featureslist.md

GroundShare — Features List

Presentation-ready inventory of every user-facing and behind-the-scenes feature. Grouped by area; duplicates merged. For the technical/architectural deep-dive (controllers, caching strategies, integrations config) see features.md.

---

Auth & Accounts

1. Welcome / landing screen — First entry point for guests
2. Login — Email + password sign-in
3. Register — New account creation
4. Google OAuth sign-in — "Sign in with Google" (ID token validated locally)
5. Social login buttons (web + native) — Unified Google login UI across platforms
6. Logout — Revoke session + clear cookie
7. Forgot password — Request a reset link
8. Reset password — Set new password via token, revoke all sessions
9. Password reset email (Resend) — Sends the reset link by email
10. Complete profile — Fill missing details after first login
11. Onboarding flow — Guided setup for new users
12. Skip onboarding — Bypass onboarding steps
13. First-time questions — Initial survey / preferences capture
14. Phone number update — Edit phone on profile
15. Account deletion (with confirmation modal) — Permanently remove the account, confirmed first
16. Auth security stack — JWT identity for protected routes · access token kept in memory only (XSS hardening) · refresh-token rotation (single-winner) · token reuse detection (revokes sessions) · httpOnly refresh cookie on web · refresh token in body on native · CSRF guard on the cookie path · constant-time BCrypt verify
17. Registration name moderation (Content Safety) — Blocks abusive display names at signup

Address Search & Geo

18. Address search — Look up any address
19. Address info panel (bottom sheet, tabs) — Sliding results panel with tabbed sections
20. Overview section — Summary stats for the address
21. Planning status section — Construction / permits / plans view
22. Events section — Community reports for the address
23. AI summary section — AI-generated address overview
24. Active planning-items count chip — Live badge of non-completed planning + disruption items, shown on the תכנון tab
25. Forward geocoding — Address → coordinates
26. Reverse geocoding — Coordinates → address
27. Reverse-geocode fallback for NULL-coord locations — Recovers coords when missing
28. Places autocomplete (Google) — Google address suggestions
29. Address autocomplete (data.gov.il / CBS) — City / street suggestions from open data
30. Parcel info (gush / chelka) — Land parcel identifiers
31. Planning status lookup — Fetches official planning data (Tel Aviv GIS, iplan/MAVAT fallback)
32. MAVAT plan-lifecycle events — National plan milestones (deposited / approved / gazette) shown when outside Tel Aviv
33. Nearby disruptions lookup — Official municipal disruptions around a point
34. Cross-layer disruption deduplication — Collapses the same job listed across overlapping GIS layers (polygon + point + night-work) into one entry, keeping the best geometry
35. Disruption coordinate backfill — Geocodes the address for GIS rows missing geometry so they still get a marker + distance (coordSource: geometry | geocoded)
36. Zoning (ייעוד) chip popover — Expands all zonings on tap
37. Active permit count chip — Shows live permit count
38. Location resolve (address → location_id) — Maps an address to a DB location
39. Location stats — Aggregated stats for a location
40. Deep-linkable address search — Open a specific report via URL / state

Interactive Map

41. Google Maps rendering — Base interactive map
42. Roadmap / streets view — Standard street map mode
43. Satellite view toggle — Switch to aerial imagery
44. Tel Aviv GIS satellite tiles — TLV orthophoto overlay
45. Satellite labels overlay — Street labels on satellite view
46. Map overlay system (markers / circles) — Screens push markers / circles to the map
47. Smooth pan-to — Animated camera movement
48. Drop-a-pin on map (+ prompt card) — Place a pin by tapping; action card appears for it
49. Map controls toggle — Show / hide map controls
50. Map layer toggle — Switch map layers
51. Radius circle for nearby reports — Visualizes the search radius
52. Persistent map layout — Map stays mounted across screens 52a. Building footprint overlay (BuildingsOverlay) — Draws official TLV building outlines (GIS layer 513) as a single google.maps.Data layer; viewport-tiled (0.01° grid), parallel-fetched, deduplicated by geometry string (not id_binyan), and anti-flicker (layer attached once, visibility toggled via setStyle, no per-feature animation, mutations only on debounced idle) 52b. House-number labels overlay (AddressNumbersOverlay) — Renders TLV house numbers (GIS layer 527) as map labels, viewport-fetched in native EPSG:2039 and reprojected; zoom-gated and separately toggleable alongside the building-footprint layer in the map controls 52c. Persistent home-address marker (HomeMarker) — The user's home address is rendered once in MapLayout so it stays visible across all map screens

Events, Voting, Comments & Reviews

53. Community event reporting — Residents report disruptions
54. Multi-step event creation (location / details / description) — Wizard for new reports
55. Event cards — Compact report display
56. Event success screen — Confirmation after creating a report
57. Nearby reports list — Reports around the user
58. Nearby event cards — Cards for nearby community reports
59. Nearby disruption cards — Cards for official disruptions
60. Distance-sorted nearby results — Events + disruptions decorated with and ordered by distance from the user
61. Event voting (upvote / downvote) — Community signal on reports
62. Comments (with live character counter) — Discussion on a report
63. Reviews — User reviews on a location
64. Add / edit review (with live character counter) — Submit or update a review
65. Text length limits — Comments / reviews / event descriptions capped, with client-side counters
66. Text moderation (Content Safety + Hebrew blocklist) — Filters abusive text

Favorites

67. Favorites / bookmarks — Save addresses
68. Favorite toggle — Add / remove a bookmark
69. Favorite check — Check if a location is saved
70. Saved address cards — List of saved addresses

Address Comparison & AI

71. Address comparison (0–100 score) — Side-by-side address scoring
72. Rule-based scoring (penalty-from-ceiling) — Starts high, deducts for disruptions
73. Confidence-weighted sentiment scoring — Reviews adjust score by data confidence
74. Data-coverage confidence (backend) — Quality flag for how much data backs a score
75. Cross-layer GIS dedup in scoring — Comparison reuses the disruption dedup so overlapping layers aren't double-counted
76. Winner banner — Highlights the better address
77. Winner reasons — Explains why one address won
78. Comparison table — Criterion-by-criterion breakdown
79. Comparison history — Past saved comparisons
80. AI address summary (Gemini) — LLM-written address summary
81. AI summary caching — Avoids re-calling the LLM for same input
82. AI Q&A assistant — Ask free-text questions in the dictionary
83. Deterministic local summary fallback — Used when the AI key / call fails

Notifications

84. Push notifications (FCM) — Device push delivery (web + native)
85. In-app notification feed — Notification list inside the app
86. Notification deep-linking — Tap lands on the relevant report
87. Notification bell badge — Unread count on the bell
88. Drawer notification count badge — Unread count in the menu
89. Notification summary banner — Top-of-feed summary
90. Mark notification seen — Clears unread state
91. Dismiss notification — Remove from feed
92. Location subscription toggle (+ check) — Follow / unfollow a location and query state
93. GPS proximity notifications — Alerts for events near the user
94. GPS preference get / set / delete — Manage GPS notification settings
95. Device registration (FCM token) — Registers the push token
96. Invalid token auto-cleanup — Removes dead FCM tokens
97. FCM fan-out on event creation — Notifies home-address + GPS-proximity subscribers (200 m)

Gamification (Personal Area)

98. Personal area screen — User's gamification dashboard
99. XP system — Earn points for activity
100. Levels (7 tiers) — Rank progression from XP (תושב חדש → אגדה עירונית)
101. Badges from stats — Awards based on user activity
102. Weekly missions (ISO-week rotation) — Rotating weekly goals
103. Mission claim + XP reward — Claim completed missions for XP
104. Activity streak — Consecutive-activity tracking
105. Comment-count stat tracking — Comments-written stat fed into missions / progress
106. Stat boxes / cards — Visual stat tiles
107. Last-activity deep-linking — Jump back to the exact item / tab

Clustering, Relevance & Onboarding

108. Neighborhood clustering (ML / K-Means) — Groups neighborhoods by livability
109. Auto-K via silhouette score — Auto-picks cluster count
110. Livability score per neighborhood — Computed score per area
111. Good / medium / bad neighborhood labels — Human-readable cluster labels
112. Cluster overlay toggle — Show / hide clusters on map
113. Neighborhood overlay — Renders neighborhood polygons
114. Neighborhood detail sheet — Tapping a neighborhood opens details
115. Clustering diagnostics — Admin / debug clustering info
116. Event relevance check-ins — Ask reporters if a report is still relevant
117. Relevance confirmation modal — UI to confirm / dismiss relevance
118. Pending confirmations — Reports awaiting the user's confirmation
119. Confirm relevance (ownership-enforced) — Only the reporter can confirm
120. Onboarding questions — Collects user role / preferences (saved via PUT /users/onboarding → sp_SaveOnboarding)
121. Onboarding thank-you screen — Post-questions confirmation

Reference Data & Uploads

122. Cities reference data — City list for pickers
123. Streets reference data — Streets per city
124. Event types reference data — Categories for reports
125. Plan status reference data — Planning status options
126. Address part normalization — Cleans / normalizes address text
127. File / image uploads — Attach images to content
128. Image upload modal — Upload UI
129. Browser-side image compression — Shrinks images before upload
130. 5-layer file validation — Multi-step upload safety checks
131. SAS-signed blob URLs — Time-limited private file access

Static Pages & Settings

132. Smart dictionary (term lookup) — Planning-term glossary
133. FAQ — Frequently asked questions
134. Legal — Terms / privacy pages
135. Settings & profile — User settings hub
136. Home address management (+ dedicated editor) — Set / update home address 136a. Contact / bug-report form — In-app modal that emails the support inbox via Resend (replaces the old mailto: link that failed silently on mobile); input HTML-encoded server-side, rate-limited
137. Drawer / hamburger menu — Side navigation menu
138. Top search bar — Persistent search entry
139. Bottom navigation bar — Primary app navigation

PWA & Offline

140. PWA offline support — App works without network
141. PWA install prompt / banner (A2HS) — Prompts to add the app to home screen
142. Service worker caching (Workbox) — Caches assets / responses
143. Per-domain runtime cache strategies — Tailored caching per source
144. NetworkOnly live-data bypass — Forces fresh data for time-sensitive APIs
145. Offline banner (network status) — Shows when device is offline
146. Firebase messaging service worker — Handles background push

Native (Capacitor)

147. iOS shell — Native iOS app wrapper
148. Android shell — Native Android app wrapper
149. Camera — Capture photos natively
150. Geolocation (coarse + high-accuracy watchers) — Native location tracking
151. Push notifications — Native push integration
152. Filesystem — Native file access
153. Keyboard — Native keyboard handling
154. Status bar — Native status-bar styling
155. Splash screen — Native launch screen
156. Android hardware back button — Handles the OS back button
157. Swipe-back gesture — Swipe-to-go-back navigation
158. Safe-area insets — Respects notches / home indicators

UI / UX

159. Hebrew / RTL layout — Right-to-left interface
160. Heebo + Poppins fonts — Hebrew + Latin typography
161. Aurora background + decorations — Animated gradient backdrop and decorative elements
162. Animated collapse — Smooth expand / collapse sections
163. Scroll hint — Cue that content scrolls
164. Onboarding app tour (replayable) — Guided walkthrough with step highlights, re-runnable
165. Phone-frame desktop preview — Mobile frame shown on desktop
166. Motion animations — UI motion / transitions
167. Click-outside handling — Closes popovers on outside click
168. Debounced inputs — Throttles rapid input events

Backend Cross-Cutting

169. Rate limiting (per-endpoint + global) — Throttles abuse per IP
170. FluentValidation input validation — Schema-based request validation
171. Global exception handling (ApiResponse envelope) — Uniform error responses
172. Security headers (CSP, HSTS, X-Frame-Options, etc.) — Hardening HTTP headers
173. Serilog logging (two-stage bootstrap) — Structured logging
174. PII log redaction — Masks sensitive data in logs
175. Request-logging middleware — Logs requests (excludes secrets)
176. Strongly-typed options with ValidateOnStart — Config validated at startup
177. CORS policy — Restricts allowed origins
178. Swagger / OpenAPI (dev) — API explorer in development
179. Sensitive-action audit log — Records security-relevant actions
180. ADO.NET DAL (stored procedures, no EF) — Manual data access via SPs 180a. Real-client-IP resolution behind Cloudflare — Forwarded-headers middleware + CF-Connecting-IP so rate limiting and audit logs see the true caller, not the proxy hop 180b. UTC date serialization — JSON converters normalize all API DateTimes to UTC ISO-8601, so clients parse dates consistently

Background Services

181. Neighborhood seed service (startup, one-shot) — Seeds neighborhood polygons
182. Clustering background job — Wakes hourly, recomputes neighborhood clusters when the last result is >1 day old
183. Relevance background job — Wakes every 6h, prompts reporters to confirm relevance when the last prompt is >20h old
184. GitHub Actions daily cron pokes — cluster-daily / relevance-daily hit the admin run-now endpoints (the free-tier App Service sleeps on idle, so the in-process timers alone aren't enough) 184a. Token-protected admin run-now endpoints — Clustering / relevance recompute gated by an X-Admin-Token header (Key Vault Admin--Token); runs fire-and-forget (202) so the App Service request timeout can't kill them, and the last-run timestamp updates only on success

CI/CD & Infra

185. Azure App Service hosting (API + frontend) — Cloud hosting
186. CI pipeline (build, typecheck, unit tests, audit) — Automated checks on push; backend xUnit + frontend vitest run on every PR, vulnerability checks block merge 186a. Security-header static host — Frontend served by a zero-dep server.cjs that injects CSP (report-only), HSTS, X-Frame-Options, nosniff, Permissions-Policy
187. CD pipeline (gated deploy on main) — Controlled production deploys
188. Post-deploy health checks — Verifies deploy succeeded
189. Health check endpoint — Liveness probe for load balancer
190. Secret scanning (gitleaks, pre-commit + CI) — Blocks committed secrets
191. CodeQL security analysis — Static security scanning
192. Single re-runnable DB schema script — Idempotent schema source of truth
193. ResetData script (wipe user data, keep schema) — Resets DB for testing

External Services & Integrations

Each row is one external dependency: what we use it for and the account/service behind it.

194. Azure subscription (Israel Central) — Cloud platform hosting all infrastructure
195. Azure App Service — Hosts the API and the frontend
196. Azure SQL Database — Primary datastore (managed SQL Server)
197. Azure Key Vault — Production secrets via Managed Identity
198. Azure Blob Storage — Image / file storage
199. Azure AI Content Safety — Text / image moderation API
200. Hebrew blocklist moderation — Local Hebrew abuse filter (runs before Content Safety)
201. Azure Application Insights — Telemetry, logs, traces, metrics
202. Google Cloud / Maps Platform — Maps, geocoding, Places autocomplete
203. Google Gemini API — AI summaries and Q&A
204. Google OAuth 2.0 — "Sign in with Google" identity provider
205. Firebase project (FCM) — Push messaging + client config
206. Resend — Transactional email: password-reset links + in-app contact/bug-report submissions (domain verified in Resend dashboard)
207. Tel Aviv ArcGIS (gisn.tel-aviv.gov.il) — Municipal GIS disruption / plan layers + satellite tiles
208. iplan / MAVAT (ags.iplan.gov.il) — National planning data (legacy TLS)
209. data.gov.il (CBS) — Open-data city / street datasets
210. Cloudflare — DNS for groundshare.app; proxies api.groundshare.app → Azure API (same-site so the refresh cookie works)
211. groundshare.app custom domain — Production domain added via Cloudflare DNS
212. GitHub — Source repo + Actions CI/CD + CodeQL + secret scanning
213. @capgo/capacitor-social-login — Native Google login plugin