feat(event-admin): remove menu restrictions for non-admin users and add test for shared menus among event admins

- Introduced AdminScope enum for tenant and event scopes.
- Updated User model to include admin_scope and event_id attributes.
- Enhanced AdminAppAccessService to validate user scopes.
- Modified AdminAppMeResource and UserResource to include event data.
- Implemented middleware to ensure valid tenant access.
- Created migration to add admin_scope and event_id to users table.
- Added tests for event admin functionality and scope validation.

ShopIt_API_Postman_Collection.json

@@ -2470,45 +2470,6 @@
                             },
                             "response": []
                         },
-                        {
-                            "name": "Create Tenant",
-                            "request": {
-                                "method": "POST",
-                                "header": [
-                                    {
-                                        "key": "Accept",
-                                        "value": "application/json",
-                                        "type": "text"
-                                    },
-                                    {
-                                        "key": "Content-Type",
-                                        "value": "application/json",
-                                        "type": "text"
-                                    }
-                                ],
-                                "description": "Ruta Laravel: `POST /api/tenants`\n\nControlador: `App\\Domains\\Tenant\\Controllers\\TenantController@store`",
-                                "url": {
-                                    "raw": "{{base_url}}/api/tenants",
-                                    "host": [
-                                        "{{base_url}}"
-                                    ],
-                                    "path": [
-                                        "api",
-                                        "tenants"
-                                    ]
-                                },
-                                "body": {
-                                    "mode": "raw",
-                                    "raw": "{\n    \"client_id\": {{client_id}},\n    \"codigo\": \"{{tenant_code}}\",\n    \"nombre\": \"Tenant Demo\",\n    \"dominio\": \"{{tenant_domain}}\",\n    \"site_title\": \"ShopIt Demo\",\n    \"primary_color\": \"#111827\",\n    \"secondary_color\": \"#2563EB\",\n    \"danger_color\": \"#DC2626\",\n    \"success_color\": \"#16A34A\",\n    \"header_bg_color\": \"#FFFFFF\",\n    \"footer_bg_color\": \"#111827\",\n    \"header_logo\": \"data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAADUlEQVR42mNk+M9QDwADhgGAWjR9awAAAABJRU5ErkJggg==\",\n    \"footer_logo\": \"data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAADUlEQVR42mNk+M9QDwADhgGAWjR9awAAAABJRU5ErkJggg==\",\n    \"search_product_layout\": \"column_with_image\",\n    \"search_group_layout\": \"paginated\",\n    \"search_items_per_page\": 12,\n    \"display_categories\": true,\n    \"display_seach_bar\": true,\n    \"display_cart\": true,\n    \"cart_editing_policy\": \"full\",\n    \"admin_website_type_code\": \"shopit\",\n    \"storefront_website_type_code\": \"shopit\"\n}",
-                                    "options": {
-                                        "raw": {
-                                            "language": "json"
-                                        }
-                                    }
-                                }
-                            },
-                            "response": []
-                        },
                         {
                             "name": "Get Tenant",
                             "request": {
@@ -2535,86 +2496,6 @@
                             },
                             "response": []
                         },
-                        {
-                            "name": "Update Tenant (PUT)",
-                            "request": {
-                                "method": "PUT",
-                                "header": [
-                                    {
-                                        "key": "Accept",
-                                        "value": "application/json",
-                                        "type": "text"
-                                    },
-                                    {
-                                        "key": "Content-Type",
-                                        "value": "application/json",
-                                        "type": "text"
-                                    }
-                                ],
-                                "description": "Ruta Laravel: `PUT /api/tenants/{tenant}`\n\nControlador: `App\\Domains\\Tenant\\Controllers\\TenantController@update`",
-                                "url": {
-                                    "raw": "{{base_url}}/api/tenants/{{tenant_id}}",
-                                    "host": [
-                                        "{{base_url}}"
-                                    ],
-                                    "path": [
-                                        "api",
-                                        "tenants",
-                                        "{{tenant_id}}"
-                                    ]
-                                },
-                                "body": {
-                                    "mode": "raw",
-                                    "raw": "{\n    \"nombre\": \"Tenant Demo Actualizado\",\n    \"site_title\": \"ShopIt Demo\",\n    \"primary_color\": \"#111827\",\n    \"cart_editing_policy\": \"full\"\n}",
-                                    "options": {
-                                        "raw": {
-                                            "language": "json"
-                                        }
-                                    }
-                                }
-                            },
-                            "response": []
-                        },
-                        {
-                            "name": "Update Tenant (PATCH)",
-                            "request": {
-                                "method": "PATCH",
-                                "header": [
-                                    {
-                                        "key": "Accept",
-                                        "value": "application/json",
-                                        "type": "text"
-                                    },
-                                    {
-                                        "key": "Content-Type",
-                                        "value": "application/json",
-                                        "type": "text"
-                                    }
-                                ],
-                                "description": "Ruta Laravel: `PATCH /api/tenants/{tenant}`\n\nControlador: `App\\Domains\\Tenant\\Controllers\\TenantController@update`",
-                                "url": {
-                                    "raw": "{{base_url}}/api/tenants/{{tenant_id}}",
-                                    "host": [
-                                        "{{base_url}}"
-                                    ],
-                                    "path": [
-                                        "api",
-                                        "tenants",
-                                        "{{tenant_id}}"
-                                    ]
-                                },
-                                "body": {
-                                    "mode": "raw",
-                                    "raw": "{\n    \"nombre\": \"Tenant Demo Actualizado\",\n    \"site_title\": \"ShopIt Demo\",\n    \"primary_color\": \"#111827\",\n    \"cart_editing_policy\": \"full\"\n}",
-                                    "options": {
-                                        "raw": {
-                                            "language": "json"
-                                        }
-                                    }
-                                }
-                            },
-                            "response": []
-                        },
                         {
                             "name": "Delete Tenant",
                             "request": {

app/Domains/Commerce/Catalog/Models/CatalogItem.php

@@ -2,7 +2,6 @@
 
 namespace App\Domains\Commerce\Catalog\Models;
 
-use App\Shared\Attachable\Models\Attachment;
 use App\Domains\Commerce\Catalog\Enums\CatalogItemType;
 use App\Domains\Commerce\Catalog\Enums\InventoryPolicy;
 use App\Domains\Commerce\Catalog\Enums\InventorySubject;
@@ -10,6 +9,7 @@ use App\Domains\Commerce\Catalog\Services\CatalogInventoryService;
 use App\Domains\Core\Tenant\Models\Tenant;
 use App\Domains\Ticketing\Event\Models\Event;
 use App\Domains\Ticketing\Ticket\Models\Ticket;
+use App\Shared\Attachable\Models\Attachment;
 use Illuminate\Database\Eloquent\Attributes\Fillable;
 use Illuminate\Database\Eloquent\Builder;
 use Illuminate\Database\Eloquent\Factories\HasFactory;
@@ -237,7 +237,7 @@ class CatalogItem extends Model
                         ->whereHas(
                             'inventory',
                             fn (Builder $inventoryQuery): Builder => $inventoryQuery
-                                ->whereColumn('inventories.real_stock', '>', 'inventories.reserved_stock')
+                                ->whereRaw('inventories.real_stock > inventories.reserved_stock + inventories.entry_reserved_stock')
                         )
                 )
                 ->orWhere(function (Builder $directItemQuery): void {
@@ -249,7 +249,7 @@ class CatalogItem extends Model
                                 ->orWhereHas(
                                     'inventory',
                                     fn (Builder $availableInventoryQuery): Builder => $availableInventoryQuery
-                                        ->whereColumn('inventories.real_stock', '>', 'inventories.reserved_stock')
+                                        ->whereRaw('inventories.real_stock > inventories.reserved_stock + inventories.entry_reserved_stock')
                                 );
                         });
                 });
@@ -264,9 +264,15 @@ class CatalogItem extends Model
     /** @return Collection<int, Variant> */
     public function visibleVariants(?int $includedVariantId = null): Collection
     {
+        $this->variants
+            ->filter(fn (Variant $variant): bool => $variant->exists)
+            ->loadMissing('desfileEntryReservations');
+
         return $this->variants
             ->each(fn (Variant $variant) => $variant->setRelation('catalogItem', $this))
             ->filter(fn (Variant $variant): bool => $variant->hasOnlyActiveEventDates()
+                && (! $variant->relationLoaded('desfileEntryReservations')
+                    || $variant->desfileEntryReservations->isEmpty())
                 && (($includedVariantId !== null && $variant->id === $includedVariantId)
                     || ($variant->isSellable() && (
                         $this->inventory_policy === InventoryPolicy::Unlimited

app/Domains/Commerce/Catalog/Models/Inventory.php

@@ -12,6 +12,7 @@ use Illuminate\Database\Eloquent\Relations\HasOne;
     'sold_units',
     'refunded_units',
     'reserved_stock',
+    'entry_reserved_stock',
     'real_stock',
 ])]
 class Inventory extends Model
@@ -35,6 +36,7 @@ class Inventory extends Model
             'sold_units' => 'integer',
             'refunded_units' => 'integer',
             'reserved_stock' => 'integer',
+            'entry_reserved_stock' => 'integer',
             'real_stock' => 'integer',
         ];
     }
@@ -59,7 +61,26 @@ class Inventory extends Model
 
     public function availableStock(): int
     {
-        return max(0, $this->real_stock - $this->reserved_stock);
+        return max(0, $this->real_stock - $this->reserved_stock - $this->entry_reserved_stock);
+    }
+
+    public function reserveEntry(int $amount, bool $tracksInventory): void
+    {
+        if ($amount < 1 || ($tracksInventory && $this->availableStock() < $amount)) {
+            throw new \InvalidArgumentException('No hay stock disponible para la reserva de entradas.');
+        }
+        $this->entry_reserved_stock += $amount;
+        $this->save();
+    }
+
+    public function releaseEntry(int $amount): void
+    {
+        if ($amount < 1 || $this->entry_reserved_stock < $amount) {
+            throw new \InvalidArgumentException('La cantidad de entradas reservadas no es válida.');
+        }
+
+        $this->entry_reserved_stock -= $amount;
+        $this->save();
     }
 
     public function reserve(int $amount, bool $tracksInventory): void
@@ -92,7 +113,7 @@ class Inventory extends Model
             throw new \InvalidArgumentException('La cantidad reservada no alcanza para confirmar la compra.');
         }
 
-        if ($tracksInventory && $this->real_stock < $amount) {
+        if ($tracksInventory && $this->real_stock - $this->entry_reserved_stock < $amount) {
             throw new \InvalidArgumentException('No hay suficiente stock real para confirmar la compra.');
         }
 

app/Domains/Commerce/Catalog/Models/Variant.php

@@ -2,9 +2,10 @@
 
 namespace App\Domains\Commerce\Catalog\Models;
 
-use App\Shared\Attachable\Models\Attachment;
+use App\Domains\Ticketing\Desfile\Models\EntryReservation;
 use App\Domains\Ticketing\Event\Models\EventDate;
 use App\Domains\Ticketing\Ticket\Models\Ticket;
+use App\Shared\Attachable\Models\Attachment;
 use Illuminate\Database\Eloquent\Attributes\Fillable;
 use Illuminate\Database\Eloquent\Factories\HasFactory;
 use Illuminate\Database\Eloquent\Model;
@@ -74,6 +75,12 @@ class Variant extends Model
         return $this->hasMany(Ticket::class, 'source_variant_id');
     }
 
+    /** @return HasMany<EntryReservation, $this> */
+    public function desfileEntryReservations(): HasMany
+    {
+        return $this->hasMany(EntryReservation::class);
+    }
+
     /** @return BelongsTo<Inventory, $this> */
     public function inventory(): BelongsTo
     {

app/Domains/Commerce/Catalog/Resources/CatalogItemDetailResource.php

@@ -7,8 +7,8 @@ use App\Domains\Commerce\Catalog\Models\CatalogItem;
 use App\Domains\Commerce\Catalog\Models\ItemAttribute;
 use App\Domains\Commerce\Catalog\Models\Variant;
 use App\Domains\Commerce\Catalog\Services\CatalogItemAllowanceService;
-use App\Shared\Enums\FieldType;
 use App\Domains\Ticketing\Ticket\Resources\ValidityTimeResource;
+use App\Shared\Enums\FieldType;
 use Illuminate\Http\Request;
 use Illuminate\Http\Resources\Json\JsonResource;
 use Illuminate\Support\Collection;
@@ -140,7 +140,7 @@ class CatalogItemDetailResource extends JsonResource
                 'validity_time_id' => $option->validity_time_id,
                 'validity_time' => $option->validityTime === null
                     ? null
-                    : ValidityTimeResource::make($option->validityTime),
+                    : ValidityTimeResource::make($option->validityTime, $this->tenant->timezone),
                 'metadata' => $option->metadata,
             ])
             ->values();

app/Domains/Commerce/Catalog/Services/CatalogInventoryService.php

@@ -153,7 +153,7 @@ class CatalogInventoryService
 
                 if ($operation === 'commit'
                     && $requirement['tracks_inventory']
-                    && $inventory->real_stock < $requiredQuantity) {
+                    && $inventory->real_stock - $inventory->entry_reserved_stock < $requiredQuantity) {
                     throw new \InvalidArgumentException('No hay suficiente stock real para confirmar la compra.');
                 }
             }

app/Domains/Commerce/Catalog/Services/CatalogService.php

@@ -2,8 +2,6 @@
 
 namespace App\Domains\Commerce\Catalog\Services;
 
-use App\Shared\Attachable\Models\Attachment;
-use App\Shared\Attachable\Services\AttachmentService;
 use App\Domains\Commerce\Catalog\Enums\CatalogItemType;
 use App\Domains\Commerce\Catalog\Models\Attribute;
 use App\Domains\Commerce\Catalog\Models\CatalogItem;
@@ -11,8 +9,10 @@ use App\Domains\Commerce\Catalog\Models\Category;
 use App\Domains\Commerce\Catalog\Models\Inventory;
 use App\Domains\Commerce\Catalog\Models\ItemAttribute;
 use App\Domains\Commerce\Catalog\Models\Variant;
-use App\Domains\Ticketing\Event\Models\EventDate;
 use App\Domains\Core\Tenant\Models\Tenant;
+use App\Domains\Ticketing\Event\Models\EventDate;
+use App\Shared\Attachable\Models\Attachment;
+use App\Shared\Attachable\Services\AttachmentService;
 use Illuminate\Database\Eloquent\Builder;
 use Illuminate\Pagination\LengthAwarePaginator;
 use Illuminate\Support\Facades\DB;
@@ -286,9 +286,11 @@ class CatalogService
         int $perPage,
         int $page,
     ): LengthAwarePaginator {
+        $categoryIds = $this->categoryAndDescendantIds($tenant, $category);
+
         return CatalogItem::query()
             ->forTenantCatalog($tenant)
-            ->where('category_id', $category->id)
+            ->whereIn('category_id', $categoryIds)
             ->whereAvailable()
             ->with([
                 'attachments',
@@ -306,6 +308,34 @@ class CatalogService
             ->paginate(perPage: $perPage, pageName: 'page', page: $page);
     }
 
+    /** @return array<int, int> */
+    private function categoryAndDescendantIds(Tenant $tenant, Category $category): array
+    {
+        $childrenByParent = Category::query()
+            ->where('tenant_code', $tenant->codigo)
+            ->get(['id', 'categoria_id'])
+            ->groupBy('categoria_id');
+
+        $categoryIds = [];
+        $pendingIds = [$category->id];
+
+        while ($pendingIds !== []) {
+            $categoryId = array_shift($pendingIds);
+
+            if (isset($categoryIds[$categoryId])) {
+                continue;
+            }
+
+            $categoryIds[$categoryId] = $categoryId;
+
+            foreach ($childrenByParent->get($categoryId, collect()) as $child) {
+                $pendingIds[] = $child->id;
+            }
+        }
+
+        return array_values($categoryIds);
+    }
+
     public function delete(CatalogItem $catalogItem): void
     {
         DB::transaction(function () use ($catalogItem): void {

app/Domains/Commerce/Catalog/Services/StockReservationService.php

@@ -225,7 +225,7 @@ class StockReservationService
                 $inventory = $inventories->get($line->inventory_id)
                     ?? throw new \InvalidArgumentException('No se encontró el inventario reservado.');
                 if ($inventory->reserved_stock < $line->quantity
-                    || ($line->tracks_inventory && $inventory->real_stock < $line->quantity)) {
+                    || ($line->tracks_inventory && $inventory->real_stock - $inventory->entry_reserved_stock < $line->quantity)) {
                     throw new \InvalidArgumentException('La reserva de stock no alcanza para confirmar la compra.');
                 }
             }

app/Domains/Commerce/Catalog/Services/VariantReplacementService.php

@@ -7,6 +7,7 @@ use App\Domains\Commerce\Catalog\Models\Inventory;
 use App\Domains\Commerce\Catalog\Models\StockReservation;
 use App\Domains\Commerce\Catalog\Models\StockReservationLine;
 use App\Domains\Commerce\Catalog\Models\Variant;
+use App\Domains\Ticketing\Desfile\Models\EntryReservation;
 use App\Domains\Ticketing\Event\Models\EventDate;
 use Illuminate\Support\Collection;
 
@@ -190,6 +191,7 @@ class VariantReplacementService
             'sold_units' => $sourceInventory->sold_units,
             'refunded_units' => $sourceInventory->refunded_units,
             'reserved_stock' => $reservedStock,
+            'entry_reserved_stock' => $sourceInventory->entry_reserved_stock,
             'real_stock' => $sourceInventory->real_stock,
         ]);
 
@@ -198,7 +200,9 @@ class VariantReplacementService
                 ->whereKey($activeLines->modelKeys())
                 ->update(['inventory_id' => $replacementInventory->getKey()]);
         }
-        $sourceInventory->update(['reserved_stock' => 0]);
+        EntryReservation::query()->where('inventory_id', $sourceInventory->id)
+            ->update(['inventory_id' => $replacementInventory->id]);
+        $sourceInventory->update(['reserved_stock' => 0, 'entry_reserved_stock' => 0]);
 
         return $replacementInventory;
     }
@@ -235,6 +239,7 @@ class VariantReplacementService
         $destinationInventory->update([
             'real_stock' => $destinationInventory->real_stock + $sourceInventory->real_stock,
             'reserved_stock' => $destinationInventory->reserved_stock + $sourceInventory->reserved_stock,
+            'entry_reserved_stock' => $destinationInventory->entry_reserved_stock + $sourceInventory->entry_reserved_stock,
             'sold_units' => $destinationInventory->sold_units + $sourceInventory->sold_units,
             'refunded_units' => $destinationInventory->refunded_units + $sourceInventory->refunded_units,
         ]);
@@ -243,9 +248,12 @@ class VariantReplacementService
                 ->whereKey($activeLines->modelKeys())
                 ->update(['inventory_id' => $destinationInventory->getKey()]);
         }
+        EntryReservation::query()->where('inventory_id', $sourceInventory->id)
+            ->update(['inventory_id' => $destinationInventory->id]);
         $sourceInventory->update([
             'real_stock' => 0,
             'reserved_stock' => 0,
+            'entry_reserved_stock' => 0,
             'sold_units' => 0,
             'refunded_units' => 0,
         ]);

app/Domains/Commerce/Catalog/documentacion/README.md

@@ -34,3 +34,8 @@ Bajo `/v1/adminapp/tenant/featured-groups`, con `auth:sanctum` y `adminapp.tenan
 ## Dependencias y reglas
 
 Usa `Attachable` para imágenes/archivos, `Tenant` para aislamiento y `Ticket`/`Event` para vigencia y fechas. `Cart` y `Purchase` consumen sus precios, variantes e inventario. Los cambios de stock deben pasar por `CatalogInventoryService` para conservar reservas y disponibilidad.
+
+## Menús deprecados
+
+Los menús `adminapp.combos` y `adminapp.categories` están retirados; las
+categorías del catálogo y sus datos comerciales no se eliminan.

app/Domains/Commerce/Purchase/Controllers/PurchaseController.php

@@ -2,7 +2,6 @@
 
 namespace App\Domains\Commerce\Purchase\Controllers;
 
-use App\Shared\Integration\Services\TelepagosIntegrationService;
 use App\Domains\Commerce\Purchase\Models\Purchase;
 use App\Domains\Commerce\Purchase\Requests\PaymentIntentRequest;
 use App\Domains\Commerce\Purchase\Requests\StartCheckoutRequest;
@@ -13,6 +12,7 @@ use App\Domains\Commerce\Purchase\Services\CheckoutService;
 use App\Domains\Commerce\Purchase\Services\PurchaseStateGuard;
 use App\Domains\Core\Tenant\Models\Tenant;
 use App\Http\Controllers\Controller;
+use App\Shared\Integration\Services\TelepagosIntegrationService;
 use Illuminate\Http\JsonResponse;
 use Illuminate\Http\Request;
 use Illuminate\Support\Facades\DB;
@@ -151,11 +151,14 @@ class PurchaseController extends Controller
         }
 
         $compra->refresh();
+        $compra->loadMissing('event');
         $totalAmount = (float) $compra->total;
 
         if ($method === 'transfer') {
             $telepagosService = new TelepagosIntegrationService;
-            $telepagosService->forTenant($tenant->codigo);
+            $compra->event
+                ? $telepagosService->forEvent($compra->event)
+                : $telepagosService->forTenant($tenant->codigo);
 
             try {
                 $accountInfo = $telepagosService->getAccountInfo();
@@ -191,7 +194,9 @@ class PurchaseController extends Controller
 
         if ($method === 'qr') {
             $telepagosService = new TelepagosIntegrationService;
-            $telepagosService->forTenant($tenant->codigo);
+            $compra->event
+                ? $telepagosService->forEvent($compra->event)
+                : $telepagosService->forTenant($tenant->codigo);
 
             try {
                 Log::channel('telepagos')->info('Generating Telepagos QR.', [

app/Domains/Commerce/Purchase/Models/Purchase.php

@@ -2,13 +2,14 @@
 
 namespace App\Domains\Commerce\Purchase\Models;
 
-use App\Domains\Core\Auth\Models\User;
 use App\Domains\Commerce\Cart\Models\Cart;
 use App\Domains\Commerce\Catalog\Models\StockReservation;
-use App\Shared\Logging\Models\Concerns\LogsValueChanges;
 use App\Domains\Commerce\Purchase\Events\PurchasePaid;
+use App\Domains\Core\Auth\Models\User;
 use App\Domains\Core\Tenant\Models\Tenant;
+use App\Domains\Ticketing\Event\Models\Event;
 use App\Domains\Ticketing\Ticket\Models\Ticket;
+use App\Shared\Logging\Models\Concerns\LogsValueChanges;
 use Illuminate\Database\Eloquent\Attributes\Fillable;
 use Illuminate\Database\Eloquent\Factories\HasFactory;
 use Illuminate\Database\Eloquent\Model;
@@ -21,6 +22,7 @@ use Illuminate\Support\Facades\DB;
 #[Fillable([
     'cart_id',
     'stock_reservation_id',
+    'event_id',
     'tenant_codigo',
     'user_id',
     'status',
@@ -149,6 +151,7 @@ class Purchase extends Model
         return [
             'cart_id' => 'integer',
             'stock_reservation_id' => 'integer',
+            'event_id' => 'integer',
             'user_id' => 'integer',
             'total' => 'decimal:2',
         ];
@@ -162,6 +165,12 @@ class Purchase extends Model
         return $this->belongsTo(Tenant::class, 'tenant_codigo', 'codigo');
     }
 
+    /** @return BelongsTo<Event, $this> */
+    public function event(): BelongsTo
+    {
+        return $this->belongsTo(Event::class);
+    }
+
     /**
      * @return BelongsTo<User, $this>
      */

app/Domains/Commerce/Purchase/Resources/PurchaseResource.php

@@ -36,11 +36,11 @@ class PurchaseResource extends JsonResource
                 === StorefrontWebsiteType::CHECKOUT_SUMMARY_EVENT;
         /** @var Event|null $checkoutEvent */
         $checkoutEvent = $usesEventSummary
-            ? $items
+            ? ($this->event ?? $items
                 ->map(fn (PurchaseItem $item) => $item->sourceCatalogItem?->event)
                 ->filter()
                 ->unique('id')
-                ->first()
+                ->first())
             : null;
 
         $subtotal = $items->isNotEmpty()
@@ -62,6 +62,7 @@ class PurchaseResource extends JsonResource
         return [
             'id' => $this->id,
             'cart_id' => $this->cart_id,
+            'event_id' => $this->event_id,
             'tenant_codigo' => $this->tenant_codigo,
             'user_id' => $this->user_id,
             'created_at' => $this->created_at,

app/Domains/Commerce/Purchase/Services/Checkout/PurchaseResponseLoader.php

@@ -14,6 +14,7 @@ class PurchaseResponseLoader
             === StorefrontWebsiteType::CHECKOUT_SUMMARY_EVENT;
         $relations = [
             'tenant',
+            'event.attachment',
             'items.sourceCatalogItem.event.attachment',
             'stockReservation',
         ];

app/Domains/Commerce/Purchase/Services/Checkout/StartCheckoutService.php

@@ -206,6 +206,7 @@ class StartCheckoutService
                 fn (array $line): float => $line['selection']->getPrice() * $line['quantity'],
             ),
             $cart->getKey(),
+            $cartItems->first()?->catalogItem?->event_id,
         );
         $cart->update(['current_purchase_id' => $purchase->getKey()]);
         $this->reservations->attachToPurchase($cart, $purchase, $this->checkoutExpiration());
@@ -273,6 +274,7 @@ class StartCheckoutService
             $purchaseData,
             $cart->getTotalAmount(),
             $cart->getKey(),
+            $cartItems->first()?->catalogItem?->event_id,
         );
         $cart->update(['current_purchase_id' => $purchase->getKey()]);
         $this->reservations->attachToPurchase($cart, $purchase, $this->checkoutExpiration());
@@ -410,10 +412,12 @@ class StartCheckoutService
         array $purchaseData,
         float $total,
         ?int $cartId,
+        ?int $eventId,
     ): Purchase {
         return Purchase::query()->create([
             ...$purchaseData,
             'cart_id' => $cartId,
+            'event_id' => $eventId,
             'tenant_codigo' => $tenant->codigo,
             'user_id' => $userId,
             'status' => Purchase::STATUS_CREATED,

app/Domains/Commerce/Purchase/Services/PurchaseRefundSummaryService.php

@@ -8,12 +8,13 @@ use Illuminate\Database\Eloquent\Builder;
 
 class PurchaseRefundSummaryService
 {
-    public function totalForTenant(Tenant $tenant): string
+    public function totalForTenant(Tenant $tenant, ?int $eventId = null): string
     {
         $total = TicketRefund::query()
             ->whereHas(
                 'purchaseItem.purchase',
                 fn (Builder $query): Builder => $query->where('tenant_codigo', $tenant->codigo)
+                    ->when($eventId !== null, fn (Builder $purchase) => $purchase->where('event_id', $eventId))
             )
             ->sum('amount');
 

app/Domains/Commerce/Purchase/Services/TenantTransactionResetService.php

@@ -25,6 +25,9 @@ class TenantTransactionResetService
             'carts' => $scope['cart_ids']->count(),
             'cart_items' => $scope['cart_item_ids']->count(),
             'tickets' => DB::table('tickets')->where('tenant_code', $tenantCode)->count(),
+            'entry_reservations' => DB::table('desfile_entry_reservations')
+                ->whereIn('variant_id', DB::table('variantes')->whereIn('catalog_item_id',
+                    DB::table('catalog_items')->where('tenant_code', $tenantCode)->select('id'))->select('id'))->count(),
             'stock_reservations' => $this->reservationQuery($scope)->count(),
             'purchase_changes' => DB::table('value_changes')
                 ->where('tenant_code', $tenantCode)
@@ -47,6 +50,10 @@ class TenantTransactionResetService
             $telepagosQr = DB::table('telepagos_qr')->whereIn('compra_id', $scope['purchase_ids'])->count();
             $summary = [
                 'stock_reservations_deleted' => $this->reservationQuery($scope)->delete(),
+                'entry_reservations_deleted' => DB::table('desfile_entry_reservations')
+                    ->whereIn('variant_id', DB::table('variantes')->whereIn('catalog_item_id',
+                        DB::table('catalog_items')->where('tenant_code', $tenantCode)->select('id'))->select('id'))->delete(),
+                'entry_reservation_batches_deleted' => DB::table('desfile_reservation_batches')->where('tenant_code', $tenantCode)->delete(),
                 'tickets_deleted' => DB::table('tickets')->where('tenant_code', $tenantCode)->delete(),
                 'purchase_changes_deleted' => DB::table('value_changes')
                     ->where('tenant_code', $tenantCode)
@@ -67,6 +74,7 @@ class TenantTransactionResetService
                 ->update([
                     'real_stock' => DB::raw('real_stock + sold_units - refunded_units'),
                     'reserved_stock' => 0,
+                    'entry_reserved_stock' => 0,
                     'sold_units' => 0,
                     'refunded_units' => 0,
                 ]);

app/Domains/Commerce/Sale/Controllers/AdminApp/SaleController.php

@@ -13,6 +13,7 @@ use App\Domains\Commerce\Sale\Resources\AdminApp\SaleTicketResource;
 use App\Domains\Commerce\Sale\Services\AdminAppSaleExcelService;
 use App\Domains\Commerce\Sale\Services\AdminAppSalePdfService;
 use App\Domains\Commerce\Sale\Services\AdminAppSaleService;
+use App\Domains\Core\Auth\Services\EventScopeService;
 use App\Http\Controllers\Controller;
 use Illuminate\Http\Request;
 use Illuminate\Http\Resources\Json\AnonymousResourceCollection;
@@ -27,15 +28,20 @@ class SaleController extends Controller
         protected AdminAppSaleExcelService $saleExcelService,
     ) {}
 
+    private function eventId(Request $request): ?int
+    {
+        return app(EventScopeService::class)->eventId($request->user());
+    }
+
     public function index(AdminAppSaleIndexRequest $request): AnonymousResourceCollection
     {
         $tenant = $request->user()->tenant()->firstOrFail();
 
         return SaleResource::collection(
-            $this->saleService->sales($tenant, $request->validated())
+            $this->saleService->sales($tenant, $request->validated(), $this->eventId($request))
         )->additional([
-            'confirmed_sales_total' => $this->saleService->confirmedSalesTotal($tenant),
-            'refunded_total' => $this->saleService->refundedTotal($tenant),
+            'confirmed_sales_total' => $this->saleService->confirmedSalesTotal($tenant, $this->eventId($request)),
+            'refunded_total' => $this->saleService->refundedTotal($tenant, $this->eventId($request)),
         ]);
     }
 
@@ -43,7 +49,7 @@ class SaleController extends Controller
     {
         $tenant = $request->user()->tenant()->firstOrFail();
 
-        return new SaleDetailResource($this->saleService->detail($tenant, $sale));
+        return new SaleDetailResource($this->saleService->detail($tenant, $sale, $this->eventId($request)));
     }
 
     public function tickets(Request $request, int $sale): AnonymousResourceCollection
@@ -51,7 +57,7 @@ class SaleController extends Controller
         $tenant = $request->user()->tenant()->firstOrFail();
 
         return SaleTicketResource::collection(
-            $this->saleService->tickets($tenant, $sale)
+            $this->saleService->tickets($tenant, $sale, $this->eventId($request))
         );
     }
 
@@ -59,14 +65,14 @@ class SaleController extends Controller
     {
         $tenant = $request->user()->tenant()->firstOrFail();
 
-        return new SaleResource($this->saleService->confirm($tenant, $sale));
+        return new SaleResource($this->saleService->confirm($tenant, $sale, $this->eventId($request)));
     }
 
     public function cancel(Request $request, int $sale): SaleResource
     {
         $tenant = $request->user()->tenant()->firstOrFail();
 
-        return new SaleResource($this->saleService->cancel($tenant, $sale));
+        return new SaleResource($this->saleService->cancel($tenant, $sale, $this->eventId($request)));
     }
 
     public function modifications(
@@ -76,6 +82,7 @@ class SaleController extends Controller
             $this->saleService->modifications(
                 $request->user()->tenant()->firstOrFail(),
                 $request->validated(),
+                $this->eventId($request),
             )
         );
     }
@@ -86,7 +93,7 @@ class SaleController extends Controller
 
         return $this->salePdfService->downloadSales(
             $tenant,
-            $this->saleService->salesForExport($tenant, $request->validated()),
+            $this->saleService->salesForExport($tenant, $request->validated(), $this->eventId($request)),
             $request->validated('timezone'),
         );
     }
@@ -97,7 +104,7 @@ class SaleController extends Controller
 
         return $this->salePdfService->downloadModifications(
             $tenant,
-            $this->saleService->modificationsForExport($tenant, $request->validated()),
+            $this->saleService->modificationsForExport($tenant, $request->validated(), $this->eventId($request)),
             $request->validated('timezone'),
         );
     }
@@ -108,7 +115,7 @@ class SaleController extends Controller
 
         return $this->saleExcelService->downloadSales(
             $tenant,
-            $this->saleService->salesForExport($tenant, $request->validated()),
+            $this->saleService->salesForExport($tenant, $request->validated(), $this->eventId($request)),
             $request->validated('timezone'),
         );
     }
@@ -120,7 +127,7 @@ class SaleController extends Controller
 
         return $this->saleExcelService->downloadModifications(
             $tenant,
-            $this->saleService->modificationsForExport($tenant, $request->validated()),
+            $this->saleService->modificationsForExport($tenant, $request->validated(), $this->eventId($request)),
             $request->validated('timezone'),
         );
     }

app/Domains/Commerce/Sale/Services/AdminAppSaleService.php

@@ -2,7 +2,6 @@
 
 namespace App\Domains\Commerce\Sale\Services;
 
-use App\Shared\Logging\Models\ValueChange;
 use App\Domains\Commerce\Purchase\Models\Purchase;
 use App\Domains\Commerce\Purchase\Services\CheckoutService;
 use App\Domains\Commerce\Purchase\Services\PurchaseRefundSummaryService;
@@ -10,6 +9,7 @@ use App\Domains\Core\Tenant\Models\Tenant;
 use App\Domains\Ticketing\Ticket\Models\Ticket;
 use App\Domains\Ticketing\Ticket\Services\TicketPresentationResolver;
 use App\Domains\Ticketing\Ticket\Services\TicketValidityResolver;
+use App\Shared\Logging\Models\ValueChange;
 use Illuminate\Database\Eloquent\Builder;
 use Illuminate\Pagination\LengthAwarePaginator;
 use Illuminate\Support\Collection;
@@ -21,19 +21,20 @@ class AdminAppSaleService
         protected PurchaseRefundSummaryService $refundSummaryService,
     ) {}
 
-    public function confirmedSalesTotal(Tenant $tenant): string
+    public function confirmedSalesTotal(Tenant $tenant, ?int $eventId = null): string
     {
         $total = Purchase::query()
             ->where('tenant_codigo', $tenant->codigo)
+            ->when($eventId !== null, fn (Builder $query) => $query->where('event_id', $eventId))
             ->where('status', Purchase::STATUS_PAID)
             ->sum('total');
 
         return number_format((float) $total, 2, '.', '');
     }
 
-    public function refundedTotal(Tenant $tenant): string
+    public function refundedTotal(Tenant $tenant, ?int $eventId = null): string
     {
-        return $this->refundSummaryService->totalForTenant($tenant);
+        return $this->refundSummaryService->totalForTenant($tenant, $eventId);
     }
 
     /**
@@ -47,43 +48,44 @@ class AdminAppSaleService
      * }  $filters
      * @return LengthAwarePaginator<Purchase>
      */
-    public function sales(Tenant $tenant, array $filters = []): LengthAwarePaginator
+    public function sales(Tenant $tenant, array $filters = [], ?int $eventId = null): LengthAwarePaginator
     {
-        return $this->salesQuery($tenant, $filters)
+        return $this->salesQuery($tenant, $filters, $eventId)
             ->paginateFromRequest()
             ->withQueryString();
     }
 
-    public function detail(Tenant $tenant, int $saleId): Purchase
+    public function detail(Tenant $tenant, int $saleId, ?int $eventId = null): Purchase
     {
         return Purchase::query()
             ->where('tenant_codigo', $tenant->codigo)
+            ->when($eventId !== null, fn (Builder $query) => $query->where('event_id', $eventId))
             ->with('items')
             ->findOrFail($saleId);
     }
 
     /** @return Collection<int, Ticket> */
-    public function tickets(Tenant $tenant, int $saleId): Collection
+    public function tickets(Tenant $tenant, int $saleId, ?int $eventId = null): Collection
     {
-        return $this->findForTenant($tenant, $saleId)
+        return $this->findForTenant($tenant, $saleId, $eventId)
             ->tickets()
             ->with([...TicketValidityResolver::RELATIONS, ...TicketPresentationResolver::RELATIONS, 'refund'])
             ->orderBy('id')
             ->get();
     }
 
-    public function confirm(Tenant $tenant, int $saleId): Purchase
+    public function confirm(Tenant $tenant, int $saleId, ?int $eventId = null): Purchase
     {
-        $sale = $this->findForTenant($tenant, $saleId);
+        $sale = $this->findForTenant($tenant, $saleId, $eventId);
 
         return $this->saleForResponse(
             $this->checkoutService->confirmPaidPurchase($sale)
         );
     }
 
-    public function cancel(Tenant $tenant, int $saleId): Purchase
+    public function cancel(Tenant $tenant, int $saleId, ?int $eventId = null): Purchase
     {
-        $sale = $this->findForTenant($tenant, $saleId);
+        $sale = $this->findForTenant($tenant, $saleId, $eventId);
 
         return $this->saleForResponse(
             $this->checkoutService->cancelPurchaseFromAdmin($sale)
@@ -94,18 +96,18 @@ class AdminAppSaleService
      * @param  array<string, mixed>  $filters
      * @return Collection<int, Purchase>
      */
-    public function salesForExport(Tenant $tenant, array $filters = []): Collection
+    public function salesForExport(Tenant $tenant, array $filters = [], ?int $eventId = null): Collection
     {
-        return $this->salesQuery($tenant, $filters)->get();
+        return $this->salesQuery($tenant, $filters, $eventId)->get();
     }
 
     /**
      * @param  array<string, mixed>  $filters
      * @return LengthAwarePaginator<ValueChange>
      */
-    public function modifications(Tenant $tenant, array $filters = []): LengthAwarePaginator
+    public function modifications(Tenant $tenant, array $filters = [], ?int $eventId = null): LengthAwarePaginator
     {
-        return $this->modificationsQuery($tenant, $filters)
+        return $this->modificationsQuery($tenant, $filters, $eventId)
             ->paginateFromRequest()
             ->withQueryString();
     }
@@ -114,13 +116,13 @@ class AdminAppSaleService
      * @param  array<string, mixed>  $filters
      * @return Collection<int, ValueChange>
      */
-    public function modificationsForExport(Tenant $tenant, array $filters = []): Collection
+    public function modificationsForExport(Tenant $tenant, array $filters = [], ?int $eventId = null): Collection
     {
-        return $this->modificationsQuery($tenant, $filters)->get();
+        return $this->modificationsQuery($tenant, $filters, $eventId)->get();
     }
 
     /** @param array<string, mixed> $filters */
-    protected function salesQuery(Tenant $tenant, array $filters): Builder
+    protected function salesQuery(Tenant $tenant, array $filters, ?int $eventId = null): Builder
     {
         $sortColumns = [
             'id' => 'id',
@@ -139,6 +141,7 @@ class AdminAppSaleService
 
         return Purchase::query()
             ->where('tenant_codigo', $tenant->codigo)
+            ->when($eventId !== null, fn (Builder $query) => $query->where('event_id', $eventId))
             ->when($filters['q'] ?? null, function (Builder $query, string $search): void {
                 $term = trim($search);
 
@@ -176,11 +179,14 @@ class AdminAppSaleService
      * @param  array<string, mixed>  $filters
      * @return Builder<ValueChange>
      */
-    protected function modificationsQuery(Tenant $tenant, array $filters): Builder
+    protected function modificationsQuery(Tenant $tenant, array $filters, ?int $eventId = null): Builder
     {
         return ValueChange::query()
             ->where('tenant_code', $tenant->codigo)
             ->where('trackable_type', (new Purchase)->getMorphClass())
+            ->when($eventId !== null, fn (Builder $query) => $query->whereHasMorph(
+                'trackable', [Purchase::class],
+                fn (Builder $sales) => $sales->where('event_id', $eventId)))
             ->when($filters['q'] ?? null, function (Builder $query, string $search): void {
                 $term = trim($search);
 
@@ -221,10 +227,11 @@ class AdminAppSaleService
             ->orderByDesc('id');
     }
 
-    protected function findForTenant(Tenant $tenant, int $saleId): Purchase
+    protected function findForTenant(Tenant $tenant, int $saleId, ?int $eventId = null): Purchase
     {
         return Purchase::query()
             ->where('tenant_codigo', $tenant->codigo)
+            ->when($eventId !== null, fn (Builder $query) => $query->where('event_id', $eventId))
             ->findOrFail($saleId);
     }
 

app/Domains/Commerce/Sale/documentacion/README.md

@@ -30,3 +30,10 @@ Consume compras de `Purchase`, datos del tenant y entradas de `Logging`. No es d
 La consulta paginada y la colección de exportación deben aplicar los mismos filtros para evitar diferencias entre pantalla, PDF y Excel.
 
 El historial comparte con ventas los filtros de búsqueda, ID, fecha de venta y estado. En el historial, el estado se evalúa sobre `ValueChange.new_value`: representa el resultado de esa modificación y no el estado actual de la venta.
+
+## Alcance por evento
+
+Las rutas usan `adminapp.tenant:event`. Para admins de evento, listados, totales,
+detalles, tickets de compras, confirmación, cancelación, historial y exportaciones
+se filtran por `user.event_id` además del tenant. Las compras pertenecen a un
+único evento. Un admin de tenant conserva acceso a sus compras de todos los eventos.

app/Domains/Commerce/Sale/routes/adminapp.php

@@ -4,7 +4,7 @@ use App\Domains\Commerce\Sale\Controllers\AdminApp\SaleController;
 use Illuminate\Support\Facades\Route;
 
 Route::prefix('v1/adminapp/tenant')
-    ->middleware(['auth:sanctum', 'adminapp.tenant'])
+    ->middleware(['auth:sanctum', 'adminapp.tenant:event'])
     ->group(function (): void {
         Route::get('sales', [SaleController::class, 'index']);
         Route::get('sales/pdf', [SaleController::class, 'downloadPdf']);

app/Domains/Core/Auth/Enums/AdminScope.php

@@ -0,0 +1,9 @@
+<?php
+
+namespace App\Domains\Core\Auth\Enums;
+
+enum AdminScope: string
+{
+    case Tenant = 'tenant';
+    case Event = 'event';
+}

app/Domains/Core/Auth/Models/User.php

@@ -2,11 +2,13 @@
 
 namespace App\Domains\Core\Auth\Models;
 
+use App\Domains\Commerce\Catalog\Models\Category;
+use App\Domains\Core\Auth\Enums\AdminScope;
 use App\Domains\Core\Authorization\Enums\RoleCode;
 use App\Domains\Core\Authorization\Models\Role;
-use App\Domains\Commerce\Catalog\Models\Category;
-use App\Domains\Ticketing\Event\Models\EventDateChangeView;
 use App\Domains\Core\Tenant\Models\Tenant;
+use App\Domains\Ticketing\Event\Models\Event;
+use App\Domains\Ticketing\Event\Models\EventDateChangeView;
 use App\Domains\Ticketing\Ticket\Models\ScanAttempt;
 use Database\Factories\UserFactory;
 use Illuminate\Database\Eloquent\Attributes\Fillable;
@@ -20,7 +22,7 @@ use Illuminate\Foundation\Auth\User as Authenticatable;
 use Illuminate\Notifications\Notifiable;
 use Laravel\Sanctum\HasApiTokens;
 
-#[Fillable(['nombre_apellido', 'email', 'password', 'dni', 'telefono', 'google_id', 'rol_codigo', 'tenant_codigo'])]
+#[Fillable(['nombre_apellido', 'email', 'password', 'dni', 'telefono', 'google_id', 'rol_codigo', 'tenant_codigo', 'admin_scope', 'event_id'])]
 #[Hidden(['password', 'remember_token', 'active_email', 'active_google_id'])]
 class User extends Authenticatable
 {
@@ -29,6 +31,7 @@ class User extends Authenticatable
 
     protected $attributes = [
         'rol_codigo' => RoleCode::User->value,
+        'admin_scope' => AdminScope::Tenant->value,
     ];
 
     protected static function newFactory(): UserFactory
@@ -86,6 +89,19 @@ class User extends Authenticatable
         return $this->belongsTo(Tenant::class, 'tenant_codigo', 'codigo');
     }
 
+    /** @return BelongsTo<Event, $this> */
+    public function event(): BelongsTo
+    {
+        return $this->belongsTo(Event::class);
+    }
+
+    public function isTenantAdministrator(): bool
+    {
+        return $this->rol_codigo === RoleCode::AdminApp->value
+            && $this->admin_scope === AdminScope::Tenant->value
+            && $this->event_id === null;
+    }
+
     /** @return BelongsToMany<Category, $this> */
     public function scanCategories(): BelongsToMany
     {
@@ -103,6 +119,7 @@ class User extends Authenticatable
     protected function casts(): array
     {
         return [
+            'event_id' => 'integer',
             'email_verified_at' => 'datetime',
             'password' => 'hashed',
             'failed_login_attempts' => 'integer',

app/Domains/Core/Auth/Resources/AdminAppMeResource.php

@@ -20,6 +20,11 @@ class AdminAppMeResource extends JsonResource
         return [
             'user' => UserResource::make($this->resource),
             'tenant' => TenantResource::make($this->tenant),
+            'event' => $this->whenLoaded('event', fn () => $this->event === null ? null : [
+                'id' => $this->event->id,
+                'title' => $this->event->title,
+                'tenant_code' => $this->event->tenant_code,
+            ]),
         ];
     }
 }

app/Domains/Core/Auth/Resources/ScannerMeResource.php

@@ -16,6 +16,9 @@ class ScannerMeResource extends JsonResource
         return [
             'user' => UserResource::make($this->resource),
             'tenant' => TenantResource::make($this->tenant),
+            'event' => $this->whenLoaded('event', fn () => $this->event === null ? null : [
+                'id' => $this->event->id, 'title' => $this->event->title,
+            ]),
         ];
     }
 }

app/Domains/Core/Auth/Resources/UserResource.php

@@ -3,6 +3,7 @@
 namespace App\Domains\Core\Auth\Resources;
 
 use App\Domains\Core\Auth\Models\User;
+use App\Domains\Core\Authorization\Enums\RoleCode;
 use Illuminate\Http\Request;
 use Illuminate\Http\Resources\Json\JsonResource;
 
@@ -24,6 +25,8 @@ class UserResource extends JsonResource
             'telefono' => $this->telefono,
             'rol_codigo' => $this->rol_codigo,
             'tenant_codigo' => $this->tenant_codigo,
+            'admin_scope' => $this->when($this->rol_codigo === RoleCode::AdminApp->value, $this->admin_scope),
+            'event_id' => $this->when(in_array($this->rol_codigo, [RoleCode::AdminApp->value, RoleCode::Scanner->value], true), $this->event_id),
             'categories' => $this->whenLoaded('scanCategories', fn () => $this->scanCategories
                 ->map(fn ($category) => [
                     'id' => $category->id,

app/Domains/Core/Auth/Services/AdminAppAccessService.php

@@ -0,0 +1,27 @@
+<?php
+
+namespace App\Domains\Core\Auth\Services;
+
+use App\Domains\Core\Auth\Enums\AdminScope;
+use App\Domains\Core\Auth\Models\User;
+use App\Domains\Core\Authorization\Enums\RoleCode;
+
+class AdminAppAccessService
+{
+    public function hasValidScope(User $user): bool
+    {
+        if ($user->rol_codigo !== RoleCode::AdminApp->value
+            || ! $user->tenant_codigo
+            || ! $user->tenant()->exists()) {
+            return false;
+        }
+
+        if ($user->isTenantAdministrator()) {
+            return true;
+        }
+
+        return $user->admin_scope === AdminScope::Event->value
+            && $user->event_id !== null
+            && $user->event()->where('tenant_code', $user->tenant_codigo)->exists();
+    }
+}

app/Domains/Core/Auth/Services/AdminAppContextService.php

@@ -20,6 +20,7 @@ class AdminAppContextService
             ->firstOrFail();
 
         $user->setRelation('tenant', $tenant);
+        $user->load('event');
 
         return $user;
     }

app/Domains/Core/Auth/Services/EventScopeService.php

@@ -0,0 +1,24 @@
+<?php
+
+namespace App\Domains\Core\Auth\Services;
+
+use App\Domains\Core\Auth\Enums\AdminScope;
+use App\Domains\Core\Auth\Models\User;
+use Illuminate\Auth\Access\AuthorizationException;
+
+class EventScopeService
+{
+    public function eventId(User $user): ?int
+    {
+        if ($user->admin_scope === AdminScope::Event->value || $user->event_id !== null) {
+            if ($user->event_id === null
+                || ! $user->event()->where('tenant_code', $user->tenant_codigo)->exists()) {
+                throw new AuthorizationException;
+            }
+
+            return $user->event_id;
+        }
+
+        return null;
+    }
+}

app/Domains/Core/Auth/Services/PasswordLoginService.php

@@ -10,6 +10,7 @@ use App\Domains\Core\Authorization\Enums\PermissionCode;
 use App\Domains\Core\Authorization\Enums\RoleCode;
 use App\Shared\Notification\Events\PasswordResetRequested;
 use Carbon\CarbonImmutable;
+use Illuminate\Auth\Access\AuthorizationException;
 use Illuminate\Support\Facades\DB;
 use Illuminate\Support\Facades\Hash;
 use Illuminate\Support\Facades\Log;
@@ -19,6 +20,7 @@ class PasswordLoginService
 {
     public function __construct(
         private readonly ResetPasswordAttemptService $resetPasswordAttemptService,
+        private readonly AdminAppAccessService $adminAppAccessService,
     ) {}
 
     /**
@@ -196,6 +198,26 @@ class PasswordLoginService
                 ];
             }
 
+            if ($requiredRole === RoleCode::AdminApp && ! $this->adminAppAccessService->hasValidScope($user)) {
+                $this->recordAttempt(
+                    $user, $normalizedEmail, $attemptTenantCode,
+                    LoginAttempt::OUTCOME_INVALID_CREDENTIALS, $ipAddress, $userAgent,
+                );
+
+                return ['outcome' => LoginAttempt::OUTCOME_INVALID_CREDENTIALS, 'user' => $user, 'locked_until' => null];
+            }
+
+            if ($requiredRole === RoleCode::Scanner) {
+                try {
+                    app(EventScopeService::class)->eventId($user);
+                } catch (AuthorizationException) {
+                    $this->recordAttempt($user, $normalizedEmail, $attemptTenantCode,
+                        LoginAttempt::OUTCOME_INVALID_CREDENTIALS, $ipAddress, $userAgent);
+
+                    return ['outcome' => LoginAttempt::OUTCOME_INVALID_CREDENTIALS, 'user' => $user, 'locked_until' => null];
+                }
+            }
+
             $user->forceFill([
                 'failed_login_attempts' => 0,
                 'last_failed_login_at' => null,

app/Domains/Core/Auth/Services/ScannerContextService.php

@@ -18,6 +18,7 @@ class ScannerContextService
             ->firstOrFail();
 
         $user->setRelation('tenant', $tenant);
+        $user->load('event');
 
         if ($tenant->requiresScannerCategoryValidation()) {
             $categories = $user->scanCategories()

app/Domains/Core/Auth/routes/adminapp.php

@@ -17,6 +17,6 @@ Route::prefix('v1/adminapp')->group(function (): void {
     Route::post('password/reset', ResetPasswordController::class)
         ->defaults('reset_role', 'adminapp')
         ->middleware('throttle:5,1');
-    Route::middleware(['auth:sanctum', 'adminapp.tenant'])
+    Route::middleware(['auth:sanctum', 'adminapp.tenant:context'])
         ->get('me', AdminAppMeController::class);
 });

app/Domains/Core/Client/Models/Client.php

@@ -2,8 +2,9 @@
 
 namespace App\Domains\Core\Client\Models;
 
-use App\Shared\Integration\Models\ClientIntegration;
 use App\Domains\Core\Tenant\Models\Tenant;
+use App\Domains\Ticketing\Event\Models\Event;
+use App\Shared\Integration\Models\ClientIntegration;
 use Illuminate\Database\Eloquent\Attributes\Fillable;
 use Illuminate\Database\Eloquent\Model;
 use Illuminate\Database\Eloquent\Relations\HasMany;
@@ -22,6 +23,12 @@ class Client extends Model
         return $this->hasMany(Tenant::class);
     }
 
+    /** @return HasMany<Event, $this> */
+    public function events(): HasMany
+    {
+        return $this->hasMany(Event::class);
+    }
+
     /** @return HasMany<ClientIntegration, $this> */
     public function integrations(): HasMany
     {

app/Domains/Core/Staff/Controllers/AdminAppStaffController.php

@@ -2,6 +2,7 @@
 
 namespace App\Domains\Core\Staff\Controllers;
 
+use App\Domains\Core\Auth\Services\EventScopeService;
 use App\Domains\Core\Staff\Requests\StoreStaffRequest;
 use App\Domains\Core\Staff\Requests\UpdateStaffRequest;
 use App\Domains\Core\Staff\Resources\StaffResource;
@@ -21,11 +22,17 @@ class AdminAppStaffController extends Controller
         private readonly ScannerTicketService $scannerTicketService,
     ) {}
 
+    private function eventId(Request $request): ?int
+    {
+        return app(EventScopeService::class)->eventId($request->user());
+    }
+
     public function index(Request $request): AnonymousResourceCollection
     {
         return StaffResource::collection($this->staffService->list(
             $request->user()->tenant()->firstOrFail(),
             $request->string('search')->trim()->toString() ?: null,
+            $this->eventId($request),
         ));
     }
 
@@ -34,6 +41,7 @@ class AdminAppStaffController extends Controller
         return StaffResource::make($this->staffService->create(
             $request->user()->tenant()->firstOrFail(),
             $request->validated(),
+            $this->eventId($request),
         ));
     }
 
@@ -43,12 +51,13 @@ class AdminAppStaffController extends Controller
             $request->user()->tenant()->firstOrFail(),
             $staff,
             $request->validated(),
+            $this->eventId($request),
         ));
     }
 
     public function destroy(Request $request, int $staff): Response
     {
-        $this->staffService->delete($request->user()->tenant()->firstOrFail(), $staff);
+        $this->staffService->delete($request->user()->tenant()->firstOrFail(), $staff, $this->eventId($request));
 
         return response()->noContent();
     }
@@ -60,6 +69,7 @@ class AdminAppStaffController extends Controller
         $scanner = $this->staffService->find(
             $request->user()->tenant()->firstOrFail(),
             $staff,
+            $this->eventId($request),
         );
 
         return ScanAttemptResource::collection(

app/Domains/Core/Staff/Resources/StaffResource.php

@@ -14,6 +14,7 @@ class StaffResource extends JsonResource
     {
         return [
             'id' => $this->id,
+            'event_id' => $this->event_id,
             'nombre_apellido' => $this->nombre_apellido,
             'dni' => $this->dni,
             'email' => $this->email,

app/Domains/Core/Staff/Services/StaffService.php

@@ -2,12 +2,13 @@
 
 namespace App\Domains\Core\Staff\Services;
 
+use App\Domains\Commerce\Catalog\Models\Category;
 use App\Domains\Core\Auth\Models\ResetPasswordAttempt;
 use App\Domains\Core\Auth\Models\User;
 use App\Domains\Core\Auth\Services\ResetPasswordAttemptService;
 use App\Domains\Core\Authorization\Enums\RoleCode;
-use App\Domains\Commerce\Catalog\Models\Category;
 use App\Domains\Core\Tenant\Models\Tenant;
+use App\Domains\Ticketing\Event\Models\Event;
 use Illuminate\Database\Eloquent\Builder;
 use Illuminate\Database\Eloquent\Collection;
 use Illuminate\Support\Arr;
@@ -22,9 +23,9 @@ class StaffService
     ) {}
 
     /** @return Collection<int, User> */
-    public function list(Tenant $tenant, ?string $search = null): Collection
+    public function list(Tenant $tenant, ?string $search = null, ?int $eventId = null): Collection
     {
-        return $this->staffQuery($tenant)
+        return $this->staffQuery($tenant, $eventId)
             ->with(['role', 'scanCategories' => fn ($query) => $query->orderBy('nombre')])
             ->when($search, function (Builder $query, string $search): void {
                 $query->where(function (Builder $query) use ($search): void {
@@ -38,7 +39,7 @@ class StaffService
     }
 
     /** @return Collection<int, Category> */
-    private function assignableCategories(Tenant $tenant): Collection
+    private function assignableCategories(Tenant $tenant, ?int $eventId = null): Collection
     {
         return Category::query()
             ->whereNull('categoria_id')
@@ -47,23 +48,30 @@ class StaffService
                     ->orWhereHas('catalogItems', fn (Builder $items) => $items
                         ->where('tenant_code', $tenant->codigo));
             })
+            ->when($eventId !== null, fn (Builder $query) => $query->whereHas(
+                'catalogItems', fn (Builder $items) => $items->where('tenant_code', $tenant->codigo)->where('event_id', $eventId)))
             ->orderBy('nombre')
             ->get();
     }
 
     /** @param array<string, mixed> $data */
-    public function create(Tenant $tenant, array $data): User
+    public function create(Tenant $tenant, array $data, ?int $eventId = null): User
     {
+        $eventId ??= $tenant->active_event_id;
+        Event::query()
+            ->where('tenant_code', $tenant->codigo)->findOrFail($eventId);
         $categoryIds = $this->categoryIdsFor($tenant, $data);
-        $this->assertCategoriesBelongToTenant($tenant, $categoryIds);
+        $this->assertCategoriesBelongToTenant($tenant, $categoryIds, $eventId);
 
-        return DB::transaction(function () use ($tenant, $data, $categoryIds): User {
+        return DB::transaction(function () use ($tenant, $data, $categoryIds, $eventId): User {
             $staff = User::query()->create([
                 ...Arr::only($data, ['nombre_apellido', 'dni', 'email']),
                 'email' => mb_strtolower(trim((string) $data['email'])),
                 'password' => Str::random(64),
                 'rol_codigo' => RoleCode::Scanner->value,
                 'tenant_codigo' => $tenant->codigo,
+                'event_id' => $eventId,
+                'admin_scope' => $eventId === null ? 'tenant' : 'event',
             ]);
             $staff->scanCategories()->sync($categoryIds);
             $this->resetPasswordAttemptService->createForScannerEmail(
@@ -76,11 +84,11 @@ class StaffService
     }
 
     /** @param array<string, mixed> $data */
-    public function update(Tenant $tenant, int $staffId, array $data): User
+    public function update(Tenant $tenant, int $staffId, array $data, ?int $eventId = null): User
     {
-        $staff = $this->find($tenant, $staffId);
+        $staff = $this->find($tenant, $staffId, $eventId);
         $categoryIds = $this->categoryIdsFor($tenant, $data);
-        $this->assertCategoriesBelongToTenant($tenant, $categoryIds);
+        $this->assertCategoriesBelongToTenant($tenant, $categoryIds, $eventId);
 
         return DB::transaction(function () use ($staff, $data, $categoryIds): User {
             $attributes = Arr::only($data, ['nombre_apellido', 'dni', 'email']);
@@ -92,9 +100,9 @@ class StaffService
         });
     }
 
-    public function delete(Tenant $tenant, int $staffId): void
+    public function delete(Tenant $tenant, int $staffId, ?int $eventId = null): void
     {
-        $staff = $this->find($tenant, $staffId);
+        $staff = $this->find($tenant, $staffId, $eventId);
 
         DB::transaction(function () use ($staff): void {
             $staff->tokens()->delete();
@@ -102,23 +110,24 @@ class StaffService
         });
     }
 
-    public function find(Tenant $tenant, int $staffId): User
+    public function find(Tenant $tenant, int $staffId, ?int $eventId = null): User
     {
-        return $this->staffQuery($tenant)->findOrFail($staffId);
+        return $this->staffQuery($tenant, $eventId)->findOrFail($staffId);
     }
 
-    private function staffQuery(Tenant $tenant): Builder
+    private function staffQuery(Tenant $tenant, ?int $eventId = null): Builder
     {
         return User::query()
             ->where('tenant_codigo', $tenant->codigo)
-            ->where('rol_codigo', RoleCode::Scanner->value);
+            ->where('rol_codigo', RoleCode::Scanner->value)
+            ->when($eventId !== null, fn (Builder $query) => $query->where('event_id', $eventId));
     }
 
     /**
      * @param  array<string, mixed>  $data
      * @return array<int, int>
      */
-    private function categoryIdsFor(Tenant $tenant, array $data): array
+    private function categoryIdsFor(Tenant $tenant, array $data, ?int $eventId = null): array
     {
         if (! $tenant->requiresScannerCategoryValidation()) {
             return [];
@@ -128,9 +137,9 @@ class StaffService
     }
 
     /** @param array<int, int> $categoryIds */
-    private function assertCategoriesBelongToTenant(Tenant $tenant, array $categoryIds): void
+    private function assertCategoriesBelongToTenant(Tenant $tenant, array $categoryIds, ?int $eventId = null): void
     {
-        $validIds = $this->assignableCategories($tenant)
+        $validIds = $this->assignableCategories($tenant, $eventId)
             ->whereIn('id', $categoryIds)
             ->pluck('id');
 

app/Domains/Core/Staff/documentacion/README.md

@@ -18,3 +18,13 @@ Recurso REST `/v1/adminapp/tenant/staff`, excepto detalle individual, protegido
 ## Dependencias y reglas
 
 Usa `Auth/User` como entidad de personal, `Authorization` para su rol, `Catalog/Category` para asignaciones y `Tenant` para aislamiento. Toda búsqueda, edición o borrado debe comprobar que el usuario pertenece al tenant autenticado.
+
+## Alcance por evento
+
+Los endpoints de Staff y su formulario aceptan `adminapp.tenant:event`. Un admin
+de evento lista, edita, elimina y consulta el historial solo de scanners de su
+evento. El backend asigna el evento al crear un scanner y no acepta cambios de
+asignación desde el formulario. Las categorías autorizables se limitan a las
+usadas por productos del evento. Los scanners aplican además su evento en
+lectura de tickets, escaneo e historial. Los intentos registran `event_id` para
+conservar el aislamiento aunque cambie la asignación del scanner.

app/Domains/Core/Staff/routes/api.php

@@ -4,7 +4,7 @@ use App\Domains\Core\Staff\Controllers\AdminAppStaffController;
 use Illuminate\Support\Facades\Route;
 
 Route::prefix('v1/adminapp/tenant')
-    ->middleware(['auth:sanctum', 'adminapp.tenant'])
+    ->middleware(['auth:sanctum', 'adminapp.tenant:event'])
     ->group(function (): void {
         Route::get('staff/{staff}/scan-attempts', [AdminAppStaffController::class, 'scanAttempts']);
         Route::apiResource('staff', AdminAppStaffController::class)->except('show');

app/Domains/Core/Tenant/Controllers/TenantController.php

@@ -3,11 +3,8 @@
 namespace App\Domains\Core\Tenant\Controllers;
 
 use App\Domains\Core\Tenant\Models\Tenant;
-use App\Domains\Core\Tenant\Requests\StoreTenantRequest;
-use App\Domains\Core\Tenant\Requests\UpdateTenantRequest;
 use App\Domains\Core\Tenant\Resources\TenantResource;
 use App\Domains\Core\Tenant\Services\TenantInformationService;
-use App\Domains\Core\Tenant\Services\TenantService;
 use App\Http\Controllers\Controller;
 use Illuminate\Http\JsonResponse;
 use Illuminate\Http\Response;
@@ -15,7 +12,6 @@ use Illuminate\Http\Response;
 class TenantController extends Controller
 {
     public function __construct(
-        protected TenantService $tenantService,
         protected TenantInformationService $tenantInformationService,
     ) {}
 
@@ -30,15 +26,6 @@ class TenantController extends Controller
         return TenantResource::collection($tenants)->response();
     }
 
-    public function store(StoreTenantRequest $request): JsonResponse
-    {
-        $tenant = $this->tenantService->create($request->validated());
-
-        return TenantResource::make(
-            $this->tenantInformationService->load($tenant)
-        )->response()->setStatusCode(201);
-    }
-
     public function show(Tenant $tenant): TenantResource
     {
         return TenantResource::make(
@@ -46,15 +33,6 @@ class TenantController extends Controller
         );
     }
 
-    public function update(UpdateTenantRequest $request, Tenant $tenant): TenantResource
-    {
-        $tenant = $this->tenantService->update($tenant, $request->validated());
-
-        return TenantResource::make(
-            $this->tenantInformationService->load($tenant)
-        );
-    }
-
     public function destroy(Tenant $tenant): Response
     {
         $tenant->delete();

app/Domains/Core/Tenant/Models/Tenant.php

@@ -2,20 +2,20 @@
 
 namespace App\Domains\Core\Tenant\Models;
 
-use App\Shared\Attachable\Models\Attachment;
 use App\Domains\Commerce\Catalog\Enums\GroupLayout;
 use App\Domains\Commerce\Catalog\Enums\ProductLayout;
 use App\Domains\Commerce\Catalog\Models\CatalogItem;
 use App\Domains\Commerce\Catalog\Models\Category;
 use App\Domains\Core\Client\Models\Client;
-use App\Domains\Ticketing\Event\Models\EventDate;
-use App\Domains\Ticketing\Event\Models\EventDateChange;
-use App\Domains\Ticketing\Event\Models\Event;
-use App\Domains\Ticketing\Event\Models\EventCategory;
 use App\Domains\Core\Menu\Models\Menu;
 use App\Domains\Core\Menu\Models\TenantMenu;
 use App\Domains\Core\Tenant\Enums\CartEditingPolicy;
+use App\Domains\Ticketing\Event\Models\Event;
+use App\Domains\Ticketing\Event\Models\EventCategory;
+use App\Domains\Ticketing\Event\Models\EventDate;
+use App\Domains\Ticketing\Event\Models\EventDateChange;
 use App\Domains\Ticketing\Ticket\Models\ScanAttempt;
+use App\Shared\Attachable\Models\Attachment;
 use Illuminate\Database\Eloquent\Attributes\Fillable;
 use Illuminate\Database\Eloquent\Factories\HasFactory;
 use Illuminate\Database\Eloquent\Model;
@@ -28,6 +28,7 @@ use Illuminate\Support\Facades\Schema;
     'client_id',
     'codigo',
     'nombre',
+    'timezone',
     'dominio',
     'base_path',
     'site_title',
@@ -66,7 +67,10 @@ class Tenant extends Model
 {
     use HasFactory;
 
+    public const DEFAULT_TIMEZONE = 'America/Argentina/Buenos_Aires';
+
     protected $attributes = [
+        'timezone' => self::DEFAULT_TIMEZONE,
         'base_path' => '/',
         'search_product_layout' => ProductLayout::ColumnWithImage->value,
         'search_group_layout' => GroupLayout::Paginated->value,

app/Domains/Core/Tenant/Requests/StoreTenantRequest.php

@@ -1,139 +0,0 @@
-<?php
-
-namespace App\Domains\Core\Tenant\Requests;
-
-use App\Domains\Commerce\Catalog\Enums\GroupLayout;
-use App\Domains\Commerce\Catalog\Enums\ProductLayout;
-use App\Shared\Rules\ImageOrBase64Rule;
-use App\Domains\Core\Tenant\Enums\CartEditingPolicy;
-use App\Domains\Core\Tenant\Services\WebsiteExtraService;
-use App\Domains\Core\Tenant\Support\TenantDomainNormalizer;
-use Closure;
-use Illuminate\Foundation\Http\FormRequest;
-use Illuminate\Validation\Rule;
-
-class StoreTenantRequest extends FormRequest
-{
-    protected bool $hasInvalidDomain = false;
-
-    protected bool $hasInvalidBasePath = false;
-
-    public function authorize(): bool
-    {
-        return true;
-    }
-
-    protected function prepareForValidation(): void
-    {
-        $rawDomain = $this->input('dominio');
-        $hasExplicitBasePath = $this->has('base_path');
-        $rawBasePath = $hasExplicitBasePath
-            ? $this->input('base_path')
-            : TenantDomainNormalizer::pathFromDomain($rawDomain);
-        $normalizedDomain = TenantDomainNormalizer::normalize($rawDomain);
-        $normalizedBasePath = TenantDomainNormalizer::normalizePath($rawBasePath);
-
-        $this->hasInvalidDomain = TenantDomainNormalizer::hasValue($rawDomain)
-            && $normalizedDomain === null;
-        $this->hasInvalidBasePath = ($hasExplicitBasePath && ! is_string($rawBasePath))
-            || $normalizedBasePath === null;
-
-        $this->merge([
-            'dominio' => $normalizedDomain,
-            'base_path' => $normalizedBasePath,
-        ]);
-    }
-
-    /**
-     * @return array<string, mixed>
-     */
-    public function rules(): array
-    {
-        $logoRule = ['required', new ImageOrBase64Rule];
-
-        return array_merge([
-            'client_id' => ['sometimes', 'integer', Rule::exists('clients', 'id')],
-            'codigo' => ['required', 'string', 'max:255', Rule::unique('tenants', 'codigo')],
-            'nombre' => ['required', 'string', 'max:255'],
-            'dominio' => [
-                'bail',
-                function (string $attribute, mixed $value, Closure $fail): void {
-                    if ($this->hasInvalidDomain) {
-                        $fail("The {$attribute} field must contain a valid domain or URL.");
-                    }
-                },
-                'required',
-                'string',
-                'max:255',
-                Rule::unique('tenants', 'dominio')
-                    ->where('base_path', $this->input('base_path')),
-            ],
-            'base_path' => [
-                'bail',
-                function (string $attribute, mixed $value, Closure $fail): void {
-                    if ($this->hasInvalidBasePath) {
-                        $fail("The {$attribute} field must contain a valid URL path.");
-                    }
-                },
-                'required',
-                'string',
-                'max:255',
-                Rule::unique('tenants', 'base_path')
-                    ->where('dominio', $this->input('dominio')),
-            ],
-            'site_title' => ['sometimes', 'nullable', 'string', 'max:255'],
-            'address' => ['sometimes', 'nullable', 'string', 'max:255'],
-            'phone' => ['sometimes', 'nullable', 'string', 'max:255'],
-            'primary_color' => ['required', 'string', 'regex:/^#([a-fA-F0-9]{3,4}|[a-fA-F0-9]{6}|[a-fA-F0-9]{8})$/'],
-            'secondary_color' => ['required', 'string', 'regex:/^#([a-fA-F0-9]{3,4}|[a-fA-F0-9]{6}|[a-fA-F0-9]{8})$/'],
-            'danger_color' => ['required', 'string', 'regex:/^#([a-fA-F0-9]{3,4}|[a-fA-F0-9]{6}|[a-fA-F0-9]{8})$/'],
-            'success_color' => ['required', 'string', 'regex:/^#([a-fA-F0-9]{3,4}|[a-fA-F0-9]{6}|[a-fA-F0-9]{8})$/'],
-            'header_bg_color' => ['required', 'string', 'regex:/^#([a-fA-F0-9]{3,4}|[a-fA-F0-9]{6}|[a-fA-F0-9]{8})$/'],
-            'footer_bg_color' => ['required', 'string', 'regex:/^#([a-fA-F0-9]{3,4}|[a-fA-F0-9]{6}|[a-fA-F0-9]{8})$/'],
-            'header_logo' => $logoRule,
-            'footer_logo' => $logoRule,
-            'favicon' => ['sometimes', 'nullable', new ImageOrBase64Rule],
-            'header_bg_image' => ['sometimes', 'nullable', new ImageOrBase64Rule],
-            'footer_bg_image' => ['sometimes', 'nullable', new ImageOrBase64Rule],
-            'social_media' => ['sometimes', 'array'],
-            'social_media.*.code' => [
-                'required',
-                'string',
-                'distinct',
-                Rule::exists('social_media', 'code'),
-            ],
-            'social_media.*.url' => ['required', 'url', 'max:2048'],
-            'social_media.*.orden' => ['sometimes', 'integer', 'min:0', 'distinct'],
-            'search_product_layout' => ['sometimes', Rule::enum(ProductLayout::class)],
-            'search_group_layout' => ['sometimes', Rule::enum(GroupLayout::class)],
-            'search_items_per_page' => ['sometimes', 'integer', 'min:4', 'max:48'],
-            'display_categories' => ['sometimes', 'boolean'],
-            'display_seach_bar' => ['sometimes', 'boolean'],
-            'display_cart' => ['sometimes', 'boolean'],
-            'cart_editing_policy' => ['sometimes', Rule::enum(CartEditingPolicy::class)],
-            'checkout_editing_policy' => [
-                'sometimes',
-                Rule::in([CartEditingPolicy::Disabled->value]),
-            ],
-            'display_cart_item_images' => ['sometimes', 'boolean'],
-            'scanner_category_validation_enabled' => ['sometimes', 'boolean'],
-            'allow_ticket_refund' => ['sometimes', 'boolean'],
-            'allow_ticket_total_refund' => ['sometimes', 'boolean'],
-            'allow_ticket_partial_refund' => ['sometimes', 'boolean'],
-            'ticket_partial_refund_percentage' => [
-                'sometimes',
-                'numeric',
-                'decimal:0,2',
-                'min:0',
-                'max:99.99',
-            ],
-            'storefront_website_type_code' => [
-                'required_with:extras',
-                'sometimes',
-                'string',
-                Rule::exists('storefront_website_types', 'codigo'),
-            ],
-            'admin_website_type_code' => ['sometimes', 'nullable', 'string', Rule::exists('admin_website_types', 'codigo')],
-        ], app(WebsiteExtraService::class)->requestRules($this->input('storefront_website_type_code')));
-    }
-}

app/Domains/Core/Tenant/Requests/UpdateTenantRequest.php

@@ -1,165 +0,0 @@
-<?php
-
-namespace App\Domains\Core\Tenant\Requests;
-
-use App\Domains\Commerce\Catalog\Enums\GroupLayout;
-use App\Domains\Commerce\Catalog\Enums\ProductLayout;
-use App\Shared\Rules\ImageOrBase64Rule;
-use App\Domains\Core\Tenant\Enums\CartEditingPolicy;
-use App\Domains\Core\Tenant\Models\Tenant;
-use App\Domains\Core\Tenant\Support\TenantDomainNormalizer;
-use Closure;
-use Illuminate\Foundation\Http\FormRequest;
-use Illuminate\Validation\Rule;
-
-class UpdateTenantRequest extends FormRequest
-{
-    protected bool $hasInvalidDomain = false;
-
-    protected bool $hasInvalidBasePath = false;
-
-    public function authorize(): bool
-    {
-        return true;
-    }
-
-    protected function prepareForValidation(): void
-    {
-        if ($this->has('dominio')) {
-            $rawDomain = $this->input('dominio');
-            $normalizedDomain = TenantDomainNormalizer::normalize($rawDomain);
-            $embeddedBasePath = TenantDomainNormalizer::pathFromDomain($rawDomain);
-
-            $this->hasInvalidDomain = TenantDomainNormalizer::hasValue($rawDomain)
-                && ($normalizedDomain === null || $embeddedBasePath === null);
-
-            $this->merge([
-                'dominio' => $normalizedDomain,
-            ]);
-
-            if (! $this->has('base_path') && $embeddedBasePath !== null && $embeddedBasePath !== '/') {
-                $this->merge(['base_path' => $embeddedBasePath]);
-            }
-        }
-
-        if ($this->has('base_path')) {
-            $rawBasePath = $this->input('base_path');
-            $normalizedBasePath = TenantDomainNormalizer::normalizePath($rawBasePath);
-
-            $this->hasInvalidBasePath = ! is_string($rawBasePath)
-                || $normalizedBasePath === null;
-
-            $this->merge(['base_path' => $normalizedBasePath]);
-        }
-    }
-
-    /**
-     * @return array<string, mixed>
-     */
-    public function rules(): array
-    {
-        /** @var Tenant|null $tenant */
-        $tenant = $this->route('tenant');
-        $domain = $this->input('dominio', $tenant?->dominio);
-        $basePath = $this->input('base_path', $tenant?->base_path ?? '/');
-
-        $logoRule = ['nullable', new ImageOrBase64Rule];
-
-        return [
-            'client_id' => ['sometimes', 'integer', Rule::exists('clients', 'id')],
-            'codigo' => [
-                'nullable',
-                'string',
-                'max:255',
-                Rule::unique('tenants', 'codigo')->ignore($tenant?->id),
-            ],
-            'nombre' => ['nullable', 'string', 'max:255'],
-            'dominio' => [
-                'bail',
-                function (string $attribute, mixed $value, Closure $fail): void {
-                    if ($this->hasInvalidDomain) {
-                        $fail("The {$attribute} field must contain a valid domain or URL.");
-                    }
-                },
-                'nullable',
-                'string',
-                'max:255',
-                Rule::unique('tenants', 'dominio')
-                    ->where('base_path', $basePath)
-                    ->ignore($tenant?->id),
-            ],
-            'base_path' => [
-                'bail',
-                function (string $attribute, mixed $value, Closure $fail): void {
-                    if ($this->hasInvalidBasePath) {
-                        $fail("The {$attribute} field must contain a valid URL path.");
-                    }
-                },
-                'nullable',
-                'string',
-                'max:255',
-                Rule::unique('tenants', 'base_path')
-                    ->where('dominio', $domain)
-                    ->ignore($tenant?->id),
-            ],
-            'site_title' => ['sometimes', 'nullable', 'string', 'max:255'],
-            'address' => ['sometimes', 'nullable', 'string', 'max:255'],
-            'phone' => ['sometimes', 'nullable', 'string', 'max:255'],
-            'primary_color' => ['nullable', 'string', 'regex:/^#([a-fA-F0-9]{3,4}|[a-fA-F0-9]{6}|[a-fA-F0-9]{8})$/'],
-            'secondary_color' => ['nullable', 'string', 'regex:/^#([a-fA-F0-9]{3,4}|[a-fA-F0-9]{6}|[a-fA-F0-9]{8})$/'],
-            'danger_color' => ['nullable', 'string', 'regex:/^#([a-fA-F0-9]{3,4}|[a-fA-F0-9]{6}|[a-fA-F0-9]{8})$/'],
-            'success_color' => ['nullable', 'string', 'regex:/^#([a-fA-F0-9]{3,4}|[a-fA-F0-9]{6}|[a-fA-F0-9]{8})$/'],
-            'header_bg_color' => ['nullable', 'string', 'regex:/^#([a-fA-F0-9]{3,4}|[a-fA-F0-9]{6}|[a-fA-F0-9]{8})$/'],
-            'footer_bg_color' => ['nullable', 'string', 'regex:/^#([a-fA-F0-9]{3,4}|[a-fA-F0-9]{6}|[a-fA-F0-9]{8})$/'],
-            'header_logo' => $logoRule,
-            'footer_logo' => $logoRule,
-            'favicon' => ['sometimes', 'nullable', new ImageOrBase64Rule],
-            'header_bg_image' => ['sometimes', 'nullable', new ImageOrBase64Rule],
-            'footer_bg_image' => ['sometimes', 'nullable', new ImageOrBase64Rule],
-            'social_media' => ['sometimes', 'array'],
-            'social_media.*.code' => [
-                'required',
-                'string',
-                'distinct',
-                Rule::exists('social_media', 'code'),
-            ],
-            'social_media.*.url' => ['required', 'url', 'max:2048'],
-            'social_media.*.orden' => ['sometimes', 'integer', 'min:0', 'distinct'],
-            'search_product_layout' => ['sometimes', Rule::enum(ProductLayout::class)],
-            'search_group_layout' => ['sometimes', Rule::enum(GroupLayout::class)],
-            'search_items_per_page' => ['sometimes', 'integer', 'min:4', 'max:48'],
-            'display_categories' => ['sometimes', 'boolean'],
-            'display_seach_bar' => ['sometimes', 'boolean'],
-            'display_cart' => ['sometimes', 'boolean'],
-            'cart_editing_policy' => ['sometimes', Rule::enum(CartEditingPolicy::class)],
-            'checkout_editing_policy' => [
-                'sometimes',
-                Rule::in([CartEditingPolicy::Disabled->value]),
-            ],
-            'display_cart_item_images' => ['sometimes', 'boolean'],
-            'scanner_category_validation_enabled' => ['sometimes', 'boolean'],
-            'allow_ticket_refund' => ['sometimes', 'boolean'],
-            'allow_ticket_total_refund' => ['sometimes', 'boolean'],
-            'allow_ticket_partial_refund' => ['sometimes', 'boolean'],
-            'ticket_partial_refund_percentage' => [
-                'sometimes',
-                'numeric',
-                'decimal:0,2',
-                'min:0',
-                'max:99.99',
-            ],
-            'admin_website_type_code' => ['sometimes', 'nullable', 'string', Rule::exists('admin_website_types', 'codigo')],
-            'storefront_website_type_code' => [
-                'sometimes',
-                'nullable',
-                'string',
-                Rule::exists('storefront_website_types', 'codigo'),
-                function (string $attribute, mixed $value, Closure $fail) use ($tenant): void {
-                    if ($tenant && $value !== $tenant->storefront_website_type_code && $tenant->websiteExtras()->exists()) {
-                        $fail('The storefront website type cannot be changed while the tenant has extras.');
-                    }
-                },
-            ],
-        ];
-    }
-}

app/Domains/Core/Tenant/Resources/TenantResource.php

@@ -35,6 +35,7 @@ class TenantResource extends JsonResource
             'client_id' => $this->client_id,
             'codigo' => $this->codigo,
             'nombre' => $this->nombre,
+            'timezone' => $this->timezone,
             'dominio' => $this->dominio,
             'base_path' => $this->base_path,
             'site_title' => $this->site_title ?? 'ShopitFront',

app/Domains/Core/Tenant/Services/AdminWebsiteTypeService.php

@@ -2,9 +2,10 @@
 
 namespace App\Domains\Core\Tenant\Services;
 
+use App\Domains\Core\Tenant\Models\AdminWebsiteType;
+use App\Domains\Core\Tenant\Models\Tenant;
 use App\Shared\Attachable\Models\Attachment;
 use App\Shared\Attachable\Services\AttachmentService;
-use App\Domains\Core\Tenant\Models\AdminWebsiteType;
 use Illuminate\Support\Facades\DB;
 use Illuminate\Support\Str;
 
@@ -96,12 +97,12 @@ class AdminWebsiteTypeService
     {
         return Tenant::query()->where('favicon_id', $attachment->id)->exists()
             || AdminWebsiteType::query()
-            ->where(function ($query) use ($attachment): void {
-                $query
-                    ->where('site_logo', $attachment->id)
-                    ->orWhere('footer_logo', $attachment->id)
-                    ->orWhere('favicon_id', $attachment->id);
-            })
-            ->exists();
+                ->where(function ($query) use ($attachment): void {
+                    $query
+                        ->where('site_logo', $attachment->id)
+                        ->orWhere('footer_logo', $attachment->id)
+                        ->orWhere('favicon_id', $attachment->id);
+                })
+                ->exists();
     }
 }

app/Domains/Core/Tenant/Services/TenantProvisioningService.php

@@ -0,0 +1,125 @@
+<?php
+
+namespace App\Domains\Core\Tenant\Services;
+
+use App\Domains\Core\Tenant\Models\Tenant;
+use App\Shared\Attachable\Models\Attachment;
+use App\Shared\Attachable\Services\AttachmentService;
+use Illuminate\Support\Facades\DB;
+use Illuminate\Support\Str;
+
+/**
+ * Internal provisioning used by migrations and seeders.
+ *
+ * General tenant writes are intentionally not exposed through the HTTP API.
+ */
+class TenantProvisioningService
+{
+    public function __construct(
+        protected AttachmentService $attachmentService,
+        protected WebsiteExtraService $websiteExtraService,
+    ) {}
+
+    /** @param array<string, mixed> $data */
+    public function create(array $data): Tenant
+    {
+        return DB::transaction(function () use ($data): Tenant {
+            $images = [
+                'header_logo' => $data['header_logo'] ?? null,
+                'footer_logo' => $data['footer_logo'] ?? null,
+                'favicon' => $data['favicon'] ?? null,
+                'header_bg_image' => $data['header_bg_image'] ?? null,
+                'footer_bg_image' => $data['footer_bg_image'] ?? null,
+            ];
+            $socialMedia = $data['social_media'] ?? [];
+            $extras = $data['extras'] ?? [];
+
+            unset(
+                $data['header_logo'],
+                $data['footer_logo'],
+                $data['favicon'],
+                $data['header_bg_image'],
+                $data['footer_bg_image'],
+                $data['social_media'],
+                $data['extras'],
+            );
+
+            foreach ($images as $key => $image) {
+                $data[$key.'_id'] = $this->storeTenantImage($image);
+            }
+
+            /** @var Tenant $tenant */
+            $tenant = Tenant::query()->create($data);
+            $this->syncSocialMedia($tenant, $socialMedia);
+
+            foreach ($extras as $code => $config) {
+                $this->websiteExtraService->updateForTenant($tenant, $code, $config);
+            }
+
+            return $tenant;
+        });
+    }
+
+    /** @param array<string, mixed> $data */
+    public function update(Tenant $tenant, array $data): Tenant
+    {
+        return DB::transaction(function () use ($tenant, $data): Tenant {
+            $imageKeys = [
+                'header_logo',
+                'footer_logo',
+                'favicon',
+                'header_bg_image',
+                'footer_bg_image',
+            ];
+            $hasSocialMedia = array_key_exists('social_media', $data);
+            $socialMedia = $data['social_media'] ?? [];
+            unset($data['social_media']);
+
+            foreach ($imageKeys as $key) {
+                if (! array_key_exists($key, $data)) {
+                    continue;
+                }
+
+                $data[$key.'_id'] = $this->storeTenantImage($data[$key]);
+                unset($data[$key]);
+            }
+
+            $tenant->update($data);
+
+            if ($hasSocialMedia) {
+                $this->syncSocialMedia($tenant, $socialMedia);
+            }
+
+            return $tenant->refresh();
+        });
+    }
+
+    /** @param array<int, array{code: string, url: string, orden?: int}> $socialMedia */
+    private function syncSocialMedia(Tenant $tenant, array $socialMedia): void
+    {
+        $associations = [];
+
+        foreach (array_values($socialMedia) as $index => $item) {
+            $associations[$item['code']] = [
+                'url' => $item['url'],
+                'orden' => $item['orden'] ?? $index,
+            ];
+        }
+
+        $tenant->socialMedia()->sync($associations);
+        $tenant->unsetRelation('socialMedia');
+    }
+
+    private function storeTenantImage(mixed $image): ?int
+    {
+        if (! $image) {
+            return null;
+        }
+
+        $attachment = is_string($image) && Str::isUuid($image)
+            ? Attachment::query()->where('key', $image)->first()
+            : $this->attachmentService->store($image, 'tenants');
+
+        return $attachment?->id;
+    }
+}

app/Domains/Core/Tenant/Services/TenantService.php

@@ -1,198 +0,0 @@
-<?php
-
-namespace App\Domains\Core\Tenant\Services;
-
-use App\Shared\Attachable\Models\Attachment;
-use App\Shared\Attachable\Services\AttachmentService;
-use App\Domains\Core\Tenant\Models\Tenant;
-use Illuminate\Support\Facades\DB;
-use Illuminate\Support\Str;
-
-class TenantService
-{
-    public function __construct(
-        protected AttachmentService $attachmentService,
-        protected WebsiteExtraService $websiteExtraService,
-    ) {}
-
-    /**
-     * Create a new tenant and store its logos.
-     *
-     * @param  array<string, mixed>  $data
-     */
-    public function create(array $data): Tenant
-    {
-        return DB::transaction(function () use ($data): Tenant {
-            $headerLogo = $data['header_logo'] ?? null;
-            $footerLogo = $data['footer_logo'] ?? null;
-            $favicon = $data['favicon'] ?? null;
-            $headerBackgroundImage = $data['header_bg_image'] ?? null;
-            $footerBackgroundImage = $data['footer_bg_image'] ?? null;
-            $socialMedia = $data['social_media'] ?? [];
-            $extras = $data['extras'] ?? [];
-
-            unset(
-                $data['header_logo'],
-                $data['footer_logo'],
-                $data['favicon'],
-                $data['header_bg_image'],
-                $data['footer_bg_image'],
-                $data['social_media'],
-                $data['extras'],
-            );
-
-            $headerAttachmentId = null;
-            if ($headerLogo) {
-                $attachment = Str::isUuid($headerLogo)
-                    ? Attachment::query()->where('key', $headerLogo)->first()
-                    : $this->attachmentService->store($headerLogo, 'tenants');
-
-                if ($attachment) {
-                    $headerAttachmentId = $attachment->id;
-                }
-            }
-
-            $footerAttachmentId = null;
-            if ($footerLogo) {
-                $attachment = Str::isUuid($footerLogo)
-                    ? Attachment::query()->where('key', $footerLogo)->first()
-                    : $this->attachmentService->store($footerLogo, 'tenants');
-
-                if ($attachment) {
-                    $footerAttachmentId = $attachment->id;
-                }
-            }
-
-            $data['header_logo_id'] = $headerAttachmentId;
-            $data['footer_logo_id'] = $footerAttachmentId;
-            $data['favicon_id'] = $this->storeTenantImage($favicon);
-            $data['header_bg_image_id'] = $this->storeTenantImage($headerBackgroundImage);
-            $data['footer_bg_image_id'] = $this->storeTenantImage($footerBackgroundImage);
-
-            /** @var Tenant $tenant */
-            $tenant = Tenant::query()->create($data);
-            $this->syncSocialMedia($tenant, $socialMedia);
-            $this->websiteExtraService->createForTenant($tenant, $extras);
-
-            return $tenant;
-        });
-    }
-
-    /**
-     * Update an existing tenant and store new logos if uploaded.
-     *
-     * @param  array<string, mixed>  $data
-     */
-    public function update(Tenant $tenant, array $data): Tenant
-    {
-        return DB::transaction(function () use ($tenant, $data): Tenant {
-            $hasHeaderLogoKey = array_key_exists('header_logo', $data);
-            $hasFooterLogoKey = array_key_exists('footer_logo', $data);
-            $hasFaviconKey = array_key_exists('favicon', $data);
-            $hasHeaderBackgroundImageKey = array_key_exists('header_bg_image', $data);
-            $hasFooterBackgroundImageKey = array_key_exists('footer_bg_image', $data);
-            $hasSocialMediaKey = array_key_exists('social_media', $data);
-            $headerLogo = $data['header_logo'] ?? null;
-            $footerLogo = $data['footer_logo'] ?? null;
-            $favicon = $data['favicon'] ?? null;
-            $headerBackgroundImage = $data['header_bg_image'] ?? null;
-            $footerBackgroundImage = $data['footer_bg_image'] ?? null;
-            $socialMedia = $data['social_media'] ?? [];
-
-            unset(
-                $data['header_logo'],
-                $data['footer_logo'],
-                $data['favicon'],
-                $data['header_bg_image'],
-                $data['footer_bg_image'],
-                $data['social_media']
-            );
-
-            $tenant->fill($data);
-
-            if ($hasHeaderLogoKey) {
-                if ($headerLogo) {
-                    $attachment = Str::isUuid($headerLogo)
-                        ? Attachment::query()->where('key', $headerLogo)->first()
-                        : $this->attachmentService->store($headerLogo, 'tenants');
-
-                    if ($attachment) {
-                        $tenant->header_logo_id = $attachment->id;
-                    } else {
-                        $tenant->header_logo_id = null;
-                    }
-                } else {
-                    $tenant->header_logo_id = null;
-                }
-            }
-
-            if ($hasFooterLogoKey) {
-                if ($footerLogo) {
-                    $attachment = Str::isUuid($footerLogo)
-                        ? Attachment::query()->where('key', $footerLogo)->first()
-                        : $this->attachmentService->store($footerLogo, 'tenants');
-
-                    if ($attachment) {
-                        $tenant->footer_logo_id = $attachment->id;
-                    } else {
-                        $tenant->footer_logo_id = null;
-                    }
-                } else {
-                    $tenant->footer_logo_id = null;
-                }
-            }
-
-            if ($hasFaviconKey) {
-                $tenant->favicon_id = $this->storeTenantImage($favicon);
-            }
-
-            if ($hasHeaderBackgroundImageKey) {
-                $tenant->header_bg_image_id = $this->storeTenantImage($headerBackgroundImage);
-            }
-
-            if ($hasFooterBackgroundImageKey) {
-                $tenant->footer_bg_image_id = $this->storeTenantImage($footerBackgroundImage);
-            }
-
-            $tenant->save();
-
-            if ($hasSocialMediaKey) {
-                $this->syncSocialMedia($tenant, $socialMedia);
-            }
-
-            return $tenant;
-        });
-    }
-
-    /**
-     * @param  array<int, array{code: string, url: string, orden?: int}>  $socialMedia
-     */
-    private function syncSocialMedia(Tenant $tenant, array $socialMedia): void
-    {
-        $owner = $tenant->activeEvent ?? $tenant;
-        $associations = [];
-
-        foreach (array_values($socialMedia) as $index => $item) {
-            $associations[$item['code']] = [
-                'url' => $item['url'],
-                'orden' => $item['orden'] ?? $index,
-            ];
-        }
-
-        $owner->socialMedia()->sync($associations);
-        $owner->unsetRelation('socialMedia');
-    }
-
-    private function storeTenantImage(mixed $image): ?int
-    {
-        if (! $image) {
-            return null;
-        }
-
-        $attachment = is_string($image) && Str::isUuid($image)
-            ? Attachment::query()->where('key', $image)->first()
-            : $this->attachmentService->store($image, 'tenants');
-
-        return $attachment?->id;
-    }
-}

app/Domains/Core/Tenant/Services/WebsiteExtraService.php

@@ -2,16 +2,14 @@
 
 namespace App\Domains\Core\Tenant\Services;
 
+use App\Domains\Core\Tenant\Models\StorefrontWebsiteTypeExtra;
+use App\Domains\Core\Tenant\Models\Tenant;
+use App\Domains\Core\Tenant\Models\WebsiteExtra;
 use App\Shared\Attachable\Enums\AttachmentType;
 use App\Shared\Attachable\Models\Attachment;
 use App\Shared\Attachable\Services\AttachmentService;
 use App\Shared\Rules\CroppedImageOrBase64Rule;
 use App\Shared\Rules\ImageOrBase64Rule;
-use App\Domains\Core\Tenant\Models\Tenant;
-use App\Domains\Core\Tenant\Models\WebsiteExtra;
-use App\Domains\Core\Tenant\Models\StorefrontWebsiteType;
-use App\Domains\Core\Tenant\Models\StorefrontWebsiteTypeExtra;
-use Illuminate\Support\Collection;
 use Illuminate\Support\Facades\DB;
 use Illuminate\Support\Str;
 use Illuminate\Validation\ValidationException;
@@ -21,109 +19,6 @@ class WebsiteExtraService
 {
     public function __construct(protected AttachmentService $attachmentService) {}
 
-    /**
-     * Build the request rules declared by the selected website type.
-     *
-     * @return array<string, mixed>
-     */
-    public function requestRules(?string $websiteTypeCode): array
-    {
-        if (! is_string($websiteTypeCode) || $websiteTypeCode === '') {
-            return [
-                'extras' => ['prohibited'],
-            ];
-        }
-
-        $definitions = $this->definitionsFor($websiteTypeCode);
-        $allowedCodes = $definitions->pluck('codigo')->all();
-        $hasRequiredExtras = $definitions->contains(
-            fn (StorefrontWebsiteTypeExtra $definition): bool => $definition->is_required
-        );
-
-        $rules = [
-            'extras' => [
-                $hasRequiredExtras ? 'required' : 'sometimes',
-                'array',
-                function (string $attribute, mixed $value, \Closure $fail) use ($allowedCodes): void {
-                    if (! is_array($value)) {
-                        return;
-                    }
-
-                    $unknownCodes = array_diff(array_keys($value), $allowedCodes);
-
-                    if ($unknownCodes !== []) {
-                        $fail(
-                            'The '.$attribute.' field contains extras not supported by the website type: '
-                            .implode(', ', $unknownCodes).'.'
-                        );
-                    }
-                },
-            ],
-        ];
-
-        foreach ($definitions as $definition) {
-            $schemaRules = $definition->config_schema['request_rules'] ?? [];
-            $rootRules = $this->compileRules($schemaRules['$'] ?? []);
-            $rootRules = array_values(array_filter(
-                $rootRules,
-                fn (mixed $rule): bool => ! in_array($rule, ['required', 'sometimes'], true)
-            ));
-            array_unshift($rootRules, $definition->is_required ? 'required' : 'sometimes');
-
-            $rules["extras.{$definition->codigo}"] = $rootRules;
-
-            foreach ($schemaRules as $path => $pathRules) {
-                if ($path === '$') {
-                    continue;
-                }
-
-                $rules[$this->requestAttribute($definition->codigo, $path)] = $this->compileRules($pathRules);
-            }
-        }
-
-        return $rules;
-    }
-
-    /**
-     * Transform and persist each extra selected for a tenant.
-     *
-     * @param  array<string, mixed>  $extras
-     */
-    public function createForTenant(Tenant $tenant, array $extras): void
-    {
-        if ($extras === []) {
-            return;
-        }
-
-        $definitions = $this->definitionsFor((string) $tenant->storefront_website_type_code)
-            ->keyBy('codigo');
-
-        foreach ($extras as $name => $config) {
-            /** @var StorefrontWebsiteTypeExtra|null $definition */
-            $definition = $definitions->get($name);
-
-            if (! $definition) {
-                throw ValidationException::withMessages([
-                    'extras' => ["The extra {$name} is not supported by the selected website type."],
-                ]);
-            }
-
-            $requestRoot = "extras.{$definition->codigo}";
-            $transformedConfig = $this->applyTransforms(
-                $tenant,
-                $definition,
-                $config,
-                $requestRoot
-            );
-            $tenant->websiteExtras()->create([
-                'website_type_extra_id' => $definition->id,
-                'config' => $transformedConfig,
-            ]);
-        }
-
-        $tenant->unsetRelation('websiteExtras');
-    }
-
     /**
      * Build request rules for one extra addressed by its stable code.
      *
@@ -201,19 +96,6 @@ class WebsiteExtraService
             ->firstOrFail();
     }
 
-    /**
-     * @return Collection<int, StorefrontWebsiteTypeExtra>
-     */
-    private function definitionsFor(string $websiteTypeCode): Collection
-    {
-        $websiteType = StorefrontWebsiteType::query()
-            ->where('codigo', $websiteTypeCode)
-            ->with('extras')
-            ->first();
-
-        return $websiteType?->extras ?? collect();
-    }
-
     /**
      * @param  string|array<int, mixed>  $rules
      * @return array<int, mixed>
@@ -232,11 +114,6 @@ class WebsiteExtraService
         );
     }
 
-    private function requestAttribute(string $extraCode, string $path): string
-    {
-        return $this->configAttribute("extras.{$extraCode}", $path);
-    }
-
     private function configAttribute(string $root, string $path): string
     {
         if ($path === '$') {

app/Domains/Core/Tenant/documentacion/README.md

@@ -15,7 +15,6 @@ Es la raíz del modelo multi-tenant. Gestiona organizaciones/sitios, tipos de we
 
 ## Servicios
 
-- `TenantService`: crea y actualiza tenants, incluyendo sus recursos asociados.
 - `TenantInformationService`: carga un tenant y las relaciones requeridas por cada contexto.
 - `AdminWebsiteTypeService`: crea o actualiza los tipos de admin y su marca.
 - `WebsiteExtraService`: construye reglas dinámicas, crea, actualiza y habilita/deshabilita extras.
@@ -25,7 +24,8 @@ El par `(dominio, base_path)` es único. Un mismo dominio puede alojar el tenant
 
 ## Endpoints
 
-- Recurso REST público/administrativo `/tenants`.
+- `GET /tenants`, `GET /tenants/{codigo}` y `DELETE /tenants/{codigo}`.
+- La creación y actualización general de tenants se administran mediante seeders o base de datos; no se exponen por API.
 - Bajo `/v1/adminapp/tenant/website-extras`, con autenticación y contexto de tenant: consulta general, detalle, actualización y activación/desactivación.
 
 ## Dependencias y reglas

app/Domains/Core/Tenant/routes/api.php

@@ -3,6 +3,6 @@
 use App\Domains\Core\Tenant\Controllers\TenantController;
 use Illuminate\Support\Facades\Route;
 
-Route::apiResource('tenants', TenantController::class);
+Route::apiResource('tenants', TenantController::class)->except(['store', 'update']);
 
 require __DIR__.'/adminapp.php';

app/Domains/Ticketing/Desfile/Controllers/EntryReservationController.php

@@ -0,0 +1,85 @@
+<?php
+
+namespace App\Domains\Ticketing\Desfile\Controllers;
+
+use App\Domains\Ticketing\Desfile\Requests\ExportEntryReservationsRequest;
+use App\Domains\Ticketing\Desfile\Requests\IndexEntryReservationsRequest;
+use App\Domains\Ticketing\Desfile\Requests\StoreEntryReservationsRequest;
+use App\Domains\Ticketing\Desfile\Resources\EntryReservationResource;
+use App\Domains\Ticketing\Desfile\Services\EntryReservationExcelService;
+use App\Domains\Ticketing\Desfile\Services\EntryReservationPdfService;
+use App\Domains\Ticketing\Desfile\Services\EntryReservationService;
+use App\Domains\Ticketing\Ticket\Services\TicketPdfService;
+use App\Http\Controllers\Controller;
+use Illuminate\Http\Resources\Json\AnonymousResourceCollection;
+use Illuminate\Http\Response;
+use Symfony\Component\HttpFoundation\StreamedResponse;
+
+class EntryReservationController extends Controller
+{
+    public function index(IndexEntryReservationsRequest $request, EntryReservationService $service): AnonymousResourceCollection
+    {
+        return EntryReservationResource::collection(
+            $service->reservations($request->user(), $request->validated()),
+        );
+    }
+
+    public function downloadPdf(
+        ExportEntryReservationsRequest $request,
+        EntryReservationService $service,
+        EntryReservationPdfService $pdf,
+    ): Response {
+        $user = $request->user();
+
+        return $pdf->download(
+            $user->tenant()->firstOrFail(),
+            $service->reservationsForExport($user, $request->validated()),
+            $request->validated('timezone'),
+        );
+    }
+
+    public function downloadExcel(
+        ExportEntryReservationsRequest $request,
+        EntryReservationService $service,
+        EntryReservationExcelService $excel,
+    ): StreamedResponse {
+        $user = $request->user();
+
+        return $excel->download(
+            $user->tenant()->firstOrFail(),
+            $service->reservationsForExport($user, $request->validated()),
+            $request->validated('timezone'),
+        );
+    }
+
+    public function downloadTicketPdf(
+        IndexEntryReservationsRequest $request,
+        int $reservation,
+        EntryReservationService $service,
+        TicketPdfService $pdf,
+    ): Response {
+        $user = $request->user();
+
+        return $pdf->download(
+            $user->tenant()->firstOrFail(),
+            collect([$service->reservationTicket($user, $reservation)]),
+        );
+    }
+
+    public function store(StoreEntryReservationsRequest $request, EntryReservationService $service): AnonymousResourceCollection
+    {
+        return EntryReservationResource::collection($service->reserve(
+            $request->user(), $request->validated('idempotency_key'), $request->validated('rows'),
+        ));
+    }
+
+    public function destroy(
+        IndexEntryReservationsRequest $request,
+        int $reservation,
+        EntryReservationService $service,
+    ): Response {
+        $service->cancel($request->user(), $reservation);
+
+        return response()->noContent();
+    }
+}

app/Domains/Ticketing/Desfile/Enums/EntryReservationPaymentType.php

@@ -0,0 +1,29 @@
+<?php
+
+namespace App\Domains\Ticketing\Desfile\Enums;
+
+enum EntryReservationPaymentType: string
+{
+    case Free = 'sin_cargo';
+    case Other = 'otro_metodo';
+
+    public function label(): string
+    {
+        return match ($this) {
+            self::Free => 'Sin cargo',
+            self::Other => 'Otro método',
+        };
+    }
+
+    /** @return list<array{value: string, label: string}> */
+    public static function options(): array
+    {
+        return array_map(
+            fn (self $type): array => [
+                'value' => $type->value,
+                'label' => $type->label(),
+            ],
+            self::cases(),
+        );
+    }
+}

app/Domains/Ticketing/Desfile/Models/EntryReservation.php

@@ -0,0 +1,54 @@
+<?php
+
+namespace App\Domains\Ticketing\Desfile\Models;
+
+use App\Domains\Commerce\Catalog\Models\Inventory;
+use App\Domains\Commerce\Catalog\Models\Variant;
+use App\Domains\Ticketing\Desfile\Enums\EntryReservationPaymentType;
+use App\Domains\Ticketing\Ticket\Models\Ticket;
+use Illuminate\Database\Eloquent\Attributes\Fillable;
+use Illuminate\Database\Eloquent\Model;
+use Illuminate\Database\Eloquent\Relations\BelongsTo;
+use Illuminate\Database\Eloquent\SoftDeletes;
+
+#[Fillable([
+    'variant_id',
+    'ticket_id',
+    'inventory_id',
+    'batch_id',
+    'fecha_reserva',
+    'importe',
+    'tipo_pago',
+])]
+class EntryReservation extends Model
+{
+    use SoftDeletes;
+
+    protected $table = 'desfile_entry_reservations';
+
+    protected function casts(): array
+    {
+        return [
+            'variant_id' => 'integer',
+            'fecha_reserva' => 'datetime',
+            'importe' => 'decimal:2',
+            'tipo_pago' => EntryReservationPaymentType::class,
+        ];
+    }
+
+    /** @return BelongsTo<Variant, $this> */
+    public function variant(): BelongsTo
+    {
+        return $this->belongsTo(Variant::class)->withTrashed();
+    }
+
+    public function ticket(): BelongsTo
+    {
+        return $this->belongsTo(Ticket::class);
+    }
+
+    public function inventory(): BelongsTo
+    {
+        return $this->belongsTo(Inventory::class);
+    }
+}

app/Domains/Ticketing/Desfile/Requests/ExportEntryReservationsRequest.php

@@ -0,0 +1,16 @@
+<?php
+
+namespace App\Domains\Ticketing\Desfile\Requests;
+
+use App\Shared\Rules\ValidTimezone;
+
+class ExportEntryReservationsRequest extends IndexEntryReservationsRequest
+{
+    public function rules(): array
+    {
+        return [
+            ...parent::rules(),
+            'timezone' => ['required', 'string', new ValidTimezone],
+        ];
+    }
+}

app/Domains/Ticketing/Desfile/Requests/IndexEntryReservationsRequest.php

@@ -0,0 +1,24 @@
+<?php
+
+namespace App\Domains\Ticketing\Desfile\Requests;
+
+use App\Domains\Ticketing\Desfile\Enums\EntryReservationPaymentType;
+use Illuminate\Foundation\Http\FormRequest;
+use Illuminate\Validation\Rule;
+
+class IndexEntryReservationsRequest extends FormRequest
+{
+    public function authorize(): bool
+    {
+        return $this->user()?->tenant_codigo === 'desfile_pura_tendencia';
+    }
+
+    public function rules(): array
+    {
+        return [
+            'tipo_pago' => ['sometimes', 'nullable', Rule::enum(EntryReservationPaymentType::class)],
+            'page' => ['sometimes', 'integer', 'min:1'],
+            'per_page' => ['sometimes', 'integer', 'min:1', 'max:100'],
+        ];
+    }
+}

app/Domains/Ticketing/Desfile/Requests/StoreEntryReservationsRequest.php

@@ -0,0 +1,26 @@
+<?php
+
+namespace App\Domains\Ticketing\Desfile\Requests;
+
+use App\Domains\Ticketing\Desfile\Enums\EntryReservationPaymentType;
+use Illuminate\Foundation\Http\FormRequest;
+use Illuminate\Validation\Rule;
+
+class StoreEntryReservationsRequest extends FormRequest
+{
+    public function authorize(): bool
+    {
+        return $this->user()?->tenant_codigo === 'desfile_pura_tendencia';
+    }
+
+    public function rules(): array
+    {
+        return [
+            'idempotency_key' => ['required', 'uuid'],
+            'rows' => ['required', 'array', 'min:1', 'max:100'],
+            'rows.*' => ['required', 'array:variant_id,tipo_pago'],
+            'rows.*.variant_id' => ['required', 'integer', 'min:1', 'distinct'],
+            'rows.*.tipo_pago' => ['required', Rule::enum(EntryReservationPaymentType::class)],
+        ];
+    }
+}

app/Domains/Ticketing/Desfile/Resources/EntryReservationResource.php

@@ -0,0 +1,47 @@
+<?php
+
+namespace App\Domains\Ticketing\Desfile\Resources;
+
+use Illuminate\Http\Request;
+use Illuminate\Http\Resources\Json\JsonResource;
+
+class EntryReservationResource extends JsonResource
+{
+    public function toArray(Request $request): array
+    {
+        $selection = $this->relationLoaded('variant')
+            ? $this->variant->selectionOptions()
+            : collect();
+
+        return [
+            'id' => $this->id,
+            'variant_id' => $this->variant_id,
+            'ticket_id' => $this->ticket_id,
+            'fecha_reserva' => $this->fecha_reserva->toIso8601String(),
+            'tipo_pago' => $this->tipo_pago->value,
+            'tipo_pago_label' => $this->tipo_pago->label(),
+            'importe' => $this->importe,
+            'entrada' => [
+                'tipo' => $this->selectionLabel($selection->get('tipo')),
+                'sector' => $this->selectionLabel($selection->get('sector')),
+                'fila' => $this->selectionLabel($selection->get('fila')),
+                'asiento' => $this->selectionLabel($selection->get('asiento')),
+            ],
+        ];
+    }
+
+    private function selectionLabel(mixed $selection): ?string
+    {
+        if (! is_array($selection)) {
+            return null;
+        }
+
+        if (array_is_list($selection)) {
+            $labels = collect($selection)->pluck('label')->filter()->implode(', ');
+
+            return $labels !== '' ? $labels : null;
+        }
+
+        return isset($selection['label']) ? (string) $selection['label'] : null;
+    }
+}

app/Domains/Ticketing/Desfile/Services/EntryReservationExcelService.php

@@ -0,0 +1,91 @@
+<?php
+
+namespace App\Domains\Ticketing\Desfile\Services;
+
+use App\Domains\Core\Tenant\Models\Tenant;
+use App\Domains\Ticketing\Desfile\Models\EntryReservation;
+use Illuminate\Support\Collection;
+use PhpOffice\PhpSpreadsheet\Cell\DataType;
+use PhpOffice\PhpSpreadsheet\Shared\Date;
+use PhpOffice\PhpSpreadsheet\Spreadsheet;
+use PhpOffice\PhpSpreadsheet\Style\Alignment;
+use PhpOffice\PhpSpreadsheet\Style\Fill;
+use PhpOffice\PhpSpreadsheet\Writer\Xlsx;
+use Symfony\Component\HttpFoundation\StreamedResponse;
+
+class EntryReservationExcelService
+{
+    public function __construct(private readonly EntryReservationReportService $report) {}
+
+    /** @param Collection<int, EntryReservation> $reservations */
+    public function download(Tenant $tenant, Collection $reservations, string $timeZone): StreamedResponse
+    {
+        $generatedAt = now();
+        $rows = $this->report->rows($reservations);
+        $spreadsheet = new Spreadsheet;
+        $spreadsheet->getProperties()
+            ->setCreator('Shopit')
+            ->setTitle('Reservas de entradas')
+            ->setSubject($tenant->nombre);
+        $sheet = $spreadsheet->getActiveSheet();
+        $sheet->setTitle('Reservas');
+        $sheet->fromArray([
+            'Tipo',
+            'Sector',
+            'Fila',
+            'Asiento',
+            'ID',
+            'Fecha',
+            'Importe',
+            'Pago',
+        ], null, 'A1');
+
+        foreach ($rows as $index => $reservation) {
+            $row = $index + 2;
+            foreach (['A' => 'tipo', 'B' => 'sector', 'C' => 'fila', 'D' => 'asiento'] as $column => $key) {
+                $sheet->setCellValueExplicit("{$column}{$row}", $reservation[$key], DataType::TYPE_STRING);
+            }
+            $sheet->setCellValueExplicit(
+                "E{$row}",
+                $reservation['ticket_id'] === null ? '-' : (string) $reservation['ticket_id'],
+                DataType::TYPE_STRING,
+            );
+            $sheet->setCellValue(
+                "F{$row}",
+                Date::dateTimeToExcel($reservation['fecha_reserva']->copy()->timezone($timeZone)),
+            );
+            if ($reservation['importe'] !== null) {
+                $sheet->setCellValue("G{$row}", (float) $reservation['importe']);
+            }
+            $sheet->setCellValueExplicit("H{$row}", $reservation['pago'], DataType::TYPE_STRING);
+        }
+
+        $lastRow = max(2, $rows->count() + 1);
+        $sheet->getStyle("F2:F{$lastRow}")->getNumberFormat()->setFormatCode('dd/mm/yyyy hh:mm');
+        $sheet->getStyle("G2:G{$lastRow}")->getNumberFormat()->setFormatCode('$ #,##0.00');
+        $sheet->getStyle('A1:H1')->applyFromArray([
+            'font' => ['bold' => true, 'color' => ['rgb' => 'FFFFFF']],
+            'fill' => [
+                'fillType' => Fill::FILL_SOLID,
+                'startColor' => ['rgb' => '26382E'],
+            ],
+            'alignment' => ['vertical' => Alignment::VERTICAL_CENTER],
+        ]);
+        $sheet->getRowDimension(1)->setRowHeight(24);
+        $sheet->freezePane('A2');
+        $sheet->setAutoFilter("A1:H{$lastRow}");
+        foreach (['A' => 20, 'B' => 22, 'C' => 12, 'D' => 12, 'E' => 16, 'F' => 20, 'G' => 16, 'H' => 18] as $column => $width) {
+            $sheet->getColumnDimension($column)->setWidth($width);
+        }
+
+        $filename = 'reservas_entradas_'.$tenant->codigo.'_'
+            .$generatedAt->copy()->timezone($timeZone)->format('Ymd_His').'.xlsx';
+
+        return response()->streamDownload(function () use ($spreadsheet): void {
+            (new Xlsx($spreadsheet))->save('php://output');
+            $spreadsheet->disconnectWorksheets();
+        }, $filename, [
+            'Content-Type' => 'application/vnd.openxmlformats-officedocument.spreadsheetml.sheet',
+        ]);
+    }
+}

app/Domains/Ticketing/Desfile/Services/EntryReservationPdfService.php

@@ -0,0 +1,51 @@
+<?php
+
+namespace App\Domains\Ticketing\Desfile\Services;
+
+use App\Domains\Core\Tenant\Models\Tenant;
+use App\Domains\Ticketing\Desfile\Models\EntryReservation;
+use Barryvdh\DomPDF\Facade\Pdf;
+use Barryvdh\DomPDF\PDF as DomPdf;
+use Illuminate\Http\Response;
+use Illuminate\Support\Collection;
+
+class EntryReservationPdfService
+{
+    public function __construct(private readonly EntryReservationReportService $report) {}
+
+    /** @param Collection<int, EntryReservation> $reservations */
+    public function download(Tenant $tenant, Collection $reservations, string $timeZone): Response
+    {
+        $generatedAt = now();
+        $rows = $this->report->rows($reservations);
+        $pdf = Pdf::loadView('pdf.adminapp.desfile-entry-reservations', [
+            'tenant' => $tenant,
+            'reservations' => $rows,
+            'generatedAt' => $generatedAt,
+            'timeZone' => $timeZone,
+        ])->setPaper('a4', 'landscape');
+
+        $this->addPageNumbers($pdf);
+
+        return $pdf->download(
+            'reservas_entradas_'.$tenant->codigo.'_'
+            .$generatedAt->copy()->timezone($timeZone)->format('Ymd_His').'.pdf'
+        );
+    }
+
+    private function addPageNumbers(DomPdf $pdf): void
+    {
+        $pdf->render();
+        $domPdf = $pdf->getDomPDF();
+        $font = $domPdf->getFontMetrics()->getFont('DejaVu Sans');
+
+        $domPdf->getCanvas()->page_text(
+            385,
+            575,
+            'Página {PAGE_NUM} de {PAGE_COUNT}',
+            $font,
+            7,
+            [0.48, 0.52, 0.49],
+        );
+    }
+}

app/Domains/Ticketing/Desfile/Services/EntryReservationReportService.php

@@ -0,0 +1,44 @@
+<?php
+
+namespace App\Domains\Ticketing\Desfile\Services;
+
+use App\Domains\Ticketing\Desfile\Models\EntryReservation;
+use Illuminate\Support\Collection;
+
+class EntryReservationReportService
+{
+    /**
+     * @param  Collection<int, EntryReservation>  $reservations
+     * @return Collection<int, array<string, mixed>>
+     */
+    public function rows(Collection $reservations): Collection
+    {
+        return $reservations->values()->map(function (EntryReservation $reservation): array {
+            $selection = $reservation->variant->selectionOptions();
+
+            return [
+                'tipo' => $this->selectionLabel($selection->get('tipo')),
+                'sector' => $this->selectionLabel($selection->get('sector')),
+                'fila' => $this->selectionLabel($selection->get('fila')),
+                'asiento' => $this->selectionLabel($selection->get('asiento')),
+                'ticket_id' => $reservation->ticket_id,
+                'fecha_reserva' => $reservation->fecha_reserva,
+                'importe' => $reservation->importe,
+                'pago' => $reservation->tipo_pago->label(),
+            ];
+        });
+    }
+
+    private function selectionLabel(mixed $selection): string
+    {
+        if (! is_array($selection)) {
+            return '-';
+        }
+
+        if (array_is_list($selection)) {
+            return collect($selection)->pluck('label')->filter()->implode(', ') ?: '-';
+        }
+
+        return isset($selection['label']) ? (string) $selection['label'] : '-';
+    }
+}

app/Domains/Ticketing/Desfile/Services/EntryReservationService.php

@@ -0,0 +1,240 @@
+<?php
+
+namespace App\Domains\Ticketing\Desfile\Services;
+
+use App\Domains\Commerce\Catalog\Enums\InventoryPolicy;
+use App\Domains\Commerce\Catalog\Models\CatalogItem;
+use App\Domains\Commerce\Catalog\Models\Inventory;
+use App\Domains\Commerce\Catalog\Models\Variant;
+use App\Domains\Core\Auth\Models\User;
+use App\Domains\Ticketing\Desfile\Enums\EntryReservationPaymentType;
+use App\Domains\Ticketing\Desfile\Models\EntryReservation;
+use App\Domains\Ticketing\Ticket\Exceptions\TicketGenerationException;
+use App\Domains\Ticketing\Ticket\Models\Ticket;
+use App\Domains\Ticketing\Ticket\Services\TicketGeneratorService;
+use App\Domains\Ticketing\Ticket\Services\TicketPresentationResolver;
+use App\Domains\Ticketing\Ticket\Services\TicketValidityResolver;
+use Illuminate\Database\Eloquent\Builder;
+use Illuminate\Pagination\LengthAwarePaginator;
+use Illuminate\Support\Collection;
+use Illuminate\Support\Facades\DB;
+use Illuminate\Validation\ValidationException;
+
+class EntryReservationService
+{
+    public function __construct(private readonly TicketGeneratorService $tickets) {}
+
+    /**
+     * @param  array{tipo_pago?: string|null, page?: int, per_page?: int}  $filters
+     * @return LengthAwarePaginator<EntryReservation>
+     */
+    public function reservations(User $user, array $filters = []): LengthAwarePaginator
+    {
+        abort_unless($user->tenant_codigo === 'desfile_pura_tendencia', 403);
+
+        return $this->reservationsQuery($user, $filters)
+            ->paginate(
+                perPage: $filters['per_page'] ?? 15,
+                pageName: 'page',
+                page: $filters['page'] ?? 1,
+            )
+            ->withQueryString();
+    }
+
+    /**
+     * @param  array{tipo_pago?: string|null}  $filters
+     * @return Collection<int, EntryReservation>
+     */
+    public function reservationsForExport(User $user, array $filters = []): Collection
+    {
+        abort_unless($user->tenant_codigo === 'desfile_pura_tendencia', 403);
+
+        return $this->reservationsQuery($user, $filters)->get();
+    }
+
+    public function reservationTicket(User $user, int $reservationId): Ticket
+    {
+        abort_unless($user->tenant_codigo === 'desfile_pura_tendencia', 403);
+
+        $reservation = EntryReservation::query()
+            ->whereKey($reservationId)
+            ->whereNotNull('ticket_id')
+            ->whereHas('variant.catalogItem', fn (Builder $query): Builder => $query
+                ->where('tenant_code', $user->tenant_codigo)
+                ->where('slug', 'entrada'))
+            ->with(['ticket' => fn ($query) => $query->with([
+                ...TicketValidityResolver::RELATIONS,
+                ...TicketPresentationResolver::RELATIONS,
+            ])])
+            ->firstOrFail();
+
+        return $reservation->ticket;
+    }
+
+    public function cancel(User $user, int $reservationId): void
+    {
+        abort_unless($user->tenant_codigo === 'desfile_pura_tendencia', 403);
+
+        DB::transaction(function () use ($user, $reservationId): void {
+            $reservation = EntryReservation::query()
+                ->whereKey($reservationId)
+                ->whereHas('variant.catalogItem', fn (Builder $query): Builder => $query
+                    ->where('tenant_code', $user->tenant_codigo)
+                    ->where('slug', 'entrada'))
+                ->lockForUpdate()
+                ->firstOrFail();
+
+            if ($reservation->ticket_id !== null) {
+                $ticket = Ticket::query()->lockForUpdate()->findOrFail($reservation->ticket_id);
+
+                if (! $ticket->can_cancel()) {
+                    throw ValidationException::withMessages([
+                        'status' => 'El ticket debe estar activo para poder cancelar la reserva.',
+                    ]);
+                }
+
+                $ticket->markAsCancelled();
+                $ticket->save();
+            }
+
+            if ($reservation->inventory_id !== null) {
+                $inventory = Inventory::query()->lockForUpdate()->findOrFail($reservation->inventory_id);
+                $inventory->releaseEntry(1);
+            }
+
+            $reservation->delete();
+        }, 3);
+    }
+
+    /** @param array{tipo_pago?: string|null} $filters */
+    private function reservationsQuery(User $user, array $filters = []): Builder
+    {
+        return EntryReservation::query()
+            ->whereHas('variant.catalogItem', fn (Builder $query): Builder => $query
+                ->where('tenant_code', $user->tenant_codigo)
+                ->where('slug', 'entrada'))
+            ->when(
+                $filters['tipo_pago'] ?? null,
+                fn (Builder $query, string $paymentType): Builder => $query->where('tipo_pago', $paymentType),
+            )
+            ->with([
+                'variant.catalogItem.itemAttributes.attribute.options',
+                'variant.definitions.itemAttribute.attribute.options',
+                'variant.eventDates',
+                'variant.eventDate',
+            ])
+            ->orderByDesc('fecha_reserva')
+            ->orderByDesc('id');
+    }
+
+    /** @param list<array{variant_id: int, tipo_pago: string}> $rows */
+    public function reserve(User $user, string $key, array $rows): Collection
+    {
+        abort_unless($user->tenant_codigo === 'desfile_pura_tendencia', 403);
+        $normalized = collect($rows)->map(fn (array $row): array => [
+            'variant_id' => (int) $row['variant_id'], 'tipo_pago' => $row['tipo_pago'],
+        ])->sortBy('variant_id')->values()->all();
+        $hash = hash('sha256', json_encode($normalized, JSON_THROW_ON_ERROR));
+
+        return DB::transaction(function () use ($user, $key, $rows, $hash): Collection {
+            // Serialize retries by the same administrator, including the first insert.
+            User::query()->whereKey($user->id)->lockForUpdate()->firstOrFail();
+            $batch = DB::table('desfile_reservation_batches')
+                ->where('user_id', $user->id)->where('idempotency_key', $key)->lockForUpdate()->first();
+            if ($batch !== null) {
+                abort_unless($batch->tenant_code === $user->tenant_codigo && hash_equals($batch->request_hash, $hash), 409,
+                    'La clave de envío ya fue utilizada con otras entradas.');
+
+                return EntryReservation::query()->where('batch_id', $batch->id)->with('ticket')->orderBy('id')->get();
+            }
+
+            $tenant = $user->tenant()->firstOrFail();
+            $entry = CatalogItem::query()->forTenantCatalog($tenant)->where('slug', 'entrada')
+                ->lockForUpdate()->firstOrFail();
+            $ids = array_column($rows, 'variant_id');
+            $variants = $entry->variants()->whereKey($ids)->orderBy('id')->lockForUpdate()->get();
+            $inventories = Inventory::query()->whereKey($variants->pluck('inventory_id')->filter()->unique())
+                ->orderBy('id')->lockForUpdate()->get()->keyBy('id');
+            $variants->load([
+                'eventDates', 'eventDate',
+                'desfileEntryReservations' => fn ($query) => $query->lockForUpdate(),
+            ]);
+            foreach ($variants as $variant) {
+                $variant->setRelation('inventory', $inventories->get($variant->inventory_id));
+            }
+            $entry->setRelation('variants', $variants);
+            $available = $entry->visibleVariants()->keyBy('id');
+            $requirements = [];
+            $errors = [];
+            foreach ($rows as $index => $row) {
+                $variant = $available->get($row['variant_id']);
+                if ($variant === null || $variant->inventory === null) {
+                    $errors["rows.{$index}.variant_id"] = $this->entryLabel($variants->firstWhere('id', $row['variant_id']), $index).': la entrada ya no está disponible.';
+
+                    continue;
+                }
+                $requirements[$variant->inventory_id] = ($requirements[$variant->inventory_id] ?? 0) + 1;
+            }
+            if ($errors !== []) {
+                throw ValidationException::withMessages($errors);
+            }
+            $tracked = $entry->inventory_policy !== InventoryPolicy::Unlimited;
+            foreach ($requirements as $inventoryId => $quantity) {
+                if ($tracked && $inventories[$inventoryId]->availableStock() < $quantity) {
+                    foreach ($rows as $index => $row) {
+                        $variant = $available[$row['variant_id']];
+                        if ($variant->inventory_id === $inventoryId) {
+                            $errors["rows.{$index}.variant_id"] = $this->entryLabel($variant, $index).': no hay stock suficiente para reservar las entradas seleccionadas.';
+                        }
+                    }
+                }
+            }
+            if ($errors !== []) {
+                throw ValidationException::withMessages($errors);
+            }
+
+            $batchId = DB::table('desfile_reservation_batches')->insertGetId([
+                'user_id' => $user->id, 'tenant_code' => $tenant->codigo,
+                'idempotency_key' => $key, 'request_hash' => $hash,
+                'created_at' => now(), 'updated_at' => now(),
+            ]);
+            foreach ($requirements as $inventoryId => $quantity) {
+                $inventories[$inventoryId]->reserveEntry($quantity, $tracked);
+            }
+            $reservations = collect();
+            foreach ($rows as $index => $row) {
+                $variant = $available[$row['variant_id']];
+                $payment = EntryReservationPaymentType::from($row['tipo_pago']);
+                try {
+                    $ticket = $this->tickets->generate($entry, $user, 1, $variant->id)->sole();
+                } catch (TicketGenerationException $exception) {
+                    throw ValidationException::withMessages([
+                        "rows.{$index}.variant_id" => $this->entryLabel($variant, $index).': no se pudo emitir el ticket. '.$exception->getMessage(),
+                    ]);
+                }
+                $reservation = EntryReservation::query()->create([
+                    'batch_id' => $batchId, 'ticket_id' => $ticket->id,
+                    'variant_id' => $variant->id, 'inventory_id' => $variant->inventory_id,
+                    'fecha_reserva' => now(), 'tipo_pago' => $payment,
+                    'importe' => $payment === EntryReservationPaymentType::Free ? 0 : $variant->getPrice(),
+                ]);
+                $reservations->push($reservation->setRelation('ticket', $ticket));
+            }
+
+            return $reservations;
+        }, 3);
+    }
+
+    private function entryLabel(?Variant $variant, int $index): string
+    {
+        if ($variant === null) {
+            return 'Entrada '.($index + 1);
+        }
+
+        $values = $variant->selectionValues();
+
+        return collect(['tipo' => 'Tipo', 'sector' => 'Sector', 'fila' => 'Fila', 'asiento' => 'Asiento'])
+            ->map(fn (string $label, string $key): string => $label.': '.($values->get($key) ?? 'sin especificar'))
+            ->implode(', ');
+    }
+}

app/Domains/Ticketing/Desfile/Services/EntryService.php

@@ -2,13 +2,13 @@
 
 namespace App\Domains\Ticketing\Desfile\Services;
 
-use App\Shared\Attachable\Models\Attachment;
-use App\Shared\Attachable\Services\AttachmentService;
 use App\Domains\Commerce\Catalog\Models\CatalogItem;
 use App\Domains\Commerce\Catalog\Models\Inventory;
 use App\Domains\Commerce\Catalog\Models\ItemAttribute;
 use App\Domains\Commerce\Catalog\Models\Variant;
 use App\Domains\Core\Tenant\Models\Tenant;
+use App\Shared\Attachable\Models\Attachment;
+use App\Shared\Attachable\Services\AttachmentService;
 use Illuminate\Database\Eloquent\Builder;
 use Illuminate\Http\UploadedFile;
 use Illuminate\Support\Collection;
@@ -254,7 +254,7 @@ class EntryService
     {
         $inventory = $variant->inventory;
 
-        if (($inventory?->reserved_stock ?? 0) > 0 || ($inventory?->sold_units ?? 0) > 0) {
+        if (($inventory?->reserved_stock ?? 0) > 0 || ($inventory?->entry_reserved_stock ?? 0) > 0 || ($inventory?->sold_units ?? 0) > 0) {
             throw ValidationException::withMessages([
                 $key => [
                     'No se puede modificar ni eliminar un asiento con ventas o reservas.',

app/Domains/Ticketing/Desfile/Services/InvitationPurchaseProvisioner.php

@@ -393,7 +393,7 @@ class InvitationPurchaseProvisioner
 
         $inventory = DB::table('inventories')->where('id', $variant->inventory_id)->lockForUpdate()->first();
 
-        if ($inventory === null || $inventory->real_stock < 1 || $inventory->reserved_stock > 0) {
+        if ($inventory === null || $inventory->real_stock < 1 || $inventory->reserved_stock > 0 || ($inventory->entry_reserved_stock ?? 0) > 0) {
             throw new RuntimeException("El asiento {$variant->descripcion} ya no está disponible.");
         }
 

app/Domains/Ticketing/Desfile/routes/api.php

@@ -1,8 +1,30 @@
 <?php
 
 use App\Domains\Ticketing\Desfile\Controllers\EntryController;
+use App\Domains\Ticketing\Desfile\Controllers\EntryReservationController;
 use Illuminate\Support\Facades\Route;
 
+Route::get('v1/adminapp/tenant/desfile/entry-reservations', [EntryReservationController::class, 'index'])
+    ->middleware(['auth:sanctum', 'adminapp.tenant', 'tenant.menu:adminapp.desfile.reservas'])
+    ->name('adminapp.desfile.entry-reservations.index');
+Route::get('v1/adminapp/tenant/desfile/entry-reservations/pdf', [EntryReservationController::class, 'downloadPdf'])
+    ->middleware(['auth:sanctum', 'adminapp.tenant', 'tenant.menu:adminapp.desfile.reservas'])
+    ->name('adminapp.desfile.entry-reservations.pdf');
+Route::get('v1/adminapp/tenant/desfile/entry-reservations/excel', [EntryReservationController::class, 'downloadExcel'])
+    ->middleware(['auth:sanctum', 'adminapp.tenant', 'tenant.menu:adminapp.desfile.reservas'])
+    ->name('adminapp.desfile.entry-reservations.excel');
+Route::get('v1/adminapp/tenant/desfile/entry-reservations/{reservation}/ticket/pdf', [EntryReservationController::class, 'downloadTicketPdf'])
+    ->whereNumber('reservation')
+    ->middleware(['auth:sanctum', 'adminapp.tenant', 'tenant.menu:adminapp.desfile.reservas'])
+    ->name('adminapp.desfile.entry-reservations.ticket.pdf');
+Route::post('v1/adminapp/tenant/desfile/entry-reservations', [EntryReservationController::class, 'store'])
+    ->middleware(['auth:sanctum', 'adminapp.tenant', 'tenant.menu:adminapp.desfile.reservas'])
+    ->name('adminapp.desfile.entry-reservations.store');
+Route::delete('v1/adminapp/tenant/desfile/entry-reservations/{reservation}', [EntryReservationController::class, 'destroy'])
+    ->whereNumber('reservation')
+    ->middleware(['auth:sanctum', 'adminapp.tenant', 'tenant.menu:adminapp.desfile.reservas'])
+    ->name('adminapp.desfile.entry-reservations.destroy');
+
 Route::prefix('v1/adminapp/tenant/desfile')
     ->middleware(['auth:sanctum', 'adminapp.tenant', 'tenant.menu:adminapp.desfile.entradas'])
     ->group(function (): void {

app/Domains/Ticketing/Event/Controllers/AdminApp/EventController.php

@@ -2,6 +2,7 @@
 
 namespace App\Domains\Ticketing\Event\Controllers\AdminApp;
 
+use App\Domains\Core\Auth\Services\EventScopeService;
 use App\Domains\Ticketing\Event\Models\EventDate;
 use App\Domains\Ticketing\Event\Requests\RescheduleEventDateRequest;
 use App\Domains\Ticketing\Event\Requests\StoreEventDateRequest;
@@ -19,7 +20,8 @@ class EventController extends Controller
     public function show(Request $request): EventResource
     {
         return EventResource::make(
-            $this->eventService->forTenant($request->user()->tenant()->firstOrFail())
+            $this->eventService->forTenant($request->user()->tenant()->firstOrFail(),
+                app(EventScopeService::class)->eventId($request->user()))
         );
     }
 
@@ -28,7 +30,8 @@ class EventController extends Controller
         return EventResource::make(
             $this->eventService->updateForTenant(
                 $request->user()->tenant()->firstOrFail(),
-                $request->validated()
+                $request->validated(),
+                app(EventScopeService::class)->eventId($request->user())
             )
         );
     }
@@ -39,6 +42,7 @@ class EventController extends Controller
             $this->eventService->createDateForTenant(
                 $request->user()->tenant()->firstOrFail(),
                 $request->validated(),
+                app(EventScopeService::class)->eventId($request->user()),
             )
         );
     }

app/Domains/Ticketing/Event/Models/Event.php

@@ -2,9 +2,11 @@
 
 namespace App\Domains\Ticketing\Event\Models;
 
+use App\Domains\Commerce\Catalog\Models\CatalogItem;
+use App\Domains\Core\Client\Models\Client;
 use App\Domains\Core\Tenant\Models\SocialMedia;
 use App\Domains\Core\Tenant\Models\Tenant;
-use App\Domains\Commerce\Catalog\Models\CatalogItem;
+use App\Domains\Ticketing\Ticket\Models\Ticket;
 use App\Shared\Attachable\Models\Attachment;
 use Illuminate\Database\Eloquent\Attributes\Fillable;
 use Illuminate\Database\Eloquent\Factories\HasFactory;
@@ -13,14 +15,27 @@ use Illuminate\Database\Eloquent\Relations\BelongsTo;
 use Illuminate\Database\Eloquent\Relations\BelongsToMany;
 use Illuminate\Database\Eloquent\Relations\HasMany;
 
-#[Fillable(['tenant_code', 'event_category_id', 'title', 'subtitle', 'description', 'location', 'exact_location', 'date_text', 'published_at', 'attachment_id'])]
+#[Fillable(['client_id', 'tenant_code', 'slug', 'event_category_id', 'title', 'subtitle', 'description', 'location', 'exact_location', 'date_text', 'published_at', 'attachment_id', 'allow_ticket_refund', 'allow_ticket_total_refund', 'allow_ticket_partial_refund', 'ticket_partial_refund_percentage'])]
 class Event extends Model
 {
     use HasFactory;
 
     protected function casts(): array
     {
-        return ['published_at' => 'datetime', 'exact_location' => 'array'];
+        return ['allow_ticket_refund' => 'boolean', 'allow_ticket_total_refund' => 'boolean',
+            'allow_ticket_partial_refund' => 'boolean', 'ticket_partial_refund_percentage' => 'decimal:2', 'client_id' => 'integer', 'published_at' => 'datetime', 'exact_location' => 'array'];
+    }
+
+    public function allow_refund(): bool
+    {
+        return (bool) $this->allow_ticket_refund
+            && ((bool) $this->allow_ticket_total_refund || $this->allow_partial_refund());
+    }
+
+    public function allow_partial_refund(): bool
+    {
+        return (bool) $this->allow_ticket_refund && (bool) $this->allow_ticket_partial_refund
+            && (float) $this->ticket_partial_refund_percentage > 0;
     }
 
     /** @return BelongsTo<Tenant, $this> */
@@ -29,6 +44,17 @@ class Event extends Model
         return $this->belongsTo(Tenant::class, 'tenant_code', 'codigo');
     }
 
+    /** @return BelongsTo<Client, $this> */
+    public function client(): BelongsTo
+    {
+        return $this->belongsTo(Client::class);
+    }
+
+    public function effectiveClient(): Client
+    {
+        return $this->client ?? $this->tenant->client;
+    }
+
     /** @return BelongsTo<EventCategory, $this> */
     public function eventCategory(): BelongsTo
     {
@@ -53,6 +79,12 @@ class Event extends Model
         return $this->hasMany(CatalogItem::class)->whereAvailable()->orderBy('group_order')->orderBy('id');
     }
 
+    /** @return HasMany<Ticket, $this> */
+    public function tickets(): HasMany
+    {
+        return $this->hasMany(Ticket::class);
+    }
+
     /** @return BelongsToMany<SocialMedia, $this> */
     public function socialMedia(): BelongsToMany
     {

app/Domains/Ticketing/Event/Models/EventDate.php

@@ -3,10 +3,10 @@
 namespace App\Domains\Ticketing\Event\Models;
 
 use App\Domains\Commerce\Catalog\Models\Variant;
+use App\Domains\Core\Tenant\Models\Tenant;
 use App\Domains\Ticketing\Event\Enums\EventDateStatus;
 use App\Domains\Ticketing\Event\Services\EffectiveEventDateResolver;
 use App\Domains\Ticketing\Event\Services\EventDateTextFormatter;
-use App\Domains\Core\Tenant\Models\Tenant;
 use App\Domains\Ticketing\Ticket\Enums\ValidityTimeType;
 use App\Domains\Ticketing\Ticket\Models\ValidityTime;
 use Carbon\CarbonInterface;
@@ -131,12 +131,12 @@ class EventDate extends Model
 
     public function startsAt(): CarbonInterface
     {
-        return Carbon::parse($this->date->format('Y-m-d').' '.$this->time_start);
+        return Carbon::parse($this->date->format('Y-m-d').' '.$this->time_start, $this->tenant->timezone);
     }
 
     public function endsAt(): CarbonInterface
     {
-        $endsAt = Carbon::parse($this->date->format('Y-m-d').' '.$this->time_end);
+        $endsAt = Carbon::parse($this->date->format('Y-m-d').' '.$this->time_end, $this->tenant->timezone);
 
         return $endsAt->lessThanOrEqualTo($this->startsAt())
             ? $endsAt->addDay()
@@ -184,8 +184,8 @@ class EventDate extends Model
 
     private function syncValidityTime(): void
     {
-        $startsAt = $this->startsAt();
-        $expiresAt = $this->endsAt();
+        $startsAt = $this->startsAt()->utc();
+        $expiresAt = $this->endsAt()->utc();
 
         $attributes = [
             'type' => ValidityTimeType::FixedWindow,

app/Domains/Ticketing/Event/Resources/EventResource.php

@@ -2,8 +2,8 @@
 
 namespace App\Domains\Ticketing\Event\Resources;
 
-use App\Domains\Ticketing\Event\Services\EventDateGroupingService;
 use App\Domains\Ticketing\Event\Models\Event;
+use App\Domains\Ticketing\Event\Services\EventDateGroupingService;
 use Illuminate\Http\Request;
 use Illuminate\Http\Resources\Json\JsonResource;
 
@@ -17,6 +17,7 @@ class EventResource extends JsonResource
 
         return [
             'id' => $this->id,
+            'slug' => $this->slug,
             'title' => $this->title,
             'subtitle' => $this->subtitle,
             'description' => $this->description,
@@ -25,10 +26,10 @@ class EventResource extends JsonResource
             'date_text' => $this->date_text,
             'published_at' => $this->published_at?->toIso8601String(),
             'attachment_id' => $this->attachment_id,
-            'allow_ticket_refund' => $this->tenant->allow_ticket_refund,
-            'allow_ticket_total_refund' => $this->tenant->allow_ticket_total_refund,
-            'allow_ticket_partial_refund' => $this->tenant->allow_ticket_partial_refund,
-            'ticket_partial_refund_percentage' => $this->tenant->ticket_partial_refund_percentage,
+            'allow_ticket_refund' => $this->allow_ticket_refund,
+            'allow_ticket_total_refund' => $this->allow_ticket_total_refund,
+            'allow_ticket_partial_refund' => $this->allow_ticket_partial_refund,
+            'ticket_partial_refund_percentage' => $this->ticket_partial_refund_percentage,
             'dates' => EventDateResource::collection(
                 app(EventDateGroupingService::class)->group($this->dates)
             ),

app/Domains/Ticketing/Event/Resources/PublicEventResource.php

@@ -5,7 +5,6 @@ namespace App\Domains\Ticketing\Event\Resources;
 use App\Domains\Commerce\Catalog\Enums\InventoryPolicy;
 use App\Domains\Commerce\Catalog\Models\CatalogItem;
 use App\Domains\Commerce\Catalog\Models\Variant;
-use Illuminate\Support\Carbon;
 use Illuminate\Http\Request;
 use Illuminate\Http\Resources\Json\JsonResource;
 
@@ -15,6 +14,7 @@ class PublicEventResource extends JsonResource
     {
         return [
             'id' => $this->id,
+            'slug' => $this->slug,
             'event_category_id' => $this->event_category_id,
             'title' => $this->title,
             'subtitle' => $this->subtitle,
@@ -29,10 +29,7 @@ class PublicEventResource extends JsonResource
                     return null;
                 }
 
-                return Carbon::parse(
-                    $first->date->format('Y-m-d').' '.$first->time_start,
-                    config('app.event_timezone'),
-                )->toISOString();
+                return $first->startsAt()->toISOString();
             }),
             'dates' => $this->whenLoaded('dates', fn () => $this->dates->map(fn ($date): array => [
                 'id' => $date->id,
@@ -52,8 +49,7 @@ class PublicEventResource extends JsonResource
                     'description' => $item->descripcion,
                     'price' => $item->precio,
                     'image' => $item->attachments->first()?->getTemporaryUrl(1440),
-                    'requires_selection' => $item->itemAttributes->contains(fn ($attribute): bool =>
-                        $attribute->show_in_selector && $attribute->attribute?->codigo !== 'event_date'),
+                    'requires_selection' => $item->itemAttributes->contains(fn ($attribute): bool => $attribute->show_in_selector && $attribute->attribute?->codigo !== 'event_date'),
                     'maximum_quantity' => $item->inventory_policy === InventoryPolicy::Unlimited
                         ? null
                         : $item->availableStock(),

app/Domains/Ticketing/Event/Services/EventService.php

@@ -2,18 +2,19 @@
 
 namespace App\Domains\Ticketing\Event\Services;
 
-use App\Domains\Core\Auth\Models\User;
 use App\Domains\Commerce\Cart\Services\InvalidateEventDateCartsService;
 use App\Domains\Commerce\Catalog\Models\Variant;
 use App\Domains\Commerce\Catalog\Services\StockReservationService;
 use App\Domains\Commerce\Catalog\Services\VariantReplacementService;
+use App\Domains\Core\Auth\Models\User;
+use App\Domains\Core\Auth\Services\EventScopeService;
+use App\Domains\Core\Tenant\Models\Tenant;
 use App\Domains\Ticketing\Event\Enums\EventDateChangeType;
 use App\Domains\Ticketing\Event\Events\EventDateRescheduled;
 use App\Domains\Ticketing\Event\Events\EventDateSuspended;
+use App\Domains\Ticketing\Event\Models\Event;
 use App\Domains\Ticketing\Event\Models\EventDate;
 use App\Domains\Ticketing\Event\Models\EventDateChange;
-use App\Domains\Ticketing\Event\Models\Event;
-use App\Domains\Core\Tenant\Models\Tenant;
 use App\Domains\Ticketing\Ticket\Models\Ticket;
 use Illuminate\Support\Collection;
 use Illuminate\Support\Facades\DB;
@@ -34,22 +35,22 @@ class EventService
         private readonly InvalidateEventDateCartsService $invalidateEventDateCarts,
     ) {}
 
-    public function forTenant(Tenant $tenant): Event
+    public function forTenant(Tenant $tenant, ?int $eventId = null): Event
     {
-        return $tenant->activeEvent->load(['dates.validityTime', 'socialMedia']);
+        return $this->resolveEvent($tenant, $eventId)->load(['dates.validityTime', 'socialMedia']);
     }
 
     /** @param array<string, mixed> $data */
-    public function updateForTenant(Tenant $tenant, array $data): Event
+    public function updateForTenant(Tenant $tenant, array $data, ?int $eventId = null): Event
     {
-        return DB::transaction(function () use ($tenant, $data): Event {
-            $event = $tenant->activeEvent;
+        return DB::transaction(function () use ($tenant, $data, $eventId): Event {
+            $event = $this->resolveEvent($tenant, $eventId);
             $event->update([
                 'title' => $data['title'],
                 'location' => $data['location'],
                 ...array_intersect_key($data, ['attachment_id' => true, 'exact_location' => true]),
             ]);
-            $tenant->update([
+            $event->update([
                 ...array_intersect_key($data, array_flip([
                     'allow_ticket_refund',
                     'allow_ticket_total_refund',
@@ -69,10 +70,10 @@ class EventService
     }
 
     /** @param array{date: string, start_time: string, end_time: string} $data */
-    public function createDateForTenant(Tenant $tenant, array $data): EventDate
+    public function createDateForTenant(Tenant $tenant, array $data, ?int $eventId = null): EventDate
     {
-        return DB::transaction(function () use ($tenant, $data): EventDate {
-            $event = $tenant->activeEvent;
+        return DB::transaction(function () use ($tenant, $data, $eventId): EventDate {
+            $event = $this->resolveEvent($tenant, $eventId);
             $attributes = $this->dateAttributes($data);
 
             if ($event->dates()->where($attributes)->exists()) {
@@ -93,7 +94,7 @@ class EventService
         ?User $createdBy = null,
     ): EventDate {
         return DB::transaction(function () use ($tenant, $eventDate, $data, $createdBy): EventDate {
-            $source = $this->lockedDateForTenant($tenant, $eventDate);
+            $source = $this->lockedDateForTenant($tenant, $eventDate, $createdBy);
 
             if ($source->suspended_at !== null) {
                 throw ValidationException::withMessages([
@@ -172,7 +173,7 @@ class EventService
         ?User $createdBy = null,
     ): EventDate {
         return DB::transaction(function () use ($tenant, $eventDate, $createdBy): EventDate {
-            $date = $this->lockedDateForTenant($tenant, $eventDate);
+            $date = $this->lockedDateForTenant($tenant, $eventDate, $createdBy);
 
             if ($date->rescheduled_to_event_date_id !== null) {
                 throw ValidationException::withMessages([
@@ -216,10 +217,18 @@ class EventService
         });
     }
 
-    private function lockedDateForTenant(Tenant $tenant, EventDate $eventDate): EventDate
+    private function resolveEvent(Tenant $tenant, ?int $eventId): Event
+    {
+        return Event::query()->where('tenant_code', $tenant->codigo)
+            ->findOrFail($eventId ?? $tenant->active_event_id);
+    }
+
+    private function lockedDateForTenant(Tenant $tenant, EventDate $eventDate, ?User $actor = null): EventDate
     {
         return $tenant->eventDates()
             ->whereKey($eventDate->getKey())
+            ->when($actor !== null && ! $actor->isTenantAdministrator(),
+                fn ($query) => $query->where('event_id', app(EventScopeService::class)->eventId($actor)))
             ->lockForUpdate()
             ->firstOrFail();
     }

app/Domains/Ticketing/Event/documentacion/README.md

@@ -37,10 +37,10 @@ se guardan en el evento. Sin evento activo se conservan las redes propias del te
 
 ## API
 
-Los endpoints de AdminApp usan `auth:sanctum` y `adminapp.tenant`:
+Los endpoints de AdminApp usan `auth:sanctum` y `adminapp.tenant:event`:
 
-- `GET/PUT /v1/adminapp/tenant/event`: acceso al evento seleccionado para el
-  storefront de evento único.
+- `GET/PUT /v1/adminapp/tenant/event`: acceso al evento asociado al usuario con scope de evento;
+  para admins de tenant se conserva el evento activo.
 - `POST /v1/adminapp/tenant/event-dates`: crea una fecha para ese evento.
 - `POST /v1/adminapp/tenant/event-dates/{eventDate}/reschedule` y
   `POST /v1/adminapp/tenant/event-dates/{eventDate}/suspend`: cambios de fecha.
@@ -53,3 +53,8 @@ una lista de eventos ni existe todavía una pantalla para gestionarlos.
 Las fechas se vinculan con variantes de `Catalog`, que a su vez pueden generar
 tickets. Los avisos por suspensión y reprogramación se construyen dinámicamente
 después de excluir los cambios que el usuario ya vio tres veces.
+
+La configuración de devoluciones se persiste en `events`, se entrega en
+`EventResource` y se aplica al evento de cada ticket. La migración inicial copia
+los valores anteriores del tenant a sus eventos. Las fechas se autorizan por
+tenant y por evento antes de cualquier suspensión o reprogramación.

app/Domains/Ticketing/Event/routes/adminapp.php

@@ -4,7 +4,7 @@ use App\Domains\Ticketing\Event\Controllers\AdminApp\EventController;
 use Illuminate\Support\Facades\Route;
 
 Route::prefix('v1/adminapp/tenant')
-    ->middleware(['auth:sanctum', 'adminapp.tenant'])
+    ->middleware(['auth:sanctum', 'adminapp.tenant:event'])
     ->group(function (): void {
         Route::get('event', [EventController::class, 'show']);
         Route::put('event', [EventController::class, 'update']);

app/Domains/Ticketing/Event/routes/api.php

@@ -6,9 +6,9 @@ use Illuminate\Support\Facades\Route;
 
 require __DIR__.'/adminapp.php';
 
-Route::prefix('tenants/{tenant:codigo}')->group(function (): void {
+Route::prefix('tenants/{tenant:codigo}')->scopeBindings()->group(function (): void {
     Route::get('events', [PublicEventController::class, 'index']);
-    Route::get('events/{event}', [PublicEventController::class, 'show']);
+    Route::get('events/{event:slug}', [PublicEventController::class, 'show']);
 });
 
 Route::middleware('auth:sanctum')->post(

app/Domains/Ticketing/Ticket/Controllers/TicketController.php

@@ -6,31 +6,47 @@ use App\Domains\Core\Tenant\Models\Tenant;
 use App\Domains\Ticketing\Ticket\Exceptions\TicketNotAvailableException;
 use App\Domains\Ticketing\Ticket\Models\Ticket;
 use App\Domains\Ticketing\Ticket\Requests\DownloadTicketsPdfRequest;
+use App\Domains\Ticketing\Ticket\Requests\ListTicketsRequest;
+use App\Domains\Ticketing\Ticket\Resources\TicketEventResource;
 use App\Domains\Ticketing\Ticket\Resources\TicketResource;
 use App\Domains\Ticketing\Ticket\Services\TicketPdfService;
 use App\Domains\Ticketing\Ticket\Services\TicketPresentationResolver;
 use App\Domains\Ticketing\Ticket\Services\TicketValidityResolver;
+use App\Domains\Ticketing\Ticket\Services\UserTicketQueryService;
 use App\Http\Controllers\Controller;
 use Illuminate\Http\JsonResponse;
 use Illuminate\Http\Request;
+use Illuminate\Http\Resources\Json\AnonymousResourceCollection;
 use Illuminate\Http\Response;
 
 class TicketController extends Controller
 {
-    public function __construct(private readonly TicketPdfService $ticketPdfService) {}
+    public function __construct(
+        private readonly TicketPdfService $ticketPdfService,
+        private readonly UserTicketQueryService $userTickets,
+    ) {}
 
-    public function index(Request $request, Tenant $tenant): JsonResponse
+    public function index(ListTicketsRequest $request, Tenant $tenant): JsonResponse
     {
-        $tickets = Ticket::query()
-            ->where('tenant_code', $tenant->codigo)
-            ->where('user_id', $request->user()->getKey())
-            ->with([...TicketValidityResolver::RELATIONS, ...TicketPresentationResolver::RELATIONS])
-            ->orderByDesc('id')
-            ->get();
+        $eventId = $request->validated('event_id');
+        $tickets = $this->userTickets->tickets(
+            $tenant,
+            $request->user(),
+            $eventId === null ? null : (int) $eventId,
+        );
 
         return TicketResource::collection($tickets)->response();
     }
 
+    public function events(Request $request, Tenant $tenant): AnonymousResourceCollection
+    {
+        abort_unless($tenant->storefront_website_type_code === 'onticket_multi_event', 404);
+
+        return TicketEventResource::collection(
+            $this->userTickets->events($tenant, $request->user())
+        );
+    }
+
     public function downloadPdf(DownloadTicketsPdfRequest $request, Tenant $tenant): Response
     {
         $ticketIds = $request->validated('ticket_ids');

app/Domains/Ticketing/Ticket/Models/ScanAttempt.php

@@ -11,6 +11,7 @@ use Illuminate\Database\Eloquent\Relations\BelongsTo;
 
 #[Fillable([
     'tenant_code',
+    'event_id',
     'scanner_user_id',
     'ticket_id',
     'data',
@@ -43,6 +44,7 @@ class ScanAttempt extends Model
     {
         return [
             'scanner_user_id' => 'integer',
+            'event_id' => 'integer',
             'ticket_id' => 'integer',
             'result' => ScanAttemptResult::class,
             'created_at' => 'datetime',

app/Domains/Ticketing/Ticket/Models/Ticket.php

@@ -2,16 +2,18 @@
 
 namespace App\Domains\Ticketing\Ticket\Models;
 
-use App\Domains\Core\Auth\Models\User;
 use App\Domains\Commerce\Catalog\Models\CatalogItem;
 use App\Domains\Commerce\Catalog\Models\Variant;
-use App\Shared\Logging\Models\Concerns\LogsValueChanges;
 use App\Domains\Commerce\Purchase\Models\PurchaseItem;
+use App\Domains\Core\Auth\Models\User;
 use App\Domains\Core\Tenant\Models\Tenant;
+use App\Domains\Ticketing\Desfile\Models\EntryReservation;
+use App\Domains\Ticketing\Event\Models\Event;
 use App\Domains\Ticketing\Ticket\Services\ResolvedTicketValidity;
 use App\Domains\Ticketing\Ticket\Services\ResolvedValidityGroup;
 use App\Domains\Ticketing\Ticket\Services\TicketPresentationResolver;
 use App\Domains\Ticketing\Ticket\Services\TicketValidityResolver;
+use App\Shared\Logging\Models\Concerns\LogsValueChanges;
 use Carbon\CarbonInterface;
 use Illuminate\Database\Eloquent\Attributes\Fillable;
 use Illuminate\Database\Eloquent\Factories\HasFactory;
@@ -24,6 +26,7 @@ use Illuminate\Validation\ValidationException;
 
 #[Fillable([
     'tenant_code',
+    'event_id',
     'ticket',
     'source_purchase_item_id',
     'source_catalog_item_id',
@@ -75,6 +78,7 @@ class Ticket extends Model
     protected function casts(): array
     {
         return [
+            'event_id' => 'integer',
             'source_catalog_item_id' => 'integer',
             'source_variant_id' => 'integer',
             'source_purchase_item_id' => 'integer',
@@ -136,9 +140,17 @@ class Ticket extends Model
         return $this->belongsTo(Tenant::class, 'tenant_code', 'codigo');
     }
 
+    /** @return BelongsTo<Event, $this> */
+    public function event(): BelongsTo
+    {
+        return $this->belongsTo(Event::class);
+    }
+
     public function allow_refund(): bool
     {
-        return $this->tenant?->allow_refund() ?? false;
+        return $this->event_id === null
+            ? ($this->tenant?->allow_refund() ?? false)
+            : ($this->event?->allow_refund() ?? false);
     }
 
     public function allowRefund(): bool
@@ -183,7 +195,9 @@ class Ticket extends Model
 
     public function can_refund(): bool
     {
-        return $this->is_active() && $this->allow_refund();
+        return $this->is_active()
+            && $this->allow_refund()
+            && ! $this->hasEntryReservation();
     }
 
     public function canRefund(): bool
@@ -226,6 +240,12 @@ class Ticket extends Model
         return $this->hasOne(TicketRefund::class);
     }
 
+    /** @return HasOne<EntryReservation, $this> */
+    public function entryReservation(): HasOne
+    {
+        return $this->hasOne(EntryReservation::class);
+    }
+
     /** @return BelongsTo<CatalogItem, $this> */
     public function sourceCatalogItem(): BelongsTo
     {
@@ -238,6 +258,15 @@ class Ticket extends Model
         return $this->belongsTo(Variant::class, 'source_variant_id')->withTrashed();
     }
 
+    private function hasEntryReservation(): bool
+    {
+        if ($this->relationLoaded('entryReservation')) {
+            return $this->getRelation('entryReservation') instanceof EntryReservation;
+        }
+
+        return $this->exists && $this->entryReservation()->exists();
+    }
+
     public function isValid(): bool
     {
         if ($this->hasTerminalStatus() || $this->used_at !== null) {

app/Domains/Ticketing/Ticket/Models/ValidityTime.php

@@ -47,30 +47,42 @@ class ValidityTime extends Model
 
     public function startsAt(
         ?CarbonInterface $at = null,
+        string $timezone = 'UTC',
     ): ?CarbonInterface {
         if ($this->type === ValidityTimeType::FixedWindow) {
             return $this->fixed_starts_at;
         }
 
-        return $this->atCurrentDate($this->start_time, $at);
+        return $this->atCurrentDate($this->start_time, $at, $timezone);
     }
 
     public function expiresAt(
         ?CarbonInterface $at = null,
+        string $timezone = 'UTC',
     ): ?CarbonInterface {
         if ($this->type === ValidityTimeType::FixedWindow) {
             return $this->fixed_expires_at;
         }
 
-        return $this->atCurrentDate($this->end_time, $at);
+        return $this->atCurrentDate($this->end_time, $at, $timezone);
     }
 
     public function isValid(
         ?CarbonInterface $at = null,
+        string $timezone = 'UTC',
     ): bool {
         $at ??= now();
-        $startsAt = $this->startsAt($at);
-        $expiresAt = $this->expiresAt($at);
+        $startsAt = $this->startsAt($at, $timezone);
+        $expiresAt = $this->expiresAt($at, $timezone);
+
+        if ($this->type === ValidityTimeType::TimeWindow
+            && $startsAt !== null && $expiresAt !== null && $expiresAt->lessThanOrEqualTo($startsAt)) {
+            if ($at->lessThan($expiresAt)) {
+                $startsAt = $startsAt->subDay();
+            } else {
+                $expiresAt = $expiresAt->addDay();
+            }
+        }
 
         return ($startsAt === null || $startsAt->lessThanOrEqualTo($at))
             && ($expiresAt === null || $expiresAt->greaterThan($at));
@@ -79,6 +91,7 @@ class ValidityTime extends Model
     private function atCurrentDate(
         ?string $time,
         ?CarbonInterface $at,
+        string $timezone,
     ): ?CarbonInterface {
         if ($time === null) {
             return null;
@@ -86,8 +99,9 @@ class ValidityTime extends Model
 
         $at ??= now();
         $localDate = CarbonImmutable::instance($at)
+            ->setTimezone($timezone)
             ->format('Y-m-d');
 
-        return CarbonImmutable::parse($localDate.' '.$time);
+        return CarbonImmutable::parse($localDate.' '.$time, $timezone);
     }
 }

app/Domains/Ticketing/Ticket/Requests/AdminAppTicketIndexRequest.php

@@ -3,6 +3,7 @@
 namespace App\Domains\Ticketing\Ticket\Requests;
 
 use App\Domains\Ticketing\Ticket\Models\Ticket;
+use App\Domains\Ticketing\Ticket\Services\AdminAppTicketAttributeService;
 use App\Domains\Ticketing\Ticket\Services\AdminAppTicketColumnService;
 use Illuminate\Foundation\Http\FormRequest;
 use Illuminate\Validation\Rule;
@@ -22,7 +23,7 @@ class AdminAppTicketIndexRequest extends FormRequest
             ? []
             : app(AdminAppTicketColumnService::class)->sortableKeys($tenant);
 
-        return [
+        $rules = [
             'q' => ['sometimes', 'nullable', 'string', 'max:255'],
             'category' => ['sometimes', 'nullable', 'string', 'max:255'],
             'product' => ['sometimes', 'nullable', 'string', 'max:255'],
@@ -39,5 +40,18 @@ class AdminAppTicketIndexRequest extends FormRequest
             'sort_by' => ['sometimes', 'nullable', 'string', Rule::in($sortableKeys)],
             'sort_direction' => ['sometimes', 'nullable', 'string', Rule::in(['asc', 'desc'])],
         ];
+
+        if ($tenant !== null) {
+            foreach (app(AdminAppTicketAttributeService::class)->attributes($tenant) as $attribute) {
+                $rules[$attribute['code']] = [
+                    'sometimes',
+                    'nullable',
+                    'string',
+                    Rule::in(array_column($attribute['options'], 'value')),
+                ];
+            }
+        }
+
+        return $rules;
     }
 }

app/Domains/Ticketing/Ticket/Requests/ListTicketsRequest.php

@@ -0,0 +1,30 @@
+<?php
+
+namespace App\Domains\Ticketing\Ticket\Requests;
+
+use App\Domains\Core\Tenant\Models\Tenant;
+use Illuminate\Foundation\Http\FormRequest;
+use Illuminate\Validation\Rule;
+
+class ListTicketsRequest extends FormRequest
+{
+    public function authorize(): bool
+    {
+        return true;
+    }
+
+    /** @return array<string, mixed> */
+    public function rules(): array
+    {
+        /** @var Tenant $tenant */
+        $tenant = $this->route('tenant');
+
+        return [
+            'event_id' => [
+                'sometimes',
+                'integer',
+                Rule::exists('events', 'id')->where('tenant_code', $tenant->codigo),
+            ],
+        ];
+    }
+}

app/Domains/Ticketing/Ticket/Resources/Scanner/ScanAttemptResource.php

@@ -32,7 +32,7 @@ class ScanAttemptResource extends JsonResource
                 ScanAttemptResult::Processing => 'Error',
                 ScanAttemptResult::Accepted => 'Verificado',
                 ScanAttemptResult::InvalidQr => 'QR no pertenece al evento',
-                ScanAttemptResult::TicketNotFound => 'Error',
+                ScanAttemptResult::TicketNotFound => 'QR no pertenece al evento',
                 ScanAttemptResult::CategoryForbidden => 'Error',
                 ScanAttemptResult::AlreadyScanned => 'Usado',
                 ScanAttemptResult::Expired => 'Vencido',

app/Domains/Ticketing/Ticket/Resources/TicketEventResource.php

@@ -0,0 +1,21 @@
+<?php
+
+namespace App\Domains\Ticketing\Ticket\Resources;
+
+use App\Domains\Ticketing\Event\Models\Event;
+use Illuminate\Http\Request;
+use Illuminate\Http\Resources\Json\JsonResource;
+
+/** @mixin Event */
+class TicketEventResource extends JsonResource
+{
+    /** @return array<string, mixed> */
+    public function toArray(Request $request): array
+    {
+        return [
+            'id' => $this->id,
+            'title' => $this->title,
+            'image' => $this->attachment?->getTemporaryUrl(1440),
+        ];
+    }
+}

app/Domains/Ticketing/Ticket/Resources/TicketResource.php

@@ -15,6 +15,7 @@ class TicketResource extends JsonResource
         return [
             'id' => $this->id,
             'tenant_code' => $this->tenant_code,
+            'event_id' => $this->event_id,
             'ticket' => $this->ticket,
             'status' => $this->status,
             'status_label' => $this->status_label,

app/Domains/Ticketing/Ticket/Resources/ValidityTimeResource.php

@@ -10,6 +10,11 @@ use Illuminate\Http\Resources\Json\JsonResource;
 /** @mixin ValidityTime */
 class ValidityTimeResource extends JsonResource
 {
+    public function __construct($resource, private readonly string $timezone = 'UTC')
+    {
+        parent::__construct($resource);
+    }
+
     /** @return array<string, mixed> */
     public function toArray(Request $request): array
     {
@@ -27,7 +32,7 @@ class ValidityTimeResource extends JsonResource
         return [
             'id' => $this->id,
             'type' => $this->type->value,
-            'is_valid' => $this->isValid(),
+            'is_valid' => $this->isValid(timezone: $this->timezone),
             ...array_filter($fields, fn (mixed $value): bool => $value !== null),
         ];
     }

app/Domains/Ticketing/Ticket/Services/AdminAppTicketAttributeService.php

@@ -0,0 +1,92 @@
+<?php
+
+namespace App\Domains\Ticketing\Ticket\Services;
+
+use App\Domains\Commerce\Catalog\Models\CatalogItem;
+use App\Domains\Core\Tenant\Models\Tenant;
+use Illuminate\Database\Eloquent\Builder;
+
+class AdminAppTicketAttributeService
+{
+    private const DESFILE_PURA_TENDENCIA = 'desfile_pura_tendencia';
+
+    /**
+     * @return list<array{
+     *     code: string,
+     *     label: string,
+     *     options: list<array{value: string, label: string}>
+     * }>
+     */
+    public function attributes(Tenant $tenant): array
+    {
+        if ($tenant->codigo !== self::DESFILE_PURA_TENDENCIA) {
+            return [];
+        }
+
+        $items = CatalogItem::withTrashed()
+            ->where('tenant_code', $tenant->codigo)
+            ->where(function (Builder $query): void {
+                $query
+                    ->where(function (Builder $activeQuery): void {
+                        $activeQuery
+                            ->whereNull('catalog_items.deleted_at')
+                            ->where('has_tickets', true);
+                    })
+                    ->orWhereHas('sourceTickets');
+            })
+            ->with([
+                'itemAttributes' => fn ($query) => $query->orderBy('sort_order')->orderBy('id'),
+                'itemAttributes.attribute.options',
+                'variants' => fn ($query) => $query
+                    ->withTrashed()
+                    ->where(fn (Builder $variantQuery): Builder => $variantQuery
+                        ->whereNull('variantes.deleted_at')
+                        ->orWhereHas('sourceTickets'))
+                    ->orderBy('id'),
+                'variants.definitions.itemAttribute.attribute.options',
+            ])
+            ->get();
+
+        $attributes = [];
+
+        foreach ($items as $item) {
+            foreach ($item->itemAttributes as $itemAttribute) {
+                $attribute = $itemAttribute->attribute;
+                if ($attribute === null) {
+                    continue;
+                }
+
+                $code = $attribute->codigo;
+                $attributes[$code] ??= [
+                    'code' => $code,
+                    'label' => $itemAttribute->ticket_label ?: $attribute->nombre,
+                    'sort_order' => $itemAttribute->sort_order,
+                    'options' => [],
+                ];
+
+                foreach ($item->variants as $variant) {
+                    $definition = $variant->definitions->firstWhere('item_attribute_id', $itemAttribute->id);
+                    if ($definition === null) {
+                        continue;
+                    }
+
+                    $value = (string) $definition->value;
+                    $option = $attribute->options->firstWhere('value', $value);
+                    $attributes[$code]['options'][$value] = [
+                        'value' => $value,
+                        'label' => (string) ($option?->label ?: $value),
+                    ];
+                }
+            }
+        }
+
+        uasort($attributes, fn (array $left, array $right): int => $left['sort_order'] <=> $right['sort_order']
+            ?: $left['label'] <=> $right['label']);
+
+        return array_values(array_map(fn (array $attribute): array => [
+            'code' => $attribute['code'],
+            'label' => $attribute['label'],
+            'options' => array_values($attribute['options']),
+        ], $attributes));
+    }
+}

app/Domains/Ticketing/Ticket/Services/AdminAppTicketColumnService.php

@@ -8,9 +8,17 @@ class AdminAppTicketColumnService
 {
     private const FIESTA_FUTBOL_INFANTIL = 'fiesta_futbol_infantil';
 
+    private const DESFILE_PURA_TENDENCIA = 'desfile_pura_tendencia';
+
+    public function __construct(private readonly AdminAppTicketAttributeService $attributeService) {}
+
     /** @return list<array{key: string, label: string, type: string, sortable: bool, sort_param: string, width: string, excel_width: int}> */
     public function columns(Tenant $tenant): array
     {
+        if ($tenant->codigo === self::DESFILE_PURA_TENDENCIA) {
+            return $this->desfileColumns($tenant);
+        }
+
         $keys = $tenant->codigo === self::FIESTA_FUTBOL_INFANTIL
             ? ['order_number', 'category', 'product', 'type', 'date', 'size', 'amount', 'client', 'id', 'status', 'scanned_by']
             : ['order_number', 'product', 'amount', 'client', 'id', 'status', 'scanned_by'];
@@ -45,6 +53,31 @@ class AdminAppTicketColumnService
         return $columns;
     }
 
+    /** @return list<array{key: string, label: string, type: string, sortable: bool, sort_param: string, width: string, excel_width: int}> */
+    private function desfileColumns(Tenant $tenant): array
+    {
+        $attributeColumns = array_map(fn (array $attribute): array => [
+            'key' => $attribute['code'],
+            'label' => $attribute['label'],
+            'type' => 'text',
+            'sortable' => false,
+            'sort_param' => $attribute['code'],
+            'width' => '8%',
+            'excel_width' => 15,
+        ], $this->attributeService->attributes($tenant));
+
+        return [
+            $this->definitions()['order_number'],
+            $this->definitions()['product'],
+            ...$attributeColumns,
+            $this->definitions()['amount'],
+            $this->definitions()['client'],
+            $this->definitions()['id'],
+            $this->definitions()['status'],
+            $this->definitions()['scanned_by'],
+        ];
+    }
+
     /** @return list<array{key: string, label: string, type: string, sortable: bool, sort_param: string, width: string}> */
     public function publicColumns(Tenant $tenant): array
     {

app/Domains/Ticketing/Ticket/Services/AdminAppTicketRowService.php

@@ -11,6 +11,8 @@ class AdminAppTicketRowService
 {
     private const FIESTA_FUTBOL_INFANTIL = 'fiesta_futbol_infantil';
 
+    private const DESFILE_PURA_TENDENCIA = 'desfile_pura_tendencia';
+
     private const CATEGORY_PRESENTATIONS = [
         'alojamientos' => ['category' => 'Camping', 'product' => 'tipo_alojamiento', 'type' => null, 'size' => null],
         'camping' => ['category' => null, 'product' => 'tipo_alojamiento', 'type' => null, 'size' => null],
@@ -25,31 +27,65 @@ class AdminAppTicketRowService
     {
         $purchaseItem = $ticket->sourcePurchaseItem;
         $refund = $ticket->refund;
+        $variantProperties = $this->variantProperties($ticket);
 
         return [
             'source_purchase_item_id' => $ticket->source_purchase_item_id,
             'order_number' => $purchaseItem?->compra_id,
-            'product' => $purchaseItem?->item_nombre
-                ?? $ticket->sourceCatalogItem?->nombre
-                ?? $ticket->name,
-            'amount' => $purchaseItem?->precio_unitario,
+            'product' => $this->productName($ticket, $purchaseItem?->item_nombre, $variantProperties),
+            'amount' => $purchaseItem?->precio_unitario ?? $ticket->entryReservation?->importe,
             'refund_type' => $refund?->type,
             'refund_type_label' => $refund?->typeLabel(),
             'client' => $purchaseItem?->purchase?->nombre_apellido ?? $ticket->user?->nombre_apellido,
             'status' => $ticket->status,
             'scanned_by' => $ticket->scannerUser?->nombre_apellido,
-            'variant_properties' => $this->variantProperties($ticket),
+            'variant_properties' => $variantProperties,
             'allow_refund' => $ticket->allow_refund(),
         ];
     }
 
+    /**
+     * @param  list<array{code: string, label: string, values: list<array{value: string, label: string}>}>  $properties
+     */
+    private function productName(Ticket $ticket, ?string $snapshotName, array $properties): string
+    {
+        $baseName = $ticket->sourceCatalogItem?->nombre ?: $ticket->name;
+
+        if ($ticket->tenant_code !== self::DESFILE_PURA_TENDENCIA) {
+            return $snapshotName ?: $baseName;
+        }
+
+        $seatDescription = collect(['sector', 'fila', 'asiento'])
+            ->map(function (string $code) use ($properties): ?string {
+                $property = collect($properties)->firstWhere('code', $code);
+                $values = collect($property['values'] ?? [])->pluck('label')->filter()->implode(', ');
+
+                return $property === null || $values === ''
+                    ? null
+                    : $property['label'].' '.$values;
+            })
+            ->filter()
+            ->implode(', ');
+
+        return $seatDescription === '' ? ($snapshotName ?: $baseName) : "{$baseName} ({$seatDescription})";
+    }
+
     /** @param array<string, mixed>|null $details */
     public function values(Ticket $ticket, ?array $details = null): array
     {
         $details ??= $this->details($ticket);
         $presentation = $this->presentation($ticket, $details);
+        $attributeValues = collect($details['variant_properties'] ?? [])
+            ->mapWithKeys(fn (array $property): array => [
+                $property['code'] => collect($property['values'] ?? [])
+                    ->pluck('label')
+                    ->filter()
+                    ->implode(', ') ?: '-',
+            ])
+            ->all();
 
         return [
+            ...$attributeValues,
             'order_number' => $details['order_number'],
             'category' => $presentation['category'],
             'product' => $presentation['product'],

app/Domains/Ticketing/Ticket/Services/AdminAppTicketService.php

@@ -2,13 +2,14 @@
 
 namespace App\Domains\Ticketing\Ticket\Services;
 
-use App\Domains\Core\Auth\Models\User;
 use App\Domains\Commerce\Catalog\Enums\InventoryPolicy;
 use App\Domains\Commerce\Catalog\Models\Inventory;
 use App\Domains\Commerce\Catalog\Models\Variant;
 use App\Domains\Commerce\Purchase\Models\PurchaseItem;
 use App\Domains\Commerce\Purchase\Services\PurchaseRefundSummaryService;
+use App\Domains\Core\Auth\Models\User;
 use App\Domains\Core\Tenant\Models\Tenant;
+use App\Domains\Ticketing\Event\Models\Event;
 use App\Domains\Ticketing\Ticket\Models\Ticket;
 use App\Domains\Ticketing\Ticket\Models\TicketRefund;
 use Illuminate\Database\Eloquent\Builder;
@@ -23,15 +24,18 @@ class AdminAppTicketService
         ...TicketValidityResolver::RELATIONS,
         ...TicketPresentationResolver::RELATIONS,
         'tenant',
+        'event',
         'user',
         'scannerUser',
         'sourceCatalogItem.category',
         'sourcePurchaseItem.purchase',
+        'entryReservation',
         'refund.createdBy',
     ];
 
     public function __construct(
         private readonly AdminAppTicketColumnService $columnService,
+        private readonly AdminAppTicketAttributeService $attributeService,
         private readonly AdminAppTicketRowService $rowService,
         private readonly PurchaseRefundSummaryService $refundSummaryService,
     ) {}
@@ -143,19 +147,20 @@ class AdminAppTicketService
             ]);
         }
 
+        $configuration = $ticket->event_id === null ? $tenant : $ticket->event;
         $unitPrice = (float) $purchaseItem->precio_unitario;
         $itemTotal = (float) $purchaseItem->total;
         $itemRefundedAmount = $this->refundedAmountForPurchaseItem($purchaseItem);
         $remainingItemAmount = max(0.0, round($itemTotal - $itemRefundedAmount, 2));
 
         $total = null;
-        if ($tenant->allow_refund() && $tenant->allow_ticket_total_refund && $unitPrice <= $remainingItemAmount) {
+        if ($configuration->allow_refund() && $configuration->allow_ticket_total_refund && $unitPrice <= $remainingItemAmount) {
             $total = number_format($unitPrice, 2, '.', '');
         }
 
         $partial = null;
-        if ($tenant->allow_refund() && $tenant->allow_partial_refund()) {
-            $partialAmount = $this->refundAmount($purchaseItem, $tenant, 'partial');
+        if ($configuration->allow_refund() && $configuration->allow_partial_refund()) {
+            $partialAmount = $this->refundAmount($purchaseItem, $configuration, 'partial');
             if ($partialAmount <= $remainingItemAmount) {
                 $partial = number_format($partialAmount, 2, '.', '');
             }
@@ -173,14 +178,15 @@ class AdminAppTicketService
         string $refundType,
         ?User $createdBy = null,
     ): Ticket {
-        $this->ensureRefundIsAllowed($tenant, $refundType);
-
         return DB::transaction(function () use ($tenant, $ticketId, $refundType, $createdBy): Ticket {
             $ticket = Ticket::query()
                 ->where('tenant_code', $tenant->codigo)
                 ->lockForUpdate()
                 ->findOrFail($ticketId);
 
+            $configuration = $ticket->event_id === null ? $tenant : $ticket->event;
+            $this->ensureRefundIsAllowed($configuration, $refundType);
+
             if (! $ticket->can_refund()) {
                 if ($ticket->status !== Ticket::STATUS_ACTIVE) {
                     throw ValidationException::withMessages([
@@ -203,7 +209,7 @@ class AdminAppTicketService
                 ]);
             }
 
-            $refundAmount = $this->refundAmount($purchaseItem, $tenant, $refundType);
+            $refundAmount = $this->refundAmount($purchaseItem, $configuration, $refundType);
             $refundedAmount = round(
                 $this->refundedAmountForPurchaseItem($purchaseItem) + $refundAmount,
                 2,
@@ -284,7 +290,7 @@ class AdminAppTicketService
             ->sum('amount'), 2);
     }
 
-    private function ensureRefundIsAllowed(Tenant $tenant, string $refundType): void
+    private function ensureRefundIsAllowed(Tenant|Event $tenant, string $refundType): void
     {
         $isAllowed = match ($refundType) {
             TicketRefund::TYPE_PARTIAL => $tenant->allow_refund() && $tenant->allow_partial_refund(),
@@ -298,7 +304,7 @@ class AdminAppTicketService
         }
     }
 
-    private function refundAmount(PurchaseItem $purchaseItem, Tenant $tenant, string $refundType): float
+    private function refundAmount(PurchaseItem $purchaseItem, Tenant|Event $tenant, string $refundType): float
     {
         $ticketAmount = (float) $purchaseItem->precio_unitario;
 
@@ -347,6 +353,13 @@ class AdminAppTicketService
 
         $this->applyStatusFilter($query, $filters['status'] ?? null);
 
+        foreach ($this->attributeService->attributes($tenant) as $attribute) {
+            $value = $filters[$attribute['code']] ?? null;
+            if ($value !== null && $value !== '') {
+                $this->whereVariantDefinition($query, $attribute['code'], (string) $value);
+            }
+        }
+
         return $query;
     }
 

app/Domains/Ticketing/Ticket/Services/ConvertValidityTimesToUtcService.php

@@ -0,0 +1,65 @@
+<?php
+
+namespace App\Domains\Ticketing\Ticket\Services;
+
+use Carbon\CarbonImmutable;
+use DateTimeZone;
+use Illuminate\Support\Facades\DB;
+use InvalidArgumentException;
+
+class ConvertValidityTimesToUtcService
+{
+    /**
+     * @param  array<int, int>  $ids
+     * @return array<int, array<string, mixed>>
+     */
+    public function run(array $ids, string $timezone, bool $apply = false, bool $all = false, bool $reverse = false): array
+    {
+        if (! in_array($timezone, DateTimeZone::listIdentifiers(DateTimeZone::ALL_WITH_BC), true)) {
+            throw new InvalidArgumentException('Zona horaria inválida.');
+        }
+        if ($all === ($ids !== [])) {
+            throw new InvalidArgumentException('Indicar --all o --ids, exclusivamente una opción.');
+        }
+
+        return DB::transaction(function () use ($ids, $timezone, $apply, $all, $reverse): array {
+            $query = DB::table('validity_times')->orderBy('id');
+            $all ? $query->where('type', 'fixed_window') : $query->whereIn('id', $ids);
+            if ($apply) {
+                $query->lockForUpdate();
+            }
+            $rows = $query->get();
+            if (! $all && $rows->count() !== count(array_unique($ids))) {
+                throw new InvalidArgumentException('Uno o más IDs no existen.');
+            }
+            if ($rows->contains(fn ($row): bool => $row->type !== 'fixed_window')) {
+                throw new InvalidArgumentException('Sólo se admiten IDs de fixed_window.');
+            }
+            $source = $reverse ? 'UTC' : $timezone;
+            $target = $reverse ? $timezone : 'UTC';
+            $result = [];
+            foreach ($rows as $row) {
+                $convert = fn (?string $value): ?string => $value === null
+                    ? null
+                    : CarbonImmutable::parse($value, $source)->setTimezone($target)->format('Y-m-d H:i:s');
+                $start = $convert($row->fixed_starts_at);
+                $end = $convert($row->fixed_expires_at);
+                $result[] = [
+                    'id' => $row->id,
+                    'original_start' => $row->fixed_starts_at,
+                    'original_end' => $row->fixed_expires_at,
+                    'result_start' => $start,
+                    'result_end' => $end,
+                ];
+                if ($apply) {
+                    DB::table('validity_times')->where('id', $row->id)->update([
+                        'fixed_starts_at' => $start,
+                        'fixed_expires_at' => $end,
+                    ]);
+                }
+            }
+
+            return $result;
+        });
+    }
+}

app/Domains/Ticketing/Ticket/Services/ResolvedValidityGroup.php

@@ -17,7 +17,7 @@ use Illuminate\Support\Collection;
 final readonly class ResolvedValidityGroup
 {
     /** @param Collection<int, ValidityTime> $validityTimes */
-    public function __construct(public Collection $validityTimes) {}
+    public function __construct(public Collection $validityTimes, public string $timezone = 'UTC') {}
 
     /** Comprueba si el instante pertenece a la intersección efectiva del grupo. */
     public function isValid(?CarbonInterface $at = null): bool
@@ -50,7 +50,17 @@ final readonly class ResolvedValidityGroup
         $anchor = $this->dateAnchor() ?? $at;
 
         return $this->validityTimes
-            ->map(fn (ValidityTime $validityTime): ?CarbonInterface => $validityTime->startsAt($anchor))
+            ->map(function (ValidityTime $validityTime) use ($anchor): ?CarbonInterface {
+                $start = $validityTime->startsAt($anchor, $this->timezone);
+                $end = $validityTime->expiresAt($anchor, $this->timezone);
+
+                if ($this->dateAnchor() === null && $start !== null && $end !== null
+                    && $end->lessThanOrEqualTo($start) && $anchor->lessThan($end)) {
+                    return $start->copy()->subDay();
+                }
+
+                return $start;
+            })
             ->filter()
             ->sortByDesc(fn (CarbonInterface $startsAt): int => $startsAt->getTimestamp())
             ->first();
@@ -67,11 +77,13 @@ final readonly class ResolvedValidityGroup
 
         return $this->validityTimes
             ->map(function (ValidityTime $validityTime) use ($anchor): ?CarbonInterface {
-                $startsAt = $validityTime->startsAt($anchor);
-                $expiresAt = $validityTime->expiresAt($anchor);
+                $startsAt = $validityTime->startsAt($anchor, $this->timezone);
+                $expiresAt = $validityTime->expiresAt($anchor, $this->timezone);
 
                 if ($startsAt !== null && $expiresAt !== null && $expiresAt->lessThanOrEqualTo($startsAt)) {
-                    return $expiresAt->addDay();
+                    return $this->dateAnchor() === null && $anchor->lessThan($expiresAt)
+                        ? $expiresAt
+                        : $expiresAt->copy()->addDay();
                 }
 
                 return $expiresAt;

app/Domains/Ticketing/Ticket/Services/ScannerTicketService.php

@@ -3,6 +3,7 @@
 namespace App\Domains\Ticketing\Ticket\Services;
 
 use App\Domains\Core\Auth\Models\User;
+use App\Domains\Core\Auth\Services\EventScopeService;
 use App\Domains\Ticketing\Ticket\Enums\ScanAttemptResult;
 use App\Domains\Ticketing\Ticket\Models\ScanAttempt;
 use App\Domains\Ticketing\Ticket\Models\Ticket;
@@ -27,6 +28,7 @@ class ScannerTicketService
             ->with('ticket.sourceCatalogItem.category')
             ->where('tenant_code', $scanner->tenant_codigo)
             ->where('scanner_user_id', $scanner->getKey())
+            ->when($this->eventId($scanner) !== null, fn (Builder $query) => $query->where('event_id', $this->eventId($scanner)))
             ->when($search !== '', function (Builder $query) use ($search): void {
                 $attemptedAtDate = $this->parseSearchDate($search);
 
@@ -60,6 +62,7 @@ class ScannerTicketService
             ->with('ticket.sourceCatalogItem.category')
             ->where('tenant_code', $scanner->tenant_codigo)
             ->where('scanner_user_id', $scanner->getKey())
+            ->when($this->eventId($scanner) !== null, fn (Builder $query) => $query->where('event_id', $this->eventId($scanner)))
             ->when($search !== '', function (Builder $query) use ($search): void {
                 $attemptedAtDate = $this->parseSearchDate($search);
                 $attemptedAtDayMonth = $this->parseSearchDayMonth($search);
@@ -106,6 +109,7 @@ class ScannerTicketService
             ->with('ticket')
             ->where('tenant_code', $scanner->tenant_codigo)
             ->where('scanner_user_id', $scanner->getKey())
+            ->when($this->eventId($scanner) !== null, fn (Builder $query) => $query->where('event_id', $this->eventId($scanner)))
             ->findOrFail($scanAttemptId);
 
         $scanAttempt->ticket?->loadMissing($this->relations());
@@ -113,6 +117,11 @@ class ScannerTicketService
         return $scanAttempt;
     }
 
+    private function eventId(User $scanner): ?int
+    {
+        return app(EventScopeService::class)->eventId($scanner);
+    }
+
     private function parseSearchDate(string $search): ?string
     {
         if (preg_match('/^(\d{4})-(\d{2})-(\d{2})$/', $search, $matches) === 1) {
@@ -154,7 +163,8 @@ class ScannerTicketService
     {
         $query = $this->baseQuery()
             ->where('tenant_code', $scanner->tenant_codigo)
-            ->where('ticket', $ticketUuid);
+            ->where('ticket', $ticketUuid)
+            ->when($this->eventId($scanner) !== null, fn (Builder $query) => $query->where('event_id', $this->eventId($scanner)));
 
         if ($this->requiresCategoryValidation($scanner)) {
             $categoryIds = $this->scannerCategoryIds($scanner);
@@ -178,6 +188,7 @@ class ScannerTicketService
         $scanAttempt = ScanAttempt::query()->create([
             'tenant_code' => $scanner->tenant_codigo,
             'scanner_user_id' => $scanner->getKey(),
+            'event_id' => $this->eventId($scanner),
             'data' => $this->serializeScannedData($scannedData),
             'result' => ScanAttemptResult::Processing,
         ]);
@@ -200,6 +211,7 @@ class ScannerTicketService
                 $ticket = $this->baseQuery()
                     ->where('tenant_code', $scanner->tenant_codigo)
                     ->where('ticket', $scannedData)
+                    ->when($this->eventId($scanner) !== null, fn (Builder $query) => $query->where('event_id', $this->eventId($scanner)))
                     ->lockForUpdate()
                     ->firstOrFail();
                 $ticketId = (int) $ticket->getKey();

app/Domains/Ticketing/Ticket/Services/TicketGeneratorService.php

@@ -2,9 +2,9 @@
 
 namespace App\Domains\Ticketing\Ticket\Services;
 
-use App\Domains\Core\Auth\Models\User;
 use App\Domains\Commerce\Catalog\Models\CatalogItem;
 use App\Domains\Commerce\Catalog\Models\Variant;
+use App\Domains\Core\Auth\Models\User;
 use App\Domains\Ticketing\Ticket\Exceptions\TicketGenerationException;
 use App\Domains\Ticketing\Ticket\Models\Ticket;
 use Illuminate\Support\Collection;
@@ -44,6 +44,7 @@ class TicketGeneratorService
                 $variant = $target['variant'];
                 $ticket = Ticket::query()->create([
                     'tenant_code' => $item->tenant_code,
+                    'event_id' => $item->event_id,
                     'ticket' => (string) Str::uuid(),
                     'source_purchase_item_id' => $sourcePurchaseItemId,
                     'source_catalog_item_id' => $item->getKey(),

app/Domains/Ticketing/Ticket/Services/TicketValidityResolver.php

@@ -29,6 +29,7 @@ class TicketValidityResolver
 
     /** Relaciones necesarias para resolver tickets sin consultas N+1. */
     public const RELATIONS = [
+        'sourceVariant.catalogItem.tenant',
         'sourceVariant.eventDates.validityTime',
         'sourceVariant.eventDate.validityTime',
         'sourceVariant.definitions.itemAttribute.attribute.options.validityTime',
@@ -60,6 +61,7 @@ class TicketValidityResolver
     public function resolveVariant(Variant $variant): ResolvedTicketValidity
     {
         $variant->loadMissing([
+            'catalogItem.tenant',
             'eventDates.validityTime',
             'eventDate.validityTime',
             'definitions.itemAttribute.attribute.options.validityTime',
@@ -149,7 +151,7 @@ class TicketValidityResolver
         }
 
         return new ResolvedTicketValidity(
-            $groups->map(fn (Collection $times): ResolvedValidityGroup => new ResolvedValidityGroup($times))
+            $groups->map(fn (Collection $times): ResolvedValidityGroup => new ResolvedValidityGroup($times, $variant->catalogItem?->tenant?->timezone ?? 'UTC'))
         );
     }
 }

app/Domains/Ticketing/Ticket/Services/UserTicketQueryService.php

@@ -0,0 +1,45 @@
+<?php
+
+namespace App\Domains\Ticketing\Ticket\Services;
+
+use App\Domains\Core\Auth\Models\User;
+use App\Domains\Core\Tenant\Models\Tenant;
+use App\Domains\Ticketing\Event\Models\Event;
+use App\Domains\Ticketing\Ticket\Models\Ticket;
+use Illuminate\Database\Eloquent\Builder;
+use Illuminate\Support\Collection;
+
+class UserTicketQueryService
+{
+    /** @return Collection<int, Ticket> */
+    public function tickets(Tenant $tenant, User $user, ?int $eventId = null): Collection
+    {
+        return $this->ticketQuery($tenant, $user)
+            ->when($eventId !== null, fn (Builder $query): Builder => $query
+                ->where('event_id', $eventId))
+            ->with([...TicketValidityResolver::RELATIONS, ...TicketPresentationResolver::RELATIONS])
+            ->orderByDesc('id')
+            ->get();
+    }
+
+    /** @return Collection<int, Event> */
+    public function events(Tenant $tenant, User $user): Collection
+    {
+        return Event::query()
+            ->where('tenant_code', $tenant->codigo)
+            ->whereHas('tickets', fn (Builder $query): Builder => $query
+                ->where('tenant_code', $tenant->codigo)
+                ->where('user_id', $user->getKey()))
+            ->with('attachment')
+            ->orderByDesc('id')
+            ->get();
+    }
+
+    /** @return Builder<Ticket> */
+    private function ticketQuery(Tenant $tenant, User $user): Builder
+    {
+        return Ticket::query()
+            ->where('tenant_code', $tenant->codigo)
+            ->where('user_id', $user->getKey());
+    }
+}

app/Domains/Ticketing/Ticket/documentacion/README.md

@@ -17,6 +17,29 @@ Genera, valida, consulta y exporta entradas asociadas a compras pagadas de produ
 se combinan con OR y las dimensiones diferentes se combinan con AND. El modelo calcula si un ticket está
 vigente, vencido o usado, y resuelve sus fechas efectivas de inicio y fin sin persistir vigencias en el ticket.
 
+## Zona horaria y vigencias
+
+La zona se configura por tenant mediante `timezone` (identificador IANA, por ejemplo
+`America/Argentina/Buenos_Aires`), configurado mediante seeders o base de datos y expuesto en la respuesta de tenants.
+Ese es el valor por defecto. La aplicación mantiene su zona global en UTC.
+
+Las fechas y horas de `EventDate` y los horarios de `time_window` son locales al tenant.
+Las ventanas `fixed_window` se guardan en UTC. El resolver pasa la zona del tenant del producto
+al grupo de vigencia: antes de combinar fecha y hora, convierte el ancla a esa zona.
+Sin fecha de evento, utiliza el día local del instante consultado; contempla ventanas nocturnas.
+El inicio es inclusivo y el vencimiento exclusivo.
+
+Para validar una ventana horaria directamente, pasar la zona explícitamente:
+`$validityTime->isValid(now(), $tenant->timezone)`. Un `ValidityTime` aislado no tiene tenant;
+los métodos mantienen UTC como valor por defecto para usos sin contexto.
+
+La migración `2026_09_21_040000_add_timezone_to_tenants.php` asigna la zona inicial y reconstruye
+una sola vez las ventanas asociadas a fechas existentes, usando las fechas y horas locales originales.
+No modifica ventanas independientes. Los cambios posteriores de zona son responsabilidad del tenant:
+reinterpretan los horarios locales, pero no reescriben los instantes UTC guardados. Editar la fecha
+u horas de un evento sí vuelve a calcular su ventana. El rollback elimina la columna, sin deshacer
+la corrección de los instantes. Ya no se utiliza `EVENT_TIMEZONE`.
+
 ## Flujo de generación
 
 1. `Purchase` emite `PurchasePaid` al confirmarse el pago.
@@ -69,3 +92,48 @@ Bajo `/v1/adminapp/tenant`, protegido por `auth:sanctum`, `adminapp.tenant` y el
 ## Dependencias y reglas
 
 Depende de `Purchase`, `Catalog`, `Tenant` y `Auth`. La generación debe ser idempotente ante reintentos del evento. `TicketNotAvailableException` y `TicketGenerationException` separan indisponibilidad de errores de generación.
+
+## Conversión de datos históricos a UTC (homo / producción)
+
+El comando no requiere migraciones adicionales ni crea una tabla de registro.
+Para convertir todos los registros de tipo `fixed_window` desde hora argentina:
+
+```bash
+# Vista previa: no escribe en la base
+php artisan tickets:convert-validity-times-to-utc --all
+# Aplicar a todos los fixed_window
+php artisan tickets:convert-validity-times-to-utc --all --apply
+```
+
+También permite seleccionar IDs específicos (los siguientes son ejemplos):
+
+```bash
+php artisan tickets:convert-validity-times-to-utc --ids=41,42
+php artisan tickets:convert-validity-times-to-utc --ids=41,42 --apply
+```
+
+`--all` y `--ids` son excluyentes. El origen por defecto es
+`America/Argentina/Buenos_Aires`; se puede indicar otra zona IANA con `--source-timezone`.
+Cada extremo conserva su fecha original y se convierte por separado, incluso si la ventana abarca
+varios días. Los límites nulos y los `time_window` no se modifican. La aplicación es transaccional.
+
+No hay registro ni detección automática de conversiones anteriores: repetir `--apply` vuelve a
+convertir los valores actuales. La migración original `2026_09_21_040000_add_timezone_to_tenants.php`
+ya convierte las ventanas asociadas a eventos; no ejecutar este comando sobre esas ventanas si
+ya fueron convertidas. `--all` incluye absolutamente todos los `fixed_window`, sin esa distinción.
+
+### Revertir una conversión
+
+`--reverse` convierte los valores actuales desde UTC hacia la zona local, con el mismo alcance
+`--all` o `--ids`. Sin `--apply` sólo muestra la vista previa.
+
+```bash
+php artisan tickets:convert-validity-times-to-utc --all --reverse
+php artisan tickets:convert-validity-times-to-utc --all --reverse --apply
+php artisan tickets:convert-validity-times-to-utc --ids=41,42 --reverse --apply
+```
+
+Con `--reverse`, `--source-timezone` indica la zona local de destino (por defecto
+`America/Argentina/Buenos_Aires`). Las fechas de cada extremo y los límites nulos se respetan;
+los `time_window` no se modifican. Revierte una conversión si se seleccionan los mismos registros
+sin ediciones intermedias. No recupera una copia histórica ni detecta conversiones previas.

app/Domains/Ticketing/Ticket/routes/api.php

@@ -6,6 +6,7 @@ use Illuminate\Support\Facades\Route;
 Route::prefix('tenants/{tenant:codigo}')
     ->middleware('auth:sanctum')
     ->group(function (): void {
+        Route::get('tickets/events', [TicketController::class, 'events']);
         Route::get('tickets', [TicketController::class, 'index']);
         Route::post('tickets/pdf', [TicketController::class, 'downloadPdf']);
     });

app/Http/Middleware/EnsureAdminAppTenant.php

@@ -2,6 +2,7 @@
 
 namespace App\Http\Middleware;
 
+use App\Domains\Core\Auth\Services\AdminAppAccessService;
 use App\Domains\Core\Authorization\Enums\RoleCode;
 use Closure;
 use Illuminate\Auth\Access\AuthorizationException;
@@ -10,10 +11,12 @@ use Symfony\Component\HttpFoundation\Response;
 
 class EnsureAdminAppTenant
 {
+    public function __construct(private readonly AdminAppAccessService $accessService) {}
+
     /**
      * Ensure the authenticated user is an AdminApp user bound to a tenant.
      */
-    public function handle(Request $request, Closure $next): Response
+    public function handle(Request $request, Closure $next, string $access = 'tenant'): Response
     {
         $user = $request->user();
 
@@ -21,6 +24,9 @@ class EnsureAdminAppTenant
             ! $user
             || $user->rol_codigo !== RoleCode::AdminApp->value
             || ! $user->tenant_codigo
+            || ! $this->accessService->hasValidScope($user)
+            // Only routes implementing event authorization may accept event administrators.
+            || (! in_array($access, ['context', 'event'], true) && ! $user->isTenantAdministrator())
         ) {
             throw new AuthorizationException;
         }

app/Http/Middleware/EnsureScannerTenant.php

@@ -2,6 +2,7 @@
 
 namespace App\Http\Middleware;
 
+use App\Domains\Core\Auth\Services\EventScopeService;
 use App\Domains\Core\Authorization\Enums\PermissionCode;
 use App\Domains\Core\Authorization\Enums\RoleCode;
 use Closure;
@@ -27,6 +28,8 @@ class EnsureScannerTenant
             throw new AuthorizationException;
         }
 
+        app(EventScopeService::class)->eventId($user);
+
         return $next($request);
     }
 }

app/Shared/Attachable/Models/Attachment.php

@@ -3,12 +3,12 @@
 namespace App\Shared\Attachable\Models;
 
 use App\Shared\Attachable\Enums\AttachmentType;
+use App\Shared\Storage\Services\TemporaryUrlService;
 use Illuminate\Database\Eloquent\Attributes\Fillable;
 use Illuminate\Database\Eloquent\Factories\HasFactory;
 use Illuminate\Database\Eloquent\Model;
 use Illuminate\Database\Eloquent\Relations\HasMany;
 use Illuminate\Database\Eloquent\Relations\HasOne;
-use Illuminate\Support\Facades\Storage;
 use Illuminate\Support\Str;
 
 #[Fillable([
@@ -70,9 +70,9 @@ class Attachment extends Model
      */
     public function getTemporaryUrl(int $expiresInMinutes = 10): string
     {
-        return Storage::disk('s3')->temporaryUrl(
+        return app(TemporaryUrlService::class)->generate(
             $this->path,
-            now()->addMinutes($expiresInMinutes)
-        );
+            $expiresInMinutes,
+        )['temporary_url'];
     }
 }

app/Shared/Forms/Controllers/AdminApp/DesfileEntryReservationFormController.php

@@ -0,0 +1,22 @@
+<?php
+
+namespace App\Shared\Forms\Controllers\AdminApp;
+
+use App\Http\Controllers\Controller;
+use App\Shared\Forms\Resources\DesfileEntryReservationFormResource;
+use App\Shared\Forms\Services\DesfileEntryReservationFormService;
+use Illuminate\Http\Request;
+
+class DesfileEntryReservationFormController extends Controller
+{
+    public function __construct(
+        private readonly DesfileEntryReservationFormService $formService,
+    ) {}
+
+    public function __invoke(Request $request): DesfileEntryReservationFormResource
+    {
+        return DesfileEntryReservationFormResource::make(
+            $this->formService->get($request->user()->tenant()->firstOrFail()),
+        );
+    }
+}

app/Shared/Forms/Controllers/AdminApp/EventFormController.php

@@ -2,9 +2,10 @@
 
 namespace App\Shared\Forms\Controllers\AdminApp;
 
+use App\Domains\Core\Auth\Services\EventScopeService;
+use App\Http\Controllers\Controller;
 use App\Shared\Forms\Resources\EventFormResource;
 use App\Shared\Forms\Services\EventFormService;
-use App\Http\Controllers\Controller;
 use Illuminate\Http\Request;
 
 class EventFormController extends Controller
@@ -15,7 +16,8 @@ class EventFormController extends Controller
     {
         return EventFormResource::make(
             $this->eventFormService->get(
-                $request->user('sanctum')->tenant()->firstOrFail()
+                $request->user('sanctum')->tenant()->firstOrFail(),
+                app(EventScopeService::class)->eventId($request->user())
             )
         );
     }

app/Shared/Forms/Controllers/AdminApp/StaffFormController.php

@@ -2,9 +2,10 @@
 
 namespace App\Shared\Forms\Controllers\AdminApp;
 
+use App\Domains\Core\Auth\Services\EventScopeService;
+use App\Http\Controllers\Controller;
 use App\Shared\Forms\Resources\StaffFormResource;
 use App\Shared\Forms\Services\StaffFormService;
-use App\Http\Controllers\Controller;
 use Illuminate\Http\Request;
 
 class StaffFormController extends Controller
@@ -15,7 +16,8 @@ class StaffFormController extends Controller
     {
         return StaffFormResource::make(
             $this->staffFormService->get(
-                $request->user('sanctum')->tenant()->firstOrFail()
+                $request->user('sanctum')->tenant()->firstOrFail(),
+                app(EventScopeService::class)->eventId($request->user())
             )
         );
     }