release: v1.6.70

[roncodes]

Release v1.6.70

A patch release for one bug, so fleetbase/storefront v0.4.25 can ship its fix. Merging into main triggers release.yml, which checks that composer.json and the first line of RELEASE.md name 1.6.70, then pushes the v1.6.70 tag.

What changed

VerificationCode::generateSmsVerificationFor() always texted $subject->phone. Storefront's request-phone-verification passes the customer's user as the subject and carries the new number only in meta.phone. This caused two problems:

• A customer changing their number got the code on the old number.
• A customer with no number on file got nothing, and the endpoint still answered { "status": "ok" }.

The method now takes a phone option. When it's given, that number is texted, and the SMS guard reserves, counts and traces the send against it instead of the subject's number. Without the option, behaviour is unchanged: the subject's phone is used, and a subject with no phone still gets a saved code and no text.

The other callers are unchanged: fleetops driver login and password reset, core 2FA, onboarding and the account-created listener.

Tests

Three new cases in tests/Unit/Models/VerificationCodeGuardTest.php:

• The option's number is texted and gets its own guard cooldown; the subject's number is used without the option.
• A subject with no phone gets a text when the option is given.
• With no number at all, the code is saved and nothing is texted.

The new cases sit before leaves the code row untouched when the guard is disabled on purpose. VerificationCodeModelTest runs next in the same process and relies on the guard being left disabled by that last test. Appending tests after it fails four model tests. This order dependency already existed; this PR doesn't fix it.

Validation, run locally on PHP 8.4:

• pest (full suite): 2236 tests, 0 failed.
• php-cs-fixer --dry-run on the changed files: clean.
• php -l on PHP 8.2: clean.

Before merging

• No migrations or settings.
• fleetbase/storefront release/v0.4.25 requires fleetbase/core-api ^1.6.70 for this fix, so this release must be tagged before the Storefront release PR's CI can install.
• Docs: none needed. The postman request "Request Phone Verification" already says the code is sent to the new phone number, which is now true.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 100.00%. Comparing base (f7bb580) to head (d675103).

Additional details and impacted files

@@             Coverage Diff             @@
##                main      #310   +/-   ##
===========================================
  Coverage     100.00%   100.00%           
- Complexity      8880      8881    +1     
===========================================
  Files            472       472           
  Lines          27918     27918           
===========================================
  Hits           27918     27918           

Flag	Coverage Δ
backend	100.00% <100.00%> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.