v0.6.72

v0.6.72 ~ "Customer tracking page settings, safer public tracking and structured label codes"

---

Highlights

• Tracking Page settings. A new Fleet-Ops → Settings → Tracking Page lets each organization configure the customer tracking page:

  • its own page at /t/{slug}, with a live address check;
  • whether its numbers can be tracked on the shared page;
  • branding: display name, accent colour with a live contrast check, an optional dark-mode accent, support contacts, "Powered by Fleetbase", and languages;
  • how customers verify (text message or email codes, session length, customer sign-in);
  • what verified customers see.

  Administrators set the shared page's defaults under Fleet-Ops Config → Tracking Page. The new tracking pages themselves arrive in a later release; these settings are what they will read.

• Safer public order lookup. GET int/v1/fleet-ops/lookup is rate limited per address and returns a minimal resource: tracking number, status, timeline, ETA, stop coordinates and items. It no longer returns notes, meta, internal ids, files, rates or customer details. The driver's location is included only while the order is under way. Unknown and malformed tracking numbers get the same answer.

• Structured label codes. Tracking-number QR codes now carry a tracking URL holding the tracking number and the owner's public id, which a phone camera opens as the tracking page. Barcodes use Code 128. Every scan endpoint still accepts the uuid codes already printed on parcels.

• Fix: signatures on private S3 buckets. Signatures were not stored on buckets that reject ACLs; they are now written without one and served through signed URLs. Legacy absolute avatar URLs on vehicles, drivers and places are re-signed when read.

• Fix: the customer credentials email linked to an unrouted page; it now links to /customer-access/{slug}.

• Fix: parcel box images on the service rate form and details showed broken images in production builds.

---

Upgrading

• Run php artisan fleetbase:create-permissions to register the new tracking-page-settings permission.
• Private-bucket signature storage pairs with fleetbase/core-api's File::signStoredUrl(); on older core-api releases stored avatar URLs pass through unchanged.

---

Need help?

• GitHub Discussions
• Discord

---

What's Changed

• fix(tracking): throttle the public order lookup and return a minimal resource by @roncodes in #352
• fix(files): store signatures without a public ACL; re-sign stored avatar URLs by @roncodes in #353
• fix(mail): link customer credentials to /customer-access/{slug} by @roncodes in #354
• feat(tracking-page): organization settings for the customer tracking page by @roncodes in #355
• feat(tracking): structured tracking-url QR codes, Code 128 barcodes, backward-compatible scan resolver by @roncodes in #356
• feat(tracking-page): settings screen for the customer tracking page by @roncodes in #357
• fix(service-rate): resolve parcel box images after production fingerprinting by @roncodes in #370
• fix(live-map): use the shipped map-marker.png as the driver/vehicle fallback icon by @roncodes in #371
• feat(socket-auth): fleetops channel resolvers, driver socket tokens, per-customer tracking channel by @roncodes in #358
• fix(places): return 404 when a place isn't found by @roncodes in #373
• fix(geo): build radius circles at the requested size by @roncodes in #374
• fix(orders): resolve public ids in facilitator and customer filters by @roncodes in #375
• fix(orders): keep the new order draft when a place is edited by @roncodes in #376
• fix(orders): soft-delete an order's payload, entities and tracking data with it by @roncodes in #377
• fix(accounts): create managed users in the sandbox database for test keys by @roncodes in #378
• refactor(descriptors): build the shared resource descriptors from fleetops-data by @roncodes in #379
• fix(telematics): retention pruner no longer scans the whole device_events table every run by @roncodes in #381
• refactor(identity-stub): build identity stubs from fleetops-data by @roncodes in #380
• fix(zones): return geofence trigger and dwell settings by @roncodes in #382
• fix(orders): don't measure distance from a driver's placeholder position by @roncodes in #383
• fix(orders): don't let a queued dispatch reset a started order by @roncodes in #384
• fix(geofence): mark arrival against the order's current destination by @roncodes in #385
• fix(orchestrator): run the engine selected in settings and report honest results by @roncodes in #386
• feat(orders): show customer photos on live order and board cards by @roncodes in #387
• feat(dashboard): add a latest proof of delivery photos widget by @roncodes in #388
• feat(map): let organisations choose where the live map opens by @roncodes in #389
• fix(api-cache): invalidate cached lists when the tables they embed are written by @roncodes in #390
• fix: driver and vehicle observer cleanup, index latest status, contact address filter by @roncodes in #391
• fix: declare relation return types the console requests and filter resource expansions through core by @roncodes in #392
• fix(routes): throttle the public SMS-sending routes per address by @roncodes in #393
• feat(auth): hashed single-use verification codes, no stub users before verification by @roncodes in #395
• feat(orders): status-guarded edits, order.changed events, driver offers by @roncodes in #394
• fix(api): answer an SMS guard refusal with its status by @roncodes in #396
• i18n(ru): improve street-1 and street-2 translations to align with customer-portal by @spanchenko in #397
• fix(orders): remove driver offers; only adhoc orders are offered by @roncodes in #398
• chore(deps): ember-ui 0.4.6, ember-core 0.3.26 and fleetops-data 0.2.3 by @roncodes in #400
• test: run the suite against core-api 1.6.69 by @roncodes in #399
• test: run the suite against core-api 1.6.69 and cover what its coverage gate flags by @roncodes in #401
• ci: track the shared API contract workflow on main by @roncodes in #402
• Release v0.6.72 by @roncodes in #372

Full Changelog: v0.6.71...v0.6.72