refactor: unify attribution into manifest dataSources and remove per-item attribution objects

Replace inline attribution objects on DataSourceDetail, SharedMobilityStation, SharedMobilityVehicle, and weather responses with a sourceId-based lookup system that resolves attribution from integration manifest dataSources at render time. This eliminates hardcoded attribution objects scattered across providers and consolidates all licensing/attribution metadata into the single source of truth established by the dataSources manifest schema.

Core type changes:
- DataSourceDetail: replace `source: string` with `sources: string[]`, remove `attribution` field
- DataSourceMeta: remove `id`, `name`, `attribution`, `categoryChipLabel` (now sourced from manifest)
- DataSourceProvider.getDetail() now returns `DataSourceDetail | null` instead of synthetic fallback objects
- DataSourceFilterDef: add `clientSide?: boolean` flag for filters applied locally instead of sent to API
- DataSourceDetailSection: add `image` and `embed` section types with imageUrl/embedUrl/embedType fields, add `videocam` and `warning` section icons
- SharedMobilityStation/Vehicle: replace `source: string` + `attribution` with `sources: string[]`
- IntegrationDataSource: add required `sourceId` field to all ~90 manifest dataSources entries
- WeatherResponse: remove inline `attribution` object, use `source` field for registry lookup

Attribution rendering:
- Add `buildSourceAttribution()` and `extractSourcePrefix()` utilities to packages/core
- DataSourceSections: new AttributionFooter component resolves attribution from integration registry by matching source prefixes against manifest dataSources
- DataSourceLayer: build map attribution from visible result sources via registry lookup, recreate MapLibre source when attribution HTML changes
- PlaceWeather/WeatherWidget: resolve weather attribution from integration registry instead of inline object
- PhotoAttribution/PlacePhotoGallery: resolve photo source names and URLs from registry instead of hardcoded PHOTO_SOURCES map
- DataSourceFilterContent/DataSourceLayer: replace duplicated CLIENT_SIDE_FILTER_IDS set with shared `splitFilters()` and `applyClientSideFilters()` utilities using the new `clientSide` filter flag

Data source orchestrator:
- listWithFilters() now derives id, name, categoryChipLabel from integration manifest instead of provider meta
- data-source detail endpoint returns 404 when provider returns null instead of serving empty fallback

Provider cleanup (bike-sharing, car-sharing, ev-charging, fuel, scooter-sharing, parking):
- Remove all inline attribution objects from station/vehicle/result construction
- Remove fallback detail objects on cache miss (return null)
- Remove server-side speed filter from ev-charging (now client-side only)
- merge-stations: merge source arrays instead of attribution objects, remove mergeAttributions import

SSRF protection:
- Consolidate three duplicate URL validation implementations (gtfs/importer.ts, validate-url.ts, store.ts) into shared `validatePublicUrl()` from @openmapx/core
- Delete apps/api/src/utils/validate-url.ts
- Add validatePublicUrl() call to catalog source fetching

Parking integration expansion:
- Add 12 new parking data sources to manifest: RDW Netherlands, BNLS France, Ghent, Brussels, Basel, Florence, Barcelona, Vienna, Copenhagen, Singapore, Madrid, UTMC Newcastle, NSW Australia
- Add corresponding health checks, env vars (UTMC_USERNAME/PASSWORD, NSW_TRANSPORT_API_KEY, WINDY_WEBCAMS_API_KEY), and i18n strings
- Add new source headers for webcam sources (windy, osm-webcam, caltrans, tfl)

Opening hours:
- Handle unknown/unparseable opening hours gracefully (isUnknown flag) in PlaceOverviewTab and CategoryResultsContent instead of showing misleading open/closed status

Other fixes:
- PlaceDetailContent: use `bgcolor: "background.paper"` for sticky tabs instead of `inherit`
- CyclingBaseLayer: fix OSM attribution link text
- Overlay attribution text corrections (hiking, winter-sports)

Author: Medformatik

apps/api/.env.example

@@ -86,6 +86,10 @@ FIRMS_MAP_KEY=
 # Register at https://openchargemap.org/ and get an API key
 OPENCHARGEMAP_API_KEY=
 
+# Webcams: Windy Webcams API
+# Get a free API key at https://api.windy.com/keys
+WINDY_WEBCAMS_API_KEY=
+
 # Fuel prices: Tankerkoenig (Germany only)
 # Get a free API key at https://creativecommons.tankerkoenig.de/
 TANKERKOENIG_API_KEY=
@@ -101,6 +105,15 @@ DB_RIS_API_KEY=
 DB_PARKING_CLIENT_ID=
 DB_PARKING_API_KEY=
 
+# Parking: UTMC Tyne & Wear (Newcastle, UK)
+# Request credentials by emailing data@glasgow.gov.uk / NE Travel Data portal
+UTMC_USERNAME=
+UTMC_PASSWORD=
+
+# Parking: Transport for NSW (Sydney, Australia)
+# Register at https://opendata.transport.nsw.gov.au/ for a free API key
+NSW_TRANSPORT_API_KEY=
+
 # Deutsche Bahn: Shared Mobility GBFS (Call-a-Bike / StadtRad)
 # Register at https://developers.deutschebahn.com/ and subscribe to the Shared Mobility GBFS API
 DB_GBFS_CLIENT_ID=

apps/api/src/services/gtfs/importer.ts

@@ -3,46 +3,12 @@ import { createHash } from "node:crypto";
 import { existsSync, mkdirSync, readdirSync, readFileSync, rmSync, writeFileSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
+import { validatePublicUrl } from "@openmapx/core";
 import { gtfsDate, parseCsv, streamCsvBatches } from "./csv";
 import { sql } from "./db";
 
 const BATCH_SIZE = 5_000;
 
-// URL Validation
-
-const PRIVATE_IP_RANGES = [
-  /^127\./, // loopback
-  /^10\./, // 10.0.0.0/8
-  /^172\.(1[6-9]|2\d|3[01])\./, // 172.16.0.0/12
-  /^192\.168\./, // 192.168.0.0/16
-  /^169\.254\./, // link-local (AWS metadata)
-  /^0\./, // 0.0.0.0/8
-  /^100\.(6[4-9]|[7-9]\d|1[01]\d|12[0-7])\./, // 100.64.0.0/10 (CGNAT)
-  /^::1$/, // IPv6 loopback
-  /^f[cd]/, // IPv6 private
-  /^fe80:/, // IPv6 link-local
-];
-
-function validateDownloadUrl(url: string): void {
-  let parsed: URL;
-  try {
-    parsed = new URL(url);
-  } catch {
-    throw new Error("Invalid URL");
-  }
-  if (parsed.protocol !== "https:" && parsed.protocol !== "http:") {
-    throw new Error("Only HTTP(S) URLs are allowed");
-  }
-  const hostname = parsed.hostname;
-  if (
-    hostname === "localhost" ||
-    hostname === "" ||
-    PRIVATE_IP_RANGES.some((re) => re.test(hostname))
-  ) {
-    throw new Error("URLs targeting internal/private addresses are not allowed");
-  }
-}
-
 // Schema DDL
 
 function createSchemaDDL(schema: string): string {
@@ -191,7 +157,7 @@ function createServiceDaysDDL(schema: string): string {
 // Download & Extract
 
 function downloadAndExtract(url: string, tempDir: string): string {
-  validateDownloadUrl(url);
+  validatePublicUrl(url);
   mkdirSync(tempDir, { recursive: true });
   const zipPath = join(tempDir, "feed.zip");
 

apps/api/src/services/gtfs/index.ts

@@ -1,5 +1,4 @@
-import type { BBox } from "@openmapx/core";
-import { validatePublicUrl } from "../../utils/validate-url";
+import { type BBox, validatePublicUrl } from "@openmapx/core";
 import { sql } from "./db";
 import { dropGtfsSchema, importGtfsFeed } from "./importer";
 import type { CatalogFeed, FeedStatus, ImportedFeed } from "./types";

apps/api/src/services/motis/manager.ts

@@ -5,9 +5,8 @@ import { promisify } from "node:util";
 import { motisLocalInstance } from "@integrations/transit-motis/instances.js";
 import type { MotisFeed, MotisStatus } from "@integrations/transit-motis/types";
 import { stops } from "@motis-project/motis-client";
-import type { BBox } from "@openmapx/core";
+import { type BBox, validatePublicUrl } from "@openmapx/core";
 import { cacheGet, cacheSet } from "../../utils/cache.js";
-import { validatePublicUrl } from "../../utils/validate-url";
 
 const execFileAsync = promisify(execFile);
 

apps/api/src/services/store.ts

@@ -2,7 +2,12 @@ import { spawn } from "node:child_process";
 import { existsSync, readFileSync } from "node:fs";
 import { dirname, join } from "node:path";
 import { fileURLToPath } from "node:url";
-import { PLATFORM_VERSION, satisfiesPlatformVersion, USER_AGENT_ADMIN } from "@openmapx/core";
+import {
+  PLATFORM_VERSION,
+  satisfiesPlatformVersion,
+  USER_AGENT_ADMIN,
+  validatePublicUrl,
+} from "@openmapx/core";
 import { eq } from "drizzle-orm";
 import { db } from "../db";
 import { installedIntegration } from "../db/schema";
@@ -66,23 +71,14 @@ async function getExtraSources(): Promise<CatalogSource[]> {
 export async function addCatalogSource(url: string, label: string): Promise<void> {
   if (!redis) return;
 
+  validatePublicUrl(url);
   const parsed = new URL(url);
   if (parsed.protocol !== "https:") {
     throw new Error("Catalog source must use HTTPS");
   }
   if (parsed.username || parsed.password) {
     throw new Error("Catalog source URL must not contain credentials");
   }
-  const hostname = parsed.hostname.toLowerCase();
-  if (
-    hostname === "localhost" ||
-    hostname.endsWith(".local") ||
-    hostname.endsWith(".internal") ||
-    /^(127\.|10\.|172\.(1[6-9]|2\d|3[01])\.|192\.168\.|169\.254\.|0\.)/.test(hostname) ||
-    hostname === "[::1]"
-  ) {
-    throw new Error("Catalog source must not point to internal addresses");
-  }
 
   const existing = await getExtraSources();
   if (existing.some((s) => s.url === url)) return;
@@ -106,6 +102,7 @@ export async function listCatalogSources(): Promise<CatalogSource[]> {
 }
 
 async function fetchCatalogFromUrl(url: string): Promise<CatalogEntry[]> {
+  validatePublicUrl(url);
   const res = await fetch(url, {
     headers: { "User-Agent": USER_AGENT_ADMIN },
     signal: AbortSignal.timeout(15_000),

apps/web/src/components/map/layers/CyclingBaseLayer.tsx

@@ -11,7 +11,7 @@ const OSM_ATTRIBUTION = buildAttributionHtml({
   license: "CC-BY-SA",
   licenseUrl: "https://creativecommons.org/licenses/by-sa/2.0/",
   attribution:
-    '© <a href="https://www.openstreetmap.org/copyright" target="_blank" rel="noopener noreferrer">OpenStreetMap</a> contributors (<a href="https://creativecommons.org/licenses/by-sa/2.0/" target="_blank" rel="noopener noreferrer">CC-BY-SA</a>)',
+    '© <a href="https://www.openstreetmap.org/copyright" target="_blank" rel="noopener noreferrer">OpenStreetMap contributors</a> (<a href="https://creativecommons.org/licenses/by-sa/2.0/" target="_blank" rel="noopener noreferrer">CC-BY-SA</a>)',
 });
 
 const CYCLOSM_ATTRIBUTION = [

apps/web/src/components/map/layers/DataSourceLayer.tsx

@@ -1,33 +1,29 @@
 "use client";
 
-import type {
-  DataSourceAttribution,
-  DataSourceMeta,
-  DataSourceResult,
-  LngLat,
-} from "@openmapx/core";
+import type { DataSourceMeta, DataSourceResult, LngLat } from "@openmapx/core";
 import {
+  applyClientSideFilters,
+  buildSourceAttribution,
   PANEL,
+  splitFilters,
   useDataSourceSearch,
   useDataSourceStore,
   useDataSources,
+  useIntegrationRegistry,
   useOpeningHoursStore,
   usePlaceStore,
   useSidebarStore,
 } from "@openmapx/core";
 import type maplibregl from "maplibre-gl";
 import type { GeoJSONSource, Map as MaplibreMap, MapMouseEvent } from "maplibre-gl";
-import { useCallback, useEffect, useMemo, useRef, useState } from "react";
+import { useCallback, useEffect, useMemo, useRef } from "react";
 import { usePinMarker } from "@/hooks/usePinMarker";
 import { INTERACTIVE_LAYER_IDS } from "@/lib/interactiveLayers";
 import { useMap } from "@/lib/MapContext";
 import { createMarkerSvg } from "@/lib/markerSvg";
 import { getFirstSymbolLayerId } from "./layerStyleUtils";
 import { useLayerReanchor } from "./useLayerReanchor";
 
-/** Filter IDs that are applied client-side instead of being sent to the API. */
-const CLIENT_SIDE_FILTER_IDS = new Set(["operator", "speed"]);
-
 function sourceId(dsId: string) {
   return `ds-${dsId}`;
 }
@@ -40,21 +36,7 @@ function labelsLayerId(dsId: string) {
   return `ds-${dsId}-labels`;
 }
 
-function buildGeoJson(
-  results: DataSourceResult[],
-  attribution: DataSourceAttribution | DataSourceAttribution[],
-  imageId?: string,
-) {
-  const attrs = Array.isArray(attribution) ? attribution : [attribution];
-  const attrHtml = attrs
-    .map((a) => {
-      const name = `<a href="${a.url}">${a.text}</a>`;
-      if (!a.license) return name;
-      const license = a.licenseUrl ? `<a href="${a.licenseUrl}">${a.license}</a>` : a.license;
-      return `${name} (${license})`;
-    })
-    .join(", ");
-
+function buildGeoJson(results: DataSourceResult[], attributionHtml: string, imageId?: string) {
   return {
     type: "FeatureCollection" as const,
     features: results.map((r) => ({
@@ -74,7 +56,7 @@ function buildGeoJson(
         ...(imageId ? { imageId } : {}),
       },
     })),
-    attribution: attrHtml,
+    attribution: attributionHtml,
   };
 }
 
@@ -157,23 +139,23 @@ export function DataSourceLayer() {
 
   const { data: sourcesData } = useDataSources();
   const prevSourceRef = useRef<string | null>(null);
+  const prevAttrRef = useRef<string>("");
 
   // Find meta for the active source
   const activeMeta = useMemo(() => {
     if (!activeSource || !sourcesData?.sources) return null;
     return sourcesData.sources.find((s) => s.id === activeSource) ?? null;
   }, [activeSource, sourcesData]);
 
-  // Separate client-side vs server-side filters
-  const serverFilters = useMemo(() => {
-    const result: Record<string, unknown> = {};
-    for (const [key, value] of Object.entries(filters)) {
-      if (!CLIENT_SIDE_FILTER_IDS.has(key)) {
-        result[key] = value;
-      }
-    }
-    return result;
-  }, [filters]);
+  const registry = useIntegrationRegistry();
+
+  // Separate server-side filters (sent to the API) from client-side filters
+  // (applied locally on the result set). Uses the `clientSide` flag from
+  // provider filter definitions instead of a hardcoded list.
+  const serverFilters = useMemo(
+    () => splitFilters(filters, activeMeta?.filters ?? []).serverFilters,
+    [filters, activeMeta?.filters],
+  );
 
   // Only fetch if zoom >= minZoom, using searchBbox (not viewportBbox)
   const shouldFetch =
@@ -187,71 +169,22 @@ export function DataSourceLayer() {
     serverFilters,
   );
 
-  // Accumulate results across searches (useState so map re-renders on new data)
-  const [accumulatedMap, setAccumulatedMap] = useState(() => new Map<string, DataSourceResult>());
-  const prevActiveRef = useRef(activeSource);
-  const prevFiltersRef = useRef(serverFilters);
-  const prevSearchBboxRef = useRef(searchBbox);
-
-  useEffect(() => {
-    if (
-      prevActiveRef.current !== activeSource ||
-      prevFiltersRef.current !== serverFilters ||
-      prevSearchBboxRef.current !== searchBbox
-    ) {
-      setAccumulatedMap(new Map());
-      prevActiveRef.current = activeSource;
-      prevFiltersRef.current = serverFilters;
-      prevSearchBboxRef.current = searchBbox;
-      return;
-    }
-
-    if (searchResults) {
-      setAccumulatedMap((prev) => {
-        const next = new Map(prev);
-        for (const r of searchResults) next.set(r.id, r);
-        return next;
-      });
-    }
-  }, [activeSource, serverFilters, searchBbox, searchResults]);
-
-  const allResults = useMemo(() => Array.from(accumulatedMap.values()), [accumulatedMap]);
-
-  // Apply client-side operator/speed filters
-  const filteredResults = useMemo(() => {
-    if (allResults.length === 0) return [];
-
-    let results = allResults;
-
-    const speedFilter = filters.speed;
-    if (speedFilter) {
-      const speedValues = Array.isArray(speedFilter)
-        ? (speedFilter as string[])
-        : [String(speedFilter)];
-      if (speedValues.length > 0) {
-        const speedSet = new Set(speedValues);
-        results = results.filter((r) => speedSet.has(r.variant));
-      }
-    }
-
-    const operatorFilter = filters.operator;
-    if (operatorFilter) {
-      const operatorValues = Array.isArray(operatorFilter)
-        ? (operatorFilter as string[])
-        : [String(operatorFilter)];
-      if (operatorValues.length > 0) {
-        const operatorSet = new Set(operatorValues);
-        results = results.filter((r) => r.operator && operatorSet.has(r.operator));
-      }
-    }
-
-    // "Open now" filter from the opening hours chip
-    if (openingHoursFilter === "open_now") {
-      results = results.filter((r) => r.variant === "open");
-    }
+  // Apply client-side filters (speed, operator, opening hours) to the search
+  // results from React Query. No manual accumulation — React Query is the
+  // single source of truth and handles caching/staleness.
+  const filteredResults = useMemo(
+    () => applyClientSideFilters(searchResults ?? [], filters, openingHoursFilter),
+    [searchResults, filters, openingHoursFilter],
+  );
 
-    return results;
-  }, [allResults, filters.speed, filters.operator, openingHoursFilter]);
+  // Build map attribution from only the sources present in visible results
+  const mapAttribution = useMemo(() => {
+    if (!activeSource || filteredResults.length === 0) return "";
+    const meta = registry.get(activeSource);
+    if (!meta?.dataSources) return "";
+    const visibleSources = [...new Set(filteredResults.map((r) => r.source))];
+    return buildSourceAttribution(meta.dataSources, visibleSources);
+  }, [activeSource, registry, filteredResults]);
 
   // Show pin marker for hovered item
   const hoveredResult = filteredResults.find((r) => r.id === hoveredItemId) ?? null;
@@ -339,9 +272,15 @@ export function DataSourceLayer() {
 
       const useIconMarkers = activeMeta.markerStyle.type === "icon";
       const imageId = useIconMarkers ? `ds-marker-${activeSource}` : undefined;
-      const geojson = buildGeoJson(filteredResults, activeMeta.attribution, imageId);
+      const geojson = buildGeoJson(filteredResults, mapAttribution, imageId);
+
+      // MapLibre doesn't support updating source attribution after creation,
+      // so recreate the source when attribution changes.
+      if (map.getSource(sid) && prevAttrRef.current !== geojson.attribution) {
+        removeLayers(map, activeSource);
+      }
+      prevAttrRef.current = geojson.attribution;
 
-      // Update or create GeoJSON source
       if (map.getSource(sid)) {
         (map.getSource(sid) as GeoJSONSource).setData(geojson);
       } else {
@@ -452,7 +391,16 @@ export function DataSourceLayer() {
     return () => {
       map.off("styledata", syncLayer);
     };
-  }, [activeSource, activeMeta, filteredResults, viewportZoom, mapReady, styleVersion, mapRef]);
+  }, [
+    activeSource,
+    activeMeta,
+    filteredResults,
+    viewportZoom,
+    mapReady,
+    styleVersion,
+    mapRef,
+    mapAttribution,
+  ]);
 
   const { setSelectedPlace } = usePlaceStore();