Sameh KhamisandClaude Opus 5.5 9b4ccbff62 fix(server): gate Google text search against cross-site requests ...

/api/google/text-search spends the same Google quota as nearby-places but
was not behind the cross-site gate. It now refuses cross-site requests
before calling Google, and a test covers both paid Google routes.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

2026-10-02 20:16:39 -07:00

..

aircraft

fix: time-limit OpenSky snapshot requests and retry once

2026-10-01 14:26:20 -07:00

cctv

fix: judge camera catalog trimming by region, not by returned cameras

2026-10-02 15:21:36 -07:00

common

fix(server): throttle the cost-bearing proxies by default

2026-10-02 19:57:29 -07:00

military-installations

style: format extracted local services

2026-09-12 13:01:49 -07:00

openai

fix(server): keep debug-log timestamps server-owned and send nosniff

2026-10-02 20:00:11 -07:00

overpass

fix(osm): stop using public Overpass by default (#648) (#742)

2026-09-28 19:07:57 -05:00

places

fix(server): gate Google text search against cross-site requests

2026-10-02 20:16:39 -07:00

radio

refactor: expose portable source record protocols

2026-09-14 19:36:32 -07:00

regional

fix(osm): stop using public Overpass by default (#648) (#742)

2026-09-28 19:07:57 -05:00

space

fix: register data providers for local preview

2026-09-12 12:43:54 -07:00

vessels

fix: treat AIS "not available" speed and course as unknown

2026-09-18 00:41:06 +01:00

wind

feat(weather): add globe wind, observed weather and cyclone context (#617)

2026-09-22 17:45:39 -05:00

cctv.js

fix: say when the camera catalog serves only part of a region

2026-10-02 15:21:36 -07:00

cyclones.js

feat(weather): add globe wind, observed weather and cyclone context (#617)

2026-09-22 17:45:39 -05:00

firePerimeters.js

feat(fires): MODIS in Active Fires and a Fire Perimeters layer (#737)

2026-09-23 21:21:52 -05:00

firms.js

feat(fires): MODIS in Active Fires and a Fire Perimeters layer (#737)

2026-09-23 21:21:52 -05:00

gbfs.js

fix(gbfs): adapt redirect hardening to provider modules and bound body reads

2026-09-12 15:13:14 -07:00

live.js

style: format extracted live provider modules

2026-09-11 19:06:10 -07:00

local-receivers.js

feat(sdr): local receivers — browser RTL-SDR, Local ADS-B layer and decoder feeds (#732)

2026-09-23 16:00:53 -05:00

local.js

feat: share the tool catalog with voice

2026-10-01 13:52:36 -07:00

military-installations.js

fix(osm): stop using public Overpass by default (#648) (#742)

2026-09-28 19:07:57 -05:00

openai.js

fix(server): gate cost/log endpoints against cross-site requests and ship a full CSP

2026-10-02 19:56:42 -07:00

overpass.js

fix(osm): stop using public Overpass by default (#648) (#742)

2026-09-28 19:07:57 -05:00

places.js

fix(server): throttle the cost-bearing proxies by default

2026-10-02 19:57:29 -07:00

radio.js

style: adopt formatting for CCTV and radio provider modules

2026-09-12 12:09:04 -07:00

regional.js

feat(search): Nominatim as the last-resort geocoder (#573)

2026-09-14 21:22:08 -05:00

space.js

style: format satellite and launch provider modules

2026-09-11 21:22:41 -07:00

terrain.js

fix(terrain): keep cold height requests within the browser deadline (#348)

2026-09-12 14:04:08 -07:00

traffic.js

fix(tomtom): size the daily tile budget to the real free allowance

2026-09-19 22:44:19 -07:00

transit.js

refactor: separate transit sources and request service

2026-09-15 07:41:56 -07:00

transitHistory.js

refactor: separate transit sources and request service

2026-09-15 07:41:56 -07:00

transitHistory.test.mjs

feat(transit): live public-transit vehicles from open GTFS-Realtime feeds (#587)

2026-09-15 05:18:30 -05:00

weather.js

feat(weather): add globe wind, observed weather and cyclone context (#617)

2026-09-22 17:45:39 -05:00

wind.js

feat(weather): add globe wind, observed weather and cyclone context (#617)

2026-09-22 17:45:39 -05:00