@fleetbase/fleetops-engine 0.6.68 → 0.6.70

package/server/src/Http/Controllers/Internal/v1/VehicleController.php

@@ -2,6 +2,7 @@
 
 namespace Fleetbase\FleetOps\Http\Controllers\Internal\v1;
 
+use Fleetbase\Attributes\SkipAuthorizationCheck;
 use Fleetbase\FleetOps\Exceptions\DeviceAlreadyAttachedException;
 use Fleetbase\FleetOps\Exports\VehicleExport;
 use Fleetbase\FleetOps\Http\Controllers\FleetOpsController;
@@ -25,6 +26,20 @@ use Maatwebsite\Excel\Facades\Excel;
 
 class VehicleController extends FleetOpsController
 {
+    /**
+     * Permissions for methods AuthorizationGuard cannot map to a schema action (see FleetOpsController).
+     *
+     * @var array<string, string|string[]>
+     */
+    protected array $methodPermissions = [
+        'unassignDriver'  => 'assign-driver-for vehicle',
+        'unassignOrders'  => 'update vehicle',
+        'attachDevice'    => 'update vehicle',
+        'detachDevice'    => 'update vehicle',
+        'attachEquipment' => 'update vehicle',
+        'detachEquipment' => 'update vehicle',
+    ];
+
     /**
      * The resource to query.
      *
@@ -111,6 +126,7 @@ class VehicleController extends FleetOpsController
         ]);
     }
 
+    #[SkipAuthorizationCheck]
     public function unassignDriver(string $id): JsonResponse
     {
         $vehicle = $this->findVehicle($id);
@@ -143,6 +159,7 @@ class VehicleController extends FleetOpsController
         ]);
     }
 
+    #[SkipAuthorizationCheck]
     public function unassignOrders(Request $request, string $id): JsonResponse
     {
         $request->validate([
@@ -179,6 +196,7 @@ class VehicleController extends FleetOpsController
         ]);
     }
 
+    #[SkipAuthorizationCheck]
     public function attachDevice(Request $request, string $id): JsonResponse
     {
         $request->validate(['device' => 'required|string']);
@@ -219,6 +237,7 @@ class VehicleController extends FleetOpsController
         ]);
     }
 
+    #[SkipAuthorizationCheck]
     public function detachDevice(Request $request, string $id): JsonResponse
     {
         $request->validate(['device' => 'required|string']);
@@ -265,6 +284,7 @@ class VehicleController extends FleetOpsController
      * Attach equipment to the vehicle. Equipment can only be equipped to one asset at a
      * time, so attaching moves it from any previous vehicle or trailer.
      */
+    #[SkipAuthorizationCheck]
     public function attachEquipment(Request $request, string $id): JsonResponse
     {
         $request->validate(['equipment' => 'required|string']);
@@ -292,6 +312,7 @@ class VehicleController extends FleetOpsController
         ]);
     }
 
+    #[SkipAuthorizationCheck]
     public function detachEquipment(Request $request, string $id): JsonResponse
     {
         $request->validate(['equipment' => 'required|string']);

package/server/src/Http/Controllers/Internal/v1/VendorController.php

@@ -2,6 +2,7 @@
 
 namespace Fleetbase\FleetOps\Http\Controllers\Internal\v1;
 
+use Fleetbase\Attributes\SkipAuthorizationCheck;
 use Fleetbase\FleetOps\Exports\VendorExport;
 use Fleetbase\FleetOps\Http\Controllers\FleetOpsController;
 use Fleetbase\FleetOps\Http\Resources\v1\Contact as ContactResource;
@@ -19,6 +20,18 @@ use Maatwebsite\Excel\Facades\Excel;
 
 class VendorController extends FleetOpsController
 {
+    /**
+     * Permissions for methods AuthorizationGuard cannot map to a schema action (see FleetOpsController).
+     *
+     * @var array<string, string|string[]>
+     */
+    protected array $methodPermissions = [
+        'assignDriver'          => 'update vendor',
+        'removeDriver'          => 'update vendor',
+        'addVendorPersonnel'    => 'update vendor',
+        'removeVendorPersonnel' => 'update vendor',
+    ];
+
     /**
      * The resource to query.
      *
@@ -128,6 +141,7 @@ class VendorController extends FleetOpsController
      *
      * @return \Illuminate\Http\Response
      */
+    #[SkipAuthorizationCheck]
     public function assignDriver(string $id, Request $request)
     {
         // Validate only param
@@ -160,6 +174,7 @@ class VendorController extends FleetOpsController
      *
      * @return \Illuminate\Http\Response
      */
+    #[SkipAuthorizationCheck]
     public function removeDriver(string $id, Request $request)
     {
         // Validate only param
@@ -197,6 +212,7 @@ class VendorController extends FleetOpsController
         return response()->json(['personnels' => $personnels->values()]);
     }
 
+    #[SkipAuthorizationCheck]
     public function addVendorPersonnel(Request $request, string $vendorId)
     {
         $vendor  = $this->findVendorByIdOrFail($vendorId);
@@ -220,6 +236,7 @@ class VendorController extends FleetOpsController
         ]);
     }
 
+    #[SkipAuthorizationCheck]
     public function removeVendorPersonnel(string $vendorId, string $contactId)
     {
         $vendor  = $this->findVendorByIdOrFail($vendorId);

package/server/src/Http/Controllers/Internal/v1/WorkOrderController.php

@@ -2,6 +2,7 @@
 
 namespace Fleetbase\FleetOps\Http\Controllers\Internal\v1;
 
+use Fleetbase\Attributes\SkipAuthorizationCheck;
 use Fleetbase\FleetOps\Exports\WorkOrderExport;
 use Fleetbase\FleetOps\Http\Controllers\FleetOpsController;
 use Fleetbase\FleetOps\Imports\WorkOrderImport;
@@ -16,6 +17,15 @@ use Maatwebsite\Excel\Facades\Excel;
 
 class WorkOrderController extends FleetOpsController
 {
+    /**
+     * Permissions for methods AuthorizationGuard cannot map to a schema action (see FleetOpsController).
+     *
+     * @var array<string, string|string[]>
+     */
+    protected array $methodPermissions = [
+        'sendEmail' => 'update work-order',
+    ];
+
     /**
      * The resource to query.
      *
@@ -80,6 +90,7 @@ class WorkOrderController extends FleetOpsController
      * Send a work order email to the assigned vendor.
      * POST /work-orders/{id}/send.
      */
+    #[SkipAuthorizationCheck]
     public function sendEmail(string $id): JsonResponse
     {
         $workOrder = $this->workOrderForEmail($id);

package/server/src/Http/Requests/CreateDriverRequest.php

@@ -41,9 +41,13 @@ class CreateDriverRequest extends FleetbaseRequest
              * value later. Both are still validated and still unique when they
              * are supplied; a driver created without them simply cannot sign in
              * to Navigator until credentials are added.
+             *
+             * On create, availability is decided by ProfileAccountManager: a team
+             * member of the company with the email or phone is linked to the new
+             * driver instead of being rejected as a duplicate.
              */
-            'email'    => ['nullable', Rule::when($this->filled('email'), ['email']), $this->uniqueAmongUsers()],
-            'phone'    => ['nullable', 'string', $this->uniqueAmongUsers()],
+            'email'    => ['nullable', Rule::when($this->filled('email'), ['email']), Rule::when(!$isCreating, [$this->uniqueAmongUsers()])],
+            'phone'    => ['nullable', 'string', Rule::when(!$isCreating, [$this->uniqueAmongUsers()])],
             'password' => 'nullable|string',
             'timezone' => 'nullable|string|max:64',
 

package/server/src/Http/Requests/Internal/CreateDriverRequest.php

@@ -23,22 +23,17 @@ class CreateDriverRequest extends CreateDriverApiRequest
      */
     public function rules(): array
     {
-        $isCreating                   = $this->isMethod('POST');
-        $isCreatingWithUser           = $this->filled('driver.user_uuid');
-        $shouldValidateUserAttributes = $isCreating && !$isCreatingWithUser;
+        $isCreating = $this->isMethod('POST');
 
         return [
-            // Required fields for driver creation
-            'name'                   => [Rule::requiredIf($shouldValidateUserAttributes), 'nullable', 'string', 'max:255'],
-            'email'                  => [
-                Rule::requiredIf($shouldValidateUserAttributes),
-                Rule::when($this->filled('email'), ['email']),
-                Rule::when($shouldValidateUserAttributes, [Rule::unique('users')->whereNull('deleted_at')]),
-            ],
-            'phone'                  => [
-                Rule::requiredIf($shouldValidateUserAttributes),
-                Rule::when($shouldValidateUserAttributes, [Rule::unique('users')->whereNull('deleted_at')]),
-            ],
+            // The driver profile manages its login account: name, email and phone
+            // are proxied to it. Email/phone availability is checked against the
+            // account the profile resolves to (see ProfileAccountManager), because a
+            // team member of the organization with the same email or phone is linked
+            // rather than rejected as a duplicate.
+            'name'                   => [Rule::requiredIf($isCreating), 'nullable', 'string', 'max:255'],
+            'email'                  => ['nullable', Rule::when($this->filled('email'), ['email'])],
+            'phone'                  => ['nullable', 'string'],
 
             // Optional fields
             'password'               => 'nullable|string|min:8',
@@ -84,11 +79,7 @@ class CreateDriverRequest extends CreateDriverApiRequest
     {
         return [
             'name.required'  => 'Driver name is required.',
-            'email.required' => 'Email address is required.',
             'email.email'    => 'Please provide a valid email address.',
-            'email.unique'   => 'This email address is already registered.',
-            'phone.required' => 'Phone number is required.',
-            'phone.unique'   => 'This phone number is already registered.',
             'password.min'   => 'Password must be at least 8 characters.',
         ];
     }

package/server/src/Http/Resources/v1/Contact.php

@@ -2,6 +2,7 @@
 
 namespace Fleetbase\FleetOps\Http\Resources\v1;
 
+use Fleetbase\FleetOps\Support\ProfileAccountManager;
 use Fleetbase\FleetOps\Support\Utils;
 use Fleetbase\Http\Resources\FleetbaseResource;
 use Fleetbase\Http\Resources\User;
@@ -40,6 +41,8 @@ class Contact extends FleetbaseResource
             'places'                        => $this->whenLoaded('places', fn () => Place::collection($this->places)->without('owner')),
             'user'                          => $this->when(Http::isInternalRequest(), fn () => new User($this->user), fn () => $this->user ? $this->user->public_id : null),
             'address'                       => $this->when(Http::isInternalRequest(), data_get($this, 'place.address')),
+            'is_staff_linked'               => $this->when(Http::isInternalRequest(), fn () => ProfileAccountManager::isStaffAccount($this->user)),
+            'login_status'                  => $this->when(Http::isInternalRequest(), fn () => data_get($this, 'user.status')),
             'address_street'                => $this->when(Http::isInternalRequest(), data_get($this, 'place.street1')),
             'type'                          => $this->type ?? null,
             'customer_type'                 => $this->when(isset($this->customer_type), Utils::toEmberResourceType($this->customer_type)),

package/server/src/Http/Resources/v1/Driver.php

@@ -2,6 +2,7 @@
 
 namespace Fleetbase\FleetOps\Http\Resources\v1;
 
+use Fleetbase\FleetOps\Support\ProfileAccountManager;
 use Fleetbase\FleetOps\Support\Utils;
 use Fleetbase\Http\Resources\FleetbaseResource;
 use Fleetbase\Http\Resources\FleetbaseResourceCollection;
@@ -32,6 +33,8 @@ class Driver extends FleetbaseResource
             'public_id'                     => $this->when(Http::isInternalRequest(), $this->public_id),
             'user'                          => $this->when(Http::isPublicRequest(), fn () => $this->user ? $this->user->public_id : null, new User($this->user)),
             'internal_id'                   => $this->internal_id,
+            'is_staff_linked'               => $this->when(Http::isInternalRequest(), fn () => ProfileAccountManager::isStaffAccount($this->user)),
+            'login_status'                  => $this->when(Http::isInternalRequest(), fn () => data_get($this, 'user.status')),
             'company'                       => $this->when(Http::isPublicRequest(), fn () => $this->company ? $this->company->public_id : null),
             'company_name'                  => $this->when(Http::isPublicRequest(), fn () => $this->company ? $this->company->name : null),
             'name'                          => $this->name,

package/server/src/Jobs/DispatchTelematicsRetentionJobs.php

@@ -0,0 +1,70 @@
+<?php
+
+namespace Fleetbase\FleetOps\Jobs;
+
+use Fleetbase\FleetOps\Support\Telematics\Telemetry\Queue;
+use Illuminate\Bus\Queueable;
+use Illuminate\Contracts\Queue\ShouldBeUnique;
+use Illuminate\Contracts\Queue\ShouldQueue;
+use Illuminate\Foundation\Bus\Dispatchable;
+use Illuminate\Queue\InteractsWithQueue;
+use Illuminate\Support\Collection;
+use Illuminate\Support\Facades\DB;
+
+/**
+ * Fan out system-wide cleanup in small pages, without a session or membership scope.
+ * Each company has its own bounded prune job so one large backlog cannot prevent
+ * other organizations from being processed within a shared worker timeout.
+ */
+class DispatchTelematicsRetentionJobs implements ShouldQueue, ShouldBeUnique
+{
+    use Dispatchable;
+    use InteractsWithQueue;
+    use Queueable;
+
+    public const PAGE_SIZE = 100;
+
+    public int $uniqueFor = 900;
+    public int $tries     = 3;
+    public int $timeout   = 60;
+
+    public function __construct(public int $afterCompanyId = 0, public int $maxBatches = 200)
+    {
+        $this->onQueue(config('telematics.telemetry.ingestion_queue', 'default'));
+    }
+
+    public function uniqueId(): string
+    {
+        return 'after-company:' . $this->afterCompanyId;
+    }
+
+    public function handle(): void
+    {
+        $companies = $this->companies();
+        foreach ($companies as $company) {
+            $this->queueJob(new PruneTelematicsDataJob($company->uuid, $this->maxBatches));
+        }
+
+        if ($companies->count() === self::PAGE_SIZE) {
+            $this->queueJob(new self((int) $companies->last()->id, $this->maxBatches));
+
+            return;
+        }
+
+        $this->queueJob(new PruneTelematicsDataJob(null, $this->maxBatches, true));
+    }
+
+    protected function companies(): Collection
+    {
+        return DB::table('companies')
+            ->where('id', '>', $this->afterCompanyId)
+            ->orderBy('id')
+            ->limit(self::PAGE_SIZE)
+            ->get(['id', 'uuid']);
+    }
+
+    protected function queueJob(ShouldBeUnique $job): void
+    {
+        Queue::dispatch($job);
+    }
+}

package/server/src/Jobs/PruneTelematicsDataJob.php

@@ -0,0 +1,74 @@
+<?php
+
+namespace Fleetbase\FleetOps\Jobs;
+
+use Fleetbase\FleetOps\Console\Commands\PruneTelematicsData;
+use Illuminate\Bus\Queueable;
+use Illuminate\Contracts\Queue\ShouldBeUnique;
+use Illuminate\Contracts\Queue\ShouldQueue;
+use Illuminate\Foundation\Bus\Dispatchable;
+use Illuminate\Queue\InteractsWithQueue;
+use Symfony\Component\Console\Input\ArrayInput;
+use Symfony\Component\Console\Output\BufferedOutput;
+
+/**
+ * Runs a bounded telematics prune for one company or orphaned data.
+ *
+ * The command is executed directly rather than through the console kernel so a
+ * worker started before this package version can still run it.
+ */
+class PruneTelematicsDataJob implements ShouldQueue, ShouldBeUnique
+{
+    use Dispatchable;
+    use InteractsWithQueue;
+    use Queueable;
+
+    public int $uniqueFor      = 900;
+    public int $tries          = 1;
+    // Finish or fail before Laravel's baseline Redis retry_after of 90 seconds.
+    public int $timeout        = 80;
+    public bool $failOnTimeout = true;
+    public bool $orphansOnly   = false;
+
+    public function __construct(public ?string $companyUuid = null, public int $maxBatches = 200, bool $orphansOnly = false)
+    {
+        $this->orphansOnly = $orphansOnly;
+        $this->onQueue(config('telematics.telemetry.ingestion_queue', 'default'));
+    }
+
+    public function uniqueId(): string
+    {
+        return $this->orphansOnly ? 'orphans' : ($this->companyUuid ?? 'all');
+    }
+
+    /**
+     * @return array<string, mixed>
+     */
+    public function parameters(): array
+    {
+        $parameters = ['--no-lock' => true, '--max-batches' => $this->maxBatches];
+        if ($this->companyUuid) {
+            $parameters['--company'] = $this->companyUuid;
+        }
+        if ($this->orphansOnly) {
+            $parameters['--orphans-only'] = true;
+        }
+
+        return $parameters;
+    }
+
+    public function handle(): void
+    {
+        $command = $this->command();
+        $command->setLaravel(app());
+        $exitCode = $command->run(new ArrayInput($this->parameters()), new BufferedOutput());
+        if ($exitCode !== PruneTelematicsData::SUCCESS) {
+            throw new \RuntimeException('Telematics cleanup failed with exit code ' . $exitCode . '.');
+        }
+    }
+
+    protected function command(): PruneTelematicsData
+    {
+        return app(PruneTelematicsData::class);
+    }
+}

package/server/src/Listeners/NotifyDriverOnShiftChange.php

@@ -48,7 +48,7 @@ class NotifyDriverOnShiftChange implements ShouldQueue
         }
 
         // Check the company-level scheduling setting
-        $settings     = $this->getSchedulingSettings();
+        $settings     = $this->getSchedulingSettings($schedule->company_uuid);
         $shouldNotify = (bool) data_get($settings, 'notify_drivers_on_shift_change', false);
         if (!$shouldNotify) {
             return;
@@ -66,9 +66,9 @@ class NotifyDriverOnShiftChange implements ShouldQueue
         return $scheduleItem->schedule()->with('subject')->first();
     }
 
-    protected function getSchedulingSettings(): array
+    protected function getSchedulingSettings(?string $companyUuid): array
     {
-        return Setting::lookupFromCompany('fleet-ops.scheduling-settings', []);
+        return Setting::lookupForCompany($companyUuid, 'fleet-ops.scheduling-settings', []);
     }
 
     protected function isCreatedEvent(object $event): bool

package/server/src/Mail/CustomerCredentialsMail.php

@@ -72,7 +72,7 @@ class CustomerCredentialsMail extends Mailable
      */
     private function getCustomerPortalAccessUrl(): string
     {
-        $customerPortalConfig = Setting::lookupFromCompany('customer-portal-config');
+        $customerPortalConfig = Setting::lookupForCompany($this->customer->company_uuid, 'customer-portal-config');
         $accessUrlSlug        = data_get($customerPortalConfig, 'accessUrlSlug', 'customer-portal');
 
         return Utils::consoleUrl($accessUrlSlug ?: 'customer-portal');

package/server/src/Mail/DriverCredentialsMail.php

@@ -0,0 +1,55 @@
+<?php
+
+namespace Fleetbase\FleetOps\Mail;
+
+use Fleetbase\FleetOps\Models\Driver;
+use Fleetbase\Models\User;
+use Illuminate\Bus\Queueable;
+use Illuminate\Mail\Mailable;
+use Illuminate\Mail\Mailables\Content;
+use Illuminate\Mail\Mailables\Envelope;
+use Illuminate\Queue\SerializesModels;
+
+class DriverCredentialsMail extends Mailable
+{
+    use Queueable;
+    use SerializesModels;
+
+    /**
+     * Create a new message instance.
+     */
+    public function __construct(private string $plaintextPassword, private Driver $driver, private User $user)
+    {
+    }
+
+    /**
+     * Get the message envelope.
+     */
+    public function envelope(): Envelope
+    {
+        $this->driver->loadMissing('company');
+
+        return new Envelope(
+            subject: 'Your ' . ($this->driver->company?->name ?? config('app.name')) . ' driver sign-in details',
+        );
+    }
+
+    /**
+     * Get the message content definition.
+     */
+    public function content(): Content
+    {
+        $this->driver->loadMissing('company');
+
+        return new Content(
+            markdown: 'fleetops::mail.driver-credentials',
+            with: [
+                'driver'            => $this->driver,
+                'user'              => $this->user,
+                'companyName'       => $this->driver->company?->name ?? config('app.name'),
+                'identity'          => $this->user->email ?? $this->user->phone,
+                'plaintextPassword' => $this->plaintextPassword,
+            ]
+        );
+    }
+}