anti cheat: don't trust the client, move trip completions to server

server/kml.go

@@ -687,7 +687,10 @@ func HandleUserProfile(w http.ResponseWriter, r *http.Request) {
 
 	// Fetch completed trips
 	rows, err := db.Query(`
-		SELECT ct.id, ct.trip_type, ct.route_name, ct.start_address, ct.end_address, ct.kml_id, ct.distance, ct.completed_at,
+		SELECT ct.id, ct.trip_type, ct.route_name, 
+		       COALESCE(ct.start_address, '') as start_address, 
+		       COALESCE(ct.end_address, '') as end_address, 
+		       ct.kml_id, ct.distance, ct.completed_at,
 		       m.filename, m.user_id, u.display_name, m.description,
 		       COALESCE((SELECT SUM(vote) FROM kml_votes WHERE kml_id = m.id), 0) as votes
 		FROM completed_trips ct
@@ -731,51 +734,3 @@ func HandleUserProfile(w http.ResponseWriter, r *http.Request) {
 }
 
 // HandleTripComplete records a completed trip
-func HandleTripComplete(w http.ResponseWriter, r *http.Request) {
-	if r.Method != http.MethodPost {
-		http.Error(w, "Method not allowed", http.StatusMethodNotAllowed)
-		return
-	}
-
-	userID, ok := getUserID(r.Context())
-	if !ok {
-		http.Error(w, "Unauthorized", http.StatusUnauthorized)
-		return
-	}
-
-	var req struct {
-		Type         string  `json:"type"`
-		RouteName    string  `json:"route_name"`
-		StartAddress string  `json:"start_address"`
-		EndAddress   string  `json:"end_address"`
-		KmlFilename  string  `json:"kml_filename"`
-		KmlOwnerID   string  `json:"kml_owner_id"`
-		Distance     float64 `json:"distance"`
-	}
-
-	if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
-		http.Error(w, "Invalid request body", http.StatusBadRequest)
-		return
-	}
-
-	var kmlID interface{} = nil
-	if req.Type == "kml" {
-		var id int
-		err := db.QueryRow("SELECT id FROM kml_metadata WHERE user_id = ? AND filename = ?", req.KmlOwnerID, req.KmlFilename).Scan(&id)
-		if err == nil {
-			kmlID = id
-		}
-	}
-
-	_, err := db.Exec(`
-		INSERT INTO completed_trips (user_id, trip_type, route_name, start_address, end_address, kml_id, distance)
-		VALUES (?, ?, ?, ?, ?, ?, ?)
-	`, userID, req.Type, req.RouteName, req.StartAddress, req.EndAddress, kmlID, req.Distance)
-
-	if err != nil {
-		http.Error(w, fmt.Sprintf("Failed to save completed trip: %v", err), http.StatusInternalServerError)
-		return
-	}
-
-	w.WriteHeader(http.StatusOK)
-}