@fleetbase/fleetops-engine 0.6.59 → 0.6.60

package/server/tests/Feature/Http/Internal/DriverControllerContractsTest.php

@@ -307,6 +307,11 @@ class FleetOpsInternalDriverAuthControllerProbe extends DriverController
 
     public static function resetProbe(): void
     {
+        // verifyCode() defers to DriverController::verificationBypassMatches(), which
+        // asks app()->environment('production'). The bare container this harness binds
+        // has no such method, so swap it before any verify-code test runs.
+        fleetopsInternalDriverAuthContainer();
+
         static::$loginUser          = null;
         static::$verificationUser   = null;
         static::$loginDriver        = null;
@@ -531,6 +536,53 @@ function fleetopsInternalDriverExportSelections(DriverExport $export): array
     return $property->getValue($export);
 }
 
+/**
+ * Swap in a container that answers environment().
+ *
+ * Mirrors fleetopsCustomerHelperContainer() in CustomerControllerHelperSeamsTest and
+ * fleetopsDriverAuthContainer() in Api/DriverControllerAuthFlowsTest. Idempotent, so
+ * resetProbe() can call it per test.
+ */
+function fleetopsInternalDriverAuthContainer(): void
+{
+    $current = Illuminate\Container\Container::getInstance();
+    if (method_exists($current, 'hasDebugModeEnabled')) {
+        return;
+    }
+
+    $replacement = new class extends Illuminate\Container\Container {
+        public function environment(...$environments)
+        {
+            if (empty($environments)) {
+                return 'testing';
+            }
+
+            $checks = is_array($environments[0]) ? $environments[0] : $environments;
+
+            return in_array('testing', $checks, true);
+        }
+
+        public function hasDebugModeEnabled()
+        {
+            return true;
+        }
+    };
+
+    foreach (['bindings', 'instances', 'aliases', 'abstractAliases', 'resolved', 'extenders', 'tags', 'contextual', 'scopedInstances', 'reboundCallbacks', 'globalBeforeResolvingCallbacks', 'globalResolvingCallbacks', 'globalAfterResolvingCallbacks', 'beforeResolvingCallbacks', 'resolvingCallbacks', 'afterResolvingCallbacks'] as $property) {
+        if (!property_exists(Illuminate\Container\Container::class, $property)) {
+            continue;
+        }
+        $reflection = new ReflectionProperty(Illuminate\Container\Container::class, $property);
+        $reflection->setAccessible(true);
+        if ($reflection->isInitialized($current)) {
+            $reflection->setValue($replacement, $reflection->getValue($current));
+        }
+    }
+
+    Illuminate\Container\Container::setInstance($replacement);
+    Illuminate\Support\Facades\Facade::setFacadeApplication($replacement);
+}
+
 function fleetopsInternalDriverUseHelperDatabase(): SQLiteConnection
 {
     $connection = new SQLiteConnection(new PDO('sqlite::memory:'));
@@ -993,6 +1045,9 @@ test('internal driver controller login with phone normalizes identity and handle
 
 test('internal driver controller verify code covers missing user invalid code and missing driver branches', function () {
     app('config')->set('fleetops.navigator.bypass_verification_code', '000000');
+    // The bypass is only honoured for a listed identity. Both forms because
+    // verifyCode normalises a non-email identity through static::phone().
+    app('config')->set('fleetops.navigator.review_accounts', ['15551234567', '+15551234567', 'driver@example.test']);
 
     FleetOpsInternalDriverAuthControllerProbe::resetProbe();
     $controller = new FleetOpsInternalDriverAuthControllerProbe();
@@ -1035,6 +1090,9 @@ test('internal driver controller verify code covers missing user invalid code an
 
 test('internal driver controller verify code returns driver resource and handles token errors', function () {
     app('config')->set('fleetops.navigator.bypass_verification_code', '000000');
+    // The bypass is only honoured for a listed identity. Both forms because
+    // verifyCode normalises a non-email identity through static::phone().
+    app('config')->set('fleetops.navigator.review_accounts', ['15551234567', '+15551234567', 'driver@example.test']);
 
     FleetOpsInternalDriverAuthControllerProbe::resetProbe();
     FleetOpsInternalDriverAuthControllerProbe::$verificationUser   = fleetopsInternalDriverAuthUser();

package/server/tests/FuelProviderTransactionControllerContractsTest.php

@@ -178,4 +178,21 @@ test('fuel provider transaction real lookup scopes identifier and company', func
 
     expect($reflection->invoke($controller, 'fpt-real-1')->public_id)->toBe('fuel_provider_transaction_real1')
         ->and($reflection->invoke($controller, 'fuel_provider_transaction_real1')->uuid)->toBe('fpt-real-1');
+
+    // resolveProvider() falls back to the stored provider when a PUT omits it, so the
+    // uniqueness scope is never null — a null scope would compare the transaction id
+    // against the wrong set of rows. Needs a real connection, which is why this lives
+    // here rather than in RequestContractsTest.
+    $resolveProvider = new ReflectionMethod(Fleetbase\FleetOps\Http\Requests\CreateFuelTransactionRequest::class, 'resolveProvider');
+    $resolveProvider->setAccessible(true);
+
+    $withRouteId = Fleetbase\FleetOps\Http\Requests\CreateFuelTransactionRequest::create('/fleetops-test', 'PUT')
+        ->setRouteResolver(fn () => new class {
+            public function parameter($key, $default = null)
+            {
+                return $key === 'id' ? 'fuel_provider_transaction_real1' : $default;
+            }
+        });
+
+    expect($resolveProvider->invoke($withRouteId))->toBe('petroapp');
 });

package/server/tests/RequestContractsTest.php

@@ -76,6 +76,18 @@ namespace Illuminate\Validation {
                 return $this;
             }
 
+            /**
+             * Recorded so tests can assert the ignore-self clause on update
+             * requests, including which column it matches on — the v1 routes
+             * pass a public_id, not a uuid.
+             */
+            public function ignore($id, $idColumn = null): self
+            {
+                $this->constraints[] = ['ignore', $id, $idColumn];
+
+                return $this;
+            }
+
             public function __toString(): string
             {
                 return $this->rule;
@@ -245,11 +257,16 @@ namespace {
     });
 
     test('fuel transaction request requires provider identifiers on create', function () {
+        // The harness `session()` stand-in is a process-wide static, so seed it
+        // here rather than relying on an earlier test in the file having done so.
+        session(['company' => 'company-uuid']);
+        bindFleetOpsRequestSession(['api_credential' => 'credential-uuid', 'company' => 'company-uuid']);
+
         $createRules = requestRules(CreateFuelTransactionRequest::class);
         $patchRules  = requestRules(CreateFuelTransactionRequest::class, 'PATCH');
 
         expect(ruleStrings($createRules['provider']))->toContain('required', 'string')
-            ->and(ruleStrings($createRules['provider_transaction_id']))->toContain('required', 'string')
+            ->and(ruleStrings($createRules['provider_transaction_id']))->toContain('required', 'string', 'unique:fuel_provider_transactions,provider_transaction_id')
             ->and(ruleStrings($patchRules['provider']))->not->toContain('required')
             ->and(ruleStrings($patchRules['provider_transaction_id']))->not->toContain('required')
             ->and($createRules['station_latitude'])->toBe(['nullable', 'numeric'])
@@ -257,6 +274,19 @@ namespace {
             ->and($createRules['normalized_payload'])->toBe(['nullable', 'array'])
             ->and($createRules['raw_payload'])->toBe(['nullable', 'array'])
             ->and($createRules['meta'])->toBe(['nullable', 'array']);
+
+        // Mirrors fuel_provider_txn_company_provider_unique. The provider is part
+        // of the scope, and company_uuid is what stops one tenant's provider
+        // transaction id from colliding with another's — the old index was global.
+        $rulesWithProvider = CreateFuelTransactionRequest::create('/fleetops-test', 'POST', ['provider' => 'petroapp'])->rules();
+        $uniqueRule        = collect($rulesWithProvider['provider_transaction_id'])->first(fn ($rule) => $rule instanceof Illuminate\Validation\Rule);
+
+        expect($uniqueRule)->not->toBeNull()
+            ->and($uniqueRule->constraints)->toBe([
+                ['where', 'company_uuid', 'company-uuid'],
+                ['where', 'provider', 'petroapp'],
+                ['whereNull', 'deleted_at'],
+            ]);
     });
 
     test('vehicle and fuel report requests expose core validation contracts', function () {
@@ -273,7 +303,13 @@ namespace {
             ->and($fuelReportRules['driver'])->toBe(['required'])
             ->and($fuelReportRules['odometer'])->toBe(['required'])
             ->and($fuelReportRules['volume'])->toBe(['required'])
-            ->and($fuelReportUpdateRules['driver'])->toBe(['required'])
+            // The update request inherits these rules, so `required` made every partial
+            // update fail — PUT with just {"status": "approved"} answered "The driver
+            // field is required.", and the update action's $request->only() list does not
+            // even include `driver`. This assertion previously pinned that behaviour.
+            ->and($fuelReportUpdateRules['driver'])->toBe(['sometimes'])
+            ->and($fuelReportUpdateRules['odometer'])->toBe(['sometimes'])
+            ->and($fuelReportUpdateRules['volume'])->toBe(['sometimes'])
             ->and($internalDriverRules['location'][1])->toBeInstanceOf(ResolvablePoint::class)
             ->and($internalDriverRules['vehicle'][1])->toBeInstanceOf(ResolvableVehicle::class)
             ->and($internalDriverRules['latitude'])->toBe(['nullable', 'required_with:longitude', 'numeric'])
@@ -621,7 +657,7 @@ namespace {
 
         expect($request->authorize())->toBeTrue()
             ->and($rules['identity'])->toBe('required|string')
-            ->and($rules['code'])->toBe('required|exists:verification_codes,code')
+            ->and($rules['code'])->toBe('required|string')
             ->and($rules['name'])->toBe('required|string')
             ->and($rules['password'])->toBe('required|string|min:8')
             ->and(ruleStrings($rules['email']))->toContain('email', 'nullable', 'unique:contacts')
@@ -649,13 +685,14 @@ namespace {
 
         expect($request->authorize())->toBeFalse();
 
-        bindFleetOpsRequestSession(['api_credential' => 'credential-uuid']);
+        session(['company' => 'company-uuid']);
+        bindFleetOpsRequestSession(['api_credential' => 'credential-uuid', 'company' => 'company-uuid']);
 
         $createRules = $request->rules();
         $patchRules  = CreatePartRequest::create('/fleetops-test', 'PATCH')->rules();
 
         expect($request->authorize())->toBeTrue()
-            ->and($createRules['sku'])->toBe(['nullable', 'string'])
+            ->and(ruleStrings($createRules['sku']))->toContain('nullable', 'string', 'unique:parts,sku')
             ->and(ruleStrings($createRules['name']))->toContain('required', 'string')
             ->and(ruleStrings($patchRules['name']))->not->toContain('required')
             ->and($createRules['manufacturer'])->toBe(['nullable', 'string'])
@@ -671,11 +708,66 @@ namespace {
             ->and($createRules['specs'])->toBe(['nullable', 'array'])
             ->and($createRules['meta'])->toBe(['nullable', 'array']);
 
+        // The SKU uniqueness rule mirrors parts_company_uuid_active_sku_unique:
+        // scoped to the session company and ignoring soft-deleted parts, so a SKU
+        // freed by a deleted part — or held by another company — stays available.
+        // Without it a duplicate reached the driver and returned a 500.
+        $skuRule = collect($createRules['sku'])->first(fn ($rule) => $rule instanceof Illuminate\Validation\Rule);
+
+        expect($skuRule)->not->toBeNull()
+            ->and($skuRule->constraints)->toBe([
+                ['where', 'company_uuid', 'company-uuid'],
+                ['whereNull', 'deleted_at'],
+            ]);
+
+        // On update the record re-sends its own SKU, so it must not collide with
+        // itself. The v1 route parameter is a public_id, not a uuid.
+        $updateRules = CreatePartRequest::create('/fleetops-test', 'PUT')
+            ->setRouteResolver(fn () => new class {
+                public function parameter($key, $default = null)
+                {
+                    return $key === 'id' ? 'part_abc123' : $default;
+                }
+            })
+            ->rules();
+
+        $updateSkuRule = collect($updateRules['sku'])->first(fn ($rule) => $rule instanceof Illuminate\Validation\Rule);
+
+        expect($updateSkuRule->constraints)->toContain(['ignore', 'part_abc123', 'public_id']);
+
         bindFleetOpsRequestSession(['is_sanctum_token' => true]);
 
         expect($request->authorize())->toBeTrue();
     });
 
+    test('duplicate-key requests name the offending field and ignore themselves on update', function () {
+        session(['company' => 'company-uuid']);
+        bindFleetOpsRequestSession(['api_credential' => 'credential-uuid', 'company' => 'company-uuid']);
+
+        // Without these the violation surfaces as the framework's generic "has already
+        // been taken", which does not say which record collided or on what.
+        expect(CreatePartRequest::create('/fleetops-test', 'POST')->messages())
+            ->toBe(['sku.unique' => 'A part with this SKU already exists.'])
+            ->and(CreateFuelTransactionRequest::create('/fleetops-test', 'POST')->messages())
+            ->toBe(['provider_transaction_id.unique' => 'A fuel transaction with this provider transaction id already exists for this provider.']);
+
+        // `provider` is supplied here, so resolveProvider() short-circuits on the input
+        // and this exercises only the ignore-self clause. The stored-provider fallback
+        // needs a database and is covered in FuelProviderTransactionControllerContractsTest.
+        $updateRules = CreateFuelTransactionRequest::create('/fleetops-test', 'PUT', ['provider' => 'petroapp'])
+            ->setRouteResolver(fn () => new class {
+                public function parameter($key, $default = null)
+                {
+                    return $key === 'id' ? 'fuel_provider_transaction_abc123' : $default;
+                }
+            })
+            ->rules();
+
+        $updateRule = collect($updateRules['provider_transaction_id'])->first(fn ($rule) => $rule instanceof Illuminate\Validation\Rule);
+
+        expect($updateRule->constraints)->toContain(['ignore', 'fuel_provider_transaction_abc123', 'public_id']);
+    });
+
     test('entity equipment payload and simulation requests expose conditional contracts', function () {
         bindFleetOpsRequestSession();
 

package/server/tests/SmallControllerContractsTest.php

@@ -227,19 +227,30 @@ class FleetOpsGettingStartedControllerProbe extends GettingStartedController
 
 class FleetOpsPublicNavigatorControllerProbe extends PublicNavigatorController
 {
-    public mixed $settings = ['require_photo' => true];
-    public array $lookups  = [];
+    public mixed $settings   = ['require_photo' => true];
+    public array $lookups    = [];
+    public bool $companyMiss = false;
 
     protected function findCompanyByPublicId(string $companyId): ?Company
     {
+        $this->lookups[] = $companyId;
+
+        // Mirrors the real lookup returning null for an unknown public id.
+        if ($this->companyMiss) {
+            return null;
+        }
+
         $company = new Company();
         $company->setRawAttributes(['uuid' => 'company-uuid', 'public_id' => $companyId], true);
 
-        $this->lookups[] = $companyId;
-
         return $company;
     }
 
+    protected function errorResponse(string $message, int $statusCode): JsonResponse
+    {
+        return new JsonResponse(['errors' => [$message]], $statusCode);
+    }
+
     protected function driverOnboardSetting(string $companyUuid): mixed
     {
         $this->lookups[] = $companyUuid;
@@ -412,6 +423,19 @@ test('public navigator controller returns configured or default driver onboardin
         ]);
 });
 
+test('public navigator controller answers 404 for an organization public id that does not resolve', function () {
+    $controller               = new FleetOpsPublicNavigatorControllerProbe();
+    $controller->companyMiss  = true;
+
+    $response = $controller->getDriverOnboardSettings('company_does_not_exist');
+
+    // Regression: the unresolved company used to be dereferenced anyway, which threw a
+    // TypeError out of the controller and rendered an HTML stack trace with a 500.
+    expect($response->getStatusCode())->toBe(404)
+        ->and($response->getData(true))->toBe(['errors' => ['Organization not found.']])
+        ->and($controller->lookups)->toBe(['company_does_not_exist']);
+});
+
 test('public contact controller normalizes create input and preserves update fields', function () {
     $controller = new FleetOpsContactControllerProbe();
 

package/server/tests/Unit/Http/Filter/MaintenanceScheduleFilterTest.php

@@ -0,0 +1,69 @@
+<?php
+
+use Fleetbase\FleetOps\Http\Filter\MaintenanceScheduleFilter;
+use Fleetbase\FleetOps\Models\Vehicle;
+use Fleetbase\Http\Filter\Filter;
+
+class FleetOpsMaintenanceScheduleFilterQuery
+{
+    public array $wheres = [];
+
+    public function where(...$arguments): self
+    {
+        $this->wheres[] = $arguments;
+
+        return $this;
+    }
+}
+
+function fleetopsMaintenanceScheduleFilter(FleetOpsMaintenanceScheduleFilterQuery $builder): MaintenanceScheduleFilter
+{
+    $filter = (new ReflectionClass(MaintenanceScheduleFilter::class))->newInstanceWithoutConstructor();
+
+    foreach ([
+        'builder' => $builder,
+        'session' => new class {
+            public function get(string $key): ?string
+            {
+                return $key === 'company' ? 'company-uuid' : null;
+            }
+        },
+    ] as $property => $value) {
+        $reflection = new ReflectionProperty(Filter::class, $property);
+        $reflection->setAccessible(true);
+        $reflection->setValue($filter, $value);
+    }
+
+    return $filter;
+}
+
+test('maintenance schedule filter scopes companies and resolves subject aliases', function () {
+    $builder = new FleetOpsMaintenanceScheduleFilterQuery();
+    $filter  = fleetopsMaintenanceScheduleFilter($builder);
+
+    $filter->queryForInternal();
+    $filter->queryForPublic();
+    $filter->subjectType('vehicle');
+    $filter->subjectType('fleet-ops:vehicle');
+    $filter->subjectType(Vehicle::class);
+    $filter->subjectUuid('vehicle-uuid');
+
+    expect($builder->wheres)->toBe([
+        ['company_uuid', 'company-uuid'],
+        ['company_uuid', 'company-uuid'],
+        ['subject_type', Vehicle::class],
+        ['subject_type', Vehicle::class],
+        ['subject_type', Vehicle::class],
+        ['subject_uuid', 'vehicle-uuid'],
+    ]);
+});
+
+test('maintenance schedule filter ignores empty subject filters', function () {
+    $builder = new FleetOpsMaintenanceScheduleFilterQuery();
+    $filter  = fleetopsMaintenanceScheduleFilter($builder);
+
+    $filter->subjectType(null);
+    $filter->subjectUuid(null);
+
+    expect($builder->wheres)->toBe([]);
+});

package/server/tests/Unit/Http/Requests/CreateFuelReportRequestTest.php

@@ -10,6 +10,7 @@ namespace Illuminate\Foundation\Http {
 
 namespace {
     use Fleetbase\FleetOps\Http\Requests\CreateFuelReportRequest;
+    use Fleetbase\FleetOps\Http\Requests\UpdateFuelReportRequest;
 
     class FleetOpsCreateFuelReportSessionStore
     {
@@ -39,6 +40,26 @@ namespace {
         return CreateFuelReportRequest::create('/fleet-ops/fuel-reports', 'POST');
     }
 
+    test('fuel report create only fields are required on POST and optional on update', function () {
+        FleetOpsCreateFuelReportRequestState::$session = new FleetOpsCreateFuelReportSessionStore(['api_credential' => 'api-credential-uuid']);
+
+        // UpdateFuelReportRequest extends this class, so a flat `required` made every
+        // partial update fail — PUT with just {"status": "approved"} answered "The driver
+        // field is required." `driver` is the plainest case: the update action's
+        // $request->only() list does not include it, so the field was demanded and then
+        // discarded.
+        $create = CreateFuelReportRequest::create('/fleet-ops/fuel-reports', 'POST')->rules();
+        $update = UpdateFuelReportRequest::create('/fleet-ops/fuel-reports/report_1', 'PUT')->rules();
+
+        foreach (['driver', 'odometer', 'volume'] as $field) {
+            expect($create[$field])->toBe(['required'])
+                ->and($update[$field])->toBe(['sometimes']);
+        }
+
+        expect($create['metric_unit'])->toBe(['nullable'])
+            ->and($create['amount'])->toBe(['nullable']);
+    });
+
     test('create fuel report authorization accepts api credentials or sanctum sessions', function () {
         expect(fleetopsCreateFuelReportRequestWithSession([])->authorize())->toBeFalse()
             ->and(fleetopsCreateFuelReportRequestWithSession(['api_credential' => 'api-credential-uuid'])->authorize())->toBeTrue()

package/server/tests/Unit/Jobs/GeofenceDwellAndBulkNotifyTest.php

@@ -180,4 +180,11 @@ test('navigator driver onboard settings endpoint resolves company settings', fun
     $connection->table('companies')->insert(['uuid' => 'company-2', 'public_id' => 'company_two', 'name' => 'Beta']);
     $empty = (new NavigatorController())->getDriverOnboardSettings('company_two');
     expect($empty->getData(true)['driverOnboardSettings'])->toBe([]);
+
+    // An unresolved public id is a client error. This drives the real
+    // errorResponse() seam, which the probe in SmallControllerContractsTest
+    // replaces — only the status is asserted, because the harness `response()`
+    // shim envelopes errors differently from the core-api macro it stands in for.
+    $missing = (new NavigatorController())->getDriverOnboardSettings('company_missing');
+    expect($missing->getStatusCode())->toBe(404);
 });

package/server/tests/Unit/Models/SensorLastPositionDefaultTest.php

@@ -0,0 +1,130 @@
+<?php
+
+use Fleetbase\FleetOps\Models\Sensor;
+use Fleetbase\LaravelMysqlSpatial\Types\Point as SpatialPoint;
+use Illuminate\Database\ConnectionResolver;
+use Illuminate\Database\Eloquent\Model as EloquentModel;
+use Illuminate\Database\SQLiteConnection;
+use Illuminate\Http\Request;
+use Illuminate\Support\Str;
+
+/**
+ * Covers Sensor::boot()'s creating hook, which defaults `last_position` to
+ * POINT(0,0).
+ *
+ * The same migration that made devices.last_position NOT NULL did it to sensors
+ * too, but only Device had a default. Creating a sensor through the API failed
+ * with "Field 'last_position' doesn't have a default value" — the Postman
+ * contract run caught it, having never been able to create a sensor at all.
+ *
+ * As with the device fixtures, the dispatcher is set up front so the model event
+ * actually fires; without it the hook is never registered and its body never runs.
+ */
+if (!function_exists('Fleetbase\Observers\event')) {
+    eval('namespace Fleetbase\Observers; function event($event = null, $payload = []) { return []; }');
+}
+
+if (!function_exists('Fleetbase\FleetOps\Observers\event')) {
+    eval('namespace Fleetbase\FleetOps\Observers; function event($event = null, $payload = []) { return []; }');
+}
+
+if (!function_exists('Fleetbase\Support\session')) {
+    eval('namespace Fleetbase\Support; function session($key = null, $default = null) { if ($key === null) { return new class { public function has($k) { return \session($k) !== null; } public function get($k, $d = null) { return \session($k, $d); } }; } return \session($key, $default); }');
+}
+
+if (!function_exists('Fleetbase\Models\session')) {
+    eval('namespace Fleetbase\Models; function session($key = null, $default = null) { if ($key === null) { return new class { public function has($k) { return \session($k) !== null; } public function get($k, $d = null) { return \session($k, $d); } public function missing($k) { return \session($k) === null; } }; } return \session($key, $default); }');
+}
+
+if (!Str::hasMacro('humanize')) {
+    Str::macro('humanize', fn ($value) => ucfirst(str_replace(['_', '-'], ' ', Str::snake((string) $value))));
+}
+
+function fleetopsSensorDefaultBoot(): SQLiteConnection
+{
+    $pdo = new PDO('sqlite::memory:');
+    $pdo->sqliteCreateFunction('ST_PointFromText', fn ($wkt, $srid = 0, $axisOrder = null) => $wkt);
+    $pdo->sqliteCreateFunction('ST_GeomFromText', fn ($wkt, $srid = 0, $axisOrder = null) => $wkt);
+    $connection = new SQLiteConnection($pdo);
+    $resolver   = new ConnectionResolver(['default' => $connection, 'mysql' => $connection]);
+    $resolver->setDefaultConnection('mysql');
+    EloquentModel::setConnectionResolver($resolver);
+
+    // The creating hook is registered against whichever dispatcher is present
+    // when the model boots, so it has to exist before Device is ever touched.
+    if (!EloquentModel::getEventDispatcher()) {
+        EloquentModel::setEventDispatcher(new Illuminate\Events\Dispatcher());
+    }
+
+    app()->instance('db', new class($connection) {
+        public function __construct(public SQLiteConnection $c)
+        {
+        }
+
+        public function connection($name = null): SQLiteConnection
+        {
+            return $this->c;
+        }
+
+        public function __call($method, $arguments)
+        {
+            return $this->c->{$method}(...$arguments);
+        }
+    });
+    app()->instance('db.schema', $connection->getSchemaBuilder());
+    app()->instance('responsecache', new class {
+        public function __call($method, $arguments)
+        {
+            return null;
+        }
+    });
+    Illuminate\Support\Facades\DB::clearResolvedInstance('db');
+    app()->instance('request', Request::create('/v1/sensors'));
+
+    config()->set('activitylog.enabled', false);
+    config()->set('activitylog.default_auth_driver', 'web');
+    app()->bind(Illuminate\Contracts\Config\Repository::class, fn () => config());
+
+    $schema = $connection->getSchemaBuilder();
+    $schema->create('sensors', function ($blueprint) {
+        $blueprint->increments('id');
+        foreach (['uuid', 'public_id', 'internal_id', 'company_uuid', 'telematic_uuid', 'device_uuid', 'name', 'slug', 'type', 'status', 'online', 'unit', 'last_value', 'last_reading_at', 'min_threshold', 'max_threshold', 'location', 'last_position', 'meta', 'data', 'options', 'notes', '_key'] as $column) {
+            $blueprint->string($column)->nullable();
+        }
+        $blueprint->timestamps();
+        $blueprint->timestamp('deleted_at')->nullable();
+    });
+
+    session(['company' => 'company-1']);
+
+    return $connection;
+}
+
+test('creating a sensor without a position defaults it to the null island', function () {
+    fleetopsSensorDefaultBoot();
+
+    $sensor = Sensor::create([
+        'company_uuid' => 'company-1',
+        'name'         => 'Defaulted Sensor',
+        'type'         => 'temperature',
+    ]);
+
+    expect($sensor->last_position)->toBeInstanceOf(SpatialPoint::class)
+        ->and($sensor->last_position->getLat())->toBe(0.0)
+        ->and($sensor->last_position->getLng())->toBe(0.0);
+});
+
+test('creating a sensor with a position leaves it untouched', function () {
+    fleetopsSensorDefaultBoot();
+
+    $sensor = Sensor::create([
+        'company_uuid'  => 'company-1',
+        'name'          => 'Positioned Sensor',
+        'type'          => 'temperature',
+        'last_position' => new SpatialPoint(1.3, 103.8),
+    ]);
+
+    expect($sensor->last_position)->toBeInstanceOf(SpatialPoint::class)
+        ->and($sensor->last_position->getLat())->toBe(1.3)
+        ->and($sensor->last_position->getLng())->toBe(103.8);
+});