Changelog: 1598 fragment

changelog.d/1598-shortcuts-modifier-keys.md

@@ -0,0 +1,5 @@
+- Keep single-key app shortcuts off Cmd, Ctrl and Alt combinations, so Cmd+F,
+  Cmd+C and Cmd+R reach the browser instead of hiding the layer panel or
+  switching layers on. `F` now collapses the layer panel the way its button
+  does, instead of hiding the panel and the button that brings it back
+  (asturksever, #1598).

changelog.d/1602-cctv-streetview-fallback-catalog.md

@@ -1,5 +0,0 @@
-- The CCTV Street View fallback serves only catalog cameras, at their catalog
-  position, heading, field of view and pitch, and ignores coordinates a
-  request supplies. It spends from the per-client Google budget
-  (`GEV_RATELIMIT_GOOGLE_PER_MIN`, default 120), so the Google key can no
-  longer be used as an unmetered Street View service (asturksever, #1602).

docs/CURRENT-STATE.md

@@ -1276,10 +1276,7 @@ and follows redirects only on the camera's origin. Catalog image URLs, and
 redirects on those hosts, are pinned by parsed URL to the agency's image
 directory. Every `/api/cctv` route refuses cross-site browser requests but
 accepts forwarding headers, so cameras work behind a reverse proxy; a forwarded
-request skips the key-bearing Street View fallback and gets the placeholder. The
-Street View fallback serves only catalog cameras, at the catalog position,
-heading, field of view and pitch, never coordinates a request supplies, and it
-shares the per-client Google budget (`GEV_RATELIMIT_GOOGLE_PER_MIN`, default 120).
+request skips the key-bearing Street View fallback and gets the placeholder.
 
 The CCTV layer draws only the cameras on or near the screen. Zoomed out, it
 keeps one camera per ground cell sized to the view, preferring a healthy feed,

scripts/package-boundaries.json

@@ -377,9 +377,7 @@
       "src/data/cctvFootprint.js",
       "src/sources/cctvTypes.js",
       "src/sources/httpBody.js",
-      "src/i18n/marker.js",
-      "server/providers/common/rate-limit.js",
-      "src/sources/rateLimit.js"
+      "src/i18n/marker.js"
     ],
     "external": []
   },

server/providers/cctv.js

@@ -19,22 +19,7 @@ import { admitSameSiteKeyless } from './common/same-site.js';
 import { PROXY_SIGNALS } from '../../src/localRequestGate.mjs';
 import { createHlsPuller } from './cctv/stream.js';
 import { googleServerApiKey } from './places/google-key.js';
-import { clientKey, makeCostRateLimiter } from './common/rate-limit.js';
 export { CCTV_FRAME_FETCH_TIMEOUT_MS, fetchCctvImageFromUpstream };
-let _streetViewRateLimiter;
-/**
- * Per-IP budget for the Street View fallback, on the same setting as the
- * other Google routes (GEV_RATELIMIT_GOOGLE_PER_MIN; 0 disables it).
- */
-function streetViewRateLimiter() {
-  if (_streetViewRateLimiter === undefined)
-    _streetViewRateLimiter = makeCostRateLimiter(
-      process.env.GEV_RATELIMIT_GOOGLE_PER_MIN,
-      120,
-    );
-  return _streetViewRateLimiter;
-}
-
 /**
  * Vite plugin: CCTV camera proxy with source registry, frame/media serving,
  * fallback chain (upstream -> Street View -> synthetic SVG), and health tracking.
@@ -524,6 +509,13 @@ export function cctvProxy({ sourceRoot = process.cwd() } = {}) {
         const source = sourceById.get(cameraId);
         const label = url.searchParams.get('label') || source?.name || cameraId;
         const city = url.searchParams.get('city') || source?.city || '';
+        const lat = Number(url.searchParams.get('lat') || source?.lat);
+        const lon = Number(url.searchParams.get('lon') || source?.lon);
+        const heading = Number(
+          url.searchParams.get('heading') || source?.headingDeg,
+        );
+        const fov = Number(url.searchParams.get('fov') || source?.fovDeg);
+        const pitch = Number(url.searchParams.get('pitch') || source?.pitchDeg);
 
         // Only use server-registered upstream URLs — never accept client-supplied URLs
         // (prevents SSRF via ?upstream= query parameter)
@@ -557,26 +549,18 @@ export function cctvProxy({ sourceRoot = process.cwd() } = {}) {
         // request (whose client this server cannot see) gets the placeholder,
         // as if no key were configured. Any forwarding header counts, even an
         // empty one.
-        // It is also only for catalog cameras, framed from the catalog (never
-        // a spot the query names), within the per-IP Google budget.
         const forwarded = PROXY_SIGNALS.some(
           (name) => req.headers?.[name] !== undefined,
         );
-        const googleBudget = googleServerApiKey()
-          ? streetViewRateLimiter()
-          : null;
-        const sv =
-          forwarded ||
-          !source ||
-          (googleBudget && !googleBudget(clientKey(req)))
-            ? null
-            : await streetViewFallback({
-                lat: Number(source.lat),
-                lon: Number(source.lon),
-                heading: Number(source.headingDeg),
-                fov: Number(source.fovDeg),
-                pitch: Number(source.pitchDeg ?? -10),
-              });
+        const sv = forwarded
+          ? null
+          : await streetViewFallback({
+              lat,
+              lon,
+              heading,
+              fov,
+              pitch,
+            });
         if (sv?.ok) {
           setHealth(cameraId, {
             status: 'degraded',

src/data/cctvMediaFeedType.test.mjs

@@ -528,30 +528,3 @@ test('a forwarded same-origin request reaches every CCTV route but not the Stree
   assert.equal(direct.body, 'street-view');
   assert.equal(streetViewCalls(), 1);
 });
-
-test('the Street View fallback frames catalog cameras only, from the catalog position', async (t) => {
-  const app = mount(t, ({ url }) =>
-    url.startsWith('https://maps.googleapis.com/')
-      ? trackedUpstream({
-          headers: { 'content-type': 'image/jpeg' },
-          body: 'street-view',
-        }).response
-      : upstreamResponse({ status: 503 }),
-  );
-  process.env.GOOGLE_MAPS_SERVER_API_KEY = 'fixture-key';
-  const streetView = () =>
-    app.requests.filter(({ url }) =>
-      url.startsWith('https://maps.googleapis.com/'),
-    );
-
-  const unknown = await app.call('/frame/not-a-camera?lat=48.85&lon=2.29');
-  assert.equal(unknown.headers['X-CCTV-Source'], 'synthetic');
-  assert.deepEqual(streetView(), [], 'no Google call for an unknown id');
-
-  const steered = await app.call(
-    `/frame/${STILL.id}?lat=48.85&lon=2.29&heading=90`,
-  );
-  assert.equal(steered.headers['X-CCTV-Source'], 'streetview');
-  const location = new URL(streetView()[0].url).searchParams.get('location');
-  assert.equal(location, `${STILL.lat},${STILL.lon}`);
-});

src/ui/applicationShell.js

@@ -542,6 +542,7 @@ export class StyleManager extends ShellFacade {
         _toggleOrbit: (...args) => this._toggleOrbit(...args),
         toggleCleanView: (...args) => this.toggleCleanView(...args),
         _toggleCctvEnabled: (...args) => this._toggleCctvEnabled(...args),
+        _togglePanel: (panelId) => this._panelChrome._togglePanel(panelId),
         _setBloomEnabled: (...args) => this._setBloomEnabled(...args),
         _setBloomIntensity: (...args) => this._setBloomIntensity(...args),
         _setSharpenEnabled: (...args) => this._setSharpenEnabled(...args),

src/ui/applicationShortcuts.js

@@ -27,6 +27,11 @@ export function bindApplicationShortcuts({
       event.target?.matches?.('select, input, textarea') ||
       event.target === searchInput;
     if (isFormControl && event.key !== 'Escape') return;
+    // Browser and OS shortcuts (Cmd+C, Ctrl+F, Alt+1…) are not ours.
+    if (event.metaKey || event.ctrlKey || event.altKey) {
+      if (event.key === 'Escape') actions.dismissSearch();
+      return;
+    }
 
     if (STYLE_KEYS[event.key]) actions.setStyle(STYLE_KEYS[event.key]);
     if (event.key === 'Escape') actions.dismissSearch();

src/ui/displayBindings.js

@@ -64,8 +64,8 @@ export class DisplayBindings {
         },
         toggleOrbit: () => this._toggleOrbit(),
         toggleCleanView: () => this.toggleCleanView(),
-        toggleLayers: () =>
-          document.getElementById('data-panel').classList.toggle('active'),
+        // Same collapse as the panel's own button, so its rail entry stays.
+        toggleLayers: () => this._togglePanel('data-panel'),
         cycleDetection: () => {
           this.shareLinkManager?.claimRestoreLane?.('visual');
           this.claimDetection();

src/ui/visualInput.test.mjs

@@ -117,9 +117,19 @@ test('the supplied search target retains editing even without form markup', () =
   assert.deepEqual(f.calls, [['dismissSearch']]);
 });
 
-test('shortcut extraction does not change repeat or modifier policy', () => {
+test('browser shortcuts with Cmd, Ctrl or Alt never reach app shortcuts', () => {
   const f = shortcuts();
-  f.press('h', new Element(), { repeat: true, ctrlKey: true });
+  for (const modifier of ['metaKey', 'ctrlKey', 'altKey'])
+    for (const key of ['1', 'h', 'o', 'v', 'f', 'd', 'c'])
+      f.press(key, new Element(), { [modifier]: true });
+  assert.deepEqual(f.calls, []);
+  f.press('Escape', new Element(), { metaKey: true });
+  assert.deepEqual(f.calls, [['dismissSearch']]);
+});
+
+test('a held key still repeats its shortcut', () => {
+  const f = shortcuts();
+  f.press('h', new Element(), { repeat: true });
   assert.deepEqual(f.calls, [['toggleHud']]);
 });