@fleetbase/fleetops-engine 0.6.68 → 0.6.70

package/server/tests/Feature/Http/Internal/TelematicsStorageDeadlinesTest.php

@@ -0,0 +1,119 @@
+<?php
+
+use Fleetbase\FleetOps\Http\Controllers\Internal\v1\SettingController;
+use Illuminate\Database\MySqlConnection;
+use Illuminate\Database\QueryException;
+use Illuminate\Support\Facades\DB;
+
+class FleetOpsStorageDeadlineConnection extends MySqlConnection
+{
+    public array $queries   = [];
+    public array $responses = [];
+    public bool $maria      = false;
+
+    public function getReadPdo()
+    {
+        return new class($this->maria) extends PDO {
+            public function __construct(private bool $maria)
+            {
+            }
+
+            public function getAttribute(int $attribute): mixed
+            {
+                if ($attribute !== PDO::ATTR_SERVER_VERSION) {
+                    throw new LogicException('Only the database server version should be read');
+                }
+
+                return $this->maria ? '10.11.8-MariaDB' : '8.0.40';
+            }
+        };
+    }
+
+    public function select($query, $bindings = [], $useReadPdo = true)
+    {
+        $this->queries[] = [$query, $bindings];
+        $response        = array_shift($this->responses) ?? [];
+        if ($response instanceof Throwable) {
+            throw $response;
+        }
+
+        return $response;
+    }
+}
+
+function fleetopsStorageQueryError(int $code): QueryException
+{
+    $error            = new PDOException('Database query failed');
+    $error->errorInfo = ['HY000', $code, 'Database query failed'];
+
+    return new QueryException('mysql', 'select history', [], $error);
+}
+
+beforeEach(function () {
+    $this->originalDb = app()->bound('db') ? app('db') : null;
+    $this->connection = new FleetOpsStorageDeadlineConnection(new PDO('sqlite::memory:'), '', '', ['driver' => 'mysql']);
+    $connection       = $this->connection;
+    app()->instance('db', new class($connection) {
+        public function __construct(public $database)
+        {
+        }
+
+        public function connection($name = null)
+        {
+            return $this->database;
+        }
+
+        public function __call($method, $args)
+        {
+            return $this->database->{$method}(...$args);
+        }
+    });
+    DB::clearResolvedInstance('db');
+    $this->controller = new SettingController();
+    $this->invoke     = fn ($method, ...$arguments) => (new ReflectionMethod(SettingController::class, $method))->invoke($this->controller, ...$arguments);
+    $this->scope      = fn ($query) => $query->where('company_uuid', 'company-a');
+});
+
+afterEach(function () {
+    if ($this->originalDb) {
+        app()->instance('db', $this->originalDb);
+    } else {
+        app()->forgetInstance('db');
+    }
+    DB::clearResolvedInstance('db');
+});
+
+test('storage scans enforce driver specific deadlines while preserving bindings', function (bool $maria) {
+    $this->connection->maria     = $maria;
+    $this->connection->responses = [[(object) ['row_count' => '4', 'oldest' => '2026-01-01']], [(object) ['rows' => 4]]];
+    expect(($this->invoke)('tableUsage', 'device_events', $this->scope, 'created_at'))->toBe(['rows' => 4, 'oldest' => '2026-01-01']);
+    ($this->invoke)('storageUsageSelect', 'select * from device_events where company_uuid = ?', ['company-a'], true);
+    expect($this->connection->queries[0][1])->toBe(['company-a'])
+        ->and($this->connection->queries[0][0])->toStartWith($maria ? 'SET STATEMENT max_statement_time=1 FOR select' : 'SELECT /*+ MAX_EXECUTION_TIME(1000) */')
+        ->and($this->connection->queries[1][0])->toStartWith($maria ? 'SET STATEMENT max_statement_time=1 FOR EXPLAIN select' : 'EXPLAIN SELECT /*+ MAX_EXECUTION_TIME(1000) */')
+        ->and($this->connection->queries[1][1])->toBe(['company-a']);
+})->with([false, true]);
+
+test('timed out counts use a scoped query plan estimate instead of another history scan', function () {
+    $this->connection->responses = [fleetopsStorageQueryError(3024), [(object) ['rows' => 101, 'filtered' => 25]]];
+    expect(($this->invoke)('tableUsage', 'device_events', $this->scope, 'created_at'))->toBe(['rows' => 25, 'oldest' => null, 'rows_estimated' => true])
+        ->and($this->connection->queries[1][0])->toStartWith('EXPLAIN SELECT')
+        ->and($this->connection->queries[1][1])->toBe(['company-a']);
+    $this->connection->responses = [fleetopsStorageQueryError(1969), fleetopsStorageQueryError(1969)];
+    expect(($this->invoke)('tableUsage', 'device_events', $this->scope, 'created_at'))->toBe(['rows' => null, 'oldest' => null, 'rows_estimated' => true]);
+});
+
+test('storage queries suppress only timeout errors and retain real database failures', function () {
+    foreach (['tableUsage', 'tableOldest'] as $method) {
+        $this->connection->responses = [fleetopsStorageQueryError(1146)];
+        expect(fn () => ($this->invoke)($method, 'device_events', $this->scope, 'created_at'))->toThrow(QueryException::class);
+    }
+    $this->connection->responses = [fleetopsStorageQueryError(3024), fleetopsStorageQueryError(1146)];
+    expect(fn () => ($this->invoke)('tableUsage', 'device_events', $this->scope, 'created_at'))->toThrow(QueryException::class);
+    $this->connection->responses = [fleetopsStorageQueryError(3024)];
+    expect(($this->invoke)('tableOldest', 'device_events', $this->scope, 'created_at'))->toBeNull();
+    $this->connection->responses = [fleetopsStorageQueryError(1969)];
+    expect(($this->invoke)('storageTableStatistics', ['device_events']))->toBe([]);
+    $this->connection->responses = [fleetopsStorageQueryError(1146)];
+    expect(fn () => ($this->invoke)('storageTableStatistics', ['device_events']))->toThrow(QueryException::class);
+});

package/server/tests/InternalCustomerControllerContractsTest.php

@@ -122,11 +122,12 @@ function fleetopsInternalCustomer(): FleetOpsInternalCustomerContactFake
     return $customer;
 }
 
-function fleetopsInternalCustomerUser(string $status = 'active'): FleetOpsInternalCustomerUserFake
+function fleetopsInternalCustomerUser(string $status = 'active', string $type = 'customer'): FleetOpsInternalCustomerUserFake
 {
     $user = new FleetOpsInternalCustomerUserFake();
     $user->setRawAttributes([
         'uuid'           => 'user-uuid',
+        'type'           => $type,
         'public_id'      => 'user_public',
         'name'           => 'Ada Customer',
         'email'          => 'ada@example.test',
@@ -236,3 +237,33 @@ test('internal customer controller validates reset credential error branches', f
             'password_confirmation' => 'one',
         ])))['error'])->toBe('Unable to reset customer credentials');
 });
+
+test('internal customer controller refuses login management for staff-linked customers', function () {
+    $staff      = fleetopsInternalCustomerUser('active', 'user');
+    $controller = fleetopsInternalCustomerController($staff);
+    $message    = 'This customer signs in with a team member account. Manage this login in IAM.';
+    $request    = new Request(['customer' => 'customer_public']);
+
+    $responses = [
+        $controller->createPortalLogin($request),
+        $controller->sendCredentials($request),
+        $controller->deactivatePortalLogin($request),
+        $controller->reactivatePortalLogin($request),
+        $controller->resetCredentials(new Request([
+            'customer'              => 'customer_public',
+            'password'              => 'chosen-secret',
+            'password_confirmation' => 'chosen-secret',
+        ])),
+    ];
+
+    foreach ($responses as $response) {
+        expect($response->getStatusCode())->toBe(422)
+            ->and(fleetopsInternalCustomerJson($response)['error'])->toBe($message);
+    }
+
+    // The team member's account is never touched
+    expect($staff->passwords)->toBe([])
+        ->and($staff->activations)->toBe(0)
+        ->and($staff->deactivations)->toBe(0)
+        ->and($controller->sentCredentials)->toBe([]);
+});

package/server/tests/InternalImportExportControllerContractsTest.php

@@ -269,14 +269,11 @@ test('internal fuel report controller syncs custom fields after save when provid
     $controller = new FleetOpsInternalFuelReportControllerProbe();
     $fuelReport = new FleetOpsInternalFuelReportAfterSaveFake();
 
-    $controller->afterSave(new Request([
-        'fuel_report' => [
-            'custom_field_values' => [
-                ['key' => 'receipt_number', 'value' => 'R-100'],
-            ],
-        ],
-    ]), $fuelReport);
-    $controller->afterSave(new Request(['fuel_report' => ['custom_field_values' => []]]), $fuelReport);
+    $input = ['custom_field_values' => [['key' => 'receipt_number', 'value' => 'R-100']]];
+    $controller->afterSave(new Request(['fuelReport' => $input]), $fuelReport, $input);
+    $controller->afterSave(new Request(), $fuelReport, ['custom_field_values' => []]);
+    $controller->afterSave(new Request(), $fuelReport, ['custom_field_values' => 'invalid']);
+    $controller->afterSave(new Request(), $fuelReport);
 
     expect($fuelReport->synced)->toBe([
         [

package/server/tests/ModelAccessorContractsTest.php

@@ -130,14 +130,51 @@ class FleetOpsContactSyncUserFake extends Fleetbase\Models\User
         return true;
     }
 
+    public function save(array $options = []): bool
+    {
+        $this->updates[] = $this->getDirty();
+        $this->syncOriginal();
+
+        return true;
+    }
+
     public function delete()
     {
         $this->deleted = true;
+        $this->setAttribute('deleted_at', '2026-01-01 00:00:00');
 
         return true;
     }
 }
 
+function fleetopsModelAccessorsUseProfileAccountTables(): void
+{
+    $connection = new SQLiteConnection(new PDO('sqlite::memory:'));
+    $schema     = $connection->getSchemaBuilder();
+    $schema->create('users', function ($table) {
+        $table->string('uuid')->nullable();
+        $table->string('type')->nullable();
+        $table->string('email')->nullable();
+        $table->string('phone')->nullable();
+        $table->timestamp('deleted_at')->nullable();
+    });
+    foreach (['drivers', 'contacts'] as $profileTable) {
+        $schema->create($profileTable, function ($table) {
+            $table->string('uuid')->nullable();
+            $table->string('user_uuid')->nullable();
+            $table->string('company_uuid')->nullable();
+            $table->timestamp('deleted_at')->nullable();
+        });
+    }
+
+    $resolver = new ConnectionResolver([
+        'default' => $connection,
+        'mysql'   => $connection,
+    ]);
+    $resolver->setDefaultConnection('mysql');
+    EloquentModel::setConnectionResolver($resolver);
+}
+
 class FleetOpsContactAccessorFake extends Contact
 {
     public array $loadedMissing                   = [];
@@ -858,6 +895,8 @@ test('contact accessors imports notifications and customer identity helpers are
 });
 
 test('contact user sync lookup and deletion guards are stable', function () {
+    fleetopsModelAccessorsUseProfileAccountTables();
+
     $user = new FleetOpsContactSyncUserFake();
     $user->setRawAttributes([
         'uuid'  => 'user-uuid',
@@ -868,22 +907,25 @@ test('contact user sync lookup and deletion guards are stable', function () {
     ], true);
 
     $contact           = new FleetOpsContactAccessorFake();
+    $contact->exists   = true;
     $contact->fakeUser = $user;
     $contact->setRawAttributes([
-        'uuid'      => 'contact-uuid',
-        'user_uuid' => 'not-a-uuid',
-        'type'      => 'customer',
-        'name'      => 'Old Name',
-        'email'     => 'old@example.com',
-        'phone'     => '+15550000000',
-        'timezone'  => 'UTC',
+        'uuid'         => 'contact-uuid',
+        'company_uuid' => 'company-uuid',
+        'user_uuid'    => 'not-a-uuid',
+        'type'         => 'customer',
+        'name'         => 'Old Name',
+        'email'        => 'old@example.com',
+        'phone'        => '+15550000000',
+        'timezone'     => 'UTC',
     ], true);
 
     $contact->name     = 'New Name';
-    $contact->email    = 'new@example.com';
-    $contact->phone    = '+15551112222';
+    $contact->email    = 'New@Example.com';
+    $contact->phone    = '+1 555-111-2222';
     $contact->timezone = 'Asia/Singapore';
 
+    // Proxy fields are normalized and pushed to the managed account
     expect($contact->syncWithUser())->toBeTrue()
         ->and($user->updates[0])->toBe([
             'name'     => 'New Name',
@@ -895,26 +937,46 @@ test('contact user sync lookup and deletion guards are stable', function () {
         ->and($contact->hasUser())->toBeTrue()
         ->and($contact->doesntHaveUser())->toBeFalse();
 
-    $deleteContact       = new FleetOpsContactAccessorFake();
-    $deleteContact->type = 'customer';
-    $deleteContact->setRelation('user', $user);
+    // An unsaved contact's account was just resolved from these values
+    $newContact           = new FleetOpsContactAccessorFake();
+    $newContact->fakeUser = $user;
+    $newContact->name     = 'Brand New';
+
+    // A saved contact with no proxy changes has nothing to sync
+    $cleanContact           = new FleetOpsContactAccessorFake();
+    $cleanContact->exists   = true;
+    $cleanContact->fakeUser = $user;
+    $cleanContact->setRawAttributes(['name' => 'New Name', 'type' => 'customer'], true);
+
+    expect($newContact->syncWithUser())->toBeFalse()
+        ->and($cleanContact->syncWithUser())->toBeFalse()
+        ->and($user->updates)->toHaveCount(1);
+
+    // Deleting the only profile holding a managed account deletes the account
+    $deleteContact               = new FleetOpsContactAccessorFake();
+    $deleteContact->type         = 'customer';
+    $deleteContact->company_uuid = 'company-uuid';
+    $deleteContact->fakeUser     = $user;
 
     expect($deleteContact->deleteUser())->toBeTrue()
-        ->and($user->deleted)->toBeTrue()
-        ->and($deleteContact->loadedMissing)->toBe(['user']);
+        ->and($user->deleted)->toBeTrue();
 
-    $mismatchedUser = new FleetOpsContactSyncUserFake();
-    $mismatchedUser->setRawAttributes(['type' => 'admin'], true);
+    // A team member's account linked to the contact is never deleted
+    $staffUser = new FleetOpsContactSyncUserFake();
+    $staffUser->setRawAttributes(['uuid' => 'staff-uuid', 'type' => 'admin'], true);
 
-    $mismatchedContact       = new FleetOpsContactAccessorFake();
-    $mismatchedContact->type = 'customer';
-    $mismatchedContact->setRelation('user', $mismatchedUser);
+    $staffContact           = new FleetOpsContactAccessorFake();
+    $staffContact->type     = 'customer';
+    $staffContact->fakeUser = $staffUser;
 
     $emptyContact           = new FleetOpsContactAccessorFake();
+    $emptyContact->exists   = true;
     $emptyContact->fakeUser = null;
     $emptyContact->setRawAttributes(['user_uuid' => 'not-a-uuid'], true);
+    $emptyContact->name = 'Changed';
 
-    expect($mismatchedContact->deleteUser())->toBeFalse()
+    expect($staffContact->deleteUser())->toBeFalse()
+        ->and($staffUser->deleted)->toBeFalse()
         ->and($emptyContact->syncWithUser())->toBeFalse()
         ->and($emptyContact->getUser())->toBeNull()
         ->and($emptyContact->hasUser())->toBeFalse()

package/server/tests/NavigatorControllerContractsTest.php

@@ -137,17 +137,24 @@ function fleetopsNavigatorCredential(string $key = 'flb_live_key'): ApiCredentia
     return $credential;
 }
 
+function fleetopsNavigatorSignedQuery(): array
+{
+    $expires = time() + 600;
+
+    return ['expires' => $expires, 'signature' => NavigatorController::linkSignature($expires)];
+}
+
 test('navigator controller builds android and ios app link redirects', function () {
     $company                   = fleetopsNavigatorCompany();
     $controller                = new FleetOpsNavigatorControllerProbe();
     $controller->adminUser     = fleetopsNavigatorUser($company);
     $controller->apiCredential = fleetopsNavigatorCredential('flb_live_navigator');
 
-    $android = $controller->linkApp(Request::create('/navigator/link-app', 'GET', [], [], [], [
+    $android = $controller->linkApp(Request::create('/navigator/link-app', 'GET', fleetopsNavigatorSignedQuery(), [], [], [
         'HTTP_USER_AGENT' => 'Mozilla/5.0 Android',
     ]))->getData(true);
 
-    $ios = $controller->linkApp(Request::create('/navigator/link-app', 'GET', [], [], [], [
+    $ios = $controller->linkApp(Request::create('/navigator/link-app', 'GET', fleetopsNavigatorSignedQuery(), [], [], [
         'HTTP_USER_AGENT' => 'Mozilla/5.0 iPhone',
     ]))->getData(true);
 
@@ -169,11 +176,32 @@ test('navigator controller returns missing organization error when no admin comp
     $controller            = new FleetOpsNavigatorControllerProbe();
     $controller->adminUser = fleetopsNavigatorUser(null);
 
-    $response = $controller->linkApp(new Request());
+    $response = $controller->linkApp(Request::create('/navigator/link-app', 'GET', fleetopsNavigatorSignedQuery()));
 
     expect($response->getData(true))->toBe(['error' => 'Organization for linking not found.']);
 });
 
+test('navigator controller refuses unsigned, tampered and expired app links before touching credentials', function () {
+    $company                   = fleetopsNavigatorCompany();
+    $controller                = new FleetOpsNavigatorControllerProbe();
+    $controller->adminUser     = fleetopsNavigatorUser($company);
+    $controller->apiCredential = fleetopsNavigatorCredential('flb_live_navigator');
+
+    $expired  = time() - 60;
+    $requests = [
+        'unsigned' => Request::create('/navigator/link-app', 'GET'),
+        'tampered' => Request::create('/navigator/link-app', 'GET', ['signature' => 'forged'] + fleetopsNavigatorSignedQuery()),
+        'expired'  => Request::create('/navigator/link-app', 'GET', ['expires' => $expired, 'signature' => NavigatorController::linkSignature($expired)]),
+    ];
+
+    foreach ($requests as $request) {
+        $response = $controller->linkApp($request);
+        expect($response->getData(true))->toBe(['error' => 'This Navigator link is invalid or has expired. Generate a new one from the console.']);
+    }
+
+    expect($controller->credentialLookups)->toBe([]);
+});
+
 test('navigator controller exposes link url settings and current organization token lookup branches', function () {
     $controller                = new FleetOpsNavigatorControllerProbe();
     $controller->apiCredential = fleetopsNavigatorCredential('flb_test_key');
@@ -194,7 +222,11 @@ test('navigator controller exposes link url settings and current organization to
     ]);
     $missing = $controller->getCurrentOrganization($secretRequest);
 
-    expect($linkUrl)->toBe(['linkUrl' => 'http://localhost/int/v1/fleet-ops/navigator/link-app'])
+    parse_str((string) parse_url($linkUrl['linkUrl'], PHP_URL_QUERY), $linkQuery);
+
+    expect($linkUrl['linkUrl'])->toStartWith('http://localhost/int/v1/fleet-ops/navigator/link-app?')
+        ->and($linkQuery['signature'])->toBe(NavigatorController::linkSignature((int) $linkQuery['expires']))
+        ->and((int) $linkQuery['expires'])->toBeGreaterThan(time())
         ->and($settings)->toBe(['enabled' => true, 'invite_code_required' => false])
         ->and($organization)->toBeInstanceOf(Organization::class)
         ->and($controller->credentialLookups)->toContain(

package/server/tests/NotificationAndMailContractsTest.php

@@ -675,3 +675,34 @@ test('maintenance schedule reminder mail exposes schedule context', function ()
             'offsetDays' => 7,
         ]);
 });
+
+test('customer credentials mail reads the portal slug from the customer company regardless of session', function (?string $sessionCompany) {
+    app('config')->set('fleetbase.console.host', 'console.fleetbase.test');
+    app('config')->set('fleetbase.console.secure', true);
+    app('config')->set('fleetbase.console.subdomain', null);
+    app('session.store')->put('company', $sessionCompany);
+
+    $connection = new Illuminate\Database\SQLiteConnection(new PDO('sqlite::memory:'));
+    $resolver   = new Illuminate\Database\ConnectionResolver(['default' => $connection, 'mysql' => $connection]);
+    $resolver->setDefaultConnection('mysql');
+    Illuminate\Database\Eloquent\Model::setConnectionResolver($resolver);
+    $connection->getSchemaBuilder()->create('settings', function ($blueprint) {
+        $blueprint->increments('id');
+        $blueprint->string('key')->nullable();
+        $blueprint->text('value')->nullable();
+        $blueprint->timestamps();
+    });
+    $connection->table('settings')->insert([
+        ['key' => 'company.company-portal.customer-portal-config', 'value' => json_encode(['accessUrlSlug' => 'acme-portal'])],
+        ['key' => 'company.other-company.customer-portal-config', 'value' => json_encode(['accessUrlSlug' => 'other-portal'])],
+    ]);
+
+    $customer              = new FleetOpsNotificationContactFake();
+    $customer->userForTest = new User();
+    $customer->userForTest->setRawAttributes(['email' => 'customer@example.test'], true);
+    $customer->setRawAttributes(['company_uuid' => 'company-portal'], true);
+
+    $content = fleetOpsNotificationWithEnvironment(fn () => (new CustomerCredentialsMail('plain-secret', $customer))->content());
+
+    expect($content->with['customerPortalUrl'])->toBe('https://console.fleetbase.test/acme-portal');
+})->with([null, 'other-company']);

package/server/tests/ObserverContractsTest.php

@@ -263,6 +263,7 @@ class FleetOpsDriverObserverUserFake extends User
     public function delete()
     {
         $this->deleted = true;
+        $this->setAttribute('deleted_at', '2026-01-01 00:00:00');
 
         return true;
     }
@@ -453,7 +454,7 @@ class FleetOpsNotifyDriverOnShiftChangeProbe extends NotifyDriverOnShiftChange
         return $this->schedule;
     }
 
-    protected function getSchedulingSettings(): array
+    protected function getSchedulingSettings(?string $companyUuid): array
     {
         return $this->settings;
     }
@@ -1149,14 +1150,30 @@ test('contact observer prevents changing existing customer contact type', functi
 });
 
 test('driver observer defaults location unassigns related records and deletes driver users', function () {
+    // releaseForProfile looks for the account's remaining driver/contact profiles
+    $connection = new Illuminate\Database\SQLiteConnection(new PDO('sqlite::memory:'));
+    $resolver   = new Illuminate\Database\ConnectionResolver(['default' => $connection, 'mysql' => $connection]);
+    $resolver->setDefaultConnection('mysql');
+    Illuminate\Database\Eloquent\Model::setConnectionResolver($resolver);
+    foreach (['drivers', 'contacts'] as $profileTable) {
+        $connection->getSchemaBuilder()->create($profileTable, function ($table) {
+            $table->string('uuid')->nullable();
+            $table->string('user_uuid')->nullable();
+            $table->string('company_uuid')->nullable();
+            $table->timestamp('deleted_at')->nullable();
+        });
+    }
+
     $driver = new Driver();
     $driver->setRawAttributes([
-        'uuid'      => 'driver-uuid',
-        'user_uuid' => 'user-uuid',
+        'uuid'         => 'driver-uuid',
+        'user_uuid'    => 'user-uuid',
+        'company_uuid' => 'company-uuid',
     ], true);
 
     $observer = new FleetOpsDriverObserverProbe();
     $user     = new FleetOpsDriverObserverUserFake();
+    $user->setRawAttributes(['uuid' => 'user-uuid', 'type' => 'driver'], true);
 
     $observer->user = $user;
     $observer->creating($driver);
@@ -1175,6 +1192,14 @@ test('driver observer defaults location unassigns related records and deletes dr
         ->and($observer->unassigned)->toBe(['driver-uuid'])
         ->and($user->deleted)->toBeTrue();
 
+    // A team member's account linked to the driver is never deleted
+    $staff = new FleetOpsDriverObserverUserFake();
+    $staff->setRawAttributes(['uuid' => 'staff-uuid', 'type' => 'user'], true);
+    $observer->user = $staff;
+    $observer->deleted($driver);
+
+    expect($staff->deleted)->toBeFalse();
+
     $driverWithLocation           = new Driver();
     $location                     = new Fleetbase\LaravelMysqlSpatial\Types\Point(1.3, 103.8);
     $driverWithLocation->location = $location;

package/server/tests/OrchestratorConsumableApiTest.php

@@ -2,6 +2,8 @@
 
 use Fleetbase\FleetOps\Http\Controllers\Api\v1\OrchestrationController;
 use Fleetbase\FleetOps\Orchestration\OrchestrationEngineRegistry;
+use Illuminate\Http\Exceptions\HttpResponseException;
+use Illuminate\Http\Request;
 
 function sanitize_orchestrator_payload(array $payload): array
 {
@@ -72,3 +74,43 @@ test('consumable orchestrator routes are registered under the public api group',
     expect($routes)->toContain("\$router->post('run', 'OrchestrationController@run');");
     expect($routes)->toContain("\$router->post('commit', 'OrchestrationController@commit');");
 });
+
+test('public orchestration uses API authentication without inheriting console IAM middleware', function () {
+    $registry = new OrchestrationEngineRegistry();
+    $public   = new OrchestrationController($registry);
+    $internal = new Fleetbase\FleetOps\Http\Controllers\Internal\v1\OrchestrationController($registry);
+
+    expect($public->getMiddleware())->toBe([]);
+
+    // An API-key request has no console IAM role. The internal workbench must
+    // still refuse this actor; its middleware must not leak onto the API class.
+    app('session.store')->flush();
+    $request = Request::create('/int/v1/fleet-ops/orchestrator/run', 'POST');
+    app()->instance('request', $request);
+    foreach (['run', 'commit'] as $method) {
+        $guard = collect($internal->getMiddleware())->first(fn ($entry) => in_array($method, $entry['options']['only'], true));
+        expect($guard)->not->toBeNull();
+
+        try {
+            $guard['middleware']($request, fn () => throw new RuntimeException('Unauthorized request reached the workbench'));
+            test()->fail('The internal workbench must require a permitted user');
+        } catch (HttpResponseException $error) {
+            expect($error->getResponse()->getStatusCode())->toBe(401);
+        }
+    }
+});
+
+test('public orchestration resolves tenant scope from the authenticated session, never request input', function () {
+    $controller = new OrchestrationController(new OrchestrationEngineRegistry());
+    $company    = new ReflectionMethod($controller, 'companyUuid');
+    $company->setAccessible(true);
+    $request = Request::create('/v1/orchestrator/run', 'POST', ['company_uuid' => 'other-company']);
+    app()->instance('request', $request);
+
+    session(['company' => 'credential-company']);
+    expect($company->invoke($controller))->toBe('credential-company');
+
+    session(['company' => 'next-credential-company']);
+    expect($company->invoke($controller))->toBe('next-credential-company');
+    app('session.store')->flush();
+});

package/server/tests/ProviderContractsTest.php

@@ -115,6 +115,13 @@ class FleetOpsProviderContractsScheduledEventFake
         return $this;
     }
 
+    public function everyFifteenMinutes(): self
+    {
+        $this->methods[] = ['everyFifteenMinutes'];
+
+        return $this;
+    }
+
     public function daily(): self
     {
         $this->methods[] = ['daily'];
@@ -277,11 +284,14 @@ test('fleetops service provider executes package registration and boot wiring',
                 'fleetops:process-operational-alerts',
                 'fleetops:sync-telematics',
                 'fleetops:drain-telematic-inbox',
+                'fleetops:prune-telematics-data',
             ])
             ->and($provider->schedule?->commands['fleetops:dispatch-orders']->methods)->toContain(['everyMinute'], ['withoutOverlapping'], ['storeOutputInDb'])
             ->and($provider->schedule?->commands['fleetops:update-estimations']->methods)->toContain(['everyTenMinutes'], ['withoutOverlapping'])
             ->and($provider->schedule?->commands['fleetops:sync-telematics']->expiresAt)->toBe(2)
             ->and($provider->schedule?->commands['fleetops:drain-telematic-inbox']->expiresAt)->toBe(2)
+            ->and($provider->schedule?->commands['fleetops:prune-telematics-data']->methods)->toContain(['everyFifteenMinutes'], ['withoutOverlapping'], ['storeOutputInDb'])
+            ->and($provider->schedule?->commands['fleetops:prune-telematics-data']->expiresAt)->toBe(14)
             ->and($orchestrationRegistry->has('vroom'))->toBeTrue()
             ->and($orchestrationRegistry->has('greedy'))->toBeTrue()
             ->and($orchestrationRegistry->has('capacity'))->toBeTrue()