feat: multi-city GTFS uploads, Google auth, changelog & announcement banner

[faizm10]

Summary

• Multi-city GTFS pipeline — Upload any city's GTFS ZIP; TypeScript processor (fflate + custom CSV parser) derives 8 data files (routes, variants, stops, schedules, departures, simulation trips) and streams them to Vercel Blob with background processing via after() so the upload API returns in ~5s regardless of feed size
• Auth-gated feeds — Google/GitHub sign-in required to upload; feeds scoped to session.user.id with ownership check on delete; gtfs_feeds table added to Neon DB
• Feed mode switcher — "City Feeds" button in the top nav bar (GO / City only / Both); city routes rendered in a separate Mapbox GL layer using GTFS route_color; FeedSelector dropdown with clear upload CTA
• Announcement banner — Dismissable banner on home page (localStorage) linking to /changelog
• Changelog page — /changelog with full release history styled to match landing page; nav link added to LandingHeader

New files

File	Purpose
lib/gtfsProcessor.ts	TypeScript GTFS processor (~600 lines)
lib/feedLoader.ts	Abstraction over local (GO) vs Blob (city) data sources
lib/feedColors.ts	Route color resolution from GTFS route_color field
app/api/gtfs/upload	Upload endpoint (auth-gated, returns immediately)
app/api/gtfs/process	Internal background processing endpoint
app/api/gtfs/feeds	List user's feeds / delete with ownership check
app/api/gtfs/feeds/[id]/geojson-url	Redirect to Blob GeoJSON for Mapbox
app/gtfs/page.tsx	Upload UI with polling
components/overlays/FeedSelector.tsx	Nav-integrated feed/mode switcher
hooks/useFeed.ts	Feed state + localStorage persistence
app/changelog/page.tsx	Changelog page
components/marketing/AnnouncementBanner.tsx	Dismissable banner

API changes

All existing API routes (/api/routes, /api/stops, /api/departures, /api/simulation, /api/variant-stops) now accept an optional ?feed=<uuid> param. Omitting it defaults to "gotransit" — no breaking change.

Test plan

• GO Transit map loads unchanged (no ?feed= param)
• Sign in with Google → upload a city GTFS ZIP → feed transitions uploading → processing → ready
• City Feeds button in nav opens dropdown; GO / City / Both mode switches work
• City routes render on map with correct feed colors
• Delete feed removes Blob files + DB row; other users cannot delete your feed
• Announcement banner shows on home page, dismisses and stays dismissed on reload
• /changelog page renders correctly

🤖 Generated with Claude Code

Greptile Summary

This PR adds multi-city GTFS feed uploads (client-side Blob upload → /api/gtfs/register → after()-triggered processing), auth-gated feeds scoped to session.user.id, a feed mode switcher on the map, a changelog page, and a dismissable announcement banner. The existing GO Transit API routes have been refactored to accept an optional ?feed=<uuid> param, backed by a new FeedCache LRU/TTL class and a feedLoader abstraction.

• GTFS pipeline: GtfsClient uploads directly to Vercel Blob, then POST /api/gtfs/register inserts a DB row and uses after() to asynchronously call /api/gtfs/process; the upload-token and register routes have complementary auth handling.
• Feed-scoped API routes: all five existing data endpoints (/routes, /stops, /departures, /simulation, /variant-stops) now accept ?feed= and route through resolveFeedSource → FeedCache.
• UI additions: FeedSelector nav dropdown, useFeed hook with localStorage persistence, announcement banner, and /changelog page.

Confidence Score: 4/5

Safe to merge after fixing the unvalidated callbackUrl redirect in the sign-in page.

The GTFS pipeline, feed-scoped API routes, caching layer, and auth-gating are all well-structured. The one concrete defect is the sign-in page redirecting already-authenticated users to whatever URL is in the query string — a crafted link can silently forward a signed-in visitor to an external domain.

client/app/auth/signin/page.tsx — the unvalidated callbackUrl redirect needs a same-origin guard before this merges.

Security Review

• Open redirect (client/app/auth/signin/page.tsx lines 36–40): callbackUrl from the query string is used verbatim in redirect(callback) for already-authenticated users, enabling an attacker to redirect signed-in visitors to an external domain via a crafted link.

Important Files Changed

Filename	Overview
client/app/auth/signin/page.tsx	Open redirect: redirect(callback) uses unvalidated callbackUrl from searchParams for already-authenticated users.
client/app/api/gtfs/register/route.ts	Correctly uses after() for async processing; fails loudly if GTFS_PROCESS_SECRET is unconfigured; marks feed failed on trigger error.
client/app/api/gtfs/process/route.ts	Processes GTFS feeds with proper secret auth; returns 503 when secret is unconfigured in production; cleans up raw ZIP on success and failure.
client/app/api/gtfs/feeds/[id]/route.ts	Ownership check correctly gates deletion on userId match; Blob prefix cleanup covers derived files.
client/lib/feedCache.ts	Correct LRU/TTL implementation; gotransit is pinned, city feeds are evicted after 10 min or when the LRU cap (6) is exceeded.
client/lib/feedLoader.ts	Clean abstraction over local and Blob feed sources; errors clearly when feed is missing/not-ready.
client/app/gtfs/GtfsClient.tsx	Upload flow handles file validation, progress, polling, and stale-processing detection; state machine is correct.
client/lib/gtfsProcessSecret.ts	Returns null in production when env var is absent, preventing the dev-secret fallback from leaking into prod.

Sequence Diagram

%%{init: {'theme': 'neutral'}}%%
sequenceDiagram
    participant Browser
    participant UploadToken as /api/gtfs/upload-token
    participant BlobCDN as Vercel Blob
    participant Register as /api/gtfs/register
    participant DB as Neon DB
    participant Process as /api/gtfs/process

    Browser->>UploadToken: POST (get upload token)
    UploadToken-->>Browser: signed token
    Browser->>BlobCDN: PUT feeds/raw/timestamp-file.zip
    BlobCDN-->>Browser: blobUrl

    Browser->>Register: "POST { blobUrl, cityName }"
    Register->>DB: "INSERT gtfs_feeds (status=processing)"
    Register-->>Browser: "{ feedId, status: processing }"

    Note over Register: after() runs post-response
    Register->>Process: "POST x-gtfs-secret + { feedId, blobUrl }"
    Process->>BlobCDN: fetch raw ZIP
    BlobCDN-->>Process: ZIP bytes
    Process->>Process: processGtfsFeed() — parse GTFS, derive 8 JSON files
    Process->>BlobCDN: "PUT feeds/feedId/*.json + geojson"
    Process->>DB: "UPDATE status=ready, blobBaseUrl, routeCount, stopCount"
    Process->>BlobCDN: DELETE raw ZIP
    Process-->>Register: 200 OK

    Browser->>DB: "poll /api/gtfs/feeds?ids=..."
    DB-->>Browser: "{ feeds: [{ status: ready }] }"

Loading

%%{init: {'theme': 'base', 'themeVariables': {"darkMode": true, "background": "#0d1117", "primaryColor": "#21262d", "primaryTextColor": "#e6edf3", "primaryBorderColor": "#8b949e", "lineColor": "#8b949e", "textColor": "#e6edf3", "edgeLabelBackground": "#161b22", "actorBkg": "#21262d", "actorBorder": "#8b949e", "actorTextColor": "#e6edf3", "actorLineColor": "#8b949e", "signalColor": "#8b949e", "signalTextColor": "#e6edf3", "noteBkgColor": "#373320", "noteBorderColor": "#d4a72c", "noteTextColor": "#f0e6c0", "labelBoxBkgColor": "#21262d", "labelBoxBorderColor": "#8b949e", "labelTextColor": "#e6edf3", "loopTextColor": "#e6edf3", "activationBkgColor": "#30363d", "activationBorderColor": "#8b949e"}}}%%
sequenceDiagram
    participant Browser
    participant UploadToken as /api/gtfs/upload-token
    participant BlobCDN as Vercel Blob
    participant Register as /api/gtfs/register
    participant DB as Neon DB
    participant Process as /api/gtfs/process

    Browser->>UploadToken: POST (get upload token)
    UploadToken-->>Browser: signed token
    Browser->>BlobCDN: PUT feeds/raw/timestamp-file.zip
    BlobCDN-->>Browser: blobUrl

    Browser->>Register: "POST { blobUrl, cityName }"
    Register->>DB: "INSERT gtfs_feeds (status=processing)"
    Register-->>Browser: "{ feedId, status: processing }"

    Note over Register: after() runs post-response
    Register->>Process: "POST x-gtfs-secret + { feedId, blobUrl }"
    Process->>BlobCDN: fetch raw ZIP
    BlobCDN-->>Process: ZIP bytes
    Process->>Process: processGtfsFeed() — parse GTFS, derive 8 JSON files
    Process->>BlobCDN: "PUT feeds/feedId/*.json + geojson"
    Process->>DB: "UPDATE status=ready, blobBaseUrl, routeCount, stopCount"
    Process->>BlobCDN: DELETE raw ZIP
    Process-->>Register: 200 OK

    Browser->>DB: "poll /api/gtfs/feeds?ids=..."
    DB-->>Browser: "{ feeds: [{ status: ready }] }"

Loading

_{Reviews (2): Last reviewed commit: "fix: unstick uploads hanging at 99% and ..." | Re-trigger Greptile}

Greptile also left 1 inline comment on this PR.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
transit-flow	Ready	Preview, Comment	Jul 2, 2026 7:27pm

[greptile-apps]

Open redirect for already-authenticated users

redirect(callback) uses callbackUrl directly from the URL query string without any origin check. A crafted link like /auth/signin?callbackUrl=https://evil.com silently forwards an already-signed-in visitor to the attacker's domain, which is a classic phishing vector. (NextAuth's own signIn() with redirectTo does validate the origin, but this direct redirect() call does not.)

Suggested change

	const { callbackUrl } = await searchParams;
	const callback = callbackUrl ?? "/";
	const { callbackUrl } = await searchParams;
	// Only allow same-origin redirects — reject absolute URLs and protocol-relative paths.
	const callback =
	callbackUrl && callbackUrl.startsWith("/") && !callbackUrl.startsWith("//")
	? callbackUrl
	: "/";