@fleetbase/fleetops-engine 0.6.67 → 0.6.69

package/docs/TELEMATICS_QUEUES.md

@@ -51,28 +51,56 @@ no worker wait indefinitely.
 
 ### 1. Add telematics workers
 
-Add worker services with the same image, environment, and volumes as the existing
-`queue` service. Change only the command and healthcheck. Docker Compose example:
+Each telematics worker must be an exact copy of the existing `queue` worker: the
+same image and tag, the same `env_file`, `environment`, volumes and `depends_on`,
+including every Compose override file that changes `queue`. Change only the command.
+Workers running a different build, or missing `APP_KEY`, fail every telematics job.
+
+Docker Compose example, assuming `queue` is defined in `docker-compose.yml` and any
+image or environment overrides for it live in `docker-compose.override.yml`:
 
 ```yaml
+# docker-compose.yml: copy the full `queue` service definition, then change the command.
 services:
   telematics-queue:
-    image: fleetbase/fleetbase-api:latest
+    # image, env_file, environment, volumes, depends_on: identical to `queue`
     command: ["php", "artisan", "queue:work", "--queue=telematics", "--sleep=1", "--max-time=3600"]
     restart: unless-stopped
     deploy:
       replicas: 2
-    # environment, volumes and depends_on: copy from the existing `queue` service
 
   telematics-broadcast-queue:
-    image: fleetbase/fleetbase-api:latest
+    # image, env_file, environment, volumes, depends_on: identical to `queue`
     command: ["php", "artisan", "queue:work", "--queue=telematics-broadcasts", "--sleep=1", "--max-time=3600"]
     restart: unless-stopped
-    # environment, volumes and depends_on: copy from the existing `queue` service
+```
+
+```yaml
+# docker-compose.override.yml: repeat every override that applies to `queue`.
+services:
+  telematics-queue:
+    image: "fleetbase-api:latest"   # the same image as `queue`
+  telematics-broadcast-queue:
+    image: "fleetbase-api:latest"
 ```
 
 Notes:
 
+- **Use the same image as `queue`, not a separate `fleetbase/fleetbase-api:latest`.**
+  Docker does not download a newer `latest` when a copy already exists locally, so a
+  new service can start from an old cached image. If you do use a registry image,
+  pin a version tag and pull it for every API container together.
+- **Every API container needs the same `APP_KEY`**: application, scheduler, the
+  default worker and the telematics workers. Provider credentials, token caches and
+  telematics deliveries are encrypted with it. If only the application service
+  receives it (for example through a mounted `.env` or an override), put it in a
+  shared `env_file` instead. Never generate a new key for a worker.
+- **Check the merged configuration, including when using `extends`.** Run
+  `docker compose config` and compare the resolved `image`, `env_file` and
+  `environment` of `queue` and each telematics service before deploying.
+- The `--queue` names must match the variables in step 2 exactly. A worker listening
+  on `telematics-broadcast` while broadcasts go to `telematics-broadcasts` receives
+  nothing.
 - Leave the existing `queue` service unchanged. `queue:work` without `--queue`
   processes the connection's default queue (`REDIS_QUEUE`, normally `default`).
 - Leave `--timeout` at its default (60 seconds) or set any value below the Redis
@@ -83,8 +111,6 @@ Notes:
   memory. `restart: unless-stopped` starts them again.
 - On Kubernetes, ECS, or another platform, create equivalent deployments with the
   same image, environment, and commands.
-- Every worker container needs the same `APP_KEY`, database, Redis, and broadcasting
-  settings as the application. Deliveries are encrypted with `APP_KEY`.
 
 ### 2. Set the queue variables for this instance only
 
@@ -154,6 +180,19 @@ of 50 requests per second per account across all workers.
 
 ## Verification
 
+First confirm every API container runs the same build and application key. Each line
+must show the same key fingerprint (a hash, never the key) and Fleet-Ops version:
+
+```bash
+for c in $(docker ps --format '{{.Names}}' | grep -E 'application|scheduler|queue'); do echo "== $c $(docker inspect --format '{{.Config.Image}}' $c)"; docker exec $c php artisan tinker --execute="echo config('app.key') ? substr(hash('sha256', config('app.key')), 0, 12) : 'MISSING', ' ', json_decode(file_get_contents('vendor/fleetbase/fleetops-api/composer.json'))->version, PHP_EOL;"; done
+```
+
+Confirm Laravel loaded the queue names in the application and a telematics worker:
+
+```bash
+php artisan config:show telematics.telemetry
+```
+
 Queue depth should stay close to zero between minute ticks:
 
 ```bash
@@ -168,6 +207,18 @@ Also verify:
   on the telematics workers, and broadcast jobs only on the broadcast worker.
 - Other jobs on `default`, such as notifications and order events, start promptly
   again.
+- The connection's status and "Last sync" update after each completed scheduled
+  sweep. Clicking "Sync Devices" while a sweep is queued or running records the
+  request, and the next sweep completes it.
+
+## Troubleshooting
+
+| Symptom | Cause |
+| --- | --- |
+| Telematics worker logs show `MissingAppKeyException` | The worker has no `APP_KEY`. Give every API container the same key and recreate the workers. |
+| A worker reports a different Fleet-Ops version | The worker uses a different or stale cached image. Use the `queue` service's image. |
+| Broadcast jobs are never processed | The broadcast worker's `--queue` name does not match `TELEMATICS_BROADCAST_QUEUE`. |
+| Scheduled sync commands report `Queued 0 telematics sync job(s)` for an enabled connection | A poll job failed on a worker that could not load it, leaving its one-hour uniqueness lock. It expires on its own; after fixing the workers you can release it with `Cache::lock('laravel_unique_job:Fleetbase\\FleetOps\\Jobs\\PollTelematicTelemetry' . $telematicUuid)->forceRelease()`. |
 
 ## Rollback
 

package/extension.json

@@ -1,6 +1,6 @@
 {
     "name": "Fleet-Ops",
-    "version": "0.6.67",
+    "version": "0.6.69",
     "description": "Fleet & Transport Management Extension for Fleetbase",
     "repository": "https://github.com/fleetbase/fleetops",
     "license": "AGPL-3.0-or-later",

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@fleetbase/fleetops-engine",
-    "version": "0.6.67",
+    "version": "0.6.69",
     "description": "Fleet & Transport Management Extension for Fleetbase",
     "fleetbase": {
         "route": "fleet-ops"
@@ -45,8 +45,8 @@
     "dependencies": {
         "@babel/core": "^7.23.2",
         "@fleetbase/ember-core": "^0.3.24",
-        "@fleetbase/ember-ui": "^0.4.1",
-        "@fleetbase/fleetops-data": "^0.2.1",
+        "@fleetbase/ember-ui": "^0.4.3",
+        "@fleetbase/fleetops-data": "^0.2.2",
         "@fleetbase/leaflet-routing-machine": "^3.2.17",
         "@fortawesome/ember-fontawesome": "^2.0.0",
         "@fortawesome/fontawesome-svg-core": "6.4.0",

package/scripts/pest-bootstrap.php

@@ -382,6 +382,18 @@ if (!interface_exists('Fleetbase\Ai\Contracts\AIActionCapabilityInterface')) {
     eval('namespace Fleetbase\Ai\Contracts; interface AIActionCapabilityInterface {}');
 }
 
+if (!interface_exists('Fleetbase\Ai\Contracts\AIToolCapabilityInterface')) {
+    eval('namespace Fleetbase\Ai\Contracts; interface AIToolCapabilityInterface {}');
+}
+
+if (!class_exists('Fleetbase\Ai\Support\AiAudience')) {
+    eval('namespace Fleetbase\Ai\Support; class AiAudience { public function __construct(public bool $isSystemAdmin = false, public array $granted = []) {} public function can(string $permission): bool { return $this->isSystemAdmin || in_array($permission, $this->granted, true); } public function canAll(array $permissions): bool { foreach ($permissions as $permission) { if (!$this->can($permission)) { return false; } } return true; } }');
+}
+
+if (!class_exists('Fleetbase\Ai\Support\AiToolContext')) {
+    eval('namespace Fleetbase\Ai\Support; class AiToolContext { public array $actionPreviews = []; public array $uiActions = []; public function __construct(public $task, public $audience) {} public function addActionPreview($capability, array $preview): array { $preview = array_merge(["preview_id" => "preview-" . (count($this->actionPreviews) + 1), "key" => $capability->key()], $preview); $this->actionPreviews[] = $preview; return $preview; } }');
+}
+
 if (!class_exists('Fleetbase\Ai\Models\AiTask')) {
     eval('namespace Fleetbase\Ai\Models; class AiTask { public function __construct(array $attributes = []) { foreach ($attributes as $key => $value) { $this->{$key} = $value; } } }');
 }

package/server/config/fuel-providers.php

@@ -55,9 +55,62 @@ return [
                 'auth_type' => 'ws_sk_header',
                 'supported_auth_types' => ['ws_sk_header', 'bearer_token'],
                 'base_urls' => \Fleetbase\FleetOps\Support\FuelProviders\Providers\PetroAppFuelProvider::BASE_URLS,
+                'environment_labels' => ['sandbox' => 'Sandbox (PetroApp staging)', 'production' => 'Production'],
                 'pagination' => 'page',
                 'default_currency' => 'SAR',
             ],
         ],
+        [
+            'key' => 'sasco',
+            'label' => 'SASCO',
+            'type' => 'native',
+            'category' => 'Fuel card integration',
+            'icon' => 'gas-pump',
+            'driver_class' => \Fleetbase\FleetOps\Support\FuelProviders\Providers\SascoFuelProvider::class,
+            'description' => 'SASCO B2B fleet fuel transactions and vehicles.',
+            'required_fields' => [
+                [
+                    'name' => 'username',
+                    'label' => 'B2B admin username',
+                    'type' => 'text',
+                    'help_text' => 'The SASCO B2B company admin login, usually an email address.',
+                    'required' => true,
+                ],
+                [
+                    'name' => 'password',
+                    'label' => 'B2B admin password',
+                    'type' => 'password',
+                    'help_text' => 'Used to request a short-lived access token from SASCO. Fleetbase re-authenticates automatically when it expires.',
+                    'required' => true,
+                ],
+                [
+                    'name' => 'base_url',
+                    'label' => 'Base URL override (optional)',
+                    'type' => 'url',
+                    'help_text' => 'Leave blank to use the selected environment. A custom URL overrides the environment selection.',
+                    'required' => false,
+                ],
+            ],
+            'capabilities' => ['vehicles', 'transactions'],
+            'sync_defaults' => [
+                'window_days' => 7,
+                'matching_order' => ['plate_number', 'internal_id', 'vin', 'serial_number', 'call_sign', 'fuel_card_number', 'trip_number'],
+                'auto_create_fuel_reports' => true,
+            ],
+            'setup_instructions' => [
+                'Request B2B API access from SASCO and obtain the company admin username and password for QC/UAT and Production.',
+                'Select Sandbox for the SASCO QC environment, enter the credentials, and run Test Connection.',
+                'SASCO transactions carry the vehicle plate only, so make sure Fleetbase vehicle plate numbers use the letters-then-digits format (for example NXD 1240).',
+                'Sync a small date window first to verify imported fuel transactions and vehicle matches.',
+            ],
+            'metadata' => [
+                'auth_type' => 'username_password',
+                'supported_auth_types' => ['username_password'],
+                'base_urls' => \Fleetbase\FleetOps\Support\FuelProviders\Providers\SascoFuelProvider::BASE_URLS,
+                'environment_labels' => ['sandbox' => 'Sandbox (SASCO QC)', 'production' => 'Production'],
+                'pagination' => 'current_page',
+                'default_currency' => 'SAR',
+            ],
+        ],
     ],
 ];

package/server/migrations/2026_09_21_000001_convert_profile_only_users_to_managed_accounts.php

@@ -0,0 +1,132 @@
+<?php
+
+use Illuminate\Database\Migrations\Migration;
+use Illuminate\Support\Facades\DB;
+use Illuminate\Support\Facades\Schema;
+
+/*
+ * Driver and customer login accounts are now managed by their FleetOps
+ * profile (user type `driver` or `customer`) instead of in IAM.
+ *
+ * Before this change the driver form created plain `user` accounts holding only
+ * the Driver role, so these accounts show up in IAM and can sign in to the
+ * console. This converts them to managed accounts. An account is converted only
+ * when it is clearly a profile login and nothing else: it has a driver or
+ * customer profile, every organization role it holds is the profile's role, it
+ * has no direct permissions or policies, and it owns no organization. Anything
+ * else is left as a team member.
+ *
+ * The previous type is kept in `meta.previous_type` so down() can revert it.
+ */
+return new class extends Migration {
+    private const PROFILE_ROLES = [
+        'driver'   => 'Driver',
+        'customer' => 'Fleet-Ops Customer',
+    ];
+
+    public function up(): void
+    {
+        if (!$this->hasRequiredTables()) {
+            return;
+        }
+
+        DB::table('users')
+            ->select(['uuid', 'meta'])
+            ->where('type', 'user')
+            ->whereNull('deleted_at')
+            ->where(function ($query) {
+                $query->whereExists(function ($query) {
+                    $query->selectRaw(1)->from('drivers')->whereColumn('drivers.user_uuid', 'users.uuid')->whereNull('drivers.deleted_at');
+                })->orWhereExists(function ($query) {
+                    $query->selectRaw(1)->from('contacts')->whereColumn('contacts.user_uuid', 'users.uuid')->where('contacts.type', 'customer')->whereNull('contacts.deleted_at');
+                });
+            })
+            ->whereNotExists(function ($query) {
+                $query->selectRaw(1)->from('companies')->whereColumn('companies.owner_uuid', 'users.uuid');
+            })
+            ->orderBy('uuid')
+            ->chunk(500, function ($users) {
+                foreach ($users as $user) {
+                    $type = $this->managedTypeFor($user->uuid);
+                    if (!$type) {
+                        continue;
+                    }
+
+                    $meta                  = json_decode($user->meta ?? '', true);
+                    $meta                  = is_array($meta) ? $meta : [];
+                    $meta['previous_type'] = 'user';
+
+                    DB::table('users')->where('uuid', $user->uuid)->update(['type' => $type, 'meta' => json_encode($meta)]);
+                }
+            });
+    }
+
+    public function down(): void
+    {
+        if (!Schema::hasTable('users')) {
+            return;
+        }
+
+        DB::table('users')
+            ->select(['uuid', 'meta'])
+            ->whereIn('type', array_keys(self::PROFILE_ROLES))
+            ->where('meta', 'like', '%"previous_type"%')
+            ->orderBy('uuid')
+            ->chunk(500, function ($users) {
+                foreach ($users as $user) {
+                    $meta = json_decode($user->meta ?? '', true);
+                    if (!is_array($meta) || ($meta['previous_type'] ?? null) !== 'user') {
+                        continue;
+                    }
+
+                    unset($meta['previous_type']);
+                    DB::table('users')->where('uuid', $user->uuid)->update(['type' => 'user', 'meta' => json_encode($meta)]);
+                }
+            });
+    }
+
+    /**
+     * The managed type for the account, or null when it should stay a team member.
+     */
+    private function managedTypeFor(string $userUuid): ?string
+    {
+        $hasDriver   = DB::table('drivers')->where('user_uuid', $userUuid)->whereNull('deleted_at')->exists();
+        $hasCustomer = DB::table('contacts')->where('user_uuid', $userUuid)->where('type', 'customer')->whereNull('deleted_at')->exists();
+
+        // An account holding both kinds of profile is a person the organization
+        // relates to in two ways; leave it for an administrator to decide.
+        if ($hasDriver === $hasCustomer) {
+            return null;
+        }
+
+        $type             = $hasDriver ? 'driver' : 'customer';
+        $companyUserUuids = DB::table('company_users')->where('user_uuid', $userUuid)->whereNull('deleted_at')->pluck('uuid');
+        $modelUuids       = $companyUserUuids->push($userUuid)->all();
+
+        $roles = DB::table('model_has_roles')
+            ->join('roles', 'roles.id', '=', 'model_has_roles.role_id')
+            ->whereIn('model_has_roles.model_uuid', $modelUuids)
+            ->pluck('roles.name')
+            ->unique();
+
+        if ($roles->isEmpty() || $roles->contains(fn ($role) => $role !== self::PROFILE_ROLES[$type])) {
+            return null;
+        }
+
+        $hasPermissions = DB::table('model_has_permissions')->whereIn('model_uuid', $modelUuids)->exists();
+        $hasPolicies    = DB::table('model_has_policies')->whereIn('model_uuid', $modelUuids)->exists();
+
+        return $hasPermissions || $hasPolicies ? null : $type;
+    }
+
+    private function hasRequiredTables(): bool
+    {
+        foreach (['users', 'drivers', 'contacts', 'companies', 'company_users', 'roles', 'model_has_roles', 'model_has_permissions', 'model_has_policies'] as $table) {
+            if (!Schema::hasTable($table)) {
+                return false;
+            }
+        }
+
+        return true;
+    }
+};

package/server/resources/views/mail/driver-credentials.blade.php

@@ -0,0 +1,21 @@
+<x-mail-layout>
+<h2 style="font-size: 18px; font-weight: 600;">
+Your driver sign-in details
+</h2>
+
+Hi {{ $user->name }},
+<br />
+<br />
+{{ $companyName }} has set up your driver account. Use these details to sign in to the driver app.
+<br />
+<br />
+<strong>Your sign-in details</strong>
+<br />
+Login: {{ $identity }}
+<br />
+Temporary password: {{ $plaintextPassword }}
+<br />
+<br />
+You can change your password after signing in.
+
+</x-mail-layout>

package/server/src/Console/Commands/FixCustomerCompanies.php

@@ -68,7 +68,7 @@ class FixCustomerCompanies extends Command
                     $this->line('Found user ' . $user->name . ' (' . $user->email . ') which doesnt have correct company assignment.');
                     $company = $this->companyByUuid($customer->company_uuid);
                     if ($company) {
-                        $user->assignCompany($company);
+                        $user->assignCompany($company, 'Fleet-Ops Customer');
                         $this->line('User ' . $user->email . ' was assigned to company: ' . $company->name);
                     }
                 }

package/server/src/Console/Commands/FixDriverCompanies.php

@@ -49,7 +49,7 @@ class FixDriverCompanies extends Command
                     $this->line('Found driver ' . $user->name . ' (' . $user->email . ') which doesnt have correct company assignment.');
                     $company = $this->companyByUuid($driver->company_uuid);
                     if ($company) {
-                        $user->assignCompany($company);
+                        $user->assignCompany($company, 'Driver');
                         $this->line('Driver ' . $user->email . ' was assigned to company: ' . $company->name);
                     }
                 }

package/server/src/Exceptions/ProfileIdentityConflictException.php

@@ -0,0 +1,34 @@
+<?php
+
+namespace Fleetbase\FleetOps\Exceptions;
+
+/**
+ * Thrown when a driver, contact or customer profile is given an email or phone
+ * that belongs to an account it cannot be linked to.
+ */
+class ProfileIdentityConflictException extends \Exception
+{
+    /**
+     * The profile field the conflict was found on (`email` or `phone`).
+     */
+    protected string $field;
+
+    public function __construct(string $message, string $field = 'email')
+    {
+        parent::__construct($message);
+        $this->field = $field;
+    }
+
+    public function getField(): string
+    {
+        return $this->field;
+    }
+
+    /**
+     * The conflict keyed by field, in the shape of a validation error bag.
+     */
+    public function getErrors(): array
+    {
+        return [$this->field => [$this->getMessage()]];
+    }
+}

package/server/src/Http/Controllers/Api/v1/CustomerController.php

@@ -44,6 +44,8 @@ class CustomerController extends Controller
 {
     use \Fleetbase\FleetOps\Http\Controllers\Concerns\ResolvesReviewAccountBypass;
 
+    public const DEACTIVATED_LOGIN_MESSAGE = 'This customer login has been deactivated.';
+
     /* ============================================================
      | Public auth flows (API credential only, no Customer-Token)
      * ============================================================ */
@@ -345,6 +347,10 @@ class CustomerController extends Controller
             return response()->apiError('Authentication failed using credentials provided.', 401);
         }
 
+        if ($user->status === 'inactive') {
+            return response()->apiError(static::DEACTIVATED_LOGIN_MESSAGE, 403);
+        }
+
         $sessionCompany = $this->sessionCompany();
         if (!$sessionCompany) {
             return response()->apiError('No company resolved from API credential.', 500);
@@ -381,6 +387,10 @@ class CustomerController extends Controller
             return response()->apiError('No customer with this phone number found.');
         }
 
+        if ($user->status === 'inactive') {
+            return response()->apiError(static::DEACTIVATED_LOGIN_MESSAGE, 403);
+        }
+
         try {
             $this->generateSmsVerification($user, 'fleetops_customer_login', [
                 'messageCallback' => fn ($verification) => 'Your ' . config('app.name') . ' verification code is ' . $verification->code,
@@ -423,6 +433,10 @@ class CustomerController extends Controller
             return response()->apiError('Unable to verify code.');
         }
 
+        if ($user->status === 'inactive') {
+            return response()->apiError(static::DEACTIVATED_LOGIN_MESSAGE, 403);
+        }
+
         $verificationCode = $this->verificationCodeExists([
             'subject_uuid' => $user->uuid,
             'code'         => $code,

package/server/src/Http/Controllers/Api/v1/DriverController.php

@@ -6,6 +6,7 @@ use Fleetbase\FleetOps\Events\DriverLocationChanged;
 use Fleetbase\FleetOps\Events\GeofenceEntered;
 use Fleetbase\FleetOps\Events\GeofenceExited;
 use Fleetbase\FleetOps\Events\VehicleLocationChanged;
+use Fleetbase\FleetOps\Exceptions\ProfileIdentityConflictException;
 use Fleetbase\FleetOps\Exceptions\PublicRelationNotFoundException;
 use Fleetbase\FleetOps\Http\Controllers\Api\v1\Concerns\ResolvesFleetOpsApiResources;
 use Fleetbase\FleetOps\Http\Controllers\Api\v1\Concerns\ResolvesPublicExpansions;
@@ -22,6 +23,7 @@ use Fleetbase\FleetOps\Models\Vehicle;
 use Fleetbase\FleetOps\Models\Vendor;
 use Fleetbase\FleetOps\Support\GeofenceIntersectionService;
 use Fleetbase\FleetOps\Support\OSRM;
+use Fleetbase\FleetOps\Support\ProfileAccountManager;
 use Fleetbase\FleetOps\Support\Utils;
 use Fleetbase\Http\Controllers\Controller;
 use Fleetbase\Http\Requests\SwitchOrganizationRequest;
@@ -47,6 +49,11 @@ class DriverController extends Controller
     use ResolvesFleetOpsApiResources;
     use ResolvesPublicExpansions;
 
+    /**
+     * Returned when a driver whose login was deactivated from the console tries to sign in.
+     */
+    public const DEACTIVATED_LOGIN_MESSAGE = 'This driver login has been deactivated.';
+
     /**
      * Public expansion name => Eloquent relation name.
      *
@@ -97,20 +104,14 @@ class DriverController extends Controller
         // Apply user infos
         $userDetails = $this->applyUserInfoFromRequest($request, $userDetails);
 
-        // Set company_uuid before creating user
-        $userDetails['company_uuid'] = $company->uuid;
-
-        // create user account for driver
-        $user = $this->createUser($userDetails);
-
-        // Assign company — the early return above guarantees $company is set
-        $user->assignCompany($company);
-
-        // Set user type
-        $user->setUserType('driver');
-
-        // assign driver role
-        $user->assignSingleRole('Driver');
+        // Resolve the driver's login account: a team member of the company with
+        // the email/phone is linked, otherwise a driver account is created and
+        // added to the company without an organization invite.
+        try {
+            $user = $this->resolveDriverAccount($company->uuid, $userDetails);
+        } catch (ProfileIdentityConflictException $exception) {
+            return $this->jsonResponse(['error' => $exception->getMessage()], 422);
+        }
 
         // set user id
         $input['user_uuid']    = $user->uuid;
@@ -193,10 +194,11 @@ class DriverController extends Controller
         // it. The driver's own record has no timezone column; the user's does.
         $userDetails = $request->only(['name', 'email', 'phone', 'timezone']);
 
-        // update driver user details
-        $driverUser = $driver->getUser();
-        if ($driverUser) {
-            $driverUser->update($userDetails);
+        // update the driver's login account through its proxy fields
+        try {
+            ProfileAccountManager::syncProxyFields($driver->getUser(), $userDetails);
+        } catch (ProfileIdentityConflictException $exception) {
+            return $this->jsonResponse(['error' => $exception->getMessage()], 422);
         }
 
         // latitude / longitude
@@ -519,10 +521,14 @@ class DriverController extends Controller
         )->whereHas('driver')->first();
 
         // Check password to authenticate driver
-        if (!Hash::check($password, $user->password)) {
+        if (!$user || !is_string($user->password) || !Hash::check((string) $password, $user->password)) {
             return response()->apiError('Authentication failed using password provided.', 401);
         }
 
+        if (static::isLoginDeactivated($user)) {
+            return response()->apiError(static::DEACTIVATED_LOGIN_MESSAGE, 403);
+        }
+
         // Get the user's company for this driver profile
         $company = static::getDriverCompanyFromUser($user);
 
@@ -561,6 +567,10 @@ class DriverController extends Controller
             return response()->apiError('No driver with this phone # found.');
         }
 
+        if (static::isLoginDeactivated($user)) {
+            return response()->apiError(static::DEACTIVATED_LOGIN_MESSAGE, 403);
+        }
+
         // Get the user's company for this driver profile
         $company = static::getDriverCompanyFromUser($user);
 
@@ -627,6 +637,10 @@ class DriverController extends Controller
             return response()->apiError('Unable to verify code.');
         }
 
+        if (static::isLoginDeactivated($user)) {
+            return response()->apiError(static::DEACTIVATED_LOGIN_MESSAGE, 403);
+        }
+
         // find and verify code
         $verificationCode = VerificationCode::where(['subject_uuid' => $user->uuid, 'code' => $code, 'for' => $for])->exists();
         if (!$verificationCode && !static::verificationBypassMatches($identity, $code)) {
@@ -975,26 +989,29 @@ class DriverController extends Controller
         return User::applyUserInfoFromRequest($request, $userDetails);
     }
 
-    protected function createUser(array $userDetails): User
+    /**
+     * Resolve the login account for a driver created through the API.
+     *
+     * @throws ProfileIdentityConflictException
+     */
+    protected function resolveDriverAccount(string $companyUuid, array $userDetails): User
     {
-        /*
-         * `password` is guarded on User, so mass assignment drops it without a
-         * word. The create endpoint has always accepted and validated one, so a
-         * driver created through the API could never sign in with the password
-         * their operator chose for them. Set it after the fact, where the
-         * model's mutator hashes it.
-         */
-        $password = $userDetails['password'] ?? null;
-        unset($userDetails['password']);
-
-        $user = User::create($userDetails);
-
-        if (is_string($password) && strlen($password)) {
-            $user->password = $password;
-            $user->save();
-        }
+        return ProfileAccountManager::resolveForProfile(
+            $companyUuid,
+            'driver',
+            $userDetails['name'] ?? null,
+            $userDetails['email'] ?? null,
+            $userDetails['phone'] ?? null,
+            array_merge(Arr::except($userDetails, ['name', 'email', 'phone']), ['status' => 'active'])
+        );
+    }
 
-        return $user;
+    /**
+     * Whether the driver's login was deactivated from the console.
+     */
+    public static function isLoginDeactivated(User $user): bool
+    {
+        return $user->status === 'inactive';
     }
 
     protected function getUuid(array|string $table, array $where, array $options = []): mixed
@@ -1313,7 +1330,7 @@ class DriverController extends Controller
         }
 
         $user = static::findDriverUserByIdentity($identity);
-        if (!$user) {
+        if (!$user || static::isLoginDeactivated($user)) {
             return response()->json(['status' => 'ok']);
         }
 
@@ -1344,7 +1361,7 @@ class DriverController extends Controller
         }
 
         $user = static::findDriverUserByIdentity($identity);
-        if (!$user) {
+        if (!$user || static::isLoginDeactivated($user)) {
             return response()->apiError('Invalid or expired reset code.', 422);
         }