@fleetbase/fleetops-engine 0.6.48 → 0.6.50

package/server/tests/CustomerEndpointTest.php

@@ -0,0 +1,199 @@
+<?php
+
+use Fleetbase\FleetOps\Http\Controllers\Api\v1\CustomerController;
+use Fleetbase\FleetOps\Http\Middleware\AuthenticateCustomerToken;
+use Fleetbase\FleetOps\Http\Requests\CreateCustomerOrderRequest;
+use Fleetbase\FleetOps\Http\Requests\CreateCustomerRequest;
+use Fleetbase\FleetOps\Http\Requests\VerifyCreateCustomerRequest;
+use Fleetbase\FleetOps\Http\Resources\v1\Customer as CustomerResource;
+use Fleetbase\FleetOps\Models\Customer as CustomerModel;
+use Fleetbase\FleetOps\Support\CustomerAuth;
+
+/*
+|--------------------------------------------------------------------------
+| Customer API surface — static shape checks.
+|
+| These mirror the lightweight static checks used elsewhere in this package
+| (see PingDriverEndpointTest.php). They verify that the customer endpoints,
+| controller methods, middleware, and supporting classes exist and are wired
+| through `Api/v1/CustomerController` without the Storefront layer.
+|
+| End-to-end HTTP tests against a running app belong in the parent `api/`
+| project's test harness; this file ensures the package surface is correct.
+|--------------------------------------------------------------------------
+*/
+
+test('customers route group is registered inside the consumable v1 namespace', function () {
+    $routes = file_get_contents(dirname(__DIR__) . '/src/routes.php');
+
+    expect($routes)
+        ->toContain("\$router->group(['prefix' => 'customers', 'middleware' => []]")
+        ->and($routes)->toContain('CustomerController@requestCreationCode')
+        ->and($routes)->toContain('CustomerController@create')
+        ->and($routes)->toContain('CustomerController@login')
+        ->and($routes)->toContain('CustomerController@loginWithPhone')
+        ->and($routes)->toContain('CustomerController@verifyCode')
+        ->and($routes)->toContain('CustomerController@forgotPassword')
+        ->and($routes)->toContain('CustomerController@resetPassword');
+});
+
+test('authenticated customer routes are gated by AuthenticateCustomerToken middleware', function () {
+    $routes = file_get_contents(dirname(__DIR__) . '/src/routes.php');
+
+    expect($routes)
+        ->toContain('AuthenticateCustomerToken::class')
+        ->and($routes)->toContain('CustomerController@me')
+        ->and($routes)->toContain('CustomerController@updateMe')
+        ->and($routes)->toContain('CustomerController@logout')
+        ->and($routes)->toContain('CustomerController@logoutAll')
+        ->and($routes)->toContain('CustomerController@orders')
+        ->and($routes)->toContain('CustomerController@createOrder')
+        ->and($routes)->toContain('CustomerController@findOrder')
+        ->and($routes)->toContain('CustomerController@places')
+        ->and($routes)->toContain('CustomerController@registerDevice');
+});
+
+test('customer controller exposes the documented method surface', function () {
+    $expected = [
+        'requestCreationCode', 'create',
+        'login', 'loginWithPhone', 'verifyCode',
+        'forgotPassword', 'resetPassword',
+        'me', 'updateMe', 'logout', 'logoutAll',
+        'orders', 'createOrder', 'findOrder',
+        'places', 'registerDevice',
+    ];
+
+    foreach ($expected as $method) {
+        expect(method_exists(CustomerController::class, $method))->toBeTrue("CustomerController::{$method} missing");
+    }
+});
+
+test('customer controller does not reference Storefront concerns', function () {
+    $source = file_get_contents(dirname(__DIR__) . '/src/Http/Controllers/Api/v1/CustomerController.php');
+
+    expect($source)
+        ->not->toContain('Storefront::about')
+        ->not->toContain("session('storefront_key')")
+        ->not->toContain("session('storefront_store')")
+        ->not->toContain("session('storefront_network')")
+        ->not->toContain('storefront_id')
+        ->not->toContain('createStripeCustomerForContact');
+});
+
+test('customer controller does not introduce client-portal field aliases', function () {
+    // Public Fleetbase APIs must accept canonical model field names only. No
+    // aliasing like line1/state/zip → street1/province/postal_code, no portal-
+    // specific tagging like meta.origin, no top-level item/weight/value/mode
+    // aliases on order create — clients conform to the API, not vice versa.
+    $source = file_get_contents(dirname(__DIR__) . '/src/Http/Controllers/Api/v1/CustomerController.php');
+
+    expect($source)
+        ->not->toContain("'line1'")
+        ->not->toContain("'line2'")
+        ->not->toContain("'state'")
+        ->not->toContain("'zip'")
+        ->not->toContain("'origin' => 'fleetops_customer_portal'")
+        ->not->toContain('fleetops_customer_portal')
+        ->not->toContain("\$request->input('item'")
+        ->not->toContain("\$request->input('value'")
+        ->not->toContain("\$request->input('delivery'")
+        ->not->toContain("\$request->input('category'");
+});
+
+test('createOrder mirrors the canonical Fleet-Ops order shape', function () {
+    $source = file_get_contents(dirname(__DIR__) . '/src/Http/Controllers/Api/v1/CustomerController.php');
+
+    expect($source)
+        ->toContain('OrderConfig::resolveFromIdentifier')
+        ->toContain('buildPayloadFromInput')
+        ->toContain('Payload')
+        ->toContain('setPickup')
+        ->toContain('setDropoff')
+        ->toContain('setEntities')
+        ->toContain("'customer_uuid'");
+});
+
+test('verification code slugs are FleetOps-namespaced, not Storefront', function () {
+    $source = file_get_contents(dirname(__DIR__) . '/src/Http/Controllers/Api/v1/CustomerController.php');
+
+    expect($source)
+        ->toContain("'fleetops_create_customer'")
+        ->toContain("'fleetops_customer_login'")
+        ->toContain("'fleetops_customer_password_reset'")
+        ->not->toContain("'storefront_create_customer'")
+        ->not->toContain("'storefront_login'");
+});
+
+test('AuthenticateCustomerToken enforces a customer-token + company cross-check', function () {
+    expect(class_exists(AuthenticateCustomerToken::class))->toBeTrue();
+
+    $source = file_get_contents(dirname(__DIR__) . '/src/Http/Middleware/AuthenticateCustomerToken.php');
+    expect($source)
+        ->toContain('Customer token is missing or invalid')
+        ->toContain('Customer does not belong to this company')
+        ->toContain('CustomerAuth::resolveFromHeader')
+        ->toContain('CustomerAuth::setCurrent');
+});
+
+test('CustomerAuth resolves tokens by contact UUID with company-preferred fallback', function () {
+    expect(class_exists(CustomerAuth::class))->toBeTrue()
+        ->and(method_exists(CustomerAuth::class, 'resolveFromHeader'))->toBeTrue()
+        ->and(method_exists(CustomerAuth::class, 'current'))->toBeTrue()
+        ->and(method_exists(CustomerAuth::class, 'setCurrent'))->toBeTrue()
+        ->and(CustomerAuth::HEADER)->toBe('Customer-Token');
+
+    $source = file_get_contents(dirname(__DIR__) . '/src/Support/CustomerAuth.php');
+    expect($source)
+        ->toContain('PersonalAccessToken::findToken')
+        ->toContain("->where('type', 'customer')")
+        ->toContain("->where('company_uuid'");
+});
+
+test('Customer model extends Contact with a type=customer global scope', function () {
+    expect(is_subclass_of(CustomerModel::class, Fleetbase\FleetOps\Models\Contact::class))->toBeTrue();
+
+    $source = file_get_contents(dirname(__DIR__) . '/src/Models/Customer.php');
+    expect($source)
+        ->toContain("\$model->type = 'customer'")
+        ->toContain("->where('type', 'customer')");
+});
+
+test('Customer API resource exposes token and orders_count for the consumable shape', function () {
+    expect(class_exists(CustomerResource::class))->toBeTrue();
+
+    $source = file_get_contents(dirname(__DIR__) . '/src/Http/Resources/v1/Customer.php');
+    expect($source)
+        ->toContain("'token'")
+        ->toContain("'orders_count'")
+        ->toContain("Str::replaceFirst('contact', 'customer'");
+});
+
+test('Customer API resource includes a company sub-object resolved from the API credential', function () {
+    $source = file_get_contents(dirname(__DIR__) . '/src/Http/Resources/v1/Customer.php');
+
+    expect($source)
+        // The sub-object lives on `company`, keyed off the customer's company_uuid.
+        ->toContain("'company'")
+        ->toContain('buildCompanyPayload')
+        // Currency must be resolved through the existing canonical helper —
+        // never hardcoded, never aliased.
+        ->toContain('Utils::getCompanyTransactionCurrency')
+        // Public-safe projection only: id, name, currency, country, phone.
+        ->toContain("'currency'")
+        ->toContain("'country'")
+        ->toContain("'phone'");
+});
+
+test('FormRequest validators are present and authorize via api credential', function () {
+    expect(class_exists(CreateCustomerRequest::class))->toBeTrue()
+        ->and(class_exists(VerifyCreateCustomerRequest::class))->toBeTrue()
+        ->and(class_exists(CreateCustomerOrderRequest::class))->toBeTrue();
+
+    $create = file_get_contents(dirname(__DIR__) . '/src/Http/Requests/CreateCustomerRequest.php');
+    $verify = file_get_contents(dirname(__DIR__) . '/src/Http/Requests/VerifyCreateCustomerRequest.php');
+
+    expect($create)
+        ->toContain("'code'     => 'required|exists:verification_codes,code'")
+        ->toContain("'password' => 'required|string|min:8'")
+        ->and($verify)->toContain("'mode'     => 'required|in:email,sms'");
+});

package/server/tests/DriverVehicleStatusDefaultTest.php

@@ -0,0 +1,39 @@
+<?php
+
+use Fleetbase\FleetOps\Models\Driver;
+use Fleetbase\FleetOps\Models\Vehicle;
+
+test('driver and vehicle statuses default to available', function () {
+    expect((new Driver())->status)
+        ->toBe('available')
+        ->and((new Vehicle())->status)
+        ->toBe('available');
+});
+
+test('legacy active and null driver and vehicle statuses normalize to available', function () {
+    $driver = new Driver();
+    $driver->status = 'active';
+    expect($driver->status)->toBe('available');
+
+    $driver->status = null;
+    expect($driver->status)->toBe('available');
+
+    $vehicle = new Vehicle();
+    $vehicle->status = 'active';
+    expect($vehicle->status)->toBe('available');
+
+    $vehicle->status = null;
+    expect($vehicle->status)->toBe('available');
+});
+
+test('dispatch driver availability queries use available status', function () {
+    $listener = file_get_contents(dirname(__DIR__) . '/src/Listeners/HandleOrderDispatched.php');
+    $order    = file_get_contents(dirname(__DIR__) . '/src/Models/Order.php');
+
+    expect($listener)
+        ->toContain("'status' => 'available'")
+        ->not->toContain("Driver::where(['status' => 'active'")
+        ->and($order)
+        ->toContain("'status' => 'available'")
+        ->not->toContain("Driver::where(['status' => 'active'");
+});

package/server/tests/LabelPdfRenderingTest.php

@@ -0,0 +1,23 @@
+<?php
+
+test('labels use the shared utf8 pdf renderer instead of arabic-only html rewriting', function () {
+    $labelPdf = file_get_contents(dirname(__DIR__) . '/src/Support/LabelPdf.php');
+    $order    = file_get_contents(dirname(__DIR__) . '/src/Models/Order.php');
+    $waypoint = file_get_contents(dirname(__DIR__) . '/src/Models/Waypoint.php');
+    $entity   = file_get_contents(dirname(__DIR__) . '/src/Models/Entity.php');
+    $default  = file_get_contents(dirname(__DIR__) . '/resources/views/labels/default.php');
+    $stop     = file_get_contents(dirname(__DIR__) . '/resources/views/labels/waypoint-label.php');
+    $utils    = file_get_contents(dirname(__DIR__) . '/src/Support/Utils.php');
+
+    expect($labelPdf)
+        ->toContain("Pdf::loadHTML(\$html, 'UTF-8')")
+        ->toContain("'defaultFont'             => 'DejaVu Sans'")
+        ->and($order)->toContain('LabelPdf::fromHtml($this->label())')
+        ->and($waypoint)->toContain('LabelPdf::fromHtml($this->label())')
+        ->and($entity)->toContain('LabelPdf::fromHtml($this->label())')
+        ->and($default)->toContain('Noto Sans Arabic')
+        ->not->toContain('strtoupper($company->name)')
+        ->and($stop)->toContain('Noto Sans CJK JP')
+        ->not->toContain('strtoupper($company->name)')
+        ->and($utils)->not->toContain('fixArabicInHTML');
+});

package/server/tests/LiveControllerViewportTest.php

@@ -0,0 +1,60 @@
+<?php
+
+use Fleetbase\FleetOps\Http\Controllers\Internal\v1\LiveController;
+use Fleetbase\FleetOps\Models\Driver;
+use Illuminate\Http\Request;
+
+function callLiveControllerMethod(string $method, array $arguments = [])
+{
+    $reflection = new ReflectionMethod(LiveController::class, $method);
+    $reflection->setAccessible(true);
+
+    return $reflection->invokeArgs(new LiveController(), $arguments);
+}
+
+test('live viewport bounds are normalized for stable cache keys', function () {
+    $request = new Request([
+        'bounds' => ['1.234567', '103.876543', '1.345678', '103.987654'],
+    ]);
+
+    expect(callLiveControllerMethod('normalizeLiveBounds', [$request]))
+        ->toBe([1.2346, 103.8765, 1.3457, 103.9877]);
+});
+
+test('invalid live viewport bounds fall back to unbounded queries', function ($bounds) {
+    $request = new Request(['bounds' => $bounds]);
+
+    expect(callLiveControllerMethod('normalizeLiveBounds', [$request]))->toBeNull();
+})->with([
+    'missing coordinate' => [[1, 2, 3]],
+    'non numeric'        => [[1, 'west', 3, 4]],
+    'invalid latitude'   => [[-91, 103, 1, 104]],
+    'invalid longitude'  => [[1, -181, 2, 104]],
+    'inverted latitude'  => [[2, 103, 1, 104]],
+    'inverted longitude' => [[1, 104, 2, 103]],
+]);
+
+test('live viewport limit defaults and clamps', function () {
+    expect(callLiveControllerMethod('normalizeLiveLimit', [new Request()]))->toBe(500)
+        ->and(callLiveControllerMethod('normalizeLiveLimit', [new Request(['limit' => 25])]))->toBe(25)
+        ->and(callLiveControllerMethod('normalizeLiveLimit', [new Request(['limit' => 0])]))->toBe(500)
+        ->and(callLiveControllerMethod('normalizeLiveLimit', [new Request(['limit' => 5000])]))->toBe(1000);
+});
+
+test('live viewport query avoids spatial constructors with fixed srids', function () {
+    $query = Driver::query();
+
+    callLiveControllerMethod('applyLiveLocationGuards', [$query]);
+    callLiveControllerMethod('applyLiveViewportBounds', [$query, [1.2, 103.8, 1.4, 104.0]]);
+    $query->orderByDesc('updated_at')->orderByDesc('id')->limit(25);
+
+    $sql = $query->toSql();
+
+    expect($sql)->toContain('ST_Y(location) BETWEEN ? AND ?')
+        ->and($sql)->toContain('ST_X(location) BETWEEN ? AND ?')
+        ->and($sql)->toContain('limit 25')
+        ->and($sql)->not->toContain('ST_MakeEnvelope')
+        ->and($sql)->not->toContain('ST_GeomFromText');
+
+    expect($query->getBindings())->toContain(1.2, 1.4, 103.8, 104.0);
+});

package/server/tests/MetricsRegistryTest.php

@@ -0,0 +1,84 @@
+<?php
+
+use Fleetbase\FleetOps\Support\Metrics\AbstractMetric;
+use Fleetbase\FleetOps\Support\Metrics\OrdersInProgressMetric;
+use Fleetbase\FleetOps\Support\Metrics\Registry;
+use Fleetbase\FleetOps\Support\Metrics\TotalTimeTraveledMetric;
+
+test('registry exposes every known metric slug', function () {
+    $slugs = Registry::slugs();
+
+    expect($slugs)->toContain('earnings');
+    expect($slugs)->toContain('fuel_costs');
+    expect($slugs)->toContain('total_distance_traveled');
+    expect($slugs)->toContain('total_time_traveled');
+    expect($slugs)->toContain('orders_completed');
+    expect($slugs)->toContain('orders_canceled');
+    expect($slugs)->toContain('orders_in_progress');
+    expect($slugs)->toContain('orders_scheduled');
+    expect($slugs)->toContain('active_live_orders');
+    expect($slugs)->toContain('drivers_online');
+    expect($slugs)->toContain('total_drivers');
+    expect($slugs)->toContain('total_customers');
+    expect($slugs)->toContain('open_issues');
+    expect($slugs)->toContain('resolved_issues');
+    expect($slugs)->toContain('avg_order_value');
+});
+
+test('registry resolves unknown slugs to null', function () {
+    expect(Registry::resolve('does_not_exist'))->toBeNull();
+});
+
+test('every registered metric extends the abstract base', function () {
+    foreach (Registry::all() as $slug => $class) {
+        expect(is_subclass_of($class, AbstractMetric::class))
+            ->toBeTrue("Metric class for slug '{$slug}' must extend AbstractMetric");
+        expect($class::slug())->toBe($slug);
+    }
+});
+
+test('open and resolved issue metrics scope to the constructor company (not session)', function () {
+    $sourceOpen     = file_get_contents(dirname(__DIR__) . '/src/Support/Metrics/OpenIssuesMetric.php');
+    $sourceResolved = file_get_contents(dirname(__DIR__) . '/src/Support/Metrics/ResolvedIssuesMetric.php');
+
+    expect($sourceOpen)->not->toContain("session('company')");
+    expect($sourceOpen)->toContain('$this->company->uuid');
+    expect($sourceResolved)->not->toContain("session('company')");
+    expect($sourceResolved)->toContain('$this->company->uuid');
+});
+
+test('total_time_traveled metric sums the time column, not distance', function () {
+    $source = file_get_contents(dirname(__DIR__) . '/src/Support/Metrics/TotalTimeTraveledMetric.php');
+
+    expect($source)->toContain("\$query->sum('time')");
+    expect($source)->not->toContain("\$query->sum('distance')");
+    expect(TotalTimeTraveledMetric::slug())->toBe('total_time_traveled');
+});
+
+test('money metrics return float values to preserve cents', function () {
+    $earnings  = file_get_contents(dirname(__DIR__) . '/src/Support/Metrics/EarningsMetric.php');
+    $fuelCosts = file_get_contents(dirname(__DIR__) . '/src/Support/Metrics/FuelCostsMetric.php');
+
+    expect($earnings)->toContain('(float) $query->sum');
+    expect($earnings)->not->toMatch('/\(int\)\s*\$query->sum/');
+    expect($fuelCosts)->toContain('(float) $query->sum');
+    expect($fuelCosts)->not->toMatch('/\(int\)\s*\$query->sum/');
+});
+
+test('money metrics filter by currency to avoid mixed-currency sums', function () {
+    $earnings  = file_get_contents(dirname(__DIR__) . '/src/Support/Metrics/EarningsMetric.php');
+    $fuelCosts = file_get_contents(dirname(__DIR__) . '/src/Support/Metrics/FuelCostsMetric.php');
+    $aov       = file_get_contents(dirname(__DIR__) . '/src/Support/Metrics/AvgOrderValueMetric.php');
+
+    expect($earnings)->toContain("->where('currency'");
+    expect($fuelCosts)->toContain("->where('currency'");
+    expect($aov)->toContain("->where('currency'");
+});
+
+test('ordersInProgress uses an explicit allowlist rather than an exclusion list', function () {
+    $statuses = OrdersInProgressMetric::IN_PROGRESS_STATUSES;
+    expect($statuses)->toBeArray();
+    expect($statuses)->not->toBeEmpty();
+    expect($statuses)->toContain('dispatched');
+    expect($statuses)->toContain('started');
+});

package/server/tests/OrchestrationPayloadBuilderTest.php

@@ -39,7 +39,7 @@ function orchestrationTestOrder($pickup = null, $dropoff = null, array $waypoint
         public function __construct(public $pickup, public $dropoff, array $waypoints)
         {
             $this->entities         = collect();
-            $this->waypointMarkers = collect($waypoints)->map(function ($place, $index) {
+            $this->waypointMarkers  = collect($waypoints)->map(function ($place, $index) {
                 return new class($place, $index) {
                     public string $public_id;
                     public string $uuid;
@@ -61,7 +61,7 @@ function orchestrationTestOrder($pickup = null, $dropoff = null, array $waypoint
         }
     };
 
-    $order = new Order();
+    $order            = new Order();
     $order->public_id = 'order_test';
     $order->setRelation('payload', $payload);
 

package/server/tests/OrderConfigEndpointTest.php

@@ -0,0 +1,86 @@
+<?php
+
+use Fleetbase\FleetOps\Http\Controllers\Api\v1\OrderConfigController;
+use Fleetbase\FleetOps\Http\Resources\Internal\v1\OrderConfig as InternalOrderConfigResource;
+use Fleetbase\FleetOps\Http\Resources\v1\OrderConfig as OrderConfigResource;
+
+/*
+|--------------------------------------------------------------------------
+| OrderConfig API surface — static shape checks.
+|
+| The OrderConfig public API surface gives consumers (customer portals,
+| third-party integrations) a read-only projection of the OrderConfig
+| `flow` JSON so they can drive status filters, activity labels, and
+| similar UI from the canonical config rather than hardcoding their own.
+|
+| These mirror the lightweight static checks used elsewhere in this
+| package and verify the routes, controller methods, and resource shape
+| exist without booting Laravel.
+|--------------------------------------------------------------------------
+*/
+
+test('order-configs route group is registered in the consumable v1 namespace', function () {
+    $routes = file_get_contents(dirname(__DIR__) . '/src/routes.php');
+
+    expect($routes)
+        ->toContain("\$router->group(['prefix' => 'order-configs']")
+        ->and($routes)->toContain('OrderConfigController@query')
+        ->and($routes)->toContain('OrderConfigController@find');
+});
+
+test('OrderConfigController exposes only read-only methods', function () {
+    foreach (['query', 'find'] as $method) {
+        expect(method_exists(OrderConfigController::class, $method))->toBeTrue(
+            "OrderConfigController::{$method} missing",
+        );
+    }
+
+    // No write methods are exposed — OrderConfigs are owned by operator UIs.
+    foreach (['create', 'update', 'delete', 'store', 'destroy'] as $method) {
+        expect(method_exists(OrderConfigController::class, $method))->toBeFalse(
+            "OrderConfigController::{$method} should NOT exist on the public surface",
+        );
+    }
+});
+
+test('find() resolves by uuid, public_id, namespace, or key', function () {
+    $source = file_get_contents(dirname(__DIR__) . '/src/Http/Controllers/Api/v1/OrderConfigController.php');
+
+    // The controller defers to the canonical resolver so /transport,
+    // /system:order-config:transport, the public_id, and the uuid all work.
+    expect($source)
+        ->toContain('OrderConfig::resolveFromIdentifier')
+        ->toContain('findRecordOrFail');
+});
+
+test('OrderConfig resource projects only public-safe fields', function () {
+    expect(class_exists(OrderConfigResource::class))->toBeTrue();
+
+    $source = file_get_contents(dirname(__DIR__) . '/src/Http/Resources/v1/OrderConfig.php');
+
+    expect($source)
+        // Public contract: id/key/name/namespace + the flow projection.
+        ->toContain("'key'")
+        ->toContain("'name'")
+        ->toContain("'namespace'")
+        ->toContain("'flow'")
+        ->toContain('projectFlow')
+        // Each flow row keeps the canonical activity keys.
+        ->toContain("'code'")
+        ->toContain("'status'")
+        ->toContain("'complete'")
+        // Internal config payload must not be exposed on the public surface.
+        ->not->toContain("'entities'");
+});
+
+test('internal OrderConfig resource preserves editable flow graph fields', function () {
+    expect(class_exists(InternalOrderConfigResource::class))->toBeTrue();
+
+    $source = file_get_contents(dirname(__DIR__) . '/src/Http/Resources/Internal/v1/OrderConfig.php');
+
+    expect($source)
+        ->toContain("'flow'")
+        ->toContain('$this->flow')
+        ->toContain("'entities'")
+        ->toContain("'core_service'");
+});

package/server/tests/OrderFileAttachmentTest.php

@@ -0,0 +1,20 @@
+<?php
+
+test('order file updates attach files to the order like creation does', function () {
+    $controller = file_get_contents(dirname(__DIR__) . '/src/Http/Controllers/Internal/v1/OrderController.php');
+    $orderModel = file_get_contents(dirname(__DIR__) . '/src/Models/Order.php');
+    $detailsJs  = file_get_contents(dirname(dirname(__DIR__)) . '/addon/components/order/details/documents.js');
+    $formJs     = file_get_contents(dirname(dirname(__DIR__)) . '/addon/components/order/form/documents.js');
+
+    expect($controller)
+        ->toContain("\$uploads = \$request->array('order.files')")
+        ->toContain('$order->attachFiles($uploads)')
+        ->and($orderModel)
+        ->toContain('public function attachFiles($uploads): self')
+        ->toContain('$file->setKey($this)')
+        ->and($detailsJs)
+        ->toContain("subject_type: 'fleet-ops:order'")
+        ->and($formJs)
+        ->toContain('if (!this.args.resource.isNew)')
+        ->toContain('subject_uuid = this.args.resource.id');
+});

package/server/tests/ServiceAreaZoneApiShapeTest.php

@@ -0,0 +1,34 @@
+<?php
+
+test('service area create and update accept persisted map geometry and style fields', function () {
+    $controller = file_get_contents(__DIR__ . '/../src/Http/Controllers/Api/v1/ServiceAreaController.php');
+
+    expect($controller)
+        ->toContain("'border'")
+        ->toContain("'color'")
+        ->toContain("'stroke_color'");
+});
+
+test('service area resource returns map geometry and style fields', function () {
+    $resource = file_get_contents(__DIR__ . '/../src/Http/Resources/v1/ServiceArea.php');
+
+    expect($resource)
+        ->toContain("'border'")
+        ->toContain("'color'")
+        ->toContain("'stroke_color'")
+        ->toContain("'trigger_on_entry'")
+        ->toContain("'trigger_on_exit'");
+});
+
+test('zone create accepts only service area public ids on the consumable api', function () {
+    $request    = file_get_contents(__DIR__ . '/../src/Http/Requests/CreateZoneRequest.php');
+    $controller = file_get_contents(__DIR__ . '/../src/Http/Controllers/Api/v1/ZoneController.php');
+
+    expect($request)
+        ->toContain("'service_area'")
+        ->not->toContain("'service_area_uuid'");
+
+    expect($controller)
+        ->toContain("'public_id'    => \$request->input('service_area')")
+        ->not->toContain("->orWhere('uuid'");
+});

package/server/tests/VehicleDriverAssignmentTest.php

@@ -0,0 +1,18 @@
+<?php
+
+test('vehicle updates preserve driver assignment unless driver input is explicit', function () {
+    $internalController = file_get_contents(dirname(__DIR__) . '/src/Http/Controllers/Internal/v1/VehicleController.php');
+    $publicController   = file_get_contents(dirname(__DIR__) . '/src/Http/Controllers/Api/v1/VehicleController.php');
+    $vehicleModel       = file_get_contents(dirname(__DIR__) . '/src/Models/Vehicle.php');
+
+    expect($internalController)
+        ->toContain('hasDriverInput($request)')
+        ->toContain('syncDriverAssignment($vehicle, $this->driverIdentifierFromRequest($request))')
+        ->toContain("Arr::has(\$payload, 'vehicle.driver_uuid')")
+        ->and($publicController)
+        ->toContain("\$request->exists('driver')")
+        ->toContain('$vehicle->unassignDriver()')
+        ->and($vehicleModel)
+        ->toContain('public function unassignDriver(): self')
+        ->toContain("Driver::where('vehicle_uuid', \$this->uuid)->update(['vehicle_uuid' => null])");
+});