@fleetbase/fleetops-engine 0.6.59 → 0.6.61

package/server/src/Http/Controllers/Api/v1/DriverController.php

@@ -39,6 +39,8 @@ use Illuminate\Support\Str;
 
 class DriverController extends Controller
 {
+    use \Fleetbase\FleetOps\Http\Controllers\Concerns\ResolvesReviewAccountBypass;
+
     /**
      * Creates a new Fleetbase Driver resource.
      *
@@ -164,8 +166,14 @@ class DriverController extends Controller
         // get request input
         $input = $request->except(['name', 'password', 'email', 'phone', 'location', 'altitude', 'heading', 'speed', 'meta']);
 
-        // get user details for driver
-        $userDetails = $request->only(['name', 'password', 'email', 'phone']);
+        /*
+         * Deliberately no `password` here. Setting one through a general update
+         * meant anyone holding a driver's token — or an unlocked handset —
+         * could take the account without proving they knew the existing
+         * password. Changing a password is its own operation with its own
+         * proof: see changePassword(), forgotPassword() and resetPassword().
+         */
+        $userDetails = $request->only(['name', 'email', 'phone']);
 
         // update driver user details
         $driverUser = $driver->getUser();
@@ -438,6 +446,15 @@ class DriverController extends Controller
      */
     public function registerDevice(?string $id = null, ?Request $request = null)
     {
+        // Laravel does NOT inject a class-typed parameter that declares a default value —
+        // RouteDependencyResolverTrait skips it and the default (null) is used. So the
+        // router always called this with $request === null, which made
+        // POST /v1/drivers/{id}/register-device fail with "Call to a member function
+        // input() on null" and POST /v1/drivers/register-device answer 404 (the driver was
+        // looked up by a null user_uuid). The default has to stay, because the internal
+        // controller delegates to this method with an id only.
+        $request = $request ?? request();
+
         try {
             // With an id (…/{id}/register-device) look the driver up directly; without
             // one (…/register-device and the internal delegation) resolve the driver
@@ -611,7 +628,7 @@ class DriverController extends Controller
 
         // find and verify code
         $verificationCode = VerificationCode::where(['subject_uuid' => $user->uuid, 'code' => $code, 'for' => $for])->exists();
-        if (!$verificationCode && $code !== config('fleetops.navigator.bypass_verification_code')) {
+        if (!$verificationCode && !static::verificationBypassMatches($identity, $code)) {
             return response()->apiError('Invalid verification code!');
         }
 
@@ -924,7 +941,24 @@ class DriverController extends Controller
 
     protected function createUser(array $userDetails): User
     {
-        return User::create($userDetails);
+        /*
+         * `password` is guarded on User, so mass assignment drops it without a
+         * word. The create endpoint has always accepted and validated one, so a
+         * driver created through the API could never sign in with the password
+         * their operator chose for them. Set it after the fact, where the
+         * model's mutator hashes it.
+         */
+        $password = $userDetails['password'] ?? null;
+        unset($userDetails['password']);
+
+        $user = User::create($userDetails);
+
+        if (is_string($password) && strlen($password)) {
+            $user->password = $password;
+            $user->save();
+        }
+
+        return $user;
     }
 
     protected function getUuid(array|string $table, array $where, array $options = []): mixed
@@ -960,7 +994,21 @@ class DriverController extends Controller
      */
     protected function currentDriver(?Request $request): Driver
     {
-        return Driver::where('user_uuid', optional(optional($request)->user())->uuid)->firstOrFail();
+        // $request->user() is never populated on the public API: the `fleetbase.api`
+        // middleware calls Auth::setSession($apiCredential), which writes the session keys
+        // but leaves $login false, so no user resolver is ever bound. Reading it alone
+        // meant POST /v1/drivers/register-device looked a driver up by a null user_uuid
+        // and answered 404 for every consumer of the route.
+        //
+        // Auth::getUserFromSession() encodes this same order, but it also calls auth() and
+        // session()->has(), neither of which exists in the SQLite test harness — so the
+        // two sources are read directly here.
+        $user = optional($request)->user();
+        if (!$user instanceof User) {
+            $user = User::where('uuid', session('user'))->first();
+        }
+
+        return Driver::where('user_uuid', optional($user)->uuid)->firstOrFail();
     }
 
     protected function queryDrivers(Request $request)
@@ -1035,6 +1083,36 @@ class DriverController extends Controller
         return $company;
     }
 
+    /**
+     * Whether the supplied code matches the configured testing bypass code.
+     *
+     * Three conditions, all required, mirroring the console equivalent in
+     * Fleetbase\Http\Controllers\Internal\v1\AuthController::authenticateWithVerificationCode:
+     *
+     *  - a bypass code must actually be configured. The previous
+     *    `$code !== config(...)` comparison meant that on a default install --
+     *    where the config resolves to null -- omitting `code` entirely made the
+     *    check `null !== null`, i.e. false, so the guard never fired and any
+     *    caller with a valid org API credential could mint a driver token for
+     *    any driver in the install without a code at all;
+     *  - the app must not be in production, so a code left set in a deployed
+     *    .env cannot be used against a live fleet;
+     *  - the comparison is constant-time.
+     *
+     * Shared with Internal\v1\DriverController so both verify-code paths cannot
+     * drift apart.
+     */
+    public static function verificationBypassMatches(?string $identity, ?string $code): bool
+    {
+        return static::reviewAccountBypassMatches(
+            'fleetops.navigator.bypass_verification_code',
+            'fleetops.navigator.review_accounts',
+            $identity,
+            $code,
+            'navigator'
+        );
+    }
+
     /**
      * Patches phone number with international code.
      */
@@ -1122,4 +1200,198 @@ class DriverController extends Controller
             }
         }
     }
+
+    /**
+     * Change the authenticated driver's password, proving the current one.
+     *
+     * A password change is an authorisation decision, not an attribute update.
+     * Requiring the existing password is what stops a borrowed handset or a
+     * leaked token from becoming a permanent account takeover, and re-issuing
+     * the caller's token afterwards is what stops every *other* session from
+     * outliving the change.
+     */
+    public function changePassword(Request $request, string $id)
+    {
+        $current  = $request->input('current_password');
+        $password = $request->input('password');
+
+        if (!$current || !$password) {
+            return response()->apiError('current_password and password are required.', 400);
+        }
+
+        if (strlen($password) < 8) {
+            return response()->apiError('Password must be at least 8 characters.', 400);
+        }
+
+        if ($request->filled('password_confirmation') && $request->input('password_confirmation') !== $password) {
+            return response()->apiError('Password confirmation does not match.', 422);
+        }
+
+        try {
+            $driver = $this->findDriver($id, ['user']);
+        } catch (\Illuminate\Database\Eloquent\ModelNotFoundException $exception) {
+            return response()->apiError('Driver resource not found.', 404);
+        }
+
+        $user = static::findDriverUserRecord($driver);
+        if (!$user) {
+            return response()->apiError('Driver has no user account.', 422);
+        }
+
+        if (!static::passwordMatches($user, $current)) {
+            // Same wording whether the password was wrong or the account is odd
+            // — a change endpoint should not become an oracle.
+            return response()->apiError('The current password is incorrect.', 422);
+        }
+
+        $user->password = $password;
+        $user->save();
+
+        /*
+         * Every other session dies with the old password. The caller keeps
+         * working by being handed a fresh token in the same response, so a
+         * driver who changes their password mid-shift is not signed out of the
+         * device in their hand.
+         */
+        $user->tokens()->delete();
+        $token = $user->createToken($request->input('device_name', 'navigator'));
+
+        return response()->json([
+            'status' => 'ok',
+            'token'  => $token->plainTextToken,
+        ]);
+    }
+
+    /**
+     * Send a password reset code to a driver who cannot sign in.
+     *
+     * Answers identically whether or not the identity exists: a reset endpoint
+     * that 404s on an unknown phone number is a way to enumerate a company's
+     * drivers.
+     */
+    public function forgotPassword(Request $request)
+    {
+        $identity = $request->input('identity');
+        if (!$identity) {
+            return response()->apiError('Identity is required.', 400);
+        }
+
+        $user = static::findDriverUserByIdentity($identity);
+        if (!$user) {
+            return response()->json(['status' => 'ok']);
+        }
+
+        try {
+            static::sendResetCode($user, $identity);
+        } catch (\Throwable $e) {
+            return response()->apiError(static::debugEnabled() ? $e->getMessage() : 'Unable to send reset code.');
+        }
+
+        return response()->json(['status' => 'ok']);
+    }
+
+    /**
+     * Set a new password using a code sent by forgotPassword().
+     */
+    public function resetPassword(Request $request)
+    {
+        $identity = $request->input('identity');
+        $code     = $request->input('code');
+        $password = $request->input('password');
+
+        if (!$identity || !$code || !$password) {
+            return response()->apiError('identity, code, and password are required.', 400);
+        }
+
+        if (strlen($password) < 8) {
+            return response()->apiError('Password must be at least 8 characters.', 400);
+        }
+
+        $user = static::findDriverUserByIdentity($identity);
+        if (!$user) {
+            return response()->apiError('Invalid or expired reset code.', 422);
+        }
+
+        $verification = static::findResetCode($user, $code);
+
+        if (!$verification) {
+            // One message for a wrong code, an expired code and an unknown
+            // identity alike.
+            return response()->apiError('Invalid or expired reset code.', 422);
+        }
+
+        $user->password = $password;
+        $user->save();
+
+        $verification->delete();
+        $user->tokens()->delete();
+
+        return response()->json(['status' => 'ok']);
+    }
+
+    /** Whether the application is in debug mode, so an error may be echoed. */
+    protected static function debugEnabled(): bool
+    {
+        return app()->hasDebugModeEnabled();
+    }
+
+    /**
+     * Load a driver's user account with every column.
+     *
+     * The `user` relation selects a named subset of columns, and `password` is
+     * not among them — reading it through the relation yields an empty string,
+     * so a password comparison would fail for everyone regardless of what they
+     * typed. Anything checking a password has to load the record itself.
+     */
+    protected static function findDriverUserRecord(Driver $driver): ?User
+    {
+        if (!$driver->user_uuid) {
+            return null;
+        }
+
+        return User::where('uuid', $driver->user_uuid)->first();
+    }
+
+    /** Whether a plaintext password matches the stored hash. */
+    protected static function passwordMatches(User $user, string $plain): bool
+    {
+        return Hash::check($plain, $user->password);
+    }
+
+    /** The unexpired reset code for this user, if the one supplied matches. */
+    protected static function findResetCode(User $user, string $code)
+    {
+        return VerificationCode::where([
+            'subject_uuid' => $user->uuid,
+            'code'         => $code,
+            'for'          => 'driver_password_reset',
+        ])->where('expires_at', '>', now())->first();
+    }
+
+    /** Sends the reset code by whichever channel the identity names. */
+    protected static function sendResetCode(User $user, string $identity): void
+    {
+        // if/else rather than an early return: a `return` sitting after a call
+        // that can throw is a line no test can reach.
+        if (Utils::isEmail($identity)) {
+            VerificationCode::generateEmailVerificationFor($user, 'driver_password_reset', [
+                'subject'         => config('app.name') . ' password reset',
+                'messageCallback' => fn ($v) => 'Your ' . config('app.name') . ' password reset code is ' . $v->code,
+            ]);
+        } else {
+            VerificationCode::generateSmsVerificationFor($user, 'driver_password_reset', [
+                'messageCallback' => fn ($v) => 'Your ' . config('app.name') . ' password reset code is ' . $v->code,
+            ]);
+        }
+    }
+
+    /** Resolve a driver's user account from an email address or a phone number. */
+    protected static function findDriverUserByIdentity(string $identity): ?User
+    {
+        $isEmail = Utils::isEmail($identity);
+        $column  = $isEmail ? 'email' : 'phone';
+        $value   = $isEmail ? $identity : static::phone($identity);
+
+        return User::whereHas('driver')->where($column, $value)->first();
+    }
 }

package/server/src/Http/Controllers/Api/v1/GeofenceController.php

@@ -4,6 +4,7 @@ namespace Fleetbase\FleetOps\Http\Controllers\Api\v1;
 
 use Fleetbase\FleetOps\Models\GeofenceEventLog;
 use Fleetbase\FleetOps\Support\Utils;
+use Fleetbase\FleetOps\Models\Driver;
 use Fleetbase\Http\Controllers\Controller;
 use Illuminate\Http\JsonResponse;
 use Illuminate\Http\Request;
@@ -201,13 +202,22 @@ class GeofenceController extends Controller
      *
      * Returns the geofence event history for a specific driver.
      */
-    public function driverHistory(Request $request, string $driverUuid): JsonResponse
+    public function driverHistory(Request $request, string $driverId): JsonResponse
     {
         $companyUuid = session('company');
         $perPage     = min((int) $request->input('per_page', 50), 200);
 
+        // Addressed by public_id, like every other public endpoint. The route parameter
+        // was named driverUuid and matched against driver_uuid directly, so this was the
+        // one place in the public API asking a caller for an internal identifier — which
+        // the API does not hand out in the first place, making it unusable.
+        $driver = $this->findDriverForHistory($driverId);
+        if (!$driver) {
+            return response()->json(['error' => 'Driver resource not found.'], 404);
+        }
+
         $events = $this->geofenceEventLogQuery($companyUuid)
-            ->where('driver_uuid', $driverUuid)
+            ->where('driver_uuid', $driver->uuid)
             ->with(['driver.vehicle', 'vehicle', 'order'])
             ->orderBy('occurred_at', 'desc')
             ->paginate($perPage);
@@ -217,6 +227,28 @@ class GeofenceController extends Controller
         return response()->json($events);
     }
 
+    /**
+     * Resolve the driver a history request addresses.
+     *
+     * Public callers use the public_id, like every other v1 endpoint. The console reaches
+     * the same method through the internal route with a uuid, so that is accepted there
+     * and ONLY there — the public contract stays public_id-only rather than quietly
+     * taking either.
+     *
+     * A seam, like geofenceEventLogQuery above, so the contract tests can drive this
+     * without a database.
+     */
+    protected function findDriverForHistory(string $driverId): ?Driver
+    {
+        $driver = Driver::where('public_id', $driverId)->first();
+
+        if (!$driver && \Fleetbase\Support\Http::isInternalRequest()) {
+            $driver = Driver::where('uuid', $driverId)->first();
+        }
+
+        return $driver;
+    }
+
     protected function serializeEvent(GeofenceEventLog $event): array
     {
         $driver      = $event->driver;

package/server/src/Http/Controllers/Api/v1/ManifestController.php

@@ -0,0 +1,250 @@
+<?php
+
+namespace Fleetbase\FleetOps\Http\Controllers\Api\v1;
+
+use Fleetbase\FleetOps\Http\Resources\v1\Manifest as ManifestResource;
+use Fleetbase\FleetOps\Http\Resources\v1\ManifestStop as ManifestStopResource;
+use Fleetbase\FleetOps\Models\Driver;
+use Fleetbase\FleetOps\Models\Manifest;
+use Fleetbase\FleetOps\Models\ManifestStop;
+use Fleetbase\FleetOps\Support\Utils;
+use Fleetbase\Http\Controllers\Controller;
+use Illuminate\Http\Request;
+
+/**
+ * Driver-facing manifests.
+ *
+ * A manifest is a driver's route: an order-agnostic sequence of stops, which
+ * may span several orders or none the driver has seen as an order. Everything a
+ * driver app needs to *run* a route lived only behind the console's internal
+ * namespace, so a driver could be assigned a route they had no way to read.
+ *
+ * These endpoints are deliberately narrow. A driver may read their own
+ * manifests, update the stops on them, and re-sequence the ones they have not
+ * done yet. They may not create, cancel or delete a manifest — that is dispatch
+ * work, and it stays on the internal namespace.
+ */
+class ManifestController extends Controller
+{
+    /**
+     * GET /v1/drivers/{id}/manifests.
+     *
+     * Defaults to what a driver actually needs on shift — today and anything
+     * still unfinished — rather than their whole history, which on a busy fleet
+     * is thousands of rows nobody asked for.
+     */
+    public function forDriver(Request $request, string $id)
+    {
+        $driver = static::findDriverRecord($id);
+        if (!$driver) {
+            return response()->apiError('Driver resource not found.', 404);
+        }
+
+        $query = static::manifestsFor($driver);
+
+        if ($request->filled('status')) {
+            $query->whereIn('status', Utils::arrayFrom($request->input('status')));
+        }
+
+        if ($request->filled('on')) {
+            $query->whereDate('scheduled_date', $request->input('on'));
+        }
+
+        return ManifestResource::collection($query->limit((int) $request->input('limit', 30))->get());
+    }
+
+    /**
+     * GET /v1/manifests/{id} — the route, with its stops in sequence.
+     */
+    public function show(string $id)
+    {
+        $manifest = static::findManifest($id);
+        if (!$manifest) {
+            return response()->apiError('Manifest resource not found.', 404);
+        }
+
+        $manifest->load(['driver', 'vehicle', 'stops' => fn ($q) => $q->orderBy('sequence')->with(['place', 'order.trackingNumber'])]);
+
+        return new ManifestResource($manifest);
+    }
+
+    /**
+     * PATCH /v1/manifest-stops/{id}.
+     *
+     * Status changes go through the model's own transitions rather than being
+     * written as a column, because arriving and completing carry side effects —
+     * timestamps, and the manifest completing itself once its last stop does.
+     */
+    public function updateStop(Request $request, string $id)
+    {
+        $stop = static::findStop($id);
+        if (!$stop) {
+            return response()->apiError('Manifest stop resource not found.', 404);
+        }
+
+        $status = $request->input('status');
+        if ($status) {
+            // Checked before it is applied: an unknown status must change
+            // nothing, not fall through a match and then be refused.
+            if (!in_array($status, ['arrived', 'completed', 'skipped'], true)) {
+                return response()->apiError('Status must be one of: arrived, completed, skipped.', 422);
+            }
+
+            match ($status) {
+                'arrived'   => $stop->markArrived(),
+                'completed' => $stop->markCompleted(),
+                default     => $stop->markSkipped(),
+            };
+        }
+
+        if ($request->filled('meta')) {
+            $stop->update(['meta' => $request->input('meta')]);
+        }
+
+        $stop->load(['place', 'order.trackingNumber']);
+
+        return new ManifestStopResource($stop);
+    }
+
+    /**
+     * POST /v1/manifests/{id}/optimize — re-sequence the stops still to do.
+     *
+     * This is the *driver's* optimise, not the orchestrator's. The orchestrator
+     * allocates orders across a fleet and produces manifests; this reorders the
+     * stops on one manifest that is already assigned, which is a different job
+     * with a different owner.
+     *
+     * **It is a nearest-neighbour heuristic, not a solved routing problem.** It
+     * walks from the driver's current position to the closest remaining stop,
+     * then to the closest from there, by straight-line distance. That is
+     * typically a large improvement over an arbitrary order and is not
+     * guaranteed optimal; calling it anything stronger would be a claim the
+     * implementation does not support. Completed and skipped stops keep their
+     * place — a route already driven is not re-planned.
+     */
+    public function optimize(Request $request, string $id)
+    {
+        $manifest = static::findManifest($id);
+        if (!$manifest) {
+            return response()->apiError('Manifest resource not found.', 404);
+        }
+
+        $manifest->load(['stops' => fn ($q) => $q->orderBy('sequence')->with('place')]);
+
+        $done    = $manifest->stops->filter(fn ($s) => in_array($s->status, ['completed', 'skipped'], true))->values();
+        $pending = $manifest->stops->reject(fn ($s) => in_array($s->status, ['completed', 'skipped'], true))->values();
+
+        if ($pending->count() < 3) {
+            // Two stops have only one order, and one has none. Re-sequencing
+            // either is work with no possible result.
+            return $this->show($id);
+        }
+
+        $from = $request->filled(['latitude', 'longitude'])
+            ? ['lat' => (float) $request->input('latitude'), 'lon' => (float) $request->input('longitude')]
+            : static::coordinatesOf($pending->first());
+
+        $remaining = $pending->all();
+        $ordered   = [];
+
+        while (count($remaining)) {
+            $closestIndex = 0;
+            $closestCost  = null;
+
+            foreach ($remaining as $index => $stop) {
+                $to = static::coordinatesOf($stop);
+                if (!$from || !$to) {
+                    continue;
+                }
+
+                $cost = static::distanceBetween($from, $to);
+
+                if ($closestCost === null || $cost < $closestCost) {
+                    $closestCost  = $cost;
+                    $closestIndex = $index;
+                }
+            }
+
+            $next      = $remaining[$closestIndex];
+            $ordered[] = $next;
+            $from      = static::coordinatesOf($next) ?? $from;
+            unset($remaining[$closestIndex]);
+            $remaining = array_values($remaining);
+        }
+
+        // Done stops keep the front of the sequence; the rest follow in the new
+        // order. Sequence stays dense so nothing downstream has to cope with
+        // gaps.
+        $sequence = 1;
+        foreach ($done as $stop) {
+            $stop->update(['sequence' => $sequence++]);
+        }
+        foreach ($ordered as $stop) {
+            $stop->update(['sequence' => $sequence++]);
+        }
+
+        return $this->show($id);
+    }
+
+    /** The driver's manifests, newest first. Separated so it can be stubbed. */
+    protected static function manifestsFor(Driver $driver)
+    {
+        return Manifest::where('driver_uuid', $driver->uuid)
+            ->with(['driver', 'vehicle'])
+            ->orderBy('scheduled_date', 'desc');
+    }
+
+    protected static function findDriverRecord(string $id): ?Driver
+    {
+        return Driver::where('public_id', $id)->orWhere('uuid', $id)->first();
+    }
+
+    protected static function findManifest(string $id): ?Manifest
+    {
+        return Manifest::where('public_id', $id)->orWhere('uuid', $id)->first();
+    }
+
+    protected static function findStop(string $id): ?ManifestStop
+    {
+        return ManifestStop::where('public_id', $id)->orWhere('uuid', $id)->first();
+    }
+
+    /**
+     * Straight-line distance between two coordinates, in metres.
+     *
+     * Deliberately not a routing call. A nearest-neighbour walk compares every
+     * remaining stop at every step, so a twenty-stop route asks roughly four
+     * hundred distance questions — as road lookups that is four hundred network
+     * round trips for one tap, which is not a thing to do on a handset waiting
+     * on a driver.
+     *
+     * Straight-line ordering and road ordering rarely disagree about which of
+     * several stops is nearest, and where they do the result is still a valid
+     * route, just not the shortest one. Since the method is a heuristic either
+     * way, the cheap version is the honest choice.
+     */
+    protected static function distanceBetween(array $from, array $to): float
+    {
+        $earthRadius = 6371000.0;
+
+        $lat1 = deg2rad($from['lat']);
+        $lat2 = deg2rad($to['lat']);
+        $dLat = $lat2 - $lat1;
+        $dLon = deg2rad($to['lon'] - $from['lon']);
+
+        $a = sin($dLat / 2) ** 2 + cos($lat1) * cos($lat2) * sin($dLon / 2) ** 2;
+
+        return $earthRadius * 2 * atan2(sqrt($a), sqrt(1 - $a));
+    }
+
+    /** Latitude and longitude of a stop's place, when it has one. */
+    protected static function coordinatesOf(?ManifestStop $stop): ?array
+    {
+        $location = data_get($stop, 'place.location');
+        if (!$location) {
+            return null;
+        }
+
+        return ['lat' => (float) $location->getLat(), 'lon' => (float) $location->getLng()];
+    }
+}

package/server/src/Http/Controllers/Api/v1/NavigatorController.php

@@ -10,25 +10,21 @@ use Illuminate\Http\JsonResponse;
 class NavigatorController extends Controller
 {
     /**
-     * Retrieve the driver onboard settings.
+     * Retrieve the driver onboard settings for an organization.
      *
-     * This method retrieves the driver onboard settings for the current company session. If no company session
-     * is found in the request, an error response is returned. The method retrieves the company ID from the session,
-     * then fetches the saved driver onboard settings. If settings for the current company are found, they are returned,
-     * otherwise, default settings are provided.
-     *
-     * @return JsonResponse
-     */
-
-    /**
-     * Retrieve driver onboard settings.
+     * The organization is resolved from its public id. An unknown public id is a client
+     * error, not a server error, so it answers 404 rather than dereferencing a null company.
      *
      * @return JsonResponse
      */
     public function getDriverOnboardSettings($companyId)
     {
-        $company                = $this->findCompanyByPublicId($companyId);
-        $driverOnboardSettings  = $this->driverOnboardSetting($company->uuid);
+        $company = $this->findCompanyByPublicId($companyId);
+        if (!$company) {
+            return $this->errorResponse('Organization not found.', 404);
+        }
+
+        $driverOnboardSettings = $this->driverOnboardSetting($company->uuid);
         if (!$driverOnboardSettings) {
             $driverOnboardSettings = [];
         }
@@ -50,4 +46,9 @@ class NavigatorController extends Controller
     {
         return response()->json($payload);
     }
+
+    protected function errorResponse(string $message, int $statusCode): JsonResponse
+    {
+        return response()->error($message, $statusCode);
+    }
 }