@fleetbase/fleetops-engine 0.6.49 → 0.6.50

package/server/src/Tracking/TrackingIntelligenceService.php

@@ -8,6 +8,8 @@ use Illuminate\Support\Facades\Cache;
 
 class TrackingIntelligenceService
 {
+    protected const TERMINAL_STATUSES = ['completed', 'canceled'];
+
     public function __construct(
         protected TrackingContextBuilder $contextBuilder,
         protected TrackingProviderManager $providerManager,
@@ -34,19 +36,28 @@ class TrackingIntelligenceService
             'completion_seconds'  => data_get($tracker, 'eta.completion_seconds'),
             'active_stop_at'      => data_get($tracker, 'eta.active_stop_at'),
             'completion_at'       => data_get($tracker, 'eta.completion_at'),
+            'start_seconds'       => data_get($tracker, 'eta.start_seconds'),
+            'start_at'            => data_get($tracker, 'eta.start_at'),
             'provider'            => data_get($tracker, 'provider'),
             'confidence'          => data_get($tracker, 'confidence'),
+            'lifecycle'           => data_get($tracker, 'lifecycle'),
             'warnings'            => data_get($tracker, 'warnings', []),
         ];
     }
 
     protected function buildResult(TrackingContext $context, TrackingProviderResult $providerResult, TrackingOptions $options): array
     {
-        $now               = now();
-        $completionSeconds = $providerResult->durationInTrafficSeconds ?? $providerResult->durationSeconds;
-        $activeStopSeconds = data_get($providerResult->legs, '0.duration_in_traffic_s', data_get($providerResult->legs, '0.duration_s', $completionSeconds));
-        $progress          = $this->progress($context, $providerResult);
-        $warnings          = array_values(array_unique([...$context->warnings, ...$providerResult->warnings]));
+        $now                  = now();
+        $rawCompletionSeconds = $providerResult->durationInTrafficSeconds ?? $providerResult->durationSeconds;
+        $rawActiveStopSeconds = data_get($providerResult->legs, '0.duration_in_traffic_s', data_get($providerResult->legs, '0.duration_s', $rawCompletionSeconds));
+        $lifecycle            = $this->lifecycle($context, $rawActiveStopSeconds, $now);
+        $showsLiveEta         = (bool) data_get($lifecycle, 'show_live_eta');
+        $showsStartEta        = (bool) data_get($lifecycle, 'show_start_eta');
+        $completionSeconds    = $showsLiveEta ? $rawCompletionSeconds : null;
+        $activeStopSeconds    = $showsLiveEta ? $rawActiveStopSeconds : null;
+        $startSeconds         = $showsStartEta ? $rawActiveStopSeconds : null;
+        $progress             = $this->progress($context, $providerResult);
+        $warnings             = array_values(array_unique([...$context->warnings, ...$providerResult->warnings]));
 
         if ($providerResult->confidence === 'low') {
             $warnings[] = 'low_confidence_eta';
@@ -64,6 +75,7 @@ class TrackingIntelligenceService
                 'online'               => (bool) data_get($context->driver, 'online', false),
             ],
             'progress'          => $progress,
+            'lifecycle'         => $lifecycle,
             'stops'             => $context->stops->map(fn (TrackingStop $stop) => $stop->toArray())->values()->all(),
             'active_stop'       => $context->activeStop?->toArray(),
             'next_stop'         => $context->nextStop?->toArray(),
@@ -73,13 +85,15 @@ class TrackingIntelligenceService
                 'duration_in_traffic_s' => $providerResult->durationInTrafficSeconds,
                 'polyline'              => $providerResult->polyline,
                 'coordinates'           => $providerResult->coordinates,
-                'legs'                  => $this->legs($context, $providerResult, $now),
+                'legs'                  => $this->legs($context, $providerResult, $now, $showsLiveEta),
             ],
             'eta'               => [
                 'active_stop_seconds' => $activeStopSeconds,
                 'completion_seconds'  => $completionSeconds,
                 'active_stop_at'      => $this->addSeconds($now, $activeStopSeconds),
                 'completion_at'       => $this->addSeconds($now, $completionSeconds),
+                'start_seconds'       => $startSeconds,
+                'start_at'            => $this->addSeconds($now, $startSeconds),
             ],
             'insights'          => [
                 'is_delayed'          => false,
@@ -107,17 +121,17 @@ class TrackingIntelligenceService
         ];
     }
 
-    protected function legs(TrackingContext $context, TrackingProviderResult $providerResult, Carbon $now): array
+    protected function legs(TrackingContext $context, TrackingProviderResult $providerResult, Carbon $now, bool $showsLiveEta = true): array
     {
         $elapsedSeconds = 0;
 
-        return collect($providerResult->legs)->map(function ($leg, $index) use ($context, $now, &$elapsedSeconds) {
+        return collect($providerResult->legs)->map(function ($leg, $index) use ($context, $now, $showsLiveEta, &$elapsedSeconds) {
             $stop        = $context->remainingStops->values()->get($index);
             $legSeconds  = data_get($leg, 'duration_in_traffic_s', data_get($leg, 'duration_s'));
             $etaSeconds  = null;
             $etaAt       = null;
 
-            if ($legSeconds !== null) {
+            if ($showsLiveEta && $stop instanceof TrackingStop && $legSeconds !== null) {
                 $elapsedSeconds += (float) $legSeconds;
                 $etaSeconds = $elapsedSeconds;
                 $etaAt      = $this->addSeconds($now, $etaSeconds);
@@ -131,6 +145,92 @@ class TrackingIntelligenceService
         })->all();
     }
 
+    protected function lifecycle(TrackingContext $context, ?float $startSeconds, Carbon $now): array
+    {
+        $order             = $context->order;
+        $status            = strtolower((string) ($order->status ?? 'created'));
+        $hasAssignedDriver = !empty($order->driver_assigned_uuid);
+        $hasStarted        = $this->hasOrderStarted($order);
+        $isTerminal        = in_array($status, self::TERMINAL_STATUSES, true);
+        $isDispatched      = $status === 'dispatched' || (bool) $order->dispatched;
+
+        if ($isTerminal) {
+            return [
+                'status'         => $status,
+                'mode'           => $status,
+                'message'        => $status === 'completed' ? 'Order has been completed.' : 'Order has been canceled.',
+                'is_terminal'    => true,
+                'has_started'    => $hasStarted,
+                'show_live_eta'  => false,
+                'show_start_eta' => false,
+            ];
+        }
+
+        if (!$hasAssignedDriver) {
+            return [
+                'status'         => $status,
+                'mode'           => 'unassigned',
+                'message'        => 'Assign a driver to start live tracking and improve ETA accuracy.',
+                'is_terminal'    => false,
+                'has_started'    => $hasStarted,
+                'show_live_eta'  => false,
+                'show_start_eta' => false,
+            ];
+        }
+
+        if (!$hasStarted && $isDispatched) {
+            return [
+                'status'         => $status,
+                'mode'           => 'dispatched',
+                'message'        => 'Order has been dispatched. Estimated start is based on the assigned driver route to the first stop.',
+                'is_terminal'    => false,
+                'has_started'    => false,
+                'show_live_eta'  => false,
+                'show_start_eta' => $startSeconds !== null,
+                'start_at'       => $this->addSeconds($now, $startSeconds),
+            ];
+        }
+
+        if (!$hasStarted) {
+            return [
+                'status'         => $status,
+                'mode'           => 'pre_start',
+                'message'        => 'Live ETA will begin once the order is started.',
+                'is_terminal'    => false,
+                'has_started'    => false,
+                'show_live_eta'  => false,
+                'show_start_eta' => false,
+            ];
+        }
+
+        return [
+            'status'         => $status,
+            'mode'           => 'active',
+            'message'        => null,
+            'is_terminal'    => false,
+            'has_started'    => true,
+            'show_live_eta'  => true,
+            'show_start_eta' => false,
+        ];
+    }
+
+    protected function hasOrderStarted(Order $order): bool
+    {
+        if ((bool) $order->started || $order->started_at || strtolower((string) $order->status) === 'started') {
+            return true;
+        }
+
+        try {
+            if ($order->relationLoaded('trackingStatuses')) {
+                return $order->trackingStatuses->contains(fn ($status) => strtolower((string) data_get($status, 'code')) === 'started');
+            }
+
+            return $order->trackingStatuses()->whereRaw('LOWER(code) = ?', ['started'])->exists();
+        } catch (\Throwable) {
+            return false;
+        }
+    }
+
     protected function capabilitiesFor(string $provider): array
     {
         $registry   = app(TrackingProviderRegistry::class);

package/server/src/Tracking/TrackingStop.php

@@ -18,6 +18,7 @@ class TrackingStop implements \JsonSerializable
         public ?Waypoint $waypoint = null,
         public bool $completed = false,
         public ?int $sequence = null,
+        public ?string $trackingNumberUuid = null,
     ) {
     }
 
@@ -35,20 +36,21 @@ class TrackingStop implements \JsonSerializable
         $point = $this->point();
 
         return [
-            'uuid'       => $this->uuid,
-            'public_id'  => $this->publicId,
-            'type'       => $this->type,
-            'status'     => $this->status,
-            'completed'  => $this->completed,
-            'sequence'   => $this->sequence,
-            'address'    => data_get($this->place, 'address'),
-            'name'       => data_get($this->place, 'name'),
-            'location'   => $point ? [
+            'uuid'                 => $this->uuid,
+            'public_id'            => $this->publicId,
+            'type'                 => $this->type,
+            'status'               => $this->status,
+            'completed'            => $this->completed,
+            'sequence'             => $this->sequence,
+            'tracking_number_uuid' => $this->trackingNumberUuid,
+            'address'              => data_get($this->place, 'address'),
+            'name'                 => data_get($this->place, 'name'),
+            'location'             => $point ? [
                 'type'        => 'Point',
                 'coordinates' => [$point->getLng(), $point->getLat()],
             ] : null,
-            'latitude'   => $point ? $point->getLat() : null,
-            'longitude'  => $point ? $point->getLng() : null,
+            'latitude'             => $point ? $point->getLat() : null,
+            'longitude'            => $point ? $point->getLng() : null,
         ];
     }
 

package/server/src/routes.php

@@ -49,6 +49,38 @@ Route::prefix(config('fleetops.api.routing.prefix', null))->namespace('Fleetbase
                 $router->put('{id}', 'ContactController@update');
                 $router->delete('{id}', 'ContactController@delete');
             });
+            // order-configs — read-only public projection of the OrderConfig flow.
+            $router->group(['prefix' => 'order-configs'], function () use ($router) {
+                $router->get('/', 'OrderConfigController@query');
+                $router->get('{id}', 'OrderConfigController@find');
+            });
+            // customers routes — public B2C customer auth + customer-scoped orders.
+            //  - Public endpoints: API key only (resolves company from credential)
+            //  - Authenticated endpoints: API key + `Customer-Token` header (Sanctum)
+            $router->group(['prefix' => 'customers', 'middleware' => []], function () use ($router) {
+                // Public auth flows
+                $router->post('request-creation-code', 'CustomerController@requestCreationCode');
+                $router->post('/', 'CustomerController@create');
+                $router->post('login', 'CustomerController@login');
+                $router->post('login-with-sms', 'CustomerController@loginWithPhone');
+                $router->post('verify-code', 'CustomerController@verifyCode');
+                $router->post('forgot-password', 'CustomerController@forgotPassword');
+                $router->post('reset-password', 'CustomerController@resetPassword');
+
+                // Authenticated (require Customer-Token)
+                $router->group(['middleware' => [Fleetbase\FleetOps\Http\Middleware\AuthenticateCustomerToken::class]], function () use ($router) {
+                    $router->get('me', 'CustomerController@me');
+                    $router->put('me', 'CustomerController@updateMe');
+                    $router->match(['post', 'patch'], 'me', 'CustomerController@updateMe');
+                    $router->post('logout', 'CustomerController@logout');
+                    $router->post('logout-all', 'CustomerController@logoutAll');
+                    $router->post('register-device', 'CustomerController@registerDevice');
+                    $router->get('places', 'CustomerController@places');
+                    $router->get('orders', 'CustomerController@orders');
+                    $router->post('orders', 'CustomerController@createOrder');
+                    $router->get('orders/{id}', 'CustomerController@findOrder');
+                });
+            });
             // vendors routes
             $router->group(['prefix' => 'vendors'], function () use ($router) {
                 $router->post('/', 'VendorController@create');
@@ -346,8 +378,10 @@ Route::prefix(config('fleetops.api.routing.prefix', null))->namespace('Fleetbase
                                 $router->get('{id}/tracker', 'OrderController@trackerInfo');
                                 $router->get('{id}/eta', 'OrderController@waypointEtas');
                                 $router->post('{id}/ping-driver', $controller('pingDriver'));
+                                $router->post('{id}/capture-photo/{subjectId?}', $controller('capturePhoto'));
                                 $router->post('process-imports', $controller('importFromFiles'));
                                 $router->patch('route/{id}', $controller('editOrderRoute'));
+                                $router->patch('set-destination/{id}/{placeId}', $controller('setDestination'));
                                 $router->patch('update-activity/{id}', $controller('updateActivity'));
                                 $router->get('{id}/proofs/{subjectId?}', $controller('proofs'));
                                 $router->patch('bulk-assign-driver', $controller('bulkAssignDriver'));
@@ -579,16 +613,16 @@ Route::prefix(config('fleetops.api.routing.prefix', null))->namespace('Fleetbase
                                 $router->group(
                                     ['prefix' => 'analytics'],
                                     function ($router) {
-                                        $router->get('operations-pulse',     'AnalyticsController@operationsPulse');
-                                        $router->get('revenue-trend',        'AnalyticsController@revenueTrend');
-                                        $router->get('orders-by-status',     'AnalyticsController@ordersByStatus');
-                                        $router->get('on-time-delivery',     'AnalyticsController@onTimeDelivery');
-                                        $router->get('top-drivers',          'AnalyticsController@topDrivers');
-                                        $router->get('fuel-efficiency',      'AnalyticsController@fuelEfficiency');
-                                        $router->get('issues-insights',      'AnalyticsController@issuesInsights');
+                                        $router->get('operations-pulse', 'AnalyticsController@operationsPulse');
+                                        $router->get('revenue-trend', 'AnalyticsController@revenueTrend');
+                                        $router->get('orders-by-status', 'AnalyticsController@ordersByStatus');
+                                        $router->get('on-time-delivery', 'AnalyticsController@onTimeDelivery');
+                                        $router->get('top-drivers', 'AnalyticsController@topDrivers');
+                                        $router->get('fuel-efficiency', 'AnalyticsController@fuelEfficiency');
+                                        $router->get('issues-insights', 'AnalyticsController@issuesInsights');
                                         $router->get('maintenance-overview', 'AnalyticsController@maintenanceOverview');
-                                        $router->get('geofence-violations',  'AnalyticsController@geofenceViolations');
-                                        $router->get('live-fleet',           'AnalyticsController@liveFleet');
+                                        $router->get('geofence-violations', 'AnalyticsController@geofenceViolations');
+                                        $router->get('live-fleet', 'AnalyticsController@liveFleet');
                                     }
                                 );
                                 $router->group(

package/server/tests/CapacityAllocationEngineTest.php

@@ -16,8 +16,8 @@ function capacityTestOrder(string $publicId, float $weightKg, float $volumeLitre
                     public float $weight;
                     public string $weight_unit = 'kg';
                     public float $length;
-                    public float $width = 1;
-                    public float $height = 1;
+                    public float $width            = 1;
+                    public float $height           = 1;
                     public string $dimensions_unit = 'm';
 
                     public function __construct(float $weightKg, float $volumeLitres)
@@ -30,8 +30,8 @@ function capacityTestOrder(string $publicId, float $weightKg, float $volumeLitre
         }
     };
 
-    $order = new Order();
-    $order->public_id = $publicId;
+    $order                  = new Order();
+    $order->public_id       = $publicId;
     $order->required_skills = $skills;
     $order->setRelation('payload', $payload);
 
@@ -40,14 +40,14 @@ function capacityTestOrder(string $publicId, float $weightKg, float $volumeLitre
 
 function capacityTestVehicle(string $publicId, float $weightKg, float $volumeM3 = 0, int $maxTasks = 0, array $skills = []): Vehicle
 {
-    $vehicle = new Vehicle();
-    $vehicle->public_id = $publicId;
-    $vehicle->payload_capacity = $weightKg;
-    $vehicle->payload_capacity_volume = $volumeM3;
+    $vehicle                           = new Vehicle();
+    $vehicle->public_id                = $publicId;
+    $vehicle->payload_capacity         = $weightKg;
+    $vehicle->payload_capacity_volume  = $volumeM3;
     $vehicle->payload_capacity_pallets = 0;
     $vehicle->payload_capacity_parcels = 100;
-    $vehicle->max_tasks = $maxTasks;
-    $vehicle->skills = $skills;
+    $vehicle->max_tasks                = $maxTasks;
+    $vehicle->skills                   = $skills;
     $vehicle->setRelation('driver', null);
 
     return $vehicle;

package/server/tests/CustomerContactIdentitySafetyTest.php

@@ -0,0 +1,54 @@
+<?php
+
+test('customer contacts reject existing non-customer users by identity', function () {
+    $contactModel  = file_get_contents(__DIR__ . '/../src/Models/Contact.php');
+    $conflictClass = file_get_contents(__DIR__ . '/../src/Exceptions/CustomerUserConflictException.php');
+    $observer      = file_get_contents(__DIR__ . '/../src/Observers/ContactObserver.php');
+
+    expect($contactModel)
+        ->toContain('assertCustomerIdentityIsAvailable')
+        ->toContain('assertCustomerUserCanBeAssigned')
+        ->toContain("orWhereHas('companyUsers'")
+        ->toContain("\$user->type === 'customer'")
+        ->toContain('cannot be used for a customer account');
+
+    expect($conflictClass)->toContain('class CustomerUserConflictException extends UserAlreadyExistsException');
+
+    expect($observer)
+        ->toContain('$contact->assertCustomerIdentityIsAvailable();')
+        ->toContain('$contact->normalizeCustomerUser();');
+});
+
+test('customer user assignment no longer promotes staff users', function () {
+    $contactModel = file_get_contents(__DIR__ . '/../src/Models/Contact.php');
+
+    expect($contactModel)
+        ->toContain('public function assignUser(User $user, bool $sendInvite = false): self')
+        ->toContain('$this->assertCustomerUserCanBeAssigned($user);')
+        ->not->toContain("if (\$this->isCustomer() && \$user->type !== 'customer') {\n            \$user->setType('customer');");
+});
+
+test('customer creation entrypoints run the customer identity guard', function () {
+    $apiContact      = file_get_contents(__DIR__ . '/../src/Http/Controllers/Api/v1/ContactController.php');
+    $internalContact = file_get_contents(__DIR__ . '/../src/Http/Controllers/Internal/v1/ContactController.php');
+    $orderController = file_get_contents(__DIR__ . '/../src/Http/Controllers/Api/v1/OrderController.php');
+    $customerForm    = file_get_contents(__DIR__ . '/../../addon/components/customer/form.hbs');
+
+    expect($apiContact)->toContain('$contactCandidate->assertCustomerIdentityIsAvailable();');
+    expect($internalContact)->toContain('$this->assertCustomerIdentityIsAvailable($input');
+    expect($orderController)->toContain('$customerCandidate->assertCustomerIdentityIsAvailable();');
+    expect($customerForm)->toContain('is_customer=true');
+});
+
+test('customer conflict audit command is registered and read only', function () {
+    $provider = file_get_contents(__DIR__ . '/../src/Providers/FleetOpsServiceProvider.php');
+    $command  = file_get_contents(__DIR__ . '/../src/Console/Commands/AuditCustomerUserConflicts.php');
+
+    expect($provider)->toContain('AuditCustomerUserConflicts::class');
+    expect($command)
+        ->toContain('fleetops:audit-customer-user-conflicts')
+        ->toContain('Reports customer contacts linked to users')
+        ->not->toContain('->save(')
+        ->not->toContain('->update(')
+        ->not->toContain('forceFill');
+});

package/server/tests/CustomerEndpointTest.php

@@ -0,0 +1,199 @@
+<?php
+
+use Fleetbase\FleetOps\Http\Controllers\Api\v1\CustomerController;
+use Fleetbase\FleetOps\Http\Middleware\AuthenticateCustomerToken;
+use Fleetbase\FleetOps\Http\Requests\CreateCustomerOrderRequest;
+use Fleetbase\FleetOps\Http\Requests\CreateCustomerRequest;
+use Fleetbase\FleetOps\Http\Requests\VerifyCreateCustomerRequest;
+use Fleetbase\FleetOps\Http\Resources\v1\Customer as CustomerResource;
+use Fleetbase\FleetOps\Models\Customer as CustomerModel;
+use Fleetbase\FleetOps\Support\CustomerAuth;
+
+/*
+|--------------------------------------------------------------------------
+| Customer API surface — static shape checks.
+|
+| These mirror the lightweight static checks used elsewhere in this package
+| (see PingDriverEndpointTest.php). They verify that the customer endpoints,
+| controller methods, middleware, and supporting classes exist and are wired
+| through `Api/v1/CustomerController` without the Storefront layer.
+|
+| End-to-end HTTP tests against a running app belong in the parent `api/`
+| project's test harness; this file ensures the package surface is correct.
+|--------------------------------------------------------------------------
+*/
+
+test('customers route group is registered inside the consumable v1 namespace', function () {
+    $routes = file_get_contents(dirname(__DIR__) . '/src/routes.php');
+
+    expect($routes)
+        ->toContain("\$router->group(['prefix' => 'customers', 'middleware' => []]")
+        ->and($routes)->toContain('CustomerController@requestCreationCode')
+        ->and($routes)->toContain('CustomerController@create')
+        ->and($routes)->toContain('CustomerController@login')
+        ->and($routes)->toContain('CustomerController@loginWithPhone')
+        ->and($routes)->toContain('CustomerController@verifyCode')
+        ->and($routes)->toContain('CustomerController@forgotPassword')
+        ->and($routes)->toContain('CustomerController@resetPassword');
+});
+
+test('authenticated customer routes are gated by AuthenticateCustomerToken middleware', function () {
+    $routes = file_get_contents(dirname(__DIR__) . '/src/routes.php');
+
+    expect($routes)
+        ->toContain('AuthenticateCustomerToken::class')
+        ->and($routes)->toContain('CustomerController@me')
+        ->and($routes)->toContain('CustomerController@updateMe')
+        ->and($routes)->toContain('CustomerController@logout')
+        ->and($routes)->toContain('CustomerController@logoutAll')
+        ->and($routes)->toContain('CustomerController@orders')
+        ->and($routes)->toContain('CustomerController@createOrder')
+        ->and($routes)->toContain('CustomerController@findOrder')
+        ->and($routes)->toContain('CustomerController@places')
+        ->and($routes)->toContain('CustomerController@registerDevice');
+});
+
+test('customer controller exposes the documented method surface', function () {
+    $expected = [
+        'requestCreationCode', 'create',
+        'login', 'loginWithPhone', 'verifyCode',
+        'forgotPassword', 'resetPassword',
+        'me', 'updateMe', 'logout', 'logoutAll',
+        'orders', 'createOrder', 'findOrder',
+        'places', 'registerDevice',
+    ];
+
+    foreach ($expected as $method) {
+        expect(method_exists(CustomerController::class, $method))->toBeTrue("CustomerController::{$method} missing");
+    }
+});
+
+test('customer controller does not reference Storefront concerns', function () {
+    $source = file_get_contents(dirname(__DIR__) . '/src/Http/Controllers/Api/v1/CustomerController.php');
+
+    expect($source)
+        ->not->toContain('Storefront::about')
+        ->not->toContain("session('storefront_key')")
+        ->not->toContain("session('storefront_store')")
+        ->not->toContain("session('storefront_network')")
+        ->not->toContain('storefront_id')
+        ->not->toContain('createStripeCustomerForContact');
+});
+
+test('customer controller does not introduce client-portal field aliases', function () {
+    // Public Fleetbase APIs must accept canonical model field names only. No
+    // aliasing like line1/state/zip → street1/province/postal_code, no portal-
+    // specific tagging like meta.origin, no top-level item/weight/value/mode
+    // aliases on order create — clients conform to the API, not vice versa.
+    $source = file_get_contents(dirname(__DIR__) . '/src/Http/Controllers/Api/v1/CustomerController.php');
+
+    expect($source)
+        ->not->toContain("'line1'")
+        ->not->toContain("'line2'")
+        ->not->toContain("'state'")
+        ->not->toContain("'zip'")
+        ->not->toContain("'origin' => 'fleetops_customer_portal'")
+        ->not->toContain('fleetops_customer_portal')
+        ->not->toContain("\$request->input('item'")
+        ->not->toContain("\$request->input('value'")
+        ->not->toContain("\$request->input('delivery'")
+        ->not->toContain("\$request->input('category'");
+});
+
+test('createOrder mirrors the canonical Fleet-Ops order shape', function () {
+    $source = file_get_contents(dirname(__DIR__) . '/src/Http/Controllers/Api/v1/CustomerController.php');
+
+    expect($source)
+        ->toContain('OrderConfig::resolveFromIdentifier')
+        ->toContain('buildPayloadFromInput')
+        ->toContain('Payload')
+        ->toContain('setPickup')
+        ->toContain('setDropoff')
+        ->toContain('setEntities')
+        ->toContain("'customer_uuid'");
+});
+
+test('verification code slugs are FleetOps-namespaced, not Storefront', function () {
+    $source = file_get_contents(dirname(__DIR__) . '/src/Http/Controllers/Api/v1/CustomerController.php');
+
+    expect($source)
+        ->toContain("'fleetops_create_customer'")
+        ->toContain("'fleetops_customer_login'")
+        ->toContain("'fleetops_customer_password_reset'")
+        ->not->toContain("'storefront_create_customer'")
+        ->not->toContain("'storefront_login'");
+});
+
+test('AuthenticateCustomerToken enforces a customer-token + company cross-check', function () {
+    expect(class_exists(AuthenticateCustomerToken::class))->toBeTrue();
+
+    $source = file_get_contents(dirname(__DIR__) . '/src/Http/Middleware/AuthenticateCustomerToken.php');
+    expect($source)
+        ->toContain('Customer token is missing or invalid')
+        ->toContain('Customer does not belong to this company')
+        ->toContain('CustomerAuth::resolveFromHeader')
+        ->toContain('CustomerAuth::setCurrent');
+});
+
+test('CustomerAuth resolves tokens by contact UUID with company-preferred fallback', function () {
+    expect(class_exists(CustomerAuth::class))->toBeTrue()
+        ->and(method_exists(CustomerAuth::class, 'resolveFromHeader'))->toBeTrue()
+        ->and(method_exists(CustomerAuth::class, 'current'))->toBeTrue()
+        ->and(method_exists(CustomerAuth::class, 'setCurrent'))->toBeTrue()
+        ->and(CustomerAuth::HEADER)->toBe('Customer-Token');
+
+    $source = file_get_contents(dirname(__DIR__) . '/src/Support/CustomerAuth.php');
+    expect($source)
+        ->toContain('PersonalAccessToken::findToken')
+        ->toContain("->where('type', 'customer')")
+        ->toContain("->where('company_uuid'");
+});
+
+test('Customer model extends Contact with a type=customer global scope', function () {
+    expect(is_subclass_of(CustomerModel::class, Fleetbase\FleetOps\Models\Contact::class))->toBeTrue();
+
+    $source = file_get_contents(dirname(__DIR__) . '/src/Models/Customer.php');
+    expect($source)
+        ->toContain("\$model->type = 'customer'")
+        ->toContain("->where('type', 'customer')");
+});
+
+test('Customer API resource exposes token and orders_count for the consumable shape', function () {
+    expect(class_exists(CustomerResource::class))->toBeTrue();
+
+    $source = file_get_contents(dirname(__DIR__) . '/src/Http/Resources/v1/Customer.php');
+    expect($source)
+        ->toContain("'token'")
+        ->toContain("'orders_count'")
+        ->toContain("Str::replaceFirst('contact', 'customer'");
+});
+
+test('Customer API resource includes a company sub-object resolved from the API credential', function () {
+    $source = file_get_contents(dirname(__DIR__) . '/src/Http/Resources/v1/Customer.php');
+
+    expect($source)
+        // The sub-object lives on `company`, keyed off the customer's company_uuid.
+        ->toContain("'company'")
+        ->toContain('buildCompanyPayload')
+        // Currency must be resolved through the existing canonical helper —
+        // never hardcoded, never aliased.
+        ->toContain('Utils::getCompanyTransactionCurrency')
+        // Public-safe projection only: id, name, currency, country, phone.
+        ->toContain("'currency'")
+        ->toContain("'country'")
+        ->toContain("'phone'");
+});
+
+test('FormRequest validators are present and authorize via api credential', function () {
+    expect(class_exists(CreateCustomerRequest::class))->toBeTrue()
+        ->and(class_exists(VerifyCreateCustomerRequest::class))->toBeTrue()
+        ->and(class_exists(CreateCustomerOrderRequest::class))->toBeTrue();
+
+    $create = file_get_contents(dirname(__DIR__) . '/src/Http/Requests/CreateCustomerRequest.php');
+    $verify = file_get_contents(dirname(__DIR__) . '/src/Http/Requests/VerifyCreateCustomerRequest.php');
+
+    expect($create)
+        ->toContain("'code'     => 'required|exists:verification_codes,code'")
+        ->toContain("'password' => 'required|string|min:8'")
+        ->and($verify)->toContain("'mode'     => 'required|in:email,sms'");
+});

package/server/tests/DriverVehicleStatusDefaultTest.php

@@ -0,0 +1,39 @@
+<?php
+
+use Fleetbase\FleetOps\Models\Driver;
+use Fleetbase\FleetOps\Models\Vehicle;
+
+test('driver and vehicle statuses default to available', function () {
+    expect((new Driver())->status)
+        ->toBe('available')
+        ->and((new Vehicle())->status)
+        ->toBe('available');
+});
+
+test('legacy active and null driver and vehicle statuses normalize to available', function () {
+    $driver = new Driver();
+    $driver->status = 'active';
+    expect($driver->status)->toBe('available');
+
+    $driver->status = null;
+    expect($driver->status)->toBe('available');
+
+    $vehicle = new Vehicle();
+    $vehicle->status = 'active';
+    expect($vehicle->status)->toBe('available');
+
+    $vehicle->status = null;
+    expect($vehicle->status)->toBe('available');
+});
+
+test('dispatch driver availability queries use available status', function () {
+    $listener = file_get_contents(dirname(__DIR__) . '/src/Listeners/HandleOrderDispatched.php');
+    $order    = file_get_contents(dirname(__DIR__) . '/src/Models/Order.php');
+
+    expect($listener)
+        ->toContain("'status' => 'available'")
+        ->not->toContain("Driver::where(['status' => 'active'")
+        ->and($order)
+        ->toContain("'status' => 'available'")
+        ->not->toContain("Driver::where(['status' => 'active'");
+});