From e8adbc75c1496f3fffd3347b7e19c2948a0f2358 Mon Sep 17 00:00:00 2001
From: "Ronald A. Richardson" <me@ron.dev>
Date: Tue, 11 Aug 2026 16:05:34 +0800
Subject: [PATCH] fix: correct three contract failures in the collections
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Set Order Destination sent {{place_id}}.
  The destination must be one of the ORDER's own stops — resolveServiceStopFromKey
  matches against the payload's places and waypoints — so a standalone place from
  the Places folder is rejected with "Place resource is not a valid destination."
  (422). Create an Order already captures {{waypoint_id}} from the order it made,
  which is exactly what this endpoint wants. The description now says so.

Capture Signature for Order sent an empty signature.
  The body shipped "signature": "" literally, so the endpoint answered "No
  signature data to capture." before doing anything. It now takes
  {{proof_signature_base64}}, injected by the contract action.

Download File was asserted to return JSON.
  The collection-level script asserts a JSON body on every response, but this
  endpoint streams the stored file — Storage::download() sends
  Content-Disposition: attachment and the file's own content type. Once Upload
  File began sending a real PNG, the assertion failed with "expected 'image/png'
  to include 'json'": the only failure left in a 24/24 collection.

  The script now branches on Content-Disposition rather than on the request name,
  so any future download endpoint is covered without another exception — and a
  regular endpoint that unexpectedly started returning a file would still be
  caught. Downloads are still asserted: non-empty body, declared content type.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
---
 .../Capture Signature for Order.request.yaml  |  2 +-
 .../Orders/Set Order Destination.request.yaml |  4 ++--
 .../.resources/definition.yaml                | 21 +++++++++++++++----
 3 files changed, 20 insertions(+), 7 deletions(-)

diff --git a/postman/collections/Fleetbase API/Orders/Capture Signature for Order.request.yaml b/postman/collections/Fleetbase API/Orders/Capture Signature for Order.request.yaml
index 23f2821..7f035ec 100644
--- a/postman/collections/Fleetbase API/Orders/Capture Signature for Order.request.yaml	
+++ b/postman/collections/Fleetbase API/Orders/Capture Signature for Order.request.yaml	
@@ -14,7 +14,7 @@ body:
   type: json
   content: |-
     {
-        "signature": "",
+        "signature": "{{proof_signature_base64}}",
         "data": []
     }
 examples: ./.resources/Capture Signature for Order.resources/examples
diff --git a/postman/collections/Fleetbase API/Orders/Set Order Destination.request.yaml b/postman/collections/Fleetbase API/Orders/Set Order Destination.request.yaml
index ad50901..7e689cf 100644
--- a/postman/collections/Fleetbase API/Orders/Set Order Destination.request.yaml	
+++ b/postman/collections/Fleetbase API/Orders/Set Order Destination.request.yaml	
@@ -8,8 +8,8 @@ pathVariables:
     value: "{{order_id}}"
     description: (Required) The id of the order to update.
   - key: placeId
-    value: "{{place_id}}"
-    description: (Required) The pickup, dropoff, or waypoint place id to set as the current destination.
+    value: "{{waypoint_id}}"
+    description: (Required) The pickup, dropoff, or waypoint place id to set as the current destination. It must belong to this order's payload — a place that is not one of the order's stops is rejected with "Place resource is not a valid destination."
 body:
   type: json
   content: ""
diff --git a/postman/collections/Fleetbase Core API/.resources/definition.yaml b/postman/collections/Fleetbase Core API/.resources/definition.yaml
index 28a7b87..ab7df84 100644
--- a/postman/collections/Fleetbase Core API/.resources/definition.yaml	
+++ b/postman/collections/Fleetbase Core API/.resources/definition.yaml	
@@ -18,10 +18,23 @@ scripts:
           pm.expect(pm.response.code, `got HTTP ${pm.response.code}`).to.be.oneOf(expected);
       });
 
-      pm.test(`${pm.info.requestName} returns a JSON body`, function () {
-          pm.expect(pm.response.headers.get('Content-Type') || '').to.include('json');
-          pm.expect(() => pm.response.json(), 'body is not parseable JSON').to.not.throw();
-      });
+      // Files/Download File streams the stored file, so JSON is the wrong contract for it.
+      // Detected by Content-Disposition rather than by request name, so any future
+      // download endpoint is covered without adding another exception — and so a regular
+      // endpoint that started returning a file would still be caught.
+      const isFileDownload = (pm.response.headers.get('Content-Disposition') || '').includes('attachment');
+
+      if (isFileDownload) {
+          pm.test(`${pm.info.requestName} streams a file body`, function () {
+              pm.expect(pm.response.responseSize, 'download returned an empty body').to.be.above(0);
+              pm.expect(pm.response.headers.get('Content-Type') || '', 'download declared no content type').to.not.be.empty;
+          });
+      } else {
+          pm.test(`${pm.info.requestName} returns a JSON body`, function () {
+              pm.expect(pm.response.headers.get('Content-Type') || '').to.include('json');
+              pm.expect(() => pm.response.json(), 'body is not parseable JSON').to.not.throw();
+          });
+      }
 
       // A 2xx carrying {"error": ...} or {"errors": [...]} is still a failure; the API
       // returns that shape for several handled conditions.