Location search not working

[nstjean]

Even on the example pages when I type in a location to search the spinner keeps spinning with nothing ever resolving.

I will try to figure out where the error is.

[welcome]

Thanks for opening your first issue here! Please follow the issue template to help us help you 👍🎉😄
If you have screenshots to share demonstrating the issue, that's really helpful! 📸 You can make a gif too!

[nstjean]

This is related to publiclab/plots2#6915

[nstjean]

When var autocomplete = new google.maps.places.Autocomplete(input); is called I am seeing this error:
js?libraries=places&language=en&key=AIzaSyDWgc7p4WWFsO3y0MTe50vF4l4NUPcPuwE:68 You have exceeded your daily request quota for this API. If you did not set a custom daily request quota, verify your project has an active billing account: http://g.co/dev/maps-no-account For more information on usage limits and the Google Maps JavaScript API services please see: https://developers.google.com/maps/documentation/javascript/usage

[nstjean]

So it looks like this bug is due to this: #160

[sagarpreet-chadha]

Wait, @jywarren why we can see key in the error log? I think this may be misused and most probably someone may be using it.
Let's hide it in some config bucket or environment variable.

Thanks @nstjean for investigating 😄 !!!

[nstjean]

Ohh, that's a very good point. I wonder if that's why it keeps saying exceeded daily quota? If someone else is using the key.

[jywarren]

Aha, indeed. I will investigate the quota, but can one of you look at how we're supposed to set it up so that it's not visible? I guess I'm not sure -- it has to be in the JS code, so it'll be hard to hide, won't it? Maybe what we need is to a) limit it to usage only from domain name PublicLab.org and b) use a key generated from our Google Apps account (this one may be a "free" tier one) so that we aren't held to a quota (we have plenty of free Cloud credits with Google). Does that sound right? Thanks for investigating!!!

…

On Fri, Dec 6, 2019 at 2:35 PM Natalie St Jean ***@***.***> wrote: Ohh, that's a very good point. I wonder if that's why it keeps saying exceeded daily quota? If someone else is using the key. — You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub <#214?email_source=notifications&email_token=AAAF6JYZFTB66HGSBW6GCLDQXKSPVA5CNFSM4JWY7ERKYY3PNVWWK3TUL52HS4DFVREXG43VMVBW63LNMVXHJKTDN5WW2ZLOORPWSZGOEGFEA6Q#issuecomment-562708602>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AAAF6J57RH7WPBIF6DQ5GJ3QXKSPVANCNFSM4JWY7ERA> .

[sagarpreet-chadha]

I think we can fetch the KEY from some private IP only once when our Server starts in production and store these private keys by making a new file inside our repo at runtime. Now using keys by pointing to this newly generated file. Also to put try/catch around the lines where private keys are used so that errors are not printed to console. Thanks!

…

On Sat, 7 Dec 2019, 04:21 Jeffrey Warren, ***@***.***> wrote: Aha, indeed. I will investigate the quota, but can one of you look at how we're supposed to set it up so that it's not visible? I guess I'm not sure -- it has to be in the JS code, so it'll be hard to hide, won't it? Maybe what we need is to a) limit it to usage only from domain name PublicLab.org and b) use a key generated from our Google Apps account (this one may be a "free" tier one) so that we aren't held to a quota (we have plenty of free Cloud credits with Google). Does that sound right? Thanks for investigating!!! On Fri, Dec 6, 2019 at 2:35 PM Natalie St Jean ***@***.***> wrote: > Ohh, that's a very good point. I wonder if that's why it keeps saying > exceeded daily quota? If someone else is using the key. > > — > You are receiving this because you were mentioned. > Reply to this email directly, view it on GitHub > < #214?email_source=notifications&email_token=AAAF6JYZFTB66HGSBW6GCLDQXKSPVA5CNFSM4JWY7ERKYY3PNVWWK3TUL52HS4DFVREXG43VMVBW63LNMVXHJKTDN5WW2ZLOORPWSZGOEGFEA6Q#issuecomment-562708602 >, > or unsubscribe > < https://github.com/notifications/unsubscribe-auth/AAAF6J57RH7WPBIF6DQ5GJ3QXKSPVANCNFSM4JWY7ERA > > . > — You are receiving this because you commented. Reply to this email directly, view it on GitHub <#214?email_source=notifications&email_token=ADSCRRJX2OFMWURM5FATJCDQXLJQZA5CNFSM4JWY7ERKYY3PNVWWK3TUL52HS4DFVREXG43VMVBW63LNMVXHJKTDN5WW2ZLOORPWSZGOEGFS6MI#issuecomment-562769713>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/ADSCRRJ2IAHYRUCJ3GLQ6ZLQXLJQZANCNFSM4JWY7ERA> .

[nstjean]

That's a good point, can't really hide it very easily in the Javascript. I think setting restrictions and using a try/catch block would do the trick... even if someone sees the code and gets the key they won't be able to use it.

Here's the page that specifies how to set restrictions: https://developers.google.com/maps/documentation/javascript/get-api-key

Just let me know what is the proper key to use and I'll make the changes.

[jywarren]

Hi, thanks for all this. I'm going to try to go through it carefully tomorrow. Can you start making a list of places where this happens, because we should check on the API key of each place, and make a permission for each originating domain name? Then I can go through each one and check it off and we won't miss any or have ambiguity. Make sense?

Thanks a ton!

[nstjean]

Ok, I'll start making a list!

[jywarren]

ah it just occurred to me that we should add permissions for Travis as well, so we can write a system test to make sure these work and are protected! Can you add that as a list item? Thanks!!

…

On Tue, Dec 10, 2019, 9:36 AM Natalie St Jean ***@***.***> wrote: Ok, I'll start making a list! — You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub <#214?email_source=notifications&email_token=AAAF6J3BEHW66XJK55RO5HLQX6SNDA5CNFSM4JWY7ERKYY3PNVWWK3TUL52HS4DFVREXG43VMVBW63LNMVXHJKTDN5WW2ZLOORPWSZGOEGPOF4Q#issuecomment-564060914>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AAAF6J56CIBJEGRT4DPPLNTQX6SNDANCNFSM4JWY7ERA> .

[nstjean]

Sure!

[nstjean]

So when looking for where this error shows up I discovered it shows up on every single page.

in plots2 we have this in application.html.erb - note that this is the only spot we are using this particular key, it's only for testing I guess.
https://github.com/publiclab/plots2/blob/319bcd0f40ffdfea83bae12866eef5baa6c8bcb6/app/views/layouts/application.html.erb#L16-L18

But we also are also declaring a key in these two places:
https://github.com/publiclab/plots2/blob/319bcd0f40ffdfea83bae12866eef5baa6c8bcb6/app/views/users/map.html.erb#L1
https://github.com/publiclab/plots2/blob/319bcd0f40ffdfea83bae12866eef5baa6c8bcb6/app/assets/javascripts/locationForm.js#L152-L156

But then on top of that we also have the same key being declared in 5 files in leaflet-blurred-location:

leaflet-blurred-location/examples/index.html

Line 8 in 1bff37c

<script src="https://maps.googleapis.com/maps/api/js?libraries=places&language=en&key=AIzaSyDWgc7p4WWFsO3y0MTe50vF4l4NUPcPuwE"></script>

leaflet-blurred-location/examples/simple.html

Line 7 in 1bff37c

<script src="https://maps.googleapis.com/maps/api/js?libraries=places&language=en&key=AIzaSyDWgc7p4WWFsO3y0MTe50vF4l4NUPcPuwE"></script>

leaflet-blurred-location/spec/javascripts/fixtures/index.html

Line 5 in 1bff37c

<script src="https://maps.googleapis.com/maps/api/js?libraries=places&language=en&key=AIzaSyDWgc7p4WWFsO3y0MTe50vF4l4NUPcPuwE"></script>

leaflet-blurred-location/src/core/Geocoding.js

Line 7 in 1bff37c

url:"https://maps.googleapis.com/maps/api/geocode/json?latlng="+lat+","+lng + "&key=AIzaSyDWgc7p4WWFsO3y0MTe50vF4l4NUPcPuwE",

leaflet-blurred-location/dist/Leaflet.BlurredLocation.js

Line 895 in 1bff37c

url:"https://maps.googleapis.com/maps/api/geocode/json?latlng="+lat+","+lng + "&key=AIzaSyDWgc7p4WWFsO3y0MTe50vF4l4NUPcPuwE",

leaflet-blurred-location/dist/Leaflet.BlurredLocation.js

Line 999 in 1bff37c

var url = "https://maps.googleapis.com/maps/api/geocode/json?address=" + string.split(" ").join("+") + "&key=AIzaSyDWgc7p4WWFsO3y0MTe50vF4l4NUPcPuwE" ;

Do we need all of those?? The instructions say

You must include an API key with every Maps JavaScript API request.

So I would think it would have to be sent with each map, not on every single page. And if it's being sent in leaflet-blurred-location it should it be sent from both the template in plots2 and the blurredlocation?

[jywarren]

Didn't get a chance to dig into this today, i'm sorry to say. But some quick initial feedback:

1. some of those usages are just in the example files, so wouldn't be reflected in bugs on plots2 (but thanks for finding them as we may have to adjust them to fix the examples!)
2. I think the Google API key policies have changed over the years and some of these lines of code may reflect earlier ways of using the key; i think possibly in earlier versions it was possible to include the key in the initial <script> include, but I'm not sure that's the case anymore.

So I think the key is this request i'm seeing in the console

https://maps.googleapis.com/maps/api/js?libraries=places&language=en&key=XXXXXXXXXXXXX

This seems to match what you're saying about needing to supply a correct API key for each. I'll check the keys against what the original <script> tag is showing and try replacing it with a new key.

error_message: "You must use an API key to authenticate each request to Google Maps Platform APIs. For additional information, please refer to http://g.co/dev/maps-no-account"

...confirming - the request actually sent in the "Network" pane of the webdev console shows this:

https://maps.googleapis.com/maps/api/place/js/AutocompletionService.GetPredictions?1ssomerville&4sen&15e3&20s612B0729-484D-4207-B6AE-15FB2518EA6B3y8qzg9czonp&21m1&2e1&callback=_xdc_._16q8my&key=XXXXXXXXXXXX&token=125951

So I think it's actually OK to be putting the key in the initial <script> include, and assuming it gets re-used on each request. Now i'll try to find a new key or trace the old one.

[jywarren]

Let's use this key, which should be limited to publiclab.org, mapknitter.org and publiclab.github.io: AIzaSyAOLUQngEmJv0_zcG1xkGq-CXIPpLQY8iQ

How do we figure out what domain Travis tests are run from? https://travis-ci.org/publiclab/plots2/jobs/623355464

[jywarren]

Opening an issue with these fixes; let's push to gh-pages branch and see if it works!

[jywarren]

We will have to do a similar search/replace PR on the plots2 instances!

[jywarren]

Tried the fix in #215, testing on gh-pages now!

[jywarren]

OK, awesome! Fixed the main issue! Now, I'm seeing the second bug as I just reported at
publiclab/plots2#6915 (comment)

i went to https://publiclab.org/post and tried using the input, i was able to use By place name and choose a location, but the map did not move and I got a loading spinner with the JS error:

Uncaught TypeError: Cannot read property 'geometry' of undefined
    at geocodeStringAndPan (Leaflet.BlurredLocation.js:1014)
    at Leaflet.BlurredLocation.js:956

I think maybe we're parsing the response of the locations api incorrectly?

OK! I've captured (lol) a sample response that I think we have to reconfigure around. I wonder when this changed and when it stopped working?

https://gist.github.com/jywarren/eec9fcec10528caaf463df6068846b0e

@nstjean would you like to try fixing that one? Thank you so much for your deep research, which made this easy to fix!

[nstjean]

@jywarren Sure I'll do that today! 😃

[nstjean]

This should be correct now, but I can't test it on my localhost.
#217

[sagarpreet-chadha]

Hey you can push this PR to gh-pages of LBL.
As @jywarren mentioned above the API key is valid for domain: publiclab.github.io
You can test this by checking into gh-pages branch in LBL and adding your changes in that branch and pushing it (if you do not have push access to gh-pages branch, you can make a new PR against gh-pages branch and i will merge it) 😄

[nstjean]

Oh ok!! I will try that out!

[nstjean]

PR for gh-pages: #218

Though when I go to publiclab.github.io I'm getting a 404 error.

[nstjean]

Oh I figured out what URL to use. :)

[nstjean]

Ok. I've pushed some changes (after some trial and error with refreshing the page!) to gh-pages so you can take a look. I've added checking for a status code and displaying the error if there is one instead of just spinning forever.

The error shown is:

{,…}
error_message: "You must enable Billing on the Google Cloud Project at https://console.cloud.google.com/project/_/billing/enable Learn more at https://developers.google.com/maps/gmp-get-started"
results: []
status: "REQUEST_DENIED"

@jywarren I believe the "cannot read geometry" error was due to there being no results, not because the parsing was incorrect!

[jywarren]

Ah, great! Then we can close that issue too; though perhaps we should just display something that says "no results" instead?

…

On Wed, Dec 11, 2019 at 2:27 PM Natalie St Jean ***@***.***> wrote: Ok. I've pushed some changes (after some trial and error with refreshing the page!) to gh-pages so you can take a look. I've added checking for a status code and displaying the error if there is one instead of just spinning forever. The error shown is: {,…} error_message: "You must enable Billing on the Google Cloud Project at https://console.cloud.google.com/project/_/billing/enable Learn more at https://developers.google.com/maps/gmp-get-started" results: [] status: "REQUEST_DENIED" @jywarren <https://github.com/jywarren> I believe the "cannot read geometry" error was due to there being no results, not because the parsing was incorrect! — You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub <#214?email_source=notifications&email_token=AAAF6JZQMJY2FTOWWPRQTGTQYE4YBA5CNFSM4JWY7ERKYY3PNVWWK3TUL52HS4DFVREXG43VMVBW63LNMVXHJKTDN5WW2ZLOORPWSZGOEGUIUPI#issuecomment-564693565>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AAAF6J6OHQBYTNDOP4E5GALQYE4YBANCNFSM4JWY7ERA> .

[nstjean]

I'd like to see if it performs correctly when the billing setting is correct just to make sure it works...

In normal use there wouldn't be no results I think, because it only gets sent if a user clicks on a city name while filling out the autocomplete, right? Though we could certainly put a a "no results" message on the screen near the box in case something like this happens again.

[jywarren]

Ah, that makes sense! Yes, and to be honest we could even add some kind of console error message that says something like "you may be rate limited" and links to this issue :-) since only devs would see it... Awesome!

…

On Wed, Dec 11, 2019 at 9:53 PM Natalie St Jean ***@***.***> wrote: I'd like to see if it performs correctly when the billing setting is correct just to make sure it works... In normal use there wouldn't be no results I think, because it only gets sent if a user clicks on a city name while filling out the autocomplete, right? Though we could certainly put a a "no results" message on the screen near the box in case something like this happens again. — You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub <#214?email_source=notifications&email_token=AAAF6J4XNDFKWWGEVFVC343QYGRBHA5CNFSM4JWY7ERKYY3PNVWWK3TUL52HS4DFVREXG43VMVBW63LNMVXHJKTDN5WW2ZLOORPWSZGOEGVI7QI#issuecomment-564826049>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AAAF6JZTXIOHCQ4KS2OAQWLQYGRBHANCNFSM4JWY7ERA> .

[nstjean]

Another thing I just thought of: If anyone tries to use LBL on a different they will have to update the API keys. I don't think there's any information about that on in the docs.

[nstjean]

I opened a pull request, but it's doing that thing where it shows a huge list of commits. I'll try looking up what I did last time this happened!

[nstjean]

I tried again thinking that it was my branch that was acting up because of using gh-pages. But brand new branch is doing the same thing. And all the tests are failing, so I'll try to figure out why it worked fine on gh-pages but not in a branch.