Every map surface (/ Live, /incidents/[id] detail) renders full-screen API KEY REQUIRED / carto.com/basemaps watermarks instead of tiles. basemaps.cartocdn.com now requires an apikey (or is rate-limiting our origin). The map is the product centerpiece and is currently illegible.
Fix: add NEXT_PUBLIC_MAP_TILE_URL as a build-arg in the frontend image build step, value e.g. https://tile.openstreetmap.org/{z}/{x}/{y}.png (raster, no {s}/{r}) or a keyed provider, then redeploy. Code side already reads it.
Found in live audit 2026-09-07, Version 5C/UI_AUDIT_0907b.md finding 1. Relates to #109.
CI build-arg added on branch fix/117-map-tile-build-arg (local commit fe64392, pending push/PR/deploy).
.gitea/workflows/deploy.yml "Build & push frontend" step now passes NEXT_PUBLIC_MAP_TILE_URL=https://tile.openstreetmap.org/{z}/{x}/{y}.png alongside the Firebase/C2 build-args, so the var is baked into the Next bundle at CI build time like the rest of the public config. The {z}/{x}/{y} Leaflet placeholders are literal in the YAML.
Separately, the MapView.tsx fallback URL is being switched from Carto to OSM on the #118 branch so prod recovers from the "API KEY REQUIRED" watermarks even before this workflow change deploys.
CI build-arg added on branch `fix/117-map-tile-build-arg` (local commit fe64392, pending push/PR/deploy).
`.gitea/workflows/deploy.yml` "Build & push frontend" step now passes `NEXT_PUBLIC_MAP_TILE_URL=https://tile.openstreetmap.org/{z}/{x}/{y}.png` alongside the Firebase/C2 build-args, so the var is baked into the Next bundle at CI build time like the rest of the public config. The `{z}/{x}/{y}` Leaflet placeholders are literal in the YAML.
Separately, the `MapView.tsx` fallback URL is being switched from Carto to OSM on the #118 branch so prod recovers from the "API KEY REQUIRED" watermarks even before this workflow change deploys.
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Every map surface (
/Live,/incidents/[id]detail) renders full-screenAPI KEY REQUIRED/carto.com/basemapswatermarks instead of tiles.basemaps.cartocdn.comnow requires an apikey (or is rate-limiting our origin). The map is the product centerpiece and is currently illegible.Cause:
components/MapView.tsxwas changed this session toprocess.env.NEXT_PUBLIC_MAP_TILE_URL || "https://{s}.basemaps.cartocdn.com/dark_all/{z}/{x}/{y}{r}.png", butNEXT_PUBLIC_MAP_TILE_URLwas never added to the frontend build args in.gitea/workflows/deploy.yml. Firebase public config is baked at CI build time via build-args; this var needs the same treatment. Prod bundle therefore still ships the dead Carto URL (attribution still reads© CARTO).Fix: add
NEXT_PUBLIC_MAP_TILE_URLas a build-arg in the frontend image build step, value e.g.https://tile.openstreetmap.org/{z}/{x}/{y}.png(raster, no{s}/{r}) or a keyed provider, then redeploy. Code side already reads it.Found in live audit 2026-09-07,
Version 5C/UI_AUDIT_0907b.mdfinding 1. Relates to #109.CI build-arg added on branch
fix/117-map-tile-build-arg(local commitfe64392, pending push/PR/deploy)..gitea/workflows/deploy.yml"Build & push frontend" step now passesNEXT_PUBLIC_MAP_TILE_URL=https://tile.openstreetmap.org/{z}/{x}/{y}.pngalongside the Firebase/C2 build-args, so the var is baked into the Next bundle at CI build time like the rest of the public config. The{z}/{x}/{y}Leaflet placeholders are literal in the YAML.Separately, the
MapView.tsxfallback URL is being switched from Carto to OSM on the #118 branch so prod recovers from the "API KEY REQUIRED" watermarks even before this workflow change deploys.