@fleetbase/fleetops-engine 0.6.69 → 0.6.71

package/server/src/Http/Controllers/Internal/v1/ContactController.php

@@ -2,6 +2,7 @@
 
 namespace Fleetbase\FleetOps\Http\Controllers\Internal\v1;
 
+use Fleetbase\Attributes\SkipAuthorizationCheck;
 use Fleetbase\FleetOps\Exports\ContactExport;
 use Fleetbase\FleetOps\Http\Controllers\FleetOpsController;
 use Fleetbase\FleetOps\Http\Resources\v1\Vendor as VendorResource;
@@ -26,6 +27,15 @@ use Maatwebsite\Excel\Facades\Excel;
 
 class ContactController extends FleetOpsController
 {
+    /**
+     * Permissions for methods AuthorizationGuard cannot map to a schema action (see FleetOpsController).
+     *
+     * @var array<string, string|string[]>
+     */
+    protected array $methodPermissions = [
+        'convertToVendor' => 'create vendor',
+    ];
+
     /**
      * The resource to query.
      *
@@ -108,6 +118,7 @@ class ContactController extends FleetOpsController
         ]);
     }
 
+    #[SkipAuthorizationCheck]
     public function convertToVendor(Request $request, string $id)
     {
         $contact = $this->contactForVendorConversion($id);

package/server/src/Http/Controllers/Internal/v1/CustomerController.php

@@ -5,6 +5,7 @@ namespace Fleetbase\FleetOps\Http\Controllers\Internal\v1;
 use Fleetbase\FleetOps\Mail\CustomerCredentialsMail;
 use Fleetbase\FleetOps\Models\Contact;
 use Fleetbase\FleetOps\Support\ProfileAccountManager;
+use Fleetbase\FleetOps\Traits\AuthorizesMethods;
 use Fleetbase\Http\Controllers\Controller;
 use Fleetbase\Models\User;
 use Illuminate\Http\Request;
@@ -13,6 +14,19 @@ use Illuminate\Support\Str;
 
 class CustomerController extends Controller
 {
+    use AuthorizesMethods;
+
+    public function __construct()
+    {
+        $this->authorizeMethods([
+            'createPortalLogin'     => 'reset-credentials-for customer',
+            'sendCredentials'       => 'reset-credentials-for customer',
+            'deactivatePortalLogin' => 'reset-credentials-for customer',
+            'reactivatePortalLogin' => 'reset-credentials-for customer',
+            'resetCredentials'      => 'reset-credentials-for customer',
+        ]);
+    }
+
     public function createPortalLogin(Request $request)
     {
         $customer = $this->resolveCustomer($request);

package/server/src/Http/Controllers/Internal/v1/DeviceController.php

@@ -2,6 +2,7 @@
 
 namespace Fleetbase\FleetOps\Http\Controllers\Internal\v1;
 
+use Fleetbase\Attributes\SkipAuthorizationCheck;
 use Fleetbase\FleetOps\Exceptions\DeviceAlreadyAttachedException;
 use Fleetbase\FleetOps\Exports\DeviceExport;
 use Fleetbase\FleetOps\Http\Controllers\FleetOpsController;
@@ -17,6 +18,16 @@ use Maatwebsite\Excel\Facades\Excel;
 
 class DeviceController extends FleetOpsController
 {
+    /**
+     * Permissions for methods AuthorizationGuard cannot map to a schema action (see FleetOpsController).
+     *
+     * @var array<string, string|string[]>
+     */
+    protected array $methodPermissions = [
+        'attach' => 'update device',
+        'detach' => 'update device',
+    ];
+
     /**
      * The resource to query.
      *
@@ -110,6 +121,7 @@ class DeviceController extends FleetOpsController
     /**
      * Attach a device to a supported FleetOps resource.
      */
+    #[SkipAuthorizationCheck]
     public function attach(Request $request, string $id): JsonResponse
     {
         $request->validate([
@@ -152,6 +164,7 @@ class DeviceController extends FleetOpsController
     /**
      * Detach a device from its current FleetOps resource.
      */
+    #[SkipAuthorizationCheck]
     public function detach(string $id): JsonResponse
     {
         $device = $this->resolveDevice($id);

package/server/src/Http/Controllers/Internal/v1/DeviceEventController.php

@@ -2,6 +2,7 @@
 
 namespace Fleetbase\FleetOps\Http\Controllers\Internal\v1;
 
+use Fleetbase\Attributes\SkipAuthorizationCheck;
 use Fleetbase\FleetOps\Http\Controllers\FleetOpsController;
 use Fleetbase\FleetOps\Models\DeviceEvent;
 use Fleetbase\FleetOps\Support\Utils;
@@ -9,6 +10,15 @@ use Illuminate\Http\JsonResponse;
 
 class DeviceEventController extends FleetOpsController
 {
+    /**
+     * Permissions for methods AuthorizationGuard cannot map to a schema action (see FleetOpsController).
+     *
+     * @var array<string, string|string[]>
+     */
+    protected array $methodPermissions = [
+        'markProcessed' => 'update device-event',
+    ];
+
     /**
      * The resource to query.
      *
@@ -51,6 +61,7 @@ class DeviceEventController extends FleetOpsController
         }
     }
 
+    #[SkipAuthorizationCheck]
     public function markProcessed(string $id): JsonResponse
     {
         $deviceEvent = DeviceEvent::where('company_uuid', session('company'))

package/server/src/Http/Controllers/Internal/v1/DriverController.php

@@ -2,6 +2,7 @@
 
 namespace Fleetbase\FleetOps\Http\Controllers\Internal\v1;
 
+use Fleetbase\Attributes\SkipAuthorizationCheck;
 use Fleetbase\Exceptions\FleetbaseRequestValidationException;
 use Fleetbase\FleetOps\Exceptions\ProfileIdentityConflictException;
 use Fleetbase\FleetOps\Exports\DriverExport;
@@ -33,6 +34,20 @@ use Maatwebsite\Excel\Facades\Excel;
 class DriverController extends FleetOpsController
 {
     use Traits\DriverSchedulingTrait;
+    /**
+     * Permissions for methods AuthorizationGuard cannot map to a schema action (see FleetOpsController).
+     *
+     * @var array<string, string|string[]>
+     */
+    protected array $methodPermissions = [
+        'sendCredentials'  => 'update-user-for driver',
+        'resetCredentials' => 'update-user-for driver',
+        'deactivateLogin'  => 'update-user-for driver',
+        'reactivateLogin'  => 'update-user-for driver',
+        'unassignOrders'   => 'assign-order-for driver',
+        'unassignOrder'    => 'assign-order-for driver',
+        'unassignVehicle'  => 'assign-vehicle-for driver',
+    ];
     /**
      * The resource to query.
      *
@@ -200,6 +215,7 @@ class DriverController extends FleetOpsController
      *
      * @return JsonResponse
      */
+    #[SkipAuthorizationCheck]
     public function sendCredentials(string $id)
     {
         [$driver, $user, $error] = $this->resolveDriverLogin($id);
@@ -221,6 +237,7 @@ class DriverController extends FleetOpsController
      *
      * @return JsonResponse
      */
+    #[SkipAuthorizationCheck]
     public function resetCredentials(Request $request, string $id)
     {
         $password = $request->input('password');
@@ -255,6 +272,7 @@ class DriverController extends FleetOpsController
      *
      * @return JsonResponse
      */
+    #[SkipAuthorizationCheck]
     public function deactivateLogin(string $id)
     {
         [$driver, $user, $error] = $this->resolveDriverLogin($id);
@@ -275,6 +293,7 @@ class DriverController extends FleetOpsController
      *
      * @return JsonResponse
      */
+    #[SkipAuthorizationCheck]
     public function reactivateLogin(string $id)
     {
         [$driver, $user, $error] = $this->resolveDriverLogin($id);
@@ -430,6 +449,7 @@ class DriverController extends FleetOpsController
         ]);
     }
 
+    #[SkipAuthorizationCheck]
     public function unassignOrders(Request $request, string $id): JsonResponse
     {
         $request->validate([
@@ -462,6 +482,7 @@ class DriverController extends FleetOpsController
         ]);
     }
 
+    #[SkipAuthorizationCheck]
     public function unassignOrder(string $id): JsonResponse
     {
         $driver = $this->findDriver($id);
@@ -498,6 +519,7 @@ class DriverController extends FleetOpsController
         ]);
     }
 
+    #[SkipAuthorizationCheck]
     public function unassignVehicle(string $id): JsonResponse
     {
         $driver  = $this->findDriver($id);

package/server/src/Http/Controllers/Internal/v1/FuelProviderConnectionController.php

@@ -2,6 +2,7 @@
 
 namespace Fleetbase\FleetOps\Http\Controllers\Internal\v1;
 
+use Fleetbase\Attributes\SkipAuthorizationCheck;
 use Fleetbase\FleetOps\Http\Controllers\FleetOpsController;
 use Fleetbase\FleetOps\Jobs\SyncFuelProviderTransactionsJob;
 use Fleetbase\FleetOps\Models\FuelProviderConnection;
@@ -13,6 +14,16 @@ use Illuminate\Validation\ValidationException;
 
 class FuelProviderConnectionController extends FleetOpsController
 {
+    /**
+     * Permissions for methods AuthorizationGuard cannot map to a schema action (see FleetOpsController).
+     *
+     * @var array<string, string|string[]>
+     */
+    protected array $methodPermissions = [
+        'testCredentials' => 'create fuel-provider-connection',
+        'testConnection'  => 'update fuel-provider-connection',
+    ];
+
     public $resource = 'fuel_provider_connection';
 
     public function __construct(protected FuelProviderService $fuelProviderService)
@@ -38,6 +49,7 @@ class FuelProviderConnectionController extends FleetOpsController
         $this->normalizeConnectionInput($input, $connection);
     }
 
+    #[SkipAuthorizationCheck]
     public function testCredentials(Request $request, string $provider): JsonResponse
     {
         $request->validate([
@@ -54,6 +66,7 @@ class FuelProviderConnectionController extends FleetOpsController
         return response()->json($result, data_get($result, 'success') ? 200 : 422);
     }
 
+    #[SkipAuthorizationCheck]
     public function testConnection(Request $request, string $id): JsonResponse
     {
         $connection = $this->findConnection($id);

package/server/src/Http/Controllers/Internal/v1/FuelProviderTransactionController.php

@@ -2,6 +2,7 @@
 
 namespace Fleetbase\FleetOps\Http\Controllers\Internal\v1;
 
+use Fleetbase\Attributes\SkipAuthorizationCheck;
 use Fleetbase\FleetOps\Http\Controllers\FleetOpsController;
 use Fleetbase\FleetOps\Models\FuelProviderTransaction;
 use Fleetbase\FleetOps\Support\FuelProviders\FuelProviderService;
@@ -10,6 +11,17 @@ use Illuminate\Http\Request;
 
 class FuelProviderTransactionController extends FleetOpsController
 {
+    /**
+     * Permissions for methods AuthorizationGuard cannot map to a schema action (see FleetOpsController).
+     *
+     * @var array<string, string|string[]>
+     */
+    protected array $methodPermissions = [
+        'matchVehicle' => 'update fuel-provider-transaction',
+        'matchOrder'   => 'update fuel-provider-transaction',
+        'reprocess'    => 'update fuel-provider-transaction',
+    ];
+
     public $resource = 'fuel_provider_transaction';
 
     public function __construct(protected FuelProviderService $fuelProviderService)
@@ -22,6 +34,7 @@ class FuelProviderTransactionController extends FleetOpsController
         $query->with(['vehicle', 'driver', 'fuelReport']);
     }
 
+    #[SkipAuthorizationCheck]
     public function matchVehicle(Request $request, string $id): JsonResponse
     {
         $request->validate(['vehicle' => 'required|string']);
@@ -33,6 +46,7 @@ class FuelProviderTransactionController extends FleetOpsController
         ]);
     }
 
+    #[SkipAuthorizationCheck]
     public function matchOrder(Request $request, string $id): JsonResponse
     {
         $request->validate(['order' => 'required|string']);
@@ -44,6 +58,7 @@ class FuelProviderTransactionController extends FleetOpsController
         ]);
     }
 
+    #[SkipAuthorizationCheck]
     public function reprocess(Request $request, string $id): JsonResponse
     {
         $transaction = $this->findTransaction($id);

package/server/src/Http/Controllers/Internal/v1/FuelReportController.php

@@ -9,6 +9,7 @@ use Fleetbase\FleetOps\Models\FuelReport;
 use Fleetbase\Http\Requests\ExportRequest;
 use Fleetbase\Http\Requests\ImportRequest;
 use Illuminate\Http\Request;
+use Illuminate\Support\Arr;
 use Illuminate\Support\Str;
 use Maatwebsite\Excel\Facades\Excel;
 
@@ -23,11 +24,16 @@ class FuelReportController extends FleetOpsController
 
     /**
      * Handle post save transactions.
+     *
+     * Reads the custom field values from the payload the base controller already extracted
+     * rather than from the raw request: Ember Data sends the resource under a camelCase root
+     * (`fuelReport`), so `$request->array('fuel_report.custom_field_values')` was always empty and no
+     * custom field value was ever persisted for this resource.
      */
-    public function afterSave(Request $request, FuelReport $fuelReport)
+    public function afterSave(Request $request, FuelReport $fuelReport, array $input = [])
     {
-        $customFieldValues = $request->array('fuel_report.custom_field_values');
-        if ($customFieldValues) {
+        $customFieldValues = Arr::get($input, 'custom_field_values');
+        if (is_array($customFieldValues) && $customFieldValues) {
             $fuelReport->syncCustomFieldValues($customFieldValues);
         }
     }

package/server/src/Http/Controllers/Internal/v1/InspectionFormController.php

@@ -2,6 +2,7 @@
 
 namespace Fleetbase\FleetOps\Http\Controllers\Internal\v1;
 
+use Fleetbase\Attributes\SkipAuthorizationCheck;
 use Fleetbase\FleetOps\Http\Controllers\FleetOpsController;
 use Fleetbase\FleetOps\Http\Resources\v1\InspectionLink as InspectionLinkResource;
 use Fleetbase\FleetOps\Models\Driver;
@@ -16,6 +17,17 @@ use Illuminate\Http\Request;
 
 class InspectionFormController extends FleetOpsController
 {
+    /**
+     * Permissions for methods AuthorizationGuard cannot map to a schema action (see FleetOpsController).
+     *
+     * @var array<string, string|string[]>
+     */
+    protected array $methodPermissions = [
+        'generateLink' => 'publish inspection-form',
+        'revokeLink'   => 'publish inspection-form',
+        'sendPin'      => 'publish inspection-form',
+    ];
+
     /**
      * The resource to query.
      *
@@ -107,6 +119,7 @@ class InspectionFormController extends FleetOpsController
         ]);
     }
 
+    #[SkipAuthorizationCheck]
     public function generateLink(Request $request, string $id): JsonResponse
     {
         $form = $this->resolveForm($id)
@@ -215,6 +228,7 @@ class InspectionFormController extends FleetOpsController
     }
 
     /** Take a link out of use, leaving the record of it in the list. */
+    #[SkipAuthorizationCheck]
     public function revokeLink(Request $request, string $id, string $linkId): JsonResponse
     {
         $form = $this->resolveForm($id)->firstOrFail();
@@ -243,6 +257,7 @@ class InspectionFormController extends FleetOpsController
      * A failed delivery answers 200 with `pin_delivery.sent` false and why, so
      * the console shows it as a warning rather than an error.
      */
+    #[SkipAuthorizationCheck]
     public function sendPin(Request $request, string $id, string $linkId): JsonResponse
     {
         $form      = $this->resolveForm($id)->firstOrFail();

package/server/src/Http/Controllers/Internal/v1/LiveController.php

@@ -18,6 +18,7 @@ use Fleetbase\FleetOps\Models\Vehicle;
 use Fleetbase\FleetOps\Support\LiveCacheService;
 use Fleetbase\FleetOps\Support\LiveOrderQuery;
 use Fleetbase\FleetOps\Support\Utils;
+use Fleetbase\FleetOps\Traits\AuthorizesMethods;
 use Fleetbase\Http\Controllers\Controller;
 use Illuminate\Http\Request;
 
@@ -26,6 +27,21 @@ use Illuminate\Http\Request;
  */
 class LiveController extends Controller
 {
+    use AuthorizesMethods;
+
+    public function __construct()
+    {
+        $this->authorizeMethods([
+            'coordinates'           => 'list order',
+            'routes'                => 'list order',
+            'orders'                => 'list order',
+            'drivers'               => 'list driver',
+            'vehicles'              => 'list vehicle',
+            'operationsMonitor'     => 'list order',
+            'places'                => 'list place',
+        ]);
+    }
+
     protected const DEFAULT_VIEWPORT_LIMIT    = 500;
     protected const MAX_VIEWPORT_LIMIT        = 1000;
     protected const VIEWPORT_BOUNDS_PRECISION = 4;

package/server/src/Http/Controllers/Internal/v1/MaintenanceController.php

@@ -2,6 +2,7 @@
 
 namespace Fleetbase\FleetOps\Http\Controllers\Internal\v1;
 
+use Fleetbase\Attributes\SkipAuthorizationCheck;
 use Fleetbase\FleetOps\Exports\MaintenanceExport;
 use Fleetbase\FleetOps\Http\Controllers\FleetOpsController;
 use Fleetbase\FleetOps\Imports\MaintenanceImport;
@@ -15,6 +16,17 @@ use Maatwebsite\Excel\Facades\Excel;
 
 class MaintenanceController extends FleetOpsController
 {
+    /**
+     * Permissions for methods AuthorizationGuard cannot map to a schema action (see FleetOpsController).
+     *
+     * @var array<string, string|string[]>
+     */
+    protected array $methodPermissions = [
+        'addLineItem'    => 'update maintenance',
+        'updateLineItem' => 'update maintenance',
+        'removeLineItem' => 'update maintenance',
+    ];
+
     /**
      * The resource to query.
      *
@@ -67,6 +79,7 @@ class MaintenanceController extends FleetOpsController
      * Add a cost line item to a maintenance record.
      * POST /maintenances/{id}/line-items.
      */
+    #[SkipAuthorizationCheck]
     public function addLineItem(string $id, Request $request): JsonResponse
     {
         $maintenance = $this->findMaintenanceForLineItem($id);
@@ -89,6 +102,7 @@ class MaintenanceController extends FleetOpsController
      * Update a cost line item on a maintenance record.
      * PUT /maintenances/{id}/line-items/{index}.
      */
+    #[SkipAuthorizationCheck]
     public function updateLineItem(string $id, int $index, Request $request): JsonResponse
     {
         $maintenance = $this->findMaintenanceForLineItem($id);
@@ -121,6 +135,7 @@ class MaintenanceController extends FleetOpsController
      * Remove a cost line item from a maintenance record.
      * DELETE /maintenances/{id}/line-items/{index}.
      */
+    #[SkipAuthorizationCheck]
     public function removeLineItem(string $id, int $index): JsonResponse
     {
         $maintenance = $this->findMaintenanceForLineItem($id);

package/server/src/Http/Controllers/Internal/v1/MaintenanceScheduleController.php

@@ -2,6 +2,7 @@
 
 namespace Fleetbase\FleetOps\Http\Controllers\Internal\v1;
 
+use Fleetbase\Attributes\SkipAuthorizationCheck;
 use Fleetbase\FleetOps\Exports\MaintenanceScheduleExport;
 use Fleetbase\FleetOps\Http\Controllers\FleetOpsController;
 use Fleetbase\FleetOps\Imports\MaintenanceScheduleImport;
@@ -22,6 +23,17 @@ use Spatie\IcalendarGenerator\ValueObjects\RRule;
 
 class MaintenanceScheduleController extends FleetOpsController
 {
+    /**
+     * Permissions for methods AuthorizationGuard cannot map to a schema action (see FleetOpsController).
+     *
+     * @var array<string, string|string[]>
+     */
+    protected array $methodPermissions = [
+        'pause'   => 'update maintenance-schedule',
+        'resume'  => 'update maintenance-schedule',
+        'trigger' => 'update maintenance-schedule',
+    ];
+
     /**
      * The resource to query.
      *
@@ -71,6 +83,7 @@ class MaintenanceScheduleController extends FleetOpsController
      * Pause a maintenance schedule.
      * POST /maintenance-schedules/{id}/pause.
      */
+    #[SkipAuthorizationCheck]
     public function pause(string $id): JsonResponse
     {
         $schedule = $this->findSchedule($id);
@@ -88,6 +101,7 @@ class MaintenanceScheduleController extends FleetOpsController
      * Resume a paused maintenance schedule.
      * POST /maintenance-schedules/{id}/resume.
      */
+    #[SkipAuthorizationCheck]
     public function resume(string $id): JsonResponse
     {
         $schedule = $this->findSchedule($id);
@@ -105,6 +119,7 @@ class MaintenanceScheduleController extends FleetOpsController
      * Manually trigger a work order from a schedule.
      * POST /maintenance-schedules/{id}/trigger.
      */
+    #[SkipAuthorizationCheck]
     public function trigger(string $id, Request $request): JsonResponse
     {
         $schedule  = $this->findSchedule($id);

package/server/src/Http/Controllers/Internal/v1/ManifestController.php

@@ -4,6 +4,7 @@ namespace Fleetbase\FleetOps\Http\Controllers\Internal\v1;
 
 use Fleetbase\FleetOps\Models\Manifest;
 use Fleetbase\FleetOps\Models\ManifestStop;
+use Fleetbase\FleetOps\Traits\AuthorizesMethods;
 use Fleetbase\Http\Controllers\Controller;
 use Illuminate\Http\JsonResponse;
 use Illuminate\Http\Request;
@@ -23,6 +24,20 @@ use Illuminate\Http\Request;
  */
 class ManifestController extends Controller
 {
+    use AuthorizesMethods;
+
+    public function __construct()
+    {
+        $this->authorizeMethods([
+            'index'      => 'list order',
+            'show'       => 'view order',
+            'cancel'     => 'cancel order',
+            'destroy'    => 'delete order',
+            'showStop'   => 'view order',
+            'updateStop' => 'update order',
+        ]);
+    }
+
     /**
      * List manifests for the current company.
      * Supports filtering by status, driver_id, vehicle_id, and scheduled_date.

package/server/src/Http/Controllers/Internal/v1/MetricsController.php

@@ -2,6 +2,7 @@
 
 namespace Fleetbase\FleetOps\Http\Controllers\Internal\v1;
 
+use Fleetbase\FleetOps\Support\Authorization;
 use Fleetbase\FleetOps\Support\Metrics;
 use Fleetbase\FleetOps\Support\Metrics\Registry;
 use Fleetbase\Http\Controllers\Controller;
@@ -10,6 +11,16 @@ use Illuminate\Support\Carbon;
 
 class MetricsController extends Controller
 {
+    public function __construct()
+    {
+        // Not a resource controller, so AuthorizationGuard cannot resolve a permission for it.
+        $this->middleware(function ($request, $next) {
+            Authorization::authorize('view analytics');
+
+            return $next($request);
+        });
+    }
+
     /**
      * Legacy bulk endpoint. Returns a flat map of slug → scalar value for the
      * requested period. Preserved for backward compat; the dashboard widgets

package/server/src/Http/Controllers/Internal/v1/NavigatorController.php

@@ -3,6 +3,7 @@
 namespace Fleetbase\FleetOps\Http\Controllers\Internal\v1;
 
 use Fleetbase\FleetOps\Support\Utils;
+use Fleetbase\FleetOps\Traits\AuthorizesMethods;
 use Fleetbase\Http\Controllers\Controller;
 use Fleetbase\Http\Resources\Organization;
 use Fleetbase\Models\ApiCredential;
@@ -15,6 +16,19 @@ use Illuminate\Support\Str;
 
 class NavigatorController extends Controller
 {
+    use AuthorizesMethods;
+    /**
+     * How long a Navigator link issued from the console stays valid.
+     */
+    public const LINK_TTL_MINUTES = 30;
+
+    public function __construct()
+    {
+        $this->authorizeMethods([
+            'getLinkAppUrl' => 'admin',
+        ]);
+    }
+
     /**
      * Redirects to the Fleetbase Navigator app using a deep link.
      * Automatically detects the platform (iOS or Android) and uses the correct URI scheme.
@@ -23,6 +37,12 @@ class NavigatorController extends Controller
      */
     public function linkApp(Request $request)
     {
+        // This route is opened from a phone without a console session, so it is
+        // authorised by the short-lived signature issued by getLinkAppUrl().
+        if (!$this->hasValidLinkSignature($request)) {
+            return response()->error('This Navigator link is invalid or has expired. Generate a new one from the console.', 403);
+        }
+
         $adminUser = $this->findAdminUser();
 
         if (!$adminUser || !$adminUser->company) {
@@ -67,8 +87,13 @@ class NavigatorController extends Controller
      */
     public function getLinkAppUrl()
     {
+        $expires = now()->addMinutes(static::LINK_TTL_MINUTES)->getTimestamp();
+
         return response()->json([
-            'linkUrl' => url('int/v1/fleet-ops/navigator/link-app'),
+            'linkUrl' => url('int/v1/fleet-ops/navigator/link-app') . '?' . http_build_query([
+                'expires'   => $expires,
+                'signature' => static::linkSignature($expires),
+            ]),
         ]);
     }
 
@@ -189,4 +214,20 @@ class NavigatorController extends Controller
     {
         return Setting::where('key', 'fleet-ops.driver-onboard')->value('value');
     }
+
+    /**
+     * HMAC signature for a Navigator link expiring at the given unix timestamp.
+     */
+    public static function linkSignature(int $expires): string
+    {
+        return hash_hmac('sha256', 'fleet-ops.navigator.link-app|' . $expires, (string) config('app.key'));
+    }
+
+    protected function hasValidLinkSignature(Request $request): bool
+    {
+        $expires   = (int) $request->query('expires');
+        $signature = (string) $request->query('signature');
+
+        return $signature !== '' && $expires >= time() && hash_equals(static::linkSignature($expires), $signature);
+    }
 }

package/server/src/Http/Controllers/Internal/v1/OrchestrationController.php

@@ -16,6 +16,7 @@ use Fleetbase\FleetOps\Models\Vendor;
 use Fleetbase\FleetOps\Orchestration\Engines\DriverAssignmentEngine;
 use Fleetbase\FleetOps\Orchestration\Engines\RouteSequencingEngine;
 use Fleetbase\FleetOps\Orchestration\OrchestrationEngineRegistry;
+use Fleetbase\FleetOps\Traits\AuthorizesMethods;
 use Fleetbase\Http\Controllers\Controller;
 use Fleetbase\Models\Setting;
 use Illuminate\Http\JsonResponse;
@@ -39,8 +40,19 @@ use Illuminate\Support\Str;
  */
 class OrchestrationController extends Controller
 {
+    use AuthorizesMethods;
+
     public function __construct(protected OrchestrationEngineRegistry $registry)
     {
+        $this->authorizeMethods([
+            'orders'                => 'list order',
+            'run'                   => 'optimize order',
+            'preview'               => 'list order',
+            'commit'                => 'assign-driver-for order',
+            'engines'               => 'list order',
+            'orderConfigFields'     => 'list order',
+            'importOrders'          => 'import order',
+        ]);
     }
 
     /**