@fleetbase/fleetops-engine 0.6.68 → 0.6.70

package/server/tests/Feature/Http/Api/TelematicsRetentionIndexMigrationTest.php

@@ -0,0 +1,115 @@
+<?php
+
+use Fleetbase\FleetOps\Support\Database\TableIndexes;
+use Illuminate\Database\SQLiteConnection;
+use Illuminate\Support\Facades\Schema;
+
+/**
+ * The retention sweep ranges over (company_uuid, created_at) and
+ * (telematic_uuid, updated_at); these migrations add those indexes once,
+ * skip equivalent existing ones, and roll back only what they created.
+ */
+function fleetopsRetentionIndexDatabase(): SQLiteConnection
+{
+    $connection = new SQLiteConnection(new PDO('sqlite::memory:'), ':memory:', '', ['driver' => 'sqlite']);
+    Schema::swap($connection->getSchemaBuilder());
+
+    return $connection;
+}
+
+function fleetopsRetentionIndexMigrations(): array
+{
+    $migrations = [];
+    foreach (glob(dirname(__DIR__, 4) . '/migrations/2026_09_23_00000*_add_retention_index_to_*.php') as $path) {
+        $migrations[basename($path)] = fn () => require $path;
+    }
+
+    return $migrations;
+}
+
+test('retention index migrations add composite indexes once and roll them back', function () {
+    fleetopsRetentionIndexDatabase();
+    Schema::create('device_events', function ($table) {
+        $table->increments('id');
+        $table->uuid('company_uuid')->nullable();
+        $table->timestamps();
+    });
+    Schema::create('positions', function ($table) {
+        $table->increments('id');
+        $table->uuid('company_uuid')->nullable();
+        $table->timestamps();
+    });
+    Schema::create('telematic_sync_runs', function ($table) {
+        $table->uuid('uuid')->primary();
+        $table->uuid('telematic_uuid')->index();
+        $table->timestamps();
+    });
+
+    $expected = [
+        'device_events'       => ['device_events_company_created_at_index', ['company_uuid', 'created_at']],
+        'positions'           => ['positions_company_created_at_index', ['company_uuid', 'created_at']],
+        'telematic_sync_runs' => ['telematic_sync_runs_telematic_updated_at_index', ['telematic_uuid', 'updated_at']],
+    ];
+    $migrations = fleetopsRetentionIndexMigrations();
+    expect($migrations)->toHaveCount(3);
+    foreach ($migrations as $load) {
+        $load()->up();
+        $load()->up();
+    }
+    foreach ($expected as $table => [$name, $columns]) {
+        expect(TableIndexes::for($table)[$name] ?? null)->toBe($columns)
+            ->and(TableIndexes::covers($table, $columns))->toBeTrue()
+            ->and(TableIndexes::covers($table, ['created_at']))->toBeFalse();
+    }
+    // The existing single-column index on telematic_uuid does not cover the composite.
+    expect(count(array_filter(TableIndexes::for('telematic_sync_runs'), fn ($columns) => $columns === ['telematic_uuid'])))->toBe(1);
+
+    foreach ($migrations as $load) {
+        $load()->down();
+    }
+    foreach ($expected as $table => [$name]) {
+        expect(TableIndexes::for($table))->not->toHaveKey($name);
+    }
+});
+
+test('retention index migrations skip missing tables, missing columns and equivalent indexes', function () {
+    fleetopsRetentionIndexDatabase();
+    $migrations = fleetopsRetentionIndexMigrations();
+
+    // No tables at all: nothing to do either way.
+    foreach ($migrations as $load) {
+        $load()->up();
+        $load()->down();
+    }
+
+    Schema::create('device_events', fn ($table) => $table->increments('id'));
+    Schema::create('positions', function ($table) {
+        $table->increments('id');
+        $table->uuid('company_uuid')->nullable();
+        $table->timestamps();
+        $table->index(['company_uuid', 'created_at', 'id'], 'positions_existing_company_created');
+    });
+    Schema::create('telematic_sync_runs', function ($table) {
+        $table->uuid('uuid')->primary();
+        $table->uuid('telematic_uuid');
+        $table->timestamps();
+        $table->index(['telematic_uuid', 'updated_at'], 'telematic_sync_runs_telematic_updated_at_index');
+    });
+    Schema::table('telematic_sync_runs', fn ($table) => $table->index('updated_at', 'unrelated_updated_at'));
+
+    foreach ($migrations as $load) {
+        $load()->up();
+    }
+    expect(TableIndexes::for('device_events'))->toBe([])
+        ->and(array_keys(TableIndexes::for('positions')))->toBe(['positions_existing_company_created'])
+        ->and(TableIndexes::for('telematic_sync_runs'))->toHaveKeys(['telematic_sync_runs_telematic_updated_at_index', 'unrelated_updated_at']);
+
+    // Rolling back never drops an index the migration did not create, even under the reserved name when its shape differs.
+    Schema::table('telematic_sync_runs', fn ($table) => $table->dropIndex('telematic_sync_runs_telematic_updated_at_index'));
+    Schema::table('telematic_sync_runs', fn ($table) => $table->index('updated_at', 'telematic_sync_runs_telematic_updated_at_index'));
+    foreach ($migrations as $load) {
+        $load()->down();
+    }
+    expect(array_keys(TableIndexes::for('positions')))->toBe(['positions_existing_company_created'])
+        ->and(TableIndexes::for('telematic_sync_runs')['telematic_sync_runs_telematic_updated_at_index'])->toBe(['updated_at']);
+});

package/server/tests/Feature/Http/Internal/ContactControllerEndpointsTest.php

@@ -252,10 +252,12 @@ test('contact update guards types resolve users and portal seams persist', funct
         $probe->callProtected('assertContactInputIsValid', [$request, &$input, $contact]);
     })->toThrow(Exception::class);
 
-    // User references resolve through uuid or public id
-    expect($probe->callProtected('resolveUserUuid', ['user_contactseam']))->toBe('88888888-8888-4888-8888-888888888881')
-        ->and($probe->callProtected('resolveUserUuid', ['88888888-8888-4888-8888-888888888881']))->toBe('88888888-8888-4888-8888-888888888881')
-        ->and($probe->callProtected('resolveUserUuid', ['unknown-user']))->toBe('unknown-user');
+    // The login account is managed by the profile, so user references are dropped
+    $userInput = ['name' => 'Seam Contact', 'user_uuid' => '88888888-8888-4888-8888-888888888881', 'user' => 'user_contactseam'];
+    Closure::bind(function (array &$input) {
+        $this->resolveUserInput(Request::create('/x', 'PUT', []), $input);
+    }, $probe, ContactController::class)($userInput);
+    expect($userInput)->toBe(['name' => 'Seam Contact']);
 
     // Portal seams read users, mint passwords, and persist meta quietly
     expect($probe->callProtected('contactUser', [$contact])?->uuid)->toBe('88888888-8888-4888-8888-888888888881')

package/server/tests/Feature/Http/Internal/CustomerControllerCredentialsTest.php

@@ -125,7 +125,9 @@ function fleetopsCustomerCredentialsBoot(): SQLiteConnection
         'contacts'  => ['uuid', 'public_id', 'company_uuid', 'user_uuid', 'name', 'email', 'phone', 'type', 'title', 'meta', 'photo_uuid', 'place_uuid', 'slug', '_key'],
         'users'     => ['uuid', 'public_id', 'company_uuid', 'name', 'email', 'phone', 'password', 'type', 'status', 'timezone', 'slug', 'username', 'avatar_uuid', 'meta', '_key'],
         'companies' => ['uuid', 'public_id', 'name', 'country'],
-        'files'     => ['uuid', 'public_id', 'company_uuid', 'subject_uuid', 'subject_type', 'name', 'path', 'disk', 'type', '_key'],
+        // session_status reads the user's membership of the session company
+        'company_users' => ['uuid', 'company_uuid', 'user_uuid', 'status'],
+        'files'         => ['uuid', 'public_id', 'company_uuid', 'subject_uuid', 'subject_type', 'name', 'path', 'disk', 'type', '_key'],
     ];
     foreach ($tables as $table => $columns) {
         $schema->create($table, function ($blueprint) use ($columns) {
@@ -192,5 +194,7 @@ test('customer resolution and payload helpers expose user details', function ()
 
     $payload = $probe->callHelper('customerPayload', $customer);
     expect($payload['uuid'])->toBe('55555555-5555-4555-8555-555555555555')
-        ->and($payload)->toHaveKey('user');
+        ->and($payload['user']['uuid'])->toBe('user-1')
+        ->and($payload['is_staff_linked'])->toBeFalse()
+        ->and($payload['login_status'])->toBe('active');
 });

package/server/tests/Feature/Http/Internal/DriverControllerContractsTest.php

@@ -1131,6 +1131,29 @@ test('internal driver controller verify code returns driver resource and handles
     ]);
 });
 
+test('internal driver controller refuses phone login and code verification for deactivated drivers', function () {
+    FleetOpsInternalDriverAuthControllerProbe::resetProbe();
+    app()->instance('request', Request::create('/', 'POST', ['phone' => '15551234567']));
+
+    $deactivated = fleetopsInternalDriverAuthUser();
+    $deactivated->setAttribute('status', 'inactive');
+    FleetOpsInternalDriverAuthControllerProbe::$loginUser          = $deactivated;
+    FleetOpsInternalDriverAuthControllerProbe::$verificationUser   = $deactivated;
+    FleetOpsInternalDriverAuthControllerProbe::$verificationExists = true;
+
+    $controller = new FleetOpsInternalDriverAuthControllerProbe();
+    $login      = $controller->loginWithPhone();
+    $verify     = $controller->verifyCode(new Request(['identity' => '+15551234567', 'code' => '111111']));
+
+    expect($login->getStatusCode())->toBe(403)
+        ->and($login->getData(true))->toBe(['error' => 'This driver login has been deactivated.'])
+        ->and($verify->getStatusCode())->toBe(403)
+        ->and($verify->getData(true))->toBe(['error' => 'This driver login has been deactivated.'])
+        // No code is sent and no token is issued
+        ->and(FleetOpsInternalDriverAuthControllerProbe::$verifications)->toBe([])
+        ->and(FleetOpsInternalDriverAuthControllerProbe::$tokens)->toBe([]);
+});
+
 test('internal driver controller delegates login and create driver verification flows to api controller', function () {
     $request = new Request(['for' => 'create_driver']);
 

package/server/tests/Feature/Http/Internal/DriverControllerCreateRecordTest.php

@@ -10,11 +10,12 @@ use Illuminate\Http\Request;
 /**
  * Covers the internal DriverController createRecord and updateRecord flows
  * against an in-memory SQLite fixture. The creation closure executes end to
- * end: company resolution, user creation with driver typing, existing-user
- * adoption and conflict detection, organization membership checks, and the
- * exception-to-error-response branches. Role assignment requires the full
- * spatie permission boot unavailable in the harness, so flows settle in the
- * documented error branch after the user record is persisted.
+ * end: company resolution, managed account creation with driver typing
+ * through ProfileAccountManager, and the exception-to-error-response
+ * branches. Role assignment requires the full spatie permission boot, which
+ * this fixture leaves out, so flows settle in the documented error branch
+ * after the user record is persisted (see
+ * DriverControllerExistingUserAdoptionTest for the full flow).
  */
 if (!function_exists('Fleetbase\Support\session')) {
     eval('namespace Fleetbase\Support; function session($key = null, $default = null) { if ($key === null) { return new class { public function has($k) { return \session($k) !== null; } public function get($k, $d = null) { return \session($k, $d); } }; } return \session($key, $default); }');
@@ -101,6 +102,28 @@ function fleetopsInternalDriverCreateBoot(): SQLiteConnection
         }
     });
     Illuminate\Support\Facades\DB::clearResolvedInstance('db');
+    app()->instance('hash', new class implements Illuminate\Contracts\Hashing\Hasher {
+        public function info($hashedValue): array
+        {
+            return [];
+        }
+
+        public function make($value, array $options = []): string
+        {
+            return 'hashed:' . $value;
+        }
+
+        public function check($value, $hashedValue, array $options = []): bool
+        {
+            return 'hashed:' . $value === $hashedValue;
+        }
+
+        public function needsRehash($hashedValue, array $options = []): bool
+        {
+            return false;
+        }
+    });
+    Illuminate\Support\Facades\Hash::clearResolvedInstance('hash');
 
     $schema = $connection->getSchemaBuilder();
     $tables = [
@@ -158,31 +181,33 @@ test('create record provisions a driver-typed user before role assignment', func
         ->and($connection->table('company_users')->count())->toBeGreaterThanOrEqual(0);
 });
 
-test('create record rejects users that already belong to a driver', function () {
+test('create record ignores a picked user account and resolves the login from the email', function () {
     $connection = fleetopsInternalDriverCreateBoot();
-    $connection->table('users')->insert(['uuid' => '11111111-1111-4111-8111-111111111111', 'company_uuid' => 'company-1', 'name' => 'Existing', 'type' => 'driver']);
-    $connection->table('drivers')->insert(['uuid' => 'driver-1', 'company_uuid' => 'company-1', 'user_uuid' => '11111111-1111-4111-8111-111111111111']);
+    $connection->table('users')->insert(['uuid' => '11111111-1111-4111-8111-111111111111', 'company_uuid' => 'company-1', 'name' => 'Existing', 'email' => 'existing@example.com', 'type' => 'driver']);
 
-    $result = (new DriverController())->createRecord(fleetopsInternalDriverCreateRequest([
-        'name'      => 'Existing',
+    (new DriverController())->createRecord(fleetopsInternalDriverCreateRequest([
+        'name'      => 'Someone Else',
+        'email'     => 'someone@example.com',
         'user_uuid' => '11111111-1111-4111-8111-111111111111',
     ]));
 
-    expect($result)->toBeInstanceOf(JsonResponse::class)
-        ->and($result->getData(true))->toBe(['error' => 'This user account already belongs to a driver.']);
+    // The login account is managed by the profile: a new driver account is
+    // created for the email rather than the picked account being taken over
+    expect($connection->table('users')->count())->toBe(2)
+        ->and($connection->table('users')->where('email', 'someone@example.com')->value('type'))->toBe('driver')
+        ->and($connection->table('users')->where('uuid', '11111111-1111-4111-8111-111111111111')->value('name'))->toBe('Existing');
 });
 
-test('create record adopts an existing user and applies photo avatars', function () {
+test('create record applies photo avatars to the new driver account', function () {
     $connection = fleetopsInternalDriverCreateBoot();
-    $connection->table('users')->insert(['uuid' => '11111111-1111-4111-8111-111111111111', 'company_uuid' => 'company-1', 'name' => 'Adoptable', 'type' => 'driver']);
 
     $result = (new DriverController())->createRecord(fleetopsInternalDriverCreateRequest([
-        'name'       => 'Adoptable',
-        'user_uuid'  => '11111111-1111-4111-8111-111111111111',
+        'name'       => 'Photo Driver',
         'photo_uuid' => '22222222-2222-4222-8222-222222222222',
     ]));
 
-    // Avatar update applies before the harness role-assignment limitation.
+    // Avatar is set when the account is created, before the harness
+    // role-assignment limitation.
     expect($connection->table('users')->value('avatar_uuid'))->toBe('22222222-2222-4222-8222-222222222222')
         ->and($result)->toBeInstanceOf(JsonResponse::class)
         ->and($result->getData(true))->toHaveKey('error');