@fleetbase/fleetops-engine 0.6.60 → 0.6.62

package/server/src/Http/Filter/DriverFilter.php

@@ -2,14 +2,21 @@
 
 namespace Fleetbase\FleetOps\Http\Filter;
 
+use Fleetbase\FleetOps\Http\Filter\Concerns\ResolvesPublicRelationUuids;
+use Fleetbase\FleetOps\Models\Fleet;
 use Fleetbase\FleetOps\Models\Place;
+use Fleetbase\FleetOps\Models\Vehicle;
+use Fleetbase\FleetOps\Models\Vendor;
 use Fleetbase\FleetOps\Support\Utils;
 use Fleetbase\Http\Filter\Filter;
 use Fleetbase\Models\Company;
+use Fleetbase\Support\Http;
 use Illuminate\Support\Str;
 
 class DriverFilter extends Filter
 {
+    use ResolvesPublicRelationUuids;
+
     public function queryForInternal()
     {
         $this->builder->where(
@@ -43,9 +50,28 @@ class DriverFilter extends Filter
         });
     }
 
+    /**
+     * Match a driver by the identifier the operator's own system uses.
+     *
+     * Two callers, two meanings. The Fleet-Ops console types into a search box
+     * and expects `VEH-10` to find `VEH-100`; an importer asks whether `VEH-10`
+     * exists and must not be told yes because `VEH-100` does. A partial match
+     * there produces a duplicate on every rerun.
+     *
+     * Core's ordinary fillable-column filtering is already equality — this
+     * method exists only because the console needs the looser behaviour, so it
+     * is the console that gets the exception. An unknown request context is
+     * treated as public: exact is the safe default of the two.
+     */
     public function internalId(?string $internalId)
     {
-        $this->builder->searchWhere('internal_id', $internalId);
+        if (Http::isInternalRequest($this->request)) {
+            $this->builder->searchWhere('internal_id', $internalId);
+
+            return;
+        }
+
+        $this->builder->where('internal_id', '=', $internalId);
     }
 
     public function name(?string $name)
@@ -58,14 +84,25 @@ class DriverFilter extends Filter
         );
     }
 
+    /**
+     * A public id identifies exactly one record, so a public lookup matches it
+     * exactly. The console keeps the partial search its id column filter box
+     * has always had.
+     */
     public function publicId(?string $publicId)
     {
-        $this->builder->searchWhere('public_id', $publicId);
+        if (Http::isInternalRequest($this->request)) {
+            $this->builder->searchWhere('public_id', $publicId);
+
+            return;
+        }
+
+        $this->builder->where('public_id', '=', $publicId);
     }
 
     public function facilitator(string $facilitator)
     {
-        $this->builder->where('vendor_uuid', $facilitator);
+        $this->builder->whereIn('vendor_uuid', $this->resolvePublicRelationUuids(Vendor::class, $facilitator));
     }
 
     public function vehicle(string $vehicle)
@@ -76,16 +113,28 @@ class DriverFilter extends Filter
             return;
         }
 
-        if (Str::isUuid($vehicle)) {
+        // The console passes a uuid; the public API passes a public or internal id.
+        if (Str::isUuid($vehicle) && Http::isInternalRequest($this->request)) {
             $this->builder->where('vehicle_uuid', $vehicle);
-        } else {
-            $this->builder->whereHas(
-                'vehicle',
-                function ($query) use ($vehicle) {
-                    $query->search($vehicle);
-                }
-            );
+
+            return;
+        }
+
+        $vehicleUuids = $this->resolvePublicRelationUuids(Vehicle::class, $vehicle);
+
+        if ($vehicleUuids !== []) {
+            $this->builder->whereIn('vehicle_uuid', $vehicleUuids);
+
+            return;
         }
+
+        // Fall back to a search so a partial plate or model still narrows a list.
+        $this->builder->whereHas(
+            'vehicle',
+            function ($query) use ($vehicle) {
+                $query->search($vehicle);
+            }
+        );
     }
 
     public function driversLicenseNumber(?string $driversLicenseNumber)
@@ -93,12 +142,17 @@ class DriverFilter extends Filter
         $this->builder->searchWhere('drivers_license_number', $driversLicenseNumber);
     }
 
+    /**
+     * `phone` is an accessor sourced from the linked user, not a relation — the
+     * previous `whereHas('phone')` asked Eloquent for a relation that does not
+     * exist and raised a 500 for every caller of `?phone=`.
+     */
     public function phone(string $phone)
     {
         $this->builder->whereHas(
-            'phone',
+            'user',
             function ($query) use ($phone) {
-                $query->search($phone);
+                $query->searchWhere('phone', $phone);
             }
         );
     }
@@ -127,10 +181,12 @@ class DriverFilter extends Filter
 
     public function fleet(string $fleet)
     {
+        $fleetUuids = $this->resolvePublicRelationUuids(Fleet::class, $fleet);
+
         $this->builder->whereHas(
             'fleets',
-            function ($q) use ($fleet) {
-                $q->where('fleet_uuid', $fleet);
+            function ($q) use ($fleetUuids) {
+                $q->whereIn('fleet_uuid', $fleetUuids);
             }
         );
     }

package/server/src/Http/Filter/FleetFilter.php

@@ -2,11 +2,19 @@
 
 namespace Fleetbase\FleetOps\Http\Filter;
 
+use Fleetbase\FleetOps\Http\Filter\Concerns\ResolvesPublicRelationUuids;
+use Fleetbase\FleetOps\Models\Fleet;
+use Fleetbase\FleetOps\Models\ServiceArea;
+use Fleetbase\FleetOps\Models\Vendor;
+use Fleetbase\FleetOps\Models\Zone;
 use Fleetbase\FleetOps\Support\Utils;
 use Fleetbase\Http\Filter\Filter;
+use Fleetbase\Support\Http;
 
 class FleetFilter extends Filter
 {
+    use ResolvesPublicRelationUuids;
+
     public function queryForInternal()
     {
         $this->builder->where('company_uuid', $this->session->get('company'))->with(['serviceArea', 'zone']);
@@ -17,15 +25,17 @@ class FleetFilter extends Filter
         $this->builder->where('company_uuid', $this->session->get('company'));
     }
 
+    /**
+     * Free-text search across a fleet's own columns.
+     *
+     * Previously matched against a `user` relation, which Fleet does not have —
+     * every `?query=` on the fleets endpoint raised a relation-not-found error
+     * rather than returning results.
+     */
     public function query(?string $searchQuery)
     {
         $this->builder->where(function ($query) use ($searchQuery) {
-            $query->orWhereHas(
-                'user',
-                function ($query) use ($searchQuery) {
-                    $query->searchWhere(['name', 'email', 'phone'], $searchQuery);
-                }
-            );
+            $query->searchWhere(['name', 'task', 'public_id'], $searchQuery);
         });
     }
 
@@ -38,49 +48,38 @@ class FleetFilter extends Filter
 
     public function serviceArea(?string $serviceArea)
     {
-        $this->builder->whereHas(
-            'serviceArea',
-            function ($query) use ($serviceArea) {
-                $query->where('uuid', $serviceArea);
-            }
-        );
+        $this->builder->whereIn('service_area_uuid', $this->resolvePublicRelationUuids(ServiceArea::class, $serviceArea));
     }
 
     public function zone(?string $zone)
     {
-        $this->builder->whereHas(
-            'zone',
-            function ($query) use ($zone) {
-                $query->where('zone_uuid', $zone);
-            }
-        );
+        $this->builder->whereIn('zone_uuid', $this->resolvePublicRelationUuids(Zone::class, $zone));
     }
 
     public function parentFleet(?string $fleet)
     {
-        $this->builder->whereHas(
-            'parent_fleet',
-            function ($query) use ($fleet) {
-                $query->where('uuid', $fleet);
-            }
-        );
-
-        $this->builder->searchWhere('parent_fleet_uuid', $fleet);
+        $this->builder->whereIn('parent_fleet_uuid', $this->resolvePublicRelationUuids(Fleet::class, $fleet));
     }
 
     public function vendor(?string $vendor)
     {
-        $this->builder->whereHas(
-            'vendor',
-            function ($query) use ($vendor) {
-                $query->where('uuid', $vendor);
-            }
-        );
+        $this->builder->whereIn('vendor_uuid', $this->resolvePublicRelationUuids(Vendor::class, $vendor));
     }
 
+    /**
+     * A public id identifies exactly one record, so a public lookup matches it
+     * exactly. The console keeps the partial search its id column filter box
+     * has always had.
+     */
     public function publicId(?string $publicId)
     {
-        $this->builder->searchWhere('public_id', $publicId);
+        if (Http::isInternalRequest($this->request)) {
+            $this->builder->searchWhere('public_id', $publicId);
+
+            return;
+        }
+
+        $this->builder->where('public_id', '=', $publicId);
     }
 
     public function task(?string $task)

package/server/src/Http/Filter/FuelReportFilter.php

@@ -86,6 +86,35 @@ class FuelReportFilter extends Filter
         });
     }
 
+    /**
+     * Aliases for {@see driver()}.
+     *
+     * The base filter resolves a query parameter to a method of the same name
+     * and **silently ignores anything it cannot match**. So a client scoping a
+     * list with `driver_uuid` — the column's own name, and the name every other
+     * part of the payload uses — matched nothing, the filter was dropped, and
+     * the response came back scoped only by company: every driver's records,
+     * with a 200 and no indication that the request had been narrowed at all.
+     *
+     * For a driver app that is a disclosure, not a nuisance: a driver asking
+     * for their own fuel reports received the whole company's.
+     */
+    public function driverUuid(?string $driver)
+    {
+        $this->driver($driver);
+    }
+
+    public function driverAssigned(?string $driver)
+    {
+        $this->driver($driver);
+    }
+
+    /** Alias for {@see vehicle()}, for the same reason. */
+    public function vehicleUuid(?string $vehicle)
+    {
+        $this->vehicle($vehicle);
+    }
+
     public function vehicle(?string $vehicle)
     {
         $this->builder->whereHas('vehicle', function ($q) use ($vehicle) {

package/server/src/Http/Filter/IssueFilter.php

@@ -88,6 +88,35 @@ class IssueFilter extends Filter
         });
     }
 
+    /**
+     * Aliases for {@see driver()}.
+     *
+     * The base filter resolves a query parameter to a method of the same name
+     * and **silently ignores anything it cannot match**. So a client scoping a
+     * list with `driver_uuid` — the column's own name, and the name every other
+     * part of the payload uses — matched nothing, the filter was dropped, and
+     * the response came back scoped only by company: every driver's records,
+     * with a 200 and no indication that the request had been narrowed at all.
+     *
+     * For a driver app that is a disclosure, not a nuisance: a driver asking
+     * for their own fuel reports received the whole company's.
+     */
+    public function driverUuid(?string $driver)
+    {
+        $this->driver($driver);
+    }
+
+    public function driverAssigned(?string $driver)
+    {
+        $this->driver($driver);
+    }
+
+    /** Alias for {@see vehicle()}, for the same reason. */
+    public function vehicleUuid(?string $vehicle)
+    {
+        $this->vehicle($vehicle);
+    }
+
     public function vehicle(?string $vehicle)
     {
         $this->builder->whereHas('vehicle', function ($q) use ($vehicle) {

package/server/src/Http/Filter/VehicleFilter.php

@@ -2,6 +2,9 @@
 
 namespace Fleetbase\FleetOps\Http\Filter;
 
+use Fleetbase\FleetOps\Http\Filter\Concerns\ResolvesPublicRelationUuids;
+use Fleetbase\FleetOps\Models\Driver;
+use Fleetbase\FleetOps\Models\Fleet;
 use Fleetbase\FleetOps\Models\Vehicle;
 use Fleetbase\FleetOps\Models\Vendor;
 use Fleetbase\FleetOps\Support\Utils;
@@ -10,6 +13,8 @@ use Fleetbase\Support\Http;
 
 class VehicleFilter extends Filter
 {
+    use ResolvesPublicRelationUuids;
+
     public function queryForInternal()
     {
         $this->builder->where('company_uuid', $this->session->get('company'));
@@ -30,14 +35,56 @@ class VehicleFilter extends Filter
         $this->builder->searchWhere(['year', 'make', 'model', 'plate_number'], $display_name);
     }
 
+    /**
+     * Match a vehicle by the identifier the operator's own system uses.
+     *
+     * `internal_id` is the column an importer keys on to decide whether a
+     * vehicle already exists, and it was the one identifier the filter did not
+     * support — so every lookup fell through to a create.
+     */
+    /**
+     * Match a vehicle by the identifier the operator's own system uses.
+     *
+     * Two callers, two meanings. The Fleet-Ops console types into a search box
+     * and expects `VEH-10` to find `VEH-100`; an importer asks whether `VEH-10`
+     * exists and must not be told yes because `VEH-100` does. A partial match
+     * there produces a duplicate on every rerun.
+     *
+     * Core's ordinary fillable-column filtering is already equality — this
+     * method exists only because the console needs the looser behaviour, so it
+     * is the console that gets the exception. An unknown request context is
+     * treated as public: exact is the safe default of the two.
+     */
+    public function internalId(?string $internalId)
+    {
+        if (Http::isInternalRequest($this->request)) {
+            $this->builder->searchWhere('internal_id', $internalId);
+
+            return;
+        }
+
+        $this->builder->where('internal_id', '=', $internalId);
+    }
+
     public function vin(?string $vin)
     {
         $this->builder->searchWhere('vin', $vin);
     }
 
+    /**
+     * A public id identifies exactly one record, so a public lookup matches it
+     * exactly. The console keeps the partial search its id column filter box
+     * has always had.
+     */
     public function publicId(?string $publicIc)
     {
-        $this->builder->searchWhere('public_id', $publicIc);
+        if (Http::isInternalRequest($this->request)) {
+            $this->builder->searchWhere('public_id', $publicIc);
+
+            return;
+        }
+
+        $this->builder->where('public_id', '=', $publicIc);
     }
 
     public function plateNumber(?string $plateNumber)
@@ -68,10 +115,12 @@ class VehicleFilter extends Filter
             return;
         }
 
+        $driverUuids = $this->resolvePublicRelationUuids(Driver::class, $driverId);
+
         $this->builder->whereHas(
             'driver',
-            function ($query) use ($driverId) {
-                $query->where('uuid', $driverId);
+            function ($query) use ($driverUuids) {
+                $query->whereIn('uuid', $driverUuids);
             }
         );
     }
@@ -82,20 +131,7 @@ class VehicleFilter extends Filter
             return;
         }
 
-        $this->builder->whereIn('vendor_uuid', Vendor::query()
-            ->where('company_uuid', $this->session->get('company'))
-            ->where(function ($query) use ($vendor) {
-                $query->where('public_id', $vendor);
-
-                if (in_array('internal_id', (new Vendor())->getFillable())) {
-                    $query->orWhere('internal_id', $vendor);
-                }
-
-                if (Http::isInternalRequest($this->request)) {
-                    $query->orWhere('uuid', $vendor);
-                }
-            })
-            ->pluck('uuid'));
+        $this->builder->whereIn('vendor_uuid', $this->resolvePublicRelationUuids(Vendor::class, $vendor));
     }
 
     public function driverUuid(?string $driverId)
@@ -132,10 +168,12 @@ class VehicleFilter extends Filter
 
     public function fleet(string $fleet)
     {
+        $fleetUuids = $this->resolvePublicRelationUuids(Fleet::class, $fleet);
+
         $this->builder->whereHas(
             'fleets',
-            function ($q) use ($fleet) {
-                $q->where('fleet_uuid', $fleet);
+            function ($q) use ($fleetUuids) {
+                $q->whereIn('fleet_uuid', $fleetUuids);
             }
         );
     }

package/server/src/Http/Requests/Concerns/ScopesPublicRelationRules.php

@@ -0,0 +1,48 @@
+<?php
+
+namespace Fleetbase\FleetOps\Http\Requests\Concerns;
+
+use Illuminate\Validation\Rule;
+
+/**
+ * Builds `exists` rules for public relationship inputs that are scoped to the
+ * authenticated company.
+ *
+ * An unscoped `exists:vendors,public_id` accepts another organization's public
+ * id, and the controller then resolves it to nothing — so the request looks
+ * accepted while the relationship is silently dropped. Scoping the rule turns
+ * that into an explicit validation failure, and keeps a public id from
+ * confirming or denying the existence of a resource in someone else's company.
+ */
+trait ScopesPublicRelationRules
+{
+    /**
+     * An `exists` rule limited to the session company and to rows that are not
+     * soft deleted.
+     *
+     * No return type: the pest harness substitutes its own `Illuminate\Validation\Rule`
+     * stand-in, which is not an instance of the real `Rules\Exists`.
+     */
+    protected function existsInCompany(string $table, string $column = 'public_id')
+    {
+        $companyUuid = session('company');
+
+        return Rule::exists($table, $column)->where(function ($query) use ($companyUuid) {
+            $query->where('company_uuid', $companyUuid);
+            $query->whereNull('deleted_at');
+        });
+    }
+
+    /**
+     * The full rule set for an optional public relationship input.
+     *
+     * `nullable` is deliberate: sending `null` is how a caller clears an
+     * existing assignment, and `exists` is skipped for a null value.
+     *
+     * @return array<int, mixed>
+     */
+    protected function publicRelationRules(string $table, string $column = 'public_id'): array
+    {
+        return ['nullable', 'string', $this->existsInCompany($table, $column)];
+    }
+}

package/server/src/Http/Requests/CreateDriverRequest.php

@@ -2,12 +2,16 @@
 
 namespace Fleetbase\FleetOps\Http\Requests;
 
+use Fleetbase\FleetOps\Http\Requests\Concerns\ScopesPublicRelationRules;
+use Fleetbase\FleetOps\Models\Driver;
 use Fleetbase\FleetOps\Rules\ResolvablePoint;
 use Fleetbase\Http\Requests\FleetbaseRequest;
 use Illuminate\Validation\Rule;
 
 class CreateDriverRequest extends FleetbaseRequest
 {
+    use ScopesPublicRelationRules;
+
     /**
      * Determine if the user is authorized to make this request.
      */
@@ -24,23 +28,110 @@ class CreateDriverRequest extends FleetbaseRequest
         $isCreating = $this->isMethod('POST');
 
         return [
-            'name'           => [Rule::requiredIf($isCreating)],
-            'email'          => [Rule::requiredIf($isCreating), Rule::when($this->filled('email'), ['email']), Rule::when($isCreating, [Rule::unique('users')->whereNull('deleted_at')])],
-            'phone'          => [Rule::requiredIf($isCreating), Rule::when($isCreating, [Rule::unique('users')->whereNull('deleted_at')])],
-            'password'       => 'nullable|string',
+            'name' => [Rule::requiredIf($isCreating), 'nullable', 'string', 'max:191'],
+
+            /*
+             * Email and phone are optional.
+             *
+             * An operational fleet record often has neither: a subcontracted or
+             * yard-only driver may have no company mailbox and no handset. The
+             * previous contract forced both, and the only way to satisfy it was
+             * to invent an address or a number — which then sits in the tenant's
+             * user table looking real, can be mailed to, and blocks the genuine
+             * value later. Both are still validated and still unique when they
+             * are supplied; a driver created without them simply cannot sign in
+             * to Navigator until credentials are added.
+             */
+            'email'    => ['nullable', Rule::when($this->filled('email'), ['email']), $this->uniqueAmongUsers()],
+            'phone'    => ['nullable', 'string', $this->uniqueAmongUsers()],
+            'password' => 'nullable|string',
+            'timezone' => 'nullable|string|max:64',
+
+            // Identity
+            'internal_id'            => 'nullable|string|max:191',
+            'drivers_license_number' => 'nullable|string|max:191',
+            'license_expiry'         => 'nullable|date',
+            'photo'                  => 'nullable|string',
+
+            // Operational
             'country'        => 'nullable|size:2',
-            'city'           => 'nullable|string',
-            'vehicle'        => 'nullable|string|starts_with:vehicle_|exists:vehicles,public_id',
-            'license_expiry' => 'nullable|date',
+            'currency'       => 'nullable|string|size:3',
+            'city'           => 'nullable|string|max:191',
+            'online'         => 'nullable|boolean',
+            'current_status' => 'nullable|string|max:64',
             'status'         => 'nullable|string|in:active,available,inactive',
-            'vendor'         => 'nullable|exists:vendors,public_id',
-            'job'            => 'nullable|exists:orders,public_id',
+            'heading'        => 'nullable|numeric',
+            'bearing'        => 'nullable|numeric',
+            'altitude'       => 'nullable|numeric',
+            'speed'          => 'nullable|numeric',
             'location'       => ['nullable', new ResolvablePoint()],
             'latitude'       => ['nullable', 'required_with:longitude'],
             'longitude'      => ['nullable', 'required_with:latitude'],
+
+            // Structured / orchestrator
+            'meta'              => 'nullable|array',
+            'skills'            => 'nullable|array',
+            'skills.*'          => 'string',
+            'max_travel_time'   => 'nullable|integer|min:0',
+            'max_distance'      => 'nullable|integer|min:0',
+            'time_window_start' => 'nullable|date_format:H:i,H:i:s',
+            'time_window_end'   => 'nullable|date_format:H:i,H:i:s',
+
+            // Relationships, resolved from public ids inside the caller's company
+            'vehicle' => ['nullable', 'string', 'starts_with:vehicle_', $this->existsInCompany('vehicles')],
+            'vendor'  => $this->publicRelationRules('vendors'),
+            'job'     => $this->publicRelationRules('orders'),
         ];
     }
 
+    /**
+     * Uniqueness against every other live user account.
+     *
+     * Update used to skip this check entirely, so one driver could be given an
+     * address another driver already signs in with — and the two would then be
+     * indistinguishable to every identity lookup, including the password reset
+     * that matches on it. The driver's own linked user is ignored by uuid, so
+     * resending an unchanged address or number still succeeds.
+     *
+     * No return type: the pest harness substitutes its own
+     * `Illuminate\Validation\Rule`, which is not an instance of `Rules\Unique`.
+     */
+    protected function uniqueAmongUsers()
+    {
+        $rule = Rule::unique('users')->whereNull('deleted_at');
+
+        $ownUserUuid = $this->linkedUserUuid();
+
+        return $ownUserUuid ? $rule->ignore($ownUserUuid, 'uuid') : $rule;
+    }
+
+    /**
+     * The uuid of the user behind the driver this request is updating.
+     *
+     * Null on create, and null when there is no resolvable route parameter —
+     * which is also what keeps this from querying during rule construction in
+     * contexts that have no route bound.
+     */
+    protected function linkedUserUuid(): ?string
+    {
+        if ($this->isMethod('POST')) {
+            return null;
+        }
+
+        $id = $this->route('id');
+
+        if (!is_string($id) || $id === '') {
+            return null;
+        }
+
+        return Driver::withoutGlobalScopes()
+            ->where('company_uuid', session('company'))
+            ->where(function ($query) use ($id) {
+                $query->where('public_id', $id)->orWhere('internal_id', $id);
+            })
+            ->value('user_uuid');
+    }
+
     /**
      * Get custom attributes for validator errors.
      */