# OpenFreeMap and user application inventory

Current update: [chapter 16](16-connectivity-and-geolocation.md) supersedes the earlier Wi-Fi/cellular protection and location-collection status.
Implemented and checked through 26 September 2026. Chapter 34 is the authoritative location-history and manual-positioning description.

## Map integration

The Overview tab uses MapLibre GL JS 5.24.0 and the OpenFreeMap Liberty style at https://tiles.openfreemap.org/styles/liberty. The renderer, CSS and separate CSP worker are vendored locally from the official npm archive; its SHA-512 npm integrity was verified and BSD-3-Clause license retained under wwwroot/vendor/maplibre. No API key or external script CDN is required at runtime.

The portal permits map connections only to tiles.openfreemap.org in addition to its own origin. Workers remain same-origin; scripts do not need unsafe-eval. Referrer-Policy is no-referrer so customer/device page URLs are not included in map resource requests. The provider necessarily receives the viewer's IP and requested map areas. Map markers and identity labels remain local browser overlays. Attribution is retained for OpenFreeMap, OpenMapTiles and OpenStreetMap.

Map controls and status messages are localized in English and Spanish. Geographic labels prefer the chosen language where the source offers it, with local-name fallbacks. Provider attribution retains its original wording. Mobile controls are touch-sized; wheel zoom is disabled to preserve page scrolling. Provider/WebGL failures show a localized message without hiding available coordinate details.

No valid location means a general map and explicit no-location text, with no marker. A valid telemetry payload may contain:

```json
{
  "location": {
    "latitude": 0.0,
    "longitude": 0.0,
    "accuracyMeters": 25.0,
    "capturedAtUtc": "2026-09-23T12:00:00Z"
  }
}
```

These are schema examples, not this terminal's coordinates. Latitude/longitude must be finite and in range; accuracy must be nonnegative and the capture timestamp present and not more than five minutes in the future. Zero coordinates are valid. The card shows accuracy, capture time and a stale warning after 24 hours. Refresh follows the existing manual page refresh. The current Android agent advertises GPS support and reports a valid fix when Android permissions, location services and the physical environment provide one. Until then the portal shows **Waiting for a location fix** and no marker. The portal does not use browser geolocation or infer a terminal location from public IP.

The data service now keeps a location history for valid terminal reports. The first position is stored, and a later position is added only after the terminal has moved at least 100 meters from the last stored point. Smaller changes still update the current telemetry snapshot, but are omitted from history to suppress normal GPS precision drift. The device Overview shows the latest 200 stored points, newest first, and draws them as a route on the map. History is tenant-scoped and requires device read access.

Devices that do not report a valid location expose **Set location** on the Overview map to users with Devices write access. An operator can search for an address, click or drag a map pin, or type latitude and longitude. The saved position is identified as Manual in the history and produces an audit event. A correction within 100 meters updates the most recent manual point; a larger move creates another history entry. Once valid device telemetry includes a location, the manual editor is hidden and the service rejects manual changes so the terminal remains authoritative.

Address lookup is an explicit search action, not autocomplete. By default it uses the public Nominatim endpoint through the portal server, caches results for 24 hours, permits at most ten searches per signed-in user per minute, and serializes uncached requests to at most one per second. The dialog displays OpenStreetMap attribution. `GeocodingBaseUrl` can switch to an organization-managed or commercial Nominatim-compatible provider without updating the portal. Search text is sent to that configured provider; do not enter personal or confidential data when the public service is configured.

The selected style URL is currently fixed in device-map.js. Changing map provider also requires reviewing the CSP allowlist. Sources: [OpenFreeMap quick start](https://openfreemap.org/quick_start/) and [MapLibre documentation](https://maplibre.org/maplibre-gl-js/docs/).

## User application inventory

The Android agent filters launcher activities before collecting app metadata. Packages marked FLAG_SYSTEM or FLAG_UPDATED_SYSTEM_APP are excluded. For each remaining package it sends packageName, displayName (Android's application label), versionName and versionCode. Names are supplied by the device's installed application and language; the portal does not invent or translate them.

The inventory remains launcher-visible user applications, with up to 40 entries and a 20 KB application-array budget to leave space in the 32 KiB telemetry envelope. Labels/version strings are bounded, and truncated/incomplete inventory is indicated. Non-launchable services are outside this inventory. The portal shows display names prominently and package identifiers below, with a package fallback for older reports. Existing historical reports are not rewritten or purged; new reports exclude system packages.

Physical NEWPOS verification: the latest SQL telemetry contains one application, UIC Home / com.uic.tms.home.uic.newpos.debug, matching adb's third-party package inventory. System Settings, Gallery, vendor settings and other preinstalled applications are no longer sent. Updating the APK preserved enrollment and the settings passcode.

## Verification

- .NET Release build: zero warnings/errors; the current clean integration run passes 239 checks.
- New checks cover coordinate bounds, zero-valued coordinates, missing accuracy/timestamp, no fabricated marker, app label priority and legacy fallback.
- NEWPOS and NEXGO UIC Home 3.9.14-dev variants build and both physical devices report current resources/inventory.
- Live OpenFreeMap style, tiles and attribution loaded successfully in the portal; no browser map errors observed.
- Spanish map controls/labels and responsive layout verified at 390 px with no document-wide horizontal overflow.
- Verified NEWPOS and NEXGO inventory behavior and the A10-T Linux `userappl` inventory fields in the portal.