@fleetbase/fleetops-engine 0.6.70 → 0.6.72

package/server/tests/Feature/Http/Internal/PositionControllerReplayChannelTest.php

@@ -0,0 +1,135 @@
+<?php
+
+use Fleetbase\FleetOps\Http\Controllers\Internal\v1\PositionController;
+use Fleetbase\Models\User;
+use Fleetbase\Support\SocketCluster\ChannelAuthorizer;
+use Fleetbase\Support\SocketCluster\ChannelDecision;
+use Fleetbase\Support\SocketCluster\SocketPrincipal;
+use Fleetbase\TestSupport\DispatchRecorder;
+use Illuminate\Database\ConnectionResolver;
+use Illuminate\Database\Eloquent\Model as EloquentModel;
+use Illuminate\Database\SQLiteConnection;
+use Illuminate\Http\Request;
+
+/**
+ * Covers the positions/replay channel check: with socket authentication on, a replay may only
+ * target a channel the requesting user could subscribe to; with it off the endpoint is unchanged.
+ */
+class PositionReplayChannelAuthorizerFake
+{
+    public array $checked = [];
+
+    public function __construct(public array $allowed = [])
+    {
+    }
+
+    public function authorize(?SocketPrincipal $principal, string $channel): ChannelDecision
+    {
+        $this->checked[] = [$principal, $channel];
+
+        return in_array($channel, $this->allowed, true) ? ChannelDecision::allowed('resolver') : ChannelDecision::denied('forbidden');
+    }
+}
+
+function positionReplayChannelBoot(bool $enabled): PositionReplayChannelAuthorizerFake
+{
+    // Socket authentication needs both the switch and the signing key.
+    config([
+        'broadcasting.connections.socketcluster.auth_enabled' => $enabled,
+        'broadcasting.connections.socketcluster.auth_key'     => $enabled ? 'fleetops-position-replay-test-key-0123456789' : null,
+    ]);
+
+    $pdo = new PDO('sqlite::memory:');
+    $pdo->sqliteCreateFunction('ST_PointFromText', fn ($wkt, $srid = 0, $axisOrder = null) => $wkt);
+    $connection = new SQLiteConnection($pdo);
+    $resolver   = new ConnectionResolver(['default' => $connection, 'mysql' => $connection]);
+    $resolver->setDefaultConnection('mysql');
+    EloquentModel::setConnectionResolver($resolver);
+
+    $schema = $connection->getSchemaBuilder();
+    foreach (['positions' => ['uuid', 'company_uuid', 'subject_uuid', 'coordinates', 'speed'], 'companies' => ['uuid', 'public_id']] as $table => $columns) {
+        $schema->create($table, function ($blueprint) use ($columns) {
+            $blueprint->increments('id');
+            foreach ($columns as $column) {
+                $blueprint->string($column)->nullable();
+            }
+            $blueprint->timestamps();
+            $blueprint->timestamp('deleted_at')->nullable();
+        });
+    }
+    $connection->table('companies')->insert(['uuid' => 'company-1', 'public_id' => 'company_one']);
+    $connection->table('positions')->insert(['uuid' => 'pos-1', 'company_uuid' => 'company-1', 'subject_uuid' => 'vehicle-1', 'created_at' => '2026-10-06 08:00:00']);
+
+    session(['company' => 'company-1']);
+    DispatchRecorder::$dispatched = [];
+
+    $authorizer = new PositionReplayChannelAuthorizerFake(['vehicle.vehicle-1']);
+    app()->instance(ChannelAuthorizer::class, $authorizer);
+
+    return $authorizer;
+}
+
+function positionReplayChannelRequest(mixed $channel, ?User $user = null): Request
+{
+    $request = Request::create('/int/v1/positions/replay', 'POST', ['channel_id' => $channel, 'position_ids' => ['pos-1']]);
+    $request->setUserResolver(fn () => $user);
+
+    return $request;
+}
+
+function positionReplayChannelUser(): User
+{
+    $user = (new ReflectionClass(User::class))->newInstanceWithoutConstructor();
+    $user->setRawAttributes(['uuid' => 'user-1', 'public_id' => 'user_one', 'company_uuid' => 'company-1', 'type' => 'user'], true);
+
+    return $user;
+}
+
+afterEach(function () {
+    config(['broadcasting.connections.socketcluster.auth_enabled' => false, 'broadcasting.connections.socketcluster.auth_key' => null]);
+});
+
+test('a replay to a channel the user may subscribe to is started', function () {
+    $authorizer = positionReplayChannelBoot(true);
+
+    $response = (new PositionController())->replay(positionReplayChannelRequest('vehicle.vehicle-1', positionReplayChannelUser()));
+
+    [$principal, $channel] = $authorizer->checked[0];
+    expect($response->getData(true)['status'])->toBe('ok')
+        ->and(DispatchRecorder::$dispatched)->toHaveCount(1)
+        ->and($channel)->toBe('vehicle.vehicle-1')
+        ->and($principal->kind)->toBe('user')
+        ->and($principal->sub)->toBe('user-1')
+        ->and($principal->cid)->toBe('company-1')
+        ->and($principal->adm)->toBeFalse();
+});
+
+test('a replay to any other channel is refused before anything is queued', function () {
+    $authorizer = positionReplayChannelBoot(true);
+    $controller = new PositionController();
+    $user       = positionReplayChannelUser();
+
+    foreach ([
+        positionReplayChannelRequest('chat_channel.someone-elses', $user),
+        positionReplayChannelRequest('vehicle.vehicle-1', null),
+        positionReplayChannelRequest('vehicle. vehicle-1', $user),
+        positionReplayChannelRequest(str_repeat('x', 256), $user),
+        positionReplayChannelRequest(['vehicle.vehicle-1'], $user),
+    ] as $request) {
+        $response = $controller->replay($request);
+        expect($response->getStatusCode())->toBe(403)
+            ->and($response->getData(true)['error'])->toContain('not allowed');
+    }
+
+    expect(DispatchRecorder::$dispatched)->toBe([])
+        ->and(array_column($authorizer->checked, 1))->toBe(['chat_channel.someone-elses']);
+});
+
+test('without socket authentication the replay endpoint does not check the channel', function () {
+    $authorizer = positionReplayChannelBoot(false);
+
+    $response = (new PositionController())->replay(positionReplayChannelRequest('anything.at-all'));
+
+    expect($response->getData(true)['status'])->toBe('ok')
+        ->and($authorizer->checked)->toBe([]);
+});

package/server/tests/Feature/Http/Internal/ProofControllerContractsTest.php

@@ -43,9 +43,9 @@ class FleetOpsProofControllerProbe extends ProofController
         return $proof;
     }
 
-    protected function storeSignature(string $path, string|false $contents, string $visibility): void
+    protected function storeSignature(string $path, string|false $contents): void
     {
-        $this->storedSignatures[] = [$path, $contents, $visibility];
+        $this->storedSignatures[] = [$path, $contents];
     }
 
     protected function createSignatureFile(string $path, string $signature, Proof $proof): Fleetbase\Models\File
@@ -206,7 +206,7 @@ test('internal proof controller captures signatures and assigns uploaded file',
             'raw_data'     => $signature,
         ])
         ->and($controller->storedSignatures)->toBe([
-            ['uploads/company-uuid/signatures/proof-public-1.png', 'signature-bytes', 'public'],
+            ['uploads/company-uuid/signatures/proof-public-1.png', 'signature-bytes'],
         ])
         ->and($controller->createdFiles)->toBe([
             ['uploads/company-uuid/signatures/proof-public-1.png', $signature, 'proof-public-1'],

package/server/tests/Feature/Http/Internal/ProofControllerRecentTest.php

@@ -0,0 +1,170 @@
+<?php
+
+use Fleetbase\FleetOps\Http\Controllers\Internal\v1\ProofController;
+use Fleetbase\FleetOps\Models\Contact;
+use Fleetbase\FleetOps\Models\Vendor;
+use Fleetbase\Models\File;
+use Illuminate\Config\Repository;
+use Illuminate\Database\ConnectionResolver;
+use Illuminate\Database\Eloquent\Model as EloquentModel;
+use Illuminate\Database\SQLiteConnection;
+use Illuminate\Events\Dispatcher;
+use Illuminate\Http\Request;
+
+/**
+ * The real query over an in-memory database; only the signed file URL is stood in,
+ * since File::url resolves a storage disk the harness does not boot.
+ */
+class FleetOpsRecentProofController extends ProofController
+{
+    protected function photoUrl(File $file): ?string
+    {
+        return 'https://cdn.test/' . $file->path;
+    }
+}
+
+function fleetOpsRecentProofDatabase(): SQLiteConnection
+{
+    $connection = new SQLiteConnection(new PDO('sqlite::memory:'));
+    $resolver   = new ConnectionResolver(['default' => $connection, 'mysql' => $connection]);
+    $resolver->setDefaultConnection('mysql');
+    EloquentModel::setConnectionResolver($resolver);
+    EloquentModel::setEventDispatcher(new Dispatcher());
+    EloquentModel::clearBootedModels();
+
+    $config = new Repository([
+        'activitylog' => ['enabled' => false, 'default_auth_driver' => null, 'default_log_name' => 'default'],
+        'api'         => ['cache' => ['enabled' => false]],
+        'filesystems' => ['default' => 'local'],
+    ]);
+    app()->instance('config', $config);
+    app()->instance(Illuminate\Contracts\Config\Repository::class, $config);
+
+    $common = ['uuid', 'public_id', '_key', 'company_uuid', 'meta', 'slug', 'internal_id'];
+    $tables = [
+        'proofs'   => ['file_uuid', 'order_uuid', 'subject_uuid', 'subject_type', 'remarks', 'raw_data', 'data'],
+        'files'    => ['uploader_uuid', 'subject_uuid', 'subject_type', 'path', 'disk', 'bucket', 'type', 'content_type', 'original_filename'],
+        'orders'   => ['customer_uuid', 'customer_type', 'status', 'type'],
+        'contacts' => ['name', 'type'],
+        'vendors'  => ['name', 'type'],
+    ];
+
+    $schema = $connection->getSchemaBuilder();
+    foreach ($tables as $table => $columns) {
+        $schema->create($table, function ($blueprint) use ($common, $columns) {
+            $blueprint->increments('id');
+            foreach (array_unique(array_merge($common, $columns)) as $column) {
+                $blueprint->string($column)->nullable();
+            }
+            $blueprint->timestamps();
+            $blueprint->timestamp('deleted_at')->nullable();
+        });
+    }
+
+    $connection->table('contacts')->insert(['uuid' => 'contact-ada', 'public_id' => 'contact_ada', 'company_uuid' => 'company-a', 'name' => 'Ada Lovelace', 'type' => 'customer']);
+    $connection->table('vendors')->insert(['uuid' => 'vendor-acme', 'public_id' => 'vendor_acme', 'company_uuid' => 'company-a', 'name' => 'Acme Retail']);
+    $connection->table('orders')->insert([
+        ['uuid' => 'order-1', 'public_id' => 'order_1', 'company_uuid' => 'company-a', 'customer_uuid' => 'contact-ada', 'customer_type' => Contact::class],
+        ['uuid' => 'order-2', 'public_id' => 'order_2', 'company_uuid' => 'company-a', 'customer_uuid' => 'vendor-acme', 'customer_type' => Vendor::class],
+        ['uuid' => 'order-3', 'public_id' => 'order_3', 'company_uuid' => 'company-a', 'customer_uuid' => null, 'customer_type' => null],
+        ['uuid' => 'order-x', 'public_id' => 'order_x', 'company_uuid' => 'company-b', 'customer_uuid' => null, 'customer_type' => null],
+    ]);
+
+    session(['company' => 'company-a']);
+
+    return $connection;
+}
+
+function fleetOpsRecentProof(SQLiteConnection $connection, string $key, string $createdAt, array $proof = [], ?string $fileType = 'photo'): void
+{
+    $proof += ['company_uuid' => 'company-a', 'order_uuid' => 'order-1', 'remarks' => 'Verified by Photo'];
+
+    if ($fileType) {
+        $connection->table('files')->insert(['uuid' => "file-{$key}", 'public_id' => "file_{$key}", 'company_uuid' => $proof['company_uuid'], 'path' => "photos/{$key}.png", 'type' => $fileType]);
+    }
+
+    $connection->table('proofs')->insert($proof + [
+        'uuid'       => "proof-{$key}",
+        'public_id'  => "proof_{$key}",
+        'file_uuid'  => $fileType ? "file-{$key}" : null,
+        'created_at' => $createdAt,
+        'updated_at' => $createdAt,
+    ]);
+}
+
+function fleetOpsRecentProofs(array $query = []): array
+{
+    return (new FleetOpsRecentProofController())->recent(Request::create('/int/v1/fleet-ops/proofs/recent', 'GET', $query))->getData(true)['proofs'];
+}
+
+test('recent proofs are the company photo proofs on orders, newest first, with their order and customer', function () {
+    $db = fleetOpsRecentProofDatabase();
+
+    fleetOpsRecentProof($db, 'old', '2026-10-01 08:00:00');
+    fleetOpsRecentProof($db, 'new', '2026-10-03 08:00:00', ['order_uuid' => 'order-2', 'remarks' => 'Left at the door']);
+    fleetOpsRecentProof($db, 'mid', '2026-10-02 08:00:00', ['order_uuid' => 'order-3']);
+    // Not photos: a signature, a QR scan with no file, a photo on no order.
+    fleetOpsRecentProof($db, 'signature', '2026-10-04 08:00:00', [], 'signature');
+    fleetOpsRecentProof($db, 'scan', '2026-10-04 09:00:00', [], null);
+    fleetOpsRecentProof($db, 'orderless', '2026-10-04 10:00:00', ['order_uuid' => null]);
+    // Another company's photo.
+    fleetOpsRecentProof($db, 'foreign', '2026-10-05 08:00:00', ['company_uuid' => 'company-b', 'order_uuid' => 'order-x']);
+
+    $proofs = fleetOpsRecentProofs();
+
+    expect(array_column($proofs, 'id'))->toBe(['proof_new', 'proof_mid', 'proof_old'])
+        ->and($proofs[0])->toBe([
+            'id'            => 'proof_new',
+            'order_id'      => 'order_2',
+            'customer_name' => 'Acme Retail',
+            'remarks'       => 'Left at the door',
+            'url'           => 'https://cdn.test/photos/new.png',
+            'captured_at'   => '2026-10-03T08:00:00+00:00',
+        ])
+        ->and($proofs[1]['customer_name'])->toBeNull()
+        ->and($proofs[2]['customer_name'])->toBe('Ada Lovelace')
+        ->and($proofs[2]['order_id'])->toBe('order_1');
+});
+
+test('recent proofs default to 12 and cap the limit between 1 and 24', function () {
+    $db = fleetOpsRecentProofDatabase();
+
+    foreach (range(1, 30) as $index) {
+        fleetOpsRecentProof($db, "p{$index}", sprintf('2026-10-01 08:%02d:00', $index));
+    }
+
+    expect(fleetOpsRecentProofs())->toHaveCount(12)
+        ->and(fleetOpsRecentProofs(['limit' => 5]))->toHaveCount(5)
+        ->and(fleetOpsRecentProofs(['limit' => 500]))->toHaveCount(ProofController::RECENT_LIMIT_MAX)
+        ->and(fleetOpsRecentProofs(['limit' => 0]))->toHaveCount(1)
+        ->and(fleetOpsRecentProofs(['limit' => 'abc']))->toHaveCount(1)
+        ->and(fleetOpsRecentProofs(['limit' => 5])[0]['id'])->toBe('proof_p30');
+});
+
+test('recent proofs are empty when the session has no company', function () {
+    $db = fleetOpsRecentProofDatabase();
+    fleetOpsRecentProof($db, 'one', '2026-10-01 08:00:00');
+    session(['company' => null]);
+
+    expect(fleetOpsRecentProofs())->toBe([]);
+});
+
+test('the photo url is the file url, signed for private buckets', function () {
+    $file = new class extends File {
+        public function getUrlAttribute()
+        {
+            return 'https://signed.test/photo.png';
+        }
+    };
+
+    $method = new ReflectionMethod(ProofController::class, 'photoUrl');
+    $method->setAccessible(true);
+
+    expect($method->invoke(new ProofController(), $file))->toBe('https://signed.test/photo.png');
+});
+
+test('the recent proofs route is registered with the proof routes', function () {
+    $routes = file_get_contents(dirname(__DIR__, 4) . '/src/routes.php');
+
+    expect($routes)->toContain("\$router->get('recent', \$controller('recent'));");
+});