@fleetbase/fleetops-engine 0.6.68 → 0.6.70

package/server/src/Support/Telematics/Retention/RetentionPolicy.php

@@ -0,0 +1,300 @@
+<?php
+
+namespace Fleetbase\FleetOps\Support\Telematics\Retention;
+
+use Fleetbase\Models\Setting;
+use Illuminate\Support\Carbon;
+
+/**
+ * Resolves how long a company keeps telematics data.
+ *
+ * Administrators control retention policy and infrastructure settings. Companies
+ * may override event and position history retention within the system maximums.
+ * Zero means "keep forever" only when the administrator has not set a maximum.
+ */
+final class RetentionPolicy
+{
+    public const SETTING_KEY = 'fleet-ops.telematics-settings';
+
+    /** Cached policies are refreshed after this many seconds so saved settings reach long-lived workers. */
+    public const CACHE_TTL_SECONDS = 60;
+
+    public const HISTORY_KEYS = ['event_retention_days', 'position_retention_days'];
+
+    public const MAXIMUMS = [
+        'event_retention_days'    => 'max_event_retention_days',
+        'position_retention_days' => 'max_position_retention_days',
+    ];
+
+    /** @var array<string, array{0: int, 1: int}> */
+    public const LIMITS = [
+        'event_retention_days'        => [1, 3650],
+        'event_compact_after_days'    => [1, 3650],
+        'position_retention_days'     => [1, 3650],
+        'processed_retention_hours'   => [1, 720],
+        'quarantine_retention_days'   => [1, 365],
+        'sync_run_retention_days'     => [1, 365],
+        'max_event_retention_days'    => [1, 3650],
+        'max_position_retention_days' => [1, 3650],
+    ];
+
+    public const BOOLEANS = ['log_telemetry_activity'];
+
+    /** Used when neither config nor settings provide a value. */
+    public const FALLBACKS = [
+        'event_retention_days'        => 30,
+        'event_compact_after_days'    => 7,
+        'position_retention_days'     => 90,
+        'processed_retention_hours'   => 24,
+        'quarantine_retention_days'   => 7,
+        'sync_run_retention_days'     => 7,
+        // A separate, opt-in cap preserves existing history when upgrading.
+        'max_event_retention_days'    => 0,
+        'max_position_retention_days' => 0,
+        'log_telemetry_activity'      => false,
+    ];
+
+    /**
+     * Test seam: fn (string $scope, string $key, mixed $default, ?string $companyUuid): mixed
+     * where $scope is `system` or `company`.
+     */
+    public static ?\Closure $settingsResolver = null;
+
+    /** @var array<string, array{policy: self, expires: int}> */
+    private static array $companyCache = [];
+
+    /** @var array{values: array, expires: int}|null */
+    private static ?array $defaultsCache = null;
+
+    private function __construct(private array $values)
+    {
+    }
+
+    /** @return string[] */
+    public static function keys(): array
+    {
+        return array_keys(self::FALLBACKS);
+    }
+
+    /**
+     * System-wide defaults: package config overridden by the admin setting.
+     */
+    public static function defaults(): array
+    {
+        if (self::$defaultsCache && self::$defaultsCache['expires'] > time()) {
+            return self::$defaultsCache['values'];
+        }
+
+        $config = array_intersect_key((array) config('telematics.telemetry', []), self::FALLBACKS);
+        $base   = self::normalize($config, self::FALLBACKS);
+        $values = self::normalize(self::resolve('system', null), $base);
+
+        self::$defaultsCache = ['values' => $values, 'expires' => time() + self::CACHE_TTL_SECONDS];
+
+        return $values;
+    }
+
+    public static function forCompany(?string $companyUuid): self
+    {
+        if (!$companyUuid) {
+            return self::fromCompanyPreferences([]);
+        }
+
+        $cached = self::$companyCache[$companyUuid] ?? null;
+        if ($cached && $cached['expires'] > time()) {
+            return $cached['policy'];
+        }
+
+        $defaults = self::defaults();
+        $policy   = self::fromCompanyPreferences(self::resolve('company', $companyUuid), $defaults);
+
+        // A policy must not extend the lifetime of system defaults it inherited.
+        self::$companyCache[$companyUuid] = ['policy' => $policy, 'expires' => self::$defaultsCache['expires']];
+
+        return $policy;
+    }
+
+    public static function fromArray(array $values, ?array $base = null): self
+    {
+        return new self(self::applyMaximums(self::normalize($values, $base ?? self::FALLBACKS)));
+    }
+
+    /**
+     * Keep only explicit, valid customer history preferences. Missing or null
+     * values remain absent so later changes to the system defaults are inherited.
+     */
+    public static function companyPreferences(array $input): array
+    {
+        $preferences = [];
+        foreach (self::HISTORY_KEYS as $key) {
+            $value = $input[$key] ?? null;
+            if ($value === null || $value === '' || is_bool($value) || filter_var($value, FILTER_VALIDATE_INT) === false) {
+                continue;
+            }
+
+            [$min, $max]       = self::LIMITS[$key];
+            $value             = (int) $value;
+            $preferences[$key] = $value === 0 ? 0 : max($min, min($max, $value));
+        }
+
+        return $preferences;
+    }
+
+    /**
+     * Legacy company overrides for ingestion, payloads and logging are ignored.
+     * Apply caps after inheritance so unlimited or overly long defaults cannot
+     * bypass an administrator's maximum either.
+     */
+    public static function fromCompanyPreferences(array $preferences, ?array $defaults = null): self
+    {
+        return self::fromArray(self::companyPreferences($preferences), $defaults ?? self::defaults());
+    }
+
+    /**
+     * Return the explicit history choices after applying the administrator's
+     * maximums. Inherited values stay absent, and an allowed zero stays explicit.
+     */
+    public static function constrainCompanyPreferences(array $preferences, ?array $defaults = null): array
+    {
+        $preferences = self::companyPreferences($preferences);
+        $effective   = self::fromCompanyPreferences($preferences, $defaults)->toArray();
+
+        return array_intersect_key($effective, $preferences);
+    }
+
+    /**
+     * Clamp and cast user input, filling gaps from `$base`.
+     */
+    public static function normalize(array $input, array $base): array
+    {
+        $values = [];
+        foreach (self::LIMITS as $key => [$min, $max]) {
+            $value        = (int) self::pick($input, $base, $key);
+            $values[$key] = $value === 0 ? 0 : max($min, min($max, $value));
+        }
+        foreach (self::BOOLEANS as $key) {
+            $values[$key] = filter_var(self::pick($input, $base, $key), FILTER_VALIDATE_BOOLEAN);
+        }
+
+        return $values;
+    }
+
+    public static function flush(?string $companyUuid = null): void
+    {
+        if ($companyUuid === null) {
+            self::$companyCache  = [];
+            self::$defaultsCache = null;
+
+            return;
+        }
+
+        unset(self::$companyCache[$companyUuid]);
+    }
+
+    /**
+     * The point in time before which rows governed by `$key` are expired, or null when retention is off.
+     */
+    public function cutoff(string $key): ?Carbon
+    {
+        $value = (int) ($this->values[$key] ?? 0);
+        if ($value <= 0) {
+            return null;
+        }
+
+        return $key === 'processed_retention_hours' ? Carbon::now()->subHours($value) : Carbon::now()->subDays($value);
+    }
+
+    public function deletesEvents(): bool
+    {
+        return $this->values['event_retention_days'] > 0;
+    }
+
+    /**
+     * Compaction strips raw payloads from events that are kept but no longer need the provider blob.
+     * It is pointless when events are deleted before, or at the same age as, they would be compacted.
+     */
+    public function compactsEvents(): bool
+    {
+        $compactAfter = $this->values['event_compact_after_days'];
+        if ($compactAfter <= 0) {
+            return false;
+        }
+
+        return !$this->deletesEvents() || $compactAfter < $this->values['event_retention_days'];
+    }
+
+    public function logsTelemetryActivity(): bool
+    {
+        return (bool) $this->values['log_telemetry_activity'];
+    }
+
+    public function get(string $key): mixed
+    {
+        return $this->values[$key] ?? null;
+    }
+
+    public function toArray(): array
+    {
+        return $this->values;
+    }
+
+    private static function applyMaximums(array $values): array
+    {
+        foreach (self::MAXIMUMS as $key => $maximumKey) {
+            $maximum = $values[$maximumKey];
+            if ($maximum > 0 && ($values[$key] === 0 || $values[$key] > $maximum)) {
+                $values[$key] = $maximum;
+            }
+        }
+
+        return $values;
+    }
+
+    private static function pick(array $input, array $base, string $key): mixed
+    {
+        if (array_key_exists($key, $input) && $input[$key] !== null && $input[$key] !== '') {
+            return $input[$key];
+        }
+
+        return $base[$key] ?? self::FALLBACKS[$key];
+    }
+
+    /**
+     * Read the stored setting for a scope. Any failure (no settings table, no session store)
+     * falls back to the layer below so ingestion never depends on the settings store.
+     */
+    private static function resolve(string $scope, ?string $companyUuid): array
+    {
+        try {
+            if (self::$settingsResolver) {
+                $value = (self::$settingsResolver)($scope, self::SETTING_KEY, [], $companyUuid);
+            } elseif ($scope === 'system') {
+                $value = Setting::lookup(self::SETTING_KEY, []);
+            } else {
+                $value = self::lookupCompanySetting($companyUuid);
+            }
+        } catch (\Throwable) {
+            $value = [];
+        }
+
+        return is_array($value) ? $value : [];
+    }
+
+    /**
+     * `Setting::lookupCompany` reads the company from the session, which queue workers and
+     * console commands do not have; scope it for the lookup and restore whatever was there.
+     */
+    private static function lookupCompanySetting(string $companyUuid): mixed
+    {
+        $session  = app('session');
+        $had      = $session->has('company');
+        $previous = $session->get('company');
+        $session->put('company', $companyUuid);
+
+        try {
+            return Setting::lookupCompany(self::SETTING_KEY, []);
+        } finally {
+            $had ? $session->put('company', $previous) : $session->forget('company');
+        }
+    }
+}

package/server/src/Support/Telematics/Retention/TelemetryActivity.php

@@ -0,0 +1,40 @@
+<?php
+
+namespace Fleetbase\FleetOps\Support\Telematics\Retention;
+
+use Spatie\Activitylog\ActivityLogger;
+
+/**
+ * Runs telemetry-driven writes with activity logging suppressed unless the
+ * system administrator enabled it. Every poll saves the device, event, position and vehicle,
+ * which otherwise writes several activity rows per device per minute.
+ */
+final class TelemetryActivity
+{
+    public static function run(?string $companyUuid, \Closure $callback): mixed
+    {
+        if (RetentionPolicy::forCompany($companyUuid)->logsTelemetryActivity()) {
+            return $callback();
+        }
+
+        $logger = self::logger();
+        if (!$logger) {
+            return $callback();
+        }
+
+        return $logger->withoutLogs($callback);
+    }
+
+    /**
+     * The logger is optional: an environment without the activity log package
+     * bound (package tests, minimal consoles) must still ingest telemetry.
+     */
+    private static function logger(): ?ActivityLogger
+    {
+        try {
+            return app(ActivityLogger::class);
+        } catch (\Throwable) {
+            return null;
+        }
+    }
+}

package/server/src/Support/Telematics/TelematicService.php

@@ -239,6 +239,12 @@ class TelematicService
         if ($provider instanceof \Fleetbase\FleetOps\Contracts\TelemetryProviderInterface) {
             return app(Telemetry\Ingestor::class)->ingest($telematic, $provider, $payload, $this);
         }
+
+        return Retention\TelemetryActivity::run($telematic->company_uuid, fn () => $this->ingestLegacySnapshot($telematic, $provider, $payload));
+    }
+
+    protected function ingestLegacySnapshot(Telematic $telematic, TelematicProviderInterface $provider, array $payload): array
+    {
         $device = $this->linkDevice($telematic, $provider->normalizeDevice($payload));
 
         $event  = null;
@@ -299,7 +305,9 @@ class TelematicService
         ], fn ($value) => $value !== null);
         $event->payload      = $eventData['payload'] ?? $eventData['meta'] ?? $eventData;
         $event->_key         = $eventKey;
-        $event->meta         = array_merge($eventData['meta'] ?? [], [
+        // Providers hand over the raw unit in `meta`; it already lives in `payload`.
+        // Persist only the normalized block so each event is stored once, not twice.
+        $event->meta = array_filter([
             'telematic_uuid'    => $telematic->uuid,
             'telematic_id'      => $telematic->public_id,
             'provider_event_id' => $event->ident,
@@ -310,7 +318,9 @@ class TelematicService
             'odometer'          => $eventData['odometer'] ?? null,
             'ignition'          => $eventData['ignition'] ?? null,
             'fuel_level'        => $eventData['fuel_level'] ?? null,
-        ]);
+            'telemetry'         => data_get($eventData, 'meta.telemetry'),
+            'provider_status'   => data_get($eventData, 'meta.provider_status'),
+        ], fn ($value) => $value !== null);
 
         $location = $this->normalizeLocation($eventData['location'] ?? null);
         if ($location) {

package/server/src/Support/Telematics/Telemetry/Ingestor.php

@@ -7,6 +7,7 @@ use Fleetbase\FleetOps\Events\DeviceTelemetryUpdated;
 use Fleetbase\FleetOps\Models\Device;
 use Fleetbase\FleetOps\Models\DeviceEvent;
 use Fleetbase\FleetOps\Models\Telematic;
+use Fleetbase\FleetOps\Support\Telematics\Retention\TelemetryActivity;
 use Fleetbase\FleetOps\Support\Telematics\TelematicService;
 use Illuminate\Support\Carbon;
 use Illuminate\Support\Facades\Cache;
@@ -32,7 +33,8 @@ class Ingestor
         }
         $key = 'telemetry:device:' . hash('sha256', $telematic->uuid . '|' . $id);
 
-        return Cache::lock($key, 60)->block(5, fn () => DB::transaction(function () use ($telematic, $sample, $options, $service, $receivedAt, $source, $normalized, $event, $id) {
+        // Telemetry saves (device, event, position, vehicle, sensors) only reach the activity log when the company opts in.
+        return Cache::lock($key, 60)->block(5, fn () => TelemetryActivity::run($telematic->company_uuid, fn () => DB::transaction(function () use ($telematic, $sample, $options, $service, $receivedAt, $source, $normalized, $event, $id) {
             $device            = Device::withoutGlobalScopes()->where('company_uuid', $telematic->company_uuid)->where('telematic_uuid', $telematic->uuid)->where('device_id', $id)->lockForUpdate()->first();
             $current           = data_get($device?->meta, 'telemetry.position_at') ?? data_get($device?->meta, 'last_update.occurred_at');
             $valid             = Sample::validPosition($event);
@@ -107,6 +109,6 @@ class Ingestor
             }
 
             return ['device' => $device, 'event' => $stored, 'events' => $stored ? [$stored] : [], 'sensors' => $sensors, 'duplicate' => $duplicate, 'invalid_position' => !$valid];
-        }, 3));
+        }, 3)));
     }
 }

package/server/src/Tracking/TrackingIntelligenceService.php

@@ -18,7 +18,7 @@ class TrackingIntelligenceService
 
     public function track(Order $order, array|TrackingOptions $options = []): array
     {
-        $options  = $options instanceof TrackingOptions ? $options : TrackingOptions::fromArray($options);
+        $options  = $options instanceof TrackingOptions ? $options : TrackingOptions::fromArray($options, $order->company_uuid);
         $context  = $this->contextBuilder->build($order, $options);
         $cacheKey = $this->cacheKey($context, $options);
 

package/server/src/Tracking/TrackingOptions.php

@@ -19,7 +19,7 @@ class TrackingOptions
     ) {
     }
 
-    public static function fromArray(array $options = []): self
+    public static function fromArray(array $options = [], ?string $companyUuid = null): self
     {
         try {
             $systemSettings = Setting::lookup('fleet-ops.tracking-settings', []);
@@ -30,7 +30,7 @@ class TrackingOptions
         $config          = array_merge(config('fleetops.tracking', []), is_array($systemSettings) ? $systemSettings : []);
         $companySettings = [];
         try {
-            $companySettings = Setting::lookupCompany('tracking', []);
+            $companySettings = Setting::lookupForCompany($companyUuid ?? session('company'), 'tracking', []);
         } catch (\Throwable) {
             $companySettings = [];
         }

package/server/src/Traits/AuthorizesMethods.php

@@ -0,0 +1,37 @@
+<?php
+
+namespace Fleetbase\FleetOps\Traits;
+
+use Fleetbase\FleetOps\Support\Authorization;
+
+/**
+ * Registers controller middleware that enforces an explicit permission per method.
+ *
+ * Used for endpoints AuthorizationGuard cannot resolve on its own: methods on
+ * resource controllers whose names do not match a schema action (these also carry
+ * `#[SkipAuthorizationCheck]`) and every method of controllers that are not
+ * resource controllers.
+ *
+ * Map values are one permission in short form (`dispatch order`), a list of
+ * permissions of which the user needs any one, or `admin` for system administrators.
+ */
+trait AuthorizesMethods
+{
+    /**
+     * @param array<string, string|string[]> $map method name => permission(s)
+     */
+    protected function authorizeMethods(array $map): void
+    {
+        foreach ($map as $method => $permissions) {
+            $this->middleware(function ($request, $next) use ($permissions) {
+                if ($permissions === 'admin') {
+                    Authorization::authorizeAdmin();
+                } else {
+                    Authorization::authorize(...(array) $permissions);
+                }
+
+                return $next($request);
+            })->only($method);
+        }
+    }
+}

package/server/src/routes.php

@@ -405,8 +405,10 @@ Route::prefix(config('fleetops.api.routing.prefix'))->namespace('Fleetbase\Fleet
                 $router->group(
                     ['prefix' => 'v1/fleet-ops/navigator', 'namespace' => 'v1'],
                     function ($router) {
-                        $router->get('get-link-app', 'NavigatorController@getLinkAppUrl');
+                        // Opened from the Navigator app's QR scan without a session;
+                        // NavigatorController::linkApp() requires a valid signature.
                         $router->get('link-app', 'NavigatorController@linkApp');
+                        $router->get('get-link-app', 'NavigatorController@getLinkAppUrl')->middleware(['fleetbase.protected']);
                     }
                 );
 
@@ -444,6 +446,10 @@ Route::prefix(config('fleetops.api.routing.prefix'))->namespace('Fleetbase\Fleet
                                 $router->post('{id}/unassign-order', $controller('unassignOrder'));
                                 $router->post('{id}/assign-vehicle', $controller('assignVehicle'));
                                 $router->post('{id}/unassign-vehicle', $controller('unassignVehicle'));
+                                $router->post('{id}/send-credentials', $controller('sendCredentials'));
+                                $router->post('{id}/reset-credentials', $controller('resetCredentials'));
+                                $router->post('{id}/deactivate-login', $controller('deactivateLogin'));
+                                $router->post('{id}/reactivate-login', $controller('reactivateLogin'));
                                 $router->match(['get', 'post'], 'export', $controller('export'));
                                 $router->post('import', $controller('import'));
                                 // Driver scheduling endpoints
@@ -764,6 +770,7 @@ Route::prefix(config('fleetops.api.routing.prefix'))->namespace('Fleetbase\Fleet
                                     function ($router) {
                                         $router->get('customers', 'FleetOpsLookupController@polymorphs');
                                         $router->get('facilitators', 'FleetOpsLookupController@polymorphs');
+                                        $router->get('profile-identity', 'FleetOpsLookupController@profileIdentity');
                                     }
                                 );
                                 $router->group(
@@ -809,6 +816,12 @@ Route::prefix(config('fleetops.api.routing.prefix'))->namespace('Fleetbase\Fleet
                                         $router->post('orchestrator-settings', 'SettingController@saveOrchestratorSettings');
                                         $router->get('orchestrator-card-fields', 'SettingController@getOrchestratorCardFields');
                                         $router->post('orchestrator-card-fields', 'SettingController@saveOrchestratorCardFields');
+                                        $router->get('telematics-settings', 'SettingController@getTelematicsSettings');
+                                        $router->post('telematics-settings', 'SettingController@saveTelematicsSettings');
+                                        $router->get('admin-telematics-settings', 'SettingController@getAdminTelematicsSettings');
+                                        $router->post('admin-telematics-settings', 'SettingController@saveAdminTelematicsSettings');
+                                        $router->get('telematics-storage-usage', 'SettingController@getTelematicsStorageUsage');
+                                        $router->post('telematics-retention/run', 'SettingController@runTelematicsRetention');
                                     }
                                 );
                                 $router->group(

package/server/tests/AiOperationalQueryCapabilityTest.php

@@ -406,6 +406,7 @@ test('asset status capability exposes metadata and denied branches', function ()
         ->and($capability->label())->toBe('Fleet-Ops asset status')
         ->and($capability->description())->toContain('vehicle, device, sensor')
         ->and($capability->permissions())->toBe([
+            'fleet-ops see driver',
             'fleet-ops see vehicle',
             'fleet-ops see device',
             'fleet-ops see sensor',

package/server/tests/AnalyticsRoutesTest.php

@@ -17,6 +17,9 @@ use Fleetbase\FleetOps\Support\Analytics\RevenueTrend;
 use Fleetbase\FleetOps\Support\Analytics\TopDrivers;
 use Fleetbase\LaravelMysqlSpatial\Types\Point;
 use Fleetbase\Models\Company;
+use Illuminate\Database\ConnectionResolver;
+use Illuminate\Database\Eloquent\Model as EloquentModel;
+use Illuminate\Database\SQLiteConnection;
 use Illuminate\Http\Request;
 use Illuminate\Support\Carbon;
 
@@ -273,6 +276,16 @@ test('analytics base applies company currency and explicit date ranges', functio
 });
 
 test('live fleet analytics serializes driver and vehicle map payloads', function () {
+    // The markers' cards look up the current order and last known position.
+    $connection = new SQLiteConnection(new PDO('sqlite::memory:'));
+    $connection->statement('create table orders (uuid varchar(64) primary key, public_id varchar(64) null, company_uuid varchar(64) null, driver_assigned_uuid varchar(64) null, vehicle_assigned_uuid varchar(64) null, tracking_number_uuid varchar(64) null, status varchar(64) null, deleted_at datetime null, created_at datetime null, updated_at datetime null)');
+    $connection->statement('create table drivers (uuid varchar(64) primary key, public_id varchar(64) null, company_uuid varchar(64) null, user_uuid varchar(64) null, vehicle_uuid varchar(64) null, current_job_uuid varchar(64) null, deleted_at datetime null, created_at datetime null, updated_at datetime null)');
+    $connection->statement('create table users (uuid varchar(64) primary key, company_uuid varchar(64) null, name varchar(255) null, deleted_at datetime null, created_at datetime null, updated_at datetime null)');
+    $connection->statement('create table positions (uuid varchar(64) primary key, company_uuid varchar(64) null, subject_uuid varchar(64) null, subject_type varchar(255) null, order_uuid varchar(64) null, speed numeric null, heading numeric null, deleted_at datetime null, created_at datetime null, updated_at datetime null)');
+    $resolver = new ConnectionResolver(['default' => $connection, 'mysql' => $connection]);
+    $resolver->setDefaultConnection('mysql');
+    EloquentModel::setConnectionResolver($resolver);
+
     $analytics = new LiveFleet();
 
     $driver                 = new TestFleetOpsLiveFleetDriver();
@@ -308,7 +321,21 @@ test('live fleet analytics serializes driver and vehicle map payloads', function
     $driverPayload->setAccessible(true);
     $vehiclePayload->setAccessible(true);
 
-    expect($driverPayload->invoke($analytics, $driver))->toBe([
+    $driverResult  = $driverPayload->invoke($analytics, $driver);
+    $vehicleResult = $vehiclePayload->invoke($analytics, $vehicle);
+
+    // Each marker carries the live map's card: the same index resource the live endpoints return.
+    expect($driverResult['card'])->toBeArray()
+        ->and($driverResult['card'])->toHaveKeys(['name', 'status', 'phone', 'email', 'online', 'meta'])
+        ->and($driverResult['card']['meta'])->toHaveKeys(['status_label', 'speed_label', 'heading_label', 'location_coordinates', 'current_order_reference'])
+        ->and($driverResult['card']['name'])->toBe('Ada Driver')
+        ->and($vehicleResult['card'])->toHaveKeys(['display_name', 'driver_name', 'plate_number', 'online', 'meta'])
+        ->and($vehicleResult['card']['display_name'])->toBe('Van 7')
+        ->and($vehicleResult['card']['meta'])->toHaveKeys(['status_label', 'speed_label', 'heading_label', 'location_coordinates', 'current_order_reference']);
+
+    unset($driverResult['card'], $vehicleResult['card']);
+
+    expect($driverResult)->toBe([
         'uuid'               => 'driver-uuid',
         'public_id'          => 'driver-public',
         'name'               => 'Ada Driver',
@@ -320,7 +347,7 @@ test('live fleet analytics serializes driver and vehicle map payloads', function
         'lat'                => 1.30,
         'lng'                => 103.80,
         'updated_at'         => '2026-01-01 10:00:00',
-    ])->and($vehiclePayload->invoke($analytics, $vehicle))->toBe([
+    ])->and($vehicleResult)->toBe([
         'uuid'         => 'vehicle-uuid',
         'public_id'    => 'vehicle-public',
         'name'         => 'Van 7',

package/server/tests/ApiCustomerControllerContractsTest.php

@@ -800,6 +800,27 @@ test('api customer controller authenticates and verifies customer codes', functi
         ]))))->toBe(['error' => 'Invalid verification code.']);
 });
 
+test('api customer controller refuses deactivated customer logins', function () {
+    $controller = fleetopsApiCustomerController();
+    foreach (['activeUser', 'loginUser', 'verificationUser'] as $property) {
+        $controller->{$property}->setAttribute('status', 'inactive');
+    }
+
+    $responses = [
+        $controller->login(Request::create('/v1/customers/login', 'POST', ['identity' => 'jane@example.test', 'password' => 'password-secret'])),
+        $controller->loginWithPhone(Request::create('/v1/customers/login/phone', 'POST', ['phone' => '15551234567'])),
+        $controller->verifyCode(Request::create('/v1/customers/verify', 'POST', ['identity' => 'jane@example.test', 'code' => '123456'])),
+    ];
+
+    foreach ($responses as $response) {
+        expect($response->getStatusCode())->toBe(403)
+            ->and(fleetopsApiCustomerJson($response))->toBe(['error' => 'This customer login has been deactivated.']);
+    }
+
+    // No verification code is sent
+    expect($controller->smsVerifications)->toBe([]);
+});
+
 test('api customer controller resets forgotten passwords', function () {
     $controller = fleetopsApiCustomerController();
     $forgot     = $controller->forgotPassword(Request::create('/v1/customers/forgot-password', 'POST', [