Validating in a test environment

Scope: this branch routes only gyms through Golbat (getAll/getOne/getAvailable). Pokestop markers/popups and stations still use SQL. Live validation needs Golbat #385 deployed with fort_in_memory = true.

1. Golbat prereqs — deploy #385, fort_in_memory = true; sanity-check (S=secret, G=golbat url):

curl -H "X-Golbat-Secret: $S" "$G/api/gym/available"
curl -H "X-Golbat-Secret: $S" -H 'Content-Type: application/json' -XPOST "$G/api/gym/scan" \
  -d '{"min":{"latitude":LAT1,"longitude":LON1},"max":{"latitude":LAT2,"longitude":LON2},"limit":1000,"filters":[]}'
curl -H "X-Golbat-Secret: $S" "$G/api/gym/id/<gym-id>"

2. ReactMap — git checkout feat/fort-consumer && yarn install, restart (server-only changes — no client rebuild).

3. Config — add endpoint + secret to the scanner DB source whose useFor includes gym (makes it a dual source). If you already did this for the Phase-1 pokestop test, gyms are already routed.

4. Confirm the endpoint path (logs):

• ReactMap, each ~15-min refresh: [GYMS] [GYM] loaded available from Golbat endpoint …/api/gym/available — …
• getAll/getOne are silent on success; a [GYM] /api/gym/scan … falling back to SQL warn = the endpoint failed → SQL.
• Golbat: available-gyms built in … each time getAvailable is hit.

5. Functional — gym + raid markers render; a popup shows team/slots/defenders and raid boss + moves + CP; the filter drawer populates teams, tiers (r), eggs (e), raid bosses.

6. Golden parity (endpoint vs SQL): curl "$R/api/v1/available/gyms?current=1" with fort_in_memory on (endpoint) vs off (SQL fallback); diff the two → expect match (bar time-sensitive active-raid keys).

7. Fallback — stop Golbat or set fort_in_memory=false → gyms should still render via SQL + the fallback warn appears (no hard endpoint dependency; a timeout falls back too).

8. Area restrictions — as an area-restricted user, confirm gyms appear only within permitted areas (exercises the new client-side filterRTree) — the one behavior that isn't a straight SQL mirror, so the most important to verify.

This is now in my production and I have verified the DNFs through manual testing

Both Codex findings addressed in f161a96:

• Pokestop endpoint-source gates (Pokestop.js): the endpoint getAll path now applies the hideOldPokestops freshness gate (and the onlyLevels/power_up_level gate — vestigial since power-ups are out of the game) on the mapped rows, matching what the SQL path and the gym endpoint path already do, so endpoint sources no longer render stale/wrong-level stops.
• Station.getDynamaxMons: now endpoint-aware — reads stationed_pokemon from the whole-record /api/station/id/{id} response when the source has an endpoint (fixing the this.query() throw on pure-endpoint station sources), falling back to SQL for dual/SQL sources.

The endpoint-backed fort paths contain an access-control bypass and several contract, filtering, and fallback regressions. These can expose restricted station data or omit valid stations, quests, and invasions despite successful lint and build checks.

Full review comments:

• [P1] Enforce strict-area denial before endpoint station scans — src/models/Station.js:785-785
  When authentication.strictAreaRestrictions is enabled, restrictions are configured, and a user has no assigned areas, this endpoint branch returns before the SQL path's getAreaSql guard. filterRTree returns true when both lists are empty, so the user receives every station in the viewport instead of []; apply the strict-area guard before accepting endpoint rows.

• [P1] Stop sending the unsupported station_active filter — server/src/filters/fort/station.js:37-37
  For every station request except inactive mode, this builder emits station_active, but the Golbat ApiFortDnfFilter contract targeted here has no such field—the companion work adds stationed_gmax, not station_active. Huma rejects unknown request properties, so endpoint-only station sources return no markers and dual sources always fall back to SQL; add the Golbat field/evaluator or stop sending it.

• [P1] Make advertised type-20 mega rewards retrievable — server/src/models/pokestopAvailableMapper.js:100-104
  When /api/fort/available reports a type-20 TEMP_EVO_BRANCH_RESOURCE with a Pokémon, this advertises an m... filter, but buildPokestopDnfFilters admits only reward type 12 and parseRdmRewards leaves non-empty type-20 rewards as u20. Selecting the advertised mega key therefore drops the row before or during secondary filtering, including the current m150-150 fallback; normalize and accept type 20 consistently in both scan stages.

• [P1] Treat endpoint incidents as confirmed-capable — server/src/models/Pokestop.js:900-900
  For a pure endpoint pokestop source, DbManager never populates hasConfirmed, even though scan rows carry confirmed and all lineup slots. Passing undefined here makes onlyConfirmed ineffective for selected invasion filters and makes confirmed a... filters use the grunt's possible encounter pool instead of the observed slots; the endpoint context and getFilterContext should explicitly model confirmed support.

• [P1] Preserve every active incident during DNF narrowing — server/src/filters/fort/pokestop.js:277-278
  When a stop has multiple active incidents, Golbat's fort DNF index exposes only one flat IncidentCharacter/IncidentDisplayType, while with_incidents:true returns the full incident array. Narrowing on these fields drops a stop whenever the selected invasion or event is not the one held in the flat lookup, so secondary filtering never sees a valid match; poison multi-incident filters to match-all or index all active incidents.

• [P2] Keep historical rarity queries on dual DB sources — server/src/services/DbManager.js:287-287
  When an existing scanner DB schema—normally using one source for Pokémon and forts—is made dual by adding endpoint, this assignment makes its Pokémon source mem truthy. historicalRarity() then substitutes [] for that bound source and clears the historical rarity map on refresh despite the DB still being available; distinguish a pure endpoint from a dual source in that skip condition.

• [P2] Apply result limits after local fort filters — server/src/models/Gym.js:542-542
  When a DNF scan has more than queryLimits.gyms candidates—for example, a large viewport where most candidates fail the user's area polygon—Golbat stops traversal at this limit before filterRTree, freshness checks, and secondaryFilter run. Valid matches later in the traversal are lost, unlike SQL's WHERE-before-LIMIT behavior; the same pre-residual cap is sent by pokestop and station scans, so push those gates upstream or defer the final cap until after local filtering.

• [P2] Return null on endpoint-only getOne misses — server/src/models/Gym.js:854-854
  When an endpoint-only source returns 404 or no response for a stale ID, fetchFortById returns null and execution reaches this SQL query. That model has no bound knex, so it throws; DbManager.getOne uses Promise.all, causing the whole gymsSingle request to fail—the identical fallback exists in Pokestop.getOne—instead of returning no match. Return null when there is no bound DB fallback.

• [P2] Include confirmed rewards from every rocket slot — server/src/models/pokestopAvailableMapper.js:176-177
  When map.misc.fallbackRocketPokemonFiltering is false, this mapper is the source of confirmed a... availability keys, but it reads only slot 1. The SQL path adds configured rewards from slots 1, 2, and 3, so endpoint-backed sources omit filters for confirmed rewards in later slots; expose and map all three slots.

Thanks for the thorough review, @Mygod. Walking through all nine — seven are addressed (across this PR and the Golbat companion #385), and two look like they were reviewed against a Golbat without #385's changes. Details below.

Fixed

• Add GraphQL Support #1 — strict-area denial before endpoint scans (P1). Confirmed bug: the endpoint paths filter with filterRTree, which returns true for empty area inputs, so a no-area user under strictAreaRestrictions was not denied the way the SQL getAreaSql denies. Added areaRestrictionsDenyAll (mirrors getAreaSql's strict-deny and empty-consolidated deny) and short-circuit each fort model's endpoint branch to []. — 15d82178
• Add Devices #3 — type-20 mega retrievable (P1). Root cause was upstream: Golbat's vendored proto didn't decode reward type 20 at all (empty info), which is what the m150-150 empty-info stopgap worked around. With Golbat Enable new Pokemon by default #382 merged (decodes TEMP_EVO_BRANCH_RESOURCE → pokemon_id/amount), type 20 is now treated as mega everywhere — SQL match/advertise/search, parseRdmRewards, and the endpoint DNF (quest_reward_type: [12, 20]) — and the GoFest stopgap is retired. — ReactMap cade9f68, Golbat c3acb26
• Refactoring #4 — endpoint incidents confirmed-capable (P1). A pure-endpoint pokestop source now reports hasConfirmed: true (the Golbat scan always returns confirmed lineup data; no DB schema check runs for a knex-less source). — f51f662e
• Add Ingress Portals #6 — historical rarity on dual sources (P2). historicalRarity() now skips only pure-endpoint sources (no bound knex) rather than any source with mem, so a dual source keeps contributing. — f51f662e
• Add weather #7 — fort scan result limit (P2). On the Golbat side, the fort scan traversal cap read Tuning.MaxPokemonResults; added a dedicated max_fort_results (default 9000) so the fort API can be tuned independently of pokemon. The per-request Limit still min()s it. — Golbat a3c82e5
• Add S2 Scan Cells #8 — getOne on endpoint-only misses (P2). DbManager.getOne now uses Promise.allSettled, so a pure-endpoint source whose by-id fetch misses (falling through to an unbound this.query()) no longer fails the whole single-fort lookup. — f51f662e
• Add Submission Cells #9 — confirmed rewards from every rocket slot (P2). Golbat's invasion availability exposed only slot 1; it now exposes slots 2/3 (FortLookupIncident/invasionKey/ApiPokestopInvasionAvailable), and the mapper advertises an a key per slot the event marks (second/thirdReward). Index cardinality is unchanged — a confirmed grunt's lineup is deterministic per character, so (character, slot1) already determines slots 2/3. — Golbat e8c4505, ReactMap fe24b481

Not reproduced (appear to predate Golbat #385)

• Add Initial Filtering Menus #2 — station_active unsupported filter. station_active is part of the Golbat ApiFortDnfFilter contract in the companion Correct Scrolling Issue #385: it's a declared field with an evaluator (isFortDnfMatch: *StationActive != (StationEndTimestamp > now)) and a dedicated test. Huma rejects only unknown properties, and this one is declared — so endpoint station sources are not rejected. Correct Scrolling Issue #385 adds both stationed_gmax and station_active.
• Add Spawnpoints #5 — multi-incident DNF drops stops. FortLookup.Incidents is a slice ([]FortLookupIncident), and isFortDnfMatch iterates all non-expired incidents with match-any semantics, not a single flat incident. ReactMap also emits incident_character and incident_display_type as separate clauses (never AND-ed within one), so a stop with the selected invasion in any active incident still matches. If you saw a drop against Correct Scrolling Issue #385's matcher I'm happy to dig into a specific repro.

All changes build/lint clean; Golbat decoder tests pass (incl. new slots-2/3 coverage). #3, #9, and the type-20 path assume a deployed Golbat ≥ #385 + #382.

I've taken the change to support slot2/slot3 availability and querying (which I previously had not added because these fields are always empty). Just like AR searching, these fields are legacy fields at the moment - but slot2/3 data coming back is something we would hope for though unlikely, whereas AR is something which is likely gone forever. A focused change later to drop AR data capture & reporting will be a wider impact in golbat