@fleetbase/fleetops-engine 0.6.70 → 0.6.72

package/server/tests/TenantScopingTest.php

@@ -0,0 +1,206 @@
+<?php
+
+use Fleetbase\FleetOps\Http\Controllers\Internal\v1\InspectionSubmissionController;
+use Fleetbase\FleetOps\Http\Controllers\Internal\v1\MaintenanceController;
+use Fleetbase\FleetOps\Http\Filter\InspectionFormFilter;
+use Fleetbase\FleetOps\Http\Filter\InspectionSubmissionFilter;
+use Fleetbase\FleetOps\Http\Filter\MaintenanceFilter;
+use Fleetbase\FleetOps\Http\Filter\ProofFilter;
+use Fleetbase\FleetOps\Http\Filter\RouteFilter;
+use Fleetbase\FleetOps\Http\Filter\TelematicFilter;
+use Fleetbase\FleetOps\Http\Filter\WarrantyFilter;
+use Fleetbase\FleetOps\Models\InspectionForm;
+use Fleetbase\FleetOps\Models\InspectionSubmission;
+use Fleetbase\FleetOps\Models\Maintenance;
+use Fleetbase\FleetOps\Models\Proof;
+use Fleetbase\FleetOps\Models\Route;
+use Fleetbase\FleetOps\Models\Telematic;
+use Fleetbase\FleetOps\Models\Warranty;
+use Fleetbase\Support\Find;
+use Illuminate\Database\ConnectionResolver;
+use Illuminate\Database\Eloquent\Model as EloquentModel;
+use Illuminate\Database\Eloquent\ModelNotFoundException;
+use Illuminate\Database\SQLiteConnection;
+use Illuminate\Http\Request;
+
+/*
+ * A console list is scoped to the signed-in company only by the resource's
+ * Filter (core-api applies `queryForInternal` and nothing else), so a model
+ * without one lists every company's rows. These tests hold each tenant-owned
+ * resource to its own company, for lists and for the by-id endpoints that
+ * look records up themselves.
+ */
+
+const FLEETOPS_TENANT_OWN   = 'company-own';
+const FLEETOPS_TENANT_OTHER = 'company-other';
+
+function fleetopsTenantScopingBoot(): SQLiteConnection
+{
+    $connection = new SQLiteConnection(new PDO('sqlite::memory:'));
+    $resolver   = new ConnectionResolver(['default' => $connection, 'mysql' => $connection]);
+    $resolver->setDefaultConnection('mysql');
+    EloquentModel::setConnectionResolver($resolver);
+    app()->instance('db', new class($connection) {
+        public function __construct(public SQLiteConnection $c)
+        {
+        }
+
+        public function connection($name = null): SQLiteConnection
+        {
+            return $this->c;
+        }
+
+        public function __call($method, $arguments)
+        {
+            return $this->c->{$method}(...$arguments);
+        }
+    });
+    Illuminate\Support\Facades\DB::clearResolvedInstance('db');
+
+    $columns = ['uuid', 'public_id', 'company_uuid', 'name', 'description', 'type', 'status', 'result', 'summary', 'notes', 'provider', 'model', 'serial_number', 'imei', 'policy_number', 'vehicle_uuid', 'driver_uuid', 'user_uuid', 'inspection_form_uuid', 'line_items', 'labor_cost', 'tax', 'parts_cost', 'total_cost'];
+    $schema  = $connection->getSchemaBuilder();
+    foreach (['inspection_forms', 'inspection_submissions', 'maintenances', 'telematics', 'warranties', 'proofs', 'routes', 'vehicles', 'drivers', 'users'] as $table) {
+        $schema->create($table, function ($blueprint) use ($columns) {
+            $blueprint->increments('id');
+            foreach ($columns as $column) {
+                $blueprint->string($column)->nullable();
+            }
+            $blueprint->timestamps();
+            $blueprint->timestamp('deleted_at')->nullable();
+        });
+    }
+
+    foreach (['inspection_forms', 'inspection_submissions', 'maintenances', 'telematics', 'warranties', 'proofs', 'routes'] as $table) {
+        foreach ([FLEETOPS_TENANT_OWN => 'own', FLEETOPS_TENANT_OTHER => 'other'] as $company => $label) {
+            $connection->table($table)->insert([
+                'uuid'          => "{$table}-{$label}",
+                'public_id'     => "{$table}_{$label}",
+                'company_uuid'  => $company,
+                'name'          => 'Shared name',
+                'summary'       => 'Shared name',
+                'provider'      => 'shared',
+                'type'          => 'shared',
+                'policy_number' => 'shared',
+            ]);
+        }
+    }
+
+    session(['company' => FLEETOPS_TENANT_OWN]);
+
+    return $connection;
+}
+
+function fleetopsTenantScopingRequest(string $uri, array $query = []): Request
+{
+    $request = Request::create('/' . $uri, 'GET', $query);
+    $session = app('session.store');
+    $session->put('company', FLEETOPS_TENANT_OWN);
+    $request->setLaravelSession($session);
+    $request->setRouteResolver(fn () => new class($uri) {
+        public array $action = [];
+
+        public function __construct(private string $uri)
+        {
+        }
+
+        public function uri(): string
+        {
+            return $this->uri;
+        }
+    });
+
+    return $request;
+}
+
+dataset('tenant scoped resources', [
+    'inspection forms'       => [InspectionForm::class, InspectionFormFilter::class, 'inspection_forms'],
+    'inspection submissions' => [InspectionSubmission::class, InspectionSubmissionFilter::class, 'inspection_submissions'],
+    'maintenances'           => [Maintenance::class, MaintenanceFilter::class, 'maintenances'],
+    'telematics'             => [Telematic::class, TelematicFilter::class, 'telematics'],
+    'warranties'             => [Warranty::class, WarrantyFilter::class, 'warranties'],
+    'proofs'                 => [Proof::class, ProofFilter::class, 'proofs'],
+    'routes'                 => [Route::class, RouteFilter::class, 'routes'],
+]);
+
+test('the resource resolves to its tenant filter', function (string $model, string $filter) {
+    expect(ltrim((string) Find::httpFilterForModel(new $model()), '\\'))->toBe($filter);
+})->with('tenant scoped resources');
+
+test('a console list returns only the session company rows', function (string $model, string $filter, string $table) {
+    fleetopsTenantScopingBoot();
+
+    $uuids = $model::query()
+        ->filter(new $filter(fleetopsTenantScopingRequest("int/v1/fleet-ops/{$table}")))
+        ->pluck('uuid')
+        ->all();
+
+    expect($uuids)->toBe(["{$table}-own"]);
+})->with('tenant scoped resources');
+
+test('a public api list returns only the session company rows', function (string $model, string $filter, string $table) {
+    fleetopsTenantScopingBoot();
+
+    $uuids = $model::query()
+        ->filter(new $filter(fleetopsTenantScopingRequest("v1/{$table}")))
+        ->pluck('uuid')
+        ->all();
+
+    expect($uuids)->toBe(["{$table}-own"]);
+})->with('tenant scoped resources');
+
+test('a search that matches every company still returns only the session company rows', function (string $model, string $filter, string $table) {
+    fleetopsTenantScopingBoot();
+
+    $uuids = $model::query()
+        ->filter(new $filter(fleetopsTenantScopingRequest("int/v1/fleet-ops/{$table}", ['query' => 'shared'])))
+        ->pluck('uuid')
+        ->all();
+
+    expect($uuids)->toBe(["{$table}-own"]);
+})->with('tenant scoped resources');
+
+function fleetopsTenantScopingController(string $class): object
+{
+    return (new ReflectionClass($class))->newInstanceWithoutConstructor();
+}
+
+function fleetopsTenantScopingCall(object $controller, string $method, ...$arguments): mixed
+{
+    $reflection = new ReflectionMethod($controller, $method);
+    $reflection->setAccessible(true);
+
+    return $reflection->invoke($controller, ...$arguments);
+}
+
+test('a maintenance line item endpoint resolves only the session company record', function () {
+    fleetopsTenantScopingBoot();
+    $controller = fleetopsTenantScopingController(MaintenanceController::class);
+
+    expect(fleetopsTenantScopingCall($controller, 'findMaintenanceForLineItem', 'maintenances-own')->uuid)->toBe('maintenances-own')
+        ->and(fleetopsTenantScopingCall($controller, 'findMaintenanceForLineItem', 'maintenances_own')->uuid)->toBe('maintenances-own');
+
+    foreach (['maintenances-other', 'maintenances_other'] as $id) {
+        expect(fn () => fleetopsTenantScopingCall($controller, 'findMaintenanceForLineItem', $id))->toThrow(ModelNotFoundException::class);
+    }
+
+    $request = Request::create('/int/v1/fleet-ops/maintenances/maintenances-other/line-items', 'POST', ['description' => 'x', 'quantity' => 1, 'unit_cost' => 1]);
+    expect(fn () => $controller->addLineItem('maintenances-other', $request))->toThrow(ModelNotFoundException::class)
+        ->and(fn () => $controller->updateLineItem('maintenances-other', 0, $request))->toThrow(ModelNotFoundException::class)
+        ->and(fn () => $controller->removeLineItem('maintenances-other', 0))->toThrow(ModelNotFoundException::class);
+});
+
+test('an inspection submission action resolves only the session company record', function () {
+    $connection = fleetopsTenantScopingBoot();
+    $controller = fleetopsTenantScopingController(InspectionSubmissionController::class);
+
+    expect(fleetopsTenantScopingCall($controller, 'submissionQuery', 'inspection_submissions-own')->value('uuid'))->toBe('inspection_submissions-own')
+        ->and(fleetopsTenantScopingCall($controller, 'submissionQuery', 'inspection_submissions_own')->value('uuid'))->toBe('inspection_submissions-own')
+        ->and(fleetopsTenantScopingCall($controller, 'submissionQuery', 'inspection_submissions-other')->exists())->toBeFalse()
+        ->and(fleetopsTenantScopingCall($controller, 'submissionQuery', 'inspection_submissions_other')->exists())->toBeFalse();
+
+    foreach (['submit', 'createIssue', 'createWorkOrder', 'resolve'] as $action) {
+        expect(fn () => $controller->{$action}('inspection_submissions-other'))->toThrow(ModelNotFoundException::class);
+    }
+
+    expect($connection->table('inspection_submissions')->where('uuid', 'inspection_submissions-other')->value('status'))->toBeNull();
+});

package/server/tests/TrackingPageSettingsTest.php

@@ -0,0 +1,343 @@
+<?php
+
+use Fleetbase\FleetOps\Http\Controllers\Internal\v1\SettingController;
+use Fleetbase\FleetOps\Support\TrackingPage\TrackingPageConfig;
+use Illuminate\Http\Request;
+
+class FleetOpsTrackingPageSettingProbe extends SettingController
+{
+    public array $settings        = [];
+    public array $companySettings = [];
+    public array $configured      = [];
+    public mixed $company         = null;
+    public array $smsProviders    = [];
+    public array $extensions      = [];
+
+    public function __construct()
+    {
+    }
+
+    protected function configureSetting(string $key, mixed $value): mixed
+    {
+        $this->configured[]   = [$key, $value];
+        $this->settings[$key] = $value;
+
+        return null;
+    }
+
+    protected function configureCompanySetting(string $key, mixed $value): mixed
+    {
+        $this->companySettings[$key] = $value;
+
+        return null;
+    }
+
+    protected function lookupSetting(string $key, mixed $defaultValue = null): mixed
+    {
+        return $this->settings[$key] ?? $defaultValue;
+    }
+
+    protected function lookupCompanySetting(string $key, mixed $defaultValue = null): mixed
+    {
+        return $this->companySettings[$key] ?? $defaultValue;
+    }
+
+    protected function currentCompany(): mixed
+    {
+        return $this->company;
+    }
+
+    protected function smsProviders(): array
+    {
+        return $this->smsProviders;
+    }
+
+    protected function installedFleetbaseExtensions(): array
+    {
+        return $this->extensions;
+    }
+}
+
+function fleetopsTrackingPageProbe(): FleetOpsTrackingPageSettingProbe
+{
+    $probe          = new FleetOpsTrackingPageSettingProbe();
+    $probe->company = (object) ['uuid' => 'company-1', 'name' => 'Northwind Couriers'];
+
+    config(['services.twilio.sid' => null, 'services.twilio.token' => null]);
+
+    return $probe;
+}
+
+function fleetopsTrackingPageRequest(array $trackingPage): Request
+{
+    return new Request(['trackingPage' => $trackingPage]);
+}
+
+test('tracking page config fills every key with defaults for an empty company setting', function () {
+    $config = TrackingPageConfig::sanitize([], [], 'Northwind Couriers');
+
+    expect($config['org_page'])->toBe(['enabled' => false, 'slug' => 'northwind-couriers'])
+        ->and($config['generic_page'])->toBe(['allowed' => true])
+        ->and($config['links'])->toBe(['target' => 'auto'])
+        ->and($config['branding'])->toBe([
+            'display_name'   => null,
+            'logo_uuid'      => null,
+            'accent'         => '#1F5FA8',
+            'accent_dark'    => null,
+            'support_phone'  => null,
+            'support_email'  => null,
+            'website'        => null,
+            'powered_by'     => true,
+            'theme'          => 'system',
+            'default_locale' => 'en-us',
+            'locales'        => TrackingPageConfig::LOCALES,
+        ])
+        ->and($config['access'])->toBe([
+            'public_status'   => true,
+            'channels'        => ['sms' => true, 'email' => true],
+            'session_hours'   => 24,
+            'account_sign_in' => true,
+            'account_upsell'  => true,
+        ])
+        ->and($config['visibility'])->toBe([
+            'map'               => true,
+            'driver_name'       => true,
+            'vehicle'           => true,
+            'driver_contact'    => 'company',
+            'items'             => true,
+            'item_prices'       => false,
+            'pod_photo'         => true,
+            'pod_signature'     => true,
+            'instructions_edit' => false,
+            'report_problem'    => true,
+        ]);
+});
+
+test('tracking page config keeps valid values and replaces invalid ones', function () {
+    $config = TrackingPageConfig::sanitize([
+        'org_page'     => ['enabled' => 'true', 'slug' => '  Northwind  '],
+        'generic_page' => ['allowed' => '0'],
+        'links'        => ['target' => 'org'],
+        'branding'     => [
+            'display_name'   => '  Northwind  ',
+            'logo_uuid'      => 'file-uuid',
+            'accent'         => '0b6',
+            'accent_dark'    => '#5cc9be',
+            'support_phone'  => 5105550142,
+            'support_email'  => 'help@northwind.example',
+            'website'        => 'https://northwind.example',
+            'powered_by'     => false,
+            'theme'          => 'light',
+            'default_locale' => 'de-de',
+            'locales'        => ['fr-fr', 'xx-xx'],
+            'unknown'        => 'dropped',
+        ],
+        'access'       => ['public_status' => 'no', 'channels' => ['sms' => 'maybe', 'email' => false], 'session_hours' => 500],
+        'visibility'   => ['driver_contact' => 'driver', 'item_prices' => 1, 'map' => 'off'],
+        'extra'        => ['dropped' => true],
+    ], ['branding' => ['accent' => '#123456', 'powered_by' => false]], 'Ignored');
+
+    expect($config['org_page'])->toBe(['enabled' => true, 'slug' => 'northwind'])
+        ->and($config['generic_page']['allowed'])->toBeFalse()
+        ->and($config['links']['target'])->toBe('org')
+        ->and($config['branding']['display_name'])->toBe('Northwind')
+        ->and($config['branding']['logo_uuid'])->toBe('file-uuid')
+        ->and($config['branding']['accent'])->toBe('#00BB66')
+        ->and($config['branding']['accent_dark'])->toBe('#5CC9BE')
+        ->and($config['branding']['support_phone'])->toBe('5105550142')
+        ->and($config['branding']['support_email'])->toBe('help@northwind.example')
+        ->and($config['branding']['website'])->toBe('https://northwind.example')
+        ->and($config['branding']['powered_by'])->toBeFalse()
+        ->and($config['branding']['theme'])->toBe('light')
+        ->and($config['branding']['default_locale'])->toBe('en-us')
+        ->and($config['branding']['locales'])->toBe(['en-us', 'fr-fr'])
+        ->and($config['branding'])->not->toHaveKey('unknown')
+        ->and($config)->not->toHaveKey('extra')
+        ->and($config['access']['public_status'])->toBeFalse()
+        ->and($config['access']['channels'])->toBe(['sms' => true, 'email' => false])
+        ->and($config['access']['session_hours'])->toBe(168)
+        ->and($config['visibility']['driver_contact'])->toBe('driver')
+        ->and($config['visibility']['item_prices'])->toBeTrue()
+        ->and($config['visibility']['map'])->toBeFalse();
+
+    $fallback = TrackingPageConfig::sanitize([
+        'branding' => [
+            'accent'        => 'teal',
+            'accent_dark'   => ['#000000'],
+            'support_email' => 'not-an-email',
+            'website'       => 'ftp://northwind.example',
+            'display_name'  => '   ',
+            'locales'       => ['ar-ae', 'en-us'],
+        ],
+        'access'   => ['session_hours' => 'soon'],
+    ], ['branding' => ['accent' => '#123456', 'powered_by' => false]], 'N');
+
+    expect($fallback['org_page']['slug'])->toBe('n-tracking')
+        ->and($fallback['branding']['accent'])->toBe('#123456')
+        ->and($fallback['branding']['accent_dark'])->toBeNull()
+        ->and($fallback['branding']['support_email'])->toBeNull()
+        ->and($fallback['branding']['website'])->toBeNull()
+        ->and($fallback['branding']['display_name'])->toBeNull()
+        ->and($fallback['branding']['powered_by'])->toBeFalse()
+        ->and($fallback['branding']['locales'])->toBe(['en-us', 'ar-ae'])
+        ->and($fallback['access']['session_hours'])->toBe(24)
+        ->and(TrackingPageConfig::sanitize(['access' => ['session_hours' => 0]])['access']['session_hours'])->toBe(1)
+        ->and(TrackingPageConfig::sanitize([])['org_page']['slug'])->toBe('company-tracking');
+});
+
+test('tracking page admin defaults are sanitized on their own', function () {
+    expect(TrackingPageConfig::sanitizeAdmin([]))->toBe([
+        'generic_page' => ['enabled' => true],
+        'branding'     => [
+            'display_name'  => null,
+            'accent'        => '#1F5FA8',
+            'support_phone' => null,
+            'support_email' => null,
+            'website'       => null,
+            'powered_by'    => true,
+        ],
+    ])->and(TrackingPageConfig::sanitizeAdmin([
+        'generic_page' => ['enabled' => false],
+        'branding'     => ['display_name' => 'Fleetbase Cloud', 'accent' => '#abcdef', 'support_email' => 'ops@fleetbase.example'],
+    ]))->toBe([
+        'generic_page' => ['enabled' => false],
+        'branding'     => [
+            'display_name'  => 'Fleetbase Cloud',
+            'accent'        => '#ABCDEF',
+            'support_phone' => null,
+            'support_email' => 'ops@fleetbase.example',
+            'website'       => null,
+            'powered_by'    => true,
+        ],
+    ]);
+});
+
+test('tracking page slugs are checked for shape and reserved words', function () {
+    expect(TrackingPageConfig::slugError('northwind'))->toBeNull()
+        ->and(TrackingPageConfig::slugError('north-wind-2'))->toBeNull()
+        ->and(TrackingPageConfig::slugError('ab'))->toBe('invalid')
+        ->and(TrackingPageConfig::slugError(str_repeat('a', 41)))->toBe('invalid')
+        ->and(TrackingPageConfig::slugError('-northwind'))->toBe('invalid')
+        ->and(TrackingPageConfig::slugError('north--wind'))->toBe('invalid')
+        ->and(TrackingPageConfig::slugError('North'))->toBe('invalid')
+        ->and(TrackingPageConfig::slugError(null))->toBe('invalid')
+        ->and(TrackingPageConfig::slugError('track'))->toBe('reserved')
+        ->and(TrackingPageConfig::slugError('customer-portal'))->toBe('reserved')
+        ->and(TrackingPageConfig::slugify(str_repeat('Northwind ', 8)))->toHaveLength(39)
+        ->and(TrackingPageConfig::slugify('Northwind Couriers, Inc.'))->toBe('northwind-couriers-inc');
+});
+
+test('tracking page accents get a readable ink and a contrast ratio', function () {
+    expect(TrackingPageConfig::inkFor('#0B6E68'))->toBe('#FFFFFF')
+        ->and(TrackingPageConfig::inkFor('#5CC9BE'))->toBe('#14191A')
+        ->and(TrackingPageConfig::contrastRatio('#FFFFFF', '#000000'))->toBe(21.0)
+        ->and(TrackingPageConfig::contrastRatio('#1F5FA8', '#FFFFFF'))->toBeGreaterThan(4.5)
+        ->and(TrackingPageConfig::contrastRatio('#FFFFFF', '#FFFFFF'))->toBe(1.0);
+});
+
+test('tracking page settings read back with what the settings screen explains', function () {
+    $probe = fleetopsTrackingPageProbe();
+
+    $view = $probe->getTrackingPageSettings()->getData(true);
+
+    expect($view['org_page'])->toBe(['enabled' => false, 'slug' => 'northwind-couriers'])
+        ->and($view['slug_validation'])->toBe(['valid' => true, 'code' => 'available', 'message' => 'This address is available.'])
+        ->and($view['accent_ink'])->toBe('#FFFFFF')
+        ->and($view['accent_contrast'])->toBeGreaterThan(4.5)
+        ->and($view['sms_available'])->toBeFalse()
+        ->and($view['customer_portal_installed'])->toBeFalse()
+        ->and($view['admin']['generic_page'])->toBe(['enabled' => true]);
+
+    $probe->extensions   = [['name' => 'fleetbase/customer-portal-api']];
+    $probe->smsProviders = ['twilio' => ['available' => true], 'vonage' => ['available' => true]];
+
+    expect($probe->getTrackingPageSettings()->getData(true))
+        ->toMatchArray(['sms_available' => true, 'customer_portal_installed' => true]);
+
+    $probe->smsProviders = ['twilio' => ['available' => true]];
+    expect($probe->getTrackingPageSettings()->getData(true)['sms_available'])->toBeFalse();
+
+    config(['services.twilio.sid' => 'AC123', 'services.twilio.token' => 'secret']);
+    expect($probe->getTrackingPageSettings()->getData(true)['sms_available'])->toBeTrue();
+});
+
+test('saving tracking page settings indexes the slug and frees the old one', function () {
+    $probe = fleetopsTrackingPageProbe();
+
+    $saved = $probe->saveTrackingPageSettings(fleetopsTrackingPageRequest([
+        'org_page' => ['enabled' => true, 'slug' => 'northwind'],
+        'branding' => ['accent' => '#0B6E68'],
+    ]))->getData(true);
+
+    expect($saved['org_page'])->toBe(['enabled' => true, 'slug' => 'northwind'])
+        ->and($saved['branding']['accent'])->toBe('#0B6E68')
+        ->and($probe->companySettings[TrackingPageConfig::SETTING_KEY]['org_page']['slug'])->toBe('northwind')
+        ->and($probe->settings[TrackingPageConfig::SLUG_INDEX_PREFIX . 'northwind'])->toBe('company-1')
+        ->and($probe->configured)->toBe([[TrackingPageConfig::SLUG_INDEX_PREFIX . 'northwind', 'company-1']]);
+
+    $probe->saveTrackingPageSettings(fleetopsTrackingPageRequest(['org_page' => ['enabled' => true, 'slug' => 'northwind-couriers']]));
+
+    expect($probe->settings[TrackingPageConfig::SLUG_INDEX_PREFIX . 'northwind'])->toBeNull()
+        ->and($probe->settings[TrackingPageConfig::SLUG_INDEX_PREFIX . 'northwind-couriers'])->toBe('company-1');
+
+    // A previous slug that another company now holds is left alone.
+    $probe->settings[TrackingPageConfig::SLUG_INDEX_PREFIX . 'northwind-couriers'] = 'company-2';
+    $probe->configured                                                            = [];
+    $probe->saveTrackingPageSettings(fleetopsTrackingPageRequest(['org_page' => ['enabled' => false, 'slug' => 'northwind-express']]));
+
+    expect($probe->configured)->toBe([[TrackingPageConfig::SLUG_INDEX_PREFIX . 'northwind-express', 'company-1']])
+        ->and($probe->settings[TrackingPageConfig::SLUG_INDEX_PREFIX . 'northwind-couriers'])->toBe('company-2');
+});
+
+test('an enabled organization page refuses an unusable slug while a disabled one keeps it unindexed', function () {
+    $probe                                                                  = fleetopsTrackingPageProbe();
+    $probe->settings[TrackingPageConfig::SLUG_INDEX_PREFIX . 'taken-slug'] = 'company-2';
+
+    expect($probe->saveTrackingPageSettings(fleetopsTrackingPageRequest(['org_page' => ['enabled' => true, 'slug' => 'taken-slug']]))->getData(true))
+        ->toBe(['error' => 'Another organization already uses this address.'])
+        ->and($probe->saveTrackingPageSettings(fleetopsTrackingPageRequest(['org_page' => ['enabled' => true, 'slug' => 'track']]))->getData(true))
+        ->toBe(['error' => 'This address is reserved. Please choose another.'])
+        ->and($probe->saveTrackingPageSettings(fleetopsTrackingPageRequest(['org_page' => ['enabled' => true, 'slug' => 'a b']]))->getData(true)['error'])
+        ->toStartWith('Use 3 to 40 lowercase letters')
+        ->and($probe->companySettings)->toBe([]);
+
+    $saved = $probe->saveTrackingPageSettings(fleetopsTrackingPageRequest(['org_page' => ['enabled' => false, 'slug' => 'taken-slug']]))->getData(true);
+
+    expect($saved['org_page'])->toBe(['enabled' => false, 'slug' => 'taken-slug'])
+        ->and($saved['slug_validation']['code'])->toBe('taken')
+        ->and($probe->configured)->toBe([])
+        ->and($probe->companySettings[TrackingPageConfig::SETTING_KEY]['org_page']['slug'])->toBe('taken-slug');
+});
+
+test('tracking page slugs can be checked while typed', function () {
+    $probe                                                                 = fleetopsTrackingPageProbe();
+    $probe->settings[TrackingPageConfig::SLUG_INDEX_PREFIX . 'northwind'] = 'company-1';
+    $probe->settings[TrackingPageConfig::SLUG_INDEX_PREFIX . 'harbor']    = 'company-2';
+
+    expect($probe->validateTrackingPageSlug(new Request(['slug' => ' Northwind ']))->getData(true))
+        ->toBe(['slug' => 'northwind', 'valid' => true, 'code' => 'available', 'message' => 'This address is available.'])
+        ->and($probe->validateTrackingPageSlug(new Request(['slug' => 'harbor']))->getData(true)['code'])->toBe('taken')
+        ->and($probe->validateTrackingPageSlug(new Request(['slug' => 'admin']))->getData(true)['code'])->toBe('reserved')
+        ->and($probe->validateTrackingPageSlug(new Request())->getData(true)['code'])->toBe('invalid');
+
+    $probe->settings[TrackingPageConfig::SLUG_INDEX_PREFIX . 'empty-owner'] = '';
+    expect($probe->validateTrackingPageSlug(new Request(['slug' => 'empty-owner']))->getData(true)['valid'])->toBeTrue();
+});
+
+test('admin tracking page defaults are read and saved sanitized', function () {
+    $probe = fleetopsTrackingPageProbe();
+
+    expect($probe->getAdminTrackingPageSettings()->getData(true)['generic_page'])->toBe(['enabled' => true]);
+
+    $saved = $probe->saveAdminTrackingPageSettings(fleetopsTrackingPageRequest([
+        'generic_page' => ['enabled' => false],
+        'branding'     => ['accent' => 'nope', 'website' => 'https://fleetbase.example'],
+    ]))->getData(true);
+
+    expect($saved['generic_page'])->toBe(['enabled' => false])
+        ->and($saved['branding']['accent'])->toBe('#1F5FA8')
+        ->and($saved['branding']['website'])->toBe('https://fleetbase.example')
+        ->and($probe->settings[TrackingPageConfig::ADMIN_SETTING_KEY])->toBe($saved)
+        ->and($probe->getAdminTrackingPageSettings()->getData(true))->toBe($saved)
+        ->and($probe->getTrackingPageSettings()->getData(true)['admin'])->toBe($saved);
+});

package/server/tests/Unit/Console/PruneTelematicsDataCommandTest.php

@@ -61,6 +61,12 @@ function fleetopsPruneBoot(): SQLiteConnection
         (require $migration)->up();
     }
 
+    // Each run remembers how far compaction got per scope; a watermark left by an earlier
+    // test would hide the rows this one inserts below it.
+    foreach (['company-1', 'company-2', 'orphans'] as $scope) {
+        Illuminate\Support\Facades\Cache::forget(PruneTelematicsData::WATERMARK_PREFIX . $scope);
+    }
+
     Carbon::setTestNow('2026-09-23 12:00:00 UTC');
     DB::table('companies')->insert([
         ['id' => 1, 'uuid' => 'company-1', 'public_id' => 'company_one'],
@@ -322,6 +328,51 @@ test('prune takes a bounded lock and yields to a run already in progress', funct
     }
 });
 
+test('compaction resumes from the last complete sweep and survives a cache outage', function () {
+    fleetopsPruneBoot();
+    DB::table('device_events')->insert([fleetopsPruneEvent('e-aged', 'company-1', 10)]);
+
+    $command                     = new PruneTelematicsDataProbe();
+    $command->options['company'] = 'company_one';
+    $command->options['table']   = ['device_events'];
+    $command->policies           = ['company-1' => ['event_retention_days' => 30, 'event_compact_after_days' => 7]];
+
+    // A complete sweep records how far it got.
+    expect($command->handle())->toBe(0)
+        ->and(DB::table('device_events')->whereNull('payload')->count())->toBe(1)
+        ->and(Illuminate\Support\Facades\Cache::get(PruneTelematicsData::WATERMARK_PREFIX . 'company-1'))->toBe('2026-09-16 12:00:00');
+
+    // Rows below the watermark were compacted by that sweep, so the next run does not revisit them.
+    DB::table('device_events')->insert([fleetopsPruneEvent('e-below-watermark', 'company-1', 20)]);
+    $command->messages = [];
+    expect($command->handle())->toBe(0)
+        ->and(DB::table('device_events')->where('uuid', 'e-below-watermark')->value('payload'))->not->toBeNull()
+        ->and($command->messages)->toBe([['info', 'Telematics prune complete: deleted=0 compacted=0 batches=0']]);
+
+    // Without a cache the sweep still runs, over the whole window.
+    $originalCache = Illuminate\Support\Facades\Cache::getFacadeRoot();
+    try {
+        Illuminate\Support\Facades\Cache::swap(new class(new Illuminate\Cache\ArrayStore()) extends Illuminate\Cache\Repository {
+            public function get($key, $default = null): mixed
+            {
+                throw new RuntimeException('cache down');
+            }
+
+            public function forever($key, $value)
+            {
+                throw new RuntimeException('cache down');
+            }
+        });
+
+        $command->messages = [];
+        expect($command->handle())->toBe(0)
+            ->and(DB::table('device_events')->whereNull('payload')->count())->toBe(2)
+            ->and($command->messages)->toContain(['info', 'company_one device_events: deleted=0 compacted=1 batches=1']);
+    } finally {
+        Illuminate\Support\Facades\Cache::swap($originalCache);
+    }
+});
+
 test('prune resolves the live company policy when none is injected', function () {
     fleetopsPruneBoot();
     Fleetbase\FleetOps\Support\Telematics\Retention\RetentionPolicy::flush();

package/server/tests/Unit/Events/OrderDispatchFailedTest.php

@@ -6,7 +6,8 @@ use Illuminate\Support\Str;
 
 class FleetOpsOrderDispatchFailedUnitProbe extends OrderDispatchFailed
 {
-    public function getEventData(): array
+    // core-api 1.6.68 adds an optional $channel parameter; the literal keeps this probe loadable on earlier versions too.
+    public function getEventData(string $channel = 'webhook'): array
     {
         return [];
     }