@fleetbase/fleetops-engine 0.6.69 → 0.6.71

package/server/src/Http/Controllers/Internal/v1/OrderController.php

@@ -2,6 +2,7 @@
 
 namespace Fleetbase\FleetOps\Http\Controllers\Internal\v1;
 
+use Fleetbase\Attributes\SkipAuthorizationCheck;
 use Fleetbase\Exceptions\FleetbaseRequestValidationException;
 use Fleetbase\FleetOps\Events\EntityActivityChanged;
 use Fleetbase\FleetOps\Events\EntityCompleted;
@@ -53,6 +54,20 @@ use Maatwebsite\Excel\Facades\Excel;
 class OrderController extends FleetOpsController
 {
     use ResolvesOrderServiceStops;
+    /**
+     * Permissions for methods AuthorizationGuard cannot map to a schema action (see FleetOpsController).
+     *
+     * @var array<string, string|string[]>
+     */
+    protected array $methodPermissions = [
+        'editOrderRoute'   => 'update-route-for order',
+        'importFromFiles'  => 'import order',
+        'bulkCancel'       => 'cancel order',
+        'bulkDispatch'     => 'dispatch order',
+        'bulkAssignDriver' => 'assign-driver-for order',
+        'dispatchOrder'    => 'dispatch order',
+        'scheduleOrder'    => 'schedule order',
+    ];
 
     /**
      * The resource to query.
@@ -148,8 +163,15 @@ class OrderController extends FleetOpsController
                         $input['type'] = 'transport';
                     }
 
+                    // a configured lifecycle always starts at its initial activity; otherwise
                     // if no status is set its default to `created`
-                    if (!isset($input['status'])) {
+                    if ($resolvedOrderConfig && $resolvedOrderConfig->hasConfiguredLifecycle()) {
+                        $input['status'] = $resolvedOrderConfig->getInitialStatusCode();
+                        if (!$resolvedOrderConfig->allowsDispatch()) {
+                            $input['dispatched'] = false;
+                            $input['adhoc']      = false;
+                        }
+                    } elseif (!isset($input['status'])) {
                         $input['status'] = 'created';
                     }
 
@@ -170,11 +192,13 @@ class OrderController extends FleetOpsController
                     $entities            = Utils::get($input, 'payload.entities');
                     $uploads             = Utils::get($input, 'files', []);
                     $customFieldValues   = Utils::get($input, 'custom_field_values', []);
+                    $orderConfig         = $order->config();
+                    $hasLifecycle        = $orderConfig && $orderConfig->hasConfiguredLifecycle();
 
                     // save order route & payload with request input
                     $order
                         ->setRoute($route)
-                        ->setStatus('created', false)
+                        ->setStatus($hasLifecycle ? $orderConfig->getInitialStatusCode() : 'created', false)
                         ->insertPayload($payload)
                         ->insertWaypoints($waypoints)
                         ->insertEntities($entities);
@@ -197,8 +221,12 @@ class OrderController extends FleetOpsController
                         );
                     }
 
-                    // Check dispatch flag with backward compatibility (default true)
+                    // Check dispatch flag with backward compatibility (default true).
+                    // Configs with a lifecycle that disables dispatch are never dispatched.
                     $shouldDispatch = isset($input['dispatched']) ? (bool) $input['dispatched'] : true;
+                    if ($hasLifecycle && !$orderConfig->allowsDispatch()) {
+                        $shouldDispatch = false;
+                    }
 
                     // dispatch if flagged true, otherwise ensure order stays in created state
                     if ($shouldDispatch) {
@@ -267,6 +295,7 @@ class OrderController extends FleetOpsController
      *
      * @return Response
      */
+    #[SkipAuthorizationCheck]
     public function editOrderRoute(string $id, Request $request)
     {
         $pickup            = $request->input('pickup');
@@ -337,6 +366,7 @@ class OrderController extends FleetOpsController
      *
      * @return \Illuminate\Http\Response
      */
+    #[SkipAuthorizationCheck]
     public function importFromFiles(Request $request)
     {
         $info    = Utils::lookupIp();
@@ -409,6 +439,7 @@ class OrderController extends FleetOpsController
      *
      * @return \Illuminate\Http\Response
      */
+    #[SkipAuthorizationCheck]
     public function bulkCancel(Request $request)
     {
         $request->validate([
@@ -454,6 +485,7 @@ class OrderController extends FleetOpsController
      *
      * @return \Illuminate\Http\Response
      */
+    #[SkipAuthorizationCheck]
     public function bulkDispatch(BulkDispatchRequest $request)
     {
         /** @var Order */
@@ -464,7 +496,7 @@ class OrderController extends FleetOpsController
         $successful = [];
 
         foreach ($orders as $order) {
-            if ($order->status !== 'created') {
+            if ($order->status !== 'created' || $order->config()?->allowsDispatch() === false) {
                 $failed[] = $order->uuid;
                 continue;
             }
@@ -502,6 +534,7 @@ class OrderController extends FleetOpsController
      *
      * @return \Illuminate\Http\Response
      */
+    #[SkipAuthorizationCheck]
     public function bulkAssignDriver(Request $request)
     {
         // Validate Inputs
@@ -578,6 +611,7 @@ class OrderController extends FleetOpsController
      *
      * @return \Illuminate\Http\Response
      */
+    #[SkipAuthorizationCheck]
     public function dispatchOrder(Request $request)
     {
         /**
@@ -594,6 +628,10 @@ class OrderController extends FleetOpsController
             return $this->errorResponse('No order config found for dispatch.');
         }
 
+        if (!$order->config()->allowsDispatch()) {
+            return $this->errorResponse('Orders of this type are not dispatched.');
+        }
+
         if (!$order->hasDriverAssigned && !$order->adhoc) {
             return $this->errorResponse('No driver assigned to dispatch!');
         }
@@ -879,6 +917,19 @@ class OrderController extends FleetOpsController
         $activity    = $request->array('activity');
         $activity    = new Activity($activity, $order->getConfigFlow());
 
+        // Configs with strict transitions only accept a configured child of the current
+        // activity, and the server-side activity definition replaces the client payload.
+        $orderConfig = $order->config();
+        if ($orderConfig && $orderConfig->hasStrictTransitions()) {
+            $targetCode = $activity->get('code');
+            $configured = $targetCode ? $orderConfig->getActivityByCode($targetCode) : null;
+            if (!$configured || !$orderConfig->canTransition($order->status, $targetCode)) {
+                return response()->error('This activity is not a permitted next step for the order.', 422);
+            }
+
+            $activity = $configured;
+        }
+
         $requiresProof = Utils::isActivity($activity)
             && ($activity->get('require_pod') || ($activity->completesOrder() && $order->pod_required));
         if ($requiresProof && !$proof && !$bypassProof) {
@@ -1906,6 +1957,7 @@ class OrderController extends FleetOpsController
      *
      * @return \Illuminate\Http\Response
      */
+    #[SkipAuthorizationCheck]
     public function scheduleOrder(Request $request)
     {
         $orderId     = $request->input('order');

package/server/src/Http/Controllers/Internal/v1/PaymentController.php

@@ -4,6 +4,7 @@ namespace Fleetbase\FleetOps\Http\Controllers\Internal\v1;
 
 use Fleetbase\FleetOps\Models\PurchaseRate;
 use Fleetbase\FleetOps\Support\Payment;
+use Fleetbase\FleetOps\Traits\AuthorizesMethods;
 use Fleetbase\Http\Controllers\Controller;
 use Fleetbase\Http\Resources\FleetbaseResource;
 use Fleetbase\Support\Auth;
@@ -12,6 +13,18 @@ use Illuminate\Support\Str;
 
 class PaymentController extends Controller
 {
+    use AuthorizesMethods;
+
+    public function __construct()
+    {
+        $this->authorizeMethods([
+            'hasStripeConnectAccount'        => 'view payments',
+            'getStripeAccount'               => 'onboard payments',
+            'getStripeAccountSession'        => 'onboard payments',
+            'getCompanyReceivedPayments'     => 'view payments',
+        ]);
+    }
+
     /**
      * Checks if the currently authenticated company has an associated Stripe Connect account.
      *

package/server/src/Http/Controllers/Internal/v1/RadarController.php

@@ -19,6 +19,7 @@ use Fleetbase\FleetOps\Support\Radar\RadarAgenda;
 use Fleetbase\FleetOps\Support\Radar\RadarBriefing;
 use Fleetbase\FleetOps\Support\Radar\RadarItemState;
 use Fleetbase\FleetOps\Support\Radar\RadarRules;
+use Fleetbase\FleetOps\Traits\AuthorizesMethods;
 use Fleetbase\Http\Controllers\Controller;
 use Fleetbase\Models\Alert;
 use Fleetbase\Models\CompanyUser;
@@ -42,6 +43,24 @@ use Illuminate\Support\Carbon;
  */
 class RadarController extends Controller
 {
+    use AuthorizesMethods;
+
+    public function __construct()
+    {
+        $this->authorizeMethods([
+            'extendShift'       => ['update driver', 'update vehicle'],
+            'acknowledge'       => ['update driver', 'update vehicle'],
+            'snooze'            => ['update driver', 'update vehicle'],
+            'wake'              => ['update driver', 'update vehicle'],
+            'assign'            => ['update driver', 'update vehicle'],
+            'plan'              => ['update driver', 'update vehicle'],
+            'resolve'           => ['update driver', 'update vehicle'],
+            'bulk'              => ['update driver', 'update vehicle'],
+            'storeNotice'       => ['update driver', 'update vehicle'],
+            'destroyNotice'     => ['update driver', 'update vehicle'],
+        ]);
+    }
+
     public const RESOLVED_WINDOW_DAYS = 7;
     public const SNOOZE_MAX_DAYS      = 90;
 

package/server/src/Http/Controllers/Internal/v1/ServiceAreaController.php

@@ -7,6 +7,7 @@ use Fleetbase\FleetOps\Http\Controllers\FleetOpsController;
 use Fleetbase\FleetOps\Models\ServiceArea;
 use Fleetbase\Http\Requests\ExportRequest;
 use Illuminate\Http\Request;
+use Illuminate\Support\Arr;
 use Illuminate\Support\Str;
 use Maatwebsite\Excel\Facades\Excel;
 
@@ -21,11 +22,16 @@ class ServiceAreaController extends FleetOpsController
 
     /**
      * Handle post save transactions.
+     *
+     * Reads the custom field values from the payload the base controller already extracted
+     * rather than from the raw request: Ember Data sends the resource under a camelCase root
+     * (`serviceArea`), so `$request->array('service_area.custom_field_values')` was always empty and no
+     * custom field value was ever persisted for this resource.
      */
-    public function afterSave(Request $request, ServiceArea $serviceArea)
+    public function afterSave(Request $request, ServiceArea $serviceArea, array $input = [])
     {
-        $customFieldValues = $request->array('service_area.custom_field_values');
-        if ($customFieldValues) {
+        $customFieldValues = Arr::get($input, 'custom_field_values');
+        if (is_array($customFieldValues) && $customFieldValues) {
             $serviceArea->syncCustomFieldValues($customFieldValues);
         }
     }