@fleetbase/fleetops-engine 0.6.50 → 0.6.52

package/server/tests/TelematicsHardeningTest.php

@@ -0,0 +1,268 @@
+<?php
+
+use Fleetbase\FleetOps\Contracts\TelematicProviderDescriptor;
+
+test('device event model and migration expose lifecycle fields used by telematics workflows', function () {
+    $model     = file_get_contents(__DIR__ . '/../src/Models/DeviceEvent.php');
+    $migration = file_get_contents(__DIR__ . '/../migrations/2026_06_06_000001_harden_device_events_telematics_contract.php');
+
+    expect($migration)
+        ->toContain("'message'")
+        ->toContain("'occurred_at'")
+        ->toContain("'processed_at'")
+        ->toContain("'data'");
+
+    expect($model)
+        ->toContain("'message'")
+        ->toContain("'occurred_at'")
+        ->toContain("'processed_at'")
+        ->toContain("'data'")
+        ->toContain("'occurred_at'     => 'datetime'")
+        ->toContain("'processed_at'    => 'datetime'");
+});
+
+test('webhook controller resolves integrations explicitly and does not select the first provider record', function () {
+    $controller = file_get_contents(__DIR__ . '/../src/Http/Controllers/TelematicWebhookController.php');
+
+    expect($controller)
+        ->toContain('$this->service->resolveWebhookTelematic($providerKey')
+        ->toContain("'Unable to resolve telematic integration'")
+        ->toContain('$result[\'devices\'] ?? []')
+        ->toContain('$result[\'events\'] ?? []')
+        ->toContain('$result[\'sensors\'] ?? []')
+        ->toContain('Ambiguous telematic integration')
+        ->toContain('validateWebhookSignature($request->getContent(), $signature')
+        ->not->toContain("Telematic::where('provider', \$providerKey)\n            ->when")
+        ->not->toContain("->first();\n\n        if (!\$telematic)");
+});
+
+test('telematics service requires provider identity and stores idempotent event keys', function () {
+    $service = file_get_contents(__DIR__ . '/../src/Support/Telematics/TelematicService.php');
+
+    expect($service)
+        ->toContain('Provider device identity is required to link a telematics device.')
+        ->toContain('DeviceEvent::firstOrNew([\'_key\' => $eventKey])')
+        ->toContain('protected function makeEventKey')
+        ->toContain('$telematic->public_id ?? $telematic->uuid')
+        ->toContain('resolveWebhookTelematic')
+        ->toContain('whereHas(\'device\'')
+        ->toContain('meta->provider_account_id');
+});
+
+test('native providers normalize device payloads to canonical FleetOps keys', function () {
+    $afaqy = file_get_contents(__DIR__ . '/../src/Support/Telematics/Providers/AfaqyProvider.php');
+    $safee = file_get_contents(__DIR__ . '/../src/Support/Telematics/Providers/SafeeProvider.php');
+
+    foreach ([$afaqy, $safee] as $provider) {
+        expect($provider)
+            ->toContain("'device_id'")
+            ->toContain("'name'")
+            ->toContain("'provider'")
+            ->toContain("'model'")
+            ->toContain("'online'")
+            ->toContain("'last_seen_at'");
+    }
+});
+
+test('telematics details use public id for consumer webhook URLs and do not read ember uuid', function () {
+    $component = file_get_contents(__DIR__ . '/../../addon/components/telematic/details.js');
+    $template  = file_get_contents(__DIR__ . '/../../addon/components/telematic/details.hbs');
+
+    expect($component)
+        ->toContain('const id = this.args.resource?.public_id;')
+        ->toContain('return null;')
+        ->not->toContain('this.args.resource?.uuid')
+        ->not->toContain('this.args.resource?.public_id ?? this.args.resource?.id');
+
+    expect($template)
+        ->toContain('this.hasWebhookUrl')
+        ->toContain('Webhook URL unavailable until this integration has a public ID.')
+        ->toContain('last_sync_job_id')
+        ->toContain('last_sync_error');
+});
+
+test('native telematics providers expose local provider icons with a descriptor fallback', function () {
+    $config    = include __DIR__ . '/../config/telematics.php';
+    $iconPath  = '/engines-dist/images/telematics/providers/';
+    $providers = array_filter($config['providers'], fn ($provider) => ($provider['type'] ?? 'native') === 'native');
+
+    foreach ($providers as $provider) {
+        $icon = $provider['icon'] ?? null;
+
+        expect($icon)
+            ->not->toBeNull()
+            ->not->toContain('http://')
+            ->not->toContain('https://');
+
+        expect(str_starts_with($icon, $iconPath))->toBeTrue();
+        expect(str_ends_with($icon, '.webp'))->toBeTrue();
+        expect(file_exists(__DIR__ . '/../../assets/images/telematics/providers/' . basename($icon)))->toBeTrue();
+    }
+
+    $safee = collect($providers)->firstWhere('key', 'safee');
+
+    expect($safee['icon'])->toBe($iconPath . 'safee.webp');
+
+    $descriptor = new TelematicProviderDescriptor([
+        'key'   => 'custom',
+        'label' => 'Custom',
+    ]);
+
+    expect($descriptor->icon)->toBe(TelematicProviderDescriptor::DEFAULT_ICON);
+    expect(file_exists(__DIR__ . '/../../assets/images/telematics/providers/default.webp'))->toBeTrue();
+});
+
+test('device event mark processed action is routed and company scoped', function () {
+    $routes     = file_get_contents(__DIR__ . '/../src/routes.php');
+    $controller = file_get_contents(__DIR__ . '/../src/Http/Controllers/Internal/v1/DeviceEventController.php');
+
+    expect($routes)
+        ->toContain("\$router->fleetbaseRoutes('device-events', function")
+        ->toContain("'{id}/mark-processed'")
+        ->toContain("\$controller('markProcessed')");
+
+    expect($controller)
+        ->toContain('public function markProcessed(string $id): JsonResponse')
+        ->toContain("where('company_uuid', session('company'))")
+        ->toContain("where('uuid', \$id)->orWhere('public_id', \$id)")
+        ->toContain('$deviceEvent->markAsProcessed()')
+        ->toContain("'Event was already processed.'");
+});
+
+test('afaqy sync stores compact device diagnostics and does not leak token URLs', function () {
+    $provider = file_get_contents(__DIR__ . '/../src/Support/Telematics/Providers/AfaqyProvider.php');
+
+    expect($provider)
+        ->toContain('compactLastUpdate')
+        ->toContain("'provider_unit_id'")
+        ->toContain("'plate_number'")
+        ->toContain("'capabilities'")
+        ->not->toContain("'raw'          => \$payload")
+        ->not->toContain("'sensors',")
+        ->not->toContain("?token=' . urlencode")
+        ->toContain("'Authorization' => 'Bearer ' . \$token")
+        ->toContain("array_merge(['token' => \$this->credentials['token']], \$payload)");
+});
+
+test('native endpoint fields are advanced optional overrides with provider defaults', function () {
+    $config = include __DIR__ . '/../config/telematics.php';
+
+    $afaqy = collect($config['providers'])->firstWhere('key', 'afaqy');
+    $safee = collect($config['providers'])->firstWhere('key', 'safee');
+
+    $afaqyBaseUrl   = collect($afaqy['required_fields'])->firstWhere('name', 'base_url');
+    $safeeServerUri = collect($safee['required_fields'])->firstWhere('name', 'server_uri');
+
+    foreach ([$afaqyBaseUrl, $safeeServerUri] as $field) {
+        expect($field['required'])->toBeFalse();
+        expect($field['advanced'])->toBeTrue();
+        expect($field['is_endpoint'])->toBeTrue();
+        expect($field['validation'])->toBe('nullable|url');
+        expect($field['default_value'])->not->toBeEmpty();
+    }
+});
+
+test('telematics activity logging excludes large json and spatial payloads', function () {
+    $device      = telematics_activity_log_method(file_get_contents(__DIR__ . '/../src/Models/Device.php'));
+    $sensor      = telematics_activity_log_method(file_get_contents(__DIR__ . '/../src/Models/Sensor.php'));
+    $deviceEvent = telematics_activity_log_method(file_get_contents(__DIR__ . '/../src/Models/DeviceEvent.php'));
+
+    foreach ([$device, $sensor, $deviceEvent] as $model) {
+        expect($model)
+            ->toContain('->logOnly([')
+            ->toContain('->logOnlyDirty()')
+            ->not->toContain('return LogOptions::defaults()->logAll();');
+    }
+
+    expect($device)
+        ->not->toContain("'meta'")
+        ->not->toContain("'data'")
+        ->not->toContain("'last_position',");
+
+    expect($sensor)
+        ->not->toContain("'meta',")
+        ->not->toContain("'last_position',");
+
+    expect($deviceEvent)
+        ->not->toContain("'payload',")
+        ->not->toContain("'data',")
+        ->not->toContain("'location',");
+});
+
+test('telematics setup renders endpoint overrides only in advanced settings', function () {
+    $formTemplate      = file_get_contents(__DIR__ . '/../../addon/components/telematic/form.hbs');
+    $settingsTemplate  = file_get_contents(__DIR__ . '/../../addon/components/telematic/settings.hbs');
+    $formComponent     = file_get_contents(__DIR__ . '/../../addon/components/telematic/form.js');
+    $settingsComponent = file_get_contents(__DIR__ . '/../../addon/components/telematic/settings.js');
+
+    foreach ([$formComponent, $settingsComponent] as $component) {
+        expect($component)
+            ->toContain('advancedCredentialFields')
+            ->toContain('field.advanced || field.is_endpoint')
+            ->toContain('!field.advanced && !field.is_endpoint');
+    }
+
+    foreach ([$formTemplate, $settingsTemplate] as $template) {
+        expect($template)
+            ->toContain('Advanced connection settings')
+            ->toContain('this.advancedCredentialFields')
+            ->toContain('field.default_value');
+    }
+});
+
+test('telematics details logs are routed and use persisted safe data only', function () {
+    $routes     = file_get_contents(__DIR__ . '/../src/routes.php');
+    $controller = file_get_contents(__DIR__ . '/../src/Http/Controllers/Internal/v1/TelematicController.php');
+
+    expect($routes)
+        ->toContain("'{id}/logs'")
+        ->toContain("\$controller('logs')");
+
+    expect($controller)
+        ->toContain('public function logs(Request $request, string $id): JsonResponse')
+        ->toContain('Activity::with([\'causer\'])')
+        ->toContain("where('subject_type', Telematic::class)")
+        ->toContain("where('subject_id', \$telematic->uuid)")
+        ->toContain("where('company_uuid', session('company'))")
+        ->toContain('Provider connection details were updated.')
+        ->toContain('makeTelematicMetadataLogs')
+        ->toContain('userFacingIssueMessage')
+        ->toContain('isSensitiveIssueMessage')
+        ->not->toContain('changed_fields')
+        ->not->toContain('Str::headline')
+        ->not->toContain('storage_path')
+        ->not->toContain('Log::');
+});
+
+test('telematics provider status display maps active and connected to connected', function () {
+    $indexController   = file_get_contents(__DIR__ . '/../../addon/controllers/connectivity/telematics/index.js');
+    $detailsController = file_get_contents(__DIR__ . '/../../addon/controllers/connectivity/telematics/details.js');
+    $statusCell        = file_get_contents(__DIR__ . '/../../addon/components/cell/telematic-status.js');
+
+    expect($indexController)
+        ->toContain("cellComponent: 'cell/telematic-status'");
+
+    expect($detailsController)
+        ->toContain("case 'active':\n                return 'Connected';");
+
+    expect($statusCell)
+        ->toContain("case 'active':")
+        ->toContain("case 'connected':")
+        ->toContain("return 'Connected';");
+});
+
+test('telematics overview attention items render as full width stacked alerts', function () {
+    $template = file_get_contents(__DIR__ . '/../../addon/components/telematic/details.hbs');
+
+    expect($template)
+        ->toContain('<section class="flex flex-col gap-3">')
+        ->toContain('class="w-full rounded-md border border-yellow-200 bg-yellow-50 p-3')
+        ->not->toContain('lg:grid-cols-2');
+});
+
+function telematics_activity_log_method(string $model): string
+{
+    preg_match('/public function getActivitylogOptions\(\): LogOptions\s+\{(?P<body>.*?)\n    \}/s', $model, $matches);
+
+    return $matches['body'] ?? '';
+}

package/server/tests/VehicleDriverAssignmentTest.php

@@ -16,3 +16,54 @@ test('vehicle updates preserve driver assignment unless driver input is explicit
         ->toContain('public function unassignDriver(): self')
         ->toContain("Driver::where('vehicle_uuid', \$this->uuid)->update(['vehicle_uuid' => null])");
 });
+
+test('driver assigned-order workflows expose list and multi-unassign endpoints', function () {
+    $routes     = file_get_contents(dirname(__DIR__) . '/src/routes.php');
+    $controller = file_get_contents(dirname(__DIR__) . '/src/Http/Controllers/Internal/v1/DriverController.php');
+    $resource   = file_get_contents(dirname(__DIR__) . '/src/Http/Resources/v1/Driver.php');
+    $index      = file_get_contents(dirname(__DIR__) . '/src/Http/Resources/v1/Index/Driver.php');
+
+    expect($routes)
+        ->toContain("\$router->get('{id}/assigned-orders', \$controller('assignedOrders'))")
+        ->toContain("\$router->post('{id}/unassign-orders', \$controller('unassignOrders'))")
+        ->and($controller)
+        ->toContain('public function assignedOrders(string $id): JsonResponse')
+        ->toContain('public function unassignOrders(Request $request, string $id): JsonResponse')
+        ->toContain("->where('driver_assigned_uuid', \$driver->uuid)")
+        ->toContain("->orderByRaw('uuid = ? desc', [\$driver->current_job_uuid])")
+        ->toContain("\$request->validate(['orders' => ['required', 'array', 'min:1']])")
+        ->toContain("->where('driver_assigned_uuid', \$driver->uuid)")
+        ->toContain("->whereIn('uuid', \$selectedOrderUuids)")
+        ->toContain("->update(['driver_assigned_uuid' => null])")
+        ->toContain("if (\$driver->current_job_uuid && \$orders->contains('uuid', \$driver->current_job_uuid))")
+        ->toContain("\$driver->update(['current_job_uuid' => null])")
+        ->and($resource)
+        ->toContain("'assigned_orders_count'")
+        ->toContain("'current_order_reference'")
+        ->and($index)
+        ->toContain("'assigned_orders_count'");
+});
+
+test('vehicle assigned-order workflows expose list and multi-unassign endpoints without clearing driver vehicle assignment', function () {
+    $routes     = file_get_contents(dirname(__DIR__) . '/src/routes.php');
+    $controller = file_get_contents(dirname(__DIR__) . '/src/Http/Controllers/Internal/v1/VehicleController.php');
+    $resource   = file_get_contents(dirname(__DIR__) . '/src/Http/Resources/v1/Vehicle.php');
+    $index      = file_get_contents(dirname(__DIR__) . '/src/Http/Resources/v1/Index/Vehicle.php');
+
+    expect($routes)
+        ->toContain("\$router->get('{id}/assigned-orders', \$controller('assignedOrders'))")
+        ->toContain("\$router->post('{id}/unassign-orders', \$controller('unassignOrders'))")
+        ->and($controller)
+        ->toContain('public function assignedOrders(string $id): JsonResponse')
+        ->toContain('public function unassignOrders(Request $request, string $id): JsonResponse')
+        ->toContain("->where('vehicle_assigned_uuid', \$vehicle->uuid)")
+        ->toContain("\$request->validate(['orders' => ['required', 'array', 'min:1']])")
+        ->toContain("->whereIn('uuid', \$selectedOrderUuids)")
+        ->toContain("->update(['vehicle_assigned_uuid' => null])")
+        ->not->toContain("->update(['vehicle_uuid' => null])")
+        ->and($resource)
+        ->toContain("'assigned_orders_count'")
+        ->toContain("'current_order_reference'")
+        ->and($index)
+        ->toContain("'assigned_orders_count'");
+});

package/translations/ar-ae.yml

@@ -1,3 +1,7 @@
+menu:
+  fuel-providers: تكاملات الوقود
+  fuel-transactions: معاملات الوقود
+
 fleet-ops:
   extension-name: Fleet-Ops
   common:
@@ -309,10 +313,12 @@ fleet-ops:
         contacts: جهات الاتصال
         places: الأماكن
         fuel-reports: تقارير الوقود
+        fuel-transactions: معاملات الوقود
         issues: القضايا
         title: إنشاء طلب جديد
         settings: الإعدادات
         order-config: تكوين الطلب
+        fuel-providers: تكاملات الوقود
     live-map-drawer:
       driver-listing:
         location: الموقع
@@ -721,6 +727,15 @@ fleet-ops:
       fleet-ops-quickstart:
         message: لنرى ما يمكنك فعله لبدء العمليات...
         start-task: بدء المهمة
+      get-started:
+        title: Get Started with Fleet-Ops
+        subtitle: Set up the essentials and complete your first dispatch flow.
+        completed: completed
+        preview-title: First order workflow
+      recommended-features:
+        title: Recommended features for you
+        subtitle: Explore tools that help new operations teams get productive faster.
+        learn-more: Learn more
       key-metrics:
         title: مقاييس Fleet-Ops
         earnings: الأرباح
@@ -1603,3 +1618,19 @@ scheduler:
   reason: Reason
   reason-placeholder: e.g. Personal appointment
   notes-placeholder: Optional additional notes
+
+order:
+    card:
+      linked-order: Linked Order
+      unknown-order: Unknown order
+      no-type: No type
+      pickup: Pickup
+      dropoff: Dropoff
+      return: Return
+      waypoints: Waypoints
+      additional-stop: additional stop
+      additional-stops: additional stops
+      no-pickup-address: No pickup address
+      no-dropoff-address: No dropoff address
+      no-route-details: No route details available.
+      no-order-linked: No order is linked to this issue.

package/translations/bg-bg.yaml

@@ -46,6 +46,7 @@ common:
   overview: Overview
   notes: Notes
   schedule: Schedule
+  current-job: Current Job
 menu:
   operations: Операции
   dashboard: Табло
@@ -61,6 +62,7 @@ menu:
   contacts: Контакти
   places: Места
   fuel-reports: Доклади за гориво
+  fuel-transactions: Транзакции за гориво
   issues: Проблеми
   maintenance: Поддръжка
   work-orders: Работни поръчки
@@ -68,6 +70,7 @@ menu:
   parts: Части
   connectivity: Свързаност
   telematics: Телематика
+  fuel-providers: Интеграции за гориво
   devices: Устройства
   sensors: Сензори
   events: Събития
@@ -410,9 +413,30 @@ driver:
     driver-license: Шофьорска книжка
     no-vehicle-assigned: Няма зададено превозно средство
   actions:
+    unassign-orders: Unassign Orders
+    unassign-vehicle: Unassign Vehicle
+    create-issue: Create Issue
     assign-order: Присвояване на поръчка на шофьор
     assign-vehicle: Присвояване на превозно средство на шофьор
     locate-driver: Намери шофьора на картата
+  prompts:
+    assign-order-success: Order assigned to {driverName}.
+    assign-order-title: "Assign order to {driverName}"
+    select-order-warning: "Select an order to assign."
+    assign-vehicle-title: "Assign vehicle to {driverName}"
+    assign-vehicle-success: "Vehicle assigned to {driverName}."
+    select-vehicle-warning: Select a vehicle to assign.
+    no-assigned-orders-warning: No assigned orders found for {driverName}.
+    select-orders-warning: Select at least one order to unassign.
+    unassign-orders-title: Unassign orders from {driverName}
+    confirm-unassign-orders-title: Unassign {count} order(s) from {driverName}?
+    confirm-unassign-orders-body: "This will remove {driverName} from these orders: {orders}."
+    unassign-orders-success: Unassigned {driverName} from {count} order(s).
+    no-vehicle-assigned-warning: No vehicle is assigned to {driverName}.
+    unassign-vehicle-title: Unassign {vehicleName} from {driverName}?
+    unassign-vehicle-body: This removes {driverName} from {vehicleName}. Order assignments are not changed.
+    unassign-vehicle-success: Unassigned {vehicleName} from {driverName}.
+    issue-title: Issue reported for {driverName}
 device:
   fields:
     title: Детайли за устройството
@@ -445,6 +469,18 @@ device:
     warranty: Гаранция
     warranty-placeholder: Изберете гаранция
     notes: Бележки
+  actions:
+    attach-to-vehicle: Attach to Vehicle
+    detach-from-vehicle: Detach from Vehicle
+  prompts:
+    attach-to-vehicle-title: Attach device to vehicle
+    attach-device-to-vehicle-title: "Attach {deviceName} to vehicle"
+    select-vehicle-warning: Select a vehicle to attach this device to.
+    attach-to-vehicle-success: Device attached to vehicle.
+    not-attached-warning: "{deviceName} is not attached to a vehicle."
+    detach-from-vehicle-title: "Detach {deviceName} from vehicle?"
+    detach-from-vehicle-body: "This detaches {deviceName} from {vehicleName} and stops vehicle telemetry updates until it is attached again."
+    detach-from-vehicle-success: Device detached from vehicle.
 entity:
   fields:
     declare: Декларирай
@@ -495,7 +531,15 @@ fleet:
     add-vehicle: Добавяне на превозно средство към флота
     loading-message: Зареждане на превозни средства във флота...
   actions:
+    assign-vehicle: Assign Vehicle to Fleet
     assign-driver: Присвояване на шофьор към флота
+  prompts:
+    assign-driver-title: Assign driver to {fleetName}
+    assign-vehicle-title: Assign vehicle to {fleetName}
+    select-driver-warning: Select a driver to assign.
+    select-vehicle-warning: Select a vehicle to assign.
+    assign-driver-success: Driver assigned to {fleetName}.
+    assign-vehicle-success: Vehicle assigned to {fleetName}.
 fuel-report:
   fields:
     details: Детайли за доклада за гориво
@@ -524,6 +568,20 @@ issue:
     tags: Етикети на проблема
     type: Тип на проблема
 order:
+  card:
+    linked-order: Linked Order
+    unknown-order: Unknown order
+    no-type: No type
+    pickup: Pickup
+    dropoff: Dropoff
+    return: Return
+    waypoints: Waypoints
+    additional-stop: additional stop
+    additional-stops: additional stops
+    no-pickup-address: No pickup address
+    no-dropoff-address: No dropoff address
+    no-route-details: No route details available.
+    no-order-linked: No order is linked to this issue.
   fields:
     ad-hoc: Спонтанен
     ad-hoc-help-text: Активирането на Ad-Hoc ще позволи на поръчката интелигентно
@@ -958,7 +1016,21 @@ vehicle:
     vin-number: VIN номер
     year: Година
   actions:
+    attach-device: Attach Device
+    unassign-orders: Unassign Orders
+    create-issue: Create Issue
     locate-vehicle: Намери превозното средство на картата
+  prompts:
+    attach-device-title: Attach device to {vehicleName}
+    select-device-warning: Select a device to attach.
+    attach-device-success: Device attached to {vehicleName}.
+    no-assigned-orders-warning: No assigned orders found for {vehicleName}.
+    select-orders-warning: Select at least one order to unassign.
+    unassign-orders-title: Unassign orders from {vehicleName}
+    confirm-unassign-orders-title: Unassign {count} order(s) from {vehicleName}?
+    confirm-unassign-orders-body: "This will remove {vehicleName} from these orders: {orders}."
+    unassign-orders-success: Unassigned {vehicleName} from {count} order(s).
+    issue-title: Issue reported for {vehicleName}
 vendor:
   fields:
     setup-vendor: Настройка на доставчик
@@ -1594,6 +1666,15 @@ widget:
   fleet-ops-quickstart:
     message: Нека видим какво можете да направите, за да стартирате операциите...
     start-task: Започнете задача
+  get-started:
+    title: Get Started with Fleet-Ops
+    subtitle: Set up the essentials and complete your first dispatch flow.
+    completed: completed
+    preview-title: First order workflow
+  recommended-features:
+    title: Recommended features for you
+    subtitle: Explore tools that help new operations teams get productive faster.
+    learn-more: Learn more
   key-metrics:
     title: Метрики на Fleet-Ops
     earnings: Печалби