@fleetbase/fleetops-engine 0.6.68 → 0.6.69

package/server/migrations/2026_09_21_000001_convert_profile_only_users_to_managed_accounts.php

@@ -0,0 +1,132 @@
+<?php
+
+use Illuminate\Database\Migrations\Migration;
+use Illuminate\Support\Facades\DB;
+use Illuminate\Support\Facades\Schema;
+
+/*
+ * Driver and customer login accounts are now managed by their FleetOps
+ * profile (user type `driver` or `customer`) instead of in IAM.
+ *
+ * Before this change the driver form created plain `user` accounts holding only
+ * the Driver role, so these accounts show up in IAM and can sign in to the
+ * console. This converts them to managed accounts. An account is converted only
+ * when it is clearly a profile login and nothing else: it has a driver or
+ * customer profile, every organization role it holds is the profile's role, it
+ * has no direct permissions or policies, and it owns no organization. Anything
+ * else is left as a team member.
+ *
+ * The previous type is kept in `meta.previous_type` so down() can revert it.
+ */
+return new class extends Migration {
+    private const PROFILE_ROLES = [
+        'driver'   => 'Driver',
+        'customer' => 'Fleet-Ops Customer',
+    ];
+
+    public function up(): void
+    {
+        if (!$this->hasRequiredTables()) {
+            return;
+        }
+
+        DB::table('users')
+            ->select(['uuid', 'meta'])
+            ->where('type', 'user')
+            ->whereNull('deleted_at')
+            ->where(function ($query) {
+                $query->whereExists(function ($query) {
+                    $query->selectRaw(1)->from('drivers')->whereColumn('drivers.user_uuid', 'users.uuid')->whereNull('drivers.deleted_at');
+                })->orWhereExists(function ($query) {
+                    $query->selectRaw(1)->from('contacts')->whereColumn('contacts.user_uuid', 'users.uuid')->where('contacts.type', 'customer')->whereNull('contacts.deleted_at');
+                });
+            })
+            ->whereNotExists(function ($query) {
+                $query->selectRaw(1)->from('companies')->whereColumn('companies.owner_uuid', 'users.uuid');
+            })
+            ->orderBy('uuid')
+            ->chunk(500, function ($users) {
+                foreach ($users as $user) {
+                    $type = $this->managedTypeFor($user->uuid);
+                    if (!$type) {
+                        continue;
+                    }
+
+                    $meta                  = json_decode($user->meta ?? '', true);
+                    $meta                  = is_array($meta) ? $meta : [];
+                    $meta['previous_type'] = 'user';
+
+                    DB::table('users')->where('uuid', $user->uuid)->update(['type' => $type, 'meta' => json_encode($meta)]);
+                }
+            });
+    }
+
+    public function down(): void
+    {
+        if (!Schema::hasTable('users')) {
+            return;
+        }
+
+        DB::table('users')
+            ->select(['uuid', 'meta'])
+            ->whereIn('type', array_keys(self::PROFILE_ROLES))
+            ->where('meta', 'like', '%"previous_type"%')
+            ->orderBy('uuid')
+            ->chunk(500, function ($users) {
+                foreach ($users as $user) {
+                    $meta = json_decode($user->meta ?? '', true);
+                    if (!is_array($meta) || ($meta['previous_type'] ?? null) !== 'user') {
+                        continue;
+                    }
+
+                    unset($meta['previous_type']);
+                    DB::table('users')->where('uuid', $user->uuid)->update(['type' => 'user', 'meta' => json_encode($meta)]);
+                }
+            });
+    }
+
+    /**
+     * The managed type for the account, or null when it should stay a team member.
+     */
+    private function managedTypeFor(string $userUuid): ?string
+    {
+        $hasDriver   = DB::table('drivers')->where('user_uuid', $userUuid)->whereNull('deleted_at')->exists();
+        $hasCustomer = DB::table('contacts')->where('user_uuid', $userUuid)->where('type', 'customer')->whereNull('deleted_at')->exists();
+
+        // An account holding both kinds of profile is a person the organization
+        // relates to in two ways; leave it for an administrator to decide.
+        if ($hasDriver === $hasCustomer) {
+            return null;
+        }
+
+        $type             = $hasDriver ? 'driver' : 'customer';
+        $companyUserUuids = DB::table('company_users')->where('user_uuid', $userUuid)->whereNull('deleted_at')->pluck('uuid');
+        $modelUuids       = $companyUserUuids->push($userUuid)->all();
+
+        $roles = DB::table('model_has_roles')
+            ->join('roles', 'roles.id', '=', 'model_has_roles.role_id')
+            ->whereIn('model_has_roles.model_uuid', $modelUuids)
+            ->pluck('roles.name')
+            ->unique();
+
+        if ($roles->isEmpty() || $roles->contains(fn ($role) => $role !== self::PROFILE_ROLES[$type])) {
+            return null;
+        }
+
+        $hasPermissions = DB::table('model_has_permissions')->whereIn('model_uuid', $modelUuids)->exists();
+        $hasPolicies    = DB::table('model_has_policies')->whereIn('model_uuid', $modelUuids)->exists();
+
+        return $hasPermissions || $hasPolicies ? null : $type;
+    }
+
+    private function hasRequiredTables(): bool
+    {
+        foreach (['users', 'drivers', 'contacts', 'companies', 'company_users', 'roles', 'model_has_roles', 'model_has_permissions', 'model_has_policies'] as $table) {
+            if (!Schema::hasTable($table)) {
+                return false;
+            }
+        }
+
+        return true;
+    }
+};

package/server/resources/views/mail/driver-credentials.blade.php

@@ -0,0 +1,21 @@
+<x-mail-layout>
+<h2 style="font-size: 18px; font-weight: 600;">
+Your driver sign-in details
+</h2>
+
+Hi {{ $user->name }},
+<br />
+<br />
+{{ $companyName }} has set up your driver account. Use these details to sign in to the driver app.
+<br />
+<br />
+<strong>Your sign-in details</strong>
+<br />
+Login: {{ $identity }}
+<br />
+Temporary password: {{ $plaintextPassword }}
+<br />
+<br />
+You can change your password after signing in.
+
+</x-mail-layout>

package/server/src/Console/Commands/FixCustomerCompanies.php

@@ -68,7 +68,7 @@ class FixCustomerCompanies extends Command
                     $this->line('Found user ' . $user->name . ' (' . $user->email . ') which doesnt have correct company assignment.');
                     $company = $this->companyByUuid($customer->company_uuid);
                     if ($company) {
-                        $user->assignCompany($company);
+                        $user->assignCompany($company, 'Fleet-Ops Customer');
                         $this->line('User ' . $user->email . ' was assigned to company: ' . $company->name);
                     }
                 }

package/server/src/Console/Commands/FixDriverCompanies.php

@@ -49,7 +49,7 @@ class FixDriverCompanies extends Command
                     $this->line('Found driver ' . $user->name . ' (' . $user->email . ') which doesnt have correct company assignment.');
                     $company = $this->companyByUuid($driver->company_uuid);
                     if ($company) {
-                        $user->assignCompany($company);
+                        $user->assignCompany($company, 'Driver');
                         $this->line('Driver ' . $user->email . ' was assigned to company: ' . $company->name);
                     }
                 }

package/server/src/Exceptions/ProfileIdentityConflictException.php

@@ -0,0 +1,34 @@
+<?php
+
+namespace Fleetbase\FleetOps\Exceptions;
+
+/**
+ * Thrown when a driver, contact or customer profile is given an email or phone
+ * that belongs to an account it cannot be linked to.
+ */
+class ProfileIdentityConflictException extends \Exception
+{
+    /**
+     * The profile field the conflict was found on (`email` or `phone`).
+     */
+    protected string $field;
+
+    public function __construct(string $message, string $field = 'email')
+    {
+        parent::__construct($message);
+        $this->field = $field;
+    }
+
+    public function getField(): string
+    {
+        return $this->field;
+    }
+
+    /**
+     * The conflict keyed by field, in the shape of a validation error bag.
+     */
+    public function getErrors(): array
+    {
+        return [$this->field => [$this->getMessage()]];
+    }
+}

package/server/src/Http/Controllers/Api/v1/CustomerController.php

@@ -44,6 +44,8 @@ class CustomerController extends Controller
 {
     use \Fleetbase\FleetOps\Http\Controllers\Concerns\ResolvesReviewAccountBypass;
 
+    public const DEACTIVATED_LOGIN_MESSAGE = 'This customer login has been deactivated.';
+
     /* ============================================================
      | Public auth flows (API credential only, no Customer-Token)
      * ============================================================ */
@@ -345,6 +347,10 @@ class CustomerController extends Controller
             return response()->apiError('Authentication failed using credentials provided.', 401);
         }
 
+        if ($user->status === 'inactive') {
+            return response()->apiError(static::DEACTIVATED_LOGIN_MESSAGE, 403);
+        }
+
         $sessionCompany = $this->sessionCompany();
         if (!$sessionCompany) {
             return response()->apiError('No company resolved from API credential.', 500);
@@ -381,6 +387,10 @@ class CustomerController extends Controller
             return response()->apiError('No customer with this phone number found.');
         }
 
+        if ($user->status === 'inactive') {
+            return response()->apiError(static::DEACTIVATED_LOGIN_MESSAGE, 403);
+        }
+
         try {
             $this->generateSmsVerification($user, 'fleetops_customer_login', [
                 'messageCallback' => fn ($verification) => 'Your ' . config('app.name') . ' verification code is ' . $verification->code,
@@ -423,6 +433,10 @@ class CustomerController extends Controller
             return response()->apiError('Unable to verify code.');
         }
 
+        if ($user->status === 'inactive') {
+            return response()->apiError(static::DEACTIVATED_LOGIN_MESSAGE, 403);
+        }
+
         $verificationCode = $this->verificationCodeExists([
             'subject_uuid' => $user->uuid,
             'code'         => $code,

package/server/src/Http/Controllers/Api/v1/DriverController.php

@@ -6,6 +6,7 @@ use Fleetbase\FleetOps\Events\DriverLocationChanged;
 use Fleetbase\FleetOps\Events\GeofenceEntered;
 use Fleetbase\FleetOps\Events\GeofenceExited;
 use Fleetbase\FleetOps\Events\VehicleLocationChanged;
+use Fleetbase\FleetOps\Exceptions\ProfileIdentityConflictException;
 use Fleetbase\FleetOps\Exceptions\PublicRelationNotFoundException;
 use Fleetbase\FleetOps\Http\Controllers\Api\v1\Concerns\ResolvesFleetOpsApiResources;
 use Fleetbase\FleetOps\Http\Controllers\Api\v1\Concerns\ResolvesPublicExpansions;
@@ -22,6 +23,7 @@ use Fleetbase\FleetOps\Models\Vehicle;
 use Fleetbase\FleetOps\Models\Vendor;
 use Fleetbase\FleetOps\Support\GeofenceIntersectionService;
 use Fleetbase\FleetOps\Support\OSRM;
+use Fleetbase\FleetOps\Support\ProfileAccountManager;
 use Fleetbase\FleetOps\Support\Utils;
 use Fleetbase\Http\Controllers\Controller;
 use Fleetbase\Http\Requests\SwitchOrganizationRequest;
@@ -47,6 +49,11 @@ class DriverController extends Controller
     use ResolvesFleetOpsApiResources;
     use ResolvesPublicExpansions;
 
+    /**
+     * Returned when a driver whose login was deactivated from the console tries to sign in.
+     */
+    public const DEACTIVATED_LOGIN_MESSAGE = 'This driver login has been deactivated.';
+
     /**
      * Public expansion name => Eloquent relation name.
      *
@@ -97,20 +104,14 @@ class DriverController extends Controller
         // Apply user infos
         $userDetails = $this->applyUserInfoFromRequest($request, $userDetails);
 
-        // Set company_uuid before creating user
-        $userDetails['company_uuid'] = $company->uuid;
-
-        // create user account for driver
-        $user = $this->createUser($userDetails);
-
-        // Assign company — the early return above guarantees $company is set
-        $user->assignCompany($company);
-
-        // Set user type
-        $user->setUserType('driver');
-
-        // assign driver role
-        $user->assignSingleRole('Driver');
+        // Resolve the driver's login account: a team member of the company with
+        // the email/phone is linked, otherwise a driver account is created and
+        // added to the company without an organization invite.
+        try {
+            $user = $this->resolveDriverAccount($company->uuid, $userDetails);
+        } catch (ProfileIdentityConflictException $exception) {
+            return $this->jsonResponse(['error' => $exception->getMessage()], 422);
+        }
 
         // set user id
         $input['user_uuid']    = $user->uuid;
@@ -193,10 +194,11 @@ class DriverController extends Controller
         // it. The driver's own record has no timezone column; the user's does.
         $userDetails = $request->only(['name', 'email', 'phone', 'timezone']);
 
-        // update driver user details
-        $driverUser = $driver->getUser();
-        if ($driverUser) {
-            $driverUser->update($userDetails);
+        // update the driver's login account through its proxy fields
+        try {
+            ProfileAccountManager::syncProxyFields($driver->getUser(), $userDetails);
+        } catch (ProfileIdentityConflictException $exception) {
+            return $this->jsonResponse(['error' => $exception->getMessage()], 422);
         }
 
         // latitude / longitude
@@ -519,10 +521,14 @@ class DriverController extends Controller
         )->whereHas('driver')->first();
 
         // Check password to authenticate driver
-        if (!Hash::check($password, $user->password)) {
+        if (!$user || !is_string($user->password) || !Hash::check((string) $password, $user->password)) {
             return response()->apiError('Authentication failed using password provided.', 401);
         }
 
+        if (static::isLoginDeactivated($user)) {
+            return response()->apiError(static::DEACTIVATED_LOGIN_MESSAGE, 403);
+        }
+
         // Get the user's company for this driver profile
         $company = static::getDriverCompanyFromUser($user);
 
@@ -561,6 +567,10 @@ class DriverController extends Controller
             return response()->apiError('No driver with this phone # found.');
         }
 
+        if (static::isLoginDeactivated($user)) {
+            return response()->apiError(static::DEACTIVATED_LOGIN_MESSAGE, 403);
+        }
+
         // Get the user's company for this driver profile
         $company = static::getDriverCompanyFromUser($user);
 
@@ -627,6 +637,10 @@ class DriverController extends Controller
             return response()->apiError('Unable to verify code.');
         }
 
+        if (static::isLoginDeactivated($user)) {
+            return response()->apiError(static::DEACTIVATED_LOGIN_MESSAGE, 403);
+        }
+
         // find and verify code
         $verificationCode = VerificationCode::where(['subject_uuid' => $user->uuid, 'code' => $code, 'for' => $for])->exists();
         if (!$verificationCode && !static::verificationBypassMatches($identity, $code)) {
@@ -975,26 +989,29 @@ class DriverController extends Controller
         return User::applyUserInfoFromRequest($request, $userDetails);
     }
 
-    protected function createUser(array $userDetails): User
+    /**
+     * Resolve the login account for a driver created through the API.
+     *
+     * @throws ProfileIdentityConflictException
+     */
+    protected function resolveDriverAccount(string $companyUuid, array $userDetails): User
     {
-        /*
-         * `password` is guarded on User, so mass assignment drops it without a
-         * word. The create endpoint has always accepted and validated one, so a
-         * driver created through the API could never sign in with the password
-         * their operator chose for them. Set it after the fact, where the
-         * model's mutator hashes it.
-         */
-        $password = $userDetails['password'] ?? null;
-        unset($userDetails['password']);
-
-        $user = User::create($userDetails);
-
-        if (is_string($password) && strlen($password)) {
-            $user->password = $password;
-            $user->save();
-        }
+        return ProfileAccountManager::resolveForProfile(
+            $companyUuid,
+            'driver',
+            $userDetails['name'] ?? null,
+            $userDetails['email'] ?? null,
+            $userDetails['phone'] ?? null,
+            array_merge(Arr::except($userDetails, ['name', 'email', 'phone']), ['status' => 'active'])
+        );
+    }
 
-        return $user;
+    /**
+     * Whether the driver's login was deactivated from the console.
+     */
+    public static function isLoginDeactivated(User $user): bool
+    {
+        return $user->status === 'inactive';
     }
 
     protected function getUuid(array|string $table, array $where, array $options = []): mixed
@@ -1313,7 +1330,7 @@ class DriverController extends Controller
         }
 
         $user = static::findDriverUserByIdentity($identity);
-        if (!$user) {
+        if (!$user || static::isLoginDeactivated($user)) {
             return response()->json(['status' => 'ok']);
         }
 
@@ -1344,7 +1361,7 @@ class DriverController extends Controller
         }
 
         $user = static::findDriverUserByIdentity($identity);
-        if (!$user) {
+        if (!$user || static::isLoginDeactivated($user)) {
             return response()->apiError('Invalid or expired reset code.', 422);
         }
 

package/server/src/Http/Controllers/Internal/v1/ContactController.php

@@ -265,25 +265,13 @@ class ContactController extends FleetOpsController
             ->get();
     }
 
+    /**
+     * The login account is managed by the contact profile, so a user can't be
+     * picked or swapped from the console.
+     */
     private function resolveUserInput(Request $request, array &$input): void
     {
-        $user = data_get($input, 'user_uuid') ?? data_get($input, 'user') ?? $request->input('contact.user_uuid') ?? $request->input('contact.user');
-
-        if (is_array($user)) {
-            $user = data_get($user, 'uuid') ?? data_get($user, 'id');
-        }
-
-        if (!$user) {
-            return;
-        }
-
-        $input['user_uuid'] = $this->resolveUserUuid($user);
-        unset($input['user']);
-    }
-
-    protected function resolveUserUuid(string $user): string
-    {
-        return User::where('uuid', $user)->orWhere('public_id', $user)->value('uuid') ?? $user;
+        unset($input['user_uuid'], $input['user']);
     }
 
     protected function assertCustomerPortalCanSendWelcomeEmail(array $input): void

package/server/src/Http/Controllers/Internal/v1/CustomerController.php

@@ -4,6 +4,7 @@ namespace Fleetbase\FleetOps\Http\Controllers\Internal\v1;
 
 use Fleetbase\FleetOps\Mail\CustomerCredentialsMail;
 use Fleetbase\FleetOps\Models\Contact;
+use Fleetbase\FleetOps\Support\ProfileAccountManager;
 use Fleetbase\Http\Controllers\Controller;
 use Fleetbase\Models\User;
 use Illuminate\Http\Request;
@@ -21,6 +22,10 @@ class CustomerController extends Controller
             return response()->error('Unable to create customer portal login.');
         }
 
+        if ($error = $this->staffLinkedError($user)) {
+            return $error;
+        }
+
         if ($user->status !== 'active') {
             $user->activate();
         }
@@ -39,6 +44,10 @@ class CustomerController extends Controller
             return response()->error('Unable to send customer portal credentials.');
         }
 
+        if ($error = $this->staffLinkedError($user)) {
+            return $error;
+        }
+
         $password = $this->randomPassword();
         $user->changePassword($password);
         $this->sendCustomerCredentials($user, $password, $customer);
@@ -57,6 +66,10 @@ class CustomerController extends Controller
             return response()->error('Customer portal login not found.');
         }
 
+        if ($error = $this->staffLinkedError($user)) {
+            return $error;
+        }
+
         $user->deactivate();
 
         return response()->json([
@@ -73,6 +86,10 @@ class CustomerController extends Controller
             return response()->error('Customer portal login not found.');
         }
 
+        if ($error = $this->staffLinkedError($user)) {
+            return $error;
+        }
+
         $user->activate();
 
         return response()->json([
@@ -149,6 +166,10 @@ class CustomerController extends Controller
             return response()->error('Unable to reset customer credentials');
         }
 
+        if ($error = $this->staffLinkedError($user)) {
+            return $error;
+        }
+
         // Change password
         $user->changePassword($password);
 
@@ -163,6 +184,19 @@ class CustomerController extends Controller
         ]);
     }
 
+    /**
+     * A customer linked to a team member's account signs in with that account,
+     * which is managed in IAM.
+     */
+    protected function staffLinkedError(User $user): ?\Illuminate\Http\JsonResponse
+    {
+        if (ProfileAccountManager::isStaffAccount($user)) {
+            return response()->error('This customer signs in with a team member account. Manage this login in IAM.', 422);
+        }
+
+        return null;
+    }
+
     protected function resolveCustomer(Request $request): Contact
     {
         $customerId = $request->input('customer');
@@ -213,10 +247,12 @@ class CustomerController extends Controller
         $customer->loadMissing('user');
 
         return [
-            'id'        => $customer->public_id,
-            'uuid'      => $customer->uuid,
-            'user_uuid' => $customer->user_uuid,
-            'user'      => $customer->user ? [
+            'id'              => $customer->public_id,
+            'uuid'            => $customer->uuid,
+            'user_uuid'       => $customer->user_uuid,
+            'is_staff_linked' => ProfileAccountManager::isStaffAccount($customer->user),
+            'login_status'    => $customer->user?->status,
+            'user'            => $customer->user ? [
                 'id'             => $customer->user->public_id,
                 'uuid'           => $customer->user->uuid,
                 'name'           => $customer->user->name,