From 835c70809470a238096aa17f438b373b7ca21e14 Mon Sep 17 00:00:00 2001
From: axv2655 <arnav.vedula@yahoo.com>
Date: Fri, 24 Jul 2026 18:23:57 -0500
Subject: [PATCH 1/5] feat: scan points

---
 .../components/ApplicationDetailPanel.tsx     |   3 +
 .../components/ApplicationsTable.tsx          |   4 +-
 .../src/pages/admin/all-applicants/types.ts   |   1 +
 .../web/src/pages/admin/scans/ScansPage.tsx   |   6 +-
 client/web/src/pages/admin/scans/api.ts       |  21 ++
 .../admin/scans/components/PointsNameCard.tsx |  71 ++++++
 .../admin/scans/components/ScanTypesTable.tsx |  40 +++-
 .../admin/scans/components/ScannerDialog.tsx  |   7 +
 client/web/src/pages/admin/scans/store.ts     |  35 +++
 client/web/src/pages/admin/scans/types.ts     |   6 +
 client/web/src/pages/admin/scans/utils.ts     |   3 +
 .../src/pages/hacker/profile/ProfilePage.tsx  |  37 ++-
 client/web/src/types.ts                       |   3 +
 cmd/api/api.go                                |   3 +
 cmd/api/applications.go                       |  23 ++
 cmd/api/applications_test.go                  |  16 ++
 cmd/api/resume.go                             |   7 +
 cmd/api/resume_test.go                        |   1 +
 cmd/api/scans.go                              |   1 +
 cmd/api/scans_test.go                         |  81 ++++++-
 cmd/api/settings.go                           |  97 ++++++++
 cmd/api/settings_test.go                      |  99 ++++++++
 .../000024_alter_scans_add_points.down.sql    |   1 +
 .../000024_alter_scans_add_points.up.sql      |   1 +
 docs/docs.go                                  | 219 ++++++++++++++++++
 internal/store/applications.go                |   6 +-
 internal/store/mock_store.go                  |  15 ++
 internal/store/scans.go                       |  27 ++-
 internal/store/settings.go                    |  50 ++++
 internal/store/storage.go                     |   3 +
 30 files changed, 861 insertions(+), 26 deletions(-)
 create mode 100644 client/web/src/pages/admin/scans/components/PointsNameCard.tsx
 create mode 100644 cmd/migrate/migrations/000024_alter_scans_add_points.down.sql
 create mode 100644 cmd/migrate/migrations/000024_alter_scans_add_points.up.sql

diff --git a/client/web/src/pages/admin/all-applicants/components/ApplicationDetailPanel.tsx b/client/web/src/pages/admin/all-applicants/components/ApplicationDetailPanel.tsx
index 423ecc0f..4a6eaca5 100644
--- a/client/web/src/pages/admin/all-applicants/components/ApplicationDetailPanel.tsx
+++ b/client/web/src/pages/admin/all-applicants/components/ApplicationDetailPanel.tsx
@@ -76,6 +76,9 @@ export const ApplicationDetailPanel = memo(function ApplicationDetailPanel({
               <Badge className={getStatusColor(application.status)}>
                 {application.status}
               </Badge>
+              <Badge variant="secondary" className="tabular-nums">
+                {application.points ?? 0} pts
+              </Badge>
             </>
           ) : null}
         </div>
diff --git a/client/web/src/pages/admin/all-applicants/components/ApplicationsTable.tsx b/client/web/src/pages/admin/all-applicants/components/ApplicationsTable.tsx
index f7067016..69d602df 100644
--- a/client/web/src/pages/admin/all-applicants/components/ApplicationsTable.tsx
+++ b/client/web/src/pages/admin/all-applicants/components/ApplicationsTable.tsx
@@ -51,12 +51,13 @@ export const ApplicationsTable = memo(function ApplicationsTable({
             <TableHead>Created</TableHead>
             <TableHead>Updated</TableHead>
             <TableHead>AI Percent</TableHead>
+            <TableHead>Points</TableHead>
           </TableRow>
         </TableHeader>
         <TableBody>
           {applications.length === 0 ? (
             <TableRow>
-              <TableCell colSpan={14} className="text-center text-gray-500">
+              <TableCell colSpan={16} className="text-center text-gray-500">
                 No applications found
               </TableCell>
             </TableRow>
@@ -107,6 +108,7 @@ export const ApplicationsTable = memo(function ApplicationsTable({
                 <TableCell>
                   {app.ai_percent != null ? `${app.ai_percent}%` : "-"}
                 </TableCell>
+                <TableCell className="tabular-nums">{app.points}</TableCell>
               </TableRow>
             ))
           )}
diff --git a/client/web/src/pages/admin/all-applicants/types.ts b/client/web/src/pages/admin/all-applicants/types.ts
index 50f6b836..fe19a7aa 100644
--- a/client/web/src/pages/admin/all-applicants/types.ts
+++ b/client/web/src/pages/admin/all-applicants/types.ts
@@ -30,6 +30,7 @@ export interface ApplicationListItem {
   reviews_assigned: number;
   reviews_completed: number;
   has_resume: boolean;
+  points: number;
 }
 
 export interface ApplicationListResult {
diff --git a/client/web/src/pages/admin/scans/ScansPage.tsx b/client/web/src/pages/admin/scans/ScansPage.tsx
index b7db5e03..94b56482 100644
--- a/client/web/src/pages/admin/scans/ScansPage.tsx
+++ b/client/web/src/pages/admin/scans/ScansPage.tsx
@@ -4,6 +4,7 @@ import { Card, CardContent, CardHeader } from "@/components/ui/card";
 import { Skeleton } from "@/components/ui/skeleton";
 import { useUserStore } from "@/shared/stores/user";
 
+import { PointsNameCard } from "./components/PointsNameCard";
 import { ScannerDialog } from "./components/ScannerDialog";
 import { ScanStatsCards } from "./components/ScanStatsCards";
 import { ScanTypesTable } from "./components/ScanTypesTable";
@@ -20,6 +21,7 @@ export default function ScansPage() {
     rebalancing,
     fetchTypes,
     fetchStats,
+    fetchPointsName,
     saveScanTypes,
     rebalanceStats,
     setActiveScanType,
@@ -31,12 +33,13 @@ export default function ScansPage() {
     const controller = new AbortController();
     fetchTypes(controller.signal);
     fetchStats(controller.signal);
+    fetchPointsName(controller.signal);
     return () => {
       controller.abort();
       // Reset active scan type so dialog doesn't reopen on navigate back
       setActiveScanType(null);
     };
-  }, [fetchTypes, fetchStats, setActiveScanType]);
+  }, [fetchTypes, fetchStats, fetchPointsName, setActiveScanType]);
 
   if (typesLoading && scanTypes.length === 0) {
     return (
@@ -74,6 +77,7 @@ export default function ScansPage() {
         stats={stats}
         loading={typesLoading || statsLoading}
       />
+      <PointsNameCard isSuperAdmin={isSuperAdmin} />
       <ScanTypesTable
         scanTypes={scanTypes}
         stats={stats}
diff --git a/client/web/src/pages/admin/scans/api.ts b/client/web/src/pages/admin/scans/api.ts
index b8fd7a8f..8fdd833d 100644
--- a/client/web/src/pages/admin/scans/api.ts
+++ b/client/web/src/pages/admin/scans/api.ts
@@ -2,6 +2,7 @@ import { getRequest, postRequest, putRequest } from "@/shared/lib/api";
 import type { ApiResponse } from "@/types";
 
 import type {
+  PointsNameResponse,
   Scan,
   ScanStatsResponse,
   ScanType,
@@ -61,3 +62,23 @@ export async function saveScanTypes(
     "scan types",
   );
 }
+
+export async function fetchPointsName(
+  signal?: AbortSignal,
+): Promise<ApiResponse<PointsNameResponse>> {
+  return getRequest<PointsNameResponse>(
+    "/points-name",
+    "points name",
+    signal,
+  );
+}
+
+export async function savePointsName(
+  name: string,
+): Promise<ApiResponse<PointsNameResponse>> {
+  return postRequest<PointsNameResponse>(
+    "/superadmin/settings/points-name",
+    { name },
+    "points name",
+  );
+}
diff --git a/client/web/src/pages/admin/scans/components/PointsNameCard.tsx b/client/web/src/pages/admin/scans/components/PointsNameCard.tsx
new file mode 100644
index 00000000..9616712e
--- /dev/null
+++ b/client/web/src/pages/admin/scans/components/PointsNameCard.tsx
@@ -0,0 +1,71 @@
+import { Coins, Loader2 } from "lucide-react";
+import { useEffect, useState } from "react";
+import { toast } from "sonner";
+
+import { Button } from "@/components/ui/button";
+import { Input } from "@/components/ui/input";
+
+import { useScansStore } from "../store";
+
+interface PointsNameCardProps {
+  isSuperAdmin: boolean;
+}
+
+export function PointsNameCard({ isSuperAdmin }: PointsNameCardProps) {
+  const { pointsName, savingPointsName, savePointsName } = useScansStore();
+  const [draft, setDraft] = useState(pointsName);
+
+  useEffect(() => {
+    setDraft(pointsName);
+  }, [pointsName]);
+
+  if (!isSuperAdmin) {
+    return null;
+  }
+
+  const dirty = draft.trim() !== pointsName;
+
+  const handleSave = async () => {
+    const trimmed = draft.trim();
+    if (!trimmed) {
+      toast.error("Points system name must not be empty");
+      return;
+    }
+    if (trimmed.length > 30) {
+      toast.error("Points system name must be at most 30 characters");
+      return;
+    }
+    await savePointsName(trimmed);
+  };
+
+  return (
+    <div className="flex items-center gap-2">
+      <Coins className="size-4 text-muted-foreground" />
+      <Input
+        value={draft}
+        onChange={(e) => setDraft(e.target.value)}
+        onKeyDown={(e) => {
+          if (e.key === "Enter" && dirty) handleSave();
+        }}
+        placeholder="Points system name"
+        className="h-8 w-44 text-sm font-light"
+        maxLength={30}
+      />
+      {dirty && (
+        <Button
+          size="sm"
+          variant="outline"
+          className="cursor-pointer"
+          disabled={savingPointsName}
+          onClick={handleSave}
+        >
+          {savingPointsName ? (
+            <Loader2 className="size-3.5 animate-spin" />
+          ) : (
+            "Save"
+          )}
+        </Button>
+      )}
+    </div>
+  );
+}
diff --git a/client/web/src/pages/admin/scans/components/ScanTypesTable.tsx b/client/web/src/pages/admin/scans/components/ScanTypesTable.tsx
index 9ac11bba..e7c67942 100644
--- a/client/web/src/pages/admin/scans/components/ScanTypesTable.tsx
+++ b/client/web/src/pages/admin/scans/components/ScanTypesTable.tsx
@@ -72,6 +72,7 @@ export function ScanTypesTable({
 }: ScanTypesTableProps) {
   const [editingIndex, setEditingIndex] = useState<number | null>(null);
   const [editDisplayName, setEditDisplayName] = useState("");
+  const [editPoints, setEditPoints] = useState("0");
   const [deleteIndex, setDeleteIndex] = useState<number | null>(null);
   const [pendingNew, setPendingNew] = useState<ScanType | null>(null);
   const [rebalanceOpen, setRebalanceOpen] = useState(false);
@@ -90,6 +91,7 @@ export function ScanTypesTable({
     setEditingIndex(index);
     if (scanTypes[index]) {
       setEditDisplayName(scanTypes[index].display_name);
+      setEditPoints(String(scanTypes[index].points ?? 0));
     }
   };
 
@@ -97,6 +99,8 @@ export function ScanTypesTable({
     if (editingIndex === null) return;
 
     const trimmed = editDisplayName.trim();
+    const parsedPoints = Number.parseInt(editPoints, 10);
+    const points = Number.isNaN(parsedPoints) ? 0 : parsedPoints;
 
     // Pending new row — save only if user typed something, otherwise no-op
     if (pendingNew) {
@@ -105,6 +109,7 @@ export function ScanTypesTable({
         ...pendingNew,
         display_name: trimmed,
         name: toSnakeCase(trimmed),
+        points,
       };
       const updated = [...scanTypes, newType];
 
@@ -124,11 +129,11 @@ export function ScanTypesTable({
     if (!current) return;
 
     // No change — skip save
-    if (trimmed === current.display_name) return;
+    if (trimmed === current.display_name && points === current.points) return;
 
     const updated = scanTypes.map((st, i) =>
       i === editingIndex
-        ? { ...st, display_name: trimmed, name: toSnakeCase(trimmed) }
+        ? { ...st, display_name: trimmed, name: toSnakeCase(trimmed), points }
         : st,
     );
 
@@ -139,7 +144,7 @@ export function ScanTypesTable({
     }
 
     onSave(updated);
-  }, [editingIndex, editDisplayName, scanTypes, pendingNew, onSave]);
+  }, [editingIndex, editDisplayName, editPoints, scanTypes, pendingNew, onSave]);
 
   // Ref to avoid stale closures in event listeners
   const saveDisplayNameRef = useRef(saveDisplayName);
@@ -197,10 +202,12 @@ export function ScanTypesTable({
       display_name: "",
       category: "other",
       is_active: true,
+      points: 0,
     };
     setPendingNew(newType);
     setEditingIndex(scanTypes.length);
     setEditDisplayName("");
+    setEditPoints("0");
   };
 
   const handleDelete = (index: number) => {
@@ -295,6 +302,7 @@ export function ScanTypesTable({
                 <TableHead className="w-24">Action</TableHead>
                 <TableHead className="w-48">Name</TableHead>
                 <TableHead className="w-150">Category</TableHead>
+                <TableHead className="w-24">Points</TableHead>
                 <TableHead className="w-24">Scans</TableHead>
                 {isSuperAdmin && <TableHead>Active</TableHead>}
               </TableRow>
@@ -375,6 +383,29 @@ export function ScanTypesTable({
                           })}
                         </div>
                       </TableCell>
+                      <TableCell>
+                        <Input
+                          type="number"
+                          min={0}
+                          value={editPoints}
+                          onChange={(e) => setEditPoints(e.target.value)}
+                          onBlur={(e) => {
+                            if (
+                              editRowRef.current?.contains(
+                                e.relatedTarget as Node,
+                              )
+                            )
+                              return;
+                            saveDisplayName();
+                          }}
+                          onKeyDown={(e) => {
+                            if (e.key === "Enter") {
+                              closeEditing();
+                            }
+                          }}
+                          className="h-8 w-20 text-sm font-light shadow-none bg-transparent pl-2 rounded-sm focus-visible:ring-1"
+                        />
+                      </TableCell>
                       <TableCell className="tabular-nums">{count}</TableCell>
                       <TableCell>
                         <div className="flex items-center gap-3">
@@ -461,6 +492,9 @@ export function ScanTypesTable({
                         </Badge>
                       </div>
                     </TableCell>
+                    <TableCell className="tabular-nums">
+                      {scanType.points ?? 0}
+                    </TableCell>
                     <TableCell className="tabular-nums">{count}</TableCell>
                     {isSuperAdmin && (
                       <TableCell>
diff --git a/client/web/src/pages/admin/scans/components/ScannerDialog.tsx b/client/web/src/pages/admin/scans/components/ScannerDialog.tsx
index bc291c38..00d6ddae 100644
--- a/client/web/src/pages/admin/scans/components/ScannerDialog.tsx
+++ b/client/web/src/pages/admin/scans/components/ScannerDialog.tsx
@@ -19,6 +19,7 @@ export function ScannerDialog() {
     activeScanType,
     lastScanResult,
     scanning,
+    pointsName,
     setActiveScanType,
     performScan,
     clearLastResult,
@@ -103,6 +104,12 @@ export function ScannerDialog() {
                 <XCircle className="size-12" />
               )}
               <p className="text-lg font-medium">{lastScanResult.message}</p>
+              {lastScanResult.success &&
+                (lastScanResult.scan?.points ?? 0) > 0 && (
+                  <p className="text-sm font-medium">
+                    +{lastScanResult.scan?.points} {pointsName}
+                  </p>
+                )}
               <Button variant="outline" onClick={handleResume}>
                 <ScanLine className="mr-2 size-4" />
                 Scan Next
diff --git a/client/web/src/pages/admin/scans/store.ts b/client/web/src/pages/admin/scans/store.ts
index d3db4f01..4c452c3e 100644
--- a/client/web/src/pages/admin/scans/store.ts
+++ b/client/web/src/pages/admin/scans/store.ts
@@ -5,9 +5,11 @@ import { errorAlert } from "@/shared/lib/api";
 
 import {
   createScan as apiCreateScan,
+  fetchPointsName as apiFetchPointsName,
   fetchScanStats,
   fetchScanTypes,
   rebalanceScanStats as apiRebalanceScanStats,
+  savePointsName as apiSavePointsName,
   saveScanTypes as apiSaveScanTypes,
 } from "./api";
 import type { Scan, ScanStat, ScanType } from "./types";
@@ -21,16 +23,20 @@ export interface ScanResult {
 export interface ScansState {
   scanTypes: ScanType[];
   stats: ScanStat[];
+  pointsName: string;
   typesLoading: boolean;
   statsLoading: boolean;
   scanning: boolean;
   saving: boolean;
+  savingPointsName: boolean;
   rebalancing: boolean;
   activeScanType: ScanType | null;
   lastScanResult: ScanResult | null;
 
   fetchTypes: (signal?: AbortSignal) => Promise<void>;
   fetchStats: (signal?: AbortSignal) => Promise<void>;
+  fetchPointsName: (signal?: AbortSignal) => Promise<void>;
+  savePointsName: (name: string) => Promise<boolean>;
   performScan: (userId: string) => Promise<void>;
   rebalanceStats: () => Promise<void>;
   saveScanTypes: (
@@ -43,10 +49,12 @@ export interface ScansState {
 export const useScansStore = create<ScansState>((set, get) => ({
   scanTypes: [],
   stats: [],
+  pointsName: "Points",
   typesLoading: false,
   statsLoading: false,
   scanning: false,
   saving: false,
+  savingPointsName: false,
   rebalancing: false,
   activeScanType: null,
   lastScanResult: null,
@@ -79,6 +87,33 @@ export const useScansStore = create<ScansState>((set, get) => ({
     }
   },
 
+  fetchPointsName: async (signal?: AbortSignal) => {
+    const res = await apiFetchPointsName(signal);
+
+    if (signal?.aborted) return;
+
+    if (res.status === 200 && res.data) {
+      set({ pointsName: res.data.name });
+    }
+  },
+
+  savePointsName: async (name: string) => {
+    if (get().savingPointsName) return false;
+
+    set({ savingPointsName: true });
+
+    const res = await apiSavePointsName(name);
+
+    if (res.status === 200 && res.data) {
+      set({ pointsName: res.data.name, savingPointsName: false });
+      toast.success("Points system name saved");
+      return true;
+    }
+    set({ savingPointsName: false });
+    errorAlert(res, "Failed to save points system name");
+    return false;
+  },
+
   performScan: async (userId: string) => {
     const { activeScanType, scanning } = get();
     if (!activeScanType || scanning) return;
diff --git a/client/web/src/pages/admin/scans/types.ts b/client/web/src/pages/admin/scans/types.ts
index bac249e5..6ddf2a39 100644
--- a/client/web/src/pages/admin/scans/types.ts
+++ b/client/web/src/pages/admin/scans/types.ts
@@ -10,6 +10,7 @@ export interface ScanType {
   display_name: string;
   category: ScanTypeCategory;
   is_active: boolean;
+  points: number;
 }
 
 export interface Scan {
@@ -17,6 +18,7 @@ export interface Scan {
   user_id: string;
   scan_type: string;
   scanned_by: string;
+  points: number;
   scanned_at: string;
   created_at: string;
 }
@@ -37,3 +39,7 @@ export interface ScanStatsResponse {
 export interface ScansResponse {
   scans: Scan[];
 }
+
+export interface PointsNameResponse {
+  name: string;
+}
diff --git a/client/web/src/pages/admin/scans/utils.ts b/client/web/src/pages/admin/scans/utils.ts
index 108879c6..113fa2c0 100644
--- a/client/web/src/pages/admin/scans/utils.ts
+++ b/client/web/src/pages/admin/scans/utils.ts
@@ -20,6 +20,9 @@ export function validate(types: ScanType[]): string | null {
   if (types.some((st) => !st.display_name.trim() || !st.name.trim())) {
     return "All scan types must have a name";
   }
+  if (types.some((st) => !Number.isInteger(st.points) || st.points < 0)) {
+    return "Points must be a non-negative whole number";
+  }
   const names = types.map((st) => st.name.trim());
   if (new Set(names).size !== names.length) {
     return "Scan type names must be unique";
diff --git a/client/web/src/pages/hacker/profile/ProfilePage.tsx b/client/web/src/pages/hacker/profile/ProfilePage.tsx
index ed35006e..930813db 100644
--- a/client/web/src/pages/hacker/profile/ProfilePage.tsx
+++ b/client/web/src/pages/hacker/profile/ProfilePage.tsx
@@ -73,6 +73,7 @@ export default function ProfilePage() {
   const fileInputRef = useRef<HTMLInputElement | null>(null);
 
   const [application, setApplication] = useState<Application | null>(null);
+  const [pointsName, setPointsName] = useState("Points");
   const [resumeBusy, setResumeBusy] = useState(false);
   const [resumeError, setResumeError] = useState<string | null>(null);
   const [deleting, setDeleting] = useState(false);
@@ -80,14 +81,24 @@ export default function ProfilePage() {
   useEffect(() => {
     const controller = new AbortController();
     const load = async () => {
-      const res = await getRequest<Application>(
-        "/applications/me",
-        "application",
-        controller.signal,
-      );
+      const [appRes, pointsNameRes] = await Promise.all([
+        getRequest<Application>(
+          "/applications/me",
+          "application",
+          controller.signal,
+        ),
+        getRequest<{ name: string }>(
+          "/points-name",
+          "points name",
+          controller.signal,
+        ),
+      ]);
       if (controller.signal.aborted) return;
-      if (res.status === 200 && res.data) {
-        setApplication(res.data);
+      if (appRes.status === 200 && appRes.data) {
+        setApplication(appRes.data);
+      }
+      if (pointsNameRes.status === 200 && pointsNameRes.data) {
+        setPointsName(pointsNameRes.data.name);
       }
     };
     load();
@@ -226,13 +237,17 @@ export default function ProfilePage() {
         </div>
       </div>
 
-      {/* Tavern points placeholder */}
+      {/* Points */}
       <div className="mt-6 flex items-center justify-between rounded-xl border border-[#E5E5E5] px-5 py-4">
         <div>
-          <p className="text-sm font-normal text-black">Tavern Points</p>
-          <p className="text-xs font-light text-[#8A8A8A]">Coming soon</p>
+          <p className="text-sm font-normal text-black">{pointsName}</p>
+          <p className="text-xs font-light text-[#8A8A8A]">
+            Earned from check-ins and events
+          </p>
         </div>
-        <span className="text-2xl font-light text-[#B8B8B8]">—</span>
+        <span className="text-2xl font-light text-black tabular-nums">
+          {application?.points ?? 0}
+        </span>
       </div>
 
       {/* Settings */}
diff --git a/client/web/src/types.ts b/client/web/src/types.ts
index ca18d186..55171edf 100644
--- a/client/web/src/types.ts
+++ b/client/web/src/types.ts
@@ -82,6 +82,8 @@ export interface Application {
   responses: Record<string, unknown>;
   /** Embedded on GET /applications/me; absent on mutation responses. */
   application_schema?: ApplicationSchemaField[];
+  /** Total scan points; populated on read endpoints. */
+  points?: number;
   resume_path: string | null;
   ai_percent: number | null;
   accept_votes: number;
@@ -161,6 +163,7 @@ export interface ApplicationListItem {
   reviews_completed: number;
   ai_percent: number | null;
   has_resume: boolean;
+  points: number;
 }
 
 // Paginated response from admin applications endpoint
diff --git a/cmd/api/api.go b/cmd/api/api.go
index 055ddb3c..7d247019 100644
--- a/cmd/api/api.go
+++ b/cmd/api/api.go
@@ -180,6 +180,7 @@ func (app *application) mount() http.Handler {
 			r.Get("/schedule/date-range", app.getHackerScheduleDateRange)
 			r.Get("/faq", app.getHackerFAQHandler)
 			r.Get("/hacker-pack", app.getHackerPackHandler)
+			r.Get("/points-name", app.getPointsNameHandler)
 			r.Delete("/users/me", app.deleteMyAccountHandler)
 			r.Get("/wallet/apple-pass/status", app.getAppleWalletStatusHandler)
 			r.Get("/wallet/apple-pass", app.getAppleWalletPassHandler)
@@ -298,6 +299,8 @@ func (app *application) mount() http.Handler {
 						r.Post("/hackathon-date-range", app.setHackathonDateRange)
 						r.Get("/hacker-pack-url", app.getHackerPackURL)
 						r.Post("/hacker-pack-url", app.setHackerPackURL)
+						r.Get("/points-name", app.getPointsName)
+						r.Post("/points-name", app.setPointsName)
 						r.Put("/scan-types", app.updateScanTypesHandler)
 						r.Get("/meal-groups", app.getMealGroups)
 						r.Put("/meal-groups", app.updateMealGroups)
diff --git a/cmd/api/applications.go b/cmd/api/applications.go
index 85f4b925..120d4c34 100644
--- a/cmd/api/applications.go
+++ b/cmd/api/applications.go
@@ -21,6 +21,8 @@ type UpdateApplicationPayload struct {
 type ApplicationWithSchema struct {
 	*store.Application
 	ApplicationSchema []store.ApplicationSchemaField `json:"application_schema"`
+	// Points is the user's total scan points; populated on read endpoints only.
+	Points int `json:"points"`
 }
 
 // getOrCreateApplicationHandler returns or creates the user's hackathon application
@@ -73,9 +75,16 @@ func (app *application) getOrCreateApplicationHandler(w http.ResponseWriter, r *
 		return
 	}
 
+	points, err := app.store.Scans.GetTotalPointsByUserID(r.Context(), user.ID)
+	if err != nil {
+		app.internalServerError(w, r, err)
+		return
+	}
+
 	response := ApplicationWithSchema{
 		Application:       application,
 		ApplicationSchema: schema,
+		Points:            points,
 	}
 
 	if err := app.jsonResponse(w, http.StatusOK, response); err != nil {
@@ -159,9 +168,16 @@ func (app *application) updateApplicationHandler(w http.ResponseWriter, r *http.
 		return
 	}
 
+	points, err := app.store.Scans.GetTotalPointsByUserID(r.Context(), user.ID)
+	if err != nil {
+		app.internalServerError(w, r, err)
+		return
+	}
+
 	response := ApplicationWithSchema{
 		Application:       application,
 		ApplicationSchema: schema,
+		Points:            points,
 	}
 
 	if err := app.jsonResponse(w, http.StatusOK, response); err != nil {
@@ -593,9 +609,16 @@ func (app *application) getApplication(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
+	points, err := app.store.Scans.GetTotalPointsByUserID(r.Context(), application.UserID)
+	if err != nil {
+		app.internalServerError(w, r, err)
+		return
+	}
+
 	response := ApplicationWithSchema{
 		Application:       application,
 		ApplicationSchema: schema,
+		Points:            points,
 	}
 
 	if err := app.jsonResponse(w, http.StatusOK, response); err != nil {
diff --git a/cmd/api/applications_test.go b/cmd/api/applications_test.go
index ac63c47b..efd7184a 100644
--- a/cmd/api/applications_test.go
+++ b/cmd/api/applications_test.go
@@ -39,6 +39,7 @@ func TestGetOrCreateApplication(t *testing.T) {
 	app := newTestApplication(t)
 	mockApps := app.store.Application.(*store.MockApplicationStore)
 	mockSettings := app.store.Settings.(*store.MockSettingsStore)
+	mockScans := app.store.Scans.(*store.MockScansStore)
 
 	t.Run("should return existing application", func(t *testing.T) {
 		user := newTestUser()
@@ -47,6 +48,7 @@ func TestGetOrCreateApplication(t *testing.T) {
 
 		mockApps.On("GetByUserID", user.ID).Return(existing, nil).Once()
 		mockSettings.On("GetApplicationSchema").Return(schema, nil).Once()
+		mockScans.On("GetTotalPointsByUserID", user.ID).Return(15, nil).Once()
 
 		req, err := http.NewRequest(http.MethodGet, "/", nil)
 		require.NoError(t, err)
@@ -55,8 +57,17 @@ func TestGetOrCreateApplication(t *testing.T) {
 		rr := executeRequest(req, http.HandlerFunc(app.getOrCreateApplicationHandler))
 		checkResponseCode(t, http.StatusOK, rr.Code)
 
+		var envelope struct {
+			Data struct {
+				Points int `json:"points"`
+			} `json:"data"`
+		}
+		require.NoError(t, json.Unmarshal(rr.Body.Bytes(), &envelope))
+		assert.Equal(t, 15, envelope.Data.Points)
+
 		mockApps.AssertExpectations(t)
 		mockSettings.AssertExpectations(t)
+		mockScans.AssertExpectations(t)
 	})
 
 	t.Run("should create draft when no application exists", func(t *testing.T) {
@@ -66,6 +77,7 @@ func TestGetOrCreateApplication(t *testing.T) {
 		mockApps.On("GetByUserID", user.ID).Return(nil, store.ErrNotFound).Once()
 		mockApps.On("Create", mock.AnythingOfType("*store.Application")).Return(nil).Once()
 		mockSettings.On("GetApplicationSchema").Return(schema, nil).Once()
+		mockScans.On("GetTotalPointsByUserID", user.ID).Return(0, nil).Once()
 
 		req, err := http.NewRequest(http.MethodGet, "/", nil)
 		require.NoError(t, err)
@@ -76,6 +88,7 @@ func TestGetOrCreateApplication(t *testing.T) {
 
 		mockApps.AssertExpectations(t)
 		mockSettings.AssertExpectations(t)
+		mockScans.AssertExpectations(t)
 	})
 
 	t.Run("should handle race condition on create conflict", func(t *testing.T) {
@@ -87,6 +100,7 @@ func TestGetOrCreateApplication(t *testing.T) {
 		mockApps.On("Create", mock.AnythingOfType("*store.Application")).Return(store.ErrConflict).Once()
 		mockApps.On("GetByUserID", user.ID).Return(existing, nil).Once()
 		mockSettings.On("GetApplicationSchema").Return(schema, nil).Once()
+		mockScans.On("GetTotalPointsByUserID", user.ID).Return(0, nil).Once()
 
 		req, err := http.NewRequest(http.MethodGet, "/", nil)
 		require.NoError(t, err)
@@ -97,6 +111,7 @@ func TestGetOrCreateApplication(t *testing.T) {
 
 		mockApps.AssertExpectations(t)
 		mockSettings.AssertExpectations(t)
+		mockScans.AssertExpectations(t)
 	})
 }
 
@@ -116,6 +131,7 @@ func TestUpdateApplication(t *testing.T) {
 		mockApps.On("GetByUserID", user.ID).Return(existing, nil).Once()
 		mockSettings.On("GetApplicationSchema").Return(schema, nil).Once()
 		mockApps.On("Update", mock.AnythingOfType("*store.Application")).Return(nil).Once()
+		app.store.Scans.(*store.MockScansStore).On("GetTotalPointsByUserID", user.ID).Return(0, nil).Once()
 
 		body := `{"responses": {"first_name": "Jane", "last_name": "Doe"}}`
 		req, err := http.NewRequest(http.MethodPatch, "/", strings.NewReader(body))
diff --git a/cmd/api/resume.go b/cmd/api/resume.go
index 2acddd12..0d1fd9b5 100644
--- a/cmd/api/resume.go
+++ b/cmd/api/resume.go
@@ -146,9 +146,16 @@ func (app *application) deleteResumeHandler(w http.ResponseWriter, r *http.Reque
 		return
 	}
 
+	points, err := app.store.Scans.GetTotalPointsByUserID(r.Context(), user.ID)
+	if err != nil {
+		app.internalServerError(w, r, err)
+		return
+	}
+
 	response := ApplicationWithSchema{
 		Application:       application,
 		ApplicationSchema: schema,
+		Points:            points,
 	}
 
 	if err := app.jsonResponse(w, http.StatusOK, response); err != nil {
diff --git a/cmd/api/resume_test.go b/cmd/api/resume_test.go
index 0b35a47a..ff30a862 100644
--- a/cmd/api/resume_test.go
+++ b/cmd/api/resume_test.go
@@ -144,6 +144,7 @@ func TestDeleteResume(t *testing.T) {
 			assert.Nil(t, updated.ResumePath)
 		}).Return(nil).Once()
 		mockSettings.On("GetApplicationSchema").Return(schema, nil).Once()
+		app.store.Scans.(*store.MockScansStore).On("GetTotalPointsByUserID", user.ID).Return(0, nil).Once()
 
 		req, err := http.NewRequest(http.MethodDelete, "/", nil)
 		require.NoError(t, err)
diff --git a/cmd/api/scans.go b/cmd/api/scans.go
index 3aa0a1c6..8913d79e 100644
--- a/cmd/api/scans.go
+++ b/cmd/api/scans.go
@@ -181,6 +181,7 @@ func (app *application) createScanHandler(w http.ResponseWriter, r *http.Request
 		UserID:    req.UserID,
 		ScanType:  req.ScanType,
 		ScannedBy: admin.ID,
+		Points:    found.Points,
 	}
 
 	if err := app.store.Scans.Create(r.Context(), scan); err != nil {
diff --git a/cmd/api/scans_test.go b/cmd/api/scans_test.go
index 7e617b9a..9878b91c 100644
--- a/cmd/api/scans_test.go
+++ b/cmd/api/scans_test.go
@@ -49,8 +49,8 @@ func TestGetScanTypes(t *testing.T) {
 
 func TestCreateScan(t *testing.T) {
 	scanTypes := []store.ScanType{
-		{Name: "check_in", DisplayName: "Check In", Category: store.ScanCategoryCheckIn, IsActive: true},
-		{Name: "lunch", DisplayName: "Lunch", Category: store.ScanCategoryMeal, IsActive: true},
+		{Name: "check_in", DisplayName: "Check In", Category: store.ScanCategoryCheckIn, IsActive: true, Points: 10},
+		{Name: "lunch", DisplayName: "Lunch", Category: store.ScanCategoryMeal, IsActive: true, Points: 5},
 		{Name: "inactive_item", DisplayName: "Inactive", Category: store.ScanCategorySwag, IsActive: false},
 	}
 
@@ -69,7 +69,9 @@ func TestCreateScan(t *testing.T) {
 		mockApps.On("GetByUserID", "user-1").Return(hackerApp, nil).Once()
 		mockApps.On("SetMealGroup", "app-1", mock.AnythingOfType("string")).
 			Return(&groups[0], nil).Once()
-		mockScans.On("Create", mock.AnythingOfType("*store.Scan")).Return(nil).Once()
+		mockScans.On("Create", mock.MatchedBy(func(s *store.Scan) bool {
+			return s.Points == 10
+		})).Return(nil).Once()
 
 		body := `{"user_id":"user-1","scan_type":"check_in"}`
 		req, err := http.NewRequest(http.MethodPost, "/", strings.NewReader(body))
@@ -87,6 +89,43 @@ func TestCreateScan(t *testing.T) {
 		require.NoError(t, err)
 		assert.NotNil(t, resp.Data.MealGroup)
 		assert.Contains(t, groups, *resp.Data.MealGroup)
+		assert.Equal(t, 10, resp.Data.Points)
+
+		mockSettings.AssertExpectations(t)
+		mockScans.AssertExpectations(t)
+		mockApps.AssertExpectations(t)
+	})
+
+	t.Run("item scan awards the scan type's configured points", func(t *testing.T) {
+		app := newTestApplication(t)
+		mockSettings := app.store.Settings.(*store.MockSettingsStore)
+		mockScans := app.store.Scans.(*store.MockScansStore)
+		mockApps := app.store.Application.(*store.MockApplicationStore)
+
+		mealGroup := "A"
+
+		mockSettings.On("GetScanTypes").Return(scanTypes, nil).Once()
+		mockScans.On("HasCheckIn", "user-1", []string{"check_in"}).Return(true, nil).Once()
+		mockScans.On("Create", mock.MatchedBy(func(s *store.Scan) bool {
+			return s.Points == 5
+		})).Return(nil).Once()
+		mockApps.On("GetMealGroupByUserID", "user-1").Return(&mealGroup, nil).Once()
+
+		body := `{"user_id":"user-1","scan_type":"lunch"}`
+		req, err := http.NewRequest(http.MethodPost, "/", strings.NewReader(body))
+		require.NoError(t, err)
+		req.Header.Set("Content-Type", "application/json")
+		req = setUserContext(req, newAdminUser())
+
+		rr := executeRequest(req, http.HandlerFunc(app.createScanHandler))
+		checkResponseCode(t, http.StatusCreated, rr.Code)
+
+		var resp struct {
+			Data CreateScanResponse `json:"data"`
+		}
+		err = json.NewDecoder(rr.Body).Decode(&resp)
+		require.NoError(t, err)
+		assert.Equal(t, 5, resp.Data.Points)
 
 		mockSettings.AssertExpectations(t)
 		mockScans.AssertExpectations(t)
@@ -619,6 +658,42 @@ func TestUpdateScanTypes(t *testing.T) {
 		mockSettings.AssertExpectations(t)
 	})
 
+	t.Run("accepts scan types with points", func(t *testing.T) {
+		app := newTestApplication(t)
+		mockSettings := app.store.Settings.(*store.MockSettingsStore)
+
+		types := []store.ScanType{
+			{Name: "check_in", DisplayName: "Check In", Category: store.ScanCategoryCheckIn, IsActive: true, Points: 10},
+			{Name: "walk_in", DisplayName: "Walk-In", Category: store.ScanCategoryWalkIn, IsActive: true},
+		}
+
+		mockSettings.On("UpdateScanTypes", types).Return(nil).Once()
+
+		body := `{"scan_types":[{"name":"check_in","display_name":"Check In","category":"check_in","is_active":true,"points":10},{"name":"walk_in","display_name":"Walk-In","category":"walk_in","is_active":true}]}`
+		req, err := http.NewRequest(http.MethodPut, "/", strings.NewReader(body))
+		require.NoError(t, err)
+		req.Header.Set("Content-Type", "application/json")
+		req = setUserContext(req, newSuperAdminUser())
+
+		rr := executeRequest(req, http.HandlerFunc(app.updateScanTypesHandler))
+		checkResponseCode(t, http.StatusOK, rr.Code)
+
+		mockSettings.AssertExpectations(t)
+	})
+
+	t.Run("400 negative points", func(t *testing.T) {
+		app := newTestApplication(t)
+
+		body := `{"scan_types":[{"name":"check_in","display_name":"Check In","category":"check_in","is_active":true,"points":-5},{"name":"walk_in","display_name":"Walk-In","category":"walk_in","is_active":true}]}`
+		req, err := http.NewRequest(http.MethodPut, "/", strings.NewReader(body))
+		require.NoError(t, err)
+		req.Header.Set("Content-Type", "application/json")
+		req = setUserContext(req, newSuperAdminUser())
+
+		rr := executeRequest(req, http.HandlerFunc(app.updateScanTypesHandler))
+		checkResponseCode(t, http.StatusBadRequest, rr.Code)
+	})
+
 	t.Run("400 duplicate names", func(t *testing.T) {
 		app := newTestApplication(t)
 
diff --git a/cmd/api/settings.go b/cmd/api/settings.go
index c90e8f66..a69429ae 100644
--- a/cmd/api/settings.go
+++ b/cmd/api/settings.go
@@ -232,6 +232,14 @@ type HackerPackURLResponse struct {
 	URL string `json:"url"`
 }
 
+type SetPointsNamePayload struct {
+	Name string `json:"name"`
+}
+
+type PointsNameResponse struct {
+	Name string `json:"name"`
+}
+
 // setReviewAssignmentToggle updates the review assignment enabled setting
 //
 //	@Summary		Set review assignment enabled state for a user (Super Admin)
@@ -658,6 +666,95 @@ func (app *application) getHackerPackHandler(w http.ResponseWriter, r *http.Requ
 	}
 }
 
+// getPointsName returns the configured points system display name
+//
+//	@Summary		Get points system name (Super Admin)
+//	@Description	Returns the configured display name of the points system
+//	@Tags			superadmin/settings
+//	@Produce		json
+//	@Success		200	{object}	PointsNameResponse
+//	@Failure		401	{object}	object{error=string}
+//	@Failure		403	{object}	object{error=string}
+//	@Failure		500	{object}	object{error=string}
+//	@Security		CookieAuth
+//	@Router			/superadmin/settings/points-name [get]
+func (app *application) getPointsName(w http.ResponseWriter, r *http.Request) {
+	name, err := app.store.Settings.GetPointsName(r.Context())
+	if err != nil {
+		app.internalServerError(w, r, err)
+		return
+	}
+
+	if err := app.jsonResponse(w, http.StatusOK, PointsNameResponse{Name: name}); err != nil {
+		app.internalServerError(w, r, err)
+	}
+}
+
+// setPointsName updates the points system display name
+//
+//	@Summary		Set points system name (Super Admin)
+//	@Description	Updates the display name of the points system shown to hackers and admins
+//	@Tags			superadmin/settings
+//	@Accept			json
+//	@Produce		json
+//	@Param			name	body		SetPointsNamePayload	true	"Points system name"
+//	@Success		200		{object}	PointsNameResponse
+//	@Failure		400		{object}	object{error=string}
+//	@Failure		401		{object}	object{error=string}
+//	@Failure		403		{object}	object{error=string}
+//	@Failure		500		{object}	object{error=string}
+//	@Security		CookieAuth
+//	@Router			/superadmin/settings/points-name [post]
+func (app *application) setPointsName(w http.ResponseWriter, r *http.Request) {
+	var req SetPointsNamePayload
+	if err := readJSON(w, r, &req); err != nil {
+		app.badRequestResponse(w, r, err)
+		return
+	}
+
+	name := strings.TrimSpace(req.Name)
+	if name == "" {
+		app.badRequestResponse(w, r, errors.New("name must not be empty"))
+		return
+	}
+	if len(name) > 30 {
+		app.badRequestResponse(w, r, errors.New("name must be at most 30 characters"))
+		return
+	}
+
+	if err := app.store.Settings.SetPointsName(r.Context(), name); err != nil {
+		app.internalServerError(w, r, err)
+		return
+	}
+
+	if err := app.jsonResponse(w, http.StatusOK, PointsNameResponse{Name: name}); err != nil {
+		app.internalServerError(w, r, err)
+	}
+}
+
+// getPointsNameHandler returns the configured points system name for any authenticated user.
+//
+//	@Summary		Get points system name
+//	@Description	Returns the configured display name of the points system
+//	@Tags			hackers
+//	@Produce		json
+//	@Success		200	{object}	PointsNameResponse
+//	@Failure		401	{object}	object{error=string}
+//	@Failure		500	{object}	object{error=string}
+//	@Security		CookieAuth
+//	@Router			/points-name [get]
+func (app *application) getPointsNameHandler(w http.ResponseWriter, r *http.Request) {
+	name, err := app.store.Settings.GetPointsName(r.Context())
+	if err != nil {
+		app.internalServerError(w, r, err)
+		return
+	}
+
+	if err := app.jsonResponse(w, http.StatusOK, PointsNameResponse{Name: name}); err != nil {
+		app.internalServerError(w, r, err)
+	}
+}
+
 type UpdateMealGroupsPayload struct {
 	Groups []string `json:"groups" validate:"max=50,dive,required,min=1,max=50"`
 }
diff --git a/cmd/api/settings_test.go b/cmd/api/settings_test.go
index c24ef626..9d0d345e 100644
--- a/cmd/api/settings_test.go
+++ b/cmd/api/settings_test.go
@@ -600,6 +600,105 @@ func TestSetHackerPackURL(t *testing.T) {
 	})
 }
 
+func TestGetPointsName(t *testing.T) {
+	app := newTestApplication(t)
+	mockSettings := app.store.Settings.(*store.MockSettingsStore)
+
+	t.Run("should return configured name", func(t *testing.T) {
+		mockSettings.On("GetPointsName").Return("Tavern Points", nil).Once()
+
+		req, err := http.NewRequest(http.MethodGet, "/", nil)
+		require.NoError(t, err)
+		req = setUserContext(req, newSuperAdminUser())
+
+		rr := executeRequest(req, http.HandlerFunc(app.getPointsName))
+		checkResponseCode(t, http.StatusOK, rr.Code)
+
+		var body struct {
+			Data PointsNameResponse `json:"data"`
+		}
+		err = json.NewDecoder(rr.Body).Decode(&body)
+		require.NoError(t, err)
+		assert.Equal(t, "Tavern Points", body.Data.Name)
+
+		mockSettings.AssertExpectations(t)
+	})
+}
+
+func TestGetPointsNameHandler(t *testing.T) {
+	app := newTestApplication(t)
+	mockSettings := app.store.Settings.(*store.MockSettingsStore)
+
+	t.Run("should return name for hacker", func(t *testing.T) {
+		mockSettings.On("GetPointsName").Return("Nuggets", nil).Once()
+
+		req, err := http.NewRequest(http.MethodGet, "/", nil)
+		require.NoError(t, err)
+		req = setUserContext(req, newTestUser())
+
+		rr := executeRequest(req, http.HandlerFunc(app.getPointsNameHandler))
+		checkResponseCode(t, http.StatusOK, rr.Code)
+
+		var body struct {
+			Data PointsNameResponse `json:"data"`
+		}
+		err = json.NewDecoder(rr.Body).Decode(&body)
+		require.NoError(t, err)
+		assert.Equal(t, "Nuggets", body.Data.Name)
+
+		mockSettings.AssertExpectations(t)
+	})
+}
+
+func TestSetPointsName(t *testing.T) {
+	app := newTestApplication(t)
+	mockSettings := app.store.Settings.(*store.MockSettingsStore)
+
+	t.Run("should trim and set name", func(t *testing.T) {
+		mockSettings.On("SetPointsName", "Tavern Points").Return(nil).Once()
+
+		body := `{"name":"  Tavern Points  "}`
+		req, err := http.NewRequest(http.MethodPost, "/", strings.NewReader(body))
+		require.NoError(t, err)
+		req.Header.Set("Content-Type", "application/json")
+		req = setUserContext(req, newSuperAdminUser())
+
+		rr := executeRequest(req, http.HandlerFunc(app.setPointsName))
+		checkResponseCode(t, http.StatusOK, rr.Code)
+
+		var respBody struct {
+			Data PointsNameResponse `json:"data"`
+		}
+		err = json.NewDecoder(rr.Body).Decode(&respBody)
+		require.NoError(t, err)
+		assert.Equal(t, "Tavern Points", respBody.Data.Name)
+
+		mockSettings.AssertExpectations(t)
+	})
+
+	t.Run("should reject empty name", func(t *testing.T) {
+		body := `{"name":"   "}`
+		req, err := http.NewRequest(http.MethodPost, "/", strings.NewReader(body))
+		require.NoError(t, err)
+		req.Header.Set("Content-Type", "application/json")
+		req = setUserContext(req, newSuperAdminUser())
+
+		rr := executeRequest(req, http.HandlerFunc(app.setPointsName))
+		checkResponseCode(t, http.StatusBadRequest, rr.Code)
+	})
+
+	t.Run("should reject name over 30 characters", func(t *testing.T) {
+		body := `{"name":"` + strings.Repeat("a", 31) + `"}`
+		req, err := http.NewRequest(http.MethodPost, "/", strings.NewReader(body))
+		require.NoError(t, err)
+		req.Header.Set("Content-Type", "application/json")
+		req = setUserContext(req, newSuperAdminUser())
+
+		rr := executeRequest(req, http.HandlerFunc(app.setPointsName))
+		checkResponseCode(t, http.StatusBadRequest, rr.Code)
+	})
+}
+
 func TestGetMealGroups(t *testing.T) {
 	app := newTestApplication(t)
 	mockSettings := app.store.Settings.(*store.MockSettingsStore)
diff --git a/cmd/migrate/migrations/000024_alter_scans_add_points.down.sql b/cmd/migrate/migrations/000024_alter_scans_add_points.down.sql
new file mode 100644
index 00000000..80f887fb
--- /dev/null
+++ b/cmd/migrate/migrations/000024_alter_scans_add_points.down.sql
@@ -0,0 +1 @@
+ALTER TABLE scans DROP COLUMN IF EXISTS points;
diff --git a/cmd/migrate/migrations/000024_alter_scans_add_points.up.sql b/cmd/migrate/migrations/000024_alter_scans_add_points.up.sql
new file mode 100644
index 00000000..2aebb995
--- /dev/null
+++ b/cmd/migrate/migrations/000024_alter_scans_add_points.up.sql
@@ -0,0 +1 @@
+ALTER TABLE scans ADD COLUMN points INT NOT NULL DEFAULT 0;
diff --git a/docs/docs.go b/docs/docs.go
index 8781e93e..80f1a71c 100644
--- a/docs/docs.go
+++ b/docs/docs.go
@@ -3213,6 +3213,53 @@ const docTemplate = `{
                 }
             }
         },
+        "/points-name": {
+            "get": {
+                "security": [
+                    {
+                        "CookieAuth": []
+                    }
+                ],
+                "description": "Returns the configured display name of the points system",
+                "produces": [
+                    "application/json"
+                ],
+                "tags": [
+                    "hackers"
+                ],
+                "summary": "Get points system name",
+                "responses": {
+                    "200": {
+                        "description": "OK",
+                        "schema": {
+                            "$ref": "#/definitions/main.PointsNameResponse"
+                        }
+                    },
+                    "401": {
+                        "description": "Unauthorized",
+                        "schema": {
+                            "type": "object",
+                            "properties": {
+                                "error": {
+                                    "type": "string"
+                                }
+                            }
+                        }
+                    },
+                    "500": {
+                        "description": "Internal Server Error",
+                        "schema": {
+                            "type": "object",
+                            "properties": {
+                                "error": {
+                                    "type": "string"
+                                }
+                            }
+                        }
+                    }
+                }
+            }
+        },
         "/public/faq": {
             "get": {
                 "description": "Returns all frequently asked questions, ordered by display order",
@@ -5309,6 +5356,145 @@ const docTemplate = `{
                 }
             }
         },
+        "/superadmin/settings/points-name": {
+            "get": {
+                "security": [
+                    {
+                        "CookieAuth": []
+                    }
+                ],
+                "description": "Returns the configured display name of the points system",
+                "produces": [
+                    "application/json"
+                ],
+                "tags": [
+                    "superadmin/settings"
+                ],
+                "summary": "Get points system name (Super Admin)",
+                "responses": {
+                    "200": {
+                        "description": "OK",
+                        "schema": {
+                            "$ref": "#/definitions/main.PointsNameResponse"
+                        }
+                    },
+                    "401": {
+                        "description": "Unauthorized",
+                        "schema": {
+                            "type": "object",
+                            "properties": {
+                                "error": {
+                                    "type": "string"
+                                }
+                            }
+                        }
+                    },
+                    "403": {
+                        "description": "Forbidden",
+                        "schema": {
+                            "type": "object",
+                            "properties": {
+                                "error": {
+                                    "type": "string"
+                                }
+                            }
+                        }
+                    },
+                    "500": {
+                        "description": "Internal Server Error",
+                        "schema": {
+                            "type": "object",
+                            "properties": {
+                                "error": {
+                                    "type": "string"
+                                }
+                            }
+                        }
+                    }
+                }
+            },
+            "post": {
+                "security": [
+                    {
+                        "CookieAuth": []
+                    }
+                ],
+                "description": "Updates the display name of the points system shown to hackers and admins",
+                "consumes": [
+                    "application/json"
+                ],
+                "produces": [
+                    "application/json"
+                ],
+                "tags": [
+                    "superadmin/settings"
+                ],
+                "summary": "Set points system name (Super Admin)",
+                "parameters": [
+                    {
+                        "description": "Points system name",
+                        "name": "name",
+                        "in": "body",
+                        "required": true,
+                        "schema": {
+                            "$ref": "#/definitions/main.SetPointsNamePayload"
+                        }
+                    }
+                ],
+                "responses": {
+                    "200": {
+                        "description": "OK",
+                        "schema": {
+                            "$ref": "#/definitions/main.PointsNameResponse"
+                        }
+                    },
+                    "400": {
+                        "description": "Bad Request",
+                        "schema": {
+                            "type": "object",
+                            "properties": {
+                                "error": {
+                                    "type": "string"
+                                }
+                            }
+                        }
+                    },
+                    "401": {
+                        "description": "Unauthorized",
+                        "schema": {
+                            "type": "object",
+                            "properties": {
+                                "error": {
+                                    "type": "string"
+                                }
+                            }
+                        }
+                    },
+                    "403": {
+                        "description": "Forbidden",
+                        "schema": {
+                            "type": "object",
+                            "properties": {
+                                "error": {
+                                    "type": "string"
+                                }
+                            }
+                        }
+                    },
+                    "500": {
+                        "description": "Internal Server Error",
+                        "schema": {
+                            "type": "object",
+                            "properties": {
+                                "error": {
+                                    "type": "string"
+                                }
+                            }
+                        }
+                    }
+                }
+            }
+        },
         "/superadmin/settings/review-assignment-toggle": {
             "put": {
                 "security": [
@@ -6136,6 +6322,10 @@ const docTemplate = `{
                 "meal_group": {
                     "type": "string"
                 },
+                "points": {
+                    "description": "Points is the user's total scan points; populated on read endpoints only.",
+                    "type": "integer"
+                },
                 "reject_votes": {
                     "type": "integer"
                 },
@@ -6228,6 +6418,9 @@ const docTemplate = `{
                 "meal_group": {
                     "type": "string"
                 },
+                "points": {
+                    "type": "integer"
+                },
                 "scan_type": {
                     "type": "string"
                 },
@@ -6444,6 +6637,14 @@ const docTemplate = `{
                 }
             }
         },
+        "main.PointsNameResponse": {
+            "type": "object",
+            "properties": {
+                "name": {
+                    "type": "string"
+                }
+            }
+        },
         "main.PromoteWalkInsPayload": {
             "type": "object",
             "required": [
@@ -6721,6 +6922,14 @@ const docTemplate = `{
                 }
             }
         },
+        "main.SetPointsNamePayload": {
+            "type": "object",
+            "properties": {
+                "name": {
+                    "type": "string"
+                }
+            }
+        },
         "main.SetReviewAssignmentTogglePayload": {
             "type": "object",
             "required": [
@@ -7130,6 +7339,9 @@ const docTemplate = `{
                 "phone": {
                     "type": "string"
                 },
+                "points": {
+                    "type": "integer"
+                },
                 "reject_votes": {
                     "type": "integer"
                 },
@@ -7431,6 +7643,9 @@ const docTemplate = `{
                 "id": {
                     "type": "string"
                 },
+                "points": {
+                    "type": "integer"
+                },
                 "scan_type": {
                     "type": "string"
                 },
@@ -7490,6 +7705,10 @@ const docTemplate = `{
                     "type": "string",
                     "maxLength": 50,
                     "minLength": 1
+                },
+                "points": {
+                    "type": "integer",
+                    "minimum": 0
                 }
             }
         },
diff --git a/internal/store/applications.go b/internal/store/applications.go
index 90483d9f..ee60cb64 100644
--- a/internal/store/applications.go
+++ b/internal/store/applications.go
@@ -80,6 +80,7 @@ type ApplicationListItem struct {
 	AIPercent          *int              `json:"ai_percent"`
 	HasResume          bool              `json:"has_resume"`
 	MealGroup          *string           `json:"meal_group"`
+	Points             int               `json:"points"`
 }
 
 // ApplicationListResult contains paginated results
@@ -368,7 +369,8 @@ func (s *ApplicationsStore) List(
 		       NULLIF(a.responses->>'hackathons_attended', '')::smallint AS hackathons_attended,
 		       a.submitted_at, a.created_at, a.updated_at,
 		       a.accept_votes, a.reject_votes, a.waitlist_votes, a.reviews_assigned, a.reviews_completed, a.ai_percent,
-		       a.resume_path IS NOT NULL AS has_resume, a.meal_group
+		       a.resume_path IS NOT NULL AS has_resume, a.meal_group,
+		       (SELECT COALESCE(SUM(s.points), 0) FROM scans s WHERE s.user_id = a.user_id) AS points
 		FROM applications a
 		INNER JOIN users u ON a.user_id = u.id`
 
@@ -463,7 +465,7 @@ func (s *ApplicationsStore) List(
 			&item.HackathonsAttended,
 			&item.SubmittedAt, &item.CreatedAt, &item.UpdatedAt,
 			&item.AcceptVotes, &item.RejectVotes, &item.WaitlistVotes, &item.ReviewsAssigned, &item.ReviewsCompleted, &item.AIPercent,
-			&item.HasResume, &item.MealGroup,
+			&item.HasResume, &item.MealGroup, &item.Points,
 		); err != nil {
 			return nil, err
 		}
diff --git a/internal/store/mock_store.go b/internal/store/mock_store.go
index 302bad3d..0c806712 100644
--- a/internal/store/mock_store.go
+++ b/internal/store/mock_store.go
@@ -271,6 +271,16 @@ func (m *MockSettingsStore) SetHackerPackURL(ctx context.Context, url string) er
 	return args.Error(0)
 }
 
+func (m *MockSettingsStore) GetPointsName(ctx context.Context) (string, error) {
+	args := m.Called()
+	return args.String(0), args.Error(1)
+}
+
+func (m *MockSettingsStore) SetPointsName(ctx context.Context, name string) error {
+	args := m.Called(name)
+	return args.Error(0)
+}
+
 func (m *MockSettingsStore) GetScanTypes(ctx context.Context) ([]ScanType, error) {
 	args := m.Called()
 	if args.Get(0) == nil {
@@ -425,6 +435,11 @@ func (m *MockScansStore) HasCheckIn(ctx context.Context, userID string, checkInT
 	return args.Bool(0), args.Error(1)
 }
 
+func (m *MockScansStore) GetTotalPointsByUserID(ctx context.Context, userID string) (int, error) {
+	args := m.Called(userID)
+	return args.Int(0), args.Error(1)
+}
+
 func (m *MockScansStore) RebalanceStats(ctx context.Context) ([]ScanStat, error) {
 	args := m.Called()
 	if args.Get(0) == nil {
diff --git a/internal/store/scans.go b/internal/store/scans.go
index 479f46c2..5e303325 100644
--- a/internal/store/scans.go
+++ b/internal/store/scans.go
@@ -26,6 +26,7 @@ type ScanType struct {
 	DisplayName string           `json:"display_name" validate:"required,min=1,max=100"`
 	Category    ScanTypeCategory `json:"category" validate:"required,oneof=check_in meal swag other walk_in"`
 	IsActive    bool             `json:"is_active"`
+	Points      int              `json:"points" validate:"min=0"`
 }
 
 type Scan struct {
@@ -33,6 +34,7 @@ type Scan struct {
 	UserID    string    `json:"user_id"`
 	ScanType  string    `json:"scan_type"`
 	ScannedBy string    `json:"scanned_by"`
+	Points    int       `json:"points"`
 	ScannedAt time.Time `json:"scanned_at"`
 	CreatedAt time.Time `json:"created_at"`
 }
@@ -57,12 +59,12 @@ func (s *ScansStore) Create(ctx context.Context, scan *Scan) error {
 	defer tx.Rollback()
 
 	query := `
-		INSERT INTO scans (user_id, scan_type, scanned_by)
-		VALUES ($1, $2, $3)
+		INSERT INTO scans (user_id, scan_type, scanned_by, points)
+		VALUES ($1, $2, $3, $4)
 		RETURNING id, scanned_at, created_at
 	`
 
-	err = tx.QueryRowContext(ctx, query, scan.UserID, scan.ScanType, scan.ScannedBy).
+	err = tx.QueryRowContext(ctx, query, scan.UserID, scan.ScanType, scan.ScannedBy, scan.Points).
 		Scan(&scan.ID, &scan.ScannedAt, &scan.CreatedAt)
 	if err != nil {
 		var pgErr *pgconn.PgError
@@ -89,7 +91,7 @@ func (s *ScansStore) GetByUserID(ctx context.Context, userID string) ([]Scan, er
 	defer cancel()
 
 	query := `
-		SELECT id, user_id, scan_type, scanned_by, scanned_at, created_at
+		SELECT id, user_id, scan_type, scanned_by, points, scanned_at, created_at
 		FROM scans
 		WHERE user_id = $1
 		ORDER BY scanned_at DESC
@@ -104,7 +106,7 @@ func (s *ScansStore) GetByUserID(ctx context.Context, userID string) ([]Scan, er
 	var scans []Scan
 	for rows.Next() {
 		var scan Scan
-		if err := rows.Scan(&scan.ID, &scan.UserID, &scan.ScanType, &scan.ScannedBy, &scan.ScannedAt, &scan.CreatedAt); err != nil {
+		if err := rows.Scan(&scan.ID, &scan.UserID, &scan.ScanType, &scan.ScannedBy, &scan.Points, &scan.ScannedAt, &scan.CreatedAt); err != nil {
 			return nil, err
 		}
 		scans = append(scans, scan)
@@ -173,6 +175,21 @@ func (s *ScansStore) HasCheckIn(ctx context.Context, userID string, checkInTypes
 	return exists, nil
 }
 
+// GetTotalPointsByUserID returns the sum of points across all of a user's scans.
+func (s *ScansStore) GetTotalPointsByUserID(ctx context.Context, userID string) (int, error) {
+	ctx, cancel := context.WithTimeout(ctx, QueryTimeoutDuration)
+	defer cancel()
+
+	query := `SELECT COALESCE(SUM(points), 0) FROM scans WHERE user_id = $1`
+
+	var total int
+	if err := s.db.QueryRowContext(ctx, query, userID).Scan(&total); err != nil {
+		return 0, err
+	}
+
+	return total, nil
+}
+
 // RebalanceStats recomputes the scan_stats counter cache from the authoritative
 // scans table and returns the recomputed stats (sorted by scan_type, matching
 // GetStats). The settings row is locked FOR UPDATE to serialize against
diff --git a/internal/store/settings.go b/internal/store/settings.go
index 9312b217..2545ffb7 100644
--- a/internal/store/settings.go
+++ b/internal/store/settings.go
@@ -24,6 +24,7 @@ const SettingsKeyHackathonDateRange = "hackathon_date_range"
 const SettingsKeyMealGroups = "meal_groups"
 const SettingsKeyApplicationsEnabled = "applications_enabled"
 const SettingsKeyHackerPackURL = "hacker_pack_url"
+const SettingsKeyPointsName = "points_name"
 
 type HackathonDateRange struct {
 	StartDate *string `json:"start_date"`
@@ -562,6 +563,55 @@ func (s *SettingsStore) SetHackerPackURL(ctx context.Context, url string) error
 	return err
 }
 
+// GetPointsName returns the configured display name of the points system.
+// Defaults to "Points" if the row does not exist (not configured).
+func (s *SettingsStore) GetPointsName(ctx context.Context) (string, error) {
+	ctx, cancel := context.WithTimeout(ctx, QueryTimeoutDuration)
+	defer cancel()
+
+	query := `
+		SELECT value
+		FROM settings
+		WHERE key = $1
+	`
+
+	var value []byte
+	err := s.db.QueryRowContext(ctx, query, SettingsKeyPointsName).Scan(&value)
+	if err != nil {
+		if errors.Is(err, sql.ErrNoRows) {
+			return "Points", nil
+		}
+		return "", err
+	}
+
+	var name string
+	if err := json.Unmarshal(value, &name); err != nil {
+		return "", err
+	}
+
+	return name, nil
+}
+
+// SetPointsName updates the display name of the points system.
+func (s *SettingsStore) SetPointsName(ctx context.Context, name string) error {
+	ctx, cancel := context.WithTimeout(ctx, QueryTimeoutDuration)
+	defer cancel()
+
+	jsonValue, err := json.Marshal(name)
+	if err != nil {
+		return err
+	}
+
+	query := `
+		INSERT INTO settings (key, value)
+		VALUES ($1, $2)
+		ON CONFLICT (key) DO UPDATE SET value = EXCLUDED.value, updated_at = NOW()
+	`
+
+	_, err = s.db.ExecContext(ctx, query, SettingsKeyPointsName, string(jsonValue))
+	return err
+}
+
 // GetMealGroups returns the configured list of meal group names (e.g., ["A", "B", "C", "D"])
 func (s *SettingsStore) GetMealGroups(ctx context.Context) ([]string, error) {
 	ctx, cancel := context.WithTimeout(ctx, QueryTimeoutDuration)
diff --git a/internal/store/storage.go b/internal/store/storage.go
index 7e4c6cd4..78bcfb7f 100644
--- a/internal/store/storage.go
+++ b/internal/store/storage.go
@@ -56,6 +56,8 @@ type Storage struct {
 		SetHackathonDateRange(ctx context.Context, dateRange HackathonDateRange) error
 		GetHackerPackURL(ctx context.Context) (string, error)
 		SetHackerPackURL(ctx context.Context, url string) error
+		GetPointsName(ctx context.Context) (string, error)
+		SetPointsName(ctx context.Context, name string) error
 		GetScanTypes(ctx context.Context) ([]ScanType, error)
 		UpdateScanTypes(ctx context.Context, scanTypes []ScanType) error
 		GetScanStats(ctx context.Context) (map[string]int, error)
@@ -77,6 +79,7 @@ type Storage struct {
 		GetByUserID(ctx context.Context, userID string) ([]Scan, error)
 		GetStats(ctx context.Context) ([]ScanStat, error)
 		HasCheckIn(ctx context.Context, userID string, checkInTypes []string) (bool, error)
+		GetTotalPointsByUserID(ctx context.Context, userID string) (int, error)
 		RebalanceStats(ctx context.Context) ([]ScanStat, error)
 	}
 	ApplicationReviews interface {

From 88af69b3b312b40e915cd9f21b19c3bf6cd73f54 Mon Sep 17 00:00:00 2001
From: axv2655 <arnav.vedula@yahoo.com>
Date: Fri, 24 Jul 2026 21:10:59 -0500
Subject: [PATCH 2/5] feat: shop scan item, subtracts points from user

---
 .../admin/scans/components/ScannerDialog.tsx  |  13 +-
 client/web/src/pages/admin/scans/store.ts     |   2 +
 client/web/src/pages/admin/scans/types.ts     |   5 +-
 client/web/src/pages/admin/scans/utils.ts     |   4 +
 cmd/api/scans.go                              |  29 ++++-
 cmd/api/scans_test.go                         | 119 ++++++++++++++++++
 ...000025_alter_scans_add_repeatable.down.sql |  14 +++
 .../000025_alter_scans_add_repeatable.up.sql  |  10 ++
 docs/docs.go                                  |  26 +++-
 internal/store/mock_store.go                  |   5 +
 internal/store/scans.go                       |  60 ++++++++-
 internal/store/storage.go                     |   8 +-
 12 files changed, 282 insertions(+), 13 deletions(-)
 create mode 100644 cmd/migrate/migrations/000025_alter_scans_add_repeatable.down.sql
 create mode 100644 cmd/migrate/migrations/000025_alter_scans_add_repeatable.up.sql

diff --git a/client/web/src/pages/admin/scans/components/ScannerDialog.tsx b/client/web/src/pages/admin/scans/components/ScannerDialog.tsx
index 00d6ddae..782041ef 100644
--- a/client/web/src/pages/admin/scans/components/ScannerDialog.tsx
+++ b/client/web/src/pages/admin/scans/components/ScannerDialog.tsx
@@ -105,9 +105,18 @@ export function ScannerDialog() {
               )}
               <p className="text-lg font-medium">{lastScanResult.message}</p>
               {lastScanResult.success &&
-                (lastScanResult.scan?.points ?? 0) > 0 && (
+                (lastScanResult.scan?.points ?? 0) !== 0 && (
                   <p className="text-sm font-medium">
-                    +{lastScanResult.scan?.points} {pointsName}
+                    {(lastScanResult.scan?.points ?? 0) > 0
+                      ? `+${lastScanResult.scan?.points}`
+                      : `−${Math.abs(lastScanResult.scan?.points ?? 0)}`}{" "}
+                    {pointsName}
+                  </p>
+                )}
+              {lastScanResult.success &&
+                lastScanResult.scan?.balance !== undefined && (
+                  <p className="text-sm font-light">
+                    Balance: {lastScanResult.scan.balance} {pointsName}
                   </p>
                 )}
               <Button variant="outline" onClick={handleResume}>
diff --git a/client/web/src/pages/admin/scans/store.ts b/client/web/src/pages/admin/scans/store.ts
index 4c452c3e..d53357e9 100644
--- a/client/web/src/pages/admin/scans/store.ts
+++ b/client/web/src/pages/admin/scans/store.ts
@@ -141,6 +141,8 @@ export const useScansStore = create<ScansState>((set, get) => ({
         message = `Already scanned for ${activeScanType.display_name}`;
       } else if (res.status === 403) {
         message = "User must check in first";
+      } else if (res.status === 402) {
+        message = res.error || "Insufficient points";
       }
 
       set({
diff --git a/client/web/src/pages/admin/scans/types.ts b/client/web/src/pages/admin/scans/types.ts
index 6ddf2a39..31d2fca6 100644
--- a/client/web/src/pages/admin/scans/types.ts
+++ b/client/web/src/pages/admin/scans/types.ts
@@ -3,7 +3,8 @@ export type ScanTypeCategory =
   | "meal"
   | "swag"
   | "other"
-  | "walk_in";
+  | "walk_in"
+  | "shop";
 
 export interface ScanType {
   name: string;
@@ -21,6 +22,8 @@ export interface Scan {
   points: number;
   scanned_at: string;
   created_at: string;
+  /** Remaining points balance; present only on shop scans. */
+  balance?: number;
 }
 
 export interface ScanStat {
diff --git a/client/web/src/pages/admin/scans/utils.ts b/client/web/src/pages/admin/scans/utils.ts
index 113fa2c0..859e856d 100644
--- a/client/web/src/pages/admin/scans/utils.ts
+++ b/client/web/src/pages/admin/scans/utils.ts
@@ -2,6 +2,7 @@ import {
   DoorOpen,
   Gift,
   MoreHorizontal,
+  ShoppingCart,
   UserCheck,
   Utensils,
 } from "lucide-react";
@@ -48,6 +49,7 @@ export const categoryIcons: Record<ScanTypeCategory, typeof UserCheck> = {
   swag: Gift,
   other: MoreHorizontal,
   walk_in: DoorOpen,
+  shop: ShoppingCart,
 };
 
 export const categoryColors: Record<ScanTypeCategory, string> = {
@@ -56,6 +58,7 @@ export const categoryColors: Record<ScanTypeCategory, string> = {
   swag: "bg-purple-100 text-purple-800",
   other: "bg-gray-100 text-gray-800",
   walk_in: "bg-violet-100 text-violet-700",
+  shop: "bg-emerald-100 text-emerald-800",
 };
 
 export const categoryOptions = [
@@ -64,4 +67,5 @@ export const categoryOptions = [
   { value: "swag", label: "Swag" },
   { value: "other", label: "Other" },
   { value: "walk_in", label: "Walk-In" },
+  { value: "shop", label: "Shop" },
 ] as const;
diff --git a/cmd/api/scans.go b/cmd/api/scans.go
index 8913d79e..671a3fb4 100644
--- a/cmd/api/scans.go
+++ b/cmd/api/scans.go
@@ -35,6 +35,8 @@ type UpdateScanTypesPayload struct {
 type CreateScanResponse struct {
 	*store.Scan
 	MealGroup *string `json:"meal_group,omitempty"`
+	// Balance is the user's remaining points; populated only for shop scans.
+	Balance *int `json:"balance,omitempty"`
 }
 
 // getScanTypesHandler returns all configured scan types
@@ -64,7 +66,7 @@ func (app *application) getScanTypesHandler(w http.ResponseWriter, r *http.Reque
 // createScanHandler records a scan for a user
 //
 //	@Summary		Create a scan (Admin)
-//	@Description	Records a scan for a user. Validates scan type exists and is active. Non-check_in scans require the user to have checked in first.
+//	@Description	Records a scan for a user. Validates scan type exists and is active. Non-check_in scans require the user to have checked in first. Shop scans deduct the type's points from the user's balance and are repeatable.
 //	@Tags			admin/scans
 //	@Accept			json
 //	@Produce		json
@@ -72,6 +74,7 @@ func (app *application) getScanTypesHandler(w http.ResponseWriter, r *http.Reque
 //	@Success		201		{object}	CreateScanResponse
 //	@Failure		400		{object}	object{error=string}
 //	@Failure		401		{object}	object{error=string}
+//	@Failure		402		{object}	object{error=string}	"Insufficient points for shop scan"
 //	@Failure		403		{object}	object{error=string}
 //	@Failure		409		{object}	object{error=string}
 //	@Failure		500		{object}	object{error=string}
@@ -184,7 +187,28 @@ func (app *application) createScanHandler(w http.ResponseWriter, r *http.Request
 		Points:    found.Points,
 	}
 
-	if err := app.store.Scans.Create(r.Context(), scan); err != nil {
+	var balance *int
+	if found.Category == store.ScanCategoryShop {
+		// Shop scans spend points: negate the configured cost and let the
+		// store verify the balance atomically.
+		scan.Points = -found.Points
+
+		newBalance, err := app.store.Scans.CreatePurchase(r.Context(), scan)
+		if err != nil {
+			if errors.Is(err, store.ErrInsufficientPoints) {
+				writeJSONError(w, http.StatusPaymentRequired,
+					fmt.Sprintf("insufficient points: balance is %d, %s costs %d", newBalance, found.DisplayName, found.Points))
+				return
+			}
+			if errors.Is(err, store.ErrNotFound) {
+				app.notFoundResponse(w, r, errors.New("user not found"))
+				return
+			}
+			app.internalServerError(w, r, err)
+			return
+		}
+		balance = &newBalance
+	} else if err := app.store.Scans.Create(r.Context(), scan); err != nil {
 		if errors.Is(err, store.ErrConflict) {
 			app.conflictResponse(w, r, errors.New("user already scanned for: "+req.ScanType))
 			return
@@ -210,6 +234,7 @@ func (app *application) createScanHandler(w http.ResponseWriter, r *http.Request
 	response := CreateScanResponse{
 		Scan:      scan,
 		MealGroup: mealGroup,
+		Balance:   balance,
 	}
 
 	if err := app.jsonResponse(w, http.StatusCreated, response); err != nil {
diff --git a/cmd/api/scans_test.go b/cmd/api/scans_test.go
index 9878b91c..145ceb7c 100644
--- a/cmd/api/scans_test.go
+++ b/cmd/api/scans_test.go
@@ -325,6 +325,101 @@ func TestCreateScan(t *testing.T) {
 		checkResponseCode(t, http.StatusBadRequest, rr.Code)
 	})
 
+	shopScanTypes := []store.ScanType{
+		{Name: "check_in", DisplayName: "Check In", Category: store.ScanCategoryCheckIn, IsActive: true, Points: 10},
+		{Name: "hoodie", DisplayName: "Hoodie", Category: store.ScanCategoryShop, IsActive: true, Points: 50},
+	}
+
+	t.Run("shop scan deducts points and returns balance", func(t *testing.T) {
+		app := newTestApplication(t)
+		mockSettings := app.store.Settings.(*store.MockSettingsStore)
+		mockScans := app.store.Scans.(*store.MockScansStore)
+		mockApps := app.store.Application.(*store.MockApplicationStore)
+
+		mealGroup := "A"
+
+		mockSettings.On("GetScanTypes").Return(shopScanTypes, nil).Once()
+		mockScans.On("HasCheckIn", "user-1", []string{"check_in"}).Return(true, nil).Once()
+		mockScans.On("CreatePurchase", mock.MatchedBy(func(s *store.Scan) bool {
+			return s.Points == -50
+		})).Return(70, nil).Once()
+		mockApps.On("GetMealGroupByUserID", "user-1").Return(&mealGroup, nil).Once()
+
+		body := `{"user_id":"user-1","scan_type":"hoodie"}`
+		req, err := http.NewRequest(http.MethodPost, "/", strings.NewReader(body))
+		require.NoError(t, err)
+		req.Header.Set("Content-Type", "application/json")
+		req = setUserContext(req, newAdminUser())
+
+		rr := executeRequest(req, http.HandlerFunc(app.createScanHandler))
+		checkResponseCode(t, http.StatusCreated, rr.Code)
+
+		var resp struct {
+			Data CreateScanResponse `json:"data"`
+		}
+		err = json.NewDecoder(rr.Body).Decode(&resp)
+		require.NoError(t, err)
+		assert.Equal(t, -50, resp.Data.Points)
+		require.NotNil(t, resp.Data.Balance)
+		assert.Equal(t, 70, *resp.Data.Balance)
+
+		mockSettings.AssertExpectations(t)
+		mockScans.AssertExpectations(t)
+		mockApps.AssertExpectations(t)
+	})
+
+	t.Run("402 when insufficient points for shop scan", func(t *testing.T) {
+		app := newTestApplication(t)
+		mockSettings := app.store.Settings.(*store.MockSettingsStore)
+		mockScans := app.store.Scans.(*store.MockScansStore)
+
+		mockSettings.On("GetScanTypes").Return(shopScanTypes, nil).Once()
+		mockScans.On("HasCheckIn", "user-1", []string{"check_in"}).Return(true, nil).Once()
+		mockScans.On("CreatePurchase", mock.AnythingOfType("*store.Scan")).
+			Return(30, store.ErrInsufficientPoints).Once()
+
+		body := `{"user_id":"user-1","scan_type":"hoodie"}`
+		req, err := http.NewRequest(http.MethodPost, "/", strings.NewReader(body))
+		require.NoError(t, err)
+		req.Header.Set("Content-Type", "application/json")
+		req = setUserContext(req, newAdminUser())
+
+		rr := executeRequest(req, http.HandlerFunc(app.createScanHandler))
+		checkResponseCode(t, http.StatusPaymentRequired, rr.Code)
+
+		var errBody struct {
+			Error string `json:"error"`
+		}
+		err = json.NewDecoder(rr.Body).Decode(&errBody)
+		require.NoError(t, err)
+		assert.Contains(t, errBody.Error, "insufficient points")
+
+		mockSettings.AssertExpectations(t)
+		mockScans.AssertExpectations(t)
+	})
+
+	t.Run("403 shop scan without check-in", func(t *testing.T) {
+		app := newTestApplication(t)
+		mockSettings := app.store.Settings.(*store.MockSettingsStore)
+		mockScans := app.store.Scans.(*store.MockScansStore)
+
+		mockSettings.On("GetScanTypes").Return(shopScanTypes, nil).Once()
+		mockScans.On("HasCheckIn", "user-1", []string{"check_in"}).Return(false, nil).Once()
+
+		body := `{"user_id":"user-1","scan_type":"hoodie"}`
+		req, err := http.NewRequest(http.MethodPost, "/", strings.NewReader(body))
+		require.NoError(t, err)
+		req.Header.Set("Content-Type", "application/json")
+		req = setUserContext(req, newAdminUser())
+
+		rr := executeRequest(req, http.HandlerFunc(app.createScanHandler))
+		checkResponseCode(t, http.StatusForbidden, rr.Code)
+
+		mockScans.AssertNotCalled(t, "CreatePurchase", mock.Anything)
+		mockSettings.AssertExpectations(t)
+		mockScans.AssertExpectations(t)
+	})
+
 	walkInScanTypes := []store.ScanType{
 		{Name: "check_in", DisplayName: "Check In", Category: store.ScanCategoryCheckIn, IsActive: true},
 		{Name: "walk_in", DisplayName: "Walk-In", Category: store.ScanCategoryWalkIn, IsActive: true},
@@ -681,6 +776,30 @@ func TestUpdateScanTypes(t *testing.T) {
 		mockSettings.AssertExpectations(t)
 	})
 
+	t.Run("accepts shop category", func(t *testing.T) {
+		app := newTestApplication(t)
+		mockSettings := app.store.Settings.(*store.MockSettingsStore)
+
+		types := []store.ScanType{
+			{Name: "check_in", DisplayName: "Check In", Category: store.ScanCategoryCheckIn, IsActive: true},
+			{Name: "walk_in", DisplayName: "Walk-In", Category: store.ScanCategoryWalkIn, IsActive: true},
+			{Name: "hoodie", DisplayName: "Hoodie", Category: store.ScanCategoryShop, IsActive: true, Points: 50},
+		}
+
+		mockSettings.On("UpdateScanTypes", types).Return(nil).Once()
+
+		body := `{"scan_types":[{"name":"check_in","display_name":"Check In","category":"check_in","is_active":true},{"name":"walk_in","display_name":"Walk-In","category":"walk_in","is_active":true},{"name":"hoodie","display_name":"Hoodie","category":"shop","is_active":true,"points":50}]}`
+		req, err := http.NewRequest(http.MethodPut, "/", strings.NewReader(body))
+		require.NoError(t, err)
+		req.Header.Set("Content-Type", "application/json")
+		req = setUserContext(req, newSuperAdminUser())
+
+		rr := executeRequest(req, http.HandlerFunc(app.updateScanTypesHandler))
+		checkResponseCode(t, http.StatusOK, rr.Code)
+
+		mockSettings.AssertExpectations(t)
+	})
+
 	t.Run("400 negative points", func(t *testing.T) {
 		app := newTestApplication(t)
 
diff --git a/cmd/migrate/migrations/000025_alter_scans_add_repeatable.down.sql b/cmd/migrate/migrations/000025_alter_scans_add_repeatable.down.sql
new file mode 100644
index 00000000..c951b48c
--- /dev/null
+++ b/cmd/migrate/migrations/000025_alter_scans_add_repeatable.down.sql
@@ -0,0 +1,14 @@
+DROP INDEX IF EXISTS idx_scans_user_id;
+DROP INDEX IF EXISTS uq_scans_user_scan_type_once;
+
+-- Restoring the constraint fails if repeatable duplicate rows exist; remove
+-- all but the earliest scan per (user_id, scan_type) first.
+DELETE FROM scans s
+USING scans keep
+WHERE s.user_id = keep.user_id
+  AND s.scan_type = keep.scan_type
+  AND (s.created_at, s.id) > (keep.created_at, keep.id);
+
+ALTER TABLE scans ADD CONSTRAINT scans_user_id_scan_type_key UNIQUE (user_id, scan_type);
+
+ALTER TABLE scans DROP COLUMN IF EXISTS repeatable;
diff --git a/cmd/migrate/migrations/000025_alter_scans_add_repeatable.up.sql b/cmd/migrate/migrations/000025_alter_scans_add_repeatable.up.sql
new file mode 100644
index 00000000..805c621a
--- /dev/null
+++ b/cmd/migrate/migrations/000025_alter_scans_add_repeatable.up.sql
@@ -0,0 +1,10 @@
+-- Shop purchases may repeat per user; all other scan types stay once-per-user.
+ALTER TABLE scans ADD COLUMN repeatable BOOLEAN NOT NULL DEFAULT false;
+
+ALTER TABLE scans DROP CONSTRAINT scans_user_id_scan_type_key;
+
+CREATE UNIQUE INDEX uq_scans_user_scan_type_once ON scans(user_id, scan_type) WHERE NOT repeatable;
+
+-- Replaces the per-user lookup role of the dropped unique constraint's index
+-- (balance SUMs and check-in existence checks).
+CREATE INDEX idx_scans_user_id ON scans(user_id);
diff --git a/docs/docs.go b/docs/docs.go
index 80f1a71c..0ff8dbf4 100644
--- a/docs/docs.go
+++ b/docs/docs.go
@@ -1201,7 +1201,7 @@ const docTemplate = `{
                         "CookieAuth": []
                     }
                 ],
-                "description": "Records a scan for a user. Validates scan type exists and is active. Non-check_in scans require the user to have checked in first.",
+                "description": "Records a scan for a user. Validates scan type exists and is active. Non-check_in scans require the user to have checked in first. Shop scans deduct the type's points from the user's balance and are repeatable.",
                 "consumes": [
                     "application/json"
                 ],
@@ -1252,6 +1252,17 @@ const docTemplate = `{
                             }
                         }
                     },
+                    "402": {
+                        "description": "Insufficient points for shop scan",
+                        "schema": {
+                            "type": "object",
+                            "properties": {
+                                "error": {
+                                    "type": "string"
+                                }
+                            }
+                        }
+                    },
                     "403": {
                         "description": "Forbidden",
                         "schema": {
@@ -6409,6 +6420,10 @@ const docTemplate = `{
         "main.CreateScanResponse": {
             "type": "object",
             "properties": {
+                "balance": {
+                    "description": "Balance is the user's remaining points; populated only for shop scans.",
+                    "type": "integer"
+                },
                 "created_at": {
                     "type": "string"
                 },
@@ -7685,7 +7700,8 @@ const docTemplate = `{
                         "meal",
                         "swag",
                         "other",
-                        "walk_in"
+                        "walk_in",
+                        "shop"
                     ],
                     "allOf": [
                         {
@@ -7719,14 +7735,16 @@ const docTemplate = `{
                 "meal",
                 "swag",
                 "other",
-                "walk_in"
+                "walk_in",
+                "shop"
             ],
             "x-enum-varnames": [
                 "ScanCategoryCheckIn",
                 "ScanCategoryMeal",
                 "ScanCategorySwag",
                 "ScanCategoryOther",
-                "ScanCategoryWalkIn"
+                "ScanCategoryWalkIn",
+                "ScanCategoryShop"
             ]
         },
         "store.ScheduleItem": {
diff --git a/internal/store/mock_store.go b/internal/store/mock_store.go
index 0c806712..0f13cc2d 100644
--- a/internal/store/mock_store.go
+++ b/internal/store/mock_store.go
@@ -414,6 +414,11 @@ func (m *MockScansStore) Create(ctx context.Context, scan *Scan) error {
 	return args.Error(0)
 }
 
+func (m *MockScansStore) CreatePurchase(ctx context.Context, scan *Scan) (int, error) {
+	args := m.Called(scan)
+	return args.Int(0), args.Error(1)
+}
+
 func (m *MockScansStore) GetByUserID(ctx context.Context, userID string) ([]Scan, error) {
 	args := m.Called(userID)
 	if args.Get(0) == nil {
diff --git a/internal/store/scans.go b/internal/store/scans.go
index 5e303325..92c1fea3 100644
--- a/internal/store/scans.go
+++ b/internal/store/scans.go
@@ -19,12 +19,13 @@ const (
 	ScanCategorySwag    ScanTypeCategory = "swag"
 	ScanCategoryOther   ScanTypeCategory = "other"
 	ScanCategoryWalkIn  ScanTypeCategory = "walk_in"
+	ScanCategoryShop    ScanTypeCategory = "shop"
 )
 
 type ScanType struct {
 	Name        string           `json:"name" validate:"required,min=1,max=50"`
 	DisplayName string           `json:"display_name" validate:"required,min=1,max=100"`
-	Category    ScanTypeCategory `json:"category" validate:"required,oneof=check_in meal swag other walk_in"`
+	Category    ScanTypeCategory `json:"category" validate:"required,oneof=check_in meal swag other walk_in shop"`
 	IsActive    bool             `json:"is_active"`
 	Points      int              `json:"points" validate:"min=0"`
 }
@@ -86,6 +87,63 @@ func (s *ScansStore) Create(ctx context.Context, scan *Scan) error {
 	return tx.Commit()
 }
 
+// CreatePurchase inserts a repeatable scan with negative points after verifying
+// the user's balance covers the cost. Returns the resulting balance. A
+// per-user advisory lock serializes concurrent purchases so two scans cannot
+// both pass the balance check; concurrent awards only increase the balance so
+// they cannot invalidate a passed check.
+func (s *ScansStore) CreatePurchase(ctx context.Context, scan *Scan) (int, error) {
+	ctx, cancel := context.WithTimeout(ctx, QueryTimeoutDuration)
+	defer cancel()
+
+	tx, err := s.db.BeginTx(ctx, nil)
+	if err != nil {
+		return 0, err
+	}
+	defer tx.Rollback()
+
+	if _, err := tx.ExecContext(ctx, `SELECT pg_advisory_xact_lock(hashtextextended($1, 0))`, scan.UserID); err != nil {
+		return 0, err
+	}
+
+	var balance int
+	err = tx.QueryRowContext(ctx, `SELECT COALESCE(SUM(points), 0) FROM scans WHERE user_id = $1`, scan.UserID).
+		Scan(&balance)
+	if err != nil {
+		return 0, err
+	}
+
+	if balance+scan.Points < 0 {
+		return balance, ErrInsufficientPoints
+	}
+
+	query := `
+		INSERT INTO scans (user_id, scan_type, scanned_by, points, repeatable)
+		VALUES ($1, $2, $3, $4, TRUE)
+		RETURNING id, scanned_at, created_at
+	`
+
+	err = tx.QueryRowContext(ctx, query, scan.UserID, scan.ScanType, scan.ScannedBy, scan.Points).
+		Scan(&scan.ID, &scan.ScannedAt, &scan.CreatedAt)
+	if err != nil {
+		var pgErr *pgconn.PgError
+		if errors.As(err, &pgErr) && pgErr.Code == "23503" {
+			return 0, ErrNotFound
+		}
+		return 0, err
+	}
+
+	if err := incrementScanStat(ctx, tx, scan.ScanType); err != nil {
+		return 0, err
+	}
+
+	if err := tx.Commit(); err != nil {
+		return 0, err
+	}
+
+	return balance + scan.Points, nil
+}
+
 func (s *ScansStore) GetByUserID(ctx context.Context, userID string) ([]Scan, error) {
 	ctx, cancel := context.WithTimeout(ctx, QueryTimeoutDuration)
 	defer cancel()
diff --git a/internal/store/storage.go b/internal/store/storage.go
index 78bcfb7f..7907d5b8 100644
--- a/internal/store/storage.go
+++ b/internal/store/storage.go
@@ -10,9 +10,10 @@ import (
 )
 
 var (
-	ErrNotFound          = errors.New("resource not found")
-	ErrConflict          = errors.New("resource already exists")
-	QueryTimeoutDuration = time.Second * 5
+	ErrNotFound           = errors.New("resource not found")
+	ErrConflict           = errors.New("resource already exists")
+	ErrInsufficientPoints = errors.New("insufficient points")
+	QueryTimeoutDuration  = time.Second * 5
 )
 
 type Storage struct {
@@ -76,6 +77,7 @@ type Storage struct {
 	}
 	Scans interface {
 		Create(ctx context.Context, scan *Scan) error
+		CreatePurchase(ctx context.Context, scan *Scan) (int, error)
 		GetByUserID(ctx context.Context, userID string) ([]Scan, error)
 		GetStats(ctx context.Context) ([]ScanStat, error)
 		HasCheckIn(ctx context.Context, userID string, checkInTypes []string) (bool, error)

From a589326ff6642b2a1fb5cbcdef26a76a4c36cea5 Mon Sep 17 00:00:00 2001
From: axv2655 <arnav.vedula@yahoo.com>
Date: Fri, 24 Jul 2026 21:29:55 -0500
Subject: [PATCH 3/5] fix: moved location of point name to superadmin section

---
 .../web/src/pages/admin/scans/ScansPage.tsx   |   2 -
 .../settings/components/SettingsDialog.tsx    |   5 +
 .../superadmin/settings/tabs/ScansTab.tsx     | 119 ++++++++++++++++++
 3 files changed, 124 insertions(+), 2 deletions(-)
 create mode 100644 client/web/src/pages/superadmin/settings/tabs/ScansTab.tsx

diff --git a/client/web/src/pages/admin/scans/ScansPage.tsx b/client/web/src/pages/admin/scans/ScansPage.tsx
index 94b56482..ff47f191 100644
--- a/client/web/src/pages/admin/scans/ScansPage.tsx
+++ b/client/web/src/pages/admin/scans/ScansPage.tsx
@@ -4,7 +4,6 @@ import { Card, CardContent, CardHeader } from "@/components/ui/card";
 import { Skeleton } from "@/components/ui/skeleton";
 import { useUserStore } from "@/shared/stores/user";
 
-import { PointsNameCard } from "./components/PointsNameCard";
 import { ScannerDialog } from "./components/ScannerDialog";
 import { ScanStatsCards } from "./components/ScanStatsCards";
 import { ScanTypesTable } from "./components/ScanTypesTable";
@@ -77,7 +76,6 @@ export default function ScansPage() {
         stats={stats}
         loading={typesLoading || statsLoading}
       />
-      <PointsNameCard isSuperAdmin={isSuperAdmin} />
       <ScanTypesTable
         scanTypes={scanTypes}
         stats={stats}
diff --git a/client/web/src/pages/superadmin/settings/components/SettingsDialog.tsx b/client/web/src/pages/superadmin/settings/components/SettingsDialog.tsx
index e3d53d24..f5840aaf 100644
--- a/client/web/src/pages/superadmin/settings/components/SettingsDialog.tsx
+++ b/client/web/src/pages/superadmin/settings/components/SettingsDialog.tsx
@@ -4,6 +4,7 @@ import {
   AlertTriangle,
   BookOpen,
   CalendarRange,
+  ScanLine,
   ShieldCheck,
   UtensilsCrossed,
 } from "lucide-react";
@@ -26,12 +27,14 @@ import HackerPackTab from "../tabs/HackerPackTab";
 import MealGroupsTab from "../tabs/MealGroupsTab";
 import PermissionsTab from "../tabs/PermissionsTab";
 import { ResetHackathonCard } from "../tabs/ResetHackathonCard";
+import ScansTab from "../tabs/ScansTab";
 import ScheduleTab from "../tabs/ScheduleTab";
 
 type SettingsTab =
   | "permissions"
   | "schedule"
   | "meal-groups"
+  | "scans"
   | "hacker-pack"
   | "reset";
 
@@ -39,6 +42,7 @@ const settingsTabs = [
   { id: "permissions" as const, label: "Permissions", icon: ShieldCheck },
   { id: "schedule" as const, label: "Schedule", icon: CalendarRange },
   { id: "meal-groups" as const, label: "Meal Groups", icon: UtensilsCrossed },
+  { id: "scans" as const, label: "Scans", icon: ScanLine },
   { id: "hacker-pack" as const, label: "Hacker Pack", icon: BookOpen },
   { id: "reset" as const, label: "Danger Zone", icon: AlertTriangle },
 ];
@@ -97,6 +101,7 @@ export function SettingsDialog({ trigger }: SettingsDialogProps) {
                 {activeTab === "permissions" && <PermissionsTab />}
                 {activeTab === "schedule" && <ScheduleTab />}
                 {activeTab === "meal-groups" && <MealGroupsTab />}
+                {activeTab === "scans" && <ScansTab />}
                 {activeTab === "hacker-pack" && <HackerPackTab />}
                 {activeTab === "reset" && <ResetHackathonCard />}
               </div>
diff --git a/client/web/src/pages/superadmin/settings/tabs/ScansTab.tsx b/client/web/src/pages/superadmin/settings/tabs/ScansTab.tsx
new file mode 100644
index 00000000..d436dab6
--- /dev/null
+++ b/client/web/src/pages/superadmin/settings/tabs/ScansTab.tsx
@@ -0,0 +1,119 @@
+import { Loader2 } from "lucide-react";
+import { useEffect, useState } from "react";
+import { toast } from "sonner";
+
+import { Button } from "@/components/ui/button";
+import { Input } from "@/components/ui/input";
+import { Label } from "@/components/ui/label";
+import { errorAlert, getRequest, postRequest } from "@/shared/lib/api";
+
+interface PointsNameResponse {
+  name: string;
+}
+
+export default function ScansTab() {
+  const [pointsName, setPointsName] = useState("");
+  const [draft, setDraft] = useState("");
+  const [loading, setLoading] = useState(true);
+  const [saving, setSaving] = useState(false);
+
+  useEffect(() => {
+    async function fetchPointsName() {
+      const res = await getRequest<PointsNameResponse>(
+        "/points-name",
+        "points name",
+      );
+      if (res.status === 200 && res.data) {
+        setPointsName(res.data.name);
+        setDraft(res.data.name);
+      } else {
+        errorAlert(res);
+      }
+      setLoading(false);
+    }
+    fetchPointsName();
+  }, []);
+
+  const dirty = draft.trim() !== pointsName;
+
+  async function handleSave() {
+    const trimmed = draft.trim();
+    if (!trimmed) {
+      toast.error("Points system name must not be empty");
+      return;
+    }
+    if (trimmed.length > 30) {
+      toast.error("Points system name must be at most 30 characters");
+      return;
+    }
+
+    setSaving(true);
+    const res = await postRequest<PointsNameResponse>(
+      "/superadmin/settings/points-name",
+      { name: trimmed },
+      "points name",
+    );
+
+    if (res.status === 200 && res.data) {
+      setPointsName(res.data.name);
+      setDraft(res.data.name);
+      toast.success("Points system name saved");
+    } else {
+      errorAlert(res, "Failed to save points system name");
+    }
+    setSaving(false);
+  }
+
+  return (
+    <div className="space-y-4">
+      <h3 className="text-lg text-zinc-100">Scans</h3>
+      <p className="text-sm text-zinc-400">
+        Configure scan and points settings.
+      </p>
+
+      <div className="bg-zinc-900 rounded-md p-4 space-y-3">
+        <div className="space-y-1">
+          <Label
+            htmlFor="points-name"
+            className="text-sm font-medium text-zinc-100"
+          >
+            Points System Name
+          </Label>
+          <p className="text-xs text-zinc-500">
+            The display name used for points across the platform (e.g.
+            &ldquo;Coins&rdquo;, &ldquo;Tokens&rdquo;).
+          </p>
+        </div>
+        <div className="flex items-center gap-2">
+          <Input
+            id="points-name"
+            value={draft}
+            onChange={(e) => setDraft(e.target.value)}
+            onKeyDown={(e) => {
+              if (e.key === "Enter" && dirty) handleSave();
+            }}
+            placeholder="Points"
+            className="h-8 w-48 text-sm font-light bg-zinc-800 border-zinc-700 text-zinc-100"
+            maxLength={30}
+            disabled={loading}
+          />
+          {dirty && (
+            <Button
+              size="sm"
+              variant="outline"
+              className="cursor-pointer border-zinc-700 text-zinc-100 hover:bg-zinc-800"
+              disabled={saving}
+              onClick={handleSave}
+            >
+              {saving ? (
+                <Loader2 className="size-3.5 animate-spin" />
+              ) : (
+                "Save"
+              )}
+            </Button>
+          )}
+        </div>
+      </div>
+    </div>
+  );
+}

From 0e581f3fd96d718183f67044d7ff20571642f17f Mon Sep 17 00:00:00 2001
From: axv2655 <arnav.vedula@yahoo.com>
Date: Fri, 24 Jul 2026 21:32:32 -0500
Subject: [PATCH 4/5] refactor: ran prettier for ci

---
 client/web/src/pages/admin/scans/api.ts                  | 6 +-----
 .../src/pages/admin/scans/components/ScanTypesTable.tsx  | 9 ++++++++-
 .../web/src/pages/superadmin/settings/tabs/ScansTab.tsx  | 6 +-----
 3 files changed, 10 insertions(+), 11 deletions(-)

diff --git a/client/web/src/pages/admin/scans/api.ts b/client/web/src/pages/admin/scans/api.ts
index 8fdd833d..e9f5ccd3 100644
--- a/client/web/src/pages/admin/scans/api.ts
+++ b/client/web/src/pages/admin/scans/api.ts
@@ -66,11 +66,7 @@ export async function saveScanTypes(
 export async function fetchPointsName(
   signal?: AbortSignal,
 ): Promise<ApiResponse<PointsNameResponse>> {
-  return getRequest<PointsNameResponse>(
-    "/points-name",
-    "points name",
-    signal,
-  );
+  return getRequest<PointsNameResponse>("/points-name", "points name", signal);
 }
 
 export async function savePointsName(
diff --git a/client/web/src/pages/admin/scans/components/ScanTypesTable.tsx b/client/web/src/pages/admin/scans/components/ScanTypesTable.tsx
index e7c67942..b7ebccbb 100644
--- a/client/web/src/pages/admin/scans/components/ScanTypesTable.tsx
+++ b/client/web/src/pages/admin/scans/components/ScanTypesTable.tsx
@@ -144,7 +144,14 @@ export function ScanTypesTable({
     }
 
     onSave(updated);
-  }, [editingIndex, editDisplayName, editPoints, scanTypes, pendingNew, onSave]);
+  }, [
+    editingIndex,
+    editDisplayName,
+    editPoints,
+    scanTypes,
+    pendingNew,
+    onSave,
+  ]);
 
   // Ref to avoid stale closures in event listeners
   const saveDisplayNameRef = useRef(saveDisplayName);
diff --git a/client/web/src/pages/superadmin/settings/tabs/ScansTab.tsx b/client/web/src/pages/superadmin/settings/tabs/ScansTab.tsx
index d436dab6..17dfd97c 100644
--- a/client/web/src/pages/superadmin/settings/tabs/ScansTab.tsx
+++ b/client/web/src/pages/superadmin/settings/tabs/ScansTab.tsx
@@ -105,11 +105,7 @@ export default function ScansTab() {
               disabled={saving}
               onClick={handleSave}
             >
-              {saving ? (
-                <Loader2 className="size-3.5 animate-spin" />
-              ) : (
-                "Save"
-              )}
+              {saving ? <Loader2 className="size-3.5 animate-spin" /> : "Save"}
             </Button>
           )}
         </div>

From a32e8f33282ec5f6e5b7d6280505736f554e3ab8 Mon Sep 17 00:00:00 2001
From: axv2655 <arnav.vedula@yahoo.com>
Date: Fri, 24 Jul 2026 21:35:24 -0500
Subject: [PATCH 5/5] fix: fixed build

---
 client/web/src/pages/admin/scans/components/ScanStatsCards.tsx | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/client/web/src/pages/admin/scans/components/ScanStatsCards.tsx b/client/web/src/pages/admin/scans/components/ScanStatsCards.tsx
index 37bf6747..c2c6f7a4 100644
--- a/client/web/src/pages/admin/scans/components/ScanStatsCards.tsx
+++ b/client/web/src/pages/admin/scans/components/ScanStatsCards.tsx
@@ -2,6 +2,7 @@ import {
   DoorOpen,
   Gift,
   MoreHorizontal,
+  ShoppingBag,
   UserCheck,
   Utensils,
 } from "lucide-react";
@@ -19,6 +20,7 @@ const categoryIcons: Record<ScanTypeCategory, typeof UserCheck> = {
   check_in: UserCheck,
   meal: Utensils,
   swag: Gift,
+  shop: ShoppingBag,
   other: MoreHorizontal,
   walk_in: DoorOpen,
 };