Apex Roads - React Native Mobile App (WIP)
A mobile-first social platform for driving and motorcycle enthusiasts. Route planning, live navigation, XP progression, community challenges, and group ride coordination - all in one app.
GitHub
This repository is private. The source code is available for review upon request - feel free to get in touch.
About the project
Apex Roads is built for road drivers and motorcycle enthusiasts - think Strava, but for cars and bikes. Users log routes, earn XP, climb leaderboards, share photos, and organize group rides. The app combines an interactive map engine powered by OSRM and Leaflet, a real-time social layer over WebSockets, a gamification system with geo-fenced quests, and live GPS tracking - all on a single PostgreSQL-backed Node.js API with image delivery via Cloudflare R2.
Features
- Plot A-to-B routes on an interactive map using OSRM routing engine
- Preview routes as a polyline before driving - navigate turn-by-turn inside the app
- Save routes with a title, description, and photos after a drive
- Make routes public to share with the community or keep them private
- Instagram-style image feed - post photos with captions, like, comment, and share via DMs
- Full real-time DM system with typing indicators, read receipts, and online presence
- Follow / unfollow users, view follower and following lists, block accounts
- Report inappropriate content - reviewed in the admin web panel
- Claim geo-located XP spots (fuel stations, parking) sourced live from OpenStreetMap via Overpass API
- Season-based quests with geo-fenced checkpoints - app auto-checks GPS and awards XP on arrival
- Earn XP by attending group meetups within 500 m of the pin location
- Global and friends-only leaderboard, filterable by 7 days, 30 days, or all-time
- Drop a pin on the map to create a scheduled group meetup with a date and description
- Other users browse and join upcoming meets from the community tab
- Attendees within 500 m of the location automatically claim +100 XP when the meet starts
- Expired meets and past events are auto-cleaned by a nightly cron job
Tech Stack
Mobile App
- React Native (Expo SDK 54)
- React Navigation v7 - Stack + Bottom Tabs
- Leaflet.js inside a WebView (map rendering)
- OSRM - route calculation & turn-by-turn
- OpenStreetMap Overpass API (XP spots)
- expo-location - real-time GPS tracking
- Axios with JWT interceptors & auto token refresh
Backend
- Node.js + Express.js
- PostgreSQL - connection pooling via pg
- WebSocket (ws) - real-time DMs on same HTTP server
- JWT (1-day access) + bcryptjs (12 salt rounds)
- Multer + Sharp + Cloudflare R2 (image storage)
- node-cron - nightly scheduled cleanup jobs
- express-rate-limit - brute-force & abuse protection
Admin Panel
- React (Vite) - standalone web app
- Axios - same backend API
- JWT auth (7-day token) + separate admin endpoint
- adminMiddleware - second auth layer on all admin routes
- Content moderation dashboard - review reports, take down posts'
Security
Auth & Sessions
- bcrypt password hashing - 12 salt rounds
- JWT access tokens - 1-day expiry, never stored in DB
- Refresh token rotation - old token deleted on every refresh
- 80-char cryptographically random refresh tokens (crypto.randomBytes)
- Nightly cron purges all expired refresh tokens
API Protection
- Auth endpoints rate-limited: 10 req / 15 min per IP
- Global rate limit: 1000 req / 15 min per IP
- authMiddleware validates JWT before any handler runs
- adminMiddleware - second layer check on all admin routes
- WebSocket auth: first frame must carry a valid JWT
Data & Files
- Parameterized SQL queries throughout - SQL injection impossible
- MIME-type file whitelist: JPEG, PNG, WebP only
- Sharp strips EXIF metadata (incl. GPS) on every upload'
- 8 MB upload cap enforced by Multer before processing
- Files in Cloudflare R2 CDN - R2 objects deleted on post/avatar delete
Gallery
