@fleetbase/fleetops-engine 0.6.68 → 0.6.70

package/server/tests/ApiDriverControllerContractsTest.php

@@ -30,6 +30,8 @@ class FleetOpsApiDriverControllerProbe extends DriverController
     public array $deviceCreates             = [];
     public array $companyCalls              = [];
     public array $createdUsers              = [];
+    public array $resolvedAccounts          = [];
+    public ?Throwable $accountConflict      = null;
     public array $uuidLookups               = [];
     public array $relationLookups           = [];
     public array $relationCompanyScopes     = [];
@@ -65,11 +67,17 @@ class FleetOpsApiDriverControllerProbe extends DriverController
         return $userDetails;
     }
 
-    protected function createUser(array $userDetails): User
+    protected function resolveDriverAccount(string $companyUuid, array $userDetails): User
     {
-        $this->createdUsers[] = $userDetails;
+        $this->resolvedAccounts[] = $companyUuid;
+        $this->createdUsers[]     = $userDetails;
+
+        if ($this->accountConflict) {
+            throw $this->accountConflict;
+        }
+
         $this->user ??= new FleetOpsApiDriverUserFake();
-        $this->user->setRawAttributes(array_merge(['uuid' => 'user-uuid'], $userDetails), true);
+        $this->user->setRawAttributes(array_merge(['uuid' => 'user-uuid', 'type' => 'driver'], $userDetails), true);
 
         return $this->user;
     }
@@ -282,7 +290,17 @@ class FleetOpsApiDriverUserFake extends User
         return true;
     }
 
-    public function assignCompany(Company $company, string $role = 'Administrator'): User
+    public function save(array $options = []): bool
+    {
+        $this->updates[] = $this->getDirty();
+        $this->syncOriginal();
+
+        return true;
+    }
+
+    // Matches core-api 1.6.63+, where no role is granted unless one is given (a nullable
+    // role is also compatible with older core-api, whose parameter was a plain string).
+    public function assignCompany(Company $company, ?string $role = null): User
     {
         $this->assignedCompanies[] = $company->uuid;
 
@@ -317,6 +335,27 @@ class FleetOpsApiDriverUserFake extends User
     }
 }
 
+/**
+ * ProfileAccountManager checks a changed email/phone against the users table.
+ */
+function fleetopsApiDriverContractsUsersTable(array $rows = []): void
+{
+    $connection = new Illuminate\Database\SQLiteConnection(new PDO('sqlite::memory:'));
+    $connection->getSchemaBuilder()->create('users', function ($table) {
+        $table->string('uuid')->nullable();
+        $table->string('type')->nullable();
+        $table->string('email')->nullable();
+        $table->string('phone')->nullable();
+        $table->timestamp('deleted_at')->nullable();
+    });
+    if ($rows) {
+        $connection->table('users')->insert($rows);
+    }
+    $resolver = new Illuminate\Database\ConnectionResolver(['default' => $connection, 'mysql' => $connection]);
+    $resolver->setDefaultConnection('mysql');
+    Illuminate\Database\Eloquent\Model::setConnectionResolver($resolver);
+}
+
 class FleetOpsApiDriverVehicleFake extends Vehicle
 {
     public array $quietUpdates = [];
@@ -363,16 +402,15 @@ test('api driver controller creates drivers with user company assignment and rel
 
     expect($response)->toBe(['resource' => 'driver', 'driver' => $controller->driver])
         ->and($controller->companyCalls)->toBe([['request', 'company_public']])
+        // The login account is resolved by ProfileAccountManager in the driver's company
+        ->and($controller->resolvedAccounts)->toBe(['company-uuid'])
         ->and($controller->createdUsers[0])->toMatchArray([
-            'name'         => 'Driver One',
-            'email'        => 'driver@example.test',
-            'phone'        => '+15551234567',
-            'company_uuid' => 'company-uuid',
-            'applied'      => true,
+            'name'     => 'Driver One',
+            'email'    => 'driver@example.test',
+            'phone'    => '+15551234567',
+            'password' => 'secret-password',
+            'applied'  => true,
         ])
-        ->and($controller->user->assignedCompanies)->toBe(['company-uuid'])
-        ->and($controller->user->assignedTypes)->toBe(['driver'])
-        ->and($controller->user->assignedRoles)->toBe(['Driver'])
         ->and($controller->createdDrivers[0])->toMatchArray([
             'status'           => 'available',
             'vehicle_uuid'     => 'vehicle-uuid',
@@ -407,8 +445,10 @@ test('api driver controller reports missing company before creating drivers', fu
 });
 
 test('api driver controller updates drivers user details assignments location and photo', function () {
+    fleetopsApiDriverContractsUsersTable();
+
     $user = new FleetOpsApiDriverUserFake();
-    $user->setRawAttributes(['uuid' => 'user-uuid'], true);
+    $user->setRawAttributes(['uuid' => 'user-uuid', 'type' => 'driver'], true);
 
     $driver = new FleetOpsApiDriverFake();
     $driver->setRawAttributes([
@@ -645,7 +685,7 @@ test('api driver controller refuses to set a password through a general update',
      * and now has its own endpoint that demands the current password.
      */
     $user = new FleetOpsApiDriverUserFake();
-    $user->setRawAttributes(['uuid' => 'user-uuid'], true);
+    $user->setRawAttributes(['uuid' => 'user-uuid', 'type' => 'driver'], true);
     $driver = new FleetOpsApiDriverFake();
     $driver->setRawAttributes([
         'uuid'      => 'driver-uuid',
@@ -759,11 +799,9 @@ test('api driver controller creates an operational driver with no email or phone
             'company_uuid' => 'company-uuid',
             'status'       => 'available',
         ])
-        // The Driver-to-User relationship, organization membership, user type
-        // and role are all preserved for a credential-less driver.
-        ->and($controller->user->assignedCompanies)->toBe(['company-uuid'])
-        ->and($controller->user->assignedTypes)->toBe(['driver'])
-        ->and($controller->user->assignedRoles)->toBe(['Driver']);
+        // The Driver-to-User relationship and organization membership are
+        // preserved for a credential-less driver.
+        ->and($controller->resolvedAccounts)->toBe(['company-uuid']);
 });
 
 test('api driver controller creates a driver with only one contact method', function () {
@@ -873,7 +911,7 @@ test('api driver controller copies timezone through to the linked user account',
     ]));
 
     $user = new FleetOpsApiDriverUserFake();
-    $user->setRawAttributes(['uuid' => 'user-uuid'], true);
+    $user->setRawAttributes(['uuid' => 'user-uuid', 'type' => 'driver'], true);
 
     $driver = new FleetOpsApiDriverFake();
     $driver->setRawAttributes(['uuid' => 'driver-uuid', 'public_id' => 'driver_public', 'user_uuid' => 'user-uuid'], true);
@@ -905,3 +943,47 @@ test('api driver controller only expands relationships the public contract allow
     // name is dropped rather than reaching Eloquent, where it would be a 500.
     expect($request->input('with'))->toBe(['vehicle', 'currentJob']);
 });
+
+test('api driver controller answers 422 when the email or phone belongs to another account', function () {
+    $create                  = new FleetOpsApiDriverControllerProbe();
+    $create->accountConflict = new Fleetbase\FleetOps\Exceptions\ProfileIdentityConflictException('This email is already in use by another account.');
+
+    expect($create->create(new CreateDriverRequest(['name' => 'Driver One', 'email' => 'taken@example.test'])))->toBe([
+        'json'   => ['error' => 'This email is already in use by another account.'],
+        'status' => 422,
+    ])
+        ->and($create->createdDrivers)->toBe([]);
+
+    fleetopsApiDriverContractsUsersTable([['uuid' => 'other-user', 'type' => 'user', 'phone' => '+15550009999']]);
+
+    $user = new FleetOpsApiDriverUserFake();
+    $user->setRawAttributes(['uuid' => 'user-uuid', 'type' => 'driver', 'phone' => '+15550001111'], true);
+    $driver = new FleetOpsApiDriverFake();
+    $driver->setRawAttributes(['uuid' => 'driver-uuid', 'public_id' => 'driver_public', 'user_uuid' => 'user-uuid'], true);
+    $driver->userForTest = $user;
+
+    $update         = new FleetOpsApiDriverControllerProbe();
+    $update->driver = $driver;
+
+    expect($update->update('driver_public', new UpdateDriverRequest(['phone' => '+1 555 000 9999'])))->toBe([
+        'json'   => ['error' => 'This phone number is already in use by another account.'],
+        'status' => 422,
+    ])
+        ->and($user->updates)->toBe([])
+        ->and($driver->updates)->toBe([]);
+});
+
+test('api driver controller only renames a team member account linked to a driver', function () {
+    $staff = new FleetOpsApiDriverUserFake();
+    $staff->setRawAttributes(['uuid' => 'staff-uuid', 'type' => 'user', 'name' => 'Staff', 'email' => 'staff@example.test'], true);
+    $driver = new FleetOpsApiDriverFake();
+    $driver->setRawAttributes(['uuid' => 'driver-uuid', 'public_id' => 'driver_public', 'user_uuid' => 'staff-uuid'], true);
+    $driver->userForTest = $staff;
+
+    $update         = new FleetOpsApiDriverControllerProbe();
+    $update->driver = $driver;
+    $update->update('driver_public', new UpdateDriverRequest(['name' => 'Staff Driver', 'email' => 'changed@example.test']));
+
+    expect($staff->updates)->toBe([['name' => 'Staff Driver']])
+        ->and($staff->email)->toBe('staff@example.test');
+});

package/server/tests/CommandContractsTest.php

@@ -884,7 +884,7 @@ class FleetOpsUserCommandFake
         return true;
     }
 
-    public function assignCompany(Company $company, string $role = 'Administrator'): self
+    public function assignCompany(Company $company, ?string $role = null): self
     {
         $this->assigned[] = [$company->uuid, $role];
 
@@ -2208,8 +2208,8 @@ test('fix customer companies command creates or links users and assigns missing
             ['email', FleetOpsCustomerCommandFake::class],
             ['phone', FleetOpsCustomerCommandFake::class],
         ])
-        ->and($createdUser->assigned)->toBe([['company-created', 'Administrator']])
-        ->and($existingUser->assigned)->toBe([['company-existing', 'Administrator']]);
+        ->and($createdUser->assigned)->toBe([['company-created', 'Fleet-Ops Customer']])
+        ->and($existingUser->assigned)->toBe([['company-existing', 'Fleet-Ops Customer']]);
 });
 
 test('fix driver companies command syncs assigned users and missing company assignments', function () {
@@ -2236,7 +2236,7 @@ test('fix driver companies command syncs assigned users and missing company assi
             ['email', Driver::class],
             ['phone', Driver::class],
         ])
-        ->and($user->assigned)->toBe([['driver-company', 'Administrator']])
+        ->and($user->assigned)->toBe([['driver-company', 'Driver']])
         ->and($command->messages)->toContain(['line', 'Found driver Driver User (driver@example.test) which doesnt have correct company assignment.'])
         ->and($command->messages)->toContain(['line', 'Driver driver@example.test was assigned to company: Driver Company']);
 });

package/server/tests/ControllerHelperContractsTest.php

@@ -254,7 +254,6 @@ class FleetOpsZoneControllerProbe extends ZoneController
 class FleetOpsInternalContactControllerProbe extends InternalContactController
 {
     public array $installedPackages = [];
-    public array $resolvedUsers     = [];
     public array $sentCredentials   = [];
     public array $savedMetas        = [];
     public ?User $contactUser       = null;
@@ -269,13 +268,6 @@ class FleetOpsInternalContactControllerProbe extends InternalContactController
         return $reflection->invoke($this, ...$arguments);
     }
 
-    protected function resolveUserUuid(string $user): string
-    {
-        $this->resolvedUsers[] = $user;
-
-        return 'resolved-' . $user;
-    }
-
     protected function installedFleetbaseExtensions(): array
     {
         return $this->installedPackages;
@@ -1607,7 +1599,7 @@ test('internal contact controller create update and after save hooks protect cus
             ],
         ],
     ]);
-    $input      = ['type' => 'contact', 'user' => ['id' => 'user_public']];
+    $input      = ['type' => 'contact', 'user' => ['id' => 'user_public'], 'user_uuid' => 'user-uuid'];
 
     $controller->onBeforeCreate($request, $input);
 
@@ -1623,8 +1615,8 @@ test('internal contact controller create update and after save hooks protect cus
 
     $controller->afterSave($request, $contact);
 
-    expect($input)->toBe(['type' => 'contact', 'user_uuid' => 'resolved-user_public'])
-        ->and($controller->resolvedUsers)->toBe(['user_public'])
+    // The login account is managed by the profile, so a user can't be picked from the console
+    expect($input)->toBe(['type' => 'contact'])
         ->and($contact->normalized)->toBeTrue()
         ->and($contact->syncedCustomFields)->toBe([
             ['key' => 'tier', 'value' => 'gold'],

package/server/tests/Feature/Http/AfaqyRealtimeIngestionTest.php

@@ -3,6 +3,7 @@
 require_once __DIR__ . '/../../Support/AfaqyTestCrypto.php';
 require_once __DIR__ . '/../../Support/ExampleTelemetryProvider.php';
 require_once __DIR__ . '/../../Support/TelemetryTestEnvironment.php';
+require_once __DIR__ . '/../../Support/PruneTelematicsDataProbe.php';
 
 use Fleetbase\FleetOps\Http\Controllers\TelematicPositionWebhookController;
 use Fleetbase\FleetOps\Jobs\ProcessTelematicDelivery;
@@ -123,6 +124,12 @@ test('database ingestion deduplicates poll and push and never regresses device s
     expect(DeviceEvent::withoutGlobalScopes()->count())->toBe(2);
     expect(count($GLOBALS['afaqy_broadcasts']))->toBe(1);
     expect($device->last_position->getLat())->toBe(24.0);
+    // The raw unit is stored once, in payload; meta carries only the normalized block.
+    $stored = DeviceEvent::withoutGlobalScopes()->orderBy('id')->first();
+    expect(data_get($stored->payload, '_id'))->toBe('unit-1')
+        ->and($stored->meta)->not->toHaveKeys(['_id', 'last_update'])
+        ->and(data_get($stored->meta, 'telemetry.position_at'))->toBe('2026-09-15T11:59:00.000000Z')
+        ->and(data_get($stored->meta, 'telematic_uuid'))->toBe('integration-1');
 });
 
 test('webhook authenticates before durable acceptance and worker quarantines unknown shapes', function () {
@@ -282,7 +289,7 @@ test('five thousand units and a duplicate reconciliation sweep fit the local pro
     expect($elapsed)->toBeLessThan(60.0);
 })->skip(getenv('AFAQY_RUN_LOAD_TESTS') !== '1', 'Opt-in local processing benchmark; production latency requires deployment testing.');
 
-test('inbox maintenance retains replayable payloads and cleans expired rows during a broker outage', function () {
+test('inbox recovery leaves retention to the prune command, which expires processed deliveries by policy', function () {
     $telematic   = afaqyDbFixture();
     $inbox       = new Inbox();
     $pending     = $inbox->accept($telematic, afaqyDbUnit(), 'poll');
@@ -297,9 +304,17 @@ test('inbox maintenance retains replayable payloads and cleans expired rows duri
         'metadata' => ['telemetry' => ['durable_ingestion' => true]],
     ]));
     expect((new Fleetbase\FleetOps\Console\Commands\DrainTelematicInbox())->handle())->toBe(0);
+    // The drain only recovers; nothing is expired until the retention sweep runs.
+    expect(DB::table('telematic_deliveries')->count())->toBe(3);
+
+    $prune                     = new PruneTelematicsDataProbe();
+    $prune->options['company'] = 'company-1';
+    $prune->companyRows        = collect([(object) ['id' => 1, 'uuid' => 'company-1', 'public_id' => 'company_1']]);
+    expect($prune->handle())->toBe(0);
     expect(DB::table('telematic_deliveries')->where('uuid', $processed)->exists())->toBeFalse();
     expect(DB::table('telematic_deliveries')->where('uuid', $quarantined)->exists())->toBeTrue();
     expect(DB::table('telematic_deliveries')->where('uuid', $pending)->value('status'))->toBe('pending');
+    expect($prune->messages)->toContain(['info', 'company_1 telematic_deliveries: deleted=1 compacted=0 batches=1']);
 });
 
 test('sensor values use source time and preserve units through partial and older snapshots', function () {
@@ -596,6 +611,11 @@ test('inbox completion waits for pending deliveries and aggregates quarantined f
     DB::table('telematic_deliveries')->where('uuid', $id)->update(['status' => 'quarantined', 'applied' => 2, 'failed' => 1]);
     Inbox::finishRun('run-pending');
     expect((array) DB::table('telematic_sync_runs')->first())->toMatchArray(['status' => 'partial', 'applied' => 2, 'failed' => 1]);
+
+    // A finished run whose connection was removed completes without touching connection meta
+    DB::table('telematic_sync_runs')->insert(['uuid' => 'run-orphan', 'telematic_uuid' => 'missing-connection', 'status' => 'ingesting', 'created_at' => now(), 'updated_at' => now()]);
+    Inbox::finishRun('run-orphan');
+    expect(DB::table('telematic_sync_runs')->where('uuid', 'run-orphan')->value('status'))->not->toBe('ingesting');
 });
 
 test('telemetry diagnostics report setup receipt backlog and degraded delivery states', function () {

package/server/tests/Feature/Http/Api/DriverControllerAuthFlowsTest.php

@@ -230,6 +230,42 @@ test('password login rejects bad credentials and issues driver tokens', function
         ->and($connection->table('personal_access_tokens')->value('name'))->toBe('driver-1');
 });
 
+test('deactivated driver logins are refused on every sign-in path', function () {
+    $connection = fleetopsDriverAuthBoot();
+    $controller = new DriverController();
+    $connection->table('users')->where('uuid', 'user-1')->update(['status' => 'inactive']);
+    app('hash')->checks = true;
+
+    // An unknown identity fails authentication rather than erroring on a null user
+    $unknown = $controller->login(Request::create('/x', 'POST', ['identity' => 'ghost@example.test', 'password' => 'secret']));
+    expect($unknown->getStatusCode())->toBe(401);
+
+    $password = $controller->login(Request::create('/x', 'POST', ['identity' => 'driver@example.test', 'password' => 'secret']));
+
+    app()->instance('request', Request::create('/x', 'POST', ['phone' => '6591234567']));
+    $phone = $controller->loginWithPhone();
+
+    $connection->table('verification_codes')->insert(['uuid' => 'vc-1', 'subject_uuid' => 'user-1', 'code' => '424242', 'for' => 'driver_login']);
+    $code = $controller->verifyCode(Request::create('/x', 'POST', ['identity' => '6591234567', 'code' => '424242']));
+
+    foreach ([$password, $phone, $code] as $response) {
+        expect($response->getStatusCode())->toBe(403)
+            ->and($response->getData(true)['error'])->toBe(DriverController::DEACTIVATED_LOGIN_MESSAGE);
+    }
+
+    // Password recovery answers as if the identity were unknown
+    $forgot = $controller->forgotPassword(Request::create('/x', 'POST', ['identity' => 'driver@example.test']));
+    $reset  = $controller->resetPassword(Request::create('/x', 'POST', ['identity' => 'driver@example.test', 'code' => '424242', 'password' => 'new-secret-123']));
+
+    expect($forgot->getData(true))->toBe(['status' => 'ok'])
+        ->and($reset->getStatusCode())->toBe(422)
+        ->and($reset->getData(true)['error'])->toBe('Invalid or expired reset code.');
+
+    expect(DriverController::isLoginDeactivated(User::where('uuid', 'user-1')->first()))->toBeTrue()
+        ->and($connection->table('personal_access_tokens')->count())->toBe(0)
+        ->and($connection->table('verification_codes')->count())->toBe(1);
+});
+
 test('phone login falls back to email verification and errors without channels', function () {
     $connection = fleetopsDriverAuthBoot();
     $controller = new DriverController();

package/server/tests/Feature/Http/Api/DriverControllerSessionHelpersTest.php

@@ -106,7 +106,7 @@ function fleetopsDriverSessionHelpersBoot(): SQLiteConnection
     $schema = $connection->getSchemaBuilder();
     app()->instance('db.schema', $schema);
     $tables = [
-        'users'        => ['uuid', 'public_id', 'company_uuid', 'name', 'email', 'phone', 'status', 'type', 'username', 'password'],
+        'users'        => ['uuid', 'public_id', 'company_uuid', 'name', 'email', 'phone', 'status', 'type', 'username', 'password', 'timezone', 'slug', 'meta'],
         'drivers'      => ['uuid', 'public_id', 'internal_id', 'company_uuid', 'user_uuid', 'vehicle_uuid', 'vendor_uuid', 'status', 'online', 'location', 'meta'],
         'companies'    => ['uuid', 'public_id', 'name', 'status', 'owner_uuid'],
         'user_devices' => ['uuid', 'public_id', 'user_uuid', 'token', 'platform', 'status'],
@@ -189,22 +189,35 @@ test('user and driver persistence helpers write records', function () {
     $userDetails = $probe->callHelper('applyUserInfoFromRequest', Request::create('/x', 'POST', []), ['name' => 'Applicant']);
     expect($userDetails['name'])->toBe('Applicant');
 
-    $user = $probe->callHelper('createUser', ['name' => 'New User']);
+    // A company that isn't in the table skips the organization membership seam,
+    // which needs spatie roles; the managed account itself is still created.
+    $missingCompany = '33333333-3333-4333-8333-333333333333';
+
+    $user = $probe->callHelper('resolveDriverAccount', $missingCompany, ['name' => 'New User']);
     expect($user)->toBeInstanceOf(User::class)
-        ->and($connection->table('users')->where('name', 'New User')->count())->toBe(1);
+        ->and($connection->table('users')->where('name', 'New User')->count())->toBe(1)
+        ->and($connection->table('users')->where('name', 'New User')->value('type'))->toBe('driver')
+        ->and($connection->table('users')->where('name', 'New User')->value('status'))->toBe('active');
 
     /*
      * `password` is guarded on User, so mass assignment drops it without a
      * word. The create endpoint has always documented and validated one, so
-     * unless the helper sets it explicitly a driver created through the API
-     * can never sign in with the password chosen for them.
+     * unless it is set explicitly a driver created through the API can never
+     * sign in with the password chosen for them.
      */
-    $withPassword = $probe->callHelper('createUser', ['name' => 'Password User', 'password' => 'seeded-password']);
+    $withPassword = $probe->callHelper('resolveDriverAccount', $missingCompany, ['name' => 'Password User', 'password' => 'seeded-password']);
     $stored       = $connection->table('users')->where('name', 'Password User')->value('password');
     expect(Hash::check('seeded-password', $withPassword->password))->toBeTrue()
         ->and($stored)->not->toBeNull()
         ->and($stored)->not->toBe('seeded-password');
 
+    // A team member of the company with the email is linked instead of duplicated
+    $connection->table('users')->insert(['uuid' => 'staff-1', 'company_uuid' => '22222222-2222-4222-8222-222222222222', 'name' => 'Staff', 'email' => 'staff@example.test', 'type' => 'user']);
+    $linked = $probe->callHelper('resolveDriverAccount', '22222222-2222-4222-8222-222222222222', ['name' => 'Staff Driver', 'email' => 'STAFF@example.test']);
+    expect($linked->uuid)->toBe('staff-1')
+        ->and($connection->table('users')->where('email', 'staff@example.test')->count())->toBe(1)
+        ->and($connection->table('users')->where('uuid', 'staff-1')->value('type'))->toBe('user');
+
     $driver = $probe->callHelper('createDriver', ['company_uuid' => '22222222-2222-4222-8222-222222222222', 'user_uuid' => 'user-1']);
     expect($driver)->toBeInstanceOf(Driver::class);
 

package/server/tests/Feature/Http/Api/ProfileOnlyUserConversionMigrationTest.php

@@ -0,0 +1,201 @@
+<?php
+
+use Illuminate\Database\ConnectionResolver;
+use Illuminate\Database\Eloquent\Model as EloquentModel;
+use Illuminate\Database\SQLiteConnection;
+use Illuminate\Support\Facades\DB;
+use Illuminate\Support\Facades\Schema;
+
+/**
+ * The migration that converts profile-only `user` accounts into managed
+ * driver/customer accounts, run up and down against in-memory SQLite.
+ *
+ * An account is converted only when it clearly is a profile login and nothing
+ * else; anything that looks like a team member is left alone, and down()
+ * reverts only the rows up() converted.
+ */
+function fleetopsProfileConversionBoot(bool $withPolicies = true): SQLiteConnection
+{
+    $connection = new SQLiteConnection(new PDO('sqlite::memory:'));
+    $resolver   = new ConnectionResolver(['default' => $connection, 'mysql' => $connection]);
+    $resolver->setDefaultConnection('mysql');
+    EloquentModel::setConnectionResolver($resolver);
+
+    app()->instance('db', new class($connection) {
+        public function __construct(public SQLiteConnection $c)
+        {
+        }
+
+        public function connection($name = null): SQLiteConnection
+        {
+            return $this->c;
+        }
+
+        public function table($table, $as = null)
+        {
+            return $this->c->table($table, $as);
+        }
+
+        public function __call($method, $arguments)
+        {
+            return $this->c->{$method}(...$arguments);
+        }
+    });
+    app()->instance('db.schema', $connection->getSchemaBuilder());
+    DB::clearResolvedInstance('db');
+    Schema::clearResolvedInstance('db.schema');
+
+    $schema = $connection->getSchemaBuilder();
+    $tables = [
+        'users'                 => ['uuid', 'type', 'meta'],
+        'drivers'               => ['uuid', 'user_uuid'],
+        'contacts'              => ['uuid', 'user_uuid', 'type'],
+        'companies'             => ['uuid', 'owner_uuid'],
+        'company_users'         => ['uuid', 'user_uuid', 'company_uuid'],
+        'roles'                 => ['name'],
+        'model_has_roles'       => ['role_id', 'model_uuid'],
+        'model_has_permissions' => ['permission_id', 'model_uuid'],
+    ];
+    if ($withPolicies) {
+        $tables['model_has_policies'] = ['policy_id', 'model_uuid'];
+    }
+    foreach ($tables as $table => $columns) {
+        $schema->create($table, function ($blueprint) use ($columns) {
+            $blueprint->increments('id');
+            foreach ($columns as $column) {
+                $blueprint->string($column)->nullable();
+            }
+            $blueprint->timestamp('deleted_at')->nullable();
+        });
+    }
+
+    foreach (['Driver', 'Fleet-Ops Customer', 'Administrator'] as $role) {
+        $connection->table('roles')->insert(['name' => $role]);
+    }
+
+    return $connection;
+}
+
+function fleetopsProfileConversionMigration(): object
+{
+    return require dirname(__DIR__, 4) . '/migrations/2026_09_21_000001_convert_profile_only_users_to_managed_accounts.php';
+}
+
+/**
+ * Seed a user holding the given profile(s), roles on its company membership
+ * (or on the user itself), and optional direct permission or policy.
+ */
+function fleetopsProfileConversionUser(SQLiteConnection $connection, string $uuid, array $options = []): void
+{
+    $connection->table('users')->insert(['uuid' => $uuid, 'type' => $options['type'] ?? 'user', 'meta' => $options['meta'] ?? null, 'deleted_at' => $options['deleted_at'] ?? null]);
+    $connection->table('company_users')->insert(['uuid' => 'cu-' . $uuid, 'user_uuid' => $uuid, 'company_uuid' => 'company-1']);
+
+    if ($options['driver'] ?? false) {
+        $connection->table('drivers')->insert(['uuid' => 'driver-' . $uuid, 'user_uuid' => $uuid]);
+    }
+
+    if ($options['customer'] ?? false) {
+        $connection->table('contacts')->insert(['uuid' => 'contact-' . $uuid, 'user_uuid' => $uuid, 'type' => 'customer']);
+    }
+
+    foreach ($options['roles'] ?? [] as $role) {
+        $roleId = $connection->table('roles')->where('name', $role)->value('id');
+        $connection->table('model_has_roles')->insert(['role_id' => $roleId, 'model_uuid' => ($options['role_on_user'] ?? false) ? $uuid : 'cu-' . $uuid]);
+    }
+
+    if ($options['permission'] ?? false) {
+        $connection->table('model_has_permissions')->insert(['permission_id' => 1, 'model_uuid' => 'cu-' . $uuid]);
+    }
+
+    if ($options['policy'] ?? false) {
+        $connection->table('model_has_policies')->insert(['policy_id' => 1, 'model_uuid' => $uuid]);
+    }
+}
+
+function fleetopsProfileConversionTypes(SQLiteConnection $connection): array
+{
+    return $connection->table('users')->orderBy('uuid')->pluck('type', 'uuid')->all();
+}
+
+test('up converts profile-only accounts and leaves anything that looks like a team member', function () {
+    $connection = fleetopsProfileConversionBoot();
+
+    fleetopsProfileConversionUser($connection, 'a-driver', ['driver' => true, 'roles' => ['Driver'], 'meta' => json_encode(['source' => 'console'])]);
+    fleetopsProfileConversionUser($connection, 'b-customer', ['customer' => true, 'roles' => ['Fleet-Ops Customer'], 'role_on_user' => true]);
+    fleetopsProfileConversionUser($connection, 'c-owner', ['driver' => true, 'roles' => ['Driver']]);
+    $connection->table('companies')->insert(['uuid' => 'company-1', 'owner_uuid' => 'c-owner']);
+    fleetopsProfileConversionUser($connection, 'd-extra-role', ['driver' => true, 'roles' => ['Driver', 'Administrator']]);
+    fleetopsProfileConversionUser($connection, 'e-permission', ['driver' => true, 'roles' => ['Driver'], 'permission' => true]);
+    fleetopsProfileConversionUser($connection, 'f-policy', ['customer' => true, 'roles' => ['Fleet-Ops Customer'], 'policy' => true]);
+    fleetopsProfileConversionUser($connection, 'g-both-profiles', ['driver' => true, 'customer' => true, 'roles' => ['Driver']]);
+    fleetopsProfileConversionUser($connection, 'h-no-roles', ['driver' => true]);
+    fleetopsProfileConversionUser($connection, 'i-wrong-role', ['customer' => true, 'roles' => ['Driver']]);
+    fleetopsProfileConversionUser($connection, 'j-no-profile', ['roles' => ['Driver']]);
+    fleetopsProfileConversionUser($connection, 'k-admin', ['type' => 'admin', 'driver' => true, 'roles' => ['Driver']]);
+    fleetopsProfileConversionUser($connection, 'l-deleted', ['driver' => true, 'roles' => ['Driver'], 'deleted_at' => '2026-01-01 00:00:00']);
+    fleetopsProfileConversionUser($connection, 'm-bad-meta', ['driver' => true, 'roles' => ['Driver'], 'meta' => 'not-json']);
+
+    fleetopsProfileConversionMigration()->up();
+
+    expect(fleetopsProfileConversionTypes($connection))->toBe([
+        'a-driver'        => 'driver',
+        'b-customer'      => 'customer',
+        'c-owner'         => 'user',
+        'd-extra-role'    => 'user',
+        'e-permission'    => 'user',
+        'f-policy'        => 'user',
+        'g-both-profiles' => 'user',
+        'h-no-roles'      => 'user',
+        'i-wrong-role'    => 'user',
+        'j-no-profile'    => 'user',
+        'k-admin'         => 'admin',
+        'l-deleted'       => 'user',
+        'm-bad-meta'      => 'driver',
+    ])
+        // The previous type is recorded next to any existing meta
+        ->and(json_decode($connection->table('users')->where('uuid', 'a-driver')->value('meta'), true))->toBe(['source' => 'console', 'previous_type' => 'user'])
+        ->and(json_decode($connection->table('users')->where('uuid', 'm-bad-meta')->value('meta'), true))->toBe(['previous_type' => 'user']);
+});
+
+test('down reverts only the accounts up converted', function () {
+    $connection = fleetopsProfileConversionBoot();
+
+    fleetopsProfileConversionUser($connection, 'a-driver', ['driver' => true, 'roles' => ['Driver'], 'meta' => json_encode(['source' => 'console'])]);
+    fleetopsProfileConversionUser($connection, 'b-customer', ['customer' => true, 'roles' => ['Fleet-Ops Customer']]);
+    // Managed accounts created after the change carry no previous type
+    fleetopsProfileConversionUser($connection, 'c-native-driver', ['type' => 'driver', 'driver' => true, 'meta' => json_encode(['source' => 'app'])]);
+    // A previous type other than `user` is not this migration's
+    fleetopsProfileConversionUser($connection, 'd-other-previous', ['type' => 'customer', 'customer' => true, 'meta' => json_encode(['previous_type' => 'contact'])]);
+
+    $migration = fleetopsProfileConversionMigration();
+    $migration->up();
+    $migration->down();
+
+    expect(fleetopsProfileConversionTypes($connection))->toBe([
+        'a-driver'         => 'user',
+        'b-customer'       => 'user',
+        'c-native-driver'  => 'driver',
+        'd-other-previous' => 'customer',
+    ])
+        ->and(json_decode($connection->table('users')->where('uuid', 'a-driver')->value('meta'), true))->toBe(['source' => 'console'])
+        ->and(json_decode($connection->table('users')->where('uuid', 'b-customer')->value('meta'), true))->toBe([])
+        ->and(json_decode($connection->table('users')->where('uuid', 'd-other-previous')->value('meta'), true))->toBe(['previous_type' => 'contact']);
+});
+
+test('up and down do nothing when the tables they read are missing', function () {
+    $connection = fleetopsProfileConversionBoot(false);
+    fleetopsProfileConversionUser($connection, 'a-driver', ['driver' => true, 'roles' => ['Driver']]);
+
+    $migration = fleetopsProfileConversionMigration();
+    $migration->up();
+
+    expect(fleetopsProfileConversionTypes($connection))->toBe(['a-driver' => 'user']);
+
+    $connection->table('users')->where('uuid', 'a-driver')->update(['type' => 'driver', 'meta' => json_encode(['previous_type' => 'user'])]);
+    $connection->getSchemaBuilder()->drop('users');
+
+    // Without a users table there is nothing to revert
+    $migration->down();
+
+    expect($connection->getSchemaBuilder()->hasTable('users'))->toBeFalse();
+});