d0468015eb
Some checks failed
CI / Lint (pull_request) Has been cancelled
CI / Schema map up to date (pull_request) Has been cancelled
CI / Forbidden patterns (9 checks) (pull_request) Has been cancelled
CI / Migrations apply (node-pg-migrate) (pull_request) Has been cancelled
Visual diff / Should run? (pull_request) Has been cancelled
CI / Unit tests (vitest) (pull_request) Has been cancelled
Convoy metrics gate / Require role-event telemetry on convoy PRs (pull_request) Has been cancelled
PR Health rollup / Aggregate gate status (pull_request) Has been cancelled
Preview smoke / Should run? (pull_request) Has been cancelled
Preview smoke / Playwright smoke (pull_request) Has been cancelled
Visual diff / Screenshot diff (pull_request) Has been cancelled
Add pricing schema, free API integrations (MTG bulk, TCGdex, Foolio), valuation and sort-by-price, card detail pricing UI, and nearby store discovery via home zip and OSM geo clients. Co-authored-by: Cursor <cursoragent@cursor.com>
40 lines
1.3 KiB
Markdown
40 lines
1.3 KiB
Markdown
---
|
|
convoy: pricing-online-local
|
|
brief_number: 11
|
|
depends_on: [10]
|
|
recommended_model: composer-2.5
|
|
model_tier: standard
|
|
files:
|
|
- pages/api/stores/nearby.js
|
|
- lib/rate-limit.js
|
|
- test/api/stores-nearby.test.js
|
|
---
|
|
|
|
# Brief 11: Stores nearby API
|
|
|
|
## Goal (1 sentence)
|
|
|
|
Ship `GET /api/stores/nearby` with geocode + Overpass lookup, caching, and per-user refresh rate limit.
|
|
|
|
## Files in scope (do not edit anything else)
|
|
- `pages/api/stores/nearby.js`
|
|
- `lib/rate-limit.js`
|
|
- `test/api/stores-nearby.test.js`
|
|
|
|
## Conventions to follow
|
|
- **Auth required** (`getUserFromRequest` → 401). Zip from user's saved `home_zip` only — ignore arbitrary `zip` query param (security planning decision A).
|
|
- Add `stores` limiter: 1/hour/user; IP backstop for burst abuse.
|
|
- Respect `PRICING_LOCAL_ENABLED` — return 503 when `false`.
|
|
- Overpass fixed-template query only (see Brief 10).
|
|
|
|
## Acceptance criteria
|
|
- [ ] Endpoint returns store list for authenticated user with saved zip
|
|
- [ ] 401 without Bearer token
|
|
- [ ] Second call within 7 days serves from `geo_stores_cache`
|
|
- [ ] Rate limit returns 429 with `Retry-After`
|
|
- [ ] Tests pass
|
|
- [ ] No scope expansion
|
|
|
|
## Rationale (≤3 sentences)
|
|
|
|
Phase 2 API surface from convoy spec. Auth-gated zip prevents geocode relay abuse. Rate limiting protects Overpass.
|