Build driver app, Uber-style dispatch, POI suggestions; fix map tiles

Driver side (was a stub): - In-app driver onboarding: a driver-role user creates their own linked drivers profile (driver/profile+api GET/POST/PATCH). - Driver dashboard: online/offline toggle, today's earnings, incoming request cards (accept/decline), active ride panel (start/complete trip). Polls /driver/rides every 4s while online. - Location heartbeat (use-driver-location): watchPositionAsync pings /driver/location every ~5s; restarts the watch on app foreground so a backgrounded driver doesn't go permanently stale and miss requests. Dispatch (auto-match nearest, Uber-style): - Ride state machine: requested -> accepted -> en_route -> completed/cancelled with a nullable driver_id until matched (lib/dispatch.matchNextDriver). - matchNextDriver locks the ride (SELECT FOR UPDATE), expires 15s-stale offers, picks the nearest eligible driver of the matching service by haversine, offers one at a time. Called from ride/create, ride/[id] GET (lazy match on the rider's poll), and ride/[id]/respond (on decline). - ride/create is now a request endpoint (driver_id NULL, status=requested, service); drops the pre-match driver_id payment reconciliation. - ride/[id] GET returns status/service/nullable driver; PATCH handles rider cancel + driver en_route/completed. ride/list backs the history tabs. Rider flow (best experience): - confirm-ride is now a request screen: single trip fare + nearest-driver ETA + cash/card + Request Ride -> live status. Periodically polls online drivers of the selected service and disables Request when none are online (prevents the "stuck searching forever" state). - book-ride is the live ride-status screen (searching -> accepted -> en_route -> completed/cancelled + Cancel), polling every 3s. - lib/request-ride unifies the Areeba card flow + cash path. - Map reads /driver/nearby (real positions, service-filtered); lib/map adds calculateTripFare + service-aware fares. POI suggestions: - lib/places (Google Nearby Search) + nearby-suggestions chips for mall/hospital/pharmacy/restaurant on the home screen. Service categories now drive both matching and a per-service fare multiplier (car 1.0 / moto 0.7 / courier 0.85 / chauffeur 1.5). Map tiles: react-native-maps rendered blank on Android because no Google Maps key was set. Switched app.json -> app.config.js so android.config.googleMaps.apiKey is injected from EXPO_PUBLIC_GOOGLE_API_KEY at build time (keeps the key out of git). Requires a native rebuild (expo run:android) to take effect. Also includes the prior payment/auth hardening (server-authoritative payment_orders ledger with double-spend guards, peppered OTP, register TOCTOU fix, stats cents fix) that was left uncommitted. Co-Authored-By: Claude <noreply@anthropic.com>
2026-08-24 13:57:21 +03:00
parent 4e0a7cca51
commit f50ff27e11
48 changed files with 3342 additions and 602 deletions
@@ -0,0 +1,44 @@
+import { requireDriverProfile } from "@/lib/driver";
+import { sql } from "@/lib/db";
+
+// POST — driver location heartbeat. Each ping updates lat/lng/last_seen and
+// keeps the driver marked online. The client (use-driver-location) fires this
+// every few seconds while the driver's online toggle is on; going offline is
+// an explicit PATCH to /driver/profile, not the absence of pings.
+export async function POST(req: Request) {
+  const result = await requireDriverProfile(req);
+  if ("error" in result) return result.error;
+
+  try {
+    const body = await req.json();
+    const { latitude, longitude } = body;
+
+    if (
+      typeof latitude !== "number" ||
+      typeof longitude !== "number" ||
+      Number.isNaN(latitude) ||
+      Number.isNaN(longitude)
+    ) {
+      return Response.json(
+        { error: "latitude and longitude must be numbers." },
+        { status: 400 },
+      );
+    }
+
+    const { driverId } = result;
+    const rows = await sql`
+      UPDATE drivers
+      SET latitude = ${latitude},
+          longitude = ${longitude},
+          last_seen = CURRENT_TIMESTAMP,
+          online = TRUE
+      WHERE id = ${driverId}
+      RETURNING id, latitude, longitude, last_seen, online
+    `;
+
+    return Response.json({ data: rows[0] });
+  } catch (error) {
+    console.error("[DRIVER_LOCATION]: ", error);
+    return Response.json({ error: "Internal Server Error" }, { status: 500 });
+  }
+}
@@ -0,0 +1,45 @@
+import { requireAuth } from "@/lib/jwt";
+import { sql } from "@/lib/db";
+
+// GET — online drivers of `service` near (lat,lng), for the rider map and the
+// "nearest driver ETA" estimate on confirm-ride. Only real, logged-in drivers
+// (user_id IS NOT NULL) with a fresh location ping are returned; legacy seed
+// rows have no position and are never shown to riders.
+//
+// Query: ?service=car&lat=33.89&lng=35.50&radius=8000
+export async function GET(req: Request) {
+  const auth = requireAuth(req);
+  if ("error" in auth) return auth.error;
+
+  try {
+    const url = new URL(req.url);
+    const service = url.searchParams.get("service") ?? "car";
+    const lat = Number(url.searchParams.get("lat"));
+    const lng = Number(url.searchParams.get("lng"));
+
+    if (Number.isNaN(lat) || Number.isNaN(lng)) {
+      return Response.json(
+        { error: "lat and lng query params are required numbers." },
+        { status: 400 },
+      );
+    }
+
+    const rows = await sql`
+      SELECT id, first_name, last_name, profile_image_url, car_image_url,
+             car_seats, rating, service, car_model, latitude, longitude,
+             last_seen
+      FROM drivers
+      WHERE service = ${service}
+        AND online = TRUE
+        AND user_id IS NOT NULL
+        AND last_seen > CURRENT_TIMESTAMP - INTERVAL '60 seconds'
+        AND latitude IS NOT NULL
+        AND longitude IS NOT NULL
+    `;
+
+    return Response.json({ data: rows });
+  } catch (error) {
+    console.error("[DRIVER_NEARBY]: ", error);
+    return Response.json({ error: "Internal Server Error" }, { status: 500 });
+  }
+}
@@ -0,0 +1,151 @@
+import { requireAuth } from "@/lib/jwt";
+import { sql, query } from "@/lib/db";
+import { isServiceId, requireDriverProfile } from "@/lib/driver";
+import { SERVICES, type ServiceId } from "@/constants/services";
+
+// GET — the signed-in user's own driver profile, or 403 (code: ONBOARD) when
+// they haven't onboarded yet. The client uses the code to show the form.
+export async function GET(req: Request) {
+  const result = await requireDriverProfile(req);
+  if ("error" in result) return result.error;
+
+  const { auth, driverId } = result;
+  const rows = await sql`
+    SELECT id, first_name, last_name, profile_image_url, car_image_url,
+           car_seats, rating, service, online, car_model, user_id
+    FROM drivers WHERE id = ${driverId}
+  `;
+  return Response.json({ data: rows[0], userId: auth.userId });
+}
+
+// POST — onboarding. A driver-role user creates their one linked drivers row.
+// The user must carry role='driver' (set on sign-up / role.tsx) so a rider
+// can't silently become a driver by hitting this endpoint.
+export async function POST(req: Request) {
+  const auth = requireAuth(req);
+  if ("error" in auth) return auth.error;
+
+  try {
+    const body = await req.json();
+    const { car_model, car_seats, service, profile_image_url, car_image_url } =
+      body;
+
+    // The user must be flagged a driver to onboard a driver profile.
+    const users = await sql<{ role: string | null; name: string | null }>`
+      SELECT role, name FROM users WHERE id = ${auth.userId}
+    `;
+    if (!users[0] || users[0].role !== "driver") {
+      return Response.json(
+        { error: "Only driver accounts can onboard a driver profile." },
+        { status: 403 },
+      );
+    }
+
+    if (!isServiceId(service)) {
+      return Response.json(
+        { error: `service must be one of: ${SERVICES.map((s) => s.id).join(", ")}.` },
+        { status: 400 },
+      );
+    }
+
+    const seats = Number(car_seats);
+    if (!Number.isInteger(seats) || seats < 1 || seats > 8) {
+      return Response.json(
+        { error: "car_seats must be a whole number between 1 and 8." },
+        { status: 400 },
+      );
+    }
+
+    const [firstName, ...rest] = (users[0].name ?? "").split(" ");
+
+    // One profile per driver user. The partial unique index on user_id
+    // guarantees this at the DB level; surface a clean 409 on collision.
+    try {
+      const rows = await sql`
+        INSERT INTO drivers (
+          user_id, first_name, last_name, profile_image_url, car_image_url,
+          car_seats, rating, service, car_model, online
+        ) VALUES (
+          ${auth.userId},
+          ${firstName || "Driver"},
+          ${rest.join(" ") || ""},
+          ${profile_image_url ?? null},
+          ${car_image_url ?? null},
+          ${seats},
+          5.0,
+          ${service as ServiceId},
+          ${car_model ?? null},
+          FALSE
+        )
+        RETURNING id, service, online
+      `;
+      return Response.json({ data: rows[0] }, { status: 201 });
+    } catch (error) {
+      if ((error as { code?: string }).code === "23505") {
+        return Response.json(
+          { error: "Driver profile already exists." },
+          { status: 409 },
+        );
+      }
+      throw error;
+    }
+  } catch (error) {
+    console.error("[DRIVER_PROFILE_POST]: ", error);
+    return Response.json({ error: "Internal Server Error" }, { status: 500 });
+  }
+}
+
+// PATCH — update mutable profile fields, most importantly the online toggle.
+export async function PATCH(req: Request) {
+  const result = await requireDriverProfile(req);
+  if ("error" in result) return result.error;
+
+  try {
+    const body = await req.json();
+    const { online, car_model, car_seats, service } = body;
+
+    const updates: string[] = [];
+    const values: (string | number | boolean | null)[] = [];
+    let idx = 1;
+    const push = (col: string, value: string | number | boolean | null) => {
+      updates.push(`${col} = $${idx++}`);
+      values.push(value);
+    };
+
+    if (typeof online === "boolean") push("online", online);
+    if (typeof car_model === "string" || car_model === null) push("car_model", car_model);
+    if (car_seats !== undefined) {
+      const seats = Number(car_seats);
+      if (!Number.isInteger(seats) || seats < 1 || seats > 8) {
+        return Response.json(
+          { error: "car_seats must be a whole number between 1 and 8." },
+          { status: 400 },
+        );
+      }
+      push("car_seats", seats);
+    }
+    if (service !== undefined) {
+      if (!isServiceId(service)) {
+        return Response.json(
+          { error: "Invalid service." },
+          { status: 400 },
+        );
+      }
+      push("service", service as string);
+    }
+
+    if (updates.length === 0) {
+      return Response.json({ error: "No fields to update." }, { status: 400 });
+    }
+
+    values.push(result.driverId);
+    const rows = await query(
+      `UPDATE drivers SET ${updates.join(", ")} WHERE id = $${idx} RETURNING *`,
+      values,
+    );
+    return Response.json({ data: rows[0] });
+  } catch (error) {
+    console.error("[DRIVER_PROFILE_PATCH]: ", error);
+    return Response.json({ error: "Internal Server Error" }, { status: 500 });
+  }
+}
@@ -0,0 +1,111 @@
+import { requireDriverProfile } from "@/lib/driver";
+import { sql } from "@/lib/db";
+
+// GET — the driver's world in one poll:
+//   offers  : incoming ride_offers awaiting this driver's accept/decline,
+//             each joined to its ride so the card can show pickup/dest/fare.
+//   active  : the ride this driver is currently on (accepted or en_route).
+//   recent  : rides completed today, for the earnings summary.
+export async function GET(req: Request) {
+  const result = await requireDriverProfile(req);
+  if ("error" in result) return result.error;
+
+  try {
+    const { driverId } = result;
+
+    const offers = await sql`
+      SELECT
+        ro.id AS offer_id, ro.offered_at,
+        r.ride_id, r.origin_address, r.destination_address,
+        r.origin_latitude, r.origin_longitude,
+        r.destination_latitude, r.destination_longitude,
+        r.ride_time, r.fare_price, r.payment_status, r.service, r.user_id
+      FROM ride_offers ro
+      JOIN rides r ON r.ride_id = ro.ride_id
+      WHERE ro.driver_id = ${driverId} AND ro.status = 'offered'
+      ORDER BY ro.offered_at DESC
+    `;
+
+    const active = await sql`
+      SELECT
+        r.ride_id, r.status, r.service, r.payment_status,
+        r.origin_address, r.destination_address,
+        r.origin_latitude, r.origin_longitude,
+        r.destination_latitude, r.destination_longitude,
+        r.ride_time, r.fare_price, r.created_at,
+        u.name AS rider_name, u.phone AS rider_phone
+      FROM rides r
+      LEFT JOIN users u ON u.id = r.user_id
+      WHERE r.driver_id = ${driverId} AND r.status IN ('accepted', 'en_route')
+      ORDER BY r.created_at DESC
+      LIMIT 1
+    `;
+
+    const recent = await sql`
+      SELECT ride_id, fare_price, service, completed_at
+      FROM rides
+      WHERE driver_id = ${driverId} AND status = 'completed'
+        AND completed_at >= CURRENT_DATE
+      ORDER BY completed_at DESC
+    `;
+
+    const earnings = recent.reduce(
+      (sum, r) => sum + Number(r.fare_price),
+      0,
+    );
+
+    return Response.json({
+      data: {
+        offers: offers as unknown as OfferRow[],
+        active: (active[0] as unknown as ActiveRide | undefined) ?? null,
+        recent: recent as unknown as RecentRow[],
+        earnings,
+      },
+    });
+  } catch (error) {
+    console.error("[DRIVER_RIDES]: ", error);
+    return Response.json({ error: "Internal Server Error" }, { status: 500 });
+  }
+}
+
+type OfferRow = {
+  offer_id: number;
+  offered_at: string;
+  ride_id: number;
+  origin_address: string;
+  destination_address: string;
+  origin_latitude: number;
+  origin_longitude: number;
+  destination_latitude: number;
+  destination_longitude: number;
+  ride_time: number;
+  fare_price: number;
+  payment_status: string;
+  service: string;
+  user_id: string;
+};
+
+type ActiveRide = {
+  ride_id: number;
+  status: string;
+  service: string;
+  payment_status: string;
+  origin_address: string;
+  destination_address: string;
+  origin_latitude: number;
+  origin_longitude: number;
+  destination_latitude: number;
+  destination_longitude: number;
+  ride_time: number;
+  fare_price: number;
+  created_at: string;
+  rider_name: string | null;
+  rider_phone: string | null;
+};
+
+type RecentRow = {
+  ride_id: number;
+  fare_price: number;
+  service: string;
+  completed_at: string;
+};