@fleetbase/fleetops-engine 0.6.68 → 0.6.70

package/server/src/Console/Commands/PruneTelematicsData.php

@@ -0,0 +1,318 @@
+<?php
+
+namespace Fleetbase\FleetOps\Console\Commands;
+
+use Fleetbase\FleetOps\Support\Telematics\Retention\RetentionPolicy;
+use Illuminate\Console\Command;
+use Illuminate\Support\Collection;
+use Illuminate\Support\Facades\Cache;
+use Illuminate\Support\Facades\DB;
+
+/**
+ * Applies each company's telematics retention policy.
+ *
+ * Deletes are hard deletes issued in bounded batches so a large backlog never
+ * monopolizes the tables ingestion is writing to; a capped run picks up where
+ * it left off on the next schedule tick.
+ */
+class PruneTelematicsData extends Command
+{
+    public const TABLES = ['device_events', 'positions', 'telematic_deliveries', 'telematic_sync_runs'];
+
+    public const LOCK = 'fleetops:prune-telematics-data';
+
+    protected $signature = 'fleetops:prune-telematics-data
+        {--company= : Only prune data for this company (uuid or public id)}
+        {--orphans-only : Only prune data without an existing company or connection}
+        {--table=* : Only prune these tables (device_events, positions, telematic_deliveries, telematic_sync_runs)}
+        {--batch-size=1000 : Rows per delete or update statement}
+        {--max-batches=50 : Maximum batches per table per company per run}
+        {--dry-run : Report matching rows without deleting or compacting}
+        {--no-lock : Skip process locking}';
+
+    protected $description = 'Prune telematics device events, positions, deliveries and sync runs according to each company\'s retention policy.';
+
+    protected int $batchSize  = 1000;
+    protected int $maxBatches = 50;
+    protected bool $dryRun    = false;
+
+    public function handle(): int
+    {
+        $tables = $this->requestedTables();
+        if ($tables === null) {
+            $this->error('Unknown table. Valid tables: ' . implode(', ', self::TABLES) . '.');
+
+            return self::FAILURE;
+        }
+
+        $lock = null;
+        if (!$this->option('no-lock')) {
+            $lock = Cache::lock(self::LOCK, 840);
+            if (!$lock->get()) {
+                $this->warn('Another telematics prune run appears to be in progress.');
+
+                return self::SUCCESS;
+            }
+        }
+
+        try {
+            // Queue workers may have cached settings before an administrator saved a new policy.
+            RetentionPolicy::flush();
+            $this->batchSize  = max(100, min(5000, (int) $this->option('batch-size') ?: 1000));
+            $this->maxBatches = max(1, (int) $this->option('max-batches') ?: 50);
+            $this->dryRun     = (bool) $this->option('dry-run');
+
+            $only        = ((string) $this->option('company')) ?: null;
+            $orphansOnly = (bool) $this->option('orphans-only');
+            if ($only && $orphansOnly) {
+                $this->error('Choose either --company or --orphans-only.');
+
+                return self::FAILURE;
+            }
+            $companies = $orphansOnly ? new Collection() : $this->companies($only);
+            if ($only && $companies->isEmpty()) {
+                $this->error(sprintf('Company [%s] was not found.', $only));
+
+                return self::FAILURE;
+            }
+
+            $totals = $this->emptyStats();
+            foreach ($companies as $company) {
+                $stats  = $this->pruneCompany($company->uuid, $this->policyFor($company->uuid), $tables);
+                $totals = $this->mergeStats($totals, $stats);
+                $this->report($company->public_id ?: $company->uuid, $stats);
+            }
+            if (!$only) {
+                $stats  = $this->pruneOrphans($this->policyFor(null), $tables);
+                $totals = $this->mergeStats($totals, $stats);
+                $this->report('orphaned', $stats);
+            }
+
+            $this->info(sprintf(
+                '%s: deleted=%d compacted=%d batches=%d%s',
+                $this->dryRun ? 'Telematics prune dry run' : 'Telematics prune complete',
+                $totals['deleted'],
+                $totals['compacted'],
+                $totals['batches'],
+                $totals['capped'] ? ' (capped; more rows remain for the next run)' : ''
+            ));
+
+            return self::SUCCESS;
+        } finally {
+            $lock?->release();
+        }
+    }
+
+    /**
+     * @return string[]|null null when an unknown table was requested
+     */
+    protected function requestedTables(): ?array
+    {
+        $requested = array_values(array_filter((array) $this->option('table')));
+        if ($requested === []) {
+            return self::TABLES;
+        }
+
+        return array_diff($requested, self::TABLES) === [] ? array_values(array_unique($requested)) : null;
+    }
+
+    protected function companies(?string $only): Collection
+    {
+        $query = DB::table('companies')->select(['id', 'uuid', 'public_id'])->orderBy('id');
+        if ($only) {
+            $query->where(fn ($where) => $where->where('uuid', $only)->orWhere('public_id', $only));
+        }
+
+        return $query->get();
+    }
+
+    protected function policyFor(?string $companyUuid): RetentionPolicy
+    {
+        return RetentionPolicy::forCompany($companyUuid);
+    }
+
+    protected function pruneCompany(string $companyUuid, RetentionPolicy $policy, array $tables): array
+    {
+        $rows = fn ($query) => $query->where('company_uuid', $companyUuid);
+
+        $telematics = null;
+        if (array_intersect(['telematic_deliveries', 'telematic_sync_runs'], $tables) !== []) {
+            // Inbox tables carry no company; trashed connections still prune under their company's policy.
+            $telematics = DB::table('telematics')->where('company_uuid', $companyUuid)->pluck('uuid')->all();
+        }
+        $inbox = $telematics ? fn ($query) => $query->whereIn('telematic_uuid', $telematics) : null;
+
+        return $this->prune($rows, $inbox, $policy, $tables);
+    }
+
+    /**
+     * Rows whose company or connection no longer exists fall back to the system defaults.
+     */
+    protected function pruneOrphans(RetentionPolicy $policy, array $tables): array
+    {
+        $rows = fn ($query) => $query->where(function ($where) {
+            $where->whereNull('company_uuid')->orWhereNotIn('company_uuid', DB::table('companies')->select('uuid'));
+        });
+        $inbox = fn ($query) => $query->whereNotExists(function ($connections) use ($query) {
+            $connections->selectRaw('1')
+                ->from('telematics')
+                ->join('companies', 'companies.uuid', '=', 'telematics.company_uuid')
+                ->whereColumn('telematics.uuid', $query->from . '.telematic_uuid');
+        });
+
+        return $this->prune($rows, $inbox, $policy, $tables);
+    }
+
+    protected function prune(\Closure $rows, ?\Closure $inbox, RetentionPolicy $policy, array $tables): array
+    {
+        $stats = $this->emptyStats();
+        if (in_array('device_events', $tables, true)) {
+            $stats['tables']['device_events'] = $this->pruneDeviceEvents($rows, $policy);
+        }
+        if (in_array('positions', $tables, true)) {
+            $stats['tables']['positions'] = $this->prunePositions($rows, $policy);
+        }
+        if ($inbox && in_array('telematic_deliveries', $tables, true)) {
+            $stats['tables']['telematic_deliveries'] = $this->pruneDeliveries($inbox, $policy);
+        }
+        if ($inbox && in_array('telematic_sync_runs', $tables, true)) {
+            $stats['tables']['telematic_sync_runs'] = $this->pruneSyncRuns($inbox, $policy);
+        }
+        foreach ($stats['tables'] as $table) {
+            $stats['deleted'] += $table['deleted'];
+            $stats['compacted'] += $table['compacted'];
+            $stats['batches'] += $table['batches'];
+            $stats['capped']     = $stats['capped'] || $table['capped'];
+        }
+
+        return $stats;
+    }
+
+    protected function pruneDeviceEvents(\Closure $rows, RetentionPolicy $policy): array
+    {
+        $stats  = $this->emptyTableStats();
+        $cutoff = $policy->cutoff('event_retention_days');
+        // Soft-deleted events only grow the table; purge them regardless of age.
+        $this->deleteInBatches('device_events', 'id', fn ($query) => $rows($query)->whereNotNull('deleted_at'), $stats);
+        if ($cutoff) {
+            $this->deleteInBatches('device_events', 'id', fn ($query) => $rows($query)->where('created_at', '<', $cutoff->toDateTimeString()), $stats);
+        }
+        if ($policy->compactsEvents() && ($compactAt = $policy->cutoff('event_compact_after_days'))) {
+            // Keep the event (type, severity, location, normalized data) but drop the raw provider blobs.
+            // Rows past the delete cutoff are left to the delete sweep rather than rewritten first.
+            $this->updateInBatches(
+                'device_events',
+                'id',
+                function ($query) use ($rows, $cutoff, $compactAt) {
+                    $query = $rows($query)->where('created_at', '<', $compactAt->toDateTimeString())->where(fn ($where) => $where->whereNotNull('payload')->orWhereNotNull('meta'));
+
+                    return $cutoff ? $query->where('created_at', '>=', $cutoff->toDateTimeString()) : $query;
+                },
+                ['payload' => null, 'meta' => null],
+                $stats
+            );
+        }
+
+        return $stats;
+    }
+
+    protected function prunePositions(\Closure $rows, RetentionPolicy $policy): array
+    {
+        $stats = $this->emptyTableStats();
+        $this->deleteInBatches('positions', 'id', fn ($query) => $rows($query)->whereNotNull('deleted_at'), $stats);
+        if ($cutoff = $policy->cutoff('position_retention_days')) {
+            $this->deleteInBatches('positions', 'id', fn ($query) => $rows($query)->where('created_at', '<', $cutoff->toDateTimeString()), $stats);
+        }
+
+        return $stats;
+    }
+
+    protected function pruneDeliveries(\Closure $inbox, RetentionPolicy $policy): array
+    {
+        $stats = $this->emptyTableStats();
+        foreach (['processed' => 'processed_retention_hours', 'quarantined' => 'quarantine_retention_days'] as $status => $key) {
+            if ($cutoff = $policy->cutoff($key)) {
+                $this->deleteInBatches('telematic_deliveries', 'uuid', fn ($query) => $inbox($query)->where('status', $status)->where('updated_at', '<', $cutoff->toDateTimeString()), $stats);
+            }
+        }
+
+        return $stats;
+    }
+
+    protected function pruneSyncRuns(\Closure $inbox, RetentionPolicy $policy): array
+    {
+        $stats = $this->emptyTableStats();
+        if ($cutoff = $policy->cutoff('sync_run_retention_days')) {
+            // In-flight runs are recovered by the drain command, never expired here.
+            $this->deleteInBatches('telematic_sync_runs', 'uuid', fn ($query) => $inbox($query)->whereNotIn('status', ['fetching', 'ingesting'])->where('updated_at', '<', $cutoff->toDateTimeString()), $stats);
+        }
+
+        return $stats;
+    }
+
+    protected function deleteInBatches(string $table, string $key, \Closure $scope, array &$stats): void
+    {
+        if ($this->dryRun) {
+            $stats['deleted'] += $scope(DB::table($table))->count();
+
+            return;
+        }
+        for ($batch = 0; $batch < $this->maxBatches; $batch++) {
+            $ids = $scope(DB::table($table))->orderBy($key)->limit($this->batchSize)->pluck($key);
+            if ($ids->isEmpty()) {
+                return;
+            }
+            $stats['batches']++;
+            $stats['deleted'] += DB::table($table)->whereIn($key, $ids->all())->delete();
+        }
+        $stats['capped'] = true;
+    }
+
+    protected function updateInBatches(string $table, string $key, \Closure $scope, array $values, array &$stats): void
+    {
+        if ($this->dryRun) {
+            $stats['compacted'] += $scope(DB::table($table))->count();
+
+            return;
+        }
+        for ($batch = 0; $batch < $this->maxBatches; $batch++) {
+            $ids = $scope(DB::table($table))->orderBy($key)->limit($this->batchSize)->pluck($key);
+            if ($ids->isEmpty()) {
+                return;
+            }
+            $stats['batches']++;
+            $stats['compacted'] += DB::table($table)->whereIn($key, $ids->all())->update($values);
+        }
+        $stats['capped'] = true;
+    }
+
+    protected function report(string $label, array $stats): void
+    {
+        foreach ($stats['tables'] as $table => $counts) {
+            if (!$counts['deleted'] && !$counts['compacted'] && !$counts['capped']) {
+                continue;
+            }
+            $this->info(sprintf('%s %s: deleted=%d compacted=%d batches=%d%s', $label, $table, $counts['deleted'], $counts['compacted'], $counts['batches'], $counts['capped'] ? ' capped' : ''));
+        }
+    }
+
+    protected function emptyTableStats(): array
+    {
+        return ['deleted' => 0, 'compacted' => 0, 'batches' => 0, 'capped' => false];
+    }
+
+    protected function emptyStats(): array
+    {
+        return ['deleted' => 0, 'compacted' => 0, 'batches' => 0, 'capped' => false, 'tables' => []];
+    }
+
+    protected function mergeStats(array $totals, array $stats): array
+    {
+        $totals['deleted'] += $stats['deleted'];
+        $totals['compacted'] += $stats['compacted'];
+        $totals['batches'] += $stats['batches'];
+        $totals['capped']     = $totals['capped'] || $stats['capped'];
+
+        return $totals;
+    }
+}

package/server/src/Exceptions/ProfileIdentityConflictException.php

@@ -0,0 +1,34 @@
+<?php
+
+namespace Fleetbase\FleetOps\Exceptions;
+
+/**
+ * Thrown when a driver, contact or customer profile is given an email or phone
+ * that belongs to an account it cannot be linked to.
+ */
+class ProfileIdentityConflictException extends \Exception
+{
+    /**
+     * The profile field the conflict was found on (`email` or `phone`).
+     */
+    protected string $field;
+
+    public function __construct(string $message, string $field = 'email')
+    {
+        parent::__construct($message);
+        $this->field = $field;
+    }
+
+    public function getField(): string
+    {
+        return $this->field;
+    }
+
+    /**
+     * The conflict keyed by field, in the shape of a validation error bag.
+     */
+    public function getErrors(): array
+    {
+        return [$this->field => [$this->getMessage()]];
+    }
+}

package/server/src/Http/Controllers/Api/v1/CustomerController.php

@@ -44,6 +44,8 @@ class CustomerController extends Controller
 {
     use \Fleetbase\FleetOps\Http\Controllers\Concerns\ResolvesReviewAccountBypass;
 
+    public const DEACTIVATED_LOGIN_MESSAGE = 'This customer login has been deactivated.';
+
     /* ============================================================
      | Public auth flows (API credential only, no Customer-Token)
      * ============================================================ */
@@ -345,6 +347,10 @@ class CustomerController extends Controller
             return response()->apiError('Authentication failed using credentials provided.', 401);
         }
 
+        if ($user->status === 'inactive') {
+            return response()->apiError(static::DEACTIVATED_LOGIN_MESSAGE, 403);
+        }
+
         $sessionCompany = $this->sessionCompany();
         if (!$sessionCompany) {
             return response()->apiError('No company resolved from API credential.', 500);
@@ -381,6 +387,10 @@ class CustomerController extends Controller
             return response()->apiError('No customer with this phone number found.');
         }
 
+        if ($user->status === 'inactive') {
+            return response()->apiError(static::DEACTIVATED_LOGIN_MESSAGE, 403);
+        }
+
         try {
             $this->generateSmsVerification($user, 'fleetops_customer_login', [
                 'messageCallback' => fn ($verification) => 'Your ' . config('app.name') . ' verification code is ' . $verification->code,
@@ -423,6 +433,10 @@ class CustomerController extends Controller
             return response()->apiError('Unable to verify code.');
         }
 
+        if ($user->status === 'inactive') {
+            return response()->apiError(static::DEACTIVATED_LOGIN_MESSAGE, 403);
+        }
+
         $verificationCode = $this->verificationCodeExists([
             'subject_uuid' => $user->uuid,
             'code'         => $code,

package/server/src/Http/Controllers/Api/v1/DriverController.php

@@ -6,6 +6,7 @@ use Fleetbase\FleetOps\Events\DriverLocationChanged;
 use Fleetbase\FleetOps\Events\GeofenceEntered;
 use Fleetbase\FleetOps\Events\GeofenceExited;
 use Fleetbase\FleetOps\Events\VehicleLocationChanged;
+use Fleetbase\FleetOps\Exceptions\ProfileIdentityConflictException;
 use Fleetbase\FleetOps\Exceptions\PublicRelationNotFoundException;
 use Fleetbase\FleetOps\Http\Controllers\Api\v1\Concerns\ResolvesFleetOpsApiResources;
 use Fleetbase\FleetOps\Http\Controllers\Api\v1\Concerns\ResolvesPublicExpansions;
@@ -22,6 +23,7 @@ use Fleetbase\FleetOps\Models\Vehicle;
 use Fleetbase\FleetOps\Models\Vendor;
 use Fleetbase\FleetOps\Support\GeofenceIntersectionService;
 use Fleetbase\FleetOps\Support\OSRM;
+use Fleetbase\FleetOps\Support\ProfileAccountManager;
 use Fleetbase\FleetOps\Support\Utils;
 use Fleetbase\Http\Controllers\Controller;
 use Fleetbase\Http\Requests\SwitchOrganizationRequest;
@@ -47,6 +49,11 @@ class DriverController extends Controller
     use ResolvesFleetOpsApiResources;
     use ResolvesPublicExpansions;
 
+    /**
+     * Returned when a driver whose login was deactivated from the console tries to sign in.
+     */
+    public const DEACTIVATED_LOGIN_MESSAGE = 'This driver login has been deactivated.';
+
     /**
      * Public expansion name => Eloquent relation name.
      *
@@ -97,20 +104,14 @@ class DriverController extends Controller
         // Apply user infos
         $userDetails = $this->applyUserInfoFromRequest($request, $userDetails);
 
-        // Set company_uuid before creating user
-        $userDetails['company_uuid'] = $company->uuid;
-
-        // create user account for driver
-        $user = $this->createUser($userDetails);
-
-        // Assign company — the early return above guarantees $company is set
-        $user->assignCompany($company);
-
-        // Set user type
-        $user->setUserType('driver');
-
-        // assign driver role
-        $user->assignSingleRole('Driver');
+        // Resolve the driver's login account: a team member of the company with
+        // the email/phone is linked, otherwise a driver account is created and
+        // added to the company without an organization invite.
+        try {
+            $user = $this->resolveDriverAccount($company->uuid, $userDetails);
+        } catch (ProfileIdentityConflictException $exception) {
+            return $this->jsonResponse(['error' => $exception->getMessage()], 422);
+        }
 
         // set user id
         $input['user_uuid']    = $user->uuid;
@@ -193,10 +194,11 @@ class DriverController extends Controller
         // it. The driver's own record has no timezone column; the user's does.
         $userDetails = $request->only(['name', 'email', 'phone', 'timezone']);
 
-        // update driver user details
-        $driverUser = $driver->getUser();
-        if ($driverUser) {
-            $driverUser->update($userDetails);
+        // update the driver's login account through its proxy fields
+        try {
+            ProfileAccountManager::syncProxyFields($driver->getUser(), $userDetails);
+        } catch (ProfileIdentityConflictException $exception) {
+            return $this->jsonResponse(['error' => $exception->getMessage()], 422);
         }
 
         // latitude / longitude
@@ -519,10 +521,14 @@ class DriverController extends Controller
         )->whereHas('driver')->first();
 
         // Check password to authenticate driver
-        if (!Hash::check($password, $user->password)) {
+        if (!$user || !is_string($user->password) || !Hash::check((string) $password, $user->password)) {
             return response()->apiError('Authentication failed using password provided.', 401);
         }
 
+        if (static::isLoginDeactivated($user)) {
+            return response()->apiError(static::DEACTIVATED_LOGIN_MESSAGE, 403);
+        }
+
         // Get the user's company for this driver profile
         $company = static::getDriverCompanyFromUser($user);
 
@@ -561,6 +567,10 @@ class DriverController extends Controller
             return response()->apiError('No driver with this phone # found.');
         }
 
+        if (static::isLoginDeactivated($user)) {
+            return response()->apiError(static::DEACTIVATED_LOGIN_MESSAGE, 403);
+        }
+
         // Get the user's company for this driver profile
         $company = static::getDriverCompanyFromUser($user);
 
@@ -627,6 +637,10 @@ class DriverController extends Controller
             return response()->apiError('Unable to verify code.');
         }
 
+        if (static::isLoginDeactivated($user)) {
+            return response()->apiError(static::DEACTIVATED_LOGIN_MESSAGE, 403);
+        }
+
         // find and verify code
         $verificationCode = VerificationCode::where(['subject_uuid' => $user->uuid, 'code' => $code, 'for' => $for])->exists();
         if (!$verificationCode && !static::verificationBypassMatches($identity, $code)) {
@@ -975,26 +989,29 @@ class DriverController extends Controller
         return User::applyUserInfoFromRequest($request, $userDetails);
     }
 
-    protected function createUser(array $userDetails): User
+    /**
+     * Resolve the login account for a driver created through the API.
+     *
+     * @throws ProfileIdentityConflictException
+     */
+    protected function resolveDriverAccount(string $companyUuid, array $userDetails): User
     {
-        /*
-         * `password` is guarded on User, so mass assignment drops it without a
-         * word. The create endpoint has always accepted and validated one, so a
-         * driver created through the API could never sign in with the password
-         * their operator chose for them. Set it after the fact, where the
-         * model's mutator hashes it.
-         */
-        $password = $userDetails['password'] ?? null;
-        unset($userDetails['password']);
-
-        $user = User::create($userDetails);
-
-        if (is_string($password) && strlen($password)) {
-            $user->password = $password;
-            $user->save();
-        }
+        return ProfileAccountManager::resolveForProfile(
+            $companyUuid,
+            'driver',
+            $userDetails['name'] ?? null,
+            $userDetails['email'] ?? null,
+            $userDetails['phone'] ?? null,
+            array_merge(Arr::except($userDetails, ['name', 'email', 'phone']), ['status' => 'active'])
+        );
+    }
 
-        return $user;
+    /**
+     * Whether the driver's login was deactivated from the console.
+     */
+    public static function isLoginDeactivated(User $user): bool
+    {
+        return $user->status === 'inactive';
     }
 
     protected function getUuid(array|string $table, array $where, array $options = []): mixed
@@ -1313,7 +1330,7 @@ class DriverController extends Controller
         }
 
         $user = static::findDriverUserByIdentity($identity);
-        if (!$user) {
+        if (!$user || static::isLoginDeactivated($user)) {
             return response()->json(['status' => 'ok']);
         }
 
@@ -1344,7 +1361,7 @@ class DriverController extends Controller
         }
 
         $user = static::findDriverUserByIdentity($identity);
-        if (!$user) {
+        if (!$user || static::isLoginDeactivated($user)) {
             return response()->apiError('Invalid or expired reset code.', 422);
         }
 

package/server/src/Http/Controllers/Api/v1/OrchestrationController.php

@@ -3,6 +3,7 @@
 namespace Fleetbase\FleetOps\Http\Controllers\Api\v1;
 
 use Fleetbase\FleetOps\Http\Controllers\Internal\v1\OrchestrationController as InternalOrchestrationController;
+use Fleetbase\FleetOps\Orchestration\OrchestrationEngineRegistry;
 use Illuminate\Http\JsonResponse;
 use Illuminate\Http\Request;
 
@@ -14,6 +15,14 @@ use Illuminate\Http\Request;
  */
 class OrchestrationController extends InternalOrchestrationController
 {
+    public function __construct(OrchestrationEngineRegistry $registry)
+    {
+        // The fleetbase.api route group authenticates API credentials and establishes
+        // their company scope. Console IAM middleware belongs to the internal
+        // workbench, not to these organization-credential endpoints.
+        $this->registry = $registry;
+    }
+
     public function run(Request $request): JsonResponse
     {
         return $this->publicResponse(parent::run($request));

package/server/src/Http/Controllers/FleetOpsController.php

@@ -2,12 +2,33 @@
 
 namespace Fleetbase\FleetOps\Http\Controllers;
 
+use Fleetbase\FleetOps\Traits\AuthorizesMethods;
 use Fleetbase\Http\Controllers\FleetbaseController;
+use Illuminate\Database\Eloquent\Model;
 
 class FleetOpsController extends FleetbaseController
 {
+    use AuthorizesMethods;
+
     /**
      * The package namespace used to resolve from.
      */
     public string $namespace = '\\Fleetbase\\FleetOps';
+
+    /**
+     * Explicit permissions for custom actions, keyed by controller method, e.g.
+     * `['bulkDispatch' => 'dispatch order']`. Those methods also carry
+     * `#[SkipAuthorizationCheck]` so AuthorizationGuard does not demand the
+     * permission it would otherwise infer from the HTTP verb.
+     *
+     * @var array<string, string|string[]>
+     */
+    protected array $methodPermissions = [];
+
+    public function __construct(?Model $model = null, ?string $resource = null)
+    {
+        parent::__construct($model, $resource);
+
+        $this->authorizeMethods($this->methodPermissions);
+    }
 }

package/server/src/Http/Controllers/Internal/v1/AnalyticsController.php

@@ -14,6 +14,7 @@ use Fleetbase\FleetOps\Support\Analytics\OperationsPulse;
 use Fleetbase\FleetOps\Support\Analytics\OrdersByStatus;
 use Fleetbase\FleetOps\Support\Analytics\RevenueTrend;
 use Fleetbase\FleetOps\Support\Analytics\TopDrivers;
+use Fleetbase\FleetOps\Support\Authorization;
 use Fleetbase\Http\Controllers\Controller;
 use Illuminate\Http\Request;
 
@@ -28,6 +29,16 @@ use Illuminate\Http\Request;
  */
 class AnalyticsController extends Controller
 {
+    public function __construct()
+    {
+        // Not a resource controller, so AuthorizationGuard cannot resolve a permission for it.
+        $this->middleware(function ($request, $next) {
+            Authorization::authorize('view analytics');
+
+            return $next($request);
+        });
+    }
+
     public function operationsPulse(Request $request)
     {
         return $this->run($request, OperationsPulse::class);