@fleetbase/fleetops-engine 0.6.58 → 0.6.60

package/server/tests/Feature/Http/Api/DriverControllerAuthFlowsTest.php

@@ -0,0 +1,530 @@
+<?php
+
+use Fleetbase\FleetOps\Http\Controllers\Api\v1\DriverController;
+use Fleetbase\FleetOps\Http\Resources\v1\Driver as DriverResource;
+use Fleetbase\FleetOps\Models\Driver;
+use Fleetbase\Models\User;
+use Illuminate\Database\ConnectionResolver;
+use Illuminate\Database\Eloquent\Model as EloquentModel;
+use Illuminate\Database\SQLiteConnection;
+use Illuminate\Http\JsonResponse;
+use Illuminate\Http\Request;
+
+/**
+ * Covers the API DriverController authentication flows against SQLite:
+ * password login with wrong-password and token-issuing branches, the
+ * phone-login SMS attempt with email fallback and no-channel error, and
+ * verification-code checking with invalid/bypass/valid variants.
+ *
+ * The `users.driver` relation used by whereHas('driver') is registered
+ * through the core Expandable expand() mechanism — the core model's __call
+ * forwards unknown methods to the query builder, bypassing Eloquent's
+ * relation resolvers.
+ */
+/**
+ * Nothing binds `twilio` in the harness, so the core SmsService fails and every
+ * phone login falls back to email. Binding this fake lets the SMS branch run.
+ */
+class FleetOpsDriverAuthTwilioFake
+{
+    public array $messages = [];
+
+    public function message($to, $text, $mediaUrls = [], $params = [])
+    {
+        $this->messages[] = [$to, $text];
+
+        return (object) ['sid' => 'SM-test-sid'];
+    }
+}
+
+class FleetOpsDriverAuthHasherFake implements Illuminate\Contracts\Hashing\Hasher
+{
+    public bool $checks = true;
+
+    public function info($hashedValue): array
+    {
+        return [];
+    }
+
+    public function make($value, array $options = []): string
+    {
+        return 'hashed-' . $value;
+    }
+
+    public function check($value, $hashedValue, array $options = []): bool
+    {
+        return $this->checks;
+    }
+
+    public function needsRehash($hashedValue, array $options = []): bool
+    {
+        return false;
+    }
+
+    public function verifyConfiguration($value): bool
+    {
+        return true;
+    }
+}
+
+class FleetOpsDriverAuthMailerFake
+{
+    public array $sent = [];
+
+    public function to($users)
+    {
+        return $this;
+    }
+
+    public function send($mailable)
+    {
+        $this->sent[] = $mailable;
+
+        return null;
+    }
+}
+
+/**
+ * Swap in a container that answers environment().
+ *
+ * verificationBypassMatches() asks app()->environment('production'), which the bare
+ * Illuminate\Container\Container used by this harness does not implement. Mirrors
+ * fleetopsCustomerHelperContainer() in CustomerControllerHelperSeamsTest.
+ */
+function fleetopsDriverAuthContainer(): void
+{
+    $current = Illuminate\Container\Container::getInstance();
+    if (method_exists($current, 'hasDebugModeEnabled')) {
+        return;
+    }
+
+    $replacement = new class extends Illuminate\Container\Container {
+        public function environment(...$environments)
+        {
+            if (empty($environments)) {
+                return 'testing';
+            }
+
+            $checks = is_array($environments[0]) ? $environments[0] : $environments;
+
+            return in_array('testing', $checks, true);
+        }
+
+        public function hasDebugModeEnabled()
+        {
+            return true;
+        }
+    };
+
+    foreach (['bindings', 'instances', 'aliases', 'abstractAliases', 'resolved', 'extenders', 'tags', 'contextual', 'scopedInstances', 'reboundCallbacks', 'globalBeforeResolvingCallbacks', 'globalResolvingCallbacks', 'globalAfterResolvingCallbacks', 'beforeResolvingCallbacks', 'resolvingCallbacks', 'afterResolvingCallbacks'] as $property) {
+        if (!property_exists(Illuminate\Container\Container::class, $property)) {
+            continue;
+        }
+        $reflection = new ReflectionProperty(Illuminate\Container\Container::class, $property);
+        $reflection->setAccessible(true);
+        if ($reflection->isInitialized($current)) {
+            $reflection->setValue($replacement, $reflection->getValue($current));
+        }
+    }
+
+    Illuminate\Container\Container::setInstance($replacement);
+    Illuminate\Support\Facades\Facade::setFacadeApplication($replacement);
+}
+
+function fleetopsDriverAuthBoot(): SQLiteConnection
+{
+    // Must run before the app()->instance() calls below, so those bindings land on
+    // the replacement container rather than the one it supersedes.
+    fleetopsDriverAuthContainer();
+
+    $connection = new SQLiteConnection(new PDO('sqlite::memory:'));
+    $resolver   = new ConnectionResolver(['default' => $connection, 'mysql' => $connection]);
+    $resolver->setDefaultConnection('mysql');
+    EloquentModel::setConnectionResolver($resolver);
+    app()->instance('db', new class($connection) {
+        public function __construct(public SQLiteConnection $c)
+        {
+        }
+
+        public function connection($name = null): SQLiteConnection
+        {
+            return $this->c;
+        }
+
+        public function __call($method, $arguments)
+        {
+            return $this->c->{$method}(...$arguments);
+        }
+    });
+    Illuminate\Support\Facades\DB::clearResolvedInstance('db');
+
+    app()->instance('hash', new FleetOpsDriverAuthHasherFake());
+    Illuminate\Support\Facades\Hash::clearResolvedInstance('hash');
+
+    app()->instance('mail.manager', new FleetOpsDriverAuthMailerFake());
+    Illuminate\Support\Facades\Mail::clearResolvedInstance('mail.manager');
+
+    $schema = $connection->getSchemaBuilder();
+    $tables = [
+        'users'                  => ['uuid', 'public_id', 'company_uuid', 'name', 'email', 'phone', 'password', 'type', 'status', 'avatar_uuid'],
+        'drivers'                => ['uuid', 'public_id', 'internal_id', 'company_uuid', 'user_uuid', 'vehicle_uuid', 'status', 'online', 'auth_token', 'location', 'meta'],
+        'companies'              => ['uuid', 'public_id', 'name', 'options'],
+        'verification_codes'     => ['uuid', 'public_id', 'subject_uuid', 'subject_type', 'for', 'code', 'meta', 'status', 'expires_at'],
+        'personal_access_tokens' => ['tokenable_type', 'tokenable_id', 'name', 'token', 'abilities', 'last_used_at', 'expires_at'],
+    ];
+    foreach ($tables as $table => $columns) {
+        $schema->create($table, function ($blueprint) use ($columns) {
+            $blueprint->increments('id');
+            foreach ($columns as $column) {
+                $blueprint->string($column)->nullable();
+            }
+            $blueprint->timestamps();
+            $blueprint->timestamp('deleted_at')->nullable();
+        });
+    }
+
+    User::expand('driver', function () {
+        return $this->hasOne(Driver::class, 'user_uuid', 'uuid')->withoutGlobalScopes();
+    });
+
+    app()->forgetInstance('twilio');
+    Illuminate\Support\Facades\Facade::clearResolvedInstance('twilio');
+
+    session(['company' => 'company-1']);
+
+    $connection->table('users')->insert([
+        'uuid'         => 'user-1',
+        'company_uuid' => 'company-1',
+        'name'         => 'Driver One',
+        'email'        => 'driver@example.test',
+        'phone'        => '+6591234567',
+        'password'     => 'hashed-secret',
+    ]);
+    $connection->table('drivers')->insert([
+        'uuid'         => 'driver-1',
+        'public_id'    => 'driver_test',
+        'company_uuid' => 'company-1',
+        'user_uuid'    => 'user-1',
+    ]);
+    $connection->table('companies')->insert(['uuid' => 'company-1', 'public_id' => 'company_test', 'name' => 'Acme']);
+
+    return $connection;
+}
+
+test('password login rejects bad credentials and issues driver tokens', function () {
+    $connection = fleetopsDriverAuthBoot();
+    $controller = new DriverController();
+
+    // Wrong password
+    app('hash')->checks = false;
+    $rejected           = $controller->login(Request::create('/x', 'POST', ['identity' => 'driver@example.test', 'password' => 'nope']));
+    expect($rejected)->toBeInstanceOf(JsonResponse::class)
+        ->and($rejected->getStatusCode())->toBe(401)
+        ->and($rejected->getData(true)['error'])->toContain('Authentication failed');
+
+    // Correct password issues a personal access token on the driver resource
+    app('hash')->checks = true;
+    $resource           = $controller->login(Request::create('/x', 'POST', ['identity' => '6591234567', 'password' => 'secret']));
+    expect($resource)->toBeInstanceOf(DriverResource::class)
+        ->and($resource->token)->not->toBeEmpty()
+        ->and($connection->table('personal_access_tokens')->value('name'))->toBe('driver-1');
+});
+
+test('phone login falls back to email verification and errors without channels', function () {
+    $connection = fleetopsDriverAuthBoot();
+    $controller = new DriverController();
+
+    // Unknown phone number
+    app()->instance('request', Request::create('/x', 'POST', ['phone' => '+000']));
+    $missing = $controller->loginWithPhone();
+    expect($missing->getData(true)['error'])->toContain('No driver with this phone');
+
+    // SMS transport is unavailable in the harness, so the SMS attempt throws
+    // and the controller falls back to the mail-faked email channel.
+    app()->instance('request', Request::create('/x', 'POST', ['phone' => '6591234567']));
+    $emailFallback = $controller->loginWithPhone();
+    expect($emailFallback->getData(true))->toBe(['status' => 'OK', 'method' => 'email'])
+        ->and($connection->table('verification_codes')->where('for', 'driver_login')->count())->toBeGreaterThan(0);
+
+    // Without an email address no verification channel remains
+    $connection->table('users')->where('uuid', 'user-1')->update(['email' => null]);
+    $noChannel = $controller->loginWithPhone();
+    expect($noChannel->getData(true)['error'])->toContain('Unable to send SMS Verification code');
+});
+
+test('phone login reports the sms method when the transport delivers', function () {
+    $connection = fleetopsDriverAuthBoot();
+    $twilio     = new FleetOpsDriverAuthTwilioFake();
+    app()->instance('twilio', $twilio);
+    Fleetbase\Twilio\Support\Laravel\Facade::clearResolvedInstances();
+
+    app()->instance('request', Request::create('/x', 'POST', ['phone' => '6591234567']));
+    $response = (new DriverController())->loginWithPhone();
+
+    // No email fallback is attempted once the SMS itself goes out
+    expect($response->getData(true))->toBe(['status' => 'OK', 'method' => 'sms'])
+        ->and($twilio->messages)->toHaveCount(1)
+        ->and($twilio->messages[0][1])->toContain('Acme verification code is')
+        ->and($connection->table('verification_codes')->where('for', 'driver_login')->count())->toBe(1);
+});
+
+test('code verification handles unknown users invalid codes bypass and success', function () {
+    $connection = fleetopsDriverAuthBoot();
+    $controller = new DriverController();
+
+    // Unknown identity
+    $unknown = $controller->verifyCode(Request::create('/x', 'POST', ['identity' => 'ghost@example.test', 'code' => '123456']));
+    expect($unknown->getData(true)['error'])->toContain('Unable to verify code');
+
+    // Invalid code with no bypass configured
+    $invalid = $controller->verifyCode(Request::create('/x', 'POST', ['identity' => 'driver@example.test', 'code' => '999999']));
+    expect($invalid->getData(true)['error'])->toContain('Invalid verification code');
+
+    // Bypass code from config authenticates without a stored code
+    config()->set('fleetops.navigator.bypass_verification_code', '777777');
+    config()->set('fleetops.navigator.review_accounts', ['driver@example.test']);
+    $bypassed = $controller->verifyCode(Request::create('/x', 'POST', ['identity' => 'driver@example.test', 'code' => '777777']));
+    expect($bypassed)->toBeInstanceOf(DriverResource::class);
+
+    // Stored verification codes authenticate and persist the auth token
+    $connection->table('verification_codes')->insert([
+        'uuid'         => 'vc-1',
+        'subject_uuid' => 'user-1',
+        'code'         => '424242',
+        'for'          => 'driver_login',
+    ]);
+    $verified = $controller->verifyCode(Request::create('/x', 'POST', ['identity' => '6591234567', 'code' => '424242']));
+    expect($verified)->toBeInstanceOf(DriverResource::class)
+        ->and($verified->token)->not->toBeEmpty()
+        ->and($connection->table('drivers')->where('uuid', 'driver-1')->value('auth_token'))->not->toBeEmpty();
+});
+
+test('verification failures report to sentry and exhaust every channel', function () {
+    $connection = fleetopsDriverAuthBoot();
+    $controller = new DriverController();
+
+    $sentry = new class {
+        public array $captured = [];
+
+        public function captureException($exception)
+        {
+            $this->captured[] = $exception;
+
+            return null;
+        }
+
+        public function __call($method, $arguments)
+        {
+            return null;
+        }
+    };
+    app()->instance('sentry', $sentry);
+
+    // The SMS attempt fails in the harness and is reported before the
+    // controller falls back to the email channel
+    app()->instance('request', Request::create('/x', 'POST', ['phone' => '6591234567']));
+    $emailFallback = $controller->loginWithPhone();
+    expect($emailFallback->getData(true))->toBe(['status' => 'OK', 'method' => 'email'])
+        ->and($sentry->captured)->toHaveCount(1);
+
+    // When the mail channel also fails both failures are reported and the
+    // controller surfaces the generic error
+    app()->instance('mail.manager', new class {
+        public function to($users)
+        {
+            return $this;
+        }
+
+        public function send($mailable)
+        {
+            throw new RuntimeException('mail transport unavailable');
+        }
+    });
+    Illuminate\Support\Facades\Mail::clearResolvedInstance('mail.manager');
+
+    $noChannel = $controller->loginWithPhone();
+    expect($noChannel->getData(true)['error'])->toContain('Unable to send SMS Verification code')
+        ->and(count($sentry->captured))->toBeGreaterThanOrEqual(3);
+
+    app()->forgetInstance('sentry');
+});
+
+test('verify code delegates driver creation requests to the create flow', function () {
+    fleetopsDriverAuthBoot();
+
+    $probe = new class extends DriverController {
+        public array $created = [];
+
+        public function create(Request $request)
+        {
+            $this->created[] = $request->input('identity');
+
+            return 'delegated-create';
+        }
+    };
+
+    $result = $probe->verifyCode(Request::create('/x', 'POST', [
+        'identity' => 'newdriver@example.test',
+        'code'     => '123456',
+        'for'      => 'create_driver',
+    ]));
+
+    expect($result)->toBe('delegated-create')
+        ->and($probe->created)->toBe(['newdriver@example.test']);
+});
+
+test('token issuance failures surface as api errors', function () {
+    $connection = fleetopsDriverAuthBoot();
+    $controller = new DriverController();
+
+    // Without the token table the sanctum call fails; the login endpoint
+    // reports the driver-facing error instead of leaking a query exception
+    $connection->getSchemaBuilder()->drop('personal_access_tokens');
+    app('hash')->checks = true;
+
+    $response = $controller->login(Request::create('/x', 'POST', [
+        'identity' => 'driver@example.test',
+        'password' => 'secret',
+    ]));
+
+    expect($response)->toBeInstanceOf(JsonResponse::class)
+        ->and($response->getData(true))->toHaveKey('error');
+});
+
+test('code verification reports token issuance failures', function () {
+    $connection = fleetopsDriverAuthBoot();
+    $controller = new DriverController();
+
+    // A bypass code authenticates without a stored verification code, so the
+    // flow reaches token issuance; without the token table that send fails
+    config()->set('fleetops.navigator.bypass_verification_code', '777777');
+    config()->set('fleetops.navigator.review_accounts', ['driver@example.test']);
+    $connection->getSchemaBuilder()->drop('personal_access_tokens');
+
+    $response = $controller->verifyCode(Request::create('/x', 'POST', [
+        'identity' => 'driver@example.test',
+        'code'     => '777777',
+    ]));
+
+    expect($response)->toBeInstanceOf(JsonResponse::class)
+        ->and($response->getData(true))->toHaveKey('error');
+});
+
+test('token persistence failures are reported to sentry', function () {
+    $connection = fleetopsDriverAuthBoot();
+    $controller = new DriverController();
+
+    $sentry = new class {
+        public array $captured = [];
+
+        public function captureException($exception)
+        {
+            $this->captured[] = $exception;
+
+            return null;
+        }
+
+        public function __call($method, $arguments)
+        {
+            return null;
+        }
+    };
+    app()->instance('sentry', $sentry);
+
+    // Rebuild drivers without the auth_token column so persisting the issued
+    // token fails after the token itself was created successfully
+    $rows = $connection->table('drivers')->get();
+    $connection->getSchemaBuilder()->drop('drivers');
+    $connection->getSchemaBuilder()->create('drivers', function ($blueprint) {
+        $blueprint->increments('id');
+        foreach (['uuid', 'public_id', 'internal_id', 'company_uuid', 'user_uuid', 'vehicle_uuid', 'status', 'online', 'location', 'meta'] as $column) {
+            $blueprint->string($column)->nullable();
+        }
+        $blueprint->timestamps();
+        $blueprint->timestamp('deleted_at')->nullable();
+    });
+    foreach ($rows as $row) {
+        $connection->table('drivers')->insert([
+            'uuid'         => $row->uuid,
+            'public_id'    => $row->public_id,
+            'company_uuid' => $row->company_uuid,
+            'user_uuid'    => $row->user_uuid,
+        ]);
+    }
+
+    config()->set('fleetops.navigator.bypass_verification_code', '777777');
+    config()->set('fleetops.navigator.review_accounts', ['driver@example.test']);
+    $response = $controller->verifyCode(Request::create('/x', 'POST', [
+        'identity' => 'driver@example.test',
+        'code'     => '777777',
+    ]));
+
+    expect($response->getData(true)['error'] ?? '')->toBe('Unable to authenticate driver.')
+        ->and($sentry->captured)->toHaveCount(1);
+
+    app()->forgetInstance('sentry');
+});
+
+test('current driver resolves the authenticated users driver profile', function () {
+    $connection = fleetopsDriverAuthBoot();
+    $connection->table('users')->insert(['uuid' => 'user-current-1', 'public_id' => 'user_current1', 'company_uuid' => 'company-1', 'name' => 'Current Driver', 'email' => 'current@example.test', 'type' => 'driver']);
+    $connection->table('drivers')->insert(['uuid' => 'driver-current-1', 'public_id' => 'driver_current1', 'company_uuid' => 'company-1', 'user_uuid' => 'user-current-1']);
+
+    // registerDevice without an id resolves the driver from the authenticated user
+    // rather than a route parameter, so exercise the real seam here — the
+    // contract probe overrides it and never runs this body
+    $currentDriver = new ReflectionMethod(DriverController::class, 'currentDriver');
+    $currentDriver->setAccessible(true);
+
+    $request = Request::create('/v1/drivers/register-device', 'POST');
+    // Auth::getUserFromSession only accepts a User model from the resolver — anything
+    // else falls through to the session, so this must be a real model, not a row object.
+    $request->setUserResolver(fn () => User::query()->where('uuid', 'user-current-1')->first());
+
+    $resolved = $currentDriver->invoke(new DriverController(), $request);
+
+    expect($resolved)->toBeInstanceOf(Driver::class)
+        ->and($resolved->uuid)->toBe('driver-current-1');
+});
+
+test('current driver resolves from the session when the request has no user resolver', function () {
+    $connection = fleetopsDriverAuthBoot();
+    $connection->table('users')->insert(['uuid' => 'user-session-1', 'public_id' => 'user_session1', 'company_uuid' => 'company-1', 'name' => 'Session Driver', 'email' => 'session@example.test', 'type' => 'driver']);
+    $connection->table('drivers')->insert(['uuid' => 'driver-session-1', 'public_id' => 'driver_session1', 'company_uuid' => 'company-1', 'user_uuid' => 'user-session-1']);
+
+    // This is the production path for the public API. `fleetbase.api` authenticates with
+    // Auth::setSession($apiCredential), which writes session('user') but does NOT bind a
+    // user resolver — so reading $request->user() directly resolved nothing and
+    // POST /v1/drivers/register-device answered 404 for every consumer.
+    session(['user' => 'user-session-1']);
+
+    $currentDriver = new ReflectionMethod(DriverController::class, 'currentDriver');
+    $currentDriver->setAccessible(true);
+
+    $resolved = $currentDriver->invoke(new DriverController(), Request::create('/v1/drivers/register-device', 'POST'));
+
+    expect($resolved)->toBeInstanceOf(Driver::class)
+        ->and($resolved->uuid)->toBe('driver-session-1');
+});
+
+test('current driver fails when the request has no matching driver', function () {
+    fleetopsDriverAuthBoot();
+    // Explicit, because the session survives between tests and a leftover `user` key
+    // would silently resolve a driver and make this assertion vacuous.
+    session(['user' => null]);
+
+    $currentDriver = new ReflectionMethod(DriverController::class, 'currentDriver');
+    $currentDriver->setAccessible(true);
+
+    // A request with no authenticated user resolves no driver, which the
+    // caller turns into a not-found response instead of a 500
+    $failure = null;
+
+    try {
+        $currentDriver->invoke(new DriverController(), Request::create('/v1/drivers/register-device', 'POST'));
+    } catch (Illuminate\Database\Eloquent\ModelNotFoundException $exception) {
+        $failure = $exception;
+    }
+
+    expect($failure)->toBeInstanceOf(Illuminate\Database\Eloquent\ModelNotFoundException::class);
+});