@fleetbase/fleetops-engine 0.6.63 → 0.6.65

package/server/tests/Feature/Http/Api/VehiclePublicContractTest.php

@@ -452,3 +452,26 @@ test('an unsupported expansion on retrieve cannot reach eloquent', function () {
         ->and($payload)->not->toHaveKey('not_a_relation')
         ->and($request->input('with'))->toBe(['vendor']);
 });
+
+test('a vehicle nested in an order response ignores the order expansions', function () {
+    fleetopsVehicleContractBoot();
+
+    $controller    = new VehicleController();
+    $createRequest = fleetopsVehicleContractRequest(CreateVehicleRequest::class, 'POST', ['make' => 'Ford', 'driver' => 'driver_contract1']);
+    $created       = $controller->create($createRequest)->resolve($createRequest);
+    $vehicle       = Vehicle::where('public_id', $created['id'])->firstOrFail();
+
+    // An order fetch expands the order's own relations. The Order resource nests
+    // the assigned vehicle as a full Vehicle resource, which re-reads the same
+    // request: `payload` is not a vehicle relation and used to reach load(),
+    // answering the whole order request with a RelationNotFoundException.
+    $orderRequest = fleetopsVehicleContractRequest(Request::class, 'GET', ['with' => ['payload', 'driverAssigned.vehicle', 'driver']], 'v1/orders');
+    $payload      = (new Fleetbase\FleetOps\Http\Resources\v1\Vehicle($vehicle))->resolve($orderRequest);
+
+    expect($payload['id'])->toBe($created['id'])
+        ->and($payload)->not->toHaveKey('payload')
+        ->and($vehicle->relationLoaded('payload'))->toBeFalse()
+        // The vehicle's own expansion in the same list still resolves.
+        ->and($payload['driver'])->toBeObject()
+        ->and($payload['driver_id'])->toBe('driver_contract1');
+});

package/server/tests/Feature/Http/Internal/DeviceControllerContractsTest.php

@@ -1,5 +1,6 @@
 <?php
 
+use Fleetbase\FleetOps\Exceptions\DeviceAlreadyAttachedException;
 use Fleetbase\FleetOps\Http\Controllers\Internal\v1\DeviceController;
 use Fleetbase\FleetOps\Models\Device;
 use Fleetbase\FleetOps\Models\Vehicle;
@@ -39,11 +40,12 @@ class FleetOpsInternalDeviceControllerProbe extends DeviceController
 
 class FleetOpsInternalDeviceFake extends Device
 {
-    public array $attachedTo = [];
-    public array $detaches   = [];
-    public array $loads      = [];
-    public bool $throwAttach = false;
-    public bool $throwDetach = false;
+    public array $attachedTo          = [];
+    public array $detaches            = [];
+    public array $loads               = [];
+    public bool $throwAttach          = false;
+    public bool $throwDetach          = false;
+    public bool $throwAlreadyAttached = false;
 
     public function attachTo(Model $attachable): bool
     {
@@ -51,6 +53,10 @@ class FleetOpsInternalDeviceFake extends Device
             throw new RuntimeException('attach failed');
         }
 
+        if ($this->throwAlreadyAttached) {
+            throw DeviceAlreadyAttachedException::for('Truck 1');
+        }
+
         $this->attachedTo[] = [$attachable::class, $attachable->uuid];
         $this->forceFill([
             'attachable_type' => $attachable::class,
@@ -350,6 +356,12 @@ test('internal device controller reports lookup and persistence failures', funct
             ->attach(new Request(['vehicle' => 'vehicle_public']), 'device_public')
     );
 
+    $conflictDevice                       = fleetopsInternalDevice();
+    $conflictDevice->throwAlreadyAttached = true;
+    $conflictResponse                     = fleetopsInternalDeviceController($conflictDevice, fleetopsInternalDeviceVehicle())
+        ->attach(new Request(['vehicle' => 'vehicle_public']), 'device_public');
+    $conflict = fleetopsInternalDeviceJson($conflictResponse);
+
     $detachFailureDevice              = fleetopsInternalDevice();
     $detachFailureDevice->throwDetach = true;
     $detachFailure                    = fleetopsInternalDeviceJson(
@@ -365,6 +377,9 @@ test('internal device controller reports lookup and persistence failures', funct
     expect($missingDevice['error'])->toBe('Device not found or not available for this organization.')
         ->and($missingVehicle['error'])->toBe('Vehicle not found or not available for this organization.')
         ->and($attachFailure['error'])->toBe('Unable to attach device to vehicle. Please try again or contact support.')
+        // A device installed elsewhere is refused with a conflict, not re-homed or reported as a crash.
+        ->and($conflict['error'])->toBe('Device is already attached to Truck 1. Detach it before attaching it elsewhere.')
+        ->and($conflictResponse->getStatusCode())->toBe(409)
         ->and($detachFailure['error'])->toBe('Unable to detach device from vehicle. Please try again or contact support.')
         ->and($missingDetachDevice['error'])->toBe('Device not found or not available for this organization.');
 });

package/server/tests/Feature/Http/Internal/LiveControllerEndpointsTest.php

@@ -123,6 +123,8 @@ function fleetopsLiveEndpointsBoot(): SQLiteConnection
         'users'             => ['uuid', 'public_id', 'company_uuid', 'name', 'phone', 'email', 'status', 'type', 'avatar_uuid'],
         'vehicles'          => ['uuid', 'public_id', 'company_uuid', 'vendor_uuid', 'photo_uuid', 'name', 'display_name', 'plate_number', 'serial_number', 'fuel_card_number', 'vin', 'vin_data', 'make', 'model', 'year', 'trim', 'class', 'color', 'call_sign', 'specs', 'telematics', 'status', 'online', 'location', 'meta', 'avatar_url', 'internal_id', 'speed', 'heading', 'altitude'],
         'devices'           => ['uuid', 'public_id', 'company_uuid', 'device_id', 'device_type', 'device_provider', 'owner_uuid', 'owner_type', 'attachable_uuid', 'attachable_type', 'status'],
+        'assets'            => ['uuid', 'public_id', 'company_uuid', 'asset_class', 'name', 'display_name', 'type', 'plate_number', 'status', 'last_online_at', 'online'],
+        'asset_connections' => ['uuid', 'public_id', 'company_uuid', 'connector_type', 'connector_uuid', 'connected_type', 'connected_uuid', 'active_connected_uuid', 'active_connector_position', 'relationship_type', 'position', 'connected_at', 'disconnected_at', 'source'],
         'vendors'           => ['uuid', 'public_id', 'company_uuid', 'name'],
         'files'             => ['uuid', 'public_id', 'company_uuid', 'type', 'path', 'disk'],
         'entities'          => ['uuid', 'public_id', 'company_uuid', 'payload_uuid', 'name', 'type'],
@@ -216,6 +218,16 @@ test('drivers and vehicles list located records within viewport bounds', functio
         ['uuid' => 'driver-2', 'company_uuid' => 'company-1', 'user_uuid' => 'user-1', 'online' => '1', 'location' => null],
     ]);
     $connection->table('vehicles')->insert(['uuid' => 'vehicle-1', 'company_uuid' => 'company-1', 'name' => 'Truck', 'location' => 'POINT(1 1)']);
+    $connection->table('assets')->insert([
+        ['uuid' => 'trailer-1', 'company_uuid' => 'company-1', 'asset_class' => 'trailer', 'name' => 'Reefer 12', 'type' => 'reefer', 'plate_number' => 'TRL-12', 'status' => 'in_use'],
+        ['uuid' => 'trailer-2', 'company_uuid' => 'company-1', 'asset_class' => 'trailer', 'name' => 'Flatbed 3', 'type' => 'flatbed', 'plate_number' => null, 'status' => 'available'],
+    ]);
+    $connection->table('asset_connections')->insert([
+        // Active towing connection: appears on the vehicle's map popover.
+        ['uuid' => 'connection-1', 'company_uuid' => 'company-1', 'connector_type' => 'Fleetbase\\FleetOps\\Models\\Vehicle', 'connector_uuid' => 'vehicle-1', 'connected_type' => 'Fleetbase\\FleetOps\\Models\\Trailer', 'connected_uuid' => 'trailer-1', 'active_connected_uuid' => 'trailer-1', 'relationship_type' => 'towing', 'position' => '1', 'connected_at' => '2026-09-01 08:00:00', 'source' => 'manual'],
+        // Ended connection: history only, never surfaced as a current trailer.
+        ['uuid' => 'connection-2', 'company_uuid' => 'company-1', 'connector_type' => 'Fleetbase\\FleetOps\\Models\\Vehicle', 'connector_uuid' => 'vehicle-1', 'connected_type' => 'Fleetbase\\FleetOps\\Models\\Trailer', 'connected_uuid' => 'trailer-2', 'relationship_type' => 'towing', 'position' => '1', 'connected_at' => '2026-08-01 08:00:00', 'disconnected_at' => '2026-08-02 08:00:00', 'source' => 'manual'],
+    ]);
 
     $drivers = (new LiveController())->drivers(Request::create('/x', 'GET'));
     expect($drivers->count())->toBe(1);
@@ -228,6 +240,13 @@ test('drivers and vehicles list located records within viewport bounds', functio
 
     $vehicles = (new LiveController())->vehicles(Request::create('/x', 'GET'));
     expect($vehicles->count())->toBe(1);
+
+    // The live feed eager-loads the trailers currently coupled to each vehicle so the
+    // map popover can list them without a second request per marker.
+    $vehicle = $vehicles->collection->first()->resource;
+    expect($vehicle->relationLoaded('currentTrailers'))->toBeTrue()
+        ->and($vehicle->relationLoaded('devices'))->toBeTrue()
+        ->and($vehicle->currentTrailers->pluck('uuid')->all())->toBe(['trailer-1']);
     expect((new LiveController())->vehicles(Request::create('/x', 'GET', ['bounds' => [0, 0, 1, 1]]))->count())->toBe(0);
 });
 

package/server/tests/ModelAccessorContractsTest.php

@@ -21,6 +21,7 @@ if (!function_exists('Fleetbase\FleetOps\Models\activity')) {
 }
 
 use Fleetbase\FleetOps\Exceptions\CustomerUserConflictException;
+use Fleetbase\FleetOps\Exceptions\DeviceAlreadyAttachedException;
 use Fleetbase\FleetOps\Flow\Activity;
 use Fleetbase\FleetOps\Models\Contact;
 use Fleetbase\FleetOps\Models\Device;
@@ -990,6 +991,15 @@ test('device accessors connection state configuration and command guards are sta
             'attachable_uuid' => 'vehicle-uuid',
         ]);
 
+    // An installed device must be detached before it can move to another asset;
+    // attaching used to silently re-home it with no feedback to the operator.
+    $device->attachable_type = Vehicle::class;
+    $device->attachable_uuid = 'other-vehicle-uuid';
+    expect(fn () => $device->attachTo($vehicle))->toThrow(DeviceAlreadyAttachedException::class, 'Detach it before attaching it elsewhere.');
+    expect(DeviceAlreadyAttachedException::for('Truck 99')->getMessage())->toBe('Device is already attached to Truck 99. Detach it before attaching it elsewhere.')
+        ->and(DeviceAlreadyAttachedException::for(null)->getMessage())->toBe('Device is already attached to another asset. Detach it before attaching it elsewhere.')
+        ->and($device->updates)->toHaveCount(3);
+
     $device->attachable_type = Vehicle::class;
     $device->attachable_uuid = 'vehicle-uuid';
 

package/server/tests/OrderFilterExecutionTest.php

@@ -181,7 +181,12 @@ test('order filter identity and relation filters support uuid and public identif
     $filter->driver('driver_public');
     $filter->driverAssigned('driver_public');
 
+    // Batch label scans arrive as one comma-separated list of internal ids; blanks are ignored.
+    $filter->internalId('ORD-1, ORD-2,');
+    $filter->internalId(' ');
+
     expect($builder->called('whereIn'))->toBeTrue()
+        ->and($builder->calls)->toContain(['whereIn', 'internal_id', ['ORD-1', 'ORD-2']])
         ->and($builder->called('removeWhereFromQuery'))->toBeTrue()
         ->and($builder->called('whereHas'))->toBeTrue()
         ->and($builder->called('orWhereHas'))->toBeTrue();

package/server/tests/PublicApiControllerInputContractsTest.php

@@ -11,6 +11,7 @@ use Fleetbase\FleetOps\Models\FuelReport;
 use Fleetbase\FleetOps\Models\Order;
 use Fleetbase\FleetOps\Models\Part;
 use Fleetbase\FleetOps\Models\Telematic;
+use Fleetbase\FleetOps\Models\Trailer;
 use Fleetbase\FleetOps\Models\Vehicle;
 use Fleetbase\FleetOps\Models\Vendor;
 use Fleetbase\FleetOps\Models\Warranty;
@@ -246,6 +247,9 @@ test('public api resource resolver exposes every supported morph alias', functio
         'fleet-ops:vehicle'                  => Vehicle::class,
         'vehicle'                            => Vehicle::class,
         Vehicle::class                       => Vehicle::class,
+        'fleet-ops:trailer'                  => Trailer::class,
+        'trailer'                            => Trailer::class,
+        Trailer::class                       => Trailer::class,
         'fleet-ops:driver'                   => Driver::class,
         'driver'                             => Driver::class,
         Driver::class                        => Driver::class,
@@ -284,6 +288,13 @@ test('public api resource resolver exposes every supported morph alias', functio
     ]);
 });
 
+test('public api resource resolver rejects unsupported morph aliases', function () {
+    $controller = new FleetOpsWorkOrderControllerProbe();
+
+    expect(fn () => $controller->callHelper('resolveMorph', 'unsupported-resource', 'resource_public'))
+        ->toThrow(ValidationException::class);
+});
+
 test('public api resource resolver detects fillable columns and primary keys', function () {
     $controller = new FleetOpsWorkOrderControllerProbe();
     $model      = new FleetOpsPublicApiResolverModelFake();

package/server/tests/PublicFleetOpsRestEndpointsTest.php

@@ -5,18 +5,20 @@ use Fleetbase\FleetOps\Http\Controllers\Api\v1\EquipmentController;
 use Fleetbase\FleetOps\Http\Controllers\Api\v1\FuelTransactionController;
 use Fleetbase\FleetOps\Http\Controllers\Api\v1\PartController;
 use Fleetbase\FleetOps\Http\Controllers\Api\v1\SensorController;
+use Fleetbase\FleetOps\Http\Controllers\Api\v1\TrailerController;
 use Fleetbase\FleetOps\Http\Controllers\Api\v1\WorkOrderController;
 use Fleetbase\FleetOps\Http\Resources\v1\Device;
 use Fleetbase\FleetOps\Http\Resources\v1\Equipment;
 use Fleetbase\FleetOps\Http\Resources\v1\FuelTransaction;
 use Fleetbase\FleetOps\Http\Resources\v1\Part;
 use Fleetbase\FleetOps\Http\Resources\v1\Sensor;
+use Fleetbase\FleetOps\Http\Resources\v1\Trailer;
 use Fleetbase\FleetOps\Http\Resources\v1\WorkOrder;
 
 test('new first-class fleetops rest routes are registered in the consumable v1 namespace', function () {
     $routes = file_get_contents(dirname(__DIR__) . '/src/routes.php');
 
-    foreach (['equipment', 'parts', 'work-orders', 'devices', 'sensors', 'fuel-transactions'] as $prefix) {
+    foreach (['equipment', 'parts', 'work-orders', 'devices', 'sensors', 'fuel-transactions', 'trailers'] as $prefix) {
         expect($routes)->toContain("\$router->group(['prefix' => '{$prefix}']");
     }
 
@@ -30,7 +32,12 @@ test('new first-class fleetops rest routes are registered in the consumable v1 n
         ->toContain('FuelTransactionController@matchVehicle')
         ->toContain('FuelTransactionController@matchOrder')
         ->toContain('FuelTransactionController@reprocess')
-        ->toContain('FuelTransactionController@review');
+        ->toContain('FuelTransactionController@review')
+        ->toContain('TrailerController@track')
+        ->toContain('TrailerController@attach')
+        ->toContain('TrailerController@detach')
+        ->toContain('TrailerController@connections')
+        ->toContain('TrailerController@vehicleTrailers');
 });
 
 test('public fuel transaction api keeps provider naming internal only', function () {
@@ -54,6 +61,7 @@ test('new public controllers expose the expected rest methods', function () {
         WorkOrderController::class       => ['create', 'query', 'find', 'update', 'delete', 'send'],
         DeviceController::class          => ['create', 'query', 'find', 'update', 'delete', 'attach', 'detach'],
         SensorController::class          => ['create', 'query', 'find', 'update', 'delete'],
+        TrailerController::class         => ['create', 'query', 'find', 'update', 'delete', 'track', 'attach', 'detach', 'connections', 'vehicleTrailers'],
         FuelTransactionController::class => ['create', 'query', 'find', 'update', 'delete', 'matchVehicle', 'matchOrder', 'reprocess', 'review'],
     ];
 
@@ -65,7 +73,7 @@ test('new public controllers expose the expected rest methods', function () {
 });
 
 test('new public resources preserve internal uuid fields behind internal request checks', function () {
-    foreach ([Equipment::class, Part::class, WorkOrder::class, Device::class, Sensor::class, FuelTransaction::class] as $resource) {
+    foreach ([Equipment::class, Part::class, WorkOrder::class, Device::class, Sensor::class, FuelTransaction::class, Trailer::class] as $resource) {
         expect(class_exists($resource))->toBeTrue();
     }
 
@@ -76,6 +84,7 @@ test('new public resources preserve internal uuid fields behind internal request
         'Sensor.php'          => ['uuid', 'company_uuid', 'device_uuid', 'warranty_uuid', 'telematic_uuid', 'photo_uuid', 'sensorable_uuid'],
         'FuelTransaction.php' => ['uuid', 'fuel_provider_connection_uuid', 'fuel_report_uuid', 'vehicle_uuid', 'driver_uuid', 'order_uuid'],
         'WorkOrder.php'       => ['uuid', 'company_uuid', 'schedule_uuid', 'created_by_uuid', 'updated_by_uuid', 'target_uuid', 'assignee_uuid'],
+        'Trailer.php'         => ['uuid', 'company_uuid'],
     ];
 
     foreach ($internalFields as $resourceFile => $fields) {
@@ -99,6 +108,7 @@ test('new shared resources do not expose unguarded uuid fields', function () {
         'Sensor.php',
         'FuelTransaction.php',
         'WorkOrder.php',
+        'Trailer.php',
     ] as $resourceFile) {
         $source = file_get_contents(dirname(__DIR__) . '/src/Http/Resources/v1/' . $resourceFile);
 
@@ -147,6 +157,7 @@ test('public controllers reject uuid shaped request keys', function () {
         'DeviceController.php',
         'SensorController.php',
         'FuelTransactionController.php',
+        'TrailerController.php',
     ] as $controllerFile) {
         $source = file_get_contents(dirname(__DIR__) . '/src/Http/Controllers/Api/v1/' . $controllerFile);
 
@@ -162,6 +173,7 @@ test('new public list endpoints have company scoped filters', function () {
         'DeviceFilter.php',
         'SensorFilter.php',
         'FuelProviderTransactionFilter.php',
+        'TrailerFilter.php',
     ] as $filterFile) {
         $source = file_get_contents(dirname(__DIR__) . '/src/Http/Filter/' . $filterFile);
 

package/server/tests/ReportSchemaContractsTest.php

@@ -214,6 +214,7 @@ test('fleetops report schema registers every table with columns computed columns
         'orders',
         'drivers',
         'vehicles',
+        'assets',
         'places',
         'contacts',
         'vendors',
@@ -241,6 +242,9 @@ test('fleetops report schema registers every table with columns computed columns
         ->and(fleetOpsReportTableName(fleetOpsReportRelationship($tables['drivers'], 'current_vehicle')))->toBe('vehicles')
         ->and(fleetOpsReportTableMeta($tables['vehicles'], 'category'))->toBe('Fleet')
         ->and(fleetOpsReportTableName(fleetOpsReportRelationship($tables['vehicles'], 'current_driver')))->toBe('drivers')
+        ->and(fleetOpsReportTableMeta($tables['assets'], 'label'))->toBe('Trailers and Assets')
+        ->and(fleetOpsReportTableMeta($tables['assets'], 'category'))->toBe('Fleet')
+        ->and(fleetOpsReportColumnFlag(fleetOpsReportColumn($tables['assets'], 'asset_class'), 'filterable'))->toBeTrue()
         ->and(fleetOpsReportTableMeta($tables['places'], 'category'))->toBe('Geography')
         ->and(fleetOpsReportTableMeta($tables['contacts'], 'category'))->toBe('CRM')
         ->and(fleetOpsReportTableMeta($tables['vendors'], 'category'))->toBe('CRM')

package/server/tests/TelematicsHardeningTest.php

@@ -2092,8 +2092,10 @@ test('device attachment morph types are normalized and legacy aliases are tolera
     expect($serviceProvider)
         ->toContain('use Illuminate\Database\Eloquent\Relations\Relation;')
         ->toContain('$this->registerMorphMap();')
-        ->toContain("'Fleetbase\\\\Models\\\\Vehicle'   => \\Fleetbase\\FleetOps\\Models\\Vehicle::class")
-        ->toContain("'\\\\Fleetbase\\\\Models\\\\Vehicle' => \\Fleetbase\\FleetOps\\Models\\Vehicle::class");
+        ->toContain("'Fleetbase\\\\Models\\\\Vehicle'")
+        ->toContain("'\\\\Fleetbase\\\\Models\\\\Vehicle'")
+        ->toContain("'fleet-ops:trailer'")
+        ->toContain('\\Fleetbase\\FleetOps\\Models\\Trailer::class');
 });
 
 test('internal device attachment endpoints return specific api errors instead of raw model misses', function () {