API endpoints

Routes are defined in config/routes.oas.json. Handlers are TypeScript modules under modules/. Every route uses the rate-limit-googlesearch policy (60 requests per minute per IP) and the anything-goes CORS policy.

Search and map data

GET /api/google-search

Google Places Text Search for food trucks (modules/search.ts). Uses GOOGLE_MAPS_API_KEY on the server.

GET /api/trucks

Lists trucks whose lastKnownLocation is inside a bounding box (modules/trucks.ts, Firestore).

  • Query (required): ne_lat, ne_lng, sw_lat, sw_lng.

  • Policies: rate limit, upstream-firebase-admin-auth-inbound.

  • Response: { "trucks": [ …​ ] } with id, name, status, lastUpdated, location.

Truck operations

POST /api/checkin

Records a check-in and updates the truck document in Firestore (modules/checkin.ts).

  • Body: truckId, status (open or closed), location (latitude, longitude).

  • Policies: rate limit, upstream-firebase-admin-auth-inbound, zuplo-jwt-auth.

Owner sign-in (Google)

GET /api/auth/login

Redirects to Google OAuth with the business.manage scope (handleLogin).

POST /api/auth/google/callback

Exchanges the OAuth code and returns an HS256 JWT valid for 30 days (handleCallback).

GET /api/business-info

Lists the signed-in owner’s Google Business Profile accounts (handleBusinessInfo). Needs zuplo-jwt-auth.

Policies

Policy Purpose

rate-limit-googlesearch

60 requests per minute per IP, on every route.

upstream-firebase-admin-auth-inbound

Adds a Firebase Admin token for Firestore calls (SERVICE_ACCOUNT_JSON).

zuplo-jwt-auth

Checks the HS256 JWT, issuer and audience food-truck-api (JWT_SECRET).

custom-cors

Localhost-only CORS policy. Defined in config/policies.json but no route uses it.

Variable names: Environment variables.