@fleetbase/fleetops-engine 0.6.64 → 0.6.66

package/server/tests/InspectionSubmitterRulesTest.php

@@ -0,0 +1,47 @@
+<?php
+
+use Fleetbase\FleetOps\Support\InspectionSubmitter;
+
+/*
+ * The public link and `POST /v1/inspections` both hand the submitter what
+ * validate() returns, and validate() returns only keys that have a rule: once
+ * an array has nested rules, its other keys are dropped. `value` had no rule of
+ * its own, so every answer reached the submitter empty and a failed check
+ * carrying its photo was refused for having none.
+ *
+ * The rules are checked here rather than run through a validator, which this
+ * package does not install.
+ */
+test('the submitter rules give every key of an answer a rule of its own', function () {
+    $rules = InspectionSubmitter::rules();
+
+    expect($rules)->toHaveKeys([
+        // What the API documents.
+        'answers',
+        'answers.*.field',
+        'answers.*.custom_field',
+        'answers.*.value',
+        'answers.*.value_type',
+        // What the first cut shipped, still accepted.
+        'custom_field_values',
+        'custom_field_values.*.custom_field',
+        'custom_field_values.*.custom_field_uuid',
+        'custom_field_values.*.value',
+        'custom_field_values.*.value_type',
+    ]);
+
+    // Either spelling satisfies the requirement, and so does a flat body.
+    expect($rules['answers'])->toContain('required_without_all:item_results,custom_field_values')
+        ->and($rules['custom_field_values'])->toContain('required_without_all:item_results,answers')
+        ->and($rules['item_results'])->toContain('required_without_all:custom_field_values,answers');
+
+    // An empty answer is still an answer (it clears the field), so the value
+    // is allowed to be null rather than required.
+    expect($rules['custom_field_values.*.value'])->toBe('nullable')
+        ->and($rules['custom_field_values.*.custom_field_uuid'])->toContain('nullable');
+
+    // Every key of a flat item result has a rule too, so none of them is dropped.
+    foreach (['item_key', 'label', 'category', 'status', 'severity', 'passed', 'comments', 'photos'] as $key) {
+        expect($rules)->toHaveKey('item_results.*.' . $key);
+    }
+});

package/server/tests/ModelAccessorContractsTest.php

@@ -21,6 +21,7 @@ if (!function_exists('Fleetbase\FleetOps\Models\activity')) {
 }
 
 use Fleetbase\FleetOps\Exceptions\CustomerUserConflictException;
+use Fleetbase\FleetOps\Exceptions\DeviceAlreadyAttachedException;
 use Fleetbase\FleetOps\Flow\Activity;
 use Fleetbase\FleetOps\Models\Contact;
 use Fleetbase\FleetOps\Models\Device;
@@ -990,6 +991,15 @@ test('device accessors connection state configuration and command guards are sta
             'attachable_uuid' => 'vehicle-uuid',
         ]);
 
+    // An installed device must be detached before it can move to another asset;
+    // attaching used to silently re-home it with no feedback to the operator.
+    $device->attachable_type = Vehicle::class;
+    $device->attachable_uuid = 'other-vehicle-uuid';
+    expect(fn () => $device->attachTo($vehicle))->toThrow(DeviceAlreadyAttachedException::class, 'Detach it before attaching it elsewhere.');
+    expect(DeviceAlreadyAttachedException::for('Truck 99')->getMessage())->toBe('Device is already attached to Truck 99. Detach it before attaching it elsewhere.')
+        ->and(DeviceAlreadyAttachedException::for(null)->getMessage())->toBe('Device is already attached to another asset. Detach it before attaching it elsewhere.')
+        ->and($device->updates)->toHaveCount(3);
+
     $device->attachable_type = Vehicle::class;
     $device->attachable_uuid = 'vehicle-uuid';
 

package/server/tests/ObserverContractsTest.php

@@ -744,7 +744,7 @@ test('work order observer creates maintenance resets schedule and dispatches com
             'maintainable_type' => 'fleet-ops:vehicle',
             'maintainable_uuid' => 'vehicle-uuid',
             'type'              => 'scheduled',
-            'status'            => 'done',
+            'status'            => 'completed',
             'priority'          => 'high',
             'performed_by_type' => 'fleet-ops:contact',
             'performed_by_uuid' => 'assignee-uuid',

package/server/tests/OrderFilterExecutionTest.php

@@ -181,7 +181,12 @@ test('order filter identity and relation filters support uuid and public identif
     $filter->driver('driver_public');
     $filter->driverAssigned('driver_public');
 
+    // Batch label scans arrive as one comma-separated list of internal ids; blanks are ignored.
+    $filter->internalId('ORD-1, ORD-2,');
+    $filter->internalId(' ');
+
     expect($builder->called('whereIn'))->toBeTrue()
+        ->and($builder->calls)->toContain(['whereIn', 'internal_id', ['ORD-1', 'ORD-2']])
         ->and($builder->called('removeWhereFromQuery'))->toBeTrue()
         ->and($builder->called('whereHas'))->toBeTrue()
         ->and($builder->called('orWhereHas'))->toBeTrue();

package/server/tests/PublicApiControllerInputContractsTest.php

@@ -11,6 +11,7 @@ use Fleetbase\FleetOps\Models\FuelReport;
 use Fleetbase\FleetOps\Models\Order;
 use Fleetbase\FleetOps\Models\Part;
 use Fleetbase\FleetOps\Models\Telematic;
+use Fleetbase\FleetOps\Models\Trailer;
 use Fleetbase\FleetOps\Models\Vehicle;
 use Fleetbase\FleetOps\Models\Vendor;
 use Fleetbase\FleetOps\Models\Warranty;
@@ -246,6 +247,9 @@ test('public api resource resolver exposes every supported morph alias', functio
         'fleet-ops:vehicle'                  => Vehicle::class,
         'vehicle'                            => Vehicle::class,
         Vehicle::class                       => Vehicle::class,
+        'fleet-ops:trailer'                  => Trailer::class,
+        'trailer'                            => Trailer::class,
+        Trailer::class                       => Trailer::class,
         'fleet-ops:driver'                   => Driver::class,
         'driver'                             => Driver::class,
         Driver::class                        => Driver::class,
@@ -284,6 +288,13 @@ test('public api resource resolver exposes every supported morph alias', functio
     ]);
 });
 
+test('public api resource resolver rejects unsupported morph aliases', function () {
+    $controller = new FleetOpsWorkOrderControllerProbe();
+
+    expect(fn () => $controller->callHelper('resolveMorph', 'unsupported-resource', 'resource_public'))
+        ->toThrow(ValidationException::class);
+});
+
 test('public api resource resolver detects fillable columns and primary keys', function () {
     $controller = new FleetOpsWorkOrderControllerProbe();
     $model      = new FleetOpsPublicApiResolverModelFake();

package/server/tests/PublicFleetOpsRestEndpointsTest.php

@@ -5,18 +5,20 @@ use Fleetbase\FleetOps\Http\Controllers\Api\v1\EquipmentController;
 use Fleetbase\FleetOps\Http\Controllers\Api\v1\FuelTransactionController;
 use Fleetbase\FleetOps\Http\Controllers\Api\v1\PartController;
 use Fleetbase\FleetOps\Http\Controllers\Api\v1\SensorController;
+use Fleetbase\FleetOps\Http\Controllers\Api\v1\TrailerController;
 use Fleetbase\FleetOps\Http\Controllers\Api\v1\WorkOrderController;
 use Fleetbase\FleetOps\Http\Resources\v1\Device;
 use Fleetbase\FleetOps\Http\Resources\v1\Equipment;
 use Fleetbase\FleetOps\Http\Resources\v1\FuelTransaction;
 use Fleetbase\FleetOps\Http\Resources\v1\Part;
 use Fleetbase\FleetOps\Http\Resources\v1\Sensor;
+use Fleetbase\FleetOps\Http\Resources\v1\Trailer;
 use Fleetbase\FleetOps\Http\Resources\v1\WorkOrder;
 
 test('new first-class fleetops rest routes are registered in the consumable v1 namespace', function () {
     $routes = file_get_contents(dirname(__DIR__) . '/src/routes.php');
 
-    foreach (['equipment', 'parts', 'work-orders', 'devices', 'sensors', 'fuel-transactions'] as $prefix) {
+    foreach (['equipment', 'parts', 'work-orders', 'devices', 'sensors', 'fuel-transactions', 'trailers'] as $prefix) {
         expect($routes)->toContain("\$router->group(['prefix' => '{$prefix}']");
     }
 
@@ -30,7 +32,12 @@ test('new first-class fleetops rest routes are registered in the consumable v1 n
         ->toContain('FuelTransactionController@matchVehicle')
         ->toContain('FuelTransactionController@matchOrder')
         ->toContain('FuelTransactionController@reprocess')
-        ->toContain('FuelTransactionController@review');
+        ->toContain('FuelTransactionController@review')
+        ->toContain('TrailerController@track')
+        ->toContain('TrailerController@attach')
+        ->toContain('TrailerController@detach')
+        ->toContain('TrailerController@connections')
+        ->toContain('TrailerController@vehicleTrailers');
 });
 
 test('public fuel transaction api keeps provider naming internal only', function () {
@@ -54,6 +61,7 @@ test('new public controllers expose the expected rest methods', function () {
         WorkOrderController::class       => ['create', 'query', 'find', 'update', 'delete', 'send'],
         DeviceController::class          => ['create', 'query', 'find', 'update', 'delete', 'attach', 'detach'],
         SensorController::class          => ['create', 'query', 'find', 'update', 'delete'],
+        TrailerController::class         => ['create', 'query', 'find', 'update', 'delete', 'track', 'attach', 'detach', 'connections', 'vehicleTrailers'],
         FuelTransactionController::class => ['create', 'query', 'find', 'update', 'delete', 'matchVehicle', 'matchOrder', 'reprocess', 'review'],
     ];
 
@@ -65,7 +73,7 @@ test('new public controllers expose the expected rest methods', function () {
 });
 
 test('new public resources preserve internal uuid fields behind internal request checks', function () {
-    foreach ([Equipment::class, Part::class, WorkOrder::class, Device::class, Sensor::class, FuelTransaction::class] as $resource) {
+    foreach ([Equipment::class, Part::class, WorkOrder::class, Device::class, Sensor::class, FuelTransaction::class, Trailer::class] as $resource) {
         expect(class_exists($resource))->toBeTrue();
     }
 
@@ -76,6 +84,7 @@ test('new public resources preserve internal uuid fields behind internal request
         'Sensor.php'          => ['uuid', 'company_uuid', 'device_uuid', 'warranty_uuid', 'telematic_uuid', 'photo_uuid', 'sensorable_uuid'],
         'FuelTransaction.php' => ['uuid', 'fuel_provider_connection_uuid', 'fuel_report_uuid', 'vehicle_uuid', 'driver_uuid', 'order_uuid'],
         'WorkOrder.php'       => ['uuid', 'company_uuid', 'schedule_uuid', 'created_by_uuid', 'updated_by_uuid', 'target_uuid', 'assignee_uuid'],
+        'Trailer.php'         => ['uuid', 'company_uuid'],
     ];
 
     foreach ($internalFields as $resourceFile => $fields) {
@@ -99,6 +108,7 @@ test('new shared resources do not expose unguarded uuid fields', function () {
         'Sensor.php',
         'FuelTransaction.php',
         'WorkOrder.php',
+        'Trailer.php',
     ] as $resourceFile) {
         $source = file_get_contents(dirname(__DIR__) . '/src/Http/Resources/v1/' . $resourceFile);
 
@@ -147,6 +157,7 @@ test('public controllers reject uuid shaped request keys', function () {
         'DeviceController.php',
         'SensorController.php',
         'FuelTransactionController.php',
+        'TrailerController.php',
     ] as $controllerFile) {
         $source = file_get_contents(dirname(__DIR__) . '/src/Http/Controllers/Api/v1/' . $controllerFile);
 
@@ -162,6 +173,7 @@ test('new public list endpoints have company scoped filters', function () {
         'DeviceFilter.php',
         'SensorFilter.php',
         'FuelProviderTransactionFilter.php',
+        'TrailerFilter.php',
     ] as $filterFile) {
         $source = file_get_contents(dirname(__DIR__) . '/src/Http/Filter/' . $filterFile);
 

package/server/tests/QueueJobContractsTest.php

@@ -713,12 +713,11 @@ test('sync fuel provider transactions job passes parsed dates and records failur
         ->and($connection->updates[0])->toMatchArray([
             'status'          => 'error',
             'last_error'      => 'provider failed',
-            'last_sync_state' => [
-                'failed_at' => '2026-05-01T12:00:00+00:00',
-                'message'   => 'provider failed',
-            ],
         ]);
 
+    expect($connection->updates[0])->not->toHaveKey('last_sync_state');
+    expect($job->middleware()[0])->toBeInstanceOf(Illuminate\Queue\Middleware\WithoutOverlapping::class);
+
     Carbon::setTestNow();
 });
 

package/server/tests/RadarRoutesTest.php

@@ -0,0 +1,35 @@
+<?php
+
+test('radar routes are registered beside the hubs', function () {
+    $routes = file_get_contents(dirname(__DIR__) . '/src/routes.php');
+
+    expect($routes)
+        ->toContain("['prefix' => 'radar']")
+        ->toContain("\$router->get('items', 'RadarController@items');")
+        ->toContain("\$router->get('summary', 'RadarController@summary');")
+        ->toContain("\$router->get('briefing', 'RadarController@briefing');")
+        ->toContain("\$router->get('agenda', 'RadarController@agenda');")
+        ->toContain("\$router->get('handovers/{key}', 'RadarController@handoverSuggest');")
+        ->toContain("\$router->post('shifts/{id}/extend', 'RadarController@extendShift');")
+        ->toContain("\$router->post('items/bulk', 'RadarController@bulk');")
+        ->toContain("\$router->post('items/{key}/acknowledge', 'RadarController@acknowledge');")
+        ->toContain("\$router->post('items/{key}/snooze', 'RadarController@snooze');")
+        ->toContain("\$router->post('items/{key}/wake', 'RadarController@wake');")
+        ->toContain("\$router->post('items/{key}/assign', 'RadarController@assign');")
+        ->toContain("\$router->post('items/{key}/plan', 'RadarController@plan');")
+        ->toContain("\$router->post('items/{key}/resolve', 'RadarController@resolve');")
+        ->toContain("\$router->post('notices', 'RadarController@storeNotice');")
+        ->toContain("\$router->delete('notices/{id}', 'RadarController@destroyNotice');");
+
+    // The bulk route is declared before the keyed routes so `items/bulk`
+    // is never read as a key called "bulk".
+    expect(strpos($routes, 'items/bulk'))->toBeLessThan(strpos($routes, 'items/{key}/acknowledge'));
+});
+
+test('radar controller exposes every routed action', function () {
+    $controller = new ReflectionClass(Fleetbase\FleetOps\Http\Controllers\Internal\v1\RadarController::class);
+
+    foreach (['items', 'summary', 'briefing', 'agenda', 'handoverSuggest', 'extendShift', 'bulk', 'acknowledge', 'snooze', 'wake', 'assign', 'plan', 'resolve', 'storeNotice', 'destroyNotice'] as $method) {
+        expect($controller->hasMethod($method))->toBeTrue("RadarController@{$method} is routed but missing");
+    }
+});

package/server/tests/ReportSchemaContractsTest.php

@@ -214,10 +214,14 @@ test('fleetops report schema registers every table with columns computed columns
         'orders',
         'drivers',
         'vehicles',
+        'assets',
         'places',
         'contacts',
         'vendors',
         'fuel_reports',
+        'work_orders',
+        'maintenances',
+        'inspection_submissions',
     ]);
 
     $orders = $tables['orders'];
@@ -241,10 +245,24 @@ test('fleetops report schema registers every table with columns computed columns
         ->and(fleetOpsReportTableName(fleetOpsReportRelationship($tables['drivers'], 'current_vehicle')))->toBe('vehicles')
         ->and(fleetOpsReportTableMeta($tables['vehicles'], 'category'))->toBe('Fleet')
         ->and(fleetOpsReportTableName(fleetOpsReportRelationship($tables['vehicles'], 'current_driver')))->toBe('drivers')
+        ->and(fleetOpsReportTableMeta($tables['assets'], 'label'))->toBe('Trailers and Assets')
+        ->and(fleetOpsReportTableMeta($tables['assets'], 'category'))->toBe('Fleet')
+        ->and(fleetOpsReportColumnFlag(fleetOpsReportColumn($tables['assets'], 'asset_class'), 'filterable'))->toBeTrue()
         ->and(fleetOpsReportTableMeta($tables['places'], 'category'))->toBe('Geography')
         ->and(fleetOpsReportTableMeta($tables['contacts'], 'category'))->toBe('CRM')
         ->and(fleetOpsReportTableMeta($tables['vendors'], 'category'))->toBe('CRM')
-        ->and(fleetOpsReportTableMeta($tables['fuel_reports'], 'category'))->toBe('Operations');
+        ->and(fleetOpsReportTableMeta($tables['fuel_reports'], 'category'))->toBe('Operations')
+        ->and(fleetOpsReportTableMeta($tables['work_orders'], 'category'))->toBe('Maintenance')
+        ->and(fleetOpsReportTableName(fleetOpsReportRelationship($tables['work_orders'], 'vehicle_target')))->toBe('vehicles')
+        ->and(fleetOpsReportColumnAggregate(fleetOpsReportColumn($tables['work_orders'], 'total_actual_cost')))->toBe('sum')
+        ->and(fleetOpsReportTableMeta($tables['maintenances'], 'label'))->toBe('Maintenance History')
+        ->and(fleetOpsReportTableName(fleetOpsReportRelationship($tables['maintenances'], 'work_order')))->toBe('work_orders')
+        ->and(fleetOpsReportTableMeta($tables['inspection_submissions'], 'label'))->toBe('Inspections')
+        ->and(fleetOpsReportTableMeta($tables['inspection_submissions'], 'category'))->toBe('Maintenance')
+        ->and(fleetOpsReportColumnFlag(fleetOpsReportColumn($tables['inspection_submissions'], 'result'), 'aggregatable'))->toBeTrue()
+        ->and(fleetOpsReportColumnAggregate(fleetOpsReportColumn($tables['inspection_submissions'], 'total_failed_items')))->toBe('sum')
+        ->and(fleetOpsReportTableName(fleetOpsReportRelationship($tables['inspection_submissions'], 'inspection_form')))->toBe('inspection_forms')
+        ->and(fleetOpsReportTableName(fleetOpsReportRelationship($tables['inspection_submissions'], 'work_order')))->toBe('work_orders');
 });
 
 test('fleetops report schema transformers normalize labels booleans distances and money', function () {

package/server/tests/RouteRegistrationExecutionTest.php

@@ -1,6 +1,35 @@
 <?php
 
 use Illuminate\Support\Facades\Route;
+use Illuminate\Support\Str;
+
+/**
+ * One recorded route, handed back so the route file can chain onto it as it
+ * would onto a real one. `middleware()` is recorded against the route; any
+ * other chained call (`name()`, `where()`) is accepted and ignored, so a chain
+ * the recorder does not model cannot break the whole file.
+ */
+class FleetOpsRecordedRoute
+{
+    public function __construct(private FleetOpsRouteRecorder $recorder, private int $index)
+    {
+    }
+
+    public function middleware(array|string $middleware): self
+    {
+        $this->recorder->routes[$this->index]['middleware'] = array_merge(
+            $this->recorder->routes[$this->index]['middleware'] ?? [],
+            (array) $middleware,
+        );
+
+        return $this;
+    }
+
+    public function __call(string $method, array $arguments): self
+    {
+        return $this;
+    }
+}
 
 class FleetOpsRouteRecorder
 {
@@ -49,47 +78,69 @@ class FleetOpsRouteRecorder
         return $this;
     }
 
-    public function get(string $uri, string|array $action): void
+    public function get(string $uri, string|array $action): FleetOpsRecordedRoute
     {
-        $this->record('GET', $uri, $action);
+        return $this->record('GET', $uri, $action);
     }
 
-    public function post(string $uri, string|array $action): void
+    public function post(string $uri, string|array $action): FleetOpsRecordedRoute
     {
-        $this->record('POST', $uri, $action);
+        return $this->record('POST', $uri, $action);
     }
 
-    public function put(string $uri, string|array $action): void
+    public function put(string $uri, string|array $action): FleetOpsRecordedRoute
     {
-        $this->record('PUT', $uri, $action);
+        return $this->record('PUT', $uri, $action);
     }
 
-    public function patch(string $uri, string|array $action): void
+    public function patch(string $uri, string|array $action): FleetOpsRecordedRoute
     {
-        $this->record('PATCH', $uri, $action);
+        return $this->record('PATCH', $uri, $action);
     }
 
-    public function delete(string $uri, string|array $action): void
+    public function delete(string $uri, string|array $action): FleetOpsRecordedRoute
     {
-        $this->record('DELETE', $uri, $action);
+        return $this->record('DELETE', $uri, $action);
     }
 
-    public function any(string $uri, string|array $action): void
+    public function any(string $uri, string|array $action): FleetOpsRecordedRoute
     {
-        $this->record('ANY', $uri, $action);
+        return $this->record('ANY', $uri, $action);
     }
 
-    public function match(array $methods, string $uri, string|array $action): void
+    public function match(array $methods, string $uri, string|array $action): FleetOpsRecordedRoute
     {
-        $this->record(implode('|', array_map('strtoupper', $methods)), $uri, $action);
+        return $this->record(implode('|', array_map('strtoupper', $methods)), $uri, $action);
     }
 
-    public function fleetbaseRoutes(string $resource): void
+    /**
+     * The platform's resource routes, and the extra routes a resource declares
+     * in its callback. The callback is run inside a group prefixed with the
+     * resource, as the platform's macro does, and handed a `$controller` that
+     * names the action the way the macro would, so those routes are recorded
+     * rather than silently skipped.
+     */
+    public function fleetbaseRoutes(string $resource, ?callable $callback = null): FleetOpsRecordedRoute
     {
-        $this->record('FLEETBASE', $resource, 'fleetbaseRoutes');
+        $route = $this->record('FLEETBASE', $resource, 'fleetbaseRoutes');
+
+        if ($callback) {
+            $controllerName = Str::studly(Str::singular($resource)) . 'Controller';
+            $this->group(['prefix' => $resource], function ($router) use ($callback, $controllerName) {
+                $callback($router, fn (string $method) => $controllerName . '@' . $method);
+            });
+        }
+
+        return $route;
+    }
+
+    /** Router methods the recorder does not model are accepted and ignored. */
+    public function __call(string $method, array $arguments): self
+    {
+        return $this;
     }
 
-    private function record(string $method, string $uri, string|array $action): void
+    private function record(string $method, string $uri, string|array $action): FleetOpsRecordedRoute
     {
         $prefixes = array_values(array_filter(array_map(
             fn (array $group) => $group['prefix'] ?? null,
@@ -102,6 +153,8 @@ class FleetOpsRouteRecorder
             'action' => $action,
             'groups' => $this->stack,
         ];
+
+        return new FleetOpsRecordedRoute($this, array_key_last($this->routes));
     }
 }
 
@@ -139,7 +192,37 @@ test('fleetops route file registers public internal analytics metrics and hub ro
         ->toContain('v1/fuel-transactions/{id}/match-vehicle')
         ->toContain('int/v1/fleet-ops/analytics/operations-pulse')
         ->toContain('int/v1/fleet-ops/metrics/{slug}')
-        ->toContain('int/v1/fleet-ops/hubs/resources');
+        ->toContain('int/v1/fleet-ops/hubs/resources')
+        ->toContain('public/inspections/forms/{id}')
+        ->toContain('public/inspections/forms/{id}/submit')
+        ->toContain('public/inspections/forms/{id}/files');
+
+    // A link's PIN can be sent again from the console.
+    $sendPin = array_values(array_filter($recorder->routes, fn (array $route) => str_ends_with($route['uri'], 'inspection-forms/{id}/links/{linkId}/send-pin')));
+    expect($sendPin)->toHaveCount(1)
+        ->and($sendPin[0]['method'])->toBe('POST')
+        ->and($sendPin[0]['action'])->toBe('InspectionFormController@sendPin');
+
+    // Every inspection route answers in JSON, so a refused request is a 422
+    // rather than a redirect: the driver API, the vehicle history and the
+    // console's form and submission routes.
+    $json    = Fleetbase\FleetOps\Http\Middleware\ForceJsonResponse::class;
+    $inGroup = fn (array $route) => in_array($json, array_merge(...array_map(fn ($group) => (array) ($group['middleware'] ?? []), $route['groups'])), true)
+        || in_array($json, (array) ($route['middleware'] ?? []), true);
+    foreach (['InspectionController@findForm', 'InspectionController@submit', 'InspectionController@forVehicle'] as $action) {
+        $route = collect($recorder->routes)->first(fn (array $route) => $route['action'] === $action);
+        expect($route)->not->toBeNull()
+            ->and($inGroup($route))->toBeTrue();
+    }
+    $console = array_filter($recorder->routes, fn (array $route) => str_contains($route['uri'], 'inspection-forms/{id}/generate-link') || str_contains($route['uri'], 'inspection-submissions/{id}/submit'));
+    expect($console)->toHaveCount(2);
+    foreach ($console as $route) {
+        expect($inGroup($route))->toBeTrue();
+    }
+
+    // Uploads through a link have a tighter limit of their own, on top of the group's.
+    $upload = collect($recorder->routes)->firstWhere('uri', 'public/inspections/forms/{id}/files');
+    expect($upload['middleware'] ?? [])->toBe(['throttle:20,1,inspection-upload']);
 });
 
 test('fleetops route file wires route groups with expected middleware and namespaces', function () {
@@ -156,6 +239,14 @@ test('fleetops route file wires route groups with expected middleware and namesp
         'namespace'  => 'Api\v1',
     ]);
 
+    // The public inspection routes answer in JSON whatever the client asks
+    // for, and are rate limited per address.
+    expect($recorder->groups)->toContainEqual([
+        'prefix'     => 'public',
+        'namespace'  => 'Public',
+        'middleware' => [Fleetbase\FleetOps\Http\Middleware\ForceJsonResponse::class, 'throttle:60,1,inspection-public'],
+    ]);
+
     expect($recorder->groups)->toContainEqual([
         'prefix'    => 'int',
         'namespace' => 'Internal',

package/server/tests/Support/AfaqyTestCrypto.php

@@ -0,0 +1,27 @@
+<?php
+
+// Package fixtures use authenticated OpenSSL encryption at the Crypt boundary.
+// Production resolves Laravel's encrypter from the host application.
+function afaqyTestCrypto(): object
+{
+    return new class {
+        public function encryptString(string $value): string
+        {
+            $iv     = random_bytes(12);
+            $cipher = openssl_encrypt($value, 'aes-256-gcm', str_repeat('t', 32), OPENSSL_RAW_DATA, $iv, $tag);
+
+            return base64_encode($iv . $tag . $cipher);
+        }
+
+        public function decryptString(string $value): string
+        {
+            $bytes = base64_decode($value, true);
+            $plain = openssl_decrypt(substr($bytes, 28), 'aes-256-gcm', str_repeat('t', 32), OPENSSL_RAW_DATA, substr($bytes, 0, 12), substr($bytes, 12, 16));
+            if ($plain === false) {
+                throw new RuntimeException('Invalid encrypted fixture.');
+            }
+
+            return $plain;
+        }
+    };
+}

package/server/tests/Support/ExampleTelemetryProvider.php

@@ -0,0 +1,82 @@
+<?php
+
+use Fleetbase\FleetOps\Contracts\TelemetryProviderInterface;
+use Fleetbase\FleetOps\Models\Telematic;
+use Fleetbase\FleetOps\Support\Telematics\Providers\AbstractProvider;
+use Fleetbase\FleetOps\Support\Telematics\Telemetry\Sample;
+
+/** Deliberately uses a protocol unrelated to any bundled vendor. */
+class ExampleTelemetryProvider extends AbstractProvider implements TelemetryProviderInterface
+{
+    public static int $connections = 0;
+    public static array $pages     = [];
+
+    protected function prepareAuthentication(): void
+    {
+    }
+
+    public function connect(Telematic $telematic): void
+    {
+        self::$connections++;
+    }
+
+    public function testConnection(array $credentials): array
+    {
+        return ['success' => true];
+    }
+
+    public function fetchDevices(array $options = []): array
+    {
+        return array_shift(self::$pages);
+    }
+
+    public function fetchDeviceDetails(string $externalId): array
+    {
+        return [];
+    }
+
+    public function normalizeSensor(array $payload): array
+    {
+        return $payload;
+    }
+
+    public function supportsWebhooks(): bool
+    {
+        return true;
+    }
+
+    public function telemetryOptions(): array
+    {
+        return ['polling_enabled' => true, 'webhooks_enabled' => true, 'page_size' => 2, 'stale_engine_on_seconds' => 90];
+    }
+
+    public function telemetryUnits(array $payload): array
+    {
+        $samples = $payload['signals'] ?? (isset($payload['tracker']) ? [$payload] : $payload);
+        foreach ($samples as $sample) {
+            if (!is_array($sample) || !isset($sample['tracker'], $sample['measured'], $sample['point'])) {
+                throw new InvalidArgumentException('Unsupported signal');
+            }
+        }
+
+        return $samples;
+    }
+
+    public function normalizeDevice(array $payload): array
+    {
+        return ['device_id' => $payload['tracker'], 'last_seen_at' => Sample::timestamp($payload['received']), 'meta' => []];
+    }
+
+    public function normalizeEvent(array $payload): array
+    {
+        return ['device_id' => $payload['tracker'], 'event_type' => 'telemetry_update',
+            'occurred_at'   => Sample::timestamp($payload['measured']), 'last_seen_at' => Sample::timestamp($payload['received']),
+            'location'      => ['lat' => $payload['point'][1], 'lng' => $payload['point'][0]], 'ignition' => true,
+            'meta'          => ['telemetry' => ['provider_at' => Sample::timestamp($payload['received'])]]];
+    }
+
+    public function normalizeTelemetrySnapshot(array $payload): array
+    {
+        return ['device' => $this->normalizeDevice($payload), 'event' => $this->normalizeEvent($payload), 'sensors' => []];
+    }
+}

package/server/tests/Support/TelemetryTestEnvironment.php

@@ -0,0 +1,53 @@
+<?php
+
+namespace Fleetbase\FleetOps\Jobs {
+    // Advance the polling deadline deterministically without sleeping in tests.
+    function microtime($asFloat = false)
+    {
+        if (!empty($GLOBALS['telemetry_test_clock'])) {
+            return array_shift($GLOBALS['telemetry_test_clock']);
+        }
+
+        return \microtime($asFloat);
+    }
+}
+
+namespace Fleetbase\FleetOps\Http\Controllers\Internal\v1 {
+    // The package test container does not include Foundation HTTP helpers.
+    function abort_unless($condition, $code, $message = '', array $headers = [])
+    {
+        if (!$condition) {
+            throw new \Symfony\Component\HttpKernel\Exception\HttpException($code, $message, null, $headers);
+        }
+    }
+}
+
+namespace Fleetbase\Support {
+    function app($abstract = null, array $parameters = [])
+    {
+        if ($abstract !== null) {
+            return \app($abstract, $parameters);
+        }
+
+        return new class() {
+            public function environment($environments = null)
+            {
+                $environment = \config('app.env', 'production');
+
+                return $environments === null ? $environment : in_array($environment, (array) $environments, true);
+            }
+
+            public function __call($method, $arguments)
+            {
+                return \app()->{$method}(...$arguments);
+            }
+        };
+    }
+
+    function url($path, $parameters = [], $secure = null)
+    {
+        $generator = new \Illuminate\Routing\UrlGenerator(new \Illuminate\Routing\RouteCollection(), \Illuminate\Http\Request::create('https://api.example.test'));
+
+        return $generator->to($path, $parameters, $secure);
+    }
+}