@fleetbase/fleetops-engine 0.6.61 → 0.6.63

package/server/tests/DriverFilterExecutionTest.php

@@ -94,6 +94,42 @@ class FleetOpsRecordingDriverFilterBuilder
     }
 }
 
+/**
+ * A filter whose request resolves to an internal console route.
+ *
+ * `Http::isInternalRequest()` reads the resolved route's uri, not the request
+ * path, so a filter built without a route resolver is always public — which is
+ * why the console's uuid branch needs a route to be reached at all.
+ */
+function fleetopsInternalDriverFilter(FleetOpsRecordingDriverFilterBuilder $builder): DriverFilter
+{
+    $uri     = 'int/v1/fleet-ops/drivers';
+    $request = Request::create('/' . $uri, 'GET');
+    $session = app('session.store');
+    $session->put('company', 'company_test');
+    $request->setLaravelSession($session);
+    $request->setRouteResolver(fn () => new class($uri) {
+        public array $action = [];
+
+        public function __construct(private string $uri)
+        {
+        }
+
+        public function uri(): string
+        {
+            return $this->uri;
+        }
+    });
+
+    $filter     = new DriverFilter($request);
+    $reflection = new ReflectionClass($filter);
+    $property   = $reflection->getParentClass()->getProperty('builder');
+    $property->setAccessible(true);
+    $property->setValue($filter, $builder);
+
+    return $filter;
+}
+
 function fleetopsDriverFilter(FleetOpsRecordingDriverFilterBuilder $builder, array $query = []): DriverFilter
 {
     $request = Request::create('/int/v1/drivers', 'GET', $query);
@@ -110,6 +146,63 @@ function fleetopsDriverFilter(FleetOpsRecordingDriverFilterBuilder $builder, arr
     return $filter;
 }
 
+/**
+ * Relationship filters resolve public ids to uuids, which is a real query.
+ *
+ * @return array<string, array<string, string>>
+ */
+function fleetopsDriverFilterRelationDatabase(): array
+{
+    $connection = new Illuminate\Database\SQLiteConnection(new PDO('sqlite::memory:'));
+    $resolver   = new Illuminate\Database\ConnectionResolver(['default' => $connection, 'mysql' => $connection]);
+    $resolver->setDefaultConnection('mysql');
+    Illuminate\Database\Eloquent\Model::setConnectionResolver($resolver);
+    app()->instance('db', new class($connection) {
+        public function __construct(public Illuminate\Database\SQLiteConnection $c)
+        {
+        }
+
+        public function connection($name = null)
+        {
+            return $this->c;
+        }
+
+        public function __call($method, $arguments)
+        {
+            return $this->c->{$method}(...$arguments);
+        }
+    });
+    Illuminate\Support\Facades\DB::clearResolvedInstance('db');
+
+    $schema = $connection->getSchemaBuilder();
+    foreach (['vendors', 'vehicles', 'fleets'] as $table) {
+        if ($schema->hasTable($table)) {
+            $schema->drop($table);
+        }
+
+        $schema->create($table, function ($blueprint) {
+            $blueprint->increments('id');
+            foreach (['uuid', 'public_id', 'internal_id', 'company_uuid', 'name', '_key'] as $column) {
+                $blueprint->string($column)->nullable();
+            }
+            $blueprint->timestamps();
+            $blueprint->timestamp('deleted_at')->nullable();
+        });
+    }
+
+    $rows = [
+        'vendors'  => ['uuid' => '88888888-8888-4888-8888-888888888801', 'public_id' => 'vendor_dfilterone1'],
+        'vehicles' => ['uuid' => '88888888-8888-4888-8888-888888888802', 'public_id' => 'vehicle_dfilteron'],
+        'fleets'   => ['uuid' => '88888888-8888-4888-8888-888888888803', 'public_id' => 'fleet_dfilterone1'],
+    ];
+
+    foreach ($rows as $table => $row) {
+        $connection->table($table)->insert($row + ['company_uuid' => 'company_test']);
+    }
+
+    return $rows;
+}
+
 test('driver filter applies internal public and text search scopes', function () {
     $builder = new FleetOpsRecordingDriverFilterBuilder();
     $filter  = fleetopsDriverFilter($builder);
@@ -128,27 +221,46 @@ test('driver filter applies internal public and text search scopes', function ()
 });
 
 test('driver filter assignment and identity filters execute uuid and public branches', function () {
+    $rows    = fleetopsDriverFilterRelationDatabase();
     $builder = new FleetOpsRecordingDriverFilterBuilder();
     $filter  = fleetopsDriverFilter($builder);
     $uuid    = (string) Str::uuid();
 
-    $filter->facilitator('vendor_uuid');
-    $filter->vendor('vendor_uuid');
+    $filter->facilitator($rows['vendors']['public_id']);
+    $filter->vendor($rows['vendors']['public_id']);
     $filter->vehicle('unassigned');
+    // The console's uuid branch — this filter is constructed on an /int route.
     $filter->vehicle($uuid);
+    $filter->vehicle($rows['vehicles']['public_id']);
+    // An identifier that resolves to nothing still narrows by search rather
+    // than raising.
     $filter->vehicle('vehicle_public');
     $filter->driversLicenseNumber('DL-123');
     $filter->phone('+15551112222');
     $filter->country('SG,MY');
     $filter->country('MN');
     $filter->status('available,offline');
-    $filter->fleet('fleet_uuid');
+    $filter->fleet($rows['fleets']['public_id']);
+
+    $whereIns = collect($builder->methodCalls('whereIn'))->map(fn ($call) => [$call[1], $call[2]])->all();
+    $nested   = collect($builder->methodCalls('whereHas'))
+        ->flatMap(fn ($call) => $call[2]->calls)
+        ->filter(fn ($call) => $call[0] === 'whereIn')
+        ->map(fn ($call) => [$call[1], $call[2]])
+        ->all();
 
     expect($builder->called('whereNull'))->toBeTrue()
-        ->and($builder->called('where'))->toBeTrue()
         ->and($builder->called('whereHas'))->toBeTrue()
-        ->and($builder->called('whereIn'))->toBeTrue()
-        ->and($builder->called('searchWhere'))->toBeTrue();
+        ->and($builder->called('searchWhere'))->toBeTrue()
+        // The vendor filter used to compare a public id against `vendor_uuid`
+        // directly, which could never match.
+        ->and($whereIns)->toContain(['vendor_uuid', [$rows['vendors']['uuid']]])
+        ->and($whereIns)->toContain(['vehicle_uuid', [$rows['vehicles']['uuid']]])
+        ->and($nested)->toContain(['fleet_uuid', [$rows['fleets']['uuid']]])
+        // `?phone=` reached for a relation that does not exist on Driver; it now
+        // searches the linked user.
+        ->and(collect($builder->methodCalls('whereHas'))->pluck(1)->all())->toContain('user')
+        ->and(collect($builder->methodCalls('whereHas'))->pluck(1)->all())->not->toContain('phone');
 });
 
 test('driver filter date and nearby coordinate filters execute query operations', function () {
@@ -261,3 +373,15 @@ test('driver filter covers alternate date branches company radius and address ne
     expect($addressBuilder->called('distanceSphere'))->toBeTrue()
         ->and($addressBuilder->called('distanceSphereValue'))->toBeTrue();
 });
+
+test('driver filter keeps the console uuid branch for internal requests only', function () {
+    $uuid = (string) Str::uuid();
+
+    $internalBuilder = new FleetOpsRecordingDriverFilterBuilder();
+    fleetopsInternalDriverFilter($internalBuilder)->vehicle($uuid);
+
+    // The console sends a vehicle uuid and must keep matching on it directly,
+    // without a lookup.
+    expect(collect($internalBuilder->methodCalls('where'))->map(fn ($call) => [$call[1], $call[2]])->all())
+        ->toContain(['vehicle_uuid', [$uuid]]);
+});

package/server/tests/ExceptionContractsTest.php

@@ -11,6 +11,7 @@ namespace Illuminate\Foundation\Auth {
 namespace {
     use Fleetbase\FleetOps\Exceptions\CustomerUserConflictException;
     use Fleetbase\FleetOps\Exceptions\IntegratedVendorException;
+    use Fleetbase\FleetOps\Exceptions\PublicRelationNotFoundException;
     use Fleetbase\FleetOps\Exceptions\TelematicProviderException;
     use Fleetbase\FleetOps\Exceptions\TelematicRateLimitExceededException;
     use Fleetbase\FleetOps\Exceptions\UserAlreadyExistsException;
@@ -78,4 +79,18 @@ namespace {
                 'integratedVendorId' => 'vendor-1',
             ]);
     });
+
+    test('public relation exceptions name the input that failed to resolve', function () {
+        $previous  = new Illuminate\Database\Eloquent\ModelNotFoundException();
+        $exception = new PublicRelationNotFoundException('parent_fleet', 'fleet_other_company', $previous);
+
+        // The message names the field in prose, so a client is told which input
+        // was at fault — while a cross-company id and a missing one produce the
+        // same answer, so neither can be used to probe another organization.
+        expect($exception->getMessage())->toBe('No parent fleet resource found for the identifier provided.')
+            ->and($exception->getRelation())->toBe('parent_fleet')
+            ->and($exception->getIdentifier())->toBe('fleet_other_company')
+            ->and($exception->getPrevious())->toBe($previous)
+            ->and((new PublicRelationNotFoundException('vendor'))->getIdentifier())->toBeNull();
+    });
 }

package/server/tests/Feature/Http/Api/DeviceControllerContractsTest.php

@@ -41,7 +41,7 @@ class FleetOpsApiDeviceControllerEndpointProbe extends DeviceController
         return [['uuid' => 'device-a'], ['uuid' => 'device-b']];
     }
 
-    protected function resolveModel(string $modelClass, string $id): EloquentModel
+    protected function resolveModel(string $modelClass, string $id, ?string $companyUuid = null): EloquentModel
     {
         $key = $modelClass . ':' . $id;
 

package/server/tests/Feature/Http/Api/FleetMembershipMigrationTest.php

@@ -0,0 +1,140 @@
+<?php
+
+use Illuminate\Database\ConnectionResolver;
+use Illuminate\Database\Eloquent\Model as EloquentModel;
+use Illuminate\Database\SQLiteConnection;
+use Illuminate\Support\Facades\DB;
+use Illuminate\Support\Facades\Schema;
+
+/**
+ * The membership uniqueness migration, run against a table that already holds
+ * the duplicates it exists to prevent.
+ *
+ * An index cannot be added on top of existing duplicates, so the migration has
+ * to decide which row survives. The policy has to be deterministic — a second
+ * run must be a no-op — and it must never reach past the pivot: no fleet,
+ * vehicle or driver is touched, and no surviving membership changes state.
+ */
+function fleetopsMembershipMigrationBoot(): SQLiteConnection
+{
+    $connection = new SQLiteConnection(new PDO('sqlite::memory:'));
+    $resolver   = new ConnectionResolver(['default' => $connection, 'mysql' => $connection]);
+    $resolver->setDefaultConnection('mysql');
+    EloquentModel::setConnectionResolver($resolver);
+
+    app()->instance('db', new class($connection) {
+        public function __construct(public SQLiteConnection $c)
+        {
+        }
+
+        public function connection($name = null): SQLiteConnection
+        {
+            return $this->c;
+        }
+
+        public function getDatabaseName(): string
+        {
+            return 'main';
+        }
+
+        public function table($table, $as = null)
+        {
+            return $this->c->table($table, $as);
+        }
+
+        public function __call($method, $arguments)
+        {
+            return $this->c->{$method}(...$arguments);
+        }
+    });
+    app()->instance('db.schema', $connection->getSchemaBuilder());
+    DB::clearResolvedInstance('db');
+    Schema::clearResolvedInstance('db.schema');
+
+    $schema = $connection->getSchemaBuilder();
+    foreach (['fleet_vehicles' => 'vehicle_uuid', 'fleet_drivers' => 'driver_uuid'] as $table => $subjectColumn) {
+        $schema->create($table, function ($blueprint) use ($subjectColumn) {
+            $blueprint->increments('id');
+            $blueprint->string('uuid')->nullable();
+            $blueprint->string('fleet_uuid')->nullable();
+            $blueprint->string($subjectColumn)->nullable();
+            $blueprint->timestamps();
+            $blueprint->timestamp('deleted_at')->nullable();
+        });
+    }
+
+    return $connection;
+}
+
+/**
+ * Reach the migration's cleanup directly. `information_schema` does not exist on
+ * sqlite, so the index step is exercised separately in FleetMembershipTest.
+ */
+function fleetopsRunMembershipCleanup(string $table, string $memberColumn): void
+{
+    $migration  = require dirname(__DIR__, 4) . '/migrations/2026_09_05_000001_add_unique_indexes_to_fleet_membership_pivots.php';
+    $reflection = new ReflectionMethod($migration, 'removeDuplicateMemberships');
+    $reflection->setAccessible(true);
+    $reflection->invoke($migration, $table, $memberColumn);
+}
+
+test('duplicate cleanup keeps the active membership and drops the rest', function () {
+    $connection = fleetopsMembershipMigrationBoot();
+
+    $connection->table('fleet_vehicles')->insert([
+        // A tombstone recorded first, then the membership the fleet actually has.
+        ['id' => 1, 'uuid' => 'a', 'fleet_uuid' => 'fleet-1', 'vehicle_uuid' => 'vehicle-1', 'deleted_at' => '2026-01-01 00:00:00'],
+        ['id' => 2, 'uuid' => 'b', 'fleet_uuid' => 'fleet-1', 'vehicle_uuid' => 'vehicle-1', 'deleted_at' => null],
+        ['id' => 3, 'uuid' => 'c', 'fleet_uuid' => 'fleet-1', 'vehicle_uuid' => 'vehicle-1', 'deleted_at' => null],
+        // A different pair, and an unrelated fleet, both untouched.
+        ['id' => 4, 'uuid' => 'd', 'fleet_uuid' => 'fleet-1', 'vehicle_uuid' => 'vehicle-2', 'deleted_at' => null],
+        ['id' => 5, 'uuid' => 'e', 'fleet_uuid' => 'fleet-2', 'vehicle_uuid' => 'vehicle-1', 'deleted_at' => null],
+    ]);
+
+    fleetopsRunMembershipCleanup('fleet_vehicles', 'vehicle_uuid');
+
+    $survivors = $connection->table('fleet_vehicles')->orderBy('id')->pluck('uuid')->all();
+
+    // The live row wins over the tombstone, the lowest id wins among equals, and
+    // nothing outside the duplicated pair is affected.
+    expect($survivors)->toBe(['b', 'd', 'e'])
+        ->and($connection->table('fleet_vehicles')->where('uuid', 'b')->value('deleted_at'))->toBeNull();
+});
+
+test('duplicate cleanup keeps one restorable row when every duplicate is soft deleted', function () {
+    $connection = fleetopsMembershipMigrationBoot();
+
+    $connection->table('fleet_drivers')->insert([
+        ['id' => 1, 'uuid' => 'a', 'fleet_uuid' => 'fleet-1', 'driver_uuid' => 'driver-1', 'deleted_at' => '2026-01-01 00:00:00'],
+        ['id' => 2, 'uuid' => 'b', 'fleet_uuid' => 'fleet-1', 'driver_uuid' => 'driver-1', 'deleted_at' => '2026-02-01 00:00:00'],
+    ]);
+
+    fleetopsRunMembershipCleanup('fleet_drivers', 'driver_uuid');
+
+    // Removing both would turn a later re-assignment into a brand new row and
+    // lose the original membership's history.
+    expect($connection->table('fleet_drivers')->pluck('uuid')->all())->toBe(['a'])
+        ->and($connection->table('fleet_drivers')->where('uuid', 'a')->value('deleted_at'))->not->toBeNull();
+});
+
+test('duplicate cleanup is idempotent and leaves orphaned rows alone', function () {
+    $connection = fleetopsMembershipMigrationBoot();
+
+    $connection->table('fleet_vehicles')->insert([
+        ['id' => 1, 'uuid' => 'a', 'fleet_uuid' => 'fleet-1', 'vehicle_uuid' => 'vehicle-1', 'deleted_at' => null],
+        ['id' => 2, 'uuid' => 'b', 'fleet_uuid' => 'fleet-1', 'vehicle_uuid' => 'vehicle-1', 'deleted_at' => null],
+        // Orphaned data rather than a membership: a null side never collides in
+        // a unique index, so it is not the migration's business.
+        ['id' => 3, 'uuid' => 'c', 'fleet_uuid' => null, 'vehicle_uuid' => 'vehicle-9', 'deleted_at' => null],
+        ['id' => 4, 'uuid' => 'd', 'fleet_uuid' => null, 'vehicle_uuid' => 'vehicle-9', 'deleted_at' => null],
+    ]);
+
+    fleetopsRunMembershipCleanup('fleet_vehicles', 'vehicle_uuid');
+    $afterFirst = $connection->table('fleet_vehicles')->orderBy('id')->pluck('uuid')->all();
+
+    fleetopsRunMembershipCleanup('fleet_vehicles', 'vehicle_uuid');
+    $afterSecond = $connection->table('fleet_vehicles')->orderBy('id')->pluck('uuid')->all();
+
+    expect($afterFirst)->toBe(['a', 'c', 'd'])
+        ->and($afterSecond)->toBe($afterFirst);
+});