MOB-10 — Location, maps & consent foundation
Permission and consent flow, location service with accuracy handling, tolerance check helper, Google Maps setup per flavor, launch of external navigation, GPS-off and out-of-tolerance states.
| Field | Details |
|---|---|
| Task code | MOB-10 |
| Phase | P0 — Foundations (cadrage, UX/UI, architecture & contract) |
| Product scope | V1 |
| Status | Planned |
| Start | Wed 4 Nov 2026 |
| Due | Thu 5 Nov 2026 |
| Responsible | Imad — Mobile developer (Flutter) |
| Co-responsible | — |
| Effort | 1.25 person-day(s) planned · 4 from scratch · size S |
| Area · app | Mobile foundation · mobile |
| Depends on | MOB-05 |
| Unblocks | MDA-03, MDA-12 |
| Milestones | — |
Summary
Permission and consent flow, location service with accuracy handling, tolerance check helper, Google Maps setup per flavor, launch of external navigation, GPS-off and out-of-tolerance states.
Description
Check-in, field sign-up and tour sampling all depend on reliable positions and on informed consent (GEO-03, FLD-07, FLD-15, SEC-07). Scope: hoco_maps — the permission and consent flow DA-04 explaining what is collected and when, a location service returning a GeoFix (lat, lng, accuracy, timestamp, isMocked) with an accuracy wait, a tolerance helper (150 m distance, accuracy ≤ 100 m, both from settings), Google Maps setup per flavor, launch of external navigation, and the GPS-off, permission-denied and out-of-tolerance states of DA-28. Background sampling is MDA-12 and the check-in screen is MDA-03. It needs from Anis the field settings exposed to the app (field.gpsToleranceMeters, field.gpsMaxAccuracyMeters, sampling policy, retention) and a way to record consent; Akram's DES-11 consent and DES-14 system-state frames. MDA-03, MDA-05, MDA-07 and MDA-12 call this package.
Subtasks
| # | Subtask | Owner |
|---|---|---|
| 1 | ConsentScreen DA-04: plain-French explanation (positions taken only while a tour is « En cours », every 5 min or 200 m, kept 90 days), « J'accepte » before the system prompt; consent version and timestamp stored and sent to the server (endpoint to confirm with Anis) | Imad |
| 2 | PermissionService over geolocator/permission_handler: while-in-use location, notification permission for the foreground service, permanently-denied path to app settings | Imad |
| 3 | LocationService.getFix(): high accuracy, keep listening up to 20 s until accuracy ≤ field.gpsMaxAccuracyMeters, returns GeoFix with isMocked; last known fix for offline use | Imad |
| 4 | ToleranceChecker: haversine distance to the point of sale, result {withinTolerance, distanceMeters, accuracyOk}; values from settings with 150 m / 100 m defaults | Imad |
| 5 | Google Maps per flavor: API keys restricted to package name + SHA-1 per flavor, manifest placeholders, HOCO map style, marker set (planned, done, not done, next) | Imad |
| 6 | ExternalNavigation.launch(lat, lng): google.navigation intent, Google Maps directions URL fallback, Waze if installed | Imad |
| 7 | DA-28 states: « GPS désactivé » with open-settings action, permission denied, low accuracy with retry, out of tolerance with distance shown, mock location warning (GPS_MOCK_LOCATION) | Imad |
| 8 | Expose field settings (tolerance, accuracy, sampling, retention, allowOutOfToleranceCheckIn) to the delegate app via appConfig or delegate.profile | Anis |
Deliverables
- packages/hoco_maps/lib/src/location/ (permission, location, tolerance)
- packages/hoco_maps/lib/src/map/ (HocoMap widget, markers, style) and navigation launcher
- apps/delegate/lib/src/features/consent/ (DA-04)
- Google Cloud API keys per flavor, restricted
Acceptance criteria
- The system location prompt never appears before the DA-04 explanation has been accepted (SEC-07)
- getFix returns within 20 s with accuracy ≤ 100 m outdoors, or an explicit low-accuracy result the UI shows (GEO-03)
- A fix 140 m from the point of sale is within tolerance and one at 160 m is not, with the default 150 m; changing the setting changes the result without a release (FLD-15)
- GPS off, permission denied and mocked locations each show their DA-28 state with a recovery action
- « Itinéraire » opens Google Maps navigation to the point of sale; without Google Maps a browser directions link opens (FLD-07)
Requirements covered
| Requirement | Title | Release |
|---|---|---|
| GEO-03 | GPS capture standard (lat/lng, accuracy, timestamp) and distance computation | V1 |
| FLD-07 | Map and navigation: position, next destination with ETA and distance, external GPS navigation, arrival confirmation within tolerance | V1 |
| FLD-15 | Location policy: consent, frequency, tolerance and retention configurable and transparent | V1 |
| SEC-07 | Geolocation consent and transparency for delegates | V1 |
| INT-01 | Maps provider (Google Maps or Mapbox) for maps, routes and geocoding | V1 |
Screens
| Screen | Name | App |
|---|---|---|
| DA-04 | Permissions & location consent | DA |
| DA-28 | System states (offline, GPS off, out of tolerance, permission denied, forced update) | DA |
Test measures
- Unit tests of ToleranceChecker (boundaries at 150 m, accuracy 101 m) and of the accuracy-wait logic with a fake position stream
- Widget tests of the DA-28 states
- Device test outdoors and indoors on two mid-range Android phones measuring time-to-fix and accuracy
Risks
- Indoor accuracy in shops often exceeds 100 m — show the live accuracy, let the delegate step outside and retry, and rely on the justified out-of-tolerance check-in if the setting allows it
- Maps API cost and key leakage — restrict keys per app signature and monitor quota in Google Cloud
KPI
- Delivered by Thu 5 Nov 2026 within 1.25 person-day(s).
- Every acceptance criterion above demonstrated before hand-off; linked requirements' acceptance criteria pass.
- Zero open critical defects, permission gaps or data-integrity regressions at sign-off.
Generated from content/plan/tasks.json by scripts/generate-team-tasks.mjs. Dates are computed by the scheduler (Sunday–Thursday weeks, holidays excluded) — change the plan, not this page.
MOB-09 — Offline foundation for the delegate app (local DB + outbox sync)
hoco_offline: drift database for tours/visits/resellers/tasks, outbox of idempotent mutations with ordered replay through /sync/batch, delta pulls, conflict surfacing, sync status stream.
MOB-11 — Media capture & uploads
Camera/gallery capture, compression, EXIF-free uploads to pre-signed URLs with retry, offline upload queue for the delegate app.