Combined Geolocation and game server processing
Each device (with appropriate permissions) may report its location to the server. This can be done using LocationService
You'll want to update location semi-regularly.
You can then answer polls from the device for a list of nearby players. Be sure to either anonymise or outright hide anything they don't need to know in the request. Just send a list of user-IDs and other information relevant to the trade.
Your server simply scans through its list of active players (most likely generated by looking for users that have sent their locations in the past minute or two) and compares the location data by latitude/longitude to a given decimal precision. If they match, they're in the same area and can trade. Some trial and error may be required to decide what level of precision is needed.
This spits out a list of nearby players, probably only a few at a time, and sends that back to the player who requested it.
The rest is a matter of handling trade-requests.
This is something I've actually done for a game in the past (sadly that game is no longer available).
Our system essentially treated the Trade as a series of communications around a server-side data-class.
* User A tells the server they want to trade with User B.
* The server creates a trade object, assigns the creator as User A, then pings User B with the trade-request.
* If they say yes, they're added as the second party in the trade, if no, the trade object is deleted and User A is notified that they refused.
* Once they're both in place, they can both see the Trade Object in their UI, items can be added or removed from their respective tables, and they can submit that they're happy with it.
* Once they've both agreed, the trade is performed, the items are swapped by the server, notifications are sent and the trade is marked as completed which prevents further interaction.
All of the interactions with the Trade object are handled as server requests, no information is directly sent between users at all at any stage for security reasons. The whole thing must be arbitrated by the server.
The paradigm is that users may only ever read data and make requests to change it, they cannot change the data directly.
