@fleetbase/fleetops-engine 0.6.61 → 0.6.62

package/server/src/Http/Filter/VehicleFilter.php

@@ -2,6 +2,9 @@
 
 namespace Fleetbase\FleetOps\Http\Filter;
 
+use Fleetbase\FleetOps\Http\Filter\Concerns\ResolvesPublicRelationUuids;
+use Fleetbase\FleetOps\Models\Driver;
+use Fleetbase\FleetOps\Models\Fleet;
 use Fleetbase\FleetOps\Models\Vehicle;
 use Fleetbase\FleetOps\Models\Vendor;
 use Fleetbase\FleetOps\Support\Utils;
@@ -10,6 +13,8 @@ use Fleetbase\Support\Http;
 
 class VehicleFilter extends Filter
 {
+    use ResolvesPublicRelationUuids;
+
     public function queryForInternal()
     {
         $this->builder->where('company_uuid', $this->session->get('company'));
@@ -30,14 +35,56 @@ class VehicleFilter extends Filter
         $this->builder->searchWhere(['year', 'make', 'model', 'plate_number'], $display_name);
     }
 
+    /**
+     * Match a vehicle by the identifier the operator's own system uses.
+     *
+     * `internal_id` is the column an importer keys on to decide whether a
+     * vehicle already exists, and it was the one identifier the filter did not
+     * support — so every lookup fell through to a create.
+     */
+    /**
+     * Match a vehicle by the identifier the operator's own system uses.
+     *
+     * Two callers, two meanings. The Fleet-Ops console types into a search box
+     * and expects `VEH-10` to find `VEH-100`; an importer asks whether `VEH-10`
+     * exists and must not be told yes because `VEH-100` does. A partial match
+     * there produces a duplicate on every rerun.
+     *
+     * Core's ordinary fillable-column filtering is already equality — this
+     * method exists only because the console needs the looser behaviour, so it
+     * is the console that gets the exception. An unknown request context is
+     * treated as public: exact is the safe default of the two.
+     */
+    public function internalId(?string $internalId)
+    {
+        if (Http::isInternalRequest($this->request)) {
+            $this->builder->searchWhere('internal_id', $internalId);
+
+            return;
+        }
+
+        $this->builder->where('internal_id', '=', $internalId);
+    }
+
     public function vin(?string $vin)
     {
         $this->builder->searchWhere('vin', $vin);
     }
 
+    /**
+     * A public id identifies exactly one record, so a public lookup matches it
+     * exactly. The console keeps the partial search its id column filter box
+     * has always had.
+     */
     public function publicId(?string $publicIc)
     {
-        $this->builder->searchWhere('public_id', $publicIc);
+        if (Http::isInternalRequest($this->request)) {
+            $this->builder->searchWhere('public_id', $publicIc);
+
+            return;
+        }
+
+        $this->builder->where('public_id', '=', $publicIc);
     }
 
     public function plateNumber(?string $plateNumber)
@@ -68,10 +115,12 @@ class VehicleFilter extends Filter
             return;
         }
 
+        $driverUuids = $this->resolvePublicRelationUuids(Driver::class, $driverId);
+
         $this->builder->whereHas(
             'driver',
-            function ($query) use ($driverId) {
-                $query->where('uuid', $driverId);
+            function ($query) use ($driverUuids) {
+                $query->whereIn('uuid', $driverUuids);
             }
         );
     }
@@ -82,20 +131,7 @@ class VehicleFilter extends Filter
             return;
         }
 
-        $this->builder->whereIn('vendor_uuid', Vendor::query()
-            ->where('company_uuid', $this->session->get('company'))
-            ->where(function ($query) use ($vendor) {
-                $query->where('public_id', $vendor);
-
-                if (in_array('internal_id', (new Vendor())->getFillable())) {
-                    $query->orWhere('internal_id', $vendor);
-                }
-
-                if (Http::isInternalRequest($this->request)) {
-                    $query->orWhere('uuid', $vendor);
-                }
-            })
-            ->pluck('uuid'));
+        $this->builder->whereIn('vendor_uuid', $this->resolvePublicRelationUuids(Vendor::class, $vendor));
     }
 
     public function driverUuid(?string $driverId)
@@ -132,10 +168,12 @@ class VehicleFilter extends Filter
 
     public function fleet(string $fleet)
     {
+        $fleetUuids = $this->resolvePublicRelationUuids(Fleet::class, $fleet);
+
         $this->builder->whereHas(
             'fleets',
-            function ($q) use ($fleet) {
-                $q->where('fleet_uuid', $fleet);
+            function ($q) use ($fleetUuids) {
+                $q->whereIn('fleet_uuid', $fleetUuids);
             }
         );
     }

package/server/src/Http/Requests/Concerns/ScopesPublicRelationRules.php

@@ -0,0 +1,48 @@
+<?php
+
+namespace Fleetbase\FleetOps\Http\Requests\Concerns;
+
+use Illuminate\Validation\Rule;
+
+/**
+ * Builds `exists` rules for public relationship inputs that are scoped to the
+ * authenticated company.
+ *
+ * An unscoped `exists:vendors,public_id` accepts another organization's public
+ * id, and the controller then resolves it to nothing — so the request looks
+ * accepted while the relationship is silently dropped. Scoping the rule turns
+ * that into an explicit validation failure, and keeps a public id from
+ * confirming or denying the existence of a resource in someone else's company.
+ */
+trait ScopesPublicRelationRules
+{
+    /**
+     * An `exists` rule limited to the session company and to rows that are not
+     * soft deleted.
+     *
+     * No return type: the pest harness substitutes its own `Illuminate\Validation\Rule`
+     * stand-in, which is not an instance of the real `Rules\Exists`.
+     */
+    protected function existsInCompany(string $table, string $column = 'public_id')
+    {
+        $companyUuid = session('company');
+
+        return Rule::exists($table, $column)->where(function ($query) use ($companyUuid) {
+            $query->where('company_uuid', $companyUuid);
+            $query->whereNull('deleted_at');
+        });
+    }
+
+    /**
+     * The full rule set for an optional public relationship input.
+     *
+     * `nullable` is deliberate: sending `null` is how a caller clears an
+     * existing assignment, and `exists` is skipped for a null value.
+     *
+     * @return array<int, mixed>
+     */
+    protected function publicRelationRules(string $table, string $column = 'public_id'): array
+    {
+        return ['nullable', 'string', $this->existsInCompany($table, $column)];
+    }
+}

package/server/src/Http/Requests/CreateDriverRequest.php

@@ -2,12 +2,16 @@
 
 namespace Fleetbase\FleetOps\Http\Requests;
 
+use Fleetbase\FleetOps\Http\Requests\Concerns\ScopesPublicRelationRules;
+use Fleetbase\FleetOps\Models\Driver;
 use Fleetbase\FleetOps\Rules\ResolvablePoint;
 use Fleetbase\Http\Requests\FleetbaseRequest;
 use Illuminate\Validation\Rule;
 
 class CreateDriverRequest extends FleetbaseRequest
 {
+    use ScopesPublicRelationRules;
+
     /**
      * Determine if the user is authorized to make this request.
      */
@@ -24,23 +28,110 @@ class CreateDriverRequest extends FleetbaseRequest
         $isCreating = $this->isMethod('POST');
 
         return [
-            'name'           => [Rule::requiredIf($isCreating)],
-            'email'          => [Rule::requiredIf($isCreating), Rule::when($this->filled('email'), ['email']), Rule::when($isCreating, [Rule::unique('users')->whereNull('deleted_at')])],
-            'phone'          => [Rule::requiredIf($isCreating), Rule::when($isCreating, [Rule::unique('users')->whereNull('deleted_at')])],
-            'password'       => 'nullable|string',
+            'name' => [Rule::requiredIf($isCreating), 'nullable', 'string', 'max:191'],
+
+            /*
+             * Email and phone are optional.
+             *
+             * An operational fleet record often has neither: a subcontracted or
+             * yard-only driver may have no company mailbox and no handset. The
+             * previous contract forced both, and the only way to satisfy it was
+             * to invent an address or a number — which then sits in the tenant's
+             * user table looking real, can be mailed to, and blocks the genuine
+             * value later. Both are still validated and still unique when they
+             * are supplied; a driver created without them simply cannot sign in
+             * to Navigator until credentials are added.
+             */
+            'email'    => ['nullable', Rule::when($this->filled('email'), ['email']), $this->uniqueAmongUsers()],
+            'phone'    => ['nullable', 'string', $this->uniqueAmongUsers()],
+            'password' => 'nullable|string',
+            'timezone' => 'nullable|string|max:64',
+
+            // Identity
+            'internal_id'            => 'nullable|string|max:191',
+            'drivers_license_number' => 'nullable|string|max:191',
+            'license_expiry'         => 'nullable|date',
+            'photo'                  => 'nullable|string',
+
+            // Operational
             'country'        => 'nullable|size:2',
-            'city'           => 'nullable|string',
-            'vehicle'        => 'nullable|string|starts_with:vehicle_|exists:vehicles,public_id',
-            'license_expiry' => 'nullable|date',
+            'currency'       => 'nullable|string|size:3',
+            'city'           => 'nullable|string|max:191',
+            'online'         => 'nullable|boolean',
+            'current_status' => 'nullable|string|max:64',
             'status'         => 'nullable|string|in:active,available,inactive',
-            'vendor'         => 'nullable|exists:vendors,public_id',
-            'job'            => 'nullable|exists:orders,public_id',
+            'heading'        => 'nullable|numeric',
+            'bearing'        => 'nullable|numeric',
+            'altitude'       => 'nullable|numeric',
+            'speed'          => 'nullable|numeric',
             'location'       => ['nullable', new ResolvablePoint()],
             'latitude'       => ['nullable', 'required_with:longitude'],
             'longitude'      => ['nullable', 'required_with:latitude'],
+
+            // Structured / orchestrator
+            'meta'              => 'nullable|array',
+            'skills'            => 'nullable|array',
+            'skills.*'          => 'string',
+            'max_travel_time'   => 'nullable|integer|min:0',
+            'max_distance'      => 'nullable|integer|min:0',
+            'time_window_start' => 'nullable|date_format:H:i,H:i:s',
+            'time_window_end'   => 'nullable|date_format:H:i,H:i:s',
+
+            // Relationships, resolved from public ids inside the caller's company
+            'vehicle' => ['nullable', 'string', 'starts_with:vehicle_', $this->existsInCompany('vehicles')],
+            'vendor'  => $this->publicRelationRules('vendors'),
+            'job'     => $this->publicRelationRules('orders'),
         ];
     }
 
+    /**
+     * Uniqueness against every other live user account.
+     *
+     * Update used to skip this check entirely, so one driver could be given an
+     * address another driver already signs in with — and the two would then be
+     * indistinguishable to every identity lookup, including the password reset
+     * that matches on it. The driver's own linked user is ignored by uuid, so
+     * resending an unchanged address or number still succeeds.
+     *
+     * No return type: the pest harness substitutes its own
+     * `Illuminate\Validation\Rule`, which is not an instance of `Rules\Unique`.
+     */
+    protected function uniqueAmongUsers()
+    {
+        $rule = Rule::unique('users')->whereNull('deleted_at');
+
+        $ownUserUuid = $this->linkedUserUuid();
+
+        return $ownUserUuid ? $rule->ignore($ownUserUuid, 'uuid') : $rule;
+    }
+
+    /**
+     * The uuid of the user behind the driver this request is updating.
+     *
+     * Null on create, and null when there is no resolvable route parameter —
+     * which is also what keeps this from querying during rule construction in
+     * contexts that have no route bound.
+     */
+    protected function linkedUserUuid(): ?string
+    {
+        if ($this->isMethod('POST')) {
+            return null;
+        }
+
+        $id = $this->route('id');
+
+        if (!is_string($id) || $id === '') {
+            return null;
+        }
+
+        return Driver::withoutGlobalScopes()
+            ->where('company_uuid', session('company'))
+            ->where(function ($query) use ($id) {
+                $query->where('public_id', $id)->orWhere('internal_id', $id);
+            })
+            ->value('user_uuid');
+    }
+
     /**
      * Get custom attributes for validator errors.
      */

package/server/src/Http/Requests/CreateFleetRequest.php

@@ -2,11 +2,14 @@
 
 namespace Fleetbase\FleetOps\Http\Requests;
 
+use Fleetbase\FleetOps\Http\Requests\Concerns\ScopesPublicRelationRules;
 use Fleetbase\Http\Requests\FleetbaseRequest;
 use Illuminate\Validation\Rule;
 
 class CreateFleetRequest extends FleetbaseRequest
 {
+    use ScopesPublicRelationRules;
+
     /**
      * Determine if the user is authorized to make this request.
      */
@@ -21,8 +24,33 @@ class CreateFleetRequest extends FleetbaseRequest
     public function rules(): array
     {
         return [
-            'name'         => [Rule::requiredIf($this->isMethod('POST'))],
-            'service_area' => 'exists:service_areas,public_id',
+            'name'   => [Rule::requiredIf($this->isMethod('POST')), 'nullable', 'string', 'max:191'],
+            'color'  => 'nullable|string|max:64',
+            'task'   => 'nullable|string|max:191',
+            /*
+             * Fleet status is not a closed set on this model: the console, the
+             * spreadsheet importer and existing integrations all write free-form
+             * values, and `active`/`disabled`/`decommissioned` are the console's
+             * options rather than a schema constraint. Restricting the public API
+             * to a subset would leave it unable to express a state the console can.
+             */
+            'status'       => 'nullable|string|max:64',
+            'service_area' => $this->publicRelationRules('service_areas'),
+            'zone'         => $this->publicRelationRules('zones'),
+            'vendor'       => $this->publicRelationRules('vendors'),
+            'parent_fleet' => $this->publicRelationRules('fleets'),
+            'photo'        => 'nullable|string',
+        ];
+    }
+
+    /**
+     * Get custom attributes for validator errors.
+     */
+    public function attributes(): array
+    {
+        return [
+            'service_area' => 'service area',
+            'parent_fleet' => 'parent fleet',
         ];
     }
 }

package/server/src/Http/Requests/CreateServiceRateRequest.php

@@ -25,8 +25,13 @@ class CreateServiceRateRequest extends FleetbaseRequest
         return [
             'service_name'                  => [Rule::requiredIf($this->isMethod('POST')), 'string'],
             'service_type'                  => [Rule::requiredIf($this->isMethod('POST')), 'string'],
-            'service_area'                  => [Rule::exists('service_areas', 'public_id')->whereNull('deleted_at')],
-            'zone'                          => [Rule::exists('zones', 'public_id')->whereNull('deleted_at')],
+            // `nullable` so an empty relationship is treated as absent rather than
+            // as an invalid one. Both are optional, but without it `exists` runs
+            // against the null that ConvertEmptyStringsToNull produced and answers
+            // "The selected service area is invalid" for a field the caller simply
+            // did not fill in.
+            'service_area'                  => ['nullable', Rule::exists('service_areas', 'public_id')->whereNull('deleted_at')],
+            'zone'                          => ['nullable', Rule::exists('zones', 'public_id')->whereNull('deleted_at')],
             'rate_calculation_method'       => [Rule::requiredIf($this->isMethod('POST')), 'string', 'in:fixed_meter,fixed_rate,per_meter,per_drop,algo,parcel'],
             'currency'                      => ['required', 'size:3'],
             'base_fee'                      => ['numeric'],

package/server/src/Http/Requests/CreateVehicleRequest.php

@@ -2,12 +2,45 @@
 
 namespace Fleetbase\FleetOps\Http\Requests;
 
+use Fleetbase\FleetOps\Http\Requests\Concerns\ScopesPublicRelationRules;
 use Fleetbase\FleetOps\Rules\ResolvablePoint;
 use Fleetbase\Http\Requests\FleetbaseRequest;
 use Illuminate\Validation\Rule;
 
 class CreateVehicleRequest extends FleetbaseRequest
 {
+    use ScopesPublicRelationRules;
+
+    /**
+     * The statuses the public API accepts for a vehicle.
+     *
+     * `active` is retained even though the model rewrites it to `available`, so
+     * clients written against the original contract keep working.
+     *
+     * @var array<int, string>
+     */
+    public const STATUSES = [
+        'active',
+        'available',
+        'in_use',
+        'maintenance',
+        'out_of_service',
+        'reserved',
+        'retired',
+        'staging',
+        'on_route',
+        'idle',
+        'cleaning',
+        'awaiting_parts',
+        'inspection_due',
+        'inspection_failed',
+        'accident',
+        'compliance_hold',
+        'stolen',
+        'operational',
+        'decommissioned',
+    ];
+
     /**
      * Determine if the user is authorized to make this request.
      */
@@ -22,40 +55,126 @@ class CreateVehicleRequest extends FleetbaseRequest
     public function rules(): array
     {
         return [
-            'status'    => [
-                'nullable',
-                Rule::in([
-                    'active',
-                    'available',
-                    'in_use',
-                    'maintenance',
-                    'out_of_service',
-                    'reserved',
-                    'retired',
-                    'staging',
-                    'on_route',
-                    'idle',
-                    'cleaning',
-                    'awaiting_parts',
-                    'inspection_due',
-                    'inspection_failed',
-                    'accident',
-                    'compliance_hold',
-                    'stolen',
-                    'operational',
-                    'decommissioned',
-                ]),
-            ],
+            'status' => ['nullable', Rule::in(static::STATUSES)],
+
+            // Identity and description
+            'internal_id'      => 'nullable|string|max:191',
+            'name'             => 'nullable|string|max:191',
+            'description'      => 'nullable|string',
+            'make'             => 'nullable|string|max:191',
+            'model'            => 'nullable|string|max:191',
+            'model_type'       => 'nullable|string|max:191',
+            'year'             => 'nullable|integer|min:1900|max:2100',
+            'trim'             => 'nullable|string|max:191',
+            'color'            => 'nullable|string|max:64',
+            'type'             => 'nullable|string|max:191',
+            'class'            => 'nullable|string|max:191',
+            'plate_number'     => 'nullable|string|max:191',
+            'vin'              => 'nullable|string|max:64',
+            'serial_number'    => 'nullable|string|max:191',
+            'call_sign'        => 'nullable|string|max:191',
+            'fuel_card_number' => 'nullable|string|max:191',
+
+            // Measurement and operation.
+            //
             // Validated rather than merely accepted: the model casts odometer
             // to an integer, so an unchecked string would be stored as 0 — a
             // vehicle reporting zero miles rather than an error.
-            'odometer'      => 'nullable|numeric|min:0',
-            'odometer_unit' => 'nullable|string|max:12',
-            'vendor'        => 'nullable|exists:vendors,public_id',
-            'driver'        => 'nullable|exists:drivers,public_id',
-            'location'      => ['nullable', new ResolvablePoint()],
-            'latitude'      => ['nullable', 'required_with:longitude'],
-            'longitude'     => ['nullable', 'required_with:latitude'],
+            'odometer'             => 'nullable|numeric|min:0',
+            'odometer_unit'        => 'nullable|string|max:12',
+            'odometer_at_purchase' => 'nullable|numeric|min:0',
+            'measurement_system'   => 'nullable|string|max:32',
+            'fuel_type'            => 'nullable|string|max:64',
+            'fuel_volume_unit'     => 'nullable|string|max:12',
+            'online'               => 'nullable|boolean',
+
+            // Body, capacity and dimensions
+            'transmission'      => 'nullable|string|max:64',
+            'body_type'         => 'nullable|string|max:191',
+            'body_sub_type'     => 'nullable|string|max:191',
+            'usage_type'        => 'nullable|string|max:64',
+            'ownership_type'    => 'nullable|string|max:64',
+            'cargo_volume'      => 'nullable|numeric|min:0',
+            'passenger_volume'  => 'nullable|numeric|min:0',
+            'interior_volume'   => 'nullable|numeric|min:0',
+            'weight'            => 'nullable|numeric|min:0',
+            'width'             => 'nullable|numeric|min:0',
+            'length'            => 'nullable|numeric|min:0',
+            'height'            => 'nullable|numeric|min:0',
+            'towing_capacity'   => 'nullable|numeric|min:0',
+            'payload_capacity'  => 'nullable|numeric|min:0',
+            'seating_capacity'  => 'nullable|integer|min:0',
+            'ground_clearance'  => 'nullable|numeric|min:0',
+            'bed_length'        => 'nullable|numeric|min:0',
+            'fuel_capacity'     => 'nullable|numeric|min:0',
+
+            // Lifecycle and financing
+            'financing_status'                     => 'nullable|string|max:64',
+            'loan_number_of_payments'              => 'nullable|integer|min:0',
+            'loan_first_payment'                   => 'nullable|date',
+            'loan_amount'                          => 'nullable|numeric|min:0',
+            'estimated_service_life_distance_unit' => 'nullable|string|max:12',
+            'estimated_service_life_distance'      => 'nullable|integer|min:0',
+            'estimated_service_life_months'        => 'nullable|integer|min:0',
+            'insurance_value'                      => 'nullable|numeric|min:0',
+            'depreciation_rate'                    => 'nullable|numeric',
+            'current_value'                        => 'nullable|numeric|min:0',
+            'acquisition_cost'                     => 'nullable|numeric|min:0',
+            'currency'                             => 'nullable|string|size:3',
+            'purchased_at'                         => 'nullable|date',
+            'lease_expires_at'                     => 'nullable|date',
+
+            // Regulatory and engine specifications
+            'emission_standard'    => 'nullable|string|max:64',
+            'dpf_equipped'         => 'nullable|boolean',
+            'scr_equipped'         => 'nullable|boolean',
+            'gvwr'                 => 'nullable|numeric|min:0',
+            'gcwr'                 => 'nullable|numeric|min:0',
+            'engine_number'        => 'nullable|string|max:191',
+            'engine_model'         => 'nullable|string|max:191',
+            'engine_make'          => 'nullable|string|max:191',
+            'engine_family'        => 'nullable|string|max:191',
+            'engine_configuration' => 'nullable|string|max:191',
+            'engine_displacement'  => 'nullable|numeric|min:0',
+            'engine_size'          => 'nullable|numeric|min:0',
+            'horsepower'           => 'nullable|numeric|min:0',
+            'horsepower_rpm'       => 'nullable|integer|min:0',
+            'torque'               => 'nullable|numeric|min:0',
+            'torque_rpm'           => 'nullable|integer|min:0',
+            'number_of_cylinders'  => 'nullable|integer|min:0',
+            'cylinder_arrangement' => 'nullable|string|max:64',
+
+            // Structured and descriptive fields
+            'specs'   => 'nullable|array',
+            'details' => 'nullable|array',
+            'notes'   => 'nullable|string',
+            'meta'    => 'nullable|array',
+
+            // Orchestrator
+            'skills'                   => 'nullable|array',
+            'skills.*'                 => 'string',
+            'payload_capacity_volume'  => 'nullable|numeric|min:0',
+            'payload_capacity_pallets' => 'nullable|integer|min:0',
+            'payload_capacity_parcels' => 'nullable|integer|min:0',
+            'max_tasks'                => 'nullable|integer|min:0',
+            'time_window_start'        => 'nullable|date_format:H:i,H:i:s',
+            'time_window_end'          => 'nullable|date_format:H:i,H:i:s',
+            'return_to_depot'          => 'nullable|boolean',
+
+            // Relationships, resolved from public ids inside the caller's company
+            'vendor'   => $this->publicRelationRules('vendors'),
+            'driver'   => $this->publicRelationRules('drivers'),
+            'category' => $this->publicRelationRules('categories'),
+            'warranty' => $this->publicRelationRules('warranties'),
+            'photo'    => 'nullable|string',
+
+            // Location
+            'location'  => ['nullable', new ResolvablePoint()],
+            'latitude'  => ['nullable', 'required_with:longitude'],
+            'longitude' => ['nullable', 'required_with:latitude'],
+            'altitude'  => 'nullable|numeric',
+            'heading'   => 'nullable|numeric',
+            'speed'     => 'nullable|numeric',
         ];
     }
 }