@fleetbase/fleetops-engine 0.6.64 → 0.6.66

package/server/src/Http/Controllers/Public/PublicInspectionController.php

@@ -0,0 +1,243 @@
+<?php
+
+namespace Fleetbase\FleetOps\Http\Controllers\Public;
+
+use Fleetbase\FleetOps\Http\Resources\v1\InspectionForm as InspectionFormResource;
+use Fleetbase\FleetOps\Http\Resources\v1\InspectionSubmission as InspectionSubmissionResource;
+use Fleetbase\FleetOps\Models\InspectionForm;
+use Fleetbase\FleetOps\Models\InspectionLink;
+use Fleetbase\FleetOps\Support\InspectionFileStore;
+use Fleetbase\FleetOps\Support\InspectionLinkPin;
+use Fleetbase\FleetOps\Support\InspectionSubmitter;
+use Fleetbase\Models\File;
+use Illuminate\Http\JsonResponse;
+use Illuminate\Http\Request;
+use Illuminate\Routing\Controller;
+use Illuminate\Support\Facades\DB;
+
+class PublicInspectionController extends Controller
+{
+    /** The largest photo a link will take, in kilobytes: a phone camera's JPEG, with room. */
+    public const MAX_UPLOAD_KB = 10240;
+
+    /** How many files one link may upload, so a leaked link cannot fill the bucket. */
+    public const MAX_UPLOADS_PER_LINK = 40;
+
+    /** What a locked link says, wherever the lock is found. */
+    protected const LOCKED_MESSAGE = 'This link is locked after too many incorrect PINs. Ask whoever sent it for a new one.';
+
+    /** The extension each accepted image type is stored under. */
+    protected const EXTENSIONS = [
+        'image/jpeg' => 'jpg',
+        'image/png'  => 'png',
+        'image/webp' => 'webp',
+        'image/gif'  => 'gif',
+        'image/heic' => 'heic',
+        'image/heif' => 'heif',
+    ];
+
+    public function show(Request $request, string $id): JsonResponse
+    {
+        [$form, $link] = $this->resolvePublishedFormAndLink($request, $id);
+
+        $link->markViewed();
+
+        return response()->json([
+            'form'     => (new InspectionFormResource($form))->resolve(),
+            'identity' => $this->identityPayload($link),
+        ]);
+    }
+
+    public function submit(Request $request, string $id): JsonResponse
+    {
+        [$form, $link] = $this->resolvePublishedFormAndLink($request, $id);
+
+        $validated = $request->validate(InspectionSubmitter::rules());
+
+        // A link submits through its form's fields. The older flat checklist
+        // stores photo URLs exactly as given, which on a public link would let
+        // anyone put an arbitrary outside image on the record.
+        if (!empty($validated['item_results']) && empty($validated['custom_field_values'])) {
+            abort(response()->json(['error' => 'Submit this inspection through its form fields.'], 422));
+        }
+
+        // A single-use link is claimed before anything is written, inside the
+        // same transaction as the submission: a second submit at the same
+        // moment finds it already taken and writes nothing, and a submission
+        // that fails to save gives the link back.
+        $submission = DB::connection($link->getConnectionName())->transaction(function () use ($form, $link, $validated, $request) {
+            if ($link->single_use && !$link->claim($request->ip(), (string) $request->userAgent())) {
+                abort(response()->json(['error' => 'This inspection link has already been used.'], 409));
+            }
+
+            $submission = InspectionSubmitter::submit($form, $validated, [
+                'vehicle_uuid'      => $link->vehicle_uuid,
+                'driver_uuid'       => $link->driver_uuid,
+                // The person the link is for: its assignee, or the driver's
+                // account. What they typed as their name is kept beside it,
+                // with whether a PIN stood between the link and the form.
+                'submitted_by_uuid' => InspectionLinkPin::recipientFor($link)?->uuid,
+                'source'            => 'public_link',
+                'meta'              => [
+                    'inspection_link_uuid' => $link->uuid,
+                    'inspection_link_id'   => $link->public_id,
+                    'completed_by_name'    => data_get($validated, 'signature.name'),
+                    'pin_verified'         => $link->hasPin(),
+                ],
+            ]);
+
+            if (!$link->single_use) {
+                $link->markUsed($request->ip(), (string) $request->userAgent());
+            }
+
+            return $submission;
+        });
+
+        return response()->json([
+            'message'    => 'Inspection submitted.',
+            'submission' => (new InspectionSubmissionResource($submission->fresh(['form', 'vehicle', 'driver', 'itemResults', 'issue', 'workOrder'])))->resolve(),
+        ]);
+    }
+
+    /**
+     * Upload a photo or a signature through the link, before submitting.
+     *
+     * The console uploads through the platform's file endpoint, which needs a
+     * session; a link has none, so this is the link's own. It checks the link
+     * exactly as submitting does, takes images only, caps how many one link
+     * may send, and tags each file with the link it came through — a
+     * submission through a link may only reference files uploaded through
+     * that same link.
+     */
+    public function upload(Request $request, string $id): JsonResponse
+    {
+        [, $link] = $this->resolvePublishedFormAndLink($request, $id);
+
+        $request->validate([
+            'file' => 'required|file|mimetypes:image/jpeg,image/png,image/webp,image/gif,image/heic,image/heif|max:' . static::MAX_UPLOAD_KB,
+            'type' => 'nullable|in:' . InspectionFileStore::TYPE_PHOTO . ',' . InspectionFileStore::TYPE_SIGNATURE,
+        ]);
+
+        $already = File::query()
+            ->where('company_uuid', $link->company_uuid)
+            ->where('meta->inspection_link_uuid', $link->uuid)
+            ->count();
+
+        if ($already >= static::MAX_UPLOADS_PER_LINK) {
+            abort(response()->json(['error' => 'This inspection link has reached its upload limit.'], 422));
+        }
+
+        $upload = $request->file('file');
+        $disk   = config('filesystems.default');
+        $bucket = config('filesystems.disks.' . $disk . '.bucket', config('filesystems.disks.s3.bucket'));
+        // The stored name's extension comes from the type the server found in
+        // the bytes, never from the name the device sent. Validation checks the
+        // content, so an image that is also valid PHP, uploaded as `photo.php`,
+        // would pass it — and stored under that extension on a web-served local
+        // disk, it would be an invitation to run it.
+        $extension = static::EXTENSIONS[$upload->getMimeType()] ?? 'jpg';
+        $stored    = $upload->storeAs('inspections/links/' . $link->uuid, File::randomFileNameFromRequest($request, 'file', $extension), ['disk' => $disk]);
+
+        if ($stored === false) {
+            abort(response()->json(['error' => 'This photo could not be stored.'], 500));
+        }
+
+        // Built here rather than through File::createFromUpload(), which takes
+        // the company and uploader from the session — and a link has none.
+        // The type comes from the bytes the server received, not from the
+        // name the device gave the file.
+        $file = File::create([
+            'company_uuid'      => $link->company_uuid,
+            'uploader_uuid'     => InspectionLinkPin::recipientFor($link)?->uuid,
+            'original_filename' => $upload->getClientOriginalName(),
+            'content_type'      => $upload->getMimeType(),
+            'disk'              => $disk,
+            'path'              => $stored,
+            'bucket'            => $bucket,
+            'type'              => $request->input('type', InspectionFileStore::TYPE_PHOTO),
+            'file_size'         => $upload->getSize(),
+            'meta'              => ['inspection_link_uuid' => $link->uuid],
+        ]);
+
+        return response()->json([
+            'file' => [
+                'id'           => $file->public_id,
+                'url'          => $file->url,
+                'filename'     => $file->original_filename,
+                'content_type' => $file->content_type,
+            ],
+        ]);
+    }
+
+    protected function resolvePublishedFormAndLink(Request $request, string $id): array
+    {
+        $token = (string) $request->query('token', $request->input('token'));
+        if (empty($token)) {
+            abort(response()->json(['error' => 'Inspection token is required.'], 403));
+        }
+
+        $form = InspectionForm::where('uuid', $id)
+            ->orWhere('public_id', $id)
+            ->firstOrFail();
+
+        if (!$form->is_published) {
+            abort(response()->json(['error' => 'This inspection form is not available.'], 403));
+        }
+
+        $link = InspectionLink::where('inspection_form_uuid', $form->uuid)
+            ->where('token_hash', InspectionLink::hashToken($token))
+            ->first();
+
+        if (!$link) {
+            abort(response()->json(['error' => 'Inspection link is invalid.'], 403));
+        }
+
+        if ($link->status === 'locked') {
+            abort(response()->json(['error' => static::LOCKED_MESSAGE, 'locked' => true], 403));
+        }
+
+        if (!$link->isUsable()) {
+            abort(response()->json(['error' => 'Inspection link is expired, revoked, or already used.'], 403));
+        }
+
+        // A link with a PIN answers nothing, not even the form's name, until
+        // the PIN is given. Wrong guesses count against the link and lock it.
+        // Every refusal here is a 403, so the page handles them all one way.
+        // The page sends it as a header, so it stays out of URLs and the
+        // access logs that record them; a `pin` field is accepted as well.
+        switch ($link->verifyPin($request->header('X-Inspection-Pin') ?: $request->input('pin'))) {
+            case 'missing':
+                abort(response()->json(['error' => 'Enter the PIN you were given with this link.', 'pin_required' => true], 403));
+                // no break
+            case 'wrong':
+                abort(response()->json(['error' => 'That PIN is not right.', 'pin_required' => true, 'attempts_left' => $link->pinAttemptsLeft()], 403));
+                // no break
+            case 'locked':
+                abort(response()->json(['error' => static::LOCKED_MESSAGE, 'locked' => true], 403));
+        }
+
+        return [$form, $link];
+    }
+
+    protected function identityPayload(InspectionLink $link): array
+    {
+        return [
+            'assignee' => $link->assignee ? [
+                'id'   => $link->assignee->public_id,
+                'name' => $link->assignee->name,
+            ] : null,
+            // Name, not phone number: whoever holds the link needs to know who
+            // it is for, not how to reach them.
+            'driver' => $link->driver ? [
+                'id'   => $link->driver->public_id,
+                'name' => $link->driver->name,
+            ] : null,
+            'vehicle' => $link->vehicle ? [
+                'id'           => $link->vehicle->public_id,
+                'name'         => $link->vehicle->display_name ?? $link->vehicle->name,
+                'plate_number' => $link->vehicle->plate_number,
+            ] : null,
+            'expires_at' => $link->expires_at,
+        ];
+    }
+}

package/server/src/Http/Controllers/TelematicPositionWebhookController.php

@@ -0,0 +1,60 @@
+<?php
+
+namespace Fleetbase\FleetOps\Http\Controllers;
+
+use Fleetbase\FleetOps\Models\Telematic;
+use Fleetbase\FleetOps\Support\Telematics\Telemetry\Configuration;
+use Fleetbase\FleetOps\Support\Telematics\Telemetry\Inbox;
+use Illuminate\Http\JsonResponse;
+use Illuminate\Http\Request;
+use Illuminate\Routing\Controller;
+use Illuminate\Support\Facades\Crypt;
+use Illuminate\Support\Facades\DB;
+
+class TelematicPositionWebhookController extends Controller
+{
+    public function handle(Request $request, Inbox $inbox, string $providerKey): JsonResponse
+    {
+        if (!$request->isMethod('post')) {
+            return response()->json(['error' => 'POST required.'], 405);
+        }
+        $id    = $request->query('telematic');
+        $token = $request->query('key');
+        if (!is_string($id) || !is_string($token)) {
+            return response()->json(['error' => 'Invalid webhook credentials.'], 403);
+        }
+        $telematic = Telematic::withoutGlobalScopes()->where('provider', $providerKey)->where('public_id', $id)->first();
+        $stored    = $telematic ? DB::table('telematic_webhook_credentials')->where('telematic_uuid', $telematic->uuid)->value('token') : null;
+        if (!$stored || !hash_equals(Crypt::decryptString($stored), $token) || !Inbox::enabled($telematic)) {
+            return response()->json(['error' => 'Invalid webhook credentials.'], 403);
+        }
+        $options = Configuration::forConnection($telematic);
+        if (!($options['webhooks_enabled'] ?? false)) {
+            return response()->json(['error' => 'Webhook processing is disabled.'], 503);
+        }
+        $body = $request->getContent();
+        if (strlen($body) > ($options['max_payload_bytes'] ?? 2097152)) {
+            return response()->json(['error' => 'Payload too large.'], 413);
+        }
+        try {
+            $payload = json_decode($body, true, 64, JSON_THROW_ON_ERROR);
+            if (!is_array($payload)) {
+                throw new \InvalidArgumentException();
+            }
+        } catch (\Throwable) {
+            return response()->json(['error' => 'JSON object or array required.'], 422);
+        }
+        try {
+            // Per-connection pressure protection; The provider can retry after capacity recovers.
+            $pending = DB::table('telematic_deliveries')->where('telematic_uuid', $telematic->uuid)->whereIn('status', ['pending', 'processing', 'retry'])->count();
+            if ($pending >= ($options['max_pending_deliveries'] ?? 10000)) {
+                return response()->json(['error' => 'Ingestion capacity exceeded.'], 503);
+            }
+            $delivery = $inbox->accept($telematic, $payload, 'webhook');
+
+            return response()->json(['status' => 'accepted', 'delivery_id' => $delivery], 200);
+        } catch (\Throwable) {
+            return response()->json(['error' => 'Unable to persist delivery; retry required.'], 503);
+        }
+    }
+}

package/server/src/Http/Controllers/TelematicWebhookController.php

@@ -38,6 +38,9 @@ class TelematicWebhookController extends Controller
      */
     public function handle(Request $request, string $providerKey): JsonResponse
     {
+        if ($this->registry->resolve($providerKey) instanceof \Fleetbase\FleetOps\Contracts\TelemetryProviderInterface) {
+            return app(TelematicPositionWebhookController::class)->handle($request, app(\Fleetbase\FleetOps\Support\Telematics\Telemetry\Inbox::class), $providerKey);
+        }
         $correlationId = Str::uuid()->toString();
 
         Log::info('Webhook received', [

package/server/src/Http/Filter/EquipmentFilter.php

@@ -2,7 +2,11 @@
 
 namespace Fleetbase\FleetOps\Http\Filter;
 
+use Fleetbase\FleetOps\Models\Driver;
+use Fleetbase\FleetOps\Models\Trailer;
+use Fleetbase\FleetOps\Models\Vehicle;
 use Fleetbase\Http\Filter\Filter;
+use Fleetbase\Support\Http;
 
 class EquipmentFilter extends Filter
 {
@@ -20,4 +24,51 @@ class EquipmentFilter extends Filter
     {
         $this->builder->search($searchQuery);
     }
+
+    public function attachmentState(?string $state)
+    {
+        $state === 'attached' ? $this->builder->whereNotNull('equipable_uuid') : $this->builder->whereNull('equipable_uuid');
+    }
+
+    public function equipableType(?string $type)
+    {
+        $class = match ($type) {
+            'vehicle', 'fleet-ops:vehicle' => Vehicle::class, 'trailer', 'fleet-ops:trailer' => Trailer::class, default => null,
+        };
+        $class ? $this->builder->where('equipable_type', $class) : $this->builder->whereRaw('0 = 1');
+    }
+
+    /**
+     * Filter by the asset the equipment is equipped to. `equipable` is a morphTo relation,
+     * which `whereHas` cannot traverse, so the identifier is resolved to the asset UUID
+     * across every equipable model first. The public API filters by public id; the
+     * console may also pass the asset UUID.
+     */
+    public function equipable($id)
+    {
+        $identifiers = array_values(array_filter(array_map('strval', (array) $id), 'strlen'));
+
+        if (empty($identifiers)) {
+            return;
+        }
+
+        $allowUuid = Http::isInternalRequest($this->request);
+        $uuids     = [];
+
+        foreach ([Vehicle::class, Trailer::class, Driver::class] as $modelClass) {
+            $uuids = array_merge($uuids, $modelClass::query()
+                ->where('company_uuid', $this->session->get('company'))
+                ->where(function ($query) use ($identifiers, $allowUuid) {
+                    $query->whereIn('public_id', $identifiers);
+
+                    if ($allowUuid) {
+                        $query->orWhereIn('uuid', $identifiers);
+                    }
+                })
+                ->pluck('uuid')
+                ->all());
+        }
+
+        $this->builder->whereIn('equipable_uuid', $uuids);
+    }
 }

package/server/src/Http/Filter/FuelProviderConnectionFilter.php

@@ -23,7 +23,7 @@ class FuelProviderConnectionFilter extends Filter
 
     public function status(?string $status)
     {
-        $this->builder->where('status', $status);
+        $this->builder->whereIn('status', explode(',', $status ?? ''));
     }
 
     public function environment(?string $environment)

package/server/src/Http/Filter/OrderFilter.php

@@ -366,6 +366,21 @@ class OrderFilter extends Filter
         }
     }
 
+    /**
+     * Exact match on one or many operator-side ids. The console's tag-input filter
+     * joins scanned or pasted ids with commas so a batch of labels resolves in one query.
+     */
+    public function internalId($internalId)
+    {
+        $ids = array_values(array_filter(array_map('trim', explode(',', (string) $internalId)), 'strlen'));
+
+        if ($ids === []) {
+            return;
+        }
+
+        $this->builder->whereIn('internal_id', $ids);
+    }
+
     public function bulkQuery($ids)
     {
         $ids     = Utils::arrayFrom($ids);

package/server/src/Http/Filter/TrailerFilter.php

@@ -0,0 +1,269 @@
+<?php
+
+namespace Fleetbase\FleetOps\Http\Filter;
+
+use Fleetbase\FleetOps\Models\Device;
+use Fleetbase\FleetOps\Models\Vehicle;
+use Fleetbase\FleetOps\Models\Vendor;
+use Fleetbase\FleetOps\Support\Utils;
+use Fleetbase\Http\Filter\Filter;
+use Fleetbase\Models\Category;
+use Fleetbase\Support\Http;
+
+class TrailerFilter extends Filter
+{
+    public function queryForInternal()
+    {
+        $this->builder->where('company_uuid', $this->session->get('company'));
+    }
+
+    public function queryForPublic()
+    {
+        $this->queryForInternal();
+    }
+
+    public function query(?string $value)
+    {
+        $this->builder->search($value);
+    }
+
+    public function publicId(?string $value)
+    {
+        $this->builder->searchWhere('public_id', $value);
+    }
+
+    public function name(?string $value)
+    {
+        $this->builder->searchWhere('name', $value);
+    }
+
+    public function code(?string $value)
+    {
+        $this->builder->searchWhere('code', $value);
+    }
+
+    public function trailerType($value)
+    {
+        $this->whereOneOf('type', $value);
+    }
+
+    public function status($value)
+    {
+        $this->whereOneOf('status', $value);
+    }
+
+    public function trailerMake(?string $value)
+    {
+        $this->builder->searchWhere('make', $value);
+    }
+
+    public function trailerModel(?string $value)
+    {
+        $this->builder->searchWhere('model', $value);
+    }
+
+    public function trailerYear($value)
+    {
+        $this->whereOneOf('year', $value);
+    }
+
+    public function plateNumber(?string $value)
+    {
+        $this->builder->searchWhere('plate_number', $value);
+    }
+
+    public function vin(?string $value)
+    {
+        $this->builder->searchWhere('vin', $value);
+    }
+
+    public function serialNumber(?string $value)
+    {
+        $this->builder->searchWhere('serial_number', $value);
+    }
+
+    public function bodyType(?string $value)
+    {
+        $this->builder->searchWhere('body_type', $value);
+    }
+
+    public function length($value)
+    {
+        $this->whereOneOf('length', $value);
+    }
+
+    public function axleCount($value)
+    {
+        $this->whereOneOf('axle_count', $value);
+    }
+
+    public function gvwr($value)
+    {
+        $this->whereOneOf('gvwr', $value);
+    }
+
+    public function payloadCapacity($value)
+    {
+        $this->whereOneOf('payload_capacity', $value);
+    }
+
+    public function ownershipType($value)
+    {
+        $this->whereOneOf('ownership_type', $value);
+    }
+
+    public function refrigerated($value)
+    {
+        $this->builder->where('refrigerated', filter_var($value, FILTER_VALIDATE_BOOLEAN));
+    }
+
+    public function devicesCount($value)
+    {
+        $this->builder->has('devices', '=', (int) $value);
+    }
+
+    public function equipmentCount($value)
+    {
+        $this->builder->has('equipments', '=', (int) $value);
+    }
+
+    /**
+     * Connectivity is derived from `last_online_at`, mirroring
+     * Trailer::getConnectivityStatusAttribute(). Multiple states combine with OR.
+     */
+    public function connectivityStatus($value)
+    {
+        $states = array_values(array_filter(array_map('strval', (array) $value), 'strlen'));
+
+        if (empty($states)) {
+            return;
+        }
+
+        $this->builder->where(function ($query) use ($states) {
+            foreach ($states as $state) {
+                $query->orWhere(function ($query) use ($state) {
+                    match ($state) {
+                        'never_connected'  => $query->whereNull('last_online_at'),
+                        'online'           => $query->where('last_online_at', '>=', now()->subMinutes(10)),
+                        'recently_offline' => $query->whereBetween('last_online_at', [now()->subDay(), now()->subMinutes(10)]),
+                        'offline'          => $query->where('last_online_at', '<', now()->subDay()),
+                        default            => $query->whereRaw('0 = 1'),
+                    };
+                });
+            }
+        });
+    }
+
+    public function attachmentState($value)
+    {
+        $states = array_unique(array_values(array_filter(array_map('strval', (array) $value), 'strlen')));
+
+        // Asking for both states is the same as not filtering.
+        if (empty($states) || count($states) > 1) {
+            return;
+        }
+
+        $method = $states[0] === 'attached' ? 'whereHas' : 'whereDoesntHave';
+        $this->builder->{$method}('currentConnection');
+    }
+
+    public function vehicle($value)
+    {
+        $uuids = $this->resolveRelationUuids(Vehicle::class, $value);
+
+        $this->builder->whereHas('currentConnection', fn ($query) => $query->whereIn('connector_uuid', $uuids));
+    }
+
+    public function vendor($value)
+    {
+        $this->builder->whereIn('vendor_uuid', $this->resolveRelationUuids(Vendor::class, $value));
+    }
+
+    /**
+     * Trailers with any of the given devices installed.
+     */
+    public function device($value)
+    {
+        $uuids = $this->resolveRelationUuids(Device::class, $value);
+
+        $this->builder->whereHas('devices', fn ($query) => $query->whereIn('uuid', $uuids));
+    }
+
+    public function category($value)
+    {
+        $this->builder->whereIn('category_uuid', $this->resolveRelationUuids(Category::class, $value, false));
+    }
+
+    public function createdAt($value)
+    {
+        $this->dateFilter('created_at', $value);
+    }
+
+    public function updatedAt($value)
+    {
+        $this->dateFilter('updated_at', $value);
+    }
+
+    public function lastOnlineAt($value)
+    {
+        $this->dateFilter('last_online_at', $value);
+    }
+
+    public function purchasedAt($value)
+    {
+        $this->dateFilter('purchased_at', $value);
+    }
+
+    /**
+     * Console multi-option filters submit arrays; the public API submits scalars.
+     */
+    private function whereOneOf(string $column, $value): void
+    {
+        $values = array_values(array_filter(array_map('strval', (array) $value), 'strlen'));
+
+        if (empty($values)) {
+            return;
+        }
+
+        count($values) === 1 ? $this->builder->where($column, $values[0]) : $this->builder->whereIn($column, $values);
+    }
+
+    /**
+     * Resolve related record identifiers to UUIDs. The console filters by the record's
+     * UUID; the public API filters by public id (or a vehicle's internal id).
+     */
+    private function resolveRelationUuids(string $modelClass, $identifiers, bool $scopeToCompany = true): array
+    {
+        $identifiers = array_values(array_filter(array_map('strval', (array) $identifiers), 'strlen'));
+
+        if (empty($identifiers)) {
+            return [];
+        }
+
+        $instance = new $modelClass();
+        $query    = $modelClass::query()->where(function ($query) use ($identifiers, $instance) {
+            $query->whereIn('public_id', $identifiers);
+
+            if (in_array('internal_id', $instance->getFillable(), true)) {
+                $query->orWhereIn('internal_id', $identifiers);
+            }
+
+            if (Http::isInternalRequest($this->request)) {
+                $query->orWhereIn('uuid', $identifiers);
+            }
+        });
+
+        if ($scopeToCompany) {
+            $query->where('company_uuid', $this->session->get('company'));
+        }
+
+        return $query->pluck('uuid')->all();
+    }
+
+    private function dateFilter(string $column, $value): void
+    {
+        $range = Utils::dateRange($value);
+
+        is_array($range) ? $this->builder->whereBetween($column, $range) : $this->builder->whereDate($column, $range);
+    }
+}