Nearspot Store Finder for OpenStreetMap

Locations are a custom post type with an address and coordinates. A visitor
types a place, picks a radius, and gets the nearest locations as pins on a map
and as a list beside it. It ships as a shortcode and as a Bricks Builder
element.

What it does

• Search by address, postcode or city, with suggestions as you type and a
  search button beside the field
• A radius filter in kilometres or miles, and a result-count filter
• “Use my location”, which asks the browser for a position only when the
  visitor presses the button
• A category filter, backed by a taxonomy
• Marker clustering, which switches itself on once a locator would draw fifty
  pins, and which can be forced on or off
• A directions link from a result to OpenStreetMap or to Google Maps, or none
  at all, whichever the site chooses
• Bulk geocoding from the admin, with a report of what happened to each row
• A settings screen whose fields are a closed list of options rather than a
  free-text box that can hold anything

How it is built

• No dependencies and no build step. No npm, no Composer, no bundler. What
  is in the plugin is what runs.
• No jQuery. One frozen window.SLOSM namespace on the front end.
• The REST API rather than admin-ajax. Four narrow, read-only routes.
• Conditional assets. The clustering bundle downloads only when a locator
  actually needs it; a site with twenty branches never sees it.
• Geocoding through a server-side proxy, with a thirty-day cache and a
  one-request-per-second gap, so a visitor’s browser never talks to the
  geocoder itself and a failure is never cached.
• Leaflet and Leaflet.markercluster are bundled rather than loaded from a CDN.

Known limitations in this release

Worth reading before this goes on a site that matters.

• The search button is new in this release, and there is no form around
  it. The address field has a Search button beside it now, running the same
  search Enter runs; with the suggestion list open, both take the highlighted
  suggestion rather than looking the text up again. What this markup
  deliberately does not have is a <form>: that would make Enter submit the
  page for anybody the plugin’s JavaScript has not reached yet, and a form
  inside a page builder’s own form is discarded by the browser’s parser with
  its controls handed to the outer one. If your theme or builder rebuilds the
  filter bar and drops the button, the field still searches on Enter.
• The styling is two files, and you can switch one of them off. One holds
  the layout — the map’s box and its height floor, the results list beside or
  under it, the suggestion popup, the dot marker — and is always loaded. The
  other is a skin: the spacing of the filter row and a border and padding on
  the search field, the selects and the buttons, in the site’s own font and
  colour rather than the browser’s. Untick “Default styles” on the Advanced tab
  to drop the skin and write your own; the map keeps its layout either way, so
  switching it off cannot leave you with a map of no height, which is the usual
  way this kind of plugin appears broken.
• The accessibility and translation passes are done; what is left is
  checking them with real software. The search field is a combobox with a
  listbox of suggestions, the arrow keys walk it, one status line announces
  what happened — including how many locations a search found — and opening a
  location’s bubble moves the keyboard focus into it and gives it back when the
  bubble closes. The map’s close button is labelled in your site’s language
  rather than in English. None of that has been through NVDA, VoiceOver or
  Orca yet, and that check is listed as open rather than claimed as done.
• One thing is deliberately left alone: the name inside a location’s bubble is
  bold text and not a heading, because a heading needs a level and the right
  level depends on the page you drop the locator into.
• Clustering at scale has not been measured on a real site either.

The free services have limits, and a busy shop will meet them

The public OpenStreetMap geocoding service allows roughly one request a second
and asks that heavy use go elsewhere. This plugin keeps to that limit and
caches hard, but a shop with real traffic needs its own instance or a paid
provider. That is a property of a free public service rather than of this
plugin, and the endpoints are settings so a site can point at its own.

Credits and licences

• Leaflet 1.9.4, unmodified, BSD-2-Clause — https://leafletjs.com/
• Leaflet.markercluster 1.5.3, unmodified, MIT —
  https://github.com/Leaflet/Leaflet.markercluster
• Map data © OpenStreetMap contributors —
  https://www.openstreetmap.org/copyright

Both bundled libraries are GPL-compatible, and each ships with its own licence
file and a note recording where it came from and what its SHA-512 digest is.

A note on the name

OpenStreetMap is a trademark of the OpenStreetMap Foundation. This plugin is an
independent piece of software that works with OpenStreetMap data and services;
it is not endorsed by, affiliated with, or an official product of the
OpenStreetMap Foundation. The name follows the Foundation’s trademark policy,
which permits naming software that works specifically with OpenStreetMap data,
and asks for exactly this disclaimer alongside it.

Leaflet and Leaflet.markercluster are bundled here under their own licences and
are likewise not affiliated with this plugin’s author.

External services

This plugin contacts three external services. Two of them are contacted by
your server; the third is contacted by every visitor’s browser. None of them
is contacted until something on the site actually asks for it.

1. Nominatim, the OpenStreetMap geocoding service

What it is for. Turning an address into coordinates.

When. When a location is saved with an address and no coordinates, when
the bulk geocoder is run from the admin, and when a visitor submits a search.
A result is cached for thirty days, so the same address is sent once.

What is sent. The address or search text, normalised; an ISO country code
when the site has set one; and a User-Agent naming this plugin, its version
and your site’s home URL, which the service’s usage policy asks for. The
request is made by your server, so the visitor’s IP address and cookies are
not part of it.

Where. https://nominatim.openstreetmap.org/search by default. The
endpoint is a setting: a site may point it at its own instance or at a paid
provider instead.

Terms and privacy. Nominatim Usage Policy:
https://operations.osmfoundation.org/policies/nominatim/ . Privacy policy of
the OpenStreetMap Foundation, which operates the service:
https://osmfoundation.org/wiki/Privacy_Policy .

2. Photon, the address-suggestion service

What it is for. The suggestions that appear while a visitor types in the
search field.

When. While typing, after a pause, and only when suggestions are switched
on. A suggestion list is cached for a day.

What is sent. The text typed so far and a result limit. As above, the
request is made by your server rather than by the visitor’s browser.

Where. https://photon.komoot.io/api by default, and also a setting.

Terms and privacy. Photon is run by komoot. Its terms are a fair-use
paragraph on the service’s own page, https://photon.komoot.io/ , which reads:
“You can use the API for your project, but please be fair – extensive usage
will be throttled. We do not guarantee for the availability and usage might be
subject of change in the future.” The service publishes no privacy policy of
its own, which is said here rather than papered over with a link to something
else. A site that needs a documented data-processing agreement for this should
point the setting at its own Photon instance, or switch suggestions off.

3. The OpenStreetMap tile server

What it is for. The map images themselves.

When. Every time a page carrying a map is viewed, from the visitor’s own
browser.

What is sent. What any image request sends: the visitor’s IP address, their
browser’s User-Agent, and the coordinates of the tiles being looked at. This
plugin sets no cookie of its own and neither the geocoding nor the suggestion
request carries one.

Where. https://tile.openstreetmap.org/{z}/{x}/{y}.png by default, and a
setting, so a site may use any tile provider it has the right to use.

Terms and privacy. Map data and attribution:
https://www.openstreetmap.org/copyright . Tile Usage Policy:
https://operations.osmfoundation.org/policies/tiles/ . Privacy policy of the
OpenStreetMap Foundation: https://osmfoundation.org/wiki/Privacy_Policy .

Not a request, but worth saying

A “directions” link opens OpenStreetMap, or Google Maps if the site chose
that, in a new tab when a visitor clicks it. Nothing is sent anywhere until
they do, and the link can be turned off in the settings.