@fleetbase/fleetops-engine 0.6.69 → 0.6.70

package/server/src/Console/Commands/PruneTelematicsData.php

@@ -0,0 +1,318 @@
+<?php
+
+namespace Fleetbase\FleetOps\Console\Commands;
+
+use Fleetbase\FleetOps\Support\Telematics\Retention\RetentionPolicy;
+use Illuminate\Console\Command;
+use Illuminate\Support\Collection;
+use Illuminate\Support\Facades\Cache;
+use Illuminate\Support\Facades\DB;
+
+/**
+ * Applies each company's telematics retention policy.
+ *
+ * Deletes are hard deletes issued in bounded batches so a large backlog never
+ * monopolizes the tables ingestion is writing to; a capped run picks up where
+ * it left off on the next schedule tick.
+ */
+class PruneTelematicsData extends Command
+{
+    public const TABLES = ['device_events', 'positions', 'telematic_deliveries', 'telematic_sync_runs'];
+
+    public const LOCK = 'fleetops:prune-telematics-data';
+
+    protected $signature = 'fleetops:prune-telematics-data
+        {--company= : Only prune data for this company (uuid or public id)}
+        {--orphans-only : Only prune data without an existing company or connection}
+        {--table=* : Only prune these tables (device_events, positions, telematic_deliveries, telematic_sync_runs)}
+        {--batch-size=1000 : Rows per delete or update statement}
+        {--max-batches=50 : Maximum batches per table per company per run}
+        {--dry-run : Report matching rows without deleting or compacting}
+        {--no-lock : Skip process locking}';
+
+    protected $description = 'Prune telematics device events, positions, deliveries and sync runs according to each company\'s retention policy.';
+
+    protected int $batchSize  = 1000;
+    protected int $maxBatches = 50;
+    protected bool $dryRun    = false;
+
+    public function handle(): int
+    {
+        $tables = $this->requestedTables();
+        if ($tables === null) {
+            $this->error('Unknown table. Valid tables: ' . implode(', ', self::TABLES) . '.');
+
+            return self::FAILURE;
+        }
+
+        $lock = null;
+        if (!$this->option('no-lock')) {
+            $lock = Cache::lock(self::LOCK, 840);
+            if (!$lock->get()) {
+                $this->warn('Another telematics prune run appears to be in progress.');
+
+                return self::SUCCESS;
+            }
+        }
+
+        try {
+            // Queue workers may have cached settings before an administrator saved a new policy.
+            RetentionPolicy::flush();
+            $this->batchSize  = max(100, min(5000, (int) $this->option('batch-size') ?: 1000));
+            $this->maxBatches = max(1, (int) $this->option('max-batches') ?: 50);
+            $this->dryRun     = (bool) $this->option('dry-run');
+
+            $only        = ((string) $this->option('company')) ?: null;
+            $orphansOnly = (bool) $this->option('orphans-only');
+            if ($only && $orphansOnly) {
+                $this->error('Choose either --company or --orphans-only.');
+
+                return self::FAILURE;
+            }
+            $companies = $orphansOnly ? new Collection() : $this->companies($only);
+            if ($only && $companies->isEmpty()) {
+                $this->error(sprintf('Company [%s] was not found.', $only));
+
+                return self::FAILURE;
+            }
+
+            $totals = $this->emptyStats();
+            foreach ($companies as $company) {
+                $stats  = $this->pruneCompany($company->uuid, $this->policyFor($company->uuid), $tables);
+                $totals = $this->mergeStats($totals, $stats);
+                $this->report($company->public_id ?: $company->uuid, $stats);
+            }
+            if (!$only) {
+                $stats  = $this->pruneOrphans($this->policyFor(null), $tables);
+                $totals = $this->mergeStats($totals, $stats);
+                $this->report('orphaned', $stats);
+            }
+
+            $this->info(sprintf(
+                '%s: deleted=%d compacted=%d batches=%d%s',
+                $this->dryRun ? 'Telematics prune dry run' : 'Telematics prune complete',
+                $totals['deleted'],
+                $totals['compacted'],
+                $totals['batches'],
+                $totals['capped'] ? ' (capped; more rows remain for the next run)' : ''
+            ));
+
+            return self::SUCCESS;
+        } finally {
+            $lock?->release();
+        }
+    }
+
+    /**
+     * @return string[]|null null when an unknown table was requested
+     */
+    protected function requestedTables(): ?array
+    {
+        $requested = array_values(array_filter((array) $this->option('table')));
+        if ($requested === []) {
+            return self::TABLES;
+        }
+
+        return array_diff($requested, self::TABLES) === [] ? array_values(array_unique($requested)) : null;
+    }
+
+    protected function companies(?string $only): Collection
+    {
+        $query = DB::table('companies')->select(['id', 'uuid', 'public_id'])->orderBy('id');
+        if ($only) {
+            $query->where(fn ($where) => $where->where('uuid', $only)->orWhere('public_id', $only));
+        }
+
+        return $query->get();
+    }
+
+    protected function policyFor(?string $companyUuid): RetentionPolicy
+    {
+        return RetentionPolicy::forCompany($companyUuid);
+    }
+
+    protected function pruneCompany(string $companyUuid, RetentionPolicy $policy, array $tables): array
+    {
+        $rows = fn ($query) => $query->where('company_uuid', $companyUuid);
+
+        $telematics = null;
+        if (array_intersect(['telematic_deliveries', 'telematic_sync_runs'], $tables) !== []) {
+            // Inbox tables carry no company; trashed connections still prune under their company's policy.
+            $telematics = DB::table('telematics')->where('company_uuid', $companyUuid)->pluck('uuid')->all();
+        }
+        $inbox = $telematics ? fn ($query) => $query->whereIn('telematic_uuid', $telematics) : null;
+
+        return $this->prune($rows, $inbox, $policy, $tables);
+    }
+
+    /**
+     * Rows whose company or connection no longer exists fall back to the system defaults.
+     */
+    protected function pruneOrphans(RetentionPolicy $policy, array $tables): array
+    {
+        $rows = fn ($query) => $query->where(function ($where) {
+            $where->whereNull('company_uuid')->orWhereNotIn('company_uuid', DB::table('companies')->select('uuid'));
+        });
+        $inbox = fn ($query) => $query->whereNotExists(function ($connections) use ($query) {
+            $connections->selectRaw('1')
+                ->from('telematics')
+                ->join('companies', 'companies.uuid', '=', 'telematics.company_uuid')
+                ->whereColumn('telematics.uuid', $query->from . '.telematic_uuid');
+        });
+
+        return $this->prune($rows, $inbox, $policy, $tables);
+    }
+
+    protected function prune(\Closure $rows, ?\Closure $inbox, RetentionPolicy $policy, array $tables): array
+    {
+        $stats = $this->emptyStats();
+        if (in_array('device_events', $tables, true)) {
+            $stats['tables']['device_events'] = $this->pruneDeviceEvents($rows, $policy);
+        }
+        if (in_array('positions', $tables, true)) {
+            $stats['tables']['positions'] = $this->prunePositions($rows, $policy);
+        }
+        if ($inbox && in_array('telematic_deliveries', $tables, true)) {
+            $stats['tables']['telematic_deliveries'] = $this->pruneDeliveries($inbox, $policy);
+        }
+        if ($inbox && in_array('telematic_sync_runs', $tables, true)) {
+            $stats['tables']['telematic_sync_runs'] = $this->pruneSyncRuns($inbox, $policy);
+        }
+        foreach ($stats['tables'] as $table) {
+            $stats['deleted'] += $table['deleted'];
+            $stats['compacted'] += $table['compacted'];
+            $stats['batches'] += $table['batches'];
+            $stats['capped']     = $stats['capped'] || $table['capped'];
+        }
+
+        return $stats;
+    }
+
+    protected function pruneDeviceEvents(\Closure $rows, RetentionPolicy $policy): array
+    {
+        $stats  = $this->emptyTableStats();
+        $cutoff = $policy->cutoff('event_retention_days');
+        // Soft-deleted events only grow the table; purge them regardless of age.
+        $this->deleteInBatches('device_events', 'id', fn ($query) => $rows($query)->whereNotNull('deleted_at'), $stats);
+        if ($cutoff) {
+            $this->deleteInBatches('device_events', 'id', fn ($query) => $rows($query)->where('created_at', '<', $cutoff->toDateTimeString()), $stats);
+        }
+        if ($policy->compactsEvents() && ($compactAt = $policy->cutoff('event_compact_after_days'))) {
+            // Keep the event (type, severity, location, normalized data) but drop the raw provider blobs.
+            // Rows past the delete cutoff are left to the delete sweep rather than rewritten first.
+            $this->updateInBatches(
+                'device_events',
+                'id',
+                function ($query) use ($rows, $cutoff, $compactAt) {
+                    $query = $rows($query)->where('created_at', '<', $compactAt->toDateTimeString())->where(fn ($where) => $where->whereNotNull('payload')->orWhereNotNull('meta'));
+
+                    return $cutoff ? $query->where('created_at', '>=', $cutoff->toDateTimeString()) : $query;
+                },
+                ['payload' => null, 'meta' => null],
+                $stats
+            );
+        }
+
+        return $stats;
+    }
+
+    protected function prunePositions(\Closure $rows, RetentionPolicy $policy): array
+    {
+        $stats = $this->emptyTableStats();
+        $this->deleteInBatches('positions', 'id', fn ($query) => $rows($query)->whereNotNull('deleted_at'), $stats);
+        if ($cutoff = $policy->cutoff('position_retention_days')) {
+            $this->deleteInBatches('positions', 'id', fn ($query) => $rows($query)->where('created_at', '<', $cutoff->toDateTimeString()), $stats);
+        }
+
+        return $stats;
+    }
+
+    protected function pruneDeliveries(\Closure $inbox, RetentionPolicy $policy): array
+    {
+        $stats = $this->emptyTableStats();
+        foreach (['processed' => 'processed_retention_hours', 'quarantined' => 'quarantine_retention_days'] as $status => $key) {
+            if ($cutoff = $policy->cutoff($key)) {
+                $this->deleteInBatches('telematic_deliveries', 'uuid', fn ($query) => $inbox($query)->where('status', $status)->where('updated_at', '<', $cutoff->toDateTimeString()), $stats);
+            }
+        }
+
+        return $stats;
+    }
+
+    protected function pruneSyncRuns(\Closure $inbox, RetentionPolicy $policy): array
+    {
+        $stats = $this->emptyTableStats();
+        if ($cutoff = $policy->cutoff('sync_run_retention_days')) {
+            // In-flight runs are recovered by the drain command, never expired here.
+            $this->deleteInBatches('telematic_sync_runs', 'uuid', fn ($query) => $inbox($query)->whereNotIn('status', ['fetching', 'ingesting'])->where('updated_at', '<', $cutoff->toDateTimeString()), $stats);
+        }
+
+        return $stats;
+    }
+
+    protected function deleteInBatches(string $table, string $key, \Closure $scope, array &$stats): void
+    {
+        if ($this->dryRun) {
+            $stats['deleted'] += $scope(DB::table($table))->count();
+
+            return;
+        }
+        for ($batch = 0; $batch < $this->maxBatches; $batch++) {
+            $ids = $scope(DB::table($table))->orderBy($key)->limit($this->batchSize)->pluck($key);
+            if ($ids->isEmpty()) {
+                return;
+            }
+            $stats['batches']++;
+            $stats['deleted'] += DB::table($table)->whereIn($key, $ids->all())->delete();
+        }
+        $stats['capped'] = true;
+    }
+
+    protected function updateInBatches(string $table, string $key, \Closure $scope, array $values, array &$stats): void
+    {
+        if ($this->dryRun) {
+            $stats['compacted'] += $scope(DB::table($table))->count();
+
+            return;
+        }
+        for ($batch = 0; $batch < $this->maxBatches; $batch++) {
+            $ids = $scope(DB::table($table))->orderBy($key)->limit($this->batchSize)->pluck($key);
+            if ($ids->isEmpty()) {
+                return;
+            }
+            $stats['batches']++;
+            $stats['compacted'] += DB::table($table)->whereIn($key, $ids->all())->update($values);
+        }
+        $stats['capped'] = true;
+    }
+
+    protected function report(string $label, array $stats): void
+    {
+        foreach ($stats['tables'] as $table => $counts) {
+            if (!$counts['deleted'] && !$counts['compacted'] && !$counts['capped']) {
+                continue;
+            }
+            $this->info(sprintf('%s %s: deleted=%d compacted=%d batches=%d%s', $label, $table, $counts['deleted'], $counts['compacted'], $counts['batches'], $counts['capped'] ? ' capped' : ''));
+        }
+    }
+
+    protected function emptyTableStats(): array
+    {
+        return ['deleted' => 0, 'compacted' => 0, 'batches' => 0, 'capped' => false];
+    }
+
+    protected function emptyStats(): array
+    {
+        return ['deleted' => 0, 'compacted' => 0, 'batches' => 0, 'capped' => false, 'tables' => []];
+    }
+
+    protected function mergeStats(array $totals, array $stats): array
+    {
+        $totals['deleted'] += $stats['deleted'];
+        $totals['compacted'] += $stats['compacted'];
+        $totals['batches'] += $stats['batches'];
+        $totals['capped']     = $totals['capped'] || $stats['capped'];
+
+        return $totals;
+    }
+}

package/server/src/Http/Controllers/Api/v1/OrchestrationController.php

@@ -3,6 +3,7 @@
 namespace Fleetbase\FleetOps\Http\Controllers\Api\v1;
 
 use Fleetbase\FleetOps\Http\Controllers\Internal\v1\OrchestrationController as InternalOrchestrationController;
+use Fleetbase\FleetOps\Orchestration\OrchestrationEngineRegistry;
 use Illuminate\Http\JsonResponse;
 use Illuminate\Http\Request;
 
@@ -14,6 +15,14 @@ use Illuminate\Http\Request;
  */
 class OrchestrationController extends InternalOrchestrationController
 {
+    public function __construct(OrchestrationEngineRegistry $registry)
+    {
+        // The fleetbase.api route group authenticates API credentials and establishes
+        // their company scope. Console IAM middleware belongs to the internal
+        // workbench, not to these organization-credential endpoints.
+        $this->registry = $registry;
+    }
+
     public function run(Request $request): JsonResponse
     {
         return $this->publicResponse(parent::run($request));

package/server/src/Http/Controllers/FleetOpsController.php

@@ -2,12 +2,33 @@
 
 namespace Fleetbase\FleetOps\Http\Controllers;
 
+use Fleetbase\FleetOps\Traits\AuthorizesMethods;
 use Fleetbase\Http\Controllers\FleetbaseController;
+use Illuminate\Database\Eloquent\Model;
 
 class FleetOpsController extends FleetbaseController
 {
+    use AuthorizesMethods;
+
     /**
      * The package namespace used to resolve from.
      */
     public string $namespace = '\\Fleetbase\\FleetOps';
+
+    /**
+     * Explicit permissions for custom actions, keyed by controller method, e.g.
+     * `['bulkDispatch' => 'dispatch order']`. Those methods also carry
+     * `#[SkipAuthorizationCheck]` so AuthorizationGuard does not demand the
+     * permission it would otherwise infer from the HTTP verb.
+     *
+     * @var array<string, string|string[]>
+     */
+    protected array $methodPermissions = [];
+
+    public function __construct(?Model $model = null, ?string $resource = null)
+    {
+        parent::__construct($model, $resource);
+
+        $this->authorizeMethods($this->methodPermissions);
+    }
 }

package/server/src/Http/Controllers/Internal/v1/AnalyticsController.php

@@ -14,6 +14,7 @@ use Fleetbase\FleetOps\Support\Analytics\OperationsPulse;
 use Fleetbase\FleetOps\Support\Analytics\OrdersByStatus;
 use Fleetbase\FleetOps\Support\Analytics\RevenueTrend;
 use Fleetbase\FleetOps\Support\Analytics\TopDrivers;
+use Fleetbase\FleetOps\Support\Authorization;
 use Fleetbase\Http\Controllers\Controller;
 use Illuminate\Http\Request;
 
@@ -28,6 +29,16 @@ use Illuminate\Http\Request;
  */
 class AnalyticsController extends Controller
 {
+    public function __construct()
+    {
+        // Not a resource controller, so AuthorizationGuard cannot resolve a permission for it.
+        $this->middleware(function ($request, $next) {
+            Authorization::authorize('view analytics');
+
+            return $next($request);
+        });
+    }
+
     public function operationsPulse(Request $request)
     {
         return $this->run($request, OperationsPulse::class);

package/server/src/Http/Controllers/Internal/v1/ContactController.php

@@ -2,6 +2,7 @@
 
 namespace Fleetbase\FleetOps\Http\Controllers\Internal\v1;
 
+use Fleetbase\Attributes\SkipAuthorizationCheck;
 use Fleetbase\FleetOps\Exports\ContactExport;
 use Fleetbase\FleetOps\Http\Controllers\FleetOpsController;
 use Fleetbase\FleetOps\Http\Resources\v1\Vendor as VendorResource;
@@ -26,6 +27,15 @@ use Maatwebsite\Excel\Facades\Excel;
 
 class ContactController extends FleetOpsController
 {
+    /**
+     * Permissions for methods AuthorizationGuard cannot map to a schema action (see FleetOpsController).
+     *
+     * @var array<string, string|string[]>
+     */
+    protected array $methodPermissions = [
+        'convertToVendor' => 'create vendor',
+    ];
+
     /**
      * The resource to query.
      *
@@ -108,6 +118,7 @@ class ContactController extends FleetOpsController
         ]);
     }
 
+    #[SkipAuthorizationCheck]
     public function convertToVendor(Request $request, string $id)
     {
         $contact = $this->contactForVendorConversion($id);

package/server/src/Http/Controllers/Internal/v1/CustomerController.php

@@ -5,6 +5,7 @@ namespace Fleetbase\FleetOps\Http\Controllers\Internal\v1;
 use Fleetbase\FleetOps\Mail\CustomerCredentialsMail;
 use Fleetbase\FleetOps\Models\Contact;
 use Fleetbase\FleetOps\Support\ProfileAccountManager;
+use Fleetbase\FleetOps\Traits\AuthorizesMethods;
 use Fleetbase\Http\Controllers\Controller;
 use Fleetbase\Models\User;
 use Illuminate\Http\Request;
@@ -13,6 +14,19 @@ use Illuminate\Support\Str;
 
 class CustomerController extends Controller
 {
+    use AuthorizesMethods;
+
+    public function __construct()
+    {
+        $this->authorizeMethods([
+            'createPortalLogin'     => 'reset-credentials-for customer',
+            'sendCredentials'       => 'reset-credentials-for customer',
+            'deactivatePortalLogin' => 'reset-credentials-for customer',
+            'reactivatePortalLogin' => 'reset-credentials-for customer',
+            'resetCredentials'      => 'reset-credentials-for customer',
+        ]);
+    }
+
     public function createPortalLogin(Request $request)
     {
         $customer = $this->resolveCustomer($request);

package/server/src/Http/Controllers/Internal/v1/DeviceController.php

@@ -2,6 +2,7 @@
 
 namespace Fleetbase\FleetOps\Http\Controllers\Internal\v1;
 
+use Fleetbase\Attributes\SkipAuthorizationCheck;
 use Fleetbase\FleetOps\Exceptions\DeviceAlreadyAttachedException;
 use Fleetbase\FleetOps\Exports\DeviceExport;
 use Fleetbase\FleetOps\Http\Controllers\FleetOpsController;
@@ -17,6 +18,16 @@ use Maatwebsite\Excel\Facades\Excel;
 
 class DeviceController extends FleetOpsController
 {
+    /**
+     * Permissions for methods AuthorizationGuard cannot map to a schema action (see FleetOpsController).
+     *
+     * @var array<string, string|string[]>
+     */
+    protected array $methodPermissions = [
+        'attach' => 'update device',
+        'detach' => 'update device',
+    ];
+
     /**
      * The resource to query.
      *
@@ -110,6 +121,7 @@ class DeviceController extends FleetOpsController
     /**
      * Attach a device to a supported FleetOps resource.
      */
+    #[SkipAuthorizationCheck]
     public function attach(Request $request, string $id): JsonResponse
     {
         $request->validate([
@@ -152,6 +164,7 @@ class DeviceController extends FleetOpsController
     /**
      * Detach a device from its current FleetOps resource.
      */
+    #[SkipAuthorizationCheck]
     public function detach(string $id): JsonResponse
     {
         $device = $this->resolveDevice($id);

package/server/src/Http/Controllers/Internal/v1/DeviceEventController.php

@@ -2,6 +2,7 @@
 
 namespace Fleetbase\FleetOps\Http\Controllers\Internal\v1;
 
+use Fleetbase\Attributes\SkipAuthorizationCheck;
 use Fleetbase\FleetOps\Http\Controllers\FleetOpsController;
 use Fleetbase\FleetOps\Models\DeviceEvent;
 use Fleetbase\FleetOps\Support\Utils;
@@ -9,6 +10,15 @@ use Illuminate\Http\JsonResponse;
 
 class DeviceEventController extends FleetOpsController
 {
+    /**
+     * Permissions for methods AuthorizationGuard cannot map to a schema action (see FleetOpsController).
+     *
+     * @var array<string, string|string[]>
+     */
+    protected array $methodPermissions = [
+        'markProcessed' => 'update device-event',
+    ];
+
     /**
      * The resource to query.
      *
@@ -51,6 +61,7 @@ class DeviceEventController extends FleetOpsController
         }
     }
 
+    #[SkipAuthorizationCheck]
     public function markProcessed(string $id): JsonResponse
     {
         $deviceEvent = DeviceEvent::where('company_uuid', session('company'))

package/server/src/Http/Controllers/Internal/v1/DriverController.php

@@ -2,6 +2,7 @@
 
 namespace Fleetbase\FleetOps\Http\Controllers\Internal\v1;
 
+use Fleetbase\Attributes\SkipAuthorizationCheck;
 use Fleetbase\Exceptions\FleetbaseRequestValidationException;
 use Fleetbase\FleetOps\Exceptions\ProfileIdentityConflictException;
 use Fleetbase\FleetOps\Exports\DriverExport;
@@ -33,6 +34,20 @@ use Maatwebsite\Excel\Facades\Excel;
 class DriverController extends FleetOpsController
 {
     use Traits\DriverSchedulingTrait;
+    /**
+     * Permissions for methods AuthorizationGuard cannot map to a schema action (see FleetOpsController).
+     *
+     * @var array<string, string|string[]>
+     */
+    protected array $methodPermissions = [
+        'sendCredentials'  => 'update-user-for driver',
+        'resetCredentials' => 'update-user-for driver',
+        'deactivateLogin'  => 'update-user-for driver',
+        'reactivateLogin'  => 'update-user-for driver',
+        'unassignOrders'   => 'assign-order-for driver',
+        'unassignOrder'    => 'assign-order-for driver',
+        'unassignVehicle'  => 'assign-vehicle-for driver',
+    ];
     /**
      * The resource to query.
      *
@@ -200,6 +215,7 @@ class DriverController extends FleetOpsController
      *
      * @return JsonResponse
      */
+    #[SkipAuthorizationCheck]
     public function sendCredentials(string $id)
     {
         [$driver, $user, $error] = $this->resolveDriverLogin($id);
@@ -221,6 +237,7 @@ class DriverController extends FleetOpsController
      *
      * @return JsonResponse
      */
+    #[SkipAuthorizationCheck]
     public function resetCredentials(Request $request, string $id)
     {
         $password = $request->input('password');
@@ -255,6 +272,7 @@ class DriverController extends FleetOpsController
      *
      * @return JsonResponse
      */
+    #[SkipAuthorizationCheck]
     public function deactivateLogin(string $id)
     {
         [$driver, $user, $error] = $this->resolveDriverLogin($id);
@@ -275,6 +293,7 @@ class DriverController extends FleetOpsController
      *
      * @return JsonResponse
      */
+    #[SkipAuthorizationCheck]
     public function reactivateLogin(string $id)
     {
         [$driver, $user, $error] = $this->resolveDriverLogin($id);
@@ -430,6 +449,7 @@ class DriverController extends FleetOpsController
         ]);
     }
 
+    #[SkipAuthorizationCheck]
     public function unassignOrders(Request $request, string $id): JsonResponse
     {
         $request->validate([
@@ -462,6 +482,7 @@ class DriverController extends FleetOpsController
         ]);
     }
 
+    #[SkipAuthorizationCheck]
     public function unassignOrder(string $id): JsonResponse
     {
         $driver = $this->findDriver($id);
@@ -498,6 +519,7 @@ class DriverController extends FleetOpsController
         ]);
     }
 
+    #[SkipAuthorizationCheck]
     public function unassignVehicle(string $id): JsonResponse
     {
         $driver  = $this->findDriver($id);

package/server/src/Http/Controllers/Internal/v1/FuelProviderConnectionController.php

@@ -2,6 +2,7 @@
 
 namespace Fleetbase\FleetOps\Http\Controllers\Internal\v1;
 
+use Fleetbase\Attributes\SkipAuthorizationCheck;
 use Fleetbase\FleetOps\Http\Controllers\FleetOpsController;
 use Fleetbase\FleetOps\Jobs\SyncFuelProviderTransactionsJob;
 use Fleetbase\FleetOps\Models\FuelProviderConnection;
@@ -13,6 +14,16 @@ use Illuminate\Validation\ValidationException;
 
 class FuelProviderConnectionController extends FleetOpsController
 {
+    /**
+     * Permissions for methods AuthorizationGuard cannot map to a schema action (see FleetOpsController).
+     *
+     * @var array<string, string|string[]>
+     */
+    protected array $methodPermissions = [
+        'testCredentials' => 'create fuel-provider-connection',
+        'testConnection'  => 'update fuel-provider-connection',
+    ];
+
     public $resource = 'fuel_provider_connection';
 
     public function __construct(protected FuelProviderService $fuelProviderService)
@@ -38,6 +49,7 @@ class FuelProviderConnectionController extends FleetOpsController
         $this->normalizeConnectionInput($input, $connection);
     }
 
+    #[SkipAuthorizationCheck]
     public function testCredentials(Request $request, string $provider): JsonResponse
     {
         $request->validate([
@@ -54,6 +66,7 @@ class FuelProviderConnectionController extends FleetOpsController
         return response()->json($result, data_get($result, 'success') ? 200 : 422);
     }
 
+    #[SkipAuthorizationCheck]
     public function testConnection(Request $request, string $id): JsonResponse
     {
         $connection = $this->findConnection($id);