@fleetbase/fleetops-engine 0.6.58 → 0.6.60

package/server/src/Http/Controllers/Api/v1/FuelTransactionController.php

@@ -33,9 +33,9 @@ class FuelTransactionController extends Controller
         $input                 = $this->input($request);
         $input['company_uuid'] = session('company');
 
-        $transaction = FuelProviderTransaction::create($input)->load(['connection', 'vehicle', 'driver', 'order', 'fuelReport']);
+        $transaction = $this->createTransaction($input)->load(['connection', 'vehicle', 'driver', 'order', 'fuelReport']);
 
-        return new FuelTransactionResource($transaction);
+        return $this->fuelTransactionResource($transaction);
     }
 
     public function update(string $id, UpdateFuelTransactionRequest $request)
@@ -50,18 +50,18 @@ class FuelTransactionController extends Controller
 
         $transaction->update($this->input($request));
 
-        return new FuelTransactionResource($transaction->refresh()->load(['connection', 'vehicle', 'driver', 'order', 'fuelReport']));
+        return $this->fuelTransactionResource($transaction->refresh()->load(['connection', 'vehicle', 'driver', 'order', 'fuelReport']));
     }
 
     public function query(Request $request)
     {
         $this->rejectUuidIdentifiers($request);
 
-        $results = FuelProviderTransaction::queryWithRequest($request, function (&$query) {
+        $results = $this->queryTransactionsWithRequest($request, function (&$query) {
             $query->with(['connection', 'vehicle', 'driver', 'order', 'fuelReport']);
         });
 
-        return FuelTransactionResource::collection($results);
+        return $this->fuelTransactionResourceCollection($results);
     }
 
     public function find(string $id)
@@ -72,7 +72,7 @@ class FuelTransactionController extends Controller
             return response()->json(['error' => 'FuelTransaction resource not found.'], 404);
         }
 
-        return new FuelTransactionResource($transaction);
+        return $this->fuelTransactionResource($transaction);
     }
 
     public function delete(string $id)
@@ -85,7 +85,7 @@ class FuelTransactionController extends Controller
 
         $transaction->delete();
 
-        return new DeletedResource($transaction);
+        return $this->deletedFuelTransactionResource($transaction);
     }
 
     public function matchVehicle(Request $request, string $id): JsonResponse
@@ -98,7 +98,7 @@ class FuelTransactionController extends Controller
 
         return response()->json([
             'status'      => 'ok',
-            'transaction' => new FuelTransactionResource($this->fuelProviderService->matchVehicle($transaction, $vehicle)),
+            'transaction' => $this->fuelTransactionResource($this->fuelProviderService->matchVehicle($transaction, $vehicle)),
         ]);
     }
 
@@ -112,7 +112,7 @@ class FuelTransactionController extends Controller
 
         return response()->json([
             'status'      => 'ok',
-            'transaction' => new FuelTransactionResource($this->fuelProviderService->matchOrder($transaction, $order)),
+            'transaction' => $this->fuelTransactionResource($this->fuelProviderService->matchOrder($transaction, $order)),
         ]);
     }
 
@@ -122,7 +122,7 @@ class FuelTransactionController extends Controller
 
         return response()->json([
             'status'      => 'ok',
-            'transaction' => new FuelTransactionResource($this->fuelProviderService->reprocessTransaction($transaction)),
+            'transaction' => $this->fuelTransactionResource($this->fuelProviderService->reprocessTransaction($transaction)),
         ]);
     }
 
@@ -135,15 +135,40 @@ class FuelTransactionController extends Controller
 
         return response()->json([
             'status'      => 'ok',
-            'transaction' => new FuelTransactionResource($this->fuelProviderService->reviewTransaction($transaction, $request->input('status'))),
+            'transaction' => $this->fuelTransactionResource($this->fuelProviderService->reviewTransaction($transaction, $request->input('status'))),
         ]);
     }
 
+    protected function createTransaction(array $input): FuelProviderTransaction
+    {
+        return FuelProviderTransaction::create($input);
+    }
+
+    protected function queryTransactionsWithRequest(Request $request, callable $callback)
+    {
+        return FuelProviderTransaction::queryWithRequest($request, $callback);
+    }
+
     protected function findTransaction(string $id): FuelProviderTransaction
     {
         return $this->resolveModel(FuelProviderTransaction::class, $id);
     }
 
+    protected function fuelTransactionResource(FuelProviderTransaction $transaction)
+    {
+        return new FuelTransactionResource($transaction);
+    }
+
+    protected function fuelTransactionResourceCollection($transactions)
+    {
+        return FuelTransactionResource::collection($transactions);
+    }
+
+    protected function deletedFuelTransactionResource(FuelProviderTransaction $transaction)
+    {
+        return new DeletedResource($transaction);
+    }
+
     protected function input(Request $request): array
     {
         $input = $request->only([

package/server/src/Http/Controllers/Api/v1/GeofenceController.php

@@ -3,6 +3,8 @@
 namespace Fleetbase\FleetOps\Http\Controllers\Api\v1;
 
 use Fleetbase\FleetOps\Models\GeofenceEventLog;
+use Fleetbase\FleetOps\Support\Utils;
+use Fleetbase\FleetOps\Models\Driver;
 use Fleetbase\Http\Controllers\Controller;
 use Illuminate\Http\JsonResponse;
 use Illuminate\Http\Request;
@@ -35,7 +37,7 @@ class GeofenceController extends Controller
     {
         $companyUuid = session('company');
 
-        $query = GeofenceEventLog::where('company_uuid', $companyUuid)
+        $query = $this->geofenceEventLogQuery($companyUuid)
             ->with(['driver.vehicle', 'vehicle', 'order'])
             ->orderBy('occurred_at', 'desc');
 
@@ -85,8 +87,10 @@ class GeofenceController extends Controller
     {
         $companyUuid = session('company');
 
-        $driverStates = DB::table('driver_geofence_states as dgs')
+        $driverStates = $this->table('driver_geofence_states as dgs')
             ->join('drivers as d', 'd.uuid', '=', 'dgs.driver_uuid')
+            // A driver's name lives on the related user record, not the drivers table.
+            ->leftJoin('users as u', 'u.uuid', '=', 'd.user_uuid')
             ->leftJoin('zones as z', function ($join) {
                 $join->on('z.uuid', '=', 'dgs.geofence_uuid')
                      ->where('dgs.geofence_type', '=', 'zone');
@@ -99,21 +103,21 @@ class GeofenceController extends Controller
             ->where('dgs.is_inside', true)
             ->whereNull('d.deleted_at')
             ->select([
-                DB::raw("'driver' as subject_type"),
+                $this->raw("'driver' as subject_type"),
                 'd.public_id as subject_id',
                 'd.uuid as subject_uuid',
-                'd.name as subject_name',
+                'u.name as subject_name',
                 'dgs.driver_uuid',
-                'd.name as driver_name',
+                'u.name as driver_name',
                 'dgs.entered_at',
                 'dgs.geofence_uuid',
-                DB::raw('COALESCE(z.name, sa.name) as geofence_name'),
+                $this->raw('COALESCE(z.name, sa.name) as geofence_name'),
                 'dgs.geofence_type',
-                DB::raw('TIMESTAMPDIFF(MINUTE, dgs.entered_at, NOW()) as minutes_inside'),
+                $this->raw(Utils::sqlMinutesDiff('dgs.entered_at', Utils::sqlNow()) . ' as minutes_inside'),
             ])
             ->get();
 
-        $vehicleStates = DB::table('vehicle_geofence_states as vgs')
+        $vehicleStates = $this->table('vehicle_geofence_states as vgs')
             ->join('vehicles as v', 'v.uuid', '=', 'vgs.vehicle_uuid')
             ->leftJoin('zones as z', function ($join) {
                 $join->on('z.uuid', '=', 'vgs.geofence_uuid')
@@ -127,17 +131,17 @@ class GeofenceController extends Controller
             ->where('vgs.is_inside', true)
             ->whereNull('v.deleted_at')
             ->select([
-                DB::raw("'vehicle' as subject_type"),
+                $this->raw("'vehicle' as subject_type"),
                 'v.public_id as subject_id',
                 'v.uuid as subject_uuid',
-                DB::raw('COALESCE(v.name, v.plate_number, v.public_id) as subject_name'),
-                DB::raw('NULL as driver_uuid'),
-                DB::raw('NULL as driver_name'),
+                $this->raw('COALESCE(v.name, v.plate_number, v.public_id) as subject_name'),
+                $this->raw('NULL as driver_uuid'),
+                $this->raw('NULL as driver_name'),
                 'vgs.entered_at',
                 'vgs.geofence_uuid',
-                DB::raw('COALESCE(z.name, sa.name) as geofence_name'),
+                $this->raw('COALESCE(z.name, sa.name) as geofence_name'),
                 'vgs.geofence_type',
-                DB::raw('TIMESTAMPDIFF(MINUTE, vgs.entered_at, NOW()) as minutes_inside'),
+                $this->raw(Utils::sqlMinutesDiff('vgs.entered_at', Utils::sqlNow()) . ' as minutes_inside'),
             ])
             ->get();
 
@@ -163,7 +167,7 @@ class GeofenceController extends Controller
     {
         $companyUuid = session('company');
 
-        $query = GeofenceEventLog::where('company_uuid', $companyUuid)
+        $query = $this->geofenceEventLogQuery($companyUuid)
             ->where('event_type', 'exited')
             ->whereNotNull('dwell_duration_minutes');
 
@@ -181,11 +185,11 @@ class GeofenceController extends Controller
                 'geofence_uuid',
                 'geofence_name',
                 'geofence_type',
-                DB::raw('COUNT(*) as visit_count'),
-                DB::raw('ROUND(AVG(dwell_duration_minutes), 1) as avg_dwell_minutes'),
-                DB::raw('MAX(dwell_duration_minutes) as max_dwell_minutes'),
-                DB::raw('MIN(dwell_duration_minutes) as min_dwell_minutes'),
-                DB::raw('SUM(dwell_duration_minutes) as total_dwell_minutes'),
+                $this->raw('COUNT(*) as visit_count'),
+                $this->raw('ROUND(AVG(dwell_duration_minutes), 1) as avg_dwell_minutes'),
+                $this->raw('MAX(dwell_duration_minutes) as max_dwell_minutes'),
+                $this->raw('MIN(dwell_duration_minutes) as min_dwell_minutes'),
+                $this->raw('SUM(dwell_duration_minutes) as total_dwell_minutes'),
             ])
             ->orderBy('visit_count', 'desc')
             ->get();
@@ -198,13 +202,22 @@ class GeofenceController extends Controller
      *
      * Returns the geofence event history for a specific driver.
      */
-    public function driverHistory(Request $request, string $driverUuid): JsonResponse
+    public function driverHistory(Request $request, string $driverId): JsonResponse
     {
         $companyUuid = session('company');
         $perPage     = min((int) $request->input('per_page', 50), 200);
 
-        $events = GeofenceEventLog::where('company_uuid', $companyUuid)
-            ->where('driver_uuid', $driverUuid)
+        // Addressed by public_id, like every other public endpoint. The route parameter
+        // was named driverUuid and matched against driver_uuid directly, so this was the
+        // one place in the public API asking a caller for an internal identifier — which
+        // the API does not hand out in the first place, making it unusable.
+        $driver = $this->findDriverForHistory($driverId);
+        if (!$driver) {
+            return response()->json(['error' => 'Driver resource not found.'], 404);
+        }
+
+        $events = $this->geofenceEventLogQuery($companyUuid)
+            ->where('driver_uuid', $driver->uuid)
             ->with(['driver.vehicle', 'vehicle', 'order'])
             ->orderBy('occurred_at', 'desc')
             ->paginate($perPage);
@@ -214,6 +227,28 @@ class GeofenceController extends Controller
         return response()->json($events);
     }
 
+    /**
+     * Resolve the driver a history request addresses.
+     *
+     * Public callers use the public_id, like every other v1 endpoint. The console reaches
+     * the same method through the internal route with a uuid, so that is accepted there
+     * and ONLY there — the public contract stays public_id-only rather than quietly
+     * taking either.
+     *
+     * A seam, like geofenceEventLogQuery above, so the contract tests can drive this
+     * without a database.
+     */
+    protected function findDriverForHistory(string $driverId): ?Driver
+    {
+        $driver = Driver::where('public_id', $driverId)->first();
+
+        if (!$driver && \Fleetbase\Support\Http::isInternalRequest()) {
+            $driver = Driver::where('uuid', $driverId)->first();
+        }
+
+        return $driver;
+    }
+
     protected function serializeEvent(GeofenceEventLog $event): array
     {
         $driver      = $event->driver;
@@ -260,4 +295,19 @@ class GeofenceController extends Controller
             ] : null,
         ];
     }
+
+    protected function geofenceEventLogQuery(?string $companyUuid): mixed
+    {
+        return GeofenceEventLog::where('company_uuid', $companyUuid);
+    }
+
+    protected function table(string $table): mixed
+    {
+        return DB::table($table);
+    }
+
+    protected function raw(string $expression): mixed
+    {
+        return DB::raw($expression);
+    }
 }

package/server/src/Http/Controllers/Api/v1/IssueController.php

@@ -36,9 +36,9 @@ class IssueController extends Controller
 
         // Find driver who is reporting
         try {
-            $driver = Driver::findRecordOrFail($request->input('driver'));
+            $driver = $this->findDriverRecord($request->input('driver'));
         } catch (\Illuminate\Database\Eloquent\ModelNotFoundException $exception) {
-            return response()->json(
+            return $this->jsonResponse(
                 [
                     'error' => 'Driver reporting issue not found.',
                 ],
@@ -53,10 +53,10 @@ class IssueController extends Controller
         $input['vehicle_uuid']      = $driver->vehicle_uuid;
 
         // create the issue
-        $issue = Issue::create($input);
+        $issue = $this->createIssue($input);
 
         // response the driver resource
-        return new IssueResource($issue);
+        return $this->issueResource($issue);
     }
 
     /**
@@ -71,9 +71,9 @@ class IssueController extends Controller
     {
         // find for the issue
         try {
-            $issue = Issue::findRecordOrFail($id);
+            $issue = $this->findIssueRecord($id);
         } catch (\Illuminate\Database\Eloquent\ModelNotFoundException $exception) {
-            return response()->json(
+            return $this->jsonResponse(
                 [
                     'error' => 'Issue resource not found.',
                 ],
@@ -94,7 +94,7 @@ class IssueController extends Controller
         $issue->update($input);
 
         // response the issue resource
-        return new IssueResource($issue);
+        return $this->issueResource($issue);
     }
 
     /**
@@ -104,9 +104,9 @@ class IssueController extends Controller
      */
     public function query(Request $request)
     {
-        $results = Issue::queryWithRequest($request);
+        $results = $this->queryIssues($request);
 
-        return IssueResource::collection($results);
+        return $this->issueResourceCollection($results);
     }
 
     /**
@@ -118,9 +118,9 @@ class IssueController extends Controller
     {
         // find for the issue
         try {
-            $issue = Issue::findRecordOrFail($id);
+            $issue = $this->findIssueRecord($id);
         } catch (\Illuminate\Database\Eloquent\ModelNotFoundException $exception) {
-            return response()->json(
+            return $this->jsonResponse(
                 [
                     'error' => 'Issue resource not found.',
                 ],
@@ -129,7 +129,7 @@ class IssueController extends Controller
         }
 
         // response the issue resource
-        return new IssueResource($issue);
+        return $this->issueResource($issue);
     }
 
     /**
@@ -141,9 +141,9 @@ class IssueController extends Controller
     {
         // find for the driver
         try {
-            $issue = Issue::findRecordOrFail($id);
+            $issue = $this->findIssueRecord($id);
         } catch (\Illuminate\Database\Eloquent\ModelNotFoundException $exception) {
-            return response()->json(
+            return $this->jsonResponse(
                 [
                     'error' => 'Issue resource not found.',
                 ],
@@ -155,6 +155,46 @@ class IssueController extends Controller
         $issue->delete();
 
         // response the issue resource
+        return $this->deletedIssueResource($issue);
+    }
+
+    protected function findDriverRecord(string $id): Driver
+    {
+        return Driver::findRecordOrFail($id);
+    }
+
+    protected function createIssue(array $input): Issue
+    {
+        return Issue::create($input);
+    }
+
+    protected function findIssueRecord(string $id): Issue
+    {
+        return Issue::findRecordOrFail($id);
+    }
+
+    protected function queryIssues(Request $request)
+    {
+        return Issue::queryWithRequest($request);
+    }
+
+    protected function issueResource(Issue $issue)
+    {
+        return new IssueResource($issue);
+    }
+
+    protected function issueResourceCollection($results)
+    {
+        return IssueResource::collection($results);
+    }
+
+    protected function deletedIssueResource(Issue $issue)
+    {
         return new DeletedIssue($issue);
     }
+
+    protected function jsonResponse(array $payload, int $status)
+    {
+        return response()->json($payload, $status);
+    }
 }

package/server/src/Http/Controllers/Api/v1/LabelController.php

@@ -19,45 +19,84 @@ class LabelController extends Controller
     {
         $format  = $request->input('format', 'stream');
         $type    = $request->input('type', strtok($publicId, '_'));
-        $subject = null;
-
-        switch ($type) {
-            case 'order':
-                $subject = Order::where('public_id', $publicId)->orWhere('uuid', $publicId)->withoutGlobalScopes()->first();
-                break;
-
-            case 'waypoint':
-                $subject = Waypoint::where('public_id', $publicId)->orWhere('uuid', $publicId)->withoutGlobalScopes()->first();
-                break;
-
-            case 'entity':
-                $subject = Entity::where('public_id', $publicId)->orWhere('uuid', $publicId)->withoutGlobalScopes()->first();
-                break;
-        }
+        $subject = $this->findLabelSubject($type, $publicId);
 
         if (!$subject) {
-            return response()->apiError('Unable to render label.');
+            return $this->apiError('Unable to render label.');
         }
 
         switch ($format) {
             case 'pdf':
             case 'stream':
             default:
-                $stream = $subject->pdfLabelStream();
-
-                return $stream;
+                return $subject->pdfLabelStream();
 
             case 'text':
                 $text = $subject->pdfLabel()->output();
 
-                return response()->make($text);
+                return $this->makeResponse($text);
 
             case 'base64':
                 $base64 = base64_encode($subject->pdfLabel()->output());
 
-                return response()->json(['data' => mb_convert_encoding($base64, 'UTF-8', 'UTF-8')]);
+                return $this->jsonResponse(['data' => mb_convert_encoding($base64, 'UTF-8', 'UTF-8')]);
+        }
+
+        return $this->apiError('Unable to render label.');
+    }
+
+    protected function findLabelSubject(?string $type, string $publicId): mixed
+    {
+        switch ($type) {
+            case 'order':
+                return $this->findLabelSubjectFor(Order::class, $publicId);
+
+            case 'waypoint':
+                return $this->findLabelSubjectFor(Waypoint::class, $publicId);
+
+            case 'entity':
+                return $this->findLabelSubjectFor(Entity::class, $publicId);
+        }
+
+        return null;
+    }
+
+    /**
+     * Resolves a label subject by public id or uuid, constrained to the current company.
+     *
+     * The identifier match is grouped so the company constraint applies to both arms —
+     * without the closure it would read as `public_id = ? OR (uuid = ? AND company_uuid = ?)`
+     * and leak labels across organizations.
+     */
+    protected function findLabelSubjectFor(string $model, string $publicId): mixed
+    {
+        $companyUuid = $this->sessionCompany();
+        if (!$companyUuid) {
+            return null;
         }
 
-        return response()->apiError('Unable to render label.');
+        return $model::where(function ($query) use ($publicId) {
+            $query->where('public_id', $publicId)->orWhere('uuid', $publicId);
+        })->where('company_uuid', $companyUuid)->withoutGlobalScopes()->first();
+    }
+
+    protected function sessionCompany(): ?string
+    {
+        return session('company');
+    }
+
+    protected function apiError(string $message)
+    {
+        return response()->apiError($message);
+    }
+
+    protected function makeResponse(string $text)
+    {
+        return response()->make($text);
+    }
+
+    protected function jsonResponse(array $payload)
+    {
+        return response()->json($payload);
     }
 }

package/server/src/Http/Controllers/Api/v1/NavigatorController.php

@@ -5,33 +5,50 @@ namespace Fleetbase\FleetOps\Http\Controllers\Api\v1;
 use Fleetbase\Http\Controllers\Controller;
 use Fleetbase\Models\Company;
 use Fleetbase\Models\Setting;
+use Illuminate\Http\JsonResponse;
 
 class NavigatorController extends Controller
 {
     /**
-     * Retrieve the driver onboard settings.
+     * Retrieve the driver onboard settings for an organization.
      *
-     * This method retrieves the driver onboard settings for the current company session. If no company session
-     * is found in the request, an error response is returned. The method retrieves the company ID from the session,
-     * then fetches the saved driver onboard settings. If settings for the current company are found, they are returned,
-     * otherwise, default settings are provided.
+     * The organization is resolved from its public id. An unknown public id is a client
+     * error, not a server error, so it answers 404 rather than dereferencing a null company.
      *
-     * @return \Illuminate\Http\JsonResponse
-     */
-
-    /**
-     * Retrieve driver onboard settings.
-     *
-     * @return \Illuminate\Http\JsonResponse
+     * @return JsonResponse
      */
     public function getDriverOnboardSettings($companyId)
     {
-        $company                = Company::select()->where('public_id', $companyId)->first();
-        $driverOnboardSettings  = Setting::where('key', 'fleet-ops.driver-onboard-settings.' . $company->uuid)->value('value');
+        $company = $this->findCompanyByPublicId($companyId);
+        if (!$company) {
+            return $this->errorResponse('Organization not found.', 404);
+        }
+
+        $driverOnboardSettings = $this->driverOnboardSetting($company->uuid);
         if (!$driverOnboardSettings) {
             $driverOnboardSettings = [];
         }
 
-        return response()->json(['driverOnboardSettings' => $driverOnboardSettings]);
+        return $this->jsonResponse(['driverOnboardSettings' => $driverOnboardSettings]);
+    }
+
+    protected function findCompanyByPublicId(string $companyId): ?Company
+    {
+        return Company::select()->where('public_id', $companyId)->first();
+    }
+
+    protected function driverOnboardSetting(string $companyUuid): mixed
+    {
+        return Setting::where('key', 'fleet-ops.driver-onboard-settings.' . $companyUuid)->value('value');
+    }
+
+    protected function jsonResponse(array $payload): JsonResponse
+    {
+        return response()->json($payload);
+    }
+
+    protected function errorResponse(string $message, int $statusCode): JsonResponse
+    {
+        return response()->error($message, $statusCode);
     }
 }

package/server/src/Http/Controllers/Api/v1/OrderConfigController.php

@@ -26,9 +26,9 @@ class OrderConfigController extends Controller
      */
     public function query(Request $request)
     {
-        $results = OrderConfig::queryWithRequest($request);
+        $results = $this->queryOrderConfigs($request);
 
-        return OrderConfigResource::collection($results);
+        return $this->orderConfigCollection($results);
     }
 
     /**
@@ -40,15 +40,45 @@ class OrderConfigController extends Controller
      */
     public function find(string $id)
     {
-        $orderConfig = OrderConfig::resolveFromIdentifier($id);
+        $orderConfig = $this->resolveOrderConfig($id);
         if (!$orderConfig) {
             try {
-                $orderConfig = OrderConfig::findRecordOrFail($id);
+                $orderConfig = $this->findOrderConfigOrFail($id);
             } catch (ModelNotFoundException $e) {
-                return response()->apiError('Order config not found.', 404);
+                return $this->apiError('Order config not found.', 404);
             }
         }
 
+        return $this->orderConfigResource($orderConfig);
+    }
+
+    protected function queryOrderConfigs(Request $request)
+    {
+        return OrderConfig::queryWithRequest($request);
+    }
+
+    protected function resolveOrderConfig(string $id): ?OrderConfig
+    {
+        return OrderConfig::resolveFromIdentifier($id);
+    }
+
+    protected function findOrderConfigOrFail(string $id): OrderConfig
+    {
+        return OrderConfig::findRecordOrFail($id);
+    }
+
+    protected function orderConfigCollection($results)
+    {
+        return OrderConfigResource::collection($results);
+    }
+
+    protected function orderConfigResource(OrderConfig $orderConfig)
+    {
         return new OrderConfigResource($orderConfig);
     }
+
+    protected function apiError(string $message, int $status)
+    {
+        return response()->apiError($message, $status);
+    }
 }