Fix guest demo UX and enforce guest limits

app/Services/EventJoinTokenService.php

@@ -4,6 +4,7 @@ namespace App\Services;
 
 use App\Models\Event;
 use App\Models\EventJoinToken;
+use App\Models\EventJoinTokenEvent;
 use App\Models\GuestPolicySetting;
 use Illuminate\Support\Arr;
 use Illuminate\Support\Carbon;
@@ -63,7 +64,7 @@ class EventJoinTokenService
         return $joinToken;
     }
 
-    public function incrementUsage(EventJoinToken $joinToken): void
+    public function incrementUsage(EventJoinToken $joinToken, ?string $deviceId = null, ?string $ipAddress = null): void
     {
         $joinToken->increment('usage_count');
 
@@ -78,6 +79,12 @@ class EventJoinTokenService
             $eventPackage = $limitEvaluator->resolveEventPackageForPhotoUpload($event->tenant, $event->id, $event);
 
             if ($eventPackage && $eventPackage->package?->max_guests !== null) {
+                $normalizedDeviceId = $this->normalizeDeviceId($deviceId);
+                $normalizedIp = is_string($ipAddress) && trim($ipAddress) !== '' ? $ipAddress : null;
+                if (! $this->shouldCountGuest($event->id, $normalizedDeviceId, $normalizedIp)) {
+                    return;
+                }
+
                 $previous = (int) $eventPackage->used_guests;
                 $eventPackage->increment('used_guests');
                 $eventPackage->refresh();
@@ -87,6 +94,28 @@ class EventJoinTokenService
         }
     }
 
+    public function hasSeenGuest(int $eventId, ?string $deviceId, ?string $ipAddress): bool
+    {
+        $normalizedDeviceId = $this->normalizeDeviceId($deviceId);
+        $normalizedIp = is_string($ipAddress) && trim($ipAddress) !== '' ? $ipAddress : null;
+
+        if (! $normalizedDeviceId && ! $normalizedIp) {
+            return false;
+        }
+
+        $query = EventJoinTokenEvent::query()
+            ->where('event_id', $eventId)
+            ->where('event_type', 'access_granted');
+
+        if ($normalizedDeviceId) {
+            $query->where('device_id', $normalizedDeviceId);
+        } else {
+            $query->where('ip_address', $normalizedIp);
+        }
+
+        return $query->exists();
+    }
+
     public function findToken(string $token, bool $includeInactive = false): ?EventJoinToken
     {
         $hash = $this->hashToken($token);
@@ -132,4 +161,35 @@ class EventJoinTokenService
     {
         return hash('sha256', $token);
     }
+
+    private function normalizeDeviceId(?string $deviceId): ?string
+    {
+        if (! is_string($deviceId) || trim($deviceId) === '') {
+            return null;
+        }
+
+        $cleaned = preg_replace('/[^a-zA-Z0-9_-]/', '', $deviceId) ?? '';
+        $cleaned = substr($cleaned, 0, 64);
+
+        return $cleaned !== '' ? $cleaned : null;
+    }
+
+    private function shouldCountGuest(int $eventId, ?string $deviceId, ?string $ipAddress): bool
+    {
+        if (! $deviceId && ! $ipAddress) {
+            return false;
+        }
+
+        $query = EventJoinTokenEvent::query()
+            ->where('event_id', $eventId)
+            ->where('event_type', 'access_granted');
+
+        if ($deviceId) {
+            $query->where('device_id', $deviceId);
+        } else {
+            $query->where('ip_address', $ipAddress);
+        }
+
+        return $query->count() <= 1;
+    }
 }