# 14 – Carrier portal

Tested live as the QA carrier (qa.carrier.crm@example.com) · 33 pages: Dashboard, Load Board, My Bids, Closed Bids, Orders (All / Pending / Running / Delivered / Paid / Tracking / Driver loads), Drivers, Trucks, Invoices, Reports, Expenses, Tax, Settings, Agreement, Profile

## Works fine

- 32 of 33 pages open. The carrier's own data is right: bid #84 (900, approved), ORDER-001, invoice CARR-QA-1 (700, Paid) – the dashboard, order lists, invoice lists and reports all agree with the company side.
- **Add Driver** (name, email, phone, vehicle, licence, address …) saves and the driver appears in *List Driver*.
- **Add Truck availability** (truck no., dates, anywhere pickup / delivery) saves: "Truck availability added successfully."
- **Whole delivery round trip works:** the company dispatches ORDER-003 to the carrier (driver **QA Driver One** chosen) → it appears for the carrier in *Order List*, *Running Orders* and *Tracking* → carrier **Update Tracing** (empty save → "This field is required"; *Pickup* and then *Delivered + POD* → "Tracing Updated Successfully") → the order moves to the carrier's *Delivered Orders* with *View POD*.

## Issues

| # | Sev | What the user experiences | Steps | Evidence |
|---|-----|---------------------------|-------|----------|
| CA1 | **High** | **A carrier sees other companies' delivered orders.** *Delivered Orders* lists orders of two companies this carrier has nothing to do with (Codemeg: OR-014 … OR-016, Sealink Fleet: 92051 … 92056) with customer, PO number, pickup and delivery places. *(Found and fixed locally – a condition was outside the carrier filter. Needs upload.)* | Carrier → Delivered Orders | `screens/carp_carrier_Delivered_Orders.png` |
| CA2 | **High** | **A carrier can change company-controlled fields about itself** – I un-ticked **Approved**, set the **Rating** and wrote **Internal notes** in the carrier's own Settings and they were saved ("Settings updated successfully"). Approval, rating and internal notes should only be changeable by the company. (I put the values back.) | Carrier → General Setting → change Approved / Rating → Update | `screens/carp_carrier_General_Setting.png` |
| CA4 | ~~Medium~~ **Fixed locally 12 Oct 2026 (needs upload)** | **Add Driver with an empty form saves a blank driver** ("Driver created successfully", a row with N/A everywhere). | Carrier → Add Driver → Create Driver without typing | – |
| CA6 | Medium | **Very slow:** every carrier page takes 6–15 s (Load Request Report 15 s, Invoice Report 13 s). | Open any page | – |
| CA7 | Low | **"Carrier Type" in Settings offers "Type 1 / Type 2"**, not the company's own Carrier Types (same as the customer's Customer Type). | Carrier → General Setting | – |
| CA8 | Low | Every page calls the government FMCSA site from the browser and the call fails (the key is visible in the page). | Console on any page | – |
| CA9 | Low | Script errors on every page (`Cannot read properties of null`); *Add Truck* also has a syntax error, *Add Driver* a missing date-picker. | Console | – |
| CA10 | ~~Medium~~ **Done locally 12 Oct 2026 - awaiting upload + live check** | The carrier saw the **customer's phone, email and company name** on its orders. Decision (you): a carrier must not see customer details. Hidden: name/company/email/phone/ID, customer PO, customer price, customer PDFs (Order PDF and customer invoices blocked; BOL has no customer PO). Kept: pickup/delivery contacts, carrier's own rates. "Ordered By" is hidden when it is the customer's name; the customer's price box on the bidding screens is hidden (carrier's own bid shows). | Carrier → Orders / Reports | – |

## Company-side issues found while testing the carrier flow

These are on the company admin screens, NOT in the carrier panel.

| # | Sev | What the user experiences | Steps | Evidence |
|---|-----|---------------------------|-------|----------|
| CA11 | Low - **fixed locally (O2), needs upload** | After choosing a driver on the company's Dispatch page, the driver's phone is **not** filled in (the driver has one). | Company → Dispatch → choose driver | – |

## Not part of the real carrier panel (hidden pages / withdrawn)

Pages that are hidden from the carrier menu or withdrawn. A carrier does not see these.

| # | Status | What was noted | Steps | Evidence |
|---|--------|----------------|-------|----------|
| CA3 | Not a visible issue | ~~Pending Orders page crashes ("Undefined variable $admins")~~ - **the "Pending Orders" link is commented out in the carrier Order menu (under-LoadOrder-sidebar.blade.php), so a carrier can only reach it by typing the URL.** The crash is fixed locally anyway (needs upload). | URL only: /carrier/Pending_Orders | `screens/carp_carrier_Pending_Orders.png` |
| CA5 | Not a visible issue | ~~Expense pages are mock-ups with sample rows~~ - **the "Expense" menu item is commented out in the carrier sidebar and the "Load Request Report" link is commented out in the Report menu, so a carrier cannot reach these pages; only by typing the URL.** | URL only: /carrier/Expense_List, /Category_List, /LoadRequest_Report | `screens/carp_carrier_Expense_List.png` |

## Not tested (and why)

- Quick Pay, expense edit (the expense pages are mock-ups – CA5), the Agreement text, profile save, a carrier invoice created by the carrier (the company enters it).
- Bids on a second load, load-board filters.

## Test data left in the QA company

- Driver **QA Driver One**, a blank driver (from CA4), Truck **TRK-QA-01** (20–30 Oct, anywhere → anywhere). Carrier Settings put back to the original values.
- **ORDER-003** (customer order request, INR 1,200, carrier rate 700): dispatched, picked up and **Delivered with POD** by the carrier – ready for the customer / carrier invoice and a part-payment test.

## Update 12 Oct 2026 - customer PO, customer price and PDFs (CA10 follow-up)
Carrier login (local test, carrier 297): customer PO and customer price no longer appear on order pages / reports; Order PDF and customer invoice PDFs return 404 for a carrier; BOL shows no customer PO for a carrier. CA3 (Pending Orders crash, `Undefined variable $admins`, LoadOrderController.php:3365) is now fixed locally (the $admins lookup was missing in carrire_Pending_Orders).