0xrsydn/research
1
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
research/comuline-krl-data/sources.md

3 KiB
Raw Permalink Blame History

Sources

★ = directly verified during this audit (Oct 12, 2026). Unmarked items are community context, not re-verified.

Comuline (the audited project)

  • ★ https://comuline.com — web app ("Cari & Simpan Jadwal KRL 2024"). Vite SPA on Cloudflare; analytics via analytics.zulio.me.
  • ★ https://api.comuline.com — public API (no auth). Docs at /docs (Scalar), OpenAPI spec at /openapi. Endpoints: /v1/station, /v1/station/{id}, /v1/schedule/{station_id}, /v1/route/{train_id}, /status.
  • ★ Source repos: github.com/comuline/web (Vite/React; openapi-fetch + swr-openapi; i18n default id), github.com/comuline/api (Hono + Bun; Drizzle + Neon Postgres + Upstash Redis; sync scripts under src/sync/), plus android (Kotlin) and ios (Swift).
  • ★ Author: Abiel Zulio M — github.com/abielzulio; prior project abielzulio/jadwal-krl.
  • ★ Repo activity: api last push 2025-03-30 (116★), web 2025-04-03 (95★), android 2025-08-22, ios 2024-09-02. None archived; all dormant on the data side.
  • ★ Repo timeline (merged vs open): PR #11 "base url to env" merged 2025-03-30 (last merge day; also PR #12/#13 wrangler+migrations). Open/unmerged since: PR #14 "feat: mrt schedule support" (2025-04-01), PR #16 "Handle KAI token config and route normalization" (2026-01-26 — env token, /schedule → /schedules, station-name normalization), issue #15 "Transjakarta API Support" (2025-11-12), issue #17 "Added of Jatake Station" (2026-02-01). Web repo: issue #16 + PR #17 open since Apr 2025.
  • ★ Author activity: abielzulio is active on GitHub as of Oct 2026 (public events) — but not on comuline. Contributors (ln2r, ahmadnathanfirdaus) still submit fixes that go unmerged.

Upstream (official KAI Commuter)

  • ★ https://api-partner.krl.co.id/krl-webs/v1 — official partner API of KRL (krl.co.id = KAI Commuter domain). Endpoints used by comuline's sync: GET /krl-station, GET /schedule?stationid={id}&timefrom=00:00&timeto=23:00.
    • Auth: Bearer JWT. A long-lived token is hardcoded in the public repo (comuline/api/src/sync/headers.ts); its value is [REDACTED] here and was not used in this audit. Unauthenticated probe returned HTTP 404.
    • Sync also sends browser-like headers and does a CORS OPTIONS preflight before each GET.
  • Context: KRL (Commuter Line) is operated by PT Kereta Commuter Indonesia (KAI Commuter), subsidiary of PT KAI. "Daop" = KAI operational region (daop 1 = Jakarta, daop 2 = Bandung, daop 6 = Yogyakarta).

Related ecosystem (community, for context)

  • github.com/vyonizr/tarif-krl — KRL fare calculator "based on the official APIs: api-partner.krl.co.id and jakartamrt.co.id" — independent confirmation that the partner API is the de-facto official source.
  • github.com/Fannandya/api-krl — KRL network-data SaaS (registration, API keys, daily quotas; curated reference data).
  • Live-ish KRL trackers (different approach, NOT audited): trackmycommuter.com, krljakarta.com ("updates every 30 seconds"), botkita.com/krl-tracker.