Phoenix Nest — Vehicle Condition Photos

A single-file WordPress plugin that captures pickup and return condition photos of a rental vehicle on the customer's own phone — no app, no login, no account — files them against the MotoPress booking, and locks each set after submit so the before/after pair is usable as dispute evidence.

The owner opens a bookmarked board on their phone, taps a booking, and shows a QR code. The customer scans it, takes six photos, and hits submit. The set locks and the link dies.

Live in production: phoenixnest.properties — Phoenix Nest Properties LLC (Destin, FL vehicle rentals).

Why this exists

Condition photos are a physical event, not form data. The booking happens online days ahead and the agreement is signed online right after — at neither moment is the customer standing next to the car. So the photos cannot ride:

• the booking form — the vehicle isn't there yet;
• the e-signature document — signer-input fields do text, not file uploads.

They need their own capture surface, opened twice per rental. And the business value is evidence: a photo set that can be quietly replaced later is worth nothing, so the lock is part of the feature, not a hardening extra.

The hard constraint is that the person holding the camera is a customer you cannot ask to install anything or create an account. That single requirement drives the whole design.

Architecture

sequenceDiagram
    actor O as Owner (phone)
    participant B as Owner board /pn-today/
    actor C as Customer (phone)
    participant P as Capture page /vehicle-photos/
    participant WP as WordPress

    Note over O,B: bookmarked once with ?k=SECRET<br/>then a derived HttpOnly cookie
    O->>B: open board for a chosen day
    B-->>O: cards — coming back · going out · still out
    alt customer is standing here
        O->>B: tap Show QR
        Note over B: QR drawn in-browser onto a canvas<br/>never sent to a QR-image API
    else customer has already gone
        O->>B: tap Send pickup or return photo link
        Note over B: phase is DERIVED, so there is no choice to offer
        B-->>O: green or red toast, dismissed with the X
    end
    C->>P: scan or tap → /vehicle-photos/?t=TOKEN (128-bit)
    Note over P: phase DERIVED from state —<br/>no pickup → pickup, pickup → return, both → read-only
    loop each of 6 slots
        C->>WP: one photo per AJAX request
        WP-->>C: thumbnail + progress
    end
    C->>WP: Submit
    Note over WP: re-check completeness server-side →<br/>write the phase lock → ROTATE the token
    WP-->>C: locked — this link is now dead

The four surfaces

The upload notice carries the owner key, and that is the trade. The board renders nothing without the cookie or k, so a keyless link would open a blank page on any device that had never been set up — worse than not sending it. So the message is a credential: it grants the whole board (every customer's name and dates, live capture tokens and codes, the send buttons). It goes to the site's own admin address and nowhere else, the link is last in the body with nothing after it (a half-linkified credential is its own failure), and Settings → Vehicle Photos → regenerate revokes every copy at once. The booking is pinned with q=#<id> rather than the customer's email — pn_vc_matches_search() already matches the id, a search replaces the day window so it resolves whatever the dates are, and no customer address ends up in an inbox or a server log. The # is rawurlencode()d because add_query_arg() does not encode: a raw one truncates the URL into a fragment and the board opens on today. | Settings | The owner link, and a regenerate button that also invalidates every phone's cookie. |

Data model

WP attachments hung off the booking post. No custom tables.

A mail plugin that replaces wp_mail() is trusted, and finding that out cost a red lie (v1.2.4). pn_vc_mail_transport() judged delivery from $GLOBALS['phpmailer']->Mailer, treating mail as "PHP mail(), which WP Engine discards". FluentSMTP — active on this site — declares its own wp_mail(), rebuilds core's body, calls $phpmailer->isMail() (pinning Mailer to mail) and then hands the message to its provider driver. So every send read as undelivered while FluentSMTP's own log said sent. Mailer cannot separate the two; who owns wp_mail() can, so that check now runs first (pn_vc_wp_mail_is_core_file(), via ReflectionFunction) and an unknown path still counts as core, keeping the stricter reading. A red lie is not the safe direction — it costs the owner exactly what a false green costs him. | booking meta | _pn_vc_pickup_done_at · _pn_vc_return_done_at | the phase locks — phase is derived from these, never passed in a URL |

Security model

Installation

# From wp-content/plugins/
git clone https://github.com/codebyshoaib/phoenix-vehicle-condition.git

Or upload the ZIP via Plugins → Add New → Upload Plugin, then Activate.

Requirements: WordPress 5.7+, PHP 7.4+, MotoPress Booking Calendar (or any booking CPT — see pn_vc_booking_post_types()).

Setup

1. Create a page at /vehicle-photos/ containing [pn_vc_capture].
2. Create a page at /pn-today/ containing [pn_vc_today].
3. Settings → Vehicle Photos → open the owner link on the phone once and add it to the home screen.
4. Exclude both paths from any page cache. A cached page ships a stale security nonce, and every upload then fails with a misleading "check your signal".

The plugin fails loud with an admin notice if either page is missing.