@fleetbase/fleetops-engine 0.6.68 → 0.6.70

package/server/src/Http/Controllers/Internal/v1/ContactController.php

@@ -2,6 +2,7 @@
 
 namespace Fleetbase\FleetOps\Http\Controllers\Internal\v1;
 
+use Fleetbase\Attributes\SkipAuthorizationCheck;
 use Fleetbase\FleetOps\Exports\ContactExport;
 use Fleetbase\FleetOps\Http\Controllers\FleetOpsController;
 use Fleetbase\FleetOps\Http\Resources\v1\Vendor as VendorResource;
@@ -26,6 +27,15 @@ use Maatwebsite\Excel\Facades\Excel;
 
 class ContactController extends FleetOpsController
 {
+    /**
+     * Permissions for methods AuthorizationGuard cannot map to a schema action (see FleetOpsController).
+     *
+     * @var array<string, string|string[]>
+     */
+    protected array $methodPermissions = [
+        'convertToVendor' => 'create vendor',
+    ];
+
     /**
      * The resource to query.
      *
@@ -108,6 +118,7 @@ class ContactController extends FleetOpsController
         ]);
     }
 
+    #[SkipAuthorizationCheck]
     public function convertToVendor(Request $request, string $id)
     {
         $contact = $this->contactForVendorConversion($id);
@@ -265,25 +276,13 @@ class ContactController extends FleetOpsController
             ->get();
     }
 
+    /**
+     * The login account is managed by the contact profile, so a user can't be
+     * picked or swapped from the console.
+     */
     private function resolveUserInput(Request $request, array &$input): void
     {
-        $user = data_get($input, 'user_uuid') ?? data_get($input, 'user') ?? $request->input('contact.user_uuid') ?? $request->input('contact.user');
-
-        if (is_array($user)) {
-            $user = data_get($user, 'uuid') ?? data_get($user, 'id');
-        }
-
-        if (!$user) {
-            return;
-        }
-
-        $input['user_uuid'] = $this->resolveUserUuid($user);
-        unset($input['user']);
-    }
-
-    protected function resolveUserUuid(string $user): string
-    {
-        return User::where('uuid', $user)->orWhere('public_id', $user)->value('uuid') ?? $user;
+        unset($input['user_uuid'], $input['user']);
     }
 
     protected function assertCustomerPortalCanSendWelcomeEmail(array $input): void

package/server/src/Http/Controllers/Internal/v1/CustomerController.php

@@ -4,6 +4,8 @@ namespace Fleetbase\FleetOps\Http\Controllers\Internal\v1;
 
 use Fleetbase\FleetOps\Mail\CustomerCredentialsMail;
 use Fleetbase\FleetOps\Models\Contact;
+use Fleetbase\FleetOps\Support\ProfileAccountManager;
+use Fleetbase\FleetOps\Traits\AuthorizesMethods;
 use Fleetbase\Http\Controllers\Controller;
 use Fleetbase\Models\User;
 use Illuminate\Http\Request;
@@ -12,6 +14,19 @@ use Illuminate\Support\Str;
 
 class CustomerController extends Controller
 {
+    use AuthorizesMethods;
+
+    public function __construct()
+    {
+        $this->authorizeMethods([
+            'createPortalLogin'     => 'reset-credentials-for customer',
+            'sendCredentials'       => 'reset-credentials-for customer',
+            'deactivatePortalLogin' => 'reset-credentials-for customer',
+            'reactivatePortalLogin' => 'reset-credentials-for customer',
+            'resetCredentials'      => 'reset-credentials-for customer',
+        ]);
+    }
+
     public function createPortalLogin(Request $request)
     {
         $customer = $this->resolveCustomer($request);
@@ -21,6 +36,10 @@ class CustomerController extends Controller
             return response()->error('Unable to create customer portal login.');
         }
 
+        if ($error = $this->staffLinkedError($user)) {
+            return $error;
+        }
+
         if ($user->status !== 'active') {
             $user->activate();
         }
@@ -39,6 +58,10 @@ class CustomerController extends Controller
             return response()->error('Unable to send customer portal credentials.');
         }
 
+        if ($error = $this->staffLinkedError($user)) {
+            return $error;
+        }
+
         $password = $this->randomPassword();
         $user->changePassword($password);
         $this->sendCustomerCredentials($user, $password, $customer);
@@ -57,6 +80,10 @@ class CustomerController extends Controller
             return response()->error('Customer portal login not found.');
         }
 
+        if ($error = $this->staffLinkedError($user)) {
+            return $error;
+        }
+
         $user->deactivate();
 
         return response()->json([
@@ -73,6 +100,10 @@ class CustomerController extends Controller
             return response()->error('Customer portal login not found.');
         }
 
+        if ($error = $this->staffLinkedError($user)) {
+            return $error;
+        }
+
         $user->activate();
 
         return response()->json([
@@ -149,6 +180,10 @@ class CustomerController extends Controller
             return response()->error('Unable to reset customer credentials');
         }
 
+        if ($error = $this->staffLinkedError($user)) {
+            return $error;
+        }
+
         // Change password
         $user->changePassword($password);
 
@@ -163,6 +198,19 @@ class CustomerController extends Controller
         ]);
     }
 
+    /**
+     * A customer linked to a team member's account signs in with that account,
+     * which is managed in IAM.
+     */
+    protected function staffLinkedError(User $user): ?\Illuminate\Http\JsonResponse
+    {
+        if (ProfileAccountManager::isStaffAccount($user)) {
+            return response()->error('This customer signs in with a team member account. Manage this login in IAM.', 422);
+        }
+
+        return null;
+    }
+
     protected function resolveCustomer(Request $request): Contact
     {
         $customerId = $request->input('customer');
@@ -213,10 +261,12 @@ class CustomerController extends Controller
         $customer->loadMissing('user');
 
         return [
-            'id'        => $customer->public_id,
-            'uuid'      => $customer->uuid,
-            'user_uuid' => $customer->user_uuid,
-            'user'      => $customer->user ? [
+            'id'              => $customer->public_id,
+            'uuid'            => $customer->uuid,
+            'user_uuid'       => $customer->user_uuid,
+            'is_staff_linked' => ProfileAccountManager::isStaffAccount($customer->user),
+            'login_status'    => $customer->user?->status,
+            'user'            => $customer->user ? [
                 'id'             => $customer->user->public_id,
                 'uuid'           => $customer->user->uuid,
                 'name'           => $customer->user->name,

package/server/src/Http/Controllers/Internal/v1/DeviceController.php

@@ -2,6 +2,7 @@
 
 namespace Fleetbase\FleetOps\Http\Controllers\Internal\v1;
 
+use Fleetbase\Attributes\SkipAuthorizationCheck;
 use Fleetbase\FleetOps\Exceptions\DeviceAlreadyAttachedException;
 use Fleetbase\FleetOps\Exports\DeviceExport;
 use Fleetbase\FleetOps\Http\Controllers\FleetOpsController;
@@ -17,6 +18,16 @@ use Maatwebsite\Excel\Facades\Excel;
 
 class DeviceController extends FleetOpsController
 {
+    /**
+     * Permissions for methods AuthorizationGuard cannot map to a schema action (see FleetOpsController).
+     *
+     * @var array<string, string|string[]>
+     */
+    protected array $methodPermissions = [
+        'attach' => 'update device',
+        'detach' => 'update device',
+    ];
+
     /**
      * The resource to query.
      *
@@ -110,6 +121,7 @@ class DeviceController extends FleetOpsController
     /**
      * Attach a device to a supported FleetOps resource.
      */
+    #[SkipAuthorizationCheck]
     public function attach(Request $request, string $id): JsonResponse
     {
         $request->validate([
@@ -152,6 +164,7 @@ class DeviceController extends FleetOpsController
     /**
      * Detach a device from its current FleetOps resource.
      */
+    #[SkipAuthorizationCheck]
     public function detach(string $id): JsonResponse
     {
         $device = $this->resolveDevice($id);

package/server/src/Http/Controllers/Internal/v1/DeviceEventController.php

@@ -2,6 +2,7 @@
 
 namespace Fleetbase\FleetOps\Http\Controllers\Internal\v1;
 
+use Fleetbase\Attributes\SkipAuthorizationCheck;
 use Fleetbase\FleetOps\Http\Controllers\FleetOpsController;
 use Fleetbase\FleetOps\Models\DeviceEvent;
 use Fleetbase\FleetOps\Support\Utils;
@@ -9,6 +10,15 @@ use Illuminate\Http\JsonResponse;
 
 class DeviceEventController extends FleetOpsController
 {
+    /**
+     * Permissions for methods AuthorizationGuard cannot map to a schema action (see FleetOpsController).
+     *
+     * @var array<string, string|string[]>
+     */
+    protected array $methodPermissions = [
+        'markProcessed' => 'update device-event',
+    ];
+
     /**
      * The resource to query.
      *
@@ -51,6 +61,7 @@ class DeviceEventController extends FleetOpsController
         }
     }
 
+    #[SkipAuthorizationCheck]
     public function markProcessed(string $id): JsonResponse
     {
         $deviceEvent = DeviceEvent::where('company_uuid', session('company'))