@fleetbase/fleetops-engine 0.6.67 → 0.6.69

package/server/tests/Feature/Http/Internal/OrderControllerContractsTest.php

@@ -298,7 +298,7 @@ class FleetOpsInternalOrderLifecycleControllerProbe extends OrderController
         return $this->order;
     }
 
-    protected function findOrderById(string $id, array $with = []): ?Order
+    protected function findOrderById(mixed $id, array $with = []): ?Order
     {
         $this->order?->setAttribute('lookup_id', $id);
         $this->order?->setAttribute('lookup_with', $with);
@@ -990,10 +990,15 @@ test('internal order controller bulk dispatch only dispatches created uncanceled
 });
 
 test('internal order controller bulk assign driver deduplicates orders and queues notifications', function () {
-    $controller = fleetopsInternalOrderLifecycleController();
     $driverUuid = '11111111-1111-4111-8111-111111111111';
     $orderA     = '22222222-2222-4222-8222-222222222222';
     $orderB     = '33333333-3333-4333-8333-333333333333';
+    // The ids are resolved through the company-scoped `ordersByUuid()` lookup, so
+    // only orders it returns are assigned, counted and notified.
+    $controller = fleetopsInternalOrderLifecycleController([
+        fleetopsInternalOrderLifecycleOrder($orderA),
+        fleetopsInternalOrderLifecycleOrder($orderB),
+    ]);
 
     $response = $controller->bulkAssignDriver(fleetopsBulkActionRequest([
         'ids'    => [$orderA, $orderA, $orderB],
@@ -1011,7 +1016,9 @@ test('internal order controller bulk assign driver deduplicates orders and queue
         ->and($controller->assignedDriverUuid)->toBe($driverUuid)
         ->and($controller->bulkNotification)->toBe([[$orderA, $orderB], $driverUuid]);
 
-    $controller = fleetopsInternalOrderLifecycleController();
+    $controller = fleetopsInternalOrderLifecycleController([
+        fleetopsInternalOrderLifecycleOrder($orderA),
+    ]);
     $controller->bulkAssignDriver(fleetopsBulkActionRequest([
         'ids'    => [$orderA],
         'driver' => $driverUuid,

package/server/tests/Feature/Http/Internal/OrderControllerImportFromFilesTest.php

@@ -177,3 +177,21 @@ test('invalid file types and unreadable spreadsheets return errors', function ()
     ]));
     expect($unreadable->getStatusCode())->toBeGreaterThanOrEqual(400);
 });
+
+test('import ignores files uploaded by another company', function () {
+    $connection = fleetopsOrderImportFilesBoot();
+    $connection->table('files')->insert(['uuid' => '33333333-3333-4333-8333-333333333333', 'public_id' => 'file_ordimport4', 'company_uuid' => 'company-2', 'path' => 'uploads/orders.xlsx', 'disk' => 'local']);
+    fleetopsOrderImportFilesExcelFake([[
+        ['name' => 'Victim Stop', 'street1' => 'Victim Rd 1', 'city' => 'Singapore'],
+    ]]);
+
+    // The file uuid is caller-supplied and nothing upstream checks who owns it,
+    // so an unscoped lookup here would read a rival company's spreadsheet.
+    $response = (new OrderController())->importFromFiles(fleetopsOrderImportFilesRequest([
+        'files' => ['33333333-3333-4333-8333-333333333333'],
+    ]));
+
+    $data = $response->getData(true);
+    expect($data['places'])->toHaveCount(0)
+        ->and($data['entities'])->toHaveCount(0);
+});

package/server/tests/Feature/Http/Internal/OrderControllerTenantScopingTest.php

@@ -0,0 +1,411 @@
+<?php
+
+if (!function_exists('Fleetbase\Support\session')) {
+    eval('namespace Fleetbase\Support; function session($key = null, $default = null) { if ($key === null) { return new class { public function has($k) { return \session($k) !== null; } public function get($k, $d = null) { return \session($k, $d); } }; } return \session($key, $default); }');
+}
+
+if (!function_exists('Fleetbase\Support\auth')) {
+    eval('namespace Fleetbase\Support; function auth() { return new class { public function user() { return null; } public function id() { return null; } }; }');
+}
+
+use Fleetbase\FleetOps\Http\Controllers\Internal\v1\OrderController;
+use Fleetbase\FleetOps\Http\Requests\BulkDispatchRequest;
+use Fleetbase\FleetOps\Http\Requests\CancelOrderRequest;
+use Fleetbase\FleetOps\Models\Driver;
+use Fleetbase\FleetOps\Models\Order;
+use Illuminate\Database\ConnectionResolver;
+use Illuminate\Database\Eloquent\Model as EloquentModel;
+use Illuminate\Database\Eloquent\ModelNotFoundException;
+use Illuminate\Database\SQLiteConnection;
+use Illuminate\Http\Request;
+
+/**
+ * Covers tenant isolation on the internal OrderController.
+ *
+ * Every order-lifecycle action here takes its target as a caller-supplied
+ * identifier in the request body or query string rather than as a bound route
+ * parameter, and `fleetbase.protected` only checks that the caller holds the
+ * named RBAC capability — never which company the record belongs to. Nothing
+ * upstream narrows these queries, so each lookup carries the company
+ * constraint itself, and these tests pin that: an identifier belonging to
+ * another organization must resolve to nothing, and a request without a
+ * company session must fail closed rather than query every tenant at once.
+ *
+ * `company-1` is the caller throughout; `company-2` is the victim tenant.
+ */
+class FleetOpsInternalOrderTenantScopeProbe extends OrderController
+{
+    public function callHelper(string $method, ...$arguments): mixed
+    {
+        return $this->{$method}(...$arguments);
+    }
+}
+
+const FLEETOPS_TENANT_OWN_ORDER     = '55555555-5555-4555-8555-555555555501';
+const FLEETOPS_TENANT_VICTIM_ORDER  = '55555555-5555-4555-8555-555555555502';
+const FLEETOPS_TENANT_OWN_DRIVER    = '55555555-5555-4555-8555-555555555511';
+const FLEETOPS_TENANT_VICTIM_DRIVER = '55555555-5555-4555-8555-555555555512';
+
+function fleetopsOrderTenantBoot(): SQLiteConnection
+{
+    $connection = new SQLiteConnection(new PDO('sqlite::memory:'));
+    $resolver   = new ConnectionResolver(['default' => $connection, 'mysql' => $connection]);
+    $resolver->setDefaultConnection('mysql');
+    EloquentModel::setConnectionResolver($resolver);
+    app()->instance('db', new class($connection) {
+        public function __construct(public SQLiteConnection $c)
+        {
+        }
+
+        public function connection($name = null): SQLiteConnection
+        {
+            return $this->c;
+        }
+
+        public function __call($method, $arguments)
+        {
+            return $this->c->{$method}(...$arguments);
+        }
+    });
+    Illuminate\Support\Facades\DB::clearResolvedInstance('db');
+
+    $schema = $connection->getSchemaBuilder();
+    $tables = [
+        'orders'            => ['uuid', 'public_id', 'company_uuid', 'payload_uuid', 'order_config_uuid', 'tracking_number_uuid', 'driver_assigned_uuid', 'status', 'type', 'adhoc', 'dispatched', 'started', 'scheduled_at', 'meta', '_key'],
+        'payloads'          => ['uuid', 'public_id', 'company_uuid', 'pickup_uuid', 'dropoff_uuid', 'current_waypoint_uuid', 'meta', 'type'],
+        'places'            => ['uuid', 'public_id', 'company_uuid', 'name', 'location'],
+        'waypoints'         => ['uuid', 'public_id', 'company_uuid', 'payload_uuid', 'place_uuid', 'tracking_number_uuid', 'order', 'type'],
+        'entities'          => ['uuid', 'public_id', 'company_uuid', 'payload_uuid', 'destination_uuid', 'tracking_number_uuid', 'name', 'type'],
+        'drivers'           => ['uuid', 'public_id', 'company_uuid', 'user_uuid', 'vehicle_uuid', 'status', 'online', 'location', 'current_job_uuid'],
+        'users'             => ['uuid', 'public_id', 'company_uuid', 'name', 'status', 'type'],
+        'tracking_numbers'  => ['uuid', 'public_id', 'company_uuid', 'tracking_number', 'owner_uuid', 'owner_type', '_key'],
+        'tracking_statuses' => ['uuid', 'public_id', 'company_uuid', 'tracking_number_uuid', 'status', 'details', 'code', '_key'],
+        'proofs'            => ['uuid', 'public_id', 'company_uuid', 'order_uuid', 'subject_uuid', 'subject_type', 'file_uuid', 'remarks', 'raw_data', 'data'],
+        'companies'         => ['uuid', 'public_id', 'name', 'country'],
+    ];
+    foreach ($tables as $table => $columns) {
+        $schema->create($table, function ($blueprint) use ($columns) {
+            $blueprint->increments('id');
+            foreach ($columns as $column) {
+                $blueprint->string($column)->nullable();
+            }
+            $blueprint->timestamps();
+            $blueprint->timestamp('deleted_at')->nullable();
+        });
+    }
+
+    session(['company' => 'company-1']);
+
+    return $connection;
+}
+
+/**
+ * Seeds one order/driver/payload per tenant. The two tenants' records are
+ * identical apart from `company_uuid`, so any lookup that resolves the
+ * `company-2` identifier is crossing the tenant boundary.
+ */
+function fleetopsOrderTenantSeed(SQLiteConnection $connection): void
+{
+    $connection->table('users')->insert([
+        ['uuid' => 'user-own', 'company_uuid' => 'company-1', 'name' => 'Own Driver'],
+        ['uuid' => 'user-victim', 'company_uuid' => 'company-2', 'name' => 'Victim Driver'],
+    ]);
+    $connection->table('drivers')->insert([
+        ['uuid' => FLEETOPS_TENANT_OWN_DRIVER, 'public_id' => 'driver_own1', 'company_uuid' => 'company-1', 'user_uuid' => 'user-own'],
+        ['uuid' => FLEETOPS_TENANT_VICTIM_DRIVER, 'public_id' => 'driver_victim1', 'company_uuid' => 'company-2', 'user_uuid' => 'user-victim'],
+    ]);
+    $connection->table('payloads')->insert([
+        ['uuid' => 'payload-own', 'company_uuid' => 'company-1'],
+        ['uuid' => 'payload-victim', 'company_uuid' => 'company-2'],
+    ]);
+    $connection->table('tracking_numbers')->insert([
+        ['uuid' => 'tn-own', 'company_uuid' => 'company-1', 'tracking_number' => 'FLB-OWN-1'],
+        ['uuid' => 'tn-victim', 'company_uuid' => 'company-2', 'tracking_number' => 'FLB-VICTIM-1'],
+    ]);
+    $connection->table('orders')->insert([
+        [
+            'uuid'                 => FLEETOPS_TENANT_OWN_ORDER,
+            'public_id'            => 'order_own1',
+            'company_uuid'         => 'company-1',
+            'payload_uuid'         => 'payload-own',
+            'tracking_number_uuid' => 'tn-own',
+            'driver_assigned_uuid' => FLEETOPS_TENANT_OWN_DRIVER,
+            'status'               => 'created',
+            'type'                 => 'transport',
+        ],
+        [
+            'uuid'                 => FLEETOPS_TENANT_VICTIM_ORDER,
+            'public_id'            => 'order_victim1',
+            'company_uuid'         => 'company-2',
+            'payload_uuid'         => 'payload-victim',
+            'tracking_number_uuid' => 'tn-victim',
+            'driver_assigned_uuid' => FLEETOPS_TENANT_VICTIM_DRIVER,
+            'status'               => 'created',
+            'type'                 => 'transport',
+        ],
+    ]);
+    $connection->table('entities')->insert([
+        ['uuid' => 'entity-own', 'company_uuid' => 'company-1', 'payload_uuid' => 'payload-own', 'name' => 'Own Parcel'],
+        ['uuid' => 'entity-victim', 'company_uuid' => 'company-2', 'payload_uuid' => 'payload-victim', 'name' => 'Victim Parcel'],
+    ]);
+    $connection->table('proofs')->insert([
+        ['uuid' => 'proof-own', 'public_id' => 'proof_own1', 'company_uuid' => 'company-1', 'order_uuid' => FLEETOPS_TENANT_OWN_ORDER, 'subject_uuid' => FLEETOPS_TENANT_OWN_ORDER],
+        ['uuid' => 'proof-victim', 'public_id' => 'proof_victim1', 'company_uuid' => 'company-2', 'order_uuid' => FLEETOPS_TENANT_VICTIM_ORDER, 'subject_uuid' => FLEETOPS_TENANT_VICTIM_ORDER],
+    ]);
+}
+
+test('order lookups resolve the callers own records', function () {
+    $connection = fleetopsOrderTenantBoot();
+    fleetopsOrderTenantSeed($connection);
+    $probe = new FleetOpsInternalOrderTenantScopeProbe();
+
+    expect($probe->callHelper('ordersByUuid', [FLEETOPS_TENANT_OWN_ORDER])->pluck('uuid')->all())->toBe([FLEETOPS_TENANT_OWN_ORDER])
+        ->and($probe->callHelper('findOrderByUuid', FLEETOPS_TENANT_OWN_ORDER)?->public_id)->toBe('order_own1')
+        ->and($probe->callHelper('findOrderById', FLEETOPS_TENANT_OWN_ORDER)?->public_id)->toBe('order_own1')
+        ->and($probe->callHelper('findOrderById', 'order_own1')?->uuid)->toBe(FLEETOPS_TENANT_OWN_ORDER)
+        ->and($probe->callHelper('findOrderRouteForEdit', FLEETOPS_TENANT_OWN_ORDER)?->uuid)->toBe(FLEETOPS_TENANT_OWN_ORDER)
+        ->and($probe->callHelper('findOrderForStart', FLEETOPS_TENANT_OWN_ORDER)?->uuid)->toBe(FLEETOPS_TENANT_OWN_ORDER)
+        ->and($probe->callHelper('findPayloadForStart', 'payload-own')?->uuid)->toBe('payload-own')
+        ->and($probe->callHelper('findOrderForSchedule', 'order_own1')?->uuid)->toBe(FLEETOPS_TENANT_OWN_ORDER)
+        ->and($probe->callHelper('findOrderForProofs', FLEETOPS_TENANT_OWN_ORDER)?->uuid)->toBe(FLEETOPS_TENANT_OWN_ORDER)
+        ->and($probe->callHelper('findOrderForDriverPing', 'order_own1')?->uuid)->toBe(FLEETOPS_TENANT_OWN_ORDER)
+        ->and($probe->callHelper('findEntityProofSubject', 'entity-own')?->uuid)->toBe('entity-own')
+        ->and($probe->callHelper('resolveProof', 'proof_own1')?->uuid)->toBe('proof-own')
+        ->and($probe->callHelper('resolveProof', 'proof-own')?->uuid)->toBe('proof-own');
+});
+
+test('driver lookups resolve the callers own drivers', function () {
+    $connection = fleetopsOrderTenantBoot();
+    fleetopsOrderTenantSeed($connection);
+    $probe = new FleetOpsInternalOrderTenantScopeProbe();
+
+    expect($probe->callHelper('findDriverByUuid', FLEETOPS_TENANT_OWN_DRIVER)?->public_id)->toBe('driver_own1')
+        ->and($probe->callHelper('findDriverForStart', FLEETOPS_TENANT_OWN_DRIVER)?->public_id)->toBe('driver_own1')
+        ->and($probe->callHelper('findDriverForSchedule', FLEETOPS_TENANT_OWN_DRIVER)?->public_id)->toBe('driver_own1')
+        ->and($probe->callHelper('findDriverForSchedule', 'driver_own1')?->uuid)->toBe(FLEETOPS_TENANT_OWN_DRIVER);
+});
+
+test('order lookups refuse identifiers belonging to another company', function () {
+    $connection = fleetopsOrderTenantBoot();
+    fleetopsOrderTenantSeed($connection);
+    $probe = new FleetOpsInternalOrderTenantScopeProbe();
+
+    // Both identifier arms are covered: an unguarded
+    // `where(uuid)->orWhere(public_id)->where(company_uuid)` chain would read as
+    // `uuid = ? OR (public_id = ? AND company_uuid = ?)` and still resolve the
+    // victim by uuid.
+    expect($probe->callHelper('ordersByUuid', [FLEETOPS_TENANT_VICTIM_ORDER]))->toHaveCount(0)
+        ->and($probe->callHelper('findOrderByUuid', FLEETOPS_TENANT_VICTIM_ORDER))->toBeNull()
+        ->and($probe->callHelper('findOrderById', FLEETOPS_TENANT_VICTIM_ORDER))->toBeNull()
+        ->and($probe->callHelper('findOrderById', 'order_victim1'))->toBeNull()
+        ->and($probe->callHelper('findOrderRouteForEdit', FLEETOPS_TENANT_VICTIM_ORDER))->toBeNull()
+        ->and($probe->callHelper('findOrderForStart', FLEETOPS_TENANT_VICTIM_ORDER))->toBeNull()
+        ->and($probe->callHelper('findPayloadForStart', 'payload-victim'))->toBeNull()
+        ->and($probe->callHelper('findOrderForSchedule', 'order_victim1'))->toBeNull()
+        ->and($probe->callHelper('findOrderForProofs', FLEETOPS_TENANT_VICTIM_ORDER))->toBeNull()
+        ->and($probe->callHelper('findEntityProofSubject', 'entity-victim'))->toBeNull()
+        ->and($probe->callHelper('resolveProof', 'proof_victim1'))->toBeNull()
+        ->and($probe->callHelper('resolveProof', 'proof-victim'))->toBeNull()
+        ->and($probe->callHelper('findDriverByUuid', FLEETOPS_TENANT_VICTIM_DRIVER))->toBeNull()
+        ->and($probe->callHelper('findDriverForStart', FLEETOPS_TENANT_VICTIM_DRIVER))->toBeNull()
+        ->and($probe->callHelper('findDriverForSchedule', FLEETOPS_TENANT_VICTIM_DRIVER))->toBeNull()
+        ->and($probe->callHelper('findDriverForSchedule', 'driver_victim1'))->toBeNull();
+
+    // The ping lookup reports a miss the same way it reports an unknown id, so
+    // the endpoint cannot be used to probe which ids exist in other tenants.
+    expect(fn () => $probe->callHelper('findOrderForDriverPing', 'order_victim1'))
+        ->toThrow(ModelNotFoundException::class);
+});
+
+test('the public tracking lookup finds an order by its tracking number alone', function () {
+    $connection = fleetopsOrderTenantBoot();
+    fleetopsOrderTenantSeed($connection);
+    $probe = new FleetOpsInternalOrderTenantScopeProbe();
+
+    // `fleet-ops/lookup` backs the public Track Order page: recipients have no session
+    // and the tracking number is the credential. It must work without a company, and
+    // for whichever company owns the order.
+    session(['company' => null]);
+
+    expect($probe->callHelper('findOrderByTrackingNumber', 'FLB-OWN-1')?->uuid)->toBe(FLEETOPS_TENANT_OWN_ORDER)
+        ->and($probe->callHelper('findOrderByTrackingNumber', 'FLB-VICTIM-1')?->uuid)->toBe(FLEETOPS_TENANT_VICTIM_ORDER)
+        ->and($probe->callHelper('findOrderByTrackingNumber', 'FLB-UNKNOWN'))->toBeNull();
+
+    session(['company' => 'company-1']);
+
+    expect($probe->callHelper('findOrderByTrackingNumber', 'FLB-VICTIM-1')?->uuid)->toBe(FLEETOPS_TENANT_VICTIM_ORDER);
+});
+
+test('order lookups fail closed when no company session is present', function () {
+    $connection = fleetopsOrderTenantBoot();
+    fleetopsOrderTenantSeed($connection);
+    session(['company' => null]);
+    $probe = new FleetOpsInternalOrderTenantScopeProbe();
+
+    expect($probe->callHelper('ordersByUuid', [FLEETOPS_TENANT_OWN_ORDER, FLEETOPS_TENANT_VICTIM_ORDER]))->toHaveCount(0)
+        ->and($probe->callHelper('findOrderByUuid', FLEETOPS_TENANT_OWN_ORDER))->toBeNull()
+        ->and($probe->callHelper('findOrderById', 'order_own1'))->toBeNull()
+        ->and($probe->callHelper('findDriverByUuid', FLEETOPS_TENANT_OWN_DRIVER))->toBeNull()
+        ->and($probe->callHelper('findDriverForSchedule', 'driver_own1'))->toBeNull();
+});
+
+test('order resolution by id rejects empty identifiers without querying', function () {
+    $connection = fleetopsOrderTenantBoot();
+    fleetopsOrderTenantSeed($connection);
+    $probe = new FleetOpsInternalOrderTenantScopeProbe();
+
+    // The identifier is raw request input, so a non-string body value has to
+    // resolve to no order rather than raising out of the endpoint.
+    expect($probe->callHelper('findOrderById', null))->toBeNull()
+        ->and($probe->callHelper('findOrderById', ''))->toBeNull()
+        ->and($probe->callHelper('findOrderById', ['uuid' => FLEETOPS_TENANT_OWN_ORDER]))->toBeNull()
+        ->and($probe->callHelper('findOrderById', 42))->toBeNull()
+        ->and($probe->callHelper('findOrderForSchedule', null))->toBeNull();
+});
+
+test('bulk driver assignment only touches orders the caller owns', function () {
+    $connection = fleetopsOrderTenantBoot();
+    fleetopsOrderTenantSeed($connection);
+    $connection->table('orders')->update(['driver_assigned_uuid' => null]);
+    $controller = new OrderController();
+
+    $response = $controller->bulkAssignDriver(Request::create('/x', 'PATCH', [
+        'ids'    => [FLEETOPS_TENANT_OWN_ORDER, FLEETOPS_TENANT_VICTIM_ORDER],
+        'driver' => FLEETOPS_TENANT_OWN_DRIVER,
+        'silent' => true,
+    ]));
+
+    // The victim order is dropped before the update, so it is neither
+    // reassigned nor counted in the response.
+    expect($response->getData(true)['count'])->toBe(1)
+        ->and($connection->table('orders')->where('uuid', FLEETOPS_TENANT_OWN_ORDER)->value('driver_assigned_uuid'))->toBe(FLEETOPS_TENANT_OWN_DRIVER)
+        ->and($connection->table('orders')->where('uuid', FLEETOPS_TENANT_VICTIM_ORDER)->value('driver_assigned_uuid'))->toBeNull();
+});
+
+test('bulk driver assignment refuses a driver from another company', function () {
+    $connection = fleetopsOrderTenantBoot();
+    fleetopsOrderTenantSeed($connection);
+    $controller = new OrderController();
+
+    $response = $controller->bulkAssignDriver(Request::create('/x', 'PATCH', [
+        'ids'    => [FLEETOPS_TENANT_OWN_ORDER],
+        'driver' => FLEETOPS_TENANT_VICTIM_DRIVER,
+        'silent' => true,
+    ]));
+
+    expect($response->getData(true)['error'] ?? '')->toContain('Invalid driver selected');
+});
+
+test('the bulk assignment update is itself scoped to the callers company', function () {
+    $connection = fleetopsOrderTenantBoot();
+    fleetopsOrderTenantSeed($connection);
+    $connection->table('orders')->update(['driver_assigned_uuid' => null]);
+    $probe  = new FleetOpsInternalOrderTenantScopeProbe();
+    $driver = Driver::where('uuid', FLEETOPS_TENANT_OWN_DRIVER)->first();
+
+    // Called directly with a victim uuid, standing in for any future caller
+    // that reaches this seam without pre-filtering the ids.
+    $probe->callHelper('assignDriverToOrders', [FLEETOPS_TENANT_OWN_ORDER, FLEETOPS_TENANT_VICTIM_ORDER], $driver);
+
+    expect($connection->table('orders')->where('uuid', FLEETOPS_TENANT_OWN_ORDER)->value('driver_assigned_uuid'))->toBe(FLEETOPS_TENANT_OWN_DRIVER)
+        ->and($connection->table('orders')->where('uuid', FLEETOPS_TENANT_VICTIM_ORDER)->value('driver_assigned_uuid'))->toBeNull();
+});
+
+test('bulk cancel and bulk dispatch skip orders from another company', function () {
+    $connection = fleetopsOrderTenantBoot();
+    fleetopsOrderTenantSeed($connection);
+    $controller = new OrderController();
+
+    $canceled = $controller->bulkCancel(Request::create('/x', 'PATCH', [
+        'ids' => [FLEETOPS_TENANT_VICTIM_ORDER],
+    ]));
+    expect($canceled->getData(true)['count'])->toBe(0)
+        ->and($connection->table('orders')->where('uuid', FLEETOPS_TENANT_VICTIM_ORDER)->value('status'))->toBe('created');
+
+    $dispatched = $controller->bulkDispatch(BulkDispatchRequest::create('/x', 'POST', [
+        'ids' => [FLEETOPS_TENANT_VICTIM_ORDER],
+    ]));
+    expect($dispatched->getData(true)['count'])->toBe(0)
+        ->and($connection->table('orders')->where('uuid', FLEETOPS_TENANT_VICTIM_ORDER)->value('dispatched'))->toBeNull();
+});
+
+test('cancel rejects a known order uuid that belongs to another company', function () {
+    $connection = fleetopsOrderTenantBoot();
+    fleetopsOrderTenantSeed($connection);
+
+    // `exists:orders,uuid` on CancelOrderRequest is a global existence check, so
+    // this uuid passes validation and the controller itself has to refuse it.
+    $response = (new OrderController())->cancel(
+        CancelOrderRequest::create('/x', 'PATCH', ['order' => FLEETOPS_TENANT_VICTIM_ORDER])
+    );
+
+    expect($response->getData(true)['error'] ?? '')->toContain('No order found to cancel')
+        ->and($connection->table('orders')->where('uuid', FLEETOPS_TENANT_VICTIM_ORDER)->value('status'))->toBe('created');
+});
+
+test('dispatch start and schedule refuse another companys order', function () {
+    $connection = fleetopsOrderTenantBoot();
+    fleetopsOrderTenantSeed($connection);
+    $controller = new OrderController();
+
+    $dispatched = $controller->dispatchOrder(Request::create('/x', 'PATCH', ['order' => FLEETOPS_TENANT_VICTIM_ORDER]));
+    expect($dispatched->getData(true)['error'] ?? '')->toContain('No order found to dispatch');
+
+    $started = $controller->start(Request::create('/x', 'PATCH', ['order' => FLEETOPS_TENANT_VICTIM_ORDER]));
+    expect($started->getData(true)['error'] ?? '')->toContain('Unable to find order to start');
+
+    $scheduled = $controller->scheduleOrder(Request::create('/x', 'PATCH', [
+        'order'        => FLEETOPS_TENANT_VICTIM_ORDER,
+        'scheduled_at' => '2026-01-01 09:00:00',
+    ]));
+    expect($scheduled->getData(true)['error'] ?? '')->toContain('No order found to schedule')
+        ->and($connection->table('orders')->where('uuid', FLEETOPS_TENANT_VICTIM_ORDER)->value('scheduled_at'))->toBeNull()
+        ->and($connection->table('drivers')->where('uuid', FLEETOPS_TENANT_VICTIM_DRIVER)->value('current_job_uuid'))->toBeNull();
+});
+
+test('schedule ignores a driver from another company', function () {
+    $connection = fleetopsOrderTenantBoot();
+    fleetopsOrderTenantSeed($connection);
+    $connection->table('orders')->where('uuid', FLEETOPS_TENANT_OWN_ORDER)->update(['driver_assigned_uuid' => null]);
+
+    $response = (new OrderController())->scheduleOrder(Request::create('/x', 'PATCH', [
+        'order'     => FLEETOPS_TENANT_OWN_ORDER,
+        'driver_id' => 'driver_victim1',
+    ]));
+
+    expect($response->getData(true)['status'])->toBe('OK')
+        ->and($connection->table('orders')->where('uuid', FLEETOPS_TENANT_OWN_ORDER)->value('driver_assigned_uuid'))->toBeNull();
+});
+
+test('activity destination and next-activity endpoints refuse another companys order', function () {
+    $connection = fleetopsOrderTenantBoot();
+    fleetopsOrderTenantSeed($connection);
+    $controller = new OrderController();
+
+    $nextActivity = $controller->nextActivity('order_victim1', Request::create('/x', 'GET'));
+    expect($nextActivity->getData(true))->toBe(['error' => 'No order found.']);
+
+    $updateActivity = $controller->updateActivity(FLEETOPS_TENANT_VICTIM_ORDER, Request::create('/x', 'PATCH', ['activity' => []]));
+    expect($updateActivity->getData(true))->toBe(['error' => 'No order found.']);
+
+    $setDestination = $controller->setDestination(FLEETOPS_TENANT_VICTIM_ORDER, 'place-victim');
+    expect($setDestination->getData(true))->toBe(['error' => 'No order found.']);
+
+    $trackerInfo = $controller->trackerInfo(Request::create('/x', 'GET'), FLEETOPS_TENANT_VICTIM_ORDER);
+    expect($trackerInfo->getData(true))->toBe(['error' => 'No order found.']);
+
+    $waypointEtas = $controller->waypointEtas(Request::create('/x', 'GET'), FLEETOPS_TENANT_VICTIM_ORDER);
+    expect($waypointEtas->getData(true))->toBe(['error' => 'No order found.']);
+
+    $editRoute = $controller->editOrderRoute(FLEETOPS_TENANT_VICTIM_ORDER, Request::create('/x', 'PATCH'));
+    expect($editRoute->getData(true)['error'] ?? '')->toContain('Unable to find order to update route for');
+});
+
+test('proofs endpoint refuses another companys order', function () {
+    $connection = fleetopsOrderTenantBoot();
+    fleetopsOrderTenantSeed($connection);
+
+    $response = (new OrderController())->proofs(Request::create('/x', 'GET'), FLEETOPS_TENANT_VICTIM_ORDER);
+
+    expect($response->getData(true)['error'] ?? '')->toContain('Unable to retrieve proof');
+});

package/server/tests/Feature/Http/Internal/OrderControllerUpstreamNotFoundTest.php

@@ -6,27 +6,15 @@ use Illuminate\Http\Request;
 /**
  * Covers the not-found branch of Internal\v1\OrderController::nextActivity().
  *
- * ---------------------------------------------------------------------------
- * THIS FILE IS EXPECTED TO FAIL until fleetbase/core-api 1.6.55 is released and
- * pulled into server_vendor. Do not "fix" it by weakening the assertion.
- * ---------------------------------------------------------------------------
+ * This branch used to depend on upstream behaviour that never fired: the
+ * controller wrapped `Order::findByIdOrFail($id)` in a
+ * `catch (ModelNotFoundException)`, but core-api's findByIdOrFail() raised a
+ * BadMethodCallException that escaped the catch and surfaced as a 500.
  *
- * The controller wraps `Order::findByIdOrFail($id)` in a
- * `catch (ModelNotFoundException)` that returns 'No order found.'. Today that
- * catch never fires: core-api's Model::findByIdOrFail() calls a
- * getModelNotFoundException() method that does not exist on Eloquent's builder,
- * so a missing order raises BadMethodCallException, escapes the catch, and
- * surfaces as a 500 instead of the intended error response.
- *
- * core-api#231 (branch dev-v1.6.55) replaces that with
- * `throw (new ModelNotFoundException())->setModel(static::class, [$identifier]);`
- * which makes this branch live. The assertion below states the post-fix
- * contract deliberately — asserting today's BadMethodCallException would
- * codify the defect instead of the intent.
- *
- * If CI must be green before that release lands, neutralise this file with a
- * single `->skip('pending fleetbase/core-api 1.6.55')` on the test below rather
- * than changing what it asserts.
+ * nextActivity() now resolves the order through the controller's own
+ * company-scoped `findOrderById()` and returns the error response on a null
+ * result, so the branch is live here regardless of the upstream release: an
+ * unknown id and an id belonging to another company are reported identically.
  */
 function fleetopsUpstreamNotFoundBoot(): Illuminate\Database\SQLiteConnection
 {

package/server/tests/Feature/Http/ManualTelemetryPollingTest.php

@@ -104,10 +104,11 @@ class ManualTelemetryProvider extends ExampleTelemetryProvider
     public array $requests = [];
     public bool $fail      = false;
     public ?int $failOnCall = null;
+    public bool $polling    = true;
 
     public function telemetryOptions(): array
     {
-        return array_merge(parent::telemetryOptions(), ['manual_batch_sync' => true, 'batch_size' => 1, 'webhooks_enabled' => false]);
+        return array_merge(parent::telemetryOptions(), ['manual_batch_sync' => true, 'batch_size' => 1, 'webhooks_enabled' => false, 'polling_enabled' => $this->polling]);
     }
 
     public function fetchDevices(array $options = []): array
@@ -213,13 +214,37 @@ test('old queued discovery jobs delegate without entering their legacy lock or H
     }
 });
 
-test('old queued discovery jobs finish quietly when a scheduled poll already holds the request', function () {
+test('manual requests made while a scheduled sweep holds the poll lease are completed by the next sweep', function () {
     [$connection, $provider, $registry, $service] = manualTelemetrySetup();
-    expect(Fleetbase\FleetOps\Support\Telematics\Telemetry\Queue::dispatch(new PollTelematicTelemetry($connection->uuid)))->toBeTrue();
+    $scheduled                                    = new PollTelematicTelemetry($connection->uuid);
+    expect(Fleetbase\FleetOps\Support\Telematics\Telemetry\Queue::dispatch($scheduled))->toBeTrue();
+    $id = $service->discoverDevices($connection);
+    // Old queued discovery jobs join the same pending request instead of failing.
+    (new SyncTelematicDevicesJob($connection->fresh(), [], 'old-job'))->handle($registry, $service);
+    $waiting = $connection->fresh();
+    expect(count($GLOBALS['manual_telemetry_jobs']))->toBe(1)
+        ->and($waiting->status)->toBe('synchronizing')
+        ->and(data_get($waiting->meta, 'last_sync_job_id'))->toBe($id)
+        ->and(data_get($waiting->meta, 'last_sync_phase'))->toBe('waiting_for_sweep');
+    ExampleTelemetryProvider::$pages = [['devices' => [manualTelemetrySample()], 'has_more' => false, 'next_cursor' => null]];
+    $scheduled->handle($registry, new Inbox());
+    expect(data_get($connection->fresh()->meta, 'last_sync_result'))->toBe('running');
+    manualTelemetryProcessPending($service);
+    $fresh = $connection->fresh();
+    expect($fresh->status)->toBe('active')
+        ->and(data_get($fresh->meta, 'last_sync_job_id'))->toBe($id)
+        ->and(data_get($fresh->meta, 'last_sync_result'))->toBe('success')
+        ->and(data_get($fresh->meta, 'last_sync_completed_at'))->toBe('2026-09-15 12:00:00')
+        ->and(data_get($fresh->meta, 'last_sync_total'))->toBe(1);
+});
+
+test('old queued discovery jobs finish quietly when polling was paused after they were queued', function () {
+    [$connection, $provider, $registry, $service] = manualTelemetrySetup();
+    $provider->polling = false;
     (new SyncTelematicDevicesJob($connection, [], 'old-job'))->handle($registry, $service);
     $fresh = $connection->fresh();
     // A thrown ValidationException would fail the tries=1 job and mark this connection as errored.
-    expect(count($GLOBALS['manual_telemetry_jobs']))->toBe(1)
+    expect(count($GLOBALS['manual_telemetry_jobs']))->toBe(0)
         ->and($fresh->status)->toBe('active')
         ->and(data_get($fresh->meta, 'last_sync_job_id'))->toBeNull();
 });
@@ -459,3 +484,62 @@ test('manual sync re-checks the locked connection before queueing', function ()
     expect(count($GLOBALS['manual_telemetry_jobs']))->toBe(0)
         ->and(DB::table('telematics')->value('status'))->toBe('disabled');
 });
+
+
+function manualTelemetryConnectionState(Telematic $connection, string $status, array $meta): void
+{
+    DB::table('telematics')->where('uuid', $connection->uuid)->update(['status' => $status, 'meta' => json_encode($meta)]);
+}
+
+test('completed scheduled sweeps replace a stale sync failure without saving through the model', function () {
+    [$connection, $provider, $registry, $service] = manualTelemetrySetup();
+    manualTelemetryConnectionState($connection, 'error', [
+        'last_sync_job_id' => 'lost-request', 'last_sync_result' => 'failed', 'last_sync_error' => 'Polling retries exhausted. MaxAttemptsExceededException',
+        'last_sync_completed_at' => '2026-06-24 07:32:18', 'preserved' => 'yes',
+    ]);
+    ExampleTelemetryProvider::$pages = [['devices' => [manualTelemetrySample()], 'has_more' => false, 'next_cursor' => null]];
+    (new PollTelematicTelemetry($connection->uuid))->handle($registry, new Inbox());
+    manualTelemetryProcessPending($service);
+    $fresh = $connection->fresh();
+    expect($fresh->status)->toBe('active')
+        ->and(data_get($fresh->meta, 'last_sync_result'))->toBe('success')
+        ->and(data_get($fresh->meta, 'last_sync_error'))->toBeNull()
+        ->and(data_get($fresh->meta, 'last_sync_completed_at'))->toBe('2026-09-15 12:00:00')
+        ->and(data_get($fresh->meta, 'last_sync_fetched_total'))->toBe(1)
+        ->and(data_get($fresh->meta, 'last_sync_job_id'))->toBe('lost-request')
+        ->and(data_get($fresh->meta, 'preserved'))->toBe('yes')
+        ->and($fresh->updated_at)->toBeNull();
+});
+
+test('partial scheduled sweeps leave the last reported sync state unchanged', function () {
+    [$connection, $provider, $registry, $service] = manualTelemetrySetup();
+    manualTelemetryConnectionState($connection, 'error', ['last_sync_result' => 'failed', 'last_sync_error' => 'Earlier failure']);
+    ExampleTelemetryProvider::$pages = [['devices' => [manualTelemetrySample()], 'has_more' => false, 'next_cursor' => null]];
+    (new PollTelematicTelemetry($connection->uuid))->handle($registry, new Inbox());
+    $run = DB::table('telematic_sync_runs')->value('uuid');
+    DB::table('telematic_deliveries')->update(['status' => 'quarantined', 'failed' => 1]);
+    Inbox::finishRun($run);
+    $fresh = $connection->fresh();
+    expect(DB::table('telematic_sync_runs')->value('status'))->toBe('partial')
+        ->and($fresh->status)->toBe('error')
+        ->and(data_get($fresh->meta, 'last_sync_error'))->toBe('Earlier failure');
+});
+
+test('scheduled sweeps adopt abandoned requests but never one bound to a sweep in progress', function (string $boundStatus, bool $adopted) {
+    [$connection, $provider, $registry, $service] = manualTelemetrySetup();
+    DB::table('telematic_sync_runs')->insert(['uuid' => 'bound-run', 'telematic_uuid' => $connection->uuid, 'status' => $boundStatus, 'created_at' => now(), 'updated_at' => now()]);
+    manualTelemetryConnectionState($connection, 'synchronizing', [
+        'last_sync_job_id' => 'abandoned-request', 'last_sync_result' => 'retrying',
+        'last_sync_run_uuid' => 'bound-run', 'last_sync_run_job_id' => 'abandoned-request',
+    ]);
+    ExampleTelemetryProvider::$pages = [['devices' => [manualTelemetrySample()], 'has_more' => false, 'next_cursor' => null]];
+    (new PollTelematicTelemetry($connection->uuid))->handle($registry, new Inbox());
+    manualTelemetryProcessPending($service);
+    $fresh = $connection->fresh();
+    expect($fresh->status)->toBe($adopted ? 'active' : 'synchronizing')
+        ->and(data_get($fresh->meta, 'last_sync_result'))->toBe($adopted ? 'success' : 'retrying')
+        ->and(data_get($fresh->meta, 'last_sync_run_uuid'))->toBe($adopted ? DB::table('telematic_sync_runs')->where('uuid', '!=', 'bound-run')->value('uuid') : 'bound-run');
+})->with([
+    'interrupted run' => ['incomplete', true],
+    'run still ingesting' => ['ingesting', false],
+]);