FuelBoard Contributor
2ed18d81a3
- BACKLOG.md: P0-P3 roadmap incl. govuk API switch (blocked on credentials) - APPSTORE.md: review-gate analysis (2 blockers: LAN data source, Always-location notes) - SECURITY.md: audit - no secrets, no ATS holes, one MEDIUM (relay IP in binary, planned fix) - FuelBoardTests/: SPM package, 28 tests on real Shared/ sources (sanitizer, price guard, RAG, sort, distance, brands) - Logos: proper 2x/3x pairs, palette-quantized, 75% smaller (315KB -> 79KB) - App icon: 1024px fuelpump on gradient (was missing entirely -> instant rejection) - decodeStations(from:) exposed for testability; relay fetch reuses it
87 lines
4.4 KiB
Markdown
87 lines
4.4 KiB
Markdown
# FuelBoard App Store Approval Review
|
||
|
||
Review date: 2026-08-11 · Target: App Store submission readiness.
|
||
This is the companion to SECURITY.md — focuses on App Store *review* gate
|
||
(guideline compliance), not code security.
|
||
|
||
## Status: NOT SUBMISSION-READY
|
||
|
||
Two blockers remain before a real submission (see below). Everything else
|
||
checks out for review.
|
||
|
||
## Blockers
|
||
|
||
### 1. Data source — LAN relay (BLOCKER)
|
||
- The app fetches from `http://192.168.1.131:8788` — a private LAN host. Off
|
||
the user's network it fails and falls back to sample data. Reviewers on
|
||
Apple's network will see empty/sample results → 2.1 (performance) rejection,
|
||
and hardcoded IPs look like test builds.
|
||
- **Fix**: the govuk API switch (BACKLOG P0). App must talk to a public HTTPS
|
||
endpoint before submission. The relay (HTTPS domain) or direct gov.uk OAuth
|
||
both work; the code path is already stubbed.
|
||
|
||
### 2. Always-location justification (BLOCKER without review notes)
|
||
- `NSLocationAlwaysAndWhenInUseUsageDescription` + `UIBackgroundModes: location`
|
||
present, but guideline 5.1.1 requires the feature to be obvious AND the app
|
||
must visibly use background location. The geofenced "cheapest station" alerts
|
||
satisfy this, but the reviewer must see it:
|
||
- Provide detailed App Review notes explaining the alert flow (enable Alerts →
|
||
geofence trigger → notification when approaching the cheapest station).
|
||
- Ensure the Alerts tab is discoverable and functional in review.
|
||
- Also: "Always" prompt should only appear after the user opts into alerts
|
||
(in-progress UX; currently the permission prompt may fire too early).
|
||
|
||
## Review-relevant configuration — PASS
|
||
|
||
- [x] **App icon**: was MISSING entirely (invalid-binary rejection). Fixed —
|
||
1024×1024 `AppIcon.appiconset` + `ASSETCATALOG_COMPILER_APPICON_NAME`.
|
||
- [x] **Launch screen**: `UILaunchScreen` empty dict present (iOS 14+ style).
|
||
- [x] **Device family**: iPhone-only (`TARGETED_DEVICE_FAMILY = 1`) — no iPad
|
||
multitasking requirements.
|
||
- [x] **Versioning**: `CFBundleShortVersionString 1.0`, `CFBundleVersion 1`
|
||
(bump per release).
|
||
- [x] **Permissions**: only location (WhenInUse + Always), with clear usage
|
||
strings. No contacts/photos/mic/camera.
|
||
- [x] **No third-party SDKs** → no SDK privacy manifests or third-party
|
||
attribution required.
|
||
- [x] **No account creation / login** → no account-deletion requirement (5.1.1(v)).
|
||
- [x] **ATS**: no `NSAllowsArbitraryLoads` (raw-IP cleartext is ATS-exempt; once
|
||
the relay is HTTPS this is moot).
|
||
- [x] **Export compliance**: no crypto beyond keychain/SecItem → no
|
||
documentation needed.
|
||
|
||
## Content / IP review
|
||
|
||
- **Brand logos (Shell, BP, Tesco…)**: bundled from Simple Icons (CC0) +
|
||
Wikimedia Commons. Nominative use (identifying stations) is standard practice
|
||
(cf. GasBuddy). Low risk, but keep the sources documented.
|
||
- **Price data**: gov.uk Fuel Finder data is OGL-licensed — include attribution
|
||
in the app (About/credits) once live data ships. Sample fallback data must be
|
||
clearly demo-labelled (or removed for review) so reviewers don't think the
|
||
prices are fake — 2.3.1 accuracy risk.
|
||
- **"Cheapest" claims**: data is 12h-old cache. The UI says "cheapest" — fine,
|
||
but a small "prices from the UK Fuel Finder dataset, updated twice daily"
|
||
footnote is good hygiene for 2.3.1.
|
||
|
||
## Suggested review notes (copy-paste for App Store Connect)
|
||
|
||
> FuelBoard shows the cheapest petrol, diesel, and premium fuel near the user
|
||
> using the UK government Fuel Finder dataset (OGL). Prices are fetched up to
|
||
> twice a day; the app filters 5/10/15-mile radii on-device. Location is used
|
||
> to (a) rank stations by distance and (b) power the optional Alerts feature:
|
||
> when enabled, the app geofences the cheapest station in the user's chosen
|
||
> radius and sends a notification when they approach it. Always-location is
|
||
> only requested when the user enables alerts. The app also provides a
|
||
> home-screen widget showing the current cheapest station nearby.
|
||
|
||
## Release checklist (before every submission)
|
||
|
||
1. [ ] Relay/govuk data source live on a public HTTPS endpoint
|
||
2. [ ] Always-permission flow tied to explicit user opt-in
|
||
3. [ ] Bump `CFBundleShortVersionString` / `CFBundleVersion`
|
||
4. [ ] Sample-data fallback labelled or removed in the release build
|
||
5. [ ] OGL attribution present in-app
|
||
6. [ ] `swift test` green (FuelBoardTests, 28 tests)
|
||
7. [ ] Security audit pass (see SECURITY.md recurring checks)
|
||
8. [ ] Icon + screenshots for all required sizes in App Store Connect
|