Scan and decide
Guards scan a QR pass and receive an allowed or denied result with the reason: wrong event, missing permission, or an expired pass.
Identity & access · Android · Deployed in Lagos
Loveworld
Security
The right person.
The right access.
A mobile-first identification and access-management system, built for staff and event operations at Loveworld headquarters.
- Role
- Full-stack architecture and build
- Platform
- Android app with a PHP API
- In use
- Loveworld headquarters, Lagos
Core features.
Everything a checkpoint needs, from the pass in a visitor's hand to the record an administrator reviews.
Event passes
Administrators create events, register attendees, and generate passes tied to that event and its access groups.
Permissions and groups
Permissions are grouped into access groups, so a pass carries exactly the areas its holder may enter.
Staff and guard profiles
People, departments and photographs sit behind every pass. Guards have their own accounts and roles.
A traceable record
Every entry and exit is logged against the pass, the guard, and the checkpoint, then synced to the server.
Phone verification
One-time passcodes verify a phone number before an account is trusted.
Architecture
The components behind a trusted scan.
Hover or tap a component to trace its connections.
Access pass
QR credential tied to an event, its permissions and an expiry
- QR generator
- Access groups
- Guard app · QR scan
Guard app
Scanning, passes, events, guards and logs on Android
- Kotlin
- Fragments
- ViewModel
- Verification rules · pass + checkpoint
- Security API · unknown pass, logs
- Firebase · auth, config
Security API
Guards, users, events, passes, logs and OTP verification
- PHP
- CodeIgniter 4
- Auth filter
- MySQL · persist
Firebase
Sign-in, runtime configuration and field crash reports
- Auth
- Remote Config
- Crashlytics
Verification rules
Checks event, permission and expiry, and names the failed check
- Scan view model
- Local database · lookup by hash
Local database
Synced passes, events, permissions and pending logs on the device
- Room
- DataStore
- Security API · incremental sync
MySQL
The system of record administrators review
- MySQLi
All connections
- Access pass to Guard app: QR scan
- Guard app to Verification rules: pass + checkpoint
- Verification rules to Local database: lookup by hash
- Local database to Security API: incremental sync
- Guard app to Security API: unknown pass, logs
- Security API to MySQL: persist
- Guard app to Firebase: auth, config
Innovation highlights.
Innovation one
Local first, remote on demand
A scan checks the pass hash against the device database first. Only an unknown pass triggers an API lookup, and the result is cached for the next scan.
Innovation two
Decisions that explain themselves
The verifier walks event, permission and expiry in order and reports which check failed. A guard can tell a visitor why, not only that.
Innovation three
Incremental sync
The API exposes "latest after" endpoints for guards, events, permissions, passes and logs, so devices pull only what changed since their last sync.
Technology stack
What it is built with.
Android app
- Kotlin
- Fragments + Navigation
- ViewModel + LiveData
- Room
- DataStore
Scanning
- code-scanner
- ZXing
- QR generator
Network
- Retrofit
- Gson
- OkHttp logging
Platform services
- Firebase Auth
- Remote Config
- Crashlytics
Server
- PHP
- CodeIgniter 4
- MySQL
Next project