@fleetbase/fleetops-engine 0.6.68 → 0.6.69

package/server/tests/CommandContractsTest.php

@@ -884,7 +884,7 @@ class FleetOpsUserCommandFake
         return true;
     }
 
-    public function assignCompany(Company $company, string $role = 'Administrator'): self
+    public function assignCompany(Company $company, ?string $role = null): self
     {
         $this->assigned[] = [$company->uuid, $role];
 
@@ -2208,8 +2208,8 @@ test('fix customer companies command creates or links users and assigns missing
             ['email', FleetOpsCustomerCommandFake::class],
             ['phone', FleetOpsCustomerCommandFake::class],
         ])
-        ->and($createdUser->assigned)->toBe([['company-created', 'Administrator']])
-        ->and($existingUser->assigned)->toBe([['company-existing', 'Administrator']]);
+        ->and($createdUser->assigned)->toBe([['company-created', 'Fleet-Ops Customer']])
+        ->and($existingUser->assigned)->toBe([['company-existing', 'Fleet-Ops Customer']]);
 });
 
 test('fix driver companies command syncs assigned users and missing company assignments', function () {
@@ -2236,7 +2236,7 @@ test('fix driver companies command syncs assigned users and missing company assi
             ['email', Driver::class],
             ['phone', Driver::class],
         ])
-        ->and($user->assigned)->toBe([['driver-company', 'Administrator']])
+        ->and($user->assigned)->toBe([['driver-company', 'Driver']])
         ->and($command->messages)->toContain(['line', 'Found driver Driver User (driver@example.test) which doesnt have correct company assignment.'])
         ->and($command->messages)->toContain(['line', 'Driver driver@example.test was assigned to company: Driver Company']);
 });

package/server/tests/ControllerHelperContractsTest.php

@@ -254,7 +254,6 @@ class FleetOpsZoneControllerProbe extends ZoneController
 class FleetOpsInternalContactControllerProbe extends InternalContactController
 {
     public array $installedPackages = [];
-    public array $resolvedUsers     = [];
     public array $sentCredentials   = [];
     public array $savedMetas        = [];
     public ?User $contactUser       = null;
@@ -269,13 +268,6 @@ class FleetOpsInternalContactControllerProbe extends InternalContactController
         return $reflection->invoke($this, ...$arguments);
     }
 
-    protected function resolveUserUuid(string $user): string
-    {
-        $this->resolvedUsers[] = $user;
-
-        return 'resolved-' . $user;
-    }
-
     protected function installedFleetbaseExtensions(): array
     {
         return $this->installedPackages;
@@ -1607,7 +1599,7 @@ test('internal contact controller create update and after save hooks protect cus
             ],
         ],
     ]);
-    $input      = ['type' => 'contact', 'user' => ['id' => 'user_public']];
+    $input      = ['type' => 'contact', 'user' => ['id' => 'user_public'], 'user_uuid' => 'user-uuid'];
 
     $controller->onBeforeCreate($request, $input);
 
@@ -1623,8 +1615,8 @@ test('internal contact controller create update and after save hooks protect cus
 
     $controller->afterSave($request, $contact);
 
-    expect($input)->toBe(['type' => 'contact', 'user_uuid' => 'resolved-user_public'])
-        ->and($controller->resolvedUsers)->toBe(['user_public'])
+    // The login account is managed by the profile, so a user can't be picked from the console
+    expect($input)->toBe(['type' => 'contact'])
         ->and($contact->normalized)->toBeTrue()
         ->and($contact->syncedCustomFields)->toBe([
             ['key' => 'tier', 'value' => 'gold'],

package/server/tests/Feature/Http/AfaqyRealtimeIngestionTest.php

@@ -596,6 +596,11 @@ test('inbox completion waits for pending deliveries and aggregates quarantined f
     DB::table('telematic_deliveries')->where('uuid', $id)->update(['status' => 'quarantined', 'applied' => 2, 'failed' => 1]);
     Inbox::finishRun('run-pending');
     expect((array) DB::table('telematic_sync_runs')->first())->toMatchArray(['status' => 'partial', 'applied' => 2, 'failed' => 1]);
+
+    // A finished run whose connection was removed completes without touching connection meta
+    DB::table('telematic_sync_runs')->insert(['uuid' => 'run-orphan', 'telematic_uuid' => 'missing-connection', 'status' => 'ingesting', 'created_at' => now(), 'updated_at' => now()]);
+    Inbox::finishRun('run-orphan');
+    expect(DB::table('telematic_sync_runs')->where('uuid', 'run-orphan')->value('status'))->not->toBe('ingesting');
 });
 
 test('telemetry diagnostics report setup receipt backlog and degraded delivery states', function () {

package/server/tests/Feature/Http/Api/DriverControllerAuthFlowsTest.php

@@ -230,6 +230,42 @@ test('password login rejects bad credentials and issues driver tokens', function
         ->and($connection->table('personal_access_tokens')->value('name'))->toBe('driver-1');
 });
 
+test('deactivated driver logins are refused on every sign-in path', function () {
+    $connection = fleetopsDriverAuthBoot();
+    $controller = new DriverController();
+    $connection->table('users')->where('uuid', 'user-1')->update(['status' => 'inactive']);
+    app('hash')->checks = true;
+
+    // An unknown identity fails authentication rather than erroring on a null user
+    $unknown = $controller->login(Request::create('/x', 'POST', ['identity' => 'ghost@example.test', 'password' => 'secret']));
+    expect($unknown->getStatusCode())->toBe(401);
+
+    $password = $controller->login(Request::create('/x', 'POST', ['identity' => 'driver@example.test', 'password' => 'secret']));
+
+    app()->instance('request', Request::create('/x', 'POST', ['phone' => '6591234567']));
+    $phone = $controller->loginWithPhone();
+
+    $connection->table('verification_codes')->insert(['uuid' => 'vc-1', 'subject_uuid' => 'user-1', 'code' => '424242', 'for' => 'driver_login']);
+    $code = $controller->verifyCode(Request::create('/x', 'POST', ['identity' => '6591234567', 'code' => '424242']));
+
+    foreach ([$password, $phone, $code] as $response) {
+        expect($response->getStatusCode())->toBe(403)
+            ->and($response->getData(true)['error'])->toBe(DriverController::DEACTIVATED_LOGIN_MESSAGE);
+    }
+
+    // Password recovery answers as if the identity were unknown
+    $forgot = $controller->forgotPassword(Request::create('/x', 'POST', ['identity' => 'driver@example.test']));
+    $reset  = $controller->resetPassword(Request::create('/x', 'POST', ['identity' => 'driver@example.test', 'code' => '424242', 'password' => 'new-secret-123']));
+
+    expect($forgot->getData(true))->toBe(['status' => 'ok'])
+        ->and($reset->getStatusCode())->toBe(422)
+        ->and($reset->getData(true)['error'])->toBe('Invalid or expired reset code.');
+
+    expect(DriverController::isLoginDeactivated(User::where('uuid', 'user-1')->first()))->toBeTrue()
+        ->and($connection->table('personal_access_tokens')->count())->toBe(0)
+        ->and($connection->table('verification_codes')->count())->toBe(1);
+});
+
 test('phone login falls back to email verification and errors without channels', function () {
     $connection = fleetopsDriverAuthBoot();
     $controller = new DriverController();

package/server/tests/Feature/Http/Api/DriverControllerSessionHelpersTest.php

@@ -106,7 +106,7 @@ function fleetopsDriverSessionHelpersBoot(): SQLiteConnection
     $schema = $connection->getSchemaBuilder();
     app()->instance('db.schema', $schema);
     $tables = [
-        'users'        => ['uuid', 'public_id', 'company_uuid', 'name', 'email', 'phone', 'status', 'type', 'username', 'password'],
+        'users'        => ['uuid', 'public_id', 'company_uuid', 'name', 'email', 'phone', 'status', 'type', 'username', 'password', 'timezone', 'slug', 'meta'],
         'drivers'      => ['uuid', 'public_id', 'internal_id', 'company_uuid', 'user_uuid', 'vehicle_uuid', 'vendor_uuid', 'status', 'online', 'location', 'meta'],
         'companies'    => ['uuid', 'public_id', 'name', 'status', 'owner_uuid'],
         'user_devices' => ['uuid', 'public_id', 'user_uuid', 'token', 'platform', 'status'],
@@ -189,22 +189,35 @@ test('user and driver persistence helpers write records', function () {
     $userDetails = $probe->callHelper('applyUserInfoFromRequest', Request::create('/x', 'POST', []), ['name' => 'Applicant']);
     expect($userDetails['name'])->toBe('Applicant');
 
-    $user = $probe->callHelper('createUser', ['name' => 'New User']);
+    // A company that isn't in the table skips the organization membership seam,
+    // which needs spatie roles; the managed account itself is still created.
+    $missingCompany = '33333333-3333-4333-8333-333333333333';
+
+    $user = $probe->callHelper('resolveDriverAccount', $missingCompany, ['name' => 'New User']);
     expect($user)->toBeInstanceOf(User::class)
-        ->and($connection->table('users')->where('name', 'New User')->count())->toBe(1);
+        ->and($connection->table('users')->where('name', 'New User')->count())->toBe(1)
+        ->and($connection->table('users')->where('name', 'New User')->value('type'))->toBe('driver')
+        ->and($connection->table('users')->where('name', 'New User')->value('status'))->toBe('active');
 
     /*
      * `password` is guarded on User, so mass assignment drops it without a
      * word. The create endpoint has always documented and validated one, so
-     * unless the helper sets it explicitly a driver created through the API
-     * can never sign in with the password chosen for them.
+     * unless it is set explicitly a driver created through the API can never
+     * sign in with the password chosen for them.
      */
-    $withPassword = $probe->callHelper('createUser', ['name' => 'Password User', 'password' => 'seeded-password']);
+    $withPassword = $probe->callHelper('resolveDriverAccount', $missingCompany, ['name' => 'Password User', 'password' => 'seeded-password']);
     $stored       = $connection->table('users')->where('name', 'Password User')->value('password');
     expect(Hash::check('seeded-password', $withPassword->password))->toBeTrue()
         ->and($stored)->not->toBeNull()
         ->and($stored)->not->toBe('seeded-password');
 
+    // A team member of the company with the email is linked instead of duplicated
+    $connection->table('users')->insert(['uuid' => 'staff-1', 'company_uuid' => '22222222-2222-4222-8222-222222222222', 'name' => 'Staff', 'email' => 'staff@example.test', 'type' => 'user']);
+    $linked = $probe->callHelper('resolveDriverAccount', '22222222-2222-4222-8222-222222222222', ['name' => 'Staff Driver', 'email' => 'STAFF@example.test']);
+    expect($linked->uuid)->toBe('staff-1')
+        ->and($connection->table('users')->where('email', 'staff@example.test')->count())->toBe(1)
+        ->and($connection->table('users')->where('uuid', 'staff-1')->value('type'))->toBe('user');
+
     $driver = $probe->callHelper('createDriver', ['company_uuid' => '22222222-2222-4222-8222-222222222222', 'user_uuid' => 'user-1']);
     expect($driver)->toBeInstanceOf(Driver::class);
 

package/server/tests/Feature/Http/Api/ProfileOnlyUserConversionMigrationTest.php

@@ -0,0 +1,201 @@
+<?php
+
+use Illuminate\Database\ConnectionResolver;
+use Illuminate\Database\Eloquent\Model as EloquentModel;
+use Illuminate\Database\SQLiteConnection;
+use Illuminate\Support\Facades\DB;
+use Illuminate\Support\Facades\Schema;
+
+/**
+ * The migration that converts profile-only `user` accounts into managed
+ * driver/customer accounts, run up and down against in-memory SQLite.
+ *
+ * An account is converted only when it clearly is a profile login and nothing
+ * else; anything that looks like a team member is left alone, and down()
+ * reverts only the rows up() converted.
+ */
+function fleetopsProfileConversionBoot(bool $withPolicies = true): SQLiteConnection
+{
+    $connection = new SQLiteConnection(new PDO('sqlite::memory:'));
+    $resolver   = new ConnectionResolver(['default' => $connection, 'mysql' => $connection]);
+    $resolver->setDefaultConnection('mysql');
+    EloquentModel::setConnectionResolver($resolver);
+
+    app()->instance('db', new class($connection) {
+        public function __construct(public SQLiteConnection $c)
+        {
+        }
+
+        public function connection($name = null): SQLiteConnection
+        {
+            return $this->c;
+        }
+
+        public function table($table, $as = null)
+        {
+            return $this->c->table($table, $as);
+        }
+
+        public function __call($method, $arguments)
+        {
+            return $this->c->{$method}(...$arguments);
+        }
+    });
+    app()->instance('db.schema', $connection->getSchemaBuilder());
+    DB::clearResolvedInstance('db');
+    Schema::clearResolvedInstance('db.schema');
+
+    $schema = $connection->getSchemaBuilder();
+    $tables = [
+        'users'                 => ['uuid', 'type', 'meta'],
+        'drivers'               => ['uuid', 'user_uuid'],
+        'contacts'              => ['uuid', 'user_uuid', 'type'],
+        'companies'             => ['uuid', 'owner_uuid'],
+        'company_users'         => ['uuid', 'user_uuid', 'company_uuid'],
+        'roles'                 => ['name'],
+        'model_has_roles'       => ['role_id', 'model_uuid'],
+        'model_has_permissions' => ['permission_id', 'model_uuid'],
+    ];
+    if ($withPolicies) {
+        $tables['model_has_policies'] = ['policy_id', 'model_uuid'];
+    }
+    foreach ($tables as $table => $columns) {
+        $schema->create($table, function ($blueprint) use ($columns) {
+            $blueprint->increments('id');
+            foreach ($columns as $column) {
+                $blueprint->string($column)->nullable();
+            }
+            $blueprint->timestamp('deleted_at')->nullable();
+        });
+    }
+
+    foreach (['Driver', 'Fleet-Ops Customer', 'Administrator'] as $role) {
+        $connection->table('roles')->insert(['name' => $role]);
+    }
+
+    return $connection;
+}
+
+function fleetopsProfileConversionMigration(): object
+{
+    return require dirname(__DIR__, 4) . '/migrations/2026_09_21_000001_convert_profile_only_users_to_managed_accounts.php';
+}
+
+/**
+ * Seed a user holding the given profile(s), roles on its company membership
+ * (or on the user itself), and optional direct permission or policy.
+ */
+function fleetopsProfileConversionUser(SQLiteConnection $connection, string $uuid, array $options = []): void
+{
+    $connection->table('users')->insert(['uuid' => $uuid, 'type' => $options['type'] ?? 'user', 'meta' => $options['meta'] ?? null, 'deleted_at' => $options['deleted_at'] ?? null]);
+    $connection->table('company_users')->insert(['uuid' => 'cu-' . $uuid, 'user_uuid' => $uuid, 'company_uuid' => 'company-1']);
+
+    if ($options['driver'] ?? false) {
+        $connection->table('drivers')->insert(['uuid' => 'driver-' . $uuid, 'user_uuid' => $uuid]);
+    }
+
+    if ($options['customer'] ?? false) {
+        $connection->table('contacts')->insert(['uuid' => 'contact-' . $uuid, 'user_uuid' => $uuid, 'type' => 'customer']);
+    }
+
+    foreach ($options['roles'] ?? [] as $role) {
+        $roleId = $connection->table('roles')->where('name', $role)->value('id');
+        $connection->table('model_has_roles')->insert(['role_id' => $roleId, 'model_uuid' => ($options['role_on_user'] ?? false) ? $uuid : 'cu-' . $uuid]);
+    }
+
+    if ($options['permission'] ?? false) {
+        $connection->table('model_has_permissions')->insert(['permission_id' => 1, 'model_uuid' => 'cu-' . $uuid]);
+    }
+
+    if ($options['policy'] ?? false) {
+        $connection->table('model_has_policies')->insert(['policy_id' => 1, 'model_uuid' => $uuid]);
+    }
+}
+
+function fleetopsProfileConversionTypes(SQLiteConnection $connection): array
+{
+    return $connection->table('users')->orderBy('uuid')->pluck('type', 'uuid')->all();
+}
+
+test('up converts profile-only accounts and leaves anything that looks like a team member', function () {
+    $connection = fleetopsProfileConversionBoot();
+
+    fleetopsProfileConversionUser($connection, 'a-driver', ['driver' => true, 'roles' => ['Driver'], 'meta' => json_encode(['source' => 'console'])]);
+    fleetopsProfileConversionUser($connection, 'b-customer', ['customer' => true, 'roles' => ['Fleet-Ops Customer'], 'role_on_user' => true]);
+    fleetopsProfileConversionUser($connection, 'c-owner', ['driver' => true, 'roles' => ['Driver']]);
+    $connection->table('companies')->insert(['uuid' => 'company-1', 'owner_uuid' => 'c-owner']);
+    fleetopsProfileConversionUser($connection, 'd-extra-role', ['driver' => true, 'roles' => ['Driver', 'Administrator']]);
+    fleetopsProfileConversionUser($connection, 'e-permission', ['driver' => true, 'roles' => ['Driver'], 'permission' => true]);
+    fleetopsProfileConversionUser($connection, 'f-policy', ['customer' => true, 'roles' => ['Fleet-Ops Customer'], 'policy' => true]);
+    fleetopsProfileConversionUser($connection, 'g-both-profiles', ['driver' => true, 'customer' => true, 'roles' => ['Driver']]);
+    fleetopsProfileConversionUser($connection, 'h-no-roles', ['driver' => true]);
+    fleetopsProfileConversionUser($connection, 'i-wrong-role', ['customer' => true, 'roles' => ['Driver']]);
+    fleetopsProfileConversionUser($connection, 'j-no-profile', ['roles' => ['Driver']]);
+    fleetopsProfileConversionUser($connection, 'k-admin', ['type' => 'admin', 'driver' => true, 'roles' => ['Driver']]);
+    fleetopsProfileConversionUser($connection, 'l-deleted', ['driver' => true, 'roles' => ['Driver'], 'deleted_at' => '2026-01-01 00:00:00']);
+    fleetopsProfileConversionUser($connection, 'm-bad-meta', ['driver' => true, 'roles' => ['Driver'], 'meta' => 'not-json']);
+
+    fleetopsProfileConversionMigration()->up();
+
+    expect(fleetopsProfileConversionTypes($connection))->toBe([
+        'a-driver'        => 'driver',
+        'b-customer'      => 'customer',
+        'c-owner'         => 'user',
+        'd-extra-role'    => 'user',
+        'e-permission'    => 'user',
+        'f-policy'        => 'user',
+        'g-both-profiles' => 'user',
+        'h-no-roles'      => 'user',
+        'i-wrong-role'    => 'user',
+        'j-no-profile'    => 'user',
+        'k-admin'         => 'admin',
+        'l-deleted'       => 'user',
+        'm-bad-meta'      => 'driver',
+    ])
+        // The previous type is recorded next to any existing meta
+        ->and(json_decode($connection->table('users')->where('uuid', 'a-driver')->value('meta'), true))->toBe(['source' => 'console', 'previous_type' => 'user'])
+        ->and(json_decode($connection->table('users')->where('uuid', 'm-bad-meta')->value('meta'), true))->toBe(['previous_type' => 'user']);
+});
+
+test('down reverts only the accounts up converted', function () {
+    $connection = fleetopsProfileConversionBoot();
+
+    fleetopsProfileConversionUser($connection, 'a-driver', ['driver' => true, 'roles' => ['Driver'], 'meta' => json_encode(['source' => 'console'])]);
+    fleetopsProfileConversionUser($connection, 'b-customer', ['customer' => true, 'roles' => ['Fleet-Ops Customer']]);
+    // Managed accounts created after the change carry no previous type
+    fleetopsProfileConversionUser($connection, 'c-native-driver', ['type' => 'driver', 'driver' => true, 'meta' => json_encode(['source' => 'app'])]);
+    // A previous type other than `user` is not this migration's
+    fleetopsProfileConversionUser($connection, 'd-other-previous', ['type' => 'customer', 'customer' => true, 'meta' => json_encode(['previous_type' => 'contact'])]);
+
+    $migration = fleetopsProfileConversionMigration();
+    $migration->up();
+    $migration->down();
+
+    expect(fleetopsProfileConversionTypes($connection))->toBe([
+        'a-driver'         => 'user',
+        'b-customer'       => 'user',
+        'c-native-driver'  => 'driver',
+        'd-other-previous' => 'customer',
+    ])
+        ->and(json_decode($connection->table('users')->where('uuid', 'a-driver')->value('meta'), true))->toBe(['source' => 'console'])
+        ->and(json_decode($connection->table('users')->where('uuid', 'b-customer')->value('meta'), true))->toBe([])
+        ->and(json_decode($connection->table('users')->where('uuid', 'd-other-previous')->value('meta'), true))->toBe(['previous_type' => 'contact']);
+});
+
+test('up and down do nothing when the tables they read are missing', function () {
+    $connection = fleetopsProfileConversionBoot(false);
+    fleetopsProfileConversionUser($connection, 'a-driver', ['driver' => true, 'roles' => ['Driver']]);
+
+    $migration = fleetopsProfileConversionMigration();
+    $migration->up();
+
+    expect(fleetopsProfileConversionTypes($connection))->toBe(['a-driver' => 'user']);
+
+    $connection->table('users')->where('uuid', 'a-driver')->update(['type' => 'driver', 'meta' => json_encode(['previous_type' => 'user'])]);
+    $connection->getSchemaBuilder()->drop('users');
+
+    // Without a users table there is nothing to revert
+    $migration->down();
+
+    expect($connection->getSchemaBuilder()->hasTable('users'))->toBeFalse();
+});

package/server/tests/Feature/Http/Internal/ContactControllerEndpointsTest.php

@@ -252,10 +252,12 @@ test('contact update guards types resolve users and portal seams persist', funct
         $probe->callProtected('assertContactInputIsValid', [$request, &$input, $contact]);
     })->toThrow(Exception::class);
 
-    // User references resolve through uuid or public id
-    expect($probe->callProtected('resolveUserUuid', ['user_contactseam']))->toBe('88888888-8888-4888-8888-888888888881')
-        ->and($probe->callProtected('resolveUserUuid', ['88888888-8888-4888-8888-888888888881']))->toBe('88888888-8888-4888-8888-888888888881')
-        ->and($probe->callProtected('resolveUserUuid', ['unknown-user']))->toBe('unknown-user');
+    // The login account is managed by the profile, so user references are dropped
+    $userInput = ['name' => 'Seam Contact', 'user_uuid' => '88888888-8888-4888-8888-888888888881', 'user' => 'user_contactseam'];
+    Closure::bind(function (array &$input) {
+        $this->resolveUserInput(Request::create('/x', 'PUT', []), $input);
+    }, $probe, ContactController::class)($userInput);
+    expect($userInput)->toBe(['name' => 'Seam Contact']);
 
     // Portal seams read users, mint passwords, and persist meta quietly
     expect($probe->callProtected('contactUser', [$contact])?->uuid)->toBe('88888888-8888-4888-8888-888888888881')

package/server/tests/Feature/Http/Internal/CustomerControllerCredentialsTest.php

@@ -125,7 +125,9 @@ function fleetopsCustomerCredentialsBoot(): SQLiteConnection
         'contacts'  => ['uuid', 'public_id', 'company_uuid', 'user_uuid', 'name', 'email', 'phone', 'type', 'title', 'meta', 'photo_uuid', 'place_uuid', 'slug', '_key'],
         'users'     => ['uuid', 'public_id', 'company_uuid', 'name', 'email', 'phone', 'password', 'type', 'status', 'timezone', 'slug', 'username', 'avatar_uuid', 'meta', '_key'],
         'companies' => ['uuid', 'public_id', 'name', 'country'],
-        'files'     => ['uuid', 'public_id', 'company_uuid', 'subject_uuid', 'subject_type', 'name', 'path', 'disk', 'type', '_key'],
+        // session_status reads the user's membership of the session company
+        'company_users' => ['uuid', 'company_uuid', 'user_uuid', 'status'],
+        'files'         => ['uuid', 'public_id', 'company_uuid', 'subject_uuid', 'subject_type', 'name', 'path', 'disk', 'type', '_key'],
     ];
     foreach ($tables as $table => $columns) {
         $schema->create($table, function ($blueprint) use ($columns) {
@@ -192,5 +194,7 @@ test('customer resolution and payload helpers expose user details', function ()
 
     $payload = $probe->callHelper('customerPayload', $customer);
     expect($payload['uuid'])->toBe('55555555-5555-4555-8555-555555555555')
-        ->and($payload)->toHaveKey('user');
+        ->and($payload['user']['uuid'])->toBe('user-1')
+        ->and($payload['is_staff_linked'])->toBeFalse()
+        ->and($payload['login_status'])->toBe('active');
 });

package/server/tests/Feature/Http/Internal/DriverControllerContractsTest.php

@@ -1131,6 +1131,29 @@ test('internal driver controller verify code returns driver resource and handles
     ]);
 });
 
+test('internal driver controller refuses phone login and code verification for deactivated drivers', function () {
+    FleetOpsInternalDriverAuthControllerProbe::resetProbe();
+    app()->instance('request', Request::create('/', 'POST', ['phone' => '15551234567']));
+
+    $deactivated = fleetopsInternalDriverAuthUser();
+    $deactivated->setAttribute('status', 'inactive');
+    FleetOpsInternalDriverAuthControllerProbe::$loginUser          = $deactivated;
+    FleetOpsInternalDriverAuthControllerProbe::$verificationUser   = $deactivated;
+    FleetOpsInternalDriverAuthControllerProbe::$verificationExists = true;
+
+    $controller = new FleetOpsInternalDriverAuthControllerProbe();
+    $login      = $controller->loginWithPhone();
+    $verify     = $controller->verifyCode(new Request(['identity' => '+15551234567', 'code' => '111111']));
+
+    expect($login->getStatusCode())->toBe(403)
+        ->and($login->getData(true))->toBe(['error' => 'This driver login has been deactivated.'])
+        ->and($verify->getStatusCode())->toBe(403)
+        ->and($verify->getData(true))->toBe(['error' => 'This driver login has been deactivated.'])
+        // No code is sent and no token is issued
+        ->and(FleetOpsInternalDriverAuthControllerProbe::$verifications)->toBe([])
+        ->and(FleetOpsInternalDriverAuthControllerProbe::$tokens)->toBe([]);
+});
+
 test('internal driver controller delegates login and create driver verification flows to api controller', function () {
     $request = new Request(['for' => 'create_driver']);
 

package/server/tests/Feature/Http/Internal/DriverControllerCreateRecordTest.php

@@ -10,11 +10,12 @@ use Illuminate\Http\Request;
 /**
  * Covers the internal DriverController createRecord and updateRecord flows
  * against an in-memory SQLite fixture. The creation closure executes end to
- * end: company resolution, user creation with driver typing, existing-user
- * adoption and conflict detection, organization membership checks, and the
- * exception-to-error-response branches. Role assignment requires the full
- * spatie permission boot unavailable in the harness, so flows settle in the
- * documented error branch after the user record is persisted.
+ * end: company resolution, managed account creation with driver typing
+ * through ProfileAccountManager, and the exception-to-error-response
+ * branches. Role assignment requires the full spatie permission boot, which
+ * this fixture leaves out, so flows settle in the documented error branch
+ * after the user record is persisted (see
+ * DriverControllerExistingUserAdoptionTest for the full flow).
  */
 if (!function_exists('Fleetbase\Support\session')) {
     eval('namespace Fleetbase\Support; function session($key = null, $default = null) { if ($key === null) { return new class { public function has($k) { return \session($k) !== null; } public function get($k, $d = null) { return \session($k, $d); } }; } return \session($key, $default); }');
@@ -101,6 +102,28 @@ function fleetopsInternalDriverCreateBoot(): SQLiteConnection
         }
     });
     Illuminate\Support\Facades\DB::clearResolvedInstance('db');
+    app()->instance('hash', new class implements Illuminate\Contracts\Hashing\Hasher {
+        public function info($hashedValue): array
+        {
+            return [];
+        }
+
+        public function make($value, array $options = []): string
+        {
+            return 'hashed:' . $value;
+        }
+
+        public function check($value, $hashedValue, array $options = []): bool
+        {
+            return 'hashed:' . $value === $hashedValue;
+        }
+
+        public function needsRehash($hashedValue, array $options = []): bool
+        {
+            return false;
+        }
+    });
+    Illuminate\Support\Facades\Hash::clearResolvedInstance('hash');
 
     $schema = $connection->getSchemaBuilder();
     $tables = [
@@ -158,31 +181,33 @@ test('create record provisions a driver-typed user before role assignment', func
         ->and($connection->table('company_users')->count())->toBeGreaterThanOrEqual(0);
 });
 
-test('create record rejects users that already belong to a driver', function () {
+test('create record ignores a picked user account and resolves the login from the email', function () {
     $connection = fleetopsInternalDriverCreateBoot();
-    $connection->table('users')->insert(['uuid' => '11111111-1111-4111-8111-111111111111', 'company_uuid' => 'company-1', 'name' => 'Existing', 'type' => 'driver']);
-    $connection->table('drivers')->insert(['uuid' => 'driver-1', 'company_uuid' => 'company-1', 'user_uuid' => '11111111-1111-4111-8111-111111111111']);
+    $connection->table('users')->insert(['uuid' => '11111111-1111-4111-8111-111111111111', 'company_uuid' => 'company-1', 'name' => 'Existing', 'email' => 'existing@example.com', 'type' => 'driver']);
 
-    $result = (new DriverController())->createRecord(fleetopsInternalDriverCreateRequest([
-        'name'      => 'Existing',
+    (new DriverController())->createRecord(fleetopsInternalDriverCreateRequest([
+        'name'      => 'Someone Else',
+        'email'     => 'someone@example.com',
         'user_uuid' => '11111111-1111-4111-8111-111111111111',
     ]));
 
-    expect($result)->toBeInstanceOf(JsonResponse::class)
-        ->and($result->getData(true))->toBe(['error' => 'This user account already belongs to a driver.']);
+    // The login account is managed by the profile: a new driver account is
+    // created for the email rather than the picked account being taken over
+    expect($connection->table('users')->count())->toBe(2)
+        ->and($connection->table('users')->where('email', 'someone@example.com')->value('type'))->toBe('driver')
+        ->and($connection->table('users')->where('uuid', '11111111-1111-4111-8111-111111111111')->value('name'))->toBe('Existing');
 });
 
-test('create record adopts an existing user and applies photo avatars', function () {
+test('create record applies photo avatars to the new driver account', function () {
     $connection = fleetopsInternalDriverCreateBoot();
-    $connection->table('users')->insert(['uuid' => '11111111-1111-4111-8111-111111111111', 'company_uuid' => 'company-1', 'name' => 'Adoptable', 'type' => 'driver']);
 
     $result = (new DriverController())->createRecord(fleetopsInternalDriverCreateRequest([
-        'name'       => 'Adoptable',
-        'user_uuid'  => '11111111-1111-4111-8111-111111111111',
+        'name'       => 'Photo Driver',
         'photo_uuid' => '22222222-2222-4222-8222-222222222222',
     ]));
 
-    // Avatar update applies before the harness role-assignment limitation.
+    // Avatar is set when the account is created, before the harness
+    // role-assignment limitation.
     expect($connection->table('users')->value('avatar_uuid'))->toBe('22222222-2222-4222-8222-222222222222')
         ->and($result)->toBeInstanceOf(JsonResponse::class)
         ->and($result->getData(true))->toHaveKey('error');