@fleetbase/fleetops-engine 0.6.70 → 0.6.72

package/addon/utils/tracking-page-theme.js

@@ -0,0 +1,123 @@
+/**
+ * Colour tokens for the customer tracking page, derived from a company's one accent colour.
+ *
+ * The server sanitizes and checks the same values (TrackingPageConfig); this mirrors it so
+ * the settings preview and the page itself re-theme live without a round trip.
+ */
+export const DEFAULT_ACCENT = '#1F5FA8';
+export const LIGHT_INK = '#FFFFFF';
+export const DARK_INK = '#14191A';
+
+const LIGHT_BASE = {
+    bg: '#F3F4F1',
+    surface: '#FFFFFF',
+    surface2: '#ECEEEA',
+    text: '#14191A',
+    muted: '#545D5F',
+    border: '#D9DED9',
+    warn: '#A8430B',
+    'warn-soft': '#FBEADF',
+    neutral: '#5F686A',
+};
+
+const DARK_BASE = {
+    bg: '#0D1112',
+    surface: '#151A1B',
+    surface2: '#1D2324',
+    text: '#E9EDEA',
+    muted: '#A1ABAB',
+    border: '#2B3335',
+    warn: '#F2A262',
+    'warn-soft': '#3A2416',
+    neutral: '#8E9899',
+};
+
+/**
+ * `#RGB` or `#RRGGBB` as uppercase `#RRGGBB`, or null.
+ */
+export function normalizeHex(value) {
+    const match = typeof value === 'string' ? value.trim().match(/^#?([0-9a-f]{3}|[0-9a-f]{6})$/i) : null;
+    if (!match) {
+        return null;
+    }
+
+    let hex = match[1];
+    if (hex.length === 3) {
+        hex = hex.replace(/./g, (char) => char + char);
+    }
+
+    return `#${hex.toUpperCase()}`;
+}
+
+function channels(hex) {
+    const value = hex.replace('#', '');
+    return [0, 2, 4].map((offset) => parseInt(value.slice(offset, offset + 2), 16));
+}
+
+function luminance(hex) {
+    const [r, g, b] = channels(hex).map((channel) => {
+        const value = channel / 255;
+        return value <= 0.03928 ? value / 12.92 : Math.pow((value + 0.055) / 1.055, 2.4);
+    });
+
+    return 0.2126 * r + 0.7152 * g + 0.0722 * b;
+}
+
+/**
+ * The WCAG contrast ratio of two `#RRGGBB` colours, rounded to two decimals.
+ */
+export function contrastRatio(a, b) {
+    const lighter = Math.max(luminance(a), luminance(b));
+    const darker = Math.min(luminance(a), luminance(b));
+
+    return Math.round(((lighter + 0.05) / (darker + 0.05)) * 100) / 100;
+}
+
+/**
+ * The text colour readable on an accent: white when it reaches 4.5:1, otherwise dark.
+ */
+export function inkFor(accent) {
+    return contrastRatio(accent, LIGHT_INK) >= 4.5 ? LIGHT_INK : DARK_INK;
+}
+
+/**
+ * A lighter accent for dark mode: the accent mixed toward white until it reads on the dark surface.
+ */
+export function darkAccentFor(accent) {
+    const [r, g, b] = channels(accent);
+    for (let weight = 0.25; weight <= 0.85; weight += 0.05) {
+        const mixed = [r, g, b].map((channel) => Math.round(channel + (255 - channel) * weight));
+        const hex = `#${mixed.map((channel) => channel.toString(16).padStart(2, '0')).join('')}`.toUpperCase();
+        if (contrastRatio(hex, DARK_BASE.surface) >= 4.5) {
+            return hex;
+        }
+    }
+
+    return '#FFFFFF';
+}
+
+/**
+ * The CSS custom properties for a page in the given mode, as a style string.
+ *
+ * @param {Object}  branding the config's branding group
+ * @param {Boolean} dark     whether the page renders dark
+ */
+export default function trackingPageTheme(branding = {}, dark = false) {
+    const accent = normalizeHex(branding.accent) ?? DEFAULT_ACCENT;
+    const darkAccent = normalizeHex(branding.accent_dark) ?? darkAccentFor(accent);
+    const modeAccent = dark ? darkAccent : accent;
+    const base = dark ? DARK_BASE : LIGHT_BASE;
+    const tokens = {
+        ...base,
+        accent: modeAccent,
+        ink: inkFor(modeAccent),
+        'accent-soft': `color-mix(in oklab, ${modeAccent} 14%, ${base.surface})`,
+    };
+
+    const declarations = [`color-scheme: ${dark ? 'dark' : 'light'}`];
+    for (const name of Object.keys(tokens)) {
+        declarations.push(`--tp-${name}: ${tokens[name]}`);
+    }
+
+    return declarations.join('; ');
+}

package/app/components/admin/tracking-page-settings.js

@@ -0,0 +1 @@
+export { default } from '@fleetbase/fleetops-engine/components/admin/tracking-page-settings';

package/app/components/tracking-page/full-view.js

@@ -0,0 +1 @@
+export { default } from '@fleetbase/fleetops-engine/components/tracking-page/full-view';

package/app/components/tracking-page/locale-selector.js

@@ -0,0 +1 @@
+export { default } from '@fleetbase/fleetops-engine/components/tracking-page/locale-selector';

package/app/components/tracking-page/map.js

@@ -0,0 +1 @@
+export { default } from '@fleetbase/fleetops-engine/components/tracking-page/map';

package/app/components/tracking-page/order-list.js

@@ -0,0 +1 @@
+export { default } from '@fleetbase/fleetops-engine/components/tracking-page/order-list';

package/app/components/tracking-page/public-view.js

@@ -0,0 +1 @@
+export { default } from '@fleetbase/fleetops-engine/components/tracking-page/public-view';

package/app/components/tracking-page/settings-preview.js

@@ -0,0 +1 @@
+export { default } from '@fleetbase/fleetops-engine/components/tracking-page/settings-preview';

package/app/components/tracking-page/verify-panel.js

@@ -0,0 +1 @@
+export { default } from '@fleetbase/fleetops-engine/components/tracking-page/verify-panel';

package/app/components/tracking-page.js

@@ -0,0 +1 @@
+export { default } from '@fleetbase/fleetops-engine/components/tracking-page';

package/app/components/widget/proof-of-delivery.js

@@ -0,0 +1 @@
+export { default } from '@fleetbase/fleetops-engine/components/widget/proof-of-delivery';

package/app/controllers/settings/tracking-page.js

@@ -0,0 +1 @@
+export { default } from '@fleetbase/fleetops-engine/controllers/settings/tracking-page';

package/app/helpers/parcel-box-image.js

@@ -0,0 +1 @@
+export { default } from '@fleetbase/fleetops-engine/helpers/parcel-box-image';

package/app/routes/settings/tracking-page.js

@@ -0,0 +1 @@
+export { default } from '@fleetbase/fleetops-engine/routes/settings/tracking-page';

package/app/services/order-presentation.js

@@ -0,0 +1 @@
+export { default } from '@fleetbase/fleetops-engine/services/order-presentation';

package/app/templates/settings/tracking-page.js

@@ -0,0 +1 @@
+export { default } from '@fleetbase/fleetops-engine/templates/settings/tracking-page';

package/app/utils/map-default-view.js

@@ -0,0 +1 @@
+export * from '@fleetbase/fleetops-engine/utils/map-default-view';

package/app/utils/tracking-live-source.js

@@ -0,0 +1 @@
+export { default, decodePolyline, ACTIVE_INTERVAL, IDLE_INTERVAL, MAX_BACKOFF } from '@fleetbase/fleetops-engine/utils/tracking-live-source';

package/app/utils/tracking-page-theme.js

@@ -0,0 +1 @@
+export { default, normalizeHex, contrastRatio, inkFor, darkAccentFor, DEFAULT_ACCENT, LIGHT_INK, DARK_INK } from '@fleetbase/fleetops-engine/utils/tracking-page-theme';

package/composer.json

@@ -1,6 +1,6 @@
 {
     "name": "fleetbase/fleetops-api",
-    "version": "0.6.70",
+    "version": "0.6.72",
     "description": "Fleet & Transport Management Extension for Fleetbase",
     "keywords": [
         "fleetbase-extension",
@@ -25,7 +25,7 @@
         "barryvdh/laravel-dompdf": "^3.1",
         "brick/geo": "0.7.2",
         "cknow/laravel-money": "^7.1",
-        "fleetbase/core-api": ">=1.6.65",
+        "fleetbase/core-api": "^1.6.69",
         "geocoder-php/google-maps-places-provider": "^1.4",
         "giggsey/libphonenumber-for-php": "^8.13",
         "league/geotools": "^1.1.0",

package/extension.json

@@ -1,6 +1,6 @@
 {
     "name": "Fleet-Ops",
-    "version": "0.6.70",
+    "version": "0.6.72",
     "description": "Fleet & Transport Management Extension for Fleetbase",
     "repository": "https://github.com/fleetbase/fleetops",
     "license": "AGPL-3.0-or-later",

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@fleetbase/fleetops-engine",
-    "version": "0.6.70",
+    "version": "0.6.72",
     "description": "Fleet & Transport Management Extension for Fleetbase",
     "fleetbase": {
         "route": "fleet-ops"
@@ -44,9 +44,9 @@
     },
     "dependencies": {
         "@babel/core": "^7.23.2",
-        "@fleetbase/ember-core": "^0.3.24",
-        "@fleetbase/ember-ui": "^0.4.3",
-        "@fleetbase/fleetops-data": "^0.2.2",
+        "@fleetbase/ember-core": "^0.3.26",
+        "@fleetbase/ember-ui": "^0.4.6",
+        "@fleetbase/fleetops-data": "^0.2.3",
         "@fleetbase/leaflet-routing-machine": "^3.2.17",
         "@fortawesome/ember-fontawesome": "^2.0.0",
         "@fortawesome/fontawesome-svg-core": "6.4.0",

package/scripts/pest-bootstrap.php

@@ -53,6 +53,10 @@ if (class_exists('Illuminate\Container\Container') && class_exists('Illuminate\S
             'fleetops'   => [],
             'services'   => [],
             'telematics' => [],
+            // The core SMS guard is off unless a test turns it on: its counters live in the
+            // shared cache, so one file's sends would otherwise rate-limit the next's, and
+            // a second text to the same number inside a test trips its cooldown.
+            'sms'        => ['guard' => ['enabled' => false]],
         ]));
     }
 

package/server/config/fleetops.php

@@ -88,6 +88,10 @@ return [
         'route_cache_ttl_seconds'          => env('TRACKING_ROUTE_CACHE_TTL_SECONDS', 600),
         'stale_location_threshold_seconds' => env('TRACKING_STALE_LOCATION_THRESHOLD_SECONDS', 300),
         'default_vehicle_speed_kph'        => env('TRACKING_DEFAULT_VEHICLE_SPEED_KPH', 35),
+        // The public tracking page's device-session cookie. `lax` suits a console and API on
+        // the same site (console.example.com and api.example.com); use `none` (sent only over
+        // HTTPS) when they are on different domains.
+        'cookie_same_site'                 => env('TRACKING_COOKIE_SAME_SITE', 'lax'),
     ],
 
     /*

package/server/migrations/2026_10_08_000001_create_tracking_sessions_tables.php

@@ -0,0 +1,51 @@
+<?php
+
+use Illuminate\Database\Migrations\Migration;
+use Illuminate\Database\Schema\Blueprint;
+use Illuminate\Support\Facades\Schema;
+
+/**
+ * Device sessions for the public customer tracking page.
+ *
+ * A visitor who enters a correct one-time code gets a device session, carried in an
+ * httpOnly cookie whose value is never stored: `token_hash` is its SHA-256. Each session
+ * holds grants, one per customer within an order (the TrackingScope), so verifying for one
+ * delivery never unlocks another and one customer never sees another's stops.
+ */
+return new class extends Migration {
+    public function up(): void
+    {
+        Schema::create('tracking_sessions', function (Blueprint $table) {
+            $table->increments('id');
+            $table->uuid('uuid')->unique();
+            $table->string('token_hash', 64)->unique();
+            $table->string('ip', 64)->nullable();
+            $table->string('user_agent', 255)->nullable();
+            $table->timestamp('last_seen_at')->nullable();
+            $table->timestamp('expires_at')->nullable()->index();
+            $table->timestamp('revoked_at')->nullable();
+            $table->timestamps();
+        });
+
+        Schema::create('tracking_session_grants', function (Blueprint $table) {
+            $table->increments('id');
+            $table->uuid('uuid')->unique();
+            $table->uuid('tracking_session_uuid')->index();
+            $table->uuid('company_uuid')->nullable()->index();
+            $table->uuid('order_uuid');
+            $table->string('customer_type');
+            $table->uuid('customer_uuid');
+            $table->string('channel', 16)->nullable();
+            $table->timestamp('expires_at')->nullable()->index();
+            $table->timestamps();
+
+            $table->index(['tracking_session_uuid', 'order_uuid', 'customer_uuid'], 'tracking_session_grants_scope_index');
+        });
+    }
+
+    public function down(): void
+    {
+        Schema::dropIfExists('tracking_session_grants');
+        Schema::dropIfExists('tracking_sessions');
+    }
+};

package/server/migrations/2026_10_10_000001_add_trashed_index_to_device_events.php

@@ -0,0 +1,40 @@
+<?php
+
+use Fleetbase\FleetOps\Support\Database\TableIndexes;
+use Illuminate\Database\Migrations\Migration;
+use Illuminate\Database\Schema\Blueprint;
+use Illuminate\Support\Facades\Schema;
+
+/**
+ * fleetops:prune-telematics-data purges soft-deleted rows on every run; without an
+ * index on deleted_at that sweep walks the whole table even when nothing is trashed.
+ */
+return new class extends Migration {
+    private const TABLE   = 'device_events';
+    private const INDEX   = 'device_events_company_deleted_at_index';
+    private const COLUMNS = ['company_uuid', 'deleted_at'];
+
+    public function up(): void
+    {
+        if (!Schema::hasTable(self::TABLE) || !Schema::hasColumns(self::TABLE, self::COLUMNS)) {
+            return;
+        }
+
+        if (TableIndexes::covers(self::TABLE, self::COLUMNS)) {
+            return;
+        }
+
+        Schema::table(self::TABLE, fn (Blueprint $table) => $table->index(self::COLUMNS, self::INDEX));
+    }
+
+    public function down(): void
+    {
+        if (!Schema::hasTable(self::TABLE)) {
+            return;
+        }
+
+        if ((TableIndexes::for(self::TABLE)[self::INDEX] ?? null) === self::COLUMNS) {
+            Schema::table(self::TABLE, fn (Blueprint $table) => $table->dropIndex(self::INDEX));
+        }
+    }
+};

package/server/migrations/2026_10_10_000002_add_trashed_index_to_positions.php

@@ -0,0 +1,40 @@
+<?php
+
+use Fleetbase\FleetOps\Support\Database\TableIndexes;
+use Illuminate\Database\Migrations\Migration;
+use Illuminate\Database\Schema\Blueprint;
+use Illuminate\Support\Facades\Schema;
+
+/**
+ * fleetops:prune-telematics-data purges soft-deleted rows on every run; without an
+ * index on deleted_at that sweep walks the whole table even when nothing is trashed.
+ */
+return new class extends Migration {
+    private const TABLE   = 'positions';
+    private const INDEX   = 'positions_company_deleted_at_index';
+    private const COLUMNS = ['company_uuid', 'deleted_at'];
+
+    public function up(): void
+    {
+        if (!Schema::hasTable(self::TABLE) || !Schema::hasColumns(self::TABLE, self::COLUMNS)) {
+            return;
+        }
+
+        if (TableIndexes::covers(self::TABLE, self::COLUMNS)) {
+            return;
+        }
+
+        Schema::table(self::TABLE, fn (Blueprint $table) => $table->index(self::COLUMNS, self::INDEX));
+    }
+
+    public function down(): void
+    {
+        if (!Schema::hasTable(self::TABLE)) {
+            return;
+        }
+
+        if ((TableIndexes::for(self::TABLE)[self::INDEX] ?? null) === self::COLUMNS) {
+            Schema::table(self::TABLE, fn (Blueprint $table) => $table->dropIndex(self::INDEX));
+        }
+    }
+};

package/server/migrations/2026_10_12_000001_add_deleted_at_to_tracking_sessions_tables.php

@@ -0,0 +1,32 @@
+<?php
+
+use Illuminate\Database\Migrations\Migration;
+use Illuminate\Database\Schema\Blueprint;
+use Illuminate\Support\Facades\Schema;
+
+/**
+ * TrackingSession and TrackingSessionGrant extend Fleetbase\Models\Model, which soft
+ * deletes, so every query on them reads `deleted_at`. The tables were created without
+ * it, which made each session and grant lookup fail and no visitor could verify.
+ */
+return new class extends Migration {
+    private const TABLES = ['tracking_sessions', 'tracking_session_grants'];
+
+    public function up(): void
+    {
+        foreach (self::TABLES as $table) {
+            if (Schema::hasTable($table) && !Schema::hasColumn($table, 'deleted_at')) {
+                Schema::table($table, fn (Blueprint $blueprint) => $blueprint->softDeletes());
+            }
+        }
+    }
+
+    public function down(): void
+    {
+        foreach (self::TABLES as $table) {
+            if (Schema::hasTable($table) && Schema::hasColumn($table, 'deleted_at')) {
+                Schema::table($table, fn (Blueprint $blueprint) => $blueprint->dropSoftDeletes());
+            }
+        }
+    }
+};

package/server/resources/views/labels/default.php

@@ -53,7 +53,7 @@ use Fleetbase\Support\Utils;
 	<div style="width: 420px; border: 2px #414141 solid; margin: auto;">
 		<div class="group" style="border-bottom: 1px #414141 solid; overflow: hidden;">
 			<div style="float: left; width: 130px; height: 120px; border-right: 1px #414141 solid; text-align: center; padding: 10px; box-sizing: border-box;">
-				<img src="data:image/png;base64,<?php echo Utils::notEmpty($trackingNumber) ? $trackingNumber->qr_code : $order->trackingNumber->qr_code; ?>" style="width: 100%; height: 100%; object-fit: cover;">
+				<img src="data:image/png;base64,<?php echo Utils::notEmpty($trackingNumber) ? $trackingNumber->qr_code : $order->trackingNumber->qr_code; ?>" style="width: 100px; height: 100px;">
 			</div>
 			<div style="margin-top: 10px; padding-left: 10px;">
 				<div style="font-size: 18px; font-weight: bold;"><?php echo e($company->name); ?></div>
@@ -185,7 +185,7 @@ use Fleetbase\Support\Utils;
 		<?php } ?>
 		<div class="group">
 			<div style="text-align: center; padding: 15px 0px; border-top: 1px #414141 solid;">
-				<img src="data:image/png;base64,<?php echo isset($trackingNumber) ? $trackingNumber->barcode : $order->trackingNumber->barcode; ?>" style="height: 90px; margin-top: 10px;">
+				<img src="data:image/png;base64,<?php echo isset($trackingNumber) ? $trackingNumber->barcode : $order->trackingNumber->barcode; ?>" style="max-width: 360px; max-height: 90px; margin-top: 10px;">
 				<div><?php echo e(strtoupper(isset($trackingNumber) ? $trackingNumber->tracking_number : $order->trackingNumber->tracking_number)); ?></div>
 			</div>
 		</div>

package/server/resources/views/labels/entity-label.php

@@ -45,7 +45,7 @@ use Fleetbase\Support\Utils;
     <div style="width: 420px; border: 2px #414141 solid; margin: auto;">
         <div class="group" style="border-bottom: 1px #414141 solid; overflow: hidden;">
             <div style="float: left; width: 130px; height: 120px; border-right: 1px #414141 solid; text-align: center; padding: 10px; box-sizing: border-box;">
-                <img src="data:image/png;base64,<?= Utils::notEmpty($trackingNumber) ? $trackingNumber->qr_code : $entity->qr_code ?>" style="width: 100%; height: 100%; object-fit: cover;">
+                <img src="data:image/png;base64,<?= Utils::notEmpty($trackingNumber) ? $trackingNumber->qr_code : $entity->qr_code ?>" style="width: 100px; height: 100px;">
             </div>
             <div style="margin-top: 10px;">
                 <span style="padding-left: 10px; font-size: 18px; font-weight: bold;"><?= strtoupper($company->name) ?></span>
@@ -114,7 +114,7 @@ use Fleetbase\Support\Utils;
         <?php } ?>
         <div class="group">
             <div style="text-align: center; padding: 15px 0px; border-top: 1px #414141 solid;">
-                <img src="data:image/png;base64,<?= isset($trackingNumber) ? $trackingNumber->barcode : $entity->barcode ?>" style="height: 90px; margin-top: 10px;">
+                <img src="data:image/png;base64,<?= isset($trackingNumber) ? $trackingNumber->barcode : $entity->barcode ?>" style="max-width: 360px; max-height: 90px; margin-top: 10px;">
                 <div><?= strtoupper(isset($trackingNumber) ? $trackingNumber->tracking_number : $entity->public_id) ?></div>
             </div>
         </div>

package/server/resources/views/labels/waypoint-label.php

@@ -52,7 +52,7 @@ use Fleetbase\Support\Utils;
     <div style="width: 420px; border: 2px #414141 solid; margin: auto;">
         <div class="group" style="border-bottom: 1px #414141 solid; overflow: hidden;">
             <div style="float: left; width: 130px; height: 120px; border-right: 1px #414141 solid; text-align: center; padding: 10px; box-sizing: border-box;">
-                <img src="data:image/png;base64,<?php echo Utils::notEmpty($trackingNumber) ? $trackingNumber->qr_code : $order->trackingNumber->qr_code; ?>" style="width: 100%; height: 100%; object-fit: cover;">
+                <img src="data:image/png;base64,<?php echo Utils::notEmpty($trackingNumber) ? $trackingNumber->qr_code : $order->trackingNumber->qr_code; ?>" style="width: 100px; height: 100px;">
             </div>
             <div style="margin-top: 10px;">
                 <span style="padding-left: 10px; font-size: 18px; font-weight: bold;"><?php echo e($company->name); ?></span>
@@ -123,7 +123,7 @@ use Fleetbase\Support\Utils;
         <?php } ?>
         <div class="group">
             <div style="text-align: center; padding: 15px 0px; border-top: 1px #414141 solid;">
-                <img src="data:image/png;base64,<?php echo isset($trackingNumber) ? $trackingNumber->barcode : $order->trackingNumber->barcode; ?>" style="height: 90px; margin-top: 10px;">
+                <img src="data:image/png;base64,<?php echo isset($trackingNumber) ? $trackingNumber->barcode : $order->trackingNumber->barcode; ?>" style="max-width: 360px; max-height: 90px; margin-top: 10px;">
                 <div><?php echo e(strtoupper(isset($trackingNumber) ? $trackingNumber->tracking_number : $order->trackingNumber->tracking_number)); ?></div>
             </div>
         </div>

package/server/src/Auth/Schemas/FleetOps.php

@@ -229,6 +229,11 @@ class FleetOps
             'actions'        => [],
             'remove_actions' => ['delete', 'export', 'create'],
         ],
+        [
+            'name'           => 'tracking-page-settings', // the customer tracking page: branding, access and what verified visitors see
+            'actions'        => [],
+            'remove_actions' => ['delete', 'export', 'create'],
+        ],
         [
             'name'           => 'telematics-settings', // organization device event and position history preferences
             'action'         => [],

package/server/src/Console/Commands/ProcessOperationalAlerts.php

@@ -189,6 +189,7 @@ class ProcessOperationalAlerts extends Command
                 'context'     => $context,
             ]);
             $order->saveQuietly();
+            $order->invalidateApiCache();
         }
 
         return true;