Build driver app, Uber-style dispatch, POI suggestions; fix map tiles

Driver side (was a stub): - In-app driver onboarding: a driver-role user creates their own linked drivers profile (driver/profile+api GET/POST/PATCH). - Driver dashboard: online/offline toggle, today's earnings, incoming request cards (accept/decline), active ride panel (start/complete trip). Polls /driver/rides every 4s while online. - Location heartbeat (use-driver-location): watchPositionAsync pings /driver/location every ~5s; restarts the watch on app foreground so a backgrounded driver doesn't go permanently stale and miss requests. Dispatch (auto-match nearest, Uber-style): - Ride state machine: requested -> accepted -> en_route -> completed/cancelled with a nullable driver_id until matched (lib/dispatch.matchNextDriver). - matchNextDriver locks the ride (SELECT FOR UPDATE), expires 15s-stale offers, picks the nearest eligible driver of the matching service by haversine, offers one at a time. Called from ride/create, ride/[id] GET (lazy match on the rider's poll), and ride/[id]/respond (on decline). - ride/create is now a request endpoint (driver_id NULL, status=requested, service); drops the pre-match driver_id payment reconciliation. - ride/[id] GET returns status/service/nullable driver; PATCH handles rider cancel + driver en_route/completed. ride/list backs the history tabs. Rider flow (best experience): - confirm-ride is now a request screen: single trip fare + nearest-driver ETA + cash/card + Request Ride -> live status. Periodically polls online drivers of the selected service and disables Request when none are online (prevents the "stuck searching forever" state). - book-ride is the live ride-status screen (searching -> accepted -> en_route -> completed/cancelled + Cancel), polling every 3s. - lib/request-ride unifies the Areeba card flow + cash path. - Map reads /driver/nearby (real positions, service-filtered); lib/map adds calculateTripFare + service-aware fares. POI suggestions: - lib/places (Google Nearby Search) + nearby-suggestions chips for mall/hospital/pharmacy/restaurant on the home screen. Service categories now drive both matching and a per-service fare multiplier (car 1.0 / moto 0.7 / courier 0.85 / chauffeur 1.5). Map tiles: react-native-maps rendered blank on Android because no Google Maps key was set. Switched app.json -> app.config.js so android.config.googleMaps.apiKey is injected from EXPO_PUBLIC_GOOGLE_API_KEY at build time (keeps the key out of git). Requires a native rebuild (expo run:android) to take effect. Also includes the prior payment/auth hardening (server-authoritative payment_orders ledger with double-spend guards, peppered OTP, register TOCTOU fix, stats cents fix) that was left uncommitted. Co-Authored-By: Claude <noreply@anthropic.com>
2026-08-24 13:57:21 +03:00
parent 4e0a7cca51
commit f50ff27e11
48 changed files with 3342 additions and 602 deletions
@@ -0,0 +1,151 @@
+import { requireAuth } from "@/lib/jwt";
+import { sql, query } from "@/lib/db";
+import { isServiceId, requireDriverProfile } from "@/lib/driver";
+import { SERVICES, type ServiceId } from "@/constants/services";
+
+// GET — the signed-in user's own driver profile, or 403 (code: ONBOARD) when
+// they haven't onboarded yet. The client uses the code to show the form.
+export async function GET(req: Request) {
+  const result = await requireDriverProfile(req);
+  if ("error" in result) return result.error;
+
+  const { auth, driverId } = result;
+  const rows = await sql`
+    SELECT id, first_name, last_name, profile_image_url, car_image_url,
+           car_seats, rating, service, online, car_model, user_id
+    FROM drivers WHERE id = ${driverId}
+  `;
+  return Response.json({ data: rows[0], userId: auth.userId });
+}
+
+// POST — onboarding. A driver-role user creates their one linked drivers row.
+// The user must carry role='driver' (set on sign-up / role.tsx) so a rider
+// can't silently become a driver by hitting this endpoint.
+export async function POST(req: Request) {
+  const auth = requireAuth(req);
+  if ("error" in auth) return auth.error;
+
+  try {
+    const body = await req.json();
+    const { car_model, car_seats, service, profile_image_url, car_image_url } =
+      body;
+
+    // The user must be flagged a driver to onboard a driver profile.
+    const users = await sql<{ role: string | null; name: string | null }>`
+      SELECT role, name FROM users WHERE id = ${auth.userId}
+    `;
+    if (!users[0] || users[0].role !== "driver") {
+      return Response.json(
+        { error: "Only driver accounts can onboard a driver profile." },
+        { status: 403 },
+      );
+    }
+
+    if (!isServiceId(service)) {
+      return Response.json(
+        { error: `service must be one of: ${SERVICES.map((s) => s.id).join(", ")}.` },
+        { status: 400 },
+      );
+    }
+
+    const seats = Number(car_seats);
+    if (!Number.isInteger(seats) || seats < 1 || seats > 8) {
+      return Response.json(
+        { error: "car_seats must be a whole number between 1 and 8." },
+        { status: 400 },
+      );
+    }
+
+    const [firstName, ...rest] = (users[0].name ?? "").split(" ");
+
+    // One profile per driver user. The partial unique index on user_id
+    // guarantees this at the DB level; surface a clean 409 on collision.
+    try {
+      const rows = await sql`
+        INSERT INTO drivers (
+          user_id, first_name, last_name, profile_image_url, car_image_url,
+          car_seats, rating, service, car_model, online
+        ) VALUES (
+          ${auth.userId},
+          ${firstName || "Driver"},
+          ${rest.join(" ") || ""},
+          ${profile_image_url ?? null},
+          ${car_image_url ?? null},
+          ${seats},
+          5.0,
+          ${service as ServiceId},
+          ${car_model ?? null},
+          FALSE
+        )
+        RETURNING id, service, online
+      `;
+      return Response.json({ data: rows[0] }, { status: 201 });
+    } catch (error) {
+      if ((error as { code?: string }).code === "23505") {
+        return Response.json(
+          { error: "Driver profile already exists." },
+          { status: 409 },
+        );
+      }
+      throw error;
+    }
+  } catch (error) {
+    console.error("[DRIVER_PROFILE_POST]: ", error);
+    return Response.json({ error: "Internal Server Error" }, { status: 500 });
+  }
+}
+
+// PATCH — update mutable profile fields, most importantly the online toggle.
+export async function PATCH(req: Request) {
+  const result = await requireDriverProfile(req);
+  if ("error" in result) return result.error;
+
+  try {
+    const body = await req.json();
+    const { online, car_model, car_seats, service } = body;
+
+    const updates: string[] = [];
+    const values: (string | number | boolean | null)[] = [];
+    let idx = 1;
+    const push = (col: string, value: string | number | boolean | null) => {
+      updates.push(`${col} = $${idx++}`);
+      values.push(value);
+    };
+
+    if (typeof online === "boolean") push("online", online);
+    if (typeof car_model === "string" || car_model === null) push("car_model", car_model);
+    if (car_seats !== undefined) {
+      const seats = Number(car_seats);
+      if (!Number.isInteger(seats) || seats < 1 || seats > 8) {
+        return Response.json(
+          { error: "car_seats must be a whole number between 1 and 8." },
+          { status: 400 },
+        );
+      }
+      push("car_seats", seats);
+    }
+    if (service !== undefined) {
+      if (!isServiceId(service)) {
+        return Response.json(
+          { error: "Invalid service." },
+          { status: 400 },
+        );
+      }
+      push("service", service as string);
+    }
+
+    if (updates.length === 0) {
+      return Response.json({ error: "No fields to update." }, { status: 400 });
+    }
+
+    values.push(result.driverId);
+    const rows = await query(
+      `UPDATE drivers SET ${updates.join(", ")} WHERE id = $${idx} RETURNING *`,
+      values,
+    );
+    return Response.json({ data: rows[0] });
+  } catch (error) {
+    console.error("[DRIVER_PROFILE_PATCH]: ", error);
+    return Response.json({ error: "Internal Server Error" }, { status: 500 });
+  }
+}