Waseel: driver capture, chat/calls, dispatch, and session fixes

Driver onboarding now photographs the licence, ID card and vehicle registration and reads the credential fields off them, plus a camera-only profile selfie riders check the arriving driver against. Adds in-app chat and WebRTC calls, push-backed ride offers, ratings, cancellation and payment sheets, settlement, and the owner dashboard endpoints behind them. Camera permission on Android: - Declare CAMERA and READ_MEDIA_IMAGES in the manifest. expo-image-picker's own plugin never declares CAMERA, and Android denies a request for an undeclared permission instantly and silently — no dialog is ever shown, which is indistinguishable from the app not asking at all. - Handle canAskAgain: once Android stops showing the dialog, repeating why we need it is a dead end, so offer Open Settings instead (lib/capture- permission.ts), matching what the location flow already did. Session: a 401 on a request that carried a token now ends the session instead of being reinterpreted per-screen — driver-home had been reading it as "this user has no driver profile" and showing an onboarding form to an already-onboarded driver. Requests without a token are exempt so a failed sign-in doesn't sign you out, and the notification is latched per token so concurrent polls tear the session down once. (root) gains the auth guard that turns that into the sign-in screen; app/index.tsx only guarded the way in, leaving a session that ended mid-screen with nowhere to go. Also ignore .uploads/ — it holds driver licence, ID and vehicle scans plus profile photos, which are personal data and must not be committed. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
2026-08-26 02:17:55 +03:00
parent 1d84003e0a
commit 8807ff41c5
111 changed files with 14568 additions and 1411 deletions
@@ -0,0 +1,154 @@
+import { sql } from "@/lib/db";
+import { requireRideParticipant, rideIsActive } from "@/lib/ride-participants";
+
+// In-app chat for a ride. Both the rider and the assigned driver can read and
+// post, but only while the ride is active (accepted / en_route); a terminal
+// ride is read-only so the conversation is frozen once the trip ends.
+
+type MessageRow = {
+  id: number;
+  ride_id: number;
+  sender_type: "rider" | "driver";
+  sender_id: string;
+  body: string;
+  created_at: string;
+  sender_name: string;
+  sender_avatar: string | null;
+};
+
+// GET — messages for the ride. `?since=<id>` returns only rows with id > since
+// (the polling cursor), oldest-first so the client can append directly. With
+// no cursor the full history is returned for the initial load.
+export async function GET(req: Request, { id }: { id: string }) {
+  const rideId = Number(id);
+  if (!Number.isInteger(rideId)) {
+    return Response.json({ error: "Invalid ride id." }, { status: 400 });
+  }
+
+  const participant = await requireRideParticipant(req, rideId);
+  if ("error" in participant) return participant.error;
+
+  const sinceParam = new URL(req.url).searchParams.get("since");
+  const since = Number(sinceParam);
+  const hasCursor = Number.isInteger(since) && since > 0;
+
+  try {
+    // The optional `since` cursor can't be a nested sql fragment (sql executes
+    // immediately), so branch into two queries that each take no extra params.
+    const rows = hasCursor
+      ? await sql<MessageRow>`
+          SELECT
+            m.id,
+            m.ride_id,
+            m.sender_type,
+            COALESCE(m.sender_user_id::text, m.sender_driver_id::text) AS sender_id,
+            m.body,
+            m.created_at,
+            COALESCE(u.name, CONCAT_WS(' ', d.first_name, d.last_name)) AS sender_name,
+            d.profile_image_url AS sender_avatar
+          FROM messages m
+          LEFT JOIN users u ON u.id = m.sender_user_id
+          LEFT JOIN drivers d ON d.id = m.sender_driver_id
+          WHERE m.ride_id = ${rideId} AND m.id > ${since}
+          ORDER BY m.id ASC
+        `
+      : await sql<MessageRow>`
+          SELECT
+            m.id,
+            m.ride_id,
+            m.sender_type,
+            COALESCE(m.sender_user_id::text, m.sender_driver_id::text) AS sender_id,
+            m.body,
+            m.created_at,
+            COALESCE(u.name, CONCAT_WS(' ', d.first_name, d.last_name)) AS sender_name,
+            d.profile_image_url AS sender_avatar
+          FROM messages m
+          LEFT JOIN users u ON u.id = m.sender_user_id
+          LEFT JOIN drivers d ON d.id = m.sender_driver_id
+          WHERE m.ride_id = ${rideId}
+          ORDER BY m.id ASC
+        `;
+
+    return Response.json({ data: rows });
+  } catch (error) {
+    console.error("[GET_MESSAGES]: ", error);
+    return Response.json({ error: "Internal Server Error." }, { status: 500 });
+  }
+}
+
+// POST — send a message. Rejected (409) if the ride is no longer active, so a
+// completed/cancelled trip can't receive new messages.
+export async function POST(req: Request, { id }: { id: string }) {
+  const rideId = Number(id);
+  if (!Number.isInteger(rideId)) {
+    return Response.json({ error: "Invalid ride id." }, { status: 400 });
+  }
+
+  const participant = await requireRideParticipant(req, rideId);
+  if ("error" in participant) return participant.error;
+
+  let body: { body?: string };
+  try {
+    body = await req.json();
+  } catch {
+    return Response.json({ error: "Invalid JSON body." }, { status: 400 });
+  }
+
+  const text = (body.body ?? "").trim();
+  if (!text) {
+    return Response.json({ error: "Message body is empty." }, { status: 400 });
+  }
+  if (text.length > 4000) {
+    return Response.json({ error: "Message is too long." }, { status: 400 });
+  }
+
+  try {
+    if (!(await rideIsActive(rideId))) {
+      return Response.json(
+        { error: "This ride is no longer active." },
+        { status: 409 },
+      );
+    }
+
+    const inserted = await sql<MessageRow>`
+      INSERT INTO messages (ride_id, sender_type, sender_user_id, sender_driver_id, body)
+      VALUES (
+        ${rideId},
+        ${participant.role},
+        ${participant.role === "rider" ? participant.userId : null},
+        ${participant.role === "driver" ? participant.driverId : null},
+        ${text}
+      )
+      RETURNING
+        id,
+        ride_id,
+        sender_type,
+        COALESCE(sender_user_id::text, sender_driver_id::text) AS sender_id,
+        body,
+        created_at
+    `;
+
+    // Join the sender's name/avatar for the returned row so the client can
+    // render the optimistic bubble identically to polled ones.
+    const message = inserted[0];
+    if (participant.role === "driver") {
+      const driver = await sql<{ name: string; avatar: string | null }>`
+        SELECT CONCAT_WS(' ', first_name, last_name) AS name, profile_image_url AS avatar
+        FROM drivers WHERE id = ${participant.driverId}
+      `;
+      message.sender_name = driver[0]?.name ?? "";
+      message.sender_avatar = driver[0]?.avatar ?? null;
+    } else {
+      const rider = await sql<{ name: string }>`
+        SELECT name FROM users WHERE id = ${participant.userId}
+      `;
+      message.sender_name = rider[0]?.name ?? "";
+      message.sender_avatar = null;
+    }
+
+    return Response.json({ data: message }, { status: 201 });
+  } catch (error) {
+    console.error("[POST_MESSAGE]: ", error);
+    return Response.json({ error: "Internal Server Error." }, { status: 500 });
+  }
+}