@fleetbase/fleetops-engine 0.6.67 → 0.6.69

package/server/tests/Feature/Http/Api/ProfileOnlyUserConversionMigrationTest.php

@@ -0,0 +1,201 @@
+<?php
+
+use Illuminate\Database\ConnectionResolver;
+use Illuminate\Database\Eloquent\Model as EloquentModel;
+use Illuminate\Database\SQLiteConnection;
+use Illuminate\Support\Facades\DB;
+use Illuminate\Support\Facades\Schema;
+
+/**
+ * The migration that converts profile-only `user` accounts into managed
+ * driver/customer accounts, run up and down against in-memory SQLite.
+ *
+ * An account is converted only when it clearly is a profile login and nothing
+ * else; anything that looks like a team member is left alone, and down()
+ * reverts only the rows up() converted.
+ */
+function fleetopsProfileConversionBoot(bool $withPolicies = true): SQLiteConnection
+{
+    $connection = new SQLiteConnection(new PDO('sqlite::memory:'));
+    $resolver   = new ConnectionResolver(['default' => $connection, 'mysql' => $connection]);
+    $resolver->setDefaultConnection('mysql');
+    EloquentModel::setConnectionResolver($resolver);
+
+    app()->instance('db', new class($connection) {
+        public function __construct(public SQLiteConnection $c)
+        {
+        }
+
+        public function connection($name = null): SQLiteConnection
+        {
+            return $this->c;
+        }
+
+        public function table($table, $as = null)
+        {
+            return $this->c->table($table, $as);
+        }
+
+        public function __call($method, $arguments)
+        {
+            return $this->c->{$method}(...$arguments);
+        }
+    });
+    app()->instance('db.schema', $connection->getSchemaBuilder());
+    DB::clearResolvedInstance('db');
+    Schema::clearResolvedInstance('db.schema');
+
+    $schema = $connection->getSchemaBuilder();
+    $tables = [
+        'users'                 => ['uuid', 'type', 'meta'],
+        'drivers'               => ['uuid', 'user_uuid'],
+        'contacts'              => ['uuid', 'user_uuid', 'type'],
+        'companies'             => ['uuid', 'owner_uuid'],
+        'company_users'         => ['uuid', 'user_uuid', 'company_uuid'],
+        'roles'                 => ['name'],
+        'model_has_roles'       => ['role_id', 'model_uuid'],
+        'model_has_permissions' => ['permission_id', 'model_uuid'],
+    ];
+    if ($withPolicies) {
+        $tables['model_has_policies'] = ['policy_id', 'model_uuid'];
+    }
+    foreach ($tables as $table => $columns) {
+        $schema->create($table, function ($blueprint) use ($columns) {
+            $blueprint->increments('id');
+            foreach ($columns as $column) {
+                $blueprint->string($column)->nullable();
+            }
+            $blueprint->timestamp('deleted_at')->nullable();
+        });
+    }
+
+    foreach (['Driver', 'Fleet-Ops Customer', 'Administrator'] as $role) {
+        $connection->table('roles')->insert(['name' => $role]);
+    }
+
+    return $connection;
+}
+
+function fleetopsProfileConversionMigration(): object
+{
+    return require dirname(__DIR__, 4) . '/migrations/2026_09_21_000001_convert_profile_only_users_to_managed_accounts.php';
+}
+
+/**
+ * Seed a user holding the given profile(s), roles on its company membership
+ * (or on the user itself), and optional direct permission or policy.
+ */
+function fleetopsProfileConversionUser(SQLiteConnection $connection, string $uuid, array $options = []): void
+{
+    $connection->table('users')->insert(['uuid' => $uuid, 'type' => $options['type'] ?? 'user', 'meta' => $options['meta'] ?? null, 'deleted_at' => $options['deleted_at'] ?? null]);
+    $connection->table('company_users')->insert(['uuid' => 'cu-' . $uuid, 'user_uuid' => $uuid, 'company_uuid' => 'company-1']);
+
+    if ($options['driver'] ?? false) {
+        $connection->table('drivers')->insert(['uuid' => 'driver-' . $uuid, 'user_uuid' => $uuid]);
+    }
+
+    if ($options['customer'] ?? false) {
+        $connection->table('contacts')->insert(['uuid' => 'contact-' . $uuid, 'user_uuid' => $uuid, 'type' => 'customer']);
+    }
+
+    foreach ($options['roles'] ?? [] as $role) {
+        $roleId = $connection->table('roles')->where('name', $role)->value('id');
+        $connection->table('model_has_roles')->insert(['role_id' => $roleId, 'model_uuid' => ($options['role_on_user'] ?? false) ? $uuid : 'cu-' . $uuid]);
+    }
+
+    if ($options['permission'] ?? false) {
+        $connection->table('model_has_permissions')->insert(['permission_id' => 1, 'model_uuid' => 'cu-' . $uuid]);
+    }
+
+    if ($options['policy'] ?? false) {
+        $connection->table('model_has_policies')->insert(['policy_id' => 1, 'model_uuid' => $uuid]);
+    }
+}
+
+function fleetopsProfileConversionTypes(SQLiteConnection $connection): array
+{
+    return $connection->table('users')->orderBy('uuid')->pluck('type', 'uuid')->all();
+}
+
+test('up converts profile-only accounts and leaves anything that looks like a team member', function () {
+    $connection = fleetopsProfileConversionBoot();
+
+    fleetopsProfileConversionUser($connection, 'a-driver', ['driver' => true, 'roles' => ['Driver'], 'meta' => json_encode(['source' => 'console'])]);
+    fleetopsProfileConversionUser($connection, 'b-customer', ['customer' => true, 'roles' => ['Fleet-Ops Customer'], 'role_on_user' => true]);
+    fleetopsProfileConversionUser($connection, 'c-owner', ['driver' => true, 'roles' => ['Driver']]);
+    $connection->table('companies')->insert(['uuid' => 'company-1', 'owner_uuid' => 'c-owner']);
+    fleetopsProfileConversionUser($connection, 'd-extra-role', ['driver' => true, 'roles' => ['Driver', 'Administrator']]);
+    fleetopsProfileConversionUser($connection, 'e-permission', ['driver' => true, 'roles' => ['Driver'], 'permission' => true]);
+    fleetopsProfileConversionUser($connection, 'f-policy', ['customer' => true, 'roles' => ['Fleet-Ops Customer'], 'policy' => true]);
+    fleetopsProfileConversionUser($connection, 'g-both-profiles', ['driver' => true, 'customer' => true, 'roles' => ['Driver']]);
+    fleetopsProfileConversionUser($connection, 'h-no-roles', ['driver' => true]);
+    fleetopsProfileConversionUser($connection, 'i-wrong-role', ['customer' => true, 'roles' => ['Driver']]);
+    fleetopsProfileConversionUser($connection, 'j-no-profile', ['roles' => ['Driver']]);
+    fleetopsProfileConversionUser($connection, 'k-admin', ['type' => 'admin', 'driver' => true, 'roles' => ['Driver']]);
+    fleetopsProfileConversionUser($connection, 'l-deleted', ['driver' => true, 'roles' => ['Driver'], 'deleted_at' => '2026-01-01 00:00:00']);
+    fleetopsProfileConversionUser($connection, 'm-bad-meta', ['driver' => true, 'roles' => ['Driver'], 'meta' => 'not-json']);
+
+    fleetopsProfileConversionMigration()->up();
+
+    expect(fleetopsProfileConversionTypes($connection))->toBe([
+        'a-driver'        => 'driver',
+        'b-customer'      => 'customer',
+        'c-owner'         => 'user',
+        'd-extra-role'    => 'user',
+        'e-permission'    => 'user',
+        'f-policy'        => 'user',
+        'g-both-profiles' => 'user',
+        'h-no-roles'      => 'user',
+        'i-wrong-role'    => 'user',
+        'j-no-profile'    => 'user',
+        'k-admin'         => 'admin',
+        'l-deleted'       => 'user',
+        'm-bad-meta'      => 'driver',
+    ])
+        // The previous type is recorded next to any existing meta
+        ->and(json_decode($connection->table('users')->where('uuid', 'a-driver')->value('meta'), true))->toBe(['source' => 'console', 'previous_type' => 'user'])
+        ->and(json_decode($connection->table('users')->where('uuid', 'm-bad-meta')->value('meta'), true))->toBe(['previous_type' => 'user']);
+});
+
+test('down reverts only the accounts up converted', function () {
+    $connection = fleetopsProfileConversionBoot();
+
+    fleetopsProfileConversionUser($connection, 'a-driver', ['driver' => true, 'roles' => ['Driver'], 'meta' => json_encode(['source' => 'console'])]);
+    fleetopsProfileConversionUser($connection, 'b-customer', ['customer' => true, 'roles' => ['Fleet-Ops Customer']]);
+    // Managed accounts created after the change carry no previous type
+    fleetopsProfileConversionUser($connection, 'c-native-driver', ['type' => 'driver', 'driver' => true, 'meta' => json_encode(['source' => 'app'])]);
+    // A previous type other than `user` is not this migration's
+    fleetopsProfileConversionUser($connection, 'd-other-previous', ['type' => 'customer', 'customer' => true, 'meta' => json_encode(['previous_type' => 'contact'])]);
+
+    $migration = fleetopsProfileConversionMigration();
+    $migration->up();
+    $migration->down();
+
+    expect(fleetopsProfileConversionTypes($connection))->toBe([
+        'a-driver'         => 'user',
+        'b-customer'       => 'user',
+        'c-native-driver'  => 'driver',
+        'd-other-previous' => 'customer',
+    ])
+        ->and(json_decode($connection->table('users')->where('uuid', 'a-driver')->value('meta'), true))->toBe(['source' => 'console'])
+        ->and(json_decode($connection->table('users')->where('uuid', 'b-customer')->value('meta'), true))->toBe([])
+        ->and(json_decode($connection->table('users')->where('uuid', 'd-other-previous')->value('meta'), true))->toBe(['previous_type' => 'contact']);
+});
+
+test('up and down do nothing when the tables they read are missing', function () {
+    $connection = fleetopsProfileConversionBoot(false);
+    fleetopsProfileConversionUser($connection, 'a-driver', ['driver' => true, 'roles' => ['Driver']]);
+
+    $migration = fleetopsProfileConversionMigration();
+    $migration->up();
+
+    expect(fleetopsProfileConversionTypes($connection))->toBe(['a-driver' => 'user']);
+
+    $connection->table('users')->where('uuid', 'a-driver')->update(['type' => 'driver', 'meta' => json_encode(['previous_type' => 'user'])]);
+    $connection->getSchemaBuilder()->drop('users');
+
+    // Without a users table there is nothing to revert
+    $migration->down();
+
+    expect($connection->getSchemaBuilder()->hasTable('users'))->toBeFalse();
+});

package/server/tests/Feature/Http/Internal/ContactControllerEndpointsTest.php

@@ -252,10 +252,12 @@ test('contact update guards types resolve users and portal seams persist', funct
         $probe->callProtected('assertContactInputIsValid', [$request, &$input, $contact]);
     })->toThrow(Exception::class);
 
-    // User references resolve through uuid or public id
-    expect($probe->callProtected('resolveUserUuid', ['user_contactseam']))->toBe('88888888-8888-4888-8888-888888888881')
-        ->and($probe->callProtected('resolveUserUuid', ['88888888-8888-4888-8888-888888888881']))->toBe('88888888-8888-4888-8888-888888888881')
-        ->and($probe->callProtected('resolveUserUuid', ['unknown-user']))->toBe('unknown-user');
+    // The login account is managed by the profile, so user references are dropped
+    $userInput = ['name' => 'Seam Contact', 'user_uuid' => '88888888-8888-4888-8888-888888888881', 'user' => 'user_contactseam'];
+    Closure::bind(function (array &$input) {
+        $this->resolveUserInput(Request::create('/x', 'PUT', []), $input);
+    }, $probe, ContactController::class)($userInput);
+    expect($userInput)->toBe(['name' => 'Seam Contact']);
 
     // Portal seams read users, mint passwords, and persist meta quietly
     expect($probe->callProtected('contactUser', [$contact])?->uuid)->toBe('88888888-8888-4888-8888-888888888881')

package/server/tests/Feature/Http/Internal/CustomerControllerCredentialsTest.php

@@ -125,7 +125,9 @@ function fleetopsCustomerCredentialsBoot(): SQLiteConnection
         'contacts'  => ['uuid', 'public_id', 'company_uuid', 'user_uuid', 'name', 'email', 'phone', 'type', 'title', 'meta', 'photo_uuid', 'place_uuid', 'slug', '_key'],
         'users'     => ['uuid', 'public_id', 'company_uuid', 'name', 'email', 'phone', 'password', 'type', 'status', 'timezone', 'slug', 'username', 'avatar_uuid', 'meta', '_key'],
         'companies' => ['uuid', 'public_id', 'name', 'country'],
-        'files'     => ['uuid', 'public_id', 'company_uuid', 'subject_uuid', 'subject_type', 'name', 'path', 'disk', 'type', '_key'],
+        // session_status reads the user's membership of the session company
+        'company_users' => ['uuid', 'company_uuid', 'user_uuid', 'status'],
+        'files'         => ['uuid', 'public_id', 'company_uuid', 'subject_uuid', 'subject_type', 'name', 'path', 'disk', 'type', '_key'],
     ];
     foreach ($tables as $table => $columns) {
         $schema->create($table, function ($blueprint) use ($columns) {
@@ -192,5 +194,7 @@ test('customer resolution and payload helpers expose user details', function ()
 
     $payload = $probe->callHelper('customerPayload', $customer);
     expect($payload['uuid'])->toBe('55555555-5555-4555-8555-555555555555')
-        ->and($payload)->toHaveKey('user');
+        ->and($payload['user']['uuid'])->toBe('user-1')
+        ->and($payload['is_staff_linked'])->toBeFalse()
+        ->and($payload['login_status'])->toBe('active');
 });

package/server/tests/Feature/Http/Internal/DriverControllerContractsTest.php

@@ -1131,6 +1131,29 @@ test('internal driver controller verify code returns driver resource and handles
     ]);
 });
 
+test('internal driver controller refuses phone login and code verification for deactivated drivers', function () {
+    FleetOpsInternalDriverAuthControllerProbe::resetProbe();
+    app()->instance('request', Request::create('/', 'POST', ['phone' => '15551234567']));
+
+    $deactivated = fleetopsInternalDriverAuthUser();
+    $deactivated->setAttribute('status', 'inactive');
+    FleetOpsInternalDriverAuthControllerProbe::$loginUser          = $deactivated;
+    FleetOpsInternalDriverAuthControllerProbe::$verificationUser   = $deactivated;
+    FleetOpsInternalDriverAuthControllerProbe::$verificationExists = true;
+
+    $controller = new FleetOpsInternalDriverAuthControllerProbe();
+    $login      = $controller->loginWithPhone();
+    $verify     = $controller->verifyCode(new Request(['identity' => '+15551234567', 'code' => '111111']));
+
+    expect($login->getStatusCode())->toBe(403)
+        ->and($login->getData(true))->toBe(['error' => 'This driver login has been deactivated.'])
+        ->and($verify->getStatusCode())->toBe(403)
+        ->and($verify->getData(true))->toBe(['error' => 'This driver login has been deactivated.'])
+        // No code is sent and no token is issued
+        ->and(FleetOpsInternalDriverAuthControllerProbe::$verifications)->toBe([])
+        ->and(FleetOpsInternalDriverAuthControllerProbe::$tokens)->toBe([]);
+});
+
 test('internal driver controller delegates login and create driver verification flows to api controller', function () {
     $request = new Request(['for' => 'create_driver']);
 

package/server/tests/Feature/Http/Internal/DriverControllerCreateRecordTest.php

@@ -10,11 +10,12 @@ use Illuminate\Http\Request;
 /**
  * Covers the internal DriverController createRecord and updateRecord flows
  * against an in-memory SQLite fixture. The creation closure executes end to
- * end: company resolution, user creation with driver typing, existing-user
- * adoption and conflict detection, organization membership checks, and the
- * exception-to-error-response branches. Role assignment requires the full
- * spatie permission boot unavailable in the harness, so flows settle in the
- * documented error branch after the user record is persisted.
+ * end: company resolution, managed account creation with driver typing
+ * through ProfileAccountManager, and the exception-to-error-response
+ * branches. Role assignment requires the full spatie permission boot, which
+ * this fixture leaves out, so flows settle in the documented error branch
+ * after the user record is persisted (see
+ * DriverControllerExistingUserAdoptionTest for the full flow).
  */
 if (!function_exists('Fleetbase\Support\session')) {
     eval('namespace Fleetbase\Support; function session($key = null, $default = null) { if ($key === null) { return new class { public function has($k) { return \session($k) !== null; } public function get($k, $d = null) { return \session($k, $d); } }; } return \session($key, $default); }');
@@ -101,6 +102,28 @@ function fleetopsInternalDriverCreateBoot(): SQLiteConnection
         }
     });
     Illuminate\Support\Facades\DB::clearResolvedInstance('db');
+    app()->instance('hash', new class implements Illuminate\Contracts\Hashing\Hasher {
+        public function info($hashedValue): array
+        {
+            return [];
+        }
+
+        public function make($value, array $options = []): string
+        {
+            return 'hashed:' . $value;
+        }
+
+        public function check($value, $hashedValue, array $options = []): bool
+        {
+            return 'hashed:' . $value === $hashedValue;
+        }
+
+        public function needsRehash($hashedValue, array $options = []): bool
+        {
+            return false;
+        }
+    });
+    Illuminate\Support\Facades\Hash::clearResolvedInstance('hash');
 
     $schema = $connection->getSchemaBuilder();
     $tables = [
@@ -158,31 +181,33 @@ test('create record provisions a driver-typed user before role assignment', func
         ->and($connection->table('company_users')->count())->toBeGreaterThanOrEqual(0);
 });
 
-test('create record rejects users that already belong to a driver', function () {
+test('create record ignores a picked user account and resolves the login from the email', function () {
     $connection = fleetopsInternalDriverCreateBoot();
-    $connection->table('users')->insert(['uuid' => '11111111-1111-4111-8111-111111111111', 'company_uuid' => 'company-1', 'name' => 'Existing', 'type' => 'driver']);
-    $connection->table('drivers')->insert(['uuid' => 'driver-1', 'company_uuid' => 'company-1', 'user_uuid' => '11111111-1111-4111-8111-111111111111']);
+    $connection->table('users')->insert(['uuid' => '11111111-1111-4111-8111-111111111111', 'company_uuid' => 'company-1', 'name' => 'Existing', 'email' => 'existing@example.com', 'type' => 'driver']);
 
-    $result = (new DriverController())->createRecord(fleetopsInternalDriverCreateRequest([
-        'name'      => 'Existing',
+    (new DriverController())->createRecord(fleetopsInternalDriverCreateRequest([
+        'name'      => 'Someone Else',
+        'email'     => 'someone@example.com',
         'user_uuid' => '11111111-1111-4111-8111-111111111111',
     ]));
 
-    expect($result)->toBeInstanceOf(JsonResponse::class)
-        ->and($result->getData(true))->toBe(['error' => 'This user account already belongs to a driver.']);
+    // The login account is managed by the profile: a new driver account is
+    // created for the email rather than the picked account being taken over
+    expect($connection->table('users')->count())->toBe(2)
+        ->and($connection->table('users')->where('email', 'someone@example.com')->value('type'))->toBe('driver')
+        ->and($connection->table('users')->where('uuid', '11111111-1111-4111-8111-111111111111')->value('name'))->toBe('Existing');
 });
 
-test('create record adopts an existing user and applies photo avatars', function () {
+test('create record applies photo avatars to the new driver account', function () {
     $connection = fleetopsInternalDriverCreateBoot();
-    $connection->table('users')->insert(['uuid' => '11111111-1111-4111-8111-111111111111', 'company_uuid' => 'company-1', 'name' => 'Adoptable', 'type' => 'driver']);
 
     $result = (new DriverController())->createRecord(fleetopsInternalDriverCreateRequest([
-        'name'       => 'Adoptable',
-        'user_uuid'  => '11111111-1111-4111-8111-111111111111',
+        'name'       => 'Photo Driver',
         'photo_uuid' => '22222222-2222-4222-8222-222222222222',
     ]));
 
-    // Avatar update applies before the harness role-assignment limitation.
+    // Avatar is set when the account is created, before the harness
+    // role-assignment limitation.
     expect($connection->table('users')->value('avatar_uuid'))->toBe('22222222-2222-4222-8222-222222222222')
         ->and($result)->toBeInstanceOf(JsonResponse::class)
         ->and($result->getData(true))->toHaveKey('error');