release: Fleet-Ops v0.6.69 - #336
Merged
Merged
Conversation
Hotfixes found while auditing the AI extension against production logs, where `search_resources` failed on every call and leaked the SQL error to the provider: - `Sensor` and the resource search referenced `sensor_type`, a column dropped by an earlier migration. Use `type`. - Search each resource type in its own try/catch so one failure no longer takes down the whole search, and report it as an unavailable search instead. - Build search terms from reference-like tokens only: never run LIKE against `status`, `type` or `uuid`, and skip the search when nothing useful remains. - Convert order amount thresholds from dollars to minor units using the currency exponent, and expose the currency on insights. - Scope the AI capability queries with `applyDirectivesForPermissions` so answers stay within what the user may see. Adds the tool-calling surface the AI extension now drives: - `propose_create_order` and `fleetops_search` tools, registered when the AI extension is installed. - `FleetOpsAiConsoleCommands`: navigate, create, view and import commands for orders, drivers, vehicles, contacts, customers, places, fleets, issues, work orders, maintenances and the Fleet-Ops settings pages. The AI may only propose these; the user confirms and the server re-authorizes before anything runs.
The internal OrderController resolved every order-lifecycle target straight
from a caller-supplied identifier with no company constraint:
Order::where('uuid', $uuid)->first() // cancel
Order::findById($id) // dispatch, schedule, tracker
Order::where('uuid', $uuid)->withoutGlobalScopes() // start
Order::whereIn('uuid', $ids)->get() // bulk-cancel, bulk-dispatch
Driver::whereUuid($uuid)->first() // bulk-assign-driver
Order::whereIn('uuid', $uuids)->update([...]) // bulk-assign-driver
These targets arrive as body/query params rather than bound route parameters,
so nothing upstream narrows them: `fleetbase.protected` runs auth:sanctum plus
AuthorizationGuard, which only checks that the caller holds the named RBAC
capability — it never inspects which company the record belongs to. Any
authenticated user with ordinary "manage orders" rights could therefore cancel,
dispatch, start, schedule or bulk-reassign another organization's orders by
supplying their uuid, which is not secret (tracking links, labels, webhooks).
Generic CRUD on the same model was already safe because it carries its own
explicit company_uuid clause; these hand-rolled lifecycle lookups did not.
Every by-identifier lookup in this controller now goes through a single
`scopedToCompany()` guard that adds the company_uuid constraint and fails the
query closed when no company is in session. Beyond the lifecycle actions, the
same guard now covers update-activity, next-activity, set-destination,
capture-photo, edit-route, ping-driver, proofs, entity/proof subjects,
tracking-number lookup and the import file lookup, which had the identical gap.
Two behavioural notes:
- `cancel()` now rejects an unresolvable order instead of dereferencing null.
`exists:orders,uuid` on CancelOrderRequest is a global existence check, so a
cross-tenant uuid passes validation and has to be refused in the controller.
- `bulkAssignDriver()` resolves the ids through the scoped lookup first, so
orders owned by another company are dropped before the update, and are
neither counted in the response nor queued for driver notification.
`findOrderById()` also takes the identifier as mixed and resolves anything that
is not a non-empty string to null, since it is raw request input.
nextActivity() no longer depends on core-api's findByIdOrFail() raising a
catchable ModelNotFoundException, so its not-found branch is live regardless of
the upstream release; the test documenting that dependency is updated.
Tests: new OrderControllerTenantScopingTest covers, for every patched lookup,
the owning-company hit, the cross-tenant miss (both the uuid and public_id
arms, so a regrouped OR cannot regress), and the no-company fail-closed path,
plus the endpoint-level refusals. OrderController.php is at 853/853 statements
covered with no uncovered lines.
Tool calling only reaches capabilities implementing `AIToolCapabilityInterface`, so the seven Fleet-Ops capabilities without a tool definition were unreachable once the AI extension defaulted to tools. Two of them had no replacement anywhere: route optimization and order import guidance simply stopped working. `OptimizeOrderRouteTool` wraps the existing preview capability so the model can propose a resequenced route for one order. As before, the proposal is a card the user confirms; nothing changes until they apply it. `ImportOrdersTool` reports the accepted file formats and required spreadsheet columns. It deliberately cannot read an uploaded file, and says so, so the model does not claim rows were imported. The remaining five are genuinely superseded by the core tools: `docs_help` by `search_docs`, `console_navigation` by `find_console_commands`, and `operational_query`, `order_insights` and `asset_status` by the generic record counting and listing tools.
fix(ai): repair resource search, add AI tools and console commands
…ping Scope internal order lifecycle lookups to the caller's company
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## main #336 +/- ##
===========================================
Coverage 99.99% 100.00%
- Complexity 11936 12089 +153
===========================================
Files 583 591 +8
Lines 44892 45427 +535
===========================================
+ Hits 44891 45427 +536
+ Misses 1 0 -1
Flags with carried forward coverage won't be shown. Click here to find out more. ☔ View full report in Codecov by Harness. 🚀 New features to boost your workflow:
|
… latest ember-core ^0.3.24 and ember-ui ^0.4.2, the latest published versions.
…file
Driver, customer and contact login accounts are now fully managed on the
server through their profile. The console never selects or creates a user
for them.
Server:
- ProfileAccountManager resolves a profile's account:
- a team member of the organization with the same email or phone is
linked (staff-linked profile);
- a managed account of the same type is reused;
- otherwise a managed driver, contact or customer account is created,
with its role and no organization invite;
- it pushes the profile's name/email/phone to the account, and a staff
account only takes the name;
- on profile delete it deletes a managed account with no other profile,
which frees its email and phone;
- it sends credentials by email, or by SMS when there is no email.
- Driver create/update (internal and public API) and Contact go through
the manager. The internal API ignores user_uuid, and email/phone
conflicts return 422.
- New internal endpoints for drivers: send-credentials, reset-credentials,
deactivate-login (also revokes app tokens) and reactivate-login.
- New profile-identity lookup for the form hint.
- Deactivated driver and customer logins are refused by the app login,
SMS login, code verification and password reset endpoints.
- Customer credential actions refuse staff-linked customers. Driver and
contact resources expose is_staff_linked and login_status.
- A migration converts existing `user` accounts that only hold the Driver
or Fleet-Ops Customer role for their profile into managed accounts, and
can be reverted.
Console:
- The driver form drops the user picker. It gets name, email and a
PhoneInput, a hint when the email/phone belongs to a team member, and
locked email/phone for staff-linked profiles.
- Drivers get Reset Password, Send Credentials and Deactivate/Reactivate
Login, like customers.
- The shared login-action util and reset-profile-credentials modal are
reused for drivers and customers.
…etry runs The adoption test rewrite had dropped the unrelated 'auth can resolves real permissions' test, which was the only coverage for several request authorize() lines. This restores it, and adds an explicit case for finishing a sync run whose connection was removed.
Migrations can run as a user that can't write the application log. The Postman contract job failed on exactly that.
FixDriverCompanies and FixCustomerCompanies called assignCompany() without a role. That used core's default, the Administrator role, so repairing a missing membership gave drivers and customers full organization access. They now pass Driver and Fleet-Ops Customer. Core no longer has a default role (fleetbase/core-api#266).
The button was a link-style button with its border and padding on the wrapper and a 50% fade on hover. It is now a default block button with btn-auth, so it matches the console's "Continue with ..." buttons, including their hover, in light and dark. Needs @fleetbase/ember-ui with btn-auth. With an older ember-ui it falls back to a plain default block button.
Manage driver, customer and contact login accounts from the profile
style(login): use ember-ui's btn-auth for the Track Order button
Add Ukrainian translation
…tails A managed account is the profile itself, so the separate User Account panel only repeated the name, email and phone. - Customer: the details panel labelled the phone field Email; it now says Phone. A new Addresses panel lists every place the customer owns as a place pill and marks the primary one. - Driver: name, email and phone move into the one details panel, which is now titled Details.
6 tasks
The details panel declared two columns but spanned three, which left a gap after the name. Rows are now: name, email, phone / ID, internal ID, driver's license / license expiry / vehicle, vendor / city, country / coordinates.
`GET int/v1/fleet-ops/lookup` backs the public Track Order page. It has no session: recipients look up an order by its tracking number, and the tracking number is the credential. #331 routed its findOrderByTrackingNumber() through scopedToCompany(), which with no session company matches nothing, so every lookup from that page failed ("No order found using tracking number provided"). The lookup is unscoped again, as it is on main (v0.6.68), with a docblock saying why. The company scoping #331 added to the order lifecycle lookups (cancel, dispatch, start, schedule, proofs, pings and so on) is unchanged. The tenant-scoping tests no longer expect the tracking lookup to be scoped. A new test checks that it finds an order by tracking number with no session and with another company's session, and returns nothing for an unknown number.
fleetops-data 0.2.2 is published. It adds the read-only managed login state (is_staff_linked, login_status) to the driver and contact models, which the driver and contact login management in this release uses. Regenerates pnpm-lock.yaml, and notes the upgrade in RELEASE.md.
ember-ui 0.4.3 is published. It provides the btn-auth style the Track Order login button (#339) uses, so that button no longer falls back to a plain default button. pnpm-lock.yaml regenerated, and the v0.6.69 notes updated.
core-api 1.6.63 (published) no longer grants Administrator by default: User::assignCompany() and Company::addUser() now take ?string $role = null. Two test fakes still overrode them with string $role = 'Administrator'. PHP rejects an override that narrows a parameter, so PHP CI died with a fatal error while loading ApiDriverControllerContractsTest. Both fakes now take ?string $role = null. A nullable role is also compatible with older core-api, whose parameter was a plain string. The source always passes an explicit role, so no assertion changes.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Planned release work
Unknown column 'sensor_type'), and expose order creation, route optimization, import requirements and resource search as Fleetbase AI tools, plus Fleet-Ops console actionsRelated