@fleetbase/fleetops-engine 0.6.59 → 0.6.61

package/server/src/Http/Controllers/Api/v1/TrackingNumberController.php

@@ -200,7 +200,16 @@ class TrackingNumberController extends Controller
             }
         }
 
-        return Utils::findModel($tables, $where);
+        // No raw-row fallback. Utils::findModel() was called with the ARRAY of table names
+        // and, when nothing matched, passed that array to DB::table() — which stringified
+        // it to the literal table name "Array" and threw SQLSTATE[42S02]. Every
+        // unresolvable code became a 500 instead of the 400 this method's caller already
+        // handles.
+        //
+        // The fallback could not have helped anyway: qrModelResource() serializes through
+        // a typed resource keyed on the model class, and a raw stdClass row has none. The
+        // mapped models above are the endpoint's whole contract.
+        return null;
     }
 
     protected function qrModelResource($model)

package/server/src/Http/Controllers/Api/v1/VehicleController.php

@@ -352,6 +352,12 @@ class VehicleController extends Controller
         return $request->only([
             'status', 'make', 'model', 'year', 'trim', 'type', 'plate_number', 'vin',
             'meta', 'online', 'location', 'altitude', 'heading', 'speed',
+            // Odometer is fillable on the model and unrestricted by the request
+            // rules, but was absent here — so a caller sending one received a
+            // 200 and a response body that looked correct while the reading was
+            // discarded. Recording mileage is the single most common write a
+            // driver app makes against a vehicle.
+            'odometer', 'odometer_unit',
             'payload_capacity', 'payload_capacity_volume',
             'payload_capacity_pallets', 'payload_capacity_parcels',
             'skills', 'max_tasks', 'time_window_start', 'time_window_end', 'return_to_depot',

package/server/src/Http/Controllers/Concerns/ResolvesReviewAccountBypass.php

@@ -0,0 +1,62 @@
+<?php
+
+namespace Fleetbase\FleetOps\Http\Controllers\Concerns;
+
+use Illuminate\Support\Facades\Log;
+
+/**
+ * Accepts a fixed verification code, but only for explicitly designated accounts.
+ *
+ * App store reviewers cannot receive our SMS or email, so a fixed code has to keep
+ * working for them — including in production, which is where a review build is
+ * tested. Refusing the bypass outside production made review impossible; refusing
+ * it for everyone except named accounts keeps review working while removing the
+ * real hazard, which was that anyone holding the code could authenticate as any
+ * driver or customer.
+ */
+trait ResolvesReviewAccountBypass
+{
+    /**
+     * @param string      $codeKey     config key holding the bypass code
+     * @param string      $accountsKey config key holding the allowlisted identities
+     * @param string|null $identity    identity being authenticated, already normalised
+     * @param string|null $code        submitted verification code
+     * @param string      $channel     label for the audit log entry
+     */
+    protected static function reviewAccountBypassMatches(
+        string $codeKey,
+        string $accountsKey,
+        ?string $identity,
+        ?string $code,
+        string $channel,
+    ): bool {
+        $bypassCode = config($codeKey);
+
+        // `!== null && !== ''` rather than `!empty()`: `!empty('0')` is false, so a
+        // configured code of "0" would otherwise be silently ignored.
+        if ($bypassCode === null || $bypassCode === '' || $code === null || $code === '' || $identity === null || $identity === '') {
+            return false;
+        }
+
+        $accounts = array_map(
+            static fn ($account) => strtolower(trim((string) $account)),
+            (array) config($accountsKey, [])
+        );
+
+        if (!in_array(strtolower(trim($identity)), $accounts, true)) {
+            return false;
+        }
+
+        // Constant-time, so a wrong code cannot be recovered by timing the response.
+        if (!hash_equals((string) $bypassCode, (string) $code)) {
+            return false;
+        }
+
+        Log::warning('[Fleetbase] Verification bypass accepted for a review account.', [
+            'channel'  => $channel,
+            'identity' => $identity,
+        ]);
+
+        return true;
+    }
+}

package/server/src/Http/Controllers/Internal/v1/DriverController.php

@@ -665,7 +665,7 @@ class DriverController extends FleetOpsController
 
         // Find and verify code
         $verificationCode = static::verificationCodeExists($user, $code, $for);
-        if (!$verificationCode && $code !== config('fleetops.navigator.bypass_verification_code')) {
+        if (!$verificationCode && !ApiDriverController::verificationBypassMatches($identity, $code)) {
             return response()->error('Invalid verification code!');
         }
 

package/server/src/Http/Controllers/Internal/v1/SettingController.php

@@ -328,6 +328,8 @@ class SettingController extends Controller
     {
         $defaults = [
             'mapProvider'                 => 'leaflet',
+            'leafletTileUrl'              => '',
+            'leafletDarkTileUrl'          => '',
             'googleMapsMapType'           => 'roadmap',
             'showGoogleMapsTrafficLayer'  => false,
             'showGoogleMapsTransitLayer'  => false,
@@ -418,12 +420,32 @@ class SettingController extends Controller
         return [
             ...$settings,
             'mapProvider'                => $mapProvider,
+            'leafletTileUrl'             => $this->sanitizeTileUrl(data_get($settings, 'leafletTileUrl', '')),
+            'leafletDarkTileUrl'         => $this->sanitizeTileUrl(data_get($settings, 'leafletDarkTileUrl', '')),
             'googleMapsMapType'          => $googleMapsMapType,
             'showGoogleMapsTrafficLayer' => filter_var(data_get($settings, 'showGoogleMapsTrafficLayer', false), FILTER_VALIDATE_BOOLEAN),
             'showGoogleMapsTransitLayer' => filter_var(data_get($settings, 'showGoogleMapsTransitLayer', false), FILTER_VALIDATE_BOOLEAN),
         ];
     }
 
+    /**
+     * Sanitize a Leaflet XYZ tile URL template — only http(s) URLs are accepted,
+     * anything else is discarded so the frontend falls back to the default tiles.
+     */
+    protected function sanitizeTileUrl($url): string
+    {
+        if (!is_string($url)) {
+            return '';
+        }
+
+        $url = trim($url);
+        if ($url === '' || !preg_match('/^https?:\/\//i', $url)) {
+            return '';
+        }
+
+        return $url;
+    }
+
     /**
      * Retrieve driver scheduling settings for the current company.
      *

package/server/src/Http/Filter/FuelReportFilter.php

@@ -86,6 +86,35 @@ class FuelReportFilter extends Filter
         });
     }
 
+    /**
+     * Aliases for {@see driver()}.
+     *
+     * The base filter resolves a query parameter to a method of the same name
+     * and **silently ignores anything it cannot match**. So a client scoping a
+     * list with `driver_uuid` — the column's own name, and the name every other
+     * part of the payload uses — matched nothing, the filter was dropped, and
+     * the response came back scoped only by company: every driver's records,
+     * with a 200 and no indication that the request had been narrowed at all.
+     *
+     * For a driver app that is a disclosure, not a nuisance: a driver asking
+     * for their own fuel reports received the whole company's.
+     */
+    public function driverUuid(?string $driver)
+    {
+        $this->driver($driver);
+    }
+
+    public function driverAssigned(?string $driver)
+    {
+        $this->driver($driver);
+    }
+
+    /** Alias for {@see vehicle()}, for the same reason. */
+    public function vehicleUuid(?string $vehicle)
+    {
+        $this->vehicle($vehicle);
+    }
+
     public function vehicle(?string $vehicle)
     {
         $this->builder->whereHas('vehicle', function ($q) use ($vehicle) {

package/server/src/Http/Filter/IssueFilter.php

@@ -88,6 +88,35 @@ class IssueFilter extends Filter
         });
     }
 
+    /**
+     * Aliases for {@see driver()}.
+     *
+     * The base filter resolves a query parameter to a method of the same name
+     * and **silently ignores anything it cannot match**. So a client scoping a
+     * list with `driver_uuid` — the column's own name, and the name every other
+     * part of the payload uses — matched nothing, the filter was dropped, and
+     * the response came back scoped only by company: every driver's records,
+     * with a 200 and no indication that the request had been narrowed at all.
+     *
+     * For a driver app that is a disclosure, not a nuisance: a driver asking
+     * for their own fuel reports received the whole company's.
+     */
+    public function driverUuid(?string $driver)
+    {
+        $this->driver($driver);
+    }
+
+    public function driverAssigned(?string $driver)
+    {
+        $this->driver($driver);
+    }
+
+    /** Alias for {@see vehicle()}, for the same reason. */
+    public function vehicleUuid(?string $vehicle)
+    {
+        $this->vehicle($vehicle);
+    }
+
     public function vehicle(?string $vehicle)
     {
         $this->builder->whereHas('vehicle', function ($q) use ($vehicle) {

package/server/src/Http/Filter/MaintenanceScheduleFilter.php

@@ -0,0 +1,40 @@
+<?php
+
+namespace Fleetbase\FleetOps\Http\Filter;
+
+use Fleetbase\FleetOps\Support\Utils;
+use Fleetbase\Http\Filter\Filter;
+use Illuminate\Support\Str;
+
+class MaintenanceScheduleFilter extends Filter
+{
+    public function queryForInternal(): void
+    {
+        $this->builder->where('company_uuid', $this->session->get('company'));
+    }
+
+    public function queryForPublic(): void
+    {
+        $this->queryForInternal();
+    }
+
+    public function subjectType(?string $subjectType): void
+    {
+        if (!$subjectType) {
+            return;
+        }
+
+        if (!Str::contains($subjectType, ['\\', ':'])) {
+            $subjectType = 'fleet-ops:' . $subjectType;
+        }
+
+        $this->builder->where('subject_type', Utils::getMutationType($subjectType));
+    }
+
+    public function subjectUuid(?string $subjectUuid): void
+    {
+        if ($subjectUuid) {
+            $this->builder->where('subject_uuid', $subjectUuid);
+        }
+    }
+}

package/server/src/Http/Requests/CreateCustomerRequest.php

@@ -23,7 +23,15 @@ class CreateCustomerRequest extends FleetbaseRequest
     {
         return [
             'identity' => 'required|string',
-            'code'     => 'required|exists:verification_codes,code',
+            // Presence only — authorizing the code is the controller's job, and its
+            // check is strictly stronger: it matches code + for + meta->identity,
+            // whereas `exists:verification_codes,code` accepts any live code issued
+            // for any purpose to any user. The rule is also already unenforced on the
+            // proxy path, since verifyCode() with for=fleetops_create_customer calls
+            // create(CreateCustomerRequest::createFrom($request)), which never runs
+            // validateResolved(). Keeping it here only blocks the configured
+            // non-production testing bypass (fleetops.customers.verification_bypass_code).
+            'code'     => 'required|string',
             'name'     => 'required|string',
             'password' => 'required|string|min:8',
             'email'    => [

package/server/src/Http/Requests/CreateFuelReportRequest.php

@@ -19,10 +19,21 @@ class CreateFuelReportRequest extends FleetbaseRequest
      */
     public function rules(): array
     {
+        // requiredIf(POST), not required: UpdateFuelReportRequest extends this class, so a
+        // flat `required` made every partial update fail — PUT /v1/fuel-reports/{id} with
+        // just {"status": "approved"} answered "The driver field is required."
+        //
+        // `driver` is the clearest case: the update action's $request->only() list does not
+        // even include it, so validation demanded a field the endpoint then discarded.
+        // CreateFuelTransactionRequest solves the same create/update inheritance with
+        // Rule::requiredIf(isMethod('POST')); a plain conditional is used here because
+        // illuminate/validation is not autoloadable in the package's test harness.
+        $requiredOnCreate = $this->isMethod('POST') ? ['required'] : ['sometimes'];
+
         return [
-            'driver'          => ['required'],
-            'odometer'        => ['required'],
-            'volume'          => ['required'],
+            'driver'          => $requiredOnCreate,
+            'odometer'        => $requiredOnCreate,
+            'volume'          => $requiredOnCreate,
             'metric_unit'     => ['nullable'],
             'location'        => ['nullable'],
             'amount'          => ['nullable'],

package/server/src/Http/Requests/CreateFuelTransactionRequest.php

@@ -2,6 +2,7 @@
 
 namespace Fleetbase\FleetOps\Http\Requests;
 
+use Fleetbase\FleetOps\Models\FuelProviderTransaction;
 use Fleetbase\Http\Requests\FleetbaseRequest;
 use Illuminate\Validation\Rule;
 
@@ -16,7 +17,7 @@ class CreateFuelTransactionRequest extends FleetbaseRequest
     {
         return [
             'provider'                => [Rule::requiredIf($this->isMethod('POST')), 'string'],
-            'provider_transaction_id' => [Rule::requiredIf($this->isMethod('POST')), 'string'],
+            'provider_transaction_id' => [Rule::requiredIf($this->isMethod('POST')), 'string', $this->uniqueProviderTransactionIdRule()],
             'connection'              => ['nullable', 'string'],
             'fuel_report'             => ['nullable', 'string'],
             'vehicle'                 => ['nullable', 'string'],
@@ -47,4 +48,66 @@ class CreateFuelTransactionRequest extends FleetbaseRequest
             'meta'                    => ['nullable', 'array'],
         ];
     }
+
+    public function messages(): array
+    {
+        return [
+            'provider_transaction_id.unique' => 'A fuel transaction with this provider transaction id already exists for this provider.',
+        ];
+    }
+
+    /**
+     * Mirrors the fuel_provider_txn_company_provider_unique index.
+     *
+     * Provider transaction ids are natural idempotency keys, so a re-sent batch
+     * used to raise an unhandled UniqueConstraintViolationException — an HTTP 500
+     * rather than a duplicate signal the client could act on.
+     *
+     * @return \Illuminate\Validation\Rules\Unique
+     */
+    protected function uniqueProviderTransactionIdRule()
+    {
+        $provider = $this->resolveProvider();
+
+        $rule = Rule::unique('fuel_provider_transactions', 'provider_transaction_id')
+            ->where(function ($query) use ($provider) {
+                $query->where('company_uuid', session('company'));
+                $query->where('provider', $provider);
+
+                return $query->whereNull('deleted_at');
+            });
+
+        // On PUT the record re-sends its own provider_transaction_id. The v1 route
+        // parameter is a public_id (fuel_provider_transaction_xxxxx), not a uuid.
+        $id = $this->route('id');
+        if (!$this->isMethod('POST') && filled($id)) {
+            $rule->ignore($id, 'public_id');
+        }
+
+        return $rule;
+    }
+
+    /**
+     * The uniqueness scope is per provider, but `provider` is only required on
+     * POST — a PUT may change the transaction id while leaving the provider out of
+     * the body. Fall back to the stored value so the scope is never null, which
+     * would otherwise compare against the wrong set of rows.
+     */
+    protected function resolveProvider(): ?string
+    {
+        if ($this->filled('provider')) {
+            return $this->input('provider');
+        }
+
+        $id = $this->route('id');
+        if (blank($id)) {
+            return null;
+        }
+
+        return FuelProviderTransaction::where('company_uuid', session('company'))
+            ->where(function ($query) use ($id) {
+                $query->where('public_id', $id)->orWhere('uuid', $id);
+            })
+            ->value('provider');
+    }
 }

package/server/src/Http/Requests/CreatePartRequest.php

@@ -15,7 +15,7 @@ class CreatePartRequest extends FleetbaseRequest
     public function rules(): array
     {
         return [
-            'sku'              => ['nullable', 'string'],
+            'sku'              => ['nullable', 'string', $this->uniqueSkuRule()],
             'name'             => [Rule::requiredIf($this->isMethod('POST')), 'string'],
             'manufacturer'     => ['nullable', 'string'],
             'model'            => ['nullable', 'string'],
@@ -37,4 +37,42 @@ class CreatePartRequest extends FleetbaseRequest
             'meta'             => ['nullable', 'array'],
         ];
     }
+
+    public function messages(): array
+    {
+        return [
+            'sku.unique' => 'A part with this SKU already exists.',
+        ];
+    }
+
+    /**
+     * Mirrors the parts_company_uuid_active_sku_unique index.
+     *
+     * Without this rule a duplicate SKU reached the driver and came back as an
+     * unhandled UniqueConstraintViolationException — an HTTP 500 with no field
+     * attribution, since public v1 controllers have no QueryException catch.
+     *
+     * `nullable` runs first, so this never fires on a null SKU; that matches the
+     * nullable column and MySQL's tolerance of repeated NULLs in a unique index.
+     *
+     * @return \Illuminate\Validation\Rules\Unique
+     */
+    protected function uniqueSkuRule()
+    {
+        $rule = Rule::unique('parts', 'sku')
+            ->where(function ($query) {
+                $query->where('company_uuid', session('company'));
+
+                return $query->whereNull('deleted_at');
+            });
+
+        // On PUT the record re-sends its own SKU, so it must not collide with
+        // itself. The v1 route parameter is a public_id (part_xxxxx), not a uuid.
+        $id = $this->route('id');
+        if (!$this->isMethod('POST') && filled($id)) {
+            $rule->ignore($id, 'public_id');
+        }
+
+        return $rule;
+    }
 }

package/server/src/Http/Requests/CreateVehicleRequest.php

@@ -46,11 +46,16 @@ class CreateVehicleRequest extends FleetbaseRequest
                     'decommissioned',
                 ]),
             ],
-            'vendor'    => 'nullable|exists:vendors,public_id',
-            'driver'    => 'nullable|exists:drivers,public_id',
-            'location'  => ['nullable', new ResolvablePoint()],
-            'latitude'  => ['nullable', 'required_with:longitude'],
-            'longitude' => ['nullable', 'required_with:latitude'],
+            // Validated rather than merely accepted: the model casts odometer
+            // to an integer, so an unchecked string would be stored as 0 — a
+            // vehicle reporting zero miles rather than an error.
+            'odometer'      => 'nullable|numeric|min:0',
+            'odometer_unit' => 'nullable|string|max:12',
+            'vendor'        => 'nullable|exists:vendors,public_id',
+            'driver'        => 'nullable|exists:drivers,public_id',
+            'location'      => ['nullable', new ResolvablePoint()],
+            'latitude'      => ['nullable', 'required_with:longitude'],
+            'longitude'     => ['nullable', 'required_with:latitude'],
         ];
     }
 }

package/server/src/Http/Resources/v1/Manifest.php

@@ -0,0 +1,52 @@
+<?php
+
+namespace Fleetbase\FleetOps\Http\Resources\v1;
+
+use Fleetbase\Http\Resources\FleetbaseResource;
+use Fleetbase\Support\Http;
+
+/**
+ * Public projection of a Manifest — a driver's route for a day.
+ *
+ * A manifest is order-agnostic: it is a sequence of stops, which may belong to
+ * several orders or to none the driver has ever seen as an order. That is why
+ * this exposes the stops directly rather than making a consumer assemble them
+ * from orders.
+ *
+ * Totals ride along because a driver wants to know what the day looks like
+ * before starting it, and computing them client-side from the stop list gives a
+ * different answer than the server's own.
+ */
+class Manifest extends FleetbaseResource
+{
+    /**
+     * Transform the resource into an array.
+     *
+     * @param \Illuminate\Http\Request $request
+     */
+    public function toArray($request): array
+    {
+        return [
+            'id'               => $this->when(Http::isInternalRequest(), $this->id, $this->public_id),
+            'uuid'             => $this->when(Http::isInternalRequest(), $this->uuid),
+            'public_id'        => $this->when(Http::isInternalRequest(), $this->public_id),
+            'status'           => $this->status,
+            'scheduled_date'   => $this->scheduled_date,
+            'started_at'       => $this->started_at,
+            'completed_at'     => $this->completed_at,
+            'total_distance_m' => $this->total_distance_m,
+            'total_duration_s' => $this->total_duration_s,
+            'stop_count'       => $this->stop_count,
+            'completed_stops'  => $this->completed_stops,
+            'pending_stops'    => $this->pending_stops,
+            'driver_name'      => $this->driver_name,
+            'vehicle_name'     => $this->vehicle_name,
+            'notes'            => $this->notes,
+            // Present only when the manifest was loaded with them, so a list
+            // endpoint stays a list.
+            'stops'            => ManifestStop::collection($this->whenLoaded('stops')),
+            'updated_at'       => $this->updated_at,
+            'created_at'       => $this->created_at,
+        ];
+    }
+}

package/server/src/Http/Resources/v1/ManifestStop.php

@@ -0,0 +1,47 @@
+<?php
+
+namespace Fleetbase\FleetOps\Http\Resources\v1;
+
+use Fleetbase\Http\Resources\FleetbaseResource;
+use Fleetbase\Support\Http;
+
+/**
+ * Public projection of a ManifestStop.
+ *
+ * Carries the place inline rather than as an id. A driver app rendering a route
+ * needs a name and a coordinate for every stop, and making it resolve each one
+ * separately turns a route of twenty stops into twenty-one requests.
+ *
+ * `sequence` is the order to drive them in, and is the field a re-sequence
+ * rewrites.
+ */
+class ManifestStop extends FleetbaseResource
+{
+    /**
+     * Transform the resource into an array.
+     *
+     * @param \Illuminate\Http\Request $request
+     */
+    public function toArray($request): array
+    {
+        return [
+            'id'                   => $this->when(Http::isInternalRequest(), $this->id, $this->public_id),
+            'uuid'                 => $this->when(Http::isInternalRequest(), $this->uuid),
+            'public_id'            => $this->when(Http::isInternalRequest(), $this->public_id),
+            'status'               => $this->status,
+            'sequence'             => $this->sequence,
+            'estimated_arrival'    => $this->estimated_arrival,
+            'actual_arrival'       => $this->actual_arrival,
+            'distance_from_prev_m' => $this->distance_from_prev_m,
+            'duration_from_prev_s' => $this->duration_from_prev_s,
+            'place'                => new Place($this->whenLoaded('place')),
+            'order'                => $this->when($this->relationLoaded('order') && $this->order, fn () => [
+                'id'              => data_get($this->order, 'public_id'),
+                'tracking_number' => data_get($this->order, 'trackingNumber.tracking_number'),
+                'status'          => data_get($this->order, 'status'),
+            ]),
+            'updated_at'           => $this->updated_at,
+            'created_at'           => $this->created_at,
+        ];
+    }
+}

package/server/src/Http/Resources/v1/OrderConfig.php

@@ -41,10 +41,25 @@ class OrderConfig extends FleetbaseResource
     }
 
     /**
-     * Project the flow JSON into an ordered list of activities, keeping only
-     * the public-safe per-activity fields. `code` and `status` (the label)
-     * are the contract; `complete`, `color`, `details`, `pod_method`, and
-     * `require_pod` are useful UI hints that can ride along.
+     * Project the flow JSON into a list of activities, keeping the public-safe
+     * per-activity fields.
+     *
+     * `code` and `status` (the label) are the contract; `complete`, `color`,
+     * `details`, `pod_method` and `require_pod` are useful UI hints that ride
+     * along.
+     *
+     * `activities`, `sequence` and `logic` describe the flow's *shape*, and are
+     * published because without them the list cannot be sequenced. The stored
+     * flow is a directed graph — `activities` names the codes an activity can
+     * transition to, `sequence` orders activities reachable from the same
+     * parent, and `logic` gates availability — which is precisely what
+     * `OrderConfig::nextActivity()` walks server-side. Projecting them away
+     * left consumers with an unordered set: a client rendering progress from
+     * array position marks a dispatched order complete whenever `completed`
+     * happens to be declared earlier, and can offer no next step at all.
+     *
+     * These are descriptions of the configured workflow, not internal state, so
+     * there is nothing here a consumer of the config should not see.
      */
     protected function projectFlow(): array
     {
@@ -66,9 +81,41 @@ class OrderConfig extends FleetbaseResource
                 'complete'    => (bool) ($activity['complete'] ?? false),
                 'pod_method'  => $activity['pod_method'] ?? null,
                 'require_pod' => (bool) ($activity['require_pod'] ?? false),
+                'sequence'    => isset($activity['sequence']) ? (int) $activity['sequence'] : null,
+                'activities'  => static::projectTransitions($activity),
+                'logic'       => $activity['logic'] ?? null,
             ];
         }
 
         return $activities;
     }
+
+    /**
+     * The codes an activity can transition to, as a list of strings.
+     *
+     * Stored flows have been written both ways over time: a bare list of codes,
+     * and a list of objects carrying a `code`. Normalising here means consumers
+     * do not each have to guess which one they were handed.
+     */
+    protected static function projectTransitions(array $activity): array
+    {
+        $transitions = $activity['activities'] ?? [];
+        if (!is_array($transitions)) {
+            return [];
+        }
+
+        $codes = [];
+        foreach ($transitions as $transition) {
+            if (is_string($transition)) {
+                $codes[] = $transition;
+                continue;
+            }
+
+            if (is_array($transition) && isset($transition['code']) && is_string($transition['code'])) {
+                $codes[] = $transition['code'];
+            }
+        }
+
+        return $codes;
+    }
 }