@fleetbase/fleetops-engine 0.6.70 → 0.6.72

package/server/src/Http/Controllers/Api/v1/OrderController.php

@@ -5,6 +5,7 @@ namespace Fleetbase\FleetOps\Http\Controllers\Api\v1;
 use Fleetbase\FleetOps\Events\OrderDispatchFailed;
 use Fleetbase\FleetOps\Events\OrderStarted;
 use Fleetbase\FleetOps\Exceptions\CustomerUserConflictException;
+use Fleetbase\FleetOps\Exceptions\OrderEditLockedException;
 use Fleetbase\FleetOps\Exceptions\UserAlreadyExistsException;
 use Fleetbase\FleetOps\Flow\Activity;
 use Fleetbase\FleetOps\Http\Requests\CreateOrderRequest;
@@ -24,7 +25,9 @@ use Fleetbase\FleetOps\Models\Place;
 use Fleetbase\FleetOps\Models\Proof;
 use Fleetbase\FleetOps\Models\ServiceQuote;
 use Fleetbase\FleetOps\Models\Waypoint;
+use Fleetbase\FleetOps\Support\OrderEdit;
 use Fleetbase\FleetOps\Support\ResolvesOrderServiceStops;
+use Fleetbase\FleetOps\Support\TrackingCode;
 use Fleetbase\FleetOps\Support\Utils;
 use Fleetbase\Http\Controllers\Controller;
 use Fleetbase\Http\Resources\Comment as CommentResource;
@@ -352,6 +355,19 @@ class OrderController extends Controller
         // get request input
         $input = $this->orderUpdateInputFromRequest($request);
 
+        // `entities_mode=replace` makes the entities sent the payload's full list
+        // (update by id, create new, delete missing); by default they are appended
+        $entitiesMode = OrderEdit::entitiesMode($request->input('entities_mode', $request->input('payload.entities_mode')));
+        $codAmount    = $this->codAmountFromRequest($request);
+
+        // refuse changes the order's status locks before anything is written
+        $edit = $this->beginOrderEdit($order);
+        try {
+            $edit->guard($edit->requestedChanges($this->orderEditInputFromRequest($request, $codAmount), $entitiesMode));
+        } catch (OrderEditLockedException $exception) {
+            return $this->lockedEditResponse($exception);
+        }
+
         // update payload if new input or change payload by id
         if ($request->isArray('payload')) {
             $payload = data_get($order, 'payload', $this->newPayload());
@@ -383,6 +399,10 @@ class OrderController extends Controller
                 $payload->setReturn($return);
             }
 
+            if ($codAmount !== null) {
+                $payload->cod_amount = $codAmount;
+            }
+
             $payload->save();
 
             // set waypoints and entities after payload is saved
@@ -392,14 +412,10 @@ class OrderController extends Controller
                 $payload->removeWaypoints();
             }
 
-            if ($entities) {
-                $payload->setEntities($entities);
-            }
+            $this->applyPayloadEntities($payload, $entities, $entitiesMode);
 
-            $firstWaypoint = $payload->getPickupOrFirstWaypoint();
-            if ($firstWaypoint instanceof Place) {
-                $payload->setCurrentWaypoint($firstWaypoint);
-            }
+            // the current waypoint is reconciled once the edit is committed: it is only
+            // moved when the route changed, and an order under way keeps its stop
 
             $input['payload_uuid'] = $payload->uuid;
         } elseif ($request->has('payload')) {
@@ -408,6 +424,11 @@ class OrderController extends Controller
                 'company_uuid' => $this->sessionCompany(),
             ]);
             unset($input['payload']);
+
+            if ($codAmount !== null && is_string($input['payload_uuid']) && ($switchedPayload = $this->findPayloadByUuid($input['payload_uuid']))) {
+                $switchedPayload->cod_amount = $codAmount;
+                $switchedPayload->save();
+            }
         }
 
         // create a payload if missing payload[] but has pickup/dropoff/etc
@@ -441,6 +462,10 @@ class OrderController extends Controller
                 $payload->setReturn($return);
             }
 
+            if ($codAmount !== null) {
+                $payload->cod_amount = $codAmount;
+            }
+
             $payload->save();
 
             // set waypoints and entities after payload is saved
@@ -450,14 +475,10 @@ class OrderController extends Controller
                 $payload->removeWaypoints();
             }
 
-            if ($entities) {
-                $payload->setEntities($entities);
-            }
+            $this->applyPayloadEntities($payload, $entities, $entitiesMode);
 
-            $firstWaypoint = $payload->getPickupOrFirstWaypoint();
-            if ($firstWaypoint instanceof Place) {
-                $payload->setCurrentWaypoint($firstWaypoint);
-            }
+            // the current waypoint is reconciled once the edit is committed: it is only
+            // moved when the route changed, and an order under way keeps its stop
 
             $input['payload_uuid'] = $payload->uuid;
         }
@@ -537,6 +558,10 @@ class OrderController extends Controller
         $order->update($input);
         $order->flushAttributesCache();
 
+        // reroute, recompute distance and time, republish tracking and announce
+        // `order.changed` for whatever this update changed
+        $this->commitOrderEdit($edit);
+
         // load required relations
         $order->load(['trackingNumber', 'trackingStatuses', 'driverAssigned', 'vehicleAssigned', 'purchaseRate.serviceQuote.items', 'customer', 'facilitator']);
 
@@ -544,6 +569,79 @@ class OrderController extends Controller
         return $this->orderResource($order);
     }
 
+    /**
+     * The cash to collect sent with an order update, as `payload.cod_amount` or a
+     * top-level `cod_amount`. Zero is a valid amount; anything not numeric is ignored.
+     */
+    protected function codAmountFromRequest(Request $request): int|float|string|null
+    {
+        $value = null;
+        if ($request->isArray('payload') && Arr::has((array) $request->input('payload'), 'cod_amount')) {
+            $value = data_get($request->input('payload'), 'cod_amount');
+        } elseif ($request->has('cod_amount')) {
+            $value = $request->input('cod_amount');
+        }
+
+        return is_numeric($value) ? $value : null;
+    }
+
+    /**
+     * The parts of an order update the edit policy looks at.
+     */
+    protected function orderEditInputFromRequest(Request $request, mixed $codAmount = null): array
+    {
+        $routeKeys = ['pickup', 'dropoff', 'return', 'waypoints', 'entities'];
+
+        if ($request->isArray('payload')) {
+            $edit = Arr::only((array) $request->input('payload'), $routeKeys);
+        } elseif ($request->has('payload')) {
+            // switching to another payload replaces the whole route
+            $edit = ['pickup' => true, 'dropoff' => true, 'waypoints' => true];
+        } else {
+            $edit = $request->only($routeKeys);
+        }
+
+        foreach (['scheduled_at', 'notes', 'customer'] as $key) {
+            if ($request->has($key)) {
+                $edit[$key] = $request->input($key);
+            }
+        }
+
+        if ($codAmount !== null) {
+            $edit['cod_amount'] = $codAmount;
+        }
+
+        return $edit;
+    }
+
+    protected function applyPayloadEntities(Payload $payload, mixed $entities, string $mode): void
+    {
+        if ($mode === OrderEdit::ENTITIES_REPLACE && is_array($entities)) {
+            $payload->syncEntities($entities);
+
+            return;
+        }
+
+        if ($entities) {
+            $payload->setEntities($entities);
+        }
+    }
+
+    protected function beginOrderEdit(Order $order): OrderEdit
+    {
+        return OrderEdit::begin($order);
+    }
+
+    protected function commitOrderEdit(OrderEdit $edit): array
+    {
+        return $edit->commit();
+    }
+
+    protected function lockedEditResponse(OrderEditLockedException $exception)
+    {
+        return response()->apiError($exception->getMessage(), 422, $exception->toResponseData());
+    }
+
     protected function orderCreateInputFromRequest(Request $request): array
     {
         return $request->only([
@@ -631,24 +729,6 @@ class OrderController extends Controller
                 });
             }
 
-            if ($request->has('facilitator')) {
-                $query->whereHas('facilitator', function ($q) use ($request) {
-                    $q->where(function ($q) use ($request) {
-                        $q->where('public_id', $request->input('facilitator'));
-                        $q->orWhere('internal_id', $request->input('facilitator'));
-                    });
-                });
-            }
-
-            if ($request->has('customer')) {
-                $query->whereHas('customer', function ($q) use ($request) {
-                    $q->where(function ($q) use ($request) {
-                        $q->where('public_id', $request->input('customer'));
-                        $q->orWhere('internal_id', $request->input('customer'));
-                    });
-                });
-            }
-
             if ($request->has('entity')) {
                 $query->whereHas('payload.entities', function ($q) use ($request) {
                     $q->where(function ($q) use ($request) {
@@ -1296,8 +1376,12 @@ class OrderController extends Controller
      *
      * @return \Fleetbase\Http\Resources\v1\Order
      */
-    public function cancelOrder(string $id)
+    public function cancelOrder(string $id, ?Request $request = null)
     {
+        // Laravel does not inject a class-typed parameter that has a default, so the
+        // current request is read here; the default keeps cancelOrder($id) callable.
+        $request = $request ?? request();
+
         try {
             $order = $this->findOrder($id);
         } catch (ModelNotFoundException $exception) {
@@ -1309,11 +1393,30 @@ class OrderController extends Controller
             );
         }
 
-        $order->cancel();
+        // the reason becomes the canceled status details and is sent with the canceled notifications
+        $reason = $this->reasonFromRequest($request);
+        if ($reason !== null) {
+            $order->cancelWithReason($reason);
+        } else {
+            $order->cancel();
+        }
 
         return $this->orderResource($order);
     }
 
+    /**
+     * The free-text `reason` sent with a cancel, trimmed to 1000 characters.
+     */
+    protected function reasonFromRequest(Request $request): ?string
+    {
+        $reason = $request->input('reason');
+        if (!is_string($reason) || trim($reason) === '') {
+            return null;
+        }
+
+        return Str::limit(trim($reason), 1000, '');
+    }
+
     /**
      * Mark a specific place (waypoint, pickup, or drop-off) as the current
      * destination for an order payload.
@@ -1444,8 +1547,8 @@ class OrderController extends Controller
             return $this->apiError('Unable to capture QR code data.');
         }
 
-        // validate
-        if ($subject && $code === $subject->uuid) {
+        // validate: the scan must name this subject, in any code format still in circulation
+        if (TrackingCode::matches($code, $subject)) {
             // create verification proof
             $proof = $this->createProof([
                 'company_uuid' => session('company'),

package/server/src/Http/Controllers/Api/v1/PayloadController.php

@@ -2,12 +2,15 @@
 
 namespace Fleetbase\FleetOps\Http\Controllers\Api\v1;
 
+use Fleetbase\FleetOps\Exceptions\OrderEditLockedException;
 use Fleetbase\FleetOps\Http\Requests\CreatePayloadRequest;
 use Fleetbase\FleetOps\Http\Requests\UpdatePayloadRequest;
 use Fleetbase\FleetOps\Http\Resources\v1\DeletedResource;
 use Fleetbase\FleetOps\Http\Resources\v1\Payload as PayloadResource;
+use Fleetbase\FleetOps\Models\Order;
 use Fleetbase\FleetOps\Models\Payload;
 use Fleetbase\FleetOps\Models\Place;
+use Fleetbase\FleetOps\Support\OrderEdit;
 use Fleetbase\Http\Controllers\Controller;
 use Illuminate\Http\Request;
 use Illuminate\Support\Arr;
@@ -103,6 +106,18 @@ class PayloadController extends Controller
         $return                 = $routeShape['return'];
         $hasWaypointsField      = $routeShape['has_waypoints_field'];
         $hasRouteEndpointFields = $routeShape['has_route_endpoint_fields'];
+        $entitiesMode           = OrderEdit::entitiesMode($input['entities_mode'] ?? null);
+
+        // when the payload belongs to an order, refuse changes the order's status locks
+        $order = $this->orderForPayload($payload);
+        $edit  = $order ? $this->beginOrderEdit($order) : null;
+        if ($edit) {
+            try {
+                $edit->guard($edit->requestedChanges(Arr::only($input, ['pickup', 'dropoff', 'return', 'waypoints', 'entities', 'cod_amount']), $entitiesMode));
+            } catch (OrderEditLockedException $exception) {
+                return $this->lockedEditResponse($exception);
+            }
+        }
 
         // pickup assignment
         if ($pickup) {
@@ -126,21 +141,29 @@ class PayloadController extends Controller
             $payload->removeWaypoints();
         }
 
-        // set entities
-        if ($entities) {
+        // set entities: appended, or with `entities_mode=replace` the full list
+        if ($entitiesMode === OrderEdit::ENTITIES_REPLACE && is_array($entities)) {
+            $payload->syncEntities($entities);
+        } elseif ($entities) {
             $payload->setEntities($entities);
         }
 
-        // update the payload
-        $payload->fill(array_filter($this->payloadFillInputFromInput($input)));
+        // update the payload; empty values are skipped, but a cash-to-collect of 0 is kept
+        $payload->fill($this->payloadUpdateFillInput($input));
 
         // save the payload
         $payload->save();
 
-        // set the first / current waypoint from the effective route shape
-        $firstWaypoint = $payload->getPickupOrFirstWaypoint();
-        if ($firstWaypoint instanceof Place) {
-            $payload->setCurrentWaypoint($firstWaypoint);
+        if ($edit) {
+            // the order's edit moves the current waypoint only when the route changed, keeps
+            // an order under way on its stop and announces the change
+            $this->commitOrderEdit($edit);
+        } else {
+            // set the first / current waypoint from the effective route shape
+            $firstWaypoint = $payload->getPickupOrFirstWaypoint();
+            if ($firstWaypoint instanceof Place) {
+                $payload->setCurrentWaypoint($firstWaypoint);
+            }
         }
 
         // make sure entities and waypoints is loaded
@@ -237,6 +260,51 @@ class PayloadController extends Controller
         return Arr::only($input, ['type', 'provider', 'meta', 'cod_amount', 'cod_currency', 'cod_payment_method']);
     }
 
+    /**
+     * The payload attributes an update fills: empty values are skipped as before,
+     * except a numeric cash-to-collect, so 0 clears it.
+     */
+    protected function payloadUpdateFillInput(array $input): array
+    {
+        $fill = $this->payloadFillInputFromInput($input);
+        $cod  = $fill['cod_amount'] ?? null;
+        $fill = array_filter($fill);
+
+        if (is_numeric($cod)) {
+            $fill['cod_amount'] = $cod;
+        }
+
+        return $fill;
+    }
+
+    protected function orderForPayload(Payload $payload): ?Order
+    {
+        if (!$payload->uuid) {
+            return null;
+        }
+
+        try {
+            return Order::where('payload_uuid', $payload->uuid)->first();
+        } catch (\Throwable) {
+            return null;
+        }
+    }
+
+    protected function beginOrderEdit(Order $order): OrderEdit
+    {
+        return OrderEdit::begin($order);
+    }
+
+    protected function commitOrderEdit(OrderEdit $edit): array
+    {
+        return $edit->commit();
+    }
+
+    protected function lockedEditResponse(OrderEditLockedException $exception)
+    {
+        return response()->apiError($exception->getMessage(), 422, $exception->toResponseData());
+    }
+
     protected function newPayload(array $input): Payload
     {
         return new Payload($input);

package/server/src/Http/Controllers/Api/v1/PlaceController.php

@@ -146,7 +146,7 @@ class PlaceController extends Controller
         try {
             $place = $this->findPlaceOrFail($id);
         } catch (\Illuminate\Database\Eloquent\ModelNotFoundException $exception) {
-            return $this->apiError('Place resource not found.');
+            return $this->apiError('Place resource not found.', 404);
         }
 
         // get request input
@@ -253,7 +253,7 @@ class PlaceController extends Controller
         try {
             $place = $this->findPlaceOrFail($id);
         } catch (\Illuminate\Database\Eloquent\ModelNotFoundException $exception) {
-            return $this->apiError('Place resource not found.');
+            return $this->apiError('Place resource not found.', 404);
         }
 
         return $this->placeResource($place);
@@ -269,7 +269,7 @@ class PlaceController extends Controller
         try {
             $place = $this->findPlaceOrFail($id);
         } catch (\Illuminate\Database\Eloquent\ModelNotFoundException $exception) {
-            return $this->apiError('Place resource not found.');
+            return $this->apiError('Place resource not found.', 404);
         }
 
         $place->delete();

package/server/src/Http/Controllers/Api/v1/TrackingNumberController.php

@@ -127,8 +127,10 @@ class TrackingNumberController extends Controller
         // validate request inputs
         $code = $request->input('code');
 
-        // get the model of from the code
-        $model = $this->findQrModel(['entities', 'orders'], ['uuid' => $code]);
+        // the order, waypoint, entity or place the code points at, in any format still in
+        // circulation: a tracking url, a bare tracking number or public id, or the bare
+        // owner uuid printed on older labels
+        $model = $this->findQrModel($code);
 
         // if no model response with error
         if (!$model) {
@@ -179,37 +181,9 @@ class TrackingNumberController extends Controller
         return new DeletedResource($trackingNumber);
     }
 
-    protected function findQrModel(array $tables, array $where)
+    protected function findQrModel(string $code)
     {
-        // Hydrate through the eloquent models so the resolved record can be
-        // wrapped in its typed resource — raw rows have no model class.
-        $modelMap = [
-            'entities' => \Fleetbase\FleetOps\Models\Entity::class,
-            'orders'   => \Fleetbase\FleetOps\Models\Order::class,
-        ];
-
-        foreach ($tables as $table) {
-            $modelClass = $modelMap[$table] ?? null;
-            if (!$modelClass) {
-                continue;
-            }
-
-            $model = $modelClass::where($where)->first();
-            if ($model) {
-                return $model;
-            }
-        }
-
-        // No raw-row fallback. Utils::findModel() was called with the ARRAY of table names
-        // and, when nothing matched, passed that array to DB::table() — which stringified
-        // it to the literal table name "Array" and threw SQLSTATE[42S02]. Every
-        // unresolvable code became a 500 instead of the 400 this method's caller already
-        // handles.
-        //
-        // The fallback could not have helped anyway: qrModelResource() serializes through
-        // a typed resource keyed on the model class, and a raw stdClass row has none. The
-        // mapped models above are the endpoint's whole contract.
-        return null;
+        return TrackingNumber::findOwnerByCode($code, session('company'));
     }
 
     protected function qrModelResource($model)

package/server/src/Http/Controllers/Api/v1/VehicleController.php

@@ -17,7 +17,9 @@ use Fleetbase\FleetOps\Models\Driver;
 use Fleetbase\FleetOps\Models\Vehicle;
 use Fleetbase\FleetOps\Models\Vendor;
 use Fleetbase\FleetOps\Models\Warranty;
+use Fleetbase\FleetOps\Support\ApiCacheThrottle;
 use Fleetbase\FleetOps\Support\GeofenceIntersectionService;
+use Fleetbase\FleetOps\Support\TrackingPublisher;
 use Fleetbase\FleetOps\Support\Utils;
 use Fleetbase\Http\Controllers\Controller;
 use Fleetbase\LaravelMysqlSpatial\Types\Point;
@@ -296,8 +298,11 @@ class VehicleController extends Controller
 
         $vehicle->updateQuietly($positionData);
         $vehicle->createPosition($positionData);
+        // Location writes are quiet and frequent: invalidate cached lists at most once a window
+        ApiCacheThrottle::invalidate($vehicle, $vehicle->company_uuid);
 
         broadcast(new VehicleLocationChanged($vehicle));
+        app(TrackingPublisher::class)->vehicleMoved($vehicle);
 
         try {
             $newLocation     = new Point($latitude, $longitude);

package/server/src/Http/Controllers/Internal/v1/ContactController.php

@@ -19,6 +19,7 @@ use Fleetbase\FleetOps\Support\Utils;
 use Fleetbase\Http\Requests\ExportRequest;
 use Fleetbase\Http\Requests\ImportRequest;
 use Fleetbase\Models\User;
+use Fleetbase\Support\ApiModelCache;
 use Illuminate\Http\Request;
 use Illuminate\Support\Facades\DB;
 use Illuminate\Support\Facades\Mail;
@@ -266,6 +267,7 @@ class ContactController extends FleetOpsController
     protected function bulkUpdateCustomerContext(string $modelClass, array $filter, array $replacement): void
     {
         $modelClass::where($filter)->update($replacement);
+        ApiModelCache::invalidateModelCache(new $modelClass(), session('company'));
     }
 
     protected function customerPortalIssuesForContact(Contact $contact)
@@ -350,6 +352,7 @@ class ContactController extends FleetOpsController
     protected function saveContactMetaQuietly(Contact $contact, array $meta): void
     {
         $contact->forceFill(['meta' => $meta])->saveQuietly();
+        $contact->invalidateApiCache();
     }
 
     protected function isCustomerPortalInstalled(): bool

package/server/src/Http/Controllers/Internal/v1/DriverController.php

@@ -595,6 +595,16 @@ class DriverController extends FleetOpsController
             'driver_assigned_uuid' => null,
             'updated_at'           => now(),
         ]);
+        Order::invalidateApiCacheManually(session('company'));
+
+        // The bulk update bypasses the order observer, so the driver taken off each
+        // order is told here
+        foreach ($orders as $order) {
+            $previousDriverUuid = $order->driver_assigned_uuid;
+            if ($previousDriverUuid) {
+                $order->notifyDriverUnassigned($previousDriverUuid);
+            }
+        }
     }
 
     protected function freshOrders($orders, array $with)

package/server/src/Http/Controllers/Internal/v1/FleetController.php

@@ -250,10 +250,17 @@ class FleetController extends FleetOpsController
 
     protected static function deleteFleetDriverAssignment(string $fleetUuid, string $driverUuid): mixed
     {
-        return FleetDriver::where([
+        $deleted = FleetDriver::where([
             'fleet_uuid'  => $fleetUuid,
             'driver_uuid' => $driverUuid,
         ])->delete();
+
+        // Deleted without model events; fleet_drivers rows carry no company
+        if ($deleted) {
+            FleetDriver::invalidateApiCacheManually();
+        }
+
+        return $deleted;
     }
 
     protected static function fleetVehicleAssignmentExists(string $fleetUuid, string $vehicleUuid): bool
@@ -274,10 +281,17 @@ class FleetController extends FleetOpsController
 
     protected static function deleteFleetVehicleAssignment(string $fleetUuid, string $vehicleUuid): mixed
     {
-        return FleetVehicle::where([
+        $deleted = FleetVehicle::where([
             'fleet_uuid'   => $fleetUuid,
             'vehicle_uuid' => $vehicleUuid,
         ])->delete();
+
+        // Deleted without model events; fleet_vehicles rows carry no company
+        if ($deleted) {
+            FleetVehicle::invalidateApiCacheManually();
+        }
+
+        return $deleted;
     }
 
     protected static function invalidateOperationsMonitor(): void

package/server/src/Http/Controllers/Internal/v1/InspectionSubmissionController.php

@@ -111,8 +111,7 @@ class InspectionSubmissionController extends FleetOpsController
 
     public function submit(string $id): JsonResponse
     {
-        $submission = InspectionSubmission::where('uuid', $id)
-            ->orWhere('public_id', $id)
+        $submission = $this->submissionQuery($id)
             ->with(['itemResults', 'vehicle', 'driver', 'form'])
             ->firstOrFail();
 
@@ -127,8 +126,7 @@ class InspectionSubmissionController extends FleetOpsController
 
     public function createIssue(string $id): JsonResponse
     {
-        $submission = InspectionSubmission::where('uuid', $id)
-            ->orWhere('public_id', $id)
+        $submission = $this->submissionQuery($id)
             ->with(['itemResults', 'vehicle', 'driver', 'form'])
             ->firstOrFail();
 
@@ -145,8 +143,7 @@ class InspectionSubmissionController extends FleetOpsController
 
     public function createWorkOrder(string $id): JsonResponse
     {
-        $submission = InspectionSubmission::where('uuid', $id)
-            ->orWhere('public_id', $id)
+        $submission = $this->submissionQuery($id)
             ->with(['itemResults', 'vehicle', 'driver', 'form'])
             ->firstOrFail();
 
@@ -164,8 +161,7 @@ class InspectionSubmissionController extends FleetOpsController
 
     public function resolve(string $id): JsonResponse
     {
-        $submission = InspectionSubmission::where('uuid', $id)
-            ->orWhere('public_id', $id)
+        $submission = $this->submissionQuery($id)
             ->firstOrFail();
 
         $submission->update([
@@ -180,6 +176,15 @@ class InspectionSubmissionController extends FleetOpsController
         ]);
     }
 
+    /** A submission by uuid or public id, only ever within the session's company. */
+    protected function submissionQuery(string $id)
+    {
+        return InspectionSubmission::where('company_uuid', session('company'))
+            ->where(function ($query) use ($id) {
+                $query->where('uuid', $id)->orWhere('public_id', $id);
+            });
+    }
+
     protected function syncItemResultsFromRequest(Request $request, InspectionSubmission $submission): void
     {
         $items = static::arrayInput($request, 'inspection_submission.item_results', 'item_results');

package/server/src/Http/Controllers/Internal/v1/IssueController.php

@@ -38,6 +38,7 @@ class IssueController extends FleetOpsController
             if ($assignee && $assignee->type === 'customer') {
                 $issue->assigned_to_uuid = null;
                 $issue->saveQuietly();
+                $issue->invalidateApiCache();
             }
         }
 
@@ -58,6 +59,7 @@ class IssueController extends FleetOpsController
             if ($order) {
                 $issue->order_uuid = $order->uuid;
                 $issue->saveQuietly();
+                $issue->invalidateApiCache();
             }
         }
     }

package/server/src/Http/Controllers/Internal/v1/MaintenanceController.php

@@ -194,8 +194,10 @@ class MaintenanceController extends FleetOpsController
 
     protected function findMaintenanceForLineItem(string $id): Maintenance
     {
-        return Maintenance::where('uuid', $id)
-            ->orWhere('public_id', $id)
+        return Maintenance::where('company_uuid', session('company'))
+            ->where(function ($query) use ($id) {
+                $query->where('uuid', $id)->orWhere('public_id', $id);
+            })
             ->firstOrFail();
     }