georges/waseel
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Waseel: driver capture, chat/calls, dispatch, and session fixes

Browse Source 
Driver onboarding now photographs the licence, ID card and vehicle
registration and reads the credential fields off them, plus a camera-only
profile selfie riders check the arriving driver against. Adds in-app chat
and WebRTC calls, push-backed ride offers, ratings, cancellation and
payment sheets, settlement, and the owner dashboard endpoints behind them.

Camera permission on Android:
  - Declare CAMERA and READ_MEDIA_IMAGES in the manifest. expo-image-picker's
    own plugin never declares CAMERA, and Android denies a request for an
    undeclared permission instantly and silently — no dialog is ever shown,
    which is indistinguishable from the app not asking at all.
  - Handle canAskAgain: once Android stops showing the dialog, repeating why
    we need it is a dead end, so offer Open Settings instead (lib/capture-
    permission.ts), matching what the location flow already did.

Session: a 401 on a request that carried a token now ends the session
instead of being reinterpreted per-screen — driver-home had been reading it
as "this user has no driver profile" and showing an onboarding form to an
already-onboarded driver. Requests without a token are exempt so a failed
sign-in doesn't sign you out, and the notification is latched per token so
concurrent polls tear the session down once. (root) gains the auth guard
that turns that into the sign-in screen; app/index.tsx only guarded the way
in, leaving a session that ended mid-screen with nowhere to go.

Also ignore .uploads/ — it holds driver licence, ID and vehicle scans plus
profile photos, which are personal data and must not be committed.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
This commit is contained in:
Krikorios
2026-08-26 02:17:55 +03:00
co-authored by Claude Opus 5
parent 1d84003e0a
commit 8807ff41c5
111 changed files with 14568 additions and 1411 deletions
Download Patch File Download Diff File Expand all files Collapse all files
app/(api)/ride/create+api.ts
+44 -118
View File
@@ -1,18 +1,25 @@
import { requireAuth } from "@/lib/jwt";
import { sql, transaction } from "@/lib/db";
import { getOrder, consumeOrderForRide } from "@/lib/payment-orders";
import { matchNextDriver } from "@/lib/dispatch";
import { sql } from "@/lib/db";
import { broadcastRequest } from "@/lib/dispatch";
import { isServiceId } from "@/lib/driver";
import { ACTIVE_STATUS_ARRAY } from "@/lib/ride-lifecycle";
import { DEFAULT_SERVICE } from "@/constants/services";
// Explicit missing check — a truthy check would reject legitimate 0 values
// like latitude 0.0 (the equator) or a zero fare.
const isMissing = (v: unknown): boolean => v === undefined || v === null;
// POST — request a ride. The rider no longer picks a driver; the ride is
// created with status='requested' and driver_id=NULL, then auto-match offers
// it to the nearest eligible driver of the requested service. `driver_id` in
// the body is accepted for backward compatibility but ignored.
// POST — open a ride request.
//
// This fires the moment the rider taps "Find now", before any payment
// decision: the ride is created with status='requested', driver_id=NULL and
// payment_status='pending', then broadcast to every eligible driver near the
// pickup. Drivers volunteer, the rider picks one, and /ride/:id/select is
// where the driver, the payment method and (for card) the paid order all land
// together.
//
// Nothing is charged here, so there is nothing to refund if no driver takes
// it — which is the point of moving payment behind the pick.
export async function POST(request: Request) {
const auth = requireAuth(request);
if ("error" in auth) return auth.error;
@@ -28,8 +35,6 @@ export async function POST(request: Request) {
destination_longitude,
ride_time,
fare_price,
payment_method,
payment_order_id,
service,
} = body;
@@ -49,116 +54,33 @@ export async function POST(request: Request) {
);
}
if (payment_method !== "card" && payment_method !== "cash")
return Response.json(
{ error: "Invalid payment method." },
{ status: 400 },
);
const rideService = isServiceId(service) ? service : DEFAULT_SERVICE;
const fareCents = Math.round(Number(fare_price));
if (payment_method === "card") {
// Card: the ride is only recorded once a paid, server-authoritative
// payment order is consumed. The client can no longer self-declare
// payment_status='paid'.
if (isMissing(payment_order_id))
return Response.json(
{ error: "Missing payment order id." },
{ status: 400 },
);
const order = await getOrder(payment_order_id);
if (!order)
return Response.json(
{ error: "Payment order not found." },
{ status: 404 },
);
if (order.user_id !== auth.userId)
return Response.json({ error: "Unauthorized." }, { status: 403 });
if (order.status !== "paid")
return Response.json(
{ error: "Payment not verified." },
{ status: 400 },
);
if (order.amount_cents !== fareCents)
return Response.json(
{ error: "Payment amount mismatch." },
{ status: 400 },
);
// Reconcile route intent (driver isn't known yet, so driver_id is no
// longer part of the intent check). Null intent fields are skipped.
const intentsMatch =
(order.origin_address === null ||
order.origin_address === origin_address) &&
(order.destination_address === null ||
order.destination_address === destination_address) &&
(order.ride_time === null || order.ride_time === Number(ride_time));
if (!intentsMatch)
return Response.json(
{ error: "Payment does not match this ride." },
{ status: 400 },
);
// Consume the order and insert the ride on one connection, so a failure
// rolls back both and no paid order is wasted without a ride.
const inserted = await transaction(async (tx) => {
const consumed = await consumeOrderForRide(
payment_order_id,
auth.userId,
tx,
);
if (!consumed) throw new Error("PAYMENT_ORDER_NOT_CONSUMABLE");
const rows = await tx`
INSERT INTO rides (
origin_address,
destination_address,
origin_latitude,
origin_longitude,
destination_latitude,
destination_longitude,
ride_time,
fare_price,
payment_status,
driver_id,
user_id,
payment_order_id,
status,
service
) VALUES (
${origin_address},
${destination_address},
${origin_latitude},
${origin_longitude},
${destination_latitude},
${destination_longitude},
${ride_time},
${fareCents},
'paid',
NULL,
${auth.userId},
${payment_order_id},
'requested',
${rideService}
)
RETURNING *
`;
return rows[0];
});
// Kick off auto-match asynchronously — don't block the response on it.
void matchNextDriver(inserted.ride_id);
return Response.json({ data: inserted }, { status: 201 });
if (!Number.isFinite(fareCents) || fareCents <= 0) {
return Response.json({ error: "Invalid fare." }, { status: 400 });
}
// One ride in flight per rider. Without this a rider who backs out of the
// tracking screen and re-books ends up with two live requests broadcast to
// the same drivers, who then see the same job twice from one person.
const inFlight = await sql<{ ride_id: number; status: string }>`
SELECT ride_id, status FROM rides
WHERE user_id = ${auth.userId}
AND status = ANY(${ACTIVE_STATUS_ARRAY}::text[])
ORDER BY created_at DESC
LIMIT 1
`;
if (inFlight[0]) {
return Response.json(
{
error: "You already have a ride in progress.",
code: "RIDE_IN_PROGRESS",
ride_id: inFlight[0].ride_id,
},
{ status: 409 },
);
}
// Cash: settled directly with the driver at drop-off. No order involved.
const response = await sql`
INSERT INTO rides (
origin_address,
@@ -183,7 +105,7 @@ export async function POST(request: Request) {
${destination_longitude},
${ride_time},
${fareCents},
'cash',
'pending',
NULL,
${auth.userId},
'requested',
@@ -192,11 +114,15 @@ export async function POST(request: Request) {
RETURNING *
`;
void matchNextDriver(response[0].ride_id);
// Announce it to nearby drivers. Not awaited: the rider's screen should
// open on "looking for drivers" immediately, and the rider's own status
// poll re-drives the broadcast if this one loses its race with the push
// service.
void broadcastRequest(response[0].ride_id);
return Response.json({ data: response[0] }, { status: 201 });
} catch (error) {
console.error("[CREATE_RIDES]: ", error);
return Response.json({ error: "Internal Server Error" }, { status: 500 });
}
}
}