[#612] Keep check-in QR codes valid across reloads

[DVidal1205]

Why

Reloading or reopening the 2026 dashboard issued a new check-in pass and revoked the previous pass. Screenshots then appeared as invalid_qr in Blade, leaving the operator without a resolved name, date of birth, or class during peak admission.

Closes: #612

What

• reuse one check-in pass idempotency key across portal reloads and devices
• allow an older unexpired pass while the same attendee still has an active, unexpired pass
• preserve current opaque QR behavior and legacy user: QR handling
• keep withdrawal and expiration invalidation intact
• delete issued passes and the stable issuance command on withdrawal so reconfirmation gets a fresh pass without reviving old tokens
• add database coverage for current, rotated, revoked, and expired pass combinations

No schema, environment variable, or dependency changes.

Test Plan

• pnpm verify:precommit
• disposable Postgres: packages/api/src/tests/hackathon-events/check-in.test.ts (15/15 passed)
• disposable Postgres: withdrawal lifecycle test (1/1 passed)
• standard Forge review: API, placement/minimality, and test-quality reviewers reported no remaining findings

Screenshots are not applicable because this changes QR issuance and scanner validation without changing UI.

Checklist

• Database: No schema changes, OR I ran pnpm db:generate and committed the generated files in packages/db/drizzle/
• Environment Variables: No environment variables changed, OR I have contacted the Development Lead to modify them on Coolify BEFORE merging.

[coderabbitai]

📝 Walkthrough

Walkthrough

The dashboard now uses a fixed idempotency key when requesting check-in passes. Check-in lookup can resolve a revoked token when another unexpired active pass exists for the attendee. Withdrawal revokes active passes and deletes matching issuance commands. Tests cover token resolution, expiration, and command cleanup.

---

Priority: ⬆️ High

Severity of issue fixed: Medium

Merge Risk: 🟡 Moderate · up to 1bb89

Check-in QR codes now stay valid across reloads. However, a QR code invalidated by withdrawal may start working again if the attendee reconfirms. This conflicts with the stated withdrawal-invalidation guarantee and should be resolved or explicitly accepted before merge.

Pre-merge checks | 7 | 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage		Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 3 functions across 5 files.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (7 passed)

Check name	Status	Explanation
Linked Issues check		Issue #612 requires stable unexpired QR resolution, continued invalidation after withdrawal or expiration, and coding tests. The portal now uses the stable check-in-pass:v1 key. Scanner lookup accep…
Out of Scope Changes check		All changed files support issue #612. The portal key change implements stable issuance. The scanner change implements rotated-pass resolution. Withdrawal cleanup preserves fresh reissuance. The added …
No Hardcoded Secrets		No hardcoded secret was introduced. The only credential-like added literal is the public idempotency key "check-in-pass:v1"; the QR payloads are deterministic test fixtures and are hashed before dat…
Validated Env Access		No new process.env usage appears in the pull-request diff. The existing direct usages in the modified test files were already present in the base revision.
No Typescript Escape Hatches		The pull-request additions contain no any type, @ts-ignore, @ts-expect-error, or non-null assertion (!.). The only any match in the changed files is an unchanged comment present in the base …
Title check		The title starts with [#612], clearly describes the QR-code change, and is 50 characters long.
Description check		The description directly explains the QR-code issuance, validation, withdrawal, expiration, and test changes.

---

---

• Fix all pre-merge checks with AI

✨ Finishing Touches 💡 1

📝 Generate docstrings 💡

• Commit to this branch
• Create a new PR

---

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

---

---

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

---

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 1

---

ℹ️ Review info

⚙️ Run configuration

• Configuration used: Repository: KnightHacks/forge/.coderabbit.yml
• Review profile: QUIET
• Plan: Advanced
• Run ID: e7b685bb-1658-435e-8f18-3307e20e38f5

📥 Commits

Reviewing files that changed from the base of the PR and between 82b70b7 and 1bb89e3.

📒 Files selected for processing (5)

• apps/2026/src/lib/hacker-portal.tsx
• packages/api/src/hacker-portal/mutations.ts
• packages/api/src/tests/hackathon-events/check-in.test.ts
• packages/api/src/tests/integration/hacker-portal-lifecycle.test.ts
• packages/api/src/utils/hackathon-events/check-in.ts

Included review availability: This review used your included allowance. Your plan provides up to 1 included review per hour; 0 remain after this review.

CodeRabbit confirmed the finding was addressed in 2882aa4 and resolved the review thread.