v0.6.3: hide the paid city lots from users without a ParkSmarter account

The green lots are the map's only paid category ("City lots - Paid hourly or
permit"); paying for them goes through ParkSmarter, so they are no use to
someone browsing without an account. Every other category is free street
parking with a posted time limit and needs nothing.

Gated by category rather than by an id list. Two lots were named (off Oak St
and off N 3rd Ave) and then the beach ones, which together is every green lot
on the map — and an id list would silently break the next time the map is
regenerated from a new PDF, since ids are positional.

- Paid lots are filtered out of the overlay when signed out, so they are
  neither drawn nor tappable.
- "Park here" still detects them, so standing in one explains that it needs an
  account instead of reporting no parking nearby.
- The area screen guards too, in case one is reached with a stale nav param.
- Server carries an optional per-area requiresAccount override for a lot that
  turns out to take payment another way. Null means "use the category
  default", so an unset value can't be confused with an explicit false.

The new column needs a real migration: CREATE TABLE IF NOT EXISTS does not add
a column to a table that already exists, so an already-deployed server would
have kept the old schema. Covered by a test that builds the pre-migration
table and then opens it.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

server/src/app.ts

@@ -197,6 +197,9 @@ export async function buildApp(opts: BuildOptions) {
           color: String(raw.color ?? '#888888'),
           shape: g.type === 'Polygon' ? 'polygon' : 'line',
           geometry: g,
+          // Absent means "let the client decide by category"; only an explicit
+          // boolean overrides a specific lot.
+          requiresAccount: typeof raw.requiresAccount === 'boolean' ? raw.requiresAccount : null,
         });
       }
       return { replaced: db.replaceAreas(areas), total: db.areaCount() };

server/src/db.ts

@@ -33,6 +33,12 @@ export interface ParkingArea {
   shape: 'line' | 'polygon';
   /** GeoJSON geometry (LineString or Polygon), lon/lat. */
   geometry: unknown;
+  /**
+   * Overrides the client's by-category default (paid city lots need a
+   * ParkSmarter account, free time-limited streets don't). Null means "use the
+   * default"; set it only to correct a specific lot.
+   */
+  requiresAccount: boolean | null;
 }
 
 /**
@@ -141,6 +147,16 @@ export class LabelDb {
         updated_at  INTEGER NOT NULL
       );
     `);
+
+    // CREATE TABLE IF NOT EXISTS won't add a column to a table that already
+    // exists, so added columns need an explicit migration.
+    this.addColumnIfMissing('parking_areas', 'requires_account', 'INTEGER');
+  }
+
+  private addColumnIfMissing(table: string, column: string, type: string): void {
+    const cols = this.db.prepare(`PRAGMA table_info(${table})`).all() as Array<{ name: string }>;
+    if (cols.some((c) => c.name === column)) return;
+    this.db.exec(`ALTER TABLE ${table} ADD COLUMN ${column} ${type}`);
   }
 
   /* ------------------------------------------------ city parking-map areas */
@@ -159,6 +175,8 @@ export class LabelDb {
       color: r.color,
       shape: r.shape as 'line' | 'polygon',
       geometry: JSON.parse(r.geometry),
+      // SQLite has no boolean; null stays null so the client applies its default.
+      requiresAccount: r.requires_account == null ? null : !!r.requires_account,
     }));
   }
 
@@ -182,13 +200,20 @@ export class LabelDb {
   replaceAreas(areas: ParkingArea[]): number {
     const now = Date.now();
     const insert = this.db.prepare(
-      `INSERT INTO parking_areas (id, kind, name, label, legend, hours, color, shape, geometry, updated_at)
-       VALUES (@id, @kind, @name, @label, @legend, @hours, @color, @shape, @geometry, @updatedAt)`,
+      `INSERT INTO parking_areas
+         (id, kind, name, label, legend, hours, color, shape, geometry, requires_account, updated_at)
+       VALUES
+         (@id, @kind, @name, @label, @legend, @hours, @color, @shape, @geometry, @requiresAccount, @updatedAt)`,
     );
     this.db.transaction((items: ParkingArea[]) => {
       this.db.prepare('DELETE FROM parking_areas').run();
       for (const a of items) {
-        insert.run({ ...a, geometry: JSON.stringify(a.geometry), updatedAt: now });
+        insert.run({
+          ...a,
+          geometry: JSON.stringify(a.geometry),
+          requiresAccount: a.requiresAccount == null ? null : a.requiresAccount ? 1 : 0,
+          updatedAt: now,
+        });
       }
     })(areas);
     return areas.length;

server/test/areas.test.ts

@@ -140,6 +140,58 @@ test('polygons are accepted; bad kinds and geometries are rejected', async () =>
   await app.close();
 });
 
+test('requiresAccount is null unless explicitly overridden', async () => {
+  const app = await make();
+
+  await app.inject({
+    method: 'PUT',
+    url: '/api/areas',
+    headers: auth,
+    payload: {
+      areas: [
+        line('sp-001'), // no override -> client decides by category
+        { ...line('sp-002', 'green_lot'), requiresAccount: false }, // a lot that needs no account
+        { ...line('sp-003'), requiresAccount: true },
+      ],
+    },
+  });
+
+  const areas = (await app.inject({ method: 'GET', url: '/api/areas' })).json().areas;
+  const by = Object.fromEntries(areas.map((a: any) => [a.id, a.requiresAccount]));
+  assert.equal(by['sp-001'], null, 'no override should stay null, not become false');
+  assert.equal(by['sp-002'], false);
+  assert.equal(by['sp-003'], true);
+
+  await app.close();
+});
+
+test('a database created before requires_account existed still works', async () => {
+  // Simulate an older deployment: build the table without the column, then let
+  // the migration add it. CREATE TABLE IF NOT EXISTS alone would not.
+  const Database = (await import('better-sqlite3')).default;
+  const file = `/tmp/bbp-migrate-${process.pid}.db`;
+  const raw = new Database(file);
+  raw.exec(`CREATE TABLE parking_areas (
+    id TEXT PRIMARY KEY, kind TEXT NOT NULL, name TEXT NOT NULL, label TEXT NOT NULL,
+    legend TEXT NOT NULL, hours REAL NOT NULL, color TEXT NOT NULL, shape TEXT NOT NULL,
+    geometry TEXT NOT NULL, updated_at INTEGER NOT NULL)`);
+  raw.close();
+
+  const app = await make({ dbPath: file });
+  const r = await app.inject({
+    method: 'PUT',
+    url: '/api/areas',
+    headers: auth,
+    payload: { areas: [{ ...line('sp-009'), requiresAccount: true }] },
+  });
+  assert.equal(r.statusCode, 200);
+  const areas = (await app.inject({ method: 'GET', url: '/api/areas' })).json().areas;
+  assert.equal(areas[0].requiresAccount, true);
+
+  await app.close();
+  (await import('node:fs')).rmSync(file, { force: true });
+});
+
 test('overlay defaults to identity and round-trips', async () => {
   const app = await make();