mirror of
https://github.com/koala73/worldmonitor.git
synced 2026-04-25 17:14:57 +02:00
6e401ad02f
* feat(supply-chain): Sprint 0 — chokepoint registry, HS2 sectors, war_risk_tier
- src/config/chokepoint-registry.ts: single source of truth for all 13
canonical chokepoints with displayName, relayName, portwatchName,
corridorRiskName, baselineId, shockModelSupported, routeIds, lat/lon
- src/config/hs2-sectors.ts: static dictionary for all 99 HS2 chapters
with category, shockModelSupported (true only for HS27), cargoType
- server/worldmonitor/supply-chain/v1/_chokepoint-ids.ts: migrated to
derive CANONICAL_CHOKEPOINTS from chokepoint-registry; no data duplication
- src/config/geo.ts + src/types/index.ts: added chokepointId field to
StrategicWaterway interface and all 13 STRATEGIC_WATERWAYS entries
- src/components/MapPopup.ts: switched chokepoint matching from fragile
name.toLowerCase() to direct chokepointId === id comparison
- server/worldmonitor/intelligence/v1/_shock-compute.ts: migrated from old
IDs (hormuz/malacca/babelm) to canonical IDs (hormuz_strait/malacca_strait/
bab_el_mandeb); same for CHOKEPOINT_LNG_EXPOSURE
- proto/worldmonitor/supply_chain/v1/supply_chain_data.proto: added
WarRiskTier enum + war_risk_tier field (field 16) on ChokepointInfo
- get-chokepoint-status.ts: populates warRiskTier from ChokepointConfig.threatLevel
via new threatLevelToWarRiskTier() helper (FREE field, no PRO gate)
* feat(supply-chain): Sprint 1 — country chokepoint exposure index + sector ring
S1.1: scripts/shared/country-port-clusters.json
~130 country → {nearestRouteIds, coastSide} mappings derived from trade route
waypoints; covers all 6 seeded Comtrade reporters plus major trading nations.
S1.2: scripts/seed-hs2-chokepoint-exposure.mjs
Daily cron seeder. Pure computation — reads country-port-clusters.json,
scores each country against CHOKEPOINT_REGISTRY route overlap, writes
supply-chain:exposure:{iso2}:{hs2}:v1 keys + seed-meta (24h TTL).
S1.3: RPC get-country-chokepoint-index (PRO-gated, request-varying)
- proto: GetCountryChokepointIndexRequest/Response + ChokepointExposureEntry
- handler: isCallerPremium gate; cachedFetchJson 24h; on-demand for any iso2
- cache-keys.ts: CHOKEPOINT_EXPOSURE_KEY(iso2, hs2) constant
- health.js: chokepointExposure SEED_META entry (48h threshold)
- gateway.ts: slow-browser cache tier
- service client: fetchCountryChokepointIndex() exported
S1.4: Chokepoint popup HS2 sector ring chart (PRO-gated)
Static trade-sector breakdown (IEA/UNCTAD estimates) per 9 major chokepoints.
SVG donut ring + legend shown for PRO users; blurred lockout + gate-hit
analytics for free users. Wired into renderWaterwayPopup().
🤖 Generated with Claude Sonnet 4.6 via Claude Code (https://claude.com/claude-code) + Compound Engineering v2.49.0
Co-Authored-By: Claude Sonnet 4.6 (200K context) <noreply@anthropic.com>
* fix(tests): update energy-shock-v2 tests to use canonical chokepoint IDs
CHOKEPOINT_EXPOSURE and CHOKEPOINT_LNG_EXPOSURE keys were migrated from
short IDs (hormuz, malacca, babelm) to canonical registry IDs
(hormuz_strait, malacca_strait, bab_el_mandeb) in Sprint 0.
Test fixtures were not updated at the time; fix them now.
* fix(tests): update energy-shock-seed chokepoint ID to canonical form
VALID_CHOKEPOINTS changed to canonical IDs in Sprint 0; the seed test
that checks valid IDs was not updated alongside it.
* fix(cache-keys): reword JSDoc comment to avoid confusing bootstrap test regex
The comment "NOT in BOOTSTRAP_CACHE_KEYS" caused the bootstrap.test.mjs
regex to match the comment rather than the actual export declaration,
resulting in 0 entries found. Rephrase to "excluded from bootstrap".
* fix(supply-chain): address P1 review findings for chokepoint exposure index
- Add get-country-chokepoint-index to PREMIUM_RPC_PATHS (CDN bypass)
- Validate iso2/hs2 params before Redis key construction (cache injection)
- Fix seeder TTL to 172800s (2× interval) and extend TTL on skipped lock
- Fix CHOKEPOINT_EXPOSURE_SEED_META_KEY to match seeder write key
- Render placeholder sectors behind blur gate (DOM data leakage)
- Document get-country-chokepoint-index in widget agent system prompts
* fix(lint): resolve Biome CI failures
- Add biome.json overrides to silence noVar in HTML inline scripts,
disable linting for public/ vendor/build artifacts and pro-test/
- Remove duplicate NG and MW keys from country-port-clusters.json
- Use import attributes (with) instead of deprecated assert syntax
* fix(build): drop JSON import attribute — esbuild rejects `with` syntax
---------
Co-authored-by: Claude Sonnet 4.6 (200K context) <noreply@anthropic.com>
36 lines
2.0 KiB
Markdown
36 lines
2.0 KiB
Markdown
---
|
|
status: pending
|
|
priority: p1
|
|
issue_id: "108"
|
|
tags: [code-review, security, pro-gate, dom, data-leakage]
|
|
---
|
|
|
|
# Blurred sector ring passes real sector data through renderSectorRing — DOM readable despite CSS blur
|
|
|
|
## Problem Statement
|
|
`src/components/MapPopup.ts` — when `!isPro`, the locked-state render path calls `renderSectorRing(sectors)` with real `CHOKEPOINT_HS2_SECTORS` data (actual share percentages and labels). The SVG is then blurred via `filter:blur(4px)`. CSS blur is a visual effect only; the SVG `stroke` colors derived from real data, the legend text (`Energy 78%`, `Chemicals 9%`, etc.), and all percentage values are fully readable in the DOM via DevTools. A free user can inspect the sector breakdown by reading the HTML source.
|
|
|
|
## Findings
|
|
`MapPopup.ts` lines 1215-1220 — `renderSectorRing(sectors)` called with full real data for the blurred lockout div. The actual sector shares and labels (e.g. `Energy 78%`) are present verbatim in the rendered SVG DOM, accessible to any user who opens browser DevTools.
|
|
|
|
## Proposed Solutions
|
|
|
|
### Option A: Replace real data with placeholder data in non-pro path (Recommended)
|
|
- For the non-pro path, pass zeroed/placeholder data to `renderSectorRing` (e.g. all shares = 20, all labels = '?')
|
|
- The blur overlay still conveys the existence of a chart without leaking the actual distribution
|
|
- Effort: Small | Risk: Low
|
|
|
|
### Option B: Omit renderSectorRing entirely in non-pro path
|
|
- Render only the lock icon overlay without calling `renderSectorRing` at all
|
|
- Simpler but loses the visual affordance that a chart exists behind the paywall
|
|
- Effort: Small | Risk: Low
|
|
|
|
## Acceptance Criteria
|
|
- [ ] DOM inspection of the non-pro waterway popup shows no real sector share percentages
|
|
- [ ] DOM inspection shows no real sector label names (e.g. "Energy", "Chemicals") with real values
|
|
- [ ] Pro users continue to see the full real sector ring with correct data
|
|
- [ ] Visual blur effect is preserved for non-pro users
|
|
|
|
## Resources
|
|
- PR: #2870
|