@fleetbase/fleetops-engine 0.6.67 → 0.6.69

package/server/src/Http/Controllers/Internal/v1/OrderController.php

@@ -39,6 +39,7 @@ use Fleetbase\Models\File;
 use Fleetbase\Models\Type;
 use Fleetbase\Support\Auth;
 use Fleetbase\Support\TemplateString;
+use Illuminate\Database\Eloquent\Builder;
 use Illuminate\Database\Eloquent\ModelNotFoundException;
 use Illuminate\Database\QueryException;
 use Illuminate\Http\Request;
@@ -341,7 +342,8 @@ class OrderController extends FleetOpsController
         $info    = Utils::lookupIp();
         $disk    = $request->input('disk', config('filesystems.default'));
         $files   = $request->input('files');
-        $files   = File::whereIn('uuid', $files)->get();
+        /** @var \Illuminate\Database\Eloquent\Collection<int, File> $files */
+        $files   = $this->scopedToCompany(File::whereIn('uuid', $files))->get();
         $country = $request->input('country', Utils::or($info, ['country_name', 'region'], 'Singapore'));
 
         $validFileTypes = ['csv', 'tsv', 'xls', 'xlsx'];
@@ -513,7 +515,13 @@ class OrderController extends FleetOpsController
         }
 
         // Prepare Order UUID Collection
-        $orderUuids = collect($data['ids'])->unique()->values();
+        //
+        // Resolved through the company-scoped lookup so ids naming another
+        // organization's orders are dropped here rather than being assigned,
+        // counted in the response and queued for notification.
+        $orderUuids = $this->ordersByUuid(collect($data['ids'])->unique()->values()->all())
+            ->pluck('uuid')
+            ->values();
 
         // Bulk Update Inside A Transaction
         $this->runTransaction(function () use ($orderUuids, $driver): void {
@@ -545,8 +553,14 @@ class OrderController extends FleetOpsController
      */
     public function cancel(CancelOrderRequest $request)
     {
-        /** @var Order */
+        /** @var Order|null */
         $order = $this->findOrderByUuid($request->input('order'));
+        if (!$order) {
+            // `exists:orders,uuid` on the form request is a global existence
+            // check, so a known uuid belonging to another organization reaches
+            // here and must be rejected rather than dereferenced.
+            return $this->errorResponse('No order found to cancel.');
+        }
 
         $order->cancel();
 
@@ -599,9 +613,39 @@ class OrderController extends FleetOpsController
         );
     }
 
+    /**
+     * Constrain a tenant-owned lookup to the company the caller is acting for.
+     *
+     * The order-lifecycle actions on this controller receive their target as a
+     * caller-supplied identifier in the request body or query string rather than
+     * as a bound route parameter, so nothing upstream narrows these queries to
+     * the caller's tenant: `fleetbase.protected` only checks that the caller
+     * holds the named RBAC capability, never which company the record belongs to.
+     *
+     * A missing company session fails the query closed instead of letting it run
+     * unbounded across every tenant.
+     */
+    protected function scopedToCompany(Builder $query): Builder
+    {
+        $companyUuid = $this->sessionCompany();
+        if (!$companyUuid) {
+            $query->whereRaw('1 = 0');
+
+            return $query;
+        }
+
+        return $query->where($query->getModel()->qualifyColumn('company_uuid'), $companyUuid);
+    }
+
+    /**
+     * @return \Illuminate\Database\Eloquent\Collection<int, Order>
+     */
     protected function ordersByUuid(array $ids)
     {
-        return Order::whereIn('uuid', $ids)->get();
+        /** @var \Illuminate\Database\Eloquent\Collection<int, Order> $orders */
+        $orders = $this->scopedToCompany(Order::whereIn('uuid', $ids))->get();
+
+        return $orders;
     }
 
     protected function trackingStatusExists(?string $trackingNumberUuid, string $code): bool
@@ -611,7 +655,10 @@ class OrderController extends FleetOpsController
 
     protected function findDriverByUuid(string $uuid): ?Driver
     {
-        return Driver::whereUuid($uuid)->first();
+        /** @var Driver|null $driver */
+        $driver = $this->scopedToCompany(Driver::whereUuid($uuid))->first();
+
+        return $driver;
     }
 
     protected function driverDisplayName(Driver $driver): string
@@ -630,17 +677,47 @@ class OrderController extends FleetOpsController
 
     protected function findOrderByUuid(string $uuid): ?Order
     {
-        return Order::where('uuid', $uuid)->first();
+        /** @var Order|null $order */
+        $order = $this->scopedToCompany(Order::where('uuid', $uuid))->first();
+
+        return $order;
     }
 
-    protected function findOrderById(string $id, array $with = []): ?Order
+    /**
+     * Resolve an order by uuid or public_id, constrained to the caller's company.
+     *
+     * The identifier match is grouped so the company constraint applies to both
+     * arms — ungrouped it would read as `uuid = ? OR (public_id = ? AND
+     * company_uuid = ?)` and still resolve another organization's orders.
+     *
+     * The identifier is whatever the caller put in the request, so anything
+     * that is not a non-empty string resolves to no order rather than raising.
+     *
+     * @param array<int, string> $with
+     */
+    protected function findOrderById(mixed $id, array $with = []): ?Order
     {
-        return Order::findById($id, $with);
+        if (!is_string($id) || $id === '') {
+            return null;
+        }
+
+        /** @var Order|null $order */
+        $order = $this->scopedToCompany(Order::query())
+            ->where(function (Builder $query) use ($id) {
+                $query->where('uuid', $id)->orWhere('public_id', $id);
+            })
+            ->with($with)
+            ->first();
+
+        return $order;
     }
 
     protected function findOrderRouteForEdit(string $uuid): ?Order
     {
-        return Order::where('uuid', $uuid)->with(['payload'])->first();
+        /** @var Order|null $order */
+        $order = $this->scopedToCompany(Order::where('uuid', $uuid))->with(['payload'])->first();
+
+        return $order;
     }
 
     protected function orderResponse(Order $order): array
@@ -650,7 +727,7 @@ class OrderController extends FleetOpsController
 
     protected function assignDriverToOrders($orderUuids, Driver $driver): void
     {
-        Order::whereIn('uuid', $orderUuids)->update([
+        $this->scopedToCompany(Order::whereIn('uuid', $orderUuids))->update([
             'driver_assigned_uuid' => $driver->uuid,
             'updated_at'           => now(),
         ]);
@@ -739,17 +816,28 @@ class OrderController extends FleetOpsController
 
     protected function findOrderForStart(?string $uuid): ?Order
     {
-        return Order::where('uuid', $uuid)->withoutGlobalScopes()->first();
+        /** @var Order|null $order */
+        $order = $this->scopedToCompany(Order::where('uuid', $uuid)->withoutGlobalScopes())->first();
+
+        return $order;
     }
 
     protected function findDriverForStart(?string $uuid): ?Driver
     {
-        return Driver::where('uuid', $uuid)->withoutGlobalScopes()->first();
+        /** @var Driver|null $driver */
+        $driver = $this->scopedToCompany(Driver::where('uuid', $uuid)->withoutGlobalScopes())->first();
+
+        return $driver;
     }
 
     protected function findPayloadForStart(?string $uuid): ?Payload
     {
-        return Payload::where('uuid', $uuid)->withoutGlobalScopes()->with(['waypoints', 'waypointMarkers', 'entities'])->first();
+        /** @var Payload|null $payload */
+        $payload = $this->scopedToCompany(Payload::where('uuid', $uuid)->withoutGlobalScopes())
+            ->with(['waypoints', 'waypointMarkers', 'entities'])
+            ->first();
+
+        return $payload;
     }
 
     protected function dispatchDomainEvent(object $event): object
@@ -771,7 +859,7 @@ class OrderController extends FleetOpsController
      */
     public function updateActivity(string $id, Request $request)
     {
-        $order = Order::findById($id, [
+        $order = $this->findOrderById($id, [
             'driverAssigned',
             'payload.entities',
             'payload.pickup',
@@ -882,9 +970,8 @@ class OrderController extends FleetOpsController
      */
     public function nextActivity(string $id, Request $request)
     {
-        try {
-            $order = Order::findByIdOrFail($id);
-        } catch (ModelNotFoundException $e) {
+        $order = $this->findOrderById($id);
+        if (!$order) {
             return response()->error('No order found.');
         }
 
@@ -935,7 +1022,7 @@ class OrderController extends FleetOpsController
      */
     public function setDestination(string $id, string $placeId)
     {
-        $order = Order::findById($id, [
+        $order = $this->findOrderById($id, [
             'payload.pickup',
             'payload.dropoff',
             'payload.return',
@@ -1013,7 +1100,7 @@ class OrderController extends FleetOpsController
             return response()->error($errorMessage, 422);
         }
 
-        $order = Order::findById($id, ['payload.pickup', 'payload.dropoff', 'payload.return', 'payload.waypoints', 'payload.waypointMarkers.place']);
+        $order = $this->findOrderById($id, ['payload.pickup', 'payload.dropoff', 'payload.return', 'payload.waypoints', 'payload.waypointMarkers.place']);
         if (!$order) {
             return response()->error('No order found.');
         }
@@ -1214,7 +1301,14 @@ class OrderController extends FleetOpsController
         }
 
         if (is_string($proof)) {
-            return Proof::where('public_id', $proof)->orWhere('uuid', $proof)->first();
+            /** @var Proof|null $resolved */
+            $resolved = $this->scopedToCompany(Proof::query())
+                ->where(function (Builder $query) use ($proof) {
+                    $query->where('public_id', $proof)->orWhere('uuid', $proof);
+                })
+                ->first();
+
+            return $resolved;
         }
 
         return null;
@@ -1419,7 +1513,12 @@ class OrderController extends FleetOpsController
 
     protected function findOrderForDriverPing(string $id): Order
     {
-        return Order::findByIdOrFail($id, ['driverAssigned']);
+        $order = $this->findOrderById($id, ['driverAssigned']);
+        if (!$order) {
+            throw new ModelNotFoundException();
+        }
+
+        return $order;
     }
 
     protected function sendDriverPing(Driver $driver, Order $order): void
@@ -1692,7 +1791,10 @@ class OrderController extends FleetOpsController
 
     protected function findOrderForProofs(string $id): ?Order
     {
-        return Order::where('uuid', $id)->first();
+        /** @var Order|null $order */
+        $order = $this->scopedToCompany(Order::where('uuid', $id))->first();
+
+        return $order;
     }
 
     protected function findWaypointProofSubject(Order $order, string $subjectId): ?Waypoint
@@ -1708,7 +1810,10 @@ class OrderController extends FleetOpsController
 
     protected function findEntityProofSubject(string $subjectId): ?Entity
     {
-        return Entity::where('uuid', $subjectId)->withoutGlobalScopes()->first();
+        /** @var Entity|null $entity */
+        $entity = $this->scopedToCompany(Entity::where('uuid', $subjectId)->withoutGlobalScopes())->first();
+
+        return $entity;
     }
 
     protected function proofsForSubject(Order $order, Order|Waypoint|Entity $subject)
@@ -1772,14 +1877,26 @@ class OrderController extends FleetOpsController
         return new OrderResource($order);
     }
 
+    /**
+     * Find the order a tracking number belongs to, for the public Track Order page.
+     *
+     * Deliberately NOT company-scoped, unlike the lifecycle lookups above. The
+     * `fleet-ops/lookup` route is public: the tracking page is used by recipients who
+     * have no session, and the tracking number itself is what grants access. Scoping
+     * it to the session company made every lookup from that page fail, because there
+     * is no company to scope to.
+     */
     protected function findOrderByTrackingNumber(string $trackingNumber): ?Order
     {
-        return Order::whereHas(
+        /** @var Order|null $order */
+        $order = Order::whereHas(
             'trackingNumber',
             function ($query) use ($trackingNumber) {
                 $query->where('tracking_number', $trackingNumber);
             }
         )->first();
+
+        return $order;
     }
 
     /**
@@ -1824,13 +1941,25 @@ class OrderController extends FleetOpsController
 
     protected function findOrderForSchedule(?string $id): ?Order
     {
-        return Order::findById($id);
+        return $this->findOrderById($id);
     }
 
+    /**
+     * Resolve a driver by uuid or public_id, constrained to the caller's company.
+     *
+     * The identifier match is grouped so the company constraint applies to both
+     * arms — ungrouped it would read as `uuid = ? OR (public_id = ? AND
+     * company_uuid = ?)` and still resolve another organization's drivers.
+     */
     protected function findDriverForSchedule(string $id): ?Driver
     {
-        return Driver::where('uuid', $id)
-            ->orWhere('public_id', $id)
+        /** @var Driver|null $driver */
+        $driver = $this->scopedToCompany(Driver::query())
+            ->where(function (Builder $query) use ($id) {
+                $query->where('uuid', $id)->orWhere('public_id', $id);
+            })
             ->first();
+
+        return $driver;
     }
 }

package/server/src/Http/Requests/CreateDriverRequest.php

@@ -41,9 +41,13 @@ class CreateDriverRequest extends FleetbaseRequest
              * value later. Both are still validated and still unique when they
              * are supplied; a driver created without them simply cannot sign in
              * to Navigator until credentials are added.
+             *
+             * On create, availability is decided by ProfileAccountManager: a team
+             * member of the company with the email or phone is linked to the new
+             * driver instead of being rejected as a duplicate.
              */
-            'email'    => ['nullable', Rule::when($this->filled('email'), ['email']), $this->uniqueAmongUsers()],
-            'phone'    => ['nullable', 'string', $this->uniqueAmongUsers()],
+            'email'    => ['nullable', Rule::when($this->filled('email'), ['email']), Rule::when(!$isCreating, [$this->uniqueAmongUsers()])],
+            'phone'    => ['nullable', 'string', Rule::when(!$isCreating, [$this->uniqueAmongUsers()])],
             'password' => 'nullable|string',
             'timezone' => 'nullable|string|max:64',
 

package/server/src/Http/Requests/Internal/CreateDriverRequest.php

@@ -23,22 +23,17 @@ class CreateDriverRequest extends CreateDriverApiRequest
      */
     public function rules(): array
     {
-        $isCreating                   = $this->isMethod('POST');
-        $isCreatingWithUser           = $this->filled('driver.user_uuid');
-        $shouldValidateUserAttributes = $isCreating && !$isCreatingWithUser;
+        $isCreating = $this->isMethod('POST');
 
         return [
-            // Required fields for driver creation
-            'name'                   => [Rule::requiredIf($shouldValidateUserAttributes), 'nullable', 'string', 'max:255'],
-            'email'                  => [
-                Rule::requiredIf($shouldValidateUserAttributes),
-                Rule::when($this->filled('email'), ['email']),
-                Rule::when($shouldValidateUserAttributes, [Rule::unique('users')->whereNull('deleted_at')]),
-            ],
-            'phone'                  => [
-                Rule::requiredIf($shouldValidateUserAttributes),
-                Rule::when($shouldValidateUserAttributes, [Rule::unique('users')->whereNull('deleted_at')]),
-            ],
+            // The driver profile manages its login account: name, email and phone
+            // are proxied to it. Email/phone availability is checked against the
+            // account the profile resolves to (see ProfileAccountManager), because a
+            // team member of the organization with the same email or phone is linked
+            // rather than rejected as a duplicate.
+            'name'                   => [Rule::requiredIf($isCreating), 'nullable', 'string', 'max:255'],
+            'email'                  => ['nullable', Rule::when($this->filled('email'), ['email'])],
+            'phone'                  => ['nullable', 'string'],
 
             // Optional fields
             'password'               => 'nullable|string|min:8',
@@ -84,11 +79,7 @@ class CreateDriverRequest extends CreateDriverApiRequest
     {
         return [
             'name.required'  => 'Driver name is required.',
-            'email.required' => 'Email address is required.',
             'email.email'    => 'Please provide a valid email address.',
-            'email.unique'   => 'This email address is already registered.',
-            'phone.required' => 'Phone number is required.',
-            'phone.unique'   => 'This phone number is already registered.',
             'password.min'   => 'Password must be at least 8 characters.',
         ];
     }

package/server/src/Http/Resources/v1/Contact.php

@@ -2,6 +2,7 @@
 
 namespace Fleetbase\FleetOps\Http\Resources\v1;
 
+use Fleetbase\FleetOps\Support\ProfileAccountManager;
 use Fleetbase\FleetOps\Support\Utils;
 use Fleetbase\Http\Resources\FleetbaseResource;
 use Fleetbase\Http\Resources\User;
@@ -40,6 +41,8 @@ class Contact extends FleetbaseResource
             'places'                        => $this->whenLoaded('places', fn () => Place::collection($this->places)->without('owner')),
             'user'                          => $this->when(Http::isInternalRequest(), fn () => new User($this->user), fn () => $this->user ? $this->user->public_id : null),
             'address'                       => $this->when(Http::isInternalRequest(), data_get($this, 'place.address')),
+            'is_staff_linked'               => $this->when(Http::isInternalRequest(), fn () => ProfileAccountManager::isStaffAccount($this->user)),
+            'login_status'                  => $this->when(Http::isInternalRequest(), fn () => data_get($this, 'user.status')),
             'address_street'                => $this->when(Http::isInternalRequest(), data_get($this, 'place.street1')),
             'type'                          => $this->type ?? null,
             'customer_type'                 => $this->when(isset($this->customer_type), Utils::toEmberResourceType($this->customer_type)),

package/server/src/Http/Resources/v1/Driver.php

@@ -2,6 +2,7 @@
 
 namespace Fleetbase\FleetOps\Http\Resources\v1;
 
+use Fleetbase\FleetOps\Support\ProfileAccountManager;
 use Fleetbase\FleetOps\Support\Utils;
 use Fleetbase\Http\Resources\FleetbaseResource;
 use Fleetbase\Http\Resources\FleetbaseResourceCollection;
@@ -32,6 +33,8 @@ class Driver extends FleetbaseResource
             'public_id'                     => $this->when(Http::isInternalRequest(), $this->public_id),
             'user'                          => $this->when(Http::isPublicRequest(), fn () => $this->user ? $this->user->public_id : null, new User($this->user)),
             'internal_id'                   => $this->internal_id,
+            'is_staff_linked'               => $this->when(Http::isInternalRequest(), fn () => ProfileAccountManager::isStaffAccount($this->user)),
+            'login_status'                  => $this->when(Http::isInternalRequest(), fn () => data_get($this, 'user.status')),
             'company'                       => $this->when(Http::isPublicRequest(), fn () => $this->company ? $this->company->public_id : null),
             'company_name'                  => $this->when(Http::isPublicRequest(), fn () => $this->company ? $this->company->name : null),
             'name'                          => $this->name,

package/server/src/Jobs/PollTelematicTelemetry.php

@@ -109,6 +109,7 @@ class PollTelematicTelemetry implements ShouldQueue, ShouldBeUnique
         try {
             $started = microtime(true);
             DB::table('telematic_sync_runs')->insert(['uuid' => $run, 'telematic_uuid' => $telematic->uuid, 'status' => 'fetching', 'created_at' => now(), 'updated_at' => now()]);
+            $this->adoptPendingRequest($run);
             $this->manualProgress([
                 'last_sync_run_uuid'      => $run, 'last_sync_run_job_id' => $this->manualJobId,
                 'last_sync_result'        => 'running', 'last_sync_phase' => 'fetching_inventory',
@@ -186,6 +187,41 @@ class PollTelematicTelemetry implements ShouldQueue, ShouldBeUnique
         return $remaining;
     }
 
+    /**
+     * Bind a manual request that has no active run to this scheduled sweep.
+     *
+     * Every poll job for a connection shares one unique lease, so while a scheduled sweep
+     * runs, the request's own job is either not queued (the request was recorded while
+     * the lease was held) or no longer exists (lost before or after an interrupted run).
+     */
+    private function adoptPendingRequest(string $run): void
+    {
+        if ($this->manualJobId) {
+            return;
+        }
+        DB::transaction(function () use ($run) {
+            $connection = Telematic::withoutGlobalScopes()->where('uuid', $this->telematicUuid)->lockForUpdate()->first();
+            $meta       = $connection?->meta ?? [];
+            $request    = data_get($meta, 'last_sync_job_id');
+            if (!$request || !in_array(data_get($meta, 'last_sync_result'), Inbox::PENDING_REQUEST_RESULTS, true)) {
+                return;
+            }
+            $bound = data_get($meta, 'last_sync_run_uuid');
+            if ($bound && DB::table('telematic_sync_runs')->where('uuid', $bound)->whereIn('status', ['fetching', 'ingesting'])->exists()) {
+                return;
+            }
+            $connection->status = 'synchronizing';
+            $connection->meta   = array_merge($meta, [
+                'last_sync_run_uuid'      => $run, 'last_sync_run_job_id' => $request,
+                'last_sync_result'        => 'running', 'last_sync_phase' => 'fetching_inventory',
+                'last_sync_fetched_total' => 0, 'last_sync_page_count' => 0,
+                'last_sync_linked_total'  => 0, 'last_sync_failed_total' => 0, 'last_sync_error' => null,
+                'last_sync_progress_at'   => now()->toDateTimeString(),
+            ]);
+            $connection->save();
+        });
+    }
+
     private function manualProgress(array $attributes): void
     {
         if (!$this->manualJobId) {

package/server/src/Jobs/SyncTelematicDevicesJob.php

@@ -58,8 +58,8 @@ class SyncTelematicDevicesJob implements ShouldQueue
                 try {
                     $service->queueTelemetrySync($this->telematic, $this->options, $this->jobId);
                 } catch (\Illuminate\Validation\ValidationException) {
-                    // Paused or already queued/running. Failing here would mark the connection
-                    // as errored and detach the active request's progress tracking.
+                    // Polling was paused after this job was queued. Failing here would mark the
+                    // connection as errored and detach any active request's progress tracking.
                     Log::info('Skipped legacy telematics sync redirect.', ['telematic_uuid' => $this->telematic->uuid]);
                 }
             }

package/server/src/Mail/DriverCredentialsMail.php

@@ -0,0 +1,55 @@
+<?php
+
+namespace Fleetbase\FleetOps\Mail;
+
+use Fleetbase\FleetOps\Models\Driver;
+use Fleetbase\Models\User;
+use Illuminate\Bus\Queueable;
+use Illuminate\Mail\Mailable;
+use Illuminate\Mail\Mailables\Content;
+use Illuminate\Mail\Mailables\Envelope;
+use Illuminate\Queue\SerializesModels;
+
+class DriverCredentialsMail extends Mailable
+{
+    use Queueable;
+    use SerializesModels;
+
+    /**
+     * Create a new message instance.
+     */
+    public function __construct(private string $plaintextPassword, private Driver $driver, private User $user)
+    {
+    }
+
+    /**
+     * Get the message envelope.
+     */
+    public function envelope(): Envelope
+    {
+        $this->driver->loadMissing('company');
+
+        return new Envelope(
+            subject: 'Your ' . ($this->driver->company?->name ?? config('app.name')) . ' driver sign-in details',
+        );
+    }
+
+    /**
+     * Get the message content definition.
+     */
+    public function content(): Content
+    {
+        $this->driver->loadMissing('company');
+
+        return new Content(
+            markdown: 'fleetops::mail.driver-credentials',
+            with: [
+                'driver'            => $this->driver,
+                'user'              => $this->user,
+                'companyName'       => $this->driver->company?->name ?? config('app.name'),
+                'identity'          => $this->user->email ?? $this->user->phone,
+                'plaintextPassword' => $this->plaintextPassword,
+            ]
+        );
+    }
+}