@fleetbase/fleetops-engine 0.6.68 → 0.6.69

package/server/src/Support/ProfileAccountManager.php

@@ -0,0 +1,405 @@
+<?php
+
+namespace Fleetbase\FleetOps\Support;
+
+use Fleetbase\FleetOps\Exceptions\ProfileIdentityConflictException;
+use Fleetbase\FleetOps\Mail\CustomerCredentialsMail;
+use Fleetbase\FleetOps\Mail\DriverCredentialsMail;
+use Fleetbase\FleetOps\Models\Contact;
+use Fleetbase\FleetOps\Models\Driver;
+use Fleetbase\Models\Company;
+use Fleetbase\Models\CompanyUser;
+use Fleetbase\Models\User;
+use Fleetbase\Services\SmsService;
+use Illuminate\Support\Facades\Mail;
+use Illuminate\Support\Str;
+
+/**
+ * Manages the login accounts behind driver, contact and customer profiles.
+ *
+ * A profile either owns a managed account (user type `driver`, `contact` or
+ * `customer`), which it creates, updates and deletes, or it is linked to a
+ * staff account (type `user` or `admin`) of the same organization. A staff
+ * account is managed in IAM, so a profile never changes its email or phone,
+ * resets its password, deactivates it or deletes it.
+ */
+class ProfileAccountManager
+{
+    /**
+     * User types owned by a profile.
+     */
+    public const MANAGED_TYPES = ['driver', 'contact', 'customer'];
+
+    /**
+     * The organization role given to each managed account type.
+     */
+    public const ROLES = [
+        'driver'   => 'Driver',
+        'contact'  => 'Fleet-Ops Contact',
+        'customer' => 'Fleet-Ops Customer',
+    ];
+
+    /**
+     * Whether the account is owned by a driver, contact or customer profile.
+     */
+    public static function isManagedAccount(?object $user): bool
+    {
+        return $user !== null && in_array(data_get($user, 'type'), static::MANAGED_TYPES, true);
+    }
+
+    /**
+     * Whether the account is a team member's account managed in IAM.
+     */
+    public static function isStaffAccount(?object $user): bool
+    {
+        return $user !== null && !static::isManagedAccount($user);
+    }
+
+    /**
+     * Find the active account holding the given email or phone.
+     */
+    public static function findAccountByIdentity(?string $email, ?string $phone, ?string $ignoreUserUuid = null): ?User
+    {
+        $email = static::normalizeEmail($email);
+        $phone = static::normalizePhone($phone);
+
+        if (!$email && !$phone) {
+            return null;
+        }
+
+        return User::where(function ($query) use ($email, $phone) {
+            if ($email) {
+                $query->orWhere('email', $email);
+            }
+
+            if ($phone) {
+                $query->orWhere('phone', $phone);
+            }
+        })
+            ->when($ignoreUserUuid, fn ($query) => $query->where('uuid', '!=', $ignoreUserUuid))
+            ->whereNull('deleted_at')
+            ->first();
+    }
+
+    /**
+     * Describe what would happen to an email/phone entered on a new or existing
+     * profile: `staff` is the team member the profile would link to, `conflict`
+     * is why the email/phone cannot be used.
+     *
+     * @return array{account: ?User, staff: ?User, conflict: ?string}
+     */
+    public static function lookup(string $companyUuid, string $type, ?string $email, ?string $phone, ?User $currentUser = null): array
+    {
+        $result  = ['account' => null, 'staff' => null, 'conflict' => null];
+        $account = static::findAccountByIdentity($email, $phone, $currentUser?->uuid);
+
+        if (!$account) {
+            return $result;
+        }
+
+        $result['account'] = $account;
+        $field             = static::matchedField($account, $email);
+
+        // An existing profile can't swap its account for another one
+        if ($currentUser) {
+            $result['conflict'] = static::takenMessage($field);
+
+            return $result;
+        }
+
+        try {
+            static::assertAccountCanHoldProfile($account, $companyUuid, $type, $field);
+        } catch (ProfileIdentityConflictException $e) {
+            $result['conflict'] = $e->getMessage();
+
+            return $result;
+        }
+
+        if (static::isStaffAccount($account)) {
+            $result['staff'] = $account;
+        }
+
+        return $result;
+    }
+
+    /**
+     * Resolve the account for a new profile. A staff member of the organization
+     * or a managed account of the same type with the email/phone is linked;
+     * otherwise a managed account is created.
+     *
+     * @param array $attributes extra user attributes: password, status, timezone, avatar_uuid, country, ip_address, meta
+     *
+     * @throws ProfileIdentityConflictException
+     */
+    public static function resolveForProfile(string $companyUuid, string $type, ?string $name, ?string $email, ?string $phone, array $attributes = []): User
+    {
+        $account = static::findAccountByIdentity($email, $phone);
+
+        if ($account) {
+            static::assertAccountCanHoldProfile($account, $companyUuid, $type, static::matchedField($account, $email));
+
+            if (static::isManagedAccount($account)) {
+                static::attachToCompany($account, $companyUuid, $type);
+            }
+
+            return $account;
+        }
+
+        return static::createManagedAccount($companyUuid, $type, $name, $email, $phone, $attributes);
+    }
+
+    /**
+     * Create a managed account and add it to the organization without an invite.
+     */
+    public static function createManagedAccount(string $companyUuid, string $type, ?string $name, ?string $email, ?string $phone, array $attributes = []): User
+    {
+        $company  = Company::where('uuid', $companyUuid)->first();
+        $password = $attributes['password'] ?? null;
+        $userData = array_filter([
+            'company_uuid' => $companyUuid,
+            'name'         => $name,
+            'email'        => static::normalizeEmail($email),
+            'phone'        => static::normalizePhone($phone),
+            'username'     => User::generateUsername($name ?: Str::random(6)),
+            'timezone'     => $attributes['timezone'] ?? $company?->timezone ?? date_default_timezone_get(),
+            'status'       => $attributes['status'] ?? 'pending',
+            'avatar_uuid'  => $attributes['avatar_uuid'] ?? null,
+            'country'      => $attributes['country'] ?? null,
+            'ip_address'   => $attributes['ip_address'] ?? null,
+            'meta'         => $attributes['meta'] ?? null,
+        ], fn ($value) => $value !== null);
+
+        $user           = new User($userData);
+        $user->password = $password ?: Str::random(16);
+        $user->save();
+        $user->setType($type);
+
+        static::attachToCompany($user, $companyUuid, $type);
+
+        return $user;
+    }
+
+    /**
+     * Push the profile's proxy fields to its account. A staff account only
+     * takes the name: its email and phone are its console identity.
+     *
+     * @throws ProfileIdentityConflictException
+     */
+    public static function syncProxyFields(?User $user, array $attributes): bool
+    {
+        if (!$user) {
+            return false;
+        }
+
+        $fields = static::isStaffAccount($user) ? ['name'] : ['name', 'email', 'phone', 'timezone', 'avatar_uuid', 'password'];
+        $input  = array_intersect_key($attributes, array_flip($fields));
+
+        if (array_key_exists('email', $input)) {
+            $input['email'] = static::normalizeEmail($input['email']);
+        }
+
+        if (array_key_exists('phone', $input)) {
+            $input['phone'] = static::normalizePhone($input['phone']);
+        }
+
+        $input = array_filter($input, fn ($value, $key) => $value !== null || in_array($key, ['email', 'phone'], true), ARRAY_FILTER_USE_BOTH);
+        $input = array_filter($input, fn ($value, $key) => $key === 'password' || $user->{$key} !== $value, ARRAY_FILTER_USE_BOTH);
+
+        if (empty($input)) {
+            return false;
+        }
+
+        $changedEmail = array_key_exists('email', $input) ? $input['email'] : null;
+        $changedPhone = array_key_exists('phone', $input) ? $input['phone'] : null;
+        $taken        = static::findAccountByIdentity($changedEmail, $changedPhone, $user->uuid);
+        if ($taken) {
+            throw new ProfileIdentityConflictException(static::takenMessage(static::matchedField($taken, $changedEmail)), static::matchedField($taken, $changedEmail));
+        }
+
+        if (isset($input['password'])) {
+            $user->password = $input['password'];
+            unset($input['password']);
+        }
+
+        $user->fill($input);
+
+        return $user->save();
+    }
+
+    /**
+     * Release a profile's account after the profile is deleted. A managed
+     * account with no other profile is deleted, which frees its email and
+     * phone; one still used by another organization's profile only leaves this
+     * organization. Staff accounts are never touched.
+     */
+    public static function releaseForProfile(?User $user, ?string $companyUuid = null): void
+    {
+        if (!static::isManagedAccount($user) || $user->trashed()) {
+            return;
+        }
+
+        $remainingProfiles = static::profileCompanies($user);
+        if ($remainingProfiles->isEmpty()) {
+            $user->delete();
+
+            return;
+        }
+
+        if ($companyUuid && !$remainingProfiles->contains($companyUuid)) {
+            CompanyUser::where(['company_uuid' => $companyUuid, 'user_uuid' => $user->uuid])->delete();
+        }
+    }
+
+    /**
+     * Generate a new password for the account and send it to the profile.
+     *
+     * @return string how the credentials were sent: `email` or `sms`
+     */
+    public static function sendCredentials(Driver|Contact $profile, User $user, ?string $password = null): string
+    {
+        $password ??= Str::random(12);
+        $user->changePassword($password);
+
+        if ($user->status !== 'active') {
+            $user->activate();
+        }
+
+        return static::deliverCredentials($profile, $user, $password);
+    }
+
+    /**
+     * Send already set credentials to the profile by email, or by SMS when the
+     * account has no email.
+     */
+    public static function deliverCredentials(Driver|Contact $profile, User $user, string $password): string
+    {
+        if ($user->email) {
+            Mail::to($user)->send($profile instanceof Driver ? new DriverCredentialsMail($password, $profile, $user) : new CustomerCredentialsMail($password, $profile));
+
+            return 'email';
+        }
+
+        if ($user->phone) {
+            $profile->loadMissing('company');
+            $companyName = $profile->company?->name ?? config('app.name');
+            $identity    = $user->phone;
+            $result      = app(SmsService::class)->send($user->phone, "Your {$companyName} sign-in details. Login: {$identity} Password: {$password}");
+
+            if (is_array($result) && array_key_exists('success', $result) && !$result['success']) {
+                throw new \Exception('The credentials could not be texted: ' . ($result['error'] ?? $result['message'] ?? 'the SMS provider refused it.'));
+            }
+
+            return 'sms';
+        }
+
+        throw new \Exception('This profile has no email or phone to send credentials to.');
+    }
+
+    /**
+     * Throw when the account can't hold the kind of profile being created.
+     *
+     * @throws ProfileIdentityConflictException
+     */
+    public static function assertAccountCanHoldProfile(User $account, string $companyUuid, string $type, string $field = 'email'): void
+    {
+        if (static::isStaffAccount($account)) {
+            if (!static::isCompanyMember($account, $companyUuid)) {
+                throw new ProfileIdentityConflictException(static::takenMessage($field), $field);
+            }
+        } elseif ($account->type !== $type) {
+            throw new ProfileIdentityConflictException('This ' . static::fieldLabel($field) . ' is already used by a ' . $account->type . '.', $field);
+        }
+
+        if (static::hasProfileInCompany($account, $companyUuid, $type)) {
+            throw new ProfileIdentityConflictException('A ' . $type . ' with this ' . static::fieldLabel($field) . ' already exists.', $field);
+        }
+    }
+
+    public static function hasProfileInCompany(User $user, string $companyUuid, string $type): bool
+    {
+        if ($type === 'driver') {
+            return Driver::withoutGlobalScopes()->where(['user_uuid' => $user->uuid, 'company_uuid' => $companyUuid])->whereNull('deleted_at')->exists();
+        }
+
+        return Contact::withoutGlobalScopes()->where(['user_uuid' => $user->uuid, 'company_uuid' => $companyUuid])->whereNull('deleted_at')->exists();
+    }
+
+    /**
+     * The organizations the account still has a driver or contact profile in.
+     */
+    public static function profileCompanies(User $user): \Illuminate\Support\Collection
+    {
+        $drivers  = Driver::withoutGlobalScopes()->where('user_uuid', $user->uuid)->whereNull('deleted_at')->pluck('company_uuid');
+        $contacts = Contact::withoutGlobalScopes()->where('user_uuid', $user->uuid)->whereNull('deleted_at')->pluck('company_uuid');
+
+        return $drivers->merge($contacts)->filter()->unique()->values();
+    }
+
+    public static function isCompanyMember(User $user, ?string $companyUuid): bool
+    {
+        if (!$companyUuid) {
+            return false;
+        }
+
+        return $user->company_uuid === $companyUuid || CompanyUser::where(['company_uuid' => $companyUuid, 'user_uuid' => $user->uuid])->exists();
+    }
+
+    /**
+     * Add a managed account to the organization with its profile role, without
+     * sending an organization invite.
+     */
+    public static function attachToCompany(User $user, string $companyUuid, string $type): ?CompanyUser
+    {
+        $company = Company::where('uuid', $companyUuid)->first();
+        if (!$company) {
+            return null;
+        }
+
+        $role        = static::ROLES[$type] ?? static::ROLES['contact'];
+        $companyUser = CompanyUser::where(['company_uuid' => $companyUuid, 'user_uuid' => $user->uuid])->first();
+        if (!$companyUser) {
+            $companyUser = $company->addUser($user, $role);
+        } elseif (static::isManagedAccount($user)) {
+            $companyUser->assignSingleRole($role);
+        }
+
+        if (!$user->company_uuid) {
+            $user->forceFill(['company_uuid' => $companyUuid])->saveQuietly();
+        }
+
+        $user->setRelation('companyUser', $companyUser);
+
+        return $companyUser;
+    }
+
+    public static function normalizeEmail(?string $email): ?string
+    {
+        $email = is_string($email) ? strtolower(trim($email)) : null;
+
+        return $email ?: null;
+    }
+
+    public static function normalizePhone(?string $phone): ?string
+    {
+        $phone = is_string($phone) ? trim($phone) : null;
+
+        return $phone ? Utils::formatPhoneNumber($phone) : null;
+    }
+
+    private static function matchedField(User $account, ?string $email): string
+    {
+        $email = static::normalizeEmail($email);
+
+        return $email && strtolower((string) $account->email) === $email ? 'email' : 'phone';
+    }
+
+    private static function fieldLabel(string $field): string
+    {
+        return $field === 'phone' ? 'phone number' : 'email';
+    }
+
+    private static function takenMessage(string $field): string
+    {
+        return 'This ' . static::fieldLabel($field) . ' is already in use by another account.';
+    }
+}

package/server/src/routes.php

@@ -444,6 +444,10 @@ Route::prefix(config('fleetops.api.routing.prefix'))->namespace('Fleetbase\Fleet
                                 $router->post('{id}/unassign-order', $controller('unassignOrder'));
                                 $router->post('{id}/assign-vehicle', $controller('assignVehicle'));
                                 $router->post('{id}/unassign-vehicle', $controller('unassignVehicle'));
+                                $router->post('{id}/send-credentials', $controller('sendCredentials'));
+                                $router->post('{id}/reset-credentials', $controller('resetCredentials'));
+                                $router->post('{id}/deactivate-login', $controller('deactivateLogin'));
+                                $router->post('{id}/reactivate-login', $controller('reactivateLogin'));
                                 $router->match(['get', 'post'], 'export', $controller('export'));
                                 $router->post('import', $controller('import'));
                                 // Driver scheduling endpoints
@@ -764,6 +768,7 @@ Route::prefix(config('fleetops.api.routing.prefix'))->namespace('Fleetbase\Fleet
                                     function ($router) {
                                         $router->get('customers', 'FleetOpsLookupController@polymorphs');
                                         $router->get('facilitators', 'FleetOpsLookupController@polymorphs');
+                                        $router->get('profile-identity', 'FleetOpsLookupController@profileIdentity');
                                     }
                                 );
                                 $router->group(

package/server/tests/AiOperationalQueryCapabilityTest.php

@@ -406,6 +406,7 @@ test('asset status capability exposes metadata and denied branches', function ()
         ->and($capability->label())->toBe('Fleet-Ops asset status')
         ->and($capability->description())->toContain('vehicle, device, sensor')
         ->and($capability->permissions())->toBe([
+            'fleet-ops see driver',
             'fleet-ops see vehicle',
             'fleet-ops see device',
             'fleet-ops see sensor',

package/server/tests/ApiCustomerControllerContractsTest.php

@@ -800,6 +800,27 @@ test('api customer controller authenticates and verifies customer codes', functi
         ]))))->toBe(['error' => 'Invalid verification code.']);
 });
 
+test('api customer controller refuses deactivated customer logins', function () {
+    $controller = fleetopsApiCustomerController();
+    foreach (['activeUser', 'loginUser', 'verificationUser'] as $property) {
+        $controller->{$property}->setAttribute('status', 'inactive');
+    }
+
+    $responses = [
+        $controller->login(Request::create('/v1/customers/login', 'POST', ['identity' => 'jane@example.test', 'password' => 'password-secret'])),
+        $controller->loginWithPhone(Request::create('/v1/customers/login/phone', 'POST', ['phone' => '15551234567'])),
+        $controller->verifyCode(Request::create('/v1/customers/verify', 'POST', ['identity' => 'jane@example.test', 'code' => '123456'])),
+    ];
+
+    foreach ($responses as $response) {
+        expect($response->getStatusCode())->toBe(403)
+            ->and(fleetopsApiCustomerJson($response))->toBe(['error' => 'This customer login has been deactivated.']);
+    }
+
+    // No verification code is sent
+    expect($controller->smsVerifications)->toBe([]);
+});
+
 test('api customer controller resets forgotten passwords', function () {
     $controller = fleetopsApiCustomerController();
     $forgot     = $controller->forgotPassword(Request::create('/v1/customers/forgot-password', 'POST', [

package/server/tests/ApiDriverControllerContractsTest.php

@@ -30,6 +30,8 @@ class FleetOpsApiDriverControllerProbe extends DriverController
     public array $deviceCreates             = [];
     public array $companyCalls              = [];
     public array $createdUsers              = [];
+    public array $resolvedAccounts          = [];
+    public ?Throwable $accountConflict      = null;
     public array $uuidLookups               = [];
     public array $relationLookups           = [];
     public array $relationCompanyScopes     = [];
@@ -65,11 +67,17 @@ class FleetOpsApiDriverControllerProbe extends DriverController
         return $userDetails;
     }
 
-    protected function createUser(array $userDetails): User
+    protected function resolveDriverAccount(string $companyUuid, array $userDetails): User
     {
-        $this->createdUsers[] = $userDetails;
+        $this->resolvedAccounts[] = $companyUuid;
+        $this->createdUsers[]     = $userDetails;
+
+        if ($this->accountConflict) {
+            throw $this->accountConflict;
+        }
+
         $this->user ??= new FleetOpsApiDriverUserFake();
-        $this->user->setRawAttributes(array_merge(['uuid' => 'user-uuid'], $userDetails), true);
+        $this->user->setRawAttributes(array_merge(['uuid' => 'user-uuid', 'type' => 'driver'], $userDetails), true);
 
         return $this->user;
     }
@@ -282,7 +290,17 @@ class FleetOpsApiDriverUserFake extends User
         return true;
     }
 
-    public function assignCompany(Company $company, string $role = 'Administrator'): User
+    public function save(array $options = []): bool
+    {
+        $this->updates[] = $this->getDirty();
+        $this->syncOriginal();
+
+        return true;
+    }
+
+    // Matches core-api 1.6.63+, where no role is granted unless one is given (a nullable
+    // role is also compatible with older core-api, whose parameter was a plain string).
+    public function assignCompany(Company $company, ?string $role = null): User
     {
         $this->assignedCompanies[] = $company->uuid;
 
@@ -317,6 +335,27 @@ class FleetOpsApiDriverUserFake extends User
     }
 }
 
+/**
+ * ProfileAccountManager checks a changed email/phone against the users table.
+ */
+function fleetopsApiDriverContractsUsersTable(array $rows = []): void
+{
+    $connection = new Illuminate\Database\SQLiteConnection(new PDO('sqlite::memory:'));
+    $connection->getSchemaBuilder()->create('users', function ($table) {
+        $table->string('uuid')->nullable();
+        $table->string('type')->nullable();
+        $table->string('email')->nullable();
+        $table->string('phone')->nullable();
+        $table->timestamp('deleted_at')->nullable();
+    });
+    if ($rows) {
+        $connection->table('users')->insert($rows);
+    }
+    $resolver = new Illuminate\Database\ConnectionResolver(['default' => $connection, 'mysql' => $connection]);
+    $resolver->setDefaultConnection('mysql');
+    Illuminate\Database\Eloquent\Model::setConnectionResolver($resolver);
+}
+
 class FleetOpsApiDriverVehicleFake extends Vehicle
 {
     public array $quietUpdates = [];
@@ -363,16 +402,15 @@ test('api driver controller creates drivers with user company assignment and rel
 
     expect($response)->toBe(['resource' => 'driver', 'driver' => $controller->driver])
         ->and($controller->companyCalls)->toBe([['request', 'company_public']])
+        // The login account is resolved by ProfileAccountManager in the driver's company
+        ->and($controller->resolvedAccounts)->toBe(['company-uuid'])
         ->and($controller->createdUsers[0])->toMatchArray([
-            'name'         => 'Driver One',
-            'email'        => 'driver@example.test',
-            'phone'        => '+15551234567',
-            'company_uuid' => 'company-uuid',
-            'applied'      => true,
+            'name'     => 'Driver One',
+            'email'    => 'driver@example.test',
+            'phone'    => '+15551234567',
+            'password' => 'secret-password',
+            'applied'  => true,
         ])
-        ->and($controller->user->assignedCompanies)->toBe(['company-uuid'])
-        ->and($controller->user->assignedTypes)->toBe(['driver'])
-        ->and($controller->user->assignedRoles)->toBe(['Driver'])
         ->and($controller->createdDrivers[0])->toMatchArray([
             'status'           => 'available',
             'vehicle_uuid'     => 'vehicle-uuid',
@@ -407,8 +445,10 @@ test('api driver controller reports missing company before creating drivers', fu
 });
 
 test('api driver controller updates drivers user details assignments location and photo', function () {
+    fleetopsApiDriverContractsUsersTable();
+
     $user = new FleetOpsApiDriverUserFake();
-    $user->setRawAttributes(['uuid' => 'user-uuid'], true);
+    $user->setRawAttributes(['uuid' => 'user-uuid', 'type' => 'driver'], true);
 
     $driver = new FleetOpsApiDriverFake();
     $driver->setRawAttributes([
@@ -645,7 +685,7 @@ test('api driver controller refuses to set a password through a general update',
      * and now has its own endpoint that demands the current password.
      */
     $user = new FleetOpsApiDriverUserFake();
-    $user->setRawAttributes(['uuid' => 'user-uuid'], true);
+    $user->setRawAttributes(['uuid' => 'user-uuid', 'type' => 'driver'], true);
     $driver = new FleetOpsApiDriverFake();
     $driver->setRawAttributes([
         'uuid'      => 'driver-uuid',
@@ -759,11 +799,9 @@ test('api driver controller creates an operational driver with no email or phone
             'company_uuid' => 'company-uuid',
             'status'       => 'available',
         ])
-        // The Driver-to-User relationship, organization membership, user type
-        // and role are all preserved for a credential-less driver.
-        ->and($controller->user->assignedCompanies)->toBe(['company-uuid'])
-        ->and($controller->user->assignedTypes)->toBe(['driver'])
-        ->and($controller->user->assignedRoles)->toBe(['Driver']);
+        // The Driver-to-User relationship and organization membership are
+        // preserved for a credential-less driver.
+        ->and($controller->resolvedAccounts)->toBe(['company-uuid']);
 });
 
 test('api driver controller creates a driver with only one contact method', function () {
@@ -873,7 +911,7 @@ test('api driver controller copies timezone through to the linked user account',
     ]));
 
     $user = new FleetOpsApiDriverUserFake();
-    $user->setRawAttributes(['uuid' => 'user-uuid'], true);
+    $user->setRawAttributes(['uuid' => 'user-uuid', 'type' => 'driver'], true);
 
     $driver = new FleetOpsApiDriverFake();
     $driver->setRawAttributes(['uuid' => 'driver-uuid', 'public_id' => 'driver_public', 'user_uuid' => 'user-uuid'], true);
@@ -905,3 +943,47 @@ test('api driver controller only expands relationships the public contract allow
     // name is dropped rather than reaching Eloquent, where it would be a 500.
     expect($request->input('with'))->toBe(['vehicle', 'currentJob']);
 });
+
+test('api driver controller answers 422 when the email or phone belongs to another account', function () {
+    $create                  = new FleetOpsApiDriverControllerProbe();
+    $create->accountConflict = new Fleetbase\FleetOps\Exceptions\ProfileIdentityConflictException('This email is already in use by another account.');
+
+    expect($create->create(new CreateDriverRequest(['name' => 'Driver One', 'email' => 'taken@example.test'])))->toBe([
+        'json'   => ['error' => 'This email is already in use by another account.'],
+        'status' => 422,
+    ])
+        ->and($create->createdDrivers)->toBe([]);
+
+    fleetopsApiDriverContractsUsersTable([['uuid' => 'other-user', 'type' => 'user', 'phone' => '+15550009999']]);
+
+    $user = new FleetOpsApiDriverUserFake();
+    $user->setRawAttributes(['uuid' => 'user-uuid', 'type' => 'driver', 'phone' => '+15550001111'], true);
+    $driver = new FleetOpsApiDriverFake();
+    $driver->setRawAttributes(['uuid' => 'driver-uuid', 'public_id' => 'driver_public', 'user_uuid' => 'user-uuid'], true);
+    $driver->userForTest = $user;
+
+    $update         = new FleetOpsApiDriverControllerProbe();
+    $update->driver = $driver;
+
+    expect($update->update('driver_public', new UpdateDriverRequest(['phone' => '+1 555 000 9999'])))->toBe([
+        'json'   => ['error' => 'This phone number is already in use by another account.'],
+        'status' => 422,
+    ])
+        ->and($user->updates)->toBe([])
+        ->and($driver->updates)->toBe([]);
+});
+
+test('api driver controller only renames a team member account linked to a driver', function () {
+    $staff = new FleetOpsApiDriverUserFake();
+    $staff->setRawAttributes(['uuid' => 'staff-uuid', 'type' => 'user', 'name' => 'Staff', 'email' => 'staff@example.test'], true);
+    $driver = new FleetOpsApiDriverFake();
+    $driver->setRawAttributes(['uuid' => 'driver-uuid', 'public_id' => 'driver_public', 'user_uuid' => 'staff-uuid'], true);
+    $driver->userForTest = $staff;
+
+    $update         = new FleetOpsApiDriverControllerProbe();
+    $update->driver = $driver;
+    $update->update('driver_public', new UpdateDriverRequest(['name' => 'Staff Driver', 'email' => 'changed@example.test']));
+
+    expect($staff->updates)->toBe([['name' => 'Staff Driver']])
+        ->and($staff->email)->toBe('staff@example.test');
+});