@fleetbase/fleetops-engine 0.6.48 → 0.6.50

package/server/src/Http/Controllers/Internal/v1/VehicleController.php

@@ -5,10 +5,12 @@ namespace Fleetbase\FleetOps\Http\Controllers\Internal\v1;
 use Fleetbase\FleetOps\Exports\VehicleExport;
 use Fleetbase\FleetOps\Http\Controllers\FleetOpsController;
 use Fleetbase\FleetOps\Imports\VehicleImport;
+use Fleetbase\FleetOps\Models\Driver;
 use Fleetbase\FleetOps\Models\Vehicle;
 use Fleetbase\Http\Requests\ExportRequest;
 use Fleetbase\Http\Requests\ImportRequest;
 use Illuminate\Http\Request;
+use Illuminate\Support\Arr;
 use Illuminate\Support\Facades\DB;
 use Illuminate\Support\Str;
 use Maatwebsite\Excel\Facades\Excel;
@@ -25,14 +27,65 @@ class VehicleController extends FleetOpsController
     /**
      * Handle post save transactions.
      */
-    public function afterSave(Request $request, Vehicle $vehicle)
+    public function afterSave(Request $request, Vehicle $vehicle, array $input = [])
     {
+        if ($this->hasDriverInput($request)) {
+            $this->syncDriverAssignment($vehicle, $this->driverIdentifierFromRequest($request));
+        }
+
         $customFieldValues = $request->array('vehicle.custom_field_values');
         if ($customFieldValues) {
             $vehicle->syncCustomFieldValues($customFieldValues);
         }
     }
 
+    protected function hasDriverInput(Request $request): bool
+    {
+        $payload = $request->all();
+
+        return Arr::has($payload, 'vehicle.driver_uuid')
+            || Arr::has($payload, 'vehicle.driver.uuid')
+            || Arr::has($payload, 'vehicle.driver.id')
+            || Arr::has($payload, 'driver_uuid')
+            || Arr::has($payload, 'driver');
+    }
+
+    protected function driverIdentifierFromRequest(Request $request): ?string
+    {
+        $payload = $request->all();
+        $driver  = data_get($payload, 'vehicle.driver') ?? data_get($payload, 'driver');
+
+        return data_get($payload, 'vehicle.driver_uuid')
+            ?? data_get($payload, 'vehicle.driver.uuid')
+            ?? data_get($payload, 'vehicle.driver.id')
+            ?? (is_string($driver) ? $driver : null)
+            ?? data_get($payload, 'driver_uuid')
+            ?? data_get($payload, 'driver.uuid')
+            ?? data_get($payload, 'driver.id');
+    }
+
+    protected function syncDriverAssignment(Vehicle $vehicle, ?string $identifier): void
+    {
+        if (empty($identifier)) {
+            $vehicle->unassignDriver();
+
+            return;
+        }
+
+        $driver = Driver::withoutGlobalScopes()
+            ->whereNull('deleted_at')
+            ->where(function ($query) use ($identifier) {
+                $query->where('uuid', $identifier)->orWhere('public_id', $identifier);
+            })
+            ->when(session('company'), fn ($query, $company) => $query->where('company_uuid', $company))
+            ->first();
+
+        if ($driver) {
+            $vehicle->assignDriver($driver);
+            $vehicle->setRelation('driver', $driver);
+        }
+    }
+
     /**
      * Get all status options for an vehicle.
      *

package/server/src/Http/Middleware/AuthenticateCustomerToken.php

@@ -0,0 +1,34 @@
+<?php
+
+namespace Fleetbase\FleetOps\Http\Middleware;
+
+use Fleetbase\FleetOps\Support\CustomerAuth;
+use Illuminate\Http\Request;
+
+/**
+ * Enforce that a Customer-Token header is present and resolves to a
+ * customer-type Contact that belongs to the same company as the request's
+ * API credential.
+ *
+ * Apply this middleware to authenticated `/v1/customers/...` routes. The
+ * public sign-up / login routes do NOT use it.
+ */
+class AuthenticateCustomerToken
+{
+    public function handle(Request $request, \Closure $next)
+    {
+        $customer = CustomerAuth::resolveFromHeader($request);
+        if (!$customer) {
+            return response()->apiError('Customer token is missing or invalid.', 401);
+        }
+
+        $sessionCompany = session('company');
+        if ($sessionCompany && $customer->company_uuid !== $sessionCompany) {
+            return response()->apiError('Customer does not belong to this company.', 403);
+        }
+
+        CustomerAuth::setCurrent($customer);
+
+        return $next($request);
+    }
+}

package/server/src/Http/Requests/CreateCustomerOrderRequest.php

@@ -0,0 +1,63 @@
+<?php
+
+namespace Fleetbase\FleetOps\Http\Requests;
+
+use Fleetbase\Http\Requests\FleetbaseRequest;
+
+/**
+ * Validates the body of `POST /v1/customers/orders`.
+ *
+ * Mirrors the canonical Fleet-Ops Order create shape used by the operator
+ * `POST /v1/orders` endpoint: `type` / `order_config`, `scheduled_at`,
+ * `notes`, `meta`, and either a nested `payload` or top-level
+ * `pickup` / `dropoff` / `return` / `waypoints` / `entities`. Place and
+ * Entity sub-objects accept the standard Fleet-Ops Place / Entity field
+ * shapes — no client-portal aliases are recognized.
+ *
+ * `customer` is intentionally not accepted: the controller forces
+ * `customer_uuid` from the authenticated Customer-Token. `status`,
+ * `driver`, `vehicle`, `facilitator`, `dispatch` and similar operator-tier
+ * fields are also out of scope for the customer surface.
+ */
+class CreateCustomerOrderRequest extends FleetbaseRequest
+{
+    public function authorize(): bool
+    {
+        return request()->session()->has('api_credential')
+            || request()->session()->has('is_sanctum_token');
+    }
+
+    public function rules(): array
+    {
+        return [
+            'type'             => 'nullable|string',
+            'order_config'     => 'nullable|string',
+            'scheduled_at'     => 'nullable|date',
+            'notes'            => 'nullable|string|max:2000',
+            'internal_id'      => 'nullable|string|max:191',
+            'meta'             => 'nullable|array',
+            // Optional ServiceQuote reference (uuid or `sqte_…` public_id).
+            // Resolved server-side via `ServiceQuote::resolveFromRequest` and
+            // consumed by `$order->purchaseServiceQuote()` after creation.
+            'service_quote'    => 'nullable|string',
+
+            // payload may be an object OR a payload public_id string
+            'payload'          => 'nullable',
+
+            // Top-level alternatives when `payload` is not provided. Each
+            // Place sub-object accepts the standard Place fillable shape.
+            'pickup'                    => 'nullable',
+            'dropoff'                   => 'nullable',
+            'return'                    => 'nullable',
+            'waypoints'                 => 'nullable|array',
+            'entities'                  => 'nullable|array',
+            'entities.*.name'           => 'nullable|string',
+            'entities.*.description'    => 'nullable|string',
+            'entities.*.weight'         => 'nullable|numeric|min:0',
+            'entities.*.weight_unit'    => 'nullable|string',
+            'entities.*.declared_value' => 'nullable|numeric|min:0',
+            'entities.*.currency'       => 'nullable|string|size:3',
+            'entities.*.meta'           => 'nullable|array',
+        ];
+    }
+}

package/server/src/Http/Requests/CreateCustomerRequest.php

@@ -0,0 +1,48 @@
+<?php
+
+namespace Fleetbase\FleetOps\Http\Requests;
+
+use Fleetbase\Http\Requests\FleetbaseRequest;
+use Illuminate\Validation\Rule;
+
+/**
+ * Validates the body of `POST /v1/customers` (final account creation step).
+ *
+ * Expects the verification code previously requested via
+ * `POST /v1/customers/request-creation-code`.
+ */
+class CreateCustomerRequest extends FleetbaseRequest
+{
+    public function authorize(): bool
+    {
+        return request()->session()->has('api_credential')
+            || request()->session()->has('is_sanctum_token');
+    }
+
+    public function rules(): array
+    {
+        return [
+            'identity' => 'required|string',
+            'code'     => 'required|exists:verification_codes,code',
+            'name'     => 'required|string',
+            'password' => 'required|string|min:8',
+            'email'    => [
+                'email', 'nullable',
+                Rule::unique('contacts')->where(function ($query) {
+                    $query->where('company_uuid', session('company'));
+
+                    return $query->whereNull('deleted_at');
+                }),
+            ],
+            'phone' => [
+                'nullable', 'string',
+                Rule::unique('contacts')->where(function ($query) {
+                    $query->where('company_uuid', session('company'));
+
+                    return $query->whereNull('deleted_at');
+                }),
+            ],
+            'meta'  => 'nullable|array',
+        ];
+    }
+}

package/server/src/Http/Requests/CreateDriverRequest.php

@@ -35,7 +35,7 @@ class CreateDriverRequest extends FleetbaseRequest
             'country'   => 'nullable|size:2',
             'city'      => 'nullable|string',
             'vehicle'   => 'nullable|string|starts_with:vehicle_|exists:vehicles,public_id',
-            'status'    => 'nullable|string|in:active,inactive',
+            'status'    => 'nullable|string|in:active,available,inactive',
             'vendor'    => 'nullable|exists:vendors,public_id',
             'job'       => 'nullable|exists:orders,public_id',
             'location'  => ['nullable', new ResolvablePoint()],

package/server/src/Http/Requests/CreateVehicleRequest.php

@@ -4,6 +4,7 @@ namespace Fleetbase\FleetOps\Http\Requests;
 
 use Fleetbase\FleetOps\Rules\ResolvablePoint;
 use Fleetbase\Http\Requests\FleetbaseRequest;
+use Illuminate\Validation\Rule;
 
 class CreateVehicleRequest extends FleetbaseRequest
 {
@@ -25,7 +26,30 @@ class CreateVehicleRequest extends FleetbaseRequest
     public function rules()
     {
         return [
-            'status'    => 'nullable|in:operational,maintenance,decommissioned',
+            'status'    => [
+                'nullable',
+                Rule::in([
+                    'active',
+                    'available',
+                    'in_use',
+                    'maintenance',
+                    'out_of_service',
+                    'reserved',
+                    'retired',
+                    'staging',
+                    'on_route',
+                    'idle',
+                    'cleaning',
+                    'awaiting_parts',
+                    'inspection_due',
+                    'inspection_failed',
+                    'accident',
+                    'compliance_hold',
+                    'stolen',
+                    'operational',
+                    'decommissioned',
+                ]),
+            ],
             'vendor'    => 'nullable|exists:vendors,public_id',
             'driver'    => 'nullable|exists:drivers,public_id',
             'location'  => ['nullable', new ResolvablePoint()],

package/server/src/Http/Requests/Internal/CreateDriverRequest.php

@@ -51,7 +51,7 @@ class CreateDriverRequest extends CreateDriverApiRequest
             'country'                => 'nullable|string|size:2',
             'city'                   => 'nullable|string|max:255',
             'vehicle'                => ['nullable', new ResolvableVehicle()],
-            'status'                 => 'nullable|string|in:active,inactive',
+            'status'                 => 'nullable|string|in:active,available,inactive',
             'vendor'                 => 'nullable|exists:vendors,public_id',
             'job'                    => 'nullable|exists:orders,public_id',
             'location'               => ['nullable', new ResolvablePoint()],

package/server/src/Http/Requests/VerifyCreateCustomerRequest.php

@@ -0,0 +1,29 @@
+<?php
+
+namespace Fleetbase\FleetOps\Http\Requests;
+
+use Fleetbase\Http\Requests\FleetbaseRequest;
+
+/**
+ * Validates the body of `POST /v1/customers/request-creation-code`.
+ */
+class VerifyCreateCustomerRequest extends FleetbaseRequest
+{
+    public function authorize(): bool
+    {
+        return request()->session()->has('api_credential')
+            || request()->session()->has('is_sanctum_token');
+    }
+
+    public function rules(): array
+    {
+        return [
+            'mode'     => 'required|in:email,sms',
+            'identity' => 'required|string',
+            // Optional profile context — when provided, used to greet the
+            // customer in the verification email and pre-seed the User row.
+            'name'     => 'nullable|string|max:255',
+            'phone'    => 'nullable|string|max:32',
+        ];
+    }
+}

package/server/src/Http/Resources/Internal/v1/OrderConfig.php

@@ -0,0 +1,41 @@
+<?php
+
+namespace Fleetbase\FleetOps\Http\Resources\Internal\v1;
+
+use Fleetbase\Http\Resources\FleetbaseResource;
+
+class OrderConfig extends FleetbaseResource
+{
+    /**
+     * Transform the resource into an array.
+     *
+     * @param \Illuminate\Http\Request $request
+     */
+    public function toArray($request): array
+    {
+        return [
+            'id'            => $this->id,
+            'uuid'          => $this->uuid,
+            'public_id'     => $this->public_id,
+            'company_uuid'  => $this->company_uuid,
+            'author_uuid'   => $this->author_uuid,
+            'category_uuid' => $this->category_uuid,
+            'icon_uuid'     => $this->icon_uuid,
+            'name'          => $this->name,
+            'namespace'     => $this->namespace,
+            'description'   => $this->description,
+            'key'           => $this->key,
+            'status'        => $this->status,
+            'version'       => $this->version,
+            'core_service'  => (bool) $this->core_service,
+            'flow'          => $this->flow ?? [],
+            'entities'      => $this->entities ?? [],
+            'tags'          => $this->tags ?? [],
+            'meta'          => $this->meta ?? [],
+            'created_at'    => $this->created_at,
+            'updated_at'    => $this->updated_at,
+            'deleted_at'    => $this->deleted_at,
+            'type'          => 'order-config',
+        ];
+    }
+}

package/server/src/Http/Resources/v1/Customer.php

@@ -0,0 +1,79 @@
+<?php
+
+namespace Fleetbase\FleetOps\Http\Resources\v1;
+
+use Fleetbase\FleetOps\Models\Order;
+use Fleetbase\FleetOps\Support\Utils;
+use Fleetbase\Http\Resources\FleetbaseResource;
+use Fleetbase\Models\Company;
+use Fleetbase\Support\Http;
+use Illuminate\Http\Request;
+use Illuminate\Support\Str;
+
+/**
+ * Public API resource for FleetOps customers.
+ *
+ * Wraps a {@see \Fleetbase\FleetOps\Models\Contact} of `type='customer'` and
+ * exposes the auth `token` field that login/signup endpoints attach.
+ */
+class Customer extends FleetbaseResource
+{
+    public function toArray($request): array
+    {
+        $this->loadMissing(['place', 'places']);
+
+        return [
+            'id'           => $this->when(Http::isInternalRequest(), $this->id, Str::replaceFirst('contact', 'customer', $this->public_id)),
+            'uuid'         => $this->when(Http::isInternalRequest(), $this->uuid),
+            'user_uuid'    => $this->when(Http::isInternalRequest(), $this->user_uuid),
+            'company_uuid' => $this->when(Http::isInternalRequest(), $this->company_uuid),
+            'public_id'    => $this->when(Http::isInternalRequest(), $this->public_id),
+            'internal_id'  => $this->internal_id,
+            'name'         => $this->name,
+            'title'        => $this->title,
+            'photo_url'    => $this->photo_url,
+            'email'        => $this->email,
+            'phone'        => $this->phone,
+            'address'      => data_get($this, 'place.address'),
+            'addresses'    => $this->whenLoaded('places', fn () => Place::collection($this->places)),
+            'token'        => $this->when($this->token, $this->token),
+            'orders_count' => $this->getOrdersCount($request),
+            'company'      => $this->when($this->company_uuid, fn () => $this->buildCompanyPayload()),
+            'meta'         => data_get($this, 'meta', Utils::createObject()),
+            'slug'         => $this->slug,
+            'created_at'   => $this->created_at,
+            'updated_at'   => $this->updated_at,
+        ];
+    }
+
+    private function getOrdersCount(Request $request): int
+    {
+        return Order::where('customer_uuid', $this->uuid)
+            ->whereNull('deleted_at')
+            ->withoutGlobalScopes()
+            ->count();
+    }
+
+    /**
+     * Public-safe projection of the customer's company. Returns the same
+     * fields any caller could fetch through other public endpoints — name,
+     * resolved currency, country, phone — plus the company's public id.
+     * Currency falls back through company.currency → ledger base_currency
+     * → "USD" via {@see Utils::getCompanyTransactionCurrency}.
+     */
+    private function buildCompanyPayload(): ?array
+    {
+        $company = Company::find($this->company_uuid);
+        if (!$company) {
+            return null;
+        }
+
+        return [
+            'id'       => $company->public_id,
+            'name'     => $company->name,
+            'currency' => Utils::getCompanyTransactionCurrency($company),
+            'country'  => $company->country,
+            'phone'    => $company->phone,
+        ];
+    }
+}

package/server/src/Http/Resources/v1/Driver.php

@@ -38,6 +38,7 @@ class Driver extends FleetbaseResource
             'email'                         => $this->email,
             'phone'                         => $this->phone,
             'drivers_license_number'        => $this->drivers_license_number,
+            'license_expiry'                => $this->license_expiry,
             'photo_url'                     => $this->photo_url,
             'avatar_url'                    => $this->avatar_url,
             'avatar_value'                  => $this->when(Http::isInternalRequest(), $this->getOriginal('avatar_url')),
@@ -94,6 +95,7 @@ class Driver extends FleetbaseResource
             'email'                  => $this->email,
             'phone'                  => $this->phone,
             'photo_url'              => $this->photo_url,
+            'license_expiry'         => $this->license_expiry,
             'vehicle'                => data_get($this, 'vehicle.public_id'),
             'current_job'            => data_get($this, 'currentJob.public_id'),
             'vendor'                 => data_get($this, 'vendor.public_id'),

package/server/src/Http/Resources/v1/Fleet.php

@@ -23,6 +23,10 @@ class Fleet extends FleetbaseResource
             }, $request->array('with'));
 
             $this->load($with);
+
+            if (in_array('subfleets', $with, true) && in_array('vehicles', $with, true)) {
+                $this->loadMissing('subFleets.vehicles');
+            }
         }
 
         return $this->withCustomFields([

package/server/src/Http/Resources/v1/Index/Driver.php

@@ -33,6 +33,7 @@ class Driver extends FleetbaseResource
             'current_job_uuid'=> $this->when($isInternal, $this->current_job_uuid),
             'name'            => $this->name,
             'vehicle_name'    => $this->when($isInternal, $this->vehicle_name),
+            'email'           => $this->email,
             'phone'           => $this->phone,
             'photo_url'       => $this->photo_url,
             'status'          => $this->status,
@@ -41,6 +42,53 @@ class Driver extends FleetbaseResource
             'altitude'        => (int) data_get($this, 'altitude', 0),
             'speed'           => (int) data_get($this, 'speed', 0),
             'online'          => data_get($this, 'online', false),
+            'meta'            => [
+                '_index_resource'         => true,
+                'location_coordinates'    => $this->locationCoordinates(),
+                'current_order_reference' => $this->currentOrderReference(),
+                'speed_label'             => $this->speedLabel(),
+                'heading_label'           => $this->headingLabel(),
+                'status_label'            => $this->statusLabel(),
+            ],
         ];
     }
+
+    protected function currentOrderReference(): ?string
+    {
+        $this->loadMissing('currentOrder');
+        $order = data_get($this, 'currentOrder');
+
+        return data_get($order, 'tracking') ?? data_get($order, 'public_id');
+    }
+
+    protected function locationCoordinates(): ?string
+    {
+        $location = Utils::castPoint($this->location);
+
+        return $location ? $this->formatCoordinate($location->getLat()) . ' ' . $this->formatCoordinate($location->getLng()) : null;
+    }
+
+    protected function speedLabel(): string
+    {
+        $speed = data_get($this, 'speed');
+
+        return is_numeric($speed) ? ((int) $speed) . ' km/h' : '-';
+    }
+
+    protected function headingLabel(): string
+    {
+        $heading = data_get($this, 'heading');
+
+        return is_numeric($heading) ? ((int) $heading) . ' deg' : '-';
+    }
+
+    protected function statusLabel(): ?string
+    {
+        return $this->status ? str($this->status)->replace(['_', '-'], ' ')->headline()->toString() : null;
+    }
+
+    protected function formatCoordinate(float $coordinate): string
+    {
+        return (string) round($coordinate, 4);
+    }
 }

package/server/src/Http/Resources/v1/Index/Vehicle.php

@@ -2,6 +2,7 @@
 
 namespace Fleetbase\FleetOps\Http\Resources\v1\Index;
 
+use Fleetbase\FleetOps\Models\Order;
 use Fleetbase\FleetOps\Support\Utils;
 use Fleetbase\Http\Resources\FleetbaseResource;
 use Fleetbase\Support\Http;
@@ -28,8 +29,12 @@ class Vehicle extends FleetbaseResource
             'company_uuid'    => $this->when($isInternal, $this->company_uuid),
             'vendor_uuid'     => $this->when($isInternal, $this->vendor_uuid),
             'photo_uuid'      => $this->when($isInternal, $this->photo_uuid),
+            'internal_id'     => $this->internal_id,
             'display_name'    => $this->display_name,
+            'driver_name'     => $this->driver_name,
             'plate_number'    => $this->plate_number,
+            'serial_number'   => $this->serial_number,
+            'vin'             => $this->vin,
             'make'            => $this->make,
             'model'           => $this->model,
             'year'            => $this->year,
@@ -43,8 +48,76 @@ class Vehicle extends FleetbaseResource
 
             // Meta flag to indicate this is an index resource
             'meta'            => [
-                '_index_resource' => true,
+                '_index_resource'          => true,
+                'current_order_reference'  => $this->currentOrderReference(),
+                'location_coordinates'     => $this->locationCoordinates(),
+                'speed_label'              => $this->speedLabel(),
+                'heading_label'            => $this->headingLabel(),
+                'status_label'             => $this->statusLabel(),
             ],
         ];
     }
+
+    protected function currentOrderReference(): ?string
+    {
+        $this->loadMissing('driver.currentOrder');
+        $order = data_get($this, 'driver.currentOrder') ?? $this->currentPositionOrder() ?? $this->currentVehicleOrder();
+
+        return data_get($order, 'tracking') ?? data_get($order, 'public_id');
+    }
+
+    protected function locationCoordinates(): ?string
+    {
+        $location = Utils::castPoint($this->location);
+
+        return $location ? $this->formatCoordinate($location->getLat()) . ' ' . $this->formatCoordinate($location->getLng()) : null;
+    }
+
+    protected function speedLabel(): string
+    {
+        $speed = data_get($this->lastKnownPosition(), 'speed', data_get($this, 'speed'));
+
+        return is_numeric($speed) ? ((int) $speed) . ' km/h' : '-';
+    }
+
+    protected function headingLabel(): string
+    {
+        $heading = data_get($this->lastKnownPosition(), 'heading', data_get($this, 'heading'));
+
+        return is_numeric($heading) ? ((int) $heading) . ' deg' : '-';
+    }
+
+    protected function statusLabel(): ?string
+    {
+        return $this->status ? str($this->status)->replace(['_', '-'], ' ')->headline()->toString() : null;
+    }
+
+    protected function currentPositionOrder(): ?Order
+    {
+        $orderUuid = data_get($this->lastKnownPosition(), 'order_uuid');
+
+        return $orderUuid ? Order::where('uuid', $orderUuid)->first() : null;
+    }
+
+    protected function currentVehicleOrder(): ?Order
+    {
+        return Order::where('vehicle_assigned_uuid', $this->uuid)
+            ->whereNotIn('status', ['completed', 'canceled', 'cancelled'])
+            ->latest()
+            ->first();
+    }
+
+    protected function lastKnownPosition()
+    {
+        if (!$this->resource->relationLoaded('last_known_position')) {
+            $this->resource->setRelation('last_known_position', $this->getLastKnownPosition());
+        }
+
+        return $this->resource->getRelation('last_known_position');
+    }
+
+    protected function formatCoordinate(float $coordinate): string
+    {
+        return (string) round($coordinate, 4);
+    }
 }