@fleetbase/fleetops-engine 0.6.61 → 0.6.63

package/server/tests/ApiVehicleControllerContractsTest.php

@@ -5,6 +5,9 @@ use Fleetbase\FleetOps\Http\Requests\CreateVehicleRequest;
 use Fleetbase\FleetOps\Http\Requests\UpdateVehicleRequest;
 use Fleetbase\FleetOps\Models\Driver;
 use Fleetbase\FleetOps\Models\Vehicle;
+use Fleetbase\FleetOps\Models\Vendor;
+use Fleetbase\FleetOps\Models\Warranty;
+use Fleetbase\Models\Category;
 use Illuminate\Database\Eloquent\ModelNotFoundException;
 use Illuminate\Http\Request;
 
@@ -13,7 +16,8 @@ class FleetOpsApiVehicleCrudControllerProbe extends VehicleController
     public ?FleetOpsApiVehicleCrudFake $vehicle = null;
     public ?FleetOpsApiDriverCrudFake $driver   = null;
     public array $createdVehicles               = [];
-    public array $vendorLookups                 = [];
+    public array $relationLookups               = [];
+    public array $unresolvable                  = [];
     public mixed $queryResults                  = null;
     public bool $vehicleNotFound                = false;
     public bool $driverNotFound                 = false;
@@ -23,11 +27,26 @@ class FleetOpsApiVehicleCrudControllerProbe extends VehicleController
         return $this->vehicleInputFromRequest($request);
     }
 
-    protected function getVendorUuid(string $table, array $where): ?string
+    /**
+     * Stand in for the company-scoped public-id lookup.
+     *
+     * Anything listed in `$unresolvable` behaves as a cross-company or missing
+     * identifier does in production: the lookup finds nothing inside the
+     * caller's company and raises.
+     */
+    protected function resolveUuid(string $modelClass, ?string $id, ?string $companyUuid = null): ?string
     {
-        $this->vendorLookups[] = [$table, $where];
+        if (empty($id)) {
+            return null;
+        }
+
+        $this->relationLookups[] = [$modelClass, $id];
+
+        if (in_array($id, $this->unresolvable, true)) {
+            throw (new ModelNotFoundException())->setModel($modelClass, $id);
+        }
 
-        return 'vendor-uuid';
+        return strtolower(class_basename($modelClass)) . '-uuid';
     }
 
     protected function createVehicle(array $input): Vehicle
@@ -51,7 +70,7 @@ class FleetOpsApiVehicleCrudControllerProbe extends VehicleController
         return $this->vehicle;
     }
 
-    protected function findDriver(string $id): Driver
+    protected function findDriver(?string $id): Driver
     {
         if ($this->driverNotFound) {
             throw new ModelNotFoundException();
@@ -240,8 +259,8 @@ test('api vehicle controller creates vehicles with defaults relation lookups and
     $vehicle = $response['vehicle'];
 
     expect($response['resource'])->toBe('vehicle')
-        ->and($controller->vendorLookups)->toBe([
-            ['vendors', ['public_id' => 'vendor-public', 'company_uuid' => 'company-uuid']],
+        ->and($controller->relationLookups)->toBe([
+            [Vendor::class, 'vendor-public'],
         ])
         ->and($controller->createdVehicles[0])->toMatchArray([
             'status'       => 'active',
@@ -292,9 +311,11 @@ test('api vehicle controller updates queries finds deletes and tracks empty coor
             'make'        => 'Nissan',
             'model'       => 'NV350',
             'vin'         => 'NEWVIN',
-            'online'      => 0,
             'vendor_uuid' => 'vendor-uuid',
         ])
+        // A partial update must not carry an unrequested `online` default: the
+        // absent key means "leave it alone", not "take the vehicle offline".
+        ->and($filledInput)->not->toHaveKey('online')
         ->and($filledInput)->toHaveKey('location')
         ->and($vehicle->unassignedDriver)->toBeTrue()
         ->and($vehicle->savedForTest)->toBeTrue()
@@ -401,3 +422,149 @@ test('api vehicle controller input still drops fields that are not part of the c
         ->and($input)->not->toHaveKey('company_uuid')
         ->and($input)->not->toHaveKey('uuid');
 });
+
+test('api vehicle controller accepts every safe vehicle field the model exposes', function () {
+    // Data-driven rather than one test per column: the point is parity between
+    // what the model can store and what the public contract will accept, so the
+    // assertion is over the whole set.
+    session(['company' => 'company-uuid']);
+
+    $payload = [
+        // Identity and description
+        'internal_id'  => 'VEH-9001', 'name' => 'Depot Van', 'description' => 'City route van',
+        'make'         => 'Ford', 'model' => 'Transit', 'model_type' => 'Custom', 'year' => 2024,
+        'trim'         => 'Trend', 'color' => 'White', 'type' => 'van', 'class' => 'N1',
+        'plate_number' => 'SG-9001', 'vin' => '1FTBW3XG8NKA00001', 'serial_number' => 'SER-9001',
+        'call_sign'    => 'DEPOT-1', 'fuel_card_number' => 'FC-9001',
+        // Measurement and operation
+        'odometer'           => 41000, 'odometer_unit' => 'km', 'odometer_at_purchase' => 12,
+        'measurement_system' => 'metric', 'fuel_type' => 'diesel', 'fuel_volume_unit' => 'l',
+        'online'             => true, 'status' => 'available',
+        // Body, capacity and dimensions
+        'transmission'     => 'automatic', 'body_type' => 'panel_van', 'body_sub_type' => 'lwb',
+        'usage_type'       => 'commercial', 'ownership_type' => 'owned', 'cargo_volume' => 11.5,
+        'passenger_volume' => 3.2, 'interior_volume' => 14.7, 'weight' => 2100.5, 'width' => 2.06,
+        'length'           => 5.98, 'height' => 2.54, 'towing_capacity' => 2500, 'payload_capacity' => 1400,
+        'seating_capacity' => 3, 'ground_clearance' => 0.18, 'bed_length' => 3.4, 'fuel_capacity' => 70,
+        // Lifecycle and financing
+        'financing_status'                     => 'financed', 'loan_number_of_payments' => 48,
+        'loan_first_payment'                   => '2026-01-15', 'loan_amount' => 32000, 'currency' => 'SGD',
+        'estimated_service_life_distance_unit' => 'km', 'estimated_service_life_distance' => 400000,
+        'estimated_service_life_months'        => 96, 'insurance_value' => 41000, 'depreciation_rate' => 12.5,
+        'current_value'                        => 38000, 'acquisition_cost' => 52000,
+        'purchased_at'                         => '2026-01-02', 'lease_expires_at' => '2029-01-02',
+        // Regulatory and engine specifications
+        'emission_standard'   => 'euro6', 'dpf_equipped' => true, 'scr_equipped' => false,
+        'gvwr'                => 3500, 'gcwr' => 6000, 'engine_number' => 'ENG-9001', 'engine_model' => 'EcoBlue',
+        'engine_make'         => 'Ford', 'engine_family' => 'Puma', 'engine_configuration' => 'inline',
+        'engine_displacement' => 2.0, 'engine_size' => 1995, 'horsepower' => 168,
+        'horsepower_rpm'      => 3500, 'torque' => 405, 'torque_rpm' => 1750,
+        'number_of_cylinders' => 4, 'cylinder_arrangement' => 'I4',
+        // Structured and descriptive
+        'specs' => ['doors' => 4], 'details' => ['liftgate' => true], 'notes' => 'City pool',
+        'meta'  => ['depot' => 'north'],
+        // Orchestrator
+        'skills'                   => ['tail_lift'], 'payload_capacity_volume' => 11.25,
+        'payload_capacity_pallets' => 6, 'payload_capacity_parcels' => 320, 'max_tasks' => 40,
+        'time_window_start'        => '08:00', 'time_window_end' => '18:00', 'return_to_depot' => true,
+    ];
+
+    $controller = new FleetOpsApiVehicleCrudControllerProbe();
+    $input      = $controller->inputForTest(new Request($payload));
+
+    $missing = array_values(array_diff(array_keys($payload), array_keys($input)));
+
+    expect($missing)->toBe([])
+        ->and($input)->toMatchArray($payload);
+});
+
+test('api vehicle controller resolves every public relationship input to a scoped uuid', function () {
+    session(['company' => 'company-uuid']);
+
+    $controller = new FleetOpsApiVehicleCrudControllerProbe();
+    $input      = $controller->inputForTest(new Request([
+        'vendor'   => 'vendor_abc',
+        'category' => 'category_abc',
+        'warranty' => 'warranty_abc',
+        'photo'    => 'file_abc',
+    ]));
+
+    expect($input)->toMatchArray([
+        'vendor_uuid'   => 'vendor-uuid',
+        'category_uuid' => 'category-uuid',
+        'warranty_uuid' => 'warranty-uuid',
+        'photo_uuid'    => 'file-uuid',
+    ])
+        ->and($controller->relationLookups)->toBe([
+            [Vendor::class, 'vendor_abc'],
+            [Category::class, 'category_abc'],
+            [Warranty::class, 'warranty_abc'],
+            [Fleetbase\Models\File::class, 'file_abc'],
+        ]);
+});
+
+test('api vehicle controller clears a relationship when the input is sent empty', function () {
+    session(['company' => 'company-uuid']);
+
+    $controller = new FleetOpsApiVehicleCrudControllerProbe();
+    $input      = $controller->inputForTest(fleetopsUpdateVehicleRequest(['vendor' => null]));
+
+    expect($input)->toHaveKey('vendor_uuid')
+        ->and($input['vendor_uuid'])->toBeNull()
+        ->and($controller->relationLookups)->toBe([]);
+});
+
+test('api vehicle controller rejects a relationship that belongs to another company', function () {
+    session(['company' => 'company-uuid']);
+
+    $controller               = new FleetOpsApiVehicleCrudControllerProbe();
+    $controller->unresolvable = ['vendor_other_company'];
+
+    $created = $controller->create(fleetopsCreateVehicleRequest([
+        'make'   => 'Ford',
+        'vendor' => 'vendor_other_company',
+    ]));
+
+    $controller               = new FleetOpsApiVehicleCrudControllerProbe();
+    $controller->vehicle      = new FleetOpsApiVehicleCrudFake();
+    $controller->unresolvable = ['vendor_other_company'];
+
+    $updated = $controller->update('vehicle-public', fleetopsUpdateVehicleRequest([
+        'vendor' => 'vendor_other_company',
+    ]));
+
+    // A cross-company identifier is answered exactly as a missing one, so the
+    // response cannot be used to discover what another organization holds.
+    expect($created)->toBe([
+        'json'   => ['error' => 'No vendor resource found for the identifier provided.'],
+        'status' => 404,
+    ])->and($updated)->toBe([
+        'json'   => ['error' => 'No vendor resource found for the identifier provided.'],
+        'status' => 404,
+    ]);
+});
+
+test('api vehicle controller input still excludes server managed and internal columns', function () {
+    $controller = new FleetOpsApiVehicleCrudControllerProbe();
+
+    $input = $controller->inputForTest(new Request([
+        'make'           => 'Ford',
+        'company_uuid'   => 'someone-elses-company',
+        'uuid'           => 'forged',
+        '_key'           => 'forged',
+        'public_id'      => 'vehicle_forged',
+        'slug'           => 'forged',
+        'vendor_uuid'    => 'forged',
+        'category_uuid'  => 'forged',
+        'warranty_uuid'  => 'forged',
+        'photo_uuid'     => 'forged',
+        'telematic_uuid' => 'forged',
+        // Written by the VIN decoder and by telematics ingestion respectively;
+        // a caller must not be able to overwrite either.
+        'vin_data'       => ['manufacturer' => 'forged'],
+        'telematics'     => ['speed' => 999],
+        'avatar_url'     => 'forged',
+    ]));
+
+    expect(array_keys($input))->toBe(['make']);
+});

package/server/tests/ControllerFilterContractsTest.php

@@ -272,6 +272,91 @@ function fleetopsProtectedMethod(string $class, string $method): ReflectionMetho
     return $reflection;
 }
 
+/**
+ * Boot an in-memory database holding one row per relationship a public filter
+ * can be asked about.
+ *
+ * Relationship filters no longer compare a caller-supplied value against a uuid
+ * column: the public API deals in public ids, so the filter resolves the id to
+ * the uuids it stands for first. That resolution is a real query, so these
+ * assertions need a real connection.
+ *
+ * @return array<string, string> uuids keyed by table
+ */
+function fleetopsFilterRelationDatabase(): array
+{
+    $connection = new Illuminate\Database\SQLiteConnection(new PDO('sqlite::memory:'));
+    $resolver   = new Illuminate\Database\ConnectionResolver(['default' => $connection, 'mysql' => $connection]);
+    $resolver->setDefaultConnection('mysql');
+    Illuminate\Database\Eloquent\Model::setConnectionResolver($resolver);
+
+    app()->instance('db', new class($connection) {
+        public function __construct(public Illuminate\Database\SQLiteConnection $c)
+        {
+        }
+
+        public function connection($name = null): Illuminate\Database\SQLiteConnection
+        {
+            return $this->c;
+        }
+
+        public function __call($method, $arguments)
+        {
+            return $this->c->{$method}(...$arguments);
+        }
+    });
+    Illuminate\Support\Facades\DB::clearResolvedInstance('db');
+
+    $schema = $connection->getSchemaBuilder();
+    foreach (['fleets', 'vendors', 'zones', 'service_areas', 'drivers', 'vehicles', 'users'] as $table) {
+        if ($schema->hasTable($table)) {
+            $schema->drop($table);
+        }
+
+        $schema->create($table, function ($blueprint) {
+            $blueprint->increments('id');
+            foreach (['uuid', 'public_id', 'internal_id', 'company_uuid', 'user_uuid', 'name', '_key'] as $column) {
+                $blueprint->string($column)->nullable();
+            }
+            $blueprint->timestamps();
+            $blueprint->timestamp('deleted_at')->nullable();
+        });
+    }
+
+    $uuids = [
+        'fleets'        => '99999999-9999-4999-8999-999999999001',
+        'vendors'       => '99999999-9999-4999-8999-999999999002',
+        'zones'         => '99999999-9999-4999-8999-999999999003',
+        'service_areas' => '99999999-9999-4999-8999-999999999004',
+        'drivers'       => '99999999-9999-4999-8999-999999999005',
+        'vehicles'      => '99999999-9999-4999-8999-999999999006',
+        'users'         => '99999999-9999-4999-8999-999999999007',
+    ];
+
+    $publicIds = [
+        'fleets'        => 'fleet_filterone12',
+        'vendors'       => 'vendor_filterone1',
+        'zones'         => 'zone_filterone123',
+        'service_areas' => 'service_area_fone',
+        'drivers'       => 'driver_filterone1',
+        'vehicles'      => 'vehicle_filterone',
+        'users'         => 'user_filterone123',
+    ];
+
+    foreach ($uuids as $table => $uuid) {
+        $connection->table($table)->insert([
+            'uuid'         => $uuid,
+            'public_id'    => $publicIds[$table],
+            'company_uuid' => 'company-uuid',
+        ]);
+    }
+
+    // The driver scope requires a linked user row to exist.
+    $connection->table('drivers')->where('uuid', $uuids['drivers'])->update(['user_uuid' => $uuids['users']]);
+
+    return ['uuids' => $uuids, 'publicIds' => $publicIds];
+}
+
 function fleetopsFilterWithBuilder(string $class, FleetOpsControllerFilterQuery $builder): object
 {
     $filter = (new ReflectionClass($class))->newInstanceWithoutConstructor();
@@ -456,6 +541,8 @@ test('device event controller skips processed scope when states are empty', func
 });
 
 test('vehicle filter records identity relationship fleet and telematic filters', function () {
+    ['uuids' => $uuids, 'publicIds' => $publicIds] = fleetopsFilterRelationDatabase();
+
     $query  = new FleetOpsControllerFilterQuery();
     $filter = fleetopsFilterWithBuilder(VehicleFilter::class, $query);
 
@@ -465,14 +552,17 @@ test('vehicle filter records identity relationship fleet and telematic filters',
     $filter->display_name('sprinter');
     $filter->vin('vin-123');
     $filter->publicId('vehicle-public');
+    $filter->internalId('VEH-42');
     $filter->plateNumber('ABC-123');
     $filter->vehicleMake('Mercedes');
     $filter->vehicleModel('Sprinter');
     $filter->vehicleYear('2026');
     $filter->driver('unassigned');
+    $filter->driver($publicIds['drivers']);
     $filter->vendor(null);
+    $filter->vendor($publicIds['vendors']);
     $filter->driverUuid('driver-uuid');
-    $filter->fleet('fleet-uuid');
+    $filter->fleet($publicIds['fleets']);
     $filter->assignedFleet('false');
     $filter->telematicUuid('telematic-uuid');
     $filter->createdAt(['2026-01-01', '2026-01-31']);
@@ -482,20 +572,32 @@ test('vehicle filter records identity relationship fleet and telematic filters',
         ->and($query->calls)->toContain(['search', 'van'])
         ->and($query->calls)->toContain(['searchWhere', ['year', 'make', 'model', 'plate_number'], 'sprinter'])
         ->and($query->calls)->toContain(['searchWhere', 'vin', 'vin-123'])
-        ->and($query->calls)->toContain(['searchWhere', 'public_id', 'vehicle-public'])
+        // A public id names exactly one record, so a public lookup is exact.
+        ->and($query->calls)->toContain(['where', ['public_id', '=', 'vehicle-public']])
+        // Exact, not partial: an importer asking whether VEH-42 exists must not
+        // be told yes because VEH-420 does.
+        ->and($query->calls)->toContain(['where', ['internal_id', '=', 'VEH-42']])
         ->and($query->calls)->toContain(['searchWhere', 'plate_number', 'ABC-123'])
         ->and($query->calls)->toContain(['searchWhere', 'make', 'Mercedes'])
         ->and($query->calls)->toContain(['searchWhere', 'model', 'Sprinter'])
         ->and($query->calls)->toContain(['searchWhere', 'year', '2026'])
         ->and($query->calls)->toContain(['whereDoesntHave', 'driver'])
-        ->and($query->calls)->toContain(['whereDoesntHave', 'fleets']);
+        ->and($query->calls)->toContain(['whereDoesntHave', 'fleets'])
+        // Public ids are resolved to the uuids the columns actually hold.
+        ->and($query->calls)->toContain(['whereIn', 'vendor_uuid', [$uuids['vendors']]]);
+
+    $nested = collect($query->calls)->where(0, 'whereHas')->flatMap(fn ($call) => $call[2])->values()->all();
 
     expect(collect($query->calls)->where(0, 'whereHas')->pluck(1)->all())->toContain('driver', 'fleets', 'devices')
+        ->and($nested)->toContain(['whereIn', 'uuid', [$uuids['drivers']]])
+        ->and($nested)->toContain(['whereIn', 'fleet_uuid', [$uuids['fleets']]])
         ->and(collect($query->calls)->where(0, 'whereBetween')->values())->toHaveCount(1)
         ->and(collect($query->calls)->where(0, 'whereDate')->values())->toHaveCount(1);
 });
 
 test('fleet filter records hierarchy relationship scalar status and date filters', function () {
+    ['uuids' => $uuids, 'publicIds' => $publicIds] = fleetopsFilterRelationDatabase();
+
     $query  = new FleetOpsControllerFilterQuery();
     $filter = fleetopsFilterWithBuilder(FleetFilter::class, $query);
 
@@ -504,10 +606,12 @@ test('fleet filter records hierarchy relationship scalar status and date filters
     $filter->query('dispatch');
     $filter->parentsOnly(true);
     $filter->parentsOnly(false);
-    $filter->serviceArea('service-area-uuid');
-    $filter->zone('zone-uuid');
-    $filter->parentFleet('parent-fleet-uuid');
-    $filter->vendor('vendor-uuid');
+    $filter->serviceArea($publicIds['service_areas']);
+    $filter->zone($publicIds['zones']);
+    $filter->parentFleet($publicIds['fleets']);
+    $filter->vendor($publicIds['vendors']);
+    // A blank identifier resolves to nothing without reaching the database.
+    $filter->vendor('');
     $filter->publicId('fleet-public');
     $filter->task('delivery');
     $filter->name('North Fleet');
@@ -515,16 +619,27 @@ test('fleet filter records hierarchy relationship scalar status and date filters
     $filter->createdAt('2026-01-01');
     $filter->updatedAt(['2026-02-01', '2026-02-28']);
 
+    $nested = collect($query->calls)->where(0, 'where')->pluck(1)->all();
+
     expect($query->calls)->toContain(['where', ['company_uuid', 'company-uuid']])
         ->and($query->calls)->toContain(['with', ['serviceArea', 'zone']])
         ->and($query->calls)->toContain(['whereNull', 'parent_fleet_uuid'])
-        ->and($query->calls)->toContain(['searchWhere', 'parent_fleet_uuid', 'parent-fleet-uuid'])
-        ->and($query->calls)->toContain(['searchWhere', 'public_id', 'fleet-public'])
+        ->and($query->calls)->toContain(['where', ['public_id', '=', 'fleet-public']])
         ->and($query->calls)->toContain(['searchWhere', 'task', 'delivery'])
         ->and($query->calls)->toContain(['searchWhere', 'name', 'North Fleet'])
-        ->and($query->calls)->toContain(['whereIn', 'status', ['active', 'inactive']]);
-
-    expect(collect($query->calls)->where(0, 'whereHas')->pluck(1)->all())->toContain('serviceArea', 'zone', 'parent_fleet', 'vendor')
+        ->and($query->calls)->toContain(['whereIn', 'status', ['active', 'inactive']])
+        // Every hierarchy and relationship filter now resolves a public id to
+        // the uuid column it stands for, rather than comparing the public id
+        // against a uuid — which never matched — or against a `zone_uuid`
+        // column that does not exist on `zones`.
+        ->and($query->calls)->toContain(['whereIn', 'service_area_uuid', [$uuids['service_areas']]])
+        ->and($query->calls)->toContain(['whereIn', 'zone_uuid', [$uuids['zones']]])
+        ->and($query->calls)->toContain(['whereIn', 'parent_fleet_uuid', [$uuids['fleets']]])
+        ->and($query->calls)->toContain(['whereIn', 'vendor_uuid', [$uuids['vendors']]])
+        ->and($query->calls)->toContain(['whereIn', 'vendor_uuid', []])
+        // `?query=` searches the fleet's own columns; it used to reach for a
+        // `user` relation Fleet does not have.
+        ->and(collect($query->calls)->where(0, 'whereHas')->pluck(1)->all())->not->toContain('user')
         ->and(collect($query->calls)->where(0, 'whereDate')->values())->toHaveCount(1)
         ->and(collect($query->calls)->where(0, 'whereBetween')->values())->toHaveCount(1);
 });
@@ -1224,9 +1339,13 @@ test('place filter alternate date branches and spatial area scopes execute', fun
 test('vehicle and fuel report filters cover alternate identity and date branches', function () {
     // Vehicle filter: unassigned drivers, blank vendor early return, inverse date
     // branches, fleet unassignment and blank telematic early return
+    fleetopsFilterRelationDatabase();
+
     $query  = new FleetOpsControllerFilterQuery();
     $filter = fleetopsFilterWithBuilder(VehicleFilter::class, $query);
     $filter->driver('unassigned');
+    // A public request may not pass a uuid, so nothing resolves and the filter
+    // matches no vehicle rather than silently matching all of them.
     $filter->driver('c4c4c4c4-4444-4444-8444-444444444444');
     $filter->vendor(null);
     $filter->createdAt('2026-02-01');
@@ -1240,7 +1359,7 @@ test('vehicle and fuel report filters cover alternate identity and date branches
         ->and($query->calls)->toContain(['whereDoesntHave', 'fleets'])
         ->and(collect($query->calls)->where(0, 'whereDate')->values())->toHaveCount(1)
         ->and(collect($query->calls)->where(0, 'whereBetween')->values())->toHaveCount(1)
-        ->and($nestedVehicle)->toContain(['where', ['uuid', 'c4c4c4c4-4444-4444-8444-444444444444']]);
+        ->and($nestedVehicle)->toContain(['whereIn', 'uuid', []]);
 
     // Fuel report filter: uuid, public-id and free-text identity branches
     // plus the inverse date branches

package/server/tests/ControllerHelperContractsTest.php

@@ -1093,7 +1093,9 @@ test('api vehicle controller exposes input defaults and tracking payload helpers
         'time_window_start'        => '08:00',
         'time_window_end'          => '17:00',
         'return_to_depot'          => true,
-        'vendor'                   => 'vendor-public',
+        // `vendor` is deliberately absent: it is no longer a scalar in this
+        // projection but a public id resolved against the caller's company,
+        // which is asserted in ApiVehicleControllerContractsTest.
         'driver'                   => 'driver-public',
     ]);
     $locationInput = $controller->callHelper('withCoordinateLocation', [], new Request([
@@ -1102,8 +1104,8 @@ test('api vehicle controller exposes input defaults and tracking payload helpers
     ]));
     $tracking      = $controller->callHelper('positionDataFromTrackingInput', 1.2816, 103.851, 12, 180, 55);
 
+    // Key order follows the allowlist, not the request body.
     expect($controller->callHelper('vehicleInputFromRequest', $request))->toBe([
-        'status'                   => 'active',
         'make'                     => 'Toyota',
         'model'                    => 'HiAce',
         'year'                     => 2025,
@@ -1111,13 +1113,14 @@ test('api vehicle controller exposes input defaults and tracking payload helpers
         'type'                     => 'van',
         'plate_number'             => 'SG-1234',
         'vin'                      => 'VIN123',
-        'meta'                     => ['temperature' => 'ambient'],
         'online'                   => false,
+        'status'                   => 'active',
         'location'                 => ['latitude' => 1.30, 'longitude' => 103.80],
         'altitude'                 => 10,
         'heading'                  => 90,
         'speed'                    => 45,
         'payload_capacity'         => 1200,
+        'meta'                     => ['temperature' => 'ambient'],
         'payload_capacity_volume'  => 8,
         'payload_capacity_pallets' => 2,
         'payload_capacity_parcels' => 80,