vbhjckfd · vbhjckfd · Aug 7, 2026 · Aug 7, 2026 · Aug 7, 2026 · Aug 7, 2026
diff --git a/README.md b/README.md
@@ -516,6 +516,25 @@ All stops as a JSON array, sorted by code.
 
 (`GET /stops` returns an HTML table instead.)
 
+#### Per-stop route overrides
+
+The upstream route list for a stop is sometimes behind reality. `GET /stops`
+applies a stored override to its `Маршрути` column — removed routes shown red and
+struck through, added ones green — and hangs the matching `?add=`/`?remove=` on
+that row's SVG and PDF links, which `offline.lad.lviv.ua` and `pdf.lad.lviv.ua`
+both understand.
+
+Add `?edit=1` to the listing to change them: click a route to drop or restore it,
+type one into the `+` box to add it.
+
+Overrides live in the browser's own `localStorage` (see
+[`public/stopOverrides.js`](public/stopOverrides.js)), not on a server — no
+account to edit through, no cache to purge, an edit applies at once. The trade
+is scope: an override is visible only in the browser that made it, not to
+anyone else who opens `/stops`.
+
+`/stops.json` reports `sign` and `sign_pdf` without overrides applied.
+
 #### `GET /stops/:code`
 
 Single stop with live realtime timetable. Short-cached (5–10 s).

diff --git a/actions/getAllStopsAction.js b/actions/getAllStopsAction.js
@@ -58,8 +58,12 @@ export default async (req, res, next) => {
 <style>
 table, th { text-align: left; }
 a { text-decoration: none; }
+.route.removed { color: red; text-decoration: line-through; }
+.route.added { color: green; }
+[data-edit] .route { cursor: pointer; }
 ${contactBannerStyle()}
 </style>
+<script type="module" src="/stop-overrides.js"></script>
 </head>
 <body>
 ${contactBannerHtml("stops")}
@@ -83,16 +87,21 @@ ${contactBannerHtml("stops")}
         })
         .sort();
 
-      result += `<tr>
+      // data-code and data-routes are what /stop-overrides.js rewrites the row
+      // from: the served HTML stays the plain upstream listing, cacheable for
+      // 30 days, and the overrides are applied in the browser.
+      result += `<tr data-code="${s.code}">
             <td><a target="blank" href="https://lad.lviv.ua/stops/${s.code}">${s.code}</a> (${s.microgiz_id})</td>
             <td>
-                <a target="blank" href="https://offline.lad.lviv.ua/${s.code}">SVG</a>
+                <a target="blank" data-kind="svg" href="https://offline.lad.lviv.ua/${s.code}">SVG</a>
                 &nbsp;
-                <a target="blank" href="https://pdf.lad.lviv.ua/${s.code}.pdf">PDF</a>
+                <a target="blank" data-kind="pdf" href="https://pdf.lad.lviv.ua/${s.code}.pdf">PDF</a>
             </td>
             <td>${escapeHtml(s.name)}</td>
             <td><a target="blank" href="https://www.openstreetmap.org/?mlat=${loc[0]}&mlon=${loc[1]}#map=18/${loc[0]}/${loc[1]}">${loc[0]}, ${loc[1]}</a></td>
-            <td>${transfers.map(escapeHtml).join(" ")}</td>
+            <td data-routes="${escapeHtml(transfers.join(" "))}">${transfers
+              .map((r) => `<span class="route kept" data-route="${escapeHtml(r)}">${escapeHtml(r)}</span>`)
+              .join(" ")}</td>
             </tr>`;
     }
     result += "</table>\n</body>\n</html>";

diff --git a/index.js b/index.js
@@ -10,12 +10,14 @@ const PORT = process.env.PORT || 8080;
 import { openDb } from "gtfs";
 import { readFile } from "fs/promises";
 import cors from "cors";
+import rateLimit from "express-rate-limit";
 import express from "express";
 import bodyParser from "body-parser";
 import localDb from "./connections/timetableSqliteDb.js";
 
 import notFoundAction from "./actions/notFoundAction.js";
 import validateStopCode from "./utils/stopCodeMiddleware.js";
+import createRateLimiter from "./utils/rateLimiter.js";
 
 import getClosestStopsAction from "./actions/getClosestStopsAction.js";
 import getSingleStopAction from "./actions/getSingleStopAction.js";
@@ -235,30 +237,16 @@ app.get("/ping", (req, res) => {
 
 app.get("/health", healthAction);
 
-// Simple in-memory rate limiter: 60 requests/min per IP
-const _mcpRateLimitMap = new Map();
-const MCP_RATE_LIMIT = 60;
-const MCP_RATE_WINDOW_MS = 60_000;
-
-function mcpRateLimiter(req, res, next) {
-  const ip = req.ip ?? "unknown";
-  const now = Date.now();
-  const entry = _mcpRateLimitMap.get(ip) ?? { count: 0, windowStart: now };
-  if (now - entry.windowStart > MCP_RATE_WINDOW_MS) {
-    entry.count = 0;
-    entry.windowStart = now;
-  }
-  entry.count++;
-  _mcpRateLimitMap.set(ip, entry);
-  if (entry.count > MCP_RATE_LIMIT) {
-    return res.status(429).json({
+const mcpRateLimiter = createRateLimiter({
+  limit: 60,
+  windowMs: 60_000,
+  onLimit: (res) =>
+    res.status(429).json({
       jsonrpc: "2.0",
       error: { code: -32000, message: "Rate limit exceeded. Try again later." },
       id: null,
-    });
-  }
-  next();
-}
+    }),
+});
 
 app.post("/mcp", mcpRateLimiter, async (req, res) => {
   try {
@@ -340,6 +328,25 @@ app.get("/favicon.ico", (req, res, next) => {
   res.sendFile(path.join(__dirname, "favicon.ico"));
 });
 
+// Applies the per-stop route overrides to the /stops listing in the browser.
+// Tagged "long" like the other baked-in assets: it ships with the image, so a
+// GTFS refresh leaves it alone and a code push purges it. Cloudflare caches it
+// for a day on that tag, so an uncached request reaching this far is rare —
+// the limiter is here so a cache-bypassing client can't turn the file read
+// underneath sendFile into an amplifier.
+const staticFileRateLimiter = rateLimit({
+  windowMs: 60_000,
+  limit: 120,
+  standardHeaders: true,
+  legacyHeaders: false,
+});
+
+app.get("/stop-overrides.js", staticFileRateLimiter, (req, res) => {
+  setStaticAssetCache(res);
+  res.type("text/javascript");
+  res.sendFile(path.join(__dirname, "public", "stopOverrides.js"));
+});
+
 app.get("/smithery.json", (req, res) => {
   setStaticAssetCache(res, 3600 * 24 * 7);
   res.sendFile(path.join(__dirname, "smithery.json"));

diff --git a/package-lock.json b/package-lock.json
diff --git a/package.json b/package.json
@@ -37,6 +37,7 @@
     "cors": "^2.8.5",
     "dotenv": "^17.4",
     "express": "^5.2.1",
+    "express-rate-limit": "^8.6.2",
     "gtfs": "^4.18.5",
     "gtfs-realtime-bindings": "^2.0.0",
     "lokijs": "^1.5.12",