Release v0.6.72

.github/workflows/postman.yml

@@ -5,9 +5,16 @@ name: API Contract (Postman)
 # fleetbase/fleetbase. Requires org secrets POSTMAN_API_KEY + _GITHUB_AUTH_TOKEN
 # (inherited); no-ops until POSTMAN_API_KEY is set.
 #
-# Pin the workflow and host checkout together so branch installation resolves the
-# required published Core release before migrating and exercising this module.
-# The workflow records the API image digest and resolved dependencies for traceability.
+# Deliberately unpinned, like storefront's. The reusable workflow defaults to booting
+# fleetbase/fleetbase@main against fleetbase/fleetbase-api:latest, so every release and
+# every fix to the run order (scripts/ci/order-collection-requests.py) is picked up
+# automatically, with no ref here to remember to bump. Each run records the image digest
+# it actually resolved in its job summary, so a result stays traceable. To reproduce an
+# older run:
+#
+#   with:
+#     fleetbase-ref: v0.7.53
+#     api-image: fleetbase/fleetbase-api:v0.7.53
 
 on:
   push:
@@ -20,9 +27,8 @@ permissions:
 
 jobs:
   contract:
-    uses: fleetbase/fleetbase/.github/workflows/api-contract.yml@880c7392c67c93e3a65f01916d7a04036c098935
+    uses: fleetbase/fleetbase/.github/workflows/api-contract.yml@main
     with:
-      fleetbase-ref: 880c7392c67c93e3a65f01916d7a04036c098935
       collections: "Fleetbase API"
       build-from-source: false
       # Without this the run tests the version of fleetbase/fleetops-api baked into the

RELEASE.md

@@ -1,29 +1,26 @@
-> v0.6.71 ~ "Extensible tables and panels, configured order lifecycles and order presentation profiles"
+> v0.6.72 ~ "Customer tracking page settings, safer public tracking and structured label codes"
 
 ---
 ## Highlights
 
-- **Resource view registries.** Extensions can add the following through `fleet-ops:<resource>:table:<slot>` and `fleet-ops:<resource>:details:<slot>`:
-  - columns, row actions, bulk actions and toolbar buttons on every top-level Fleet-Ops table;
-  - header buttons and "…" menu items on its details panels and side panels.
+- **Tracking Page settings.** A new Fleet-Ops → Settings → Tracking Page lets each organization configure the customer tracking page:
+  - its own page at `/t/{slug}`, with a live address check;
+  - whether its numbers can be tracked on the shared page;
+  - branding: display name, accent colour with a live contrast check, an optional dark-mode accent, support contacts, "Powered by Fleetbase", and languages;
+  - how customers verify (text message or email codes, session length, customer sign-in);
+  - what verified customers see.
 
-  Built-in items carry stable ids, so registered items can be placed before or after them.
-- **Configured order lifecycles.** An order config can define its own lifecycle in `meta.lifecycle`: `initial`, `completed`, `canceled` and `terminal` activities, `dispatch: false` and `strict_transitions`. The internal API starts orders at the initial activity, refuses to dispatch when dispatch is off, accepts only the flow's transitions when strict, and cancels to the configured activity. Configs without a lifecycle behave as before.
-  - **Lifecycle tab** in Order Configuration, to view and edit a config's lifecycle.
-  - **The board** shows a configured lifecycle's activities as its columns.
-  - **The activity flow editor** roots at the configured initial activity, and handles flows with cycles.
-- **Order presentation profiles.** An extension can give its order type its own order form sections, extra and hidden fields, details view sections and hidden actions, registered in `fleet-ops:order-presentation`. **Edit details** opens the profiled form. Other order types are unchanged.
-- **The Order Configuration manager lists every config**, including configs created while the console is open.
-- **An order's activity timeline follows status changes made on the server.**
-- **Fix: the Activity Flow crashed on a flow with a cycle.**
-- **Fix: order details now load the assigned vehicle with the order.**
-- **Fix: the order form failed when its custom fields couldn't load.**
-- **Fix: registered details tabs.** Opening a driver, vehicle or trailer side panel removed the route from tabs other extensions had registered, which broke them in the full details view. Side panels also left out the tabs they could render.
-- **Fix: the sensor details view showed the tabs registered for places.**
+  Administrators set the shared page's defaults under Fleet-Ops Config → Tracking Page. The new tracking pages themselves arrive in a later release; these settings are what they will read.
+- **Safer public order lookup.** `GET int/v1/fleet-ops/lookup` is rate limited per address and returns a minimal resource: tracking number, status, timeline, ETA, stop coordinates and items. It no longer returns notes, meta, internal ids, files, rates or customer details. The driver's location is included only while the order is under way. Unknown and malformed tracking numbers get the same answer.
+- **Structured label codes.** Tracking-number QR codes now carry a tracking URL holding the tracking number and the owner's public id, which a phone camera opens as the tracking page. Barcodes use Code 128. Every scan endpoint still accepts the uuid codes already printed on parcels.
+- **Fix: signatures on private S3 buckets.** Signatures were not stored on buckets that reject ACLs; they are now written without one and served through signed URLs. Legacy absolute avatar URLs on vehicles, drivers and places are re-signed when read.
+- **Fix: the customer credentials email** linked to an unrouted page; it now links to `/customer-access/{slug}`.
+- **Fix: parcel box images** on the service rate form and details showed broken images in production builds.
 
 ---
 ## Upgrading
-Needs fleetbase/ember-core v0.3.25 and fleetbase/ember-ui v0.4.5.
+- Run `php artisan fleetbase:create-permissions` to register the new `tracking-page-settings` permission.
+- Private-bucket signature storage pairs with fleetbase/core-api's `File::signStoredUrl()`; on older core-api releases stored avatar URLs pass through unchanged.
 
 ---
 ## Need help?

addon/components/admin/tracking-page-settings.hbs

@@ -0,0 +1,56 @@
+<ContentPanel @title="Generic Tracking Page" @open={{true}} @wrapperClass="bordered-classic">
+    <div class="space-y-5">
+        <div class="flex items-start justify-between gap-4">
+            <div>
+                <div class="text-sm font-semibold">Enable the generic tracking page</div>
+                <div class="text-xs text-gray-600 dark:text-gray-300">Serves /~/track for every organization that allows it. Organizations can also run their own page from their Fleet-Ops settings.</div>
+            </div>
+            <Toggle @isToggled={{this.genericEnabled}} @onToggle={{fn (mut this.genericEnabled)}} />
+        </div>
+        <div>
+            <label for="admin-tracking-page-name" class="block text-sm font-semibold mb-1">Display name</label>
+            <input id="admin-tracking-page-name" type="text" class="form-input w-full" value={{this.displayName}} placeholder="Fleetbase" {{on "input" (fn this.setValue "displayName")}} />
+            <p class="mt-1 text-xs text-gray-600 dark:text-gray-300">Shown before a lookup. The logo comes from the instance branding.</p>
+        </div>
+        <div>
+            <label for="admin-tracking-page-accent" class="block text-sm font-semibold mb-1">Accent colour</label>
+            <div class="flex items-center gap-3">
+                <input id="admin-tracking-page-accent" type="color" class="h-10 w-14 rounded-md border border-gray-300 dark:border-gray-700 bg-transparent cursor-pointer" value={{this.accent}} {{on "input" (fn this.setValue "accent")}} />
+                <span class="font-mono text-sm">{{this.accent}}</span>
+            </div>
+        </div>
+        <div class="grid grid-cols-1 md:grid-cols-3 gap-4">
+            <div>
+                <label for="admin-tracking-page-phone" class="block text-sm font-semibold mb-1">Support phone</label>
+                <input id="admin-tracking-page-phone" type="tel" class="form-input w-full" value={{this.supportPhone}} placeholder="+1 555 010 0100" {{on "input" (fn this.setValue "supportPhone")}} />
+            </div>
+            <div>
+                <label for="admin-tracking-page-email" class="block text-sm font-semibold mb-1">Support email</label>
+                <input id="admin-tracking-page-email" type="email" class="form-input w-full" value={{this.supportEmail}} placeholder="support@example.com" {{on "input" (fn this.setValue "supportEmail")}} />
+            </div>
+            <div>
+                <label for="admin-tracking-page-website" class="block text-sm font-semibold mb-1">Website</label>
+                <input id="admin-tracking-page-website" type="url" class="form-input w-full" value={{this.website}} placeholder="https://example.com" {{on "input" (fn this.setValue "website")}} />
+            </div>
+        </div>
+        <div class="flex items-start justify-between gap-4">
+            <div>
+                <div class="text-sm font-semibold">Show "Powered by Fleetbase"</div>
+                <div class="text-xs text-gray-600 dark:text-gray-300">The default for organizations that haven't chosen.</div>
+            </div>
+            <Toggle @isToggled={{this.poweredBy}} @onToggle={{fn (mut this.poweredBy)}} />
+        </div>
+    </div>
+</ContentPanel>
+
+<EmberWormhole @to="next-view-section-subheader-actions">
+    <Button
+        @type="primary"
+        @size="sm"
+        @icon="save"
+        @text="Save Changes"
+        @onClick={{perform this.saveSettings}}
+        @isLoading={{or this.saveSettings.isRunning this.loadSettings.isRunning}}
+        @disabled={{this.saveSettings.isRunning}}
+    />
+</EmberWormhole>

addon/components/admin/tracking-page-settings.js

@@ -0,0 +1,67 @@
+import Component from '@glimmer/component';
+import { inject as service } from '@ember/service';
+import { tracked } from '@glimmer/tracking';
+import { action } from '@ember/object';
+import { task } from 'ember-concurrency';
+
+/**
+ * Instance-wide defaults for the generic customer tracking page: whether it is on, and the
+ * branding it shows before a lookup (and for companies without their own).
+ */
+export default class AdminTrackingPageSettingsComponent extends Component {
+    @service fetch;
+    @service notifications;
+    @tracked genericEnabled = true;
+    @tracked displayName = '';
+    @tracked accent = '#1F5FA8';
+    @tracked supportPhone = '';
+    @tracked supportEmail = '';
+    @tracked website = '';
+    @tracked poweredBy = true;
+
+    constructor() {
+        super(...arguments);
+        this.loadSettings.perform();
+    }
+
+    @task *loadSettings() {
+        try {
+            const settings = yield this.fetch.get('fleet-ops/settings/admin-tracking-page-settings');
+            this.genericEnabled = settings?.generic_page?.enabled ?? true;
+            this.displayName = settings?.branding?.display_name ?? '';
+            this.accent = settings?.branding?.accent ?? '#1F5FA8';
+            this.supportPhone = settings?.branding?.support_phone ?? '';
+            this.supportEmail = settings?.branding?.support_email ?? '';
+            this.website = settings?.branding?.website ?? '';
+            this.poweredBy = settings?.branding?.powered_by ?? true;
+        } catch (error) {
+            this.notifications.serverError(error);
+        }
+    }
+
+    @action setValue(property, event) {
+        this[property] = event.target.value;
+    }
+
+    @task *saveSettings() {
+        try {
+            yield this.fetch.post('fleet-ops/settings/admin-tracking-page-settings', {
+                trackingPage: {
+                    generic_page: { enabled: this.genericEnabled },
+                    branding: {
+                        display_name: this.displayName,
+                        accent: this.accent,
+                        support_phone: this.supportPhone,
+                        support_email: this.supportEmail,
+                        website: this.website,
+                        powered_by: this.poweredBy,
+                    },
+                },
+            });
+
+            this.notifications.success('Tracking page defaults saved.');
+        } catch (error) {
+            this.notifications.serverError(error);
+        }
+    }
+}

addon/components/device/form.hbs

@@ -137,7 +137,7 @@
 
             <InputGroup @name={{t "device.fields.installation-date"}}>
                 <DatePicker
-                    @value={{@resource.installation_date}}
+                    @value={{format-date-fns @resource.installation_date "yyyy-MM-dd"}}
                     @onChange={{fn (mut @resource.installation_date)}}
                     @placeholder={{t "device.fields.installation-date-placeholder"}}
                     @disabled={{cannot-write @resource}}
@@ -147,7 +147,7 @@
 
             <InputGroup @name={{t "device.fields.last-maintenance-date"}}>
                 <DatePicker
-                    @value={{@resource.last_maintenance_date}}
+                    @value={{format-date-fns @resource.last_maintenance_date "yyyy-MM-dd"}}
                     @onChange={{fn (mut @resource.last_maintenance_date)}}
                     @placeholder={{t "device.fields.last-maintenance-date-placeholder"}}
                     @disabled={{cannot-write @resource}}

addon/components/driver/details.hbs

@@ -27,7 +27,7 @@
             </div>
             <div class="field-info-container md:col-span-3">
                 <div class="field-name">{{t "driver.fields.license-expiry"}}</div>
-                <div class="field-value">{{n-a (format-date-fns @resource.license_expiry)}}</div>
+                <div class="field-value">{{n-a (format-date-fns @resource.license_expiry "yyyy-MM-dd")}}</div>
             </div>
             <div class="field-info-container">
                 <div class="field-name">{{t "resource.vehicle"}}</div>

addon/components/driver/form.hbs

@@ -66,7 +66,7 @@
 
             <InputGroup @name={{t "driver.fields.license-expiry"}}>
                 <DatePicker
-                    @value={{@resource.license_expiry}}
+                    @value={{format-date-fns @resource.license_expiry "yyyy-MM-dd"}}
                     @onChange={{fn (mut @resource.license_expiry)}}
                     @placeholder={{t "driver.fields.license-expiry"}}
                     @disabled={{cannot-write @resource}}

addon/components/equipment/form.hbs

@@ -159,7 +159,7 @@
             </InputGroup>
             <InputGroup @name="Purchase Date">
                 <DatePicker
-                    @value={{or (format-date-fns @resource.purchased_at "dd-MM-yyyy") null}}
+                    @value={{or (format-date-fns @resource.purchased_at "yyyy-MM-dd") null}}
                     @onChange={{fn (mut @resource.purchased_at)}}
                     @placeholder="DD-MM-YYYY"
                     class="filter-date-input w-full flex-1"