@fleetbase/fleetops-engine 0.6.68 → 0.6.70

package/server/tests/Unit/Support/Ai/Capabilities/SearchResourcesCapabilityTest.php

@@ -67,6 +67,17 @@ class FleetOpsSearchResourcesCapabilityProbe extends SearchResourcesCapability
     public array $queries            = [];
     public array $appliedLikes       = [];
 
+    public array $failing = [];
+
+    public function exposeSearchTerms(string $prompt): array
+    {
+        return $this->searchTerms($prompt);
+    }
+
+    protected function reportSearchFailure(string $resource, Throwable $e): void
+    {
+    }
+
     public function exposePromptMatches(string $prompt): bool
     {
         return $this->matchesPrompt($prompt);
@@ -103,6 +114,10 @@ class FleetOpsSearchResourcesCapabilityProbe extends SearchResourcesCapability
 
     protected function genericSearchQuery(string $modelClass)
     {
+        if ($modelClass === Sensor::class && in_array('sensors', $this->failing, true)) {
+            throw new RuntimeException("SQLSTATE[42S22]: Column not found: 1054 Unknown column 'sensor_type'");
+        }
+
         return match ($modelClass) {
             WorkOrder::class   => $this->queries['work_orders'],
             Maintenance::class => $this->queries['maintenances'],
@@ -197,7 +212,7 @@ test('search resources resolve returns authorized resource summaries across all
     $result = $capability->resolve(new AiTask(['prompt' => 'Find order ORDER-1 vehicle VEH-1 driver DRV-1 device DEV-1 sensor SNS-1 telematic TEL-1']));
 
     expect($capability->exposePromptMatches('look up work order WO-1'))->toBeTrue()
-        ->and($result['query_terms'])->toBe(['ORDER-1', 'VEH-1', 'DRV-1', 'device', 'DEV-1', 'sensor'])
+        ->and($result['query_terms'])->toBe(['ORDER-1', 'VEH-1', 'DRV-1', 'DEV-1', 'SNS-1', 'TEL-1'])
         ->and($result['results'])->toHaveKeys(['orders', 'vehicles', 'drivers', 'work_orders', 'maintenances', 'devices', 'sensors', 'telematics'])
         ->and($result['results']['orders'][0])->toMatchArray([
             'id'                   => 'order_public',
@@ -235,3 +250,72 @@ test('search resources resolve returns authorized resource summaries across all
         ->and($capability->queries['orders']->calls)->toContain(['limit', 5], ['get'])
         ->and($capability->appliedLikes)->not->toBeEmpty();
 });
+
+function fleetopsSearchResourcesEmptyQueries(): array
+{
+    return collect(['orders', 'vehicles', 'drivers', 'work_orders', 'maintenances', 'devices', 'sensors', 'telematics'])
+        ->mapWithKeys(fn ($key) => [$key => new FleetOpsSearchResourcesQueryFake()])
+        ->all();
+}
+
+test('search terms ignore ordinary words from real production prompts', function () {
+    $capability = new FleetOpsSearchResourcesCapabilityProbe();
+
+    expect($capability->exposeSearchTerms('i want turn this into a platform where i add cisterns and on a different page BUSINESS leave they orders'))->toBe([])
+        ->and($capability->exposeSearchTerms('Create a few dummy orders so we can test with it'))->toBe([])
+        ->and($capability->exposeSearchTerms('download order import template'))->toBe([])
+        ->and($capability->exposeSearchTerms('config driver app ยังไง'))->toBe([])
+        ->and($capability->exposeSearchTerms('como activar un conductor'))->toBe([]);
+});
+
+test('search terms keep record references such as public ids, plates, emails, quoted and capitalized names', function () {
+    $capability = new FleetOpsSearchResourcesCapabilityProbe();
+
+    expect($capability->exposeSearchTerms('status of order order_yhkejdnzgz'))->toBe(['order_yhkejdnzgz'])
+        ->and($capability->exposeSearchTerms('vehicle plate SBA1234Z'))->toBe(['SBA1234Z'])
+        ->and($capability->exposeSearchTerms('driver with email ada@example.com'))->toBe(['ada@example.com'])
+        ->and($capability->exposeSearchTerms('where is driver Jane Doe right now'))->toBe(['Jane', 'Doe'])
+        ->and($capability->exposeSearchTerms('find "north depot" vehicles'))->toBe(['north depot']);
+});
+
+test('search resources skips querying when the prompt has no record reference', function () {
+    $capability                     = new FleetOpsSearchResourcesCapabilityProbe();
+    $capability->allowedPermissions = $capability->permissions();
+    $capability->queries            = fleetopsSearchResourcesEmptyQueries();
+
+    $result = $capability->resolve(new AiTask(['prompt' => 'how do I create a new order']));
+
+    expect($result['query_terms'])->toBe([])
+        ->and($result['results'])->toBe([])
+        ->and($capability->appliedLikes)->toBe([]);
+});
+
+test('search resources never searches the dropped sensor_type column or status/uuid columns', function () {
+    $capability                     = new FleetOpsSearchResourcesCapabilityProbe();
+    $capability->allowedPermissions = $capability->permissions();
+    $capability->queries            = fleetopsSearchResourcesEmptyQueries();
+
+    $capability->resolve(new AiTask(['prompt' => 'find SNS-1']));
+
+    $columns = collect($capability->appliedLikes)->flatMap(fn ($like) => $like[0])->unique()->all();
+
+    expect($columns)->not->toContain('sensor_type')
+        ->and($columns)->not->toContain('status')
+        ->and($columns)->not->toContain('uuid')
+        ->and($columns)->not->toContain('type');
+});
+
+test('a failing resource search does not discard the other results or leak the error', function () {
+    $vehicle = fleetopsSearchResourcesModel(Vehicle::class, ['public_id' => 'vehicle_public', 'uuid' => 'vehicle-uuid', 'name' => 'Van 12']);
+
+    $capability                     = new FleetOpsSearchResourcesCapabilityProbe();
+    $capability->allowedPermissions = $capability->permissions();
+    $capability->failing            = ['sensors'];
+    $capability->queries            = array_merge(fleetopsSearchResourcesEmptyQueries(), ['vehicles' => new FleetOpsSearchResourcesQueryFake([$vehicle])]);
+
+    $result = $capability->resolve(new AiTask(['prompt' => 'find VEH-12']));
+
+    expect($result['results'])->toHaveKey('vehicles')
+        ->and($result['unavailable_search'])->toBe(['sensors'])
+        ->and(json_encode($result))->not->toContain('SQLSTATE');
+});

package/server/tests/Unit/Support/Ai/FleetOpsAiConsoleCommandsTest.php

@@ -0,0 +1,31 @@
+<?php
+
+use Fleetbase\FleetOps\Support\Ai\FleetOpsAiConsoleCommands;
+
+test('fleet-ops console commands are unique, complete, and only navigate or call allowlisted services', function () {
+    $commands = collect(FleetOpsAiConsoleCommands::all());
+
+    expect($commands->pluck('id')->duplicates())->toBeEmpty()
+        ->and($commands->every(fn ($command) => filled($command['label']) && filled($command['breadcrumb']) && filled($command['description']) && !empty($command['steps'])))->toBeTrue()
+        ->and($commands->every(fn ($command) => collect($command['steps'])->every(fn ($step) => $step['type'] === 'navigate'
+            ? str_starts_with($step['route'], 'console.fleet-ops.')
+            : $step['type'] === 'service' && $step['engine'] === FleetOpsAiConsoleCommands::ENGINE && preg_match('/^[a-zA-Z]+$/', $step['method']))))->toBeTrue()
+        ->and($commands->every(fn ($command) => ($command['audience'] ?? 'end_user') === 'end_user'))->toBeTrue();
+});
+
+test('fleet-ops console commands cover create, import, view, and settings', function () {
+    $commands = collect(FleetOpsAiConsoleCommands::all())->keyBy('id');
+
+    expect($commands['fleet-ops.orders.create']['steps'])->toBe([['type' => 'navigate', 'route' => 'console.fleet-ops.operations.orders.index.new']])
+        ->and($commands['fleet-ops.orders.create']['permissions'])->toBe(['fleet-ops create order'])
+        ->and($commands['fleet-ops.orders.import']['steps'][1])->toBe(['type' => 'service', 'engine' => '@fleetbase/fleetops-engine', 'service' => 'order-actions', 'method' => 'importOrders'])
+        ->and($commands['fleet-ops.customers.import']['steps'][1]['service'])->toBe('customer-actions')
+        ->and($commands['fleet-ops.customers.import']['permissions'])->toBe(['fleet-ops import contact'])
+        ->and($commands)->not->toHaveKey('fleet-ops.fleets.import')
+        ->and($commands['fleet-ops.drivers.view']['steps'][0]['models'])->toBe(['public_id'])
+        ->and($commands['fleet-ops.drivers.view']['params'])->toHaveKey('public_id')
+        ->and($commands['fleet-ops.settings.map.open']['steps'][0]['route'])->toBe('console.fleet-ops.settings.map')
+        ->and($commands['fleet-ops.settings.map.open']['permissions'])->toBe(['fleet-ops view map-settings'])
+        ->and($commands['fleet-ops.settings.map.open']['keywords'])->toContain('google maps', 'view maps')
+        ->and($commands['fleet-ops.settings.scheduling.open']['permissions'])->toBe([]);
+});

package/server/tests/Unit/Support/Ai/Tools/FleetOpsAiToolsTest.php

@@ -0,0 +1,246 @@
+<?php
+
+use Fleetbase\Ai\Models\AiTask;
+use Fleetbase\Ai\Support\AiAudience;
+use Fleetbase\Ai\Support\AiToolContext;
+use Fleetbase\FleetOps\Models\OrderConfig;
+use Fleetbase\FleetOps\Support\Ai\Tools\CreateOrderTool;
+use Fleetbase\FleetOps\Support\Ai\Tools\SearchResourcesTool;
+
+class FleetOpsCreateOrderToolProbe extends CreateOrderTool
+{
+    public array $resolvedPlaces = [];
+
+    public function exposeBuildDraft(AiTask $task, array $input = []): array
+    {
+        return $this->buildDraft($task, $input);
+    }
+
+    protected function can(string $permission): bool
+    {
+        return true;
+    }
+
+    protected function draftFromPrompt(string $prompt): array
+    {
+        return array_filter([
+            'order_config_uuid' => 'order-config-uuid',
+            'type'              => 'transport',
+            'payload'           => $prompt !== '' ? ['pickup_query' => 'Parsed from prompt'] : [],
+            'dispatched'        => false,
+        ], fn ($value) => $value !== []) + ['payload' => []];
+    }
+
+    protected function resolvePlace(?string $query): ?array
+    {
+        return $this->resolvedPlaces[$query] ?? null;
+    }
+
+    protected function resolveOrderConfig(array $draft): ?OrderConfig
+    {
+        $config = new OrderConfig();
+        $config->setRawAttributes(['uuid' => 'order-config-uuid', 'key' => 'transport', 'name' => 'Transport'], true);
+
+        return $config;
+    }
+
+    protected function resolveDriver(array $draft): ?Fleetbase\FleetOps\Models\Driver
+    {
+        return null;
+    }
+
+    protected function resolveVehicle(array $draft): ?Fleetbase\FleetOps\Models\Vehicle
+    {
+        return null;
+    }
+}
+
+class FleetOpsSearchResourcesToolProbe extends SearchResourcesTool
+{
+    public array $searched = [];
+
+    protected function searchAll(array $terms, ?array $types = null): array
+    {
+        $this->searched[] = [$terms, $types];
+
+        return ['query_terms' => $terms, 'results' => []];
+    }
+}
+
+test('create order tool prepares one draft preview per call from structured fields without parsing the prompt', function () {
+    $tool    = new FleetOpsCreateOrderToolProbe();
+    $task    = new AiTask(['prompt' => 'Create some dummy orders with made up data', 'metadata' => []]);
+    $context = new AiToolContext($task, new AiAudience(false, ['fleet-ops create order']));
+
+    $first = $tool->invoke($task, [
+        'pickup'       => 'Kabelweg 57, Amsterdam',
+        'dropoff'      => 'Danzigerkade 15, Amsterdam',
+        'scheduled_at' => '2026-09-16T09:30:00+02:00',
+        'driver'       => '  ',
+        'notes'        => 'Test order',
+    ], $context);
+    $second = $tool->invoke($task, ['pickup' => 'Diemerhof 32, Diemen', 'dropoff' => 'Herikerbergweg 238, Amsterdam', 'dispatch' => true], $context);
+
+    expect($first['preview_id'])->toBe('preview-1')
+        ->and($second['preview_id'])->toBe('preview-2')
+        ->and($first['status'])->toBe('draft_shown_to_user')
+        ->and($first['message'])->toContain('does not exist until the user reviews the card')
+        ->and($context->actionPreviews)->toHaveCount(2)
+        ->and($context->actionPreviews[0]['draft']['payload']['pickup_query'])->toBe('Kabelweg 57, Amsterdam')
+        ->and($context->actionPreviews[0]['draft']['scheduled_at'])->toBe('2026-09-16T09:30:00+02:00')
+        ->and($context->actionPreviews[0]['draft']['notes'])->toBe('Test order')
+        ->and($context->actionPreviews[0]['draft'])->not->toHaveKey('driver_query')
+        ->and($context->actionPreviews[0]['draft']['dispatched'])->toBeFalse()
+        ->and($context->actionPreviews[1]['draft']['payload']['pickup_query'])->toBe('Diemerhof 32, Diemen')
+        ->and($context->actionPreviews[1]['draft']['dispatched'])->toBeTrue()
+        ->and(json_encode($context->actionPreviews))->not->toContain('Parsed from prompt')
+        ->and($tool->toolName())->toBe('propose_create_order')
+        ->and($tool->key())->toBe('fleet-ops.create_order')
+        ->and($tool->toolDescription())->toContain('NOT created by this tool')
+        ->and($tool->toolParameters()['required'])->toBe(['pickup', 'dropoff'])
+        ->and($tool->availableFor($context))->toBeTrue()
+        ->and($tool->availableFor(new AiToolContext($task, new AiAudience(false, []))))->toBeFalse();
+});
+
+test('create order drafts refresh from the edited preview and still parse prompts in keyword mode', function () {
+    $tool = new FleetOpsCreateOrderToolProbe();
+    $task = new AiTask(['prompt' => 'create order', 'metadata' => ['action_previews' => [['draft' => ['notes' => 'first preview']]]]]);
+
+    $refreshed = $tool->exposeBuildDraft($task, ['existing_draft' => ['notes' => 'second preview'], 'draft' => ['dispatched' => true]]);
+    $keyword   = $tool->exposeBuildDraft($task, ['dispatched' => false]);
+
+    expect($refreshed['notes'])->toBe('second preview')
+        ->and($refreshed['dispatched'])->toBeTrue()
+        ->and($refreshed['payload']['pickup_query'])->toBe('Parsed from prompt')
+        ->and($keyword['notes'])->toBe('first preview')
+        ->and($keyword)->not->toHaveKey('existing_draft');
+});
+
+test('search tool searches the requested phrase and identifiers for the chosen record types', function () {
+    $tool    = new FleetOpsSearchResourcesToolProbe();
+    $task    = new AiTask(['prompt' => 'where is Jane']);
+    $context = new AiToolContext($task, new AiAudience(false, ['fleet-ops see driver']));
+
+    $tool->invoke($task, ['query' => 'Jane Doe', 'types' => ['drivers', 'pets']], $context);
+    $tool->invoke($task, ['query' => 'order order_yhkejdnzgz'], $context);
+
+    expect($tool->searched[0])->toBe([['Jane Doe', 'Doe'], ['drivers']])
+        ->and($tool->searched[1])->toBe([['order order_yhkejdnzgz', 'order_yhkejdnzgz'], null])
+        ->and($tool->invoke($task, ['query' => ' x '], $context))->toBe(['error' => 'Provide an identifier or name to search for.'])
+        ->and($tool->toolName())->toBe('fleetops_search')
+        ->and($tool->key())->toBe('fleet-ops.search_resources')
+        ->and($tool->toolDescription())->toContain('particular record')
+        ->and($tool->toolParameters()['properties']['types']['items']['enum'])->toBe(SearchResourcesTool::TYPES)
+        ->and($tool->availableFor($context))->toBeTrue()
+        ->and($tool->availableFor(new AiToolContext($task, new AiAudience(false, []))))->toBeFalse();
+});
+
+test('search tool narrows the real search to the requested types', function () {
+    $tool = new class extends SearchResourcesTool {
+        public array $called = [];
+
+        protected function orders(array $terms): array
+        {
+            $this->called[] = 'orders';
+
+            return [['id' => 'order_1']];
+        }
+
+        protected function drivers(array $terms): array
+        {
+            $this->called[] = 'drivers';
+
+            return [];
+        }
+    };
+
+    $result = $tool->invoke(new AiTask(['prompt' => '']), ['query' => 'ORDER-1', 'types' => ['orders']], new AiToolContext(new AiTask(), new AiAudience(true)));
+
+    expect($tool->called)->toBe(['orders'])
+        ->and($result['results'])->toBe(['orders' => [['id' => 'order_1']]]);
+});
+
+class FleetOpsOptimizeOrderRouteToolProbe extends Fleetbase\FleetOps\Support\Ai\Tools\OptimizeOrderRouteTool
+{
+    public array $previewedPrompts = [];
+
+    public function preview(AiTask $task, array $input = []): array
+    {
+        $this->previewedPrompts[] = $task->prompt;
+
+        return [
+            'action'         => $this->key(),
+            'ready'          => true,
+            'message'        => 'Fleetbase AI prepared an optimized waypoint sequence. Review it before applying.',
+            'missing_fields' => [],
+            'fields'         => [['label' => 'Order', 'value' => 'order_abc']],
+        ];
+    }
+}
+
+test('optimize route tool proposes a reviewable preview for the order the model named', function () {
+    $tool    = new FleetOpsOptimizeOrderRouteToolProbe();
+    $task    = new AiTask(['prompt' => 'can you optimise the route please', 'metadata' => []]);
+    $context = new AiToolContext($task, new AiAudience(false, ['fleet-ops optimize order', 'fleet-ops update-route-for order']));
+
+    $result = $tool->invoke($task, ['order' => 'order_abc'], $context);
+
+    expect($result['preview_id'])->toBe('preview-1')
+        ->and($result['ready'])->toBeTrue()
+        ->and($result['status'])->toBe('proposal_shown_to_user')
+        ->and($result['fields'])->toBe([['label' => 'Order', 'value' => 'order_abc']])
+        ->and($result['missing_fields'])->toBe([])
+        // The capability finds the order in the prompt text, so the tool hands it the id the model gave.
+        ->and($tool->previewedPrompts)->toBe(['order_abc'])
+        ->and($task->prompt)->toBe('can you optimise the route please')
+        ->and($context->actionPreviews)->toHaveCount(1)
+        ->and($tool->toolName())->toBe('propose_optimize_order_route')
+        ->and($tool->key())->toBe('fleet-ops.optimize_order_route')
+        ->and($tool->toolDescription())->toContain('NOT changed by this tool')
+        ->and($tool->toolParameters()['required'])->toBe(['order'])
+        ->and($tool->availableFor($context))->toBeTrue()
+        ->and($tool->availableFor(new AiToolContext($task, new AiAudience(false, ['fleet-ops optimize order']))))->toBeFalse();
+});
+
+test('optimize route tool refuses to build a preview without an order', function () {
+    $tool    = new FleetOpsOptimizeOrderRouteToolProbe();
+    $task    = new AiTask(['prompt' => 'optimise a route', 'metadata' => []]);
+    $context = new AiToolContext($task, new AiAudience(false, ['fleet-ops optimize order', 'fleet-ops update-route-for order']));
+
+    expect($tool->invoke($task, ['order' => '   '], $context))->toBe([
+        'error'   => 'invalid_arguments',
+        'message' => 'An order id is required to optimize a route.',
+    ])
+        ->and($tool->invoke($task, [], $context)['error'])->toBe('invalid_arguments')
+        ->and($context->actionPreviews)->toBe([])
+        ->and($tool->previewedPrompts)->toBe([]);
+});
+
+class FleetOpsImportOrdersToolProbe extends Fleetbase\FleetOps\Support\Ai\Tools\ImportOrdersTool
+{
+    protected function can(string $permission): bool
+    {
+        return true;
+    }
+}
+
+test('import tool reports what an import needs and never claims to have imported anything', function () {
+    $tool    = new FleetOpsImportOrdersToolProbe();
+    $task    = new AiTask(['prompt' => 'can I import orders from a spreadsheet', 'metadata' => []]);
+    $context = new AiToolContext($task, new AiAudience(false, ['fleet-ops import order']));
+
+    $result = $tool->invoke($task, [], $context);
+
+    expect($result['accepted_sources'])->toBe(['xlsx', 'csv'])
+        ->and($result['minimum_columns'])->toContain('pickup address or pickup place')
+        ->and($result['can_import_here'])->toBeFalse()
+        ->and($result['message'])->toContain('will not process uploaded spreadsheets')
+        ->and($context->actionPreviews)->toBe([])
+        ->and($tool->toolName())->toBe('fleetops_import_requirements')
+        ->and($tool->key())->toBe('fleet-ops.import_orders_preview')
+        ->and($tool->toolDescription())->toContain('does NOT import anything')
+        ->and($tool->toolParameters()['properties'])->toBeInstanceOf(stdClass::class)
+        ->and(json_encode($tool->toolParameters()['properties']))->toBe('{}')
+        ->and($tool->availableFor($context))->toBeTrue()
+        ->and($tool->availableFor(new AiToolContext($task, new AiAudience(false, []))))->toBeFalse();
+});

package/server/tests/Unit/Support/AiCapabilityPermissionsTest.php

@@ -96,7 +96,7 @@ test('permission checks for non admin users delegate to the gate', function () {
         ->and(fn () => fleetopsAiPermissionsHelper('canAll')->invoke($capability, ['fleet-ops list order']))->toThrow(TypeError::class);
 });
 
-test('search terms extract identifiers and fall back to the raw prompt', function () {
+test('search terms extract identifiers and never fall back to the raw prompt', function () {
     fleetopsAiPermissionsBoot();
     $capability  = new OperationalQueryCapability();
     $searchTerms = fleetopsAiPermissionsHelper('searchTerms');
@@ -105,8 +105,8 @@ test('search terms extract identifiers and fall back to the raw prompt', functio
     expect($terms)->toContain('TRK-12345', 'atlas99')
         ->and($terms)->not->toContain('find', 'order');
 
-    // Stop-word-only prompts fall back to the trimmed prompt
-    expect($searchTerms->invoke($capability, 'find order'))->toBe(['find order']);
+    // Prompts without a record reference produce no search terms, so nothing is searched
+    expect($searchTerms->invoke($capability, 'find order'))->toBe([]);
 });
 
 test('where like any matches across columns and terms', function () {

package/server/tests/Unit/Support/Analytics/LiveFleetTest.php

@@ -38,6 +38,12 @@ function fleetopsLiveFleetUseInMemoryConnection(): SQLiteConnection
     $connection->statement('create table drivers (uuid varchar(64) primary key, public_id varchar(64) null, user_uuid varchar(64) null, company_uuid varchar(64) null, vehicle_uuid varchar(64) null, current_job_uuid varchar(64) null, avatar_url varchar(255) null, location blob null, heading numeric null, online integer null, last_location_update_at datetime null, deleted_at datetime null, created_at datetime null, updated_at datetime null)');
     $connection->statement('create table vehicles (uuid varchar(64) primary key, public_id varchar(64) null, company_uuid varchar(64) null, driver_uuid varchar(64) null, photo_uuid varchar(64) null, avatar_url varchar(255) null, name varchar(255) null, year integer null, make varchar(255) null, model varchar(255) null, trim varchar(255) null, plate_number varchar(64) null, location blob null, heading numeric null, online integer null, deleted_at datetime null, created_at datetime null, updated_at datetime null)');
     $connection->statement('create table orders (uuid varchar(64) primary key, public_id varchar(64) null, internal_id varchar(64) null, company_uuid varchar(64) null, driver_assigned_uuid varchar(64) null, status varchar(64) null, tracking_number_uuid varchar(64) null, deleted_at datetime null, created_at datetime null, updated_at datetime null)');
+    // Tables the markers' index-resource cards read: devices, coupled trailers and positions.
+    $connection->statement('create table devices (uuid varchar(64) primary key, public_id varchar(64) null, company_uuid varchar(64) null, attachable_uuid varchar(64) null, attachable_type varchar(255) null, name varchar(255) null, device_id varchar(64) null, serial_number varchar(64) null, imei varchar(64) null, provider varchar(64) null, status varchar(64) null, online integer null, deleted_at datetime null, created_at datetime null, updated_at datetime null)');
+    $connection->statement('create table asset_connections (uuid varchar(64) primary key, company_uuid varchar(64) null, connector_uuid varchar(64) null, connector_type varchar(255) null, connected_uuid varchar(64) null, connected_type varchar(255) null, connected_at datetime null, disconnected_at datetime null, deleted_at datetime null, created_at datetime null, updated_at datetime null)');
+    $connection->statement('create table assets (uuid varchar(64) primary key, public_id varchar(64) null, company_uuid varchar(64) null, asset_class varchar(64) null, name varchar(255) null, code varchar(64) null, type varchar(64) null, status varchar(64) null, plate_number varchar(64) null, online integer null, deleted_at datetime null, created_at datetime null, updated_at datetime null)');
+    $connection->statement('create table positions (uuid varchar(64) primary key, company_uuid varchar(64) null, subject_uuid varchar(64) null, subject_type varchar(255) null, order_uuid varchar(64) null, speed numeric null, heading numeric null, coordinates blob null, deleted_at datetime null, created_at datetime null, updated_at datetime null)');
+    $connection->statement('create table tracking_numbers (uuid varchar(64) primary key, public_id varchar(64) null, company_uuid varchar(64) null, owner_uuid varchar(64) null, owner_type varchar(255) null, status_uuid varchar(64) null, tracking_number varchar(64) null, region varchar(64) null, deleted_at datetime null, created_at datetime null, updated_at datetime null)');
     $connection->statement('create table files (uuid varchar(64) primary key, type varchar(64) null, url varchar(255) null, deleted_at datetime null, created_at datetime null, updated_at datetime null)');
 
     $resolver = new ConnectionResolver([

package/server/tests/Unit/Support/AuthorizationTest.php

@@ -0,0 +1,142 @@
+<?php
+
+use Fleetbase\FleetOps\Support\Authorization;
+use Fleetbase\FleetOps\Traits\AuthorizesMethods;
+use Fleetbase\Models\User;
+use Illuminate\Database\ConnectionResolver;
+use Illuminate\Database\Eloquent\Model;
+use Illuminate\Database\SQLiteConnection;
+use Illuminate\Http\Exceptions\HttpResponseException;
+use Illuminate\Http\Request;
+use Illuminate\Routing\Controller;
+
+if (!function_exists('Fleetbase\\Support\\auth')) {
+    eval('namespace Fleetbase\\Support; function auth() { return \\app("fleetops.authorization.test-auth"); }');
+}
+
+if (!function_exists('Fleetbase\\Support\\session')) {
+    eval('namespace Fleetbase\\Support; function session($key = null, $default = null) { return \\session($key, $default); }');
+}
+
+class FleetOpsAuthorizationUser extends User
+{
+    public array $grantedPermissions        = [];
+    public bool $permissionStoreUnavailable = false;
+
+    public function hasPermissionTo($permission, $guardName = null): bool
+    {
+        if ($this->permissionStoreUnavailable) {
+            throw new RuntimeException('Permission store unavailable');
+        }
+
+        return in_array($permission->name, $this->grantedPermissions, true);
+    }
+}
+
+beforeEach(function () {
+    $connection = new SQLiteConnection(new PDO('sqlite::memory:'));
+    $resolver   = new ConnectionResolver(['mysql' => $connection]);
+    $resolver->setDefaultConnection('mysql');
+    Model::setConnectionResolver($resolver);
+    config()->set('auth.defaults.guard', 'sanctum');
+    config()->set('permission.table_names.permissions', 'permissions');
+    $connection->getSchemaBuilder()->create('permissions', function ($table) {
+        $table->string('id')->primary();
+        $table->string('name');
+        $table->string('guard_name')->default('sanctum');
+    });
+    $connection->table('permissions')->insert([
+        ['id' => 'optimize', 'name' => 'fleet-ops optimize order'],
+        ['id' => 'dispatch', 'name' => 'fleet-ops dispatch order'],
+        ['id' => 'resource', 'name' => 'fleet-ops * order'],
+        ['id' => 'service', 'name' => 'fleet-ops *'],
+    ]);
+    session(['user' => null]);
+    $this->user = new FleetOpsAuthorizationUser();
+    $this->user->setRawAttributes(['type' => 'user'], true);
+    $this->auth = new class($this->user) {
+        public bool $unavailable = false;
+
+        public function __construct(public ?User $currentUser)
+        {
+        }
+
+        public function user(): ?User
+        {
+            if ($this->unavailable) {
+                throw new RuntimeException('Session unavailable');
+            }
+
+            return $this->currentUser;
+        }
+    };
+    app()->instance('fleetops.authorization.test-auth', $this->auth);
+});
+
+test('operation authorization accepts exact and wildcard grants', function (string $grant) {
+    $this->user->grantedPermissions = [$grant];
+
+    expect(Authorization::canAny('optimize order'))->toBeTrue();
+    Authorization::authorize('optimize order');
+})->with(['fleet-ops optimize order', 'fleet-ops * order', 'fleet-ops *']);
+
+test('operation authorization accepts any requested permission and rejects missing grants', function () {
+    $this->user->grantedPermissions = ['fleet-ops dispatch order'];
+
+    expect(Authorization::canAny('optimize order'))->toBeFalse()
+        ->and(Authorization::canAny('optimize order', 'dispatch order'))->toBeTrue()
+        ->and(Authorization::canAny('list unseeded-resource'))->toBeTrue();
+    expect(fn () => Authorization::authorize('optimize order'))->toThrow(HttpResponseException::class);
+
+    $this->user->permissionStoreUnavailable = true;
+    expect(Authorization::canAny('dispatch order'))->toBeFalse();
+});
+
+test('platform administrators pass operations while system settings reject ordinary users', function () {
+    expect(fn () => Authorization::authorizeAdmin())->toThrow(HttpResponseException::class);
+    $this->user->setAttribute('type', 'admin');
+    expect(Authorization::canAny('optimize order'))->toBeTrue();
+    Authorization::authorizeAdmin();
+});
+
+test('authorization fails closed when the authenticated user is missing or cannot be read', function () {
+    $this->auth->currentUser = null;
+    expect(Authorization::canAny('optimize order'))->toBeFalse();
+    expect(fn () => Authorization::authorizeAdmin())->toThrow(HttpResponseException::class);
+    $this->auth->unavailable = true;
+    expect(Authorization::canAny('optimize order'))->toBeFalse();
+});
+
+test('controller middleware applies the mapped operation and administrator checks', function () {
+    $controller = new class extends Controller {
+        use AuthorizesMethods;
+
+        public function __construct()
+        {
+            $this->authorizeMethods(['optimize' => ['optimize order', 'dispatch order'], 'settings' => 'admin']);
+        }
+    };
+    $middleware                     = $controller->getMiddleware();
+    $request                        = Request::create('/');
+    $this->user->grantedPermissions = ['fleet-ops dispatch order'];
+
+    expect($middleware[0]['options']['only'])->toBe(['optimize'])
+        ->and($middleware[0]['middleware']($request, fn ($nextRequest) => $nextRequest))->toBe($request);
+    expect(fn () => $middleware[1]['middleware']($request, fn () => 'allowed'))->toThrow(HttpResponseException::class);
+    $this->user->setAttribute('type', 'admin');
+    expect($middleware[1]['middleware']($request, fn () => 'allowed'))->toBe('allowed');
+});
+
+test('analytics controllers enforce authorization before invoking their next middleware', function (string $class) {
+    $connection = Model::getConnectionResolver()->connection();
+    $connection->table('permissions')->insert(['id' => 'analytics', 'name' => 'fleet-ops view analytics']);
+    $controller = new $class();
+    $middleware = $controller->getMiddleware()[0]['middleware'];
+    $request    = Request::create('/analytics');
+    expect(fn () => $middleware($request, fn () => 'private analytics'))->toThrow(HttpResponseException::class);
+    $this->user->grantedPermissions = ['fleet-ops view analytics'];
+    expect($middleware($request, fn ($forwarded) => $forwarded))->toBe($request);
+})->with([
+    Fleetbase\FleetOps\Http\Controllers\Internal\v1\AnalyticsController::class,
+    Fleetbase\FleetOps\Http\Controllers\Internal\v1\MetricsController::class,
+]);

package/server/tests/Unit/Support/MaintainableAndOperationalAlertsTest.php

@@ -184,10 +184,21 @@ test('operational alert helpers query orders positions and settings', function (
     $order = Order::where('uuid', 'order-1')->withoutGlobalScopes()->first();
     expect($probe->callHelper('latestPositionForOrder', $order))->toBeInstanceOf(Position::class);
 
-    $settings = $probe->callHelper('alertSettings');
+    $settings = $probe->callHelper('alertSettings', $order);
     expect($settings['late_departures']['enabled'])->toBeTrue()
         ->and($settings['route_deviations']['distance_threshold_meters'])->toBe(500)
         ->and($settings['prolonged_stoppages']['duration_threshold_minutes'])->toBe(30);
+
+    // Settings resolve from the order's company without a company session
+    $connection->table('settings')->insert([
+        'key'   => 'company.company-1.tracking',
+        'value' => json_encode(['alerts' => ['late_departures' => ['enabled' => false], 'route_deviations' => ['distance_threshold_meters' => 750]]]),
+    ]);
+    session(['company' => null]);
+    $settings = $probe->callHelper('alertSettings', $order);
+    session(['company' => 'company-1']);
+    expect($settings['late_departures']['enabled'])->toBeFalse()
+        ->and($settings['route_deviations']['distance_threshold_meters'])->toBe(750);
 });
 
 test('route point collection normalizes pairs and measures distances', function () {

package/server/tests/Unit/Support/MoreQuerySeamsTest.php

@@ -384,13 +384,22 @@ test('index driver resource counts assigned orders and names the current one', f
 });
 
 test('shift change listener reads company scheduling settings', function () {
-    fleetopsMoreSeamBoot();
+    $connection = fleetopsMoreSeamBoot();
 
     $class    = Fleetbase\FleetOps\Listeners\NotifyDriverOnShiftChange::class;
     $listener = (new ReflectionClass($class))->newInstanceWithoutConstructor();
 
     // With nothing stored the lookup falls back to the empty default
-    expect(fleetopsMoreSeamInvoke($listener, $class, 'getSchedulingSettings'))->toBe([]);
+    expect(fleetopsMoreSeamInvoke($listener, $class, 'getSchedulingSettings', ['company-seam-2']))->toBe([]);
+
+    // Queued listeners have no company session, so the schedule's company is used
+    $connection->table('settings')->insert(['key' => 'company.company-seam-3.fleet-ops.scheduling-settings', 'value' => json_encode(['notify_drivers_on_shift_change' => true])]);
+    session(['company' => null]);
+    $settings = fleetopsMoreSeamInvoke($listener, $class, 'getSchedulingSettings', ['company-seam-3']);
+    session(['company' => 'company-seam-2']);
+
+    expect($settings)->toBe(['notify_drivers_on_shift_change' => true])
+        ->and(fleetopsMoreSeamInvoke($listener, $class, 'getSchedulingSettings', [null]))->toBe([]);
 });
 
 test('order insights capability builds its own company-scoped order query', function () {