docs(street-level): the proxy adds the token to tile requests and refuses redirects

Co-Authored-By: Claude Opus 5.5 <[email protected]>

CHANGELOG.md

@@ -77,9 +77,10 @@
   and an embedded viewer with full-screen EXPAND and FIT/FILL. Coverage lines
   (below 60 km) and image cones drape on the terrain and Google 3D tiles;
   opening a photo frames it with one camera flight. Share links carry the
-  switch, the filters and the panel's collapsed state. A server proxy keeps
+  switch, the filters and the panel's collapsed state. A server proxy adds the
-  the token server-side, trims coverage tiles and caches them in memory for
+  token to coverage-tile requests, trims the tiles and caches them in memory
-  24 h; it refuses cross-site requests and rate-limits per IP. The panel reads
+  for 24 h; it refuses cross-site requests and upstream redirects, rate-limits
+  per IP and runs at most six Mapillary fetches at once. The panel reads
   KEY REQUIRED without a token and KEY REJECTED when Mapillary refuses it.
 
 - Add Norway's road cameras from Statens vegvesen as a CCTV pack. The camera

SECURITY.md

@@ -28,7 +28,7 @@ These are designed to be used directly in the browser (like a Mapbox public toke
 
 1. **Google Maps API key** — loads Photorealistic 3D Tiles directly and powers GEV place search. **Restrict it** (HTTP referrer + API restriction to the required Google APIs) in the Google Cloud Console. An unrestricted key in a public deployment can be abused and billed to you.
 2. **Cesium ion token** (`CESIUM_ION_TOKEN`, optional — for ion-hosted Google Photorealistic 3D Tiles, Bing world imagery, and world terrain) — used as `Cesium.Ion.defaultAccessToken` client-side. Use a public **`assets:read`** token with **URL restrictions** for any hosted deployment. The Community plan has eligibility and usage limits; a public token is not a secret, but it can still consume the account's quota.
-3. **Mapillary client token** (`MAPILLARY_CLIENT_TOKEN`, optional, Street Level) — used by the MapillaryJS viewer and Graph API lookups in the browser, and by the server's coverage-tile proxy, which sends it only to `tiles.mapillary.com` over HTTPS (redirects are followed by hand and pinned to that origin) and caches tiles in memory only. Mapillary client tokens are meant for browser use.
+3. **Mapillary client token** (`MAPILLARY_CLIENT_TOKEN`, optional, Street Level) — used by the MapillaryJS viewer and Graph API lookups in the browser, and by the server's coverage-tile proxy, which sends it only to `tiles.mapillary.com` over HTTPS (an upstream redirect is refused and answered 502, never followed) and caches tiles in memory only. Mapillary client tokens are meant for browser use.
 
 > The explicit browser `define` block in `build/vite.js` controls exactly what reaches the client: only these three keys. Everything else stays server-side.
 

docs/CURRENT-STATE.md

@@ -3045,10 +3045,11 @@ reads KEY REQUIRED, says which key to add and disables the filters; a rejected
 key reads KEY REJECTED and stops tile requests until the layer goes off; a 429
 pauses them for its Retry-After.
 
-The server proxy (`server/providers/mapillary.js`) keeps the token server-side,
+The server proxy (`server/providers/mapillary.js`) adds the token to
-serves only z11–14 coverage, refuses upstream redirects, strips the unused
+coverage-tile requests (the browser holds it too, for MapillaryJS and the Graph
-`image` layer, coalesces concurrent requests and keeps tiles in a 24 h memory
+API), serves only z11–14 coverage, refuses upstream redirects, strips the
-cache.
+unused `image` layer, coalesces concurrent requests, runs at most six Mapillary
+fetches at once and keeps tiles in a 24 h memory cache.
 
 MapillaryJS loads on the first photo. Opening one frames it with a single
 camera flight through the application's deferred navigation (`begin` /