@fleetbase/fleetops-engine 0.6.59 → 0.6.61

package/server/tests/Feature/Http/Internal/PlaceControllerTest.php

@@ -36,6 +36,18 @@ if (!Request::hasMacro('resolveFilesFromIds')) {
     Request::macro('resolveFilesFromIds', fn () => FleetOpsInternalPlaceEndpointsState::$files);
 }
 
+if (!Request::hasMacro('or')) {
+    Request::macro('or', function (array $params = [], $default = null) {
+        foreach ($params as $param) {
+            if ($this->has($param)) {
+                return $this->input($param);
+            }
+        }
+
+        return $default;
+    });
+}
+
 class FleetOpsInternalPlaceEndpointsState
 {
     public static array $files = [];
@@ -81,6 +93,14 @@ class FleetOpsInternalPlaceEndpointsPlaceFake extends Place
     }
 }
 
+class FleetOpsInternalPlaceUpdateFake extends Place
+{
+    public function applyDirectivesToQuery(Request $request, $builder)
+    {
+        return $builder;
+    }
+}
+
 class FleetOpsInternalPlaceEndpointsProbe extends PlaceController
 {
     public function callProtected(string $method, array $arguments = []): mixed
@@ -128,6 +148,7 @@ function fleetopsInternalPlaceEndpointsBoot(): SQLiteConnection
         $table->string('postal_code')->nullable();
         $table->string('location')->nullable();
         $table->timestamp('created_at')->nullable();
+        $table->timestamp('updated_at')->nullable();
         $table->timestamp('deleted_at')->nullable();
     });
     $schema->create('files', function ($table) {
@@ -250,3 +271,27 @@ test('sync custom field values helper delegates to the place model', function ()
 
     expect($place->syncedValues)->toBe([['priority' => 'high']]);
 });
+
+test('place updates accept serialized display-only attributes', function () {
+    $connection = fleetopsInternalPlaceEndpointsBoot();
+    $connection->table('places')->insert([
+        'uuid'         => '77777777-7777-4777-8777-777777777777',
+        'public_id'    => 'place_display1',
+        'company_uuid' => 'company-1',
+        'name'         => 'Original place',
+        'street1'      => '205 Dostyk Avenue',
+    ]);
+
+    $place = (new FleetOpsInternalPlaceUpdateFake())->updateRecordFromRequest(Request::create('/int/v1/places/place_display1', 'PUT', [
+        'place' => [
+            'name'         => 'Updated place',
+            'street2'      => 'Entrance 2',
+            'avatar_value' => 'basic-building',
+            'eta'          => '12 minutes',
+        ],
+    ]), 'place_display1', options: ['return_object' => true]);
+
+    expect($place->name)->toBe('Updated place')
+        ->and($place->street2)->toBe('Entrance 2')
+        ->and($connection->table('places')->where('public_id', 'place_display1')->value('name'))->toBe('Updated place');
+});

package/server/tests/FuelProviderTransactionControllerContractsTest.php

@@ -178,4 +178,21 @@ test('fuel provider transaction real lookup scopes identifier and company', func
 
     expect($reflection->invoke($controller, 'fpt-real-1')->public_id)->toBe('fuel_provider_transaction_real1')
         ->and($reflection->invoke($controller, 'fuel_provider_transaction_real1')->uuid)->toBe('fpt-real-1');
+
+    // resolveProvider() falls back to the stored provider when a PUT omits it, so the
+    // uniqueness scope is never null — a null scope would compare the transaction id
+    // against the wrong set of rows. Needs a real connection, which is why this lives
+    // here rather than in RequestContractsTest.
+    $resolveProvider = new ReflectionMethod(Fleetbase\FleetOps\Http\Requests\CreateFuelTransactionRequest::class, 'resolveProvider');
+    $resolveProvider->setAccessible(true);
+
+    $withRouteId = Fleetbase\FleetOps\Http\Requests\CreateFuelTransactionRequest::create('/fleetops-test', 'PUT')
+        ->setRouteResolver(fn () => new class {
+            public function parameter($key, $default = null)
+            {
+                return $key === 'id' ? 'fuel_provider_transaction_real1' : $default;
+            }
+        });
+
+    expect($resolveProvider->invoke($withRouteId))->toBe('petroapp');
 });

package/server/tests/RequestContractsTest.php

@@ -76,6 +76,18 @@ namespace Illuminate\Validation {
                 return $this;
             }
 
+            /**
+             * Recorded so tests can assert the ignore-self clause on update
+             * requests, including which column it matches on — the v1 routes
+             * pass a public_id, not a uuid.
+             */
+            public function ignore($id, $idColumn = null): self
+            {
+                $this->constraints[] = ['ignore', $id, $idColumn];
+
+                return $this;
+            }
+
             public function __toString(): string
             {
                 return $this->rule;
@@ -245,11 +257,16 @@ namespace {
     });
 
     test('fuel transaction request requires provider identifiers on create', function () {
+        // The harness `session()` stand-in is a process-wide static, so seed it
+        // here rather than relying on an earlier test in the file having done so.
+        session(['company' => 'company-uuid']);
+        bindFleetOpsRequestSession(['api_credential' => 'credential-uuid', 'company' => 'company-uuid']);
+
         $createRules = requestRules(CreateFuelTransactionRequest::class);
         $patchRules  = requestRules(CreateFuelTransactionRequest::class, 'PATCH');
 
         expect(ruleStrings($createRules['provider']))->toContain('required', 'string')
-            ->and(ruleStrings($createRules['provider_transaction_id']))->toContain('required', 'string')
+            ->and(ruleStrings($createRules['provider_transaction_id']))->toContain('required', 'string', 'unique:fuel_provider_transactions,provider_transaction_id')
             ->and(ruleStrings($patchRules['provider']))->not->toContain('required')
             ->and(ruleStrings($patchRules['provider_transaction_id']))->not->toContain('required')
             ->and($createRules['station_latitude'])->toBe(['nullable', 'numeric'])
@@ -257,6 +274,19 @@ namespace {
             ->and($createRules['normalized_payload'])->toBe(['nullable', 'array'])
             ->and($createRules['raw_payload'])->toBe(['nullable', 'array'])
             ->and($createRules['meta'])->toBe(['nullable', 'array']);
+
+        // Mirrors fuel_provider_txn_company_provider_unique. The provider is part
+        // of the scope, and company_uuid is what stops one tenant's provider
+        // transaction id from colliding with another's — the old index was global.
+        $rulesWithProvider = CreateFuelTransactionRequest::create('/fleetops-test', 'POST', ['provider' => 'petroapp'])->rules();
+        $uniqueRule        = collect($rulesWithProvider['provider_transaction_id'])->first(fn ($rule) => $rule instanceof Illuminate\Validation\Rule);
+
+        expect($uniqueRule)->not->toBeNull()
+            ->and($uniqueRule->constraints)->toBe([
+                ['where', 'company_uuid', 'company-uuid'],
+                ['where', 'provider', 'petroapp'],
+                ['whereNull', 'deleted_at'],
+            ]);
     });
 
     test('vehicle and fuel report requests expose core validation contracts', function () {
@@ -270,10 +300,21 @@ namespace {
             ->and($vehicleRules['longitude'])->toBe(['nullable', 'required_with:latitude'])
             ->and(ruleStrings($vehicleRules['status']))->toContain('nullable')
             ->and(implode('|', ruleStrings($vehicleRules['status'])))->toContain('operational')
+            // The model casts odometer to an integer, so an unvalidated string
+            // would land as 0 — a vehicle reporting zero miles rather than an
+            // error. These rules are what stop that.
+            ->and($vehicleRules['odometer'])->toBe('nullable|numeric|min:0')
+            ->and($vehicleRules['odometer_unit'])->toBe('nullable|string|max:12')
             ->and($fuelReportRules['driver'])->toBe(['required'])
             ->and($fuelReportRules['odometer'])->toBe(['required'])
             ->and($fuelReportRules['volume'])->toBe(['required'])
-            ->and($fuelReportUpdateRules['driver'])->toBe(['required'])
+            // The update request inherits these rules, so `required` made every partial
+            // update fail — PUT with just {"status": "approved"} answered "The driver
+            // field is required.", and the update action's $request->only() list does not
+            // even include `driver`. This assertion previously pinned that behaviour.
+            ->and($fuelReportUpdateRules['driver'])->toBe(['sometimes'])
+            ->and($fuelReportUpdateRules['odometer'])->toBe(['sometimes'])
+            ->and($fuelReportUpdateRules['volume'])->toBe(['sometimes'])
             ->and($internalDriverRules['location'][1])->toBeInstanceOf(ResolvablePoint::class)
             ->and($internalDriverRules['vehicle'][1])->toBeInstanceOf(ResolvableVehicle::class)
             ->and($internalDriverRules['latitude'])->toBe(['nullable', 'required_with:longitude', 'numeric'])
@@ -621,7 +662,7 @@ namespace {
 
         expect($request->authorize())->toBeTrue()
             ->and($rules['identity'])->toBe('required|string')
-            ->and($rules['code'])->toBe('required|exists:verification_codes,code')
+            ->and($rules['code'])->toBe('required|string')
             ->and($rules['name'])->toBe('required|string')
             ->and($rules['password'])->toBe('required|string|min:8')
             ->and(ruleStrings($rules['email']))->toContain('email', 'nullable', 'unique:contacts')
@@ -649,13 +690,14 @@ namespace {
 
         expect($request->authorize())->toBeFalse();
 
-        bindFleetOpsRequestSession(['api_credential' => 'credential-uuid']);
+        session(['company' => 'company-uuid']);
+        bindFleetOpsRequestSession(['api_credential' => 'credential-uuid', 'company' => 'company-uuid']);
 
         $createRules = $request->rules();
         $patchRules  = CreatePartRequest::create('/fleetops-test', 'PATCH')->rules();
 
         expect($request->authorize())->toBeTrue()
-            ->and($createRules['sku'])->toBe(['nullable', 'string'])
+            ->and(ruleStrings($createRules['sku']))->toContain('nullable', 'string', 'unique:parts,sku')
             ->and(ruleStrings($createRules['name']))->toContain('required', 'string')
             ->and(ruleStrings($patchRules['name']))->not->toContain('required')
             ->and($createRules['manufacturer'])->toBe(['nullable', 'string'])
@@ -671,11 +713,66 @@ namespace {
             ->and($createRules['specs'])->toBe(['nullable', 'array'])
             ->and($createRules['meta'])->toBe(['nullable', 'array']);
 
+        // The SKU uniqueness rule mirrors parts_company_uuid_active_sku_unique:
+        // scoped to the session company and ignoring soft-deleted parts, so a SKU
+        // freed by a deleted part — or held by another company — stays available.
+        // Without it a duplicate reached the driver and returned a 500.
+        $skuRule = collect($createRules['sku'])->first(fn ($rule) => $rule instanceof Illuminate\Validation\Rule);
+
+        expect($skuRule)->not->toBeNull()
+            ->and($skuRule->constraints)->toBe([
+                ['where', 'company_uuid', 'company-uuid'],
+                ['whereNull', 'deleted_at'],
+            ]);
+
+        // On update the record re-sends its own SKU, so it must not collide with
+        // itself. The v1 route parameter is a public_id, not a uuid.
+        $updateRules = CreatePartRequest::create('/fleetops-test', 'PUT')
+            ->setRouteResolver(fn () => new class {
+                public function parameter($key, $default = null)
+                {
+                    return $key === 'id' ? 'part_abc123' : $default;
+                }
+            })
+            ->rules();
+
+        $updateSkuRule = collect($updateRules['sku'])->first(fn ($rule) => $rule instanceof Illuminate\Validation\Rule);
+
+        expect($updateSkuRule->constraints)->toContain(['ignore', 'part_abc123', 'public_id']);
+
         bindFleetOpsRequestSession(['is_sanctum_token' => true]);
 
         expect($request->authorize())->toBeTrue();
     });
 
+    test('duplicate-key requests name the offending field and ignore themselves on update', function () {
+        session(['company' => 'company-uuid']);
+        bindFleetOpsRequestSession(['api_credential' => 'credential-uuid', 'company' => 'company-uuid']);
+
+        // Without these the violation surfaces as the framework's generic "has already
+        // been taken", which does not say which record collided or on what.
+        expect(CreatePartRequest::create('/fleetops-test', 'POST')->messages())
+            ->toBe(['sku.unique' => 'A part with this SKU already exists.'])
+            ->and(CreateFuelTransactionRequest::create('/fleetops-test', 'POST')->messages())
+            ->toBe(['provider_transaction_id.unique' => 'A fuel transaction with this provider transaction id already exists for this provider.']);
+
+        // `provider` is supplied here, so resolveProvider() short-circuits on the input
+        // and this exercises only the ignore-self clause. The stored-provider fallback
+        // needs a database and is covered in FuelProviderTransactionControllerContractsTest.
+        $updateRules = CreateFuelTransactionRequest::create('/fleetops-test', 'PUT', ['provider' => 'petroapp'])
+            ->setRouteResolver(fn () => new class {
+                public function parameter($key, $default = null)
+                {
+                    return $key === 'id' ? 'fuel_provider_transaction_abc123' : $default;
+                }
+            })
+            ->rules();
+
+        $updateRule = collect($updateRules['provider_transaction_id'])->first(fn ($rule) => $rule instanceof Illuminate\Validation\Rule);
+
+        expect($updateRule->constraints)->toContain(['ignore', 'fuel_provider_transaction_abc123', 'public_id']);
+    });
+
     test('entity equipment payload and simulation requests expose conditional contracts', function () {
         bindFleetOpsRequestSession();
 

package/server/tests/SettingControllerContractsTest.php

@@ -408,3 +408,36 @@ test('setting controller handles map scheduling orchestrator and card field sett
             'settings' => ['standard' => ['tracking'], 'byConfig' => [], 'meta' => ['dense' => true]],
         ]);
 });
+
+test('setting controller sanitizes leaflet tile provider urls', function () {
+    $controller = new FleetOpsSettingControllerProbe();
+
+    $saved = fleetopsJsonPayload($controller->saveMapSettings(new Request([
+        'settings' => [
+            'leafletTileUrl'     => '  https://tile.openstreetmap.org/{z}/{x}/{y}.png  ',
+            'leafletDarkTileUrl' => 'javascript:alert(1)',
+        ],
+    ])));
+
+    expect($saved['leafletTileUrl'])->toBe('https://tile.openstreetmap.org/{z}/{x}/{y}.png')
+        ->and($saved['leafletDarkTileUrl'])->toBe('')
+        ->and($controller->configuredCompany['fleet-ops.map-settings'])->toMatchArray([
+            'leafletTileUrl'     => 'https://tile.openstreetmap.org/{z}/{x}/{y}.png',
+            'leafletDarkTileUrl' => '',
+        ]);
+
+    $savedNonString = fleetopsJsonPayload($controller->saveMapSettings(new Request([
+        'settings' => [
+            'leafletTileUrl'     => ['not' => 'a-string'],
+            'leafletDarkTileUrl' => 'ftp://tiles.example.com/{z}/{x}/{y}.png',
+        ],
+    ])));
+
+    expect($savedNonString['leafletTileUrl'])->toBe('')
+        ->and($savedNonString['leafletDarkTileUrl'])->toBe('');
+
+    $defaults = fleetopsJsonPayload((new FleetOpsSettingControllerProbe())->getMapSettings());
+
+    expect($defaults['leafletTileUrl'])->toBe('')
+        ->and($defaults['leafletDarkTileUrl'])->toBe('');
+});

package/server/tests/SmallControllerContractsTest.php

@@ -227,19 +227,30 @@ class FleetOpsGettingStartedControllerProbe extends GettingStartedController
 
 class FleetOpsPublicNavigatorControllerProbe extends PublicNavigatorController
 {
-    public mixed $settings = ['require_photo' => true];
-    public array $lookups  = [];
+    public mixed $settings   = ['require_photo' => true];
+    public array $lookups    = [];
+    public bool $companyMiss = false;
 
     protected function findCompanyByPublicId(string $companyId): ?Company
     {
+        $this->lookups[] = $companyId;
+
+        // Mirrors the real lookup returning null for an unknown public id.
+        if ($this->companyMiss) {
+            return null;
+        }
+
         $company = new Company();
         $company->setRawAttributes(['uuid' => 'company-uuid', 'public_id' => $companyId], true);
 
-        $this->lookups[] = $companyId;
-
         return $company;
     }
 
+    protected function errorResponse(string $message, int $statusCode): JsonResponse
+    {
+        return new JsonResponse(['errors' => [$message]], $statusCode);
+    }
+
     protected function driverOnboardSetting(string $companyUuid): mixed
     {
         $this->lookups[] = $companyUuid;
@@ -412,6 +423,19 @@ test('public navigator controller returns configured or default driver onboardin
         ]);
 });
 
+test('public navigator controller answers 404 for an organization public id that does not resolve', function () {
+    $controller               = new FleetOpsPublicNavigatorControllerProbe();
+    $controller->companyMiss  = true;
+
+    $response = $controller->getDriverOnboardSettings('company_does_not_exist');
+
+    // Regression: the unresolved company used to be dereferenced anyway, which threw a
+    // TypeError out of the controller and rendered an HTML stack trace with a 500.
+    expect($response->getStatusCode())->toBe(404)
+        ->and($response->getData(true))->toBe(['errors' => ['Organization not found.']])
+        ->and($controller->lookups)->toBe(['company_does_not_exist']);
+});
+
 test('public contact controller normalizes create input and preserves update fields', function () {
     $controller = new FleetOpsContactControllerProbe();
 

package/server/tests/Unit/Http/Filter/FuelReportFilterTest.php

@@ -0,0 +1,135 @@
+<?php
+
+use Fleetbase\FleetOps\Http\Filter\FuelReportFilter;
+use Fleetbase\Http\Filter\Filter;
+use Illuminate\Http\Request;
+
+/**
+ * Covers the FuelReportFilter query branches against a recording builder fake:
+ * base scoping, keyword search, priority and status constraints, and the
+ * assignee, reporter, driver and vehicle relation lookups routing by uuid,
+ * public id, or fallback search.
+ */
+class FleetOpsFuelReportFilterUnitQuery
+{
+    public array $calls = [];
+
+    public function where(...$arguments): self
+    {
+        if (isset($arguments[0]) && is_callable($arguments[0])) {
+            $nested = new self();
+            $arguments[0]($nested);
+            $this->calls[] = ['whereNested', $nested->calls];
+
+            return $this;
+        }
+
+        $this->calls[] = ['where', $arguments];
+
+        return $this;
+    }
+
+    public function whereHas(string $relation, ?callable $callback = null): self
+    {
+        $nested = new self();
+        if ($callback) {
+            $callback($nested);
+        }
+        $this->calls[] = ['whereHas', $relation, $nested->calls];
+
+        return $this;
+    }
+
+    public function search(?string $query): self
+    {
+        $this->calls[] = ['search', $query];
+
+        return $this;
+    }
+
+    public function whereIn(string $column, mixed $values): self
+    {
+        $this->calls[] = ['whereIn', $column, $values];
+
+        return $this;
+    }
+
+    public function whereBetween(string $column, mixed $bounds): self
+    {
+        $this->calls[] = ['whereBetween', $column, $bounds];
+
+        return $this;
+    }
+
+    public function whereDate(string $column, mixed $value): self
+    {
+        $this->calls[] = ['whereDate', $column, $value];
+
+        return $this;
+    }
+
+    public function __call($method, $arguments): self
+    {
+        $this->calls[] = [$method, $arguments];
+
+        return $this;
+    }
+}
+
+function fleetopsFuelReportFilterUnitFilter(FleetOpsFuelReportFilterUnitQuery $builder, ?Request $request = null): FuelReportFilter
+{
+    $filter = (new ReflectionClass(FuelReportFilter::class))->newInstanceWithoutConstructor();
+
+    foreach ([
+        'builder' => $builder,
+        'session' => new class {
+            public function get(string $key): ?string
+            {
+                return $key === 'company' ? 'company-uuid' : null;
+            }
+        },
+        'request' => $request ?? new Request(),
+    ] as $property => $value) {
+        $reflection = new ReflectionProperty(Filter::class, $property);
+        $reflection->setAccessible(true);
+        $reflection->setValue($filter, $value);
+    }
+
+    return $filter;
+}
+
+test('fuel report filter scopes by driver_uuid and driver_assigned, not just driver', function () {
+    foreach (['driverUuid', 'driverAssigned'] as $method) {
+        $builder = new FleetOpsFuelReportFilterUnitQuery();
+        $filter  = fleetopsFuelReportFilterUnitFilter($builder);
+
+        $filter->{$method}('driver_filterone');
+
+        $whereHas = collect($builder->calls)->where(0, 'whereHas')->firstWhere(1, 'driver');
+        expect($whereHas)->not->toBeNull("{$method} must constrain the driver relation")
+            ->and($whereHas[2][0][1][0])->toBe('public_id');
+    }
+});
+
+test('fuel report filter driver aliases route uuids the same way driver does', function () {
+    $builder = new FleetOpsFuelReportFilterUnitQuery();
+    $filter  = fleetopsFuelReportFilterUnitFilter($builder);
+
+    $filter->driverUuid('33333333-3333-4333-8333-333333333333');
+
+    $whereHas = collect($builder->calls)->where(0, 'whereHas')->firstWhere(1, 'driver');
+    expect($whereHas[2][0][1][0])->toBe('uuid');
+});
+
+test('fuel report filter scopes by vehicle_uuid as well as vehicle', function () {
+    $builder = new FleetOpsFuelReportFilterUnitQuery();
+    $filter  = fleetopsFuelReportFilterUnitFilter($builder);
+
+    $filter->vehicleUuid('44444444-4444-4444-8444-444444444444');
+    $filter->vehicleUuid('vehicle_filterone');
+
+    $whereHasCalls = collect($builder->calls)->where(0, 'whereHas')->where(1, 'vehicle')->values();
+    expect($whereHasCalls)->toHaveCount(2)
+        ->and($whereHasCalls[0][2][0][1][0])->toBe('uuid')
+        ->and($whereHasCalls[1][2][0][1][0])->toBe('public_id');
+});

package/server/tests/Unit/Http/Filter/IssueFilterTest.php

@@ -127,3 +127,46 @@ test('issue filter relation branches route uuids public ids and searches', funct
     $searchNested = $whereHasCalls->filter(fn ($call) => collect($call[2])->contains(fn ($inner) => $inner[0] === 'search'));
     expect($searchNested->count())->toBeGreaterThanOrEqual(3);
 });
+
+test('issue filter scopes by driver_uuid and driver_assigned, not just driver', function () {
+    /*
+     * The base filter resolves a query parameter to a method of the same name
+     * and silently ignores what it cannot match. `driver_uuid` matched nothing,
+     * so the filter was dropped and the list came back scoped only by company —
+     * every driver's issues, with a 200 and no sign the request had been
+     * narrowed. For a driver app that is a disclosure, not a nuisance.
+     */
+    foreach (['driverUuid', 'driverAssigned'] as $method) {
+        $builder = new FleetOpsIssueFilterUnitQuery();
+        $filter  = fleetopsIssueFilterUnitFilter($builder);
+
+        $filter->{$method}('driver_filterone');
+
+        $whereHas = collect($builder->calls)->where(0, 'whereHas')->firstWhere(1, 'driver');
+        expect($whereHas)->not->toBeNull("{$method} must constrain the driver relation")
+            ->and($whereHas[2][0][1][0])->toBe('public_id');
+    }
+});
+
+test('issue filter driver aliases route uuids the same way driver does', function () {
+    $builder = new FleetOpsIssueFilterUnitQuery();
+    $filter  = fleetopsIssueFilterUnitFilter($builder);
+
+    $filter->driverUuid('33333333-3333-4333-8333-333333333333');
+
+    $whereHas = collect($builder->calls)->where(0, 'whereHas')->firstWhere(1, 'driver');
+    expect($whereHas[2][0][1][0])->toBe('uuid');
+});
+
+test('issue filter scopes by vehicle_uuid as well as vehicle', function () {
+    $builder = new FleetOpsIssueFilterUnitQuery();
+    $filter  = fleetopsIssueFilterUnitFilter($builder);
+
+    $filter->vehicleUuid('44444444-4444-4444-8444-444444444444');
+    $filter->vehicleUuid('vehicle_filterone');
+
+    $whereHasCalls = collect($builder->calls)->where(0, 'whereHas')->where(1, 'vehicle')->values();
+    expect($whereHasCalls)->toHaveCount(2)
+        ->and($whereHasCalls[0][2][0][1][0])->toBe('uuid')
+        ->and($whereHasCalls[1][2][0][1][0])->toBe('public_id');
+});

package/server/tests/Unit/Http/Filter/MaintenanceScheduleFilterTest.php

@@ -0,0 +1,69 @@
+<?php
+
+use Fleetbase\FleetOps\Http\Filter\MaintenanceScheduleFilter;
+use Fleetbase\FleetOps\Models\Vehicle;
+use Fleetbase\Http\Filter\Filter;
+
+class FleetOpsMaintenanceScheduleFilterQuery
+{
+    public array $wheres = [];
+
+    public function where(...$arguments): self
+    {
+        $this->wheres[] = $arguments;
+
+        return $this;
+    }
+}
+
+function fleetopsMaintenanceScheduleFilter(FleetOpsMaintenanceScheduleFilterQuery $builder): MaintenanceScheduleFilter
+{
+    $filter = (new ReflectionClass(MaintenanceScheduleFilter::class))->newInstanceWithoutConstructor();
+
+    foreach ([
+        'builder' => $builder,
+        'session' => new class {
+            public function get(string $key): ?string
+            {
+                return $key === 'company' ? 'company-uuid' : null;
+            }
+        },
+    ] as $property => $value) {
+        $reflection = new ReflectionProperty(Filter::class, $property);
+        $reflection->setAccessible(true);
+        $reflection->setValue($filter, $value);
+    }
+
+    return $filter;
+}
+
+test('maintenance schedule filter scopes companies and resolves subject aliases', function () {
+    $builder = new FleetOpsMaintenanceScheduleFilterQuery();
+    $filter  = fleetopsMaintenanceScheduleFilter($builder);
+
+    $filter->queryForInternal();
+    $filter->queryForPublic();
+    $filter->subjectType('vehicle');
+    $filter->subjectType('fleet-ops:vehicle');
+    $filter->subjectType(Vehicle::class);
+    $filter->subjectUuid('vehicle-uuid');
+
+    expect($builder->wheres)->toBe([
+        ['company_uuid', 'company-uuid'],
+        ['company_uuid', 'company-uuid'],
+        ['subject_type', Vehicle::class],
+        ['subject_type', Vehicle::class],
+        ['subject_type', Vehicle::class],
+        ['subject_uuid', 'vehicle-uuid'],
+    ]);
+});
+
+test('maintenance schedule filter ignores empty subject filters', function () {
+    $builder = new FleetOpsMaintenanceScheduleFilterQuery();
+    $filter  = fleetopsMaintenanceScheduleFilter($builder);
+
+    $filter->subjectType(null);
+    $filter->subjectUuid(null);
+
+    expect($builder->wheres)->toBe([]);
+});

package/server/tests/Unit/Http/Requests/CreateFuelReportRequestTest.php

@@ -10,6 +10,7 @@ namespace Illuminate\Foundation\Http {
 
 namespace {
     use Fleetbase\FleetOps\Http\Requests\CreateFuelReportRequest;
+    use Fleetbase\FleetOps\Http\Requests\UpdateFuelReportRequest;
 
     class FleetOpsCreateFuelReportSessionStore
     {
@@ -39,6 +40,26 @@ namespace {
         return CreateFuelReportRequest::create('/fleet-ops/fuel-reports', 'POST');
     }
 
+    test('fuel report create only fields are required on POST and optional on update', function () {
+        FleetOpsCreateFuelReportRequestState::$session = new FleetOpsCreateFuelReportSessionStore(['api_credential' => 'api-credential-uuid']);
+
+        // UpdateFuelReportRequest extends this class, so a flat `required` made every
+        // partial update fail — PUT with just {"status": "approved"} answered "The driver
+        // field is required." `driver` is the plainest case: the update action's
+        // $request->only() list does not include it, so the field was demanded and then
+        // discarded.
+        $create = CreateFuelReportRequest::create('/fleet-ops/fuel-reports', 'POST')->rules();
+        $update = UpdateFuelReportRequest::create('/fleet-ops/fuel-reports/report_1', 'PUT')->rules();
+
+        foreach (['driver', 'odometer', 'volume'] as $field) {
+            expect($create[$field])->toBe(['required'])
+                ->and($update[$field])->toBe(['sometimes']);
+        }
+
+        expect($create['metric_unit'])->toBe(['nullable'])
+            ->and($create['amount'])->toBe(['nullable']);
+    });
+
     test('create fuel report authorization accepts api credentials or sanctum sessions', function () {
         expect(fleetopsCreateFuelReportRequestWithSession([])->authorize())->toBeFalse()
             ->and(fleetopsCreateFuelReportRequestWithSession(['api_credential' => 'api-credential-uuid'])->authorize())->toBeTrue()