@fleetbase/fleetops-engine 0.6.68 → 0.6.70

package/server/src/Http/Controllers/Internal/v1/InspectionFormController.php

@@ -2,6 +2,7 @@
 
 namespace Fleetbase\FleetOps\Http\Controllers\Internal\v1;
 
+use Fleetbase\Attributes\SkipAuthorizationCheck;
 use Fleetbase\FleetOps\Http\Controllers\FleetOpsController;
 use Fleetbase\FleetOps\Http\Resources\v1\InspectionLink as InspectionLinkResource;
 use Fleetbase\FleetOps\Models\Driver;
@@ -16,6 +17,17 @@ use Illuminate\Http\Request;
 
 class InspectionFormController extends FleetOpsController
 {
+    /**
+     * Permissions for methods AuthorizationGuard cannot map to a schema action (see FleetOpsController).
+     *
+     * @var array<string, string|string[]>
+     */
+    protected array $methodPermissions = [
+        'generateLink' => 'publish inspection-form',
+        'revokeLink'   => 'publish inspection-form',
+        'sendPin'      => 'publish inspection-form',
+    ];
+
     /**
      * The resource to query.
      *
@@ -107,6 +119,7 @@ class InspectionFormController extends FleetOpsController
         ]);
     }
 
+    #[SkipAuthorizationCheck]
     public function generateLink(Request $request, string $id): JsonResponse
     {
         $form = $this->resolveForm($id)
@@ -215,6 +228,7 @@ class InspectionFormController extends FleetOpsController
     }
 
     /** Take a link out of use, leaving the record of it in the list. */
+    #[SkipAuthorizationCheck]
     public function revokeLink(Request $request, string $id, string $linkId): JsonResponse
     {
         $form = $this->resolveForm($id)->firstOrFail();
@@ -243,6 +257,7 @@ class InspectionFormController extends FleetOpsController
      * A failed delivery answers 200 with `pin_delivery.sent` false and why, so
      * the console shows it as a warning rather than an error.
      */
+    #[SkipAuthorizationCheck]
     public function sendPin(Request $request, string $id, string $linkId): JsonResponse
     {
         $form      = $this->resolveForm($id)->firstOrFail();

package/server/src/Http/Controllers/Internal/v1/LiveController.php

@@ -18,6 +18,7 @@ use Fleetbase\FleetOps\Models\Vehicle;
 use Fleetbase\FleetOps\Support\LiveCacheService;
 use Fleetbase\FleetOps\Support\LiveOrderQuery;
 use Fleetbase\FleetOps\Support\Utils;
+use Fleetbase\FleetOps\Traits\AuthorizesMethods;
 use Fleetbase\Http\Controllers\Controller;
 use Illuminate\Http\Request;
 
@@ -26,6 +27,21 @@ use Illuminate\Http\Request;
  */
 class LiveController extends Controller
 {
+    use AuthorizesMethods;
+
+    public function __construct()
+    {
+        $this->authorizeMethods([
+            'coordinates'           => 'list order',
+            'routes'                => 'list order',
+            'orders'                => 'list order',
+            'drivers'               => 'list driver',
+            'vehicles'              => 'list vehicle',
+            'operationsMonitor'     => 'list order',
+            'places'                => 'list place',
+        ]);
+    }
+
     protected const DEFAULT_VIEWPORT_LIMIT    = 500;
     protected const MAX_VIEWPORT_LIMIT        = 1000;
     protected const VIEWPORT_BOUNDS_PRECISION = 4;

package/server/src/Http/Controllers/Internal/v1/MaintenanceController.php

@@ -2,6 +2,7 @@
 
 namespace Fleetbase\FleetOps\Http\Controllers\Internal\v1;
 
+use Fleetbase\Attributes\SkipAuthorizationCheck;
 use Fleetbase\FleetOps\Exports\MaintenanceExport;
 use Fleetbase\FleetOps\Http\Controllers\FleetOpsController;
 use Fleetbase\FleetOps\Imports\MaintenanceImport;
@@ -15,6 +16,17 @@ use Maatwebsite\Excel\Facades\Excel;
 
 class MaintenanceController extends FleetOpsController
 {
+    /**
+     * Permissions for methods AuthorizationGuard cannot map to a schema action (see FleetOpsController).
+     *
+     * @var array<string, string|string[]>
+     */
+    protected array $methodPermissions = [
+        'addLineItem'    => 'update maintenance',
+        'updateLineItem' => 'update maintenance',
+        'removeLineItem' => 'update maintenance',
+    ];
+
     /**
      * The resource to query.
      *
@@ -67,6 +79,7 @@ class MaintenanceController extends FleetOpsController
      * Add a cost line item to a maintenance record.
      * POST /maintenances/{id}/line-items.
      */
+    #[SkipAuthorizationCheck]
     public function addLineItem(string $id, Request $request): JsonResponse
     {
         $maintenance = $this->findMaintenanceForLineItem($id);
@@ -89,6 +102,7 @@ class MaintenanceController extends FleetOpsController
      * Update a cost line item on a maintenance record.
      * PUT /maintenances/{id}/line-items/{index}.
      */
+    #[SkipAuthorizationCheck]
     public function updateLineItem(string $id, int $index, Request $request): JsonResponse
     {
         $maintenance = $this->findMaintenanceForLineItem($id);
@@ -121,6 +135,7 @@ class MaintenanceController extends FleetOpsController
      * Remove a cost line item from a maintenance record.
      * DELETE /maintenances/{id}/line-items/{index}.
      */
+    #[SkipAuthorizationCheck]
     public function removeLineItem(string $id, int $index): JsonResponse
     {
         $maintenance = $this->findMaintenanceForLineItem($id);

package/server/src/Http/Controllers/Internal/v1/MaintenanceScheduleController.php

@@ -2,6 +2,7 @@
 
 namespace Fleetbase\FleetOps\Http\Controllers\Internal\v1;
 
+use Fleetbase\Attributes\SkipAuthorizationCheck;
 use Fleetbase\FleetOps\Exports\MaintenanceScheduleExport;
 use Fleetbase\FleetOps\Http\Controllers\FleetOpsController;
 use Fleetbase\FleetOps\Imports\MaintenanceScheduleImport;
@@ -22,6 +23,17 @@ use Spatie\IcalendarGenerator\ValueObjects\RRule;
 
 class MaintenanceScheduleController extends FleetOpsController
 {
+    /**
+     * Permissions for methods AuthorizationGuard cannot map to a schema action (see FleetOpsController).
+     *
+     * @var array<string, string|string[]>
+     */
+    protected array $methodPermissions = [
+        'pause'   => 'update maintenance-schedule',
+        'resume'  => 'update maintenance-schedule',
+        'trigger' => 'update maintenance-schedule',
+    ];
+
     /**
      * The resource to query.
      *
@@ -71,6 +83,7 @@ class MaintenanceScheduleController extends FleetOpsController
      * Pause a maintenance schedule.
      * POST /maintenance-schedules/{id}/pause.
      */
+    #[SkipAuthorizationCheck]
     public function pause(string $id): JsonResponse
     {
         $schedule = $this->findSchedule($id);
@@ -88,6 +101,7 @@ class MaintenanceScheduleController extends FleetOpsController
      * Resume a paused maintenance schedule.
      * POST /maintenance-schedules/{id}/resume.
      */
+    #[SkipAuthorizationCheck]
     public function resume(string $id): JsonResponse
     {
         $schedule = $this->findSchedule($id);
@@ -105,6 +119,7 @@ class MaintenanceScheduleController extends FleetOpsController
      * Manually trigger a work order from a schedule.
      * POST /maintenance-schedules/{id}/trigger.
      */
+    #[SkipAuthorizationCheck]
     public function trigger(string $id, Request $request): JsonResponse
     {
         $schedule  = $this->findSchedule($id);

package/server/src/Http/Controllers/Internal/v1/ManifestController.php

@@ -4,6 +4,7 @@ namespace Fleetbase\FleetOps\Http\Controllers\Internal\v1;
 
 use Fleetbase\FleetOps\Models\Manifest;
 use Fleetbase\FleetOps\Models\ManifestStop;
+use Fleetbase\FleetOps\Traits\AuthorizesMethods;
 use Fleetbase\Http\Controllers\Controller;
 use Illuminate\Http\JsonResponse;
 use Illuminate\Http\Request;
@@ -23,6 +24,20 @@ use Illuminate\Http\Request;
  */
 class ManifestController extends Controller
 {
+    use AuthorizesMethods;
+
+    public function __construct()
+    {
+        $this->authorizeMethods([
+            'index'      => 'list order',
+            'show'       => 'view order',
+            'cancel'     => 'cancel order',
+            'destroy'    => 'delete order',
+            'showStop'   => 'view order',
+            'updateStop' => 'update order',
+        ]);
+    }
+
     /**
      * List manifests for the current company.
      * Supports filtering by status, driver_id, vehicle_id, and scheduled_date.

package/server/src/Http/Controllers/Internal/v1/MetricsController.php

@@ -2,6 +2,7 @@
 
 namespace Fleetbase\FleetOps\Http\Controllers\Internal\v1;
 
+use Fleetbase\FleetOps\Support\Authorization;
 use Fleetbase\FleetOps\Support\Metrics;
 use Fleetbase\FleetOps\Support\Metrics\Registry;
 use Fleetbase\Http\Controllers\Controller;
@@ -10,6 +11,16 @@ use Illuminate\Support\Carbon;
 
 class MetricsController extends Controller
 {
+    public function __construct()
+    {
+        // Not a resource controller, so AuthorizationGuard cannot resolve a permission for it.
+        $this->middleware(function ($request, $next) {
+            Authorization::authorize('view analytics');
+
+            return $next($request);
+        });
+    }
+
     /**
      * Legacy bulk endpoint. Returns a flat map of slug → scalar value for the
      * requested period. Preserved for backward compat; the dashboard widgets

package/server/src/Http/Controllers/Internal/v1/NavigatorController.php

@@ -3,6 +3,7 @@
 namespace Fleetbase\FleetOps\Http\Controllers\Internal\v1;
 
 use Fleetbase\FleetOps\Support\Utils;
+use Fleetbase\FleetOps\Traits\AuthorizesMethods;
 use Fleetbase\Http\Controllers\Controller;
 use Fleetbase\Http\Resources\Organization;
 use Fleetbase\Models\ApiCredential;
@@ -15,6 +16,19 @@ use Illuminate\Support\Str;
 
 class NavigatorController extends Controller
 {
+    use AuthorizesMethods;
+    /**
+     * How long a Navigator link issued from the console stays valid.
+     */
+    public const LINK_TTL_MINUTES = 30;
+
+    public function __construct()
+    {
+        $this->authorizeMethods([
+            'getLinkAppUrl' => 'admin',
+        ]);
+    }
+
     /**
      * Redirects to the Fleetbase Navigator app using a deep link.
      * Automatically detects the platform (iOS or Android) and uses the correct URI scheme.
@@ -23,6 +37,12 @@ class NavigatorController extends Controller
      */
     public function linkApp(Request $request)
     {
+        // This route is opened from a phone without a console session, so it is
+        // authorised by the short-lived signature issued by getLinkAppUrl().
+        if (!$this->hasValidLinkSignature($request)) {
+            return response()->error('This Navigator link is invalid or has expired. Generate a new one from the console.', 403);
+        }
+
         $adminUser = $this->findAdminUser();
 
         if (!$adminUser || !$adminUser->company) {
@@ -67,8 +87,13 @@ class NavigatorController extends Controller
      */
     public function getLinkAppUrl()
     {
+        $expires = now()->addMinutes(static::LINK_TTL_MINUTES)->getTimestamp();
+
         return response()->json([
-            'linkUrl' => url('int/v1/fleet-ops/navigator/link-app'),
+            'linkUrl' => url('int/v1/fleet-ops/navigator/link-app') . '?' . http_build_query([
+                'expires'   => $expires,
+                'signature' => static::linkSignature($expires),
+            ]),
         ]);
     }
 
@@ -189,4 +214,20 @@ class NavigatorController extends Controller
     {
         return Setting::where('key', 'fleet-ops.driver-onboard')->value('value');
     }
+
+    /**
+     * HMAC signature for a Navigator link expiring at the given unix timestamp.
+     */
+    public static function linkSignature(int $expires): string
+    {
+        return hash_hmac('sha256', 'fleet-ops.navigator.link-app|' . $expires, (string) config('app.key'));
+    }
+
+    protected function hasValidLinkSignature(Request $request): bool
+    {
+        $expires   = (int) $request->query('expires');
+        $signature = (string) $request->query('signature');
+
+        return $signature !== '' && $expires >= time() && hash_equals(static::linkSignature($expires), $signature);
+    }
 }

package/server/src/Http/Controllers/Internal/v1/OrchestrationController.php

@@ -16,6 +16,7 @@ use Fleetbase\FleetOps\Models\Vendor;
 use Fleetbase\FleetOps\Orchestration\Engines\DriverAssignmentEngine;
 use Fleetbase\FleetOps\Orchestration\Engines\RouteSequencingEngine;
 use Fleetbase\FleetOps\Orchestration\OrchestrationEngineRegistry;
+use Fleetbase\FleetOps\Traits\AuthorizesMethods;
 use Fleetbase\Http\Controllers\Controller;
 use Fleetbase\Models\Setting;
 use Illuminate\Http\JsonResponse;
@@ -39,8 +40,19 @@ use Illuminate\Support\Str;
  */
 class OrchestrationController extends Controller
 {
+    use AuthorizesMethods;
+
     public function __construct(protected OrchestrationEngineRegistry $registry)
     {
+        $this->authorizeMethods([
+            'orders'                => 'list order',
+            'run'                   => 'optimize order',
+            'preview'               => 'list order',
+            'commit'                => 'assign-driver-for order',
+            'engines'               => 'list order',
+            'orderConfigFields'     => 'list order',
+            'importOrders'          => 'import order',
+        ]);
     }
 
     /**