fix: stop the driver password requests breaking driver auth, and give the manifest requests a manifest

postman/collections/Fleetbase API/.resources/definition.yaml

@@ -40,18 +40,21 @@ variables:
   customer_phone: ""
   verification_code: ""
   push_token: ""
-  driver_identity: ""
-  driver_email: ""
-  driver_phone: ""
+  # Deliberately NOT declaring driver_identity / driver_password / driver_phone:
+  # a contract run injects those for a driver it seeds, and the driver login
+  # requests authenticate as it.
+  created_driver_email: ""
+  created_driver_phone: ""
   # Seeded on Create a Driver so the password endpoints have a known starting
-  # point; `driver_password` then tracks whatever is currently in force.
+  # point; created_driver_password then tracks whatever is currently in force.
   driver_seed_password: "contract-seed-password"
-  driver_password: ""
+  created_driver_password: ""
   driver_new_password: "contract-changed-password"
   # A reserved address (RFC 2606) that can never be delivered to. Requesting a
   # reset answers the same way for an unknown identity as for a real one, so the
   # endpoint is still exercised and no stranger receives a reset code.
   driver_reset_identity: "driver-password-reset@example.com"
+  driver_password_reset_code: ""
   manifest_id: ""
   manifest_stop_id: ""
 scripts:

postman/collections/Fleetbase API/Drivers/Change Driver Password.request.yaml

@@ -17,7 +17,7 @@ body:
   type: json
   content: |-
     {
-      "current_password": "{{driver_password}}",
+      "current_password": "{{created_driver_password}}",
       "password": "{{driver_new_password}}",
       "password_confirmation": "{{driver_new_password}}",
       "device_name": "navigator"
@@ -29,7 +29,7 @@ scripts:
       // The password in force has changed, so anything authenticating later
       // must use the new one.
       if (pm.response.code === 200) {
-          pm.environment.set("driver_password", pm.variables.get("driver_new_password"));
+          pm.environment.set("created_driver_password", pm.variables.get("driver_new_password"));
       }
     language: text/javascript
 

postman/collections/Fleetbase API/Drivers/Create a Driver.request.yaml

@@ -23,18 +23,21 @@ scripts:
       cv.set("driver_id", json_response.id);
       cv.set("driver_name", json_response.name);
 
-      // The email and phone are generated inline, so the response is the only
-      // place they can be read back. Without them the password and login
-      // requests below have no identity to use.
-      cv.set("driver_email", json_response.email);
-      cv.set("driver_phone", json_response.phone);
-      cv.set("driver_identity", json_response.email);
+      // The generated email and phone exist only in this response, and the
+      // password endpoints below need both an identity and a current password.
+      // Deliberately NOT driver_identity / driver_password / driver_phone:
+      // those name the driver the CI contract run seeds, which the driver
+      // login requests authenticate as. Overwriting them with this throwaway
+      // driver — deleted a few requests later — signs those requests in as
+      // an account that no longer exists.
+      cv.set("created_driver_email", json_response.email);
+      cv.set("created_driver_phone", json_response.phone);
 
-      // Tracks the password currently in force, so Change Driver Password can
-      // prove the old one and later requests still know what it is.
-      // pm.variables resolves across scopes; the seed is a collection variable,
-      // which pm.environment cannot see.
-      cv.set("driver_password", pm.variables.get("driver_seed_password"));
+      // Tracks the password currently in force for the created driver, so
+      // Change Driver Password can prove the old one.
+      // pm.variables resolves across scopes; the seed is a collection
+      // variable, which pm.environment cannot see.
+      cv.set("created_driver_password", pm.variables.get("driver_seed_password"));
     language: text/javascript
 examples: ./.resources/Create a Driver.resources/examples
 order: 1000

postman/collections/Fleetbase API/Drivers/List Driver Manifests.request.yaml

@@ -13,20 +13,5 @@ pathVariables:
     value: "{{driver_id}}"
     description: (Required) The driver whose manifests to list.
 
-scripts:
-  - type: afterResponse
-    code: |-
-      // Captures a manifest for the Manifests folder to address. On an instance
-      // with no routes assigned this simply finds nothing, and those requests
-      // skip themselves.
-      if (pm.response.code === 200) {
-          const body = pm.response.json();
-          const rows = Array.isArray(body) ? body : (body.data || []);
-
-          if (rows.length) {
-              pm.environment.set("manifest_id", rows[0].id);
-          }
-      }
-    language: text/javascript
 
 order: 4500

postman/collections/Fleetbase API/Drivers/Reset Driver Password.request.yaml

@@ -6,31 +6,18 @@ description: |-
   A wrong code, an expired code and an unknown identity all return the same error, so the endpoint cannot be used to test which of the three happened.
 
   Every session is revoked on success. A reset is a recovery from losing control of an account, so nothing that was signed in stays signed in.
+
+  `driver_password_reset_code` is a code issued for this flow specifically — a login code will not do, because the endpoint matches on purpose as well as on value. The password is set back to the one already in force so the run stays repeatable and the driver login requests further down still authenticate.
 url: "{{base_url}}/{{namespace}}/drivers/reset-password"
 method: POST
 
 body:
   type: json
   content: |-
     {
-      "identity": "{{driver_email}}",
+      "identity": "{{driver_identity}}",
       "code": "{{driver_password_reset_code}}",
-      "password": "{{driver_new_password}}"
+      "password": "{{driver_password}}"
     }
 
-scripts:
-  - type: beforeRequest
-    code: |-
-      // The reset code is delivered by email or SMS, so an automated run has no
-      // way to read it. Skipped rather than failed: the request is here to be
-      // documented and to work for anyone who sets `verification_code`, and a
-      // request that cannot succeed should not be reported as a broken endpoint.
-      const code = pm.environment.get("verification_code");
-      const unresolved = !code || /^\{\{.*\}\}$/.test(String(code));
-
-      if (unresolved && typeof pm.execution !== "undefined" && pm.execution.skipRequest) {
-          pm.execution.skipRequest();
-      }
-    language: text/javascript
-
 order: 4400

postman/collections/Fleetbase API/Manifests/.resources/definition.yaml

@@ -1,6 +1,8 @@
 $kind: collection
 description: |-
+  Manifests are produced by dispatch: `POST /orchestrator/commit` creates them from a plan. This folder is ordered after Orchestrator so it has one to address.
+
   A manifest is a driver's route: an order-agnostic sequence of stops which may span several orders, or none the driver has seen as an order.
 
   These endpoints are for the driver running the route. Creating, cancelling and deleting a manifest is dispatch work and is not part of the consumable API.
-order: 8500
+order: 8600

postman/collections/Fleetbase API/Manifests/Optimize a Manifest.request.yaml

@@ -25,20 +25,5 @@ body:
       "longitude": 103.8198
     }
 
-scripts:
-  - type: beforeRequest
-    code: |-
-      // Manifests are produced by dispatch — the consumable API deliberately
-      // cannot create one — so a fresh instance has none to address. Skipped
-      // rather than failed: the request documents the endpoint and runs for
-      // anyone whose instance has a manifest, and a missing fixture is not an
-      // endpoint fault.
-      const id = pm.environment.get("manifest_id");
-      const unresolved = !id || /^\{\{.*\}\}$/.test(String(id));
-
-      if (unresolved && typeof pm.execution !== "undefined" && pm.execution.skipRequest) {
-          pm.execution.skipRequest();
-      }
-    language: text/javascript
 
 order: 2000

postman/collections/Fleetbase API/Manifests/Retrieve a Manifest.request.yaml

@@ -11,19 +11,17 @@ pathVariables:
     value: "{{manifest_id}}"
     description: (Required) The manifest to retrieve.
 
+
 scripts:
-  - type: beforeRequest
+  - type: afterResponse
     code: |-
-      // Manifests are produced by dispatch — the consumable API deliberately
-      // cannot create one — so a fresh instance has none to address. Skipped
-      // rather than failed: the request documents the endpoint and runs for
-      // anyone whose instance has a manifest, and a missing fixture is not an
-      // endpoint fault.
-      const id = pm.environment.get("manifest_id");
-      const unresolved = !id || /^\{\{.*\}\}$/.test(String(id));
+      // The stops come back with the manifest, so this is the only request
+      // that can name one for Update a Manifest Stop.
+      const json_response = pm.response.json();
+      const stops = json_response.stops || [];
 
-      if (unresolved && typeof pm.execution !== "undefined" && pm.execution.skipRequest) {
-          pm.execution.skipRequest();
+      if (stops.length) {
+          pm.environment.set("manifest_stop_id", stops[0].id);
       }
     language: text/javascript
 

postman/collections/Fleetbase API/Manifests/Update a Manifest Stop.request.yaml

@@ -20,20 +20,5 @@ body:
       "status": "arrived"
     }
 
-scripts:
-  - type: beforeRequest
-    code: |-
-      // Manifests are produced by dispatch — the consumable API deliberately
-      // cannot create one — so a fresh instance has none to address. Skipped
-      // rather than failed: the request documents the endpoint and runs for
-      // anyone whose instance has a manifest, and a missing fixture is not an
-      // endpoint fault.
-      const id = pm.environment.get("manifest_stop_id");
-      const unresolved = !id || /^\{\{.*\}\}$/.test(String(id));
-
-      if (unresolved && typeof pm.execution !== "undefined" && pm.execution.skipRequest) {
-          pm.execution.skipRequest();
-      }
-    language: text/javascript
 
 order: 3000

postman/collections/Fleetbase API/Orchestrator/Commit Orchestrator Plan.request.yaml

@@ -25,5 +25,19 @@ body:
         }
       ]
     }
+scripts:
+  - type: afterResponse
+    code: |-
+      // Commit is what creates a manifest, and the id it returns is the only
+      // place the Manifests folder can get one — there is no endpoint that
+      // creates a manifest directly.
+      const json_response = pm.response.json();
+      const manifests = json_response.manifests || [];
+
+      if (manifests.length) {
+          pm.environment.set("manifest_id", manifests[0]);
+      }
+    language: text/javascript
+
 examples: ./.resources/Commit Orchestrator Plan.resources/examples
 order: 2000