Merge remote-tracking branch 'upstream/main' into fix/terrain-same-site-gate-on-686

# Conflicts:
#	CHANGELOG.md
#	docs/CURRENT-STATE.md
#	scripts/format-scope.json

server/providers/cctv/normalize.js

@@ -39,11 +39,21 @@ export function escapeXml(text) {
 /**
  * Coerce a value to a finite number, returning fallback if NaN/Infinity.
  *
+ * Absent, blank and boolean values take the fallback too: `Number` reads
+ * null, '' and false as 0, which would turn a missing coordinate, heading or
+ * elevation into a real zero.
+ *
  * @param {*} value
  * @param {number} [fallback=NaN]
  * @returns {number}
  */
 export function toFiniteNumber(value, fallback = NaN) {
+  if (
+    value == null ||
+    typeof value === 'boolean' ||
+    (typeof value === 'string' && !value.trim())
+  )
+    return fallback;
   const num = Number(value);
   return Number.isFinite(num) ? num : fallback;
 }

server/providers/cyclones.js

@@ -4,6 +4,8 @@ const STATUS_URL = 'https://www.nhc.noaa.gov/CurrentStorms.json';
 const GIS =
   'https://mapservices.weather.noaa.gov/tropical/rest/services/tropical/NHC_tropical_weather_summary/MapServer';
 const HOUR = 3600_000;
+// Data, not UI copy: src/layers/cyclones/index.js keeps the same English in
+// msg() and translates it when shown (likewise 'Cyclone data unavailable').
 const COVERAGE =
   'Atlantic and eastern/central North Pacific; not worldwide cyclone coverage.';
 const LAYERS = [

server/providers/gbfs.js

@@ -1,4 +1,5 @@
 import { readResponseTextCapped } from './common/http.js';
+import { makeRateLimiter, clientKey } from './common/rate-limit.js';
 import {
   isAllowedGbfsHost,
   isAllowedGbfsPath,
@@ -17,6 +18,19 @@ export const GBFS_CLIENT_IDENTIFIER = 'gods-eye-view';
 
 export const GBFS_MAX_BODY_BYTES = 5 * 1024 * 1024; // 5 MB
 
+/**
+ * Requests/minute/IP admitted by the proxy.
+ *
+ * The bikeshare layer's own demand is small and known: `src/layers/bikeshare/
+ * registry.js` catalogues 15 systems, station information is cached per city
+ * after its first fetch, and station status refreshes once per city every
+ * `STATUS_POLL_MS` (60 s) with in-flight requests deduplicated. Even with every
+ * catalogued system in camera range at once that is about 15 requests a minute,
+ * so 120 is eight times a maximal real session while still capping a caller
+ * using this proxy as an open relay against a third-party GBFS host.
+ */
+export const GBFS_RATE_PER_MIN = 120;
+
 function gbfsRedirectHost(location, requestUrl) {
   if (!location) return '';
   try {
@@ -121,7 +135,12 @@ export async function fetchGbfsUpstream(
  *
  * @returns {import('vite').Plugin}
  */
-export function gbfsProxy() {
+export function gbfsProxy({ ratePerMinute = GBFS_RATE_PER_MIN } = {}) {
+  const allow = makeRateLimiter({
+    windowMs: 60_000,
+    max: ratePerMinute,
+    globalMax: ratePerMinute * 3,
+  });
   const installMiddleware = (server) => {
     server.middlewares.use('/api/gbfs', async (req, res) => {
       try {
@@ -134,6 +153,19 @@ export function gbfsProxy() {
           return;
         }
 
+        // Frequency, checked before the target is even parsed: the allowlist
+        // already says WHERE this proxy may go, nothing said HOW OFTEN. A
+        // refused request performs no outbound fetch and starts no timer.
+        if (!allow(clientKey(req))) {
+          res.writeHead(429, {
+            'Content-Type': 'application/json',
+            'Cache-Control': 'no-store',
+            'Retry-After': '10',
+          });
+          res.end(JSON.stringify({ error: 'Rate limit exceeded' }));
+          return;
+        }
+
         const url = new URL(req.url || '/', 'http://localhost');
         const encodedTarget = url.pathname.replace(/^\/+/, '');
         if (!encodedTarget) {

server/providers/overpass/transport.js

@@ -14,7 +14,7 @@ import { simplifyOverpassPayloadBody } from './geometry.js';
  * Checks for known rate-limit phrases in the body text regardless of
  * HTTP status code, since some mirrors return 200 with an error payload.
  *
- * @param {string} bodyText - Upstream response body.
+ * @param {string} bodyText - The remark of a data reply, or a non-data body.
  * @returns {boolean} True if the body looks rate-limited.
  */
 function overpassLooksRateLimited(bodyText) {
@@ -41,6 +41,14 @@ function overpassLooksRuntimeError(bodyText) {
   );
 }
 
+function parseJson(text) {
+  try {
+    return JSON.parse(text);
+  } catch {
+    return undefined;
+  }
+}
+
 /**
  * True only for an upstream response that is actually Overpass data.
  *
@@ -151,15 +159,22 @@ async function fetchOverpassPayload(
         signal: controller.signal,
       });
       const responseBody = await readBody(upstream, maxResponseBytes);
+      const parsed = parseJson(responseBody);
+      // An Overpass data reply reports failure in its remark; its element
+      // tags are data and can contain any phrase. Any other body (an error
+      // page, or JSON without elements) is matched whole.
+      const failureText = Array.isArray(parsed?.elements)
+        ? String(parsed.remark || '')
+        : responseBody;
       const rateLimited =
         upstream.status === 429 ||
         upstream.status === 406 ||
-        overpassLooksRateLimited(responseBody);
+        overpassLooksRateLimited(failureText);
       if (
         rateLimited ||
         upstream.status < 200 ||
         upstream.status >= 300 ||
-        overpassLooksRuntimeError(responseBody)
+        overpassLooksRuntimeError(failureText)
       ) {
         const failures = (previous?.failures || 0) + 1;
         const delay = retryDelay(
@@ -178,7 +193,6 @@ async function fetchOverpassPayload(
         failure = refusal(status, delay);
         continue;
       }
-      const parsed = JSON.parse(responseBody);
       if (!Array.isArray(parsed?.elements) || parsed.remark)
         throw new Error('Malformed Overpass response');
       cooldowns.delete(endpoint);

server/providers/traffic.js

@@ -8,6 +8,7 @@ import {
   normalizeBudget as normalizeTomTomBudget,
   isOverBudget as isTomTomOverBudget,
 } from '../../src/data/tomtomTiles.js';
+import { admitSameSite } from './common/same-site.js';
 
 /**
  * TomTom traffic-flow vector-tile proxy with a daily budget governor.
@@ -35,6 +36,13 @@ import {
  * for the rest of the billing period. 6,000/day keeps a full 31-day month
  * inside the allowance (186,000) with headroom to spare.
  *
+ * Cross-site gate: both routes refuse cross-site browser requests with 403
+ * (the gate Mapillary, OpenAI and Places already use). Every uncached tile is
+ * a billed upstream attempt counted against the persistent daily budget, so
+ * without the gate any web page the user visits could fire `<img>` requests
+ * at distinct tiles, spend the TomTom quota and leave the traffic layer on
+ * 429 budget for the rest of the UTC day.
+ *
  * GET /api/tomtom/status → {hasKey, dailyCount, budget, date}. Keyless mode:
  * status reports hasKey:false and the tile endpoint 503s {error:'no_key'}
  * without touching upstream — the traffic layer then stays in simulation mode.
@@ -161,6 +169,8 @@ export function tomtomProxy() {
 
   const installMiddleware = (server) => {
     server.middlewares.use('/api/tomtom', async (req, res) => {
+      // Gate first: a cross-site <img>/fetch must not reach the budget counter.
+      if (admitSameSite(req, res)) return;
       // Sanitized responses only (proxy/security baseline): no upstream
       // error details, and never echo the key or the upstream URL.
       const sendJson = (status, obj, extraHeaders = {}) => {

server/providers/wind.js

@@ -3,6 +3,10 @@ import { fetchIfsWind } from './wind/ifs.js';
 import { decodeWindGribMessage } from './wind/decode.js';
 import { weatherScalarMetadata, weatherScalarError } from './wind/grid.js';
 
+// Data, not UI copy: the client (src/layers/wind/index.js) marks this exact
+// English with msg() and translates it when shown, so keep the two in sync.
+const UPSTREAM_UNAVAILABLE = 'Wind upstream unavailable';
+
 /** Serve bounded, single-flight, per-model/overlay forecast snapshots from fixed providers. */
 export function windProxy({
   fetchImpl = fetch,
@@ -25,7 +29,7 @@ export function windProxy({
       ...(overlay === 'none' ? {} : { overlay }),
       unavailable: true,
       stale: true,
-      reason: 'Wind upstream unavailable',
+      reason: UPSTREAM_UNAVAILABLE,
     },
   });
   const sendJson = (res, value, status = 200) => {
@@ -139,7 +143,7 @@ export function windProxy({
           old.manifest = {
             ...old.manifest,
             stale: true,
-            reason: 'Wind upstream unavailable',
+            reason: UPSTREAM_UNAVAILABLE,
           };
           return old;
         }

server/standalone/key-setup.js

@@ -134,6 +134,8 @@ function keySetupEndpoint({ sourceRoot = defaultSourceRoot } = {}) {
   };
   // The gate itself is pure and unit-tested (admitKeySetupRequest in
   // src/keySetupCore.mjs) — this just feeds it the request.
+  // `code`/`params` pick the panel's sentence (src/keySetup.js); `error` is for logs.
+  const refusal = ({ error, code, params }) => ({ error, code, params });
   const admit = (req) =>
     admitKeySetupRequest({
       method: req.method,
@@ -247,18 +249,24 @@ function keySetupEndpoint({ sourceRoot = defaultSourceRoot } = {}) {
     configureServer(server) {
       server.middlewares.use('/api/setup/status', (req, res) => {
         if (req.method !== 'GET')
-          return respond(res, 405, { error: 'Method not allowed' });
+          return respond(res, 405, {
+            error: 'Method not allowed',
+            code: 'method',
+          });
         const admission = admit(req);
         if (!admission.ok)
-          return respond(res, admission.status, { error: admission.error });
+          return respond(res, admission.status, refusal(admission));
         respond(res, 200, providerStatus());
       });
       server.middlewares.use('/api/setup/keys', (req, res) => {
         if (req.method !== 'POST')
-          return respond(res, 405, { error: 'Method not allowed' });
+          return respond(res, 405, {
+            error: 'Method not allowed',
+            code: 'method',
+          });
         const admission = admit(req);
         if (!admission.ok)
-          return respond(res, admission.status, { error: admission.error });
+          return respond(res, admission.status, refusal(admission));
         let body = '';
         let overflowed = false;
         req.on('data', (chunk) => {
@@ -270,15 +278,21 @@ function keySetupEndpoint({ sourceRoot = defaultSourceRoot } = {}) {
         });
         req.on('end', () => {
           if (overflowed)
-            return respond(res, 413, { error: 'Request too large' });
+            return respond(res, 413, {
+              error: 'Request too large',
+              code: 'too-large',
+            });
           let parsed;
           try {
             parsed = JSON.parse(body || '{}');
           } catch {
-            return respond(res, 400, { error: 'Invalid JSON' });
+            return respond(res, 400, {
+              error: 'Invalid JSON',
+              code: 'invalid-json',
+            });
           }
           const verdict = validateKeySetupUpdates(parsed);
-          if (!verdict.ok) return respond(res, 400, { error: verdict.error });
+          if (!verdict.ok) return respond(res, 400, refusal(verdict));
           // Neither a replace NOR a removal may touch an externally-supplied
           // credential (shell env, Keychain, another workflow). This backs the
           // UI's read-only "configured externally" state with a real contract —
@@ -289,6 +303,8 @@ function keySetupEndpoint({ sourceRoot = defaultSourceRoot } = {}) {
             if (isExternallyManaged(name, inStore)) {
               return respond(res, 409, {
                 error: `${name} is configured outside Provider Settings and can only be changed where it was set`,
+                code: 'external',
+                params: { name },
               });
             }
           }
@@ -305,10 +321,16 @@ function keySetupEndpoint({ sourceRoot = defaultSourceRoot } = {}) {
             ) {
               return respond(res, 500, {
                 error: `The key was not saved: ${error.message}`,
+                code:
+                  error.code === 'GEV_HARDEN_FAILED'
+                    ? 'harden-failed'
+                    : 'store-unreadable',
               });
             }
             return respond(res, 500, {
               error: `Could not write the ${storeName()} store`,
+              code: 'write-failed',
+              params: { store: storeName() },
             });
           }
           // Live for the server-side proxies immediately; the restart below is