@fleetbase/fleetops-engine 0.6.71 → 0.6.72

package/server/tests/RouteRegistrationExecutionTest.php

@@ -223,6 +223,32 @@ test('fleetops route file registers public internal analytics metrics and hub ro
     // Uploads through a link have a tighter limit of their own, on top of the group's.
     $upload = collect($recorder->routes)->firstWhere('uri', 'public/inspections/forms/{id}/files');
     expect($upload['middleware'] ?? [])->toBe(['throttle:20,1,inspection-upload']);
+
+    // The public tracking lookup has no session either, so it is rate limited
+    // per address, on a limiter of its own.
+    $lookup = collect($recorder->routes)->first(fn (array $route) => $route['action'] === 'OrderController@lookup');
+    expect($lookup)->not->toBeNull()
+        ->and($lookup['middleware'] ?? [])->toBe(['throttle:30,1,tracking-lookup']);
+
+    // The customer tracking page's public API answers in JSON and throttles inside the
+    // controller, so a throttled lookup looks exactly like an unknown number.
+    $tracking = collect($recorder->routes)->filter(fn (array $route) => str_starts_with($route['uri'], 'public/track/'));
+    expect($tracking->pluck('action', 'uri')->all())->toMatchArray([
+        'public/track/config'                    => 'TrackingController@config',
+        'public/track/account/orders'            => 'TrackingController@accountOrders',
+        'public/track/session'                   => 'TrackingController@signOut',
+        'public/track/{number}'                  => 'TrackingController@show',
+        'public/track/{number}/codes'            => 'TrackingController@sendCode',
+        'public/track/{number}/codes/verify'     => 'TrackingController@verifyCode',
+        'public/track/{number}/instructions'     => 'TrackingController@updateInstructions',
+        'public/track/{number}/proofs/{id}'      => 'TrackingController@proof',
+        'public/track/{number}/report'           => 'TrackingController@report',
+        'public/track/{number}/socket-token'     => 'TrackingController@socketToken',
+    ]);
+    foreach ($tracking as $route) {
+        expect($inGroup($route))->toBeTrue()
+            ->and($route['middleware'] ?? [])->toBe([]);
+    }
 });
 
 test('fleetops route file wires route groups with expected middleware and namespaces', function () {

package/server/tests/RouteSequencingEngineTest.php

@@ -128,6 +128,20 @@ test('route sequencing preserves vehicle assignment and orders stops by nearest
         'sequence'   => 1,
     ]);
     expect($assignments['order_far']['sequence'])->toBeGreaterThan($assignments['order_near']['sequence']);
+
+    // arrival, distance and duration are estimated along the sequenced stops
+    $near = $assignments['order_near'];
+    $far  = $assignments['order_far'];
+    expect($near['arrival'])->toBeGreaterThan(0)
+        ->and($far['arrival'])->toBeGreaterThan($near['arrival'])
+        ->and($far['distance'])->toBe($far['route_distance'])
+        ->and($near['distance'])->toBeLessThan($far['distance'])
+        ->and($near['route_duration'])->toBe($far['duration'])
+        ->and($result['summary'])->toMatchArray([
+            'distance' => $far['route_distance'],
+            'duration' => $far['route_duration'],
+            'metrics'  => 'estimated',
+        ]);
 });
 
 test('route sequencing handles multi drop waypoints and missing vehicle relations', function () {
@@ -150,7 +164,10 @@ test('route sequencing handles multi drop waypoints and missing vehicle relation
             'vehicle_id' => 'vehicle-missing-relation',
             'driver_id'  => null,
             'sequence'   => 1,
+            // with no vehicle position the route is measured from its first stop
+            'route_distance' => $result['assignments'][0]['distance'],
         ])
+        ->and($result['assignments'][0]['distance'])->toBeGreaterThan(0)
         ->and($result['summary']['assigned'])->toBe(1);
 });
 

package/server/tests/SettingControllerContractsTest.php

@@ -162,6 +162,116 @@ function fleetopsJsonPayload(mixed $response): array
     return $response->getData(true);
 }
 
+class FleetOpsMapCenterRedisFake
+{
+    public array $sets = [];
+
+    public function __construct(private array $cached = [], private bool $throws = false)
+    {
+    }
+
+    public function exists(string $key): bool
+    {
+        if ($this->throws) {
+            throw new RuntimeException('redis unavailable');
+        }
+
+        return array_key_exists($key, $this->cached);
+    }
+
+    public function get(string $key): mixed
+    {
+        return json_encode($this->cached[$key]);
+    }
+
+    public function set(string $key, string $value): bool
+    {
+        $this->sets[] = $key;
+
+        return true;
+    }
+}
+
+function fleetopsMapCenterFor(mixed $company, FleetOpsMapCenterRedisFake $redis): mixed
+{
+    Illuminate\Support\Facades\Redis::swap($redis);
+
+    $controller          = new FleetOpsSettingControllerProbe();
+    $controller->company = $company;
+
+    return fleetopsJsonPayload($controller->getMapSettings())['companyMapCenter'];
+}
+
+test('map settings persist a company default view and never persist the derived country centre', function () {
+    $controller = new FleetOpsSettingControllerProbe();
+
+    $saved = fleetopsJsonPayload($controller->saveMapSettings(new Request([
+        'settings' => [
+            'defaultMapLatitude'  => '-33.8688',
+            'defaultMapLongitude' => 151.2093,
+            'defaultMapZoom'      => '25',
+            'fitMapToVehicles'    => '1',
+            'companyMapCenter'    => ['latitude' => 1, 'longitude' => 2],
+        ],
+    ])));
+
+    expect($controller->configuredCompany['fleet-ops.map-settings'])->toMatchArray([
+        'defaultMapLatitude'  => -33.8688,
+        'defaultMapLongitude' => 151.2093,
+        'defaultMapZoom'      => 20,
+        'fitMapToVehicles'    => true,
+    ])
+        ->and(array_key_exists('companyMapCenter', $controller->configuredCompany['fleet-ops.map-settings']))->toBeFalse()
+        ->and($saved['defaultMapLatitude'])->toBe(-33.8688)
+        ->and($saved['companyMapCenter'])->toBeNull();
+
+    // A fresh company reads the defaults: no centre, no zoom, no fitting.
+    $fresh = fleetopsJsonPayload((new FleetOpsSettingControllerProbe())->getMapSettings());
+    expect($fresh)->toMatchArray([
+        'defaultMapLatitude'  => null,
+        'defaultMapLongitude' => null,
+        'defaultMapZoom'      => null,
+        'fitMapToVehicles'    => false,
+        'companyMapCenter'    => null,
+    ]);
+});
+
+test('map default view drops half or out of range centres and clamps the zoom', function (array $input, array $expected) {
+    $controller = new FleetOpsSettingControllerProbe();
+    $controller->saveMapSettings(new Request(['settings' => $input]));
+
+    expect($controller->configuredCompany['fleet-ops.map-settings'])->toMatchArray($expected);
+})->with([
+    'latitude only'          => [['defaultMapLatitude' => '10'], ['defaultMapLatitude' => null, 'defaultMapLongitude' => null]],
+    'latitude out of range'  => [['defaultMapLatitude' => 91, 'defaultMapLongitude' => 10], ['defaultMapLatitude' => null, 'defaultMapLongitude' => null]],
+    'longitude out of range' => [['defaultMapLatitude' => 10, 'defaultMapLongitude' => -180.5], ['defaultMapLatitude' => null, 'defaultMapLongitude' => null]],
+    'non numeric'            => [['defaultMapLatitude' => 'north', 'defaultMapLongitude' => ''], ['defaultMapLatitude' => null, 'defaultMapLongitude' => null]],
+    'zero is a real place'   => [['defaultMapLatitude' => 0, 'defaultMapLongitude' => '0'], ['defaultMapLatitude' => 0.0, 'defaultMapLongitude' => 0.0]],
+    'zoom below range'       => [['defaultMapZoom' => 0], ['defaultMapZoom' => 1]],
+    'zoom not an integer'    => [['defaultMapZoom' => '4.5'], ['defaultMapZoom' => null]],
+]);
+
+test('map settings centre a company on its country, falling back to the country of its timezone', function () {
+    $australia = ['countryData:AU' => ['coordinates' => ['latitude' => -25.58, 'longitude' => 134.5]]];
+
+    expect(fleetopsMapCenterFor(['country' => 'au'], new FleetOpsMapCenterRedisFake($australia)))
+        ->toBe(['country' => 'AU', 'latitude' => -25.58, 'longitude' => 134.5])
+        ->and(fleetopsMapCenterFor(['country' => 'Australia', 'timezone' => 'Australia/Sydney'], new FleetOpsMapCenterRedisFake($australia)))
+        ->toBe(['country' => 'AU', 'latitude' => -25.58, 'longitude' => 134.5]);
+});
+
+test('map settings omit the country centre when the company location cannot be resolved', function (mixed $company, array $cached, bool $throws) {
+    expect(fleetopsMapCenterFor($company, new FleetOpsMapCenterRedisFake($cached, $throws)))->toBeNull();
+})->with([
+    'no company'             => [null, [], false],
+    'no country or timezone' => [['country' => null, 'timezone' => ''], [], false],
+    'utc timezone'           => [['timezone' => 'UTC'], [], false],
+    'unknown timezone'       => [['timezone' => 'Not/AZone'], [], false],
+    'unknown country'        => [['country' => 'ZZ'], ['countryData:ZZ' => []], false],
+    'null island centroid'   => [['country' => 'XX'], ['countryData:XX' => ['coordinates' => ['latitude' => 0, 'longitude' => 0]]], false],
+    'country lookup fails'   => [['country' => 'AU'], [], true],
+]);
+
 test('setting controller persists and returns basic company settings through configured keys', function () {
     session(['company' => 'company-1']);
     $controller                  = new FleetOpsSettingControllerProbe();

package/server/tests/Support/TrackingPageDatabase.php

@@ -0,0 +1,200 @@
+<?php
+
+namespace Fleetbase\Tests\Support;
+
+use Illuminate\Database\ConnectionResolver;
+use Illuminate\Database\Eloquent\Model as EloquentModel;
+use Illuminate\Database\SQLiteConnection;
+
+/**
+ * An in-memory database holding the tables the public tracking page reads and writes,
+ * so its queries run for real in tests.
+ */
+final class TrackingPageDatabase
+{
+    public static function boot(): SQLiteConnection
+    {
+        $connection = new SQLiteConnection(new \PDO('sqlite::memory:'));
+        $resolver   = new ConnectionResolver(['default' => $connection, 'mysql' => $connection, 'testing' => $connection]);
+        $resolver->setDefaultConnection('mysql');
+        EloquentModel::setConnectionResolver($resolver);
+        EloquentModel::clearBootedModels();
+
+        $schema = $connection->getSchemaBuilder();
+        $common = function ($table) {
+            $table->increments('id');
+            $table->string('_key')->nullable();
+            $table->string('uuid')->nullable();
+            $table->string('public_id')->nullable();
+            $table->string('company_uuid')->nullable();
+            $table->text('meta')->nullable();
+            $table->timestamp('created_at')->nullable();
+            $table->timestamp('updated_at')->nullable();
+            $table->timestamp('deleted_at')->nullable();
+        };
+
+        $schema->create('settings', function ($table) {
+            $table->increments('id');
+            $table->string('key')->nullable();
+            $table->text('value')->nullable();
+            $table->timestamp('created_at')->nullable();
+            $table->timestamp('updated_at')->nullable();
+        });
+        $schema->create('tracking_numbers', function ($table) use ($common) {
+            $common($table);
+            $table->string('tracking_number')->nullable();
+            $table->string('owner_uuid')->nullable();
+            $table->string('owner_type')->nullable();
+            $table->string('region')->nullable();
+            $table->string('status_uuid')->nullable();
+            $table->text('qr_code')->nullable();
+            $table->text('barcode')->nullable();
+        });
+        $schema->create('orders', function ($table) use ($common) {
+            $common($table);
+            $table->string('payload_uuid')->nullable();
+            $table->string('customer_uuid')->nullable();
+            $table->string('customer_type')->nullable();
+            $table->string('tracking_number_uuid')->nullable();
+            $table->string('driver_assigned_uuid')->nullable();
+            $table->string('vehicle_assigned_uuid')->nullable();
+            $table->string('status')->nullable();
+            $table->boolean('dispatched')->nullable();
+            $table->boolean('started')->nullable();
+            $table->timestamp('scheduled_at')->nullable();
+            $table->timestamp('started_at')->nullable();
+        });
+        $schema->create('payloads', function ($table) use ($common) {
+            $common($table);
+            $table->string('pickup_uuid')->nullable();
+            $table->string('dropoff_uuid')->nullable();
+            $table->string('pickup_tracking_number_uuid')->nullable();
+            $table->string('dropoff_tracking_number_uuid')->nullable();
+        });
+        $schema->create('waypoints', function ($table) use ($common) {
+            $common($table);
+            $table->string('payload_uuid')->nullable();
+            $table->string('place_uuid')->nullable();
+            $table->string('customer_uuid')->nullable();
+            $table->string('customer_type')->nullable();
+            $table->string('tracking_number_uuid')->nullable();
+            $table->integer('order')->nullable();
+        });
+        $schema->create('entities', function ($table) use ($common) {
+            $common($table);
+            $table->string('payload_uuid')->nullable();
+            $table->string('destination_uuid')->nullable();
+            $table->string('tracking_number_uuid')->nullable();
+            $table->string('customer_uuid')->nullable();
+            $table->string('customer_type')->nullable();
+            $table->string('photo_uuid')->nullable();
+            $table->string('name')->nullable();
+            $table->string('description')->nullable();
+            $table->string('price')->nullable();
+            $table->string('currency')->nullable();
+        });
+        $schema->create('proofs', function ($table) use ($common) {
+            $common($table);
+            $table->string('order_uuid')->nullable();
+            $table->string('subject_uuid')->nullable();
+            $table->string('subject_type')->nullable();
+            $table->string('file_uuid')->nullable();
+            $table->text('raw_data')->nullable();
+            $table->string('remarks')->nullable();
+            $table->text('data')->nullable();
+        });
+        $schema->create('companies', function ($table) use ($common) {
+            $common($table);
+            $table->string('name')->nullable();
+            $table->string('logo_uuid')->nullable();
+            $table->string('phone')->nullable();
+            $table->string('website_url')->nullable();
+            $table->text('options')->nullable();
+        });
+        $schema->create('places', function ($table) use ($common) {
+            $common($table);
+            $table->string('name')->nullable();
+            $table->string('street1')->nullable();
+            $table->string('city')->nullable();
+            $table->string('phone')->nullable();
+            $table->text('location')->nullable();
+        });
+        $schema->create('files', function ($table) use ($common) {
+            $common($table);
+            $table->string('type')->nullable();
+            $table->string('path')->nullable();
+            $table->string('disk')->nullable();
+        });
+        $schema->create('contacts', function ($table) use ($common) {
+            $common($table);
+            $table->string('user_uuid')->nullable();
+            $table->string('name')->nullable();
+            $table->string('email')->nullable();
+            $table->string('phone')->nullable();
+            $table->string('type')->nullable();
+        });
+        $schema->create('vendors', function ($table) use ($common) {
+            $common($table);
+            $table->string('name')->nullable();
+            $table->string('email')->nullable();
+            $table->string('phone')->nullable();
+        });
+        $schema->create('tracking_statuses', function ($table) use ($common) {
+            $common($table);
+            $table->string('tracking_number_uuid')->nullable();
+            $table->string('status')->nullable();
+            $table->string('details')->nullable();
+            $table->string('code')->nullable();
+            $table->boolean('complete')->nullable();
+        });
+        $schema->create('verification_codes', function ($table) {
+            $table->increments('id');
+            $table->string('uuid')->nullable();
+            $table->string('subject_uuid')->nullable();
+            $table->string('subject_type')->nullable();
+            $table->string('code')->nullable();
+            $table->string('for')->nullable();
+            $table->text('meta')->nullable();
+            $table->string('status')->nullable();
+            $table->timestamp('expires_at')->nullable();
+            $table->timestamp('created_at')->nullable();
+            $table->timestamp('updated_at')->nullable();
+            $table->timestamp('deleted_at')->nullable();
+        });
+        $schema->create('tracking_sessions', function ($table) {
+            $table->increments('id');
+            $table->string('uuid')->nullable();
+            $table->string('token_hash')->nullable();
+            $table->string('ip')->nullable();
+            $table->string('user_agent')->nullable();
+            $table->timestamp('last_seen_at')->nullable();
+            $table->timestamp('expires_at')->nullable();
+            $table->timestamp('revoked_at')->nullable();
+            $table->timestamp('created_at')->nullable();
+            $table->timestamp('updated_at')->nullable();
+            // Fleetbase models soft delete (2026_10_12_000001_add_deleted_at_to_tracking_sessions_tables).
+            $table->timestamp('deleted_at')->nullable();
+        });
+        $schema->create('tracking_session_grants', function ($table) {
+            $table->increments('id');
+            $table->string('uuid')->nullable();
+            $table->string('tracking_session_uuid')->nullable();
+            $table->string('company_uuid')->nullable();
+            $table->string('order_uuid')->nullable();
+            $table->string('customer_type')->nullable();
+            $table->string('customer_uuid')->nullable();
+            $table->string('channel')->nullable();
+            $table->timestamp('expires_at')->nullable();
+            $table->timestamp('created_at')->nullable();
+            $table->timestamp('updated_at')->nullable();
+            $table->timestamp('deleted_at')->nullable();
+        });
+
+        return $connection;
+    }
+
+    public static function insert(SQLiteConnection $connection, string $table, array $row): void
+    {
+        $connection->table($table)->insert($row);
+    }
+}

package/server/tests/TenantScopingTest.php

@@ -0,0 +1,206 @@
+<?php
+
+use Fleetbase\FleetOps\Http\Controllers\Internal\v1\InspectionSubmissionController;
+use Fleetbase\FleetOps\Http\Controllers\Internal\v1\MaintenanceController;
+use Fleetbase\FleetOps\Http\Filter\InspectionFormFilter;
+use Fleetbase\FleetOps\Http\Filter\InspectionSubmissionFilter;
+use Fleetbase\FleetOps\Http\Filter\MaintenanceFilter;
+use Fleetbase\FleetOps\Http\Filter\ProofFilter;
+use Fleetbase\FleetOps\Http\Filter\RouteFilter;
+use Fleetbase\FleetOps\Http\Filter\TelematicFilter;
+use Fleetbase\FleetOps\Http\Filter\WarrantyFilter;
+use Fleetbase\FleetOps\Models\InspectionForm;
+use Fleetbase\FleetOps\Models\InspectionSubmission;
+use Fleetbase\FleetOps\Models\Maintenance;
+use Fleetbase\FleetOps\Models\Proof;
+use Fleetbase\FleetOps\Models\Route;
+use Fleetbase\FleetOps\Models\Telematic;
+use Fleetbase\FleetOps\Models\Warranty;
+use Fleetbase\Support\Find;
+use Illuminate\Database\ConnectionResolver;
+use Illuminate\Database\Eloquent\Model as EloquentModel;
+use Illuminate\Database\Eloquent\ModelNotFoundException;
+use Illuminate\Database\SQLiteConnection;
+use Illuminate\Http\Request;
+
+/*
+ * A console list is scoped to the signed-in company only by the resource's
+ * Filter (core-api applies `queryForInternal` and nothing else), so a model
+ * without one lists every company's rows. These tests hold each tenant-owned
+ * resource to its own company, for lists and for the by-id endpoints that
+ * look records up themselves.
+ */
+
+const FLEETOPS_TENANT_OWN   = 'company-own';
+const FLEETOPS_TENANT_OTHER = 'company-other';
+
+function fleetopsTenantScopingBoot(): SQLiteConnection
+{
+    $connection = new SQLiteConnection(new PDO('sqlite::memory:'));
+    $resolver   = new ConnectionResolver(['default' => $connection, 'mysql' => $connection]);
+    $resolver->setDefaultConnection('mysql');
+    EloquentModel::setConnectionResolver($resolver);
+    app()->instance('db', new class($connection) {
+        public function __construct(public SQLiteConnection $c)
+        {
+        }
+
+        public function connection($name = null): SQLiteConnection
+        {
+            return $this->c;
+        }
+
+        public function __call($method, $arguments)
+        {
+            return $this->c->{$method}(...$arguments);
+        }
+    });
+    Illuminate\Support\Facades\DB::clearResolvedInstance('db');
+
+    $columns = ['uuid', 'public_id', 'company_uuid', 'name', 'description', 'type', 'status', 'result', 'summary', 'notes', 'provider', 'model', 'serial_number', 'imei', 'policy_number', 'vehicle_uuid', 'driver_uuid', 'user_uuid', 'inspection_form_uuid', 'line_items', 'labor_cost', 'tax', 'parts_cost', 'total_cost'];
+    $schema  = $connection->getSchemaBuilder();
+    foreach (['inspection_forms', 'inspection_submissions', 'maintenances', 'telematics', 'warranties', 'proofs', 'routes', 'vehicles', 'drivers', 'users'] as $table) {
+        $schema->create($table, function ($blueprint) use ($columns) {
+            $blueprint->increments('id');
+            foreach ($columns as $column) {
+                $blueprint->string($column)->nullable();
+            }
+            $blueprint->timestamps();
+            $blueprint->timestamp('deleted_at')->nullable();
+        });
+    }
+
+    foreach (['inspection_forms', 'inspection_submissions', 'maintenances', 'telematics', 'warranties', 'proofs', 'routes'] as $table) {
+        foreach ([FLEETOPS_TENANT_OWN => 'own', FLEETOPS_TENANT_OTHER => 'other'] as $company => $label) {
+            $connection->table($table)->insert([
+                'uuid'          => "{$table}-{$label}",
+                'public_id'     => "{$table}_{$label}",
+                'company_uuid'  => $company,
+                'name'          => 'Shared name',
+                'summary'       => 'Shared name',
+                'provider'      => 'shared',
+                'type'          => 'shared',
+                'policy_number' => 'shared',
+            ]);
+        }
+    }
+
+    session(['company' => FLEETOPS_TENANT_OWN]);
+
+    return $connection;
+}
+
+function fleetopsTenantScopingRequest(string $uri, array $query = []): Request
+{
+    $request = Request::create('/' . $uri, 'GET', $query);
+    $session = app('session.store');
+    $session->put('company', FLEETOPS_TENANT_OWN);
+    $request->setLaravelSession($session);
+    $request->setRouteResolver(fn () => new class($uri) {
+        public array $action = [];
+
+        public function __construct(private string $uri)
+        {
+        }
+
+        public function uri(): string
+        {
+            return $this->uri;
+        }
+    });
+
+    return $request;
+}
+
+dataset('tenant scoped resources', [
+    'inspection forms'       => [InspectionForm::class, InspectionFormFilter::class, 'inspection_forms'],
+    'inspection submissions' => [InspectionSubmission::class, InspectionSubmissionFilter::class, 'inspection_submissions'],
+    'maintenances'           => [Maintenance::class, MaintenanceFilter::class, 'maintenances'],
+    'telematics'             => [Telematic::class, TelematicFilter::class, 'telematics'],
+    'warranties'             => [Warranty::class, WarrantyFilter::class, 'warranties'],
+    'proofs'                 => [Proof::class, ProofFilter::class, 'proofs'],
+    'routes'                 => [Route::class, RouteFilter::class, 'routes'],
+]);
+
+test('the resource resolves to its tenant filter', function (string $model, string $filter) {
+    expect(ltrim((string) Find::httpFilterForModel(new $model()), '\\'))->toBe($filter);
+})->with('tenant scoped resources');
+
+test('a console list returns only the session company rows', function (string $model, string $filter, string $table) {
+    fleetopsTenantScopingBoot();
+
+    $uuids = $model::query()
+        ->filter(new $filter(fleetopsTenantScopingRequest("int/v1/fleet-ops/{$table}")))
+        ->pluck('uuid')
+        ->all();
+
+    expect($uuids)->toBe(["{$table}-own"]);
+})->with('tenant scoped resources');
+
+test('a public api list returns only the session company rows', function (string $model, string $filter, string $table) {
+    fleetopsTenantScopingBoot();
+
+    $uuids = $model::query()
+        ->filter(new $filter(fleetopsTenantScopingRequest("v1/{$table}")))
+        ->pluck('uuid')
+        ->all();
+
+    expect($uuids)->toBe(["{$table}-own"]);
+})->with('tenant scoped resources');
+
+test('a search that matches every company still returns only the session company rows', function (string $model, string $filter, string $table) {
+    fleetopsTenantScopingBoot();
+
+    $uuids = $model::query()
+        ->filter(new $filter(fleetopsTenantScopingRequest("int/v1/fleet-ops/{$table}", ['query' => 'shared'])))
+        ->pluck('uuid')
+        ->all();
+
+    expect($uuids)->toBe(["{$table}-own"]);
+})->with('tenant scoped resources');
+
+function fleetopsTenantScopingController(string $class): object
+{
+    return (new ReflectionClass($class))->newInstanceWithoutConstructor();
+}
+
+function fleetopsTenantScopingCall(object $controller, string $method, ...$arguments): mixed
+{
+    $reflection = new ReflectionMethod($controller, $method);
+    $reflection->setAccessible(true);
+
+    return $reflection->invoke($controller, ...$arguments);
+}
+
+test('a maintenance line item endpoint resolves only the session company record', function () {
+    fleetopsTenantScopingBoot();
+    $controller = fleetopsTenantScopingController(MaintenanceController::class);
+
+    expect(fleetopsTenantScopingCall($controller, 'findMaintenanceForLineItem', 'maintenances-own')->uuid)->toBe('maintenances-own')
+        ->and(fleetopsTenantScopingCall($controller, 'findMaintenanceForLineItem', 'maintenances_own')->uuid)->toBe('maintenances-own');
+
+    foreach (['maintenances-other', 'maintenances_other'] as $id) {
+        expect(fn () => fleetopsTenantScopingCall($controller, 'findMaintenanceForLineItem', $id))->toThrow(ModelNotFoundException::class);
+    }
+
+    $request = Request::create('/int/v1/fleet-ops/maintenances/maintenances-other/line-items', 'POST', ['description' => 'x', 'quantity' => 1, 'unit_cost' => 1]);
+    expect(fn () => $controller->addLineItem('maintenances-other', $request))->toThrow(ModelNotFoundException::class)
+        ->and(fn () => $controller->updateLineItem('maintenances-other', 0, $request))->toThrow(ModelNotFoundException::class)
+        ->and(fn () => $controller->removeLineItem('maintenances-other', 0))->toThrow(ModelNotFoundException::class);
+});
+
+test('an inspection submission action resolves only the session company record', function () {
+    $connection = fleetopsTenantScopingBoot();
+    $controller = fleetopsTenantScopingController(InspectionSubmissionController::class);
+
+    expect(fleetopsTenantScopingCall($controller, 'submissionQuery', 'inspection_submissions-own')->value('uuid'))->toBe('inspection_submissions-own')
+        ->and(fleetopsTenantScopingCall($controller, 'submissionQuery', 'inspection_submissions_own')->value('uuid'))->toBe('inspection_submissions-own')
+        ->and(fleetopsTenantScopingCall($controller, 'submissionQuery', 'inspection_submissions-other')->exists())->toBeFalse()
+        ->and(fleetopsTenantScopingCall($controller, 'submissionQuery', 'inspection_submissions_other')->exists())->toBeFalse();
+
+    foreach (['submit', 'createIssue', 'createWorkOrder', 'resolve'] as $action) {
+        expect(fn () => $controller->{$action}('inspection_submissions-other'))->toThrow(ModelNotFoundException::class);
+    }
+
+    expect($connection->table('inspection_submissions')->where('uuid', 'inspection_submissions-other')->value('status'))->toBeNull();
+});