@fleetbase/fleetops-engine 0.6.59 → 0.6.61

package/server/src/Http/Resources/v1/TrackingNumber.php

@@ -30,6 +30,17 @@ class TrackingNumber extends FleetbaseResource
             'status'          => $this->last_status,
             'status_code'     => $this->last_status_code,
             'qr_code'         => $this->qr_code,
+            // The raw text encoded inside qr_code, exposed ONLY in debug mode.
+            //
+            // qr_code is a base64 PNG generated from owner_uuid (TrackingNumber::newBarcode),
+            // and the endpoints that consume a scanned code match on that uuid. A client
+            // scans the image to obtain it; an automated contract run cannot, so debug
+            // builds publish the value beside the image rather than the API growing a
+            // decode endpoint or handing out uuids generally.
+            //
+            // `when()` omits the key entirely when false — it is absent, not null — so a
+            // production response is byte-identical to before.
+            'qr_code_content' => $this->when(static::exposesQrCodeContent(), fn () => $this->owner_uuid),
             'barcode'         => $this->barcode,
             'url'             => Utils::consoleUrl('track-order', ['order' => $this->tracking_number]),
             'type'            => Utils::getTypeFromClassName($this->owner_type),
@@ -38,6 +49,28 @@ class TrackingNumber extends FleetbaseResource
         ];
     }
 
+    /**
+     * Whether the QR code's decoded content may be published.
+     *
+     * Debug mode only, and fails closed: any failure to determine the debug state — no
+     * container, an application without the accessor — answers false rather than
+     * defaulting to exposure.
+     */
+    protected static function exposesQrCodeContent(): bool
+    {
+        try {
+            $app = app();
+
+            if (!is_object($app) || !method_exists($app, 'hasDebugModeEnabled')) {
+                return false;
+            }
+
+            return (bool) $app->hasDebugModeEnabled();
+        } catch (\Throwable $e) {
+            return false;
+        }
+    }
+
     /**
      * Transform the resource into an webhook payload.
      *

package/server/src/Models/FuelReport.php

@@ -6,6 +6,7 @@ use Fleetbase\Casts\Json;
 use Fleetbase\FleetOps\Casts\Point;
 use Fleetbase\FleetOps\Support\Utils;
 use Fleetbase\LaravelMysqlSpatial\Eloquent\SpatialTrait;
+use Fleetbase\LaravelMysqlSpatial\Types\Point as SpatialPoint;
 use Fleetbase\Models\Model;
 use Fleetbase\Models\User;
 use Fleetbase\Traits\HasApiModelBehavior;
@@ -149,6 +150,26 @@ class FuelReport extends Model
         return $this->belongsTo(User::class, 'reported_by_uuid');
     }
 
+    /**
+     * Bootstrap the model.
+     *
+     * `location` is declared nullable in CreateFuelReportRequest but the column is
+     * POINT NOT NULL, so a report created without one failed outright with
+     * SQLSTATE[HY000] 1364 "Field 'location' doesn't have a default value" — a 500 for
+     * a request the validator had just accepted. Mirrors Device and Sensor, which
+     * default their spatial columns the same way.
+     */
+    protected static function boot()
+    {
+        parent::boot();
+
+        static::creating(function (self $fuelReport) {
+            if (empty($fuelReport->location)) {
+                $fuelReport->location = new SpatialPoint(0, 0);
+            }
+        });
+    }
+
     /**
      * Get the driver's name assigned to vehicle.
      *

package/server/src/Models/Place.php

@@ -129,7 +129,7 @@ class Place extends Model
      *
      * @var array
      */
-    protected $filterParams = ['vendor', 'contact', 'vendor_uuid', 'vendor_name'];
+    protected $filterParams = ['vendor', 'contact', 'vendor_uuid', 'vendor_name', 'avatar_value', 'eta'];
 
     /**
      * @return \Illuminate\Database\Eloquent\Relations\MorphTo

package/server/src/Models/Sensor.php

@@ -147,6 +147,30 @@ class Sensor extends Model
      */
     protected $spatialFields = ['last_position'];
 
+    /**
+     * Bootstrap the model.
+     *
+     * The same migration that made devices.last_position NOT NULL did it to
+     * sensors.last_position too, but only Device got a default. Creating a sensor
+     * without a position therefore failed outright:
+     *
+     *   SQLSTATE[HY000]: General error: 1364 Field 'last_position' doesn't have a
+     *   default value
+     *
+     * Position is not something a caller has when registering a sensor, so default
+     * it to POINT(0,0) on create, exactly as Device does.
+     */
+    protected static function boot()
+    {
+        parent::boot();
+
+        static::creating(function (self $sensor) {
+            if (empty($sensor->last_position)) {
+                $sensor->last_position = new SpatialPoint(0, 0);
+            }
+        });
+    }
+
     /**
      * The attributes that should be cast to native types.
      *

package/server/src/Support/FuelProviders/FuelProviderService.php

@@ -173,8 +173,17 @@ class FuelProviderService
         return DB::transaction(function () use ($connection, $payload) {
             $provider              = $payload['provider'] ?? $connection->provider;
             $providerTransactionId = $payload['provider_transaction_id'];
+            // The match must include company_uuid. Provider transaction ids are only
+            // unique within the account they were issued for, so keying on
+            // (provider, provider_transaction_id) alone let one company's sync find
+            // and overwrite another company's transaction — reassigning its
+            // company_uuid. Mirrors fuel_provider_txn_company_provider_unique.
             $transaction           = FuelProviderTransaction::updateOrCreate(
-                ['provider' => $provider, 'provider_transaction_id' => $providerTransactionId],
+                [
+                    'company_uuid'            => $connection->company_uuid,
+                    'provider'                => $provider,
+                    'provider_transaction_id' => $providerTransactionId,
+                ],
                 array_merge($payload, [
                     'company_uuid'                  => $connection->company_uuid,
                     'fuel_provider_connection_uuid' => $connection->uuid,

package/server/src/routes.php

@@ -28,6 +28,13 @@ Route::prefix(config('fleetops.api.routing.prefix'))->namespace('Fleetbase\Fleet
                 $router->post('login-with-sms', 'DriverController@loginWithPhone');
                 $router->post('verify-code', 'DriverController@verifyCode');
                 $router->post('login', 'DriverController@login');
+                // Password management. Deliberately separate from the driver
+                // update: changing a password requires proving the old one, and
+                // resetting it requires a code, neither of which a general PUT
+                // can express.
+                $router->post('forgot-password', 'DriverController@forgotPassword');
+                $router->post('reset-password', 'DriverController@resetPassword');
+                $router->post('{id}/change-password', 'DriverController@changePassword');
                 $router->post('{id}/simulate', 'DriverController@simulate');
                 $router->match(['put', 'patch', 'post'], '{id}/track', 'DriverController@track');
                 $router->post('{id}/register-device', 'DriverController@registerDevice');
@@ -37,6 +44,8 @@ Route::prefix(config('fleetops.api.routing.prefix'))->namespace('Fleetbase\Fleet
                 $router->get('/', 'DriverController@query');
                 $router->get('{id}', 'DriverController@find');
                 $router->get('{id}/organizations', 'DriverController@listOrganizations');
+                // A driver's own routes for the day.
+                $router->get('{id}/manifests', 'ManifestController@forDriver');
                 $router->get('{id}/current-organization', 'DriverController@currentOrganization');
                 $router->put('{id}', 'DriverController@update');
                 $router->delete('{id}', 'DriverController@delete');
@@ -185,6 +194,18 @@ Route::prefix(config('fleetops.api.routing.prefix'))->namespace('Fleetbase\Fleet
                 $router->delete('{id}', 'OrderController@delete');
                 $router->get('{id}/editable-entity-fields', 'OrderController@getEditableEntityFields');
             });
+            // manifests — a driver's route. Read and run only: creating,
+            // cancelling and deleting a manifest is dispatch work and stays on
+            // the internal namespace.
+            $router->group(['prefix' => 'manifests'], function () use ($router) {
+                $router->get('{id}', 'ManifestController@show');
+                $router->post('{id}/optimize', 'ManifestController@optimize');
+            });
+            $router->group(['prefix' => 'manifest-stops'], function () use ($router) {
+                $router->patch('{id}', 'ManifestController@updateStop');
+                $router->post('{id}', 'ManifestController@updateStop');
+            });
+
             // entities routes
             $router->group(['prefix' => 'entities'], function () use ($router) {
                 $router->post('/', 'EntityController@create');
@@ -237,7 +258,7 @@ Route::prefix(config('fleetops.api.routing.prefix'))->namespace('Fleetbase\Fleet
                 $router->get('events', 'GeofenceController@events');
                 $router->get('inventory', 'GeofenceController@inventory');
                 $router->get('dwell-report', 'GeofenceController@dwellReport');
-                $router->get('driver/{driverUuid}/history', 'GeofenceController@driverHistory');
+                $router->get('driver/{driverId}/history', 'GeofenceController@driverHistory');
             });
             // service-rates routes
             $router->group(['prefix' => 'service-rates'], function () use ($router) {

package/server/tests/ApiCustomerControllerContractsTest.php

@@ -960,3 +960,171 @@ test('api customer controller handles verification delivery fallbacks and profil
             'name' => 'explode',
         ]))))->toBe(['error' => 'update failed']);
 });
+
+/**
+ * Run a callback with an app container that supports environment().
+ *
+ * The harness binds a bare Illuminate\Container\Container, which has no
+ * environment() — so CustomerController::verificationBypassMatches fatals with
+ * "Call to undefined method" without this. Mirrors the swap in
+ * NotificationAndMailContractsTest, but carries every existing binding across so
+ * the controller can still resolve config/request/db.
+ */
+function fleetopsApiCustomerWithEnvironment(string $environment, callable $callback): mixed
+{
+    $previousApp = Illuminate\Container\Container::getInstance();
+    $app         = new class extends Illuminate\Container\Container {
+        public string $fleetopsEnvironment = 'testing';
+
+        public function environment(...$environments)
+        {
+            if (empty($environments)) {
+                return $this->fleetopsEnvironment;
+            }
+
+            $environments = is_array($environments[0]) ? $environments[0] : $environments;
+
+            return in_array($this->fleetopsEnvironment, $environments, true);
+        }
+
+        public function hasDebugModeEnabled()
+        {
+            return false;
+        }
+    };
+    $app->fleetopsEnvironment = $environment;
+
+    $reflection = new ReflectionClass(Illuminate\Container\Container::class);
+    foreach (['bindings', 'instances', 'aliases', 'abstractAliases', 'resolved', 'scopedInstances'] as $property) {
+        if (!$reflection->hasProperty($property)) {
+            continue;
+        }
+        $handle = $reflection->getProperty($property);
+        $handle->setAccessible(true);
+        $handle->setValue($app, $handle->getValue($previousApp));
+    }
+
+    Illuminate\Container\Container::setInstance($app);
+
+    try {
+        return $callback();
+    } finally {
+        Illuminate\Container\Container::setInstance($previousApp);
+    }
+}
+
+test('api customer controller ignores the verification bypass unless it is configured', function () {
+    // Unset and empty-string are both inert. Without this the bypass would be a
+    // standing hole in every default install, which is the entire risk of shipping one.
+    foreach ([null, ''] as $bypassCode) {
+        config(['fleetops.customers.verification_bypass_code' => $bypassCode]);
+
+        fleetopsApiCustomerWithEnvironment('local', function () {
+            $create                     = fleetopsApiCustomerController();
+            $create->verificationExists = false;
+            $verify                     = fleetopsApiCustomerController();
+            $verify->verificationExists = false;
+            $reset                      = fleetopsApiCustomerController();
+            $reset->verificationCode    = null;
+
+            expect(fleetopsApiCustomerJson($create->create(new CreateCustomerRequest([
+                'code'     => '000000',
+                'identity' => 'jane@example.test',
+            ]))))->toBe(['error' => 'Invalid verification code provided.'])
+                ->and(fleetopsApiCustomerJson($verify->verifyCode(Request::create('/v1/customers/verify-code', 'POST', [
+                    'identity' => 'jane@example.test',
+                    'code'     => '000000',
+                ]))))->toBe(['error' => 'Invalid verification code.'])
+                ->and(fleetopsApiCustomerJson($reset->resetPassword(Request::create('/v1/customers/reset-password', 'POST', [
+                    'identity' => 'jane@example.test',
+                    'code'     => '000000',
+                    'password' => 'password-secret',
+                ]))))->toBe(['error' => 'Invalid reset code.']);
+        });
+    }
+
+    config(['fleetops.customers.verification_bypass_code' => null]);
+});
+
+test('api customer controller accepts a configured verification bypass for a listed review account', function () {
+    config([
+        'fleetops.customers.verification_bypass_code' => '000000',
+        'fleetops.customers.review_accounts'          => ['jane@example.test'],
+    ]);
+
+    // Deliberately production. App store reviewers test a release build against
+    // production, so refusing the bypass there made review impossible — that is the
+    // behaviour this replaces. Safety now comes from the allowlist, not the environment.
+    fleetopsApiCustomerWithEnvironment('production', function () {
+        $create                     = fleetopsApiCustomerController();
+        $create->verificationExists = false;
+        $verify                     = fleetopsApiCustomerController();
+        $verify->verificationExists = false;
+        // No VerificationCode row on the bypass path — resetPassword must not fatal
+        // calling ->delete() on null, and must still revoke existing sessions.
+        $reset                   = fleetopsApiCustomerController();
+        $reset->verificationCode = null;
+        // A non-matching code is still rejected while the bypass is live.
+        $wrong                     = fleetopsApiCustomerController();
+        $wrong->verificationExists = false;
+
+        expect($create->create(new CreateCustomerRequest([
+            'code'     => '000000',
+            'identity' => 'jane@example.test',
+            'name'     => 'Jane',
+            'password' => 'password-secret',
+        ])))->toMatchArray(['resource' => 'customer', 'token' => 'plain-token'])
+            ->and($verify->verifyCode(Request::create('/v1/customers/verify-code', 'POST', [
+                'identity' => 'jane@example.test',
+                'code'     => '000000',
+            ])))->toMatchArray(['resource' => 'customer', 'token' => 'plain-token'])
+            ->and(fleetopsApiCustomerJson($reset->resetPassword(Request::create('/v1/customers/reset-password', 'POST', [
+                'identity' => 'jane@example.test',
+                'code'     => '000000',
+                'password' => 'password-secret',
+            ]))))->toBe(['status' => 'ok'])
+            ->and($reset->genericUser->tokensDeleted)->toBeTrue()
+            ->and(fleetopsApiCustomerJson($wrong->create(new CreateCustomerRequest([
+                'code'     => '999999',
+                'identity' => 'jane@example.test',
+            ]))))->toBe(['error' => 'Invalid verification code provided.']);
+    });
+
+    config(['fleetops.customers.verification_bypass_code' => null, 'fleetops.customers.review_accounts' => []]);
+});
+
+test('api customer controller refuses the verification bypass for an identity that is not listed', function () {
+    // The point of the allowlist: holding the code is not sufficient. Previously
+    // anyone who learned it could authenticate as any customer.
+    foreach ([['someone-else@example.test'], []] as $reviewAccounts) {
+        config([
+            'fleetops.customers.verification_bypass_code' => '000000',
+            'fleetops.customers.review_accounts'          => $reviewAccounts,
+        ]);
+
+        fleetopsApiCustomerWithEnvironment('local', function () {
+            $create                     = fleetopsApiCustomerController();
+            $create->verificationExists = false;
+            $verify                     = fleetopsApiCustomerController();
+            $verify->verificationExists = false;
+            $reset                      = fleetopsApiCustomerController();
+            $reset->verificationCode    = null;
+
+            expect(fleetopsApiCustomerJson($create->create(new CreateCustomerRequest([
+                'code'     => '000000',
+                'identity' => 'jane@example.test',
+            ]))))->toBe(['error' => 'Invalid verification code provided.'])
+                ->and(fleetopsApiCustomerJson($verify->verifyCode(Request::create('/v1/customers/verify-code', 'POST', [
+                    'identity' => 'jane@example.test',
+                    'code'     => '000000',
+                ]))))->toBe(['error' => 'Invalid verification code.'])
+                ->and(fleetopsApiCustomerJson($reset->resetPassword(Request::create('/v1/customers/reset-password', 'POST', [
+                    'identity' => 'jane@example.test',
+                    'code'     => '000000',
+                    'password' => 'password-secret',
+                ]))))->toBe(['error' => 'Invalid reset code.']);
+        });
+    }
+
+    config(['fleetops.customers.verification_bypass_code' => null, 'fleetops.customers.review_accounts' => []]);
+});

package/server/tests/ApiDriverControllerContractsTest.php

@@ -550,6 +550,38 @@ test('api driver controller registers a device for the authenticated driver with
     ]);
 });
 
+test('api driver controller falls back to the container request when the router injects null', function () {
+    // Laravel's ResolvesRouteDependencies::transformDependency() returns null — it does
+    // NOT resolve from the container — for any class-typed parameter that declares a
+    // default value. registerDevice() has to declare one, because the internal controller
+    // delegates with an id only, so every routed call arrived with $request === null.
+    // Every other test here passes a request explicitly, which is why they stayed green
+    // while POST /v1/drivers/{id}/register-device answered 500.
+    $driver = new FleetOpsApiDriverFake();
+    $driver->setRawAttributes([
+        'uuid'      => 'driver-uuid',
+        'public_id' => 'driver_public',
+        'user_uuid' => 'user-uuid',
+    ], true);
+
+    $controller         = new FleetOpsApiDriverControllerProbe();
+    $controller->driver = $driver;
+
+    $bound = new FleetOpsApiDriverRegisterDeviceRequest(['token' => 'push-token', 'platform' => 'android']);
+    app()->instance('request', $bound);
+
+    expect($controller->registerDevice('driver_public', null))->toBe([
+        'json'   => ['device' => 'device_public'],
+        'status' => 200,
+    ])
+        ->and($controller->deviceCreates)->toBe([
+            [
+                ['token' => 'push-token', 'platform' => 'android'],
+                ['user_uuid' => 'user-uuid', 'platform' => 'android', 'token' => 'push-token', 'status' => 'active'],
+            ],
+        ]);
+});
+
 test('api driver controller reports missing driver branches', function () {
     $controller                 = new FleetOpsApiDriverControllerProbe();
     $controller->driverNotFound = true;
@@ -569,3 +601,36 @@ test('api driver controller reports missing driver branches', function () {
             'status'   => 404,
         ]);
 });
+
+test('api driver controller refuses to set a password through a general update', function () {
+    /*
+     * Regression for a takeover path: `update()` passed `password` straight
+     * through to the user, so anyone holding a driver's token — or an unlocked
+     * handset — could set a new one without proving they knew the old one, and
+     * the account was theirs. A password change is an authorisation decision
+     * and now has its own endpoint that demands the current password.
+     */
+    $user = new FleetOpsApiDriverUserFake();
+    $user->setRawAttributes(['uuid' => 'user-uuid'], true);
+    $driver = new FleetOpsApiDriverFake();
+    $driver->setRawAttributes([
+        'uuid'      => 'driver-uuid',
+        'public_id' => 'driver_public',
+        'user_uuid' => 'user-uuid',
+    ], true);
+    $driver->userForTest = $user;
+    $driver->setRelation('user', $user);
+
+    $controller                     = new FleetOpsApiDriverControllerProbe();
+    $controller->driver             = $driver;
+    $controller->sessionCompanyUuid = 'session-company-uuid';
+
+    $controller->update('driver_public', new UpdateDriverRequest([
+        'name'     => 'Driver Updated',
+        'password' => 'attacker-chosen-password',
+    ]));
+
+    expect($user->updates)->not->toBeEmpty()
+        ->and($user->updates[0])->not->toHaveKey('password')
+        ->and($user->updates[0])->toHaveKey('name');
+});