Fix endcustomer package allocation and event create gating

tests/Feature/CheckoutSessionLocalConfirmationTest.php

@@ -8,6 +8,7 @@ use App\Models\Tenant;
 use App\Models\User;
 use App\Services\Checkout\CheckoutSessionService;
 use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Support\Facades\Config;
 use Illuminate\Support\Facades\Mail;
 use Illuminate\Support\Facades\Notification;
 use Tests\TestCase;
@@ -19,6 +20,10 @@ class CheckoutSessionLocalConfirmationTest extends TestCase
     public function test_local_confirmation_marks_checkout_completed(): void
     {
         $this->app['env'] = 'local';
+        Config::set('checkout.providers', [
+            CheckoutSession::PROVIDER_LEMONSQUEEZY,
+            CheckoutSession::PROVIDER_FREE,
+        ]);
         Mail::fake();
         Notification::fake();
 
@@ -70,4 +75,61 @@ class CheckoutSessionLocalConfirmationTest extends TestCase
             'active' => true,
         ]);
     }
+
+    public function test_local_confirmation_creates_new_endcustomer_tenant_package_per_purchase(): void
+    {
+        $this->app['env'] = 'local';
+        Config::set('checkout.providers', [
+            CheckoutSession::PROVIDER_LEMONSQUEEZY,
+            CheckoutSession::PROVIDER_FREE,
+        ]);
+        Mail::fake();
+        Notification::fake();
+
+        $tenant = Tenant::factory()->create();
+        $user = User::factory()->for($tenant)->create();
+        $package = Package::factory()->create([
+            'type' => 'endcustomer',
+            'lemonsqueezy_variant_id' => 'pri_456',
+            'lemonsqueezy_product_id' => 'pro_456',
+            'price' => 120,
+        ]);
+
+        $sessions = app(CheckoutSessionService::class);
+
+        $firstSession = $sessions->createOrResume($user, $package, ['tenant' => $tenant]);
+        $sessions->selectProvider($firstSession, CheckoutSession::PROVIDER_LEMONSQUEEZY);
+
+        $this->actingAs($user);
+        $this->withSession(['_token' => 'test-token']);
+
+        $this->postJson(
+            route('checkout.session.confirm', $firstSession),
+            [
+                'order_id' => 'ord_456_a',
+                'checkout_id' => 'chk_456_a',
+            ],
+            ['X-CSRF-TOKEN' => 'test-token']
+        )->assertOk();
+
+        $secondSession = $sessions->createOrResume($user, $package, ['tenant' => $tenant]);
+        $sessions->selectProvider($secondSession, CheckoutSession::PROVIDER_LEMONSQUEEZY);
+
+        $this->postJson(
+            route('checkout.session.confirm', $secondSession),
+            [
+                'order_id' => 'ord_456_b',
+                'checkout_id' => 'chk_456_b',
+            ],
+            ['X-CSRF-TOKEN' => 'test-token']
+        )->assertOk();
+
+        $this->assertSame(
+            2,
+            \App\Models\TenantPackage::query()
+                ->where('tenant_id', $tenant->id)
+                ->where('package_id', $package->id)
+                ->count()
+        );
+    }
 }

tests/Feature/EventControllerTest.php

@@ -158,6 +158,67 @@ class EventControllerTest extends TenantTestCase
             ->assertJsonValidationErrors(['accepted_waiver']);
     }
 
+    public function test_create_event_uses_available_endcustomer_packages_and_stops_when_all_are_consumed(): void
+    {
+        $tenant = $this->tenant;
+        $eventType = EventType::factory()->create();
+        $package = Package::factory()->endcustomer()->create(['max_photos' => 100]);
+
+        $firstTenantPackage = TenantPackage::factory()->create([
+            'tenant_id' => $tenant->id,
+            'package_id' => $package->id,
+            'active' => true,
+            'purchased_at' => now()->subDay(),
+            'expires_at' => now()->addYear(),
+        ]);
+
+        $secondTenantPackage = TenantPackage::factory()->create([
+            'tenant_id' => $tenant->id,
+            'package_id' => $package->id,
+            'active' => true,
+            'purchased_at' => now(),
+            'expires_at' => now()->addYear(),
+        ]);
+
+        $firstResponse = $this->authenticatedRequest('POST', '/api/v1/tenant/events', [
+            'name' => 'First Endcustomer Event',
+            'slug' => 'first-endcustomer-event',
+            'event_date' => Carbon::now()->addDays(10)->toDateString(),
+            'event_type_id' => $eventType->id,
+            'accepted_waiver' => true,
+        ]);
+        $firstResponse->assertStatus(201);
+
+        $firstEvent = Event::query()->where('slug', 'first-endcustomer-event')->firstOrFail();
+        $firstEventPackage = EventPackage::query()->where('event_id', $firstEvent->id)->firstOrFail();
+
+        $secondResponse = $this->authenticatedRequest('POST', '/api/v1/tenant/events', [
+            'name' => 'Second Endcustomer Event',
+            'slug' => 'second-endcustomer-event',
+            'event_date' => Carbon::now()->addDays(11)->toDateString(),
+            'event_type_id' => $eventType->id,
+            'accepted_waiver' => true,
+        ]);
+        $secondResponse->assertStatus(201);
+
+        $secondEvent = Event::query()->where('slug', 'second-endcustomer-event')->firstOrFail();
+        $secondEventPackage = EventPackage::query()->where('event_id', $secondEvent->id)->firstOrFail();
+
+        $this->assertContains($firstEventPackage->tenant_package_id, [$firstTenantPackage->id, $secondTenantPackage->id]);
+        $this->assertContains($secondEventPackage->tenant_package_id, [$firstTenantPackage->id, $secondTenantPackage->id]);
+        $this->assertNotSame($firstEventPackage->tenant_package_id, $secondEventPackage->tenant_package_id);
+
+        $thirdResponse = $this->authenticatedRequest('POST', '/api/v1/tenant/events', [
+            'name' => 'Third Endcustomer Event',
+            'slug' => 'third-endcustomer-event',
+            'event_date' => Carbon::now()->addDays(12)->toDateString(),
+            'event_type_id' => $eventType->id,
+            'accepted_waiver' => true,
+        ]);
+        $thirdResponse->assertStatus(402)
+            ->assertJsonPath('error.code', 'event_limit_exceeded');
+    }
+
     public function test_create_event_with_reseller_package_limits_events(): void
     {
         $tenant = $this->tenant;

tests/Unit/Services/PackageLimitEvaluatorTest.php

@@ -65,6 +65,34 @@ class PackageLimitEvaluatorTest extends TestCase
         $this->assertSame(0, $violation['meta']['remaining']);
     }
 
+    public function test_assess_event_creation_returns_violation_when_all_endcustomer_packages_are_consumed(): void
+    {
+        $tenant = Tenant::factory()->create();
+        $package = Package::factory()->endcustomer()->create();
+
+        $tenantPackage = TenantPackage::factory()->for($tenant)->for($package)->create([
+            'active' => true,
+            'expires_at' => now()->addMonth(),
+        ]);
+
+        $event = Event::factory()->for($tenant)->create();
+        EventPackage::create([
+            'event_id' => $event->id,
+            'package_id' => $package->id,
+            'tenant_package_id' => $tenantPackage->id,
+            'purchased_price' => 0,
+            'purchased_at' => now(),
+            'gallery_expires_at' => now()->addDays(7),
+        ]);
+
+        $violation = $this->evaluator->assessEventCreation($tenant, null);
+
+        $this->assertNotNull($violation);
+        $this->assertSame('event_limit_exceeded', $violation['code']);
+        $this->assertSame('endcustomer_packages', $violation['meta']['source']);
+        $this->assertSame(0, $violation['meta']['remaining']);
+    }
+
     public function test_assess_photo_upload_returns_violation_when_photo_limit_reached(): void
     {
         $package = Package::factory()->endcustomer()->create([