Initial Deploy

Dockerfile

@@ -0,0 +1,17 @@
+FROM python:3.12-slim
+
+WORKDIR /app
+
+RUN apt-get update && apt-get install -y --no-install-recommends \
+    build-essential \
+    && rm -rf /var/lib/apt/lists/*
+
+COPY requirements.txt .
+RUN pip install --no-cache-dir -r requirements.txt
+
+COPY app ./app
+COPY alembic ./alembic
+
+EXPOSE 8000
+
+CMD ["uvicorn", "app.main:app", "--host", "0.0.0.0", "--port", "8000"]

README.md

@@ -1,11 +1,34 @@
 ---
-title: Rideshare Api
-emoji: 🌖
-colorFrom: yellow
-colorTo: red
+title: RideShare API
+emoji: 🚕
+colorFrom: indigo
+colorTo: emerald
 sdk: docker
+app_port: 8000
 pinned: false
 license: apache-2.0
+short_description: FastAPI backend for the RideShare demo (rider, driver, payments).
 ---
 
-Check out the configuration reference at https://huggingface.co/docs/hub/spaces-config-reference
+# RideShare API
+
+FastAPI backend powering the RideShare Android demo. PostgreSQL/PostGIS data lives in Supabase; this service exposes the REST + WebSocket surface the mobile app consumes.
+
+## Health check
+
+```
+GET /health → {"status":"ok"}
+```
+
+## Required secrets (set in HF Space → Settings → Secrets)
+
+| Key | Source |
+|---|---|
+| `DATABASE_URL` | Supabase Transaction Pooler URI with `postgresql+asyncpg://` prefix |
+| `SUPABASE_URL` | Supabase project URL |
+| `SUPABASE_JWT_SECRET` | Supabase → Settings → API → JWT Settings → JWT Secret |
+| `GOOGLE_MAPS_KEY` | Google Cloud project key with Directions API enabled |
+| `STRIPE_SECRET_KEY` | Stripe dashboard (test mode) |
+| `STRIPE_PUBLISHABLE_KEY` | Stripe dashboard (test mode) |
+
+App reads them at runtime via `pydantic-settings`. Missing required vars will crash on boot — check the build logs.

app/api/v1/drivers.py

@@ -0,0 +1,41 @@
+import json
+from fastapi import APIRouter, Depends, HTTPException
+from app.deps import get_current_user
+from app.models.profile import Profile, UserRole
+from app.schemas.drivers import LocationIn
+from app.services.redis_client import r
+
+router = APIRouter()
+
+
+def _require_driver(user: Profile) -> None:
+    if user.role != UserRole.driver:
+        raise HTTPException(403, 'Driver role required')
+
+
+@router.post('/online')
+async def go_online(loc: LocationIn, user: Profile = Depends(get_current_user)):
+    _require_driver(user)
+    await r.geoadd('drivers:online', (loc.lng, loc.lat, str(user.id)))
+    await r.hset(f'driver:{user.id}', mapping={'lat': loc.lat, 'lng': loc.lng})
+    return {'ok': True}
+
+
+@router.post('/offline')
+async def go_offline(user: Profile = Depends(get_current_user)):
+    _require_driver(user)
+    await r.zrem('drivers:online', str(user.id))
+    await r.delete(f'driver:{user.id}')
+    return {'ok': True}
+
+
+@router.post('/location')
+async def update_location(loc: LocationIn, user: Profile = Depends(get_current_user)):
+    _require_driver(user)
+    await r.geoadd('drivers:online', (loc.lng, loc.lat, str(user.id)))
+    if loc.ride_id is not None:
+        await r.publish(
+            f'ride:{loc.ride_id}:driver_location',
+            json.dumps({'lat': loc.lat, 'lng': loc.lng}),
+        )
+    return {'ok': True}

app/api/v1/payments.py

@@ -0,0 +1,118 @@
+import logging
+from datetime import UTC, datetime
+
+import stripe
+from fastapi import APIRouter, Depends, HTTPException
+from sqlalchemy.ext.asyncio import AsyncSession
+
+from app.core.config import settings
+from app.core.database import get_db
+from app.deps import get_current_user
+from app.models.profile import Profile
+from app.models.ride import Ride, RideStatus
+from app.schemas.payments import (
+    ConfirmRidePaymentIn,
+    InitRidePaymentIn,
+    InitRidePaymentOut,
+    TestChargeIn,
+    TestChargeOut,
+)
+from app.services.stripe_service import (
+    create_ephemeral_key,
+    create_payment_intent,
+    ensure_customer,
+)
+from app.websockets.manager import manager
+
+logger = logging.getLogger(__name__)
+router = APIRouter()
+
+
+@router.post('/init-ride-payment', response_model=InitRidePaymentOut)
+async def init_ride_payment(
+    data: InitRidePaymentIn,
+    user: Profile = Depends(get_current_user),
+    db: AsyncSession = Depends(get_db),
+):
+    ride = await db.get(Ride, data.ride_id)
+    if ride is None:
+        raise HTTPException(404, 'Ride not found')
+    if ride.rider_id != user.id:
+        raise HTTPException(403, 'Only the rider can pay for this ride')
+    if ride.fare is None or ride.fare <= 0:
+        raise HTTPException(400, 'Ride has no fare')
+
+    try:
+        customer_id = ensure_customer(user)
+        intent = create_payment_intent(
+            amount=ride.fare, customer_id=customer_id, ride_id=str(ride.id)
+        )
+        ephemeral = create_ephemeral_key(customer_id)
+    except stripe.StripeError as exc:
+        logger.exception('Stripe error initialising ride payment')
+        raise HTTPException(502, f'Stripe error: {exc.user_message or str(exc)}') from exc
+
+    ride.payment_intent_id = intent['id']
+    await db.commit()
+
+    return InitRidePaymentOut(
+        payment_intent_id=intent['id'],
+        client_secret=intent['client_secret'],
+        ephemeral_key=ephemeral,
+        customer_id=customer_id,
+        publishable_key=settings.STRIPE_PUBLISHABLE_KEY,
+    )
+
+
+@router.post('/confirm-ride-payment')
+async def confirm_ride_payment(
+    data: ConfirmRidePaymentIn,
+    user: Profile = Depends(get_current_user),
+    db: AsyncSession = Depends(get_db),
+):
+    ride = await db.get(Ride, data.ride_id)
+    if ride is None:
+        raise HTTPException(404, 'Ride not found')
+    if ride.rider_id != user.id:
+        raise HTTPException(403, 'Only the rider can confirm this payment')
+
+    ride.status = RideStatus.completed
+    ride.ended_at = datetime.now(UTC)
+    await db.commit()
+
+    receipt = {
+        'type': 'ride_paid',
+        'ride_id': str(ride.id),
+        'fare': ride.fare,
+    }
+    await manager.send(str(ride.rider_id), receipt)
+    if ride.driver_id is not None:
+        await manager.send(str(ride.driver_id), receipt)
+
+    return {'ok': True}
+
+
+@router.post('/test-charge', response_model=TestChargeOut)
+async def test_charge(
+    data: TestChargeIn,
+    user: Profile = Depends(get_current_user),
+    db: AsyncSession = Depends(get_db),
+):
+    if data.amount <= 0:
+        raise HTTPException(400, 'Amount must be greater than zero')
+
+    try:
+        customer_id = ensure_customer(user)
+        intent = stripe.PaymentIntent.create(
+            amount=int(data.amount * 100),
+            currency=data.currency,
+            customer=customer_id,
+            automatic_payment_methods={'enabled': True, 'allow_redirects': 'never'},
+            metadata={'profile_id': str(user.id), 'kind': 'test_charge'},
+        )
+    except stripe.StripeError as exc:
+        logger.exception('Stripe error creating test charge')
+        raise HTTPException(502, f'Stripe error: {exc.user_message or str(exc)}') from exc
+
+    await db.commit()
+    return TestChargeOut(payment_intent_id=intent['id'], client_secret=intent['client_secret'])

app/api/v1/rides.py

@@ -0,0 +1,79 @@
+from datetime import UTC, datetime
+from fastapi import APIRouter, Depends, HTTPException
+from geoalchemy2 import WKTElement
+from sqlalchemy.exc import SQLAlchemyError
+from sqlalchemy.ext.asyncio import AsyncSession
+
+from app.core.database import get_db
+from app.deps import get_current_user
+from app.models.ride import Ride
+from app.services.maps import google_directions
+from app.services.matching import find_nearest_driver
+from app.services.pricing import estimate_fare
+from app.schemas.rides import EstimateIn, EstimateOut, RideRequestIn, RideOut
+
+router = APIRouter()
+
+
+@router.post('/estimate', response_model=EstimateOut)
+async def estimate(data: EstimateIn):
+    try:
+        distance_km, duration_min = await google_directions(data.pickup, data.dropoff)
+    except Exception as exc:
+        raise HTTPException(400, 'Unable to estimate this route') from exc
+
+    return EstimateOut(
+        distance_km=distance_km,
+        duration_min=duration_min,
+        fare=estimate_fare(distance_km, duration_min, data.vehicle_type),
+        vehicle_type=data.vehicle_type,
+    )
+
+
+@router.post('/request', response_model=RideOut)
+async def request_ride(
+    data: RideRequestIn,
+    user=Depends(get_current_user),
+    db: AsyncSession = Depends(get_db),
+):
+    ride = Ride(
+        rider_id=user.id,
+        pickup=WKTElement(f'POINT({data.pickup.lng} {data.pickup.lat})', srid=4326),
+        dropoff=WKTElement(f'POINT({data.dropoff.lng} {data.dropoff.lat})', srid=4326),
+        pickup_address=data.pickup_address,
+        dropoff_address=data.dropoff_address,
+        fare=data.fare,
+        distance_km=data.distance_km,
+        duration_min=data.duration_min,
+        vehicle_type=data.vehicle_type,
+    )
+    db.add(ride)
+    try:
+        await db.commit()
+        await db.refresh(ride)
+    except SQLAlchemyError as exc:
+        await db.rollback()
+        raise HTTPException(400, 'Unable to save ride request') from exc
+
+    try:
+        await find_nearest_driver(ride.id, data.pickup)
+    except HTTPException as exc:
+        if exc.status_code != 404:
+            raise
+    except Exception:
+        # Ride creation should still succeed if live driver matching is temporarily unavailable.
+        pass
+
+    return RideOut(
+        id=ride.id,
+        rider_id=ride.rider_id,
+        driver_id=ride.driver_id,
+        status=ride.status,
+        fare=ride.fare,
+        distance_km=ride.distance_km,
+        duration_min=ride.duration_min,
+        pickup_address=ride.pickup_address,
+        dropoff_address=ride.dropoff_address,
+        vehicle_type=ride.vehicle_type,
+        requested_at=ride.requested_at or datetime.now(UTC),
+    )

app/api/v1/users.py

@@ -0,0 +1,20 @@
+from fastapi import APIRouter, Depends
+from sqlalchemy.ext.asyncio import AsyncSession
+
+from app.core.database import get_db
+from app.deps import get_current_user
+from app.models.profile import Profile
+from app.schemas.users import PushTokenIn
+
+router = APIRouter()
+
+
+@router.post('/push-token')
+async def save_push_token(
+    data: PushTokenIn,
+    user: Profile = Depends(get_current_user),
+    db: AsyncSession = Depends(get_db),
+):
+    user.push_token = data.token
+    await db.commit()
+    return {'ok': True}

app/core/config.py

@@ -0,0 +1,20 @@
+from pydantic_settings import BaseSettings
+
+
+class Settings(BaseSettings):
+    DATABASE_URL: str
+    REDIS_URL: str = 'redis://localhost:6379/0'
+
+    SUPABASE_URL: str
+    SUPABASE_JWT_SECRET: str
+    SUPABASE_JWT_ALGORITHM: str = 'HS256'
+
+    GOOGLE_MAPS_KEY: str
+    STRIPE_SECRET_KEY: str
+    STRIPE_PUBLISHABLE_KEY: str
+
+    class Config:
+        env_file = '.env'
+
+
+settings = Settings()

app/core/database.py

@@ -0,0 +1,11 @@
+from sqlalchemy.ext.asyncio import create_async_engine, AsyncSession
+from sqlalchemy.orm import sessionmaker, declarative_base
+from app.core.config import settings
+ 
+engine = create_async_engine(settings.DATABASE_URL, echo=False)
+AsyncSessionLocal = sessionmaker(engine, class_=AsyncSession, expire_on_commit=False)
+Base = declarative_base()
+ 
+async def get_db():
+    async with AsyncSessionLocal() as session:
+        yield session

app/deps.py

@@ -0,0 +1,77 @@
+import uuid
+from fastapi import Depends, HTTPException
+from fastapi.security import OAuth2PasswordBearer
+from jose import jwt, JWTError
+import requests
+from sqlalchemy.exc import SQLAlchemyError
+from app.core.config import settings
+from app.core.database import get_db
+from app.models.profile import Profile, UserRole
+
+oauth2 = OAuth2PasswordBearer(tokenUrl='supabase')
+
+
+def verify_supabase_token(token: str = Depends(oauth2)) -> dict:
+    try:
+        header = jwt.get_unverified_header(token)
+        algorithm = header.get('alg')
+        if not algorithm:
+            raise JWTError('Missing token algorithm')
+
+        if algorithm == settings.SUPABASE_JWT_ALGORITHM:
+            payload = jwt.decode(
+                token,
+                settings.SUPABASE_JWT_SECRET,
+                algorithms=[settings.SUPABASE_JWT_ALGORITHM],
+                audience='authenticated',
+            )
+        else:
+            jwks_url = f'{settings.SUPABASE_URL.rstrip("/")}/auth/v1/.well-known/jwks.json'
+            response = requests.get(jwks_url, timeout=5)
+            response.raise_for_status()
+            keys = response.json().get('keys', [])
+            key = next((item for item in keys if item.get('kid') == header.get('kid')), None)
+            if not key:
+                raise JWTError('No matching JWKS key')
+            payload = jwt.decode(
+                token,
+                key,
+                algorithms=[algorithm],
+                audience='authenticated',
+                issuer=f'{settings.SUPABASE_URL.rstrip("/")}/auth/v1',
+            )
+        uuid.UUID(payload['sub'])
+        return payload
+    except (JWTError, KeyError, ValueError, requests.RequestException):
+        raise HTTPException(401, 'Invalid token')
+
+
+async def get_current_user(payload: dict = Depends(verify_supabase_token), db=Depends(get_db)) -> Profile:
+    user_id = uuid.UUID(payload['sub'])
+
+    try:
+        profile = await db.get(Profile, user_id)
+    except SQLAlchemyError as exc:
+        raise HTTPException(503, 'Unable to load user profile') from exc
+
+    if not profile:
+        metadata = payload.get('user_metadata') or {}
+        try:
+            role = UserRole(metadata.get('role'))
+        except ValueError:
+            role = UserRole.rider
+
+        profile = Profile(
+            id=user_id,
+            full_name=metadata.get('full_name') or payload.get('email') or 'Rider',
+            role=role,
+        )
+        db.add(profile)
+        try:
+            await db.commit()
+            await db.refresh(profile)
+        except SQLAlchemyError as exc:
+            await db.rollback()
+            raise HTTPException(503, 'Unable to create user profile') from exc
+
+    return profile

app/main.py

@@ -0,0 +1,24 @@
+from fastapi import FastAPI
+from fastapi.middleware.cors import CORSMiddleware
+from app.api.v1 import rides, drivers, payments, users
+from app.websockets import routes as ws_routes
+
+app = FastAPI(title='RideShare API', version='1.0.0')
+
+app.add_middleware(
+    CORSMiddleware,
+    allow_origins=['*'],
+    allow_methods=['*'],
+    allow_headers=['*'],
+)
+
+app.include_router(rides.router, prefix='/api/v1/rides', tags=['rides'])
+app.include_router(drivers.router, prefix='/api/v1/drivers', tags=['drivers'])
+app.include_router(payments.router, prefix='/api/v1/payments', tags=['payments'])
+app.include_router(users.router, prefix='/api/v1/users', tags=['users'])
+app.include_router(ws_routes.router)
+
+
+@app.get('/health')
+async def health():
+    return {'status': 'ok'}

app/models/driver.py

@@ -0,0 +1,16 @@
+from sqlalchemy import Column, ForeignKey, Boolean, Float, String
+from sqlalchemy.dialects.postgresql import UUID
+from geoalchemy2 import Geography
+from app.core.database import Base
+
+
+class Driver(Base):
+    __tablename__ = 'drivers'
+    user_id = Column(UUID(as_uuid=True), ForeignKey('profiles.id', ondelete='CASCADE'), primary_key=True)
+    license_no = Column(String, nullable=False)
+    vehicle_make = Column(String)
+    vehicle_model = Column(String)
+    vehicle_plate = Column(String)
+    is_online = Column(Boolean, default=False)
+    rating = Column(Float, default=5.0)
+    current_location = Column(Geography('POINT', srid=4326))

app/models/profile.py

@@ -0,0 +1,19 @@
+import enum
+from sqlalchemy import Column, String, DateTime, Enum, func
+from sqlalchemy.dialects.postgresql import UUID
+from app.core.database import Base
+
+
+class UserRole(str, enum.Enum):
+    rider = 'rider'
+    driver = 'driver'
+
+
+class Profile(Base):
+    __tablename__ = 'profiles'
+    id = Column(UUID(as_uuid=True), primary_key=True)
+    full_name = Column(String, nullable=False)
+    role = Column(Enum(UserRole, name='user_role'), nullable=False)
+    stripe_customer_id = Column(String, nullable=True)
+    push_token = Column(String, nullable=True)
+    created_at = Column(DateTime(timezone=True), server_default=func.now())

app/models/ride.py

@@ -0,0 +1,35 @@
+import uuid
+import enum
+from sqlalchemy import Column, ForeignKey, Float, String, DateTime, Enum, func
+from sqlalchemy.dialects.postgresql import UUID
+from geoalchemy2 import Geography
+from app.core.database import Base
+
+
+class RideStatus(str, enum.Enum):
+    searching = 'searching'
+    accepted = 'accepted'
+    arriving = 'arriving'
+    in_progress = 'in_progress'
+    completed = 'completed'
+    cancelled = 'cancelled'
+
+
+class Ride(Base):
+    __tablename__ = 'rides'
+    id = Column(UUID(as_uuid=True), primary_key=True, default=uuid.uuid4)
+    rider_id = Column(UUID(as_uuid=True), ForeignKey('profiles.id', ondelete='CASCADE'), nullable=False)
+    driver_id = Column(UUID(as_uuid=True), ForeignKey('profiles.id', ondelete='SET NULL'), nullable=True)
+    pickup = Column(Geography('POINT', srid=4326))
+    dropoff = Column(Geography('POINT', srid=4326))
+    pickup_address = Column(String)
+    dropoff_address = Column(String)
+    status = Column(Enum(RideStatus, name='ride_status'), default=RideStatus.searching, nullable=False)
+    fare = Column(Float)
+    distance_km = Column(Float)
+    duration_min = Column(Float)
+    payment_intent_id = Column(String, nullable=True)
+    vehicle_type = Column(String, default='car')
+    requested_at = Column(DateTime(timezone=True), server_default=func.now())
+    started_at = Column(DateTime(timezone=True), nullable=True)
+    ended_at = Column(DateTime(timezone=True), nullable=True)

app/schemas/drivers.py

@@ -0,0 +1,8 @@
+import uuid
+from pydantic import BaseModel
+
+
+class LocationIn(BaseModel):
+    lat: float
+    lng: float
+    ride_id: uuid.UUID | None = None

app/schemas/payments.py

@@ -0,0 +1,28 @@
+import uuid
+from pydantic import BaseModel
+
+
+class InitRidePaymentIn(BaseModel):
+    ride_id: uuid.UUID
+
+
+class InitRidePaymentOut(BaseModel):
+    payment_intent_id: str
+    client_secret: str
+    ephemeral_key: str
+    customer_id: str
+    publishable_key: str
+
+
+class ConfirmRidePaymentIn(BaseModel):
+    ride_id: uuid.UUID
+
+
+class TestChargeIn(BaseModel):
+    amount: float
+    currency: str = 'pkr'
+
+
+class TestChargeOut(BaseModel):
+    payment_intent_id: str
+    client_secret: str

app/schemas/rides.py

@@ -0,0 +1,49 @@
+import uuid
+from datetime import datetime
+from pydantic import BaseModel, ConfigDict
+from app.models.ride import RideStatus
+
+
+class Coordinate(BaseModel):
+    lat: float
+    lng: float
+
+
+class EstimateIn(BaseModel):
+    pickup: Coordinate
+    dropoff: Coordinate
+    vehicle_type: str = 'car'
+
+
+class EstimateOut(BaseModel):
+    distance_km: float
+    duration_min: float
+    fare: float
+    vehicle_type: str = 'car'
+
+
+class RideRequestIn(BaseModel):
+    pickup: Coordinate
+    dropoff: Coordinate
+    pickup_address: str
+    dropoff_address: str
+    fare: float
+    distance_km: float
+    duration_min: float
+    vehicle_type: str = 'car'
+
+
+class RideOut(BaseModel):
+    model_config = ConfigDict(from_attributes=True)
+
+    id: uuid.UUID
+    rider_id: uuid.UUID
+    driver_id: uuid.UUID | None = None
+    status: RideStatus
+    fare: float | None = None
+    distance_km: float | None = None
+    duration_min: float | None = None
+    pickup_address: str | None = None
+    dropoff_address: str | None = None
+    vehicle_type: str | None = None
+    requested_at: datetime

app/schemas/users.py

@@ -0,0 +1,5 @@
+from pydantic import BaseModel
+
+
+class PushTokenIn(BaseModel):
+    token: str