refactor: extract place-search and routing provider modules

server/providers/places/google-key.js

@@ -0,0 +1,26 @@
+import { resolveGoogleServerKey } from '../../../scripts/google-server-key.mjs';
+
+/**
+ * Optional Google place context is an empty capability when no key is present,
+ * not a server outage. Returning 200 keeps a deliberately keyless session out
+ * of the browser error console while preserving an explicit configured flag.
+ */
+export function keylessGooglePlacesResponse(apiKey) {
+  if (String(apiKey ?? '').trim()) return null;
+  return {
+    statusCode: 200,
+    payload: { configured: false, error: null, places: [] },
+  };
+}
+
+/**
+ * Google API key for the SERVER-SIDE calls (Places nearby/text search, the
+ * CCTV Street View fallback). These never reach the browser, so this key can
+ * be restricted by server IP and scoped to Places API + Street View Static
+ * API — while GOOGLE_MAPS_API_KEY stays referrer-restricted to Map Tiles +
+ * Geocoding for the browser (#33). Splitting them is opt-in: unset, this
+ * falls back to the shared browser key and nothing changes.
+ */
+export function googleServerApiKey() {
+  return resolveGoogleServerKey(process.env);
+}

server/providers/places/google.js

@@ -0,0 +1,210 @@
+import { googleServerApiKey, keylessGooglePlacesResponse } from './google-key.js';
+import { makeOptInRateLimiter, clientKey } from '../common/rate-limit.js';
+import { projectNearbyPlaces, projectTextSearchPlaces } from '../../../src/data/placeProviderPayloads.js';
+
+// Construct lazily after the standalone environment has loaded.
+// undefined = not built yet; null = unlimited; fn = active limiter
+let _googleRateLimiter;
+
+/** Google cost endpoint (nearby-places). Null = unlimited (default). */
+function googleRateLimiter() {
+  if (_googleRateLimiter === undefined) _googleRateLimiter = makeOptInRateLimiter(process.env.GEV_RATELIMIT_GOOGLE_PER_MIN);
+  return _googleRateLimiter;
+}
+
+/** Nearby place labels and view-biased text search, with request-time key resolution. */
+export function googlePlacesContextProxy({ resolveApiKey = googleServerApiKey } = {}) {
+  function install(middlewares) {
+    middlewares.use('/api/google/nearby-places', async (req, res) => {
+      if (req.method !== 'GET') {
+        res.statusCode = 405;
+        res.setHeader('Content-Type', 'application/json');
+        res.end(JSON.stringify({ error: 'Method not allowed', places: [] }));
+        return;
+      }
+
+      // Keyless place context has no provider cost, so it resolves before the
+      // paid-endpoint limiter can consume or exhaust quota (mirrors the HUD
+      // summary route).
+      const apiKey = resolveApiKey();
+      const keyless = keylessGooglePlacesResponse(apiKey);
+      if (keyless) {
+        res.statusCode = keyless.statusCode;
+        res.setHeader('Content-Type', 'application/json');
+        res.setHeader('Cache-Control', 'no-store');
+        res.end(JSON.stringify(keyless.payload));
+        return;
+      }
+
+      // Opt-in per-IP throttle (GEV_RATELIMIT_GOOGLE_PER_MIN). No-op when unset.
+      // Inlined (not the shared helper) so the 429 body keeps this endpoint's
+      // `places: []` contract that the client expects on every error response.
+      const _grl = googleRateLimiter();
+      if (_grl && !_grl(clientKey(req))) {
+        res.statusCode = 429;
+        res.setHeader('Content-Type', 'application/json');
+        res.setHeader('Retry-After', '5');
+        res.end(JSON.stringify({ error: 'Rate limit exceeded', places: [] }));
+        return;
+      }
+
+      const requestUrl = new URL(req.url || '', 'http://localhost');
+      const latitude = Number(requestUrl.searchParams.get('lat'));
+      const longitude = Number(requestUrl.searchParams.get('lon'));
+      const radiusM = Math.max(25, Math.min(5000, Number(requestUrl.searchParams.get('radiusM')) || 250));
+      if (!Number.isFinite(latitude) || !Number.isFinite(longitude)) {
+        res.statusCode = 400;
+        res.setHeader('Content-Type', 'application/json');
+        res.end(JSON.stringify({ error: 'Valid lat and lon are required', places: [] }));
+        return;
+      }
+
+      try {
+        const response = await fetch('https://places.googleapis.com/v1/places:searchNearby', {
+          method: 'POST',
+          headers: {
+            'Content-Type': 'application/json',
+            'X-Goog-Api-Key': apiKey,
+            'X-Goog-FieldMask': [
+              'places.id',
+              'places.displayName',
+              'places.formattedAddress',
+              'places.shortFormattedAddress',
+              'places.location',
+              'places.primaryType',
+              'places.primaryTypeDisplayName',
+              'places.types',
+            ].join(','),
+          },
+          body: JSON.stringify({
+            maxResultCount: 20,
+            rankPreference: 'DISTANCE',
+            locationRestriction: {
+              circle: {
+                center: { latitude, longitude },
+                radius: radiusM,
+              },
+            },
+          }),
+        });
+        const data = await response.json().catch(() => ({}));
+        const places = projectNearbyPlaces(data, latitude, longitude);
+
+        res.statusCode = response.ok ? 200 : response.status;
+        res.setHeader('Content-Type', 'application/json; charset=utf-8');
+        res.setHeader('Cache-Control', 'private, max-age=300');
+        res.end(JSON.stringify({
+          places,
+          error: response.ok ? null : data.error?.message || 'Google Places request failed',
+        }));
+      } catch (error) {
+        res.statusCode = 502;
+        res.setHeader('Content-Type', 'application/json; charset=utf-8');
+        res.end(JSON.stringify({ error: error?.message || 'Google Places request failed', places: [] }));
+      }
+    });
+
+    // Text Search: resolve a named landmark/POI to a real coordinate, biased to
+    // the view. Geocoding scatters obscure monument/POI names across the city;
+    // a view-biased Text Search lands on the actual feature. Same key, field
+    // mask, throttle, and `places: []` error contract as nearby-places above.
+    middlewares.use('/api/google/text-search', async (req, res) => {
+      if (req.method !== 'GET') {
+        res.statusCode = 405;
+        res.setHeader('Content-Type', 'application/json');
+        res.end(JSON.stringify({ error: 'Method not allowed', places: [] }));
+        return;
+      }
+
+      // Keyless place context has no provider cost, so it resolves before the
+      // paid-endpoint limiter can consume or exhaust quota (mirrors the HUD
+      // summary route).
+      const apiKey = resolveApiKey();
+      const keyless = keylessGooglePlacesResponse(apiKey);
+      if (keyless) {
+        res.statusCode = keyless.statusCode;
+        res.setHeader('Content-Type', 'application/json');
+        res.setHeader('Cache-Control', 'no-store');
+        res.end(JSON.stringify(keyless.payload));
+        return;
+      }
+
+      // Opt-in per-IP throttle (GEV_RATELIMIT_GOOGLE_PER_MIN). No-op when unset.
+      // Inlined (like nearby-places) so the 429 body keeps the `places: []`
+      // contract the client expects on every error response.
+      const _grl = googleRateLimiter();
+      if (_grl && !_grl(clientKey(req))) {
+        res.statusCode = 429;
+        res.setHeader('Content-Type', 'application/json');
+        res.setHeader('Retry-After', '5');
+        res.end(JSON.stringify({ error: 'Rate limit exceeded', places: [] }));
+        return;
+      }
+
+      const requestUrl = new URL(req.url || '', 'http://localhost');
+      const textQuery = String(requestUrl.searchParams.get('q') || '').trim();
+      const latitude = Number(requestUrl.searchParams.get('lat'));
+      const longitude = Number(requestUrl.searchParams.get('lon'));
+      const radiusM = Math.max(50, Math.min(50000, Number(requestUrl.searchParams.get('radiusM')) || 4000));
+      if (!textQuery || !Number.isFinite(latitude) || !Number.isFinite(longitude)) {
+        res.statusCode = 400;
+        res.setHeader('Content-Type', 'application/json');
+        res.end(JSON.stringify({ error: 'q, lat and lon are required', places: [] }));
+        return;
+      }
+
+      try {
+        const response = await fetch('https://places.googleapis.com/v1/places:searchText', {
+          method: 'POST',
+          headers: {
+            'Content-Type': 'application/json',
+            'X-Goog-Api-Key': apiKey,
+            'X-Goog-FieldMask': [
+              'places.id',
+              'places.displayName',
+              'places.formattedAddress',
+              'places.location',
+              'places.viewport',
+              'places.primaryType',
+              'places.types',
+            ].join(','),
+          },
+          body: JSON.stringify({
+            textQuery,
+            locationBias: {
+              circle: {
+                center: { latitude, longitude },
+                radius: radiusM,
+              },
+            },
+            maxResultCount: 5,
+          }),
+        });
+        const data = await response.json().catch(() => ({}));
+        const places = projectTextSearchPlaces(data, latitude, longitude);
+
+        res.statusCode = response.ok ? 200 : response.status;
+        res.setHeader('Content-Type', 'application/json; charset=utf-8');
+        res.setHeader('Cache-Control', 'private, max-age=300');
+        res.end(JSON.stringify({
+          places,
+          error: response.ok ? null : data.error?.message || 'Google Places request failed',
+        }));
+      } catch (error) {
+        res.statusCode = 502;
+        res.setHeader('Content-Type', 'application/json; charset=utf-8');
+        res.end(JSON.stringify({ error: error?.message || 'Google Places request failed', places: [] }));
+      }
+    });
+  }
+
+  return {
+    name: 'google-places-context-proxy',
+    configureServer(server) {
+      install(server.middlewares);
+    },
+    configurePreviewServer(server) {
+      install(server.middlewares);
+    },
+  };
+}

server/providers/places/routes.js

@@ -0,0 +1,104 @@
+import { makeRateLimiter, clientKey } from '../common/rate-limit.js';
+import { haversineKm } from '../common/geo.js';
+import { readResponseTextCapped } from '../common/http.js';
+import { normalizeRouteProfile, projectRouteResult } from '../../../src/data/placeProviderPayloads.js';
+
+/** OSM routing (FOSSGIS OSRM) cache: profile|coords -> { payload, cachedAt }. */
+const ROUTE_CACHE_MS = 600000;
+
+const _routeCache = new Map();
+
+/** Hard cap on the OSRM route response we will buffer. */
+const ROUTE_MAX_RESPONSE_BYTES = 8 * 1024 * 1024; // 8 MB
+
+/** Reject routes whose straight-line spans are obviously abusive (km). */
+const ROUTE_MAX_LEG_KM = 600;
+
+const ROUTE_MAX_TOTAL_KM = 2500;
+
+const _routeRateLimiter = makeRateLimiter({ windowMs: 60_000, max: 60, globalMax: 200 });
+
+export function installRouteMiddleware(middlewares) {
+      // Real OSM routing via the public FOSSGIS OSRM servers (foot/car/bike).
+      // GET /api/route?profile=foot|car|bike&coords=lon,lat;lon,lat[;...]
+      middlewares.use('/api/route', async (req, res) => {
+        const fail = (msg) => {
+          res.writeHead(200, { 'Content-Type': 'application/json' });
+          res.end(JSON.stringify({ ok: false, error: msg }));
+        };
+        try {
+          if (!_routeRateLimiter(clientKey(req))) {
+            res.writeHead(429, { 'Content-Type': 'application/json', 'Retry-After': '5' });
+            res.end(JSON.stringify({ ok: false, error: 'rate limited' }));
+            return;
+          }
+          const url = new URL(req.url, 'http://localhost');
+          const raw = (url.searchParams.get('profile') || 'foot').toLowerCase();
+          const profile = normalizeRouteProfile(raw);
+          if (!profile) return fail('invalid profile');
+          const osrmProfile = profile === 'car' ? 'driving' : profile;
+          const pairs = (url.searchParams.get('coords') || '').split(';').map((s) => s.trim()).filter(Boolean);
+          if (pairs.length < 2 || pairs.length > 12) return fail('need 2-12 coordinates');
+          const clean = [];
+          const pts = [];
+          for (const pr of pairs) {
+            const parts = pr.split(',');
+            if (parts.length !== 2) return fail('invalid coordinate');
+            const lon = Number(parts[0]);
+            const lat = Number(parts[1]);
+            if (!Number.isFinite(lon) || !Number.isFinite(lat) || Math.abs(lat) > 90 || Math.abs(lon) > 180) {
+              return fail('invalid coordinate');
+            }
+            clean.push(`${lon},${lat}`);
+            pts.push([lon, lat]);
+          }
+          // Reject obviously-abusive spans — a real walking/driving route is local,
+          // so a cross-continent request is either a bug or an attempt to drive
+          // heavy upstream OSRM work.
+          let totalKm = 0;
+          for (let i = 1; i < pts.length; i += 1) {
+            // pts are [lon, lat]; existing haversineKm takes (lat1, lon1, lat2, lon2).
+            const legKm = haversineKm(pts[i - 1][1], pts[i - 1][0], pts[i][1], pts[i][0]);
+            if (legKm > ROUTE_MAX_LEG_KM) return fail('route leg too long');
+            totalKm += legKm;
+          }
+          if (totalKm > ROUTE_MAX_TOTAL_KM) return fail('route too long');
+          const coords = clean.join(';');
+          const cacheKey = `${profile}|${coords}`;
+          const now = Date.now();
+          const cached = _routeCache.get(cacheKey);
+          if (cached && now - cached.cachedAt <= ROUTE_CACHE_MS) {
+            res.writeHead(200, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify(cached.payload));
+            return;
+          }
+          const upstream = `https://routing.openstreetmap.de/routed-${profile}/route/v1/${osrmProfile}/${coords}?overview=full&geometries=geojson&alternatives=false&steps=false`;
+          const controller = new AbortController();
+          const timer = setTimeout(() => controller.abort(), 12000);
+          let osrm;
+          try {
+            const upstreamRes = await fetch(upstream, {
+              signal: controller.signal,
+              headers: { 'User-Agent': 'gods-eye-view/dev (local)' },
+            });
+            if (!upstreamRes.ok) return fail('no route found');
+            const ctype = upstreamRes.headers.get('content-type') || '';
+            if (!ctype.includes('json')) return fail('no route found');
+            const text = await readResponseTextCapped(upstreamRes, ROUTE_MAX_RESPONSE_BYTES);
+            osrm = JSON.parse(text);
+          } finally {
+            clearTimeout(timer);
+          }
+          const route = osrm?.routes?.[0];
+          if (osrm?.code !== 'Ok' || !route?.geometry?.coordinates?.length) return fail('no route found');
+          const payload = projectRouteResult(route, profile);
+          _routeCache.set(cacheKey, { payload, cachedAt: now });
+          if (_routeCache.size > 200) _routeCache.delete(_routeCache.keys().next().value);
+          res.writeHead(200, { 'Content-Type': 'application/json' });
+          res.end(JSON.stringify(payload));
+        } catch (e) {
+          console.error('[Route Proxy]', e?.message || e);
+          fail('route proxy error');
+        }
+      });
+}