@fleetbase/fleetops-engine 0.6.61 → 0.6.62

package/server/src/Http/Controllers/Api/v1/VehicleController.php

@@ -5,6 +5,9 @@ namespace Fleetbase\FleetOps\Http\Controllers\Api\v1;
 use Fleetbase\FleetOps\Events\GeofenceEntered;
 use Fleetbase\FleetOps\Events\GeofenceExited;
 use Fleetbase\FleetOps\Events\VehicleLocationChanged;
+use Fleetbase\FleetOps\Exceptions\PublicRelationNotFoundException;
+use Fleetbase\FleetOps\Http\Controllers\Api\v1\Concerns\ResolvesFleetOpsApiResources;
+use Fleetbase\FleetOps\Http\Controllers\Api\v1\Concerns\ResolvesPublicExpansions;
 use Fleetbase\FleetOps\Http\Requests\CreateVehicleRequest;
 use Fleetbase\FleetOps\Http\Requests\UpdateVehicleRequest;
 use Fleetbase\FleetOps\Http\Resources\v1\DeletedResource;
@@ -12,16 +15,45 @@ use Fleetbase\FleetOps\Http\Resources\v1\Vehicle as VehicleResource;
 use Fleetbase\FleetOps\Jobs\CheckGeofenceDwell;
 use Fleetbase\FleetOps\Models\Driver;
 use Fleetbase\FleetOps\Models\Vehicle;
+use Fleetbase\FleetOps\Models\Vendor;
+use Fleetbase\FleetOps\Models\Warranty;
 use Fleetbase\FleetOps\Support\GeofenceIntersectionService;
 use Fleetbase\FleetOps\Support\Utils;
 use Fleetbase\Http\Controllers\Controller;
 use Fleetbase\LaravelMysqlSpatial\Types\Point;
+use Fleetbase\Models\Category;
+use Fleetbase\Models\File;
 use Illuminate\Http\Request;
 use Illuminate\Support\Carbon;
 use Illuminate\Support\Facades\DB;
 
 class VehicleController extends Controller
 {
+    use ResolvesFleetOpsApiResources;
+    use ResolvesPublicExpansions;
+
+    /**
+     * Relationships eager loaded so the public resource can report each
+     * assignment as a public id without a query per vehicle.
+     *
+     * Loading them does not expand them: the nested object is returned only for
+     * a relation the caller named in `with`, which is the shape the endpoint has
+     * always had.
+     */
+    protected const PUBLIC_RELATIONS = ['vendor', 'category', 'warranty', 'driver', 'photo'];
+
+    /**
+     * Public expansion name => Eloquent relation name.
+     */
+    public const EXPANDABLE = [
+        'driver'   => 'driver',
+        'vendor'   => 'vendor',
+        'category' => 'category',
+        'warranty' => 'warranty',
+        'photo'    => 'photo',
+        'devices'  => 'devices',
+    ];
+
     /**
      * Creates a new Fleetbase Vehicle resource.
      *
@@ -31,8 +63,14 @@ class VehicleController extends Controller
      */
     public function create(CreateVehicleRequest $request)
     {
+        $this->applyPublicExpansions($request, static::EXPANDABLE);
+
         // get request input
-        $input = $this->vehicleInputFromRequest($request);
+        try {
+            $input = $this->vehicleInputFromRequest($request);
+        } catch (PublicRelationNotFoundException $exception) {
+            return $this->jsonResponse(['error' => $exception->getMessage()], 404);
+        }
 
         // make sure company is set
         $input['company_uuid'] = session('company');
@@ -40,14 +78,6 @@ class VehicleController extends Controller
         // set default online
         $input = $this->withDefaultOnline($input);
 
-        // vendor assignment
-        if ($request->has('vendor')) {
-            $input['vendor_uuid'] = $this->getVendorUuid('vendors', [
-                'public_id'    => $request->input('vendor'),
-                'company_uuid' => session('company'),
-            ]);
-        }
-
         // latitude / longitude
         $input = $this->withCoordinateLocation($input, $request);
 
@@ -85,6 +115,8 @@ class VehicleController extends Controller
      */
     public function update($id, UpdateVehicleRequest $request)
     {
+        $this->applyPublicExpansions($request, static::EXPANDABLE);
+
         // find for the vehicle
         try {
             $vehicle = $this->findVehicle($id);
@@ -98,19 +130,12 @@ class VehicleController extends Controller
         }
 
         // get request input
-        $input = $this->vehicleInputFromRequest($request);
-
-        // vendor assignment
-        if ($request->has('vendor')) {
-            $input['vendor_uuid'] = $this->getVendorUuid('vendors', [
-                'public_id'    => $request->input('vendor'),
-                'company_uuid' => session('company'),
-            ]);
+        try {
+            $input = $this->vehicleInputFromRequest($request);
+        } catch (PublicRelationNotFoundException $exception) {
+            return $this->jsonResponse(['error' => $exception->getMessage()], 404);
         }
 
-        // set default online
-        $input = $this->withDefaultOnline($input);
-
         // latitude / longitude
         $input = $this->withCoordinateLocation($input, $request);
 
@@ -157,6 +182,8 @@ class VehicleController extends Controller
      */
     public function query(Request $request)
     {
+        $this->applyPublicExpansions($request, static::EXPANDABLE);
+
         $results = $this->queryVehicles($request);
 
         return $this->vehicleResourceCollection($results);
@@ -169,8 +196,17 @@ class VehicleController extends Controller
      *
      * @return \Fleetbase\Http\Resources\VehicleCollection
      */
-    public function find($id)
+    public function find($id, ?Request $request = null)
     {
+        // Falls back to the container's request rather than trusting injection:
+        // the parameter carries a default, and Laravel's controller dispatcher
+        // skips resolving a type-hinted dependency that has one. It arrives null,
+        // the expansions are never mapped, and an unsupported name reaches
+        // Eloquent — a 500 for a typo, on the one endpoint most likely to be
+        // handed one.
+        $request = $request instanceof Request ? $request : request();
+        $this->applyPublicExpansions($request, static::EXPANDABLE);
+
         // find for the vehicle
         try {
             $vehicle = $this->findVehicle($id);
@@ -347,23 +383,75 @@ class VehicleController extends Controller
         }
     }
 
+    /**
+     * The explicit public input allowlist for a vehicle.
+     *
+     * Mirrors every safe business field the model and the Fleet-Ops vehicle form
+     * expose. Deliberately absent: `company_uuid` and the raw `*_uuid` relation
+     * columns (resolved from public ids below), `public_id` / `uuid` / `_key` /
+     * `slug` (generated), `avatar_url` when given as a uuid, `vin_data` (written
+     * by the VIN decoder) and `telematics` (written by telematics ingestion).
+     *
+     * @throws PublicRelationNotFoundException
+     */
     protected function vehicleInputFromRequest(Request $request): array
     {
-        return $request->only([
-            'status', 'make', 'model', 'year', 'trim', 'type', 'plate_number', 'vin',
-            'meta', 'online', 'location', 'altitude', 'heading', 'speed',
+        $input = $request->only([
+            // Identity and description
+            'internal_id', 'name', 'description', 'make', 'model', 'model_type', 'year',
+            'trim', 'color', 'type', 'class', 'plate_number', 'vin', 'serial_number',
+            'call_sign', 'fuel_card_number',
+            // Measurement and operation.
+            //
             // Odometer is fillable on the model and unrestricted by the request
             // rules, but was absent here — so a caller sending one received a
             // 200 and a response body that looked correct while the reading was
             // discarded. Recording mileage is the single most common write a
             // driver app makes against a vehicle.
-            'odometer', 'odometer_unit',
-            'payload_capacity', 'payload_capacity_volume',
-            'payload_capacity_pallets', 'payload_capacity_parcels',
+            'odometer', 'odometer_unit', 'odometer_at_purchase', 'measurement_system',
+            'fuel_type', 'fuel_volume_unit', 'online', 'status',
+            'location', 'altitude', 'heading', 'speed',
+            // Body, capacity and dimensions
+            'transmission', 'body_type', 'body_sub_type', 'usage_type', 'ownership_type',
+            'cargo_volume', 'passenger_volume', 'interior_volume', 'weight', 'width',
+            'length', 'height', 'towing_capacity', 'payload_capacity', 'seating_capacity',
+            'ground_clearance', 'bed_length', 'fuel_capacity',
+            // Lifecycle and financing
+            'financing_status', 'loan_number_of_payments', 'loan_first_payment', 'loan_amount',
+            'estimated_service_life_distance_unit', 'estimated_service_life_distance',
+            'estimated_service_life_months', 'insurance_value', 'depreciation_rate',
+            'current_value', 'acquisition_cost', 'currency', 'purchased_at', 'lease_expires_at',
+            // Regulatory and engine specifications
+            'emission_standard', 'dpf_equipped', 'scr_equipped', 'gvwr', 'gcwr',
+            'engine_number', 'engine_model', 'engine_make', 'engine_family',
+            'engine_configuration', 'engine_displacement', 'engine_size', 'horsepower',
+            'horsepower_rpm', 'torque', 'torque_rpm', 'number_of_cylinders',
+            'cylinder_arrangement',
+            // Structured and descriptive fields
+            'specs', 'details', 'notes', 'meta',
+            // Orchestrator
+            'payload_capacity_volume', 'payload_capacity_pallets', 'payload_capacity_parcels',
             'skills', 'max_tasks', 'time_window_start', 'time_window_end', 'return_to_depot',
         ]);
+
+        $this->applyPublicIdRelations($input, [
+            'vendor'   => ['vendor_uuid', Vendor::class],
+            'category' => ['category_uuid', Category::class],
+            'warranty' => ['warranty_uuid', Warranty::class],
+            'photo'    => ['photo_uuid', File::class],
+        ], $request);
+
+        return $input;
     }
 
+    /**
+     * A vehicle that does not say otherwise starts offline.
+     *
+     * Applied on create only. Applying it on update too meant any partial write —
+     * a plate correction, an odometer reading — silently knocked the vehicle
+     * offline, because the absent key was read as "set it to false" rather than
+     * "leave it alone".
+     */
     protected function withDefaultOnline(array $input): array
     {
         if (!isset($input['online'])) {
@@ -394,11 +482,6 @@ class VehicleController extends Controller
         ];
     }
 
-    protected function getVendorUuid(string $table, array $where): ?string
-    {
-        return Utils::getUuid($table, $where);
-    }
-
     protected function createVehicle(array $input): Vehicle
     {
         return Vehicle::create($input);
@@ -409,19 +492,35 @@ class VehicleController extends Controller
         return Vehicle::findRecordOrFail($id);
     }
 
-    protected function findDriver(string $id): Driver
+    protected function findDriver(?string $id): Driver
     {
         return Driver::findRecordOrFail($id);
     }
 
     protected function queryVehicles(Request $request)
     {
-        return Vehicle::queryWithRequest($request);
+        return Vehicle::queryWithRequest($request, function (&$query) {
+            $query->with(static::PUBLIC_RELATIONS);
+        });
     }
 
     protected function vehicleResource(Vehicle $vehicle)
     {
-        return new VehicleResource($vehicle);
+        return new VehicleResource($this->withPublicRelations($vehicle));
+    }
+
+    /**
+     * Load the relations the public resource reports as identifiers.
+     *
+     * One query per relation instead of one per relation per read, and it makes
+     * an assignment made moments earlier in the same request readable back
+     * immediately.
+     */
+    protected function withPublicRelations(Vehicle $vehicle): Vehicle
+    {
+        $vehicle->loadMissing(static::PUBLIC_RELATIONS);
+
+        return $vehicle;
     }
 
     protected function vehicleResourceCollection($results)

package/server/src/Http/Controllers/Api/v1/ZoneController.php

@@ -212,7 +212,7 @@ class ZoneController extends Controller
         return (int) $request->input('radius', 500);
     }
 
-    protected function serviceAreaUuid(string $publicId, array $where): ?string
+    protected function serviceAreaUuid(?string $publicId, array $where): ?string
     {
         return Utils::getUuid('service_areas', $where);
     }

package/server/src/Http/Filter/Concerns/ResolvesPublicRelationUuids.php

@@ -0,0 +1,54 @@
+<?php
+
+namespace Fleetbase\FleetOps\Http\Filter\Concerns;
+
+use Fleetbase\FleetOps\Support\Utils;
+use Fleetbase\Support\Http;
+
+/**
+ * Resolves a relationship filter value expressed as a public identifier into the
+ * internal uuids the column actually stores.
+ *
+ * The public API never hands out uuids, so `?vendor=vendor_abc` has to be
+ * translated before it can be compared against `vendor_uuid`. Internal console
+ * requests deliberately keep passing uuids straight through, so the uuid arm is
+ * gated on the request kind rather than on the shape of the value.
+ */
+trait ResolvesPublicRelationUuids
+{
+    /**
+     * Resolve one or more public identifiers to uuids within the session company.
+     *
+     * @param class-string              $modelClass  the model the identifiers belong to
+     * @param string|array<int, string> $identifiers public_id / internal_id values (uuid when internal)
+     *
+     * @return array<int, string>
+     */
+    protected function resolvePublicRelationUuids(string $modelClass, string|array $identifiers, ?bool $allowUuid = null): array
+    {
+        $identifiers = array_values(array_filter(Utils::arrayFrom($identifiers), static fn ($identifier) => filled($identifier)));
+
+        if ($identifiers === []) {
+            return [];
+        }
+
+        $allowUuid = $allowUuid ?? Http::isInternalRequest($this->request);
+        $instance  = new $modelClass();
+
+        return $modelClass::query()
+            ->where('company_uuid', $this->session->get('company'))
+            ->where(function ($query) use ($identifiers, $instance, $allowUuid) {
+                $query->whereIn('public_id', $identifiers);
+
+                if (in_array('internal_id', $instance->getFillable())) {
+                    $query->orWhereIn('internal_id', $identifiers);
+                }
+
+                if ($allowUuid) {
+                    $query->orWhereIn('uuid', $identifiers);
+                }
+            })
+            ->pluck('uuid')
+            ->all();
+    }
+}

package/server/src/Http/Filter/DriverFilter.php

@@ -2,14 +2,21 @@
 
 namespace Fleetbase\FleetOps\Http\Filter;
 
+use Fleetbase\FleetOps\Http\Filter\Concerns\ResolvesPublicRelationUuids;
+use Fleetbase\FleetOps\Models\Fleet;
 use Fleetbase\FleetOps\Models\Place;
+use Fleetbase\FleetOps\Models\Vehicle;
+use Fleetbase\FleetOps\Models\Vendor;
 use Fleetbase\FleetOps\Support\Utils;
 use Fleetbase\Http\Filter\Filter;
 use Fleetbase\Models\Company;
+use Fleetbase\Support\Http;
 use Illuminate\Support\Str;
 
 class DriverFilter extends Filter
 {
+    use ResolvesPublicRelationUuids;
+
     public function queryForInternal()
     {
         $this->builder->where(
@@ -43,9 +50,28 @@ class DriverFilter extends Filter
         });
     }
 
+    /**
+     * Match a driver by the identifier the operator's own system uses.
+     *
+     * Two callers, two meanings. The Fleet-Ops console types into a search box
+     * and expects `VEH-10` to find `VEH-100`; an importer asks whether `VEH-10`
+     * exists and must not be told yes because `VEH-100` does. A partial match
+     * there produces a duplicate on every rerun.
+     *
+     * Core's ordinary fillable-column filtering is already equality — this
+     * method exists only because the console needs the looser behaviour, so it
+     * is the console that gets the exception. An unknown request context is
+     * treated as public: exact is the safe default of the two.
+     */
     public function internalId(?string $internalId)
     {
-        $this->builder->searchWhere('internal_id', $internalId);
+        if (Http::isInternalRequest($this->request)) {
+            $this->builder->searchWhere('internal_id', $internalId);
+
+            return;
+        }
+
+        $this->builder->where('internal_id', '=', $internalId);
     }
 
     public function name(?string $name)
@@ -58,14 +84,25 @@ class DriverFilter extends Filter
         );
     }
 
+    /**
+     * A public id identifies exactly one record, so a public lookup matches it
+     * exactly. The console keeps the partial search its id column filter box
+     * has always had.
+     */
     public function publicId(?string $publicId)
     {
-        $this->builder->searchWhere('public_id', $publicId);
+        if (Http::isInternalRequest($this->request)) {
+            $this->builder->searchWhere('public_id', $publicId);
+
+            return;
+        }
+
+        $this->builder->where('public_id', '=', $publicId);
     }
 
     public function facilitator(string $facilitator)
     {
-        $this->builder->where('vendor_uuid', $facilitator);
+        $this->builder->whereIn('vendor_uuid', $this->resolvePublicRelationUuids(Vendor::class, $facilitator));
     }
 
     public function vehicle(string $vehicle)
@@ -76,16 +113,28 @@ class DriverFilter extends Filter
             return;
         }
 
-        if (Str::isUuid($vehicle)) {
+        // The console passes a uuid; the public API passes a public or internal id.
+        if (Str::isUuid($vehicle) && Http::isInternalRequest($this->request)) {
             $this->builder->where('vehicle_uuid', $vehicle);
-        } else {
-            $this->builder->whereHas(
-                'vehicle',
-                function ($query) use ($vehicle) {
-                    $query->search($vehicle);
-                }
-            );
+
+            return;
+        }
+
+        $vehicleUuids = $this->resolvePublicRelationUuids(Vehicle::class, $vehicle);
+
+        if ($vehicleUuids !== []) {
+            $this->builder->whereIn('vehicle_uuid', $vehicleUuids);
+
+            return;
         }
+
+        // Fall back to a search so a partial plate or model still narrows a list.
+        $this->builder->whereHas(
+            'vehicle',
+            function ($query) use ($vehicle) {
+                $query->search($vehicle);
+            }
+        );
     }
 
     public function driversLicenseNumber(?string $driversLicenseNumber)
@@ -93,12 +142,17 @@ class DriverFilter extends Filter
         $this->builder->searchWhere('drivers_license_number', $driversLicenseNumber);
     }
 
+    /**
+     * `phone` is an accessor sourced from the linked user, not a relation — the
+     * previous `whereHas('phone')` asked Eloquent for a relation that does not
+     * exist and raised a 500 for every caller of `?phone=`.
+     */
     public function phone(string $phone)
     {
         $this->builder->whereHas(
-            'phone',
+            'user',
             function ($query) use ($phone) {
-                $query->search($phone);
+                $query->searchWhere('phone', $phone);
             }
         );
     }
@@ -127,10 +181,12 @@ class DriverFilter extends Filter
 
     public function fleet(string $fleet)
     {
+        $fleetUuids = $this->resolvePublicRelationUuids(Fleet::class, $fleet);
+
         $this->builder->whereHas(
             'fleets',
-            function ($q) use ($fleet) {
-                $q->where('fleet_uuid', $fleet);
+            function ($q) use ($fleetUuids) {
+                $q->whereIn('fleet_uuid', $fleetUuids);
             }
         );
     }

package/server/src/Http/Filter/FleetFilter.php

@@ -2,11 +2,19 @@
 
 namespace Fleetbase\FleetOps\Http\Filter;
 
+use Fleetbase\FleetOps\Http\Filter\Concerns\ResolvesPublicRelationUuids;
+use Fleetbase\FleetOps\Models\Fleet;
+use Fleetbase\FleetOps\Models\ServiceArea;
+use Fleetbase\FleetOps\Models\Vendor;
+use Fleetbase\FleetOps\Models\Zone;
 use Fleetbase\FleetOps\Support\Utils;
 use Fleetbase\Http\Filter\Filter;
+use Fleetbase\Support\Http;
 
 class FleetFilter extends Filter
 {
+    use ResolvesPublicRelationUuids;
+
     public function queryForInternal()
     {
         $this->builder->where('company_uuid', $this->session->get('company'))->with(['serviceArea', 'zone']);
@@ -17,15 +25,17 @@ class FleetFilter extends Filter
         $this->builder->where('company_uuid', $this->session->get('company'));
     }
 
+    /**
+     * Free-text search across a fleet's own columns.
+     *
+     * Previously matched against a `user` relation, which Fleet does not have —
+     * every `?query=` on the fleets endpoint raised a relation-not-found error
+     * rather than returning results.
+     */
     public function query(?string $searchQuery)
     {
         $this->builder->where(function ($query) use ($searchQuery) {
-            $query->orWhereHas(
-                'user',
-                function ($query) use ($searchQuery) {
-                    $query->searchWhere(['name', 'email', 'phone'], $searchQuery);
-                }
-            );
+            $query->searchWhere(['name', 'task', 'public_id'], $searchQuery);
         });
     }
 
@@ -38,49 +48,38 @@ class FleetFilter extends Filter
 
     public function serviceArea(?string $serviceArea)
     {
-        $this->builder->whereHas(
-            'serviceArea',
-            function ($query) use ($serviceArea) {
-                $query->where('uuid', $serviceArea);
-            }
-        );
+        $this->builder->whereIn('service_area_uuid', $this->resolvePublicRelationUuids(ServiceArea::class, $serviceArea));
     }
 
     public function zone(?string $zone)
     {
-        $this->builder->whereHas(
-            'zone',
-            function ($query) use ($zone) {
-                $query->where('zone_uuid', $zone);
-            }
-        );
+        $this->builder->whereIn('zone_uuid', $this->resolvePublicRelationUuids(Zone::class, $zone));
     }
 
     public function parentFleet(?string $fleet)
     {
-        $this->builder->whereHas(
-            'parent_fleet',
-            function ($query) use ($fleet) {
-                $query->where('uuid', $fleet);
-            }
-        );
-
-        $this->builder->searchWhere('parent_fleet_uuid', $fleet);
+        $this->builder->whereIn('parent_fleet_uuid', $this->resolvePublicRelationUuids(Fleet::class, $fleet));
     }
 
     public function vendor(?string $vendor)
     {
-        $this->builder->whereHas(
-            'vendor',
-            function ($query) use ($vendor) {
-                $query->where('uuid', $vendor);
-            }
-        );
+        $this->builder->whereIn('vendor_uuid', $this->resolvePublicRelationUuids(Vendor::class, $vendor));
     }
 
+    /**
+     * A public id identifies exactly one record, so a public lookup matches it
+     * exactly. The console keeps the partial search its id column filter box
+     * has always had.
+     */
     public function publicId(?string $publicId)
     {
-        $this->builder->searchWhere('public_id', $publicId);
+        if (Http::isInternalRequest($this->request)) {
+            $this->builder->searchWhere('public_id', $publicId);
+
+            return;
+        }
+
+        $this->builder->where('public_id', '=', $publicId);
     }
 
     public function task(?string $task)