@fleetbase/fleetops-engine 0.6.69 → 0.6.70

package/server/src/Http/Controllers/Internal/v1/VehicleController.php

@@ -2,6 +2,7 @@
 
 namespace Fleetbase\FleetOps\Http\Controllers\Internal\v1;
 
+use Fleetbase\Attributes\SkipAuthorizationCheck;
 use Fleetbase\FleetOps\Exceptions\DeviceAlreadyAttachedException;
 use Fleetbase\FleetOps\Exports\VehicleExport;
 use Fleetbase\FleetOps\Http\Controllers\FleetOpsController;
@@ -25,6 +26,20 @@ use Maatwebsite\Excel\Facades\Excel;
 
 class VehicleController extends FleetOpsController
 {
+    /**
+     * Permissions for methods AuthorizationGuard cannot map to a schema action (see FleetOpsController).
+     *
+     * @var array<string, string|string[]>
+     */
+    protected array $methodPermissions = [
+        'unassignDriver'  => 'assign-driver-for vehicle',
+        'unassignOrders'  => 'update vehicle',
+        'attachDevice'    => 'update vehicle',
+        'detachDevice'    => 'update vehicle',
+        'attachEquipment' => 'update vehicle',
+        'detachEquipment' => 'update vehicle',
+    ];
+
     /**
      * The resource to query.
      *
@@ -111,6 +126,7 @@ class VehicleController extends FleetOpsController
         ]);
     }
 
+    #[SkipAuthorizationCheck]
     public function unassignDriver(string $id): JsonResponse
     {
         $vehicle = $this->findVehicle($id);
@@ -143,6 +159,7 @@ class VehicleController extends FleetOpsController
         ]);
     }
 
+    #[SkipAuthorizationCheck]
     public function unassignOrders(Request $request, string $id): JsonResponse
     {
         $request->validate([
@@ -179,6 +196,7 @@ class VehicleController extends FleetOpsController
         ]);
     }
 
+    #[SkipAuthorizationCheck]
     public function attachDevice(Request $request, string $id): JsonResponse
     {
         $request->validate(['device' => 'required|string']);
@@ -219,6 +237,7 @@ class VehicleController extends FleetOpsController
         ]);
     }
 
+    #[SkipAuthorizationCheck]
     public function detachDevice(Request $request, string $id): JsonResponse
     {
         $request->validate(['device' => 'required|string']);
@@ -265,6 +284,7 @@ class VehicleController extends FleetOpsController
      * Attach equipment to the vehicle. Equipment can only be equipped to one asset at a
      * time, so attaching moves it from any previous vehicle or trailer.
      */
+    #[SkipAuthorizationCheck]
     public function attachEquipment(Request $request, string $id): JsonResponse
     {
         $request->validate(['equipment' => 'required|string']);
@@ -292,6 +312,7 @@ class VehicleController extends FleetOpsController
         ]);
     }
 
+    #[SkipAuthorizationCheck]
     public function detachEquipment(Request $request, string $id): JsonResponse
     {
         $request->validate(['equipment' => 'required|string']);

package/server/src/Http/Controllers/Internal/v1/VendorController.php

@@ -2,6 +2,7 @@
 
 namespace Fleetbase\FleetOps\Http\Controllers\Internal\v1;
 
+use Fleetbase\Attributes\SkipAuthorizationCheck;
 use Fleetbase\FleetOps\Exports\VendorExport;
 use Fleetbase\FleetOps\Http\Controllers\FleetOpsController;
 use Fleetbase\FleetOps\Http\Resources\v1\Contact as ContactResource;
@@ -19,6 +20,18 @@ use Maatwebsite\Excel\Facades\Excel;
 
 class VendorController extends FleetOpsController
 {
+    /**
+     * Permissions for methods AuthorizationGuard cannot map to a schema action (see FleetOpsController).
+     *
+     * @var array<string, string|string[]>
+     */
+    protected array $methodPermissions = [
+        'assignDriver'          => 'update vendor',
+        'removeDriver'          => 'update vendor',
+        'addVendorPersonnel'    => 'update vendor',
+        'removeVendorPersonnel' => 'update vendor',
+    ];
+
     /**
      * The resource to query.
      *
@@ -128,6 +141,7 @@ class VendorController extends FleetOpsController
      *
      * @return \Illuminate\Http\Response
      */
+    #[SkipAuthorizationCheck]
     public function assignDriver(string $id, Request $request)
     {
         // Validate only param
@@ -160,6 +174,7 @@ class VendorController extends FleetOpsController
      *
      * @return \Illuminate\Http\Response
      */
+    #[SkipAuthorizationCheck]
     public function removeDriver(string $id, Request $request)
     {
         // Validate only param
@@ -197,6 +212,7 @@ class VendorController extends FleetOpsController
         return response()->json(['personnels' => $personnels->values()]);
     }
 
+    #[SkipAuthorizationCheck]
     public function addVendorPersonnel(Request $request, string $vendorId)
     {
         $vendor  = $this->findVendorByIdOrFail($vendorId);
@@ -220,6 +236,7 @@ class VendorController extends FleetOpsController
         ]);
     }
 
+    #[SkipAuthorizationCheck]
     public function removeVendorPersonnel(string $vendorId, string $contactId)
     {
         $vendor  = $this->findVendorByIdOrFail($vendorId);

package/server/src/Http/Controllers/Internal/v1/WorkOrderController.php

@@ -2,6 +2,7 @@
 
 namespace Fleetbase\FleetOps\Http\Controllers\Internal\v1;
 
+use Fleetbase\Attributes\SkipAuthorizationCheck;
 use Fleetbase\FleetOps\Exports\WorkOrderExport;
 use Fleetbase\FleetOps\Http\Controllers\FleetOpsController;
 use Fleetbase\FleetOps\Imports\WorkOrderImport;
@@ -16,6 +17,15 @@ use Maatwebsite\Excel\Facades\Excel;
 
 class WorkOrderController extends FleetOpsController
 {
+    /**
+     * Permissions for methods AuthorizationGuard cannot map to a schema action (see FleetOpsController).
+     *
+     * @var array<string, string|string[]>
+     */
+    protected array $methodPermissions = [
+        'sendEmail' => 'update work-order',
+    ];
+
     /**
      * The resource to query.
      *
@@ -80,6 +90,7 @@ class WorkOrderController extends FleetOpsController
      * Send a work order email to the assigned vendor.
      * POST /work-orders/{id}/send.
      */
+    #[SkipAuthorizationCheck]
     public function sendEmail(string $id): JsonResponse
     {
         $workOrder = $this->workOrderForEmail($id);

package/server/src/Jobs/DispatchTelematicsRetentionJobs.php

@@ -0,0 +1,70 @@
+<?php
+
+namespace Fleetbase\FleetOps\Jobs;
+
+use Fleetbase\FleetOps\Support\Telematics\Telemetry\Queue;
+use Illuminate\Bus\Queueable;
+use Illuminate\Contracts\Queue\ShouldBeUnique;
+use Illuminate\Contracts\Queue\ShouldQueue;
+use Illuminate\Foundation\Bus\Dispatchable;
+use Illuminate\Queue\InteractsWithQueue;
+use Illuminate\Support\Collection;
+use Illuminate\Support\Facades\DB;
+
+/**
+ * Fan out system-wide cleanup in small pages, without a session or membership scope.
+ * Each company has its own bounded prune job so one large backlog cannot prevent
+ * other organizations from being processed within a shared worker timeout.
+ */
+class DispatchTelematicsRetentionJobs implements ShouldQueue, ShouldBeUnique
+{
+    use Dispatchable;
+    use InteractsWithQueue;
+    use Queueable;
+
+    public const PAGE_SIZE = 100;
+
+    public int $uniqueFor = 900;
+    public int $tries     = 3;
+    public int $timeout   = 60;
+
+    public function __construct(public int $afterCompanyId = 0, public int $maxBatches = 200)
+    {
+        $this->onQueue(config('telematics.telemetry.ingestion_queue', 'default'));
+    }
+
+    public function uniqueId(): string
+    {
+        return 'after-company:' . $this->afterCompanyId;
+    }
+
+    public function handle(): void
+    {
+        $companies = $this->companies();
+        foreach ($companies as $company) {
+            $this->queueJob(new PruneTelematicsDataJob($company->uuid, $this->maxBatches));
+        }
+
+        if ($companies->count() === self::PAGE_SIZE) {
+            $this->queueJob(new self((int) $companies->last()->id, $this->maxBatches));
+
+            return;
+        }
+
+        $this->queueJob(new PruneTelematicsDataJob(null, $this->maxBatches, true));
+    }
+
+    protected function companies(): Collection
+    {
+        return DB::table('companies')
+            ->where('id', '>', $this->afterCompanyId)
+            ->orderBy('id')
+            ->limit(self::PAGE_SIZE)
+            ->get(['id', 'uuid']);
+    }
+
+    protected function queueJob(ShouldBeUnique $job): void
+    {
+        Queue::dispatch($job);
+    }
+}

package/server/src/Jobs/PruneTelematicsDataJob.php

@@ -0,0 +1,74 @@
+<?php
+
+namespace Fleetbase\FleetOps\Jobs;
+
+use Fleetbase\FleetOps\Console\Commands\PruneTelematicsData;
+use Illuminate\Bus\Queueable;
+use Illuminate\Contracts\Queue\ShouldBeUnique;
+use Illuminate\Contracts\Queue\ShouldQueue;
+use Illuminate\Foundation\Bus\Dispatchable;
+use Illuminate\Queue\InteractsWithQueue;
+use Symfony\Component\Console\Input\ArrayInput;
+use Symfony\Component\Console\Output\BufferedOutput;
+
+/**
+ * Runs a bounded telematics prune for one company or orphaned data.
+ *
+ * The command is executed directly rather than through the console kernel so a
+ * worker started before this package version can still run it.
+ */
+class PruneTelematicsDataJob implements ShouldQueue, ShouldBeUnique
+{
+    use Dispatchable;
+    use InteractsWithQueue;
+    use Queueable;
+
+    public int $uniqueFor      = 900;
+    public int $tries          = 1;
+    // Finish or fail before Laravel's baseline Redis retry_after of 90 seconds.
+    public int $timeout        = 80;
+    public bool $failOnTimeout = true;
+    public bool $orphansOnly   = false;
+
+    public function __construct(public ?string $companyUuid = null, public int $maxBatches = 200, bool $orphansOnly = false)
+    {
+        $this->orphansOnly = $orphansOnly;
+        $this->onQueue(config('telematics.telemetry.ingestion_queue', 'default'));
+    }
+
+    public function uniqueId(): string
+    {
+        return $this->orphansOnly ? 'orphans' : ($this->companyUuid ?? 'all');
+    }
+
+    /**
+     * @return array<string, mixed>
+     */
+    public function parameters(): array
+    {
+        $parameters = ['--no-lock' => true, '--max-batches' => $this->maxBatches];
+        if ($this->companyUuid) {
+            $parameters['--company'] = $this->companyUuid;
+        }
+        if ($this->orphansOnly) {
+            $parameters['--orphans-only'] = true;
+        }
+
+        return $parameters;
+    }
+
+    public function handle(): void
+    {
+        $command = $this->command();
+        $command->setLaravel(app());
+        $exitCode = $command->run(new ArrayInput($this->parameters()), new BufferedOutput());
+        if ($exitCode !== PruneTelematicsData::SUCCESS) {
+            throw new \RuntimeException('Telematics cleanup failed with exit code ' . $exitCode . '.');
+        }
+    }
+
+    protected function command(): PruneTelematicsData
+    {
+        return app(PruneTelematicsData::class);
+    }
+}

package/server/src/Listeners/NotifyDriverOnShiftChange.php

@@ -48,7 +48,7 @@ class NotifyDriverOnShiftChange implements ShouldQueue
         }
 
         // Check the company-level scheduling setting
-        $settings     = $this->getSchedulingSettings();
+        $settings     = $this->getSchedulingSettings($schedule->company_uuid);
         $shouldNotify = (bool) data_get($settings, 'notify_drivers_on_shift_change', false);
         if (!$shouldNotify) {
             return;
@@ -66,9 +66,9 @@ class NotifyDriverOnShiftChange implements ShouldQueue
         return $scheduleItem->schedule()->with('subject')->first();
     }
 
-    protected function getSchedulingSettings(): array
+    protected function getSchedulingSettings(?string $companyUuid): array
     {
-        return Setting::lookupFromCompany('fleet-ops.scheduling-settings', []);
+        return Setting::lookupForCompany($companyUuid, 'fleet-ops.scheduling-settings', []);
     }
 
     protected function isCreatedEvent(object $event): bool

package/server/src/Mail/CustomerCredentialsMail.php

@@ -72,7 +72,7 @@ class CustomerCredentialsMail extends Mailable
      */
     private function getCustomerPortalAccessUrl(): string
     {
-        $customerPortalConfig = Setting::lookupFromCompany('customer-portal-config');
+        $customerPortalConfig = Setting::lookupForCompany($this->customer->company_uuid, 'customer-portal-config');
         $accessUrlSlug        = data_get($customerPortalConfig, 'accessUrlSlug', 'customer-portal');
 
         return Utils::consoleUrl($accessUrlSlug ?: 'customer-portal');

package/server/src/Orchestration/Engines/VroomOrchestrationEngine.php

@@ -37,6 +37,12 @@ use Illuminate\Support\Facades\Log;
  */
 class VroomOrchestrationEngine implements OrchestrationEngineInterface
 {
+    /**
+     * The company whose VROOM settings apply to the current allocation run.
+     * Resolved from the orders so queued runs work without a company session.
+     */
+    protected ?string $companyUuid = null;
+
     public function getName(): string
     {
         return 'VROOM';
@@ -59,6 +65,8 @@ class VroomOrchestrationEngine implements OrchestrationEngineInterface
      */
     public function allocate(Collection $orders, Collection $vehicles, array $options = []): array
     {
+        $this->companyUuid = data_get($orders->first(), 'company_uuid');
+
         if (($options['allocation_strategy'] ?? null) === 'capacity_only') {
             return $this->allocateCapacityOnly($orders, $vehicles, $options);
         }
@@ -520,7 +528,7 @@ class VroomOrchestrationEngine implements OrchestrationEngineInterface
     protected function resolveVroomSetting(string $key, $default = null)
     {
         try {
-            $organizationValue = data_get(Setting::lookupCompany('vroom', []), $key);
+            $organizationValue = data_get(Setting::lookupForCompany($this->companyUuid ?? session('company'), 'vroom', []), $key);
             if ($this->hasConfiguredValue($organizationValue)) {
                 return $organizationValue;
             }

package/server/src/Providers/FleetOpsServiceProvider.php

@@ -77,6 +77,7 @@ class FleetOpsServiceProvider extends CoreServiceProvider
         \Fleetbase\FleetOps\Console\Commands\ProcessOperationalAlerts::class,
         \Fleetbase\FleetOps\Console\Commands\SyncTelematics::class,
         \Fleetbase\FleetOps\Console\Commands\DrainTelematicInbox::class,
+        \Fleetbase\FleetOps\Console\Commands\PruneTelematicsData::class,
     ];
 
     /**
@@ -153,6 +154,8 @@ class FleetOpsServiceProvider extends CoreServiceProvider
             // leave the default 24-hour overlap lease blocking telemetry recovery.
             $schedule->command('fleetops:sync-telematics')->everyMinute()->withoutOverlapping(2)->storeOutputInDb();
             $schedule->command('fleetops:drain-telematic-inbox')->everyMinute()->withoutOverlapping(2);
+            // Bounded batches per company and table; a capped run simply continues on the next tick.
+            $schedule->command('fleetops:prune-telematics-data')->everyFifteenMinutes()->withoutOverlapping(14)->storeOutputInDb();
         });
         $this->registerNotifications();
         $this->registerAiCapabilities();

package/server/src/Support/Analytics/LiveFleet.php

@@ -2,10 +2,13 @@
 
 namespace Fleetbase\FleetOps\Support\Analytics;
 
+use Fleetbase\FleetOps\Http\Resources\v1\Index\Driver as DriverIndexResource;
+use Fleetbase\FleetOps\Http\Resources\v1\Index\Vehicle as VehicleIndexResource;
 use Fleetbase\FleetOps\Models\Driver;
 use Fleetbase\FleetOps\Models\Order;
 use Fleetbase\FleetOps\Models\Vehicle;
 use Fleetbase\FleetOps\Support\Metrics\OrdersInProgressMetric;
+use Illuminate\Http\Resources\Json\JsonResource;
 
 /**
  * Real-time fleet snapshot used as the initial-state payload for Live Fleet Map.
@@ -23,7 +26,8 @@ class LiveFleet extends AbstractAnalytics
 
         // Driver.name is a virtual attribute backed by users.name — eager-load the
         // user so the accessor resolves cleanly without a per-record query.
-        $drivers = Driver::with(['user:uuid,name,avatar_uuid'])
+        // The user and vehicle also feed each marker's card (see card()).
+        $drivers = Driver::with(['user', 'vehicle'])
             ->where('drivers.company_uuid', $companyUuid)
             ->whereNotNull('drivers.location')
             ->where(function ($q) {
@@ -33,7 +37,8 @@ class LiveFleet extends AbstractAnalytics
 
         // Vehicles tracked independently of drivers (telematics-connected rigs may
         // report position without an active driver session).
-        $vehicles = Vehicle::where('company_uuid', $companyUuid)
+        $vehicles = Vehicle::with(['devices', 'driver', 'currentTrailers'])
+            ->where('company_uuid', $companyUuid)
             ->whereNotNull('location')
             ->get();
 
@@ -79,6 +84,7 @@ class LiveFleet extends AbstractAnalytics
             'lat'                => $lat,
             'lng'                => $lng,
             'updated_at'         => $d->last_location_update_at,
+            'card'               => $this->card(new DriverIndexResource($d)),
         ];
     }
 
@@ -98,9 +104,19 @@ class LiveFleet extends AbstractAnalytics
             'heading'      => (float) ($v->heading ?? 0),
             'lat'          => $lat,
             'lng'          => $lng,
+            'card'         => $this->card(new VehicleIndexResource($v)),
         ];
     }
 
+    /**
+     * What the operational live map shows in a marker's popup and tooltip: the same index
+     * resource its live endpoints return, so the dashboard widget renders identical cards.
+     */
+    private function card(JsonResource $resource): array
+    {
+        return $resource->resolve(request());
+    }
+
     /**
      * Pull [lat, lng] out of whatever shape the spatial accessor handed us.
      * Supports Point objects, [lat, lng] arrays, and {lat, lng} hashes.

package/server/src/Support/Authorization.php

@@ -0,0 +1,103 @@
+<?php
+
+namespace Fleetbase\FleetOps\Support;
+
+use Fleetbase\Models\Permission;
+use Fleetbase\Support\Auth;
+use Illuminate\Http\Exceptions\HttpResponseException;
+
+/**
+ * Explicit Fleet-Ops permission checks for endpoints that AuthorizationGuard
+ * cannot resolve correctly on its own: controllers that are not resource
+ * controllers, and custom actions whose method name does not match a schema
+ * action (for example `bulkDispatch`, which the guard maps to `create order`).
+ *
+ * Mirrors the guard's semantics:
+ *  - platform admins always pass;
+ *  - a permission is granted by its exact name, `fleet-ops * {resource}` or `fleet-ops *`;
+ *  - while the resource has no permission rows at all (the schema has not been
+ *    seeded yet) the check passes, exactly like an unguarded resource.
+ *
+ * Methods that call this must carry `#[SkipAuthorizationCheck]` so the guard
+ * does not also demand its own (wrong) permission.
+ */
+class Authorization
+{
+    public const SERVICE = 'fleet-ops';
+
+    /**
+     * Abort with a 401 JSON response unless the user holds at least one of the permissions.
+     *
+     * @param string ...$permissions Short form `{action} {resource}`, e.g. `dispatch order`
+     *
+     * @throws HttpResponseException
+     */
+    public static function authorize(string ...$permissions): void
+    {
+        if (static::canAny(...$permissions)) {
+            return;
+        }
+
+        throw new HttpResponseException(response()->json(['errors' => ['User is not authorized to ' . $permissions[0]]], 401));
+    }
+
+    /**
+     * Abort with a 401 JSON response unless the current user is a platform administrator.
+     *
+     * @throws HttpResponseException
+     */
+    public static function authorizeAdmin(): void
+    {
+        $user = static::user();
+        if ($user && $user->isAdmin()) {
+            return;
+        }
+
+        throw new HttpResponseException(response()->json(['errors' => ['This action requires a system administrator']], 401));
+    }
+
+    public static function canAny(string ...$permissions): bool
+    {
+        $user = static::user();
+        if (!$user) {
+            return false;
+        }
+
+        if ($user->isAdmin()) {
+            return true;
+        }
+
+        foreach ($permissions as $permission) {
+            if (static::can($permission)) {
+                return true;
+            }
+        }
+
+        return false;
+    }
+
+    public static function can(string $permission): bool
+    {
+        [$action, $resource] = explode(' ', $permission, 2);
+
+        // Same test as Auth::isResourceGuarded(): no permission rows for the resource yet.
+        if (!Permission::where('name', 'like', static::SERVICE . ' % ' . $resource)->exists()) {
+            return true;
+        }
+
+        try {
+            return Auth::can(static::SERVICE . " {$action} {$resource}");
+        } catch (\Throwable $e) {
+            return false;
+        }
+    }
+
+    protected static function user()
+    {
+        try {
+            return Auth::getUserFromSession();
+        } catch (\Throwable $e) {
+            return null;
+        }
+    }
+}

package/server/src/Support/Database/TableIndexes.php

@@ -0,0 +1,66 @@
+<?php
+
+namespace Fleetbase\FleetOps\Support\Database;
+
+use Illuminate\Support\Facades\Schema;
+
+/**
+ * Inspect table indexes without Schema::getIndexes, which is absent in the
+ * Laravel versions this package supports. Fleet-Ops deploys on MySQL and runs
+ * its migration tests on SQLite.
+ */
+final class TableIndexes
+{
+    /**
+     * @return array<string, string[]> index name => ordered column names
+     */
+    public static function for(string $table): array
+    {
+        $connection = Schema::getConnection();
+        $prefixed   = $connection->getTablePrefix() . $table;
+        $indexes    = [];
+
+        if ($connection instanceof \Illuminate\Database\SQLiteConnection || $connection->getDriverName() === 'sqlite') {
+            $quoted = str_replace('"', '""', $prefixed);
+            foreach ($connection->select('PRAGMA index_list("' . $quoted . '")') as $index) {
+                $name    = str_replace('"', '""', $index->name);
+                $columns = $connection->select('PRAGMA index_info("' . $name . '")');
+                usort($columns, fn ($a, $b) => $a->seqno <=> $b->seqno);
+                $indexes[$index->name] = array_column($columns, 'name');
+            }
+
+            return $indexes;
+        }
+
+        // @codeCoverageIgnoreStart
+        if ($connection->getDriverName() !== 'mysql') {
+            throw new \RuntimeException('Index inspection requires MySQL or SQLite.');
+        }
+
+        $quoted = str_replace('`', '``', $prefixed);
+        foreach ($connection->select('SHOW INDEX FROM `' . $quoted . '`') as $index) {
+            $indexes[$index->Key_name][(int) $index->Seq_in_index - 1] = $index->Column_name;
+        }
+        foreach ($indexes as &$columns) {
+            ksort($columns);
+            $columns = array_values($columns);
+        }
+
+        return $indexes;
+        // @codeCoverageIgnoreEnd
+    }
+
+    /**
+     * Whether any index already leads with exactly these columns, in order.
+     */
+    public static function covers(string $table, array $columns): bool
+    {
+        foreach (self::for($table) as $indexed) {
+            if (array_slice($indexed, 0, count($columns)) === $columns) {
+                return true;
+            }
+        }
+
+        return false;
+    }
+}

package/server/src/Support/OrderTracker.php

@@ -14,11 +14,11 @@ class OrderTracker
 
     public function eta(array $options = []): array
     {
-        return app(TrackingIntelligenceService::class)->eta($this->order, TrackingOptions::fromArray($options));
+        return app(TrackingIntelligenceService::class)->eta($this->order, TrackingOptions::fromArray($options, $this->order->company_uuid));
     }
 
     public function toArray(array $options = []): array
     {
-        return app(TrackingIntelligenceService::class)->track($this->order, TrackingOptions::fromArray($options));
+        return app(TrackingIntelligenceService::class)->track($this->order, TrackingOptions::fromArray($options, $this->order->company_uuid));
     }
 }