fix(api): answer 404 instead of 500 for an unknown onboard organization

[roncodes]

Problem

GET /v1/onboard/driver-onboard-settings/{companyId} returned HTTP 500 with a ~1.2 MB HTML stack trace.

getDriverOnboardSettings() passed findCompanyByPublicId() straight into driverOnboardSetting() without checking it. The lookup is declared ?Company — the null return is deliberate — but the call site never guarded it, so null->uuid yielded null, which hit the string type declaration and threw:

TypeError: Fleetbase\FleetOps\Http\Controllers\Api\v1\NavigatorController::driverOnboardSetting():
Argument #1 ($companyUuid) must be of type string, null given

Reproduced against a live stack:

Path variable	Before	After
valid company_hfUOJNWBuO	200 JSON	200 JSON (unchanged)
bogus company_DOESNOTEXIST	500, text/html, 1,190,813 b	404 JSON
literal {{organization_id}}	500, text/html, 1,193,751 b	404 JSON

The failure was independent of the unresolved Postman variable — any public id that does not resolve produced it.

Change

Guard the null and return 404 via a new errorResponse() seam, matching the protected-seam style the rest of this controller already uses (jsonResponse, findCompanyByPublicId, driverOnboardSetting).

Test coverage

FleetOpsPublicNavigatorControllerProbe overrode findCompanyByPublicId() to always return a hydrated Company, so the null branch was unreachable — which is why this shipped. The probe can now be made to miss, and a regression test pins the 404 and its error envelope.

Related

The HTML-instead-of-JSON rendering is a separate, broader defect in the API exception handler — any unlisted exception on any /v1/* route leaks the same way (confirmed on PUT /v1/orders). Fixed separately in fleetbase/core-api.

Verification status

⚠️ Not verified locally — the dev stack was down when this was committed, so the three cases above are unrun against the fix. The reproduction numbers are real (captured pre-fix). CI is the first real run.

To verify once a stack is up:

K=<api_key>; for P in 'company_hfUOJNWBuO' 'company_DOESNOTEXIST'; do curl -s -H "Authorization: Bearer $K" -w ' <- %{http_code} %{content_type}\n' "http://localhost:8000/v1/onboard/driver-onboard-settings/$P"; done

The unit test also has not been run locally — it needs a real 542 MB server_vendor copy in the worktree.

🤖 Generated with Claude Code

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 100.00%. Comparing base (fa37e78) to head (1c7085b).
⚠️ Report is 5 commits behind head on dev-v0.6.60.

Additional details and impacted files

@@               Coverage Diff               @@
##             dev-v0.6.60      #290   +/-   ##
===============================================
  Coverage         100.00%   100.00%           
- Complexity          9766      9768    +2     
===============================================
  Files                521       521           
  Lines              37762     37766    +4     
===============================================
+ Hits               37762     37766    +4     

Flag	Coverage Δ
backend	100.00% <100.00%> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.