[roncodes]

Summary

Adds the /v1/customers routes a white-label rider app needs, so it no longer has to use company-wide routes. Every route is limited to the signed-in rider's own records. An order or place belonging to someone else returns 404.

New routes

• POST customers/request-code sends a login or signup code and answers the same for any number. verify-code returns new_customer only after the code is proven, without using the code up.
• GET customers/places/search returns the rider's places plus geocoder results. Unowned rows are excluded because they hold addresses from other riders' trips.
• GET customers/geocode looks up an address or coordinates and stores nothing.
• POST, PUT and DELETE customers/places.
• POST customers/me/phone-code.
• POST customers/orders/{id}/dispatch and cancel, and GET driver, tracker and eta. driver returns name, photo, location and car, with no contact details.

Behaviour changes for existing callers

• customers/me refuses a phone change unless it comes with a code sent to the new number, and refuses a number another account holds. Storefront and Navigator don't use this route, but a third-party integration might.
• ServiceQuote::resolveFromRequest treats another company's quote as not found.
• customers/orders refuses an expired fare or one from another company.
• verify-code for an unknown identity now says Invalid verification code. instead of Unable to verify code..
• GET service-quotes?preview=1 no longer stores a place for coordinates.
• The signup password is optional.

Left unchanged

• places/search still returns customer-owned places to a full key, because the Odoo and ERPNext clients use it. The rider key in fleetbase/core-api is what keeps a published app off this route.
• customers/login-with-sms still reveals unknown numbers to older callers.

The rider key profile is a separate change in core-api, and neither PR needs the other to merge first.

Testing

Pest passes on PHP 8.4 for every test file touching this code. The full suite wasn't run, and CI on this PR is the first full run.

Also run against a local API with a rider key: place isolation, saved places, previews storing nothing, cancel, tracker, ETA, two-step signup with no password, and phone changes.

Not exercised against a real API

• request-code, which could text a real number (mocked tests only).
• The socket principal, because socket auth is off locally.
• driver and dispatch with a real assigned driver.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 100.00%. Comparing base (811aa71) to head (6e53c01).

Additional details and impacted files

@@             Coverage Diff              @@
##                main      #420    +/-   ##
============================================
  Coverage     100.00%   100.00%            
- Complexity     13847     13947   +100     
============================================
  Files            642       642            
  Lines          49865     50099   +234     
============================================
+ Hits           49865     50099   +234     

Flag	Coverage Δ
backend	100.00% <100.00%> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.