Merge branch 'main' into feat/changelog-fragments

CHANGELOG.md

@@ -1,13 +1,10 @@
 # Changelog
 
-- Bound how often the GBFS proxy will relay. `/api/gbfs` already restricted
-  where it could go — https, an allowlisted host, a station feed path, no
-  redirects, a 12-second deadline and a 5 MB body cap — but nothing restricted
-  how often, so the dev server would make unlimited requests at a third-party
-  bikeshare operator on any caller's behalf. The route now admits 120
-  requests/minute per client address, refusing the rest with 429 and
-  `Retry-After` before any outbound fetch. The bikeshare layer needs about 15 a
-  minute with every catalogued system in range, so ordinary use is unchanged.
+- Add Barcelona's bike share to the GBFS registry: Bicing (543 stations, the
+  city's PBSC system) and AMBici (237 e-bike stations across the metropolitan
+  area, run by nextbike). Both are keyless GBFS 2.3 feeds listed in
+  MobilityData's systems catalogue; AMBici's is CC0. `gbfs.nextbike.net` joins
+  the proxy allowlist. These are the layer's first stations in Spain.
 
 - Add nine Ontario transit feeds: TTC, MiWay, Hamilton HSR, Durham Region,
   YRT/Viva, Guelph, Burlington, Barrie and Kingston, each carrying its own

DATA_SOURCES.md

@@ -68,6 +68,8 @@ How to read this:
 | **GBFS (Lyft / BCycle / Social Bicycles / PBSC)**                     | Bikeshare availability                                                                                                              | Per-feed (attribution-only)                                                                                                                                                                                                                                                                                                                           | Credit the operator (e.g. Austin BCycle) + its `license_url`                                                                                                   |
 | **Bike Share Toronto** (`toronto.publicbikesystem.net`) | Bikeshare station availability, Toronto | Operator GBFS feed. No licence is published: the City's open-data package declares none and the feed has no `license_url`. Attribution is given to the operator. | "Bike Share Toronto (Toronto Parking Authority)" |
 | **Bike Itaú (Tembici)** (`*.publicbikesystem.net`, seven Brazilian cities) | Bikeshare station availability: São Paulo, Rio de Janeiro, Salvador, Recife, Porto Alegre, Brasília and Curitiba | Operator GBFS feeds. No licence is published: the feeds' `system_information.json` carries no `license_url`, operator or attribution fields. Attribution is given to the operator. | "Bike Itaú (Tembici)" |
+| **Bicing** (`barcelona.publicbikesystem.net`) | Bikeshare station availability, Barcelona | Operator GBFS feed (PBSC), keyless. The feed publishes no licence; the City's own open-data copy of the same station data is CC BY 4.0 but needs a token. Attribution is given to the operator. | "Bicing, Barcelona City Council (B:SM)" |
+| **AMBici** (nextbike, `gbfs.nextbike.net`) | Bikeshare station availability, Barcelona metropolitan area (e-bikes) | Operator GBFS feed, keyless. `system_information.license_id` is **CC0-1.0**; no attribution required, given anyway. | "AMBici, Àrea Metropolitana de Barcelona, operated by nextbike" |
 | **Oslo / Bergen / Trondheim Bysykkel** (Urban Sharing, `gbfs.urbansharing.com`) | Bikeshare availability, Oslo, Bergen and Trondheim city bikes. Keyless GBFS; the proxy sends the `Client-Identifier` header the operators ask for | [NLOD 2.0](https://data.norge.no/nlod/en/2.0) — attribution REQUIRED ([Oslo](https://oslobysykkel.no/en/open-data/realtime), [Bergen](https://bergenbysykkel.no/en/apne-data/sanntid), [Trondheim](https://trondheimbysykkel.no/en/open-data/realtime)) | "Contains data under the Norwegian licence for Open Government data (NLOD) made available by Oslo Bysykkel, Bergen Bysykkel and Trondheim Bysykkel" |
 | **Kolumbus / Farte Bysykkel** (Entur Mobility, `api.entur.io/mobility/v2/gbfs`) | Bikeshare availability, Kolumbus Bysykkel (Stavanger/Nord-Jæren) and Farte Bysykkel (Skien/Porsgrunn). Keyless GBFS; the proxy sends the `ET-Client-Name` header Entur requires and is limited to Entur's GBFS paths | [NLOD](https://data.norge.no/nlod/en/2.0) per the [Entur Mobility API docs](https://developer.entur.org/pages-mobility-docs-mobility-v2) — attribution REQUIRED | "Contains data under the Norwegian licence for Open Government data (NLOD) made available by Entur (Kolumbus Bysykkel, Farte Bysykkel)" |
 | **JCDecaux Cyclocity** (`api.cyclocity.fr`) | Bikeshare availability, Bysykkel Lillestrøm. Keyless GBFS; the proxy is limited to JCDecaux contract paths | [Licence Ouverte / Etalab](https://developer.jcdecaux.com/files/Open-Licence-fr.pdf) (the feed's `license_url`) — attribution REQUIRED | "Bysykkel Lillestrøm: JCDecaux, Licence Ouverte" |

docs/CURRENT-STATE.md

@@ -3277,7 +3277,7 @@ its criteria cannot be silently ignored.
 | CCTV                   | Austin + Caltrans (CA) + TfL London + Ontario 511 + Fintraffic (FI) + DriveBC (BC) + TxDOT (TX) + Estonia (Tallinn, Tarktee) + Live Traffic NSW + Open Calgary Open Data + Statens vegvesen (NO, stills + live HLS) + King County (WA) Open Data + WSDOT (WA) Open Data + NYC DOT TMC (opt-in) + City of Toronto RESCU + Catalonia (Servei Català de Trànsit) + Street View fallback | `src/data/cctv.js`                                    | `/api/cctv`                                              | 10s (active)                                                                      |
 | Radio                  | Radio Browser (public-domain station directory)                                                                                                                                                 | `src/data/radio.js`                                   | `/api/radio/stations`, `/api/radio/click/:uuid`          | 45 min directory refresh                                                          |
 | Transit 🚌             | Operator GTFS-Realtime VehiclePositions (7 keyless regions, `src/data/transitFeeds.js`)                                                                                                         | `src/layers/transit/` via `src/app/layers/transit.js` | `/api/transit`                                           | 15s (poll + delayed playback)                                                     |
-| Bikeshare 🚲           | GBFS (Lyft + BCycle + Social Bicycles + PBSC incl. Bike Share Toronto and Bike Itaú (Brazil) + Urban Sharing, Entur, JCDecaux NO)                                                                                                                                        | `src/data/bikeshare.js`                               | `/api/gbfs`                                              | 60s                                                                               |
+| Bikeshare 🚲           | GBFS (Lyft + BCycle + Social Bicycles + PBSC incl. Bike Share Toronto, Bike Itaú (Brazil) and Bicing (Barcelona) + Urban Sharing, Entur, JCDecaux NO + nextbike (AMBici))                                                                                                                                        | `src/data/bikeshare.js`                               | `/api/gbfs`                                              | 60s                                                                               |
 | Directions 🧭          | OSRM on FOSSGIS servers (OpenStreetMap)                                                                                                                                                         | `src/data/directions.js`                              | `/api/route` (`steps=1`)                                 | on placement / mode change                                                        |
 | Datacenters ▣          | OSM extract (bundled)                                                                                                                                                                           | `src/data/localLayers.js`                             | —                                                        | static                                                                            |
 | Dams ▰                 | OpenInfraMap/OSM extract (bundled)                                                                                                                                                              | `src/data/localLayers.js`                             | —                                                        | static                                                                            |

src/data/dataCredits.js

@@ -304,7 +304,8 @@ export const DATA_CREDITS = [
     key: 'gbfs',
     html:
       'Bikeshare availability: GBFS operator feeds ' +
-      '(e.g. Austin BCycle; Bike Share Toronto, operated by the Toronto Parking Authority; Bike Itaú, operated by Tembici)',
+      '(e.g. Austin BCycle; Bike Share Toronto, operated by the Toronto Parking Authority; Bike Itaú, operated by Tembici; ' +
+      'Bicing, Barcelona City Council (B:SM); AMBici, Àrea Metropolitana de Barcelona, operated by nextbike)',
   },
   {
     key: 'urbansharing-gbfs',

src/data/gbfsSource.js

@@ -8,6 +8,7 @@ const GBFS_ALLOWED_HOSTS = new Set([
   'austin.publicbikesystem.net',
   'hon.publicbikesystem.net',
   'chat.publicbikesystem.net',
+  'gbfs.nextbike.net',
   'gbfs.urbansharing.com',
   'api.entur.io',
   'api.cyclocity.fr',

src/layers/bikeshare/barcelonaSystems.test.mjs

@@ -0,0 +1,104 @@
+import assert from 'node:assert/strict';
+import test from 'node:test';
+import { CITY_BY_ID } from './registry.js';
+import { createModel } from './model.js';
+import { createViewport } from './viewport.js';
+import { isAllowedGbfsHost, isAllowedGbfsPath } from '../../data/gbfsSource.js';
+
+// Each Barcelona system's host, and the stations farthest from its registered
+// centre in the live feed (checked 2026-10-16). AMBici spans the metropolitan
+// area, so it lists its south-western and north-eastern ends.
+const SYSTEMS = {
+  'barcelona-bicing': {
+    host: 'barcelona.publicbikesystem.net',
+    provider: 'Bicing',
+    stations: [
+      { name: 'AV. RASOS DE PEGUERA, 10', lat: 41.462095, lon: 2.178959 },
+      { name: 'C/ 60, NÚMERO 25', lat: 41.3467746, lon: 2.1436235 },
+    ],
+  },
+  'barcelona-ambici': {
+    host: 'gbfs.nextbike.net',
+    provider: 'AMBici',
+    stations: [
+      { name: 'Poal', lat: 41.268865, lon: 1.943849 },
+      { name: 'Platja del Manresà', lat: 41.460101, lon: 2.267271 },
+      { name: 'Can Ruti', lat: 41.482205, lon: 2.237607 },
+    ],
+  },
+};
+
+// The production range check, with no viewer or fetches behind it.
+const parts = {
+  model: createModel({ state: {}, services: {}, parts: {}, source: null }),
+};
+const { computeInRangeCities } = createViewport({
+  state: {},
+  services: { render: { governorRequestRender() {} } },
+  parts,
+  source: null,
+});
+
+test('Bicing and AMBici are registered and readable through the proxy', () => {
+  for (const [id, expected] of Object.entries(SYSTEMS)) {
+    const system = CITY_BY_ID.get(id);
+    assert.ok(system, `${id} is registered`);
+    assert.equal(system.provider, expected.provider);
+    assert.deepEqual(system.hosts, [expected.host]);
+    for (const feed of [
+      system.stationInformationUrl,
+      system.stationStatusUrl,
+    ]) {
+      const url = new URL(feed);
+      assert.ok(isAllowedGbfsHost(url.hostname), `${id} host ${url.hostname}`);
+      assert.ok(
+        isAllowedGbfsPath(url.pathname, url.hostname),
+        `${id} path ${url.pathname}`,
+      );
+    }
+  }
+});
+
+test('a camera over each outermost station activates its system', () => {
+  for (const [id, expected] of Object.entries(SYSTEMS)) {
+    for (const station of expected.stations) {
+      assert.ok(
+        computeInRangeCities({ lat: station.lat, lon: station.lon }).has(id),
+        `${station.name} activates ${id}`,
+      );
+    }
+  }
+});
+
+test('each load radius reaches its outermost stations', () => {
+  // The range check floors every radius at 100 km, so the test above passes
+  // with any loadRadiusKm; get_bike_share uses the radius as registered.
+  for (const [id, expected] of Object.entries(SYSTEMS)) {
+    const system = CITY_BY_ID.get(id);
+    for (const station of expected.stations) {
+      const distance = parts.model.haversineKm(
+        system.centerLat,
+        system.centerLon,
+        station.lat,
+        station.lon,
+      );
+      assert.ok(
+        distance <= system.loadRadiusKm,
+        `${station.name} is ${distance.toFixed(1)} km from the ${id} centre`,
+      );
+    }
+  }
+});
+
+test('a camera over central Barcelona activates both systems', () => {
+  // Plaça de Catalunya.
+  const active = computeInRangeCities({ lat: 41.387, lon: 2.17 });
+  assert.ok(active.has('barcelona-bicing'));
+  assert.ok(active.has('barcelona-ambici'));
+});
+
+test('the nextbike allowance is that one host, not its domain', () => {
+  assert.equal(isAllowedGbfsHost('gbfs.nextbike.net'), true);
+  assert.equal(isAllowedGbfsHost('api.nextbike.net'), false);
+  assert.equal(isAllowedGbfsHost('gbfs.nextbike.net.example'), false);
+});

src/layers/bikeshare/registry.js

@@ -554,6 +554,32 @@ const RAW_GBFS_CITY_REGISTRY = [
       'https://api.cyclocity.fr/contracts/lillestrom/gbfs/station_status.json',
     provider: 'Bysykkel Lillestrøm',
   },
+  {
+    id: 'barcelona-bicing',
+    city: 'Barcelona, Spain',
+    centerLat: 41.3926,
+    centerLon: 2.164,
+    loadRadiusKm: 40,
+    stationInformationUrl:
+      'https://barcelona.publicbikesystem.net/customer/gbfs/v2/en/station_information.json',
+    stationStatusUrl:
+      'https://barcelona.publicbikesystem.net/customer/gbfs/v2/en/station_status.json',
+    provider: 'Bicing',
+  },
+  // AMBici covers the metropolitan municipalities around Barcelona, from
+  // Castelldefels to Badalona, and overlaps Bicing only at the city edge.
+  {
+    id: 'barcelona-ambici',
+    city: 'Barcelona metropolitan area, Spain',
+    centerLat: 41.37,
+    centerLon: 2.07,
+    loadRadiusKm: 40,
+    stationInformationUrl:
+      'https://gbfs.nextbike.net/maps/gbfs/v2/nextbike_bs/en/station_information.json',
+    stationStatusUrl:
+      'https://gbfs.nextbike.net/maps/gbfs/v2/nextbike_bs/en/station_status.json',
+    provider: 'AMBici',
+  },
 ];
 function normalizeRegistryEntry(entry) {
   const id = String(entry?.id || '')