# Sprint G004, G005, G006, G007, & G008 — Walkthrough

## Sprint G008 — QR Attendance Engine

The **QR Attendance Engine** establishes personalized QR Code attendance capability for wedding guests. This is done by extending the existing Guest and Public Invitation modules, providing high-resolution image downloads (PNG / vector SVG fallbacks) and a secure public verification endpoint without exposing database IDs.

---

## Files Created & Modified

### Modified Files
- [QrCodeService.php](file:///c:/xampp/htdocs/inveetaire/app/services/QrCodeService.php): Extended to support high-resolution printable PNG generation (`generatePng()`) and vector scaling (`generateSvg()`) for offline fallback.
- [routes.php (Guest)](file:///c:/xampp/htdocs/inveetaire/app/modules/Guest/routes.php): Registered `GET /app/couple/guests/qr/{id}` for secure, workspace-isolated QR downloads.
- [GuestController.php](file:///c:/xampp/htdocs/inveetaire/app/modules/Guest/GuestController.php): Added `downloadQr(Request $request)` to stream high-resolution QR codes to couples.
- [routes.php (PublicInvitation)](file:///c:/xampp/htdocs/inveetaire/app/modules/PublicInvitation/routes.php): Registered public unauthenticated validation path `/i/validation/{guest_token}`.
- [PublicInvitationModel.php](file:///c:/xampp/htdocs/inveetaire/app/modules/PublicInvitation/PublicInvitationModel.php): Implemented `getValidationData($token)` which resolves verification fields across guest, invitation, and workspace contexts in a single query.
- [PublicInvitationController.php](file:///c:/xampp/htdocs/inveetaire/app/modules/PublicInvitation/PublicInvitationController.php): Added `validateQr(Request $request)` to output checking results safely as JSON.
- [list.php (view)](file:///c:/xampp/htdocs/inveetaire/app/views/guest/list.php): Added a **Download QR** action button inside each guest row of the Actions column.

---

## Architecture & Security Verification

- **ID Obfuscation**: The validation API accepts only cryptographically secure `guest_token` values and returns sanitized verification data (names, honorifics, pax, category) without exposing internal database IDs.
- **Verification Integrity**: The validation endpoint queries the status of both the workspace (`active`) and the invitation (`published`). Check-ins are rejected with clear error codes (e.g. 403 Forbidden) if the invitation is not published or the couple's account is inactive.
- **Offline / Local Fallback**: If internet connectivity is down and `api.qrserver.com` cannot be reached, the system automatically falls back to streaming high-resolution vector SVGs so files can still be printed.

---

## Validation & Testing Results

- ✅ `QrCodeService.php` — No syntax errors
- ✅ `Guest/routes.php` — No syntax errors
- ✅ `GuestController.php` — No syntax errors
- ✅ `PublicInvitation/routes.php` — No syntax errors
- ✅ `PublicInvitationModel.php` — No syntax errors
- ✅ `PublicInvitationController.php` — No syntax errors
- ✅ `list.php` view — No syntax errors