From 22efe5e63258c64cddb50be7c43351acf65ef66c Mon Sep 17 00:00:00 2001 From: Sam Rolfe Date: Fri, 7 Aug 2026 16:37:50 +1000 Subject: [PATCH] =?UTF-8?q?Plan:=20preset=20tag-ID=20registry=20requiremen?= =?UTF-8?q?t=20(anti-scam=20=E2=80=94=20codes=20must=20match=20DB,=20no=20?= =?UTF-8?q?user-created=20codes)?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- where_woof.md | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/where_woof.md b/where_woof.md index 993f4f0..d6add9c 100644 --- a/where_woof.md +++ b/where_woof.md @@ -97,6 +97,14 @@ CREATE TABLE scans ( - Tag status: `unset` → `active` → `suspended` (admin can suspend). - Billing: **Stripe (Australia)** — **NOT in the front-end phase**; phased later. +### ⚠️ Preset tag IDs (anti-scam, confirmed 2026-08) + +Tag codes are **preset at manufacture** (printed QR + NFC) and **must match the database registry** — there are no user-created tag codes. A scanned or claimed code that does not exist in the `tags` table is rejected ("tag not found / already claimed"). The 2014 system enforced the same rule via a `productid_hash` on the QR URL — *"if productid_hash is not set we can do NO REGISTERING"* — and tied each tag to a sold product (`onlineorderproductid`). + +- The DB must be **seeded with the real manufactured tag IDs** (production list from the manufacturer, or recovered old IDs) — TEST codes are dev-only. +- Long-term (Laravel admin, Phase 4+): each tag is linked to a sold product/order for stronger validation (mirrors the old `products`/`online_order_product_details` model). +- Old product IDs from the 2014 system are **not in the .13 archive** (old live `websitebuilder` DB not preserved) — recover from the old hosting account / manufacturer list, or generate fresh IDs. + ## Endpoints — GOAT front-end | Method | Path | Purpose |