rstillwell/deckhearth
1
0
Fork 0
Code Issues 1 Pull requests Projects Releases Packages Wiki Activity Actions
deckhearth/.convoys/pricing-online-local/brief-11-stores-nearby-api.md
Randall Stillwell d0468015eb
Some checks failed
CI / Lint (pull_request) Has been cancelled
Details
CI / Schema map up to date (pull_request) Has been cancelled
Details
CI / Forbidden patterns (9 checks) (pull_request) Has been cancelled
Details
CI / Migrations apply (node-pg-migrate) (pull_request) Has been cancelled
Details
Visual diff / Should run? (pull_request) Has been cancelled
Details
CI / Unit tests (vitest) (pull_request) Has been cancelled
Details
Convoy metrics gate / Require role-event telemetry on convoy PRs (pull_request) Has been cancelled
Details
PR Health rollup / Aggregate gate status (pull_request) Has been cancelled
Details
Preview smoke / Should run? (pull_request) Has been cancelled
Details
Preview smoke / Playwright smoke (pull_request) Has been cancelled
Details
Visual diff / Screenshot diff (pull_request) Has been cancelled
Details
feat(pricing): convoy for online prices and local stores 
Add pricing schema, free API integrations (MTG bulk, TCGdex, Foolio),
valuation and sort-by-price, card detail pricing UI, and nearby store
discovery via home zip and OSM geo clients.

Co-authored-by: Cursor <cursoragent@cursor.com>
2026-09-08 22:47:46 -05:00

1.3 KiB
Raw Blame History

convoy brief_number depends_on recommended_model model_tier files
pricing-online-local 11
10
composer-2.5 standard
pages/api/stores/nearby.js
lib/rate-limit.js
test/api/stores-nearby.test.js

Brief 11: Stores nearby API

Goal (1 sentence)

Ship GET /api/stores/nearby with geocode + Overpass lookup, caching, and per-user refresh rate limit.

Files in scope (do not edit anything else)

  • pages/api/stores/nearby.js
  • lib/rate-limit.js
  • test/api/stores-nearby.test.js

Conventions to follow

  • Auth required (getUserFromRequest → 401). Zip from user's saved home_zip only — ignore arbitrary zip query param (security planning decision A).
  • Add stores limiter: 1/hour/user; IP backstop for burst abuse.
  • Respect PRICING_LOCAL_ENABLED — return 503 when false.
  • Overpass fixed-template query only (see Brief 10).

Acceptance criteria

  • Endpoint returns store list for authenticated user with saved zip
  • 401 without Bearer token
  • Second call within 7 days serves from geo_stores_cache
  • Rate limit returns 429 with Retry-After
  • Tests pass
  • No scope expansion

Rationale (≤3 sentences)

Phase 2 API surface from convoy spec. Auth-gated zip prevents geocode relay abuse. Rate limiting protects Overpass.