Release: develop -> main

CONTRIBUTING.md

@@ -4,15 +4,15 @@ The map API keeps the same gates as the 21.gifts API.
 
 ## Branches
 
-| Branch    | Purpose                                                  | Image                      |
-| --------- | -------------------------------------------------------- | -------------------------- |
-| `develop` | Integration branch. Open pull requests here.             | `opencryptopay/api:beta`   |
-| `main`    | Production. Moves only through the release pull request. | `opencryptopay/api:latest` |
+| Branch    | Purpose                                                  |
+| --------- | -------------------------------------------------------- |
+| `develop` | Integration branch. Open pull requests here.             |
+| `main`    | Production. Moves only through the release pull request. |
 
 - Land work on `develop` through a feature branch and a pull request. Do not push `develop` or `main` directly.
-- A push to `develop` publishes `:beta` for the dev environment and runs CI on that commit. The release pull request shows that same CI run.
-- A push to `main` publishes `:latest` for production.
-- `auto-release-pr.yaml` opens `Release: develop -> main` when `develop` is ahead of `main`. A normal production publish waits for that pull request. The dev and production workflows also have a manual run, and that run publishes `:beta` or `:latest` for whichever commit you start it on.
+- A push to `develop` runs CI on that commit. The release pull request shows that same CI run.
+- This repository does not publish a container image.
+- `auto-release-pr.yaml` opens `Release: develop -> main` when `develop` is ahead of `main`.
 - Never force-push, and never amend a published commit.
 
 ## Commit messages
@@ -38,19 +38,4 @@ Do not lower a coverage threshold to land a change. A genuinely unreachable bran
 | Workflow               | Trigger                             | Action                                                                  |
 | ---------------------- | ----------------------------------- | ----------------------------------------------------------------------- |
 | `ci.yaml`              | Pull request, and push to `develop` | Typecheck, lint, handbook, e2e-check, test (100% coverage), build, e2e  |
-| `deploy-dev.yaml`      | Push to `develop`                   | Build and push `opencryptopay/api:beta`, then wait for the deploy       |
-| `deploy-prd.yaml`      | Push to `main`                      | Build and push `opencryptopay/api:latest`, then wait for the deploy     |
 | `auto-release-pr.yaml` | Push to `develop`                   | Open the release pull request (`develop` → `main`) when there is a diff |
-
-Images target `linux/arm64`.
-
-Deploy workflows need these Actions secrets:
-
-| Secret            | Purpose                                               |
-| ----------------- | ----------------------------------------------------- |
-| `DOCKER_USERNAME` | Registry username for the image push                  |
-| `DOCKER_PASSWORD` | Registry token for the image push                     |
-| `DISPATCH_TOKEN`  | Token that sends `image-published` and reads that run |
-| `DISPATCH_REPO`   | `owner/repo` that receives `image-published`          |
-
-If `DISPATCH_TOKEN` or `DISPATCH_REPO` is missing, deploy fails after the image push. The job then waits for the infrastructure run titled `image-published opencryptopay/api:<tag> <sha>` and fails when that run does not succeed.

README.md

@@ -1,6 +1,6 @@
 # OpenCryptoPay API
 
-Map API. `GET /map/places` is the public list of places. `POST /map/places` adds a place once.
+Map API. `GET /map/places` is the public list of places, each with a tech provider. `POST /map/places` adds a place once. `PUT /map/places` updates a place. `DELETE /map/places` removes a place.
 
 The same `origin` and `externalId` returns the first pin and does not submit it again. When `BTCMAP_ACCESS_TOKEN` is set, a new pin is posted once to `https://api.btcmap.org/v4/place-submissions`. A missing token stores the pin and skips that call.
 
@@ -20,7 +20,7 @@ The process listens on port `3000` unless `PORT` is set. The database file is `d
 
 ## Branches
 
-Pull requests target `develop`. A push there publishes `opencryptopay/api:beta`. `main` publishes `opencryptopay/api:latest` and moves only through the release pull request from `develop`.
+Pull requests target `develop`. `main` moves only through the release pull request from `develop`. This repository does not publish a container image.
 
 ## Checks
 

docs/handbook/endpoints.md

@@ -9,14 +9,28 @@
 
 ## Endpoint: GET /map/places
 
-- **Purpose:** Public map list, newest first. Each item is `id`, `origin`, `name`, `lat`, `lon`, and `category`. The caller id and payment methods are not included.
+- **Purpose:** Public map list, newest first. Each item is `id`, `origin`, `name`, `lat`, `lon`, `category`, and `techProvider`. The caller id and payment methods are not included.
 - **Errors:** 400 `{ error: "Invalid limit" }` when `limit` is not an integer from 1 to 1000. Omitted `limit` means 1000.
 - **Used by:** The OpenCryptoPay map.
 - **Auth:** none. Browser calls are allowed from any origin.
 
 ## Endpoint: POST /map/places
 
-- **Purpose:** Create one map pin. The same `origin` and `externalId` returns the first row and does not call BTC Map again. A new row is posted once when `BTCMAP_ACCESS_TOKEN` is set.
+- **Purpose:** Create one map pin. The same `origin` and `externalId` returns the first row, including its tech provider, and does not call BTC Map again. A new row is posted once when `BTCMAP_ACCESS_TOKEN` is set. An omitted tech provider is stored as `DFX.swiss`.
 - **Errors:** 503 `{ error: "Place ingest is not configured" }` when the ingest token is unset or blank. 401 `{ error: "Unauthorized" }` when the bearer does not match. 400 with the validator message for a bad body. A BTC Map failure still returns 201 with `btcmap: "failed"`.
 - **Used by:** Trusted callers that add a shop the first time it appears.
 - **Auth:** `Authorization: Bearer` must equal `OCP_PLACE_INGEST_TOKEN`. Status 201 when new, 200 when the pair already exists.
+
+## Endpoint: PUT /map/places
+
+- **Purpose:** Update one map pin, or create it when the origin and external id are new. BTC Map is called only when this request inserts the row. An update returns `btcmap: "skipped"` and does not call BTC Map.
+- **Errors:** 503 `{ error: "Place ingest is not configured" }` when the ingest token is unset or blank. 401 `{ error: "Unauthorized" }` when the bearer does not match. 400 with the validator message for a bad body.
+- **Used by:** Trusted callers that correct a shop or set its tech provider.
+- **Auth:** `Authorization: Bearer` must equal `OCP_PLACE_INGEST_TOKEN`. Status 201 when new, 200 when the pair already exists.
+
+## Endpoint: DELETE /map/places
+
+- **Purpose:** Remove one map pin by origin and external id. A missing pair returns `{ deleted: false }` with status 200. This call does not contact BTC Map.
+- **Errors:** 503 `{ error: "Place ingest is not configured" }` when the ingest token is unset or blank. 401 `{ error: "Unauthorized" }` when the bearer does not match. 400 with the validator message for a bad body.
+- **Used by:** Trusted callers that take a shop off the public map.
+- **Auth:** `Authorization: Bearer` must equal `OCP_PLACE_INGEST_TOKEN`. The JSON body is `origin` and `externalId`.