Parking and QR Code Safety

import jsQR from 'jsqr';
import sharp from 'sharp';

const SCAMVERIFY_API_KEY = process.env.SCAMVERIFY_API_KEY;
const BASE_URL = 'https://scamverify.ai/api/v1';

// Known-good domains for your parking operation
const TRUSTED_DOMAINS = new Set([
  'paybyphone.com',
  'parkmobile.io',
  'parkwhiz.com',
  'spothero.com',
]);

/**
 * Decode a QR code from an image buffer and verify the URL.
 * Returns a safety assessment before the user is redirected.
 */
async function verifyMeterQR(imageBuffer) {
  // Step 1: Decode QR code from the image
  const { data, info } = await sharp(imageBuffer)
    .ensureAlpha()
    .raw()
    .toBuffer({ resolveWithObject: true });

  const qr = jsQR(new Uint8ClampedArray(data), info.width, info.height);

  if (!qr || !qr.data) {
    return { safe: false, reason: 'NO_QR_DETECTED', message: 'No QR code found in image.' };
  }

  const decodedUrl = qr.data;

  // Step 2: Basic URL validation
  let parsedUrl;
  try {
    parsedUrl = new URL(decodedUrl);
  } catch {
    return {
      safe: false,
      reason: 'INVALID_URL',
      message: 'QR code does not contain a valid URL.',
      decoded: decodedUrl,
    };
  }

  // Step 3: Check against trusted domain list
  const domain = parsedUrl.hostname.replace(/^www\./, '');
  const isTrustedDomain = TRUSTED_DOMAINS.has(domain);

  // Step 4: Verify URL through ScamVerify™ API
  const response = await fetch(`${BASE_URL}/url/lookup`, {
    method: 'POST',
    headers: {
      'Authorization': `Bearer ${SCAMVERIFY_API_KEY}`,
      'Content-Type': 'application/json',
    },
    body: JSON.stringify({ url: decodedUrl }),
  });

  if (!response.ok) {
    throw new Error(`ScamVerify API error: ${response.status}`);
  }

  const result = await response.json();

  // Step 5: Build safety assessment
  const brandImpersonation = result.signals.brand_impersonation?.detected || false;
  const domainAgeDays = result.signals.domain_age_days;
  const isNewDomain = domainAgeDays !== null && domainAgeDays < 30;
  const isThreatListed = result.signals.urlhaus_listed || result.signals.threatfox_listed;

  const assessment = {
    safe: result.risk_score < 40 && !brandImpersonation && !isThreatListed,
    url: decodedUrl,
    domain,
    isTrustedDomain,
    riskScore: result.risk_score,
    verdict: result.verdict,
    explanation: result.explanation,
    warnings: [],
  };

  if (brandImpersonation) {
    assessment.warnings.push(
      `This domain may be impersonating ${result.signals.brand_impersonation.brand}. ` +
      `Verify the URL carefully before entering payment information.`
    );
  }

  if (isNewDomain) {
    assessment.warnings.push(
      `This domain was registered ${domainAgeDays} day(s) ago. ` +
      `Legitimate parking services typically have well-established domains.`
    );
  }

  if (isThreatListed) {
    assessment.warnings.push(
      'This URL appears in known malware or threat intelligence databases. Do not proceed.'
    );
  }

  if (!isTrustedDomain && result.risk_score < 40) {
    assessment.warnings.push(
      'This domain is not on your trusted parking provider list. Verify with the meter operator.'
    );
  }

  return assessment;
}

// Usage in an Express-based parking app
app.post('/api/verify-meter', async (req, res) => {
  const { imageBase64 } = req.body;
  const imageBuffer = Buffer.from(imageBase64, 'base64');

  const assessment = await verifyMeterQR(imageBuffer);

  if (!assessment.safe) {
    // Log the suspicious QR for the parking operator
    await logSuspiciousMeter({
      location: req.body.meterLocation,
      url: assessment.url,
      riskScore: assessment.riskScore,
      warnings: assessment.warnings,
      timestamp: new Date().toISOString(),
    });
  }

  return res.json(assessment);
});

import requests
import os

SCAMVERIFY_API_KEY = os.environ["SCAMVERIFY_API_KEY"]
BASE_URL = "https://scamverify.ai/api/v1"

# Your known-good menu domain
EXPECTED_DOMAIN = "yourvenue.com"


def verify_menu_qr(decoded_url: str, table_id: str) -> dict:
    """
    Verify a decoded QR code URL against the expected domain
    and ScamVerify™ threat intelligence.
    """
    from urllib.parse import urlparse

    parsed = urlparse(decoded_url)
    domain = parsed.hostname.replace("www.", "") if parsed.hostname else ""

    # Quick check: does it match the expected domain?
    domain_matches = domain == EXPECTED_DOMAIN

    # Full verification through ScamVerify™
    response = requests.post(
        f"{BASE_URL}/url/lookup",
        headers={
            "Authorization": f"Bearer {SCAMVERIFY_API_KEY}",
            "Content-Type": "application/json",
        },
        json={"url": decoded_url},
    )
    response.raise_for_status()
    result = response.json()

    is_safe = (
        result["risk_score"] < 30
        and domain_matches
        and not result["signals"].get("brand_impersonation", {}).get("detected", False)
    )

    return {
        "table_id": table_id,
        "url": decoded_url,
        "domain_matches_expected": domain_matches,
        "risk_score": result["risk_score"],
        "verdict": result["verdict"],
        "is_safe": is_safe,
        "action": "ok" if is_safe else "replace_qr_code",
        "explanation": result["explanation"],
    }


# Periodic scan of all venue QR codes
venue_qr_codes = [
    {"url": "https://yourvenue.com/menu/table-1", "table": "T1"},
    {"url": "https://yourvenue.com/menu/table-2", "table": "T2"},
    {"url": "https://y0urvenue.com/menu/table-3", "table": "T3"},  # Tampered
]

for qr in venue_qr_codes:
    result = verify_menu_qr(qr["url"], qr["table"])
    if not result["is_safe"]:
        print(f"ALERT: Table {result['table_id']} QR code compromised!")
        print(f"  URL: {result['url']}")
        print(f"  Risk score: {result['risk_score']}")
        print(f"  Action: {result['action']}")