@fleetbase/fleetops-engine 0.6.58 → 0.6.60

package/server/tests/ControllerSerializationContractsTest.php

@@ -0,0 +1,141 @@
+<?php
+
+use Fleetbase\FleetOps\Http\Controllers\Api\v1\GeofenceController;
+use Fleetbase\FleetOps\Models\GeofenceEventLog;
+
+function fleetopsCallControllerMethod(object $controller, string $method, array $arguments = []): mixed
+{
+    $reflection = new ReflectionMethod($controller::class, $method);
+    $reflection->setAccessible(true);
+
+    return $reflection->invokeArgs($controller, $arguments);
+}
+
+test('geofence event serializer projects subject driver vehicle and order details', function () {
+    $driver = (object) [
+        'public_id' => 'driver_public',
+        'uuid'      => 'driver-uuid',
+        'name'      => 'Jane Driver',
+        'phone'     => '+6555550000',
+    ];
+    $vehicle = (object) [
+        'public_id'    => 'vehicle_public',
+        'uuid'         => 'vehicle-uuid',
+        'display_name' => 'Truck 101',
+        'name'         => 'Fallback Truck',
+        'plate_number' => 'SG-101',
+    ];
+    $order = (object) [
+        'public_id' => 'order_public',
+        'uuid'      => 'order-uuid',
+        'status'    => 'dispatched',
+    ];
+    $driver->vehicle = $vehicle;
+
+    $event = new GeofenceEventLog([
+        'uuid'                   => 'event-uuid',
+        'subject_uuid'           => 'driver-uuid',
+        'subject_type'           => 'driver',
+        'subject_name'           => 'Jane Driver',
+        'event_type'             => 'entered',
+        'occurred_at'            => null,
+        'dwell_duration_minutes' => 12,
+        'geofence_uuid'          => 'zone-uuid',
+        'geofence_name'          => 'Central Zone',
+        'geofence_type'          => 'zone',
+        'latitude'               => 1.3521,
+        'longitude'              => 103.8198,
+    ]);
+    $event->setRelation('driver', $driver);
+    $event->setRelation('vehicle', null);
+    $event->setRelation('order', $order);
+
+    $payload = fleetopsCallControllerMethod(new GeofenceController(), 'serializeEvent', [$event]);
+
+    expect($payload)->toMatchArray([
+        'id'                     => 'event-uuid',
+        'event_type'             => 'geofence.entered',
+        'occurred_at'            => null,
+        'dwell_duration_minutes' => 12,
+        'subject'                => [
+            'type' => 'driver',
+            'id'   => 'driver_public',
+            'uuid' => 'driver-uuid',
+            'name' => 'Jane Driver',
+        ],
+        'driver'                 => [
+            'id'    => 'driver_public',
+            'uuid'  => 'driver-uuid',
+            'name'  => 'Jane Driver',
+            'phone' => '+6555550000',
+        ],
+        'vehicle'                => [
+            'id'    => 'vehicle_public',
+            'uuid'  => 'vehicle-uuid',
+            'name'  => 'Truck 101',
+            'plate' => 'SG-101',
+        ],
+        'geofence'               => [
+            'uuid' => 'zone-uuid',
+            'name' => 'Central Zone',
+            'type' => 'zone',
+        ],
+        'location'               => [
+            'latitude'  => 1.3521,
+            'longitude' => 103.8198,
+        ],
+        'order'                  => [
+            'id'     => 'order_public',
+            'uuid'   => 'order-uuid',
+            'status' => 'dispatched',
+        ],
+    ]);
+});
+
+test('geofence event serializer falls back to vehicle subjects without drivers', function () {
+    $vehicle = (object) [
+        'public_id'    => 'vehicle_public',
+        'uuid'         => 'vehicle-uuid',
+        'display_name' => null,
+        'name'         => 'Vehicle Name',
+        'plate_number' => 'SG-202',
+    ];
+
+    $event = new GeofenceEventLog([
+        'uuid'          => 'vehicle-event-uuid',
+        'subject_uuid'  => 'vehicle-uuid',
+        'subject_type'  => 'vehicle',
+        'subject_name'  => null,
+        'event_type'    => 'exited',
+        'occurred_at'   => null,
+        'geofence_uuid' => 'service-area-uuid',
+        'geofence_name' => 'North Service Area',
+        'geofence_type' => 'service_area',
+        'latitude'      => null,
+        'longitude'     => null,
+    ]);
+    $event->setRelation('driver', null);
+    $event->setRelation('vehicle', $vehicle);
+    $event->setRelation('order', null);
+
+    $payload = fleetopsCallControllerMethod(new GeofenceController(), 'serializeEvent', [$event]);
+
+    expect($payload)->toMatchArray([
+        'id'         => 'vehicle-event-uuid',
+        'event_type' => 'geofence.exited',
+        'subject'    => [
+            'type' => 'vehicle',
+            'id'   => 'vehicle_public',
+            'uuid' => 'vehicle-uuid',
+            'name' => 'SG-202',
+        ],
+        'driver'     => null,
+        'vehicle'    => [
+            'id'    => 'vehicle_public',
+            'uuid'  => 'vehicle-uuid',
+            'name'  => 'Vehicle Name',
+            'plate' => 'SG-202',
+        ],
+        'order'      => null,
+    ]);
+});

package/server/tests/CoverageSummaryScriptTest.php

@@ -0,0 +1,93 @@
+<?php
+
+function writeCoverageFixture(string $path, int $coveredStatements = 2, int $statements = 4): void
+{
+    $xml = <<<XML
+<?xml version="1.0" encoding="UTF-8"?>
+<coverage>
+  <project>
+    <file name="/tmp/Foo.php">
+      <metrics statements="{$statements}" coveredstatements="{$coveredStatements}" methods="2" coveredmethods="1"/>
+    </file>
+    <metrics statements="{$statements}" coveredstatements="{$coveredStatements}" methods="2" coveredmethods="1" classes="1" coveredclasses="0"/>
+  </project>
+</coverage>
+XML;
+
+    file_put_contents($path, $xml);
+}
+
+function writeCoverageFixtureWithoutCoveredClasses(string $path): void
+{
+    $xml = <<<XML
+<?xml version="1.0" encoding="UTF-8"?>
+<coverage>
+  <project>
+    <file name="/tmp/Foo.php">
+      <class name="Foo">
+        <metrics statements="2" coveredstatements="2" methods="1" coveredmethods="1"/>
+      </class>
+      <metrics statements="2" coveredstatements="2" methods="1" coveredmethods="1" classes="1"/>
+    </file>
+    <file name="/tmp/Bar.php">
+      <class name="Bar">
+        <metrics statements="2" coveredstatements="1" methods="1" coveredmethods="0"/>
+      </class>
+      <metrics statements="2" coveredstatements="1" methods="1" coveredmethods="0" classes="1"/>
+    </file>
+    <metrics statements="4" coveredstatements="3" methods="2" coveredmethods="1" classes="2"/>
+  </project>
+</coverage>
+XML;
+
+    file_put_contents($path, $xml);
+}
+
+function coverageSummaryPhpCommand(): string
+{
+    $binary = escapeshellarg(PHP_BINARY);
+
+    return PHP_SAPI === 'phpdbg' ? $binary . ' -qrr' : $binary;
+}
+
+test('coverage summary reports line method class directory and file coverage', function () {
+    $fixture = tempnam(sys_get_temp_dir(), 'fleetops-clover-');
+    writeCoverageFixture($fixture);
+
+    exec(coverageSummaryPhpCommand() . ' scripts/coverage-summary.php ' . escapeshellarg($fixture), $output, $exitCode);
+
+    @unlink($fixture);
+
+    expect($exitCode)->toBe(0)
+        ->and(implode("\n", $output))->toContain('Line coverage: 50.00% (2/4 statements)')
+        ->and(implode("\n", $output))->toContain('Method coverage: 50.00% (1/2 methods)')
+        ->and(implode("\n", $output))->toContain('Class coverage: 0.00% (0/1 classes)')
+        ->and(implode("\n", $output))->toContain('Lowest covered directories:')
+        ->and(implode("\n", $output))->toContain('Lowest covered files:');
+});
+
+test('coverage summary derives class coverage when clover omits coveredclasses', function () {
+    $fixture = tempnam(sys_get_temp_dir(), 'fleetops-clover-');
+    writeCoverageFixtureWithoutCoveredClasses($fixture);
+
+    exec(coverageSummaryPhpCommand() . ' scripts/coverage-summary.php ' . escapeshellarg($fixture), $output, $exitCode);
+
+    @unlink($fixture);
+
+    expect($exitCode)->toBe(0)
+        ->and(implode("\n", $output))->toContain('Line coverage: 75.00% (3/4 statements)')
+        ->and(implode("\n", $output))->toContain('Method coverage: 50.00% (1/2 methods)')
+        ->and(implode("\n", $output))->toContain('Class coverage: 50.00% (1/2 classes)');
+});
+
+test('coverage summary fails when coverage is below the configured threshold', function () {
+    $fixture = tempnam(sys_get_temp_dir(), 'fleetops-clover-');
+    writeCoverageFixture($fixture, 3, 4);
+
+    exec(coverageSummaryPhpCommand() . ' scripts/coverage-summary.php ' . escapeshellarg($fixture) . ' --fail-under=100 2>&1', $output, $exitCode);
+
+    @unlink($fixture);
+
+    expect($exitCode)->toBe(1)
+        ->and(implode("\n", $output))->toContain('Coverage 75.00% is below the required 100.00% line threshold.');
+});

package/server/tests/CustomerContactIdentitySafetyTest.php

@@ -32,12 +32,10 @@ test('customer creation entrypoints run the customer identity guard', function (
     $apiContact      = file_get_contents(__DIR__ . '/../src/Http/Controllers/Api/v1/ContactController.php');
     $internalContact = file_get_contents(__DIR__ . '/../src/Http/Controllers/Internal/v1/ContactController.php');
     $orderController = file_get_contents(__DIR__ . '/../src/Http/Controllers/Api/v1/OrderController.php');
-    $customerForm    = file_get_contents(__DIR__ . '/../../addon/components/customer/form.hbs');
 
     expect($apiContact)->toContain('$contactCandidate->assertCustomerIdentityIsAvailable();');
     expect($internalContact)->toContain('$this->assertCustomerIdentityIsAvailable($input');
     expect($orderController)->toContain('$customerCandidate->assertCustomerIdentityIsAvailable();');
-    expect($customerForm)->toContain('is_customer=true');
 });
 
 test('customer conflict audit command is registered and read only', function () {
@@ -59,7 +57,6 @@ test('customer portal welcome email is opt in and does not create organization i
     $contactModel        = file_get_contents(__DIR__ . '/../src/Models/Contact.php');
     $customerCredentials = file_get_contents(__DIR__ . '/../src/Mail/CustomerCredentialsMail.php');
     $customerEmail       = file_get_contents(__DIR__ . '/../resources/views/mail/customer-credentials.blade.php');
-    $customerForm        = file_get_contents(__DIR__ . '/../../addon/components/customer/form.hbs');
 
     expect($internalContact)
         ->toContain('meta.customer_portal.send_welcome_email')
@@ -81,9 +78,7 @@ test('customer portal welcome email is opt in and does not create organization i
         ->and($customerEmail)->toContain('Your customer portal access is ready')
         ->and($customerEmail)->toContain('Sign in to customer portal')
         ->and($customerEmail)->toContain('Temporary password:')
-        ->and($customerEmail)->toContain('You can change your password after signing in.')
-        ->and($customerForm)->toContain('this.showWelcomeEmailOption')
-        ->and($customerForm)->toContain('this.toggleWelcomeEmail');
+        ->and($customerEmail)->toContain('You can change your password after signing in.');
 
     expect($contactModel)
         ->toContain('assignUserToContactCompany')

package/server/tests/CustomerEndpointTest.php

@@ -4,10 +4,41 @@ use Fleetbase\FleetOps\Http\Controllers\Api\v1\CustomerController;
 use Fleetbase\FleetOps\Http\Middleware\AuthenticateCustomerToken;
 use Fleetbase\FleetOps\Http\Requests\CreateCustomerOrderRequest;
 use Fleetbase\FleetOps\Http\Requests\CreateCustomerRequest;
+use Fleetbase\FleetOps\Http\Requests\UpdateContactRequest;
 use Fleetbase\FleetOps\Http\Requests\VerifyCreateCustomerRequest;
 use Fleetbase\FleetOps\Http\Resources\v1\Customer as CustomerResource;
+use Fleetbase\FleetOps\Models\Contact;
 use Fleetbase\FleetOps\Models\Customer as CustomerModel;
 use Fleetbase\FleetOps\Support\CustomerAuth;
+use Illuminate\Http\JsonResponse;
+use Illuminate\Http\Request;
+
+if (!function_exists('Fleetbase\FleetOps\Http\Controllers\Api\v1\response')) {
+    eval('namespace Fleetbase\FleetOps\Http\Controllers\Api\v1; function response() { return new class {
+        public function apiError(string $message, int $status = 400): \Illuminate\Http\JsonResponse
+        {
+            return new \Illuminate\Http\JsonResponse(["error" => $message], $status);
+        }
+
+        public function json(array $payload = [], int $status = 200): \Illuminate\Http\JsonResponse
+        {
+            return new \Illuminate\Http\JsonResponse($payload, $status);
+        }
+    }; }');
+}
+
+function fleetopsCustomerControllerProtectedMethod(string $method): ReflectionMethod
+{
+    $reflection = new ReflectionMethod(CustomerController::class, $method);
+    $reflection->setAccessible(true);
+
+    return $reflection;
+}
+
+function fleetopsCustomerEndpointJson(JsonResponse $response): array
+{
+    return $response->getData(true);
+}
 
 /*
 |--------------------------------------------------------------------------
@@ -150,8 +181,15 @@ test('CustomerAuth resolves tokens by contact UUID with company-preferred fallba
         ->toContain("->where('company_uuid'");
 });
 
+test('CustomerAuth returns null when no customer token or binding exists', function () {
+    app()->forgetInstance(CustomerAuth::APP_BINDING);
+
+    expect(CustomerAuth::resolveFromHeader(Request::create('/customers/me', 'GET')))->toBeNull()
+        ->and(CustomerAuth::current())->toBeNull();
+});
+
 test('Customer model extends Contact with a type=customer global scope', function () {
-    expect(is_subclass_of(CustomerModel::class, Fleetbase\FleetOps\Models\Contact::class))->toBeTrue();
+    expect(is_subclass_of(CustomerModel::class, Contact::class))->toBeTrue();
 
     $source = file_get_contents(dirname(__DIR__) . '/src/Models/Customer.php');
     expect($source)
@@ -193,8 +231,137 @@ test('FormRequest validators are present and authorize via api credential', func
     $create = file_get_contents(dirname(__DIR__) . '/src/Http/Requests/CreateCustomerRequest.php');
     $verify = file_get_contents(dirname(__DIR__) . '/src/Http/Requests/VerifyCreateCustomerRequest.php');
 
+    // These match against source text, so they have to be updated whenever the rule
+    // strings change. `code` is presence-only by design — the controller's own check
+    // (code + for + meta->identity) is strictly stronger than exists:verification_codes.
     expect($create)
-        ->toContain("'code'     => 'required|exists:verification_codes,code'")
+        ->toContain("'code'     => 'required|string'")
         ->toContain("'password' => 'required|string|min:8'")
         ->and($verify)->toContain("'mode'     => 'required|in:email,sms'");
 });
+
+test('customer controller rejects invalid public auth inputs before persistence', function () {
+    $controller = new CustomerController();
+
+    $invalidEmail = $controller->requestCreationCode(new VerifyCreateCustomerRequest([
+        'mode'     => 'email',
+        'identity' => '+15551234567',
+    ]));
+    $missingLogin = $controller->login(Request::create('/v1/customers/login', 'POST', [
+        'identity' => 'jane@example.test',
+    ]));
+    $missingForgotPassword = $controller->forgotPassword(Request::create('/v1/customers/forgot-password', 'POST'));
+    $missingResetPassword  = $controller->resetPassword(Request::create('/v1/customers/reset-password', 'POST', [
+        'identity' => 'jane@example.test',
+        'code'     => '123456',
+    ]));
+    $shortResetPassword = $controller->resetPassword(Request::create('/v1/customers/reset-password', 'POST', [
+        'identity' => 'jane@example.test',
+        'code'     => '123456',
+        'password' => 'short',
+    ]));
+
+    expect($invalidEmail->getStatusCode())->toBe(400)
+        ->and(fleetopsCustomerEndpointJson($invalidEmail))->toBe(['error' => 'Invalid email provided for identity.'])
+        ->and($missingLogin->getStatusCode())->toBe(400)
+        ->and(fleetopsCustomerEndpointJson($missingLogin))->toBe(['error' => 'Identity and password are required.'])
+        ->and($missingForgotPassword->getStatusCode())->toBe(400)
+        ->and(fleetopsCustomerEndpointJson($missingForgotPassword))->toBe(['error' => 'Identity is required.'])
+        ->and($missingResetPassword->getStatusCode())->toBe(400)
+        ->and(fleetopsCustomerEndpointJson($missingResetPassword))->toBe(['error' => 'identity, code, and password are required.'])
+        ->and($shortResetPassword->getStatusCode())->toBe(400)
+        ->and(fleetopsCustomerEndpointJson($shortResetPassword))->toBe(['error' => 'Password must be at least 8 characters.']);
+});
+
+test('customer controller reports missing company before persistence', function () {
+    $controller = new CustomerController();
+
+    $missingEmailCompany = $controller->requestCreationCode(new VerifyCreateCustomerRequest([
+        'mode'     => 'email',
+        'identity' => 'jane@example.test',
+    ]));
+    $missingSmsCompany = $controller->requestCreationCode(new VerifyCreateCustomerRequest([
+        'mode'     => 'sms',
+        'identity' => '15551234567',
+    ]));
+
+    $customer = new Contact();
+    $customer->setRawAttributes([
+        'uuid'         => 'customer-uuid',
+        'company_uuid' => 'company-uuid',
+        'type'         => 'customer',
+    ], true);
+    app()->instance(CustomerAuth::APP_BINDING, $customer);
+
+    $missingOrderCompany = $controller->createOrder(new CreateCustomerOrderRequest());
+
+    expect($missingEmailCompany->getStatusCode())->toBe(500)
+        ->and(fleetopsCustomerEndpointJson($missingEmailCompany))->toBe(['error' => 'No company resolved from API credential.'])
+        ->and($missingSmsCompany->getStatusCode())->toBe(500)
+        ->and(fleetopsCustomerEndpointJson($missingSmsCompany))->toBe(['error' => 'No company resolved from API credential.'])
+        ->and($missingOrderCompany->getStatusCode())->toBe(500)
+        ->and(fleetopsCustomerEndpointJson($missingOrderCompany))->toBe(['error' => 'No company resolved from API credential.']);
+});
+
+test('customer controller authenticated endpoints require a current customer', function () {
+    app()->forgetInstance(CustomerAuth::APP_BINDING);
+
+    $controller = new CustomerController();
+    $request    = Request::create('/v1/customers', 'GET');
+
+    foreach ([
+        $controller->me(),
+        $controller->updateMe(new UpdateContactRequest()),
+        $controller->logout($request),
+        $controller->logoutAll(),
+        $controller->orders($request),
+        $controller->findOrder('order_123'),
+        $controller->createOrder(new CreateCustomerOrderRequest()),
+        $controller->places($request),
+        $controller->registerDevice(Request::create('/v1/customers/devices', 'POST')),
+    ] as $response) {
+        expect($response->getStatusCode())->toBe(401)
+            ->and(fleetopsCustomerEndpointJson($response))->toBe(['error' => 'Not authenticated.']);
+    }
+});
+
+test('customer controller handles lightweight authenticated profile and logout flows', function () {
+    $customer = new Contact();
+    $customer->setRawAttributes([
+        'uuid'         => 'customer-uuid',
+        'public_id'    => 'contact_public',
+        'company_uuid' => 'company-uuid',
+        'type'         => 'customer',
+        'user_uuid'    => null,
+    ], true);
+
+    app()->instance(CustomerAuth::APP_BINDING, $customer);
+
+    $controller     = new CustomerController();
+    $profile        = $controller->me();
+    $logout         = $controller->logout(Request::create('/v1/customers/logout', 'POST'));
+    $logoutAllError = $controller->logoutAll();
+
+    expect($profile)->toBeInstanceOf(CustomerResource::class)
+        ->and($profile->resource)->toBe($customer)
+        ->and($logout->getStatusCode())->toBe(200)
+        ->and(fleetopsCustomerEndpointJson($logout))->toBe(['status' => 'ok'])
+        ->and($logoutAllError->getStatusCode())->toBe(401)
+        ->and(fleetopsCustomerEndpointJson($logoutAllError))->toBe(['error' => 'Not authenticated.']);
+});
+
+test('customer controller helper methods normalize phones and ignore empty place inputs', function () {
+    $controller = new CustomerController();
+    $resolver   = fleetopsCustomerControllerProtectedMethod('resolveCustomerPlace');
+    $customer   = new Contact();
+    $customer->setRawAttributes(['uuid' => 'customer-uuid'], true);
+
+    expect(CustomerController::phone(null))->toBe('')
+        ->and(CustomerController::phone(''))->toBe('')
+        ->and(CustomerController::phone(' 15551234567 '))->toBe('+15551234567')
+        ->and(CustomerController::phone('+15551234567'))->toBe('+15551234567')
+        ->and($resolver->invoke($controller, null, $customer, 'company-uuid'))->toBeNull()
+        ->and($resolver->invoke($controller, [], $customer, 'company-uuid'))->toBeNull()
+        ->and($resolver->invoke($controller, ['name' => '', 'phone' => null], $customer, 'company-uuid'))->toBeNull()
+        ->and($resolver->invoke($controller, 12345, $customer, 'company-uuid'))->toBeNull();
+});