Repository navigation
Conversation
Signed-off-by: Nirmal Khedkar <nirmalhk7@gmail.com>
nirmalhk7
marked this pull request as ready for review
October 26, 2026 21:57
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
|
|
||
| // Update coordinates for a user | ||
| router.post('/:id', locationController.setLocation); | ||
| router.post('/:id', locationController.requireOwner, locationController.setLocation); |
| // Update coordinates for a user | ||
| router.post('/:id', locationController.setLocation); | ||
| router.post('/:id', locationController.requireOwner, locationController.setLocation); | ||
| router.get('/:id', locationController.requireOwner, locationController.getLocation); |
| const express = require('express'); | ||
| const auth = require('../middleware/authMiddleware'); | ||
| const app = express(); | ||
| app.use(express.json(), auth); |
Signed-off-by: Nirmal Khedkar <nirmalhk7@gmail.com>
Limit owner reads and writes to 1,000 requests per minute. Keep a guard before verification and an account budget after it so adding an API key cannot bypass an exhausted account limit. Bound the local storage-check server too. Preserve location privacy, discovery and pagination, and retain current main's retry-safe messages. Signed-off-by: Nirmal Khedkar <nirmalhk7@gmail.com>
Move input checks and saved-receipt replay into focused helpers. Extract verification database setup and worker cleanup without changing request results, receipt keys or lifecycle ordering. Add a regression for a missing stored assistant reply: replay must return 410 without repeating delivery or returning a partial success. Signed-off-by: Nirmal Khedkar <nirmalhk7@gmail.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What the change is
Adds working location saves, owner reloads, and nearby-location discovery.
Why it is needed
Saving currently reports success without writing to DynamoDB, and discovery always returns an empty list. Members cannot reliably save or find locations.
How the change works
An account token lets members save and reload their own location. Every save requires an explicit sharing choice:
privacy: trueshares exact coordinates;falsekeeps them private. Discovery filters by distance in kilometres and optional location type, checks at most 100 records per page, and returns only location fields. Encrypted continuation tokens support later pages without exposing private account IDs.Locations stay in a separate local table so existing user and federation exports cannot expose this new data. Legacy coordinates are not automatically published. Existing account-security gaps remain separate work.
Where it is involved
Agrinet's
/api/locationroutes, location controller, newbackend/models/location.js, integration workflow, and API/deployment guide. Operators must provision theLocationstable with string keyidand backend read/write/scan permissions. This PR has no UI changes.Verified locally: 37 Node tests, 46 Jest tests, and real DynamoDB persistence/privacy/pagination checks passed. Hosted workflows await maintainer approval.