@fleetbase/fleetops-engine 0.6.71 → 0.6.72

package/server/tests/Feature/Http/Internal/DriverControllerCreateRecordTest.php

@@ -14,7 +14,7 @@ use Illuminate\Http\Request;
  * through ProfileAccountManager, and the exception-to-error-response
  * branches. Role assignment requires the full spatie permission boot, which
  * this fixture leaves out, so flows settle in the documented error branch
- * after the user record is persisted (see
+ * and the account created for the failed driver is removed again (see
  * DriverControllerExistingUserAdoptionTest for the full flow).
  */
 if (!function_exists('Fleetbase\Support\session')) {
@@ -157,6 +157,17 @@ function fleetopsInternalDriverCreateBoot(): SQLiteConnection
     return $connection;
 }
 
+/**
+ * Keep a copy of every removed user row so a test can inspect the account
+ * that was created and then cleaned up when the driver failed.
+ */
+function fleetopsInternalDriverCreateTrackRemovedUsers(SQLiteConnection $connection): void
+{
+    $columns = $connection->getSchemaBuilder()->getColumnListing('users');
+    $connection->statement('create table removed_users as select * from users where 0');
+    $connection->statement('create trigger keep_removed_users after delete on users begin insert into removed_users (' . implode(', ', $columns) . ') values (' . implode(', ', array_map(fn ($column) => 'old.' . $column, $columns)) . '); end');
+}
+
 function fleetopsInternalDriverCreateRequest(array $driver): Request
 {
     return Request::create('/int/v1/drivers', 'POST', ['driver' => $driver]);
@@ -164,6 +175,7 @@ function fleetopsInternalDriverCreateRequest(array $driver): Request
 
 test('create record provisions a driver-typed user before role assignment', function () {
     $connection = fleetopsInternalDriverCreateBoot();
+    fleetopsInternalDriverCreateTrackRemovedUsers($connection);
 
     $result = (new DriverController())->createRecord(fleetopsInternalDriverCreateRequest([
         'name'  => 'New Driver',
@@ -172,17 +184,18 @@ test('create record provisions a driver-typed user before role assignment', func
     ]));
 
     // The user record is created and typed before role assignment fails in
-    // the harness; the exception surfaces through the error response branch.
+    // the harness; the exception surfaces through the error response branch
+    // and the account is removed so no orphan login is left behind.
     expect($result)->toBeInstanceOf(JsonResponse::class)
         ->and($result->getData(true))->toHaveKey('error')
-        ->and($connection->table('users')->count())->toBe(1)
-        ->and($connection->table('users')->value('type'))->toBe('driver')
-        ->and($connection->table('users')->value('email'))->toBe('newdriver@example.com')
-        ->and($connection->table('company_users')->count())->toBeGreaterThanOrEqual(0);
+        ->and($connection->table('users')->count())->toBe(0)
+        ->and($connection->table('removed_users')->value('type'))->toBe('driver')
+        ->and($connection->table('removed_users')->value('email'))->toBe('newdriver@example.com');
 });
 
 test('create record ignores a picked user account and resolves the login from the email', function () {
     $connection = fleetopsInternalDriverCreateBoot();
+    fleetopsInternalDriverCreateTrackRemovedUsers($connection);
     $connection->table('users')->insert(['uuid' => '11111111-1111-4111-8111-111111111111', 'company_uuid' => 'company-1', 'name' => 'Existing', 'email' => 'existing@example.com', 'type' => 'driver']);
 
     (new DriverController())->createRecord(fleetopsInternalDriverCreateRequest([
@@ -193,13 +206,14 @@ test('create record ignores a picked user account and resolves the login from th
 
     // The login account is managed by the profile: a new driver account is
     // created for the email rather than the picked account being taken over
-    expect($connection->table('users')->count())->toBe(2)
-        ->and($connection->table('users')->where('email', 'someone@example.com')->value('type'))->toBe('driver')
+    expect($connection->table('users')->count())->toBe(1)
+        ->and($connection->table('removed_users')->where('email', 'someone@example.com')->value('type'))->toBe('driver')
         ->and($connection->table('users')->where('uuid', '11111111-1111-4111-8111-111111111111')->value('name'))->toBe('Existing');
 });
 
 test('create record applies photo avatars to the new driver account', function () {
     $connection = fleetopsInternalDriverCreateBoot();
+    fleetopsInternalDriverCreateTrackRemovedUsers($connection);
 
     $result = (new DriverController())->createRecord(fleetopsInternalDriverCreateRequest([
         'name'       => 'Photo Driver',
@@ -208,7 +222,7 @@ test('create record applies photo avatars to the new driver account', function (
 
     // Avatar is set when the account is created, before the harness
     // role-assignment limitation.
-    expect($connection->table('users')->value('avatar_uuid'))->toBe('22222222-2222-4222-8222-222222222222')
+    expect($connection->table('removed_users')->value('avatar_uuid'))->toBe('22222222-2222-4222-8222-222222222222')
         ->and($result)->toBeInstanceOf(JsonResponse::class)
         ->and($result->getData(true))->toHaveKey('error');
 });

package/server/tests/Feature/Http/Internal/OrchestrationControllerContractsTest.php

@@ -327,6 +327,9 @@ function fleetopsOrchestrationOrder(string $publicId, ?string $dropoffUuid = 'dr
     $payload = new Payload();
     $payload->setRawAttributes(['uuid' => 'payload-' . $publicId], true);
     $payload->setRelation('dropoff', $dropoff);
+    // the run resolves route stops, so every stop relation is set up front
+    $payload->setRelation('pickup', null);
+    $payload->setRelation('waypoints', collect());
 
     $order = new FleetOpsOrchestrationCommitOrderFake();
     $order->setRawAttributes([
@@ -518,8 +521,17 @@ test('orchestration optimize routes hydrates missing vehicle relations before se
         'mode' => 'optimize_routes',
     ]));
 
+    $payload = $response->getData(true);
+
+    // greedy (the probe's configured engine) cannot sequence stops, so the
+    // built-in sequencer runs and the summary says so without raising a warning
     expect($response->getStatusCode())->toBe(200)
-        ->and($response->getData(true)['summary'])->toBe(['engine' => 'route_sequence_fake'])
+        ->and($payload['summary'])->toMatchArray([
+            'engine'           => 'route_sequence_fake',
+            'requested_engine' => 'greedy',
+        ])
+        ->and($payload['summary']['fallback_reason'])->toContain('does not sequence stops')
+        ->and($payload)->not->toHaveKey('warning')
         ->and($order->relationLoaded('vehicle'))->toBeTrue()
         ->and($order->vehicle->driver->public_id)->toBe('driver_one')
         ->and($controller->routeEngine->calls)->toHaveCount(1);
@@ -926,3 +938,161 @@ test('assign drivers skips orders without a prior assignment entry', function ()
     expect($matched->vehicle_assigned_uuid)->toBe('vehicle_one-uuid')
         ->and($unmatched->vehicle_assigned_uuid)->toBeNull();
 });
+
+class FleetOpsSolverEngineFake implements OrchestrationEngineInterface
+{
+    public array $calls = [];
+
+    public function allocate(Collection $orders, Collection $vehicles, array $options = []): array
+    {
+        $this->calls[] = compact('orders', 'vehicles', 'options');
+        $vehicle       = $vehicles->first();
+
+        return [
+            'assignments' => $orders->values()->map(fn ($order, $index) => [
+                'order_id'       => $order->public_id,
+                'vehicle_id'     => $vehicle->public_id,
+                'driver_id'      => null,
+                'sequence'       => $index + 1,
+                'arrival'        => 1778918400 + $index,
+                'duration'       => 600,
+                'distance'       => 4200,
+                'route_distance' => 4200,
+                'route_duration' => 600,
+            ])->all(),
+            'unassigned'  => [],
+            'summary'     => ['cost' => 600],
+        ];
+    }
+
+    public function getName(): string
+    {
+        return 'VROOM';
+    }
+
+    public function getIdentifier(): string
+    {
+        return 'vroom';
+    }
+}
+
+function fleetopsOrchestrationAssignedOrder(string $publicId, ?string $vehicleUuid, ?Vehicle $vehicle = null): FleetOpsOrchestrationCommitOrderFake
+{
+    $order                        = fleetopsOrchestrationOrder($publicId);
+    $order->vehicle_assigned_uuid = $vehicleUuid;
+    if ($vehicle) {
+        $order->setRelation('vehicle', $vehicle);
+    }
+
+    return $order;
+}
+
+test('orchestration run falls back to greedy and reports why when the selected engine is unavailable', function () {
+    $registry = new OrchestrationEngineRegistry();
+    $registry->register(new GreedyOrchestrationEngine());
+    $registry->register(new FleetOpsThrowingOrchestrationEngineFake());
+
+    $vehicle = fleetopsOrchestrationVehicle('vehicle_one');
+    $vehicle->setRelation('driver', fleetopsOrchestrationDriver('driver_one'));
+
+    $controller                = new FleetOpsOrchestrationCommitControllerProbe($registry);
+    $controller->engineSetting = 'throwing';
+    $controller->orderQuery    = new FleetOpsOrchestrationQueryFake(collect([fleetopsOrchestrationOrder('order_one'), fleetopsOrchestrationOrder('order_two')]));
+    $controller->vehicleQuery  = new FleetOpsOrchestrationQueryFake(collect([$vehicle]));
+
+    // an empty engine option defers to the organization's selected engine
+    $response = $controller->run(Request::create('/orchestrator/run', 'POST', [
+        'mode'    => 'assign_vehicles',
+        'options' => ['engine' => ''],
+    ]));
+
+    $payload = $response->getData(true);
+
+    expect($response->getStatusCode())->toBe(200)
+        ->and($payload['summary'])->toMatchArray([
+            'engine'           => 'greedy',
+            'requested_engine' => 'throwing',
+            'fallback_reason'  => 'orchestration unavailable',
+            'metrics'          => 'estimated',
+            'distance'         => 0,
+            'duration'         => 0,
+        ])
+        ->and($payload['warning'])->toBe('The "greedy" engine was used instead of "throwing": orchestration unavailable')
+        // the fallback still routes every order onto the one vehicle
+        ->and(array_column($payload['assignments'], 'order_id'))->toBe(['order_one', 'order_two'])
+        ->and($payload['assignments'][0])->toHaveKeys(['arrival', 'route_distance', 'route_duration']);
+});
+
+test('orchestration optimize routes runs the selected solver once per vehicle', function () {
+    $solver   = new FleetOpsSolverEngineFake();
+    $registry = new OrchestrationEngineRegistry();
+    $registry->register(new GreedyOrchestrationEngine());
+    $registry->register($solver);
+
+    $vehicle       = fleetopsOrchestrationVehicle('vehicle_one');
+    $vehicle->uuid = 'vehicle-one-uuid';
+
+    $controller                = new FleetOpsOrchestrationCommitControllerProbe($registry);
+    $controller->engineSetting = 'vroom';
+    $controller->orderQuery    = new FleetOpsOrchestrationQueryFake(collect([
+        fleetopsOrchestrationAssignedOrder('order_one', 'vehicle-one-uuid', $vehicle),
+        fleetopsOrchestrationAssignedOrder('order_two', 'vehicle-one-uuid', $vehicle),
+        // a vehicle that can no longer be found, and an order with no vehicle
+        fleetopsOrchestrationAssignedOrder('order_ghost', 'ghost-uuid'),
+        fleetopsOrchestrationAssignedOrder('order_loose', null),
+    ]));
+    $controller->vehicleQuery = new FleetOpsOrchestrationQueryFake(collect([$vehicle]));
+
+    $response = $controller->run(Request::create('/orchestrator/run', 'POST', [
+        'mode'    => 'optimize_routes',
+        'options' => ['allocation_strategy' => 'capacity_only'],
+    ]));
+
+    $payload = $response->getData(true);
+
+    expect($response->getStatusCode())->toBe(200)
+        ->and($solver->calls)->toHaveCount(1)
+        ->and($solver->calls[0]['vehicles']->all())->toBe([$vehicle])
+        ->and($solver->calls[0]['orders']->pluck('public_id')->all())->toBe(['order_one', 'order_two'])
+        // sequencing always needs a routed solve, whatever the phase asked for
+        ->and($solver->calls[0]['options']['allocation_strategy'])->toBe('route_aware')
+        ->and(array_column($payload['assignments'], 'arrival'))->toBe([1778918400, 1778918401])
+        ->and($payload['unassigned'])->toBe(['order_ghost', 'order_loose'])
+        ->and($payload['summary'])->toBe([
+            'engine'     => 'vroom',
+            'assigned'   => 2,
+            'unassigned' => 2,
+            'distance'   => 4200,
+            'duration'   => 600,
+            'metrics'    => 'engine',
+        ])
+        ->and($payload)->not->toHaveKey('warning');
+});
+
+test('orchestration optimize routes falls back to the route sequencer with a warning', function (string $engineSetting, string $reason) {
+    $registry = new OrchestrationEngineRegistry();
+    $registry->register(new GreedyOrchestrationEngine());
+    $registry->register(new FleetOpsThrowingOrchestrationEngineFake());
+
+    $vehicle       = fleetopsOrchestrationVehicle('vehicle_one');
+    $vehicle->uuid = 'vehicle-one-uuid';
+    $vehicle->setRelation('driver', fleetopsOrchestrationDriver('driver_one'));
+
+    $controller                = new FleetOpsOrchestrationCommitControllerProbe($registry);
+    $controller->engineSetting = $engineSetting;
+    $controller->orderQuery    = new FleetOpsOrchestrationQueryFake(collect([fleetopsOrchestrationAssignedOrder('order_one', 'vehicle-one-uuid', $vehicle)]));
+    $controller->vehicleQuery  = new FleetOpsOrchestrationQueryFake(collect([$vehicle]));
+
+    $payload = $controller->run(Request::create('/orchestrator/run', 'POST', ['mode' => 'optimize_routes']))->getData(true);
+
+    expect($controller->routeEngine->calls)->toHaveCount(1)
+        ->and($payload['summary'])->toMatchArray([
+            'engine'           => 'route_sequence_fake',
+            'requested_engine' => $engineSetting,
+            'fallback_reason'  => $reason,
+        ])
+        ->and($payload['warning'])->toContain($reason);
+})->with([
+    'unavailable solver' => ['throwing', 'orchestration unavailable'],
+    'unregistered'       => ['missing', 'No orchestration engine is registered as "missing".'],
+]);

package/server/tests/Feature/Http/Internal/OrderControllerContractsTest.php

@@ -1,9 +1,11 @@
 <?php
 
+use Fleetbase\FleetOps\Exceptions\OrderEditLockedException;
 use Fleetbase\FleetOps\Flow\Activity;
 use Fleetbase\FleetOps\Http\Controllers\Internal\v1\OrderController;
 use Fleetbase\FleetOps\Http\Requests\BulkDispatchRequest;
 use Fleetbase\FleetOps\Http\Requests\CancelOrderRequest;
+use Fleetbase\FleetOps\Http\Resources\v1\PublicOrderTracking;
 use Fleetbase\FleetOps\Models\Driver;
 use Fleetbase\FleetOps\Models\Entity;
 use Fleetbase\FleetOps\Models\Order;
@@ -13,6 +15,8 @@ use Fleetbase\FleetOps\Models\Place;
 use Fleetbase\FleetOps\Models\Proof;
 use Fleetbase\FleetOps\Models\TrackingStatus;
 use Fleetbase\FleetOps\Models\Waypoint;
+use Fleetbase\FleetOps\Support\OrderEdit;
+use Fleetbase\FleetOps\Support\OrderEditPolicy;
 use Fleetbase\FleetOps\Support\OrderTracker;
 use Fleetbase\Http\Requests\ExportRequest;
 use Fleetbase\Models\Type;
@@ -37,6 +41,43 @@ if (!class_exists('Fleetbase\Http\Requests\ExportRequest', false)) {
     eval('namespace Fleetbase\Http\Requests; class ExportRequest extends \Illuminate\Http\Request {}');
 }
 
+/**
+ * Records the route edit guard and commit instead of reading and announcing through the database.
+ */
+class FleetOpsInternalOrderEditFake extends OrderEdit
+{
+    public array $guarded  = [];
+    public array $lockWith = [];
+    public int $commits    = 0;
+
+    public function __construct(public Order $order)
+    {
+        $this->policy = OrderEditPolicy::for($order);
+    }
+
+    public function requestedChanges(array $input, string $entitiesMode = self::ENTITIES_APPEND): array
+    {
+        return $input;
+    }
+
+    public function guard(array $changes): static
+    {
+        $this->guarded[] = $changes;
+        if ($this->lockWith) {
+            throw new OrderEditLockedException($this->lockWith);
+        }
+
+        return $this;
+    }
+
+    public function commit(array $extra = [], bool $notifyDriver = true): array
+    {
+        $this->commits++;
+
+        return [];
+    }
+}
+
 class FleetOpsInternalOrderLifecycleControllerProbe extends OrderController
 {
     public Collection $orders;
@@ -68,6 +109,7 @@ class FleetOpsInternalOrderLifecycleControllerProbe extends OrderController
     public Collection $proofResults;
     public array $exportDownloads                                    = [];
     public ?FleetOpsInternalOrderLifecycleOrderFake $trackingOrder   = null;
+    public array $trackingLookups                                   = [];
     public ?FleetOpsInternalOrderLifecycleOrderFake $scheduleOrder   = null;
     public ?FleetOpsInternalOrderLifecycleDriverFake $scheduleDriver = null;
 
@@ -218,6 +260,7 @@ class FleetOpsInternalOrderLifecycleControllerProbe extends OrderController
 
     protected function findOrderByTrackingNumber(string $trackingNumber): ?Order
     {
+        $this->trackingLookups[] = $trackingNumber;
         $this->trackingOrder?->setAttribute('tracking_lookup', $trackingNumber);
 
         return $this->trackingOrder;
@@ -254,6 +297,18 @@ class FleetOpsInternalOrderLifecycleControllerProbe extends OrderController
         return $this->order;
     }
 
+    public ?FleetOpsInternalOrderEditFake $edit = null;
+
+    public array $editLockedWith = [];
+
+    protected function beginOrderEdit(Order $order): OrderEdit
+    {
+        $this->edit ??= new FleetOpsInternalOrderEditFake($order);
+        $this->edit->lockWith = $this->editLockedWith;
+
+        return $this->edit;
+    }
+
     protected function orderResponse(Order $order): array
     {
         return ['order' => $order];
@@ -413,6 +468,15 @@ class FleetOpsInternalOrderLifecycleOrderFake extends Order
         return $this;
     }
 
+    public ?string $cancelReasonForTest = null;
+
+    public function cancelWithReason(?string $reason = null)
+    {
+        $this->cancelReasonForTest = $reason;
+
+        return $this->cancel();
+    }
+
     public function dispatch(bool $save = true): Order
     {
         $this->dispatchedForTest = true;
@@ -908,10 +972,29 @@ test('internal order controller edits order routes and refreshes current destina
         ->and($payload->calls)->toContain(['setDropoff', ['name' => 'Dropoff'], ['save' => true]])
         ->and($payload->calls)->toContain(['setReturn', ['name' => 'Return'], ['save' => true]])
         ->and($payload->calls)->toContain(['updateWaypoints', [['name' => 'Waypoint']]])
-        ->and($payload->calls)->toContain(['setCurrentWaypoint', $startingDestination, true])
+        // the current waypoint is reconciled by the committed edit, not reset to the first stop here
+        ->and(collect($payload->calls)->where(0, 'setCurrentWaypoint')->all())->toBe([])
+        ->and($controller->edit->guarded)->toBe([['pickup' => true, 'dropoff' => true, 'return' => true, 'waypoints' => true]])
+        ->and($controller->edit->commits)->toBe(1)
         ->and($order->loadedRelations)->toBe([['payload.pickup', 'payload.dropoff', 'payload.return', 'payload.waypoints']]);
 });
 
+test('internal order controller refuses route edits on finished orders with a 422', function () {
+    $payload = fleetopsInternalOrderLifecyclePayload(fleetopsInternalOrderLifecyclePlace('starting-place'));
+    $order   = fleetopsInternalOrderLifecycleOrder('order-route', 'completed');
+    $order->setRelation('payload', $payload);
+    $controller                 = fleetopsInternalOrderLifecycleController([$order]);
+    $controller->editLockedWith = ['dropoff' => 'The order is completed and can no longer be changed.'];
+
+    $response = $controller->editOrderRoute('order-route', new Request(['dropoff' => ['name' => 'Dropoff']]));
+
+    // the harness response factory keeps only the message; the app's error macro adds `locked`
+    expect($response->getStatusCode())->toBe(422)
+        ->and($response->getData(true)['error'])->toBe('The order is completed and can no longer be changed.')
+        ->and($payload->calls)->toBe([])
+        ->and($controller->edit->commits)->toBe(0);
+});
+
 test('internal order controller clears route endpoints and falls back to dropoff destination', function () {
     $fallbackDestination = fleetopsInternalOrderLifecyclePlace('fallback-place');
     $payload             = fleetopsInternalOrderLifecyclePayload(null, $fallbackDestination);
@@ -930,7 +1013,7 @@ test('internal order controller clears route endpoints and falls back to dropoff
         ->and($payload->calls)->toContain(['removePlace', 'dropoff', ['save' => true]])
         ->and($payload->calls)->toContain(['removePlace', 'return', ['save' => true]])
         ->and($payload->calls)->toContain(['removeWaypoints'])
-        ->and($payload->calls)->toContain(['setCurrentWaypoint', $fallbackDestination, true]);
+        ->and($controller->edit->commits)->toBe(1);
 });
 
 test('internal order controller reports missing order route edits', function () {
@@ -1054,7 +1137,15 @@ test('internal order controller cancels and dispatches individual orders', funct
         'order'   => 'order-uuid',
     ])
         ->and($order->lookup_uuid)->toBe('order-uuid')
-        ->and($order->canceledForTest)->toBeTrue();
+        ->and($order->canceledForTest)->toBeTrue()
+        ->and($order->cancelReasonForTest)->toBeNull();
+
+    $order      = fleetopsInternalOrderLifecycleOrder('order-uuid', 'created');
+    $controller = fleetopsInternalOrderLifecycleController([$order]);
+    $controller->cancel(fleetopsCancelOrderRequest(['order' => 'order-uuid', 'reason' => 'Customer asked to cancel']));
+
+    expect($order->canceledForTest)->toBeTrue()
+        ->and($order->cancelReasonForTest)->toBe('Customer asked to cancel');
 
     $order      = fleetopsInternalOrderLifecycleOrder('order-dispatch', 'created');
     $controller = fleetopsInternalOrderLifecycleController([$order]);
@@ -1549,24 +1640,29 @@ test('internal order controller export lookup and schedule endpoints use resolve
         ->and($export['selections'])->toBe(['order-one', 'order-two'])
         ->and($controller->exportDownloads[0][0])->toBe(['order-one', 'order-two']);
 
-    expect($controller->lookup(new Request())->getData(true))->toBe([
-        'error' => 'No tracking number provided for lookup.',
-    ])
-        ->and($controller->lookup(new Request(['tracking' => 'TN-404']))->getData(true))->toBe([
-            'error' => 'No order found using tracking number provided.',
-        ]);
+    // Missing, malformed and unknown tracking numbers all get the one answer,
+    // and malformed input never reaches the query.
+    $notFound = ['error' => OrderController::TRACKING_LOOKUP_ERROR];
+    foreach ([[], ['tracking' => ''], ['tracking' => '   '], ['tracking' => ['TN-1']], ['tracking' => '../etc/passwd'], ['tracking' => "TN-1' OR 1=1"], ['tracking' => str_repeat('A', 101)], ['tracking' => '-TN']] as $input) {
+        expect($controller->lookup(new Request($input))->getData(true))->toBe($notFound);
+    }
+    expect($controller->trackingLookups)->toBe([]);
+
+    expect($controller->lookup(new Request(['tracking' => 'TN-404']))->getData(true))->toBe($notFound)
+        ->and($controller->trackingLookups)->toBe(['TN-404']);
 
     $trackedOrder                 = fleetopsInternalOrderLifecycleOrder('tracked-order');
     $trackedOrder->trackerForTest = new FleetOpsInternalOrderLifecycleTrackerFake($trackedOrder);
     $controller->trackingOrder    = $trackedOrder;
 
-    $lookup = $controller->lookup(new Request(['tracking' => 'TN-100']));
+    $lookup = $controller->lookup(new Request(['tracking' => '  TN-100.a_b  ']));
 
-    expect($lookup->resource)->toBe($trackedOrder)
-        ->and($trackedOrder->tracking_lookup)->toBe('TN-100')
-        ->and($trackedOrder->loadedMissing)->toBe([['trackingNumber', 'payload', 'trackingStatuses']])
+    expect($lookup)->toBeInstanceOf(PublicOrderTracking::class)
+        ->and($lookup->resource)->toBe($trackedOrder)
+        ->and($trackedOrder->tracking_lookup)->toBe('TN-100.a_b')
+        ->and($trackedOrder->loadedMissing)->toBe([['trackingNumber', 'trackingStatuses', 'payload.pickup', 'payload.dropoff', 'payload.waypoints', 'payload.entities']])
         ->and($trackedOrder->tracker_data)->toBe(['tracker' => 'info', 'options' => []])
-        ->and($trackedOrder->eta)->toBe(['eta' => [['stop' => 'dropoff']], 'options' => []]);
+        ->and($trackedOrder->trackerForTest->etaOptions)->toBe([]);
 
     expect($controller->scheduleOrder(new Request(['order' => 'missing-order']))->getData(true))->toBe([
         'error' => 'No order found to schedule.',

package/server/tests/Feature/Http/Internal/OrderControllerHelpersTest.php

@@ -157,18 +157,20 @@ test('bulk assign driver validation enforces uuid contracts', function () {
     expect($valid['driver'])->toBe('22222222-2222-4222-8222-222222222222');
 });
 
-test('assign driver to orders updates the assignment column', function () {
+test('assign driver to orders updates the assignment column and tells the drivers it replaces', function () {
     $connection = fleetopsInternalOrderHelpersBoot();
     $connection->table('orders')->insert([
-        ['uuid' => 'order-1', 'company_uuid' => 'company-1'],
-        ['uuid' => 'order-2', 'company_uuid' => 'company-1'],
+        ['uuid' => 'order-1', 'company_uuid' => 'company-1', 'driver_assigned_uuid' => null],
+        ['uuid' => 'order-2', 'company_uuid' => 'company-1', 'driver_assigned_uuid' => null],
+        // already with another driver, who no longer exists: nothing to tell, nothing to fail
+        ['uuid' => 'order-3', 'company_uuid' => 'company-1', 'driver_assigned_uuid' => 'driver-gone'],
     ]);
     $driver = new Driver();
     $driver->setRawAttributes(['uuid' => 'driver-1'], true);
 
-    (new FleetOpsInternalOrderHelpersProbe())->callProtected('assignDriverToOrders', ['order-1', 'order-2'], $driver);
+    (new FleetOpsInternalOrderHelpersProbe())->callProtected('assignDriverToOrders', ['order-1', 'order-2', 'order-3'], $driver);
 
-    expect($connection->table('orders')->where('driver_assigned_uuid', 'driver-1')->count())->toBe(2);
+    expect($connection->table('orders')->where('driver_assigned_uuid', 'driver-1')->count())->toBe(3);
 });
 
 test('dispatch domain event helper emits and returns the event', function () {

package/server/tests/Feature/Http/Internal/PositionControllerReplayChannelTest.php

@@ -0,0 +1,135 @@
+<?php
+
+use Fleetbase\FleetOps\Http\Controllers\Internal\v1\PositionController;
+use Fleetbase\Models\User;
+use Fleetbase\Support\SocketCluster\ChannelAuthorizer;
+use Fleetbase\Support\SocketCluster\ChannelDecision;
+use Fleetbase\Support\SocketCluster\SocketPrincipal;
+use Fleetbase\TestSupport\DispatchRecorder;
+use Illuminate\Database\ConnectionResolver;
+use Illuminate\Database\Eloquent\Model as EloquentModel;
+use Illuminate\Database\SQLiteConnection;
+use Illuminate\Http\Request;
+
+/**
+ * Covers the positions/replay channel check: with socket authentication on, a replay may only
+ * target a channel the requesting user could subscribe to; with it off the endpoint is unchanged.
+ */
+class PositionReplayChannelAuthorizerFake
+{
+    public array $checked = [];
+
+    public function __construct(public array $allowed = [])
+    {
+    }
+
+    public function authorize(?SocketPrincipal $principal, string $channel): ChannelDecision
+    {
+        $this->checked[] = [$principal, $channel];
+
+        return in_array($channel, $this->allowed, true) ? ChannelDecision::allowed('resolver') : ChannelDecision::denied('forbidden');
+    }
+}
+
+function positionReplayChannelBoot(bool $enabled): PositionReplayChannelAuthorizerFake
+{
+    // Socket authentication needs both the switch and the signing key.
+    config([
+        'broadcasting.connections.socketcluster.auth_enabled' => $enabled,
+        'broadcasting.connections.socketcluster.auth_key'     => $enabled ? 'fleetops-position-replay-test-key-0123456789' : null,
+    ]);
+
+    $pdo = new PDO('sqlite::memory:');
+    $pdo->sqliteCreateFunction('ST_PointFromText', fn ($wkt, $srid = 0, $axisOrder = null) => $wkt);
+    $connection = new SQLiteConnection($pdo);
+    $resolver   = new ConnectionResolver(['default' => $connection, 'mysql' => $connection]);
+    $resolver->setDefaultConnection('mysql');
+    EloquentModel::setConnectionResolver($resolver);
+
+    $schema = $connection->getSchemaBuilder();
+    foreach (['positions' => ['uuid', 'company_uuid', 'subject_uuid', 'coordinates', 'speed'], 'companies' => ['uuid', 'public_id']] as $table => $columns) {
+        $schema->create($table, function ($blueprint) use ($columns) {
+            $blueprint->increments('id');
+            foreach ($columns as $column) {
+                $blueprint->string($column)->nullable();
+            }
+            $blueprint->timestamps();
+            $blueprint->timestamp('deleted_at')->nullable();
+        });
+    }
+    $connection->table('companies')->insert(['uuid' => 'company-1', 'public_id' => 'company_one']);
+    $connection->table('positions')->insert(['uuid' => 'pos-1', 'company_uuid' => 'company-1', 'subject_uuid' => 'vehicle-1', 'created_at' => '2026-10-06 08:00:00']);
+
+    session(['company' => 'company-1']);
+    DispatchRecorder::$dispatched = [];
+
+    $authorizer = new PositionReplayChannelAuthorizerFake(['vehicle.vehicle-1']);
+    app()->instance(ChannelAuthorizer::class, $authorizer);
+
+    return $authorizer;
+}
+
+function positionReplayChannelRequest(mixed $channel, ?User $user = null): Request
+{
+    $request = Request::create('/int/v1/positions/replay', 'POST', ['channel_id' => $channel, 'position_ids' => ['pos-1']]);
+    $request->setUserResolver(fn () => $user);
+
+    return $request;
+}
+
+function positionReplayChannelUser(): User
+{
+    $user = (new ReflectionClass(User::class))->newInstanceWithoutConstructor();
+    $user->setRawAttributes(['uuid' => 'user-1', 'public_id' => 'user_one', 'company_uuid' => 'company-1', 'type' => 'user'], true);
+
+    return $user;
+}
+
+afterEach(function () {
+    config(['broadcasting.connections.socketcluster.auth_enabled' => false, 'broadcasting.connections.socketcluster.auth_key' => null]);
+});
+
+test('a replay to a channel the user may subscribe to is started', function () {
+    $authorizer = positionReplayChannelBoot(true);
+
+    $response = (new PositionController())->replay(positionReplayChannelRequest('vehicle.vehicle-1', positionReplayChannelUser()));
+
+    [$principal, $channel] = $authorizer->checked[0];
+    expect($response->getData(true)['status'])->toBe('ok')
+        ->and(DispatchRecorder::$dispatched)->toHaveCount(1)
+        ->and($channel)->toBe('vehicle.vehicle-1')
+        ->and($principal->kind)->toBe('user')
+        ->and($principal->sub)->toBe('user-1')
+        ->and($principal->cid)->toBe('company-1')
+        ->and($principal->adm)->toBeFalse();
+});
+
+test('a replay to any other channel is refused before anything is queued', function () {
+    $authorizer = positionReplayChannelBoot(true);
+    $controller = new PositionController();
+    $user       = positionReplayChannelUser();
+
+    foreach ([
+        positionReplayChannelRequest('chat_channel.someone-elses', $user),
+        positionReplayChannelRequest('vehicle.vehicle-1', null),
+        positionReplayChannelRequest('vehicle. vehicle-1', $user),
+        positionReplayChannelRequest(str_repeat('x', 256), $user),
+        positionReplayChannelRequest(['vehicle.vehicle-1'], $user),
+    ] as $request) {
+        $response = $controller->replay($request);
+        expect($response->getStatusCode())->toBe(403)
+            ->and($response->getData(true)['error'])->toContain('not allowed');
+    }
+
+    expect(DispatchRecorder::$dispatched)->toBe([])
+        ->and(array_column($authorizer->checked, 1))->toBe(['chat_channel.someone-elses']);
+});
+
+test('without socket authentication the replay endpoint does not check the channel', function () {
+    $authorizer = positionReplayChannelBoot(false);
+
+    $response = (new PositionController())->replay(positionReplayChannelRequest('anything.at-all'));
+
+    expect($response->getData(true)['status'])->toBe('ok')
+        ->and($authorizer->checked)->toBe([]);
+});