Scanning and incoming links
A venue QR code can encode a controlled HTTPS destination for a venue or table. The native scanner adapter and URL resolver exist, but camera permission and QR scanning are not proven in a signed Capacitor device build. The presenter can simulate entering a table via QR/NFC example links.
NFC foreground scanning has no finished customer screen or reader integration. Background HTTPS NDEF handling requires validated Android/iOS app association. Unknown or unsafe QR destinations must be rejected.
Why HSLG scans codes
A venue or table QR code offers a faster way to enter a location than typing a table number. The code must represent a controlled HTTPS destination and may identify a venue and table; it does not authorize an account, permit payment or prove physical presence. A user may scan a code printed in the venue or open an associated application URL from another app. Both entry paths must pass the same destination validation.
Customer steps
Check the displayed venue. Select the table-scan action. If the phone requests camera access, approve it only if scanning is wanted. Aim the camera at a printed QR; a valid code should resolve to the appropriate venue/table ordering context. On cancellation or permission denial, return safely to manual table selection. If the code points to an unknown host, malformed path or unexpected venue, show an explanatory error and leave the prior basket/table unchanged.
What is implemented today
The source has a shared URL resolver, table-scan UI entry and a Capacitor Barcode Scanner adapter that requests rear-camera QR scans. It also registers incoming application URLs through Capacitor App. These are genuine source adapters, but not yet proven by a compiled and device-tested Capacitor APK. The WordPress presenter can simulate the destination for UI review; that simulated scan is not real camera proof.
NFC and app links
Foreground NFC reading is not yet implemented as a native reader and currently rejects its request. Android may open a validated HTTPS NDEF tag through system app links, but that requires the right tag payload and verified site association. It is not the same as pressing a Scan NFC button inside the app. The owner still needs to approve the customer gesture, error/fallback design and tag management. Do not invent a redeem/reward operation based solely on the NFC data.
Testing requirements
Test valid table codes for each venue, altered and off-domain URLs, wrong-venue codes, camera denial, cancel, poor lighting, cold-start app links and an app link received while HSLG is already open. Confirm the OS chooses the signed application after HTTPS association. If the app opens in a browser instead, examine Android association and package signatures before changing the shared router. Record APK and Android OS versions with each test.