fix(places): gate OSM snapping by item identity + manifest-driven scheme dispatch

Two related problems were letting unrelated OSM POI metadata leak onto data-
source items in the place panel:

1. lookupByOsmFilters snapped to the nearest amenity match regardless of
   identity. A Dott bike station co-located with an optician kiosk would
   inherit the optician's website, opening hours, wheelchair status, and
   social tags. Bike-sharing, car-sharing, ev-charging, fuel, and parking
   detail mappers now carry an OsmIdentity (ref / operator / network /
   brand) on DataSourceDetail; the resolver passes it to lookupByOsmFilters
   which only accepts candidates that match by at least one identity field.
   Match is normalized + token-subset so "Shell" matches "Shell Deutschland
   Oil GmbH" but not the optician.

2. The /api/places/:id route fell through to a generic name+coord lookup
   for any scheme without a registered resolver, which produced the same
   leak whenever an integration's setup() failed to register. The fallback
   is now gated on isIntegrationScheme(): schemes owned by an installed
   manifest must resolve via a registered resolver (404 otherwise);
   non-integration freeform schemes (saved, label, stylePoi, streetView)
   still get the name+coord lookup. The gate is data-driven from the
   manifest registry — no allowlist to maintain.

Author: Medformatik

apps/api/src/integration-host.ts

@@ -1130,6 +1130,20 @@ export function getAllIntegrations(): LoadedIntegration[] {
   return Array.from(integrations.values());
 }
 
+/**
+ * True when `scheme` matches the id of an installed integration manifest —
+ * regardless of whether its `setup()` succeeded. The places route uses this
+ * to decide whether an unregistered resolver should 404 (the integration
+ * owns the scheme but didn't boot) or fall through to the freeform name+
+ * coord lookup (the scheme is a UI-side convention like `saved`/`stylePoi`,
+ * not an integration). Manifest discovery runs before `setup()`, so this
+ * stays accurate even when an integration crashes during boot — which is
+ * the failure mode this gate exists to catch.
+ */
+export function isIntegrationScheme(scheme: string): boolean {
+  return integrations.has(scheme);
+}
+
 export function getIntegrationsByDomain(domain: string): LoadedIntegration[] {
   return Array.from(integrations.values()).filter(
     (i) => i.enabled && i.manifest.domains.includes(domain),

apps/api/src/routes/__tests__/places.test.ts

@@ -85,8 +85,10 @@ vi.mock("@integrations/reviews/orchestrator", () => ({
   fetchAggregate: vi.fn().mockResolvedValue(null),
 }));
 
+const mockIsIntegrationScheme = vi.fn().mockReturnValue(false);
 vi.mock("../../integration-host.js", () => ({
   getAllIntegrations: vi.fn().mockReturnValue([]),
+  isIntegrationScheme: (scheme: string) => mockIsIntegrationScheme(scheme),
 }));
 
 // Mock DB RIS service
@@ -455,6 +457,53 @@ describe("GET /places/:id", () => {
     expect(mockLookupByCoords).toHaveBeenCalled();
   });
 
+  it("returns 404 for an integration scheme whose resolver didn't register", async () => {
+    // Mirrors the failure mode that produced the original leak: a data-
+    // source integration (here scooter-sharing) is installed — its manifest
+    // is on disk so `isIntegrationScheme` returns true — but its `setup()`
+    // threw at boot, so no resolver was registered. Without this gate the
+    // route would fall through to lookupByCoords and substitute the
+    // nearest OSM POI's tags onto the scooter.
+    mockIsIntegrationScheme.mockImplementation((scheme) => scheme === "scooter-sharing");
+
+    const res = await app.inject({
+      method: "GET",
+      url: `/places/${encodeURIComponent("scooter-sharing:dott-123")}?${qs({
+        lat: "50.7764",
+        lng: "6.0889",
+        name: "Dott E-Scooter",
+      })}`,
+    });
+
+    expect(res.statusCode).toBe(404);
+    expect(mockLookupByNameAndCoords).not.toHaveBeenCalled();
+    expect(mockLookupByCoords).not.toHaveBeenCalled();
+
+    mockIsIntegrationScheme.mockReturnValue(false);
+  });
+
+  it("allows coord-fallback for a non-integration freeform scheme (stylePoi)", async () => {
+    // `stylePoi` is emitted by the web client when the user clicks a basemap
+    // POI symbol. It corresponds to no integration manifest, so the route
+    // should let the name+coord lookup run as today — that's how we get the
+    // OSM POI's full enrichment when the user genuinely asked for it.
+    mockLookupByNameAndCoords.mockResolvedValue(MOCK_PLACE);
+    mockGetPlaceKnowledge.mockResolvedValue({ externalIds: {} });
+    mockBuildReviewLinks.mockReturnValue([]);
+
+    const res = await app.inject({
+      method: "GET",
+      url: `/places/${encodeURIComponent("stylePoi:abc")}?${qs({
+        lat: "52.52",
+        lng: "13.37",
+        name: "Some POI",
+      })}`,
+    });
+
+    expect(res.statusCode).toBe(200);
+    expect(mockLookupByNameAndCoords).toHaveBeenCalled();
+  });
+
   it("returns 404 when neither lookup returns a result", async () => {
     mockLookupByNameAndCoords.mockResolvedValue(null);
     mockLookupByCoords.mockResolvedValue(null);

apps/api/src/routes/places.ts

@@ -31,7 +31,7 @@ import {
   type PlaceResolverContext,
 } from "@openmapx/place-ids";
 import type { FastifyPluginAsync } from "fastify";
-import { getAllIntegrations } from "../integration-host.js";
+import { getAllIntegrations, isIntegrationScheme } from "../integration-host.js";
 import { getPlaceKnowledge } from "../services/knowledge/index";
 import { buildReviewLinks } from "../services/review-links";
 import { TTL, withCache } from "../utils/cache.js";
@@ -384,6 +384,25 @@ export const placesRoute: FastifyPluginAsync = async (fastify) => {
               }
               return enrichPlace(resolved, lang);
             }
+            // No resolver registered for this scheme. The coord-fallback
+            // below would happily snap to the nearest OSM POI — fine for
+            // freeform UI schemes (saved labels, basemap POI clicks,
+            // Street View drops) that aren't backed by any integration,
+            // dangerous for an integration whose `setup()` failed and
+            // never got to register its resolver. The manifest registry
+            // tells us which is which: any scheme matching an installed
+            // integration id is strict; everything else is freeform.
+            if (isIntegrationScheme(parsedId.scheme)) {
+              fastify.log.warn(
+                { scheme: parsedId.scheme, rawId },
+                "places: integration scheme has no resolver; refusing coord-fallback",
+              );
+              const err: CacheableError = {
+                statusCode: 404,
+                message: `No resolver for scheme '${parsedId.scheme}'`,
+              };
+              throw err;
+            }
           }
 
           // Coord-fallback path for schemes without a registered resolver

integrations/data-source/resolver.ts

@@ -15,14 +15,26 @@
  */
 
 import { createPlace } from "@openmapx/core";
-import type { MobilityDataSourceProvider } from "@openmapx/integration-framework";
+import type { MobilityDataSourceProvider, OsmIdentity } from "@openmapx/integration-framework";
 import {
   lookupAddressByCoords,
   lookupByOsmFilters,
 } from "@openmapx/integration-geocoding/place-lookup";
 import { VEHICLE_ID_PREFIX } from "@openmapx/mobility-core/mapper";
 import type { PlaceResolver } from "@openmapx/place-ids";
 
+async function fetchIdentity(
+  provider: MobilityDataSourceProvider,
+  itemId: string,
+): Promise<OsmIdentity | undefined> {
+  try {
+    const detail = await provider.getDetail(itemId);
+    return detail.data?.identity;
+  } catch {
+    return undefined;
+  }
+}
+
 export function createDataSourceResolver(provider: MobilityDataSourceProvider): PlaceResolver {
   const scheme = provider.id;
   const osmFilters = provider.meta.osmFilters;
@@ -35,13 +47,20 @@ export function createDataSourceResolver(provider: MobilityDataSourceProvider):
 
     const isVehicle = value.startsWith(VEHICLE_ID_PREFIX);
 
+    // When the provider supplies an identity for the item (operator / ref /
+    // network / brand), constrain the OSM snap to candidates that match it.
+    // Providers that don't yet expose `identity` on their detail get the
+    // legacy nearest-match behaviour — the gate inside `lookupByOsmFilters`
+    // ignores identity when none is passed.
+    const identity = osmFilters && !isVehicle ? await fetchIdentity(provider, value) : undefined;
+
     // Providers without an OSM equivalent (webcams, scooters, …) skip the
     // Overpass lookup and return an address-only Place so the panel can
     // still show something sensible. Free-floating vehicles take the same
     // path even when the provider's stations would normally snap to OSM.
     let place =
       osmFilters && !isVehicle
-        ? await lookupByOsmFilters(lat, lng, osmFilters, `${scheme}:${value}`)
+        ? await lookupByOsmFilters(lat, lng, osmFilters, `${scheme}:${value}`, identity)
         : null;
 
     // Skip the reverse-geocode fallback when the caller already has an

integrations/ev-charging/providers/station-mapper.ts

@@ -1,6 +1,26 @@
-import type { DataSourceDetail, DataSourceDetailSection, DataSourceResult } from "@openmapx/core";
+import type {
+  DataSourceDetail,
+  DataSourceDetailSection,
+  DataSourceResult,
+  OsmIdentity,
+} from "@openmapx/core";
 import type { EvChargingConnector, EvChargingStation } from "@openmapx/mobility-core/ev-charging";
 
+function stationIdentity(station: EvChargingStation): OsmIdentity | undefined {
+  const operator = station.operator?.name;
+  const legal = station.operator?.legalName;
+  if (!operator && !legal) return undefined;
+  const identity: OsmIdentity = {};
+  if (operator) {
+    identity.operator = operator;
+    identity.brand = operator;
+  }
+  if (legal && legal !== operator) {
+    identity.network = legal;
+  }
+  return identity;
+}
+
 function getMaxPower(station: EvChargingStation): number {
   return station.connectors.reduce((max, connector) => {
     if (connector.powerKw && connector.powerKw > max) return connector.powerKw;
@@ -138,6 +158,7 @@ export function mapStationToDetail(station: EvChargingStation): DataSourceDetail
     sources: station.sources,
     name: station.name,
     coordinates: station.coordinates,
+    identity: stationIdentity(station),
     attributions: station.attributions,
     address: station.address,
     operator: station.operator,

integrations/fuel/providers/mapper.ts

@@ -1,7 +1,17 @@
-import type { DataSourceDetail, DataSourceDetailSection, DataSourceResult } from "@openmapx/core";
+import type {
+  DataSourceDetail,
+  DataSourceDetailSection,
+  DataSourceResult,
+  OsmIdentity,
+} from "@openmapx/core";
 import type { FuelStation } from "@openmapx/mobility-core/fuel";
 import opening_hours from "opening_hours";
 
+function stationIdentity(station: FuelStation): OsmIdentity | undefined {
+  if (!station.brand) return undefined;
+  return { brand: station.brand, operator: station.brand };
+}
+
 interface OpeningTime {
   text: string;
   start: string;
@@ -103,6 +113,7 @@ export function mapFuelStationToDetail(station: FuelStation): DataSourceDetail {
     sources: [extractSourcePrefix(station.id)],
     name: station.name,
     coordinates: station.coordinates,
+    identity: stationIdentity(station),
     address: station.address ? { line1: station.address } : undefined,
     operator: station.brand ? { name: station.brand } : undefined,
     sections,
@@ -185,6 +196,7 @@ export function buildTankerkoenigDetail(
     sources: ["tankerkoenig"],
     name: station.name,
     coordinates: station.coordinates,
+    identity: stationIdentity(station),
     address: station.address ? { line1: station.address } : undefined,
     operator: station.brand ? { name: station.brand } : undefined,
     openingHours: tankerkoenigToOsmHours(tankerkoenigRaw),