KrikoriosandClaude Opus 5
8807ff41c5
Driver onboarding now photographs the licence, ID card and vehicle
registration and reads the credential fields off them, plus a camera-only
profile selfie riders check the arriving driver against. Adds in-app chat
and WebRTC calls, push-backed ride offers, ratings, cancellation and
payment sheets, settlement, and the owner dashboard endpoints behind them.
Camera permission on Android:
- Declare CAMERA and READ_MEDIA_IMAGES in the manifest. expo-image-picker's
own plugin never declares CAMERA, and Android denies a request for an
undeclared permission instantly and silently — no dialog is ever shown,
which is indistinguishable from the app not asking at all.
- Handle canAskAgain: once Android stops showing the dialog, repeating why
we need it is a dead end, so offer Open Settings instead (lib/capture-
permission.ts), matching what the location flow already did.
Session: a 401 on a request that carried a token now ends the session
instead of being reinterpreted per-screen — driver-home had been reading it
as "this user has no driver profile" and showing an onboarding form to an
already-onboarded driver. Requests without a token are exempt so a failed
sign-in doesn't sign you out, and the notification is latched per token so
concurrent polls tear the session down once. (root) gains the auth guard
that turns that into the sign-in screen; app/index.tsx only guarded the way
in, leaving a session that ended mid-screen with nowhere to go.
Also ignore .uploads/ — it holds driver licence, ID and vehicle scans plus
profile photos, which are personal data and must not be committed.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
81 lines
2.5 KiB
TypeScript
81 lines
2.5 KiB
TypeScript
import { requireAuth } from "@/lib/jwt";
|
|
import { sql } from "@/lib/db";
|
|
|
|
// Device registration for push notifications.
|
|
//
|
|
// POST — claim this device for the signed-in user. Upsert on the token, so
|
|
// signing in as a different account on the same phone MOVES the
|
|
// device rather than leaving the previous account subscribed to
|
|
// notifications that are now someone else's.
|
|
// DELETE — release the device, called on sign-out.
|
|
//
|
|
// Not driver-only: riders need it too (a driver accepting, arriving, or the
|
|
// search timing out are all things worth waking a phone for), so it lives
|
|
// under /push rather than /driver.
|
|
|
|
const isExpoToken = (v: unknown): v is string =>
|
|
typeof v === "string" &&
|
|
v.length <= 256 &&
|
|
/^Expo(nent)?PushToken\[[^\]]+\]$/.test(v);
|
|
|
|
export async function POST(req: Request) {
|
|
const auth = requireAuth(req);
|
|
if ("error" in auth) return auth.error;
|
|
|
|
try {
|
|
const body = await req.json();
|
|
const { token, platform } = body;
|
|
|
|
if (!isExpoToken(token)) {
|
|
return Response.json(
|
|
{ error: "A valid Expo push token is required." },
|
|
{ status: 400 },
|
|
);
|
|
}
|
|
|
|
const rows = await sql<{ token: string }>`
|
|
INSERT INTO push_tokens (token, user_id, platform)
|
|
VALUES (${token}, ${auth.userId}, ${platform ?? null})
|
|
ON CONFLICT (token) DO UPDATE
|
|
SET user_id = EXCLUDED.user_id,
|
|
platform = EXCLUDED.platform,
|
|
updated_at = CURRENT_TIMESTAMP
|
|
RETURNING token
|
|
`;
|
|
|
|
return Response.json({ data: { registered: Boolean(rows[0]) } });
|
|
} catch (error) {
|
|
console.error("[PUSH_TOKEN_POST]: ", error);
|
|
return Response.json({ error: "Internal Server Error" }, { status: 500 });
|
|
}
|
|
}
|
|
|
|
export async function DELETE(req: Request) {
|
|
const auth = requireAuth(req);
|
|
if ("error" in auth) return auth.error;
|
|
|
|
try {
|
|
const body = await req.json().catch(() => ({}));
|
|
const { token } = body as { token?: unknown };
|
|
|
|
if (!isExpoToken(token)) {
|
|
return Response.json(
|
|
{ error: "A valid Expo push token is required." },
|
|
{ status: 400 },
|
|
);
|
|
}
|
|
|
|
// Scoped to the caller: a token can only be released by the account that
|
|
// currently holds it.
|
|
await sql`
|
|
DELETE FROM push_tokens
|
|
WHERE token = ${token} AND user_id = ${auth.userId}
|
|
`;
|
|
|
|
return Response.json({ data: { released: true } });
|
|
} catch (error) {
|
|
console.error("[PUSH_TOKEN_DELETE]: ", error);
|
|
return Response.json({ error: "Internal Server Error" }, { status: 500 });
|
|
}
|
|
}
|