Build driver app, Uber-style dispatch, POI suggestions; fix map tiles
Driver side (was a stub): - In-app driver onboarding: a driver-role user creates their own linked drivers profile (driver/profile+api GET/POST/PATCH). - Driver dashboard: online/offline toggle, today's earnings, incoming request cards (accept/decline), active ride panel (start/complete trip). Polls /driver/rides every 4s while online. - Location heartbeat (use-driver-location): watchPositionAsync pings /driver/location every ~5s; restarts the watch on app foreground so a backgrounded driver doesn't go permanently stale and miss requests. Dispatch (auto-match nearest, Uber-style): - Ride state machine: requested -> accepted -> en_route -> completed/cancelled with a nullable driver_id until matched (lib/dispatch.matchNextDriver). - matchNextDriver locks the ride (SELECT FOR UPDATE), expires 15s-stale offers, picks the nearest eligible driver of the matching service by haversine, offers one at a time. Called from ride/create, ride/[id] GET (lazy match on the rider's poll), and ride/[id]/respond (on decline). - ride/create is now a request endpoint (driver_id NULL, status=requested, service); drops the pre-match driver_id payment reconciliation. - ride/[id] GET returns status/service/nullable driver; PATCH handles rider cancel + driver en_route/completed. ride/list backs the history tabs. Rider flow (best experience): - confirm-ride is now a request screen: single trip fare + nearest-driver ETA + cash/card + Request Ride -> live status. Periodically polls online drivers of the selected service and disables Request when none are online (prevents the "stuck searching forever" state). - book-ride is the live ride-status screen (searching -> accepted -> en_route -> completed/cancelled + Cancel), polling every 3s. - lib/request-ride unifies the Areeba card flow + cash path. - Map reads /driver/nearby (real positions, service-filtered); lib/map adds calculateTripFare + service-aware fares. POI suggestions: - lib/places (Google Nearby Search) + nearby-suggestions chips for mall/hospital/pharmacy/restaurant on the home screen. Service categories now drive both matching and a per-service fare multiplier (car 1.0 / moto 0.7 / courier 0.85 / chauffeur 1.5). Map tiles: react-native-maps rendered blank on Android because no Google Maps key was set. Switched app.json -> app.config.js so android.config.googleMaps.apiKey is injected from EXPO_PUBLIC_GOOGLE_API_KEY at build time (keeps the key out of git). Requires a native rebuild (expo run:android) to take effect. Also includes the prior payment/auth hardening (server-authoritative payment_orders ledger with double-spend guards, peppered OTP, register TOCTOU fix, stats cents fix) that was left uncommitted. Co-Authored-By: Claude <noreply@anthropic.com>
This commit is contained in:
Krikorios
+168
-41
@@ -1,6 +1,18 @@
|
||||
import { requireAuth } from "@/lib/jwt";
|
||||
import { sql } from "@/lib/db";
|
||||
import { sql, transaction } from "@/lib/db";
|
||||
import { getOrder, consumeOrderForRide } from "@/lib/payment-orders";
|
||||
import { matchNextDriver } from "@/lib/dispatch";
|
||||
import { isServiceId } from "@/lib/driver";
|
||||
import { DEFAULT_SERVICE } from "@/constants/services";
|
||||
|
||||
// Explicit missing check — a truthy check would reject legitimate 0 values
|
||||
// like latitude 0.0 (the equator) or a zero fare.
|
||||
const isMissing = (v: unknown): boolean => v === undefined || v === null;
|
||||
|
||||
// POST — request a ride. The rider no longer picks a driver; the ride is
|
||||
// created with status='requested' and driver_id=NULL, then auto-match offers
|
||||
// it to the nearest eligible driver of the requested service. `driver_id` in
|
||||
// the body is accepted for backward compatibility but ignored.
|
||||
export async function POST(request: Request) {
|
||||
const auth = requireAuth(request);
|
||||
if ("error" in auth) return auth.error;
|
||||
@@ -16,21 +28,20 @@ export async function POST(request: Request) {
|
||||
destination_longitude,
|
||||
ride_time,
|
||||
fare_price,
|
||||
payment_status,
|
||||
driver_id,
|
||||
payment_method,
|
||||
payment_order_id,
|
||||
service,
|
||||
} = body;
|
||||
|
||||
if (
|
||||
!origin_address ||
|
||||
!destination_address ||
|
||||
!origin_latitude ||
|
||||
!origin_longitude ||
|
||||
!destination_latitude ||
|
||||
!destination_longitude ||
|
||||
!ride_time ||
|
||||
!fare_price ||
|
||||
!payment_status ||
|
||||
!driver_id
|
||||
isMissing(origin_address) ||
|
||||
isMissing(destination_address) ||
|
||||
isMissing(origin_latitude) ||
|
||||
isMissing(origin_longitude) ||
|
||||
isMissing(destination_latitude) ||
|
||||
isMissing(destination_longitude) ||
|
||||
isMissing(ride_time) ||
|
||||
isMissing(fare_price)
|
||||
) {
|
||||
return Response.json(
|
||||
{ error: "Missing required fields" },
|
||||
@@ -38,38 +49,154 @@ export async function POST(request: Request) {
|
||||
);
|
||||
}
|
||||
|
||||
const response = await sql`
|
||||
INSERT INTO rides (
|
||||
origin_address,
|
||||
destination_address,
|
||||
origin_latitude,
|
||||
origin_longitude,
|
||||
destination_latitude,
|
||||
destination_longitude,
|
||||
ride_time,
|
||||
fare_price,
|
||||
payment_status,
|
||||
driver_id,
|
||||
user_id
|
||||
) VALUES (
|
||||
${origin_address},
|
||||
${destination_address},
|
||||
${origin_latitude},
|
||||
${origin_longitude},
|
||||
${destination_latitude},
|
||||
${destination_longitude},
|
||||
${ride_time},
|
||||
${fare_price},
|
||||
${payment_status},
|
||||
${driver_id},
|
||||
${auth.userId}
|
||||
)
|
||||
RETURNING *;
|
||||
if (payment_method !== "card" && payment_method !== "cash")
|
||||
return Response.json(
|
||||
{ error: "Invalid payment method." },
|
||||
{ status: 400 },
|
||||
);
|
||||
|
||||
const rideService = isServiceId(service) ? service : DEFAULT_SERVICE;
|
||||
const fareCents = Math.round(Number(fare_price));
|
||||
|
||||
if (payment_method === "card") {
|
||||
// Card: the ride is only recorded once a paid, server-authoritative
|
||||
// payment order is consumed. The client can no longer self-declare
|
||||
// payment_status='paid'.
|
||||
if (isMissing(payment_order_id))
|
||||
return Response.json(
|
||||
{ error: "Missing payment order id." },
|
||||
{ status: 400 },
|
||||
);
|
||||
|
||||
const order = await getOrder(payment_order_id);
|
||||
if (!order)
|
||||
return Response.json(
|
||||
{ error: "Payment order not found." },
|
||||
{ status: 404 },
|
||||
);
|
||||
|
||||
if (order.user_id !== auth.userId)
|
||||
return Response.json({ error: "Unauthorized." }, { status: 403 });
|
||||
|
||||
if (order.status !== "paid")
|
||||
return Response.json(
|
||||
{ error: "Payment not verified." },
|
||||
{ status: 400 },
|
||||
);
|
||||
|
||||
if (order.amount_cents !== fareCents)
|
||||
return Response.json(
|
||||
{ error: "Payment amount mismatch." },
|
||||
{ status: 400 },
|
||||
);
|
||||
|
||||
// Reconcile route intent (driver isn't known yet, so driver_id is no
|
||||
// longer part of the intent check). Null intent fields are skipped.
|
||||
const intentsMatch =
|
||||
(order.origin_address === null ||
|
||||
order.origin_address === origin_address) &&
|
||||
(order.destination_address === null ||
|
||||
order.destination_address === destination_address) &&
|
||||
(order.ride_time === null || order.ride_time === Number(ride_time));
|
||||
|
||||
if (!intentsMatch)
|
||||
return Response.json(
|
||||
{ error: "Payment does not match this ride." },
|
||||
{ status: 400 },
|
||||
);
|
||||
|
||||
// Consume the order and insert the ride on one connection, so a failure
|
||||
// rolls back both and no paid order is wasted without a ride.
|
||||
const inserted = await transaction(async (tx) => {
|
||||
const consumed = await consumeOrderForRide(
|
||||
payment_order_id,
|
||||
auth.userId,
|
||||
tx,
|
||||
);
|
||||
if (!consumed) throw new Error("PAYMENT_ORDER_NOT_CONSUMABLE");
|
||||
|
||||
const rows = await tx`
|
||||
INSERT INTO rides (
|
||||
origin_address,
|
||||
destination_address,
|
||||
origin_latitude,
|
||||
origin_longitude,
|
||||
destination_latitude,
|
||||
destination_longitude,
|
||||
ride_time,
|
||||
fare_price,
|
||||
payment_status,
|
||||
driver_id,
|
||||
user_id,
|
||||
payment_order_id,
|
||||
status,
|
||||
service
|
||||
) VALUES (
|
||||
${origin_address},
|
||||
${destination_address},
|
||||
${origin_latitude},
|
||||
${origin_longitude},
|
||||
${destination_latitude},
|
||||
${destination_longitude},
|
||||
${ride_time},
|
||||
${fareCents},
|
||||
'paid',
|
||||
NULL,
|
||||
${auth.userId},
|
||||
${payment_order_id},
|
||||
'requested',
|
||||
${rideService}
|
||||
)
|
||||
RETURNING *
|
||||
`;
|
||||
return rows[0];
|
||||
});
|
||||
|
||||
// Kick off auto-match asynchronously — don't block the response on it.
|
||||
void matchNextDriver(inserted.ride_id);
|
||||
|
||||
return Response.json({ data: inserted }, { status: 201 });
|
||||
}
|
||||
|
||||
// Cash: settled directly with the driver at drop-off. No order involved.
|
||||
const response = await sql`
|
||||
INSERT INTO rides (
|
||||
origin_address,
|
||||
destination_address,
|
||||
origin_latitude,
|
||||
origin_longitude,
|
||||
destination_latitude,
|
||||
destination_longitude,
|
||||
ride_time,
|
||||
fare_price,
|
||||
payment_status,
|
||||
driver_id,
|
||||
user_id,
|
||||
status,
|
||||
service
|
||||
) VALUES (
|
||||
${origin_address},
|
||||
${destination_address},
|
||||
${origin_latitude},
|
||||
${origin_longitude},
|
||||
${destination_latitude},
|
||||
${destination_longitude},
|
||||
${ride_time},
|
||||
${fareCents},
|
||||
'cash',
|
||||
NULL,
|
||||
${auth.userId},
|
||||
'requested',
|
||||
${rideService}
|
||||
)
|
||||
RETURNING *
|
||||
`;
|
||||
|
||||
void matchNextDriver(response[0].ride_id);
|
||||
|
||||
return Response.json({ data: response[0] }, { status: 201 });
|
||||
} catch (error) {
|
||||
console.error("[CREATE_RIDES]: ", error);
|
||||
return Response.json({ error: "Internal Server Error" }, { status: 500 });
|
||||
}
|
||||
}
|
||||
}
|
||||
Reference in New Issue
Block a user