@fleetbase/fleetops-engine 0.6.62 → 0.6.64

package/RELEASE.md

@@ -1,38 +1,13 @@
-> v0.6.62 ~ "The public Fleet, Vehicle and Driver APIs now expose what the records actually hold"
-
----
-## Highlights
-The public v1 API exposed a small subset of what the Fleet, Vehicle and Driver records can hold, and the gaps were silent: a caller sending a field the controller did not copy received a `200` and a response body that looked correct while the value was discarded. This release closes that gap, adds fleet hierarchies and fleet membership to the public API, and makes it possible to record a driver who has no email address or phone number.
-
----
-## Features
-- **Fleet create and update accept every safe field.** `name`, `color`, `task`, `status`, and the `service_area`, `zone`, `vendor` and `parent_fleet` relationships. Only `name` and `service_area` were reachable before, so a fleet hierarchy could not be built through the API at all. `"parent_fleet": null` clears a parent; a fleet may not be its own parent, nor sit beneath one of its own descendants.
-- **Fleet membership has public endpoints.** `POST` and `DELETE` on `/v1/fleets/{fleet}/vehicles/{vehicle}` and `/v1/fleets/{fleet}/drivers/{driver}`, all four taking public IDs and sharing one response shape. Assignment is idempotent and restores a soft-deleted membership rather than duplicating it; removal is a safe no-op and touches only the pivot, never the driver, the vehicle, the driver's current vehicle, or any other fleet.
-- **The Vehicle contract covers the whole record.** The input projection accepted 21 of the model's 99 fields; it now accepts all 90 safe ones — identity, odometer and measurement, body, capacity and dimensions, lifecycle and financing, regulatory and engine specifications, structured `specs`/`details`/`meta`, and orchestrator constraints — each with type-appropriate validation. `vendor`, `category`, `warranty` and `photo` resolve from public IDs.
-- **A driver can be recorded without credentials.** `email` and `phone` are optional on create; an operational record may legitimately have neither. Nothing is invented to fill the gap and no invitation is sent when there is nowhere to send one. Such a driver cannot sign in to Navigator until credentials are supplied.
-- **Relationships are readable back as public IDs.** A caller that writes `parent_fleet: "fleet_abc"` can now read the assignment back. Asking for a relation through `?with=` still returns the nested object it always did, and internal console responses are unchanged.
+> v0.6.64 ~ "Order responses no longer fail when a vehicle is assigned"
 
 ---
 ## Bug Fixes
-- **`Driver::$fillable` listed `'meta,'`** — a trailing comma inside the string — so driver metadata was never mass assignable and never persisted through the public API.
-- **Driver input was a blocklist, not an allowlist.** Anything nobody had thought to exclude reached `Driver::create()` intact, including `auth_token`, `user_uuid` and `company_uuid`, while `location`, `heading`, `altitude`, `speed` and `meta` were dropped on every write.
-- **Driver photo upload wrote `photo_uuid` to `users`,** which has no such column. `User` guards mass assignment by fillable, so every photo uploaded through the public API was discarded without a word. It now writes `avatar_uuid`.
-- **A partial vehicle update took the vehicle offline.** The create-time `online` default was applied on update too, so a plate correction or an odometer reading silently reset it.
-- **Relationship filters could never match.** `?vendor=`, `?fleet=`, `?driver=` and the fleet hierarchy filters compared caller-supplied public IDs against uuid columns. `FleetFilter::query()` searched a `user` relation Fleet does not have, `DriverFilter::phone()` a `phone` relation that does not exist, and `FleetFilter::zone()` a `zone_uuid` column `zones` does not have — the last three raised rather than filtered.
-- **`VehicleFilter` had no `internal_id` filter,** which is the lookup an importer keys on to decide whether a vehicle already exists.
-- **Cross-company relationship IDs were accepted and silently dropped.** Relationship inputs were validated with unscoped `exists` rules, so another organization's public ID passed validation and then resolved to nothing. They are now scoped at validation and again at resolution, and a cross-company ID is answered exactly as a missing one — so a response cannot be used to probe another organization's data.
-- **The Fleet resource ran four `count()` queries per fleet on every public request** and discarded the results, because `when()` evaluates a plain value argument eagerly.
-- **The Fleet webhook payload gated `parent_fleet` on `serviceArea`,** so a subfleet with no service area never reported its parent.
+- **Orders with an assigned vehicle serialize again when expansions are requested.** The Vehicle and Fleet resources read the request's `with` list and loaded it onto the model they wrap. That is correct on their own endpoints, where the controller has already allowlisted the list, but both resources are also rendered nested inside Order and Driver responses. There the same request carries the parent's expansions, so `GET /v1/orders?with=payload` on an order with a vehicle assigned failed during serialisation with `RelationNotFoundException: Call to undefined relationship [payload] on model Vehicle`. Navigator order fetches and the console scheduler both hit this. Nested resources now keep only the relations the wrapped model actually defines; direct endpoint behaviour is unchanged.
 
 ---
 ## Testing
-- Coverage held at 100% on all three metrics — 34670/34670 statements, 4428/4428 methods, 530/530 classes.
-- New database-backed coverage of the fleet membership pivots: idempotent assignment, restore of a soft-deleted membership, repeated removal as a no-op, and preservation of the driver's vehicle and of unrelated fleet memberships.
-- Data-driven parity tests prove every newly exposed Fleet, Vehicle and Driver field is accepted and persisted, and that tenancy, authentication and generated columns still are not.
-
----
-## Continuous Integration
-- The PHP, Ember and Postman contract workflows now run on pull requests targeting `release/v*`. `release.yml` learned that branch name in v0.6.61's follow-up, but the three check workflows did not — so a PR retargeted onto a release branch ran no checks at all.
+- Added resource-level regressions for parent expansions reaching a nested Vehicle or Fleet resource, for string and empty `with` forms, and for resources wrapping plain data.
+- Added end-to-end checks resolving a real vehicle and a real fleet against an order-shaped request.
 
 ---
 ## Need help?

package/addon/controllers/management/drivers/index.js

@@ -241,7 +241,10 @@ export default class ManagementDriversIndexController extends Controller {
                         this.notifications.serverError(err);
                     }
                 },
-                valuePath: 'vendor.name',
+                // Driver list responses already include the vendor_name accessor,
+                // while the vendor relationship itself is not eager loaded. Use
+                // the scalar so assigned vendors do not render as blank cells.
+                valuePath: 'vendor_name',
                 modelNamePath: 'name',
                 resizable: true,
                 filterable: true,

package/addon/routes/management/fleets/index/details.js

@@ -24,6 +24,6 @@ export default class ManagementFleetsIndexDetailsRoute extends Route {
     }
 
     model({ public_id }) {
-        return this.store.queryRecord('fleet', { public_id, single: true, with: ['parent_fleet', 'service_area', 'zone', 'subfleets', 'drivers', 'vehicles'] });
+        return this.store.queryRecord('fleet', { public_id, single: true, with: ['parentFleet', 'serviceArea', 'zone', 'subFleets', 'drivers', 'vehicles'] });
     }
 }

package/addon/routes/management/fleets/index/edit.js

@@ -24,6 +24,6 @@ export default class ManagementFleetsIndexEditRoute extends Route {
     }
 
     model({ public_id }) {
-        return this.store.queryRecord('fleet', { public_id, single: true, with: ['parent_fleet', 'service_area', 'zone'] });
+        return this.store.queryRecord('fleet', { public_id, single: true, with: ['parentFleet', 'serviceArea', 'zone'] });
     }
 }

package/addon/routes/management/fleets/index.js

@@ -24,6 +24,8 @@ export default class ManagementFleetsIndexRoute extends Route {
     };
 
     model(params) {
-        return this.store.query('fleet', { ...params, with: ['parent_fleet', 'service_area', 'zone'] });
+        // Internal Fleet-Ops requests go directly to Eloquent's relation loader,
+        // so these must be the model method names rather than public API aliases.
+        return this.store.query('fleet', { ...params, with: ['parentFleet', 'serviceArea', 'zone'] });
     }
 }

package/composer.json

@@ -1,6 +1,6 @@
 {
     "name": "fleetbase/fleetops-api",
-    "version": "0.6.62",
+    "version": "0.6.64",
     "description": "Fleet & Transport Management Extension for Fleetbase",
     "keywords": [
         "fleetbase-extension",

package/extension.json

@@ -1,6 +1,6 @@
 {
     "name": "Fleet-Ops",
-    "version": "0.6.62",
+    "version": "0.6.64",
     "description": "Fleet & Transport Management Extension for Fleetbase",
     "repository": "https://github.com/fleetbase/fleetops",
     "license": "AGPL-3.0-or-later",

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@fleetbase/fleetops-engine",
-    "version": "0.6.62",
+    "version": "0.6.64",
     "description": "Fleet & Transport Management Extension for Fleetbase",
     "fleetbase": {
         "route": "fleet-ops"

package/server/src/Http/Resources/v1/Concerns/ResolvesPublicRelationFields.php

@@ -22,8 +22,13 @@ trait ResolvesPublicRelationFields
     /**
      * The relations the caller asked for, as real Eloquent relation names.
      *
-     * The controller has already normalised, mapped and allowlisted `with` /
-     * `expand` by the time a resource runs, so this is a plain read.
+     * The controller normalises, maps and allowlists `with` / `expand` for the
+     * resource it returns. That guarantee does not travel: this resource is also
+     * rendered nested inside Order and Driver responses, where the request's
+     * `with` names the parent's relations (`payload`, `driverAssigned.vehicle`).
+     * A nested resource re-reads the same request, so only relations the wrapped
+     * model actually defines are kept — a parent's expansion must never reach
+     * this model's loader, where it raises RelationNotFoundException.
      *
      * @return array<int, string>
      */
@@ -39,7 +44,28 @@ trait ResolvesPublicRelationFields
             return [];
         }
 
-        return array_values(array_filter(array_map('strval', $with), 'strlen'));
+        $with = array_values(array_filter(array_map('strval', $with), 'strlen'));
+
+        return array_values(array_filter($with, fn (string $relation): bool => $this->definesRelation($relation)));
+    }
+
+    /**
+     * Whether the wrapped model defines the root of a relation path.
+     *
+     * Only the first segment is checked: nested segments belong to the related
+     * model, and Eloquent validates those itself once the root exists.
+     */
+    private function definesRelation(string $relation): bool
+    {
+        $resource = $this->resource;
+
+        if (!is_object($resource) || !method_exists($resource, 'loadMissing')) {
+            return false;
+        }
+
+        $root = explode('.', $relation, 2)[0];
+
+        return $root !== '' && method_exists($resource, $root);
     }
 
     /**

package/server/src/Http/Resources/v1/Fleet.php

@@ -24,7 +24,9 @@ class Fleet extends FleetbaseResource
         // dropped anything outside the public allowlist, so they are safe to
         // hand to the loader. `subfleets` used to arrive here spelled exactly
         // that and reach `load('subfleets')`, which is not the relation —
-        // the documented expansion raised instead of resolving.
+        // the documented expansion raised instead of resolving. Relations the
+        // fleet does not define are dropped as well: nested under another
+        // response the request's `with` describes the parent, not the fleet.
         $with = $this->requestedRelations($request);
 
         if ($with !== []) {

package/server/tests/Feature/Http/Api/VehiclePublicContractTest.php

@@ -452,3 +452,26 @@ test('an unsupported expansion on retrieve cannot reach eloquent', function () {
         ->and($payload)->not->toHaveKey('not_a_relation')
         ->and($request->input('with'))->toBe(['vendor']);
 });
+
+test('a vehicle nested in an order response ignores the order expansions', function () {
+    fleetopsVehicleContractBoot();
+
+    $controller    = new VehicleController();
+    $createRequest = fleetopsVehicleContractRequest(CreateVehicleRequest::class, 'POST', ['make' => 'Ford', 'driver' => 'driver_contract1']);
+    $created       = $controller->create($createRequest)->resolve($createRequest);
+    $vehicle       = Vehicle::where('public_id', $created['id'])->firstOrFail();
+
+    // An order fetch expands the order's own relations. The Order resource nests
+    // the assigned vehicle as a full Vehicle resource, which re-reads the same
+    // request: `payload` is not a vehicle relation and used to reach load(),
+    // answering the whole order request with a RelationNotFoundException.
+    $orderRequest = fleetopsVehicleContractRequest(Request::class, 'GET', ['with' => ['payload', 'driverAssigned.vehicle', 'driver']], 'v1/orders');
+    $payload      = (new Fleetbase\FleetOps\Http\Resources\v1\Vehicle($vehicle))->resolve($orderRequest);
+
+    expect($payload['id'])->toBe($created['id'])
+        ->and($payload)->not->toHaveKey('payload')
+        ->and($vehicle->relationLoaded('payload'))->toBeFalse()
+        // The vehicle's own expansion in the same list still resolves.
+        ->and($payload['driver'])->toBeObject()
+        ->and($payload['driver_id'])->toBe('driver_contract1');
+});

package/server/tests/Unit/Http/Resources/FleetResourceTest.php

@@ -144,3 +144,20 @@ test('fleet resource accepts the explicit nested expansion spelling', function (
     expect($subFleet->relationLoaded('drivers'))->toBeTrue()
         ->and($subFleet->relationLoaded('vehicles'))->toBeFalse();
 });
+
+test('fleet resource ignores expansions that describe a parent resource', function () {
+    fleetopsFleetResourceBoot();
+
+    $fleet = Fleet::where('uuid', 'fleet-parent-1')->first();
+
+    // Rendered inside another response, the request's `with` is the parent's
+    // list. `payload` is not a fleet relation and used to raise from load();
+    // the fleet's own relation in the same list still loads.
+    $request  = Request::create('/v1/orders', 'GET', ['with' => ['payload', 'drivers']]);
+    $resolved = (new FleetResource($fleet))->resolve($request);
+
+    expect($resolved['name'])->toBe('Parent Fleet')
+        ->and($resolved)->not->toHaveKey('payload')
+        ->and($fleet->relationLoaded('payload'))->toBeFalse()
+        ->and($fleet->relationLoaded('drivers'))->toBeTrue();
+});

package/server/tests/VehicleResourceContractsTest.php

@@ -311,3 +311,42 @@ test('vehicle without driver resource omits driver relationships and serializes
         ])
         ->and($webhook)->not->toHaveKey('driver');
 });
+
+/**
+ * Resolve the request's `with` list the way a nested resource does.
+ *
+ * @return array<int, string>
+ */
+function fleetopsVehicleResourceRequestedRelations(mixed $resource, array $query): array
+{
+    $request = Request::create('/api/v1/fleet-ops/orders', 'GET', $query);
+    $method  = new ReflectionMethod(VehicleResource::class, 'requestedRelations');
+    $method->setAccessible(true);
+
+    return $method->invoke(new VehicleResource($resource), $request);
+}
+
+test('requested relations keep only what the wrapped model defines', function () {
+    $vehicle = new class(['uuid' => 'vehicle-uuid']) extends FleetOpsVehicleResourceFixture {
+        public function driver(): void
+        {
+        }
+    };
+
+    // Nested under an Order, the request's `with` describes the order:
+    // `payload` and `driverAssigned.vehicle` are not vehicle relations and must
+    // never reach this model's loader. The vehicle's own relations still pass,
+    // including a nested path whose root the vehicle defines.
+    expect(fleetopsVehicleResourceRequestedRelations($vehicle, ['with' => ['payload', 'driverAssigned.vehicle', 'driver', 'driver.user', '']]))->toBe(['driver', 'driver.user'])
+        ->and(fleetopsVehicleResourceRequestedRelations($vehicle, ['with' => 'payload,driver']))->toBe(['driver'])
+        ->and(fleetopsVehicleResourceRequestedRelations($vehicle, ['with' => ['.driver']]))->toBe([])
+        ->and(fleetopsVehicleResourceRequestedRelations($vehicle, []))->toBe([]);
+});
+
+test('requested relations are empty when the resource cannot load any', function () {
+    // Webhook fixtures and compact serializers hand the resource plain data;
+    // there is no loader to feed, so nothing is requested from it.
+    expect(fleetopsVehicleResourceRequestedRelations(['uuid' => 'vehicle-uuid'], ['with' => ['driver']]))->toBe([])
+        ->and(fleetopsVehicleResourceRequestedRelations((object) ['uuid' => 'vehicle-uuid'], ['with' => ['driver']]))->toBe([])
+        ->and(fleetopsVehicleResourceRequestedRelations(fleetopsVehicleResourceFixture(), ['with' => ['driver']]))->toBe([]);
+});