test" force="true"/>
         <env name="APP_MAINTENANCE_DRIVER" value="file"/>
         <env name="APP_CONFIG_CACHE" value="bootstrap/cache/phpunit-config.php"/>

resources/views/mail/notifications/account-locked.blade.php

@@ -0,0 +1,6 @@
+@include('mail.notifications.partials.password-action', [
+    'title' => 'Desbloqueá tu cuenta',
+    'description' => 'registramos varios intentos fallidos de inicio de sesión en tu cuenta. Por seguridad, bloqueamos el acceso temporalmente. Utilizá este código para cambiar tu contraseña y desbloquearla.',
+    'buttonLabel' => 'Ingresar código ahora',
+    'footer' => 'Si no fuiste vos, por favor desestimá y borrá este correo. Tu cuenta seguirá protegida.',
+])

resources/views/mail/notifications/administrator-created.blade.php

@@ -0,0 +1,6 @@
+@include('mail.notifications.partials.password-action', [
+    'title' => 'Tu cuenta de administrador está lista',
+    'description' => 'creamos tu cuenta de administrador en '.$brand->nombre.'. Creá tu contraseña con este código para ingresar al panel de administración.',
+    'buttonLabel' => 'Crear mi contraseña',
+    'footer' => 'Si no esperabas recibir una cuenta de administrador, podés ignorar este mensaje.',
+])

resources/views/mail/notifications/partials/password-action.blade.php

@@ -0,0 +1,24 @@
+<h1 style="margin: 0 0 20px; color: {{ $brand->primary_color }};">
+    {{ $title }}
+</h1>
+
+<p>Hola {{ $attempt->user->nombre_apellido }}, {{ $description }}</p>
+
+<p>Ingresá este código en {{ $brand->nombre }}:</p>
+
+<div style="margin: 28px 0; padding: 20px; border: 2px solid {{ $brand->primary_color }}; border-radius: 8px; text-align: center;">
+    <span style="color: {{ $brand->primary_color }}; font-size: 36px; font-weight: 700; letter-spacing: 12px;">
+        {{ $attempt->codigo }}
+    </span>
+</div>
+
+@if($recoveryUrl)
+<div style="text-align: center; margin-bottom: 28px;">
+    <a href="{{ $recoveryUrl }}"
+       style="display: inline-block; padding: 12px 24px; background-color: {{ $brand->primary_color }}; color: #ffffff; text-decoration: none; border-radius: 6px; font-weight: bold;">
+        {{ $buttonLabel }}
+    </a>
+</div>
+@endif
+
+<p style="color: #64748b; font-size: 14px;">{{ $footer }}</p>

resources/views/mail/notifications/password-reset.blade.php

@@ -1,45 +1,6 @@
-<h1 style="margin: 0 0 20px; color: {{ $brand->primary_color }};">
+@include('mail.notifications.partials.password-action', [
-    Recuperá tu contraseña
+    'title' => 'Recuperá tu contraseña',
-</h1>
+    'description' => 'recibimos una solicitud para restablecer la contraseña de tu cuenta.',
-
+    'buttonLabel' => 'Ingresar código ahora',
-@if($attempt->reason === \App\Domains\Auth\Models\ResetPasswordAttempt::REASON_STAFF_CREATED)
+    'footer' => 'Si no solicitaste recuperar tu contraseña, podés ignorar este mensaje.',
-<p>
+])
-    Hola {{ $attempt->user->nombre_apellido }}, creamos tu cuenta de scanner en {{ $brand->nombre }}. Utilizá este código para crear tu contraseña y comenzar a usarla.
-</p>
-@elseif($attempt->reason === \App\Domains\Auth\Models\ResetPasswordAttempt::REASON_ACCOUNT_LOCKED)
-<p>
-    Hola {{ $attempt->user->nombre_apellido }}, registramos varios intentos fallidos de inicio de sesión en tu cuenta. Por seguridad, hemos bloqueado el acceso temporalmente. Puedes utilizar este código para cambiar tu contraseña y desbloquearla inmediatamente.
-</p>
-@else
-<p>
-    Hola {{ $attempt->user->nombre_apellido }}, recibimos una solicitud para restablecer
-    la contraseña de tu cuenta.
-</p>
-@endif
-
-<p>Ingresá este código en {{ $brand->nombre }}:</p>
-
-<div style="margin: 28px 0; padding: 20px; border: 2px solid {{ $brand->primary_color }}; border-radius: 8px; text-align: center;">
-    <span style="color: {{ $brand->primary_color }}; font-size: 36px; font-weight: 700; letter-spacing: 12px;">
-        {{ $attempt->codigo }}
-    </span>
-</div>
-
-@if($recoveryUrl)
-<div style="text-align: center; margin-bottom: 28px;">
-    <a href="{{ $recoveryUrl }}" 
-       style="display: inline-block; padding: 12px 24px; background-color: {{ $brand->primary_color }}; color: #ffffff; text-decoration: none; border-radius: 6px; font-weight: bold;">
-        {{ $attempt->reason === \App\Domains\Auth\Models\ResetPasswordAttempt::REASON_STAFF_CREATED ? 'Crear mi contraseña' : 'Ingresar código ahora' }}
-    </a>
-</div>
-@endif
-
-<p style="color: #64748b; font-size: 14px;">
-@if($attempt->reason === \App\Domains\Auth\Models\ResetPasswordAttempt::REASON_ACCOUNT_LOCKED)
-    Si no fuiste vos, por favor desestimá y borrá este correo. Tu cuenta seguirá protegida.
-@elseif($attempt->reason === \App\Domains\Auth\Models\ResetPasswordAttempt::REASON_STAFF_CREATED)
-    Si no esperabas recibir una cuenta de scanner, podés ignorar este mensaje.
-@else
-    Si no solicitaste recuperar tu contraseña, podés ignorar este mensaje.
-@endif
-</p>

resources/views/mail/notifications/scanner-created.blade.php

@@ -0,0 +1,6 @@
+@include('mail.notifications.partials.password-action', [
+    'title' => 'Tu cuenta de escáner está lista',
+    'description' => 'creamos tu cuenta de escáner en '.$brand->nombre.'. Creá tu contraseña con este código para ingresar y comenzar a escanear entradas.',
+    'buttonLabel' => 'Crear mi contraseña',
+    'footer' => 'Si no esperabas recibir una cuenta de escáner, podés ignorar este mensaje.',
+])

resources/views/mail/notifications/welcome.blade.php

@@ -1,3 +1,8 @@
 <h1 style="margin: 0 0 20px;">¡Bienvenido a {{ $brand->nombre }}!</h1>
 <p>Hola {{ $user->nombre_apellido }}, tu cuenta fue creada correctamente.</p>
-<p>Ya podés ingresar y comenzar a comprar.</p>
+<div style="text-align: center; margin-bottom: 28px;">
+    <a href="{{ $tenantUrl }}"
+       style="display: inline-block; padding: 12px 24px; background-color: {{ $brand->primary_color }}; color: #ffffff; text-decoration: none; border-radius: 6px; font-weight: bold;">
+        Encendé tu experiencia
+    </a>
+</div>

resources/views/pdf/adminapp/sales.blade.php

@@ -47,11 +47,7 @@
                     <td>{{ $sale->created_at?->copy()->timezone($timeZone)->format('d/m/Y H:i') ?? '-' }}</td>
                     <td>{{ $sale->nombre_apellido ?: 'Sin nombre' }}</td>
                     <td class="center">{{ (int) ($sale->quantity ?? 0) }}</td>
-                    <td>{{ match ($sale->status) {
+                    <td>{{ \App\Domains\Purchase\Models\Purchase::adminStatusNameFor($sale->status) ?? $sale->status }}</td>
-                        'paid' => 'Confirmado',
-                        'created', 'pending_payment' => 'Esperando pago',
-                        default => 'Anulado',
-                    } }}</td>
                     <td class="number">${{ number_format((float) $sale->total, 2, ',', '.') }}</td>
                     <td class="center">{{ (int) ($sale->tickets_count ?? 0) }}</td>
                 </tr>

resources/views/pdf/adminapp/tickets.blade.php

@@ -0,0 +1,57 @@
+<!doctype html>
+<html lang="es">
+<head>
+    <meta http-equiv="Content-Type" content="text/html; charset=utf-8">
+    <style>
+        @page { margin: 28px 34px 58px; }
+        body { color: #17211b; font-family: DejaVu Sans, sans-serif; font-size: 11px; margin: 0; }
+        h1 { font-size: 21px; margin: 0 0 3px; }
+        .subtitle { color: #66736b; margin: 0 0 15px; }
+        .summary { background: #eef5f1; border-left: 4px solid #198754; margin-bottom: 14px; padding: 8px 11px; }
+        .summary strong { font-size: 12px; }
+        table { border-collapse: collapse; width: 100%; }
+        thead { display: table-header-group; }
+        tr { page-break-inside: avoid; }
+        th { background: #26382e; color: #fff; font-size: 11px; letter-spacing: .25px; padding: 6px 5px; text-align: left; text-transform: uppercase; }
+        td { border-bottom: 1px solid #dfe7e2; overflow-wrap: break-word; padding: 6px 5px; vertical-align: top; }
+        tbody tr:nth-child(even) { background: #f7f9f8; }
+        .number { text-align: right; }
+        .ticket-id { font-size: 11px; word-break: break-all; }
+        .empty { color: #66736b; padding: 24px; text-align: center; }
+    </style>
+</head>
+<body>
+    <h1>Listado de tickets</h1>
+    <p class="subtitle">{{ $tenant->nombre }} · Generado el {{ $generatedAt->copy()->timezone($timeZone)->format('d/m/Y H:i') }}</p>
+
+    <div class="summary">
+        Tickets incluidos: <strong>{{ $tickets->count() }}</strong>
+        &nbsp;&nbsp;·&nbsp;&nbsp;
+        Escaneados: <strong>{{ $tickets->where('status', 'Usado')->count() }}</strong>
+    </div>
+
+    <table>
+        <thead>
+            <tr>
+                @foreach ($columns as $column)
+                    <th @class(['number' => $column['type'] === 'currency'])>{{ $column['label'] }}</th>
+                @endforeach
+            </tr>
+        </thead>
+        <tbody>
+            @forelse ($tickets as $ticket)
+                <tr>
+                    @foreach ($columns as $column)
+                        <td @class([
+                            'number' => $column['type'] === 'currency',
+                            'ticket-id' => $column['key'] === 'ticket',
+                        ])>{{ $ticket[$column['key']] }}</td>
+                    @endforeach
+                </tr>
+            @empty
+                <tr><td class="empty" colspan="{{ count($columns) }}">No hay tickets para los criterios seleccionados.</td></tr>
+            @endforelse
+        </tbody>
+    </table>
+</body>
+</html>

routes/api.php

@@ -16,5 +16,6 @@ require __DIR__.'/../app/Domains/Ticket/routes/api.php';
 require __DIR__.'/../app/Domains/Event/routes/api.php';
 require __DIR__.'/../app/Domains/Forms/routes/api.php';
 require __DIR__.'/../app/Domains/Staff/routes/api.php';
+require __DIR__.'/../app/Domains/Administrator/routes/api.php';
 require __DIR__.'/../app/Domains/FiestaFutbolInfantil/routes/api.php';
 require __DIR__.'/../app/Domains/Desfile/routes/api.php';

tests/Feature/Administrator/AdministratorControllerTest.php

@@ -0,0 +1,159 @@
+<?php
+
+namespace Tests\Feature\Administrator;
+
+use App\Domains\Attachable\Enums\AttachmentType;
+use App\Domains\Attachable\Models\Attachment;
+use App\Domains\Auth\Models\ResetPasswordAttempt;
+use App\Domains\Auth\Models\User;
+use App\Domains\Authorization\Enums\RoleCode;
+use App\Domains\Notification\Events\PasswordResetRequested;
+use App\Domains\Tenant\Models\Tenant;
+use App\Domains\Tenant\Models\WebsiteType;
+use Database\Seeders\AuthorizationSeeder;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Support\Facades\Event;
+use Laravel\Sanctum\Sanctum;
+use Tests\TestCase;
+
+class AdministratorControllerTest extends TestCase
+{
+    use RefreshDatabase;
+
+    private Tenant $tenant;
+
+    private User $admin;
+
+    protected function setUp(): void
+    {
+        parent::setUp();
+
+        Event::fake([PasswordResetRequested::class]);
+        $this->seed(AuthorizationSeeder::class);
+        WebsiteType::query()->create(['codigo' => 'onticket', 'nombre' => 'OnTicket']);
+        $headerLogo = $this->createAttachment('header.png');
+        $footerLogo = $this->createAttachment('footer.png');
+        $this->tenant = Tenant::query()->create([
+            'codigo' => 'acme',
+            'nombre' => 'Acme',
+            'dominio' => 'acme.test',
+            'website_type_code' => 'onticket',
+            'primary_color' => '#111111',
+            'secondary_color' => '#222222',
+            'danger_color' => '#cc0000',
+            'success_color' => '#008800',
+            'header_bg_color' => '#ffffff',
+            'footer_bg_color' => '#ffffff',
+            'header_logo_id' => $headerLogo->id,
+            'footer_logo_id' => $footerLogo->id,
+        ]);
+        $this->admin = User::factory()->create([
+            'rol_codigo' => RoleCode::AdminApp->value,
+            'tenant_codigo' => $this->tenant->codigo,
+        ]);
+    }
+
+    private const URL = '/api/v1/adminapp/tenant/administrators';
+
+    private function payload(): array
+    {
+        return ['nombre_apellido' => 'Ada Lovelace', 'dni' => '12345678', 'email' => 'ada@example.test'];
+    }
+
+    public function test_email_can_be_shared_with_customers_and_scanners(): void
+    {
+        Sanctum::actingAs($this->admin);
+        foreach (['user', 'scanner'] as $role) {
+            User::factory()->create(['email' => 'ada@example.test', 'rol_codigo' => $role]);
+        }
+        $response = $this->postJson(self::URL, $this->payload())->assertCreated();
+        $this->putJson(self::URL.'/'.$response->json('data.id'), $this->payload())->assertOk();
+        $this->postJson(self::URL, $this->payload())->assertUnprocessable()->assertJsonValidationErrors('email');
+    }
+
+    public function test_crud_and_password_setup_and_token_revocation(): void
+    {
+        Sanctum::actingAs($this->admin);
+        $response = $this->postJson(self::URL, [...$this->payload(), 'email' => ' ADA@example.test ', 'rol_codigo' => 'admin', 'tenant_codigo' => 'other'])
+            ->assertCreated()->assertJsonPath('data.email', 'ada@example.test')
+            ->assertJsonPath('data.rol_codigo', 'adminapp')->assertJsonMissingPath('data.password');
+        $id = $response->json('data.id');
+        $this->assertDatabaseHas('users', ['id' => $id, 'tenant_codigo' => $this->tenant->codigo, 'rol_codigo' => 'adminapp']);
+        $this->assertDatabaseHas('reset_password_attempts', ['user_id' => $id, 'reason' => ResetPasswordAttempt::REASON_ADMINISTRATOR_CREATED, 'status' => ResetPasswordAttempt::STATUS_PENDING]);
+        Event::assertDispatched(PasswordResetRequested::class, fn ($event) => $event->channel === PasswordResetRequested::CHANNEL_ADMINAPP && $event->tenantCode === $this->tenant->codigo);
+        $this->getJson(self::URL.'?search=Ada')->assertOk()->assertJsonCount(1, 'data');
+        $this->putJson(self::URL."/{$id}", [...$this->payload(), 'nombre_apellido' => 'Ada Byron', 'rol_codigo' => 'scanner'])
+            ->assertOk()->assertJsonPath('data.nombre_apellido', 'Ada Byron')->assertJsonPath('data.rol_codigo', 'adminapp');
+        $token = User::findOrFail($id)->createToken('adminapp')->accessToken;
+        $this->deleteJson(self::URL."/{$id}")->assertNoContent();
+        $this->assertSoftDeleted('users', ['id' => $id]);
+        $this->assertDatabaseMissing('personal_access_tokens', ['id' => $token->id]);
+        $this->getJson(self::URL.'?search=Ada')->assertOk()->assertJsonCount(0, 'data');
+        $this->postJson(self::URL, $this->payload())->assertCreated();
+    }
+
+    public function test_validation_and_case_insensitive_active_email_uniqueness(): void
+    {
+        Sanctum::actingAs($this->admin);
+        $this->postJson(self::URL, [])->assertUnprocessable()->assertJsonValidationErrors(['nombre_apellido', 'dni', 'email']);
+        $this->postJson(self::URL, [...$this->payload(), 'email' => 'invalid'])->assertUnprocessable()->assertJsonValidationErrors('email');
+        $this->postJson(self::URL, [...$this->payload(), 'email' => strtoupper($this->admin->email)])->assertUnprocessable()->assertJsonValidationErrors('email');
+        $target = User::factory()->create(['rol_codigo' => 'adminapp', 'tenant_codigo' => $this->tenant->codigo]);
+        $this->putJson(self::URL."/{$target->id}", [...$this->payload(), 'email' => strtoupper($this->admin->email)])->assertUnprocessable()->assertJsonValidationErrors('email');
+    }
+
+    public function test_other_tenants_and_roles_are_excluded(): void
+    {
+        Sanctum::actingAs($this->admin);
+        $otherTenant = $this->tenant->replicate();
+        $otherTenant->codigo = 'other';
+        $otherTenant->dominio = 'other.test';
+        $otherTenant->save();
+        $targets = [
+            User::factory()->create(['rol_codigo' => 'adminapp', 'tenant_codigo' => $otherTenant->codigo]),
+            User::factory()->create(['rol_codigo' => 'scanner', 'tenant_codigo' => $this->tenant->codigo]),
+            User::factory()->create(['rol_codigo' => 'admin', 'tenant_codigo' => $this->tenant->codigo]),
+        ];
+        $this->getJson(self::URL)->assertOk()->assertJsonCount(1, 'data')->assertJsonPath('data.0.id', $this->admin->id);
+        foreach ($targets as $target) {
+            $this->putJson(self::URL."/{$target->id}", $this->payload())->assertNotFound();
+            $this->deleteJson(self::URL."/{$target->id}")->assertNotFound();
+            $this->assertNotSoftDeleted($target);
+        }
+    }
+
+    public function test_cannot_delete_self_even_with_another_administrator(): void
+    {
+        Sanctum::actingAs($this->admin);
+        $this->deleteJson(self::URL."/{$this->admin->id}")->assertUnprocessable()->assertJsonValidationErrors('administrator');
+        User::factory()->create(['rol_codigo' => 'adminapp', 'tenant_codigo' => $this->tenant->codigo]);
+        $this->deleteJson(self::URL."/{$this->admin->id}")->assertUnprocessable();
+        $this->assertNotSoftDeleted($this->admin);
+    }
+
+    public function test_in_flight_request_from_deleted_actor_cannot_remove_last_administrator(): void
+    {
+        $remaining = User::factory()->create(['rol_codigo' => 'adminapp', 'tenant_codigo' => $this->tenant->codigo]);
+        $this->admin->delete();
+        Sanctum::actingAs($this->admin);
+        $this->deleteJson(self::URL."/{$remaining->id}")->assertUnprocessable()->assertJsonValidationErrors('administrator');
+        $this->assertNotSoftDeleted($remaining);
+    }
+
+    public function test_authentication_and_role_are_required_for_all_operations(): void
+    {
+        $this->getJson(self::URL)->assertUnauthorized();
+        foreach (['user', 'scanner', 'admin'] as $role) {
+            Sanctum::actingAs(User::factory()->create(['rol_codigo' => $role, 'tenant_codigo' => $this->tenant->codigo]));
+            $this->getJson(self::URL)->assertForbidden();
+            $this->postJson(self::URL, $this->payload())->assertForbidden();
+            $this->putJson(self::URL."/{$this->admin->id}", $this->payload())->assertForbidden();
+            $this->deleteJson(self::URL."/{$this->admin->id}")->assertForbidden();
+        }
+    }
+
+    private function createAttachment(string $filename): Attachment
+    {
+        return Attachment::query()->create(['path' => "test/{$filename}", 'filename' => $filename, 'type' => AttachmentType::Image, 'mime_type' => 'image/png']);
+    }
+}

tests/Feature/Auth/EmailUniquenessPerRoleTest.php

@@ -0,0 +1,133 @@
+<?php
+
+namespace Tests\Feature\Auth;
+
+use App\Domains\Attachable\Enums\AttachmentType;
+use App\Domains\Attachable\Models\Attachment;
+use App\Domains\Auth\Models\ResetPasswordAttempt;
+use App\Domains\Auth\Models\User;
+use App\Domains\Authorization\Enums\RoleCode;
+use App\Domains\Notification\Events\PasswordResetRequested;
+use App\Domains\Tenant\Models\Tenant;
+use Database\Seeders\AuthorizationSeeder;
+use Illuminate\Database\UniqueConstraintViolationException;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Routing\Middleware\ThrottleRequests;
+use Illuminate\Support\Facades\Event;
+use Illuminate\Support\Facades\Hash;
+use Tests\TestCase;
+
+class EmailUniquenessPerRoleTest extends TestCase
+{
+    use RefreshDatabase;
+
+    protected function setUp(): void
+    {
+        parent::setUp();
+        $this->withoutMiddleware(ThrottleRequests::class);
+        $this->seed(AuthorizationSeeder::class);
+        Event::fake([PasswordResetRequested::class]);
+    }
+
+    public function test_database_allows_different_roles_and_reuse_after_soft_delete(): void
+    {
+        foreach (RoleCode::cases() as $role) {
+            User::factory()->create(['email' => 'Shared@example.com', 'rol_codigo' => $role->value]);
+        }
+        $user = User::where('rol_codigo', 'user')->sole();
+        $user->delete();
+        $replacement = User::factory()->create(['email' => 'shared@example.com']);
+        $this->assertNotSame($user->id, $replacement->id);
+        $this->assertSame(4, User::where('active_email', 'shared@example.com')->count());
+    }
+
+    public function test_database_rejects_same_role_case_insensitively_across_tenants(): void
+    {
+        foreach (['one', 'two'] as $code) {
+            $this->createTenant($code);
+        }
+        User::factory()->create(['email' => 'Shared@example.com', 'tenant_codigo' => 'one']);
+        $this->expectException(UniqueConstraintViolationException::class);
+        User::factory()->create(['email' => 'shared@example.com', 'tenant_codigo' => 'two']);
+    }
+
+    public function test_role_change_cannot_create_a_duplicate_active_identity(): void
+    {
+        User::factory()->create(['email' => 'shared@example.com']);
+        $admin = User::factory()->create(['email' => 'shared@example.com', 'rol_codigo' => 'adminapp']);
+        $this->expectException(UniqueConstraintViolationException::class);
+        $admin->update(['rol_codigo' => 'user']);
+    }
+
+    public function test_registration_accepts_another_role_but_rejects_same_role(): void
+    {
+        User::factory()->create(['email' => 'SHARED@example.com', 'rol_codigo' => 'adminapp']);
+        $payload = ['nombre_apellido' => 'Shared', 'email' => ' Shared@Example.com ',
+            'password' => 'Secret!123', 'password_confirmation' => 'Secret!123'];
+        $this->postJson('/api/register', $payload)->assertCreated()->assertJsonPath('data.email', 'shared@example.com');
+        $this->postJson('/api/register', $payload)->assertUnprocessable()->assertJsonValidationErrors('email');
+    }
+
+    public function test_login_and_password_reset_select_the_role_from_each_application(): void
+    {
+        $tenant = $this->createTenant('acme');
+        $users = [];
+        // Create staff first so an email-only lookup would select the wrong account.
+        foreach (['adminapp', 'scanner', 'user'] as $role) {
+            $users[$role] = User::factory()->create([
+                'email' => 'Shared@example.com', 'rol_codigo' => $role,
+                'tenant_codigo' => $tenant->codigo, 'password' => 'Old!'.$role,
+            ]);
+        }
+        foreach (['user' => '/api', 'adminapp' => '/api/v1/adminapp', 'scanner' => '/api/v1/scanner'] as $role => $base) {
+            $this->postJson($base.'/login', [
+                'email' => 'SHARED@example.com', 'password' => 'Old!'.$role, 'tenant_codigo' => 'acme',
+            ])->assertOk()->assertJsonPath('user.id', $users[$role]->id);
+            $this->postJson($base.'/password/reset-attempts', [
+                'email' => 'shared@example.com', 'tenant_codigo' => 'acme',
+            ])->assertAccepted();
+        }
+        // Identical codes across roles must still only change the intended account.
+        ResetPasswordAttempt::query()->update(['codigo' => '1234']);
+        foreach (['user' => '/api', 'adminapp' => '/api/v1/adminapp', 'scanner' => '/api/v1/scanner'] as $role => $base) {
+            $this->postJson($base.'/password/reset-attempts/validate', [
+                'email' => 'shared@example.com', 'codigo' => '1234',
+            ])->assertOk();
+            $this->postJson($base.'/password/reset', [
+                'email' => 'shared@example.com', 'codigo' => '1234',
+                'password' => 'New!'.$role, 'password_confirmation' => 'New!'.$role,
+            ])->assertOk();
+            $this->assertTrue(Hash::check('New!'.$role, $users[$role]->fresh()->password));
+        }
+    }
+
+    private function createTenant(string $code): Tenant
+    {
+        $headerLogo = $this->createAttachment("{$code}-header");
+        $footerLogo = $this->createAttachment("{$code}-footer");
+
+        return Tenant::query()->create([
+            'codigo' => $code,
+            'nombre' => ucfirst($code),
+            'dominio' => "{$code}.local",
+            'primary_color' => '#000000',
+            'secondary_color' => '#000000',
+            'danger_color' => '#000000',
+            'success_color' => '#000000',
+            'header_bg_color' => '#000000',
+            'footer_bg_color' => '#000000',
+            'header_logo_id' => $headerLogo->id,
+            'footer_logo_id' => $footerLogo->id,
+        ]);
+    }
+
+    private function createAttachment(string $name): Attachment
+    {
+        return Attachment::query()->create([
+            'path' => "test/{$name}.png",
+            'filename' => "{$name}.png",
+            'type' => AttachmentType::Image,
+            'mime_type' => 'image/png',
+        ]);
+    }
+}

tests/Feature/Auth/RegisterControllerTest.php

@@ -135,4 +135,36 @@ class RegisterControllerTest extends TestCase
             'password',
         ]);
     }
+
+    public function test_it_can_reuse_the_email_of_a_soft_deleted_user(): void
+    {
+        $deletedUser = User::factory()->create([
+            'email' => 'reused@example.com',
+        ]);
+        $deletedUser->delete();
+
+        $response = $this->postJson('/api/register', [
+            'nombre_apellido' => 'New Account',
+            'email' => 'reused@example.com',
+            'password' => 'Secret!123',
+            'password_confirmation' => 'Secret!123',
+        ])->assertCreated();
+
+        $newUserId = $response->json('data.id');
+
+        $this->assertNotSame($deletedUser->id, $newUserId);
+        $this->assertSame(
+            2,
+            User::withTrashed()->where('email', 'reused@example.com')->count(),
+        );
+        $this->assertDatabaseHas('users', [
+            'id' => $deletedUser->id,
+            'active_email' => null,
+        ]);
+        $this->assertDatabaseHas('users', [
+            'id' => $newUserId,
+            'active_email' => 'reused@example.com',
+            'deleted_at' => null,
+        ]);
+    }
 }

tests/Feature/Auth/ScannerLoginControllerTest.php

@@ -2,6 +2,7 @@
 
 namespace Tests\Feature\Auth;
 
+use App\Domains\Attachable\Models\Attachment;
 use App\Domains\Auth\Models\LoginAttempt;
 use App\Domains\Auth\Models\ResetPasswordAttempt;
 use App\Domains\Auth\Models\User;
@@ -14,6 +15,7 @@ use App\Domains\Tenant\Models\Tenant;
 use Illuminate\Foundation\Testing\RefreshDatabase;
 use Illuminate\Support\Facades\Event;
 use Illuminate\Support\Facades\Hash;
+use Illuminate\Support\Str;
 use Tests\TestCase;
 
 class ScannerLoginControllerTest extends TestCase
@@ -23,19 +25,15 @@ class ScannerLoginControllerTest extends TestCase
     public function test_it_logs_in_a_tenant_bound_user_with_scan_permission(): void
     {
         $role = Role::query()->create([
-            'codigo' => RoleCode::AdminApp->value,
+            'codigo' => RoleCode::Scanner->value,
-            'nombre' => 'Operador',
+            'nombre' => 'Scanner',
         ]);
         $permission = Permission::query()->create([
             'codigo' => PermissionCode::ScanTickets->value,
             'nombre' => 'Escanear tickets',
         ]);
         $role->permissions()->attach($permission->codigo);
-        $tenant = Tenant::query()->create([
+        $tenant = $this->createTenant();
-            'codigo' => 'acme',
-            'nombre' => 'Acme',
-            'dominio' => 'acme.test',
-        ]);
         $user = User::factory()->create([
             'email' => 'scanner@example.com',
             'password' => Hash::make('secret123'),
@@ -51,23 +49,85 @@ class ScannerLoginControllerTest extends TestCase
         $response
             ->assertOk()
             ->assertJsonPath('user.id', $user->id)
-            ->assertJsonPath('user.rol_codigo', RoleCode::AdminApp->value)
+            ->assertJsonPath('user.rol_codigo', RoleCode::Scanner->value)
             ->assertJsonPath('token_type', 'Bearer');
 
         $this->assertSame(['scanner'], $user->tokens()->sole()->abilities);
     }
 
+    public function test_it_rejects_adminapp_credentials_even_when_the_role_has_scan_permission(): void
+    {
+        $role = Role::query()->create([
+            'codigo' => RoleCode::AdminApp->value,
+            'nombre' => 'Administrador',
+        ]);
+        $permission = Permission::query()->create([
+            'codigo' => PermissionCode::ScanTickets->value,
+            'nombre' => 'Escanear tickets',
+        ]);
+        $role->permissions()->attach($permission->codigo);
+        $tenant = $this->createTenant();
+        $adminApp = User::factory()->create([
+            'email' => 'shared@example.com',
+            'password' => Hash::make('admin-password'),
+            'rol_codigo' => $role->codigo,
+            'tenant_codigo' => $tenant->codigo,
+        ]);
+
+        $this->postJson('/api/v1/scanner/login', [
+            'email' => $adminApp->email,
+            'password' => 'admin-password',
+            'rol_codigo' => RoleCode::AdminApp->value,
+        ])->assertUnprocessable()->assertJsonValidationErrors(['email']);
+
+        $this->assertDatabaseCount('personal_access_tokens', 0);
+    }
+
+    public function test_shared_email_authenticates_the_scanner_identity_only(): void
+    {
+        $scannerRole = Role::query()->create([
+            'codigo' => RoleCode::Scanner->value,
+            'nombre' => 'Scanner',
+        ]);
+        $adminAppRole = Role::query()->create([
+            'codigo' => RoleCode::AdminApp->value,
+            'nombre' => 'Administrador',
+        ]);
+        $permission = Permission::query()->create([
+            'codigo' => PermissionCode::ScanTickets->value,
+            'nombre' => 'Escanear tickets',
+        ]);
+        $scannerRole->permissions()->attach($permission->codigo);
+        $tenant = $this->createTenant();
+        User::factory()->create([
+            'email' => 'shared@example.com',
+            'password' => Hash::make('admin-password'),
+            'rol_codigo' => $adminAppRole->codigo,
+            'tenant_codigo' => $tenant->codigo,
+        ]);
+        $scanner = User::factory()->create([
+            'email' => 'shared@example.com',
+            'password' => Hash::make('scanner-password'),
+            'rol_codigo' => $scannerRole->codigo,
+            'tenant_codigo' => $tenant->codigo,
+        ]);
+
+        $this->postJson('/api/v1/scanner/login', [
+            'email' => 'shared@example.com',
+            'password' => 'scanner-password',
+        ])
+            ->assertOk()
+            ->assertJsonPath('user.id', $scanner->id)
+            ->assertJsonPath('user.rol_codigo', RoleCode::Scanner->value);
+    }
+
     public function test_it_rejects_a_user_without_scan_permission(): void
     {
         $role = Role::query()->create([
             'codigo' => RoleCode::Scanner->value,
             'nombre' => 'Scanner sin permiso',
         ]);
-        $tenant = Tenant::query()->create([
+        $tenant = $this->createTenant();
-            'codigo' => 'acme',
-            'nombre' => 'Acme',
-            'dominio' => 'acme.test',
-        ]);
         $user = User::factory()->create([
             'email' => 'customer@example.com',
             'password' => Hash::make('secret123'),
@@ -92,11 +152,7 @@ class ScannerLoginControllerTest extends TestCase
             'nombre' => 'Escanear tickets',
         ]);
         $role->permissions()->attach($permission->codigo);
-        $tenant = Tenant::query()->create([
+        $tenant = $this->createTenant();
-            'codigo' => 'acme',
-            'nombre' => 'Acme',
-            'dominio' => 'acme.test',
-        ]);
         $user = User::factory()->create([
             'email' => 'scanner@example.com',
             'password' => Hash::make('correct-password'),
@@ -134,11 +190,7 @@ class ScannerLoginControllerTest extends TestCase
             'nombre' => 'Escanear tickets',
         ]);
         $role->permissions()->attach($permission->codigo);
-        $tenant = Tenant::query()->create([
+        $tenant = $this->createTenant();
-            'codigo' => 'acme',
-            'nombre' => 'Acme',
-            'dominio' => 'acme.test',
-        ]);
         $user = User::factory()->create([
             'email' => 'scanner@example.com',
             'password' => Hash::make('correct-password'),
@@ -163,4 +215,30 @@ class ScannerLoginControllerTest extends TestCase
                 && $event->channel === PasswordResetRequested::CHANNEL_SCANNER,
         );
     }
+
+    private function createTenant(): Tenant
+    {
+        $logo = Attachment::query()->create([
+            'key' => (string) Str::uuid(),
+            'path' => 'tests/scanner-login-logo.png',
+            'filename' => 'scanner-login-logo.png',
+            'type' => 'image',
+            'mime_type' => 'image/png',
+            'extension' => 'png',
+            'size' => 1,
+        ]);
+
+        return Tenant::query()->create([
+            'codigo' => 'acme',
+            'nombre' => 'Acme',
+            'dominio' => 'acme.test',
+            'primary_color' => '#000000',
+            'secondary_color' => '#000000',
+            'danger_color' => '#000000',
+            'header_bg_color' => '#000000',
+            'footer_bg_color' => '#000000',
+            'header_logo_id' => $logo->id,
+            'footer_logo_id' => $logo->id,
+        ]);
+    }
 }

tests/Feature/Auth/ScannerMeControllerTest.php

@@ -2,6 +2,7 @@
 
 namespace Tests\Feature\Auth;
 
+use App\Domains\Attachable\Models\Attachment;
 use App\Domains\Auth\Models\User;
 use App\Domains\Authorization\Enums\PermissionCode;
 use App\Domains\Authorization\Enums\RoleCode;
@@ -10,6 +11,7 @@ use App\Domains\Authorization\Models\Role;
 use App\Domains\Menu\Models\Menu;
 use App\Domains\Tenant\Models\Tenant;
 use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Support\Str;
 use Laravel\Sanctum\Sanctum;
 use Tests\TestCase;
 
@@ -28,11 +30,7 @@ class ScannerMeControllerTest extends TestCase
             'nombre' => 'Escanear tickets',
         ]);
         $scannerRole->permissions()->attach($permission->codigo);
-        $tenant = Tenant::query()->create([
+        $tenant = $this->createTenant();
-            'codigo' => 'acme',
-            'nombre' => 'Acme',
-            'dominio' => 'acme.test',
-        ]);
         $home = Menu::query()->create([
             'code' => 'scanner.inicio',
             'label' => 'Inicio',
@@ -65,4 +63,51 @@ class ScannerMeControllerTest extends TestCase
             ->assertJsonCount(2, 'data.tenant.menues')
             ->assertJsonMissing(['code' => $foreign->code]);
     }
+
+    public function test_it_rejects_an_adminapp_user_even_with_scan_permission(): void
+    {
+        $adminAppRole = Role::query()->create([
+            'codigo' => RoleCode::AdminApp->value,
+            'nombre' => 'Administrador',
+        ]);
+        $permission = Permission::query()->create([
+            'codigo' => PermissionCode::ScanTickets->value,
+            'nombre' => 'Escanear tickets',
+        ]);
+        $adminAppRole->permissions()->attach($permission->codigo);
+        $tenant = $this->createTenant();
+        $adminApp = User::factory()->create([
+            'rol_codigo' => $adminAppRole->codigo,
+            'tenant_codigo' => $tenant->codigo,
+        ]);
+        Sanctum::actingAs($adminApp);
+
+        $this->getJson('/api/v1/scanner/me')->assertForbidden();
+    }
+
+    private function createTenant(): Tenant
+    {
+        $logo = Attachment::query()->create([
+            'key' => (string) Str::uuid(),
+            'path' => 'tests/scanner-me-logo.png',
+            'filename' => 'scanner-me-logo.png',
+            'type' => 'image',
+            'mime_type' => 'image/png',
+            'extension' => 'png',
+            'size' => 1,
+        ]);
+
+        return Tenant::query()->create([
+            'codigo' => 'acme',
+            'nombre' => 'Acme',
+            'dominio' => 'acme.test',
+            'primary_color' => '#000000',
+            'secondary_color' => '#000000',
+            'danger_color' => '#000000',
+            'header_bg_color' => '#000000',
+            'footer_bg_color' => '#000000',
+            'header_logo_id' => $logo->id,
+            'footer_logo_id' => $logo->id,
+        ]);
+    }
 }

tests/Feature/Forms/AdminAppSaleFormControllerTest.php

@@ -2,6 +2,8 @@
 
 namespace Tests\Feature\Forms;
 
+use App\Domains\Attachable\Enums\AttachmentType;
+use App\Domains\Attachable\Models\Attachment;
 use App\Domains\Auth\Models\User;
 use App\Domains\Authorization\Enums\RoleCode;
 use App\Domains\Purchase\Models\Purchase;
@@ -34,12 +36,7 @@ class AdminAppSaleFormControllerTest extends TestCase
 
     public function test_an_adminapp_user_can_get_the_sale_form(): void
     {
-        $tenant = Tenant::query()->create([
+        $tenant = $this->createTenant('acme');
-            'codigo' => 'acme',
-            'nombre' => 'Acme',
-            'dominio' => 'acme.test',
-            'website_type_code' => 'onticket',
-        ]);
         Sanctum::actingAs(User::factory()->create([
             'rol_codigo' => RoleCode::AdminApp->value,
             'tenant_codigo' => $tenant->codigo,
@@ -47,13 +44,15 @@ class AdminAppSaleFormControllerTest extends TestCase
 
         $this->getJson('/api/v1/adminapp/forms/sale')
             ->assertOk()
-            ->assertJsonCount(count(Purchase::statuses()), 'data.statuses')
+            ->assertJsonCount(count(Purchase::adminStatusCodes()), 'data.statuses')
-            ->assertJsonPath('data.statuses.0.code', Purchase::STATUS_CREATED)
+            ->assertJsonPath('data.statuses.0.value', Purchase::ADMIN_STATUS_INCOMPLETE)
-            ->assertJsonPath('data.statuses.0.name', 'Creada')
+            ->assertJsonPath('data.statuses.0.label', 'Por completar datos')
-            ->assertJsonPath('data.statuses.1.code', Purchase::STATUS_PENDING_PAYMENT)
+            ->assertJsonPath('data.statuses.0.real_statuses.0', Purchase::STATUS_CREATED)
-            ->assertJsonPath('data.statuses.2.code', Purchase::STATUS_IN_REVIEW)
+            ->assertJsonPath('data.statuses.1.value', Purchase::ADMIN_STATUS_AWAITING_PAYMENT)
-            ->assertJsonPath('data.statuses.3.code', Purchase::STATUS_PAID)
+            ->assertJsonPath('data.statuses.1.real_statuses.0', Purchase::STATUS_PENDING_PAYMENT)
-            ->assertJsonPath('data.statuses.6.code', Purchase::STATUS_EXPIRED);
+            ->assertJsonPath('data.statuses.1.real_statuses.1', Purchase::STATUS_IN_REVIEW)
+            ->assertJsonPath('data.statuses.2.value', Purchase::ADMIN_STATUS_CONFIRMED)
+            ->assertJsonPath('data.statuses.3.value', Purchase::ADMIN_STATUS_CANCELLED);
     }
 
     public function test_a_customer_cannot_get_the_sale_form(): void
@@ -65,4 +64,34 @@ class AdminAppSaleFormControllerTest extends TestCase
 
         $this->getJson('/api/v1/adminapp/forms/sale')->assertForbidden();
     }
+
+    private function createTenant(string $code): Tenant
+    {
+        $headerLogo = $this->createAttachment("{$code}-header");
+        $footerLogo = $this->createAttachment("{$code}-footer");
+
+        return Tenant::query()->create([
+            'codigo' => $code,
+            'nombre' => ucfirst($code),
+            'dominio' => "{$code}.test",
+            'primary_color' => '#000000',
+            'secondary_color' => '#ffffff',
+            'danger_color' => '#dc3545',
+            'header_bg_color' => '#ffffff',
+            'footer_bg_color' => '#000000',
+            'header_logo_id' => $headerLogo->id,
+            'footer_logo_id' => $footerLogo->id,
+            'website_type_code' => 'onticket',
+        ]);
+    }
+
+    private function createAttachment(string $name): Attachment
+    {
+        return Attachment::query()->create([
+            'path' => "test/{$name}.png",
+            'filename' => "{$name}.png",
+            'type' => AttachmentType::Image,
+            'mime_type' => 'image/png',
+        ]);
+    }
 }

tests/Feature/Forms/AdminAppTicketFilterFormControllerTest.php

@@ -0,0 +1,357 @@
+<?php
+
+namespace Tests\Feature\Forms;
+
+use App\Domains\Attachable\Enums\AttachmentType;
+use App\Domains\Attachable\Models\Attachment;
+use App\Domains\Auth\Models\User;
+use App\Domains\Authorization\Enums\RoleCode;
+use App\Domains\Catalog\Models\CatalogItem;
+use App\Domains\Catalog\Services\CatalogService;
+use App\Domains\Menu\Models\Menu;
+use App\Domains\Tenant\Models\Tenant;
+use App\Domains\Ticket\Models\Ticket;
+use Database\Seeders\AttributeSeeder;
+use Database\Seeders\AuthorizationSeeder;
+use Database\Seeders\FiestaFutbolInfantilProductSeeder;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Support\Str;
+use Laravel\Sanctum\Sanctum;
+use Tests\TestCase;
+
+class AdminAppTicketFilterFormControllerTest extends TestCase
+{
+    use RefreshDatabase;
+
+    protected function setUp(): void
+    {
+        parent::setUp();
+
+        $this->seed(AuthorizationSeeder::class);
+    }
+
+    public function test_authentication_is_required(): void
+    {
+        $this->getJson('/api/v1/adminapp/forms/tickets-filter')->assertUnauthorized();
+    }
+
+    public function test_the_tenant_must_have_the_tickets_menu(): void
+    {
+        $tenant = $this->createTenant('tenant_without_tickets');
+        Sanctum::actingAs($this->createAdminAppUser($tenant));
+
+        $this->getJson('/api/v1/adminapp/forms/tickets-filter')->assertNotFound();
+    }
+
+    public function test_it_returns_the_common_ticket_filter_fields_for_other_tenants(): void
+    {
+        $tenant = $this->createTenant('another_tenant');
+        $this->grantTicketsMenu($tenant);
+        Sanctum::actingAs($this->createAdminAppUser($tenant));
+
+        $this->getJson('/api/v1/adminapp/forms/tickets-filter')
+            ->assertOk()
+            ->assertExactJson([
+                'data' => [
+                    'code' => 'tickets_filter',
+                    'action' => '/api/v1/adminapp/tenant/tickets',
+                    'method' => 'GET',
+                    'columns' => $this->commonColumns(),
+                    'fields' => [
+                        [
+                            'name' => 'date',
+                            'query_param' => 'date',
+                            'label' => 'Fecha',
+                            'type' => 'date',
+                            'required' => false,
+                            'default' => null,
+                        ],
+                        [
+                            'name' => 'status',
+                            'query_param' => 'status',
+                            'label' => 'Estado',
+                            'type' => 'select',
+                            'required' => false,
+                            'default' => null,
+                            'placeholder' => 'Estado',
+                            'options' => [
+                                ['value' => 'active', 'label' => 'Activo'],
+                                ['value' => 'used', 'label' => 'Usado'],
+                                ['value' => 'expired', 'label' => 'Vencido'],
+                            ],
+                        ],
+                    ],
+                ],
+            ]);
+    }
+
+    public function test_it_returns_the_complete_nested_form_for_fiesta_futbol_infantil(): void
+    {
+        $tenant = $this->createFiestaFutbolInfantilTenant();
+        $this->grantTicketsMenu($tenant);
+        $admin = $this->createAdminAppUser($tenant);
+        Sanctum::actingAs($admin);
+
+        $response = $this->getJson('/api/v1/adminapp/forms/tickets-filter')
+            ->assertOk()
+            ->assertJsonPath('data.fields.0.name', 'category')
+            ->assertJsonPath('data.fields.0.query_param', 'category')
+            ->assertJsonPath('data.fields.1.name', 'product')
+            ->assertJsonPath('data.fields.1.query_param', 'product')
+            ->assertJsonPath('data.fields.1.depends_on', 'category')
+            ->assertJsonPath('data.fields.2.name', 'type')
+            ->assertJsonPath('data.fields.2.query_param', 'type')
+            ->assertJsonPath('data.fields.2.depends_on', 'product')
+            ->assertJsonPath('data.fields.3.name', 'size')
+            ->assertJsonPath('data.fields.3.query_param', 'size')
+            ->assertJsonPath('data.fields.3.depends_on', 'type')
+            ->assertJsonPath('data.fields.4.name', 'date')
+            ->assertJsonPath('data.fields.4.query_param', 'date')
+            ->assertJsonPath('data.fields.4.depends_on', 'category')
+            ->assertJsonPath('data.fields.5.name', 'status')
+            ->assertJsonPath('data.fields.5.query_param', 'status')
+            ->assertJsonPath('data.columns.0.key', 'order_number')
+            ->assertJsonPath('data.columns.0.sort_param', 'order_number')
+            ->assertJsonPath('data.columns.1.key', 'category')
+            ->assertJsonPath('data.columns.2.key', 'product')
+            ->assertJsonPath('data.columns.2.sortable', false)
+            ->assertJsonPath('data.columns.3.key', 'type')
+            ->assertJsonPath('data.columns.3.sortable', false)
+            ->assertJsonPath('data.columns.4.key', 'date')
+            ->assertJsonPath('data.columns.4.sortable', false)
+            ->assertJsonPath('data.columns.5.key', 'size')
+            ->assertJsonPath('data.columns.5.sortable', false);
+
+        $categories = collect($response->json('data.fields.0.options'));
+        $this->assertSame(
+            ['Entradas', 'Camping', 'Comida', 'Merchandising'],
+            $categories->pluck('label')->all(),
+        );
+
+        $entries = $categories->firstWhere('value', 'entradas');
+        $this->assertSame('Abono', $entries['children'][0]['options'][0]['label']);
+        $this->assertTrue($entries['children'][0]['options'][0]['children'][0]['disabled']);
+        $this->assertTrue($entries['children'][1]['disabled']);
+
+        $camping = $categories->firstWhere('value', 'alojamientos');
+        $this->assertSame(
+            ['Carpa', 'Motorhome'],
+            collect($camping['children'][0]['options'])->pluck('label')->all(),
+        );
+        $this->assertTrue($camping['children'][0]['options'][0]['children'][0]['disabled']);
+
+        $merchandise = $categories->firstWhere('value', 'merchandising');
+        $merchandiseProduct = $merchandise['children'][0]['options'][0];
+        $this->assertSame('Camiseta', $merchandiseProduct['label']);
+        $this->assertSame(
+            ['Verde', 'Blanco'],
+            collect($merchandiseProduct['children'][0]['options'])->pluck('label')->all(),
+        );
+        $this->assertSame(
+            ['14', 'S', 'M', 'L', 'XL', 'XXL'],
+            collect($merchandiseProduct['children'][0]['options'][0]['children'][0]['options'])
+                ->pluck('label')
+                ->all(),
+        );
+    }
+
+    public function test_merchandise_sizes_are_scoped_to_the_selected_product_and_color(): void
+    {
+        $tenant = $this->createFiestaFutbolInfantilTenant();
+        $this->grantTicketsMenu($tenant);
+        Sanctum::actingAs($this->createAdminAppUser($tenant));
+
+        $merchandise = CatalogItem::query()
+            ->where('tenant_code', $tenant->codigo)
+            ->where('slug', 'camiseta')
+            ->with([
+                'itemAttributes.attribute.options',
+                'variants.definitions.itemAttribute.attribute.options',
+            ])
+            ->firstOrFail();
+        $whiteXxl = $merchandise->variants->first(fn ($variant): bool => $variant->selectionValues()->get('color') === 'Blanco'
+            && $variant->selectionValues()->get('talle') === 'XXL');
+        $this->assertNotNull($whiteXxl);
+        app(CatalogService::class)->deleteVariant($whiteXxl);
+
+        $response = $this->getJson('/api/v1/adminapp/forms/tickets-filter')->assertOk();
+        $merchandiseCategory = collect($response->json('data.fields.0.options'))
+            ->firstWhere('value', 'merchandising');
+        $product = $merchandiseCategory['children'][0]['options'][0];
+        $colors = collect($product['children'][0]['options']);
+        $greenSizes = collect($colors->firstWhere('value', 'Verde')['children'][0]['options'])
+            ->pluck('value');
+        $whiteSizes = collect($colors->firstWhere('value', 'Blanco')['children'][0]['options'])
+            ->pluck('value');
+
+        $this->assertContains('XXL', $greenSizes);
+        $this->assertNotContains('XXL', $whiteSizes);
+    }
+
+    public function test_a_food_schedule_is_only_returned_when_a_variant_exists_for_the_date(): void
+    {
+        $tenant = $this->createFiestaFutbolInfantilTenant();
+        $this->grantTicketsMenu($tenant);
+        Sanctum::actingAs($this->createAdminAppUser($tenant));
+
+        $food = CatalogItem::query()
+            ->where('tenant_code', $tenant->codigo)
+            ->where('slug', 'comida')
+            ->with([
+                'itemAttributes.attribute.options',
+                'variants.definitions.itemAttribute.attribute.options',
+                'variants.eventDates',
+                'variants.eventDate',
+            ])
+            ->firstOrFail();
+
+        $food->variants
+            ->filter(fn ($variant): bool => $variant->selectionValues()->get('horario') === 'Almuerzo')
+            ->each->delete();
+
+        $response = $this->getJson('/api/v1/adminapp/forms/tickets-filter')->assertOk();
+        $foodCategory = collect($response->json('data.fields.0.options'))->firstWhere('value', 'comidas');
+        $schedules = collect($foodCategory['children'][0]['options'])->pluck('value');
+
+        $this->assertNotContains('Almuerzo', $schedules);
+        $this->assertContains('Desayuno', $schedules);
+        $this->assertContains('Cena', $schedules);
+    }
+
+    public function test_a_deleted_food_variant_remains_in_the_filter_when_a_ticket_references_it(): void
+    {
+        $tenant = $this->createFiestaFutbolInfantilTenant();
+        $this->grantTicketsMenu($tenant);
+        $admin = $this->createAdminAppUser($tenant);
+        Sanctum::actingAs($admin);
+
+        $food = CatalogItem::query()
+            ->where('tenant_code', $tenant->codigo)
+            ->where('slug', 'comida')
+            ->with([
+                'itemAttributes.attribute.options',
+                'variants.definitions.itemAttribute.attribute.options',
+                'variants.eventDates',
+                'variants.eventDate',
+            ])
+            ->firstOrFail();
+        $historicalVariant = $food->variants->first(function ($variant): bool {
+            return $variant->selectedEventDates()->first()?->date->format('d/m') === '12/10'
+                && $variant->selectionValues()->get('horario') === 'Cena';
+        });
+        $this->assertNotNull($historicalVariant);
+        $historicalService = $historicalVariant->selectionValues()->get('servicio');
+
+        $ticket = Ticket::query()->create([
+            'tenant_code' => $tenant->codigo,
+            'ticket' => (string) Str::uuid(),
+            'user_id' => $admin->id,
+            'source_catalog_item_id' => $food->id,
+            'source_variant_id' => $historicalVariant->id,
+        ]);
+
+        $catalogService = app(CatalogService::class);
+        foreach ($food->variants as $variant) {
+            $catalogService->deleteVariant($variant);
+        }
+
+        $this->assertTrue(CatalogItem::withTrashed()->findOrFail($food->id)->trashed());
+
+        $response = $this->getJson('/api/v1/adminapp/forms/tickets-filter')->assertOk();
+        $foodCategory = collect($response->json('data.fields.0.options'))->firstWhere('value', 'comidas');
+        $products = collect($foodCategory['children'][0]['options']);
+
+        $this->assertCount(1, $products);
+        $this->assertSame('Cena', $products->first()['label']);
+        $this->assertSame(
+            [$historicalService],
+            collect($products->first()['children'][0]['options'])->pluck('label')->all(),
+        );
+
+        $this->getJson('/api/v1/adminapp/tenant/tickets?'.http_build_query([
+            'category' => 'comidas',
+            'product' => $products->first()['value'],
+            'type' => $historicalService,
+            'date' => '2026-10-12',
+        ]))
+            ->assertOk()
+            ->assertJsonCount(1, 'data')
+            ->assertJsonPath('data.0.id', $ticket->id)
+            ->assertJsonPath('data.0.values.category', 'Comida')
+            ->assertJsonPath('data.0.values.product', 'Cena')
+            ->assertJsonPath('data.0.values.type', $historicalService)
+            ->assertJsonPath('data.0.values.date', '12/10')
+            ->assertJsonPath('data.0.values.size', '-');
+    }
+
+    private function createFiestaFutbolInfantilTenant(): Tenant
+    {
+        $tenant = $this->createTenant('fiesta_futbol_infantil');
+        $this->seed([AttributeSeeder::class, FiestaFutbolInfantilProductSeeder::class]);
+
+        return $tenant->refresh();
+    }
+
+    /** @return list<array<string, mixed>> */
+    private function commonColumns(): array
+    {
+        return [
+            ['key' => 'order_number', 'label' => 'N° de orden', 'type' => 'order_number', 'sortable' => true, 'sort_param' => 'order_number', 'width' => '11%'],
+            ['key' => 'product', 'label' => 'Producto', 'type' => 'text', 'sortable' => true, 'sort_param' => 'product', 'width' => '15%'],
+            ['key' => 'amount', 'label' => 'Importe', 'type' => 'currency', 'sortable' => true, 'sort_param' => 'amount', 'width' => '10%'],
+            ['key' => 'client', 'label' => 'Cliente', 'type' => 'text', 'sortable' => true, 'sort_param' => 'client', 'width' => '15%'],
+            ['key' => 'id', 'label' => 'ID', 'type' => 'text', 'sortable' => true, 'sort_param' => 'id', 'width' => '8%'],
+            ['key' => 'status', 'label' => 'Estado', 'type' => 'status', 'sortable' => true, 'sort_param' => 'status', 'width' => '8%'],
+            ['key' => 'scanned_by', 'label' => 'Escaneado por', 'type' => 'text', 'sortable' => true, 'sort_param' => 'scanned_by', 'width' => '11%'],
+        ];
+    }
+
+    private function createTenant(string $code): Tenant
+    {
+        $headerLogo = $this->createAttachment("{$code}-header.png");
+        $footerLogo = $this->createAttachment("{$code}-footer.png");
+
+        return Tenant::query()->create([
+            'codigo' => $code,
+            'nombre' => ucfirst($code),
+            'dominio' => "{$code}.test",
+            'primary_color' => '#111111',
+            'secondary_color' => '#222222',
+            'danger_color' => '#333333',
+            'success_color' => '#444444',
+            'header_bg_color' => '#ffffff',
+            'footer_bg_color' => '#ffffff',
+            'header_logo_id' => $headerLogo->id,
+            'footer_logo_id' => $footerLogo->id,
+        ]);
+    }
+
+    private function createAttachment(string $filename): Attachment
+    {
+        return Attachment::query()->create([
+            'path' => "tests/{$filename}",
+            'filename' => $filename,
+            'type' => AttachmentType::Image,
+            'mime_type' => 'image/png',
+        ]);
+    }
+
+    private function createAdminAppUser(Tenant $tenant): User
+    {
+        return User::factory()->create([
+            'rol_codigo' => RoleCode::AdminApp->value,
+            'tenant_codigo' => $tenant->codigo,
+        ]);
+    }
+
+    private function grantTicketsMenu(Tenant $tenant): void
+    {
+        $menu = Menu::query()->create([
+            'code' => 'adminapp.tickets',
+            'label' => 'Tickets',
+            'route' => '/admin/tickets',
+        ]);
+
+        $tenant->menues()->attach($menu->code);
+    }
+}

tests/Feature/Forms/AdminAppTicketFormControllerTest.php

@@ -0,0 +1,155 @@
+<?php
+
+namespace Tests\Feature\Forms;
+
+use App\Domains\Attachable\Enums\AttachmentType;
+use App\Domains\Attachable\Models\Attachment;
+use App\Domains\Auth\Models\User;
+use App\Domains\Authorization\Enums\RoleCode;
+use App\Domains\Tenant\Models\Tenant;
+use Database\Seeders\AttributeSeeder;
+use Database\Seeders\AuthorizationSeeder;
+use Database\Seeders\FiestaFutbolInfantilProductSeeder;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Laravel\Sanctum\Sanctum;
+use Tests\TestCase;
+
+class AdminAppTicketFormControllerTest extends TestCase
+{
+    use RefreshDatabase;
+
+    protected function setUp(): void
+    {
+        parent::setUp();
+
+        $this->seed(AuthorizationSeeder::class);
+    }
+
+    public function test_authentication_is_required(): void
+    {
+        $this->getJson('/api/v1/adminapp/forms/fiesta-futbol-infantil/ticket')
+            ->assertUnauthorized();
+    }
+
+    public function test_it_returns_nested_ticket_options_using_the_frontend_presentation_mapping(): void
+    {
+        $headerLogo = $this->createAttachment('header.png');
+        $footerLogo = $this->createAttachment('footer.png');
+        $tenant = Tenant::query()->create([
+            'codigo' => 'fiesta_futbol_infantil',
+            'nombre' => 'Fiesta Fútbol Infantil',
+            'dominio' => 'fiesta-futbol-infantil.test',
+            'primary_color' => '#00973F',
+            'secondary_color' => '#A0A0A0',
+            'danger_color' => '#FF8888',
+            'success_color' => '#198754',
+            'header_bg_color' => '#ffffff',
+            'footer_bg_color' => '#015327',
+            'header_logo_id' => $headerLogo->id,
+            'footer_logo_id' => $footerLogo->id,
+        ]);
+        $this->seed([AttributeSeeder::class, FiestaFutbolInfantilProductSeeder::class]);
+
+        Sanctum::actingAs(User::factory()->create([
+            'rol_codigo' => RoleCode::AdminApp->value,
+            'tenant_codigo' => $tenant->codigo,
+        ]));
+
+        $response = $this->getJson('/api/v1/adminapp/forms/fiesta-futbol-infantil/ticket')
+            ->assertOk()
+            ->assertExactJson([
+                'data' => [
+                    'statuses' => [
+                        ['value' => 'active', 'label' => 'Activo'],
+                        ['value' => 'used', 'label' => 'Usado'],
+                        ['value' => 'expired', 'label' => 'Vencido'],
+                    ],
+                    'categories' => [
+                        [
+                            'value' => 'entradas',
+                            'label' => 'Entradas',
+                            'products' => [[
+                                'value' => 'abono',
+                                'label' => 'Abono',
+                                'types' => [],
+                            ]],
+                        ],
+                        [
+                            'value' => 'alojamientos',
+                            'label' => 'Camping',
+                            'products' => [
+                                ['value' => 'Carpa', 'label' => 'Carpa', 'types' => []],
+                                ['value' => 'Motorhome', 'label' => 'Motorhome', 'types' => []],
+                            ],
+                        ],
+                        [
+                            'value' => 'comidas',
+                            'label' => 'Comida',
+                            'products' => [
+                                [
+                                    'value' => (string) $tenant->eventDates[0]->id,
+                                    'label' => '09/10',
+                                    'types' => [
+                                        ['value' => 'Desayuno', 'label' => 'Desayuno'],
+                                        ['value' => 'Almuerzo', 'label' => 'Almuerzo'],
+                                        ['value' => 'Cena', 'label' => 'Cena'],
+                                    ],
+                                ],
+                                [
+                                    'value' => (string) $tenant->eventDates[1]->id,
+                                    'label' => '10/10',
+                                    'types' => [
+                                        ['value' => 'Desayuno', 'label' => 'Desayuno'],
+                                        ['value' => 'Almuerzo', 'label' => 'Almuerzo'],
+                                        ['value' => 'Cena', 'label' => 'Cena'],
+                                    ],
+                                ],
+                                [
+                                    'value' => (string) $tenant->eventDates[2]->id,
+                                    'label' => '11/10',
+                                    'types' => [
+                                        ['value' => 'Desayuno', 'label' => 'Desayuno'],
+                                        ['value' => 'Almuerzo', 'label' => 'Almuerzo'],
+                                        ['value' => 'Cena', 'label' => 'Cena'],
+                                    ],
+                                ],
+                                [
+                                    'value' => (string) $tenant->eventDates[3]->id,
+                                    'label' => '12/10',
+                                    'types' => [
+                                        ['value' => 'Desayuno', 'label' => 'Desayuno'],
+                                        ['value' => 'Almuerzo', 'label' => 'Almuerzo'],
+                                        ['value' => 'Cena', 'label' => 'Cena'],
+                                    ],
+                                ],
+                            ],
+                        ],
+                        [
+                            'value' => 'merchandising',
+                            'label' => 'Merchandising',
+                            'products' => [[
+                                'value' => 'camiseta',
+                                'label' => 'Camiseta',
+                                'types' => [
+                                    ['value' => 'Verde', 'label' => 'Verde'],
+                                    ['value' => 'Blanco', 'label' => 'Blanco'],
+                                ],
+                            ]],
+                        ],
+                    ],
+                ],
+            ]);
+
+        $response->assertJsonMissingPath('data.categories.0.products.0.category');
+    }
+
+    private function createAttachment(string $filename): Attachment
+    {
+        return Attachment::query()->create([
+            'path' => "tests/{$filename}",
+            'filename' => $filename,
+            'type' => AttachmentType::Image,
+            'mime_type' => 'image/png',
+        ]);
+    }
+}

tests/Feature/Notification/NotificationMailServiceTest.php

@@ -4,6 +4,7 @@ namespace Tests\Feature\Notification;
 
 use App\Domains\Attachable\Enums\AttachmentType;
 use App\Domains\Attachable\Models\Attachment;
+use App\Domains\Auth\Models\ResetPasswordAttempt;
 use App\Domains\Auth\Models\User;
 use App\Domains\Catalog\Models\CatalogItem;
 use App\Domains\Integration\Models\Integration;
@@ -133,15 +134,64 @@ class NotificationMailServiceTest extends TestCase
         );
 
         Mail::assertSent(Mailable::class, function (Mailable $mail): bool {
+            $mail->assertHasSubject('Tu cuenta de escáner está lista - Scanner Mail');
             $rendered = $mail->render();
 
             return str_contains($rendered, 'https://scanner.mail.local/recuperar-contrasena/codigo')
+                && str_contains($rendered, 'Tu cuenta de escáner está lista')
+                && str_contains($rendered, 'comenzar a escanear entradas')
+                && ! str_contains($rendered, 'Recuperá tu contraseña')
                 && str_contains($rendered, 'email=ada%40example.com')
                 && str_contains($rendered, 'code=0123')
                 && str_contains($rendered, 'Crear mi');
         });
     }
 
+    public function test_administrator_creation_has_custom_copy_and_the_existing_code_and_link(): void
+    {
+        $websiteType = WebsiteType::query()->create([
+            'codigo' => 'admin-mail', 'nombre' => 'Admin Mail',
+            'dominio' => 'admin.mail.local', 'scanner_domain' => 'scanner.mail.local',
+        ]);
+        $this->tenant->update(['website_type_code' => $websiteType->codigo]);
+        $attempt = $this->user->resetPasswordAttempts()->create([
+            'codigo' => '0456', 'reason' => ResetPasswordAttempt::REASON_ADMINISTRATOR_CREATED,
+        ]);
+        app(NotificationMailService::class)->sendPasswordResetCode($attempt->id, $this->tenant->codigo, PasswordResetRequested::CHANNEL_ADMINAPP);
+        Mail::assertSent(Mailable::class, function (Mailable $mail): bool {
+            $mail->assertHasSubject('Tu cuenta de administrador está lista - Admin Mail');
+            $html = $mail->render();
+
+            return str_contains($html, 'Tu cuenta de administrador está lista')
+                && str_contains($html, 'ingresar al panel de administración')
+                && str_contains($html, '0456')
+                && str_contains($html, 'Crear mi contraseña')
+                && str_contains($html, 'https://admin.mail.local/recuperar-contrasena/codigo?email=ada%40example.com')
+                && ! str_contains($html, 'scanner.mail.local')
+                && ! str_contains($html, 'administrator_created')
+                && ! str_contains($html, 'Recuperá tu contraseña');
+        });
+    }
+
+    public function test_locked_account_has_its_own_copy_and_the_shared_code_action(): void
+    {
+        $attempt = $this->user->resetPasswordAttempts()->create([
+            'codigo' => '0789', 'reason' => ResetPasswordAttempt::REASON_ACCOUNT_LOCKED,
+        ]);
+        app(NotificationMailService::class)->sendPasswordResetCode($attempt->id, $this->tenant->codigo);
+        Mail::assertSent(Mailable::class, function (Mailable $mail): bool {
+            $mail->assertHasSubject('Desbloqueá tu cuenta - Mail Tenant');
+            $html = $mail->render();
+
+            return str_contains($html, 'Desbloqueá tu cuenta')
+                && str_contains($html, 'bloqueamos el acceso temporalmente')
+                && str_contains($html, '0789')
+                && str_contains($html, 'Ingresar código ahora')
+                && str_contains($html, 'https://mail.local/recuperar-contrasena/codigo')
+                && ! str_contains($html, 'account_locked');
+        });
+    }
+
     public function test_it_sends_one_purchase_confirmation_with_generated_tickets_attached(): void
     {
         $this->useWebsiteTypeBranding();
@@ -161,7 +211,7 @@ class NotificationMailServiceTest extends TestCase
             'precio' => 25,
             'has_tickets' => true,
         ]);
-        $purchase->items()->create([
+        $purchaseItem = $purchase->items()->create([
             'source_catalog_item_id' => $catalogItem->id,
             'nombre' => 'Entrada',
             'descripcion' => 'Entrada general',
@@ -175,7 +225,7 @@ class NotificationMailServiceTest extends TestCase
         $ticket = Ticket::query()->create([
             'tenant_code' => $this->tenant->codigo,
             'ticket' => fake()->uuid(),
-            'source_purchase_id' => $purchase->id,
+            'source_purchase_item_id' => $purchaseItem->id,
             'source_catalog_item_id' => $catalogItem->id,
             'user_id' => $this->user->id,
         ]);

tests/Feature/Purchase/StorePurchaseTest.php

@@ -10,6 +10,7 @@ use App\Domains\Catalog\Enums\InventoryPolicy;
 use App\Domains\Catalog\Models\CatalogItem;
 use App\Domains\Catalog\Models\Category;
 use App\Domains\Catalog\Models\Inventory;
+use App\Domains\Catalog\Models\StockReservation;
 use App\Domains\Catalog\Models\Variant;
 use App\Domains\Purchase\Models\Purchase;
 use App\Domains\Purchase\Services\CheckoutService;
@@ -714,11 +715,11 @@ class StorePurchaseTest extends TestCase
 
         $this->actingAs($user, 'sanctum')
             ->postJson("/api/tenants/sonder/compras/{$purchase->id}/cancel")
-            ->assertUnprocessable()
+            ->assertOk()
-            ->assertJsonPath('code', 'purchase.expired');
+            ->assertJsonPath('data.status', Purchase::STATUS_EXPIRED);
     }
 
-    public function test_an_overdue_purchase_cannot_be_cancelled_before_the_expiration_job_runs(): void
+    public function test_leaving_an_overdue_purchase_expires_it_before_the_expiration_job_runs(): void
     {
         $this->createTenant('sonder', 'Sonder', 'sonder.com.ar');
         $user = User::factory()->create();
@@ -728,20 +729,17 @@ class StorePurchaseTest extends TestCase
 
         $this->actingAs($user, 'sanctum')
             ->postJson("/api/tenants/sonder/compras/{$purchase->id}/cancel")
-            ->assertUnprocessable()
+            ->assertOk()
-            ->assertExactJson([
+            ->assertJsonPath('data.status', Purchase::STATUS_EXPIRED);
-                'code' => 'stock_reservation.expired',
-                'message' => __('api.cart.reservation_expired'),
-            ]);
 
         $this->assertDatabaseHas('compras', [
             'id' => $purchase->id,
-            'status' => Purchase::STATUS_CREATED,
+            'status' => Purchase::STATUS_EXPIRED,
             'stock_reservation_id' => $purchase->stock_reservation_id,
         ]);
         $this->assertDatabaseHas('stock_reservations', [
             'id' => $purchase->stock_reservation_id,
-            'status' => 'active',
+            'status' => StockReservation::STATUS_EXPIRED,
         ]);
     }
 

tests/Feature/Sale/AdminAppSaleControllerTest.php

@@ -2,6 +2,8 @@
 
 namespace Tests\Feature\Sale;
 
+use App\Domains\Attachable\Enums\AttachmentType;
+use App\Domains\Attachable\Models\Attachment;
 use App\Domains\Auth\Models\User;
 use App\Domains\Authorization\Enums\RoleCode;
 use App\Domains\Cart\Models\Cart;
@@ -9,6 +11,8 @@ use App\Domains\Cart\Models\CartItem;
 use App\Domains\Catalog\Models\CatalogItem;
 use App\Domains\Catalog\Models\Inventory;
 use App\Domains\Catalog\Models\Variant;
+use App\Domains\Logging\Enums\ValueChangeActorType;
+use App\Domains\Logging\Models\ValueChange;
 use App\Domains\Purchase\Events\PurchasePaid;
 use App\Domains\Purchase\Models\Purchase;
 use App\Domains\Purchase\Models\PurchaseItem;
@@ -34,6 +38,96 @@ class AdminAppSaleControllerTest extends TestCase
         WebsiteType::query()->create(['codigo' => 'onticket', 'nombre' => 'OnTicket']);
     }
 
+    public function test_sale_modifications_use_sale_filters_and_resulting_status(): void
+    {
+        $tenant = $this->createTenant('acme');
+        $otherTenant = $this->createTenant('other');
+        $admin = $this->createAdminAppUser($tenant);
+        Sanctum::actingAs($admin);
+
+        $sale = Purchase::query()->create([
+            'tenant_codigo' => $tenant->codigo,
+            'nombre_apellido' => 'Ana Pérez',
+            'status' => Purchase::STATUS_CANCELLED,
+            'total' => '10000.00',
+        ]);
+        Purchase::query()->whereKey($sale->id)->update([
+            'created_at' => '2026-08-04 10:00:00',
+        ]);
+
+        $otherSale = Purchase::query()->create([
+            'tenant_codigo' => $tenant->codigo,
+            'nombre_apellido' => 'Otro cliente',
+            'status' => Purchase::STATUS_PAID,
+            'total' => '20000.00',
+        ]);
+        Purchase::query()->whereKey($otherSale->id)->update([
+            'created_at' => '2026-08-05 10:00:00',
+        ]);
+
+        $confirmedChange = ValueChange::query()->create([
+            'tenant_code' => $tenant->codigo,
+            'trackable_type' => $sale->getMorphClass(),
+            'trackable_id' => $sale->id,
+            'attribute' => 'status',
+            'old_value' => Purchase::STATUS_PENDING_PAYMENT,
+            'new_value' => Purchase::STATUS_PAID,
+            'changed_at' => '2026-08-06 10:00:00',
+            'actor_type' => ValueChangeActorType::User,
+            'user_id' => $admin->id,
+        ]);
+        ValueChange::query()->create([
+            'tenant_code' => $tenant->codigo,
+            'trackable_type' => $sale->getMorphClass(),
+            'trackable_id' => $sale->id,
+            'attribute' => 'status',
+            'old_value' => Purchase::STATUS_PAID,
+            'new_value' => Purchase::STATUS_CANCELLED,
+            'changed_at' => '2026-08-07 10:00:00',
+            'actor_type' => ValueChangeActorType::User,
+            'user_id' => $admin->id,
+        ]);
+        ValueChange::query()->create([
+            'tenant_code' => $tenant->codigo,
+            'trackable_type' => $otherSale->getMorphClass(),
+            'trackable_id' => $otherSale->id,
+            'attribute' => 'status',
+            'old_value' => Purchase::STATUS_PENDING_PAYMENT,
+            'new_value' => Purchase::STATUS_PAID,
+            'changed_at' => '2026-08-08 10:00:00',
+            'actor_type' => ValueChangeActorType::System,
+        ]);
+        ValueChange::query()->create([
+            'tenant_code' => $otherTenant->codigo,
+            'trackable_type' => $sale->getMorphClass(),
+            'trackable_id' => $sale->id,
+            'attribute' => 'status',
+            'old_value' => Purchase::STATUS_PENDING_PAYMENT,
+            'new_value' => Purchase::STATUS_PAID,
+            'changed_at' => '2026-08-09 10:00:00',
+            'actor_type' => ValueChangeActorType::System,
+        ]);
+
+        $this->getJson('/api/v1/adminapp/tenant/sales/modifications?'.http_build_query([
+            'q' => 'Ana',
+            'id' => $sale->id,
+            'sale_date' => '2026-08-04',
+            'status' => Purchase::ADMIN_STATUS_CONFIRMED,
+        ]))
+            ->assertOk()
+            ->assertJsonCount(1, 'data')
+            ->assertJsonPath('data.0.id', $confirmedChange->id)
+            ->assertJsonPath('data.0.new_value', Purchase::STATUS_PAID)
+            ->assertJsonPath('data.0.admin_status', Purchase::ADMIN_STATUS_CONFIRMED);
+
+        $this->getJson('/api/v1/adminapp/tenant/sales/modifications?status='.
+            Purchase::ADMIN_STATUS_CANCELLED)
+            ->assertOk()
+            ->assertJsonCount(1, 'data')
+            ->assertJsonPath('data.0.sale_id', $sale->id)
+            ->assertJsonPath('data.0.new_value', Purchase::STATUS_CANCELLED);
+    }
+
     public function test_sales_list_uses_purchase_item_snapshots_for_every_status(): void
     {
         $tenant = $this->createTenant('acme');
@@ -64,6 +158,7 @@ class AdminAppSaleControllerTest extends TestCase
         PurchaseItem::query()->create([
             'compra_id' => $createdPurchase->id,
             'source_catalog_item_id' => $catalogItem->id,
+            'nombre' => $catalogItem->nombre,
             'item_nombre' => $catalogItem->nombre,
             'cantidad' => 3,
             'precio_unitario' => '10000.00',
@@ -88,6 +183,7 @@ class AdminAppSaleControllerTest extends TestCase
         PurchaseItem::query()->create([
             'compra_id' => $pendingPurchase->id,
             'source_catalog_item_id' => $catalogItem->id,
+            'nombre' => $catalogItem->nombre,
             'item_nombre' => $catalogItem->nombre,
             'cantidad' => 4,
             'precio_unitario' => '10000.00',
@@ -102,6 +198,7 @@ class AdminAppSaleControllerTest extends TestCase
         PurchaseItem::query()->create([
             'compra_id' => $paidPurchase->id,
             'source_catalog_item_id' => $catalogItem->id,
+            'nombre' => $catalogItem->nombre,
             'item_nombre' => $catalogItem->nombre,
             'cantidad' => 2,
             'precio_unitario' => '10000.00',
@@ -116,6 +213,7 @@ class AdminAppSaleControllerTest extends TestCase
         PurchaseItem::query()->create([
             'compra_id' => $supersededPurchase->id,
             'source_catalog_item_id' => $catalogItem->id,
+            'nombre' => $catalogItem->nombre,
             'item_nombre' => $catalogItem->nombre,
             'cantidad' => 5,
             'precio_unitario' => '10000.00',
@@ -124,17 +222,25 @@ class AdminAppSaleControllerTest extends TestCase
 
         $this->getJson('/api/v1/adminapp/tenant/sales?sort_by=id&sort_direction=asc')
             ->assertOk()
-            ->assertJsonCount(3, 'data')
+            ->assertJsonCount(4, 'data')
             ->assertJsonPath('data.0.id', $createdPurchase->id)
             ->assertJsonPath('data.0.quantity', 3)
+            ->assertJsonPath('data.0.admin_status', Purchase::ADMIN_STATUS_INCOMPLETE)
+            ->assertJsonPath('data.0.status_label', 'Por completar datos')
             ->assertJsonPath('data.1.id', $pendingPurchase->id)
             ->assertJsonPath('data.1.quantity', 4)
+            ->assertJsonPath('data.1.admin_status', Purchase::ADMIN_STATUS_AWAITING_PAYMENT)
+            ->assertJsonPath('data.1.status_label', 'Esperando pago')
             ->assertJsonPath('data.2.id', $paidPurchase->id)
-            ->assertJsonPath('data.2.quantity', 2);
+            ->assertJsonPath('data.2.quantity', 2)
+            ->assertJsonPath('data.2.admin_status', Purchase::ADMIN_STATUS_CONFIRMED)
+            ->assertJsonPath('data.2.status_label', 'Confirmado')
+            ->assertJsonPath('data.3.id', $supersededPurchase->id)
+            ->assertJsonPath('data.3.admin_status', Purchase::ADMIN_STATUS_CANCELLED)
+            ->assertJsonPath('data.3.status_label', 'Anulado');
 
         $this->getJson('/api/v1/adminapp/tenant/sales?status='.Purchase::STATUS_SUPERSEDED)
-            ->assertOk()
+            ->assertUnprocessable();
-            ->assertJsonCount(0, 'data');
     }
 
     public function test_authentication_is_required_to_read_a_sale_detail(): void
@@ -142,7 +248,7 @@ class AdminAppSaleControllerTest extends TestCase
         $this->getJson('/api/v1/adminapp/tenant/sales/1')->assertUnauthorized();
     }
 
-    public function test_pending_payment_filter_also_returns_purchases_in_review(): void
+    public function test_awaiting_payment_filter_returns_every_mapped_real_status(): void
     {
         $tenant = $this->createTenant('acme');
         Sanctum::actingAs($this->createAdminAppUser($tenant));
@@ -160,13 +266,41 @@ class AdminAppSaleControllerTest extends TestCase
             'status' => Purchase::STATUS_PAID,
         ]);
 
-        $this->getJson('/api/v1/adminapp/tenant/sales?status=pending_payment&sort_by=id&sort_direction=asc')
+        $this->getJson('/api/v1/adminapp/tenant/sales?status=awaiting_payment&sort_by=id&sort_direction=asc')
             ->assertOk()
             ->assertJsonCount(2, 'data')
             ->assertJsonPath('data.0.id', $pendingPurchase->id)
             ->assertJsonPath('data.1.id', $reviewPurchase->id);
     }
 
+    public function test_cancelled_filter_returns_every_visible_mapped_real_status(): void
+    {
+        $tenant = $this->createTenant('acme');
+        Sanctum::actingAs($this->createAdminAppUser($tenant));
+
+        foreach ([
+            Purchase::STATUS_CANCELLED,
+            Purchase::STATUS_REJECTED,
+            Purchase::STATUS_EXPIRED,
+            Purchase::STATUS_SUPERSEDED,
+        ] as $status) {
+            Purchase::query()->create([
+                'tenant_codigo' => $tenant->codigo,
+                'status' => $status,
+            ]);
+        }
+        Purchase::query()->create([
+            'tenant_codigo' => $tenant->codigo,
+            'status' => Purchase::STATUS_PAID,
+        ]);
+
+        $this->getJson('/api/v1/adminapp/tenant/sales?status=cancelled')
+            ->assertOk()
+            ->assertJsonCount(4, 'data')
+            ->assertJsonPath('data.0.admin_status', Purchase::ADMIN_STATUS_CANCELLED)
+            ->assertJsonPath('data.0.status_label', 'Anulado');
+    }
+
     public function test_an_adminapp_user_can_read_a_sale_detail_from_its_tenant(): void
     {
         $tenant = $this->createTenant('acme');
@@ -233,6 +367,7 @@ class AdminAppSaleControllerTest extends TestCase
         $purchaseItem = PurchaseItem::query()->create([
             'compra_id' => $purchase->id,
             'source_catalog_item_id' => $catalogItem->id,
+            'nombre' => $catalogItem->nombre,
             'item_nombre' => $catalogItem->nombre,
             'cantidad' => 2,
             'precio_unitario' => '12500.00',
@@ -336,17 +471,28 @@ class AdminAppSaleControllerTest extends TestCase
             'precio' => 20000,
             'has_tickets' => true,
         ]);
+        $purchaseItem = $purchase->items()->create([
+            'source_catalog_item_id' => $catalogItem->id,
+            'nombre' => $catalogItem->nombre,
+            'descripcion' => $catalogItem->descripcion,
+            'slug' => $catalogItem->slug,
+            'item_nombre' => $catalogItem->nombre,
+            'variant_attributes' => [],
+            'cantidad' => 2,
+            'precio_unitario' => 10000,
+            'total' => 20000,
+        ]);
         $firstTicket = Ticket::query()->create([
             'tenant_code' => $tenant->codigo,
             'ticket' => '11111111-1111-4111-8111-111111111111',
-            'source_purchase_id' => $purchase->id,
+            'source_purchase_item_id' => $purchaseItem->id,
             'source_catalog_item_id' => $catalogItem->id,
             'user_id' => $admin->id,
         ]);
         $usedTicket = Ticket::query()->create([
             'tenant_code' => $tenant->codigo,
             'ticket' => '22222222-2222-4222-8222-222222222222',
-            'source_purchase_id' => $purchase->id,
+            'source_purchase_item_id' => $purchaseItem->id,
             'source_catalog_item_id' => $catalogItem->id,
             'used_at' => now()->subMinute(),
             'user_id' => $admin->id,
@@ -468,6 +614,7 @@ class AdminAppSaleControllerTest extends TestCase
         PurchaseItem::query()->create([
             'compra_id' => $purchase->id,
             'source_catalog_item_id' => $catalogItem->id,
+            'nombre' => $catalogItem->nombre,
             'item_nombre' => $catalogItem->nombre,
             'cantidad' => 2,
             'precio_unitario' => '10000.00',
@@ -563,14 +710,34 @@ class AdminAppSaleControllerTest extends TestCase
 
     private function createTenant(string $code): Tenant
     {
+        $headerLogo = $this->createAttachment("{$code}-header");
+        $footerLogo = $this->createAttachment("{$code}-footer");
+
         return Tenant::query()->create([
             'codigo' => $code,
             'nombre' => ucfirst($code),
             'dominio' => "{$code}.test",
+            'primary_color' => '#000000',
+            'secondary_color' => '#ffffff',
+            'danger_color' => '#dc3545',
+            'header_bg_color' => '#ffffff',
+            'footer_bg_color' => '#000000',
+            'header_logo_id' => $headerLogo->id,
+            'footer_logo_id' => $footerLogo->id,
             'website_type_code' => 'onticket',
         ]);
     }
 
+    private function createAttachment(string $name): Attachment
+    {
+        return Attachment::query()->create([
+            'path' => "test/{$name}.png",
+            'filename' => "{$name}.png",
+            'type' => AttachmentType::Image,
+            'mime_type' => 'image/png',
+        ]);
+    }
+
     private function createAdminAppUser(Tenant $tenant): User
     {
         return User::factory()->create([

tests/Feature/Seeders/AuthorizationSeederTest.php

@@ -27,7 +27,7 @@ class AuthorizationSeederTest extends TestCase
             ],
             Role::query()->orderBy('codigo')->pluck('codigo')->all()
         );
-        $this->assertCount(22, Permission::query()->get());
+        $this->assertCount(23, Permission::query()->get());
     }
 
     public function test_it_assigns_the_expected_permissions_to_each_role(): void
@@ -39,7 +39,7 @@ class AuthorizationSeederTest extends TestCase
         $scanner = Role::query()->where('codigo', RoleCode::Scanner->value)->firstOrFail();
         $user = Role::query()->where('codigo', RoleCode::User->value)->firstOrFail();
 
-        $this->assertCount(22, $admin->permissions);
+        $this->assertCount(23, $admin->permissions);
         $this->assertCount(0, $appAdmin->permissions);
         $this->assertSame(
             [PermissionCode::ScanTickets->value],
@@ -54,7 +54,7 @@ class AuthorizationSeederTest extends TestCase
         $this->seed(AuthorizationSeeder::class);
 
         $this->assertCount(4, Role::query()->get());
-        $this->assertCount(22, Permission::query()->get());
+        $this->assertCount(23, Permission::query()->get());
-        $this->assertDatabaseCount('roles_permisos', 23);
+        $this->assertDatabaseCount('roles_permisos', 24);
     }
 }