chore: initial Laravel 13 project setup for eCert MBIP

- Laravel 13.9 + PHP 8.5 + MySQL
- Bootstrap 5.3 + jQuery 3.7 + Chart.js (replacing Alpine/Tailwind)
- Packages: intervention/image, dompdf, simple-qrcode, league/csv, laravel/breeze, laravel/boost
- 17 database migrations: users, programs, qr_codes, participants, attendances, certificates, questionnaires, email_logs, audit_logs
- 13 Eloquent models with full relationships
- Admin layout (Bootstrap 5 sidebar) + public layout (mobile-first)
- Rate limiters: checkin (60/min), certificate (30/min)
- Admin seeder: admin@mbip.gov.my
- Storage directories + symlink configured

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

app/Http/Controllers/Admin/CertificateController.php

@@ -0,0 +1,11 @@
+<?php
+
+namespace App\Http\Controllers\Admin;
+
+use App\Http\Controllers\Controller;
+use Illuminate\Http\Request;
+
+class CertificateController extends Controller
+{
+    //
+}

app/Http/Controllers/Admin/CertificateTemplateController.php

@@ -0,0 +1,11 @@
+<?php
+
+namespace App\Http\Controllers\Admin;
+
+use App\Http\Controllers\Controller;
+use Illuminate\Http\Request;
+
+class CertificateTemplateController extends Controller
+{
+    //
+}

app/Http/Controllers/Admin/DashboardController.php

@@ -0,0 +1,36 @@
+<?php
+
+namespace App\Http\Controllers\Admin;
+
+use App\Http\Controllers\Controller;
+use App\Models\Attendance;
+use App\Models\Certificate;
+use App\Models\EmailLog;
+use App\Models\Participant;
+use App\Models\Program;
+use App\Models\QuestionnaireResponse;
+
+class DashboardController extends Controller
+{
+    public function index()
+    {
+        $stats = [
+            'total_programs'      => Program::count(),
+            'active_programs'     => Program::where('status', 'published')->count(),
+            'total_participants'  => Participant::count(),
+            'total_attendances'   => Attendance::count(),
+            'total_certificates'  => Certificate::count(),
+            'generated_certs'     => Certificate::whereIn('status', ['generated', 'emailed', 'downloaded'])->count(),
+            'downloaded_certs'    => Certificate::where('status', 'downloaded')->count(),
+            'total_responses'     => QuestionnaireResponse::count(),
+            'pending_emails'      => EmailLog::where('status', 'pending')->count(),
+        ];
+
+        $recentPrograms = Program::with('creator')
+            ->latest()
+            ->limit(5)
+            ->get();
+
+        return view('admin.dashboard', compact('stats', 'recentPrograms'));
+    }
+}

app/Http/Controllers/Admin/ParticipantController.php

@@ -0,0 +1,11 @@
+<?php
+
+namespace App\Http\Controllers\Admin;
+
+use App\Http\Controllers\Controller;
+use Illuminate\Http\Request;
+
+class ParticipantController extends Controller
+{
+    //
+}

app/Http/Controllers/Admin/ProgramController.php

@@ -0,0 +1,65 @@
+<?php
+
+namespace App\Http\Controllers\Admin;
+
+use App\Http\Controllers\Controller;
+use Illuminate\Http\Request;
+
+class ProgramController extends Controller
+{
+    /**
+     * Display a listing of the resource.
+     */
+    public function index()
+    {
+        //
+    }
+
+    /**
+     * Show the form for creating a new resource.
+     */
+    public function create()
+    {
+        //
+    }
+
+    /**
+     * Store a newly created resource in storage.
+     */
+    public function store(Request $request)
+    {
+        //
+    }
+
+    /**
+     * Display the specified resource.
+     */
+    public function show(string $id)
+    {
+        //
+    }
+
+    /**
+     * Show the form for editing the specified resource.
+     */
+    public function edit(string $id)
+    {
+        //
+    }
+
+    /**
+     * Update the specified resource in storage.
+     */
+    public function update(Request $request, string $id)
+    {
+        //
+    }
+
+    /**
+     * Remove the specified resource from storage.
+     */
+    public function destroy(string $id)
+    {
+        //
+    }
+}

app/Http/Controllers/Admin/ProgramQuestionnaireController.php

@@ -0,0 +1,11 @@
+<?php
+
+namespace App\Http\Controllers\Admin;
+
+use App\Http\Controllers\Controller;
+use Illuminate\Http\Request;
+
+class ProgramQuestionnaireController extends Controller
+{
+    //
+}

app/Http/Controllers/Admin/QrCodeController.php

@@ -0,0 +1,11 @@
+<?php
+
+namespace App\Http\Controllers\Admin;
+
+use App\Http\Controllers\Controller;
+use Illuminate\Http\Request;
+
+class QrCodeController extends Controller
+{
+    //
+}

app/Http/Controllers/Admin/QuestionController.php

@@ -0,0 +1,11 @@
+<?php
+
+namespace App\Http\Controllers\Admin;
+
+use App\Http\Controllers\Controller;
+use Illuminate\Http\Request;
+
+class QuestionController extends Controller
+{
+    //
+}

app/Http/Controllers/Admin/QuestionnaireSetController.php

@@ -0,0 +1,65 @@
+<?php
+
+namespace App\Http\Controllers\Admin;
+
+use App\Http\Controllers\Controller;
+use Illuminate\Http\Request;
+
+class QuestionnaireSetController extends Controller
+{
+    /**
+     * Display a listing of the resource.
+     */
+    public function index()
+    {
+        //
+    }
+
+    /**
+     * Show the form for creating a new resource.
+     */
+    public function create()
+    {
+        //
+    }
+
+    /**
+     * Store a newly created resource in storage.
+     */
+    public function store(Request $request)
+    {
+        //
+    }
+
+    /**
+     * Display the specified resource.
+     */
+    public function show(string $id)
+    {
+        //
+    }
+
+    /**
+     * Show the form for editing the specified resource.
+     */
+    public function edit(string $id)
+    {
+        //
+    }
+
+    /**
+     * Update the specified resource in storage.
+     */
+    public function update(Request $request, string $id)
+    {
+        //
+    }
+
+    /**
+     * Remove the specified resource from storage.
+     */
+    public function destroy(string $id)
+    {
+        //
+    }
+}

app/Http/Controllers/Admin/StatisticsController.php

@@ -0,0 +1,11 @@
+<?php
+
+namespace App\Http\Controllers\Admin;
+
+use App\Http\Controllers\Controller;
+use Illuminate\Http\Request;
+
+class StatisticsController extends Controller
+{
+    //
+}

app/Http/Controllers/Auth/AuthenticatedSessionController.php

@@ -0,0 +1,47 @@
+<?php
+
+namespace App\Http\Controllers\Auth;
+
+use App\Http\Controllers\Controller;
+use App\Http\Requests\Auth\LoginRequest;
+use Illuminate\Http\RedirectResponse;
+use Illuminate\Http\Request;
+use Illuminate\Support\Facades\Auth;
+use Illuminate\View\View;
+
+class AuthenticatedSessionController extends Controller
+{
+    /**
+     * Display the login view.
+     */
+    public function create(): View
+    {
+        return view('auth.login');
+    }
+
+    /**
+     * Handle an incoming authentication request.
+     */
+    public function store(LoginRequest $request): RedirectResponse
+    {
+        $request->authenticate();
+
+        $request->session()->regenerate();
+
+        return redirect()->intended(route('admin.dashboard', absolute: false));
+    }
+
+    /**
+     * Destroy an authenticated session.
+     */
+    public function destroy(Request $request): RedirectResponse
+    {
+        Auth::guard('web')->logout();
+
+        $request->session()->invalidate();
+
+        $request->session()->regenerateToken();
+
+        return redirect('/');
+    }
+}

app/Http/Controllers/Auth/ConfirmablePasswordController.php

@@ -0,0 +1,40 @@
+<?php
+
+namespace App\Http\Controllers\Auth;
+
+use App\Http\Controllers\Controller;
+use Illuminate\Http\RedirectResponse;
+use Illuminate\Http\Request;
+use Illuminate\Support\Facades\Auth;
+use Illuminate\Validation\ValidationException;
+use Illuminate\View\View;
+
+class ConfirmablePasswordController extends Controller
+{
+    /**
+     * Show the confirm password view.
+     */
+    public function show(): View
+    {
+        return view('auth.confirm-password');
+    }
+
+    /**
+     * Confirm the user's password.
+     */
+    public function store(Request $request): RedirectResponse
+    {
+        if (! Auth::guard('web')->validate([
+            'email' => $request->user()->email,
+            'password' => $request->password,
+        ])) {
+            throw ValidationException::withMessages([
+                'password' => __('auth.password'),
+            ]);
+        }
+
+        $request->session()->put('auth.password_confirmed_at', time());
+
+        return redirect()->intended(route('dashboard', absolute: false));
+    }
+}

app/Http/Controllers/Auth/EmailVerificationNotificationController.php

@@ -0,0 +1,24 @@
+<?php
+
+namespace App\Http\Controllers\Auth;
+
+use App\Http\Controllers\Controller;
+use Illuminate\Http\RedirectResponse;
+use Illuminate\Http\Request;
+
+class EmailVerificationNotificationController extends Controller
+{
+    /**
+     * Send a new email verification notification.
+     */
+    public function store(Request $request): RedirectResponse
+    {
+        if ($request->user()->hasVerifiedEmail()) {
+            return redirect()->intended(route('dashboard', absolute: false));
+        }
+
+        $request->user()->sendEmailVerificationNotification();
+
+        return back()->with('status', 'verification-link-sent');
+    }
+}

app/Http/Controllers/Auth/EmailVerificationPromptController.php

@@ -0,0 +1,21 @@
+<?php
+
+namespace App\Http\Controllers\Auth;
+
+use App\Http\Controllers\Controller;
+use Illuminate\Http\RedirectResponse;
+use Illuminate\Http\Request;
+use Illuminate\View\View;
+
+class EmailVerificationPromptController extends Controller
+{
+    /**
+     * Display the email verification prompt.
+     */
+    public function __invoke(Request $request): RedirectResponse|View
+    {
+        return $request->user()->hasVerifiedEmail()
+                    ? redirect()->intended(route('dashboard', absolute: false))
+                    : view('auth.verify-email');
+    }
+}

app/Http/Controllers/Auth/NewPasswordController.php

@@ -0,0 +1,63 @@
+<?php
+
+namespace App\Http\Controllers\Auth;
+
+use App\Http\Controllers\Controller;
+use App\Models\User;
+use Illuminate\Auth\Events\PasswordReset;
+use Illuminate\Http\RedirectResponse;
+use Illuminate\Http\Request;
+use Illuminate\Support\Facades\Hash;
+use Illuminate\Support\Facades\Password;
+use Illuminate\Support\Str;
+use Illuminate\Validation\Rules;
+use Illuminate\Validation\ValidationException;
+use Illuminate\View\View;
+
+class NewPasswordController extends Controller
+{
+    /**
+     * Display the password reset view.
+     */
+    public function create(Request $request): View
+    {
+        return view('auth.reset-password', ['request' => $request]);
+    }
+
+    /**
+     * Handle an incoming new password request.
+     *
+     * @throws ValidationException
+     */
+    public function store(Request $request): RedirectResponse
+    {
+        $request->validate([
+            'token' => ['required'],
+            'email' => ['required', 'email'],
+            'password' => ['required', 'confirmed', Rules\Password::defaults()],
+        ]);
+
+        // Here we will attempt to reset the user's password. If it is successful we
+        // will update the password on an actual user model and persist it to the
+        // database. Otherwise we will parse the error and return the response.
+        $status = Password::reset(
+            $request->only('email', 'password', 'password_confirmation', 'token'),
+            function (User $user) use ($request) {
+                $user->forceFill([
+                    'password' => Hash::make($request->password),
+                    'remember_token' => Str::random(60),
+                ])->save();
+
+                event(new PasswordReset($user));
+            }
+        );
+
+        // If the password was successfully reset, we will redirect the user back to
+        // the application's home authenticated view. If there is an error we can
+        // redirect them back to where they came from with their error message.
+        return $status == Password::PASSWORD_RESET
+                    ? redirect()->route('login')->with('status', __($status))
+                    : back()->withInput($request->only('email'))
+                        ->withErrors(['email' => __($status)]);
+    }
+}

app/Http/Controllers/Auth/PasswordController.php

@@ -0,0 +1,29 @@
+<?php
+
+namespace App\Http\Controllers\Auth;
+
+use App\Http\Controllers\Controller;
+use Illuminate\Http\RedirectResponse;
+use Illuminate\Http\Request;
+use Illuminate\Support\Facades\Hash;
+use Illuminate\Validation\Rules\Password;
+
+class PasswordController extends Controller
+{
+    /**
+     * Update the user's password.
+     */
+    public function update(Request $request): RedirectResponse
+    {
+        $validated = $request->validateWithBag('updatePassword', [
+            'current_password' => ['required', 'current_password'],
+            'password' => ['required', Password::defaults(), 'confirmed'],
+        ]);
+
+        $request->user()->update([
+            'password' => Hash::make($validated['password']),
+        ]);
+
+        return back()->with('status', 'password-updated');
+    }
+}

app/Http/Controllers/Auth/PasswordResetLinkController.php

@@ -0,0 +1,45 @@
+<?php
+
+namespace App\Http\Controllers\Auth;
+
+use App\Http\Controllers\Controller;
+use Illuminate\Http\RedirectResponse;
+use Illuminate\Http\Request;
+use Illuminate\Support\Facades\Password;
+use Illuminate\Validation\ValidationException;
+use Illuminate\View\View;
+
+class PasswordResetLinkController extends Controller
+{
+    /**
+     * Display the password reset link request view.
+     */
+    public function create(): View
+    {
+        return view('auth.forgot-password');
+    }
+
+    /**
+     * Handle an incoming password reset link request.
+     *
+     * @throws ValidationException
+     */
+    public function store(Request $request): RedirectResponse
+    {
+        $request->validate([
+            'email' => ['required', 'email'],
+        ]);
+
+        // We will send the password reset link to this user. Once we have attempted
+        // to send the link, we will examine the response then see the message we
+        // need to show to the user. Finally, we'll send out a proper response.
+        $status = Password::sendResetLink(
+            $request->only('email')
+        );
+
+        return $status == Password::RESET_LINK_SENT
+                    ? back()->with('status', __($status))
+                    : back()->withInput($request->only('email'))
+                        ->withErrors(['email' => __($status)]);
+    }
+}

app/Http/Controllers/Auth/RegisteredUserController.php

@@ -0,0 +1,51 @@
+<?php
+
+namespace App\Http\Controllers\Auth;
+
+use App\Http\Controllers\Controller;
+use App\Models\User;
+use Illuminate\Auth\Events\Registered;
+use Illuminate\Http\RedirectResponse;
+use Illuminate\Http\Request;
+use Illuminate\Support\Facades\Auth;
+use Illuminate\Support\Facades\Hash;
+use Illuminate\Validation\Rules;
+use Illuminate\Validation\ValidationException;
+use Illuminate\View\View;
+
+class RegisteredUserController extends Controller
+{
+    /**
+     * Display the registration view.
+     */
+    public function create(): View
+    {
+        return view('auth.register');
+    }
+
+    /**
+     * Handle an incoming registration request.
+     *
+     * @throws ValidationException
+     */
+    public function store(Request $request): RedirectResponse
+    {
+        $request->validate([
+            'name' => ['required', 'string', 'max:255'],
+            'email' => ['required', 'string', 'lowercase', 'email', 'max:255', 'unique:'.User::class],
+            'password' => ['required', 'confirmed', Rules\Password::defaults()],
+        ]);
+
+        $user = User::create([
+            'name' => $request->name,
+            'email' => $request->email,
+            'password' => Hash::make($request->password),
+        ]);
+
+        event(new Registered($user));
+
+        Auth::login($user);
+
+        return redirect(route('dashboard', absolute: false));
+    }
+}

app/Http/Controllers/Auth/VerifyEmailController.php

@@ -0,0 +1,27 @@
+<?php
+
+namespace App\Http\Controllers\Auth;
+
+use App\Http\Controllers\Controller;
+use Illuminate\Auth\Events\Verified;
+use Illuminate\Foundation\Auth\EmailVerificationRequest;
+use Illuminate\Http\RedirectResponse;
+
+class VerifyEmailController extends Controller
+{
+    /**
+     * Mark the authenticated user's email address as verified.
+     */
+    public function __invoke(EmailVerificationRequest $request): RedirectResponse
+    {
+        if ($request->user()->hasVerifiedEmail()) {
+            return redirect()->intended(route('dashboard', absolute: false).'?verified=1');
+        }
+
+        if ($request->user()->markEmailAsVerified()) {
+            event(new Verified($request->user()));
+        }
+
+        return redirect()->intended(route('dashboard', absolute: false).'?verified=1');
+    }
+}

app/Http/Controllers/Controller.php

@@ -0,0 +1,8 @@
+<?php
+
+namespace App\Http\Controllers;
+
+abstract class Controller
+{
+    //
+}

app/Http/Controllers/ProfileController.php

@@ -0,0 +1,60 @@
+<?php
+
+namespace App\Http\Controllers;
+
+use App\Http\Requests\ProfileUpdateRequest;
+use Illuminate\Http\RedirectResponse;
+use Illuminate\Http\Request;
+use Illuminate\Support\Facades\Auth;
+use Illuminate\Support\Facades\Redirect;
+use Illuminate\View\View;
+
+class ProfileController extends Controller
+{
+    /**
+     * Display the user's profile form.
+     */
+    public function edit(Request $request): View
+    {
+        return view('profile.edit', [
+            'user' => $request->user(),
+        ]);
+    }
+
+    /**
+     * Update the user's profile information.
+     */
+    public function update(ProfileUpdateRequest $request): RedirectResponse
+    {
+        $request->user()->fill($request->validated());
+
+        if ($request->user()->isDirty('email')) {
+            $request->user()->email_verified_at = null;
+        }
+
+        $request->user()->save();
+
+        return Redirect::route('profile.edit')->with('status', 'profile-updated');
+    }
+
+    /**
+     * Delete the user's account.
+     */
+    public function destroy(Request $request): RedirectResponse
+    {
+        $request->validateWithBag('userDeletion', [
+            'password' => ['required', 'current_password'],
+        ]);
+
+        $user = $request->user();
+
+        Auth::logout();
+
+        $user->delete();
+
+        $request->session()->invalidate();
+        $request->session()->regenerateToken();
+
+        return Redirect::to('/');
+    }
+}

app/Http/Controllers/Public/AttendanceCheckController.php

@@ -0,0 +1,11 @@
+<?php
+
+namespace App\Http\Controllers\Public;
+
+use App\Http\Controllers\Controller;
+use Illuminate\Http\Request;
+
+class AttendanceCheckController extends Controller
+{
+    //
+}

app/Http/Controllers/Public/CertificateController.php

@@ -0,0 +1,11 @@
+<?php
+
+namespace App\Http\Controllers\Public;
+
+use App\Http\Controllers\Controller;
+use Illuminate\Http\Request;
+
+class CertificateController extends Controller
+{
+    //
+}

app/Http/Controllers/Public/CheckinController.php

@@ -0,0 +1,11 @@
+<?php
+
+namespace App\Http\Controllers\Public;
+
+use App\Http\Controllers\Controller;
+use Illuminate\Http\Request;
+
+class CheckinController extends Controller
+{
+    //
+}

app/Http/Controllers/Public/QuestionnaireController.php

@@ -0,0 +1,11 @@
+<?php
+
+namespace App\Http\Controllers\Public;
+
+use App\Http\Controllers\Controller;
+use Illuminate\Http\Request;
+
+class QuestionnaireController extends Controller
+{
+    //
+}

app/Http/Requests/Auth/LoginRequest.php

@@ -0,0 +1,86 @@
+<?php
+
+namespace App\Http\Requests\Auth;
+
+use Illuminate\Auth\Events\Lockout;
+use Illuminate\Contracts\Validation\ValidationRule;
+use Illuminate\Foundation\Http\FormRequest;
+use Illuminate\Support\Facades\Auth;
+use Illuminate\Support\Facades\RateLimiter;
+use Illuminate\Support\Str;
+use Illuminate\Validation\ValidationException;
+
+class LoginRequest extends FormRequest
+{
+    /**
+     * Determine if the user is authorized to make this request.
+     */
+    public function authorize(): bool
+    {
+        return true;
+    }
+
+    /**
+     * Get the validation rules that apply to the request.
+     *
+     * @return array<string, ValidationRule|array<mixed>|string>
+     */
+    public function rules(): array
+    {
+        return [
+            'email' => ['required', 'string', 'email'],
+            'password' => ['required', 'string'],
+        ];
+    }
+
+    /**
+     * Attempt to authenticate the request's credentials.
+     *
+     * @throws ValidationException
+     */
+    public function authenticate(): void
+    {
+        $this->ensureIsNotRateLimited();
+
+        if (! Auth::attempt($this->only('email', 'password'), $this->boolean('remember'))) {
+            RateLimiter::hit($this->throttleKey());
+
+            throw ValidationException::withMessages([
+                'email' => trans('auth.failed'),
+            ]);
+        }
+
+        RateLimiter::clear($this->throttleKey());
+    }
+
+    /**
+     * Ensure the login request is not rate limited.
+     *
+     * @throws ValidationException
+     */
+    public function ensureIsNotRateLimited(): void
+    {
+        if (! RateLimiter::tooManyAttempts($this->throttleKey(), 5)) {
+            return;
+        }
+
+        event(new Lockout($this));
+
+        $seconds = RateLimiter::availableIn($this->throttleKey());
+
+        throw ValidationException::withMessages([
+            'email' => trans('auth.throttle', [
+                'seconds' => $seconds,
+                'minutes' => ceil($seconds / 60),
+            ]),
+        ]);
+    }
+
+    /**
+     * Get the rate limiting throttle key for the request.
+     */
+    public function throttleKey(): string
+    {
+        return Str::transliterate(Str::lower($this->string('email')).'|'.$this->ip());
+    }
+}

app/Http/Requests/ProfileUpdateRequest.php

@@ -0,0 +1,31 @@
+<?php
+
+namespace App\Http\Requests;
+
+use App\Models\User;
+use Illuminate\Contracts\Validation\ValidationRule;
+use Illuminate\Foundation\Http\FormRequest;
+use Illuminate\Validation\Rule;
+
+class ProfileUpdateRequest extends FormRequest
+{
+    /**
+     * Get the validation rules that apply to the request.
+     *
+     * @return array<string, ValidationRule|array<mixed>|string>
+     */
+    public function rules(): array
+    {
+        return [
+            'name' => ['required', 'string', 'max:255'],
+            'email' => [
+                'required',
+                'string',
+                'lowercase',
+                'email',
+                'max:255',
+                Rule::unique(User::class)->ignore($this->user()->id),
+            ],
+        ];
+    }
+}

app/Models/Attendance.php

@@ -0,0 +1,34 @@
+<?php
+
+namespace App\Models;
+
+use Illuminate\Database\Eloquent\Model;
+
+class Attendance extends Model
+{
+    protected $fillable = [
+        'program_id', 'participant_id', 'program_participant_id',
+        'attendance_source', 'attendance_session',
+        'checked_in_at', 'checked_in_ip', 'user_agent', 'notes',
+    ];
+
+    protected function casts(): array
+    {
+        return ['checked_in_at' => 'datetime'];
+    }
+
+    public function program()
+    {
+        return $this->belongsTo(Program::class);
+    }
+
+    public function participant()
+    {
+        return $this->belongsTo(Participant::class);
+    }
+
+    public function programParticipant()
+    {
+        return $this->belongsTo(ProgramParticipant::class);
+    }
+}

app/Models/AuditLog.php

@@ -0,0 +1,31 @@
+<?php
+
+namespace App\Models;
+
+use Illuminate\Database\Eloquent\Model;
+
+class AuditLog extends Model
+{
+    protected $fillable = [
+        'user_id', 'action', 'auditable_type', 'auditable_id',
+        'old_values', 'new_values', 'ip_address', 'user_agent',
+    ];
+
+    protected function casts(): array
+    {
+        return [
+            'old_values' => 'array',
+            'new_values' => 'array',
+        ];
+    }
+
+    public function user()
+    {
+        return $this->belongsTo(User::class);
+    }
+
+    public function auditable()
+    {
+        return $this->morphTo();
+    }
+}

app/Models/Certificate.php

@@ -0,0 +1,67 @@
+<?php
+
+namespace App\Models;
+
+use Illuminate\Database\Eloquent\Model;
+use Illuminate\Support\Str;
+
+class Certificate extends Model
+{
+    protected $fillable = [
+        'uuid', 'program_id', 'participant_id', 'certificate_template_id',
+        'certificate_no', 'file_path', 'token', 'status', 'error_message',
+        'generated_at', 'emailed_at', 'downloaded_at', 'download_count',
+    ];
+
+    protected function casts(): array
+    {
+        return [
+            'generated_at'   => 'datetime',
+            'emailed_at'     => 'datetime',
+            'downloaded_at'  => 'datetime',
+            'download_count' => 'integer',
+        ];
+    }
+
+    protected static function boot(): void
+    {
+        parent::boot();
+        static::creating(function ($model) {
+            $model->uuid  ??= (string) Str::uuid();
+            $model->token ??= Str::random(48);
+        });
+    }
+
+    public function program()
+    {
+        return $this->belongsTo(Program::class);
+    }
+
+    public function participant()
+    {
+        return $this->belongsTo(Participant::class);
+    }
+
+    public function template()
+    {
+        return $this->belongsTo(CertificateTemplate::class, 'certificate_template_id');
+    }
+
+    public function emailLogs()
+    {
+        return $this->hasMany(EmailLog::class);
+    }
+
+    public function isGenerated(): bool
+    {
+        return $this->status === 'generated' || $this->status === 'emailed' || $this->status === 'downloaded';
+    }
+
+    public function recordDownload(): void
+    {
+        $this->increment('download_count');
+        if (! $this->downloaded_at) {
+            $this->update(['downloaded_at' => now(), 'status' => 'downloaded']);
+        }
+    }
+}

app/Models/CertificateTemplate.php

@@ -0,0 +1,40 @@
+<?php
+
+namespace App\Models;
+
+use Illuminate\Database\Eloquent\Model;
+
+class CertificateTemplate extends Model
+{
+    protected $fillable = [
+        'program_id', 'original_filename', 'image_path', 'config_json', 'is_active', 'uploaded_by',
+    ];
+
+    protected function casts(): array
+    {
+        return [
+            'config_json' => 'array',
+            'is_active'   => 'boolean',
+        ];
+    }
+
+    public function program()
+    {
+        return $this->belongsTo(Program::class);
+    }
+
+    public function uploader()
+    {
+        return $this->belongsTo(User::class, 'uploaded_by');
+    }
+
+    public function certificates()
+    {
+        return $this->hasMany(Certificate::class);
+    }
+
+    public function getFieldConfig(string $field): ?array
+    {
+        return $this->config_json['fields'][$field] ?? null;
+    }
+}

app/Models/EmailLog.php

@@ -0,0 +1,33 @@
+<?php
+
+namespace App\Models;
+
+use Illuminate\Database\Eloquent\Model;
+
+class EmailLog extends Model
+{
+    protected $fillable = [
+        'program_id', 'participant_id', 'certificate_id',
+        'recipient_email', 'subject', 'email_type', 'status', 'error_message', 'sent_at',
+    ];
+
+    protected function casts(): array
+    {
+        return ['sent_at' => 'datetime'];
+    }
+
+    public function program()
+    {
+        return $this->belongsTo(Program::class);
+    }
+
+    public function participant()
+    {
+        return $this->belongsTo(Participant::class);
+    }
+
+    public function certificate()
+    {
+        return $this->belongsTo(Certificate::class);
+    }
+}

app/Models/Participant.php

@@ -0,0 +1,62 @@
+<?php
+
+namespace App\Models;
+
+use Illuminate\Database\Eloquent\Model;
+use Illuminate\Database\Eloquent\Factories\HasFactory;
+use Illuminate\Support\Str;
+
+class Participant extends Model
+{
+    use HasFactory;
+
+    protected $fillable = [
+        'uuid', 'name', 'no_kp', 'email', 'phone', 'agency', 'participant_type',
+    ];
+
+    protected static function boot(): void
+    {
+        parent::boot();
+        static::creating(fn($model) => $model->uuid ??= (string) Str::uuid());
+    }
+
+    public function programs()
+    {
+        return $this->belongsToMany(Program::class, 'program_participants')
+                    ->withPivot(['registration_source', 'is_pre_registered', 'pre_registered_session', 'status', 'registered_at'])
+                    ->withTimestamps();
+    }
+
+    public function programParticipants()
+    {
+        return $this->hasMany(ProgramParticipant::class);
+    }
+
+    public function attendances()
+    {
+        return $this->hasMany(Attendance::class);
+    }
+
+    public function certificates()
+    {
+        return $this->hasMany(Certificate::class);
+    }
+
+    public function questionnaireResponses()
+    {
+        return $this->hasMany(QuestionnaireResponse::class);
+    }
+
+    public function attendanceForProgram(int $programId): ?Attendance
+    {
+        return $this->attendances()->where('program_id', $programId)->first();
+    }
+
+    public function hasAnsweredQuestionnaire(int $programId, int $questionnaireSetId): bool
+    {
+        return $this->questionnaireResponses()
+                    ->where('program_id', $programId)
+                    ->where('questionnaire_set_id', $questionnaireSetId)
+                    ->exists();
+    }
+}

app/Models/Program.php

@@ -0,0 +1,122 @@
+<?php
+
+namespace App\Models;
+
+use Illuminate\Database\Eloquent\Model;
+use Illuminate\Database\Eloquent\Factories\HasFactory;
+use Illuminate\Support\Str;
+
+class Program extends Model
+{
+    use HasFactory;
+
+    protected $fillable = [
+        'uuid', 'title', 'description', 'organizer', 'location',
+        'start_date', 'end_date',
+        'checkin_start_at', 'checkin_end_at',
+        'ecert_download_start_at', 'ecert_download_end_at',
+        'status', 'allow_walk_in',
+        'default_staff_session', 'default_external_session',
+        'created_by',
+    ];
+
+    protected function casts(): array
+    {
+        return [
+            'start_date'              => 'date',
+            'end_date'                => 'date',
+            'checkin_start_at'        => 'datetime',
+            'checkin_end_at'          => 'datetime',
+            'ecert_download_start_at' => 'datetime',
+            'ecert_download_end_at'   => 'datetime',
+            'allow_walk_in'           => 'boolean',
+        ];
+    }
+
+    protected static function boot(): void
+    {
+        parent::boot();
+        static::creating(fn($model) => $model->uuid ??= (string) Str::uuid());
+    }
+
+    public function getRouteKeyName(): string
+    {
+        return 'uuid';
+    }
+
+    public function creator()
+    {
+        return $this->belongsTo(User::class, 'created_by');
+    }
+
+    public function qrCode()
+    {
+        return $this->hasOne(ProgramQrCode::class)->where('is_active', true)->latestOfMany();
+    }
+
+    public function qrCodes()
+    {
+        return $this->hasMany(ProgramQrCode::class);
+    }
+
+    public function participants()
+    {
+        return $this->belongsToMany(Participant::class, 'program_participants')
+                    ->withPivot(['registration_source', 'is_pre_registered', 'pre_registered_session', 'status', 'registered_at'])
+                    ->withTimestamps();
+    }
+
+    public function programParticipants()
+    {
+        return $this->hasMany(ProgramParticipant::class);
+    }
+
+    public function attendances()
+    {
+        return $this->hasMany(Attendance::class);
+    }
+
+    public function certificateTemplate()
+    {
+        return $this->hasOne(CertificateTemplate::class)->where('is_active', true)->latestOfMany();
+    }
+
+    public function certificateTemplates()
+    {
+        return $this->hasMany(CertificateTemplate::class);
+    }
+
+    public function certificates()
+    {
+        return $this->hasMany(Certificate::class);
+    }
+
+    public function questionnaire()
+    {
+        return $this->hasOne(ProgramQuestionnaire::class);
+    }
+
+    public function questionnaireSets()
+    {
+        return $this->belongsToMany(QuestionnaireSet::class, 'program_questionnaires')
+                    ->withPivot(['is_confirmed', 'confirmed_at', 'confirmed_by'])
+                    ->withTimestamps();
+    }
+
+    public function isCheckinOpen(): bool
+    {
+        $now = now();
+        return $this->status === 'published'
+            && $this->checkin_start_at
+            && $now->between($this->checkin_start_at, $this->checkin_end_at ?? $now->addYear());
+    }
+
+    public function isDownloadOpen(): bool
+    {
+        $now = now();
+        return $this->status === 'published'
+            && $this->ecert_download_start_at
+            && $now->gte($this->ecert_download_start_at)
+            && (! $this->ecert_download_end_at || $now->lte($this->ecert_download_end_at));
+    }
+}

app/Models/ProgramParticipant.php

@@ -0,0 +1,37 @@
+<?php
+
+namespace App\Models;
+
+use Illuminate\Database\Eloquent\Model;
+
+class ProgramParticipant extends Model
+{
+    protected $fillable = [
+        'program_id', 'participant_id',
+        'registration_source', 'is_pre_registered', 'pre_registered_session',
+        'status', 'registered_at',
+    ];
+
+    protected function casts(): array
+    {
+        return [
+            'is_pre_registered' => 'boolean',
+            'registered_at'     => 'datetime',
+        ];
+    }
+
+    public function program()
+    {
+        return $this->belongsTo(Program::class);
+    }
+
+    public function participant()
+    {
+        return $this->belongsTo(Participant::class);
+    }
+
+    public function attendance()
+    {
+        return $this->hasOne(Attendance::class);
+    }
+}

app/Models/ProgramQrCode.php

@@ -0,0 +1,27 @@
+<?php
+
+namespace App\Models;
+
+use Illuminate\Database\Eloquent\Model;
+use Illuminate\Support\Str;
+
+class ProgramQrCode extends Model
+{
+    protected $fillable = ['program_id', 'token', 'qr_image_path', 'is_active'];
+
+    protected function casts(): array
+    {
+        return ['is_active' => 'boolean'];
+    }
+
+    protected static function boot(): void
+    {
+        parent::boot();
+        static::creating(fn($model) => $model->token ??= Str::random(48));
+    }
+
+    public function program()
+    {
+        return $this->belongsTo(Program::class);
+    }
+}

app/Models/ProgramQuestionnaire.php

@@ -0,0 +1,35 @@
+<?php
+
+namespace App\Models;
+
+use Illuminate\Database\Eloquent\Model;
+
+class ProgramQuestionnaire extends Model
+{
+    protected $fillable = [
+        'program_id', 'questionnaire_set_id', 'is_confirmed', 'confirmed_at', 'confirmed_by',
+    ];
+
+    protected function casts(): array
+    {
+        return [
+            'is_confirmed' => 'boolean',
+            'confirmed_at' => 'datetime',
+        ];
+    }
+
+    public function program()
+    {
+        return $this->belongsTo(Program::class);
+    }
+
+    public function questionnaireSet()
+    {
+        return $this->belongsTo(QuestionnaireSet::class);
+    }
+
+    public function confirmedBy()
+    {
+        return $this->belongsTo(User::class, 'confirmed_by');
+    }
+}

app/Models/QuestionnaireAnswer.php

@@ -0,0 +1,27 @@
+<?php
+
+namespace App\Models;
+
+use Illuminate\Database\Eloquent\Model;
+
+class QuestionnaireAnswer extends Model
+{
+    protected $fillable = [
+        'questionnaire_response_id', 'questionnaire_question_id', 'answer_value',
+    ];
+
+    protected function casts(): array
+    {
+        return ['answer_value' => 'array'];
+    }
+
+    public function response()
+    {
+        return $this->belongsTo(QuestionnaireResponse::class, 'questionnaire_response_id');
+    }
+
+    public function question()
+    {
+        return $this->belongsTo(QuestionnaireQuestion::class, 'questionnaire_question_id');
+    }
+}

app/Models/QuestionnaireQuestion.php

@@ -0,0 +1,32 @@
+<?php
+
+namespace App\Models;
+
+use Illuminate\Database\Eloquent\Model;
+
+class QuestionnaireQuestion extends Model
+{
+    protected $fillable = [
+        'questionnaire_set_id', 'question_text', 'question_type',
+        'options_json', 'is_required', 'sort_order',
+    ];
+
+    protected function casts(): array
+    {
+        return [
+            'options_json' => 'array',
+            'is_required'  => 'boolean',
+            'sort_order'   => 'integer',
+        ];
+    }
+
+    public function questionnaireSet()
+    {
+        return $this->belongsTo(QuestionnaireSet::class);
+    }
+
+    public function answers()
+    {
+        return $this->hasMany(QuestionnaireAnswer::class);
+    }
+}

app/Models/QuestionnaireResponse.php

@@ -0,0 +1,38 @@
+<?php
+
+namespace App\Models;
+
+use Illuminate\Database\Eloquent\Model;
+
+class QuestionnaireResponse extends Model
+{
+    protected $fillable = [
+        'program_id', 'participant_id', 'questionnaire_set_id',
+        'submitted_at', 'ip_address', 'user_agent',
+    ];
+
+    protected function casts(): array
+    {
+        return ['submitted_at' => 'datetime'];
+    }
+
+    public function program()
+    {
+        return $this->belongsTo(Program::class);
+    }
+
+    public function participant()
+    {
+        return $this->belongsTo(Participant::class);
+    }
+
+    public function questionnaireSet()
+    {
+        return $this->belongsTo(QuestionnaireSet::class);
+    }
+
+    public function answers()
+    {
+        return $this->hasMany(QuestionnaireAnswer::class);
+    }
+}

app/Models/QuestionnaireSet.php

@@ -0,0 +1,40 @@
+<?php
+
+namespace App\Models;
+
+use Illuminate\Database\Eloquent\Model;
+use Illuminate\Database\Eloquent\Factories\HasFactory;
+
+class QuestionnaireSet extends Model
+{
+    use HasFactory;
+
+    protected $fillable = ['title', 'description', 'status', 'created_by'];
+
+    public function creator()
+    {
+        return $this->belongsTo(User::class, 'created_by');
+    }
+
+    public function questions()
+    {
+        return $this->hasMany(QuestionnaireQuestion::class)->orderBy('sort_order');
+    }
+
+    public function programs()
+    {
+        return $this->belongsToMany(Program::class, 'program_questionnaires')
+                    ->withPivot(['is_confirmed', 'confirmed_at', 'confirmed_by'])
+                    ->withTimestamps();
+    }
+
+    public function programQuestionnaires()
+    {
+        return $this->hasMany(ProgramQuestionnaire::class);
+    }
+
+    public function responses()
+    {
+        return $this->hasMany(QuestionnaireResponse::class);
+    }
+}

app/Models/User.php

@@ -0,0 +1,36 @@
+<?php
+
+namespace App\Models;
+
+use Database\Factories\UserFactory;
+use Illuminate\Database\Eloquent\Factories\HasFactory;
+use Illuminate\Foundation\Auth\User as Authenticatable;
+use Illuminate\Notifications\Notifiable;
+
+class User extends Authenticatable
+{
+    /** @use HasFactory<UserFactory> */
+    use HasFactory, Notifiable;
+
+    protected $fillable = ['name', 'email', 'password', 'is_admin'];
+    protected $hidden   = ['password', 'remember_token'];
+
+    protected function casts(): array
+    {
+        return [
+            'email_verified_at' => 'datetime',
+            'password'          => 'hashed',
+            'is_admin'          => 'boolean',
+        ];
+    }
+
+    public function programs()
+    {
+        return $this->hasMany(Program::class, 'created_by');
+    }
+
+    public function auditLogs()
+    {
+        return $this->hasMany(AuditLog::class);
+    }
+}

app/Providers/AppServiceProvider.php

@@ -0,0 +1,31 @@
+<?php
+
+namespace App\Providers;
+
+use Illuminate\Cache\RateLimiting\Limit;
+use Illuminate\Http\Request;
+use Illuminate\Support\Facades\RateLimiter;
+use Illuminate\Support\Facades\URL;
+use Illuminate\Support\ServiceProvider;
+
+class AppServiceProvider extends ServiceProvider
+{
+    public function register(): void {}
+
+    public function boot(): void
+    {
+        // Rate limiters for public routes
+        RateLimiter::for('checkin', fn(Request $request) =>
+            Limit::perMinute(60)->by($request->ip())
+        );
+
+        RateLimiter::for('certificate', fn(Request $request) =>
+            Limit::perMinute(30)->by($request->ip())
+        );
+
+        // Force HTTPS in production
+        if (app()->environment('production')) {
+            URL::forceScheme('https');
+        }
+    }
+}

app/View/Components/AppLayout.php

@@ -0,0 +1,17 @@
+<?php
+
+namespace App\View\Components;
+
+use Illuminate\View\Component;
+use Illuminate\View\View;
+
+class AppLayout extends Component
+{
+    /**
+     * Get the view / contents that represents the component.
+     */
+    public function render(): View
+    {
+        return view('layouts.app');
+    }
+}

app/View/Components/GuestLayout.php

@@ -0,0 +1,17 @@
+<?php
+
+namespace App\View\Components;
+
+use Illuminate\View\Component;
+use Illuminate\View\View;
+
+class GuestLayout extends Component
+{
+    /**
+     * Get the view / contents that represents the component.
+     */
+    public function render(): View
+    {
+        return view('layouts.guest');
+    }
+}