@fleetbase/fleetops-engine 0.6.58 → 0.6.60

package/server/src/Http/Controllers/Internal/v1/VendorController.php

@@ -44,7 +44,7 @@ class VendorController extends FleetOpsController
      */
     public function getAsFacilitator($id)
     {
-        $vendor = Vendor::where('uuid', $id)->withTrashed()->first();
+        $vendor = $this->findVendorWithTrashedByUuid($id);
 
         if (!$vendor) {
             return response()->error('Facilitator not found.');
@@ -62,7 +62,7 @@ class VendorController extends FleetOpsController
      */
     public function getAsCustomer($id)
     {
-        $vendor = Vendor::where('uuid', $id)->withTrashed()->first();
+        $vendor = $this->findVendorWithTrashedByUuid($id);
 
         if (!$vendor) {
             return response()->error('Customer not found.');
@@ -94,14 +94,7 @@ class VendorController extends FleetOpsController
      */
     public function statuses()
     {
-        $statuses = DB::table('vendors')
-            ->select('status')
-            ->where('company_uuid', session('company'))
-            ->distinct()
-            ->get()
-            ->pluck('status')
-            ->filter()
-            ->values();
+        $statuses = $this->vendorStatuses();
 
         return response()->json($statuses);
     }
@@ -119,8 +112,8 @@ class VendorController extends FleetOpsController
 
         foreach ($files as $file) {
             try {
-                $import = new VendorImport();
-                Excel::import($import, $file->path, $disk);
+                $import = $this->newVendorImport();
+                $this->importVendorFile($import, $file->path, $disk);
                 $importedCount += $import->imported;
             } catch (\Throwable $e) {
                 return response()->error('Invalid file, unable to proccess.');
@@ -143,13 +136,13 @@ class VendorController extends FleetOpsController
         }
 
         // Find driver
-        $driver = Driver::where('uuid', $request->input('driver'))->first();
+        $driver = $this->findDriverByUuid($request->input('driver'));
         if (!$driver) {
             return response()->error('Selected driver cannot be found.');
         }
 
         // Validate vendor
-        $vendor = Vendor::where('uuid', $id)->first();
+        $vendor = $this->findVendorByUuid($id);
         if (!$vendor) {
             return response()->error('Vendor attempting to assign driver to is invalid.');
         }
@@ -175,13 +168,13 @@ class VendorController extends FleetOpsController
         }
 
         // Find driver
-        $driver = Driver::where('uuid', $request->input('driver'))->first();
+        $driver = $this->findDriverByUuid($request->input('driver'));
         if (!$driver) {
             return response()->error('Selected driver cannot be found.');
         }
 
         // Validate vendor
-        $vendor = Vendor::where('uuid', $id)->first();
+        $vendor = $this->findVendorByUuid($id);
         if (!$vendor) {
             return response()->error('Vendor attempting to remove driver from is invalid.');
         }
@@ -196,12 +189,9 @@ class VendorController extends FleetOpsController
 
     public function vendorPersonnels(string $vendorId)
     {
-        $vendor = Vendor::findByIdOrFail($vendorId);
+        $vendor = $this->findVendorByIdOrFail($vendorId);
 
-        $personnels = VendorPersonnel::where('vendor_uuid', $vendor->uuid)
-            ->with('contact')
-            ->latest()
-            ->get()
+        $personnels = $this->queryVendorPersonnel($vendor->uuid)
             ->map(fn (VendorPersonnel $personnel) => $this->vendorPersonnelPayload($personnel));
 
         return response()->json(['personnels' => $personnels->values()]);
@@ -209,10 +199,10 @@ class VendorController extends FleetOpsController
 
     public function addVendorPersonnel(Request $request, string $vendorId)
     {
-        $vendor  = Vendor::findByIdOrFail($vendorId);
+        $vendor  = $this->findVendorByIdOrFail($vendorId);
         $contact = $this->resolveOrCreatePersonnelContact($request);
 
-        $personnel = VendorPersonnel::updateOrCreate(
+        $personnel = $this->updateOrCreateVendorPersonnel(
             ['vendor_uuid' => $vendor->uuid, 'contact_uuid' => $contact->uuid],
             [
                 'role'            => $request->input('role', 'member'),
@@ -232,10 +222,10 @@ class VendorController extends FleetOpsController
 
     public function removeVendorPersonnel(string $vendorId, string $contactId)
     {
-        $vendor  = Vendor::findByIdOrFail($vendorId);
-        $contact = Contact::findByIdOrFail($contactId);
+        $vendor  = $this->findVendorByIdOrFail($vendorId);
+        $contact = $this->findContactByIdOrFail($contactId);
 
-        VendorPersonnel::where(['vendor_uuid' => $vendor->uuid, 'contact_uuid' => $contact->uuid])->delete();
+        $this->deleteVendorPersonnel($vendor->uuid, $contact->uuid);
 
         return response()->json(['status' => 'ok']);
     }
@@ -244,14 +234,10 @@ class VendorController extends FleetOpsController
     {
         $contactId = $request->input('contact');
         if ($contactId) {
-            return Contact::where('company_uuid', session('company'))
-                ->where(function ($query) use ($contactId) {
-                    $query->where('uuid', $contactId)->orWhere('public_id', $contactId);
-                })
-                ->firstOrFail();
+            return $this->findPersonnelContact($contactId);
         }
 
-        return Contact::create([
+        return $this->createPersonnelContact([
             'company_uuid' => session('company'),
             'name'         => $request->input('name'),
             'email'        => $request->input('email'),
@@ -276,7 +262,91 @@ class VendorController extends FleetOpsController
             'role'            => $personnel->role ?? 'member',
             'status'          => $personnel->status ?? 'active',
             'invited_by_uuid' => $personnel->invited_by_uuid,
-            'contact'         => $contact ? (new ContactResource($contact))->resolve() : null,
+            'contact'         => $contact ? $this->contactResourcePayload($contact) : null,
         ];
     }
+
+    protected function contactResourcePayload(Contact $contact): array
+    {
+        return (new ContactResource($contact))->resolve();
+    }
+
+    protected function findVendorWithTrashedByUuid(string $id): ?Vendor
+    {
+        return Vendor::where('uuid', $id)->withTrashed()->first();
+    }
+
+    protected function vendorStatuses()
+    {
+        return DB::table('vendors')
+            ->select('status')
+            ->where('company_uuid', session('company'))
+            ->distinct()
+            ->get()
+            ->pluck('status')
+            ->filter()
+            ->values();
+    }
+
+    protected function newVendorImport(): mixed
+    {
+        return new VendorImport();
+    }
+
+    protected function importVendorFile(mixed $import, string $path, string $disk): void
+    {
+        Excel::import($import, $path, $disk);
+    }
+
+    protected function findDriverByUuid(string $uuid): ?Driver
+    {
+        return Driver::where('uuid', $uuid)->first();
+    }
+
+    protected function findVendorByUuid(string $uuid): ?Vendor
+    {
+        return Vendor::where('uuid', $uuid)->first();
+    }
+
+    protected function findVendorByIdOrFail(string $id): Vendor
+    {
+        return Vendor::findByIdOrFail($id);
+    }
+
+    protected function findContactByIdOrFail(string $id): Contact
+    {
+        return Contact::findByIdOrFail($id);
+    }
+
+    protected function queryVendorPersonnel(string $vendorUuid)
+    {
+        return VendorPersonnel::where('vendor_uuid', $vendorUuid)
+            ->with('contact')
+            ->latest()
+            ->get();
+    }
+
+    protected function updateOrCreateVendorPersonnel(array $where, array $attributes): VendorPersonnel
+    {
+        return VendorPersonnel::updateOrCreate($where, $attributes);
+    }
+
+    protected function deleteVendorPersonnel(string $vendorUuid, string $contactUuid): void
+    {
+        VendorPersonnel::where(['vendor_uuid' => $vendorUuid, 'contact_uuid' => $contactUuid])->delete();
+    }
+
+    protected function findPersonnelContact(string $contactId): Contact
+    {
+        return Contact::where('company_uuid', session('company'))
+            ->where(function ($query) use ($contactId) {
+                $query->where('uuid', $contactId)->orWhere('public_id', $contactId);
+            })
+            ->firstOrFail();
+    }
+
+    protected function createPersonnelContact(array $attributes): Contact
+    {
+        return Contact::create($attributes);
+    }
 }

package/server/src/Http/Controllers/Internal/v1/WorkOrderController.php

@@ -34,7 +34,7 @@ class WorkOrderController extends FleetOpsController
         $selections = $request->array('selections');
         $fileName   = trim(Str::slug('work-orders-' . date('Y-m-d-H:i')) . '.' . $format);
 
-        return Excel::download(new WorkOrderExport($selections), $fileName);
+        return $this->downloadExport(new WorkOrderExport($selections), $fileName);
     }
 
     /**
@@ -50,8 +50,8 @@ class WorkOrderController extends FleetOpsController
 
         foreach ($files as $file) {
             try {
-                $import = new WorkOrderImport();
-                Excel::import($import, $file->path, $disk);
+                $import = $this->createImport();
+                $this->importFile($import, $file->path, $disk);
                 $importedCount += $import->imported;
             } catch (\Throwable $e) {
                 return response()->error('Invalid file, unable to process.');
@@ -61,16 +61,28 @@ class WorkOrderController extends FleetOpsController
         return response()->json(['status' => 'ok', 'message' => 'Import completed', 'imported' => $importedCount]);
     }
 
+    protected function downloadExport(WorkOrderExport $export, string $fileName)
+    {
+        return Excel::download($export, $fileName);
+    }
+
+    protected function createImport(): WorkOrderImport
+    {
+        return new WorkOrderImport();
+    }
+
+    protected function importFile(WorkOrderImport $import, string $path, string $disk): void
+    {
+        Excel::import($import, $path, $disk);
+    }
+
     /**
      * Send a work order email to the assigned vendor.
      * POST /work-orders/{id}/send.
      */
     public function sendEmail(string $id): JsonResponse
     {
-        $workOrder = WorkOrder::where('uuid', $id)
-            ->orWhere('public_id', $id)
-            ->with(['assignee', 'target'])
-            ->firstOrFail();
+        $workOrder = $this->workOrderForEmail($id);
 
         // Resolve recipient email from the assignee (vendor or contact)
         $assignee = $workOrder->assignee;
@@ -85,16 +97,34 @@ class WorkOrderController extends FleetOpsController
             return response()->json(['error' => 'The assigned vendor has no email address on file.'], 422);
         }
 
-        Mail::to($email)->send(new WorkOrderDispatched($workOrder));
+        $this->sendWorkOrderDispatchedMail($email, $workOrder);
 
-        activity('work_order_sent')
-            ->performedOn($workOrder)
-            ->withProperties(['sent_to' => $email])
-            ->log('Work order emailed to vendor');
+        $this->recordWorkOrderSentActivity($workOrder, $email);
 
         return response()->json([
             'status'  => 'ok',
             'message' => 'Work order successfully sent to ' . $email,
         ]);
     }
+
+    protected function workOrderForEmail(string $id): WorkOrder
+    {
+        return WorkOrder::where('uuid', $id)
+            ->orWhere('public_id', $id)
+            ->with(['assignee', 'target'])
+            ->firstOrFail();
+    }
+
+    protected function sendWorkOrderDispatchedMail(string $email, WorkOrder $workOrder): void
+    {
+        Mail::to($email)->send(new WorkOrderDispatched($workOrder));
+    }
+
+    protected function recordWorkOrderSentActivity(WorkOrder $workOrder, string $email): void
+    {
+        activity('work_order_sent')
+            ->performedOn($workOrder)
+            ->withProperties(['sent_to' => $email])
+            ->log('Work order emailed to vendor');
+    }
 }

package/server/src/Http/Filter/DriverFilter.php

@@ -172,7 +172,7 @@ class DriverFilter extends Filter
         }
 
         // if wants to find nearby place or coordinates
-        if (Utils::isCoordinates($nearby)) {
+        if (Utils::isCoordinatesStrict($nearby)) {
             $location = Utils::getPointFromMixed($nearby);
 
             $this->builder->whereNotNull('location')->whereRaw('
@@ -191,7 +191,7 @@ class DriverFilter extends Filter
         if ($addedNearbyQuery === false && is_string($nearby)) {
             $place = Place::createFromMixed($nearby, [], false);
 
-            if ($nearby instanceof Place) {
+            if ($place instanceof Place) {
                 $this->builder->whereNotNull('location')->whereRaw('
                 ST_Y(location) BETWEEN -90 AND 90
                 AND ST_X(location) BETWEEN -180 AND 180

package/server/src/Http/Filter/MaintenanceScheduleFilter.php

@@ -0,0 +1,40 @@
+<?php
+
+namespace Fleetbase\FleetOps\Http\Filter;
+
+use Fleetbase\FleetOps\Support\Utils;
+use Fleetbase\Http\Filter\Filter;
+use Illuminate\Support\Str;
+
+class MaintenanceScheduleFilter extends Filter
+{
+    public function queryForInternal(): void
+    {
+        $this->builder->where('company_uuid', $this->session->get('company'));
+    }
+
+    public function queryForPublic(): void
+    {
+        $this->queryForInternal();
+    }
+
+    public function subjectType(?string $subjectType): void
+    {
+        if (!$subjectType) {
+            return;
+        }
+
+        if (!Str::contains($subjectType, ['\\', ':'])) {
+            $subjectType = 'fleet-ops:' . $subjectType;
+        }
+
+        $this->builder->where('subject_type', Utils::getMutationType($subjectType));
+    }
+
+    public function subjectUuid(?string $subjectUuid): void
+    {
+        if ($subjectUuid) {
+            $this->builder->where('subject_uuid', $subjectUuid);
+        }
+    }
+}

package/server/src/Http/Filter/OrderFilter.php

@@ -354,7 +354,7 @@ class OrderFilter extends Filter
     {
         $exclude = Utils::arrayFrom($exclude);
         if (is_array($exclude)) {
-            $isUuids = Arr::every($exclude, function ($id) {
+            $isUuids = collect($exclude)->every(function ($id) {
                 return Str::isUuid($id);
             });
 

package/server/src/Http/Filter/VehicleFilter.php

@@ -3,8 +3,10 @@
 namespace Fleetbase\FleetOps\Http\Filter;
 
 use Fleetbase\FleetOps\Models\Vehicle;
+use Fleetbase\FleetOps\Models\Vendor;
 use Fleetbase\FleetOps\Support\Utils;
 use Fleetbase\Http\Filter\Filter;
+use Fleetbase\Support\Http;
 
 class VehicleFilter extends Filter
 {
@@ -74,14 +76,26 @@ class VehicleFilter extends Filter
         );
     }
 
-    public function vendor(?string $vendorId)
+    public function vendor(?string $vendor)
     {
-        $this->builder->whereHas(
-            'vendor',
-            function ($query) use ($vendorId) {
-                $query->where('uuid', $vendorId);
-            }
-        );
+        if (!$vendor) {
+            return;
+        }
+
+        $this->builder->whereIn('vendor_uuid', Vendor::query()
+            ->where('company_uuid', $this->session->get('company'))
+            ->where(function ($query) use ($vendor) {
+                $query->where('public_id', $vendor);
+
+                if (in_array('internal_id', (new Vendor())->getFillable())) {
+                    $query->orWhere('internal_id', $vendor);
+                }
+
+                if (Http::isInternalRequest($this->request)) {
+                    $query->orWhere('uuid', $vendor);
+                }
+            })
+            ->pluck('uuid'));
     }
 
     public function driverUuid(?string $driverId)

package/server/src/Http/Middleware/AuthenticateCustomerToken.php

@@ -17,7 +17,7 @@ class AuthenticateCustomerToken
 {
     public function handle(Request $request, \Closure $next)
     {
-        $customer = CustomerAuth::resolveFromHeader($request);
+        $customer = $this->resolveCustomerFromHeader($request);
         if (!$customer) {
             return response()->apiError('Customer token is missing or invalid.', 401);
         }
@@ -27,8 +27,18 @@ class AuthenticateCustomerToken
             return response()->apiError('Customer does not belong to this company.', 403);
         }
 
-        CustomerAuth::setCurrent($customer);
+        $this->setCurrentCustomer($customer);
 
         return $next($request);
     }
+
+    protected function resolveCustomerFromHeader(Request $request): mixed
+    {
+        return CustomerAuth::resolveFromHeader($request);
+    }
+
+    protected function setCurrentCustomer(mixed $customer): void
+    {
+        CustomerAuth::setCurrent($customer);
+    }
 }

package/server/src/Http/Requests/BulkDispatchRequest.php

@@ -8,20 +8,16 @@ class BulkDispatchRequest extends FleetbaseRequest
 {
     /**
      * Determine if the user is authorized to make this request.
-     *
-     * @return bool
      */
-    public function authorize()
+    public function authorize(): bool
     {
         return $this->session()->has('user');
     }
 
     /**
      * Get the validation rules that apply to the request.
-     *
-     * @return array
      */
-    public function rules()
+    public function rules(): array
     {
         return [
             'ids' => ['required', 'array'],
@@ -30,10 +26,8 @@ class BulkDispatchRequest extends FleetbaseRequest
 
     /**
      * Get the validation rules error messages.
-     *
-     * @return array
      */
-    public function messages()
+    public function messages(): array
     {
         return [
             'ids.required' => 'Please provide a resource ID.',

package/server/src/Http/Requests/CancelOrderRequest.php

@@ -8,20 +8,16 @@ class CancelOrderRequest extends FleetbaseRequest
 {
     /**
      * Determine if the user is authorized to make this request.
-     *
-     * @return bool
      */
-    public function authorize()
+    public function authorize(): bool
     {
         return request()->session()->has('api_credential');
     }
 
     /**
      * Get the validation rules that apply to the request.
-     *
-     * @return array
      */
-    public function rules()
+    public function rules(): array
     {
         return [
             'order' => 'required|exists:orders,uuid',

package/server/src/Http/Requests/CreateContactRequest.php

@@ -9,20 +9,16 @@ class CreateContactRequest extends FleetbaseRequest
 {
     /**
      * Determine if the user is authorized to make this request.
-     *
-     * @return bool
      */
-    public function authorize()
+    public function authorize(): bool
     {
         return request()->session()->has('storefront_key') || request()->session()->has('api_credential') || request()->session()->has('is_sanctum_token');
     }
 
     /**
      * Get the validation rules that apply to the request.
-     *
-     * @return array
      */
-    public function rules()
+    public function rules(): array
     {
         return [
             'name'  => [new RequiredIf($this->isMethod('POST'))],

package/server/src/Http/Requests/CreateCustomerRequest.php

@@ -23,7 +23,15 @@ class CreateCustomerRequest extends FleetbaseRequest
     {
         return [
             'identity' => 'required|string',
-            'code'     => 'required|exists:verification_codes,code',
+            // Presence only — authorizing the code is the controller's job, and its
+            // check is strictly stronger: it matches code + for + meta->identity,
+            // whereas `exists:verification_codes,code` accepts any live code issued
+            // for any purpose to any user. The rule is also already unenforced on the
+            // proxy path, since verifyCode() with for=fleetops_create_customer calls
+            // create(CreateCustomerRequest::createFrom($request)), which never runs
+            // validateResolved(). Keeping it here only blocks the configured
+            // non-production testing bypass (fleetops.customers.verification_bypass_code).
+            'code'     => 'required|string',
             'name'     => 'required|string',
             'password' => 'required|string|min:8',
             'email'    => [

package/server/src/Http/Requests/CreateDeviceRequest.php

@@ -8,12 +8,12 @@ use Illuminate\Validation\Rule;
 
 class CreateDeviceRequest extends FleetbaseRequest
 {
-    public function authorize()
+    public function authorize(): bool
     {
         return request()->session()->has('api_credential') || request()->session()->has('is_sanctum_token');
     }
 
-    public function rules()
+    public function rules(): array
     {
         return [
             'name'                  => [Rule::requiredIf($this->isMethod('POST')), 'string'],

package/server/src/Http/Requests/CreateDriverRequest.php

@@ -10,20 +10,16 @@ class CreateDriverRequest extends FleetbaseRequest
 {
     /**
      * Determine if the user is authorized to make this request.
-     *
-     * @return bool
      */
-    public function authorize()
+    public function authorize(): bool
     {
         return request()->is('navigator/v1/*') || request()->session()->has('api_credential') || request()->session()->has('is_sanctum_token');
     }
 
     /**
      * Get the validation rules that apply to the request.
-     *
-     * @return array
      */
-    public function rules()
+    public function rules(): array
     {
         $isCreating = $this->isMethod('POST');
 
@@ -47,10 +43,8 @@ class CreateDriverRequest extends FleetbaseRequest
 
     /**
      * Get custom attributes for validator errors.
-     *
-     * @return array
      */
-    public function attributes()
+    public function attributes(): array
     {
         return [
             'email' => 'email address',

package/server/src/Http/Requests/CreateEntityRequest.php

@@ -9,20 +9,16 @@ class CreateEntityRequest extends FleetbaseRequest
 {
     /**
      * Determine if the user is authorized to make this request.
-     *
-     * @return bool
      */
-    public function authorize()
+    public function authorize(): bool
     {
         return request()->session()->has('api_credential') || request()->session()->has('is_sanctum_token');
     }
 
     /**
      * Get the validation rules that apply to the request.
-     *
-     * @return array
      */
-    public function rules()
+    public function rules(): array
     {
         return [
             'name'            => [Rule::requiredIf($this->isMethod('POST'))],

package/server/src/Http/Requests/CreateEquipmentRequest.php

@@ -7,12 +7,12 @@ use Illuminate\Validation\Rule;
 
 class CreateEquipmentRequest extends FleetbaseRequest
 {
-    public function authorize()
+    public function authorize(): bool
     {
         return request()->session()->has('api_credential') || request()->session()->has('is_sanctum_token');
     }
 
-    public function rules()
+    public function rules(): array
     {
         return [
             'name'           => [Rule::requiredIf($this->isMethod('POST')), 'string'],

package/server/src/Http/Requests/CreateFleetRequest.php

@@ -9,20 +9,16 @@ class CreateFleetRequest extends FleetbaseRequest
 {
     /**
      * Determine if the user is authorized to make this request.
-     *
-     * @return bool
      */
-    public function authorize()
+    public function authorize(): bool
     {
         return request()->session()->has('api_credential');
     }
 
     /**
      * Get the validation rules that apply to the request.
-     *
-     * @return array
      */
-    public function rules()
+    public function rules(): array
     {
         return [
             'name'         => [Rule::requiredIf($this->isMethod('POST'))],