apt/fuelboard
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity
Files
1bdef59d789fbe0f551283126fd11f5e9a28d8a5
fuelboard/APPSTORE.md
T
FuelBoard Contributor 2ed18d81a3 Backlog, tests, logo compression, security audit, App Store icon 
- BACKLOG.md: P0-P3 roadmap incl. govuk API switch (blocked on credentials)
- APPSTORE.md: review-gate analysis (2 blockers: LAN data source, Always-location notes)
- SECURITY.md: audit - no secrets, no ATS holes, one MEDIUM (relay IP in binary, planned fix)
- FuelBoardTests/: SPM package, 28 tests on real Shared/ sources (sanitizer, price guard, RAG, sort, distance, brands)
- Logos: proper 2x/3x pairs, palette-quantized, 75% smaller (315KB -> 79KB)
- App icon: 1024px fuelpump on gradient (was missing entirely -> instant rejection)
- decodeStations(from:) exposed for testability; relay fetch reuses it
2026-08-11 23:14:28 +01:00

4.4 KiB
Raw Blame History

FuelBoard App Store Approval Review

Review date: 2026-08-11 · Target: App Store submission readiness. This is the companion to SECURITY.md — focuses on App Store review gate (guideline compliance), not code security.

Status: NOT SUBMISSION-READY

Two blockers remain before a real submission (see below). Everything else checks out for review.

Blockers

1. Data source — LAN relay (BLOCKER)

  • The app fetches from http://192.168.1.131:8788 — a private LAN host. Off the user's network it fails and falls back to sample data. Reviewers on Apple's network will see empty/sample results → 2.1 (performance) rejection, and hardcoded IPs look like test builds.
  • Fix: the govuk API switch (BACKLOG P0). App must talk to a public HTTPS endpoint before submission. The relay (HTTPS domain) or direct gov.uk OAuth both work; the code path is already stubbed.

2. Always-location justification (BLOCKER without review notes)

  • NSLocationAlwaysAndWhenInUseUsageDescription + UIBackgroundModes: location present, but guideline 5.1.1 requires the feature to be obvious AND the app must visibly use background location. The geofenced "cheapest station" alerts satisfy this, but the reviewer must see it:
    • Provide detailed App Review notes explaining the alert flow (enable Alerts → geofence trigger → notification when approaching the cheapest station).
    • Ensure the Alerts tab is discoverable and functional in review.
    • Also: "Always" prompt should only appear after the user opts into alerts (in-progress UX; currently the permission prompt may fire too early).

Review-relevant configuration — PASS

  • App icon: was MISSING entirely (invalid-binary rejection). Fixed — 1024×1024 AppIcon.appiconset + ASSETCATALOG_COMPILER_APPICON_NAME.
  • Launch screen: UILaunchScreen empty dict present (iOS 14+ style).
  • Device family: iPhone-only (TARGETED_DEVICE_FAMILY = 1) — no iPad multitasking requirements.
  • Versioning: CFBundleShortVersionString 1.0, CFBundleVersion 1 (bump per release).
  • Permissions: only location (WhenInUse + Always), with clear usage strings. No contacts/photos/mic/camera.
  • No third-party SDKs → no SDK privacy manifests or third-party attribution required.
  • No account creation / login → no account-deletion requirement (5.1.1(v)).
  • ATS: no NSAllowsArbitraryLoads (raw-IP cleartext is ATS-exempt; once the relay is HTTPS this is moot).
  • Export compliance: no crypto beyond keychain/SecItem → no documentation needed.

Content / IP review

  • Brand logos (Shell, BP, Tesco…): bundled from Simple Icons (CC0) + Wikimedia Commons. Nominative use (identifying stations) is standard practice (cf. GasBuddy). Low risk, but keep the sources documented.
  • Price data: gov.uk Fuel Finder data is OGL-licensed — include attribution in the app (About/credits) once live data ships. Sample fallback data must be clearly demo-labelled (or removed for review) so reviewers don't think the prices are fake — 2.3.1 accuracy risk.
  • "Cheapest" claims: data is 12h-old cache. The UI says "cheapest" — fine, but a small "prices from the UK Fuel Finder dataset, updated twice daily" footnote is good hygiene for 2.3.1.

Suggested review notes (copy-paste for App Store Connect)

FuelBoard shows the cheapest petrol, diesel, and premium fuel near the user using the UK government Fuel Finder dataset (OGL). Prices are fetched up to twice a day; the app filters 5/10/15-mile radii on-device. Location is used to (a) rank stations by distance and (b) power the optional Alerts feature: when enabled, the app geofences the cheapest station in the user's chosen radius and sends a notification when they approach it. Always-location is only requested when the user enables alerts. The app also provides a home-screen widget showing the current cheapest station nearby.

Release checklist (before every submission)

  1. Relay/govuk data source live on a public HTTPS endpoint
  2. Always-permission flow tied to explicit user opt-in
  3. Bump CFBundleShortVersionString / CFBundleVersion
  4. Sample-data fallback labelled or removed in the release build
  5. OGL attribution present in-app
  6. swift test green (FuelBoardTests, 28 tests)
  7. Security audit pass (see SECURITY.md recurring checks)
  8. Icon + screenshots for all required sizes in App Store Connect
Reference in New Issue View Git Blame Copy Permalink