@fleetbase/fleetops-engine 0.6.60 → 0.6.61

package/addon/templates/settings/map.hbs

@@ -31,6 +31,16 @@
                         />
                     </InputGroup>
 
+                    {{#if this.isLeafletSelected}}
+                        <InputGroup @name={{t "settings.map.leaflet-tile-url"}} @helpText={{t "settings.map.leaflet-tile-url-help-text"}}>
+                            <Input @type="text" @value={{this.leafletTileUrl}} placeholder="https://tile.openstreetmap.org/{z}/{x}/{y}.png" class="w-full form-input" />
+                        </InputGroup>
+
+                        <InputGroup @name={{t "settings.map.leaflet-dark-tile-url"}} @helpText={{t "settings.map.leaflet-dark-tile-url-help-text"}}>
+                            <Input @type="text" @value={{this.leafletDarkTileUrl}} placeholder="https://tile.openstreetmap.org/{z}/{x}/{y}.png" class="w-full form-input" />
+                        </InputGroup>
+                    {{/if}}
+
                     {{#if this.isGoogleMapsSelected}}
                         <InputGroup @name={{t "settings.map.google-maps-map-type"}} @helpText={{t "settings.map.google-maps-map-type-help-text"}}>
                             <Select

package/addon/utils/leaflet-tile-url.js

@@ -0,0 +1,31 @@
+/**
+ * Default Leaflet raster tile sources.
+ *
+ * CARTO's `basemaps.cartocdn.com` raster tiles now require an API key and
+ * render an "API key required" watermark without one, so the default basemap
+ * is the keyless OpenStreetMap tile server. Operators can point Leaflet at any
+ * other XYZ provider (including a keyed CARTO URL) via Fleet-Ops map settings.
+ */
+export const DEFAULT_LEAFLET_TILE_URL = 'https://tile.openstreetmap.org/{z}/{x}/{y}.png';
+export const DEFAULT_LEAFLET_DARK_TILE_URL = DEFAULT_LEAFLET_TILE_URL;
+export const DEFAULT_LEAFLET_TILE_ATTRIBUTION = '&copy; <a href="https://www.openstreetmap.org/copyright">OpenStreetMap</a> contributors';
+
+/**
+ * Resolve the Leaflet tile URL for a theme from a map settings object.
+ *
+ * @param {Object} settings map settings, may contain `leafletTileUrl` and `leafletDarkTileUrl`
+ * @param {String} theme 'light' or 'dark'
+ * @return {String} the XYZ tile URL template to use
+ */
+export function getLeafletTileUrl(settings = {}, theme = 'light') {
+    const customLight = typeof settings.leafletTileUrl === 'string' ? settings.leafletTileUrl.trim() : '';
+    const customDark = typeof settings.leafletDarkTileUrl === 'string' ? settings.leafletDarkTileUrl.trim() : '';
+
+    if (theme === 'dark') {
+        return customDark || customLight || DEFAULT_LEAFLET_DARK_TILE_URL;
+    }
+
+    return customLight || DEFAULT_LEAFLET_TILE_URL;
+}
+
+export default getLeafletTileUrl;

package/addon/utils/prepare-place-for-save.js

@@ -0,0 +1,13 @@
+export default function preparePlaceForSave(store, place) {
+    if (!place || place.isNew || place.public_id) {
+        return place;
+    }
+
+    const attributes = {};
+
+    place.constructor.eachAttribute((attribute) => {
+        attributes[attribute] = place[attribute];
+    });
+
+    return store.createRecord('place', attributes);
+}

package/app/components/driver/card.js

@@ -0,0 +1 @@
+export { default } from '@fleetbase/fleetops-engine/components/driver/card';

package/app/helpers/leaflet-tile-url.js

@@ -0,0 +1 @@
+export { default } from '@fleetbase/fleetops-engine/helpers/leaflet-tile-url';

package/app/utils/leaflet-tile-url.js

@@ -0,0 +1 @@
+export { default, DEFAULT_LEAFLET_TILE_URL, DEFAULT_LEAFLET_DARK_TILE_URL, DEFAULT_LEAFLET_TILE_ATTRIBUTION, getLeafletTileUrl } from '@fleetbase/fleetops-engine/utils/leaflet-tile-url';

package/composer.json

@@ -1,6 +1,6 @@
 {
     "name": "fleetbase/fleetops-api",
-    "version": "0.6.60",
+    "version": "0.6.61",
     "description": "Fleet & Transport Management Extension for Fleetbase",
     "keywords": [
         "fleetbase-extension",

package/extension.json

@@ -1,6 +1,6 @@
 {
     "name": "Fleet-Ops",
-    "version": "0.6.60",
+    "version": "0.6.61",
     "description": "Fleet & Transport Management Extension for Fleetbase",
     "repository": "https://github.com/fleetbase/fleetops",
     "license": "AGPL-3.0-or-later",

package/index.js

@@ -44,6 +44,15 @@ module.exports = buildEngine({
         return trees;
     },
 
+    treeForLeafletImages: function () {
+        const leafletImagesPath = path.join(this.pathBase('leaflet'), 'dist', 'images');
+
+        return new Funnel(leafletImagesPath, {
+            destDir: 'assets/images',
+            include: ['marker-icon.png', 'marker-icon-2x.png', 'marker-shadow.png'],
+        });
+    },
+
     treeForJointJs: function () {
         const trees = [];
 
@@ -70,12 +79,14 @@ module.exports = buildEngine({
 
     mergeWithPublicTree: function (publicTree) {
         const leafletTree = this.treeForLeaflet();
+        const leafletImagesTree = this.treeForLeafletImages();
         const jointJsTree = this.treeForJointJs();
         const assetsTree = [
             new Funnel(path.join(__dirname, 'assets'), {
                 destDir: '',
             }),
             ...leafletTree,
+            leafletImagesTree,
             ...jointJsTree,
         ];
 

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@fleetbase/fleetops-engine",
-    "version": "0.6.60",
+    "version": "0.6.61",
     "description": "Fleet & Transport Management Extension for Fleetbase",
     "fleetbase": {
         "route": "fleet-ops"
@@ -70,6 +70,7 @@
         "ember-radio-button": "^3.0.0-beta.1",
         "ember-tag-input": "^3.1.0",
         "ember-wormhole": "^0.6.0",
+        "leaflet": "^1.9.4",
         "leaflet-contextmenu": "^1.4.0",
         "leaflet-draw": "^1.0.4",
         "xlsx": "^0.18.5"

package/server/src/Http/Controllers/Api/v1/DriverController.php

@@ -166,8 +166,14 @@ class DriverController extends Controller
         // get request input
         $input = $request->except(['name', 'password', 'email', 'phone', 'location', 'altitude', 'heading', 'speed', 'meta']);
 
-        // get user details for driver
-        $userDetails = $request->only(['name', 'password', 'email', 'phone']);
+        /*
+         * Deliberately no `password` here. Setting one through a general update
+         * meant anyone holding a driver's token — or an unlocked handset —
+         * could take the account without proving they knew the existing
+         * password. Changing a password is its own operation with its own
+         * proof: see changePassword(), forgotPassword() and resetPassword().
+         */
+        $userDetails = $request->only(['name', 'email', 'phone']);
 
         // update driver user details
         $driverUser = $driver->getUser();
@@ -935,7 +941,24 @@ class DriverController extends Controller
 
     protected function createUser(array $userDetails): User
     {
-        return User::create($userDetails);
+        /*
+         * `password` is guarded on User, so mass assignment drops it without a
+         * word. The create endpoint has always accepted and validated one, so a
+         * driver created through the API could never sign in with the password
+         * their operator chose for them. Set it after the fact, where the
+         * model's mutator hashes it.
+         */
+        $password = $userDetails['password'] ?? null;
+        unset($userDetails['password']);
+
+        $user = User::create($userDetails);
+
+        if (is_string($password) && strlen($password)) {
+            $user->password = $password;
+            $user->save();
+        }
+
+        return $user;
     }
 
     protected function getUuid(array|string $table, array $where, array $options = []): mixed
@@ -1177,4 +1200,198 @@ class DriverController extends Controller
             }
         }
     }
+
+    /**
+     * Change the authenticated driver's password, proving the current one.
+     *
+     * A password change is an authorisation decision, not an attribute update.
+     * Requiring the existing password is what stops a borrowed handset or a
+     * leaked token from becoming a permanent account takeover, and re-issuing
+     * the caller's token afterwards is what stops every *other* session from
+     * outliving the change.
+     */
+    public function changePassword(Request $request, string $id)
+    {
+        $current  = $request->input('current_password');
+        $password = $request->input('password');
+
+        if (!$current || !$password) {
+            return response()->apiError('current_password and password are required.', 400);
+        }
+
+        if (strlen($password) < 8) {
+            return response()->apiError('Password must be at least 8 characters.', 400);
+        }
+
+        if ($request->filled('password_confirmation') && $request->input('password_confirmation') !== $password) {
+            return response()->apiError('Password confirmation does not match.', 422);
+        }
+
+        try {
+            $driver = $this->findDriver($id, ['user']);
+        } catch (\Illuminate\Database\Eloquent\ModelNotFoundException $exception) {
+            return response()->apiError('Driver resource not found.', 404);
+        }
+
+        $user = static::findDriverUserRecord($driver);
+        if (!$user) {
+            return response()->apiError('Driver has no user account.', 422);
+        }
+
+        if (!static::passwordMatches($user, $current)) {
+            // Same wording whether the password was wrong or the account is odd
+            // — a change endpoint should not become an oracle.
+            return response()->apiError('The current password is incorrect.', 422);
+        }
+
+        $user->password = $password;
+        $user->save();
+
+        /*
+         * Every other session dies with the old password. The caller keeps
+         * working by being handed a fresh token in the same response, so a
+         * driver who changes their password mid-shift is not signed out of the
+         * device in their hand.
+         */
+        $user->tokens()->delete();
+        $token = $user->createToken($request->input('device_name', 'navigator'));
+
+        return response()->json([
+            'status' => 'ok',
+            'token'  => $token->plainTextToken,
+        ]);
+    }
+
+    /**
+     * Send a password reset code to a driver who cannot sign in.
+     *
+     * Answers identically whether or not the identity exists: a reset endpoint
+     * that 404s on an unknown phone number is a way to enumerate a company's
+     * drivers.
+     */
+    public function forgotPassword(Request $request)
+    {
+        $identity = $request->input('identity');
+        if (!$identity) {
+            return response()->apiError('Identity is required.', 400);
+        }
+
+        $user = static::findDriverUserByIdentity($identity);
+        if (!$user) {
+            return response()->json(['status' => 'ok']);
+        }
+
+        try {
+            static::sendResetCode($user, $identity);
+        } catch (\Throwable $e) {
+            return response()->apiError(static::debugEnabled() ? $e->getMessage() : 'Unable to send reset code.');
+        }
+
+        return response()->json(['status' => 'ok']);
+    }
+
+    /**
+     * Set a new password using a code sent by forgotPassword().
+     */
+    public function resetPassword(Request $request)
+    {
+        $identity = $request->input('identity');
+        $code     = $request->input('code');
+        $password = $request->input('password');
+
+        if (!$identity || !$code || !$password) {
+            return response()->apiError('identity, code, and password are required.', 400);
+        }
+
+        if (strlen($password) < 8) {
+            return response()->apiError('Password must be at least 8 characters.', 400);
+        }
+
+        $user = static::findDriverUserByIdentity($identity);
+        if (!$user) {
+            return response()->apiError('Invalid or expired reset code.', 422);
+        }
+
+        $verification = static::findResetCode($user, $code);
+
+        if (!$verification) {
+            // One message for a wrong code, an expired code and an unknown
+            // identity alike.
+            return response()->apiError('Invalid or expired reset code.', 422);
+        }
+
+        $user->password = $password;
+        $user->save();
+
+        $verification->delete();
+        $user->tokens()->delete();
+
+        return response()->json(['status' => 'ok']);
+    }
+
+    /** Whether the application is in debug mode, so an error may be echoed. */
+    protected static function debugEnabled(): bool
+    {
+        return app()->hasDebugModeEnabled();
+    }
+
+    /**
+     * Load a driver's user account with every column.
+     *
+     * The `user` relation selects a named subset of columns, and `password` is
+     * not among them — reading it through the relation yields an empty string,
+     * so a password comparison would fail for everyone regardless of what they
+     * typed. Anything checking a password has to load the record itself.
+     */
+    protected static function findDriverUserRecord(Driver $driver): ?User
+    {
+        if (!$driver->user_uuid) {
+            return null;
+        }
+
+        return User::where('uuid', $driver->user_uuid)->first();
+    }
+
+    /** Whether a plaintext password matches the stored hash. */
+    protected static function passwordMatches(User $user, string $plain): bool
+    {
+        return Hash::check($plain, $user->password);
+    }
+
+    /** The unexpired reset code for this user, if the one supplied matches. */
+    protected static function findResetCode(User $user, string $code)
+    {
+        return VerificationCode::where([
+            'subject_uuid' => $user->uuid,
+            'code'         => $code,
+            'for'          => 'driver_password_reset',
+        ])->where('expires_at', '>', now())->first();
+    }
+
+    /** Sends the reset code by whichever channel the identity names. */
+    protected static function sendResetCode(User $user, string $identity): void
+    {
+        // if/else rather than an early return: a `return` sitting after a call
+        // that can throw is a line no test can reach.
+        if (Utils::isEmail($identity)) {
+            VerificationCode::generateEmailVerificationFor($user, 'driver_password_reset', [
+                'subject'         => config('app.name') . ' password reset',
+                'messageCallback' => fn ($v) => 'Your ' . config('app.name') . ' password reset code is ' . $v->code,
+            ]);
+        } else {
+            VerificationCode::generateSmsVerificationFor($user, 'driver_password_reset', [
+                'messageCallback' => fn ($v) => 'Your ' . config('app.name') . ' password reset code is ' . $v->code,
+            ]);
+        }
+    }
+
+    /** Resolve a driver's user account from an email address or a phone number. */
+    protected static function findDriverUserByIdentity(string $identity): ?User
+    {
+        $isEmail = Utils::isEmail($identity);
+        $column  = $isEmail ? 'email' : 'phone';
+        $value   = $isEmail ? $identity : static::phone($identity);
+
+        return User::whereHas('driver')->where($column, $value)->first();
+    }
 }

package/server/src/Http/Controllers/Api/v1/ManifestController.php

@@ -0,0 +1,250 @@
+<?php
+
+namespace Fleetbase\FleetOps\Http\Controllers\Api\v1;
+
+use Fleetbase\FleetOps\Http\Resources\v1\Manifest as ManifestResource;
+use Fleetbase\FleetOps\Http\Resources\v1\ManifestStop as ManifestStopResource;
+use Fleetbase\FleetOps\Models\Driver;
+use Fleetbase\FleetOps\Models\Manifest;
+use Fleetbase\FleetOps\Models\ManifestStop;
+use Fleetbase\FleetOps\Support\Utils;
+use Fleetbase\Http\Controllers\Controller;
+use Illuminate\Http\Request;
+
+/**
+ * Driver-facing manifests.
+ *
+ * A manifest is a driver's route: an order-agnostic sequence of stops, which
+ * may span several orders or none the driver has seen as an order. Everything a
+ * driver app needs to *run* a route lived only behind the console's internal
+ * namespace, so a driver could be assigned a route they had no way to read.
+ *
+ * These endpoints are deliberately narrow. A driver may read their own
+ * manifests, update the stops on them, and re-sequence the ones they have not
+ * done yet. They may not create, cancel or delete a manifest — that is dispatch
+ * work, and it stays on the internal namespace.
+ */
+class ManifestController extends Controller
+{
+    /**
+     * GET /v1/drivers/{id}/manifests.
+     *
+     * Defaults to what a driver actually needs on shift — today and anything
+     * still unfinished — rather than their whole history, which on a busy fleet
+     * is thousands of rows nobody asked for.
+     */
+    public function forDriver(Request $request, string $id)
+    {
+        $driver = static::findDriverRecord($id);
+        if (!$driver) {
+            return response()->apiError('Driver resource not found.', 404);
+        }
+
+        $query = static::manifestsFor($driver);
+
+        if ($request->filled('status')) {
+            $query->whereIn('status', Utils::arrayFrom($request->input('status')));
+        }
+
+        if ($request->filled('on')) {
+            $query->whereDate('scheduled_date', $request->input('on'));
+        }
+
+        return ManifestResource::collection($query->limit((int) $request->input('limit', 30))->get());
+    }
+
+    /**
+     * GET /v1/manifests/{id} — the route, with its stops in sequence.
+     */
+    public function show(string $id)
+    {
+        $manifest = static::findManifest($id);
+        if (!$manifest) {
+            return response()->apiError('Manifest resource not found.', 404);
+        }
+
+        $manifest->load(['driver', 'vehicle', 'stops' => fn ($q) => $q->orderBy('sequence')->with(['place', 'order.trackingNumber'])]);
+
+        return new ManifestResource($manifest);
+    }
+
+    /**
+     * PATCH /v1/manifest-stops/{id}.
+     *
+     * Status changes go through the model's own transitions rather than being
+     * written as a column, because arriving and completing carry side effects —
+     * timestamps, and the manifest completing itself once its last stop does.
+     */
+    public function updateStop(Request $request, string $id)
+    {
+        $stop = static::findStop($id);
+        if (!$stop) {
+            return response()->apiError('Manifest stop resource not found.', 404);
+        }
+
+        $status = $request->input('status');
+        if ($status) {
+            // Checked before it is applied: an unknown status must change
+            // nothing, not fall through a match and then be refused.
+            if (!in_array($status, ['arrived', 'completed', 'skipped'], true)) {
+                return response()->apiError('Status must be one of: arrived, completed, skipped.', 422);
+            }
+
+            match ($status) {
+                'arrived'   => $stop->markArrived(),
+                'completed' => $stop->markCompleted(),
+                default     => $stop->markSkipped(),
+            };
+        }
+
+        if ($request->filled('meta')) {
+            $stop->update(['meta' => $request->input('meta')]);
+        }
+
+        $stop->load(['place', 'order.trackingNumber']);
+
+        return new ManifestStopResource($stop);
+    }
+
+    /**
+     * POST /v1/manifests/{id}/optimize — re-sequence the stops still to do.
+     *
+     * This is the *driver's* optimise, not the orchestrator's. The orchestrator
+     * allocates orders across a fleet and produces manifests; this reorders the
+     * stops on one manifest that is already assigned, which is a different job
+     * with a different owner.
+     *
+     * **It is a nearest-neighbour heuristic, not a solved routing problem.** It
+     * walks from the driver's current position to the closest remaining stop,
+     * then to the closest from there, by straight-line distance. That is
+     * typically a large improvement over an arbitrary order and is not
+     * guaranteed optimal; calling it anything stronger would be a claim the
+     * implementation does not support. Completed and skipped stops keep their
+     * place — a route already driven is not re-planned.
+     */
+    public function optimize(Request $request, string $id)
+    {
+        $manifest = static::findManifest($id);
+        if (!$manifest) {
+            return response()->apiError('Manifest resource not found.', 404);
+        }
+
+        $manifest->load(['stops' => fn ($q) => $q->orderBy('sequence')->with('place')]);
+
+        $done    = $manifest->stops->filter(fn ($s) => in_array($s->status, ['completed', 'skipped'], true))->values();
+        $pending = $manifest->stops->reject(fn ($s) => in_array($s->status, ['completed', 'skipped'], true))->values();
+
+        if ($pending->count() < 3) {
+            // Two stops have only one order, and one has none. Re-sequencing
+            // either is work with no possible result.
+            return $this->show($id);
+        }
+
+        $from = $request->filled(['latitude', 'longitude'])
+            ? ['lat' => (float) $request->input('latitude'), 'lon' => (float) $request->input('longitude')]
+            : static::coordinatesOf($pending->first());
+
+        $remaining = $pending->all();
+        $ordered   = [];
+
+        while (count($remaining)) {
+            $closestIndex = 0;
+            $closestCost  = null;
+
+            foreach ($remaining as $index => $stop) {
+                $to = static::coordinatesOf($stop);
+                if (!$from || !$to) {
+                    continue;
+                }
+
+                $cost = static::distanceBetween($from, $to);
+
+                if ($closestCost === null || $cost < $closestCost) {
+                    $closestCost  = $cost;
+                    $closestIndex = $index;
+                }
+            }
+
+            $next      = $remaining[$closestIndex];
+            $ordered[] = $next;
+            $from      = static::coordinatesOf($next) ?? $from;
+            unset($remaining[$closestIndex]);
+            $remaining = array_values($remaining);
+        }
+
+        // Done stops keep the front of the sequence; the rest follow in the new
+        // order. Sequence stays dense so nothing downstream has to cope with
+        // gaps.
+        $sequence = 1;
+        foreach ($done as $stop) {
+            $stop->update(['sequence' => $sequence++]);
+        }
+        foreach ($ordered as $stop) {
+            $stop->update(['sequence' => $sequence++]);
+        }
+
+        return $this->show($id);
+    }
+
+    /** The driver's manifests, newest first. Separated so it can be stubbed. */
+    protected static function manifestsFor(Driver $driver)
+    {
+        return Manifest::where('driver_uuid', $driver->uuid)
+            ->with(['driver', 'vehicle'])
+            ->orderBy('scheduled_date', 'desc');
+    }
+
+    protected static function findDriverRecord(string $id): ?Driver
+    {
+        return Driver::where('public_id', $id)->orWhere('uuid', $id)->first();
+    }
+
+    protected static function findManifest(string $id): ?Manifest
+    {
+        return Manifest::where('public_id', $id)->orWhere('uuid', $id)->first();
+    }
+
+    protected static function findStop(string $id): ?ManifestStop
+    {
+        return ManifestStop::where('public_id', $id)->orWhere('uuid', $id)->first();
+    }
+
+    /**
+     * Straight-line distance between two coordinates, in metres.
+     *
+     * Deliberately not a routing call. A nearest-neighbour walk compares every
+     * remaining stop at every step, so a twenty-stop route asks roughly four
+     * hundred distance questions — as road lookups that is four hundred network
+     * round trips for one tap, which is not a thing to do on a handset waiting
+     * on a driver.
+     *
+     * Straight-line ordering and road ordering rarely disagree about which of
+     * several stops is nearest, and where they do the result is still a valid
+     * route, just not the shortest one. Since the method is a heuristic either
+     * way, the cheap version is the honest choice.
+     */
+    protected static function distanceBetween(array $from, array $to): float
+    {
+        $earthRadius = 6371000.0;
+
+        $lat1 = deg2rad($from['lat']);
+        $lat2 = deg2rad($to['lat']);
+        $dLat = $lat2 - $lat1;
+        $dLon = deg2rad($to['lon'] - $from['lon']);
+
+        $a = sin($dLat / 2) ** 2 + cos($lat1) * cos($lat2) * sin($dLon / 2) ** 2;
+
+        return $earthRadius * 2 * atan2(sqrt($a), sqrt(1 - $a));
+    }
+
+    /** Latitude and longitude of a stop's place, when it has one. */
+    protected static function coordinatesOf(?ManifestStop $stop): ?array
+    {
+        $location = data_get($stop, 'place.location');
+        if (!$location) {
+            return null;
+        }
+
+        return ['lat' => (float) $location->getLat(), 'lon' => (float) $location->getLng()];
+    }
+}

package/server/src/Http/Controllers/Api/v1/VehicleController.php

@@ -352,6 +352,12 @@ class VehicleController extends Controller
         return $request->only([
             'status', 'make', 'model', 'year', 'trim', 'type', 'plate_number', 'vin',
             'meta', 'online', 'location', 'altitude', 'heading', 'speed',
+            // Odometer is fillable on the model and unrestricted by the request
+            // rules, but was absent here — so a caller sending one received a
+            // 200 and a response body that looked correct while the reading was
+            // discarded. Recording mileage is the single most common write a
+            // driver app makes against a vehicle.
+            'odometer', 'odometer_unit',
             'payload_capacity', 'payload_capacity_volume',
             'payload_capacity_pallets', 'payload_capacity_parcels',
             'skills', 'max_tasks', 'time_window_start', 'time_window_end', 'return_to_depot',