@fleetbase/fleetops-engine 0.6.60 → 0.6.62

package/server/tests/RequestContractsTest.php

@@ -290,6 +290,8 @@ namespace {
     });
 
     test('vehicle and fuel report requests expose core validation contracts', function () {
+        session(['company' => 'company-uuid']);
+
         $vehicleRules          = requestRules(CreateVehicleRequest::class);
         $fuelReportRules       = requestRules(CreateFuelReportRequest::class);
         $fuelReportUpdateRules = requestRules(UpdateFuelReportRequest::class, 'PATCH');
@@ -300,6 +302,58 @@ namespace {
             ->and($vehicleRules['longitude'])->toBe(['nullable', 'required_with:latitude'])
             ->and(ruleStrings($vehicleRules['status']))->toContain('nullable')
             ->and(implode('|', ruleStrings($vehicleRules['status'])))->toContain('operational')
+            // The model casts odometer to an integer, so an unvalidated string
+            // would land as 0 — a vehicle reporting zero miles rather than an
+            // error. These rules are what stop that.
+            ->and($vehicleRules['odometer'])->toBe('nullable|numeric|min:0')
+            ->and($vehicleRules['odometer_unit'])->toBe('nullable|string|max:12')
+            // Postman documented three statuses while the API accepted nineteen.
+            // This enum is the source of truth both must agree with; dropping a
+            // value would silently break an integration already sending it.
+            ->and(CreateVehicleRequest::STATUSES)->toContain(
+                'active',
+                'available',
+                'in_use',
+                'maintenance',
+                'out_of_service',
+                'reserved',
+                'retired',
+                'staging',
+                'on_route',
+                'idle',
+                'cleaning',
+                'awaiting_parts',
+                'inspection_due',
+                'inspection_failed',
+                'accident',
+                'compliance_hold',
+                'stolen',
+                'operational',
+                'decommissioned',
+            )
+            // Every newly exposed vehicle field carries a type-appropriate rule.
+            ->and($vehicleRules['year'])->toBe('nullable|integer|min:1900|max:2100')
+            ->and($vehicleRules['dpf_equipped'])->toBe('nullable|boolean')
+            ->and($vehicleRules['purchased_at'])->toBe('nullable|date')
+            ->and($vehicleRules['currency'])->toBe('nullable|string|size:3')
+            ->and($vehicleRules['specs'])->toBe('nullable|array')
+            ->and($vehicleRules['meta'])->toBe('nullable|array')
+            ->and($vehicleRules['seating_capacity'])->toBe('nullable|integer|min:0')
+            ->and($vehicleRules['weight'])->toBe('nullable|numeric|min:0')
+            ->and($vehicleRules['return_to_depot'])->toBe('nullable|boolean')
+            // Relationship inputs are confined to the caller's own company.
+            ->and(ruleStrings($vehicleRules['vendor']))->toContain('exists:vendors,public_id')
+            ->and(ruleStrings($vehicleRules['driver']))->toContain('exists:drivers,public_id')
+            ->and(ruleStrings($vehicleRules['category']))->toContain('exists:categories,public_id')
+            ->and(ruleStrings($vehicleRules['warranty']))->toContain('exists:warranties,public_id')
+            ->and($vehicleRules['vendor'][2]->constraints)->toBe([
+                ['where', 'company_uuid', 'company-uuid'],
+                ['whereNull', 'deleted_at'],
+            ])
+            ->and($vehicleRules['driver'][2]->constraints)->toBe([
+                ['where', 'company_uuid', 'company-uuid'],
+                ['whereNull', 'deleted_at'],
+            ])
             ->and($fuelReportRules['driver'])->toBe(['required'])
             ->and($fuelReportRules['odometer'])->toBe(['required'])
             ->and($fuelReportRules['volume'])->toBe(['required'])
@@ -429,7 +483,30 @@ namespace {
             ])
             ->and(ruleStrings($fleetCreateRules['name']))->toContain('required')
             ->and(ruleStrings($fleetPatchRules['name']))->not->toContain('required')
-            ->and($fleetCreateRules['service_area'])->toBe('exists:service_areas,public_id')
+            ->and(ruleStrings($fleetCreateRules['service_area']))->toContain('nullable', 'exists:service_areas,public_id')
+            ->and(ruleStrings($fleetCreateRules['zone']))->toContain('exists:zones,public_id')
+            ->and(ruleStrings($fleetCreateRules['vendor']))->toContain('exists:vendors,public_id')
+            ->and(ruleStrings($fleetCreateRules['parent_fleet']))->toContain('exists:fleets,public_id')
+            ->and($fleetCreateRules['color'])->toBe('nullable|string|max:64')
+            ->and($fleetCreateRules['task'])->toBe('nullable|string|max:191')
+            ->and($fleetCreateRules['status'])->toBe('nullable|string|max:64')
+            // Every fleet relationship input is confined to the caller's own
+            // company, so another organization's public id cannot be assigned
+            // — and cannot be probed for existence either.
+            ->and($fleetCreateRules['service_area'][2]->constraints)->toBe([
+                ['where', 'company_uuid', 'company-uuid'],
+                ['whereNull', 'deleted_at'],
+            ])
+            ->and($fleetCreateRules['parent_fleet'][2]->constraints)->toBe([
+                ['where', 'company_uuid', 'company-uuid'],
+                ['whereNull', 'deleted_at'],
+            ])
+            // A validation message naming `parent_fleet` reads worse than one
+            // naming "parent fleet".
+            ->and(CreateFleetRequest::create('/fleetops-test', 'POST')->attributes())->toBe([
+                'service_area' => 'service area',
+                'parent_fleet' => 'parent fleet',
+            ])
             ->and(requestRules(CancelOrderRequest::class))->toBe(['order' => 'required|exists:orders,uuid'])
             ->and(requestRules(DecodeTrackingNumberQR::class))->toBe(['code' => 'required|string'])
             ->and(requestRules(CreateServiceQuoteRequest::class))->toBe([]);
@@ -833,6 +910,9 @@ namespace {
     });
 
     test('driver request authorizes api sanctum and navigator sessions with identity rules', function () {
+        // The harness `session()` is a process-wide static independent of the
+        // bound store, and the company-scoped rule closures read it.
+        session(['company' => 'company-uuid']);
         bindFleetOpsRequestSession();
 
         $request = CreateDriverRequest::create('/fleetops-test', 'POST', [
@@ -849,15 +929,27 @@ namespace {
         expect($request->authorize())->toBeTrue()
             ->and(ruleStrings($createRules['name']))->toContain('required')
             ->and(ruleStrings($patchRules['name']))->not->toContain('required')
-            ->and(ruleStrings($createRules['email']))->toContain('required', 'email', 'unique:users')
-            ->and(ruleStrings($createRules['phone']))->toContain('required', 'unique:users')
+            // Contact details are optional but still validated and still unique:
+            // an operational driver record may legitimately have neither.
+            ->and(ruleStrings($createRules['email']))->toContain('nullable', 'email', 'unique:users')
+            ->and(ruleStrings($createRules['email']))->not->toContain('required')
+            ->and(ruleStrings($createRules['phone']))->toContain('nullable', 'unique:users')
+            ->and(ruleStrings($createRules['phone']))->not->toContain('required')
             ->and($createRules['password'])->toBe('nullable|string')
             ->and($createRules['country'])->toBe('nullable|size:2')
-            ->and($createRules['vehicle'])->toBe('nullable|string|starts_with:vehicle_|exists:vehicles,public_id')
+            ->and(ruleStrings($createRules['vehicle']))->toContain('nullable', 'string', 'starts_with:vehicle_', 'exists:vehicles,public_id')
             ->and($createRules['license_expiry'])->toBe('nullable|date')
             ->and($createRules['status'])->toBe('nullable|string|in:active,available,inactive')
-            ->and($createRules['vendor'])->toBe('nullable|exists:vendors,public_id')
-            ->and($createRules['job'])->toBe('nullable|exists:orders,public_id')
+            ->and(ruleStrings($createRules['vendor']))->toContain('nullable', 'exists:vendors,public_id')
+            ->and(ruleStrings($createRules['job']))->toContain('nullable', 'exists:orders,public_id')
+            ->and($createRules['vehicle'][3]->constraints)->toBe([
+                ['where', 'company_uuid', 'company-uuid'],
+                ['whereNull', 'deleted_at'],
+            ])
+            ->and($createRules['internal_id'])->toBe('nullable|string|max:191')
+            ->and($createRules['meta'])->toBe('nullable|array')
+            ->and($createRules['current_status'])->toBe('nullable|string|max:64')
+            ->and($createRules['max_travel_time'])->toBe('nullable|integer|min:0')
             ->and($createRules['location'][1])->toBeInstanceOf(ResolvablePoint::class)
             ->and($createRules['latitude'])->toBe(['nullable', 'required_with:longitude'])
             ->and($createRules['longitude'])->toBe(['nullable', 'required_with:latitude'])
@@ -949,7 +1041,13 @@ namespace {
             ->and(ruleStrings($rateRules['peak_hours_calculation_method']))->toContain('required', 'in:percentage,flat')
             ->and(ruleStrings($rateRules['peak_hours_percent']))->toContain('required', 'integer')
             ->and(ruleStrings($rateRules['peak_hours_start']))->toContain('required', 'date_format:H:i')
-            ->and(ruleStrings($rateRules['peak_hours_end']))->toContain('required', 'date_format:H:i');
+            ->and(ruleStrings($rateRules['peak_hours_end']))->toContain('required', 'date_format:H:i')
+            // Both relationships are optional, so an empty one has to read as
+            // absent. Without `nullable` the `exists` rule runs against the null
+            // that ConvertEmptyStringsToNull produced and answers "the selected
+            // service area is invalid" for a field the caller left blank.
+            ->and(ruleStrings($rateRules['service_area']))->toContain('nullable')
+            ->and(ruleStrings($rateRules['zone']))->toContain('nullable');
 
         // A street address alone satisfies the name requirement on create, and
         // updates never require either field since the record already exists

package/server/tests/SettingControllerContractsTest.php

@@ -408,3 +408,36 @@ test('setting controller handles map scheduling orchestrator and card field sett
             'settings' => ['standard' => ['tracking'], 'byConfig' => [], 'meta' => ['dense' => true]],
         ]);
 });
+
+test('setting controller sanitizes leaflet tile provider urls', function () {
+    $controller = new FleetOpsSettingControllerProbe();
+
+    $saved = fleetopsJsonPayload($controller->saveMapSettings(new Request([
+        'settings' => [
+            'leafletTileUrl'     => '  https://tile.openstreetmap.org/{z}/{x}/{y}.png  ',
+            'leafletDarkTileUrl' => 'javascript:alert(1)',
+        ],
+    ])));
+
+    expect($saved['leafletTileUrl'])->toBe('https://tile.openstreetmap.org/{z}/{x}/{y}.png')
+        ->and($saved['leafletDarkTileUrl'])->toBe('')
+        ->and($controller->configuredCompany['fleet-ops.map-settings'])->toMatchArray([
+            'leafletTileUrl'     => 'https://tile.openstreetmap.org/{z}/{x}/{y}.png',
+            'leafletDarkTileUrl' => '',
+        ]);
+
+    $savedNonString = fleetopsJsonPayload($controller->saveMapSettings(new Request([
+        'settings' => [
+            'leafletTileUrl'     => ['not' => 'a-string'],
+            'leafletDarkTileUrl' => 'ftp://tiles.example.com/{z}/{x}/{y}.png',
+        ],
+    ])));
+
+    expect($savedNonString['leafletTileUrl'])->toBe('')
+        ->and($savedNonString['leafletDarkTileUrl'])->toBe('');
+
+    $defaults = fleetopsJsonPayload((new FleetOpsSettingControllerProbe())->getMapSettings());
+
+    expect($defaults['leafletTileUrl'])->toBe('')
+        ->and($defaults['leafletDarkTileUrl'])->toBe('');
+});

package/server/tests/Unit/Http/Filter/FuelReportFilterTest.php

@@ -0,0 +1,135 @@
+<?php
+
+use Fleetbase\FleetOps\Http\Filter\FuelReportFilter;
+use Fleetbase\Http\Filter\Filter;
+use Illuminate\Http\Request;
+
+/**
+ * Covers the FuelReportFilter query branches against a recording builder fake:
+ * base scoping, keyword search, priority and status constraints, and the
+ * assignee, reporter, driver and vehicle relation lookups routing by uuid,
+ * public id, or fallback search.
+ */
+class FleetOpsFuelReportFilterUnitQuery
+{
+    public array $calls = [];
+
+    public function where(...$arguments): self
+    {
+        if (isset($arguments[0]) && is_callable($arguments[0])) {
+            $nested = new self();
+            $arguments[0]($nested);
+            $this->calls[] = ['whereNested', $nested->calls];
+
+            return $this;
+        }
+
+        $this->calls[] = ['where', $arguments];
+
+        return $this;
+    }
+
+    public function whereHas(string $relation, ?callable $callback = null): self
+    {
+        $nested = new self();
+        if ($callback) {
+            $callback($nested);
+        }
+        $this->calls[] = ['whereHas', $relation, $nested->calls];
+
+        return $this;
+    }
+
+    public function search(?string $query): self
+    {
+        $this->calls[] = ['search', $query];
+
+        return $this;
+    }
+
+    public function whereIn(string $column, mixed $values): self
+    {
+        $this->calls[] = ['whereIn', $column, $values];
+
+        return $this;
+    }
+
+    public function whereBetween(string $column, mixed $bounds): self
+    {
+        $this->calls[] = ['whereBetween', $column, $bounds];
+
+        return $this;
+    }
+
+    public function whereDate(string $column, mixed $value): self
+    {
+        $this->calls[] = ['whereDate', $column, $value];
+
+        return $this;
+    }
+
+    public function __call($method, $arguments): self
+    {
+        $this->calls[] = [$method, $arguments];
+
+        return $this;
+    }
+}
+
+function fleetopsFuelReportFilterUnitFilter(FleetOpsFuelReportFilterUnitQuery $builder, ?Request $request = null): FuelReportFilter
+{
+    $filter = (new ReflectionClass(FuelReportFilter::class))->newInstanceWithoutConstructor();
+
+    foreach ([
+        'builder' => $builder,
+        'session' => new class {
+            public function get(string $key): ?string
+            {
+                return $key === 'company' ? 'company-uuid' : null;
+            }
+        },
+        'request' => $request ?? new Request(),
+    ] as $property => $value) {
+        $reflection = new ReflectionProperty(Filter::class, $property);
+        $reflection->setAccessible(true);
+        $reflection->setValue($filter, $value);
+    }
+
+    return $filter;
+}
+
+test('fuel report filter scopes by driver_uuid and driver_assigned, not just driver', function () {
+    foreach (['driverUuid', 'driverAssigned'] as $method) {
+        $builder = new FleetOpsFuelReportFilterUnitQuery();
+        $filter  = fleetopsFuelReportFilterUnitFilter($builder);
+
+        $filter->{$method}('driver_filterone');
+
+        $whereHas = collect($builder->calls)->where(0, 'whereHas')->firstWhere(1, 'driver');
+        expect($whereHas)->not->toBeNull("{$method} must constrain the driver relation")
+            ->and($whereHas[2][0][1][0])->toBe('public_id');
+    }
+});
+
+test('fuel report filter driver aliases route uuids the same way driver does', function () {
+    $builder = new FleetOpsFuelReportFilterUnitQuery();
+    $filter  = fleetopsFuelReportFilterUnitFilter($builder);
+
+    $filter->driverUuid('33333333-3333-4333-8333-333333333333');
+
+    $whereHas = collect($builder->calls)->where(0, 'whereHas')->firstWhere(1, 'driver');
+    expect($whereHas[2][0][1][0])->toBe('uuid');
+});
+
+test('fuel report filter scopes by vehicle_uuid as well as vehicle', function () {
+    $builder = new FleetOpsFuelReportFilterUnitQuery();
+    $filter  = fleetopsFuelReportFilterUnitFilter($builder);
+
+    $filter->vehicleUuid('44444444-4444-4444-8444-444444444444');
+    $filter->vehicleUuid('vehicle_filterone');
+
+    $whereHasCalls = collect($builder->calls)->where(0, 'whereHas')->where(1, 'vehicle')->values();
+    expect($whereHasCalls)->toHaveCount(2)
+        ->and($whereHasCalls[0][2][0][1][0])->toBe('uuid')
+        ->and($whereHasCalls[1][2][0][1][0])->toBe('public_id');
+});

package/server/tests/Unit/Http/Filter/IssueFilterTest.php

@@ -127,3 +127,46 @@ test('issue filter relation branches route uuids public ids and searches', funct
     $searchNested = $whereHasCalls->filter(fn ($call) => collect($call[2])->contains(fn ($inner) => $inner[0] === 'search'));
     expect($searchNested->count())->toBeGreaterThanOrEqual(3);
 });
+
+test('issue filter scopes by driver_uuid and driver_assigned, not just driver', function () {
+    /*
+     * The base filter resolves a query parameter to a method of the same name
+     * and silently ignores what it cannot match. `driver_uuid` matched nothing,
+     * so the filter was dropped and the list came back scoped only by company —
+     * every driver's issues, with a 200 and no sign the request had been
+     * narrowed. For a driver app that is a disclosure, not a nuisance.
+     */
+    foreach (['driverUuid', 'driverAssigned'] as $method) {
+        $builder = new FleetOpsIssueFilterUnitQuery();
+        $filter  = fleetopsIssueFilterUnitFilter($builder);
+
+        $filter->{$method}('driver_filterone');
+
+        $whereHas = collect($builder->calls)->where(0, 'whereHas')->firstWhere(1, 'driver');
+        expect($whereHas)->not->toBeNull("{$method} must constrain the driver relation")
+            ->and($whereHas[2][0][1][0])->toBe('public_id');
+    }
+});
+
+test('issue filter driver aliases route uuids the same way driver does', function () {
+    $builder = new FleetOpsIssueFilterUnitQuery();
+    $filter  = fleetopsIssueFilterUnitFilter($builder);
+
+    $filter->driverUuid('33333333-3333-4333-8333-333333333333');
+
+    $whereHas = collect($builder->calls)->where(0, 'whereHas')->firstWhere(1, 'driver');
+    expect($whereHas[2][0][1][0])->toBe('uuid');
+});
+
+test('issue filter scopes by vehicle_uuid as well as vehicle', function () {
+    $builder = new FleetOpsIssueFilterUnitQuery();
+    $filter  = fleetopsIssueFilterUnitFilter($builder);
+
+    $filter->vehicleUuid('44444444-4444-4444-8444-444444444444');
+    $filter->vehicleUuid('vehicle_filterone');
+
+    $whereHasCalls = collect($builder->calls)->where(0, 'whereHas')->where(1, 'vehicle')->values();
+    expect($whereHasCalls)->toHaveCount(2)
+        ->and($whereHasCalls[0][2][0][1][0])->toBe('uuid')
+        ->and($whereHasCalls[1][2][0][1][0])->toBe('public_id');
+});

package/server/tests/Unit/Http/Resources/FleetResourceTest.php

@@ -1,5 +1,6 @@
 <?php
 
+use Fleetbase\FleetOps\Http\Controllers\Api\v1\FleetController;
 use Fleetbase\FleetOps\Http\Resources\v1\Fleet as FleetResource;
 use Fleetbase\FleetOps\Models\Fleet;
 use Illuminate\Database\ConnectionResolver;
@@ -81,22 +82,65 @@ function fleetopsFleetResourceBoot(): SQLiteConnection
     return $connection;
 }
 
+/**
+ * Resolve expansions the way a request does, then serialize.
+ */
+function fleetopsFleetResourcePayload(Fleet $fleet, array $query): array
+{
+    $request    = Request::create('/v1/fleets/fleet_parentone', 'GET', $query);
+    $controller = new FleetController();
+    $reflection = new ReflectionMethod(FleetController::class, 'applyPublicExpansions');
+    $reflection->setAccessible(true);
+    $reflection->invoke($controller, $request, FleetController::EXPANDABLE);
+
+    return (new FleetResource($fleet))->resolve($request);
+}
+
 test('fleet resource preloads requested subfleet driver and vehicle relations', function () {
     fleetopsFleetResourceBoot();
 
-    $fleet   = Fleet::where('uuid', 'fleet-parent-1')->first();
-    $request = Request::create('/v1/fleets/fleet_parentone', 'GET', ['with' => ['subfleets', 'drivers', 'vehicles']]);
-
-    $resolved = (new FleetResource($fleet))->resolve($request);
+    $fleet    = Fleet::where('uuid', 'fleet-parent-1')->first();
+    $resolved = fleetopsFleetResourcePayload($fleet, ['with' => ['subfleets', 'drivers', 'vehicles']]);
 
+    // `subFleets` is the relation Eloquent actually has. The public name differs
+    // from it only in case, and PHP method calls are case-insensitive, so
+    // `load('subfleets')` used to succeed and store a *second* copy under the
+    // mis-cased key — which `whenLoaded('subFleets')` then could not see.
     expect($resolved['name'])->toBe('Parent Fleet')
-        ->and($fleet->relationLoaded('subfleets'))->toBeTrue()
-        ->and($fleet->relationLoaded('subFleets'))->toBeTrue();
+        ->and($fleet->relationLoaded('subFleets'))->toBeTrue()
+        ->and($resolved)->toHaveKey('subfleets');
 
     $subFleet = $fleet->getRelation('subFleets')->first();
+
+    // Asking for subfleets alongside drivers and vehicles still nests them, as
+    // the released contract did.
     expect($subFleet)->not->toBeNull()
         ->and($subFleet->relationLoaded('drivers'))->toBeTrue()
         ->and($subFleet->relationLoaded('vehicles'))->toBeTrue()
         ->and($subFleet->drivers)->toHaveCount(1)
         ->and($subFleet->vehicles)->toHaveCount(1);
 });
+
+test('fleet resource resolves subfleets on its own, which the mis-cased load never did', function () {
+    fleetopsFleetResourceBoot();
+
+    $fleet    = Fleet::where('uuid', 'fleet-parent-1')->first();
+    $resolved = fleetopsFleetResourcePayload($fleet, ['with' => 'subfleets']);
+
+    // Before the mapping, this returned no `subfleets` key at all: the load
+    // landed under `subfleets` and the resource looked for `subFleets`.
+    expect($resolved)->toHaveKey('subfleets')
+        ->and($fleet->relationLoaded('subFleets'))->toBeTrue();
+});
+
+test('fleet resource accepts the explicit nested expansion spelling', function () {
+    fleetopsFleetResourceBoot();
+
+    $fleet = Fleet::where('uuid', 'fleet-parent-1')->first();
+    fleetopsFleetResourcePayload($fleet, ['with' => ['subfleets.drivers']]);
+
+    $subFleet = $fleet->getRelation('subFleets')->first();
+
+    expect($subFleet->relationLoaded('drivers'))->toBeTrue()
+        ->and($subFleet->relationLoaded('vehicles'))->toBeFalse();
+});

package/server/tests/Unit/Http/Resources/ManifestResourceTest.php

@@ -0,0 +1,129 @@
+<?php
+
+/*
+ * The models resolve their connection through a namespaced `config()`, which
+ * does not exist without the full application. Stubbed so a resource can be
+ * exercised on its own — the projection is the thing under test, not Eloquent.
+ */
+if (!function_exists('Fleetbase\Traits\config')) {
+    eval('namespace Fleetbase\Traits; function config($key = null, $default = null) { return $key === "api.cache.enabled" ? false : $default; }');
+}
+
+if (!function_exists('Fleetbase\Models\config')) {
+    eval('namespace Fleetbase\Models; function config($key = null, $default = null) { return $default; }');
+}
+
+if (!function_exists('Fleetbase\FleetOps\Models\config')) {
+    eval('namespace Fleetbase\FleetOps\Models; function config($key = null, $default = null) { return $default; }');
+}
+
+use Fleetbase\FleetOps\Http\Resources\v1\Manifest as ManifestResource;
+use Fleetbase\FleetOps\Http\Resources\v1\ManifestStop as ManifestStopResource;
+use Fleetbase\FleetOps\Models\Manifest;
+use Fleetbase\FleetOps\Models\ManifestStop;
+use Illuminate\Http\Request;
+
+if (!class_exists('FleetOpsSupportRequestState')) {
+    class FleetOpsSupportRequestState
+    {
+        public static ?Request $request = null;
+    }
+}
+
+if (!function_exists('Fleetbase\Support\request')) {
+    eval('namespace Fleetbase\Support; function request($key = null, $default = null) { return \FleetOpsSupportRequestState::$request; }');
+}
+
+/**
+ * The manifest's stop counts are accessors that query the database, and the
+ * driver and vehicle names walk relations. None of that is what a resource test
+ * is for, so they are answered directly — the projection is under test, not
+ * Eloquent.
+ */
+class FleetOpsManifestFake extends Manifest
+{
+    public function getCompletedStopsAttribute(): int
+    {
+        return 3;
+    }
+
+    public function getPendingStopsAttribute(): int
+    {
+        return 5;
+    }
+
+    public function getDriverNameAttribute(): ?string
+    {
+        return 'Ron';
+    }
+
+    public function getVehicleNameAttribute(): ?string
+    {
+        return 'EAS-01';
+    }
+}
+
+test('manifest resource publishes what a driver needs to run a route', function () {
+    $request                             = Request::create('/v1/manifests/manifest_public', 'GET');
+    FleetOpsSupportRequestState::$request = $request;
+
+    $manifest = new FleetOpsManifestFake();
+    $manifest->setRawAttributes([
+        'id'               => 3,
+        'uuid'             => 'manifest-uuid',
+        'public_id'        => 'manifest_public',
+        'status'           => 'in_progress',
+        'total_distance_m' => 41200,
+        'total_duration_s' => 5400,
+        'stop_count'       => 8,
+        'notes'            => 'Cold chain first',
+    ], true);
+
+    $payload = (new ManifestResource($manifest))->resolve($request);
+
+    expect($payload['id'])->toBe('manifest_public')
+        ->and($payload['status'])->toBe('in_progress')
+        ->and($payload['total_distance_m'])->toBe(41200)
+        ->and($payload['stop_count'])->toBe(8)
+        ->and($payload['notes'])->toBe('Cold chain first')
+        ->and($payload['completed_stops'])->toBe(3)
+        ->and($payload['pending_stops'])->toBe(5)
+        ->and($payload['driver_name'])->toBe('Ron');
+});
+
+test('manifest resource omits stops when they were not loaded, so a list stays a list', function () {
+    // A driver's manifest list on a busy fleet must not drag every stop of
+    // every route along with it.
+    $request                             = Request::create('/v1/drivers/driver_public/manifests', 'GET');
+    FleetOpsSupportRequestState::$request = $request;
+
+    $manifest = new FleetOpsManifestFake();
+    $manifest->setRawAttributes(['id' => 4, 'uuid' => 'm-uuid', 'public_id' => 'manifest_public', 'status' => 'pending'], true);
+
+    $payload = (new ManifestResource($manifest))->resolve($request);
+
+    expect($payload)->not->toHaveKey('stops');
+});
+
+test('manifest stop resource carries the sequence a re-sequence rewrites', function () {
+    $request                             = Request::create('/v1/manifest-stops/stop_public', 'GET');
+    FleetOpsSupportRequestState::$request = $request;
+
+    $stop = new ManifestStop();
+    $stop->setRawAttributes([
+        'id'                   => 9,
+        'uuid'                 => 'stop-uuid',
+        'public_id'            => 'stop_public',
+        'status'               => 'pending',
+        'sequence'             => 4,
+        'distance_from_prev_m' => 1800,
+        'duration_from_prev_s' => 240,
+    ], true);
+
+    $payload = (new ManifestStopResource($stop))->resolve($request);
+
+    expect($payload['id'])->toBe('stop_public')
+        ->and($payload['sequence'])->toBe(4)
+        ->and($payload['status'])->toBe('pending')
+        ->and($payload['distance_from_prev_m'])->toBe(1800);
+});