Build driver app, Uber-style dispatch, POI suggestions; fix map tiles
Driver side (was a stub): - In-app driver onboarding: a driver-role user creates their own linked drivers profile (driver/profile+api GET/POST/PATCH). - Driver dashboard: online/offline toggle, today's earnings, incoming request cards (accept/decline), active ride panel (start/complete trip). Polls /driver/rides every 4s while online. - Location heartbeat (use-driver-location): watchPositionAsync pings /driver/location every ~5s; restarts the watch on app foreground so a backgrounded driver doesn't go permanently stale and miss requests. Dispatch (auto-match nearest, Uber-style): - Ride state machine: requested -> accepted -> en_route -> completed/cancelled with a nullable driver_id until matched (lib/dispatch.matchNextDriver). - matchNextDriver locks the ride (SELECT FOR UPDATE), expires 15s-stale offers, picks the nearest eligible driver of the matching service by haversine, offers one at a time. Called from ride/create, ride/[id] GET (lazy match on the rider's poll), and ride/[id]/respond (on decline). - ride/create is now a request endpoint (driver_id NULL, status=requested, service); drops the pre-match driver_id payment reconciliation. - ride/[id] GET returns status/service/nullable driver; PATCH handles rider cancel + driver en_route/completed. ride/list backs the history tabs. Rider flow (best experience): - confirm-ride is now a request screen: single trip fare + nearest-driver ETA + cash/card + Request Ride -> live status. Periodically polls online drivers of the selected service and disables Request when none are online (prevents the "stuck searching forever" state). - book-ride is the live ride-status screen (searching -> accepted -> en_route -> completed/cancelled + Cancel), polling every 3s. - lib/request-ride unifies the Areeba card flow + cash path. - Map reads /driver/nearby (real positions, service-filtered); lib/map adds calculateTripFare + service-aware fares. POI suggestions: - lib/places (Google Nearby Search) + nearby-suggestions chips for mall/hospital/pharmacy/restaurant on the home screen. Service categories now drive both matching and a per-service fare multiplier (car 1.0 / moto 0.7 / courier 0.85 / chauffeur 1.5). Map tiles: react-native-maps rendered blank on Android because no Google Maps key was set. Switched app.json -> app.config.js so android.config.googleMaps.apiKey is injected from EXPO_PUBLIC_GOOGLE_API_KEY at build time (keeps the key out of git). Requires a native rebuild (expo run:android) to take effect. Also includes the prior payment/auth hardening (server-authoritative payment_orders ledger with double-spend guards, peppered OTP, register TOCTOU fix, stats cents fix) that was left uncommitted. Co-Authored-By: Claude <noreply@anthropic.com>
This commit is contained in:
Krikorios
+136
-34
@@ -1,46 +1,148 @@
|
||||
import { requireAuth } from "@/lib/jwt";
|
||||
import { sql } from "@/lib/db";
|
||||
import { sql, query } from "@/lib/db";
|
||||
import { matchNextDriver } from "@/lib/dispatch";
|
||||
import { requireDriverProfile } from "@/lib/driver";
|
||||
|
||||
// GET — single ride by id, the rider's status-poll endpoint. If the ride is
|
||||
// still 'requested' with no offer in flight, kick auto-match before reading
|
||||
// so the rider's poll itself drives matching forward (no background worker).
|
||||
export async function GET(request: Request, { id }: { id: string }) {
|
||||
const auth = requireAuth(request);
|
||||
if ("error" in auth) return auth.error;
|
||||
|
||||
try {
|
||||
const response = await sql`
|
||||
SELECT
|
||||
rides.ride_id,
|
||||
rides.origin_address,
|
||||
rides.destination_address,
|
||||
rides.origin_latitude,
|
||||
rides.origin_longitude,
|
||||
rides.destination_latitude,
|
||||
rides.destination_longitude,
|
||||
rides.ride_time,
|
||||
rides.fare_price,
|
||||
rides.payment_status,
|
||||
rides.created_at,
|
||||
json_build_object(
|
||||
'driver_id', drivers.id,
|
||||
'first_name', drivers.first_name,
|
||||
'last_name', drivers.last_name,
|
||||
'profile_image_url', drivers.profile_image_url,
|
||||
'car_image_url', drivers.car_image_url,
|
||||
'car_seats', drivers.car_seats,
|
||||
'rating', drivers.rating
|
||||
) AS driver
|
||||
FROM
|
||||
rides
|
||||
INNER JOIN
|
||||
drivers ON rides.driver_id = drivers.id
|
||||
WHERE
|
||||
rides.user_id = ${auth.userId}
|
||||
ORDER BY
|
||||
rides.created_at DESC;
|
||||
`;
|
||||
const rideId = Number(id);
|
||||
if (!Number.isInteger(rideId)) {
|
||||
return Response.json({ error: "Invalid ride id." }, { status: 400 });
|
||||
}
|
||||
|
||||
return Response.json({ data: response });
|
||||
try {
|
||||
const ride = await sql`
|
||||
SELECT status FROM rides WHERE ride_id = ${rideId} AND user_id = ${auth.userId}
|
||||
`;
|
||||
if (!ride[0]) {
|
||||
return Response.json({ error: "Ride not found." }, { status: 404 });
|
||||
}
|
||||
|
||||
// Lazy match: try to offer the ride to a driver if it's still requested.
|
||||
if (ride[0].status === "requested") {
|
||||
void matchNextDriver(rideId);
|
||||
}
|
||||
|
||||
const rows = await sql`
|
||||
SELECT
|
||||
r.ride_id,
|
||||
r.origin_address,
|
||||
r.destination_address,
|
||||
r.origin_latitude,
|
||||
r.origin_longitude,
|
||||
r.destination_latitude,
|
||||
r.destination_longitude,
|
||||
r.ride_time,
|
||||
r.fare_price,
|
||||
r.payment_status,
|
||||
r.status,
|
||||
r.service,
|
||||
r.created_at,
|
||||
r.completed_at,
|
||||
r.cancelled_at,
|
||||
json_build_object(
|
||||
'id', d.id,
|
||||
'first_name', d.first_name,
|
||||
'last_name', d.last_name,
|
||||
'car_seats', d.car_seats,
|
||||
'profile_image_url', d.profile_image_url,
|
||||
'car_image_url', d.car_image_url,
|
||||
'rating', d.rating,
|
||||
'service', d.service,
|
||||
'car_model', d.car_model,
|
||||
'latitude', d.latitude,
|
||||
'longitude', d.longitude
|
||||
) AS driver
|
||||
FROM rides r
|
||||
LEFT JOIN drivers d ON d.id = r.driver_id
|
||||
WHERE r.ride_id = ${rideId}
|
||||
`;
|
||||
|
||||
return Response.json({ data: rows[0] });
|
||||
} catch (error) {
|
||||
console.error("[GET_RIDE]: ", error);
|
||||
return Response.json({ error: "Internal Server Error" }, { status: 500 });
|
||||
}
|
||||
}
|
||||
|
||||
// PATCH — ride lifecycle transitions.
|
||||
// Rider: { status: 'cancelled' } — only from 'requested' or 'accepted', and
|
||||
// only on their own ride.
|
||||
// Driver: { status: 'en_route' | 'completed' } — only on the ride they own
|
||||
// (driver_id = their profile), from the right prior state.
|
||||
export async function PATCH(request: Request, { id }: { id: string }) {
|
||||
const rideId = Number(id);
|
||||
if (!Number.isInteger(rideId)) {
|
||||
return Response.json({ error: "Invalid ride id." }, { status: 400 });
|
||||
}
|
||||
|
||||
let body: { status?: string };
|
||||
try {
|
||||
body = await request.json();
|
||||
} catch {
|
||||
return Response.json({ error: "Invalid JSON body." }, { status: 400 });
|
||||
}
|
||||
|
||||
const next = body.status;
|
||||
|
||||
try {
|
||||
// Rider cancel — authenticate by ownership of the ride.
|
||||
if (next === "cancelled") {
|
||||
const auth = requireAuth(request);
|
||||
if ("error" in auth) return auth.error;
|
||||
|
||||
const rows = await sql<{ status: string }>`
|
||||
UPDATE rides
|
||||
SET status = 'cancelled', cancelled_at = CURRENT_TIMESTAMP
|
||||
WHERE ride_id = ${rideId}
|
||||
AND user_id = ${auth.userId}
|
||||
AND status IN ('requested', 'accepted')
|
||||
RETURNING status
|
||||
`;
|
||||
if (!rows[0]) {
|
||||
return Response.json(
|
||||
{ error: "Ride cannot be cancelled." },
|
||||
{ status: 409 },
|
||||
);
|
||||
}
|
||||
return Response.json({ data: { status: rows[0].status } });
|
||||
}
|
||||
|
||||
// Driver transitions — must be the driver assigned to the ride.
|
||||
if (next === "en_route" || next === "completed") {
|
||||
const result = await requireDriverProfile(request);
|
||||
if ("error" in result) return result.error;
|
||||
|
||||
const { driverId } = result;
|
||||
const priorStatus = next === "en_route" ? "accepted" : "en_route";
|
||||
const setClause =
|
||||
next === "completed"
|
||||
? "status = $1, completed_at = CURRENT_TIMESTAMP, driver_id = $2"
|
||||
: "status = $1, driver_id = $2";
|
||||
|
||||
const rows = await query<{ status: string }>(
|
||||
`UPDATE rides SET ${setClause}
|
||||
WHERE ride_id = $3 AND driver_id = $2 AND status = $4
|
||||
RETURNING status`,
|
||||
[next, driverId, rideId, priorStatus],
|
||||
);
|
||||
if (!rows[0]) {
|
||||
return Response.json(
|
||||
{ error: "Ride cannot transition to that state." },
|
||||
{ status: 409 },
|
||||
);
|
||||
}
|
||||
return Response.json({ data: { status: rows[0].status } });
|
||||
}
|
||||
|
||||
return Response.json({ error: "Unknown status transition." }, { status: 400 });
|
||||
} catch (error) {
|
||||
console.error("[PATCH_RIDE]: ", error);
|
||||
return Response.json({ error: "Internal Server Error" }, { status: 500 });
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,102 @@
|
||||
import { requireDriverProfile } from "@/lib/driver";
|
||||
import { transaction } from "@/lib/db";
|
||||
import { matchNextDriver } from "@/lib/dispatch";
|
||||
|
||||
// POST — a driver responds to a ride offer.
|
||||
// { action: 'accept' } — claim the ride: offer -> accepted, ride -> accepted,
|
||||
// ride.driver_id set to this driver. Guarded so only
|
||||
// the offered driver can accept, and only while the
|
||||
// offer is still 'offered' (not expired/timed out).
|
||||
// { action: 'decline' } — release the ride: offer -> declined, then offer
|
||||
// it to the next-nearest driver via matchNextDriver.
|
||||
export async function POST(req: Request, { id }: { id: string }) {
|
||||
const rideId = Number(id);
|
||||
if (!Number.isInteger(rideId)) {
|
||||
return Response.json({ error: "Invalid ride id." }, { status: 400 });
|
||||
}
|
||||
|
||||
const result = await requireDriverProfile(req);
|
||||
if ("error" in result) return result.error;
|
||||
|
||||
const { driverId } = result;
|
||||
|
||||
let body: { action?: string };
|
||||
try {
|
||||
body = await req.json();
|
||||
} catch {
|
||||
return Response.json({ error: "Invalid JSON body." }, { status: 400 });
|
||||
}
|
||||
|
||||
const action = body.action;
|
||||
if (action !== "accept" && action !== "decline") {
|
||||
return Response.json(
|
||||
{ error: "action must be 'accept' or 'decline'." },
|
||||
{ status: 400 },
|
||||
);
|
||||
}
|
||||
|
||||
try {
|
||||
if (action === "accept") {
|
||||
const claimed = await transaction(async (tx) => {
|
||||
// Atomically flip the offer to accepted only if it's still offered to
|
||||
// this driver. This is the race guard: two drivers can't both accept,
|
||||
// and an expired offer can't be revived.
|
||||
const offer = await tx<{ id: number }>`
|
||||
UPDATE ride_offers
|
||||
SET status = 'accepted', responded_at = CURRENT_TIMESTAMP
|
||||
WHERE ride_id = ${rideId}
|
||||
AND driver_id = ${driverId}
|
||||
AND status = 'offered'
|
||||
RETURNING id
|
||||
`;
|
||||
if (!offer[0]) return null;
|
||||
|
||||
// Assign the ride to this driver. The status='requested' guard means
|
||||
// we never overwrite a ride another driver already accepted.
|
||||
const ride = await tx`
|
||||
UPDATE rides
|
||||
SET status = 'accepted', driver_id = ${driverId}
|
||||
WHERE ride_id = ${rideId} AND status = 'requested'
|
||||
RETURNING ride_id
|
||||
`;
|
||||
if (!ride[0]) return null;
|
||||
|
||||
return offer[0].id;
|
||||
});
|
||||
|
||||
if (claimed === null) {
|
||||
return Response.json(
|
||||
{ error: "This offer is no longer available." },
|
||||
{ status: 409 },
|
||||
);
|
||||
}
|
||||
return Response.json({ data: { action: "accepted" } });
|
||||
}
|
||||
|
||||
// Decline: mark the offer declined and offer the ride to the next driver.
|
||||
const declined = await transaction(async (tx) => {
|
||||
const offer = await tx`
|
||||
UPDATE ride_offers
|
||||
SET status = 'declined', responded_at = CURRENT_TIMESTAMP
|
||||
WHERE ride_id = ${rideId}
|
||||
AND driver_id = ${driverId}
|
||||
AND status = 'offered'
|
||||
RETURNING id
|
||||
`;
|
||||
return offer[0]?.id ?? null;
|
||||
});
|
||||
|
||||
if (declined === null) {
|
||||
return Response.json(
|
||||
{ error: "This offer is no longer available." },
|
||||
{ status: 409 },
|
||||
);
|
||||
}
|
||||
|
||||
void matchNextDriver(rideId);
|
||||
return Response.json({ data: { action: "declined" } });
|
||||
} catch (error) {
|
||||
console.error("[RIDE_RESPOND]: ", error);
|
||||
return Response.json({ error: "Internal Server Error" }, { status: 500 });
|
||||
}
|
||||
}
|
||||
+168
-41
@@ -1,6 +1,18 @@
|
||||
import { requireAuth } from "@/lib/jwt";
|
||||
import { sql } from "@/lib/db";
|
||||
import { sql, transaction } from "@/lib/db";
|
||||
import { getOrder, consumeOrderForRide } from "@/lib/payment-orders";
|
||||
import { matchNextDriver } from "@/lib/dispatch";
|
||||
import { isServiceId } from "@/lib/driver";
|
||||
import { DEFAULT_SERVICE } from "@/constants/services";
|
||||
|
||||
// Explicit missing check — a truthy check would reject legitimate 0 values
|
||||
// like latitude 0.0 (the equator) or a zero fare.
|
||||
const isMissing = (v: unknown): boolean => v === undefined || v === null;
|
||||
|
||||
// POST — request a ride. The rider no longer picks a driver; the ride is
|
||||
// created with status='requested' and driver_id=NULL, then auto-match offers
|
||||
// it to the nearest eligible driver of the requested service. `driver_id` in
|
||||
// the body is accepted for backward compatibility but ignored.
|
||||
export async function POST(request: Request) {
|
||||
const auth = requireAuth(request);
|
||||
if ("error" in auth) return auth.error;
|
||||
@@ -16,21 +28,20 @@ export async function POST(request: Request) {
|
||||
destination_longitude,
|
||||
ride_time,
|
||||
fare_price,
|
||||
payment_status,
|
||||
driver_id,
|
||||
payment_method,
|
||||
payment_order_id,
|
||||
service,
|
||||
} = body;
|
||||
|
||||
if (
|
||||
!origin_address ||
|
||||
!destination_address ||
|
||||
!origin_latitude ||
|
||||
!origin_longitude ||
|
||||
!destination_latitude ||
|
||||
!destination_longitude ||
|
||||
!ride_time ||
|
||||
!fare_price ||
|
||||
!payment_status ||
|
||||
!driver_id
|
||||
isMissing(origin_address) ||
|
||||
isMissing(destination_address) ||
|
||||
isMissing(origin_latitude) ||
|
||||
isMissing(origin_longitude) ||
|
||||
isMissing(destination_latitude) ||
|
||||
isMissing(destination_longitude) ||
|
||||
isMissing(ride_time) ||
|
||||
isMissing(fare_price)
|
||||
) {
|
||||
return Response.json(
|
||||
{ error: "Missing required fields" },
|
||||
@@ -38,38 +49,154 @@ export async function POST(request: Request) {
|
||||
);
|
||||
}
|
||||
|
||||
const response = await sql`
|
||||
INSERT INTO rides (
|
||||
origin_address,
|
||||
destination_address,
|
||||
origin_latitude,
|
||||
origin_longitude,
|
||||
destination_latitude,
|
||||
destination_longitude,
|
||||
ride_time,
|
||||
fare_price,
|
||||
payment_status,
|
||||
driver_id,
|
||||
user_id
|
||||
) VALUES (
|
||||
${origin_address},
|
||||
${destination_address},
|
||||
${origin_latitude},
|
||||
${origin_longitude},
|
||||
${destination_latitude},
|
||||
${destination_longitude},
|
||||
${ride_time},
|
||||
${fare_price},
|
||||
${payment_status},
|
||||
${driver_id},
|
||||
${auth.userId}
|
||||
)
|
||||
RETURNING *;
|
||||
if (payment_method !== "card" && payment_method !== "cash")
|
||||
return Response.json(
|
||||
{ error: "Invalid payment method." },
|
||||
{ status: 400 },
|
||||
);
|
||||
|
||||
const rideService = isServiceId(service) ? service : DEFAULT_SERVICE;
|
||||
const fareCents = Math.round(Number(fare_price));
|
||||
|
||||
if (payment_method === "card") {
|
||||
// Card: the ride is only recorded once a paid, server-authoritative
|
||||
// payment order is consumed. The client can no longer self-declare
|
||||
// payment_status='paid'.
|
||||
if (isMissing(payment_order_id))
|
||||
return Response.json(
|
||||
{ error: "Missing payment order id." },
|
||||
{ status: 400 },
|
||||
);
|
||||
|
||||
const order = await getOrder(payment_order_id);
|
||||
if (!order)
|
||||
return Response.json(
|
||||
{ error: "Payment order not found." },
|
||||
{ status: 404 },
|
||||
);
|
||||
|
||||
if (order.user_id !== auth.userId)
|
||||
return Response.json({ error: "Unauthorized." }, { status: 403 });
|
||||
|
||||
if (order.status !== "paid")
|
||||
return Response.json(
|
||||
{ error: "Payment not verified." },
|
||||
{ status: 400 },
|
||||
);
|
||||
|
||||
if (order.amount_cents !== fareCents)
|
||||
return Response.json(
|
||||
{ error: "Payment amount mismatch." },
|
||||
{ status: 400 },
|
||||
);
|
||||
|
||||
// Reconcile route intent (driver isn't known yet, so driver_id is no
|
||||
// longer part of the intent check). Null intent fields are skipped.
|
||||
const intentsMatch =
|
||||
(order.origin_address === null ||
|
||||
order.origin_address === origin_address) &&
|
||||
(order.destination_address === null ||
|
||||
order.destination_address === destination_address) &&
|
||||
(order.ride_time === null || order.ride_time === Number(ride_time));
|
||||
|
||||
if (!intentsMatch)
|
||||
return Response.json(
|
||||
{ error: "Payment does not match this ride." },
|
||||
{ status: 400 },
|
||||
);
|
||||
|
||||
// Consume the order and insert the ride on one connection, so a failure
|
||||
// rolls back both and no paid order is wasted without a ride.
|
||||
const inserted = await transaction(async (tx) => {
|
||||
const consumed = await consumeOrderForRide(
|
||||
payment_order_id,
|
||||
auth.userId,
|
||||
tx,
|
||||
);
|
||||
if (!consumed) throw new Error("PAYMENT_ORDER_NOT_CONSUMABLE");
|
||||
|
||||
const rows = await tx`
|
||||
INSERT INTO rides (
|
||||
origin_address,
|
||||
destination_address,
|
||||
origin_latitude,
|
||||
origin_longitude,
|
||||
destination_latitude,
|
||||
destination_longitude,
|
||||
ride_time,
|
||||
fare_price,
|
||||
payment_status,
|
||||
driver_id,
|
||||
user_id,
|
||||
payment_order_id,
|
||||
status,
|
||||
service
|
||||
) VALUES (
|
||||
${origin_address},
|
||||
${destination_address},
|
||||
${origin_latitude},
|
||||
${origin_longitude},
|
||||
${destination_latitude},
|
||||
${destination_longitude},
|
||||
${ride_time},
|
||||
${fareCents},
|
||||
'paid',
|
||||
NULL,
|
||||
${auth.userId},
|
||||
${payment_order_id},
|
||||
'requested',
|
||||
${rideService}
|
||||
)
|
||||
RETURNING *
|
||||
`;
|
||||
return rows[0];
|
||||
});
|
||||
|
||||
// Kick off auto-match asynchronously — don't block the response on it.
|
||||
void matchNextDriver(inserted.ride_id);
|
||||
|
||||
return Response.json({ data: inserted }, { status: 201 });
|
||||
}
|
||||
|
||||
// Cash: settled directly with the driver at drop-off. No order involved.
|
||||
const response = await sql`
|
||||
INSERT INTO rides (
|
||||
origin_address,
|
||||
destination_address,
|
||||
origin_latitude,
|
||||
origin_longitude,
|
||||
destination_latitude,
|
||||
destination_longitude,
|
||||
ride_time,
|
||||
fare_price,
|
||||
payment_status,
|
||||
driver_id,
|
||||
user_id,
|
||||
status,
|
||||
service
|
||||
) VALUES (
|
||||
${origin_address},
|
||||
${destination_address},
|
||||
${origin_latitude},
|
||||
${origin_longitude},
|
||||
${destination_latitude},
|
||||
${destination_longitude},
|
||||
${ride_time},
|
||||
${fareCents},
|
||||
'cash',
|
||||
NULL,
|
||||
${auth.userId},
|
||||
'requested',
|
||||
${rideService}
|
||||
)
|
||||
RETURNING *
|
||||
`;
|
||||
|
||||
void matchNextDriver(response[0].ride_id);
|
||||
|
||||
return Response.json({ data: response[0] }, { status: 201 });
|
||||
} catch (error) {
|
||||
console.error("[CREATE_RIDES]: ", error);
|
||||
return Response.json({ error: "Internal Server Error" }, { status: 500 });
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,53 @@
|
||||
import { requireAuth } from "@/lib/jwt";
|
||||
import { sql } from "@/lib/db";
|
||||
|
||||
// GET — the signed-in rider's ride history (completed + cancelled rides),
|
||||
// newest first, with the assigned driver (nullable via LEFT JOIN). This feeds
|
||||
// the "Recent Rides" / "All rides" lists; the active/in-progress ride is
|
||||
// tracked separately on the book-ride status screen.
|
||||
export async function GET(req: Request) {
|
||||
const auth = requireAuth(req);
|
||||
if ("error" in auth) return auth.error;
|
||||
|
||||
try {
|
||||
const response = await sql`
|
||||
SELECT
|
||||
r.ride_id,
|
||||
r.origin_address,
|
||||
r.destination_address,
|
||||
r.origin_latitude,
|
||||
r.origin_longitude,
|
||||
r.destination_latitude,
|
||||
r.destination_longitude,
|
||||
r.ride_time,
|
||||
r.fare_price,
|
||||
r.payment_status,
|
||||
r.status,
|
||||
r.service,
|
||||
r.created_at,
|
||||
r.completed_at,
|
||||
r.cancelled_at,
|
||||
json_build_object(
|
||||
'id', d.id,
|
||||
'first_name', d.first_name,
|
||||
'last_name', d.last_name,
|
||||
'car_seats', d.car_seats,
|
||||
'profile_image_url', d.profile_image_url,
|
||||
'car_image_url', d.car_image_url,
|
||||
'rating', d.rating,
|
||||
'service', d.service,
|
||||
'car_model', d.car_model
|
||||
) AS driver
|
||||
FROM rides r
|
||||
LEFT JOIN drivers d ON d.id = r.driver_id
|
||||
WHERE r.user_id = ${auth.userId}
|
||||
AND r.status IN ('completed', 'cancelled')
|
||||
ORDER BY r.created_at DESC
|
||||
`;
|
||||
|
||||
return Response.json({ data: response });
|
||||
} catch (error) {
|
||||
console.error("[GET_RIDE_LIST]: ", error);
|
||||
return Response.json({ error: "Internal Server Error" }, { status: 500 });
|
||||
}
|
||||
}
|
||||
Reference in New Issue
Block a user