Aqar Saudi Properties and Details Scraper

This Actor extracts source-backed Saudi property fields from sa.aqar.fm. It reads server-rendered RealEstateListing JSON-LD on an official listing or category page, then can fetch listing pages for detail JSON-LD. Aqar's platform terms require permission for collecting/reusing platform or user data; the Actor makes no source requests unless authorizationConfirmed is explicitly set to true after applicable written permission is confirmed.

Input

• startUrl: an explicit HTTPS Aqar listing or category URL. There is no default source URL.
• maxItems: maximum unique properties, default 5.
• includeDetails: fetch each public property page for richer source-backed fields, default true.
• timeoutSecs: direct request timeout, default 30.
• authorizationConfirmed: set to true only when written permission covers automated collection and reuse of Aqar listing content. Defaults to false; otherwise the Actor completes as SUCCEEDED with collectionStatus: SKIPPED_POLICY, makes zero source requests, and emits no dataset rows. Redirects are refused and responses must remain on https://sa.aqar.fm.

Output

The dataset contains only source-backed property records. Source and dataset failures never become diagnostic or placeholder rows. OUTPUT_SUMMARY.status is the operational status (SUCCEEDED or FAILED); runStatus and collectionStatus use COMPLETED, PARTIAL, FAILED, or SKIPPED_POLICY. Clean bounded or empty runs are SUCCEEDED / COMPLETED. A later failure after saving real property rows is SUCCEEDED / PARTIAL; a failure with no saved rows is FAILED / FAILED and exits nonzero. Missing written permission produces SUCCEEDED / SKIPPED_POLICY, zero requests, and a KVS-only diagnostic. Failure details stay in the aggregate KVS summary.

Only direct public HTTP requests to sa.aqar.fm are used. The actor does not call private APIs, log in, bypass access controls, or infer fields that are absent from the official JSON-LD.

Local development

npm install
apify validate-schema
npm run lint
apify run --input '{"maxItems":3,"authorizationConfirmed":false}'
npm test

Requests are sequential so each listing page can be checked against its source-backed detail record. Execution uses local Apify storage only.

Dependency security

The locked dependency graph overrides basic-ftp with the patched 6.2.1 release. The SDK’s unpatched HTTP cache policy is replaced with the readable local vendor/noncaching-http-policy adapter, which refuses cache reads and writes and forces fresh network responses. This is an explicit removal of caching, not a claimed upstream security patch. Source transports, permission gates and request limits are unchanged. npm run test:dependencies checks cross-user cache isolation, imported stale policy rejection, FTP integration methods and adversarial listing parsing. Cloud builds run npm audit --omit=dev --audit-level=low against the installed production graph.