Update guest PWA v2 UI and likes

tests/Feature/ContentSecurityPolicyTest.php

@@ -0,0 +1,20 @@
+<?php
+
+namespace Tests\Feature;
+
+use Tests\TestCase;
+
+class ContentSecurityPolicyTest extends TestCase
+{
+    public function test_guest_routes_include_worker_src_for_blob(): void
+    {
+        config(['app.debug' => false]);
+
+        $response = $this->get('/e/test/upload');
+
+        $csp = $response->headers->get('Content-Security-Policy');
+
+        $this->assertNotNull($csp);
+        $this->assertStringContainsString("worker-src 'self' blob:", $csp);
+    }
+}

tests/Feature/EventJoinTokenExpiryActionTest.php

@@ -51,6 +51,52 @@ class EventJoinTokenExpiryActionTest extends TestCase
         );
     }
 
+    public function test_superadmin_can_toggle_demo_read_only_on_join_token(): void
+    {
+        $user = User::factory()->create(['role' => 'super_admin']);
+        $event = Event::factory()->create([
+            'date' => now()->addDays(10),
+        ]);
+
+        $token = $event->joinTokens()->latest('id')->first();
+
+        $this->bootSuperAdminPanel($user);
+
+        Livewire::test(ListEvents::class)
+            ->callAction(
+                [
+                    TestAction::make('join_tokens')->table($event),
+                    TestAction::make('set_demo_read_only')
+                        ->arguments(['token_id' => $token->id]),
+                ],
+                [
+                    'demo_read_only' => true,
+                ]
+            )
+            ->assertHasNoErrors();
+
+        $token->refresh();
+
+        $this->assertTrue((bool) data_get($token->metadata, 'demo_read_only', false));
+
+        Livewire::test(ListEvents::class)
+            ->callAction(
+                [
+                    TestAction::make('join_tokens')->table($event),
+                    TestAction::make('set_demo_read_only')
+                        ->arguments(['token_id' => $token->id]),
+                ],
+                [
+                    'demo_read_only' => false,
+                ]
+            )
+            ->assertHasNoErrors();
+
+        $token->refresh();
+
+        $this->assertFalse((bool) data_get($token->metadata, 'demo_read_only', false));
+    }
+
     private function bootSuperAdminPanel(User $user): void
     {
         $panel = Filament::getPanel('superadmin');

tests/Feature/GuestJoinTokenFlowTest.php

@@ -368,6 +368,38 @@ class GuestJoinTokenFlowTest extends TestCase
         $this->assertEquals(1, $photo->fresh()->likes_count);
     }
 
+    public function test_guest_can_unlike_photo_after_liking(): void
+    {
+        $event = $this->createPublishedEvent();
+        $token = $this->tokenService->createToken($event);
+
+        $photo = Photo::factory()->create([
+            'event_id' => $event->id,
+            'likes_count' => 0,
+        ]);
+
+        $this->getJson("/api/v1/events/{$token->token}");
+
+        $this->withHeader('X-Device-Id', 'device-like')
+            ->postJson("/api/v1/photos/{$photo->id}/like")
+            ->assertOk();
+
+        $response = $this->withHeader('X-Device-Id', 'device-like')
+            ->deleteJson("/api/v1/photos/{$photo->id}/like");
+
+        $response->assertOk()
+            ->assertJson([
+                'liked' => false,
+            ]);
+
+        $this->assertDatabaseMissing('photo_likes', [
+            'photo_id' => $photo->id,
+            'guest_name' => 'device-like',
+        ]);
+
+        $this->assertEquals(0, $photo->fresh()->likes_count);
+    }
+
     public function test_guest_cannot_access_event_with_expired_token(): void
     {
         $event = $this->createPublishedEvent();