Merge branch 'main' into feature/geo-uri-search

# Conflicts:
#	CHANGELOG.md

src/search/coordinate-empty-components.test.mjs

@@ -0,0 +1,12 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import { parseCoordinateQuery } from './coordinateParser.js';
+test('search refuses omitted components and repeated separators', () => {
+  for (const q of ['30,, -97', ',30,-97', '30,-97,', '30;; -97', '30,; -97'])
+    assert.equal(parseCoordinateQuery(q), null, q);
+  for (const q of ['30,-97', '30; -97', '30 -97', 'N 30, W 97'])
+    assert.deepEqual(
+      [parseCoordinateQuery(q).lat, parseCoordinateQuery(q).lon],
+      [30, -97],
+    );
+});

src/search/coordinateParser.js

@@ -54,8 +54,8 @@ function splitComponents(query) {
   const parts = /[,;]/.test(text)
     ? text.split(/[,;]/)
     : text.split(/\s+(?=[+-]?[.\d]|[NSEW]\s*[+-]?[.\d])/i);
-  const trimmed = parts.map((part) => part.trim()).filter(Boolean);
-  return trimmed.length === 2 ? trimmed : null;
+  const trimmed = parts.map((part) => part.trim());
+  return trimmed.length === 2 && trimmed.every(Boolean) ? trimmed : null;
 }
 
 /** Present a parsed pair the way a coordinate is normally written. */

src/search/defaults.js

@@ -42,18 +42,23 @@ export function createDefaultPlaceSearch({
       ...(selected
         ? [selected]
         : [
+            // Google answers through the local proxy, which holds the server
+            // key: its Geocoding web service refuses referrer-restricted keys,
+            // so calling it from here would force the bundled browser key to be
+            // left unrestricted (#363). That key still gates the provider,
+            // because a keyless session must not spend a request to learn it
+            // has no Google: the proxy's "not configured" reads as an
+            // unanswered provider, which stops the chain caching the negative
+            // Photon or Nominatim then produces.
             createGoogleGeocoder({
               request(query, { bias, signal }) {
-                const key = resolveApiKey?.();
-                if (!key) return null;
-                const url = new URL(
-                  endpoints.geocode ||
-                    'https://maps.googleapis.com/maps/api/geocode/json',
+                if (!resolveApiKey?.()) return null;
+                const params = new URLSearchParams({ address: query });
+                if (bias) params.set('bounds', bias);
+                return fetchImpl(
+                  `${endpoints.geocode || '/api/google/geocode'}?${params}`,
+                  { signal },
                 );
-                url.searchParams.set('address', query);
-                url.searchParams.set('key', key);
-                if (bias) url.searchParams.set('bounds', bias);
-                return fetchImpl(url.toString(), { signal });
               },
             }),
             createPhotonGeocoder({ fetchImpl, endpoint: endpoints.photon }),

src/search/http.js

@@ -53,7 +53,9 @@ export function createHttpGeospatialProvider({
   endpoints = {},
 } = {}) {
   const urls = {
-    reverse: 'https://maps.googleapis.com/maps/api/geocode/json',
+    // Same-origin like its siblings below: Google's Geocoding web service
+    // refuses referrer-restricted keys, so the key stays on the server (#363).
+    reverse: '/api/google/reverse-geocode',
     textSearch: '/api/google/text-search',
     nearby: '/api/google/nearby-places',
     route: '/api/route',
@@ -88,14 +90,11 @@ export function createHttpGeospatialProvider({
     },
     routeProfiles: ['foot', 'car', 'bike'],
     async reverseGeocode(latitude, longitude, options) {
-      const key = resolveApiKey?.();
-      if (resolveApiKey && !key) return null;
+      // The browser key gates the provider without travelling with the
+      // request: the proxy supplies the key Google actually sees.
+      if (resolveApiKey && !resolveApiKey()) return null;
       return normalizeGoogleReverse(
-        await json(
-          urls.reverse,
-          { latlng: `${latitude},${longitude}`, ...(key ? { key } : {}) },
-          options,
-        ),
+        await json(urls.reverse, { lat: latitude, lon: longitude }, options),
       );
     },
     async textSearch(query, { latitude, longitude, radiusM = 6000 }, options) {

src/search/placeSearch.test.mjs

@@ -20,7 +20,7 @@ test('standalone geocoding falls back after Google connection, JSON and refusal
   for (const fail of [() => { throw new Error('offline'); }, () => new Response('invalid json'), () => Response.json({ status: 'REQUEST_DENIED' })]) {
     const urls = [];
     const service = createStandalonePlaceSearch({ resolveApiKey: () => 'fixture', fetchImpl: async (url) => {
-      urls.push(url); return url.includes('maps.googleapis.com') ? fail() : hit();
+      urls.push(url); return url.includes('/api/google/geocode') ? fail() : hit();
     } });
     const result = await service.geocode('Hanoi');
     assert.equal(result.place.name, 'Hà Nội');