@fleetbase/fleetops-engine 0.6.59 → 0.6.61

package/addon/templates/management/drivers/index.hbs

@@ -1,33 +1,67 @@
-<Layout::Resource::Tabular
-    @resource="driver"
-    @title={{t "resource.drivers"}}
-    @searchQuery={{this.query}}
-    @onSearch={{perform this.driverActions.controllerSearchTask this}}
-    @data={{@model}}
-    @columns={{this.columns}}
-    @page={{this.page}}
-    @onPageChange={{fn (mut this.page)}}
-    @setupTable={{fn (mut this.table)}}
-    @actionButtons={{this.actionButtons}}
-    @bulkActions={{this.bulkActions}}
-    @controller={{this}}
-    @emptyStateComponent={{component
-        "table/empty-state"
-        icon="id-card"
-        title="Add your first driver"
-        description="Drivers power dispatching, live fleet visibility, assignments, and delivery activity."
-        filteredTitle="No drivers match your search"
-        filteredDescription="Adjust the search or filters to find another driver."
-        primaryText="New driver"
-        primaryIcon="plus"
-        primaryAction=this.driverActions.transition.create
-        secondaryText="Import"
-        secondaryIcon="upload"
-        secondaryAction=this.driverActions.import
-        docsSlug="fleet-ops/resources/drivers/overview"
-        docsTitle="Drivers guide"
-        docsText="Driver guide"
-        docsSource="fleet-ops-empty-drivers"
-    }}
-/>
-{{outlet}}
+{{#if (eq this.layout "table")}}
+    <Layout::Resource::Tabular
+        @resource="driver"
+        @title={{t "resource.drivers"}}
+        @searchQuery={{this.query}}
+        @onSearch={{perform this.driverActions.controllerSearchTask this}}
+        @data={{@model}}
+        @columns={{this.columns}}
+        @page={{this.page}}
+        @onPageChange={{fn (mut this.page)}}
+        @setupTable={{fn (mut this.table)}}
+        @actionButtons={{this.actionButtons}}
+        @bulkActions={{this.bulkActions}}
+        @controller={{this}}
+        @emptyStateComponent={{component
+            "table/empty-state"
+            icon="id-card"
+            title="Add your first driver"
+            description="Drivers power dispatching, live fleet visibility, assignments, and delivery activity."
+            filteredTitle="No drivers match your search"
+            filteredDescription="Adjust the search or filters to find another driver."
+            primaryText="New driver"
+            primaryIcon="plus"
+            primaryAction=this.driverActions.transition.create
+            secondaryText="Import"
+            secondaryIcon="upload"
+            secondaryAction=this.driverActions.import
+            docsSlug="fleet-ops/resources/drivers/overview"
+            docsTitle="Drivers guide"
+            docsText="Driver guide"
+            docsSource="fleet-ops-empty-drivers"
+        }}
+    />
+{{else}}
+    <Layout::Section::Header @title={{t "resource.drivers"}} @actionsWrapperClass="space-x-1">
+        <Layout::Resource::TabularActions
+            @searchQuery={{this.query}}
+            @onSearch={{perform this.driverActions.controllerSearchTask this}}
+            @columns={{this.columns}}
+            @page={{this.page}}
+            @onPageChange={{fn (mut this.page)}}
+            @setupTable={{fn (mut this.table)}}
+            @actionButtons={{this.actionButtons}}
+            @bulkActions={{this.bulkActions}}
+            @controller={{this}}
+            @hideColumnsPicker={{true}}
+        />
+    </Layout::Section::Header>
+
+    <Layout::Section::Body class="overflow-y-scroll-i h-full">
+        <Layout::Resource::CardsGrid
+            @resource="driver"
+            @data={{@model}}
+            @columns="4"
+            @showPagination={{true}}
+            @page={{this.page}}
+            @onPageChange={{fn (mut this.page)}}
+            @paginationMeta={{@model.meta}}
+            @containerClass="p-4"
+            class="h-full"
+            as |Item|
+        >
+            <Driver::Card @resource={{Item.model}} />
+        </Layout::Resource::CardsGrid>
+    </Layout::Section::Body>
+{{/if}}
+{{outlet}}

package/addon/templates/settings/map.hbs

@@ -31,6 +31,16 @@
                         />
                     </InputGroup>
 
+                    {{#if this.isLeafletSelected}}
+                        <InputGroup @name={{t "settings.map.leaflet-tile-url"}} @helpText={{t "settings.map.leaflet-tile-url-help-text"}}>
+                            <Input @type="text" @value={{this.leafletTileUrl}} placeholder="https://tile.openstreetmap.org/{z}/{x}/{y}.png" class="w-full form-input" />
+                        </InputGroup>
+
+                        <InputGroup @name={{t "settings.map.leaflet-dark-tile-url"}} @helpText={{t "settings.map.leaflet-dark-tile-url-help-text"}}>
+                            <Input @type="text" @value={{this.leafletDarkTileUrl}} placeholder="https://tile.openstreetmap.org/{z}/{x}/{y}.png" class="w-full form-input" />
+                        </InputGroup>
+                    {{/if}}
+
                     {{#if this.isGoogleMapsSelected}}
                         <InputGroup @name={{t "settings.map.google-maps-map-type"}} @helpText={{t "settings.map.google-maps-map-type-help-text"}}>
                             <Select

package/addon/utils/leaflet-tile-url.js

@@ -0,0 +1,31 @@
+/**
+ * Default Leaflet raster tile sources.
+ *
+ * CARTO's `basemaps.cartocdn.com` raster tiles now require an API key and
+ * render an "API key required" watermark without one, so the default basemap
+ * is the keyless OpenStreetMap tile server. Operators can point Leaflet at any
+ * other XYZ provider (including a keyed CARTO URL) via Fleet-Ops map settings.
+ */
+export const DEFAULT_LEAFLET_TILE_URL = 'https://tile.openstreetmap.org/{z}/{x}/{y}.png';
+export const DEFAULT_LEAFLET_DARK_TILE_URL = DEFAULT_LEAFLET_TILE_URL;
+export const DEFAULT_LEAFLET_TILE_ATTRIBUTION = '&copy; <a href="https://www.openstreetmap.org/copyright">OpenStreetMap</a> contributors';
+
+/**
+ * Resolve the Leaflet tile URL for a theme from a map settings object.
+ *
+ * @param {Object} settings map settings, may contain `leafletTileUrl` and `leafletDarkTileUrl`
+ * @param {String} theme 'light' or 'dark'
+ * @return {String} the XYZ tile URL template to use
+ */
+export function getLeafletTileUrl(settings = {}, theme = 'light') {
+    const customLight = typeof settings.leafletTileUrl === 'string' ? settings.leafletTileUrl.trim() : '';
+    const customDark = typeof settings.leafletDarkTileUrl === 'string' ? settings.leafletDarkTileUrl.trim() : '';
+
+    if (theme === 'dark') {
+        return customDark || customLight || DEFAULT_LEAFLET_DARK_TILE_URL;
+    }
+
+    return customLight || DEFAULT_LEAFLET_TILE_URL;
+}
+
+export default getLeafletTileUrl;

package/addon/utils/prepare-place-for-save.js

@@ -0,0 +1,13 @@
+export default function preparePlaceForSave(store, place) {
+    if (!place || place.isNew || place.public_id) {
+        return place;
+    }
+
+    const attributes = {};
+
+    place.constructor.eachAttribute((attribute) => {
+        attributes[attribute] = place[attribute];
+    });
+
+    return store.createRecord('place', attributes);
+}

package/app/components/driver/card.js

@@ -0,0 +1 @@
+export { default } from '@fleetbase/fleetops-engine/components/driver/card';

package/app/helpers/leaflet-tile-url.js

@@ -0,0 +1 @@
+export { default } from '@fleetbase/fleetops-engine/helpers/leaflet-tile-url';

package/app/utils/leaflet-tile-url.js

@@ -0,0 +1 @@
+export { default, DEFAULT_LEAFLET_TILE_URL, DEFAULT_LEAFLET_DARK_TILE_URL, DEFAULT_LEAFLET_TILE_ATTRIBUTION, getLeafletTileUrl } from '@fleetbase/fleetops-engine/utils/leaflet-tile-url';

package/composer.json

@@ -1,6 +1,6 @@
 {
     "name": "fleetbase/fleetops-api",
-    "version": "0.6.59",
+    "version": "0.6.61",
     "description": "Fleet & Transport Management Extension for Fleetbase",
     "keywords": [
         "fleetbase-extension",

package/extension.json

@@ -1,6 +1,6 @@
 {
     "name": "Fleet-Ops",
-    "version": "0.6.59",
+    "version": "0.6.61",
     "description": "Fleet & Transport Management Extension for Fleetbase",
     "repository": "https://github.com/fleetbase/fleetops",
     "license": "AGPL-3.0-or-later",

package/index.js

@@ -44,6 +44,15 @@ module.exports = buildEngine({
         return trees;
     },
 
+    treeForLeafletImages: function () {
+        const leafletImagesPath = path.join(this.pathBase('leaflet'), 'dist', 'images');
+
+        return new Funnel(leafletImagesPath, {
+            destDir: 'assets/images',
+            include: ['marker-icon.png', 'marker-icon-2x.png', 'marker-shadow.png'],
+        });
+    },
+
     treeForJointJs: function () {
         const trees = [];
 
@@ -70,12 +79,14 @@ module.exports = buildEngine({
 
     mergeWithPublicTree: function (publicTree) {
         const leafletTree = this.treeForLeaflet();
+        const leafletImagesTree = this.treeForLeafletImages();
         const jointJsTree = this.treeForJointJs();
         const assetsTree = [
             new Funnel(path.join(__dirname, 'assets'), {
                 destDir: '',
             }),
             ...leafletTree,
+            leafletImagesTree,
             ...jointJsTree,
         ];
 

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@fleetbase/fleetops-engine",
-    "version": "0.6.59",
+    "version": "0.6.61",
     "description": "Fleet & Transport Management Extension for Fleetbase",
     "fleetbase": {
         "route": "fleet-ops"
@@ -70,6 +70,7 @@
         "ember-radio-button": "^3.0.0-beta.1",
         "ember-tag-input": "^3.1.0",
         "ember-wormhole": "^0.6.0",
+        "leaflet": "^1.9.4",
         "leaflet-contextmenu": "^1.4.0",
         "leaflet-draw": "^1.0.4",
         "xlsx": "^0.18.5"

package/server/config/fleetops.php

@@ -96,10 +96,54 @@ return [
     |--------------------------------------------------------------------------
     */
     'navigator' => [
+        /*
+        | App store reviewers cannot receive our SMS, so a fixed verification code has
+        | to keep working for them — including in production, which is where a review
+        | build is tested. Blocking the bypass outside production made review
+        | impossible; restricting it to named accounts makes it safe instead.
+        |
+        | Both values are required, and neither has a default. The code alone is not
+        | sufficient: it is only accepted for an identity listed in review_accounts, so
+        | a leaked code cannot be used to authenticate as an arbitrary driver.
+        |
+        |   NAVIGATOR_BYPASS_VERIFICATION_CODE=<a secret, rotated code>
+        |   NAVIGATOR_REVIEW_ACCOUNTS=+15555550100,apple-review@example.com
+        */
         'bypass_verification_code' => env('SMS_AUTH_BYPASS_CODE', env('NAVIGATOR_BYPASS_VERIFICATION_CODE')),
+        'review_accounts'          => array_values(array_filter(array_map(
+            'trim',
+            explode(',', (string) env('NAVIGATOR_REVIEW_ACCOUNTS', ''))
+        ))),
         'app_identifier'           => env('NAVIGATOR_APP_IDENTIFIER', 'io.fleetbase.navigator'),
     ],
 
+    /*
+    |--------------------------------------------------------------------------
+    | Customers
+    |--------------------------------------------------------------------------
+    |
+    | Testing-only verification-code bypass for the customer auth flows
+    | (POST /v1/customers, /customers/verify-code, /customers/reset-password).
+    | Intended for local development and staging QA, where signing up means
+    | waiting on a real email or paying for a real SMS.
+    |
+    | MUST be left unset in production. It is ignored outright when the app
+    | environment is `production`, and when unset no bypass is possible.
+    |
+    | Deliberately NOT wired to SMS_AUTH_BYPASS_CODE: that variable already
+    | gates operator console login and driver login, and reusing it here would
+    | make one leaked value unlock three different privilege tiers.
+    |
+    */
+    'customers' => [
+        'verification_bypass_code' => env('FLEETOPS_CUSTOMER_VERIFICATION_BYPASS_CODE'),
+        // Identities the bypass code is accepted for. See the note on navigator below.
+        'review_accounts'          => array_values(array_filter(array_map(
+            'trim',
+            explode(',', (string) env('FLEETOPS_CUSTOMER_REVIEW_ACCOUNTS', ''))
+        ))),
+    ],
+
     /*
     |--------------------------------------------------------------------------
     | API Events

package/server/config/geocoder.php

@@ -57,7 +57,7 @@ return [
     'providers' => [
         Chain::class => [
             GoogleMaps::class => [
-                config('services.google_maps.locale', env('GOOGLE_MAPS_LOCALE', 'us')),
+                config('services.google_maps.locale', env('GOOGLE_MAPS_LOCALE', 'en')),
                 config('services.google_maps.api_key', env('GOOGLE_MAPS_API_KEY')),
             ]
         ],

package/server/migrations/2026_08_08_000001_make_sku_and_provider_transaction_unique_indexes_soft_delete_aware.php

@@ -0,0 +1,152 @@
+<?php
+
+use Illuminate\Database\Migrations\Migration;
+use Illuminate\Database\Schema\Blueprint;
+use Illuminate\Support\Facades\DB;
+use Illuminate\Support\Facades\Schema;
+
+/**
+ * Both `parts` and `fuel_provider_transactions` soft-delete, but their unique
+ * indexes were not soft-delete aware.  A deleted row kept occupying the key, so
+ * re-creating a Part with a previously used SKU (or re-ingesting a fuel provider
+ * transaction that had been deleted) raised a UniqueConstraintViolationException.
+ * On the public v1 API that surfaced as an HTTP 500, and because there is no
+ * restore/force-delete route the key was unusable from then on.
+ *
+ * The fix follows the pattern already used for alrashed contract numbers in
+ * 2026_05_25_000001_make_contract_number_unique_for_active_contracts: a STORED
+ * generated column that is NULL for soft-deleted rows.  MySQL permits any number
+ * of NULLs in a unique index, so tombstones stop colliding while live rows stay
+ * constrained.
+ *
+ * `fuel_provider_transactions` additionally gains `company_uuid` in the key.  The
+ * old index was global, so one company's provider transaction id blocked — or,
+ * via FuelProviderService::ingestTransaction()'s updateOrCreate, silently
+ * overwrote — another company's.  Provider transaction ids are only unique within
+ * the account they were issued for, so the key belongs per tenant.
+ *
+ * Both new indexes are strictly more permissive than the ones they replace, so no
+ * existing row can violate them and no backfill is required.
+ */
+return new class extends Migration {
+    /**
+     * Run the migrations.
+     *
+     * @return void
+     */
+    public function up()
+    {
+        // ---- parts: (company_uuid, sku) -> (company_uuid, active_sku) ----
+        if (!Schema::hasColumn('parts', 'active_sku')) {
+            Schema::table('parts', function (Blueprint $table) {
+                $table->string('active_sku')->nullable()->storedAs('IF(`deleted_at` IS NULL, `sku`, NULL)');
+            });
+        }
+
+        // The replacement index MUST be created before the old one is dropped:
+        // parts_company_uuid_sku_unique is currently the only index covering
+        // company_uuid, and parts_company_uuid_foreign depends on it. Adding an
+        // index that also leads with company_uuid lets it take over as the
+        // covering index, otherwise the drop below fails with errno 150.
+        if (!$this->indexExists('parts', 'parts_company_uuid_active_sku_unique')) {
+            Schema::table('parts', function (Blueprint $table) {
+                $table->unique(['company_uuid', 'active_sku'], 'parts_company_uuid_active_sku_unique');
+            });
+        }
+
+        if ($this->indexExists('parts', 'parts_company_uuid_sku_unique')) {
+            Schema::table('parts', function (Blueprint $table) {
+                $table->dropUnique('parts_company_uuid_sku_unique');
+            });
+        }
+
+        // ---- fuel_provider_transactions: (provider, provider_transaction_id)
+        //      -> (company_uuid, provider, active_provider_transaction_id) ----
+        if (!Schema::hasColumn('fuel_provider_transactions', 'active_provider_transaction_id')) {
+            Schema::table('fuel_provider_transactions', function (Blueprint $table) {
+                $table->string('active_provider_transaction_id', 191)->nullable()->storedAs('IF(`deleted_at` IS NULL, `provider_transaction_id`, NULL)');
+            });
+        }
+
+        if (!$this->indexExists('fuel_provider_transactions', 'fuel_provider_txn_company_provider_unique')) {
+            Schema::table('fuel_provider_transactions', function (Blueprint $table) {
+                $table->unique(['company_uuid', 'provider', 'active_provider_transaction_id'], 'fuel_provider_txn_company_provider_unique');
+            });
+        }
+
+        if ($this->indexExists('fuel_provider_transactions', 'fuel_provider_txn_provider_unique')) {
+            Schema::table('fuel_provider_transactions', function (Blueprint $table) {
+                $table->dropUnique('fuel_provider_txn_provider_unique');
+            });
+        }
+    }
+
+    /**
+     * Reverse the migrations.
+     *
+     * Restoring the old global index can fail if rows now exist that only the new
+     * key permits (two tenants sharing a provider transaction id, or a live row
+     * whose SKU matches a soft-deleted one). That is inherent to reversing a
+     * relaxed constraint, so the old indexes are restored on a best-effort basis
+     * and the generated columns are dropped either way.
+     *
+     * @return void
+     */
+    public function down()
+    {
+        if (!$this->indexExists('parts', 'parts_company_uuid_sku_unique')) {
+            try {
+                Schema::table('parts', function (Blueprint $table) {
+                    $table->unique(['company_uuid', 'sku'], 'parts_company_uuid_sku_unique');
+                });
+            } catch (Throwable $e) {
+                // Duplicate SKUs the new index allowed now block the old one.
+            }
+        }
+
+        if ($this->indexExists('parts', 'parts_company_uuid_active_sku_unique')) {
+            Schema::table('parts', function (Blueprint $table) {
+                $table->dropUnique('parts_company_uuid_active_sku_unique');
+            });
+        }
+
+        if (Schema::hasColumn('parts', 'active_sku')) {
+            Schema::table('parts', function (Blueprint $table) {
+                $table->dropColumn('active_sku');
+            });
+        }
+
+        if (!$this->indexExists('fuel_provider_transactions', 'fuel_provider_txn_provider_unique')) {
+            try {
+                Schema::table('fuel_provider_transactions', function (Blueprint $table) {
+                    $table->unique(['provider', 'provider_transaction_id'], 'fuel_provider_txn_provider_unique');
+                });
+            } catch (Throwable $e) {
+                // Cross-tenant duplicates the new index allows now block the old one.
+            }
+        }
+
+        if ($this->indexExists('fuel_provider_transactions', 'fuel_provider_txn_company_provider_unique')) {
+            Schema::table('fuel_provider_transactions', function (Blueprint $table) {
+                $table->dropUnique('fuel_provider_txn_company_provider_unique');
+            });
+        }
+
+        if (Schema::hasColumn('fuel_provider_transactions', 'active_provider_transaction_id')) {
+            Schema::table('fuel_provider_transactions', function (Blueprint $table) {
+                $table->dropColumn('active_provider_transaction_id');
+            });
+        }
+    }
+
+    private function indexExists(string $table, string $index): bool
+    {
+        $database = DB::connection()->getDatabaseName();
+
+        return DB::table('information_schema.statistics')
+            ->where('table_schema', $database)
+            ->where('table_name', $table)
+            ->where('index_name', $index)
+            ->exists();
+    }
+};

package/server/src/Http/Controllers/Api/v1/CustomerController.php

@@ -19,6 +19,7 @@ use Fleetbase\FleetOps\Models\ServiceQuote;
 use Fleetbase\FleetOps\Support\CustomerAuth;
 use Fleetbase\FleetOps\Support\Utils;
 use Fleetbase\Http\Controllers\Controller;
+use Fleetbase\LaravelMysqlSpatial\Types\Point as SpatialPoint;
 use Fleetbase\Models\File;
 use Fleetbase\Models\User;
 use Fleetbase\Models\UserDevice;
@@ -41,6 +42,8 @@ use Illuminate\Support\Str;
  */
 class CustomerController extends Controller
 {
+    use \Fleetbase\FleetOps\Http\Controllers\Concerns\ResolvesReviewAccountBypass;
+
     /* ============================================================
      | Public auth flows (API credential only, no Customer-Token)
      * ============================================================ */
@@ -144,7 +147,7 @@ class CustomerController extends Controller
             'for'            => 'fleetops_create_customer',
             'meta->identity' => $identity,
         ]);
-        if (!$verificationCode) {
+        if (!$verificationCode && !$this->verificationBypassMatches($identity, $code)) {
             return response()->apiError('Invalid verification code provided.');
         }
 
@@ -312,6 +315,14 @@ class CustomerController extends Controller
                 'company_uuid' => $companyUuid,
                 'owner_uuid'   => $contact->uuid,
                 'owner_type'   => get_class($contact),
+                // `places.location` is a NOT NULL POINT column with no database default,
+                // and $allowed above is address-only — a caller cannot supply coordinates
+                // here. Without this the insert fails with SQLSTATE[HY000] 1364 ("Field
+                // 'location' doesn't have a default value"), turning a documented signup
+                // payload into a 500. Point(0, 0) is the same placeholder the geocoding
+                // helpers fall back to when an address cannot be resolved — see
+                // Place::getGoogleAddressArray and Place::findExistingSharedPlace.
+                'location'     => new SpatialPoint(0, 0),
             ],
             $attributes,
         ));
@@ -417,7 +428,7 @@ class CustomerController extends Controller
             'code'         => $code,
             'for'          => $for,
         ]);
-        if (!$verificationCode) {
+        if (!$verificationCode && !$this->verificationBypassMatches($identity, $code)) {
             return response()->apiError('Invalid verification code.');
         }
 
@@ -503,7 +514,9 @@ class CustomerController extends Controller
             'for'            => 'fleetops_customer_password_reset',
             'meta->identity' => $needle,
         ]);
-        if (!$verificationCode) {
+        // $needle, not $identity: the other verify paths normalise in place, so an
+        // allowlisted phone must be compared in the same normalised form here too.
+        if (!$verificationCode && !$this->verificationBypassMatches($needle, $code)) {
             return response()->apiError('Invalid reset code.');
         }
 
@@ -517,7 +530,10 @@ class CustomerController extends Controller
         $user->save();
         // Invalidate all existing sessions for this user after a password reset.
         $this->deleteUserTokens($user);
-        $verificationCode->delete();
+        // Null on the testing-bypass path — there is no row to consume.
+        if ($verificationCode) {
+            $verificationCode->delete();
+        }
 
         return response()->json(['status' => 'ok']);
     }
@@ -918,6 +934,36 @@ class CustomerController extends Controller
         return VerificationCode::generateSmsVerificationFor($user, $for, $options);
     }
 
+    /**
+     * Whether the supplied code matches the configured testing bypass code.
+     *
+     * Three conditions, all required, mirroring the console equivalent in
+     * Fleetbase\Http\Controllers\Internal\v1\AuthController::authenticateWithVerificationCode:
+     * a bypass code must actually be configured, the app must not be running in
+     * production, and the comparison is constant-time.
+     *
+     * Fails safe by default: config/app.php resolves `env` to `production` when
+     * neither APP_ENV nor ENVIRONMENT is set, so an unconfigured install cannot
+     * be bypassed even accidentally.
+     *
+     * `!== null && !== ''` rather than `!empty()` — `!empty('0')` is false, so a
+     * configured bypass code of "0" would otherwise be silently ignored.
+     *
+     * Kept out of verificationCodeExists()/findVerificationCode() on purpose:
+     * those two are test seams that the controller contract tests override, so a
+     * policy living inside them would be stubbed away exactly where it matters.
+     */
+    protected function verificationBypassMatches(?string $identity, ?string $code): bool
+    {
+        return static::reviewAccountBypassMatches(
+            'fleetops.customers.verification_bypass_code',
+            'fleetops.customers.review_accounts',
+            $identity,
+            $code,
+            'fleetops-customer'
+        );
+    }
+
     protected function verificationCodeExists(array $attributes): bool
     {
         return VerificationCode::where($attributes)->exists();