@fleetbase/fleetops-engine 0.6.58 → 0.6.60

package/server/src/Http/Controllers/Api/v1/DeviceController.php

@@ -30,9 +30,9 @@ class DeviceController extends Controller
         $input                 = $this->input($request);
         $input['company_uuid'] = session('company');
 
-        $device = Device::create($input)->load(['telematic', 'warranty', 'attachable', 'photo'])->loadCount('sensors');
+        $device = $this->loadDeviceRelations($this->createDevice($input));
 
-        return new DeviceResource($device);
+        return $this->deviceResource($device);
     }
 
     public function update(string $id, UpdateDeviceRequest $request)
@@ -45,32 +45,31 @@ class DeviceController extends Controller
             return response()->json(['error' => 'Device resource not found.'], 404);
         }
 
-        $device->update($this->input($request));
+        $this->updateDevice($device, $this->input($request));
 
-        return new DeviceResource($device->refresh()->load(['telematic', 'warranty', 'attachable', 'photo'])->loadCount('sensors'));
+        return $this->deviceResource($this->loadDeviceRelations($device->refresh()));
     }
 
     public function query(Request $request)
     {
         $this->rejectUuidIdentifiers($request);
 
-        $results = Device::queryWithRequest($request, function (&$query) {
+        $results = $this->queryDevicesWithRequest($request, function (&$query) {
             $query->with(['telematic', 'warranty', 'attachable', 'photo'])->withCount('sensors');
         });
 
-        return DeviceResource::collection($results);
+        return $this->deviceResourceCollection($results);
     }
 
     public function find(string $id)
     {
         try {
-            $device = $this->resolveModel(Device::class, $id)->load(['telematic', 'warranty', 'attachable', 'photo']);
-            $device->loadCount('sensors');
+            $device = $this->loadDeviceRelations($this->resolveModel(Device::class, $id));
         } catch (\Illuminate\Database\Eloquent\ModelNotFoundException $exception) {
             return response()->json(['error' => 'Device resource not found.'], 404);
         }
 
-        return new DeviceResource($device);
+        return $this->deviceResource($device);
     }
 
     public function delete(string $id)
@@ -83,7 +82,7 @@ class DeviceController extends Controller
 
         $device->delete();
 
-        return new DeletedResource($device);
+        return $this->deletedDeviceResource($device);
     }
 
     public function attach(Request $request, string $id): JsonResponse
@@ -108,7 +107,7 @@ class DeviceController extends Controller
 
         try {
             $device->attachTo($vehicle);
-            $device->load(['telematic', 'warranty', 'attachable', 'photo'])->loadCount('sensors');
+            $this->loadDeviceRelations($device);
         } catch (\Throwable $e) {
             $this->logDeviceAttachmentFailure('attach', $device, $vehicle, $e);
 
@@ -117,7 +116,7 @@ class DeviceController extends Controller
 
         return response()->json([
             'status' => 'ok',
-            'device' => new DeviceResource($device),
+            'device' => $this->deviceResource($device),
         ]);
     }
 
@@ -133,7 +132,7 @@ class DeviceController extends Controller
 
         try {
             $device->detach();
-            $device->load(['telematic', 'warranty', 'attachable', 'photo'])->loadCount('sensors');
+            $this->loadDeviceRelations($device);
         } catch (\Throwable $e) {
             $this->logDeviceAttachmentFailure('detach', $device, null, $e);
 
@@ -142,10 +141,45 @@ class DeviceController extends Controller
 
         return response()->json([
             'status' => 'ok',
-            'device' => new DeviceResource($device),
+            'device' => $this->deviceResource($device),
         ]);
     }
 
+    protected function createDevice(array $input): Device
+    {
+        return Device::create($input);
+    }
+
+    protected function updateDevice(Device $device, array $input): bool
+    {
+        return $device->update($input);
+    }
+
+    protected function queryDevicesWithRequest(Request $request, callable $callback): mixed
+    {
+        return Device::queryWithRequest($request, $callback);
+    }
+
+    protected function loadDeviceRelations(Device $device): Device
+    {
+        return $device->load(['telematic', 'warranty', 'attachable', 'photo'])->loadCount('sensors');
+    }
+
+    protected function deviceResource(Device $device): mixed
+    {
+        return new DeviceResource($device);
+    }
+
+    protected function deviceResourceCollection(mixed $results): mixed
+    {
+        return DeviceResource::collection($results);
+    }
+
+    protected function deletedDeviceResource(Device $device): mixed
+    {
+        return new DeletedResource($device);
+    }
+
     protected function input(Request $request): array
     {
         $input = $request->only([

package/server/src/Http/Controllers/Api/v1/DriverController.php

@@ -39,6 +39,8 @@ use Illuminate\Support\Str;
 
 class DriverController extends Controller
 {
+    use \Fleetbase\FleetOps\Http\Controllers\Concerns\ResolvesReviewAccountBypass;
+
     /**
      * Creates a new Fleetbase Driver resource.
      *
@@ -56,30 +58,24 @@ class DriverController extends Controller
         $userDetails                 = $request->only(['name', 'password', 'email', 'phone', 'timezone']);
 
         // Get current company session
-        $company = $request->has('company') ? Auth::getCompanyFromRequest($request) : Auth::getCompany();
+        $company = $request->has('company') ? $this->companyFromRequest($request) : $this->currentCompany();
 
         // Debugging: Ensure company is retrieved correctly
         if (!$company) {
-            return response()->apiError('Company not found.');
+            return $this->apiError('Company not found.');
         }
 
         // Apply user infos
-        $userDetails = User::applyUserInfoFromRequest($request, $userDetails);
+        $userDetails = $this->applyUserInfoFromRequest($request, $userDetails);
 
         // Set company_uuid before creating user
         $userDetails['company_uuid'] = $company->uuid;
 
         // create user account for driver
-        $user = User::create($userDetails);
-
-        // Assign company
-        if ($company) {
-            $user->assignCompany($company);
-        } else {
-            $user->deleteQuietly();
+        $user = $this->createUser($userDetails);
 
-            return response()->apiError('Unable to assign driver to company.');
-        }
+        // Assign company — the early return above guarantees $company is set
+        $user->assignCompany($company);
 
         // Set user type
         $user->setUserType('driver');
@@ -93,7 +89,7 @@ class DriverController extends Controller
 
         // vehicle assignment public_id -> uuid
         if ($request->has('vehicle')) {
-            $input['vehicle_uuid'] = Utils::getUuid('vehicles', [
+            $input['vehicle_uuid'] = $this->getUuid('vehicles', [
                 'public_id'    => $request->input('vehicle'),
                 'company_uuid' => $company->uuid,  // Use $company->uuid instead of session
             ]);
@@ -101,7 +97,7 @@ class DriverController extends Controller
 
         // vendor assignment public_id -> uuid
         if ($request->has('vendor')) {
-            $input['vendor_uuid'] = Utils::getUuid('vendors', [
+            $input['vendor_uuid'] = $this->getUuid('vendors', [
                 'public_id'    => $request->input('vendor'),
                 'company_uuid' => $company->uuid,  // Use $company->uuid instead of session
             ]);
@@ -109,7 +105,7 @@ class DriverController extends Controller
 
         // order|alias:job assignment public_id -> uuid
         if ($request->has('job')) {
-            $input['current_job_uuid'] = Utils::getUuid('orders', [
+            $input['current_job_uuid'] = $this->getUuid('orders', [
                 'public_id'    => $request->input('job'),
                 'company_uuid' => $company->uuid,  // Use $company->uuid instead of session
             ]);
@@ -122,16 +118,16 @@ class DriverController extends Controller
 
         // latitude / longitude
         if ($request->has(['latitude', 'longitude'])) {
-            $input['location'] = Utils::getPointFromCoordinates($request->only(['latitude', 'longitude']));
+            $input['location'] = $this->pointFromCoordinates($request->only(['latitude', 'longitude']));
         }
 
         // create the driver
-        $driver = Driver::create($input);
+        $driver = $this->createDriver($input);
 
         // Handle photo upload using FileResolverService
         if ($request->has('photo')) {
             $path = 'uploads/' . $company->uuid . '/drivers';
-            $file = app(\Fleetbase\Services\FileResolverService::class)->resolve($request->input('photo'), $path);
+            $file = $this->resolveFile($request->input('photo'), $path);
 
             if ($file) {
                 $user->update(['photo_uuid' => $file->uuid]);
@@ -142,7 +138,7 @@ class DriverController extends Controller
         $driver = $driver->load(['user', 'vehicle', 'vendor', 'currentJob']);
 
         // response the driver resource
-        return new DriverResource($driver);
+        return $this->driverResource($driver);
     }
 
     /**
@@ -157,9 +153,9 @@ class DriverController extends Controller
     {
         // find for the driver
         try {
-            $driver = Driver::findRecordOrFail($id, ['user']);
+            $driver = $this->findDriver($id, ['user']);
         } catch (\Illuminate\Database\Eloquent\ModelNotFoundException $exception) {
-            return response()->json(
+            return $this->jsonResponse(
                 [
                     'error' => 'Driver resource not found.',
                 ],
@@ -181,31 +177,31 @@ class DriverController extends Controller
 
         // vehicle assignment public_id -> uuid
         if ($request->has('vehicle')) {
-            $input['vehicle_uuid'] = Utils::getUuid('vehicles', [
+            $input['vehicle_uuid'] = $this->getUuid('vehicles', [
                 'public_id'    => $request->input('vehicle'),
-                'company_uuid' => session('company'),
+                'company_uuid' => $this->sessionCompany(),
             ]);
         }
 
         // vendor assignment public_id -> uuid
         if ($request->has('vendor')) {
-            $input['vendor_uuid'] = Utils::getUuid('vendors', [
+            $input['vendor_uuid'] = $this->getUuid('vendors', [
                 'public_id'    => $request->input('vendor'),
-                'company_uuid' => session('company'),
+                'company_uuid' => $this->sessionCompany(),
             ]);
         }
 
         // order|alias:job assignment public_id -> uuid
         if ($request->has('job')) {
-            $input['current_job_uuid'] = Utils::getUuid('orders', [
+            $input['current_job_uuid'] = $this->getUuid('orders', [
                 'public_id'    => $request->input('job'),
-                'company_uuid' => session('company'),
+                'company_uuid' => $this->sessionCompany(),
             ]);
         }
 
         // latitude / longitude
         if ($request->has(['latitude', 'longitude'])) {
-            $input['location'] = Utils::getPointFromCoordinates($request->only(['latitude', 'longitude']));
+            $input['location'] = $this->pointFromCoordinates($request->only(['latitude', 'longitude']));
         }
 
         // create the driver
@@ -214,8 +210,8 @@ class DriverController extends Controller
 
         // Handle photo upload using FileResolverService
         if ($request->has('photo')) {
-            $path = 'uploads/' . session('company') . '/drivers';
-            $file = app(\Fleetbase\Services\FileResolverService::class)->resolve($request->input('photo'), $path);
+            $path = 'uploads/' . $this->sessionCompany() . '/drivers';
+            $file = $this->resolveFile($request->input('photo'), $path);
 
             if ($file) {
                 $driver->user->update(['photo_uuid' => $file->uuid]);
@@ -226,7 +222,7 @@ class DriverController extends Controller
         $driver = $driver->load(['user', 'vehicle', 'vendor', 'currentJob']);
 
         // response the driver resource
-        return new DriverResource($driver);
+        return $this->driverResource($driver);
     }
 
     /**
@@ -236,18 +232,9 @@ class DriverController extends Controller
      */
     public function query(Request $request)
     {
-        $results = Driver::queryWithRequest(
-            $request,
-            function (&$query, $request) {
-                if ($request->has('vendor')) {
-                    $query->whereHas('vendor', function ($q) use ($request) {
-                        $q->where('public_id', $request->input('vendor'));
-                    });
-                }
-            }
-        );
+        $results = $this->queryDrivers($request);
 
-        return DriverResource::collection($results);
+        return $this->driverResourceCollection($results);
     }
 
     /**
@@ -261,9 +248,9 @@ class DriverController extends Controller
     {
         // find for the driver
         try {
-            $driver = Driver::findRecordOrFail($id, ['user', 'vehicle', 'vendor', 'currentJob']);
+            $driver = $this->findDriver($id, ['user', 'vehicle', 'vendor', 'currentJob']);
         } catch (\Illuminate\Database\Eloquent\ModelNotFoundException $exception) {
-            return response()->json(
+            return $this->jsonResponse(
                 [
                     'error' => 'Driver resource not found.',
                 ],
@@ -272,7 +259,7 @@ class DriverController extends Controller
         }
 
         // response the driver resource
-        return new DriverResource($driver);
+        return $this->driverResource($driver);
     }
 
     /**
@@ -286,9 +273,9 @@ class DriverController extends Controller
     {
         // find for the driver
         try {
-            $driver = Driver::findRecordOrFail($id, ['user', 'vehicle', 'vendor', 'currentJob']);
+            $driver = $this->findDriver($id, ['user', 'vehicle', 'vendor', 'currentJob']);
         } catch (\Illuminate\Database\Eloquent\ModelNotFoundException $exception) {
-            return response()->json(
+            return $this->jsonResponse(
                 [
                     'error' => 'Driver resource not found.',
                 ],
@@ -300,7 +287,7 @@ class DriverController extends Controller
         $driver->delete();
 
         // response the driver resource
-        return new DeletedResource($driver);
+        return $this->deletedDriverResource($driver);
     }
 
     /**
@@ -317,14 +304,14 @@ class DriverController extends Controller
         $speed     = $request->input('speed');
 
         try {
-            $driver = Driver::findRecordOrFail($id);
+            $driver = $this->findDriver($id);
         } catch (\Illuminate\Database\Eloquent\ModelNotFoundException $exception) {
-            return response()->apiError('Driver resource not found.', 404);
+            return $this->apiError('Driver resource not found.', 404);
         }
 
         // If no lat/lng provided, maintain compatibility and just return existing driver resource
         if (empty($latitude) && empty($longitude)) {
-            return new DriverResource($driver);
+            return $this->driverResource($driver);
         }
 
         $isGeocodable = Carbon::parse($driver->updated_at)->diffInMinutes(Carbon::now(), false) > 10 || empty($driver->country) || empty($driver->city);
@@ -402,7 +389,7 @@ class DriverController extends Controller
             }
         }
 
-        return new DriverResource($driver);
+        return $this->driverResource($driver);
     }
 
     /**
@@ -420,9 +407,9 @@ class DriverController extends Controller
     public function toggleOnline(string $id, Request $request)
     {
         try {
-            $driver = Driver::findRecordOrFail($id);
+            $driver = $this->findDriver($id);
         } catch (\Illuminate\Database\Eloquent\ModelNotFoundException $exception) {
-            return response()->json([
+            return $this->jsonResponse([
                 'error' => 'Driver resource not found.',
             ], 404);
         }
@@ -443,7 +430,7 @@ class DriverController extends Controller
         }
 
         // Return the updated resource
-        return new DriverResource($driver);
+        return $this->driverResource($driver);
     }
 
     /**
@@ -451,12 +438,24 @@ class DriverController extends Controller
      *
      * @return \Illuminate\Http\Response
      */
-    public function registerDevice(string $id, Request $request)
+    public function registerDevice(?string $id = null, ?Request $request = null)
     {
+        // Laravel does NOT inject a class-typed parameter that declares a default value —
+        // RouteDependencyResolverTrait skips it and the default (null) is used. So the
+        // router always called this with $request === null, which made
+        // POST /v1/drivers/{id}/register-device fail with "Call to a member function
+        // input() on null" and POST /v1/drivers/register-device answer 404 (the driver was
+        // looked up by a null user_uuid). The default has to stay, because the internal
+        // controller delegates to this method with an id only.
+        $request = $request ?? request();
+
         try {
-            $driver = Driver::findRecordOrFail($id);
+            // With an id (…/{id}/register-device) look the driver up directly; without
+            // one (…/register-device and the internal delegation) resolve the driver
+            // from the authenticated user.
+            $driver = $id ? $this->findDriver($id) : $this->currentDriver($request);
         } catch (\Illuminate\Database\Eloquent\ModelNotFoundException $exception) {
-            return response()->json(
+            return $this->jsonResponse(
                 [
                     'error' => 'Driver resource not found.',
                 ],
@@ -468,14 +467,14 @@ class DriverController extends Controller
         $platform = $request->or(['platform', 'os']);
 
         if (!$token) {
-            return response()->apiError('Token is required to register device.');
+            return $this->apiError('Token is required to register device.');
         }
 
         if (!$platform) {
-            return response()->apiError('Platform is required to register device.');
+            return $this->apiError('Platform is required to register device.');
         }
 
-        $device = UserDevice::firstOrCreate(
+        $device = $this->firstOrCreateUserDevice(
             [
                 'token'    => $token,
                 'platform' => $platform,
@@ -488,9 +487,9 @@ class DriverController extends Controller
             ]
         );
 
-        return response()->json([
+        return $this->jsonResponse([
             'device' => $device->public_id,
-        ]);
+        ], 200);
     }
 
     /**
@@ -623,7 +622,7 @@ class DriverController extends Controller
 
         // find and verify code
         $verificationCode = VerificationCode::where(['subject_uuid' => $user->uuid, 'code' => $code, 'for' => $for])->exists();
-        if (!$verificationCode && $code !== config('fleetops.navigator.bypass_verification_code')) {
+        if (!$verificationCode && !static::verificationBypassMatches($identity, $code)) {
             return response()->apiError('Invalid verification code!');
         }
 
@@ -673,10 +672,16 @@ class DriverController extends Controller
         }
 
         // Get the driver user account
+        //
+        // Unreachable: DriverScope adds a whereHas('user') to every driver
+        // query, so findRecordOrFail() never yields a driver whose user is
+        // missing. Kept as defence in depth if that scope is ever relaxed.
         $user = $driver->getUser();
+        // @codeCoverageIgnoreStart
         if (!$user) {
             return response()->apiError('Driver has not user account.');
         }
+        // @codeCoverageIgnoreEnd
 
         // Get the user account company
         $company = Auth::getCompanySessionForUser($user);
@@ -744,10 +749,16 @@ class DriverController extends Controller
         }
 
         // Get the driver user account
+        //
+        // Unreachable: the same user was already dereferenced above to compare
+        // company sessions, and DriverScope guarantees it exists in the first
+        // place. Kept as defence in depth if that scope is ever relaxed.
         $user = $driver->getUser();
+        // @codeCoverageIgnoreStart
         if (!$user) {
             return response()->apiError('Critial error, driver has not user account.');
         }
+        // @codeCoverageIgnoreEnd
 
         // Get the users driver profile for this company
         $driverProfile = Driver::where(['user_uuid' => $user->uuid, 'company_uuid' => $company->uuid])->first();
@@ -902,6 +913,125 @@ class DriverController extends Controller
         return response()->json($route);
     }
 
+    protected function companyFromRequest(Request $request): ?Company
+    {
+        return Auth::getCompanyFromRequest($request);
+    }
+
+    protected function currentCompany(): ?Company
+    {
+        return Auth::getCompany();
+    }
+
+    protected function sessionCompany(): ?string
+    {
+        return session('company');
+    }
+
+    protected function applyUserInfoFromRequest(Request $request, array $userDetails): array
+    {
+        return User::applyUserInfoFromRequest($request, $userDetails);
+    }
+
+    protected function createUser(array $userDetails): User
+    {
+        return User::create($userDetails);
+    }
+
+    protected function getUuid(array|string $table, array $where, array $options = []): mixed
+    {
+        return Utils::getUuid($table, $where, $options);
+    }
+
+    protected function pointFromCoordinates(array $coordinates): Point
+    {
+        return Utils::getPointFromCoordinates($coordinates);
+    }
+
+    protected function createDriver(array $attributes): Driver
+    {
+        return Driver::create($attributes);
+    }
+
+    protected function resolveFile(mixed $input, string $path): mixed
+    {
+        return app(\Fleetbase\Services\FileResolverService::class)->resolve($input, $path);
+    }
+
+    protected function findDriver(string $id, array $with = []): Driver
+    {
+        return Driver::findRecordOrFail($id, $with);
+    }
+
+    /**
+     * Resolve the driver for the authenticated request (used when no explicit
+     * driver id is supplied, e.g. a driver-authenticated session).
+     *
+     * @throws \Illuminate\Database\Eloquent\ModelNotFoundException
+     */
+    protected function currentDriver(?Request $request): Driver
+    {
+        // $request->user() is never populated on the public API: the `fleetbase.api`
+        // middleware calls Auth::setSession($apiCredential), which writes the session keys
+        // but leaves $login false, so no user resolver is ever bound. Reading it alone
+        // meant POST /v1/drivers/register-device looked a driver up by a null user_uuid
+        // and answered 404 for every consumer of the route.
+        //
+        // Auth::getUserFromSession() encodes this same order, but it also calls auth() and
+        // session()->has(), neither of which exists in the SQLite test harness — so the
+        // two sources are read directly here.
+        $user = optional($request)->user();
+        if (!$user instanceof User) {
+            $user = User::where('uuid', session('user'))->first();
+        }
+
+        return Driver::where('user_uuid', optional($user)->uuid)->firstOrFail();
+    }
+
+    protected function queryDrivers(Request $request)
+    {
+        return Driver::queryWithRequest(
+            $request,
+            function (&$query, $request) {
+                if ($request->has('vendor')) {
+                    $query->whereHas('vendor', function ($q) use ($request) {
+                        $q->where('public_id', $request->input('vendor'));
+                    });
+                }
+            }
+        );
+    }
+
+    protected function firstOrCreateUserDevice(array $attributes, array $values): UserDevice
+    {
+        return UserDevice::firstOrCreate($attributes, $values);
+    }
+
+    protected function driverResource(Driver $driver)
+    {
+        return new DriverResource($driver);
+    }
+
+    protected function driverResourceCollection($results)
+    {
+        return DriverResource::collection($results);
+    }
+
+    protected function deletedDriverResource(Driver $driver)
+    {
+        return new DeletedResource($driver);
+    }
+
+    protected function jsonResponse(array $payload, int $status)
+    {
+        return response()->json($payload, $status);
+    }
+
+    protected function apiError(string $message, int $status = 400)
+    {
+        return response()->apiError($message, $status);
+    }
+
     /**
      * Get the drivers current company using their user account.
      */
@@ -930,6 +1060,36 @@ class DriverController extends Controller
         return $company;
     }
 
+    /**
+     * Whether the supplied code matches the configured testing bypass code.
+     *
+     * Three conditions, all required, mirroring the console equivalent in
+     * Fleetbase\Http\Controllers\Internal\v1\AuthController::authenticateWithVerificationCode:
+     *
+     *  - a bypass code must actually be configured. The previous
+     *    `$code !== config(...)` comparison meant that on a default install --
+     *    where the config resolves to null -- omitting `code` entirely made the
+     *    check `null !== null`, i.e. false, so the guard never fired and any
+     *    caller with a valid org API credential could mint a driver token for
+     *    any driver in the install without a code at all;
+     *  - the app must not be in production, so a code left set in a deployed
+     *    .env cannot be used against a live fleet;
+     *  - the comparison is constant-time.
+     *
+     * Shared with Internal\v1\DriverController so both verify-code paths cannot
+     * drift apart.
+     */
+    public static function verificationBypassMatches(?string $identity, ?string $code): bool
+    {
+        return static::reviewAccountBypassMatches(
+            'fleetops.navigator.bypass_verification_code',
+            'fleetops.navigator.review_accounts',
+            $identity,
+            $code,
+            'navigator'
+        );
+    }
+
     /**
      * Patches phone number with international code.
      */