@fleetbase/fleetops-engine 0.6.71 → 0.6.72

package/server/tests/CompactResourceSerializationTest.php

@@ -2739,8 +2739,8 @@ test('tracking number and waypoint webhook resources serialize tracking contract
         'scheduled_at'       => '2026-07-30 09:00:00',
     ]);
 
-    // The decoded QR content is a debug-only field and must never ride along on a webhook,
-    // which is a separate literal payload rather than a filtered toArray().
+    // The webhook is a separate literal payload rather than a filtered toArray(), and its
+    // shape is unchanged: the QR content is not added to it.
     expect(array_key_exists('qr_code_content', (new TrackingNumberResource($trackingNumber))->toWebhookPayload()))->toBeFalse();
 
     expect((new TrackingNumberResource($trackingNumber))->toWebhookPayload())->toMatchArray([
@@ -2790,14 +2790,15 @@ test('tracking number and waypoint webhook resources serialize tracking contract
         ]);
 });
 
-test('tracking number resource publishes the qr code content only in debug mode', function () {
-    // qr_code is a base64 PNG generated from owner_uuid, and the endpoints that consume a
-    // scanned code match on that uuid. Debug builds publish the value beside the image so
-    // an automated client can follow the flow without decoding a PNG; production must not.
+test('tracking number resource publishes a scannable qr code content beside the image', function () {
+    // qr_code is a base64 PNG; qr_code_content is the text current labels encode in it,
+    // a tracking url naming the tracking number and the subject's public id. Both are in
+    // the resource already, so it is published in every environment.
     $trackingNumber = fleetopsCompactResourceFixture([
-        'tracking_number'  => 'TN-DEBUG',
-        'owner_uuid'       => 'owner-uuid-under-the-qr',
+        'tracking_number'  => 'TN-SCAN',
+        'owner_uuid'       => 'owner-uuid-never-published',
         'owner_type'       => 'Fleetbase\\FleetOps\\Models\\Order',
+        'owner'            => (object) ['public_id' => 'order_public'],
         'region'           => 'sg',
         'qr_code'          => 'qr-data',
         'barcode'          => 'barcode-data',
@@ -2811,70 +2812,33 @@ test('tracking number resource publishes the qr code content only in debug mode'
     // cover the index resource and the webhook payload.
     $previousContainer = Illuminate\Container\Container::getInstance();
     $container         = new class extends Illuminate\Container\Container {
-        public bool $debugMode = false;
-
         public function environment(...$environments)
         {
             return in_array('testing', $environments, true) || $environments === [] ? 'testing' : false;
         }
-
-        // Stands in for the framework's Application::hasDebugModeEnabled().
-        public function hasDebugModeEnabled()
-        {
-            return $this->debugMode;
-        }
     };
     $container->instance('config', new Illuminate\Config\Repository([
         'fleetbase' => ['console' => ['host' => 'console.fleetbase.test', 'subdomain' => null, 'secure' => true]],
     ]));
     Illuminate\Container\Container::setInstance($container);
 
-    // Drive the REAL accessor through the container rather than overriding it, so the
-    // debug check itself is exercised and not just the resource's use of it.
-    $container->debugMode = true;
-    $withDebug            = new TrackingNumberResource($trackingNumber);
-
     try {
-        $debugPayload = $withDebug->resolve($request);
-
-        $container->debugMode = false;
-        $productionPayload    = (new TrackingNumberResource($trackingNumber))->resolve($request);
+        $payload       = (new TrackingNumberResource($trackingNumber))->resolve($request);
+        $withoutNumber = (new TrackingNumberResource(fleetopsCompactResourceFixture([
+            'tracking_number' => null,
+            'owner_type'      => 'Fleetbase\\FleetOps\\Models\\Order',
+            'owner'           => null,
+        ])))->resolve($request);
     } finally {
         Illuminate\Container\Container::setInstance($previousContainer);
     }
 
-    // Present and exactly the value the QR was generated from — not a public id.
-    expect($debugPayload['qr_code_content'])->toBe('owner-uuid-under-the-qr')
-        ->and($debugPayload['qr_code'])->toBe('qr-data')
-        // Absent, not null: `when()` drops the key entirely, so a production response is
-        // byte-identical to one from before the field existed.
-        ->and(array_key_exists('qr_code_content', $productionPayload))->toBeFalse()
-        ->and($productionPayload['qr_code'])->toBe('qr-data');
-});
-
-test('tracking number resource fails closed when the debug state cannot be determined', function () {
-    // Any failure to resolve the debug state must answer false rather than defaulting to
-    // exposure. The real accessor is exercised here with no usable application bound.
-    $expose = new ReflectionMethod(TrackingNumberResource::class, 'exposesQrCodeContent');
-    $expose->setAccessible(true);
-
-    $previous = Illuminate\Container\Container::getInstance();
-
-    try {
-        // A container that is not an Application has no hasDebugModeEnabled().
-        Illuminate\Container\Container::setInstance(new Illuminate\Container\Container());
-        expect($expose->invoke(null))->toBeFalse();
-
-        // And an accessor that throws must also answer false rather than propagating —
-        // a resource must not be able to fail serialization over a debug check.
-        Illuminate\Container\Container::setInstance(new class extends Illuminate\Container\Container {
-            public function hasDebugModeEnabled()
-            {
-                throw new RuntimeException('debug state unavailable');
-            }
-        });
-        expect($expose->invoke(null))->toBeFalse();
-    } finally {
-        Illuminate\Container\Container::setInstance($previous);
-    }
+    expect($payload['qr_code_content'])->toBe('https://console.fleetbase.test/~/track-order?order=TN-SCAN&r=order_public&v=1')
+        ->and($payload['qr_code_content'])->not->toContain('owner-uuid')
+        ->and($payload['url'])->toBe('https://console.fleetbase.test/~/track/TN-SCAN')
+        ->and($payload['qr_code'])->toBe('qr-data')
+        // Nothing to scan without a tracking number: the key is absent, not null.
+        ->and(array_key_exists('qr_code_content', $withoutNumber))->toBeFalse()
+        // Nor is there a tracking page to link to.
+        ->and(array_key_exists('url', $withoutNumber))->toBeFalse();
 });

package/server/tests/ControllerFilterContractsTest.php

@@ -1152,7 +1152,7 @@ test('contact filter records identity address and date filters', function () {
         ->and(collect($query->calls)->where(0, 'whereBetween')->values())->toHaveCount(1)
         ->and(collect($query->calls)->where(0, 'whereDate')->values())->toHaveCount(1);
 
-    $address = collect($query->calls)->first(fn ($call) => $call[0] === 'whereHas' && $call[1] === 'addresses');
+    $address = collect($query->calls)->first(fn ($call) => $call[0] === 'whereHas' && $call[1] === 'place');
 
     expect($address[2])->toBe([
         ['search', '1 Test Street'],

package/server/tests/CustomerContactIdentitySafetyTest.php

@@ -74,7 +74,7 @@ test('customer portal welcome email is opt in and does not create organization i
         ->not->toContain('send_invite');
 
     expect($customerCredentials)->toContain('customer portal access is ready')
-        ->and($customerCredentials)->toContain("Utils::consoleUrl(\$accessUrlSlug ?: 'customer-portal')")
+        ->and($customerCredentials)->toContain("Utils::consoleUrl(\$accessUrlSlug ? 'customer-access/' . \$accessUrlSlug : 'customer-portal')")
         ->and($customerEmail)->toContain('Your customer portal access is ready')
         ->and($customerEmail)->toContain('Sign in to customer portal')
         ->and($customerEmail)->toContain('Temporary password:')

package/server/tests/EventContractsTest.php

@@ -33,6 +33,8 @@ use Fleetbase\FleetOps\Models\FuelProviderTransaction;
 use Fleetbase\FleetOps\Models\FuelReport;
 use Fleetbase\FleetOps\Models\GeofenceEventLog;
 use Fleetbase\FleetOps\Models\Order;
+use Fleetbase\FleetOps\Models\Payload;
+use Fleetbase\FleetOps\Models\Place;
 use Fleetbase\FleetOps\Models\TrackingStatus;
 use Fleetbase\FleetOps\Models\Vehicle;
 use Fleetbase\FleetOps\Models\Waypoint;
@@ -231,6 +233,11 @@ class FleetOpsUserRemovedDriverDeleteQueryFake
 {
     public bool $deleted = false;
 
+    public function get(): Illuminate\Support\Collection
+    {
+        return collect([$this]);
+    }
+
     public function delete(): void
     {
         $this->deleted = true;
@@ -832,8 +839,19 @@ test('geofence entered listener handles arrival branch outcomes', function () {
         'name'      => 'Event Zone',
     ], 'zone', new Point(1.3521, 103.8198));
 
-    $place        = (object) ['location' => new Point(1.3521, 103.8198)];
-    $destination  = (object) ['place' => $place];
+    $payloadTo = function (?Point $location): Payload {
+        $pickup = new Place();
+        $pickup->setRawAttributes(['uuid' => 'pickup-place-uuid', 'location' => $location], true);
+
+        $payload = new Payload();
+        $payload->setRawAttributes(['uuid' => 'arrival-payload-uuid'], true);
+        $payload->setRelation('pickup', $pickup);
+        $payload->setRelation('dropoff', null);
+        $payload->setRelation('waypoints', collect());
+        $payload->setRelation('waypointMarkers', collect());
+
+        return $payload;
+    };
     $nearGeofence = new class {
         public string $uuid      = 'near-zone-uuid';
         public string $public_id = 'near_zone_public';
@@ -896,66 +914,14 @@ test('geofence entered listener handles arrival branch outcomes', function () {
         return $order;
     };
 
-    $missingPlaceOrder = $makeOrder((object) [
-        'getPickupOrCurrentWaypoint' => null,
-    ]);
-    $missingPlaceOrder->setRelation('payload', new class($destination) {
-        public function __construct(private object $destination)
-        {
-        }
-
-        public function getPickupOrCurrentWaypoint(): object
-        {
-            return (object) ['place' => (object) ['location' => null]];
-        }
-    });
-
-    $farOrder = $makeOrder(new class($destination) {
-        public function __construct(private object $destination)
-        {
-        }
-
-        public function getPickupOrCurrentWaypoint(): object
-        {
-            return $this->destination;
-        }
-    });
-
-    $badCentroidOrder = $makeOrder(new class($destination) {
-        public function __construct(private object $destination)
-        {
-        }
-
-        public function getPickupOrCurrentWaypoint(): object
-        {
-            return $this->destination;
-        }
-    });
-
-    $customer     = new FleetOpsGeofenceArrivalCustomerFake();
-    $successOrder = $makeOrder(new class($destination) {
-        public function __construct(private object $destination)
-        {
-        }
-
-        public function getPickupOrCurrentWaypoint(): object
-        {
-            return $this->destination;
-        }
-    }, $customer);
-
+    $missingPlaceOrder             = $makeOrder($payloadTo(null));
+    $farOrder                      = $makeOrder($payloadTo(new Point(1.3521, 103.8198)));
+    $badCentroidOrder              = $makeOrder($payloadTo(new Point(1.3521, 103.8198)));
+    $customer                      = new FleetOpsGeofenceArrivalCustomerFake();
+    $successOrder                  = $makeOrder($payloadTo(new Point(1.3521, 103.8198)), $customer);
     $throwingCustomer              = new FleetOpsGeofenceArrivalCustomerFake();
     $throwingCustomer->shouldThrow = true;
-    $notificationFailureOrder      = $makeOrder(new class($destination) {
-        public function __construct(private object $destination)
-        {
-        }
-
-        public function getPickupOrCurrentWaypoint(): object
-        {
-            return $this->destination;
-        }
-    }, $throwingCustomer);
+    $notificationFailureOrder      = $makeOrder($payloadTo(new Point(1.3521, 103.8198)), $throwingCustomer);
 
     $arrival->invoke($listener, $driver, $nearGeofence, $missingPlaceOrder, $event);
     $arrival->invoke($listener, $driver, $farGeofence, $farOrder, $event);

package/server/tests/ExpansionContractsTest.php

@@ -11,7 +11,9 @@ function bindFleetOpsExpansionClosure(Closure $closure, object $target): Closure
     return $closure->bindTo($target, $target::class);
 }
 
-class FleetOpsExpansionRelationFake
+// The expansion closures declare HasOne / HasMany return types, so the fakes extend
+// those relations; the parent constructor is skipped on purpose.
+trait FleetOpsExpansionRecordsRelationCalls
 {
     public array $calls = [];
 
@@ -34,6 +36,16 @@ class FleetOpsExpansionRelationFake
     }
 }
 
+class FleetOpsExpansionRelationFake extends Illuminate\Database\Eloquent\Relations\HasOne
+{
+    use FleetOpsExpansionRecordsRelationCalls;
+}
+
+class FleetOpsExpansionManyRelationFake extends Illuminate\Database\Eloquent\Relations\HasMany
+{
+    use FleetOpsExpansionRecordsRelationCalls;
+}
+
 class FleetOpsExpansionModelFake
 {
     public array $calls     = [];
@@ -41,9 +53,10 @@ class FleetOpsExpansionModelFake
 
     public function __construct()
     {
-        foreach (['driver', 'driverProfiles', 'customer', 'contact'] as $name) {
+        foreach (['driver', 'customer', 'contact'] as $name) {
             $this->relations[$name] = new FleetOpsExpansionRelationFake($name);
         }
+        $this->relations['driverProfiles'] = new FleetOpsExpansionManyRelationFake('driverProfiles');
     }
 
     public function hasMany($class)

package/server/tests/Feature/Http/Api/CustomerControllerHelperSeamsTest.php

@@ -452,14 +452,16 @@ test('identity checks session context and user lookups resolve', function () {
 test('verification codes files contacts and customer auth resolve', function () {
     $connection = fleetopsCustomerHelperBoot();
     $connection->table('verification_codes')->insert(['uuid' => 'vc-1', 'subject_uuid' => 'user-1', 'subject_type' => 'user', 'code' => '123456', 'for' => 'customer_verification']);
+    // A code is used up by the lookup that accepts it, so each check gets its own row.
+    $connection->table('verification_codes')->insert(['uuid' => 'vc-2', 'subject_uuid' => 'user-1', 'subject_type' => 'user', 'code' => '654321', 'for' => 'customer_verification']);
     $connection->table('files')->insert(['uuid' => 'file-1', 'public_id' => 'file_custhelp1', 'company_uuid' => 'company-1', 'name' => 'photo.png']);
     $connection->table('contacts')->insert(['uuid' => 'contact-1', 'public_id' => 'contact_custhelp1', 'company_uuid' => 'company-1', 'name' => 'Casey', 'type' => 'customer']);
 
     $probe = new FleetOpsCustomerControllerProbe();
 
-    expect($probe->callHelper('verificationCodeExists', ['code' => '123456', 'for' => 'customer_verification']))->toBeTrue()
-        ->and($probe->callHelper('findVerificationCode', ['code' => '123456'])?->uuid)->toBe('vc-1')
-        ->and($probe->callHelper('findVerificationCode', ['code' => '999999']))->toBeNull()
+    expect($probe->callHelper('verificationCodeExists', ['code' => '654321', 'for' => 'customer_verification']))->toBeTrue()
+        ->and($probe->callHelper('findVerificationCode', ['code' => '123456', 'for' => 'customer_verification'])?->uuid)->toBe('vc-1')
+        ->and($probe->callHelper('findVerificationCode', ['code' => '999999', 'for' => 'customer_verification']))->toBeNull()
         ->and($probe->callHelper('findFileByPublicId', 'file_custhelp1')?->uuid)->toBe('file-1');
 
     expect($probe->callHelper('findCustomerContact', ['uuid' => 'contact-1'])?->name)->toBe('Casey')
@@ -829,3 +831,27 @@ test('customer place photo and quote seams resolve through their real bodies', f
     expect($connection->table('contacts')->where('uuid', '88888888-8888-4888-8888-888888888820')->value('photo_uuid'))->toBe('file-b64-1');
     app()->forgetInstance(CustomerAuth::APP_BINDING);
 });
+
+test('a wrong code counts against the live code, a right one uses it up, and a used code never verifies again', function () {
+    $connection = fleetopsCustomerHelperBoot();
+    $controller = new CustomerController();
+
+    $connection->table('verification_codes')->insert([
+        ['uuid' => 'vc-older', 'code' => '101010', 'for' => 'fleetops_create_customer', 'meta' => json_encode(['identity' => 'spend@example.com']), 'status' => 'active', 'created_at' => '2026-10-13 09:00:00'],
+        ['uuid' => 'vc-newer', 'code' => '202020', 'for' => 'fleetops_create_customer', 'meta' => json_encode(['identity' => 'spend@example.com']), 'status' => 'active', 'created_at' => '2026-10-13 09:05:00'],
+    ]);
+
+    $wrong = $controller->create(CreateCustomerRequest::create('/v1/customers', 'POST', ['code' => '999999', 'identity' => 'spend@example.com', 'name' => 'Spender', 'password' => 'secret']));
+    expect($wrong->getData(true)['error'])->toContain('Invalid verification code')
+        ->and(json_decode($connection->table('verification_codes')->where('uuid', 'vc-newer')->value('meta'), true)['attempts'])->toBe(1)
+        ->and(json_decode($connection->table('verification_codes')->where('uuid', 'vc-older')->value('meta'), true)['attempts'])->toBe(1);
+
+    // The older code still verifies while it is live, and is used up by doing so.
+    $controller->create(CreateCustomerRequest::create('/v1/customers', 'POST', ['code' => '101010', 'identity' => 'spend@example.com', 'name' => 'Spender', 'password' => 'secret']));
+    expect($connection->table('contacts')->where('email', 'spend@example.com')->count())->toBe(1)
+        ->and($connection->table('verification_codes')->where('uuid', 'vc-older')->value('status'))->toBe('used')
+        ->and($connection->table('verification_codes')->where('uuid', 'vc-newer')->value('status'))->toBe('active');
+
+    $again = $controller->create(CreateCustomerRequest::create('/v1/customers', 'POST', ['code' => '101010', 'identity' => 'spend@example.com', 'name' => 'Spender', 'password' => 'secret']));
+    expect($again->getData(true)['error'])->toContain('Invalid verification code');
+});

package/server/tests/Feature/Http/Api/DriverControllerAuthFlowsTest.php

@@ -304,6 +304,29 @@ test('phone login reports the sms method when the transport delivers', function
         ->and($connection->table('verification_codes')->where('for', 'driver_login')->count())->toBe(1);
 });
 
+test('phone login passes an sms guard refusal through once no email can carry the code', function () {
+    $connection = fleetopsDriverAuthBoot();
+    app()->instance('twilio', new class {
+        public function message($to, $text, $mediaUrls = [], $params = [])
+        {
+            throw Fleetbase\Exceptions\SmsBlockedException::paused('platform', 300);
+        }
+    });
+    Fleetbase\Twilio\Support\Laravel\Facade::clearResolvedInstances();
+
+    // With an email on file the refusal is handled like any send failure: by email.
+    app()->instance('request', Request::create('/x', 'POST', ['phone' => '6591234567']));
+    $byEmail = (new DriverController())->loginWithPhone();
+    expect($byEmail->getData(true))->toBe(['status' => 'OK', 'method' => 'email']);
+
+    // Without one, the app gets the refusal itself: 423 and how long to wait.
+    $connection->table('users')->where('uuid', 'user-1')->update(['email' => null]);
+    $refused = (new DriverController())->loginWithPhone();
+    expect($refused->getStatusCode())->toBe(423)
+        ->and($refused->headers->get('Retry-After'))->toBe('300')
+        ->and($refused->getData(true)['error'])->toBe('Text messages are temporarily unavailable. Try again later.');
+});
+
 test('code verification handles unknown users invalid codes bypass and success', function () {
     $connection = fleetopsDriverAuthBoot();
     $controller = new DriverController();

package/server/tests/Feature/Http/Api/OrderControllerNearbyFiltersTest.php

@@ -135,19 +135,20 @@ function fleetopsOrderNearbyBoot(): SQLiteConnection
 
     $schema = $connection->getSchemaBuilder();
     $tables = [
-        'orders'            => ['uuid', 'public_id', 'internal_id', 'company_uuid', 'payload_uuid', 'driver_assigned_uuid', 'customer_uuid', 'customer_type', 'facilitator_uuid', 'facilitator_type', 'tracking_number_uuid', 'status', 'pod_required', 'dispatched', 'scheduled_at', 'type'],
-        'payloads'          => ['uuid', 'public_id', 'company_uuid', 'pickup_uuid', 'dropoff_uuid', 'return_uuid', 'current_waypoint_uuid', 'type'],
-        'places'            => ['uuid', 'public_id', 'company_uuid', 'name', 'street1', 'city', 'country', 'location', 'meta'],
-        'waypoints'         => ['uuid', 'public_id', 'company_uuid', 'payload_uuid', 'place_uuid'],
-        'entities'          => ['uuid', 'public_id', 'internal_id', 'company_uuid', 'payload_uuid', 'name'],
-        'drivers'           => ['uuid', 'public_id', 'company_uuid', 'user_uuid', 'location'],
-        'users'             => ['uuid', 'public_id', 'company_uuid', 'type'],
-        'contacts'          => ['uuid', 'public_id', 'internal_id', 'company_uuid', 'name'],
-        'vendors'           => ['uuid', 'public_id', 'internal_id', 'company_uuid', 'name'],
-        'companies'         => ['uuid', 'public_id', 'name', 'options'],
-        'tracking_numbers'  => ['uuid', 'public_id', 'company_uuid', 'tracking_number', 'owner_uuid', 'owner_type', 'status_uuid', '_key'],
-        'tracking_statuses' => ['uuid', 'public_id', 'company_uuid', 'tracking_number_uuid', 'code', 'status', 'details'],
-        'directives'        => ['uuid', 'company_uuid', 'permission_uuid', 'subject_type', 'subject_uuid', 'key', 'rules'],
+        'orders'             => ['uuid', 'public_id', 'internal_id', 'company_uuid', 'payload_uuid', 'driver_assigned_uuid', 'customer_uuid', 'customer_type', 'facilitator_uuid', 'facilitator_type', 'tracking_number_uuid', 'status', 'pod_required', 'dispatched', 'scheduled_at', 'type'],
+        'payloads'           => ['uuid', 'public_id', 'company_uuid', 'pickup_uuid', 'dropoff_uuid', 'return_uuid', 'current_waypoint_uuid', 'type'],
+        'places'             => ['uuid', 'public_id', 'company_uuid', 'name', 'street1', 'city', 'country', 'location', 'meta'],
+        'waypoints'          => ['uuid', 'public_id', 'company_uuid', 'payload_uuid', 'place_uuid'],
+        'entities'           => ['uuid', 'public_id', 'internal_id', 'company_uuid', 'payload_uuid', 'name'],
+        'drivers'            => ['uuid', 'public_id', 'company_uuid', 'user_uuid', 'location'],
+        'users'              => ['uuid', 'public_id', 'company_uuid', 'type'],
+        'contacts'           => ['uuid', 'public_id', 'internal_id', 'company_uuid', 'name'],
+        'vendors'            => ['uuid', 'public_id', 'internal_id', 'company_uuid', 'name'],
+        'integrated_vendors' => ['uuid', 'public_id', 'company_uuid', 'provider'],
+        'companies'          => ['uuid', 'public_id', 'name', 'options'],
+        'tracking_numbers'   => ['uuid', 'public_id', 'company_uuid', 'tracking_number', 'owner_uuid', 'owner_type', 'status_uuid', '_key'],
+        'tracking_statuses'  => ['uuid', 'public_id', 'company_uuid', 'tracking_number_uuid', 'code', 'status', 'details'],
+        'directives'         => ['uuid', 'company_uuid', 'permission_uuid', 'subject_type', 'subject_uuid', 'key', 'rules'],
     ];
     foreach ($tables as $table => $columns) {
         $schema->create($table, function ($blueprint) use ($columns) {
@@ -276,7 +277,6 @@ test('facilitator and customer filters constrain by public and internal ids', fu
         'facilitator' => 'vendor_nearby1',
         'customer'    => 'contact_nearby1',
     ]));
-    // MorphTo whereHas subqueries build and constrain without matching in
-    // the harness morph map
-    expect($result->count())->toBeGreaterThanOrEqual(0);
+    // Both ids resolve to the uuids the order stores, so exactly that order matches.
+    expect($result->pluck('uuid')->all())->toBe(['order-1']);
 });

package/server/tests/Feature/Http/Api/OrderControllerQueryFiltersTest.php

@@ -73,20 +73,21 @@ function fleetopsOrderQueryFiltersBoot(): SQLiteConnection
 
     $schema = $connection->getSchemaBuilder();
     $tables = [
-        'orders'            => ['uuid', 'public_id', 'internal_id', 'company_uuid', 'payload_uuid', 'driver_assigned_uuid', 'vehicle_assigned_uuid', 'customer_uuid', 'customer_type', 'facilitator_uuid', 'facilitator_type', 'tracking_number_uuid', 'status', 'pod_required', 'dispatched', 'scheduled_at', 'type'],
-        'payloads'          => ['uuid', 'public_id', 'company_uuid', 'pickup_uuid', 'dropoff_uuid', 'return_uuid', 'current_waypoint_uuid', 'type'],
-        'places'            => ['uuid', 'public_id', 'company_uuid', 'name', 'location'],
-        'waypoints'         => ['uuid', 'public_id', 'company_uuid', 'payload_uuid', 'place_uuid', 'location'],
-        'entities'          => ['uuid', 'public_id', 'internal_id', 'company_uuid', 'payload_uuid', 'tracking_number_uuid', 'name'],
-        'tracking_numbers'  => ['uuid', 'public_id', 'company_uuid', 'tracking_number', 'owner_uuid', 'status_uuid'],
-        'tracking_statuses' => ['uuid', 'public_id', 'company_uuid', 'tracking_number_uuid', 'code', 'status'],
-        'drivers'           => ['uuid', 'public_id', 'company_uuid', 'user_uuid', 'location'],
-        'users'             => ['uuid', 'public_id', 'company_uuid'],
-        'vehicles'          => ['uuid', 'public_id', 'company_uuid'],
-        'contacts'          => ['uuid', 'public_id', 'internal_id', 'company_uuid', 'name'],
-        'vendors'           => ['uuid', 'public_id', 'internal_id', 'company_uuid', 'name'],
-        'companies'         => ['uuid', 'public_id', 'name', 'options'],
-        'directives'        => ['uuid', 'company_uuid', 'permission_uuid', 'subject_type', 'subject_uuid', 'key', 'rules'],
+        'orders'             => ['uuid', 'public_id', 'internal_id', 'company_uuid', 'payload_uuid', 'driver_assigned_uuid', 'vehicle_assigned_uuid', 'customer_uuid', 'customer_type', 'facilitator_uuid', 'facilitator_type', 'tracking_number_uuid', 'status', 'pod_required', 'dispatched', 'scheduled_at', 'type'],
+        'payloads'           => ['uuid', 'public_id', 'company_uuid', 'pickup_uuid', 'dropoff_uuid', 'return_uuid', 'current_waypoint_uuid', 'type'],
+        'places'             => ['uuid', 'public_id', 'company_uuid', 'name', 'location'],
+        'waypoints'          => ['uuid', 'public_id', 'company_uuid', 'payload_uuid', 'place_uuid', 'location'],
+        'entities'           => ['uuid', 'public_id', 'internal_id', 'company_uuid', 'payload_uuid', 'tracking_number_uuid', 'name'],
+        'tracking_numbers'   => ['uuid', 'public_id', 'company_uuid', 'tracking_number', 'owner_uuid', 'status_uuid'],
+        'tracking_statuses'  => ['uuid', 'public_id', 'company_uuid', 'tracking_number_uuid', 'code', 'status'],
+        'drivers'            => ['uuid', 'public_id', 'company_uuid', 'user_uuid', 'location'],
+        'users'              => ['uuid', 'public_id', 'company_uuid'],
+        'vehicles'           => ['uuid', 'public_id', 'company_uuid'],
+        'contacts'           => ['uuid', 'public_id', 'internal_id', 'company_uuid', 'name'],
+        'vendors'            => ['uuid', 'public_id', 'internal_id', 'company_uuid', 'name'],
+        'integrated_vendors' => ['uuid', 'public_id', 'company_uuid', 'provider'],
+        'companies'          => ['uuid', 'public_id', 'name', 'options'],
+        'directives'         => ['uuid', 'company_uuid', 'permission_uuid', 'subject_type', 'subject_uuid', 'key', 'rules'],
     ];
     foreach ($tables as $table => $columns) {
         $schema->create($table, function ($blueprint) use ($columns) {
@@ -182,3 +183,29 @@ test('query supports entity status arrays', function () {
 
     expect($result->count())->toBe(0);
 });
+
+test('query finds orders by facilitator and customer public ids', function () {
+    $connection = fleetopsOrderQueryFiltersBoot();
+    $connection->table('payloads')->insert(['uuid' => 'payload-1', 'public_id' => 'payload_test', 'company_uuid' => 'company-1']);
+    $connection->table('vendors')->insert(['uuid' => 'vendor-1', 'public_id' => 'vendor_facil', 'internal_id' => 'VND-1', 'company_uuid' => 'company-1']);
+    $connection->table('integrated_vendors')->insert(['uuid' => 'integrated-vendor-1', 'public_id' => 'integrated_vendor_facil', 'company_uuid' => 'company-1']);
+    $connection->table('contacts')->insert(['uuid' => 'contact-1', 'public_id' => 'contact_cust', 'company_uuid' => 'company-1']);
+    // The stored type is the class name, which is not the morph class the
+    // morph map gives these models — the mismatch that emptied every result.
+    $connection->table('orders')->insert([
+        ['uuid' => 'order-1', 'public_id' => 'order_a', 'company_uuid' => 'company-1', 'payload_uuid' => 'payload-1', 'facilitator_uuid' => 'vendor-1', 'facilitator_type' => 'Fleetbase\FleetOps\Models\Vendor', 'customer_uuid' => 'contact-1', 'customer_type' => 'Fleetbase\FleetOps\Models\Contact'],
+        ['uuid' => 'order-2', 'public_id' => 'order_b', 'company_uuid' => 'company-1', 'payload_uuid' => 'payload-1', 'facilitator_uuid' => 'integrated-vendor-1', 'facilitator_type' => 'Fleetbase\FleetOps\Models\IntegratedVendor', 'customer_uuid' => 'vendor-1', 'customer_type' => 'Fleetbase\FleetOps\Models\Vendor'],
+        ['uuid' => 'order-3', 'public_id' => 'order_c', 'company_uuid' => 'company-1', 'payload_uuid' => 'payload-1', 'facilitator_uuid' => null, 'facilitator_type' => null, 'customer_uuid' => null, 'customer_type' => null],
+    ]);
+
+    $publicIds = fn (array $input) => (new OrderController())->query(fleetopsOrderQueryFiltersRequest($input))->pluck('public_id')->sort()->values()->all();
+
+    expect($publicIds(['facilitator' => 'vendor_facil']))->toBe(['order_a'])
+        ->and($publicIds(['facilitator' => 'VND-1']))->toBe(['order_a'])
+        ->and($publicIds(['facilitator' => 'integrated_vendor_facil']))->toBe(['order_b'])
+        ->and($publicIds(['customer' => 'contact_cust']))->toBe(['order_a'])
+        ->and($publicIds(['customer' => 'vendor_facil']))->toBe(['order_b'])
+        // An unknown id matches nothing, never every order.
+        ->and($publicIds(['facilitator' => 'vendor_missing']))->toBe([])
+        ->and($publicIds(['customer' => 'contact_missing']))->toBe([]);
+});

package/server/tests/Feature/Http/Api/TrackingNumberControllerHelpersTest.php

@@ -133,28 +133,63 @@ test('tracking number helpers look up owners create records and wrap resources',
         ->and($helper('deletedTrackingNumberResource', $found))->toBeInstanceOf(Fleetbase\FleetOps\Http\Resources\v1\DeletedResource::class)
         ->and($helper('jsonResponse', ['ok' => true], 200))->toBeInstanceOf(Illuminate\Http\JsonResponse::class);
 
-    // Qr model resolution finds models and wraps them in fleet-ops v1 resources
-    $qrModel = $helper('findQrModel', ['entities'], ['public_id' => 'entity_tnhelper1']);
-    expect($qrModel)->not->toBeNull()
-        ->and($helper('qrModelResource', $qrModel))->toBeInstanceOf(Fleetbase\FleetOps\Http\Resources\v1\Entity::class);
-
-    // A table with no eloquent mapping resolves to null rather than a raw row.
-    //
-    // The raw-row fallback was removed: it passed the ARRAY of table names to
-    // DB::table(), which stringified it to the literal table "Array" and threw
-    // SQLSTATE[42S02], so every unresolvable QR code answered 500 instead of the 400 the
-    // caller already handles. It could not have helped either way — qrModelResource()
-    // serializes through a typed resource keyed on the model class, and a raw stdClass
-    // row has none.
-    $connection->table('tracking_statuses')->insert([
-        'uuid'      => '44444444-4444-4444-8444-444444444403',
-        'public_id' => 'tracking_status_tnhelper1',
-        'code'      => 'DISPATCHED',
-        'status'    => 'Dispatched',
+    // Qr model resolution goes through the shared resolver and wraps the owner in its
+    // fleet-ops v1 resource.
+    $connection->table('tracking_numbers')->insert([
+        'uuid'            => '44444444-4444-4444-8444-444444444404',
+        'public_id'       => 'track_tnhelper2',
+        'company_uuid'    => 'company-1',
+        'tracking_number' => 'FLB-HELPER-2',
+        'owner_uuid'      => '44444444-4444-4444-8444-444444444402',
+        'owner_type'      => Fleetbase\FleetOps\Models\Entity::class,
+    ]);
+
+    $qrModel = $helper('findQrModel', 'https://console.fleetbase.test/track-order?order=FLB-HELPER-2&r=entity_tnhelper1&v=1');
+    expect($qrModel)->toBeInstanceOf(Fleetbase\FleetOps\Models\Entity::class)
+        ->and($helper('qrModelResource', $qrModel))->toBeInstanceOf(Fleetbase\FleetOps\Http\Resources\v1\Entity::class)
+        ->and($helper('findQrModel', '{{qr_code}}'))->toBeNull();
+});
+
+test('tracking number owners resolve from every code format within the company', function () {
+    $connection = fleetopsTrackingNumberHelpersBoot();
+    $connection->table('orders')->insert(['uuid' => '55555555-5555-4555-8555-555555555501', 'public_id' => 'order_codes1', 'company_uuid' => 'company-1', 'status' => 'created']);
+    $connection->table('entities')->insert(['uuid' => '55555555-5555-4555-8555-555555555502', 'public_id' => 'entity_codes1', 'company_uuid' => 'company-1', 'name' => 'Parcel']);
+    $connection->table('orders')->insert(['uuid' => '55555555-5555-4555-8555-555555555503', 'public_id' => 'order_codes2', 'company_uuid' => 'company-2', 'status' => 'created']);
+    $connection->table('tracking_numbers')->insert([
+        ['uuid' => 'tn-codes-1', 'public_id' => 'track_codes1', 'company_uuid' => 'company-1', 'tracking_number' => 'ACM1111111111SG', 'owner_uuid' => '55555555-5555-4555-8555-555555555501', 'owner_type' => Fleetbase\FleetOps\Models\Order::class],
+        // Entity::insertGetUuid() inserts raw, storing the owner class with a leading slash.
+        ['uuid' => 'tn-codes-2', 'public_id' => 'track_codes2', 'company_uuid' => 'company-1', 'tracking_number' => 'ACM2222222222SG', 'owner_uuid' => '55555555-5555-4555-8555-555555555502', 'owner_type' => '\\' . Fleetbase\FleetOps\Models\Entity::class],
+        ['uuid' => 'tn-codes-3', 'public_id' => 'track_codes3', 'company_uuid' => 'company-2', 'tracking_number' => 'OTH3333333333SG', 'owner_uuid' => '55555555-5555-4555-8555-555555555503', 'owner_type' => Fleetbase\FleetOps\Models\Order::class],
     ]);
 
-    expect($helper('findQrModel', ['tracking_statuses'], ['public_id' => 'tracking_status_tnhelper1']))->toBeNull()
-        // And a mapped table that simply matches nothing is also null, which is the path
-        // an unknown or unresolved code takes.
-        ->and($helper('findQrModel', ['entities', 'orders'], ['uuid' => '{{qr_code}}']))->toBeNull();
+    $owner = fn (?string $code, ?string $company = 'company-1') => TrackingNumber::findOwnerByCode($code, $company)?->public_id;
+
+    // Labels in circulation carry the owner's bare uuid.
+    expect($owner('55555555-5555-4555-8555-555555555501'))->toBe('order_codes1')
+        // Current labels carry a tracking url; the host is irrelevant.
+        ->and($owner('https://console.fleetbase.test/track-order?order=ACM1111111111SG&r=order_codes1&v=1'))->toBe('order_codes1')
+        ->and($owner('https://old-host.example/track-order?order=ACM2222222222SG&v=1'))->toBe('entity_codes1')
+        // The Code 128 barcode, or a value typed by hand: a tracking number or public id.
+        ->and($owner('ACM2222222222SG'))->toBe('entity_codes1')
+        ->and($owner('entity_codes1'))->toBe('entity_codes1')
+        ->and($owner('https://console.fleetbase.test/track-order?r=order_codes1'))->toBe('order_codes1');
+
+    // A url whose two identifiers disagree, or that names an unknown tracking number, is
+    // refused rather than resolved through the half that matches.
+    expect($owner('https://console.fleetbase.test/track-order?order=ACM1111111111SG&r=entity_codes1&v=1'))->toBeNull()
+        ->and($owner('https://console.fleetbase.test/track-order?order=ACM9999999999SG&r=order_codes1&v=1'))->toBeNull()
+        // Unknown values, unmapped prefixes, and values that are no public id at all.
+        ->and($owner('55555555-5555-4555-8555-555555555599'))->toBeNull()
+        ->and($owner('ACM9999999999SG'))->toBeNull()
+        ->and($owner('vehicle_codes1'))->toBeNull()
+        ->and($owner('order_missing'))->toBeNull()
+        ->and($owner(''))->toBeNull();
+
+    // Another company's parcel never resolves, in any format, and without a company
+    // nothing does.
+    expect($owner('55555555-5555-4555-8555-555555555503'))->toBeNull()
+        ->and($owner('OTH3333333333SG'))->toBeNull()
+        ->and($owner('order_codes2'))->toBeNull()
+        ->and($owner('order_codes2', 'company-2'))->toBe('order_codes2')
+        ->and($owner('55555555-5555-4555-8555-555555555501', null))->toBeNull();
 });