Build driver app, Uber-style dispatch, POI suggestions; fix map tiles

Driver side (was a stub):
- In-app driver onboarding: a driver-role user creates their own linked
  drivers profile (driver/profile+api GET/POST/PATCH).
- Driver dashboard: online/offline toggle, today's earnings, incoming
  request cards (accept/decline), active ride panel (start/complete trip).
  Polls /driver/rides every 4s while online.
- Location heartbeat (use-driver-location): watchPositionAsync pings
  /driver/location every ~5s; restarts the watch on app foreground so a
  backgrounded driver doesn't go permanently stale and miss requests.

Dispatch (auto-match nearest, Uber-style):
- Ride state machine: requested -> accepted -> en_route -> completed/cancelled
  with a nullable driver_id until matched (lib/dispatch.matchNextDriver).
- matchNextDriver locks the ride (SELECT FOR UPDATE), expires 15s-stale
  offers, picks the nearest eligible driver of the matching service by
  haversine, offers one at a time. Called from ride/create, ride/[id] GET
  (lazy match on the rider's poll), and ride/[id]/respond (on decline).
- ride/create is now a request endpoint (driver_id NULL, status=requested,
  service); drops the pre-match driver_id payment reconciliation.
- ride/[id] GET returns status/service/nullable driver; PATCH handles rider
  cancel + driver en_route/completed. ride/list backs the history tabs.

Rider flow (best experience):
- confirm-ride is now a request screen: single trip fare + nearest-driver
  ETA + cash/card + Request Ride -> live status. Periodically polls online
  drivers of the selected service and disables Request when none are
  online (prevents the "stuck searching forever" state).
- book-ride is the live ride-status screen (searching -> accepted ->
  en_route -> completed/cancelled + Cancel), polling every 3s.
- lib/request-ride unifies the Areeba card flow + cash path.
- Map reads /driver/nearby (real positions, service-filtered); lib/map
  adds calculateTripFare + service-aware fares.

POI suggestions:
- lib/places (Google Nearby Search) + nearby-suggestions chips for
  mall/hospital/pharmacy/restaurant on the home screen.

Service categories now drive both matching and a per-service fare
multiplier (car 1.0 / moto 0.7 / courier 0.85 / chauffeur 1.5).

Map tiles: react-native-maps rendered blank on Android because no Google
Maps key was set. Switched app.json -> app.config.js so
android.config.googleMaps.apiKey is injected from
EXPO_PUBLIC_GOOGLE_API_KEY at build time (keeps the key out of git).
Requires a native rebuild (expo run:android) to take effect.

Also includes the prior payment/auth hardening (server-authoritative
payment_orders ledger with double-spend guards, peppered OTP, register
TOCTOU fix, stats cents fix) that was left uncommitted.

Co-Authored-By: Claude <noreply@anthropic.com>

app/(api)/(areeba)/create+api.ts

@@ -1,38 +1,123 @@
+import { randomUUID } from "crypto";
+
+import { requireAuth } from "@/lib/jwt";
 import { createCheckoutSession } from "@/lib/areeba";
+import { createOrder } from "@/lib/payment-orders";
+
+// Only these return URLs may be handed to the gateway. Anything else
+// (including open redirects) is rejected and we fall back to the deep link.
+const isAllowedReturnUrl = (url: string): boolean => {
+  try {
+    const parsed = new URL(url);
+
+    // The app's own deep link is always allowed.
+    if (parsed.protocol === "waseel:") return true;
+
+    // The configured server origin (EXPO_PUBLIC_SERVER_URL), if set.
+    const serverUrl = process.env.EXPO_PUBLIC_SERVER_URL;
+    if (serverUrl) {
+      const server = new URL(serverUrl);
+      if (parsed.protocol === server.protocol && parsed.host === server.host)
+        return true;
+    }
+
+    return false;
+  } catch {
+    return false;
+  }
+};
+
+// Resolve the fare to integer cents. Accept fare_cents directly, or fare /
+// amount in dollars (legacy client field) and convert.
+const resolveAmountCents = (fareCents: unknown, fare: unknown, amount: unknown): number | null => {
+  let cents: number;
+  if (fareCents !== undefined && fareCents !== null) {
+    cents = Math.round(Number(fareCents));
+  } else if (fare !== undefined && fare !== null) {
+    cents = Math.round(Number(fare) * 100);
+  } else if (amount !== undefined && amount !== null) {
+    cents = Math.round(Number(amount) * 100);
+  } else {
+    return null;
+  }
+
+  if (!Number.isFinite(cents) || cents <= 0) return null;
+  return cents;
+};
 
 export async function POST(req: Request) {
-  const body = await req.json();
-  const { name, email, amount, returnUrl } = body;
+  const auth = requireAuth(req);
+  if ("error" in auth) return auth.error;
 
-  if (!name || !email || !amount)
-    return new Response(
-      JSON.stringify({ error: "Missing required payment information." }),
+  const body = await req.json().catch(() => ({}));
+  const {
+    name,
+    email,
+    amount,
+    fare_cents,
+    fare,
+    returnUrl,
+    driver_id,
+    origin_address,
+    destination_address,
+    origin_latitude,
+    origin_longitude,
+    destination_latitude,
+    destination_longitude,
+    ride_time,
+  } = body;
+
+  if (!name || !email)
+    return Response.json(
+      { error: "Missing required payment information." },
       { status: 400 },
     );
 
+  const amountCents = resolveAmountCents(fare_cents, fare, amount);
+  if (amountCents === null)
+    return Response.json({ error: "Invalid fare amount." }, { status: 400 });
+
+  const finalReturnUrl =
+    typeof returnUrl === "string" && isAllowedReturnUrl(returnUrl)
+      ? returnUrl
+      : "waseel://book-ride";
+
   try {
-    const orderId = `waseel-${Date.now()}`;
+    const orderId = randomUUID();
 
     const session = await createCheckoutSession({
       orderId,
-      amount: parseFloat(amount),
+      amount: amountCents / 100,
       currency: "USD",
       description: `Waseel ride payment for ${name}`,
-      returnUrl: returnUrl || "waseel://book-ride",
+      returnUrl: finalReturnUrl,
     });
 
-    return new Response(
-      JSON.stringify({
-        orderId,
-        checkoutUrl: session.checkoutUrl,
-        successIndicator: session.successIndicator,
-      }),
-    );
+    // The successIndicator stays server-side; the client never sees it.
+    if (!session.successIndicator)
+      throw new Error("Areeba did not return a successIndicator.");
+
+    await createOrder({
+      order_id: orderId,
+      user_id: auth.userId,
+      amount_cents: amountCents,
+      currency: "USD",
+      driver_id: driver_id ?? null,
+      origin_address: origin_address ?? null,
+      destination_address: destination_address ?? null,
+      origin_latitude: origin_latitude ?? null,
+      origin_longitude: origin_longitude ?? null,
+      destination_latitude: destination_latitude ?? null,
+      destination_longitude: destination_longitude ?? null,
+      ride_time: ride_time ?? null,
+      success_indicator: session.successIndicator,
+      status: "pending",
+    });
+
+    return Response.json({ orderId, checkoutUrl: session.checkoutUrl });
   } catch (err) {
     console.log("[AREEBA_PAYMENT_CREATE]: ", err);
 
-    return new Response(JSON.stringify({ error: "Internal Server Error" }), {
-      status: 500,
-    });
+    return Response.json({ error: "Internal Server Error" }, { status: 500 });
   }
-}
+}

app/(api)/(areeba)/verify+api.ts

@@ -1,35 +1,69 @@
+import { requireAuth } from "@/lib/jwt";
 import { retrieveOrder } from "@/lib/areeba";
+import { getOrder, markPaid } from "@/lib/payment-orders";
 
 export async function POST(req: Request) {
-  const body = await req.json();
-  const { orderId, resultIndicator, successIndicator } = body;
+  const auth = requireAuth(req);
+  if ("error" in auth) return auth.error;
 
-  if (!orderId)
-    return new Response(JSON.stringify({ error: "Missing order id." }), {
-      status: 400,
-    });
+  const body = await req.json().catch(() => ({}));
+  const { orderId, resultIndicator } = body;
+
+  if (!orderId || !resultIndicator)
+    return Response.json(
+      { error: "Missing order id or result indicator." },
+      { status: 400 },
+    );
 
   try {
-    const order = await retrieveOrder(orderId);
+    // Look the order up server-side — never trust a client-supplied
+    // successIndicator value, only the one we persisted at creation time.
+    const order = await getOrder(orderId);
+    if (!order)
+      return Response.json({ error: "Order not found." }, { status: 404 });
 
-    // The gateway appends resultIndicator to the return URL after payment;
-    // it must match the successIndicator issued when the session was created.
-    const indicatorMatches =
-      !successIndicator || resultIndicator === successIndicator;
+    if (order.user_id !== auth.userId)
+      return Response.json({ error: "Unauthorized." }, { status: 403 });
 
-    return new Response(
-      JSON.stringify({
-        success: order.paid && indicatorMatches,
-        status: order.status,
-        amount: order.amount,
-        currency: order.currency,
-      }),
-    );
+    // An order can only be verified once. A 'paid' or 'consumed' order has
+    // already settled — rejecting here is the primary double-spend defense: it
+    // stops a client from re-verifying an order it already used for a ride.
+    if (order.status !== "pending")
+      return Response.json(
+        { error: "This payment order is no longer pending." },
+        { status: 400 },
+      );
+
+    if (
+      !order.success_indicator ||
+      order.success_indicator !== resultIndicator
+    )
+      return Response.json(
+        { error: "Payment verification failed." },
+        { status: 400 },
+      );
+
+    const retrieved = await retrieveOrder(orderId);
+
+    if (!retrieved.paid)
+      return Response.json({ error: "Payment not captured." }, { status: 400 });
+
+    // Reconcile the gateway's amount/currency against what we stored, so a
+    // tampered or partial payment cannot mark a full-fare order paid.
+    const gatewayCents = Math.round(Number(retrieved.amount) * 100);
+    const gatewayCurrency = retrieved.currency ?? "USD";
+    if (gatewayCents !== order.amount_cents || gatewayCurrency !== order.currency)
+      return Response.json(
+        { error: "Payment amount mismatch." },
+        { status: 400 },
+      );
+
+    await markPaid(orderId);
+
+    return Response.json({ success: true, orderId });
   } catch (err) {
     console.log("[AREEBA_PAYMENT_VERIFY]: ", err);
 
-    return new Response(JSON.stringify({ error: "Internal Server Error" }), {
-      status: 500,
-    });
+    return Response.json({ error: "Internal Server Error" }, { status: 500 });
   }
-}
+}