Driver onboarding now photographs the licence, ID card and vehicle
registration and reads the credential fields off them, plus a camera-only
profile selfie riders check the arriving driver against. Adds in-app chat
and WebRTC calls, push-backed ride offers, ratings, cancellation and
payment sheets, settlement, and the owner dashboard endpoints behind them.
Camera permission on Android:
- Declare CAMERA and READ_MEDIA_IMAGES in the manifest. expo-image-picker's
own plugin never declares CAMERA, and Android denies a request for an
undeclared permission instantly and silently — no dialog is ever shown,
which is indistinguishable from the app not asking at all.
- Handle canAskAgain: once Android stops showing the dialog, repeating why
we need it is a dead end, so offer Open Settings instead (lib/capture-
permission.ts), matching what the location flow already did.
Session: a 401 on a request that carried a token now ends the session
instead of being reinterpreted per-screen — driver-home had been reading it
as "this user has no driver profile" and showing an onboarding form to an
already-onboarded driver. Requests without a token are exempt so a failed
sign-in doesn't sign you out, and the notification is latched per token so
concurrent polls tear the session down once. (root) gains the auth guard
that turns that into the sign-in screen; app/index.tsx only guarded the way
in, leaving a session that ended mid-screen with nowhere to go.
Also ignore .uploads/ — it holds driver licence, ID and vehicle scans plus
profile photos, which are personal data and must not be committed.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
155 lines
5.3 KiB
TypeScript
155 lines
5.3 KiB
TypeScript
import { sql } from "@/lib/db";
|
|
import { requireRideParticipant, rideIsActive } from "@/lib/ride-participants";
|
|
|
|
// In-app chat for a ride. Both the rider and the assigned driver can read and
|
|
// post, but only while the ride is active (accepted / en_route); a terminal
|
|
// ride is read-only so the conversation is frozen once the trip ends.
|
|
|
|
type MessageRow = {
|
|
id: number;
|
|
ride_id: number;
|
|
sender_type: "rider" | "driver";
|
|
sender_id: string;
|
|
body: string;
|
|
created_at: string;
|
|
sender_name: string;
|
|
sender_avatar: string | null;
|
|
};
|
|
|
|
// GET — messages for the ride. `?since=<id>` returns only rows with id > since
|
|
// (the polling cursor), oldest-first so the client can append directly. With
|
|
// no cursor the full history is returned for the initial load.
|
|
export async function GET(req: Request, { id }: { id: string }) {
|
|
const rideId = Number(id);
|
|
if (!Number.isInteger(rideId)) {
|
|
return Response.json({ error: "Invalid ride id." }, { status: 400 });
|
|
}
|
|
|
|
const participant = await requireRideParticipant(req, rideId);
|
|
if ("error" in participant) return participant.error;
|
|
|
|
const sinceParam = new URL(req.url).searchParams.get("since");
|
|
const since = Number(sinceParam);
|
|
const hasCursor = Number.isInteger(since) && since > 0;
|
|
|
|
try {
|
|
// The optional `since` cursor can't be a nested sql fragment (sql executes
|
|
// immediately), so branch into two queries that each take no extra params.
|
|
const rows = hasCursor
|
|
? await sql<MessageRow>`
|
|
SELECT
|
|
m.id,
|
|
m.ride_id,
|
|
m.sender_type,
|
|
COALESCE(m.sender_user_id::text, m.sender_driver_id::text) AS sender_id,
|
|
m.body,
|
|
m.created_at,
|
|
COALESCE(u.name, CONCAT_WS(' ', d.first_name, d.last_name)) AS sender_name,
|
|
d.profile_image_url AS sender_avatar
|
|
FROM messages m
|
|
LEFT JOIN users u ON u.id = m.sender_user_id
|
|
LEFT JOIN drivers d ON d.id = m.sender_driver_id
|
|
WHERE m.ride_id = ${rideId} AND m.id > ${since}
|
|
ORDER BY m.id ASC
|
|
`
|
|
: await sql<MessageRow>`
|
|
SELECT
|
|
m.id,
|
|
m.ride_id,
|
|
m.sender_type,
|
|
COALESCE(m.sender_user_id::text, m.sender_driver_id::text) AS sender_id,
|
|
m.body,
|
|
m.created_at,
|
|
COALESCE(u.name, CONCAT_WS(' ', d.first_name, d.last_name)) AS sender_name,
|
|
d.profile_image_url AS sender_avatar
|
|
FROM messages m
|
|
LEFT JOIN users u ON u.id = m.sender_user_id
|
|
LEFT JOIN drivers d ON d.id = m.sender_driver_id
|
|
WHERE m.ride_id = ${rideId}
|
|
ORDER BY m.id ASC
|
|
`;
|
|
|
|
return Response.json({ data: rows });
|
|
} catch (error) {
|
|
console.error("[GET_MESSAGES]: ", error);
|
|
return Response.json({ error: "Internal Server Error." }, { status: 500 });
|
|
}
|
|
}
|
|
|
|
// POST — send a message. Rejected (409) if the ride is no longer active, so a
|
|
// completed/cancelled trip can't receive new messages.
|
|
export async function POST(req: Request, { id }: { id: string }) {
|
|
const rideId = Number(id);
|
|
if (!Number.isInteger(rideId)) {
|
|
return Response.json({ error: "Invalid ride id." }, { status: 400 });
|
|
}
|
|
|
|
const participant = await requireRideParticipant(req, rideId);
|
|
if ("error" in participant) return participant.error;
|
|
|
|
let body: { body?: string };
|
|
try {
|
|
body = await req.json();
|
|
} catch {
|
|
return Response.json({ error: "Invalid JSON body." }, { status: 400 });
|
|
}
|
|
|
|
const text = (body.body ?? "").trim();
|
|
if (!text) {
|
|
return Response.json({ error: "Message body is empty." }, { status: 400 });
|
|
}
|
|
if (text.length > 4000) {
|
|
return Response.json({ error: "Message is too long." }, { status: 400 });
|
|
}
|
|
|
|
try {
|
|
if (!(await rideIsActive(rideId))) {
|
|
return Response.json(
|
|
{ error: "This ride is no longer active." },
|
|
{ status: 409 },
|
|
);
|
|
}
|
|
|
|
const inserted = await sql<MessageRow>`
|
|
INSERT INTO messages (ride_id, sender_type, sender_user_id, sender_driver_id, body)
|
|
VALUES (
|
|
${rideId},
|
|
${participant.role},
|
|
${participant.role === "rider" ? participant.userId : null},
|
|
${participant.role === "driver" ? participant.driverId : null},
|
|
${text}
|
|
)
|
|
RETURNING
|
|
id,
|
|
ride_id,
|
|
sender_type,
|
|
COALESCE(sender_user_id::text, sender_driver_id::text) AS sender_id,
|
|
body,
|
|
created_at
|
|
`;
|
|
|
|
// Join the sender's name/avatar for the returned row so the client can
|
|
// render the optimistic bubble identically to polled ones.
|
|
const message = inserted[0];
|
|
if (participant.role === "driver") {
|
|
const driver = await sql<{ name: string; avatar: string | null }>`
|
|
SELECT CONCAT_WS(' ', first_name, last_name) AS name, profile_image_url AS avatar
|
|
FROM drivers WHERE id = ${participant.driverId}
|
|
`;
|
|
message.sender_name = driver[0]?.name ?? "";
|
|
message.sender_avatar = driver[0]?.avatar ?? null;
|
|
} else {
|
|
const rider = await sql<{ name: string }>`
|
|
SELECT name FROM users WHERE id = ${participant.userId}
|
|
`;
|
|
message.sender_name = rider[0]?.name ?? "";
|
|
message.sender_avatar = null;
|
|
}
|
|
|
|
return Response.json({ data: message }, { status: 201 });
|
|
} catch (error) {
|
|
console.error("[POST_MESSAGE]: ", error);
|
|
return Response.json({ error: "Internal Server Error." }, { status: 500 });
|
|
}
|
|
}
|