# QRS Training Certificates — Setup Guide

Two modules:

1. **training-certificates-backend.zip** — NestJS module (goes in your backend, next to `certificates/`)
2. **training-certificates-frontend.zip** — Next.js pages (goes in your Next.js website / admin)

Both use the SAME QR verification system as your existing company
certificates: UUID token + fingerprint, QR pointing to
`https://qrsyst.com/verify-certificate?token=...&fp=...`

---

## 1. Backend (NestJS)

1. Copy the `training-certificates/` folder into your backend `src/`
   (beside your existing `certificates/` folder).

2. Register the module in `app.module.ts`:

   ```ts
   import { TrainingCertificatesModule } from './training-certificates/training-certificates.module';

   @Module({
     imports: [
       // ...existing modules
       TrainingCertificatesModule,
     ],
   })
   ```

3. Database table:
   - If TypeORM `synchronize: true` → table is created automatically.
   - If not → run `training_certificate.sql` on the `scheme_dbs` database.

4. No new npm packages needed (`uuid`, `qrcode`, multer are already in
   your project).

### Endpoints

| Method | URL | What it does |
|---|---|---|
| POST | `/training-certificates` | Issue one certificate (auto `QRS-TRG-YY-NNN` + QR) |
| POST | `/training-certificates/batch` | Issue a whole session (many participants) |
| GET | `/training-certificates?page=&search=` | Paginated list + search |
| GET | `/training-certificates/verify?token=&fp=` | **UNIFIED public verify** — training first, then company certificates |
| GET | `/training-certificates/:id` | One certificate + QR + verification URL |
| PATCH / PUT | `/training-certificates/:id` | Update (incl. `status`: revoke / fake / active) |
| DELETE | `/training-certificates/:id` | Delete |
| POST | `/training-certificates/:id/scan` | Upload signed scan (field `scan`, JPG/PNG/PDF) → status becomes `active` |

Lifecycle: create → `pending_scan` → upload scan → `active`.
`valid_until` empty = certificate never expires.

---

## 2. Frontend (Next.js)

1. Copy the contents into your Next.js project:
   - `lib/training-api.ts` → your `lib/` folder
   - `app/verify-certificate/` → your `app/` folder ⚠️ **If you already
     have this page, back it up first.** This version handles BOTH
     company certification AND training certificates (it reads
     `record_type` from the unified endpoint).
   - `app/admin/training-certificates/` → your `app/` folder

2. Add to `.env.local`:

   ```
   NEXT_PUBLIC_API_URL=https://web.qrsyst.com
   ```

   If your NestJS uses a global prefix (`app.setGlobalPrefix('api')`),
   use `https://web.qrsyst.com/api` instead.

3. **Protect the admin routes.** These pages have no login of their own —
   put `/admin/*` behind your existing auth (middleware, basic auth, or
   however your current admin is protected).

4. **CORS**: the browser calls the NestJS API directly, so your backend
   must allow your site's origin, e.g. in `main.ts`:

   ```ts
   app.enableCors({ origin: ['https://qrsyst.com'] });
   ```

### Pages included

| Page | URL | Purpose |
|---|---|---|
| Public verify | `/verify-certificate?token=&fp=` | QR landing page — shows training OR company certificate result |
| Admin list | `/admin/training-certificates` | Search + paginated table + status + QR thumbnails |
| Admin create | `/admin/training-certificates/new` | Single OR whole-session batch issue, with QR downloads |
| Admin detail | `/admin/training-certificates/[id]` | QR download, copy verify URL, upload scan, edit, revoke/fake/delete |

Uses only Tailwind + lucide-react (already in your project) and your
site's CSS variables (`--navy`, `--primary`, `--font-montserrat`,
`section-label`).

---

## Daily workflow

1. Admin → New Certificate → fill course + participants → Issue.
2. Download the QR(s), place on the printed certificate, sign it.
3. Scan the signed copy → upload on the certificate's detail page →
   status becomes **active**.
4. Anyone scanning the QR lands on `/verify-certificate` and sees the
   participant, course, date, status, and the digital copy.