Cambodia certificate QR + Verification

sequenceDiagram
  actor Staff as Registry staff
  participant REG as qrcode_gen.php
  participant QR as qr.limkokwing.net CI4
  participant VER as verification.limkokwing.net
  participant CMS as campus2_cambodia
  participant FILE as StudentID_ProgramCode.png

  Staff->>REG: StdProgramID · StudentID · ProgramCode
  REG->>REG: short_code = KHM-PNH_ + StdProgramID
  REG->>REG: token = AES-256-CBC(StdProgramID)
  REG->>QR: POST /api/create_qrcode_api
  Note over REG,QR: name · category=LUCT · short_code
url = verification…/cambodia/token
  QR->>QR: Insert qrcode.slug + url
  QR->>QR: PNG data = qr…/qrcode/short_code
  QR-->>REG: JSON Qrcode base64 PNG
  REG->>FILE: download PNG for certificate print

  actor Public as Scanner
  Public->>QR: GET /qrcode/KHM-PNH_…
  QR-->>Public: 302 → verification…/cambodia/token
  Public->>VER: GET /cambodia/token
  VER->>VER: AES decrypt → StdProgramID
  VER->>CMS: CALL GetStudentCertInfo(StdProgramID)
  CMS-->>VER: name · programme · CertSN · blob
  VER-->>Public: Verified HTML page
          

1. Build short_code = KHM-PNH_{StdProgramID}.
2. Encrypt StdProgramID → base64 token; build Verification URL under /cambodia/.
3. POST create API (see §3). SaaS stores url; PNG encodes short redirect URL.
4. Parse JSON field Qrcode (base64 PNG); save as {StudentID}_{ProgramCode}.png.

sequenceDiagram
  participant KH as Cambodia campus
  participant CY as Cyberjaya ops
  Note over KH,CY: Manual — not modelled in Registry PHP
  KH->>CY: Certificates · QR PNGs · student data pack
  CY->>CY: Print / stamp / process
  CY-->>KH: Return physical certificates
  Note over KH: Public scan still Verification → GetStudentCertInfo
          

• JSON; field Qrcode = base64 PNG. Also status (1 success / 0 error-or-exists) and message.
• If short_code already exists: returns existing PNG with status: 0, message “QR code already exists” (CMS still gets an image).
• PNG payload data = {base_url}/qrcode/{short_code}, not the Verification URL. Redirect resolves the stored url.
• Image via Endroid QR Code (300px, medium ECC). Stored under writable/uploads/qrcodes/{short_code}.png.
• Category auto-created by name if missing (description “Auto-created category”) — how LUCT appeared in the dump.

The QR SaaS is therefore a multi-purpose Limkokwing short-link / QR registry (namecards + marketing + certificates), not Cambodia-only. Certificate volume dominates this dump.

flowchart TD
  A["GET /{country}/{token}"] --> B[urldecode token]
  B --> C[AES-256-CBC decrypt]
  C --> D[StdProgramID]
  D --> E["CALL GetStudentCertInfo(StdProgramID)"]
  E --> F{Row found?}
  F -->|yes| G[Certificate Verified UI]
  F -->|no| H[No certificate found]
          

• Apache .htaccess rewrites all non-files to index.php.
• First path segment is treated as country (UI hard-codes campus label “Cambodia” today).
• Decrypt supports plain numeric StdProgramID or legacy …_timestamp_date forms (takes trailing segment after last _ when non-numeric).

Defined on campus2_cambodia (CMS procedures dump 7 Oct 2026). Verification calls it over MySQL with a dedicated DB user (credentials in pack — ops secret, not published).

• Input: StdProgID (varchar).
• Reads r_studentcert_cambodia + join s_upload where UploadType in (11) for cert image blob.
• Returns: StdProgramID, StudentID, StudentName, PicURL, ProgramCode, ProgramName, GraduationDate, CertSN, CertFileBlob, CertFileName, CertFileType.

• Student photo (PicURL), name, Student ID
• Programme name · Campus label “Cambodia” · Graduation date
• Certificate serial (CertSN) · inline certificate PNG from blob when SN present
• Footer branding: “Raisd AI”

https://verification.limkokwing.net/cambodia/{token}

• {token} = base64(AES-256-CBC ciphertext of StdProgramID).
• URL-encoded when appended (urlencode / rawurlencode depending on script).
• Stored as qrcode.url in the SaaS. The PNG encodes qr.limkokwing.net/qrcode/{short_code}, which 302-redirects here.
• Key material in Registry + Verification PHP — ops secret; never republish. Packs currently disagree (see §5).

Raisd should treat short-code allocation as owned by the QR SaaS + campus convention — do not invent a parallel allocator in Schema without campus agreement.

• Current path: OpenSSL AES-256-CBC of StdProgramID alone (commented older path appended _timestamp_YYYYMMDD).
• Legacy: qrcode_gen1.php / early helpers used mcrypt Rijndael — obsolete; not the create-API path.
• Local-only QR: early qrcode.php built images with phpqrcode against Verification base URL — superseded by SaaS create API.

Filename pattern: {StudentID}_{ProgramCode}.png (example defaults in the current script: 601001001_PUFP.png). Served as Content-Disposition: attachment, then unlinked from the web root.

1. Campus integration, not Portal API core (Lesotho M4). Applicant Demo DEMO PDFs must not pretend to be this certificate QR path.
2. Three hops on scan: PNG → QR short URL → Verification → live campus2_cambodia via GetStudentCertInfo. Raisd Live must not break the SP or upload-type 11 cert blob join.
3. QR SaaS is shared infrastructure (namecards + marketing + certs). This dump’s certificate short-codes are Cambodia-only (KHM-PNH_); other campuses may adopt new prefixes later.
4. M5 adapter: after official cert issuance, POST create API (TLS verify on, secrets in vault). Expect idempotent “already exists” responses. Prefer documenting Cloudflare allow-lists over disabling SSL verification.
5. AES keys must match between encrypt (Registry/adapter) and decrypt (Verification). Do not ship pack keys into git; resolve live key ownership with campus ops.
6. Verification DB access is a direct MySQL read of CMS — treat as high-trust path (network allow-list, least-privilege user, no credentials in repos).

flowchart LR
  subgraph Issue["Issue path"]
    REG[Registry qrcode_gen]
    ADAPT[Future Raisd ACL]
  end
  subgraph QRSaaS["qr.limkokwing.net"]
    API[create_qrcode_api]
    REDIR["/qrcode/slug → 302"]
  end
  subgraph Verify["verification.limkokwing.net"]
    FRONT[index.php decrypt]
  end
  subgraph SoR["campus2_cambodia"]
    SP[GetStudentCertInfo]
  end
  REG --> API
  ADAPT -.-> API
  API --> REDIR
  REDIR --> FRONT
  FRONT --> SP