@fleetbase/fleetops-engine 0.6.60 → 0.6.61

package/server/src/Http/Controllers/Internal/v1/SettingController.php

@@ -328,6 +328,8 @@ class SettingController extends Controller
     {
         $defaults = [
             'mapProvider'                 => 'leaflet',
+            'leafletTileUrl'              => '',
+            'leafletDarkTileUrl'          => '',
             'googleMapsMapType'           => 'roadmap',
             'showGoogleMapsTrafficLayer'  => false,
             'showGoogleMapsTransitLayer'  => false,
@@ -418,12 +420,32 @@ class SettingController extends Controller
         return [
             ...$settings,
             'mapProvider'                => $mapProvider,
+            'leafletTileUrl'             => $this->sanitizeTileUrl(data_get($settings, 'leafletTileUrl', '')),
+            'leafletDarkTileUrl'         => $this->sanitizeTileUrl(data_get($settings, 'leafletDarkTileUrl', '')),
             'googleMapsMapType'          => $googleMapsMapType,
             'showGoogleMapsTrafficLayer' => filter_var(data_get($settings, 'showGoogleMapsTrafficLayer', false), FILTER_VALIDATE_BOOLEAN),
             'showGoogleMapsTransitLayer' => filter_var(data_get($settings, 'showGoogleMapsTransitLayer', false), FILTER_VALIDATE_BOOLEAN),
         ];
     }
 
+    /**
+     * Sanitize a Leaflet XYZ tile URL template — only http(s) URLs are accepted,
+     * anything else is discarded so the frontend falls back to the default tiles.
+     */
+    protected function sanitizeTileUrl($url): string
+    {
+        if (!is_string($url)) {
+            return '';
+        }
+
+        $url = trim($url);
+        if ($url === '' || !preg_match('/^https?:\/\//i', $url)) {
+            return '';
+        }
+
+        return $url;
+    }
+
     /**
      * Retrieve driver scheduling settings for the current company.
      *

package/server/src/Http/Filter/FuelReportFilter.php

@@ -86,6 +86,35 @@ class FuelReportFilter extends Filter
         });
     }
 
+    /**
+     * Aliases for {@see driver()}.
+     *
+     * The base filter resolves a query parameter to a method of the same name
+     * and **silently ignores anything it cannot match**. So a client scoping a
+     * list with `driver_uuid` — the column's own name, and the name every other
+     * part of the payload uses — matched nothing, the filter was dropped, and
+     * the response came back scoped only by company: every driver's records,
+     * with a 200 and no indication that the request had been narrowed at all.
+     *
+     * For a driver app that is a disclosure, not a nuisance: a driver asking
+     * for their own fuel reports received the whole company's.
+     */
+    public function driverUuid(?string $driver)
+    {
+        $this->driver($driver);
+    }
+
+    public function driverAssigned(?string $driver)
+    {
+        $this->driver($driver);
+    }
+
+    /** Alias for {@see vehicle()}, for the same reason. */
+    public function vehicleUuid(?string $vehicle)
+    {
+        $this->vehicle($vehicle);
+    }
+
     public function vehicle(?string $vehicle)
     {
         $this->builder->whereHas('vehicle', function ($q) use ($vehicle) {

package/server/src/Http/Filter/IssueFilter.php

@@ -88,6 +88,35 @@ class IssueFilter extends Filter
         });
     }
 
+    /**
+     * Aliases for {@see driver()}.
+     *
+     * The base filter resolves a query parameter to a method of the same name
+     * and **silently ignores anything it cannot match**. So a client scoping a
+     * list with `driver_uuid` — the column's own name, and the name every other
+     * part of the payload uses — matched nothing, the filter was dropped, and
+     * the response came back scoped only by company: every driver's records,
+     * with a 200 and no indication that the request had been narrowed at all.
+     *
+     * For a driver app that is a disclosure, not a nuisance: a driver asking
+     * for their own fuel reports received the whole company's.
+     */
+    public function driverUuid(?string $driver)
+    {
+        $this->driver($driver);
+    }
+
+    public function driverAssigned(?string $driver)
+    {
+        $this->driver($driver);
+    }
+
+    /** Alias for {@see vehicle()}, for the same reason. */
+    public function vehicleUuid(?string $vehicle)
+    {
+        $this->vehicle($vehicle);
+    }
+
     public function vehicle(?string $vehicle)
     {
         $this->builder->whereHas('vehicle', function ($q) use ($vehicle) {

package/server/src/Http/Requests/CreateVehicleRequest.php

@@ -46,11 +46,16 @@ class CreateVehicleRequest extends FleetbaseRequest
                     'decommissioned',
                 ]),
             ],
-            'vendor'    => 'nullable|exists:vendors,public_id',
-            'driver'    => 'nullable|exists:drivers,public_id',
-            'location'  => ['nullable', new ResolvablePoint()],
-            'latitude'  => ['nullable', 'required_with:longitude'],
-            'longitude' => ['nullable', 'required_with:latitude'],
+            // Validated rather than merely accepted: the model casts odometer
+            // to an integer, so an unchecked string would be stored as 0 — a
+            // vehicle reporting zero miles rather than an error.
+            'odometer'      => 'nullable|numeric|min:0',
+            'odometer_unit' => 'nullable|string|max:12',
+            'vendor'        => 'nullable|exists:vendors,public_id',
+            'driver'        => 'nullable|exists:drivers,public_id',
+            'location'      => ['nullable', new ResolvablePoint()],
+            'latitude'      => ['nullable', 'required_with:longitude'],
+            'longitude'     => ['nullable', 'required_with:latitude'],
         ];
     }
 }

package/server/src/Http/Resources/v1/Manifest.php

@@ -0,0 +1,52 @@
+<?php
+
+namespace Fleetbase\FleetOps\Http\Resources\v1;
+
+use Fleetbase\Http\Resources\FleetbaseResource;
+use Fleetbase\Support\Http;
+
+/**
+ * Public projection of a Manifest — a driver's route for a day.
+ *
+ * A manifest is order-agnostic: it is a sequence of stops, which may belong to
+ * several orders or to none the driver has ever seen as an order. That is why
+ * this exposes the stops directly rather than making a consumer assemble them
+ * from orders.
+ *
+ * Totals ride along because a driver wants to know what the day looks like
+ * before starting it, and computing them client-side from the stop list gives a
+ * different answer than the server's own.
+ */
+class Manifest extends FleetbaseResource
+{
+    /**
+     * Transform the resource into an array.
+     *
+     * @param \Illuminate\Http\Request $request
+     */
+    public function toArray($request): array
+    {
+        return [
+            'id'               => $this->when(Http::isInternalRequest(), $this->id, $this->public_id),
+            'uuid'             => $this->when(Http::isInternalRequest(), $this->uuid),
+            'public_id'        => $this->when(Http::isInternalRequest(), $this->public_id),
+            'status'           => $this->status,
+            'scheduled_date'   => $this->scheduled_date,
+            'started_at'       => $this->started_at,
+            'completed_at'     => $this->completed_at,
+            'total_distance_m' => $this->total_distance_m,
+            'total_duration_s' => $this->total_duration_s,
+            'stop_count'       => $this->stop_count,
+            'completed_stops'  => $this->completed_stops,
+            'pending_stops'    => $this->pending_stops,
+            'driver_name'      => $this->driver_name,
+            'vehicle_name'     => $this->vehicle_name,
+            'notes'            => $this->notes,
+            // Present only when the manifest was loaded with them, so a list
+            // endpoint stays a list.
+            'stops'            => ManifestStop::collection($this->whenLoaded('stops')),
+            'updated_at'       => $this->updated_at,
+            'created_at'       => $this->created_at,
+        ];
+    }
+}

package/server/src/Http/Resources/v1/ManifestStop.php

@@ -0,0 +1,47 @@
+<?php
+
+namespace Fleetbase\FleetOps\Http\Resources\v1;
+
+use Fleetbase\Http\Resources\FleetbaseResource;
+use Fleetbase\Support\Http;
+
+/**
+ * Public projection of a ManifestStop.
+ *
+ * Carries the place inline rather than as an id. A driver app rendering a route
+ * needs a name and a coordinate for every stop, and making it resolve each one
+ * separately turns a route of twenty stops into twenty-one requests.
+ *
+ * `sequence` is the order to drive them in, and is the field a re-sequence
+ * rewrites.
+ */
+class ManifestStop extends FleetbaseResource
+{
+    /**
+     * Transform the resource into an array.
+     *
+     * @param \Illuminate\Http\Request $request
+     */
+    public function toArray($request): array
+    {
+        return [
+            'id'                   => $this->when(Http::isInternalRequest(), $this->id, $this->public_id),
+            'uuid'                 => $this->when(Http::isInternalRequest(), $this->uuid),
+            'public_id'            => $this->when(Http::isInternalRequest(), $this->public_id),
+            'status'               => $this->status,
+            'sequence'             => $this->sequence,
+            'estimated_arrival'    => $this->estimated_arrival,
+            'actual_arrival'       => $this->actual_arrival,
+            'distance_from_prev_m' => $this->distance_from_prev_m,
+            'duration_from_prev_s' => $this->duration_from_prev_s,
+            'place'                => new Place($this->whenLoaded('place')),
+            'order'                => $this->when($this->relationLoaded('order') && $this->order, fn () => [
+                'id'              => data_get($this->order, 'public_id'),
+                'tracking_number' => data_get($this->order, 'trackingNumber.tracking_number'),
+                'status'          => data_get($this->order, 'status'),
+            ]),
+            'updated_at'           => $this->updated_at,
+            'created_at'           => $this->created_at,
+        ];
+    }
+}

package/server/src/Http/Resources/v1/OrderConfig.php

@@ -41,10 +41,25 @@ class OrderConfig extends FleetbaseResource
     }
 
     /**
-     * Project the flow JSON into an ordered list of activities, keeping only
-     * the public-safe per-activity fields. `code` and `status` (the label)
-     * are the contract; `complete`, `color`, `details`, `pod_method`, and
-     * `require_pod` are useful UI hints that can ride along.
+     * Project the flow JSON into a list of activities, keeping the public-safe
+     * per-activity fields.
+     *
+     * `code` and `status` (the label) are the contract; `complete`, `color`,
+     * `details`, `pod_method` and `require_pod` are useful UI hints that ride
+     * along.
+     *
+     * `activities`, `sequence` and `logic` describe the flow's *shape*, and are
+     * published because without them the list cannot be sequenced. The stored
+     * flow is a directed graph — `activities` names the codes an activity can
+     * transition to, `sequence` orders activities reachable from the same
+     * parent, and `logic` gates availability — which is precisely what
+     * `OrderConfig::nextActivity()` walks server-side. Projecting them away
+     * left consumers with an unordered set: a client rendering progress from
+     * array position marks a dispatched order complete whenever `completed`
+     * happens to be declared earlier, and can offer no next step at all.
+     *
+     * These are descriptions of the configured workflow, not internal state, so
+     * there is nothing here a consumer of the config should not see.
      */
     protected function projectFlow(): array
     {
@@ -66,9 +81,41 @@ class OrderConfig extends FleetbaseResource
                 'complete'    => (bool) ($activity['complete'] ?? false),
                 'pod_method'  => $activity['pod_method'] ?? null,
                 'require_pod' => (bool) ($activity['require_pod'] ?? false),
+                'sequence'    => isset($activity['sequence']) ? (int) $activity['sequence'] : null,
+                'activities'  => static::projectTransitions($activity),
+                'logic'       => $activity['logic'] ?? null,
             ];
         }
 
         return $activities;
     }
+
+    /**
+     * The codes an activity can transition to, as a list of strings.
+     *
+     * Stored flows have been written both ways over time: a bare list of codes,
+     * and a list of objects carrying a `code`. Normalising here means consumers
+     * do not each have to guess which one they were handed.
+     */
+    protected static function projectTransitions(array $activity): array
+    {
+        $transitions = $activity['activities'] ?? [];
+        if (!is_array($transitions)) {
+            return [];
+        }
+
+        $codes = [];
+        foreach ($transitions as $transition) {
+            if (is_string($transition)) {
+                $codes[] = $transition;
+                continue;
+            }
+
+            if (is_array($transition) && isset($transition['code']) && is_string($transition['code'])) {
+                $codes[] = $transition['code'];
+            }
+        }
+
+        return $codes;
+    }
 }

package/server/src/Models/Place.php

@@ -129,7 +129,7 @@ class Place extends Model
      *
      * @var array
      */
-    protected $filterParams = ['vendor', 'contact', 'vendor_uuid', 'vendor_name'];
+    protected $filterParams = ['vendor', 'contact', 'vendor_uuid', 'vendor_name', 'avatar_value', 'eta'];
 
     /**
      * @return \Illuminate\Database\Eloquent\Relations\MorphTo

package/server/src/routes.php

@@ -28,6 +28,13 @@ Route::prefix(config('fleetops.api.routing.prefix'))->namespace('Fleetbase\Fleet
                 $router->post('login-with-sms', 'DriverController@loginWithPhone');
                 $router->post('verify-code', 'DriverController@verifyCode');
                 $router->post('login', 'DriverController@login');
+                // Password management. Deliberately separate from the driver
+                // update: changing a password requires proving the old one, and
+                // resetting it requires a code, neither of which a general PUT
+                // can express.
+                $router->post('forgot-password', 'DriverController@forgotPassword');
+                $router->post('reset-password', 'DriverController@resetPassword');
+                $router->post('{id}/change-password', 'DriverController@changePassword');
                 $router->post('{id}/simulate', 'DriverController@simulate');
                 $router->match(['put', 'patch', 'post'], '{id}/track', 'DriverController@track');
                 $router->post('{id}/register-device', 'DriverController@registerDevice');
@@ -37,6 +44,8 @@ Route::prefix(config('fleetops.api.routing.prefix'))->namespace('Fleetbase\Fleet
                 $router->get('/', 'DriverController@query');
                 $router->get('{id}', 'DriverController@find');
                 $router->get('{id}/organizations', 'DriverController@listOrganizations');
+                // A driver's own routes for the day.
+                $router->get('{id}/manifests', 'ManifestController@forDriver');
                 $router->get('{id}/current-organization', 'DriverController@currentOrganization');
                 $router->put('{id}', 'DriverController@update');
                 $router->delete('{id}', 'DriverController@delete');
@@ -185,6 +194,18 @@ Route::prefix(config('fleetops.api.routing.prefix'))->namespace('Fleetbase\Fleet
                 $router->delete('{id}', 'OrderController@delete');
                 $router->get('{id}/editable-entity-fields', 'OrderController@getEditableEntityFields');
             });
+            // manifests — a driver's route. Read and run only: creating,
+            // cancelling and deleting a manifest is dispatch work and stays on
+            // the internal namespace.
+            $router->group(['prefix' => 'manifests'], function () use ($router) {
+                $router->get('{id}', 'ManifestController@show');
+                $router->post('{id}/optimize', 'ManifestController@optimize');
+            });
+            $router->group(['prefix' => 'manifest-stops'], function () use ($router) {
+                $router->patch('{id}', 'ManifestController@updateStop');
+                $router->post('{id}', 'ManifestController@updateStop');
+            });
+
             // entities routes
             $router->group(['prefix' => 'entities'], function () use ($router) {
                 $router->post('/', 'EntityController@create');

package/server/tests/ApiDriverControllerContractsTest.php

@@ -601,3 +601,36 @@ test('api driver controller reports missing driver branches', function () {
             'status'   => 404,
         ]);
 });
+
+test('api driver controller refuses to set a password through a general update', function () {
+    /*
+     * Regression for a takeover path: `update()` passed `password` straight
+     * through to the user, so anyone holding a driver's token — or an unlocked
+     * handset — could set a new one without proving they knew the old one, and
+     * the account was theirs. A password change is an authorisation decision
+     * and now has its own endpoint that demands the current password.
+     */
+    $user = new FleetOpsApiDriverUserFake();
+    $user->setRawAttributes(['uuid' => 'user-uuid'], true);
+    $driver = new FleetOpsApiDriverFake();
+    $driver->setRawAttributes([
+        'uuid'      => 'driver-uuid',
+        'public_id' => 'driver_public',
+        'user_uuid' => 'user-uuid',
+    ], true);
+    $driver->userForTest = $user;
+    $driver->setRelation('user', $user);
+
+    $controller                     = new FleetOpsApiDriverControllerProbe();
+    $controller->driver             = $driver;
+    $controller->sessionCompanyUuid = 'session-company-uuid';
+
+    $controller->update('driver_public', new UpdateDriverRequest([
+        'name'     => 'Driver Updated',
+        'password' => 'attacker-chosen-password',
+    ]));
+
+    expect($user->updates)->not->toBeEmpty()
+        ->and($user->updates[0])->not->toHaveKey('password')
+        ->and($user->updates[0])->toHaveKey('name');
+});