Add guest policy settings

tests/Feature/Api/EventGuestUploadLimitTest.php

@@ -7,6 +7,7 @@ use App\Jobs\Packages\SendEventPackagePhotoThresholdWarning;
 use App\Models\Emotion;
 use App\Models\Event;
 use App\Models\EventPackage;
+use App\Models\GuestPolicySetting;
 use App\Models\MediaStorageTarget;
 use App\Models\Package;
 use App\Models\Photo;
@@ -213,6 +214,43 @@ class EventGuestUploadLimitTest extends TestCase
         ]);
     }
 
+    public function test_guest_policy_overrides_device_upload_limit(): void
+    {
+        GuestPolicySetting::flushCache();
+        GuestPolicySetting::query()->create([
+            'id' => 1,
+            'per_device_upload_limit' => 2,
+        ]);
+
+        $tenant = Tenant::factory()->create();
+        $event = Event::factory()->for($tenant)->create([
+            'status' => 'published',
+        ]);
+
+        $mock = \Mockery::mock(PackageLimitEvaluator::class);
+        $mock->shouldReceive('assessPhotoUpload')->andReturn(null);
+        $mock->shouldReceive('resolveEventPackageForPhotoUpload')->andReturn(null);
+        $this->instance(PackageLimitEvaluator::class, $mock);
+
+        Photo::factory()->count(2)->for($event)->create([
+            'guest_name' => 'device-limit',
+        ]);
+
+        $emotion = Emotion::factory()->create();
+        $emotion->eventTypes()->attach($event->event_type_id);
+
+        $token = app(EventJoinTokenService::class)->createToken($event)->plain_token;
+
+        $response = $this->post("/api/v1/events/{$token}/upload", [
+            'photo' => UploadedFile::fake()->image('limit-device.jpg', 800, 600),
+        ], [
+            'X-Device-Id' => 'device-limit',
+        ]);
+
+        $response->assertStatus(429);
+        $response->assertJsonPath('error.meta.limit', 2);
+    }
+
     public function test_photo_limit_violation_creates_notification(): void
     {
         $tenant = Tenant::factory()->create();

tests/Feature/GuestJoinTokenFlowTest.php

@@ -4,6 +4,7 @@ namespace Tests\Feature;
 
 use App\Models\Event;
 use App\Models\EventPackage;
+use App\Models\GuestPolicySetting;
 use App\Models\MediaStorageTarget;
 use App\Models\Package;
 use App\Models\Photo;
@@ -206,6 +207,25 @@ class GuestJoinTokenFlowTest extends TestCase
             ->assertJsonPath('error.code', 'invalid_token');
     }
 
+    public function test_gallery_defaults_use_guest_policy_settings(): void
+    {
+        GuestPolicySetting::flushCache();
+        GuestPolicySetting::query()->create([
+            'id' => 1,
+            'guest_downloads_enabled' => false,
+            'guest_sharing_enabled' => false,
+        ]);
+
+        $event = $this->createPublishedEvent();
+        $token = $this->tokenService->createToken($event);
+
+        $response = $this->getJson("/api/v1/gallery/{$token->token}");
+
+        $response->assertOk()
+            ->assertJsonPath('event.guest_downloads_enabled', false)
+            ->assertJsonPath('event.guest_sharing_enabled', false);
+    }
+
     public function test_guest_cannot_access_event_with_revoked_token(): void
     {
         $event = $this->createPublishedEvent();

tests/Feature/Tenant/GuestNotificationBroadcastTest.php

@@ -4,6 +4,8 @@ namespace Tests\Feature\Tenant;
 
 use App\Models\Event;
 use App\Models\GuestNotification;
+use App\Models\GuestPolicySetting;
+use Illuminate\Support\Carbon;
 use Illuminate\Support\Str;
 
 class GuestNotificationBroadcastTest extends TenantTestCase
@@ -49,6 +51,38 @@ class GuestNotificationBroadcastTest extends TenantTestCase
         ]);
     }
 
+    public function test_guest_notification_default_ttl_applies(): void
+    {
+        $now = now();
+        Carbon::setTestNow($now);
+
+        GuestPolicySetting::flushCache();
+        GuestPolicySetting::query()->create([
+            'id' => 1,
+            'guest_notification_ttl_hours' => 6,
+        ]);
+
+        $event = Event::factory()->for($this->tenant)->create();
+
+        $payload = [
+            'title' => 'Upload-Reminder',
+            'message' => 'Bitte lade deine letzten Fotos hoch.',
+            'type' => 'broadcast',
+        ];
+
+        $response = $this->authenticatedRequest('POST', "/api/v1/tenant/events/{$event->slug}/guest-notifications", $payload);
+
+        $response->assertCreated();
+
+        $notification = GuestNotification::query()->where('event_id', $event->id)->first();
+
+        $this->assertNotNull($notification);
+        $this->assertNotNull($notification->expires_at);
+        $this->assertEquals($now->copy()->addHours(6)->toDateTimeString(), $notification->expires_at?->toDateTimeString());
+
+        Carbon::setTestNow();
+    }
+
     public function test_admin_cannot_access_foreign_event(): void
     {
         $otherTenantEvent = Event::factory()->create([