@fleetbase/fleetops-engine 0.6.69 → 0.6.70

package/server/src/Http/Controllers/Internal/v1/FuelProviderTransactionController.php

@@ -2,6 +2,7 @@
 
 namespace Fleetbase\FleetOps\Http\Controllers\Internal\v1;
 
+use Fleetbase\Attributes\SkipAuthorizationCheck;
 use Fleetbase\FleetOps\Http\Controllers\FleetOpsController;
 use Fleetbase\FleetOps\Models\FuelProviderTransaction;
 use Fleetbase\FleetOps\Support\FuelProviders\FuelProviderService;
@@ -10,6 +11,17 @@ use Illuminate\Http\Request;
 
 class FuelProviderTransactionController extends FleetOpsController
 {
+    /**
+     * Permissions for methods AuthorizationGuard cannot map to a schema action (see FleetOpsController).
+     *
+     * @var array<string, string|string[]>
+     */
+    protected array $methodPermissions = [
+        'matchVehicle' => 'update fuel-provider-transaction',
+        'matchOrder'   => 'update fuel-provider-transaction',
+        'reprocess'    => 'update fuel-provider-transaction',
+    ];
+
     public $resource = 'fuel_provider_transaction';
 
     public function __construct(protected FuelProviderService $fuelProviderService)
@@ -22,6 +34,7 @@ class FuelProviderTransactionController extends FleetOpsController
         $query->with(['vehicle', 'driver', 'fuelReport']);
     }
 
+    #[SkipAuthorizationCheck]
     public function matchVehicle(Request $request, string $id): JsonResponse
     {
         $request->validate(['vehicle' => 'required|string']);
@@ -33,6 +46,7 @@ class FuelProviderTransactionController extends FleetOpsController
         ]);
     }
 
+    #[SkipAuthorizationCheck]
     public function matchOrder(Request $request, string $id): JsonResponse
     {
         $request->validate(['order' => 'required|string']);
@@ -44,6 +58,7 @@ class FuelProviderTransactionController extends FleetOpsController
         ]);
     }
 
+    #[SkipAuthorizationCheck]
     public function reprocess(Request $request, string $id): JsonResponse
     {
         $transaction = $this->findTransaction($id);

package/server/src/Http/Controllers/Internal/v1/FuelReportController.php

@@ -9,6 +9,7 @@ use Fleetbase\FleetOps\Models\FuelReport;
 use Fleetbase\Http\Requests\ExportRequest;
 use Fleetbase\Http\Requests\ImportRequest;
 use Illuminate\Http\Request;
+use Illuminate\Support\Arr;
 use Illuminate\Support\Str;
 use Maatwebsite\Excel\Facades\Excel;
 
@@ -23,11 +24,16 @@ class FuelReportController extends FleetOpsController
 
     /**
      * Handle post save transactions.
+     *
+     * Reads the custom field values from the payload the base controller already extracted
+     * rather than from the raw request: Ember Data sends the resource under a camelCase root
+     * (`fuelReport`), so `$request->array('fuel_report.custom_field_values')` was always empty and no
+     * custom field value was ever persisted for this resource.
      */
-    public function afterSave(Request $request, FuelReport $fuelReport)
+    public function afterSave(Request $request, FuelReport $fuelReport, array $input = [])
     {
-        $customFieldValues = $request->array('fuel_report.custom_field_values');
-        if ($customFieldValues) {
+        $customFieldValues = Arr::get($input, 'custom_field_values');
+        if (is_array($customFieldValues) && $customFieldValues) {
             $fuelReport->syncCustomFieldValues($customFieldValues);
         }
     }

package/server/src/Http/Controllers/Internal/v1/InspectionFormController.php

@@ -2,6 +2,7 @@
 
 namespace Fleetbase\FleetOps\Http\Controllers\Internal\v1;
 
+use Fleetbase\Attributes\SkipAuthorizationCheck;
 use Fleetbase\FleetOps\Http\Controllers\FleetOpsController;
 use Fleetbase\FleetOps\Http\Resources\v1\InspectionLink as InspectionLinkResource;
 use Fleetbase\FleetOps\Models\Driver;
@@ -16,6 +17,17 @@ use Illuminate\Http\Request;
 
 class InspectionFormController extends FleetOpsController
 {
+    /**
+     * Permissions for methods AuthorizationGuard cannot map to a schema action (see FleetOpsController).
+     *
+     * @var array<string, string|string[]>
+     */
+    protected array $methodPermissions = [
+        'generateLink' => 'publish inspection-form',
+        'revokeLink'   => 'publish inspection-form',
+        'sendPin'      => 'publish inspection-form',
+    ];
+
     /**
      * The resource to query.
      *
@@ -107,6 +119,7 @@ class InspectionFormController extends FleetOpsController
         ]);
     }
 
+    #[SkipAuthorizationCheck]
     public function generateLink(Request $request, string $id): JsonResponse
     {
         $form = $this->resolveForm($id)
@@ -215,6 +228,7 @@ class InspectionFormController extends FleetOpsController
     }
 
     /** Take a link out of use, leaving the record of it in the list. */
+    #[SkipAuthorizationCheck]
     public function revokeLink(Request $request, string $id, string $linkId): JsonResponse
     {
         $form = $this->resolveForm($id)->firstOrFail();
@@ -243,6 +257,7 @@ class InspectionFormController extends FleetOpsController
      * A failed delivery answers 200 with `pin_delivery.sent` false and why, so
      * the console shows it as a warning rather than an error.
      */
+    #[SkipAuthorizationCheck]
     public function sendPin(Request $request, string $id, string $linkId): JsonResponse
     {
         $form      = $this->resolveForm($id)->firstOrFail();

package/server/src/Http/Controllers/Internal/v1/LiveController.php

@@ -18,6 +18,7 @@ use Fleetbase\FleetOps\Models\Vehicle;
 use Fleetbase\FleetOps\Support\LiveCacheService;
 use Fleetbase\FleetOps\Support\LiveOrderQuery;
 use Fleetbase\FleetOps\Support\Utils;
+use Fleetbase\FleetOps\Traits\AuthorizesMethods;
 use Fleetbase\Http\Controllers\Controller;
 use Illuminate\Http\Request;
 
@@ -26,6 +27,21 @@ use Illuminate\Http\Request;
  */
 class LiveController extends Controller
 {
+    use AuthorizesMethods;
+
+    public function __construct()
+    {
+        $this->authorizeMethods([
+            'coordinates'           => 'list order',
+            'routes'                => 'list order',
+            'orders'                => 'list order',
+            'drivers'               => 'list driver',
+            'vehicles'              => 'list vehicle',
+            'operationsMonitor'     => 'list order',
+            'places'                => 'list place',
+        ]);
+    }
+
     protected const DEFAULT_VIEWPORT_LIMIT    = 500;
     protected const MAX_VIEWPORT_LIMIT        = 1000;
     protected const VIEWPORT_BOUNDS_PRECISION = 4;

package/server/src/Http/Controllers/Internal/v1/MaintenanceController.php

@@ -2,6 +2,7 @@
 
 namespace Fleetbase\FleetOps\Http\Controllers\Internal\v1;
 
+use Fleetbase\Attributes\SkipAuthorizationCheck;
 use Fleetbase\FleetOps\Exports\MaintenanceExport;
 use Fleetbase\FleetOps\Http\Controllers\FleetOpsController;
 use Fleetbase\FleetOps\Imports\MaintenanceImport;
@@ -15,6 +16,17 @@ use Maatwebsite\Excel\Facades\Excel;
 
 class MaintenanceController extends FleetOpsController
 {
+    /**
+     * Permissions for methods AuthorizationGuard cannot map to a schema action (see FleetOpsController).
+     *
+     * @var array<string, string|string[]>
+     */
+    protected array $methodPermissions = [
+        'addLineItem'    => 'update maintenance',
+        'updateLineItem' => 'update maintenance',
+        'removeLineItem' => 'update maintenance',
+    ];
+
     /**
      * The resource to query.
      *
@@ -67,6 +79,7 @@ class MaintenanceController extends FleetOpsController
      * Add a cost line item to a maintenance record.
      * POST /maintenances/{id}/line-items.
      */
+    #[SkipAuthorizationCheck]
     public function addLineItem(string $id, Request $request): JsonResponse
     {
         $maintenance = $this->findMaintenanceForLineItem($id);
@@ -89,6 +102,7 @@ class MaintenanceController extends FleetOpsController
      * Update a cost line item on a maintenance record.
      * PUT /maintenances/{id}/line-items/{index}.
      */
+    #[SkipAuthorizationCheck]
     public function updateLineItem(string $id, int $index, Request $request): JsonResponse
     {
         $maintenance = $this->findMaintenanceForLineItem($id);
@@ -121,6 +135,7 @@ class MaintenanceController extends FleetOpsController
      * Remove a cost line item from a maintenance record.
      * DELETE /maintenances/{id}/line-items/{index}.
      */
+    #[SkipAuthorizationCheck]
     public function removeLineItem(string $id, int $index): JsonResponse
     {
         $maintenance = $this->findMaintenanceForLineItem($id);

package/server/src/Http/Controllers/Internal/v1/MaintenanceScheduleController.php

@@ -2,6 +2,7 @@
 
 namespace Fleetbase\FleetOps\Http\Controllers\Internal\v1;
 
+use Fleetbase\Attributes\SkipAuthorizationCheck;
 use Fleetbase\FleetOps\Exports\MaintenanceScheduleExport;
 use Fleetbase\FleetOps\Http\Controllers\FleetOpsController;
 use Fleetbase\FleetOps\Imports\MaintenanceScheduleImport;
@@ -22,6 +23,17 @@ use Spatie\IcalendarGenerator\ValueObjects\RRule;
 
 class MaintenanceScheduleController extends FleetOpsController
 {
+    /**
+     * Permissions for methods AuthorizationGuard cannot map to a schema action (see FleetOpsController).
+     *
+     * @var array<string, string|string[]>
+     */
+    protected array $methodPermissions = [
+        'pause'   => 'update maintenance-schedule',
+        'resume'  => 'update maintenance-schedule',
+        'trigger' => 'update maintenance-schedule',
+    ];
+
     /**
      * The resource to query.
      *
@@ -71,6 +83,7 @@ class MaintenanceScheduleController extends FleetOpsController
      * Pause a maintenance schedule.
      * POST /maintenance-schedules/{id}/pause.
      */
+    #[SkipAuthorizationCheck]
     public function pause(string $id): JsonResponse
     {
         $schedule = $this->findSchedule($id);
@@ -88,6 +101,7 @@ class MaintenanceScheduleController extends FleetOpsController
      * Resume a paused maintenance schedule.
      * POST /maintenance-schedules/{id}/resume.
      */
+    #[SkipAuthorizationCheck]
     public function resume(string $id): JsonResponse
     {
         $schedule = $this->findSchedule($id);
@@ -105,6 +119,7 @@ class MaintenanceScheduleController extends FleetOpsController
      * Manually trigger a work order from a schedule.
      * POST /maintenance-schedules/{id}/trigger.
      */
+    #[SkipAuthorizationCheck]
     public function trigger(string $id, Request $request): JsonResponse
     {
         $schedule  = $this->findSchedule($id);

package/server/src/Http/Controllers/Internal/v1/ManifestController.php

@@ -4,6 +4,7 @@ namespace Fleetbase\FleetOps\Http\Controllers\Internal\v1;
 
 use Fleetbase\FleetOps\Models\Manifest;
 use Fleetbase\FleetOps\Models\ManifestStop;
+use Fleetbase\FleetOps\Traits\AuthorizesMethods;
 use Fleetbase\Http\Controllers\Controller;
 use Illuminate\Http\JsonResponse;
 use Illuminate\Http\Request;
@@ -23,6 +24,20 @@ use Illuminate\Http\Request;
  */
 class ManifestController extends Controller
 {
+    use AuthorizesMethods;
+
+    public function __construct()
+    {
+        $this->authorizeMethods([
+            'index'      => 'list order',
+            'show'       => 'view order',
+            'cancel'     => 'cancel order',
+            'destroy'    => 'delete order',
+            'showStop'   => 'view order',
+            'updateStop' => 'update order',
+        ]);
+    }
+
     /**
      * List manifests for the current company.
      * Supports filtering by status, driver_id, vehicle_id, and scheduled_date.

package/server/src/Http/Controllers/Internal/v1/MetricsController.php

@@ -2,6 +2,7 @@
 
 namespace Fleetbase\FleetOps\Http\Controllers\Internal\v1;
 
+use Fleetbase\FleetOps\Support\Authorization;
 use Fleetbase\FleetOps\Support\Metrics;
 use Fleetbase\FleetOps\Support\Metrics\Registry;
 use Fleetbase\Http\Controllers\Controller;
@@ -10,6 +11,16 @@ use Illuminate\Support\Carbon;
 
 class MetricsController extends Controller
 {
+    public function __construct()
+    {
+        // Not a resource controller, so AuthorizationGuard cannot resolve a permission for it.
+        $this->middleware(function ($request, $next) {
+            Authorization::authorize('view analytics');
+
+            return $next($request);
+        });
+    }
+
     /**
      * Legacy bulk endpoint. Returns a flat map of slug → scalar value for the
      * requested period. Preserved for backward compat; the dashboard widgets

package/server/src/Http/Controllers/Internal/v1/NavigatorController.php

@@ -3,6 +3,7 @@
 namespace Fleetbase\FleetOps\Http\Controllers\Internal\v1;
 
 use Fleetbase\FleetOps\Support\Utils;
+use Fleetbase\FleetOps\Traits\AuthorizesMethods;
 use Fleetbase\Http\Controllers\Controller;
 use Fleetbase\Http\Resources\Organization;
 use Fleetbase\Models\ApiCredential;
@@ -15,6 +16,19 @@ use Illuminate\Support\Str;
 
 class NavigatorController extends Controller
 {
+    use AuthorizesMethods;
+    /**
+     * How long a Navigator link issued from the console stays valid.
+     */
+    public const LINK_TTL_MINUTES = 30;
+
+    public function __construct()
+    {
+        $this->authorizeMethods([
+            'getLinkAppUrl' => 'admin',
+        ]);
+    }
+
     /**
      * Redirects to the Fleetbase Navigator app using a deep link.
      * Automatically detects the platform (iOS or Android) and uses the correct URI scheme.
@@ -23,6 +37,12 @@ class NavigatorController extends Controller
      */
     public function linkApp(Request $request)
     {
+        // This route is opened from a phone without a console session, so it is
+        // authorised by the short-lived signature issued by getLinkAppUrl().
+        if (!$this->hasValidLinkSignature($request)) {
+            return response()->error('This Navigator link is invalid or has expired. Generate a new one from the console.', 403);
+        }
+
         $adminUser = $this->findAdminUser();
 
         if (!$adminUser || !$adminUser->company) {
@@ -67,8 +87,13 @@ class NavigatorController extends Controller
      */
     public function getLinkAppUrl()
     {
+        $expires = now()->addMinutes(static::LINK_TTL_MINUTES)->getTimestamp();
+
         return response()->json([
-            'linkUrl' => url('int/v1/fleet-ops/navigator/link-app'),
+            'linkUrl' => url('int/v1/fleet-ops/navigator/link-app') . '?' . http_build_query([
+                'expires'   => $expires,
+                'signature' => static::linkSignature($expires),
+            ]),
         ]);
     }
 
@@ -189,4 +214,20 @@ class NavigatorController extends Controller
     {
         return Setting::where('key', 'fleet-ops.driver-onboard')->value('value');
     }
+
+    /**
+     * HMAC signature for a Navigator link expiring at the given unix timestamp.
+     */
+    public static function linkSignature(int $expires): string
+    {
+        return hash_hmac('sha256', 'fleet-ops.navigator.link-app|' . $expires, (string) config('app.key'));
+    }
+
+    protected function hasValidLinkSignature(Request $request): bool
+    {
+        $expires   = (int) $request->query('expires');
+        $signature = (string) $request->query('signature');
+
+        return $signature !== '' && $expires >= time() && hash_equals(static::linkSignature($expires), $signature);
+    }
 }

package/server/src/Http/Controllers/Internal/v1/OrchestrationController.php

@@ -16,6 +16,7 @@ use Fleetbase\FleetOps\Models\Vendor;
 use Fleetbase\FleetOps\Orchestration\Engines\DriverAssignmentEngine;
 use Fleetbase\FleetOps\Orchestration\Engines\RouteSequencingEngine;
 use Fleetbase\FleetOps\Orchestration\OrchestrationEngineRegistry;
+use Fleetbase\FleetOps\Traits\AuthorizesMethods;
 use Fleetbase\Http\Controllers\Controller;
 use Fleetbase\Models\Setting;
 use Illuminate\Http\JsonResponse;
@@ -39,8 +40,19 @@ use Illuminate\Support\Str;
  */
 class OrchestrationController extends Controller
 {
+    use AuthorizesMethods;
+
     public function __construct(protected OrchestrationEngineRegistry $registry)
     {
+        $this->authorizeMethods([
+            'orders'                => 'list order',
+            'run'                   => 'optimize order',
+            'preview'               => 'list order',
+            'commit'                => 'assign-driver-for order',
+            'engines'               => 'list order',
+            'orderConfigFields'     => 'list order',
+            'importOrders'          => 'import order',
+        ]);
     }
 
     /**

package/server/src/Http/Controllers/Internal/v1/OrderController.php

@@ -2,6 +2,7 @@
 
 namespace Fleetbase\FleetOps\Http\Controllers\Internal\v1;
 
+use Fleetbase\Attributes\SkipAuthorizationCheck;
 use Fleetbase\Exceptions\FleetbaseRequestValidationException;
 use Fleetbase\FleetOps\Events\EntityActivityChanged;
 use Fleetbase\FleetOps\Events\EntityCompleted;
@@ -53,6 +54,20 @@ use Maatwebsite\Excel\Facades\Excel;
 class OrderController extends FleetOpsController
 {
     use ResolvesOrderServiceStops;
+    /**
+     * Permissions for methods AuthorizationGuard cannot map to a schema action (see FleetOpsController).
+     *
+     * @var array<string, string|string[]>
+     */
+    protected array $methodPermissions = [
+        'editOrderRoute'   => 'update-route-for order',
+        'importFromFiles'  => 'import order',
+        'bulkCancel'       => 'cancel order',
+        'bulkDispatch'     => 'dispatch order',
+        'bulkAssignDriver' => 'assign-driver-for order',
+        'dispatchOrder'    => 'dispatch order',
+        'scheduleOrder'    => 'schedule order',
+    ];
 
     /**
      * The resource to query.
@@ -267,6 +282,7 @@ class OrderController extends FleetOpsController
      *
      * @return Response
      */
+    #[SkipAuthorizationCheck]
     public function editOrderRoute(string $id, Request $request)
     {
         $pickup            = $request->input('pickup');
@@ -337,6 +353,7 @@ class OrderController extends FleetOpsController
      *
      * @return \Illuminate\Http\Response
      */
+    #[SkipAuthorizationCheck]
     public function importFromFiles(Request $request)
     {
         $info    = Utils::lookupIp();
@@ -409,6 +426,7 @@ class OrderController extends FleetOpsController
      *
      * @return \Illuminate\Http\Response
      */
+    #[SkipAuthorizationCheck]
     public function bulkCancel(Request $request)
     {
         $request->validate([
@@ -454,6 +472,7 @@ class OrderController extends FleetOpsController
      *
      * @return \Illuminate\Http\Response
      */
+    #[SkipAuthorizationCheck]
     public function bulkDispatch(BulkDispatchRequest $request)
     {
         /** @var Order */
@@ -502,6 +521,7 @@ class OrderController extends FleetOpsController
      *
      * @return \Illuminate\Http\Response
      */
+    #[SkipAuthorizationCheck]
     public function bulkAssignDriver(Request $request)
     {
         // Validate Inputs
@@ -578,6 +598,7 @@ class OrderController extends FleetOpsController
      *
      * @return \Illuminate\Http\Response
      */
+    #[SkipAuthorizationCheck]
     public function dispatchOrder(Request $request)
     {
         /**
@@ -1906,6 +1927,7 @@ class OrderController extends FleetOpsController
      *
      * @return \Illuminate\Http\Response
      */
+    #[SkipAuthorizationCheck]
     public function scheduleOrder(Request $request)
     {
         $orderId     = $request->input('order');

package/server/src/Http/Controllers/Internal/v1/PaymentController.php

@@ -4,6 +4,7 @@ namespace Fleetbase\FleetOps\Http\Controllers\Internal\v1;
 
 use Fleetbase\FleetOps\Models\PurchaseRate;
 use Fleetbase\FleetOps\Support\Payment;
+use Fleetbase\FleetOps\Traits\AuthorizesMethods;
 use Fleetbase\Http\Controllers\Controller;
 use Fleetbase\Http\Resources\FleetbaseResource;
 use Fleetbase\Support\Auth;
@@ -12,6 +13,18 @@ use Illuminate\Support\Str;
 
 class PaymentController extends Controller
 {
+    use AuthorizesMethods;
+
+    public function __construct()
+    {
+        $this->authorizeMethods([
+            'hasStripeConnectAccount'        => 'view payments',
+            'getStripeAccount'               => 'onboard payments',
+            'getStripeAccountSession'        => 'onboard payments',
+            'getCompanyReceivedPayments'     => 'view payments',
+        ]);
+    }
+
     /**
      * Checks if the currently authenticated company has an associated Stripe Connect account.
      *

package/server/src/Http/Controllers/Internal/v1/RadarController.php

@@ -19,6 +19,7 @@ use Fleetbase\FleetOps\Support\Radar\RadarAgenda;
 use Fleetbase\FleetOps\Support\Radar\RadarBriefing;
 use Fleetbase\FleetOps\Support\Radar\RadarItemState;
 use Fleetbase\FleetOps\Support\Radar\RadarRules;
+use Fleetbase\FleetOps\Traits\AuthorizesMethods;
 use Fleetbase\Http\Controllers\Controller;
 use Fleetbase\Models\Alert;
 use Fleetbase\Models\CompanyUser;
@@ -42,6 +43,24 @@ use Illuminate\Support\Carbon;
  */
 class RadarController extends Controller
 {
+    use AuthorizesMethods;
+
+    public function __construct()
+    {
+        $this->authorizeMethods([
+            'extendShift'       => ['update driver', 'update vehicle'],
+            'acknowledge'       => ['update driver', 'update vehicle'],
+            'snooze'            => ['update driver', 'update vehicle'],
+            'wake'              => ['update driver', 'update vehicle'],
+            'assign'            => ['update driver', 'update vehicle'],
+            'plan'              => ['update driver', 'update vehicle'],
+            'resolve'           => ['update driver', 'update vehicle'],
+            'bulk'              => ['update driver', 'update vehicle'],
+            'storeNotice'       => ['update driver', 'update vehicle'],
+            'destroyNotice'     => ['update driver', 'update vehicle'],
+        ]);
+    }
+
     public const RESOLVED_WINDOW_DAYS = 7;
     public const SNOOZE_MAX_DAYS      = 90;
 

package/server/src/Http/Controllers/Internal/v1/ServiceAreaController.php

@@ -7,6 +7,7 @@ use Fleetbase\FleetOps\Http\Controllers\FleetOpsController;
 use Fleetbase\FleetOps\Models\ServiceArea;
 use Fleetbase\Http\Requests\ExportRequest;
 use Illuminate\Http\Request;
+use Illuminate\Support\Arr;
 use Illuminate\Support\Str;
 use Maatwebsite\Excel\Facades\Excel;
 
@@ -21,11 +22,16 @@ class ServiceAreaController extends FleetOpsController
 
     /**
      * Handle post save transactions.
+     *
+     * Reads the custom field values from the payload the base controller already extracted
+     * rather than from the raw request: Ember Data sends the resource under a camelCase root
+     * (`serviceArea`), so `$request->array('service_area.custom_field_values')` was always empty and no
+     * custom field value was ever persisted for this resource.
      */
-    public function afterSave(Request $request, ServiceArea $serviceArea)
+    public function afterSave(Request $request, ServiceArea $serviceArea, array $input = [])
     {
-        $customFieldValues = $request->array('service_area.custom_field_values');
-        if ($customFieldValues) {
+        $customFieldValues = Arr::get($input, 'custom_field_values');
+        if (is_array($customFieldValues) && $customFieldValues) {
             $serviceArea->syncCustomFieldValues($customFieldValues);
         }
     }