Merge pull request #257 from TheAngryRaven/BETA

2.8.0

Author: TheAngryRaven

.env.example

@@ -1,5 +1,5 @@
 # =============================================================================
-# Build-time configuration for Dove's DataViewer / HackTheTrack
+# Build-time configuration for Dove's DataViewer / LapWing
 # =============================================================================
 #
 # Two prefixes are accepted at build time (see vite.config.ts):
@@ -61,3 +61,10 @@ VITE_ENABLE_ADMIN="true"
 # Optional: Cloudflare Turnstile site key for the public contact form.
 # Leave empty to skip CAPTCHA.
 VITE_TURNSTILE_SITE_KEY=""
+
+# Set to "true" ONLY for the native (Tauri/Android) shell build. Skips the
+# service worker, hides in-app purchases (paid plans are web-only — Google Play
+# billing policy), and routes external links through the system browser. The web
+# app must leave this unset/"false". See docs/android.md and src/lib/platform.ts.
+# VITE_IS_NATIVE="true"
+# HTT_IS_NATIVE="true"

.github/ISSUE_TEMPLATE/config.yml

@@ -1,7 +1,7 @@
 blank_issues_enabled: false
 contact_links:
-  - name: Live App — HackTheTrack.net
-    url: https://hackthetrack.net
+  - name: Live App — LapWing
+    url: https://lapwingdata.com
     about: Try the app directly in your browser.
   - name: DovesDataLogger (Hardware)
     url: https://github.com/TheAngryRaven/DovesDataLogger

CHANGELOG.md

@@ -11,6 +11,38 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 > from git history and grouped by theme rather than exhaustive per-commit
 > detail.
 
+## [2.8.0] - 2026-06-20
+
+### Added
+- **Android app groundwork.** The same frontend can now also serve a native
+  Android app (built with Tauri in a separate repo) while the web app is
+  unchanged. A new platform layer (`isNativeApp()`) gates native-only behaviour:
+  the service worker is skipped inside the native WebView, external links open in
+  the system browser, and — to comply with Google Play's billing policy — paid
+  plans are not sold or managed in-app (cloud **sync still works**; subscriptions
+  are purchased and managed on the web). Set `VITE_IS_NATIVE=true` for the native
+  build. See `docs/android.md`.
+- **Public account-deletion page.** A no-login page at **/delete-account** lets
+  you request permanent deletion of your cloud account from the web (Google Play
+  requires a public deletion URL), in addition to the existing in-app flow under
+  Profile → Data & privacy.
+- **Import your data.** Profile → Data & privacy gains an **Import data** option
+  that restores files and garage data from a previously downloaded data-export
+  ZIP. This is the migration path when moving between origins (e.g. the old
+  hackthetrack.net site → lapwingdata.com), where per-browser storage doesn't
+  carry over. Existing files are kept; matching names are skipped. Works signed
+  in or out (it's a local restore).
+
+### Changed
+- **Renamed to LapWing.** The app's display name is now **LapWing** everywhere
+  (the previous "HackTheTrack" / "HackTheTrack.net" branding).
+- **New domain — lapwingdata.com.** The site now lives at **lapwingdata.com**
+  (canonical URLs, sitemap, social tags, in-app links). Production attaches the
+  domain via a `custom_domain` route in `wrangler.jsonc`; the beta domain
+  **beta.lapwingdata.com** is served by the `beta-proxy/` reverse-proxy Worker.
+- **Privacy Policy & Terms** now describe the Android app's web-only billing, the
+  public deletion URL, and the app's foreground-only location use.
+
 ## [2.7.2] - 2026-06-20
 
 ### Added

CLAUDE.md

@@ -8,9 +8,9 @@
 
 ## Project Identity
 
-**Dove's DataViewer / HackTheTrack** — Open-source, offline-first motorsport
+**Dove's DataViewer / LapWing** — Open-source, offline-first motorsport
 telemetry viewer.
-- Live: [hackthetrack.net](https://hackthetrack.net) | Beta: [beta.perchwerks.com](https://beta.perchwerks.com)
+- Live: [lapwingdata.com](https://lapwingdata.com) | Beta: [beta.lapwingdata.com](https://beta.lapwingdata.com)
 - Companion hardware: [DovesDataLogger](https://github.com/TheAngryRaven/DovesDataLogger) (nRF52840 GPS logger with BLE — Seeed XIAO nRF52840, `sense`/`nonsense` IMU variants)
 - PWA with full offline support via service worker + IndexedDB
 
@@ -308,6 +308,12 @@ unless noted.
 - **Cloud sync, subscriptions, GDPR**: Supabase-backed, touch nothing in the core
   app per Rule 1 → `docs/backend.md`. Documents, logs, and lap snapshots draw from
   **one pooled per-tier byte budget** (`subscription_tiers.total_bytes`).
+- **Android / Tauri shell** (`lib/platform.ts`): the same bundle serves the web app
+  and a native Android app (separate Tauri repo). `isNativeApp()` is the single
+  gate — on native: **no service worker** (`main.tsx`), **no in-app purchases**
+  (paid plans are web-only per Google Play policy; cloud sync still works), and
+  external links open in the system browser (`openExternal`/`interceptExternal`).
+  Public deletion URL at `/delete-account`. → `docs/android.md`.
 
 ---
 
@@ -360,6 +366,7 @@ and the seeder: **→ `docs/i18n.md`**.
 | `VITE_ENABLE_ADMIN` | Client | `"true"` enables admin UI + `/admin`. `/login` is mounted when this OR `VITE_ENABLE_CLOUD` is on. |
 | `VITE_ENABLE_CLOUD` | Client | `"true"` enables public accounts (Cloud Sync + email sign-in + `/register` etc.). Default `"false"`. |
 | `VITE_ENABLE_GOOGLE_AUTH` | Client | `"true"` shows "Continue with Google". Requires `VITE_ENABLE_CLOUD`. Default `"false"`. |
+| `VITE_IS_NATIVE` | Client/Build | `"true"` ONLY for the native (Tauri/Android) shell build. Gates `isNativeApp()` (`lib/platform.ts`): no service worker, no in-app purchases (web-only billing — Google Play policy), external links via the system browser. Default `"false"`. → `docs/android.md`. |
 | `VITE_TURNSTILE_SITE_KEY` | Client | Cloudflare Turnstile site key (optional CAPTCHA) |
 | `TURNSTILE_SECRET_KEY` | Server (edge fn) | Turnstile secret — `???` |
 | `VITE_FIRMWARE_MANIFEST_URL` | Client | Override the logger firmware OTA manifest URL. Unset: `main` → production manifest, non-`main`/preview → beta channel (same `isPreviewBuild()` switch). |
@@ -370,8 +377,13 @@ and the seeder: **→ `docs/i18n.md`**.
 **PWA/deploy detail:** the active offline worker is `/service-worker.js` (registered
 outside preview/iframe contexts); `public/sw.js` is a legacy kill-switch. Static
 hosting is Cloudflare Workers (static-assets-only, `wrangler.jsonc`,
-`bun run build` then `wrangler deploy`). Per-branch preview backend: `vite.config.ts`
-`pick()` prefers `*_PREVIEW` Supabase creds on any non-`main` branch
+`bun run build` then `wrangler deploy`). Production `lapwingdata.com` attaches via
+a `custom_domain` route in `wrangler.jsonc` (auto DNS+TLS — don't also attach it in
+the dashboard). The beta domain `beta.lapwingdata.com` can't bind to a Branch
+Preview URL, so a separate thin reverse-proxy Worker in `beta-proxy/` owns it and
+forwards to `beta-dovesdataviewer.perchwerks.workers.dev` (deployed on its own; see
+`beta-proxy/README.md`). Per-branch preview backend: `vite.config.ts` `pick()`
+prefers `*_PREVIEW` Supabase creds on any non-`main` branch
 (`WORKERS_CI_BRANCH`/`CF_PAGES_BRANCH`), so beta deployments bake in a preview DB.
 `main` and local dev never read `_PREVIEW`. See README "Deployment".
 

README.md

@@ -9,7 +9,7 @@
 [![Build](https://github.com/TheAngryRaven/DovesDataViewer/actions/workflows/build.yml/badge.svg)](https://github.com/TheAngryRaven/DovesDataViewer/actions/workflows/build.yml)
 [![Coverage](https://img.shields.io/endpoint?url=https://gist.githubusercontent.com/TheAngryRaven/9c0c31f9c333c565804b26643a2e3aec/raw/coverage-badge.json)](https://github.com/TheAngryRaven/DovesDataViewer/actions/workflows/coverage.yml)
 
-🌐 **Live Demo:** [HackTheTrack.net](https://hackthetrack.net)  
+🌐 **Live Demo:** [LapWing](https://lapwingdata.com)  
 🔧 **Hardware Project:** [DovesDataLogger on GitHub](https://github.com/TheAngryRaven/DovesDataLogger)
 
 **Now officially in BETA status**
@@ -59,7 +59,7 @@ This project is **100% open source**. The entire codebase—every feature, every
 
 ## Free Forever
 
-- **Single file processing on HackTheTrack.net is always free**—no download or account required
+- **Single file processing on LapWing is always free**—no download or account required
 - **Self-hosting is always an option**—clone this repo and run it yourself
 - The only potential future paid feature: optional cloud storage for users who *want* hosted data retention on *my* infrastructure
 
@@ -160,6 +160,7 @@ view. Older JSON with only `sector_2_*`/`sector_3_*` is read as the two majors.
 | `VITE_ENABLE_ADMIN` | No | Set to `true` to enable admin UI and `/admin` route. `/login` mounts when admin OR cloud is enabled. Default `false` — a fresh clone ships the public, offline-first app, not admin UI pointed at an upstream backend. |
 | `VITE_ENABLE_CLOUD` | No | Set to `true` to enable public user accounts: Cloud Sync panels, email sign-in/registration, `/register`, `/forgot-password`, `/reset-password`, `/auth/callback`. Default `false` — flag-off builds ship zero cloud auth code (offline-first invariant). |
 | `VITE_ENABLE_GOOGLE_AUTH` | No | Set to `true` to show the "Continue with Google" buttons (login, register, Profile). Requires `VITE_ENABLE_CLOUD`. Default `false`: Google sign-in currently routes through Lovable's hosted OAuth broker, so it stays hidden until native Supabase Google OAuth is configured (Google Cloud OAuth client + Supabase provider). |
+| `VITE_IS_NATIVE` | No | Set to `true` **only** for the native (Tauri/Android) shell build. Skips the service worker, hides in-app purchases (paid plans are web-only — Google Play billing policy; cloud sync still works), and opens external links in the system browser. The web app leaves this unset/`false`. See [`docs/android.md`](docs/android.md). |
 | `VITE_TURNSTILE_SITE_KEY` | No | Cloudflare Turnstile site key for track submission CAPTCHA |
 | `VITE_FIRMWARE_MANIFEST_URL` | No | Override the DovesDataLogger firmware OTA manifest URL used by the in-app firmware updater. When unset: `main` builds use the production manifest (`https://theangryraven.github.io/DovesDataLogger/manifest.json`); non-`main`/preview builds use the **beta channel** (`https://theangryraven.github.io/DovesDataLogger/beta/manifest.json`). Set this to force a specific channel on any branch. |
 | `TURNSTILE_SECRET_KEY` | No | Cloudflare Turnstile secret key (edge function secret — `???`) |
@@ -455,6 +456,30 @@ whenever that branch isn't `main`, and ignores them on `main` and in local dev.
    is also accepted. Add the Cloudflare preview URL to the preview branch's
    **Auth → Redirect URLs** so cloud sign-in works there.
 
+#### Custom domains (production + beta)
+
+- **Production — `lapwingdata.com`:** `wrangler.jsonc` declares a
+  `custom_domain` route, so `wrangler deploy` provisions the DNS record and TLS
+  certificate automatically. The zone `lapwingdata.com` must be in the same
+  Cloudflare account; **do not also attach the domain by hand** in the dashboard
+  or the bindings conflict.
+- **Beta — `beta.lapwingdata.com`:** custom domains can't attach to a Branch
+  Preview URL, so a separate thin reverse-proxy Worker owns the beta hostname and
+  forwards to the stable `beta` preview (`beta-dovesdataviewer.perchwerks.workers.dev`).
+  It lives in [`beta-proxy/`](beta-proxy/README.md) and is deployed on its own
+  (`cd beta-proxy && npm install && npm run deploy`). Keep Cloudflare Access
+  **off** on the upstream preview URL — see that README.
+
+### Android app (Tauri)
+
+The same frontend also serves a native **Android** app built with Tauri (in a
+separate repo) — the web app is unchanged. Build the bundle with
+`VITE_IS_NATIVE=true` and the app skips the service worker, hides in-app purchases
+(paid plans stay web-only per Google Play's billing policy; cloud sync still
+works), and opens external links in the system browser. See
+[`docs/android.md`](docs/android.md) for the platform layer, the native bridge
+contract, the Data Safety form, and the Android permission set.
+
 ---
 
 ## Project Structure

SECURITY.md

@@ -4,7 +4,7 @@
 
 Dove's DataViewer is a continuously deployed web app. Security fixes are applied
 to the latest release on the `main` branch, which is what powers
-[hackthetrack.net](https://hackthetrack.net). Older tagged releases are not
+[lapwingdata.com](https://lapwingdata.com). Older tagged releases are not
 separately patched.
 
 | Version | Supported |

beta-proxy/.gitignore

@@ -0,0 +1,4 @@
+node_modules/
+.wrangler/
+dist/
+package-lock.json

beta-proxy/README.md

@@ -0,0 +1,70 @@
+# beta-proxy
+
+A minimal Cloudflare Worker that reverse-proxies **https://beta.lapwingdata.com**
+to the stable `beta` branch preview of the `dovesdataviewer` Worker.
+
+## Why this exists
+
+The `dovesdataviewer` Worker has non-production branch builds enabled. Pushes to
+the `beta` branch publish a **stable Branch Preview URL**:
+
+```
+https://beta-dovesdataviewer.perchwerks.workers.dev
+```
+
+that always serves the latest `beta` push. Cloudflare **custom domains cannot be
+attached directly to a preview URL**, so this thin proxy Worker owns
+`beta.lapwingdata.com` and forwards every request to the preview URL, returning
+the upstream response unchanged (it also rewrites the `Location` header on 3xx
+redirects so the preview hostname never leaks to the client).
+
+The upstream host is a single top-level constant (`UPSTREAM_HOST`) in
+[`src/index.ts`](src/index.ts) — change it there if the target ever moves. (It
+stays on `perchwerks.workers.dev` because the preview URL is derived from the
+Worker name + the account's workers.dev subdomain, which the new public domain
+doesn't change.)
+
+## Prerequisites
+
+- The zone **lapwingdata.com** is already managed in this Cloudflare account.
+- Node.js installed locally.
+
+## Deploy
+
+```bash
+cd beta-proxy
+npm install
+
+# Authenticate (opens a browser; one-time per machine)
+npx wrangler login
+
+# Validate config + bundle without deploying
+npm run dry-run
+
+# Deploy for real
+npm run deploy
+```
+
+> **Note:** this project lives inside the `dovesdataviewer` repo, which has its
+> own root `wrangler.jsonc`. Wrangler's config discovery walks *up* the tree and
+> would otherwise pick up that parent config, so the npm scripts (and any direct
+> invocation) must pass `--config ./wrangler.toml`. The `npm run deploy` /
+> `npm run dry-run` scripts already do this — if you call wrangler directly, run
+> `npx wrangler deploy --config ./wrangler.toml`.
+
+The `custom_domain` route in [`wrangler.toml`](wrangler.toml) makes Cloudflare
+**automatically provision the DNS record and TLS certificate** for
+`beta.lapwingdata.com` on first deploy. **Do not create any DNS records by hand** —
+doing so will conflict with the custom-domain binding.
+
+## ⚠️ Cloudflare Access must be OFF on the upstream preview URL
+
+This proxy makes a server-side `fetch()` to
+`beta-dovesdataviewer.perchwerks.workers.dev`. If **Cloudflare Access** (Zero
+Trust) is enabled on that preview hostname (or on the `*.workers.dev` route),
+the proxy's `fetch` will be redirected to an Access login wall and your users
+will see a Cloudflare login page instead of the app.
+
+**Keep Cloudflare Access disabled on the upstream preview URL** for this proxy
+to work. If you need to gate `beta.lapwingdata.com`, add Access on *this* proxy's
+custom domain instead, not on the upstream.

beta-proxy/package.json

@@ -0,0 +1,14 @@
+{
+  "name": "beta-proxy",
+  "version": "1.0.0",
+  "private": true,
+  "description": "Reverse-proxy Worker serving the dovesdataviewer beta branch preview at beta.lapwingdata.com",
+  "scripts": {
+    "deploy": "wrangler deploy --config ./wrangler.toml",
+    "dry-run": "wrangler deploy --dry-run --config ./wrangler.toml"
+  },
+  "devDependencies": {
+    "@cloudflare/workers-types": "^4.20250601.0",
+    "wrangler": "^4.20.0"
+  }
+}

beta-proxy/src/index.ts

@@ -0,0 +1,75 @@
+/**
+ * beta-proxy — a thin reverse-proxy Worker.
+ *
+ * Cloudflare custom domains cannot attach to a *Branch Preview* URL, so this
+ * Worker owns beta.lapwingdata.com and transparently forwards every request to
+ * the stable `beta` branch preview of the `dovesdataviewer` Worker.
+ *
+ * Change the deployment target by editing UPSTREAM_HOST below.
+ */
+
+// The stable Branch Preview hostname for the `beta` branch of `dovesdataviewer`.
+// It's derived from the Worker name + account workers.dev subdomain, which are
+// unchanged by the new public domain — so this stays on perchwerks.workers.dev.
+const UPSTREAM_HOST = "beta-dovesdataviewer.perchwerks.workers.dev";
+
+// The public hostname this proxy serves on (used to rewrite redirect targets so
+// the preview host never leaks back to the client).
+const PUBLIC_HOST = "beta.lapwingdata.com";
+
+export default {
+  async fetch(request: Request): Promise<Response> {
+    const url = new URL(request.url);
+
+    // Forward to the upstream preview host, preserving path + query string.
+    url.hostname = UPSTREAM_HOST;
+    url.protocol = "https:";
+    url.port = "";
+
+    // Reconstruct the request so all methods, headers, and the body are
+    // forwarded verbatim. `redirect: "manual"` lets us rewrite Location
+    // headers ourselves rather than letting fetch follow them.
+    const upstreamRequest = new Request(url.toString(), request);
+
+    const upstreamResponse = await fetch(upstreamRequest, { redirect: "manual" });
+
+    // On 3xx redirects, swap the upstream .workers.dev host in the Location
+    // header for our public host so clients never see the preview hostname.
+    if (upstreamResponse.status >= 300 && upstreamResponse.status < 400) {
+      const location = upstreamResponse.headers.get("Location");
+      if (location) {
+        const rewritten = rewriteLocation(location);
+        if (rewritten !== location) {
+          const headers = new Headers(upstreamResponse.headers);
+          headers.set("Location", rewritten);
+          return new Response(upstreamResponse.body, {
+            status: upstreamResponse.status,
+            statusText: upstreamResponse.statusText,
+            headers,
+          });
+        }
+      }
+    }
+
+    return upstreamResponse;
+  },
+} satisfies ExportedHandler;
+
+/**
+ * Rewrite a Location header value, replacing the upstream preview host with the
+ * public host. Handles both absolute URLs and bare/relative values (which are
+ * returned unchanged).
+ */
+function rewriteLocation(location: string): string {
+  try {
+    const target = new URL(location);
+    if (target.hostname === UPSTREAM_HOST) {
+      target.hostname = PUBLIC_HOST;
+      return target.toString();
+    }
+    return location;
+  } catch {
+    // Relative Location (e.g. "/path") — nothing to rewrite.
+    return location;
+  }
+}