@fleetbase/fleetops-engine 0.6.59 → 0.6.60

package/server/src/Http/Controllers/Api/v1/NavigatorController.php

@@ -10,25 +10,21 @@ use Illuminate\Http\JsonResponse;
 class NavigatorController extends Controller
 {
     /**
-     * Retrieve the driver onboard settings.
+     * Retrieve the driver onboard settings for an organization.
      *
-     * This method retrieves the driver onboard settings for the current company session. If no company session
-     * is found in the request, an error response is returned. The method retrieves the company ID from the session,
-     * then fetches the saved driver onboard settings. If settings for the current company are found, they are returned,
-     * otherwise, default settings are provided.
-     *
-     * @return JsonResponse
-     */
-
-    /**
-     * Retrieve driver onboard settings.
+     * The organization is resolved from its public id. An unknown public id is a client
+     * error, not a server error, so it answers 404 rather than dereferencing a null company.
      *
      * @return JsonResponse
      */
     public function getDriverOnboardSettings($companyId)
     {
-        $company                = $this->findCompanyByPublicId($companyId);
-        $driverOnboardSettings  = $this->driverOnboardSetting($company->uuid);
+        $company = $this->findCompanyByPublicId($companyId);
+        if (!$company) {
+            return $this->errorResponse('Organization not found.', 404);
+        }
+
+        $driverOnboardSettings = $this->driverOnboardSetting($company->uuid);
         if (!$driverOnboardSettings) {
             $driverOnboardSettings = [];
         }
@@ -50,4 +46,9 @@ class NavigatorController extends Controller
     {
         return response()->json($payload);
     }
+
+    protected function errorResponse(string $message, int $statusCode): JsonResponse
+    {
+        return response()->error($message, $statusCode);
+    }
 }

package/server/src/Http/Controllers/Api/v1/TrackingNumberController.php

@@ -200,7 +200,16 @@ class TrackingNumberController extends Controller
             }
         }
 
-        return Utils::findModel($tables, $where);
+        // No raw-row fallback. Utils::findModel() was called with the ARRAY of table names
+        // and, when nothing matched, passed that array to DB::table() — which stringified
+        // it to the literal table name "Array" and threw SQLSTATE[42S02]. Every
+        // unresolvable code became a 500 instead of the 400 this method's caller already
+        // handles.
+        //
+        // The fallback could not have helped anyway: qrModelResource() serializes through
+        // a typed resource keyed on the model class, and a raw stdClass row has none. The
+        // mapped models above are the endpoint's whole contract.
+        return null;
     }
 
     protected function qrModelResource($model)

package/server/src/Http/Controllers/Concerns/ResolvesReviewAccountBypass.php

@@ -0,0 +1,62 @@
+<?php
+
+namespace Fleetbase\FleetOps\Http\Controllers\Concerns;
+
+use Illuminate\Support\Facades\Log;
+
+/**
+ * Accepts a fixed verification code, but only for explicitly designated accounts.
+ *
+ * App store reviewers cannot receive our SMS or email, so a fixed code has to keep
+ * working for them — including in production, which is where a review build is
+ * tested. Refusing the bypass outside production made review impossible; refusing
+ * it for everyone except named accounts keeps review working while removing the
+ * real hazard, which was that anyone holding the code could authenticate as any
+ * driver or customer.
+ */
+trait ResolvesReviewAccountBypass
+{
+    /**
+     * @param string      $codeKey     config key holding the bypass code
+     * @param string      $accountsKey config key holding the allowlisted identities
+     * @param string|null $identity    identity being authenticated, already normalised
+     * @param string|null $code        submitted verification code
+     * @param string      $channel     label for the audit log entry
+     */
+    protected static function reviewAccountBypassMatches(
+        string $codeKey,
+        string $accountsKey,
+        ?string $identity,
+        ?string $code,
+        string $channel,
+    ): bool {
+        $bypassCode = config($codeKey);
+
+        // `!== null && !== ''` rather than `!empty()`: `!empty('0')` is false, so a
+        // configured code of "0" would otherwise be silently ignored.
+        if ($bypassCode === null || $bypassCode === '' || $code === null || $code === '' || $identity === null || $identity === '') {
+            return false;
+        }
+
+        $accounts = array_map(
+            static fn ($account) => strtolower(trim((string) $account)),
+            (array) config($accountsKey, [])
+        );
+
+        if (!in_array(strtolower(trim($identity)), $accounts, true)) {
+            return false;
+        }
+
+        // Constant-time, so a wrong code cannot be recovered by timing the response.
+        if (!hash_equals((string) $bypassCode, (string) $code)) {
+            return false;
+        }
+
+        Log::warning('[Fleetbase] Verification bypass accepted for a review account.', [
+            'channel'  => $channel,
+            'identity' => $identity,
+        ]);
+
+        return true;
+    }
+}

package/server/src/Http/Controllers/Internal/v1/DriverController.php

@@ -665,7 +665,7 @@ class DriverController extends FleetOpsController
 
         // Find and verify code
         $verificationCode = static::verificationCodeExists($user, $code, $for);
-        if (!$verificationCode && $code !== config('fleetops.navigator.bypass_verification_code')) {
+        if (!$verificationCode && !ApiDriverController::verificationBypassMatches($identity, $code)) {
             return response()->error('Invalid verification code!');
         }
 

package/server/src/Http/Filter/MaintenanceScheduleFilter.php

@@ -0,0 +1,40 @@
+<?php
+
+namespace Fleetbase\FleetOps\Http\Filter;
+
+use Fleetbase\FleetOps\Support\Utils;
+use Fleetbase\Http\Filter\Filter;
+use Illuminate\Support\Str;
+
+class MaintenanceScheduleFilter extends Filter
+{
+    public function queryForInternal(): void
+    {
+        $this->builder->where('company_uuid', $this->session->get('company'));
+    }
+
+    public function queryForPublic(): void
+    {
+        $this->queryForInternal();
+    }
+
+    public function subjectType(?string $subjectType): void
+    {
+        if (!$subjectType) {
+            return;
+        }
+
+        if (!Str::contains($subjectType, ['\\', ':'])) {
+            $subjectType = 'fleet-ops:' . $subjectType;
+        }
+
+        $this->builder->where('subject_type', Utils::getMutationType($subjectType));
+    }
+
+    public function subjectUuid(?string $subjectUuid): void
+    {
+        if ($subjectUuid) {
+            $this->builder->where('subject_uuid', $subjectUuid);
+        }
+    }
+}

package/server/src/Http/Requests/CreateCustomerRequest.php

@@ -23,7 +23,15 @@ class CreateCustomerRequest extends FleetbaseRequest
     {
         return [
             'identity' => 'required|string',
-            'code'     => 'required|exists:verification_codes,code',
+            // Presence only — authorizing the code is the controller's job, and its
+            // check is strictly stronger: it matches code + for + meta->identity,
+            // whereas `exists:verification_codes,code` accepts any live code issued
+            // for any purpose to any user. The rule is also already unenforced on the
+            // proxy path, since verifyCode() with for=fleetops_create_customer calls
+            // create(CreateCustomerRequest::createFrom($request)), which never runs
+            // validateResolved(). Keeping it here only blocks the configured
+            // non-production testing bypass (fleetops.customers.verification_bypass_code).
+            'code'     => 'required|string',
             'name'     => 'required|string',
             'password' => 'required|string|min:8',
             'email'    => [

package/server/src/Http/Requests/CreateFuelReportRequest.php

@@ -19,10 +19,21 @@ class CreateFuelReportRequest extends FleetbaseRequest
      */
     public function rules(): array
     {
+        // requiredIf(POST), not required: UpdateFuelReportRequest extends this class, so a
+        // flat `required` made every partial update fail — PUT /v1/fuel-reports/{id} with
+        // just {"status": "approved"} answered "The driver field is required."
+        //
+        // `driver` is the clearest case: the update action's $request->only() list does not
+        // even include it, so validation demanded a field the endpoint then discarded.
+        // CreateFuelTransactionRequest solves the same create/update inheritance with
+        // Rule::requiredIf(isMethod('POST')); a plain conditional is used here because
+        // illuminate/validation is not autoloadable in the package's test harness.
+        $requiredOnCreate = $this->isMethod('POST') ? ['required'] : ['sometimes'];
+
         return [
-            'driver'          => ['required'],
-            'odometer'        => ['required'],
-            'volume'          => ['required'],
+            'driver'          => $requiredOnCreate,
+            'odometer'        => $requiredOnCreate,
+            'volume'          => $requiredOnCreate,
             'metric_unit'     => ['nullable'],
             'location'        => ['nullable'],
             'amount'          => ['nullable'],

package/server/src/Http/Requests/CreateFuelTransactionRequest.php

@@ -2,6 +2,7 @@
 
 namespace Fleetbase\FleetOps\Http\Requests;
 
+use Fleetbase\FleetOps\Models\FuelProviderTransaction;
 use Fleetbase\Http\Requests\FleetbaseRequest;
 use Illuminate\Validation\Rule;
 
@@ -16,7 +17,7 @@ class CreateFuelTransactionRequest extends FleetbaseRequest
     {
         return [
             'provider'                => [Rule::requiredIf($this->isMethod('POST')), 'string'],
-            'provider_transaction_id' => [Rule::requiredIf($this->isMethod('POST')), 'string'],
+            'provider_transaction_id' => [Rule::requiredIf($this->isMethod('POST')), 'string', $this->uniqueProviderTransactionIdRule()],
             'connection'              => ['nullable', 'string'],
             'fuel_report'             => ['nullable', 'string'],
             'vehicle'                 => ['nullable', 'string'],
@@ -47,4 +48,66 @@ class CreateFuelTransactionRequest extends FleetbaseRequest
             'meta'                    => ['nullable', 'array'],
         ];
     }
+
+    public function messages(): array
+    {
+        return [
+            'provider_transaction_id.unique' => 'A fuel transaction with this provider transaction id already exists for this provider.',
+        ];
+    }
+
+    /**
+     * Mirrors the fuel_provider_txn_company_provider_unique index.
+     *
+     * Provider transaction ids are natural idempotency keys, so a re-sent batch
+     * used to raise an unhandled UniqueConstraintViolationException — an HTTP 500
+     * rather than a duplicate signal the client could act on.
+     *
+     * @return \Illuminate\Validation\Rules\Unique
+     */
+    protected function uniqueProviderTransactionIdRule()
+    {
+        $provider = $this->resolveProvider();
+
+        $rule = Rule::unique('fuel_provider_transactions', 'provider_transaction_id')
+            ->where(function ($query) use ($provider) {
+                $query->where('company_uuid', session('company'));
+                $query->where('provider', $provider);
+
+                return $query->whereNull('deleted_at');
+            });
+
+        // On PUT the record re-sends its own provider_transaction_id. The v1 route
+        // parameter is a public_id (fuel_provider_transaction_xxxxx), not a uuid.
+        $id = $this->route('id');
+        if (!$this->isMethod('POST') && filled($id)) {
+            $rule->ignore($id, 'public_id');
+        }
+
+        return $rule;
+    }
+
+    /**
+     * The uniqueness scope is per provider, but `provider` is only required on
+     * POST — a PUT may change the transaction id while leaving the provider out of
+     * the body. Fall back to the stored value so the scope is never null, which
+     * would otherwise compare against the wrong set of rows.
+     */
+    protected function resolveProvider(): ?string
+    {
+        if ($this->filled('provider')) {
+            return $this->input('provider');
+        }
+
+        $id = $this->route('id');
+        if (blank($id)) {
+            return null;
+        }
+
+        return FuelProviderTransaction::where('company_uuid', session('company'))
+            ->where(function ($query) use ($id) {
+                $query->where('public_id', $id)->orWhere('uuid', $id);
+            })
+            ->value('provider');
+    }
 }

package/server/src/Http/Requests/CreatePartRequest.php

@@ -15,7 +15,7 @@ class CreatePartRequest extends FleetbaseRequest
     public function rules(): array
     {
         return [
-            'sku'              => ['nullable', 'string'],
+            'sku'              => ['nullable', 'string', $this->uniqueSkuRule()],
             'name'             => [Rule::requiredIf($this->isMethod('POST')), 'string'],
             'manufacturer'     => ['nullable', 'string'],
             'model'            => ['nullable', 'string'],
@@ -37,4 +37,42 @@ class CreatePartRequest extends FleetbaseRequest
             'meta'             => ['nullable', 'array'],
         ];
     }
+
+    public function messages(): array
+    {
+        return [
+            'sku.unique' => 'A part with this SKU already exists.',
+        ];
+    }
+
+    /**
+     * Mirrors the parts_company_uuid_active_sku_unique index.
+     *
+     * Without this rule a duplicate SKU reached the driver and came back as an
+     * unhandled UniqueConstraintViolationException — an HTTP 500 with no field
+     * attribution, since public v1 controllers have no QueryException catch.
+     *
+     * `nullable` runs first, so this never fires on a null SKU; that matches the
+     * nullable column and MySQL's tolerance of repeated NULLs in a unique index.
+     *
+     * @return \Illuminate\Validation\Rules\Unique
+     */
+    protected function uniqueSkuRule()
+    {
+        $rule = Rule::unique('parts', 'sku')
+            ->where(function ($query) {
+                $query->where('company_uuid', session('company'));
+
+                return $query->whereNull('deleted_at');
+            });
+
+        // On PUT the record re-sends its own SKU, so it must not collide with
+        // itself. The v1 route parameter is a public_id (part_xxxxx), not a uuid.
+        $id = $this->route('id');
+        if (!$this->isMethod('POST') && filled($id)) {
+            $rule->ignore($id, 'public_id');
+        }
+
+        return $rule;
+    }
 }

package/server/src/Http/Resources/v1/TrackingNumber.php

@@ -30,6 +30,17 @@ class TrackingNumber extends FleetbaseResource
             'status'          => $this->last_status,
             'status_code'     => $this->last_status_code,
             'qr_code'         => $this->qr_code,
+            // The raw text encoded inside qr_code, exposed ONLY in debug mode.
+            //
+            // qr_code is a base64 PNG generated from owner_uuid (TrackingNumber::newBarcode),
+            // and the endpoints that consume a scanned code match on that uuid. A client
+            // scans the image to obtain it; an automated contract run cannot, so debug
+            // builds publish the value beside the image rather than the API growing a
+            // decode endpoint or handing out uuids generally.
+            //
+            // `when()` omits the key entirely when false — it is absent, not null — so a
+            // production response is byte-identical to before.
+            'qr_code_content' => $this->when(static::exposesQrCodeContent(), fn () => $this->owner_uuid),
             'barcode'         => $this->barcode,
             'url'             => Utils::consoleUrl('track-order', ['order' => $this->tracking_number]),
             'type'            => Utils::getTypeFromClassName($this->owner_type),
@@ -38,6 +49,28 @@ class TrackingNumber extends FleetbaseResource
         ];
     }
 
+    /**
+     * Whether the QR code's decoded content may be published.
+     *
+     * Debug mode only, and fails closed: any failure to determine the debug state — no
+     * container, an application without the accessor — answers false rather than
+     * defaulting to exposure.
+     */
+    protected static function exposesQrCodeContent(): bool
+    {
+        try {
+            $app = app();
+
+            if (!is_object($app) || !method_exists($app, 'hasDebugModeEnabled')) {
+                return false;
+            }
+
+            return (bool) $app->hasDebugModeEnabled();
+        } catch (\Throwable $e) {
+            return false;
+        }
+    }
+
     /**
      * Transform the resource into an webhook payload.
      *

package/server/src/Models/FuelReport.php

@@ -6,6 +6,7 @@ use Fleetbase\Casts\Json;
 use Fleetbase\FleetOps\Casts\Point;
 use Fleetbase\FleetOps\Support\Utils;
 use Fleetbase\LaravelMysqlSpatial\Eloquent\SpatialTrait;
+use Fleetbase\LaravelMysqlSpatial\Types\Point as SpatialPoint;
 use Fleetbase\Models\Model;
 use Fleetbase\Models\User;
 use Fleetbase\Traits\HasApiModelBehavior;
@@ -149,6 +150,26 @@ class FuelReport extends Model
         return $this->belongsTo(User::class, 'reported_by_uuid');
     }
 
+    /**
+     * Bootstrap the model.
+     *
+     * `location` is declared nullable in CreateFuelReportRequest but the column is
+     * POINT NOT NULL, so a report created without one failed outright with
+     * SQLSTATE[HY000] 1364 "Field 'location' doesn't have a default value" — a 500 for
+     * a request the validator had just accepted. Mirrors Device and Sensor, which
+     * default their spatial columns the same way.
+     */
+    protected static function boot()
+    {
+        parent::boot();
+
+        static::creating(function (self $fuelReport) {
+            if (empty($fuelReport->location)) {
+                $fuelReport->location = new SpatialPoint(0, 0);
+            }
+        });
+    }
+
     /**
      * Get the driver's name assigned to vehicle.
      *

package/server/src/Models/Sensor.php

@@ -147,6 +147,30 @@ class Sensor extends Model
      */
     protected $spatialFields = ['last_position'];
 
+    /**
+     * Bootstrap the model.
+     *
+     * The same migration that made devices.last_position NOT NULL did it to
+     * sensors.last_position too, but only Device got a default. Creating a sensor
+     * without a position therefore failed outright:
+     *
+     *   SQLSTATE[HY000]: General error: 1364 Field 'last_position' doesn't have a
+     *   default value
+     *
+     * Position is not something a caller has when registering a sensor, so default
+     * it to POINT(0,0) on create, exactly as Device does.
+     */
+    protected static function boot()
+    {
+        parent::boot();
+
+        static::creating(function (self $sensor) {
+            if (empty($sensor->last_position)) {
+                $sensor->last_position = new SpatialPoint(0, 0);
+            }
+        });
+    }
+
     /**
      * The attributes that should be cast to native types.
      *

package/server/src/Support/FuelProviders/FuelProviderService.php

@@ -173,8 +173,17 @@ class FuelProviderService
         return DB::transaction(function () use ($connection, $payload) {
             $provider              = $payload['provider'] ?? $connection->provider;
             $providerTransactionId = $payload['provider_transaction_id'];
+            // The match must include company_uuid. Provider transaction ids are only
+            // unique within the account they were issued for, so keying on
+            // (provider, provider_transaction_id) alone let one company's sync find
+            // and overwrite another company's transaction — reassigning its
+            // company_uuid. Mirrors fuel_provider_txn_company_provider_unique.
             $transaction           = FuelProviderTransaction::updateOrCreate(
-                ['provider' => $provider, 'provider_transaction_id' => $providerTransactionId],
+                [
+                    'company_uuid'            => $connection->company_uuid,
+                    'provider'                => $provider,
+                    'provider_transaction_id' => $providerTransactionId,
+                ],
                 array_merge($payload, [
                     'company_uuid'                  => $connection->company_uuid,
                     'fuel_provider_connection_uuid' => $connection->uuid,

package/server/src/routes.php

@@ -237,7 +237,7 @@ Route::prefix(config('fleetops.api.routing.prefix'))->namespace('Fleetbase\Fleet
                 $router->get('events', 'GeofenceController@events');
                 $router->get('inventory', 'GeofenceController@inventory');
                 $router->get('dwell-report', 'GeofenceController@dwellReport');
-                $router->get('driver/{driverUuid}/history', 'GeofenceController@driverHistory');
+                $router->get('driver/{driverId}/history', 'GeofenceController@driverHistory');
             });
             // service-rates routes
             $router->group(['prefix' => 'service-rates'], function () use ($router) {