@fleetbase/fleetops-engine 0.6.63 → 0.6.64

package/RELEASE.md

@@ -1,14 +1,13 @@
-> v0.6.63 ~ "Fleet and driver relationship display fixes"
+> v0.6.64 ~ "Order responses no longer fail when a vehicle is assigned"
 
 ---
 ## Bug Fixes
-- **Driver vendor names display correctly.** The Drivers table now uses the `vendor_name` value included in the list response instead of reading an unloaded `vendor` relationship.
-- **Fleet pages load hierarchy relationships correctly.** Internal Fleet-Ops requests now use the Fleet model's Eloquent relationship names, preventing the `RelationNotFoundException` raised when opening the Fleets route.
+- **Orders with an assigned vehicle serialize again when expansions are requested.** The Vehicle and Fleet resources read the request's `with` list and loaded it onto the model they wrap. That is correct on their own endpoints, where the controller has already allowlisted the list, but both resources are also rendered nested inside Order and Driver responses. There the same request carries the parent's expansions, so `GET /v1/orders?with=payload` on an order with a vehicle assigned failed during serialisation with `RelationNotFoundException: Call to undefined relationship [payload] on model Vehicle`. Navigator order fetches and the console scheduler both hit this. Nested resources now keep only the relations the wrapped model actually defines; direct endpoint behaviour is unchanged.
 
 ---
 ## Testing
-- Added a regression assertion for the vendor column used by the Drivers table.
-- Added route coverage for the relationship names requested by the Fleet index, edit and details pages.
+- Added resource-level regressions for parent expansions reaching a nested Vehicle or Fleet resource, for string and empty `with` forms, and for resources wrapping plain data.
+- Added end-to-end checks resolving a real vehicle and a real fleet against an order-shaped request.
 
 ---
 ## Need help?

package/composer.json

@@ -1,6 +1,6 @@
 {
     "name": "fleetbase/fleetops-api",
-    "version": "0.6.63",
+    "version": "0.6.64",
     "description": "Fleet & Transport Management Extension for Fleetbase",
     "keywords": [
         "fleetbase-extension",

package/extension.json

@@ -1,6 +1,6 @@
 {
     "name": "Fleet-Ops",
-    "version": "0.6.63",
+    "version": "0.6.64",
     "description": "Fleet & Transport Management Extension for Fleetbase",
     "repository": "https://github.com/fleetbase/fleetops",
     "license": "AGPL-3.0-or-later",

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@fleetbase/fleetops-engine",
-    "version": "0.6.63",
+    "version": "0.6.64",
     "description": "Fleet & Transport Management Extension for Fleetbase",
     "fleetbase": {
         "route": "fleet-ops"

package/server/src/Http/Resources/v1/Concerns/ResolvesPublicRelationFields.php

@@ -22,8 +22,13 @@ trait ResolvesPublicRelationFields
     /**
      * The relations the caller asked for, as real Eloquent relation names.
      *
-     * The controller has already normalised, mapped and allowlisted `with` /
-     * `expand` by the time a resource runs, so this is a plain read.
+     * The controller normalises, maps and allowlists `with` / `expand` for the
+     * resource it returns. That guarantee does not travel: this resource is also
+     * rendered nested inside Order and Driver responses, where the request's
+     * `with` names the parent's relations (`payload`, `driverAssigned.vehicle`).
+     * A nested resource re-reads the same request, so only relations the wrapped
+     * model actually defines are kept — a parent's expansion must never reach
+     * this model's loader, where it raises RelationNotFoundException.
      *
      * @return array<int, string>
      */
@@ -39,7 +44,28 @@ trait ResolvesPublicRelationFields
             return [];
         }
 
-        return array_values(array_filter(array_map('strval', $with), 'strlen'));
+        $with = array_values(array_filter(array_map('strval', $with), 'strlen'));
+
+        return array_values(array_filter($with, fn (string $relation): bool => $this->definesRelation($relation)));
+    }
+
+    /**
+     * Whether the wrapped model defines the root of a relation path.
+     *
+     * Only the first segment is checked: nested segments belong to the related
+     * model, and Eloquent validates those itself once the root exists.
+     */
+    private function definesRelation(string $relation): bool
+    {
+        $resource = $this->resource;
+
+        if (!is_object($resource) || !method_exists($resource, 'loadMissing')) {
+            return false;
+        }
+
+        $root = explode('.', $relation, 2)[0];
+
+        return $root !== '' && method_exists($resource, $root);
     }
 
     /**

package/server/src/Http/Resources/v1/Fleet.php

@@ -24,7 +24,9 @@ class Fleet extends FleetbaseResource
         // dropped anything outside the public allowlist, so they are safe to
         // hand to the loader. `subfleets` used to arrive here spelled exactly
         // that and reach `load('subfleets')`, which is not the relation —
-        // the documented expansion raised instead of resolving.
+        // the documented expansion raised instead of resolving. Relations the
+        // fleet does not define are dropped as well: nested under another
+        // response the request's `with` describes the parent, not the fleet.
         $with = $this->requestedRelations($request);
 
         if ($with !== []) {

package/server/tests/Feature/Http/Api/VehiclePublicContractTest.php

@@ -452,3 +452,26 @@ test('an unsupported expansion on retrieve cannot reach eloquent', function () {
         ->and($payload)->not->toHaveKey('not_a_relation')
         ->and($request->input('with'))->toBe(['vendor']);
 });
+
+test('a vehicle nested in an order response ignores the order expansions', function () {
+    fleetopsVehicleContractBoot();
+
+    $controller    = new VehicleController();
+    $createRequest = fleetopsVehicleContractRequest(CreateVehicleRequest::class, 'POST', ['make' => 'Ford', 'driver' => 'driver_contract1']);
+    $created       = $controller->create($createRequest)->resolve($createRequest);
+    $vehicle       = Vehicle::where('public_id', $created['id'])->firstOrFail();
+
+    // An order fetch expands the order's own relations. The Order resource nests
+    // the assigned vehicle as a full Vehicle resource, which re-reads the same
+    // request: `payload` is not a vehicle relation and used to reach load(),
+    // answering the whole order request with a RelationNotFoundException.
+    $orderRequest = fleetopsVehicleContractRequest(Request::class, 'GET', ['with' => ['payload', 'driverAssigned.vehicle', 'driver']], 'v1/orders');
+    $payload      = (new Fleetbase\FleetOps\Http\Resources\v1\Vehicle($vehicle))->resolve($orderRequest);
+
+    expect($payload['id'])->toBe($created['id'])
+        ->and($payload)->not->toHaveKey('payload')
+        ->and($vehicle->relationLoaded('payload'))->toBeFalse()
+        // The vehicle's own expansion in the same list still resolves.
+        ->and($payload['driver'])->toBeObject()
+        ->and($payload['driver_id'])->toBe('driver_contract1');
+});

package/server/tests/Unit/Http/Resources/FleetResourceTest.php

@@ -144,3 +144,20 @@ test('fleet resource accepts the explicit nested expansion spelling', function (
     expect($subFleet->relationLoaded('drivers'))->toBeTrue()
         ->and($subFleet->relationLoaded('vehicles'))->toBeFalse();
 });
+
+test('fleet resource ignores expansions that describe a parent resource', function () {
+    fleetopsFleetResourceBoot();
+
+    $fleet = Fleet::where('uuid', 'fleet-parent-1')->first();
+
+    // Rendered inside another response, the request's `with` is the parent's
+    // list. `payload` is not a fleet relation and used to raise from load();
+    // the fleet's own relation in the same list still loads.
+    $request  = Request::create('/v1/orders', 'GET', ['with' => ['payload', 'drivers']]);
+    $resolved = (new FleetResource($fleet))->resolve($request);
+
+    expect($resolved['name'])->toBe('Parent Fleet')
+        ->and($resolved)->not->toHaveKey('payload')
+        ->and($fleet->relationLoaded('payload'))->toBeFalse()
+        ->and($fleet->relationLoaded('drivers'))->toBeTrue();
+});

package/server/tests/VehicleResourceContractsTest.php

@@ -311,3 +311,42 @@ test('vehicle without driver resource omits driver relationships and serializes
         ])
         ->and($webhook)->not->toHaveKey('driver');
 });
+
+/**
+ * Resolve the request's `with` list the way a nested resource does.
+ *
+ * @return array<int, string>
+ */
+function fleetopsVehicleResourceRequestedRelations(mixed $resource, array $query): array
+{
+    $request = Request::create('/api/v1/fleet-ops/orders', 'GET', $query);
+    $method  = new ReflectionMethod(VehicleResource::class, 'requestedRelations');
+    $method->setAccessible(true);
+
+    return $method->invoke(new VehicleResource($resource), $request);
+}
+
+test('requested relations keep only what the wrapped model defines', function () {
+    $vehicle = new class(['uuid' => 'vehicle-uuid']) extends FleetOpsVehicleResourceFixture {
+        public function driver(): void
+        {
+        }
+    };
+
+    // Nested under an Order, the request's `with` describes the order:
+    // `payload` and `driverAssigned.vehicle` are not vehicle relations and must
+    // never reach this model's loader. The vehicle's own relations still pass,
+    // including a nested path whose root the vehicle defines.
+    expect(fleetopsVehicleResourceRequestedRelations($vehicle, ['with' => ['payload', 'driverAssigned.vehicle', 'driver', 'driver.user', '']]))->toBe(['driver', 'driver.user'])
+        ->and(fleetopsVehicleResourceRequestedRelations($vehicle, ['with' => 'payload,driver']))->toBe(['driver'])
+        ->and(fleetopsVehicleResourceRequestedRelations($vehicle, ['with' => ['.driver']]))->toBe([])
+        ->and(fleetopsVehicleResourceRequestedRelations($vehicle, []))->toBe([]);
+});
+
+test('requested relations are empty when the resource cannot load any', function () {
+    // Webhook fixtures and compact serializers hand the resource plain data;
+    // there is no loader to feed, so nothing is requested from it.
+    expect(fleetopsVehicleResourceRequestedRelations(['uuid' => 'vehicle-uuid'], ['with' => ['driver']]))->toBe([])
+        ->and(fleetopsVehicleResourceRequestedRelations((object) ['uuid' => 'vehicle-uuid'], ['with' => ['driver']]))->toBe([])
+        ->and(fleetopsVehicleResourceRequestedRelations(fleetopsVehicleResourceFixture(), ['with' => ['driver']]))->toBe([]);
+});