fix: address the per-slice review findings (2 P2 + input/robustness P3s)

From the /review of the separated slice PRs. (The NODE_ENV, remittance-double-pay,
and idempotency-scope findings the reviewers raised were on frozen historical
slices — already fixed at HEAD.)

P2:
- assignRider (manual admin dispatch) now gates on a VERIFIED rider profile, not
  just the RIDER role — parity with auto-dispatch, so a draft/rejected rider who
  hasn't proven license/ID is never handed platform cash. (repo.isRiderVerified)
- zones.isCovered fails CLOSED when zones exist but all are deactivated (was
  falling back to the full pilot ring, silently reopening coverage). Distinguishes
  empty-table (bootstrap → pilot ring) from all-off (admin closed → no coverage).

P3:
- orders ?status query validated via ParseEnumPipe (garbage → 400, not Prisma 500).
- onboarding proof keys (shop permit/photos, rider license/id) must live under the
  caller's uploads/<uid>/ prefix — a crafted key can no longer point the admin's
  presigned-GET at another user's private object. (shared assertOwnedKey)
- rider backfill migration: existing RIDER users get a VERIFIED profile (idempotent)
  so the new dispatch gate doesn't strand pre-existing riders.
- shop-facing remittance strips paidByUid (an admin's Firebase UID).
- admin-shops addService/addMember map the concurrent-dup P2002 to 409, not 500.
- /geocode/search throttled 20/min (billable TomTom call, was global-only).
- platform-config envNum accepts a deliberate 0 (presence check, not !== 0).

Noted, not fixed (dev-only / negligible): auth bearer-before-bypass dev 500,
capacity-race returns 409, pagination cursor positional side-channel.

290 api unit tests. Integration + backfill migration validated by CI (local Docker
unavailable this session).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: Banyel3

apps/api/prisma/migrations/20260725211906_backfill_rider_profiles/migration.sql

@@ -0,0 +1,9 @@
+-- Backfill: any pre-existing RIDER user without a profile was admin-provisioned
+-- and trusted, so give them a VERIFIED profile — otherwise the onboarding-D
+-- dispatch gate (riderProfile status VERIFIED) would make them permanently
+-- undispatchable. Idempotent (NOT EXISTS); a no-op on a DB with no such users.
+INSERT INTO "RiderProfile" ("id", "userId", "status", "verifiedAt", "createdAt")
+SELECT gen_random_uuid()::text, u."id", 'VERIFIED', now(), now()
+FROM "User" u
+WHERE 'RIDER' = ANY(u."roles")
+  AND NOT EXISTS (SELECT 1 FROM "RiderProfile" p WHERE p."userId" = u."id");

apps/api/src/maps/geocode.controller.ts

@@ -7,6 +7,7 @@ import {
   UseGuards,
 } from '@nestjs/common';
 import { ApiBearerAuth, ApiOperation, ApiTags } from '@nestjs/swagger';
+import { Throttle } from '@nestjs/throttler';
 import type { GeocodeResult, MapsProvider } from '@wash-and-go/maps';
 import { RolesGuard } from '../common/guards/roles.guard';
 import { MAPS_PROVIDER } from './maps.constants';
@@ -38,6 +39,9 @@ export class GeocodeController {
 
   // Typeahead: up to `limit` ranked candidates for an address autocomplete
   // (admin shop editor). Empty array on no match. Any-authenticated like geocode.
+  // Each call is a billed TomTom request — cap it tighter than the global 60/min
+  // so any authenticated token can't burn the maps quota via the typeahead.
+  @Throttle({ default: { limit: 20, ttl: 60_000 } })
   @Get('search')
   @ApiOperation({ summary: 'Address autocomplete — ranked candidates' })
   async search(

apps/api/src/orders/orders.controller.ts

@@ -4,6 +4,7 @@ import {
   Get,
   Headers,
   Param,
+  ParseEnumPipe,
   Post,
   Query,
   UseGuards,
@@ -138,7 +139,9 @@ export class OrdersController {
   @ApiOperation({ summary: 'List orders visible to the caller (paged, newest first)' })
   list(
     @CurrentUser() user: User,
-    @Query('status') status?: OrderStatus,
+    // Validate the enum so a garbage ?status=foo is a 400, not a Prisma 500.
+    @Query('status', new ParseEnumPipe(OrderStatus, { optional: true }))
+    status?: OrderStatus,
     @Query('q') q?: string,
     @Query('limit') limit?: string,
     @Query('before') before?: string,

apps/api/src/orders/orders.repository.ts

@@ -133,6 +133,13 @@ export class OrdersRepository {
     return u !== null && !u.disabledAt && u.roles.includes(role as never);
   }
 
+  // A rider is dispatchable only with a VERIFIED profile (onboarding D). Manual
+  // admin assign gates on this too, not just auto-dispatch.
+  async isRiderVerified(userId: string): Promise<boolean> {
+    const p = await this.prisma.riderProfile.findUnique({ where: { userId } });
+    return p?.status === 'VERIFIED';
+  }
+
   // ── capacity path (all take tx) ─────────────────────────────────────────
 
   // T1: serialize concurrent bookings per (shop, Manila-day). Transaction-scoped

apps/api/src/orders/orders.service.spec.ts

@@ -135,6 +135,7 @@ describe('OrdersService', () => {
       countExpressUsedByShopForDay: jest.fn().mockResolvedValue(new Map()),
       isShopMember: jest.fn(),
       userHasRole: jest.fn(),
+      isRiderVerified: jest.fn().mockResolvedValue(true),
       lockShopDay: jest.fn().mockResolvedValue(undefined),
       countExpressOrdersForShopDay: jest.fn(),
       pickAutoDispatchRider: jest.fn().mockResolvedValue(null),
@@ -180,6 +181,7 @@ describe('OrdersService', () => {
     // giving true coverage behavior (central ZC in, Manila out) without mocking.
     const zones = new ZonesService({
       findActive: async () => [],
+      countAll: async () => 0, // empty table → pilot-ring fallback (in-coverage)
     } as unknown as ZonesRepository);
 
     const notifications = {
@@ -550,6 +552,14 @@ describe('OrdersService', () => {
       ).rejects.toBeInstanceOf(BadRequestException);
     });
 
+    it('rejects assigning an unverified rider (parity with auto-dispatch gate)', async () => {
+      repo.userHasRole.mockResolvedValue(true);
+      repo.isRiderVerified.mockResolvedValue(false);
+      await expect(
+        service.assignRider(makeUser(['ADMIN']), 'o1', { riderId: 'draft-rider' }),
+      ).rejects.toBeInstanceOf(BadRequestException);
+    });
+
     it('assigns and transitions BOOKED → ASSIGNED', async () => {
       repo.userHasRole.mockResolvedValue(true);
       repo.findByIdForUpdate.mockResolvedValue(makeOrder({ status: 'BOOKED' }));

apps/api/src/orders/orders.service.ts

@@ -495,6 +495,10 @@ export class OrdersService {
   ): Promise<Order> {
     const riderOk = await this.repo.userHasRole(dto.riderId, 'RIDER');
     if (!riderOk) throw new BadRequestException('Assignee is not a rider');
+    // Only VERIFIED riders are dispatchable — parity with auto-dispatch, so a
+    // draft/rejected rider (no verified license/ID) is never handed platform cash.
+    const verified = await this.repo.isRiderVerified(dto.riderId);
+    if (!verified) throw new BadRequestException('Rider is not verified yet');
 
     return this.prisma.$transaction(async (tx) => {
       const order = await this.repo.findByIdForUpdate(tx, orderId);

apps/api/src/platform-config/platform-config.service.ts

@@ -83,8 +83,12 @@ export class PlatformConfigService {
   ) {}
 
   private envNum(key: string, def: number): number {
-    const v = Number(this.env.get<string>(key));
-    return Number.isFinite(v) && v !== 0 ? v : def;
+    // Presence check, not `!== 0` — a deliberate 0 (e.g. SERVICE_FEE_PHP=0) is a
+    // valid override, not "unset". Missing/blank/garbage → the code default.
+    const raw = this.env.get<string>(key);
+    if (raw == null || String(raw).trim() === '') return def;
+    const v = Number(raw);
+    return Number.isFinite(v) ? v : def;
   }
 
   // Bootstrap defaults (env-overridable) used only when the row does not exist.

apps/api/src/remittance/remittance.service.spec.ts

@@ -63,7 +63,8 @@ describe('RemittanceService', () => {
       expect(repo.listBatches).toHaveBeenCalledWith({
         shopId: { in: ['shopA', 'shopB'] },
       });
-      expect(out).toEqual([{ id: 'b1' }]);
+      // paidByUid is stripped for the shop-facing response.
+      expect(out).toEqual([{ id: 'b1', paidByUid: null }]);
     });
   });
 

apps/api/src/remittance/remittance.service.ts

@@ -102,11 +102,14 @@ export class RemittanceService {
     return batch;
   }
 
-  // Shop-facing: only the caller's own shop payout batches.
+  // Shop-facing: only the caller's own shop payout batches. Strip paidByUid — a
+  // shop has no business seeing which admin's Firebase UID marked the transfer
+  // (the reference + paidAt are enough proof of payment).
   async listBatchesForMember(userId: string): Promise<RemittanceBatch[]> {
     const shopIds = await this.repo.shopIdsForMember(userId);
     if (shopIds.length === 0) return [];
-    return this.repo.listBatches({ shopId: { in: shopIds } });
+    const batches = await this.repo.listBatches({ shopId: { in: shopIds } });
+    return batches.map((b) => ({ ...b, paidByUid: null }));
   }
 
   async listBatches(filter: {

apps/api/src/riders/rider-onboarding.service.ts

@@ -6,6 +6,7 @@ import {
 } from '@nestjs/common';
 import { RiderProfile, User } from '@prisma/client';
 import { PrismaService } from '../prisma/prisma.service';
+import { assertOwnedKey } from '../uploads/object-key';
 import type { UpdateRiderOnboardingDto } from './dto/rider-onboarding.dto';
 
 // Rider's own onboarding view.
@@ -57,6 +58,9 @@ export class RiderOnboardingService {
           : 'Your profile is verified',
       );
     }
+    if (dto.licenseKey != null) assertOwnedKey(user.id, dto.licenseKey);
+    if (dto.idKey != null) assertOwnedKey(user.id, dto.idKey);
+
     const updated = await this.prisma.riderProfile.update({
       where: { userId: user.id },
       data: {