feat: QR checkin system

.env.example

@@ -48,6 +48,16 @@ SUPABASE_SERVICE_ROLE_KEY=
 # SUPABASE_SERVICE_KEY=
 
 
+# --- Entry passes (QR check-in at the venue) --------------------------------------------------------------
+# Required for entry passes. SECRET, server-only: 32 random bytes, base64. Encrypts each participant's QR token at rest
+# so POST /api/pass can show the owner the same QR on any device (the database only stores the token's SHA-256 plus
+# this ciphertext). Generate with:
+#   node -e "console.log(require('crypto').randomBytes(32).toString('base64'))"
+# Set it once and keep it: changing it makes every QR already shown undecryptable (admins would have to reissue them).
+# Use a different value per environment (production, preview, local/test).
+ENTRY_PASS_ENCRYPTION_KEY=
+
+
 # --- Site identity and search engines -------------------------------------------------------------------
 
 # Optional (public). The ONE canonical origin of the site (src/config/site.ts), no trailing slash. Used for canonical

next.config.ts

@@ -59,6 +59,14 @@ const nextConfig: NextConfig = {
           { key: "Cross-Origin-Opener-Policy", value: "same-origin" },
         ],
       },
+      {
+        // The check-in scanner needs the camera. Must stay AFTER the global "/:path*" entry: when two entries set the
+        // same header for a path, the last one wins (Next.js headers docs, "Header Overriding Behavior").
+        source: "/admin/scan",
+        headers: [
+          { key: "Permissions-Policy", value: "camera=(self), microphone=(), geolocation=(), payment=(), usb=()" },
+        ],
+      },
       {
         // API responses carry personal data and tokens: never let a browser or CDN cache them. The two public,
         // anonymous endpoints (events, gallery) are excluded and set their own cache headers.