Waseel: driver capture, chat/calls, dispatch, and session fixes

Driver onboarding now photographs the licence, ID card and vehicle
registration and reads the credential fields off them, plus a camera-only
profile selfie riders check the arriving driver against. Adds in-app chat
and WebRTC calls, push-backed ride offers, ratings, cancellation and
payment sheets, settlement, and the owner dashboard endpoints behind them.

Camera permission on Android:
  - Declare CAMERA and READ_MEDIA_IMAGES in the manifest. expo-image-picker's
    own plugin never declares CAMERA, and Android denies a request for an
    undeclared permission instantly and silently — no dialog is ever shown,
    which is indistinguishable from the app not asking at all.
  - Handle canAskAgain: once Android stops showing the dialog, repeating why
    we need it is a dead end, so offer Open Settings instead (lib/capture-
    permission.ts), matching what the location flow already did.

Session: a 401 on a request that carried a token now ends the session
instead of being reinterpreted per-screen — driver-home had been reading it
as "this user has no driver profile" and showing an onboarding form to an
already-onboarded driver. Requests without a token are exempt so a failed
sign-in doesn't sign you out, and the notification is latched per token so
concurrent polls tear the session down once. (root) gains the auth guard
that turns that into the sign-in screen; app/index.tsx only guarded the way
in, leaving a session that ended mid-screen with nowhere to go.

Also ignore .uploads/ — it holds driver licence, ID and vehicle scans plus
profile photos, which are personal data and must not be committed.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

lib/request-ride.ts

@@ -4,33 +4,26 @@ import { ApiError, fetchAPI } from "@/lib/fetch";
 import type { ServiceId } from "@/constants/services";
 import type { Ride } from "@/types/type";
 
-// The rider's request flow, used by the confirm-ride screen. This is the card
-// (Areeba hosted checkout -> server verify -> consume order -> create ride)
-// and cash (create ride directly) paths, now unified behind one entry point so
-// the screen doesn't re-implement the gateway dance.
+// The rider's side of dispatch, in two steps that used to be one.
 //
-// The ride is always created with status='requested' and driver_id=null; the
-// server's auto-match engine assigns a driver asynchronously. Returns the
-// created ride so the caller can navigate to the status screen.
+// Asking for a ride and paying for it are now separate moments: the request
+// goes out to nearby drivers the instant the rider taps "Find now", they watch
+// offers come back, and money only changes hands once they have picked the
+// driver they want. Nothing is charged for a ride nobody takes.
 
 export type RequestInput = {
-  method: "cash" | "card";
   service: ServiceId;
-  user: { name: string; email: string };
-  // Location snapshot at request time.
   origin: { address: string; latitude: number; longitude: number };
   destination: { address: string; latitude: number; longitude: number };
   rideTimeSeconds: number;
   fareCents: number;
 };
 
-export type RequestResult = { ride: Ride };
-
-const recordRide = async (
-  input: RequestInput,
-  method: "cash" | "card",
-  orderId?: string,
-): Promise<Ride> => {
+/**
+ * Step one: open the request. Returns the created ride, which is already
+ * being broadcast to drivers by the time this resolves.
+ */
+export const createRideRequest = async (input: RequestInput): Promise<Ride> => {
   const res = await fetchAPI("/(api)/ride/create", {
     method: "POST",
     headers: { "Content-Type": "application/json" },
@@ -43,44 +36,50 @@ const recordRide = async (
       destination_longitude: input.destination.longitude,
       ride_time: Math.round(input.rideTimeSeconds),
       fare_price: input.fareCents,
-      payment_method: method,
       service: input.service,
-      ...(orderId ? { payment_order_id: orderId } : {}),
     }),
   });
   return res.data as Ride;
 };
 
-export const requestRide = async (input: RequestInput): Promise<RequestResult> => {
-  if (input.method === "cash") {
-    const ride = await recordRide(input, "cash");
-    return { ride };
-  }
+/**
+ * Take a card payment for a ride that already exists, and return the paid
+ * order id for the selection call.
+ *
+ * The order is only *consumed* when the driver is assigned, so if the pick
+ * then fails — the driver took another job while the rider was in the payment
+ * sheet — the same order id can be used for the next driver rather than the
+ * rider paying twice.
+ */
+export const payByCard = async (input: {
+  ride: Ride;
+  user: { name: string; email: string };
+}): Promise<string> => {
+  const { ride, user } = input;
 
-  // Card: create an Areeba checkout session on our server.
   const { orderId, checkoutUrl, error } = await fetchAPI(
     "/(api)/(areeba)/create",
     {
       method: "POST",
       headers: { "Content-Type": "application/json" },
       body: JSON.stringify({
-        name: input.user.name || input.user.email,
-        email: input.user.email,
-        fare_cents: input.fareCents,
-        origin_address: input.origin.address,
-        destination_address: input.destination.address,
-        origin_latitude: input.origin.latitude,
-        origin_longitude: input.origin.longitude,
-        destination_latitude: input.destination.latitude,
-        destination_longitude: input.destination.longitude,
-        ride_time: Math.round(input.rideTimeSeconds),
+        name: user.name || user.email,
+        email: user.email,
+        fare_cents: ride.fare_price,
+        origin_address: ride.origin_address,
+        destination_address: ride.destination_address,
+        origin_latitude: ride.origin_latitude,
+        origin_longitude: ride.origin_longitude,
+        destination_latitude: ride.destination_latitude,
+        destination_longitude: ride.destination_longitude,
+        ride_time: ride.ride_time,
       }),
     },
   );
   if (error || !checkoutUrl) throw new Error(error || "No checkout URL");
 
-  // Open Areeba's hosted payment page. After payment the gateway redirects
-  // back to the app (waseel://book-ride).
+  // Areeba's hosted payment page. After payment the gateway redirects back to
+  // the app (waseel://book-ride).
   const browserResult = await WebBrowser.openAuthSessionAsync(
     checkoutUrl,
     "waseel://book-ride",
@@ -88,12 +87,13 @@ export const requestRide = async (input: RequestInput): Promise<RequestResult> =
 
   let resultIndicator: string | undefined;
   if (browserResult.type === "success" && browserResult.url) {
-    resultIndicator = new URL(browserResult.url).searchParams.get(
-      "resultIndicator",
-    ) ?? undefined;
+    resultIndicator =
+      new URL(browserResult.url).searchParams.get("resultIndicator") ??
+      undefined;
   }
 
-  // Verify the payment server-side.
+  // The gateway's word is never taken from the client: the server asks Areeba
+  // directly before the order is marked paid.
   const verification = await fetchAPI("/(api)/(areeba)/verify", {
     method: "POST",
     headers: { "Content-Type": "application/json" },
@@ -107,6 +107,26 @@ export const requestRide = async (input: RequestInput): Promise<RequestResult> =
     );
   }
 
-  const ride = await recordRide(input, "card", orderId);
-  return { ride };
-};
+  return orderId as string;
+};
+
+/**
+ * Step two: pick a driver. This is the call that assigns the ride, records how
+ * it will be paid, and releases every other driver who offered.
+ */
+export const selectDriver = async (input: {
+  rideId: number;
+  offerId: number;
+  method: "cash" | "card";
+  orderId?: string;
+}): Promise<void> => {
+  await fetchAPI(`/(api)/ride/${input.rideId}/select`, {
+    method: "POST",
+    headers: { "Content-Type": "application/json" },
+    body: JSON.stringify({
+      offer_id: input.offerId,
+      payment_method: input.method,
+      ...(input.orderId ? { payment_order_id: input.orderId } : {}),
+    }),
+  });
+};