Valid

Author: udaycodespace

app/app.py

@@ -5,6 +5,7 @@
 import hmac
 import hashlib
 import gzip
+from urllib.parse import urlencode, urlsplit, urlunsplit, parse_qsl
 
 # Optionally load environment variables from a .env file
 try:
@@ -187,9 +188,30 @@ def _build_verify_url(credential_id):
     """Build the canonical verify URL used by all QR generation paths."""
     qr_data = _generate_qr_hidden_payload(credential_id)
     qr_token = _generate_qr_secret_token(credential_id, _hash_qr_hidden_payload(qr_data))
-    verify_url = url_for('public_verify', _external=True) + f'?id={credential_id}&qk={qr_token}'
+    verifier_base_url = (
+        os.environ.get("QR_VERIFIER_BASE_URL")
+        or "https://udaycodespace.github.io/credify-verify/"
+    ).strip()
+
+    if not verifier_base_url:
+        verifier_base_url = url_for('public_verify', _external=True)
+
+    parsed = urlsplit(verifier_base_url)
+    existing_query = dict(parse_qsl(parsed.query, keep_blank_values=True))
+    existing_query.update({
+        "id": credential_id,
+        "qk": qr_token,
+    })
     if qr_data:
-        verify_url += f'&qd={qr_data}'
+        existing_query["qd"] = qr_data
+
+    verify_url = urlunsplit((
+        parsed.scheme,
+        parsed.netloc,
+        parsed.path or "/",
+        urlencode(existing_query),
+        parsed.fragment,
+    ))
     return {
         'verify_url': verify_url,
         'qr_token': qr_token,
@@ -1437,7 +1459,7 @@ def api_credential_pdf(credential_id):
         qr.save(qr_buffer, format='PNG')
         qr_buffer.seek(0)
         from reportlab.lib.utils import ImageReader
-        p.drawImage(ImageReader(qr_buffer), width-145, y_box-82, width=65, height=65)
+        p.drawImage(ImageReader(qr_buffer), width-176, y_box-86, width=96, height=96)
 
         # Mini Badge (15% Smaller)
         p.setFillColor(gold)

qr-web-app/app.js

@@ -302,6 +302,48 @@ async function processPayload(payload, sourceTag) {
   }
 }
 
+// Keep repeat scans valid on the same device; local storage is only a warning, not proof of fraud.
+processPayload = async function processPayloadOverride(payload, sourceTag) {
+  const parsed = parseQrPayload(payload);
+  if (!parsed.ok) {
+    setStatus('fake', 'INVALID QR');
+    renderCardHtml(`<div class="fail">Credential Invalid ❌</div><div>${escapeHtml(parsed.reason)}</div>`);
+    return;
+  }
+
+  try {
+    const alreadyConsumed = await isQrAlreadyConsumed(parsed.qk);
+    const decodedQd = await decodeQdPayload(parsed.qd);
+    const decoded = decodedQd.parsed;
+    const offlineCheck = await verifyJwsToken(parsed.qk, decodedQd.payloadText, parsed.credentialId);
+
+    if (offlineCheck && offlineCheck.ok && !alreadyConsumed) {
+      await markQrConsumed(parsed.qk, parsed.credentialId);
+    }
+
+    const offlineReason = String(offlineCheck?.reason || '');
+    const repeatedScanReason = alreadyConsumed
+      ? `${offlineReason}${offlineReason ? '. ' : ''}This QR was already scanned on this device earlier.`
+      : offlineReason;
+
+    renderDecodedSecret(decoded, sourceTag, {
+      ...offlineCheck,
+      reason: repeatedScanReason
+    });
+  } catch (e) {
+    setStatus('fake', 'INVALID');
+    renderCardHtml(`<div class="fail">Credential Invalid ❌</div><div>${escapeHtml(String(e))}</div>`);
+  }
+}
+
+function getLandingPayloadFromPageUrl() {
+  const params = new URLSearchParams(window.location.search);
+  if (!params.get('id') || !params.get('qk') || !params.get('qd')) {
+    return null;
+  }
+  return window.location.href;
+}
+
 async function startCameraScan() {
   if (activeVideoTrack) return;
 
@@ -402,3 +444,20 @@ qrFile.addEventListener('change', async (e) => {
     }
   });
 })();
+
+(async function autoVerifyLandingUrl() {
+  const landingPayload = getLandingPayloadFromPageUrl();
+  if (!landingPayload) {
+    return;
+  }
+
+  const ok = await loadIssuerRegistry();
+  if (!ok) {
+    return;
+  }
+
+  qrLinkInput.value = landingPayload;
+  setStatus('pending', 'VERIFYING');
+  renderCardHtml('<div>QR payload detected in page URL. Verifying now...</div>');
+  processPayload(landingPayload, 'landing-url');
+})();

qr-web-app/index.html

@@ -14,7 +14,7 @@
     <header class="hero">
       <h1>Credify Verify</h1>
       <p>Independent Credential Verifier</p>
-      <small>Scan QR or upload QR image</small>
+      <small>Open from a certificate QR, scan live, or upload a QR image</small>
     </header>
 
     <section class="panel">
@@ -36,7 +36,7 @@ <h2>Upload QR Image</h2>
     <section class="panel">
       <h2>QR Link Verification</h2>
       <div class="row">
-        <input id="qrLinkInput" type="text" placeholder="Paste verify link (credify://... or https://...)">
+        <input id="qrLinkInput" type="text" placeholder="Paste a verification URL if you are not scanning directly">
         <button id="verifyLinkBtn" type="button">Verify Link</button>
       </div>
     </section>

templates/certificate_view.html

@@ -558,7 +558,7 @@ <h3 class="section-title" style="color: #b91c1c;">Outstanding Backlog Subjects</
         document.getElementById('certVerifyUrl').value = certVerifyURL;
 
         QRCode.toCanvas(document.createElement('canvas'), certVerifyURL, {
-            width: 140,
+            width: 180,
             margin: 2
         }, function (error, canvas) {
             if (error) console.error(error);
@@ -600,4 +600,4 @@ <h3 class="section-title" style="color: #b91c1c;">Outstanding Backlog Subjects</
         document.body.removeChild(a);
     }
 </script>
-{% endblock %}
+{% endblock %}