@fleetbase/fleetops-engine 0.6.60 → 0.6.61

package/server/tests/Feature/Http/Api/DriverControllerSessionHelpersTest.php

@@ -10,6 +10,7 @@ use Illuminate\Database\ConnectionResolver;
 use Illuminate\Database\Eloquent\Model as EloquentModel;
 use Illuminate\Database\SQLiteConnection;
 use Illuminate\Http\Request;
+use Illuminate\Support\Facades\Hash;
 
 /**
  * Covers the API DriverController protected session/persistence helpers
@@ -73,6 +74,35 @@ function fleetopsDriverSessionHelpersBoot(): SQLiteConnection
     });
     Illuminate\Support\Facades\DB::clearResolvedInstance('db');
 
+    /*
+     * Only the hashing contract ships with this package, not an implementation,
+     * so the User password mutator has nothing to call. Bind PHP's own hashing
+     * behind the contract: the point of the assertions below is that a password
+     * is stored hashed and verifies, not which algorithm did it.
+     */
+    app()->instance('hash', new class implements Illuminate\Contracts\Hashing\Hasher {
+        public function info($hashedValue): array
+        {
+            return password_get_info($hashedValue);
+        }
+
+        public function make($value, array $options = []): string
+        {
+            return password_hash($value, PASSWORD_BCRYPT);
+        }
+
+        public function check($value, $hashedValue, array $options = []): bool
+        {
+            return is_string($hashedValue) && password_verify($value, $hashedValue);
+        }
+
+        public function needsRehash($hashedValue, array $options = []): bool
+        {
+            return false;
+        }
+    });
+    Hash::clearResolvedInstance('hash');
+
     $schema = $connection->getSchemaBuilder();
     app()->instance('db.schema', $schema);
     $tables = [
@@ -163,6 +193,18 @@ test('user and driver persistence helpers write records', function () {
     expect($user)->toBeInstanceOf(User::class)
         ->and($connection->table('users')->where('name', 'New User')->count())->toBe(1);
 
+    /*
+     * `password` is guarded on User, so mass assignment drops it without a
+     * word. The create endpoint has always documented and validated one, so
+     * unless the helper sets it explicitly a driver created through the API
+     * can never sign in with the password chosen for them.
+     */
+    $withPassword = $probe->callHelper('createUser', ['name' => 'Password User', 'password' => 'seeded-password']);
+    $stored       = $connection->table('users')->where('name', 'Password User')->value('password');
+    expect(Hash::check('seeded-password', $withPassword->password))->toBeTrue()
+        ->and($stored)->not->toBeNull()
+        ->and($stored)->not->toBe('seeded-password');
+
     $driver = $probe->callHelper('createDriver', ['company_uuid' => '22222222-2222-4222-8222-222222222222', 'user_uuid' => 'user-1']);
     expect($driver)->toBeInstanceOf(Driver::class);
 
@@ -173,6 +215,25 @@ test('user and driver persistence helpers write records', function () {
         ->and($connection->table('user_devices')->count())->toBe(1);
 });
 
+test('the driver user loader reads the password column the relation omits', function () {
+    $connection = fleetopsDriverSessionHelpersBoot();
+    $probe      = new FleetOpsDriverSessionHelpersProbe();
+
+    $connection->table('users')->where('uuid', 'user-1')->update(['password' => 'stored-hash']);
+
+    /*
+     * The `user` relation selects a named subset of columns and `password` is
+     * not among them, so a password comparison made through it fails for
+     * everyone regardless of what they typed. Anything checking a password has
+     * to load the record itself.
+     */
+    $driver = Driver::where('public_id', 'driver_one')->first();
+    expect($probe->callHelper('findDriverUserRecord', $driver)->password)->toBe('stored-hash');
+
+    $unlinked = new Driver();
+    expect($probe->callHelper('findDriverUserRecord', $unlinked))->toBeNull();
+});
+
 test('lookup utility and resource helpers resolve records and wrappers', function () {
     fleetopsDriverSessionHelpersBoot();
     $probe = new FleetOpsDriverSessionHelpersProbe();

package/server/tests/Feature/Http/Internal/PlaceControllerTest.php

@@ -36,6 +36,18 @@ if (!Request::hasMacro('resolveFilesFromIds')) {
     Request::macro('resolveFilesFromIds', fn () => FleetOpsInternalPlaceEndpointsState::$files);
 }
 
+if (!Request::hasMacro('or')) {
+    Request::macro('or', function (array $params = [], $default = null) {
+        foreach ($params as $param) {
+            if ($this->has($param)) {
+                return $this->input($param);
+            }
+        }
+
+        return $default;
+    });
+}
+
 class FleetOpsInternalPlaceEndpointsState
 {
     public static array $files = [];
@@ -81,6 +93,14 @@ class FleetOpsInternalPlaceEndpointsPlaceFake extends Place
     }
 }
 
+class FleetOpsInternalPlaceUpdateFake extends Place
+{
+    public function applyDirectivesToQuery(Request $request, $builder)
+    {
+        return $builder;
+    }
+}
+
 class FleetOpsInternalPlaceEndpointsProbe extends PlaceController
 {
     public function callProtected(string $method, array $arguments = []): mixed
@@ -128,6 +148,7 @@ function fleetopsInternalPlaceEndpointsBoot(): SQLiteConnection
         $table->string('postal_code')->nullable();
         $table->string('location')->nullable();
         $table->timestamp('created_at')->nullable();
+        $table->timestamp('updated_at')->nullable();
         $table->timestamp('deleted_at')->nullable();
     });
     $schema->create('files', function ($table) {
@@ -250,3 +271,27 @@ test('sync custom field values helper delegates to the place model', function ()
 
     expect($place->syncedValues)->toBe([['priority' => 'high']]);
 });
+
+test('place updates accept serialized display-only attributes', function () {
+    $connection = fleetopsInternalPlaceEndpointsBoot();
+    $connection->table('places')->insert([
+        'uuid'         => '77777777-7777-4777-8777-777777777777',
+        'public_id'    => 'place_display1',
+        'company_uuid' => 'company-1',
+        'name'         => 'Original place',
+        'street1'      => '205 Dostyk Avenue',
+    ]);
+
+    $place = (new FleetOpsInternalPlaceUpdateFake())->updateRecordFromRequest(Request::create('/int/v1/places/place_display1', 'PUT', [
+        'place' => [
+            'name'         => 'Updated place',
+            'street2'      => 'Entrance 2',
+            'avatar_value' => 'basic-building',
+            'eta'          => '12 minutes',
+        ],
+    ]), 'place_display1', options: ['return_object' => true]);
+
+    expect($place->name)->toBe('Updated place')
+        ->and($place->street2)->toBe('Entrance 2')
+        ->and($connection->table('places')->where('public_id', 'place_display1')->value('name'))->toBe('Updated place');
+});

package/server/tests/RequestContractsTest.php

@@ -300,6 +300,11 @@ namespace {
             ->and($vehicleRules['longitude'])->toBe(['nullable', 'required_with:latitude'])
             ->and(ruleStrings($vehicleRules['status']))->toContain('nullable')
             ->and(implode('|', ruleStrings($vehicleRules['status'])))->toContain('operational')
+            // The model casts odometer to an integer, so an unvalidated string
+            // would land as 0 — a vehicle reporting zero miles rather than an
+            // error. These rules are what stop that.
+            ->and($vehicleRules['odometer'])->toBe('nullable|numeric|min:0')
+            ->and($vehicleRules['odometer_unit'])->toBe('nullable|string|max:12')
             ->and($fuelReportRules['driver'])->toBe(['required'])
             ->and($fuelReportRules['odometer'])->toBe(['required'])
             ->and($fuelReportRules['volume'])->toBe(['required'])

package/server/tests/SettingControllerContractsTest.php

@@ -408,3 +408,36 @@ test('setting controller handles map scheduling orchestrator and card field sett
             'settings' => ['standard' => ['tracking'], 'byConfig' => [], 'meta' => ['dense' => true]],
         ]);
 });
+
+test('setting controller sanitizes leaflet tile provider urls', function () {
+    $controller = new FleetOpsSettingControllerProbe();
+
+    $saved = fleetopsJsonPayload($controller->saveMapSettings(new Request([
+        'settings' => [
+            'leafletTileUrl'     => '  https://tile.openstreetmap.org/{z}/{x}/{y}.png  ',
+            'leafletDarkTileUrl' => 'javascript:alert(1)',
+        ],
+    ])));
+
+    expect($saved['leafletTileUrl'])->toBe('https://tile.openstreetmap.org/{z}/{x}/{y}.png')
+        ->and($saved['leafletDarkTileUrl'])->toBe('')
+        ->and($controller->configuredCompany['fleet-ops.map-settings'])->toMatchArray([
+            'leafletTileUrl'     => 'https://tile.openstreetmap.org/{z}/{x}/{y}.png',
+            'leafletDarkTileUrl' => '',
+        ]);
+
+    $savedNonString = fleetopsJsonPayload($controller->saveMapSettings(new Request([
+        'settings' => [
+            'leafletTileUrl'     => ['not' => 'a-string'],
+            'leafletDarkTileUrl' => 'ftp://tiles.example.com/{z}/{x}/{y}.png',
+        ],
+    ])));
+
+    expect($savedNonString['leafletTileUrl'])->toBe('')
+        ->and($savedNonString['leafletDarkTileUrl'])->toBe('');
+
+    $defaults = fleetopsJsonPayload((new FleetOpsSettingControllerProbe())->getMapSettings());
+
+    expect($defaults['leafletTileUrl'])->toBe('')
+        ->and($defaults['leafletDarkTileUrl'])->toBe('');
+});

package/server/tests/Unit/Http/Filter/FuelReportFilterTest.php

@@ -0,0 +1,135 @@
+<?php
+
+use Fleetbase\FleetOps\Http\Filter\FuelReportFilter;
+use Fleetbase\Http\Filter\Filter;
+use Illuminate\Http\Request;
+
+/**
+ * Covers the FuelReportFilter query branches against a recording builder fake:
+ * base scoping, keyword search, priority and status constraints, and the
+ * assignee, reporter, driver and vehicle relation lookups routing by uuid,
+ * public id, or fallback search.
+ */
+class FleetOpsFuelReportFilterUnitQuery
+{
+    public array $calls = [];
+
+    public function where(...$arguments): self
+    {
+        if (isset($arguments[0]) && is_callable($arguments[0])) {
+            $nested = new self();
+            $arguments[0]($nested);
+            $this->calls[] = ['whereNested', $nested->calls];
+
+            return $this;
+        }
+
+        $this->calls[] = ['where', $arguments];
+
+        return $this;
+    }
+
+    public function whereHas(string $relation, ?callable $callback = null): self
+    {
+        $nested = new self();
+        if ($callback) {
+            $callback($nested);
+        }
+        $this->calls[] = ['whereHas', $relation, $nested->calls];
+
+        return $this;
+    }
+
+    public function search(?string $query): self
+    {
+        $this->calls[] = ['search', $query];
+
+        return $this;
+    }
+
+    public function whereIn(string $column, mixed $values): self
+    {
+        $this->calls[] = ['whereIn', $column, $values];
+
+        return $this;
+    }
+
+    public function whereBetween(string $column, mixed $bounds): self
+    {
+        $this->calls[] = ['whereBetween', $column, $bounds];
+
+        return $this;
+    }
+
+    public function whereDate(string $column, mixed $value): self
+    {
+        $this->calls[] = ['whereDate', $column, $value];
+
+        return $this;
+    }
+
+    public function __call($method, $arguments): self
+    {
+        $this->calls[] = [$method, $arguments];
+
+        return $this;
+    }
+}
+
+function fleetopsFuelReportFilterUnitFilter(FleetOpsFuelReportFilterUnitQuery $builder, ?Request $request = null): FuelReportFilter
+{
+    $filter = (new ReflectionClass(FuelReportFilter::class))->newInstanceWithoutConstructor();
+
+    foreach ([
+        'builder' => $builder,
+        'session' => new class {
+            public function get(string $key): ?string
+            {
+                return $key === 'company' ? 'company-uuid' : null;
+            }
+        },
+        'request' => $request ?? new Request(),
+    ] as $property => $value) {
+        $reflection = new ReflectionProperty(Filter::class, $property);
+        $reflection->setAccessible(true);
+        $reflection->setValue($filter, $value);
+    }
+
+    return $filter;
+}
+
+test('fuel report filter scopes by driver_uuid and driver_assigned, not just driver', function () {
+    foreach (['driverUuid', 'driverAssigned'] as $method) {
+        $builder = new FleetOpsFuelReportFilterUnitQuery();
+        $filter  = fleetopsFuelReportFilterUnitFilter($builder);
+
+        $filter->{$method}('driver_filterone');
+
+        $whereHas = collect($builder->calls)->where(0, 'whereHas')->firstWhere(1, 'driver');
+        expect($whereHas)->not->toBeNull("{$method} must constrain the driver relation")
+            ->and($whereHas[2][0][1][0])->toBe('public_id');
+    }
+});
+
+test('fuel report filter driver aliases route uuids the same way driver does', function () {
+    $builder = new FleetOpsFuelReportFilterUnitQuery();
+    $filter  = fleetopsFuelReportFilterUnitFilter($builder);
+
+    $filter->driverUuid('33333333-3333-4333-8333-333333333333');
+
+    $whereHas = collect($builder->calls)->where(0, 'whereHas')->firstWhere(1, 'driver');
+    expect($whereHas[2][0][1][0])->toBe('uuid');
+});
+
+test('fuel report filter scopes by vehicle_uuid as well as vehicle', function () {
+    $builder = new FleetOpsFuelReportFilterUnitQuery();
+    $filter  = fleetopsFuelReportFilterUnitFilter($builder);
+
+    $filter->vehicleUuid('44444444-4444-4444-8444-444444444444');
+    $filter->vehicleUuid('vehicle_filterone');
+
+    $whereHasCalls = collect($builder->calls)->where(0, 'whereHas')->where(1, 'vehicle')->values();
+    expect($whereHasCalls)->toHaveCount(2)
+        ->and($whereHasCalls[0][2][0][1][0])->toBe('uuid')
+        ->and($whereHasCalls[1][2][0][1][0])->toBe('public_id');
+});

package/server/tests/Unit/Http/Filter/IssueFilterTest.php

@@ -127,3 +127,46 @@ test('issue filter relation branches route uuids public ids and searches', funct
     $searchNested = $whereHasCalls->filter(fn ($call) => collect($call[2])->contains(fn ($inner) => $inner[0] === 'search'));
     expect($searchNested->count())->toBeGreaterThanOrEqual(3);
 });
+
+test('issue filter scopes by driver_uuid and driver_assigned, not just driver', function () {
+    /*
+     * The base filter resolves a query parameter to a method of the same name
+     * and silently ignores what it cannot match. `driver_uuid` matched nothing,
+     * so the filter was dropped and the list came back scoped only by company —
+     * every driver's issues, with a 200 and no sign the request had been
+     * narrowed. For a driver app that is a disclosure, not a nuisance.
+     */
+    foreach (['driverUuid', 'driverAssigned'] as $method) {
+        $builder = new FleetOpsIssueFilterUnitQuery();
+        $filter  = fleetopsIssueFilterUnitFilter($builder);
+
+        $filter->{$method}('driver_filterone');
+
+        $whereHas = collect($builder->calls)->where(0, 'whereHas')->firstWhere(1, 'driver');
+        expect($whereHas)->not->toBeNull("{$method} must constrain the driver relation")
+            ->and($whereHas[2][0][1][0])->toBe('public_id');
+    }
+});
+
+test('issue filter driver aliases route uuids the same way driver does', function () {
+    $builder = new FleetOpsIssueFilterUnitQuery();
+    $filter  = fleetopsIssueFilterUnitFilter($builder);
+
+    $filter->driverUuid('33333333-3333-4333-8333-333333333333');
+
+    $whereHas = collect($builder->calls)->where(0, 'whereHas')->firstWhere(1, 'driver');
+    expect($whereHas[2][0][1][0])->toBe('uuid');
+});
+
+test('issue filter scopes by vehicle_uuid as well as vehicle', function () {
+    $builder = new FleetOpsIssueFilterUnitQuery();
+    $filter  = fleetopsIssueFilterUnitFilter($builder);
+
+    $filter->vehicleUuid('44444444-4444-4444-8444-444444444444');
+    $filter->vehicleUuid('vehicle_filterone');
+
+    $whereHasCalls = collect($builder->calls)->where(0, 'whereHas')->where(1, 'vehicle')->values();
+    expect($whereHasCalls)->toHaveCount(2)
+        ->and($whereHasCalls[0][2][0][1][0])->toBe('uuid')
+        ->and($whereHasCalls[1][2][0][1][0])->toBe('public_id');
+});

package/server/tests/Unit/Http/Resources/ManifestResourceTest.php

@@ -0,0 +1,129 @@
+<?php
+
+/*
+ * The models resolve their connection through a namespaced `config()`, which
+ * does not exist without the full application. Stubbed so a resource can be
+ * exercised on its own — the projection is the thing under test, not Eloquent.
+ */
+if (!function_exists('Fleetbase\Traits\config')) {
+    eval('namespace Fleetbase\Traits; function config($key = null, $default = null) { return $key === "api.cache.enabled" ? false : $default; }');
+}
+
+if (!function_exists('Fleetbase\Models\config')) {
+    eval('namespace Fleetbase\Models; function config($key = null, $default = null) { return $default; }');
+}
+
+if (!function_exists('Fleetbase\FleetOps\Models\config')) {
+    eval('namespace Fleetbase\FleetOps\Models; function config($key = null, $default = null) { return $default; }');
+}
+
+use Fleetbase\FleetOps\Http\Resources\v1\Manifest as ManifestResource;
+use Fleetbase\FleetOps\Http\Resources\v1\ManifestStop as ManifestStopResource;
+use Fleetbase\FleetOps\Models\Manifest;
+use Fleetbase\FleetOps\Models\ManifestStop;
+use Illuminate\Http\Request;
+
+if (!class_exists('FleetOpsSupportRequestState')) {
+    class FleetOpsSupportRequestState
+    {
+        public static ?Request $request = null;
+    }
+}
+
+if (!function_exists('Fleetbase\Support\request')) {
+    eval('namespace Fleetbase\Support; function request($key = null, $default = null) { return \FleetOpsSupportRequestState::$request; }');
+}
+
+/**
+ * The manifest's stop counts are accessors that query the database, and the
+ * driver and vehicle names walk relations. None of that is what a resource test
+ * is for, so they are answered directly — the projection is under test, not
+ * Eloquent.
+ */
+class FleetOpsManifestFake extends Manifest
+{
+    public function getCompletedStopsAttribute(): int
+    {
+        return 3;
+    }
+
+    public function getPendingStopsAttribute(): int
+    {
+        return 5;
+    }
+
+    public function getDriverNameAttribute(): ?string
+    {
+        return 'Ron';
+    }
+
+    public function getVehicleNameAttribute(): ?string
+    {
+        return 'EAS-01';
+    }
+}
+
+test('manifest resource publishes what a driver needs to run a route', function () {
+    $request                             = Request::create('/v1/manifests/manifest_public', 'GET');
+    FleetOpsSupportRequestState::$request = $request;
+
+    $manifest = new FleetOpsManifestFake();
+    $manifest->setRawAttributes([
+        'id'               => 3,
+        'uuid'             => 'manifest-uuid',
+        'public_id'        => 'manifest_public',
+        'status'           => 'in_progress',
+        'total_distance_m' => 41200,
+        'total_duration_s' => 5400,
+        'stop_count'       => 8,
+        'notes'            => 'Cold chain first',
+    ], true);
+
+    $payload = (new ManifestResource($manifest))->resolve($request);
+
+    expect($payload['id'])->toBe('manifest_public')
+        ->and($payload['status'])->toBe('in_progress')
+        ->and($payload['total_distance_m'])->toBe(41200)
+        ->and($payload['stop_count'])->toBe(8)
+        ->and($payload['notes'])->toBe('Cold chain first')
+        ->and($payload['completed_stops'])->toBe(3)
+        ->and($payload['pending_stops'])->toBe(5)
+        ->and($payload['driver_name'])->toBe('Ron');
+});
+
+test('manifest resource omits stops when they were not loaded, so a list stays a list', function () {
+    // A driver's manifest list on a busy fleet must not drag every stop of
+    // every route along with it.
+    $request                             = Request::create('/v1/drivers/driver_public/manifests', 'GET');
+    FleetOpsSupportRequestState::$request = $request;
+
+    $manifest = new FleetOpsManifestFake();
+    $manifest->setRawAttributes(['id' => 4, 'uuid' => 'm-uuid', 'public_id' => 'manifest_public', 'status' => 'pending'], true);
+
+    $payload = (new ManifestResource($manifest))->resolve($request);
+
+    expect($payload)->not->toHaveKey('stops');
+});
+
+test('manifest stop resource carries the sequence a re-sequence rewrites', function () {
+    $request                             = Request::create('/v1/manifest-stops/stop_public', 'GET');
+    FleetOpsSupportRequestState::$request = $request;
+
+    $stop = new ManifestStop();
+    $stop->setRawAttributes([
+        'id'                   => 9,
+        'uuid'                 => 'stop-uuid',
+        'public_id'            => 'stop_public',
+        'status'               => 'pending',
+        'sequence'             => 4,
+        'distance_from_prev_m' => 1800,
+        'duration_from_prev_s' => 240,
+    ], true);
+
+    $payload = (new ManifestStopResource($stop))->resolve($request);
+
+    expect($payload['id'])->toBe('stop_public')
+        ->and($payload['sequence'])->toBe(4)
+        ->and($payload['status'])->toBe('pending')
+        ->and($payload['distance_from_prev_m'])->toBe(1800);
+});

package/server/tests/Unit/Http/Resources/OrderConfigResourceTest.php

@@ -45,3 +45,94 @@ test('order config resource projects empty and invalid flow as an empty list', f
     expect($payload['id'])->toBe('order_config_public')
         ->and($payload['flow'])->toBe([]);
 });
+
+test('order config resource publishes the flow graph so consumers can sequence it', function () {
+    $request                                          = Request::create('/v1/fleet-ops/order-configs/order_config_public', 'GET');
+    FleetOpsOrderConfigResourceRequestState::$request = $request;
+    FleetOpsSupportRequestState::$request             = $request;
+
+    // Declared deliberately out of workflow order, which is how flows are
+    // stored: `completed` before the step that leads to it, `dispatched` last.
+    $config = new OrderConfig();
+    $config->setRawAttributes([
+        'id'        => 8,
+        'uuid'      => 'order-config-uuid',
+        'public_id' => 'order_config_public',
+        'key'       => 'transport',
+        'name'      => 'Transport',
+        'flow'      => [
+            ['code' => 'completed', 'status' => 'Order Completed', 'complete' => true, 'activities' => []],
+            ['code' => 'created', 'status' => 'Order Created', 'activities' => ['dispatched']],
+            ['code' => 'dispatched', 'status' => 'Order Dispatched', 'activities' => ['enroute'], 'sequence' => 2],
+            [
+                'code'       => 'enroute',
+                'status'     => 'Driver Enroute',
+                'activities' => ['completed', 'failed'],
+                'logic'      => [['type' => 'and', 'conditions' => []]],
+            ],
+        ],
+    ], true);
+
+    $flow   = (new OrderConfigResource($config))->resolve($request)['flow'];
+    $byCode = collect($flow)->keyBy('code');
+
+    expect($byCode['created']['activities'])->toBe(['dispatched'])
+        ->and($byCode['dispatched']['sequence'])->toBe(2)
+        ->and($byCode['enroute']['activities'])->toBe(['completed', 'failed'])
+        ->and($byCode['enroute']['logic'])->toBe([['type' => 'and', 'conditions' => []]])
+        ->and($byCode['completed']['complete'])->toBeTrue();
+});
+
+test('order config resource normalises transitions written as objects', function () {
+    $request                                          = Request::create('/v1/fleet-ops/order-configs/order_config_public', 'GET');
+    FleetOpsOrderConfigResourceRequestState::$request = $request;
+    FleetOpsSupportRequestState::$request             = $request;
+
+    // Flows have been authored both ways; a consumer should not have to guess.
+    $config = new OrderConfig();
+    $config->setRawAttributes([
+        'id'        => 9,
+        'uuid'      => 'order-config-uuid',
+        'public_id' => 'order_config_public',
+        'key'       => 'transport',
+        'name'      => 'Transport',
+        'flow'      => [
+            ['code' => 'created', 'activities' => [['code' => 'dispatched'], 'enroute', ['label' => 'no code here']]],
+            // A flow hand-edited down to a single transition can leave a bare
+            // string where the list belongs. Publish an empty list rather than
+            // letting the shape vary — a consumer iterating the field should
+            // never have to type-check it.
+            ['code' => 'dispatched', 'activities' => 'enroute'],
+        ],
+    ], true);
+
+    $flow = (new OrderConfigResource($config))->resolve($request)['flow'];
+
+    expect($flow[0]['activities'])->toBe(['dispatched', 'enroute'])
+        ->and($flow[1]['activities'])->toBe([]);
+});
+
+test('order config resource keeps flow fields absent from a legacy activity null rather than missing', function () {
+    $request                                          = Request::create('/v1/fleet-ops/order-configs/order_config_public', 'GET');
+    FleetOpsOrderConfigResourceRequestState::$request = $request;
+    FleetOpsSupportRequestState::$request             = $request;
+
+    $config = new OrderConfig();
+    $config->setRawAttributes([
+        'id'        => 10,
+        'uuid'      => 'order-config-uuid',
+        'public_id' => 'order_config_public',
+        'key'       => 'transport',
+        'name'      => 'Transport',
+        'flow'      => [['code' => 'created', 'status' => 'Order Created']],
+    ], true);
+
+    $flow = (new OrderConfigResource($config))->resolve($request)['flow'];
+
+    // Present-and-null is a contract a client can read; absent is one it has to
+    // feel for.
+    expect($flow[0])->toHaveKeys(['sequence', 'activities', 'logic'])
+        ->and($flow[0]['sequence'])->toBeNull()
+        ->and($flow[0]['activities'])->toBe([])
+        ->and($flow[0]['logic'])->toBeNull();
+});

package/translations/en-us.yaml

@@ -2006,6 +2006,10 @@ settings:
         map-provider: Map Provider
         map-provider-help-text: Choose the map engine used to render the live operations map. Leaflet uses OpenStreetMap tiles and requires no API key. Google Maps requires a valid Google Maps JavaScript API key.
         select-map-provider: Select map provider
+        leaflet-tile-url: Leaflet Tile Provider URL
+        leaflet-tile-url-help-text: Optional custom XYZ tile provider URL template used by the Leaflet map. Leave blank to use the default OpenStreetMap tiles which require no API key. Use this to point Leaflet at your own tile provider, including keyed providers such as CARTO.
+        leaflet-dark-tile-url: Leaflet Dark Mode Tile Provider URL
+        leaflet-dark-tile-url-help-text: Optional tile provider URL used when the console is in dark mode. Leave blank to fall back to the tile provider URL above, or the default OpenStreetMap tiles.
         google-maps-map-type: Map Type
         google-maps-map-type-help-text: The default map style to display when Google Maps is active.
         select-map-type: Select map type