[shivanathd]

Since #352 (merged 7 Oct 2026) the public tracking lookup and fleet-ops/lookup reject any tracking number that contains a space. Some generated numbers do contain one, so those orders can no longer be tracked. Numbers like this resolved fine up to v0.7.68.

Why the numbers contain a space

TrackingNumber::generateTrackingNumber() builds the prefix from strtoupper(substr($company->name, 0, 3)). A company named "Al Noor Transport" therefore issues numbers like AL 7796486490AE. TrackingResolver::NUMBER_PATTERN and OrderController::normalizeTrackingLookup() both use /^[A-Za-z0-9][A-Za-z0-9._\-]{0,99}$/, which has no space, so these numbers now get the "not found" answer.

Changes

Commit 1: accept single inner spaces in lookups. Both patterns become:

/^[A-Za-z0-9](?:[A-Za-z0-9._\-]| (?=[A-Za-z0-9._\-])){0,99}$/

A space is allowed only when an allowed character follows it. Leading, trailing and double spaces are still refused, as are tabs, newlines, quotes, & and everything else the old pattern refused. The 100-character limit is unchanged. Both call sites already trim() first, so a number pasted with surrounding spaces still resolves, as before.

Commit 2 (optional, drop it if you prefer): keep only A-Z0-9 in the generated prefix. New numbers no longer get a space, & or ' from the company name (e.g. "A&B Logistics" currently gives A&B…, which no lookup accepts). The fallback is FLB when nothing is left, which also covers names in non-Latin scripts: today substr(…, 0, 3) cuts those mid-character. The logic moves into a small TrackingNumber::trackingNumberPrefix() helper so it can be unit tested. Numbers already issued keep working through commit 1.

Tests

• TrackingResolverTest: new case for inner spaces. AL 7796486490AE and ABC1234567890AE resolve. " AL1" and "AL1 " fail the pattern itself. AL 1, AL'1, AL&1, tab, newline and 101 characters are refused.
• OrderControllerContractsTest (fix(tracking): throttle the public order lookup and return a minimal resource #352's lookup test): AL 7796486490AE now reaches the query; AL 1, tab, newline and AL&1 still don't.
• TrackingNumberTest: prefix cases (NOR, AL, AB, 3PL, Arabic name → FLB, blank/null → FLB).

I ran these on PHP 8.2 with Pest:

• TrackingResolverTest: 6/6 pass.
• TrackingNumberTest: 6/6 pass.
• QuerySeamsTest: 10/10 pass.
• ModelLookupFallbackSeamsTest: 4/4 pass.
• OrderControllerContractsTest: 23/24 pass. The one error is proof_photo_helpers_…, which needs the GD extension my container lacks; it errors the same way on main.

The new resolver and controller cases fail on main and pass with this change. php-cs-fixer --dry-run is clean on the changed lines. phpstan on the three changed source files reports the same findings as main (none new).

Related: #352, #181 (custom tracking numbers would face the same pattern).

This PR was prepared with an AI coding tool (Claude Code) and reviewed by Shiv. Found by Mindcat (mindcat.ai).

---

Generated by Claude Code

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 100.00%. Comparing base (33032e5) to head (4ee3a82).

Additional details and impacted files

@@             Coverage Diff             @@
##                main      #413   +/-   ##
===========================================
  Coverage     100.00%   100.00%           
- Complexity     13596     13598    +2     
===========================================
  Files            634       634           
  Lines          49342     49344    +2     
===========================================
+ Hits           49342     49344    +2     

Flag	Coverage Δ
backend	100.00% <100.00%> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[roncodes]

Thanks @shivanathd, this looks good, and I'm keeping both commits.

• The lookahead pattern allows a space only before an allowed character. Together with the existing trim() at both call sites, leading, trailing and double spaces are still refused. I checked the edge cases in the tests: 101 characters, tab and newline.
• trackingNumberPrefix() also fixes the &/' prefixes and the multibyte cut. Numbers already issued with & in the prefix still can't be looked up, but those were never reachable through the lookup, so that's out of scope here.
• Version note: fix(tracking): throttle the public order lookup and return a minimal resource #352 first shipped in v0.6.72 (the description says v0.7.68, probably a typo for v0.6.71).

Retargeted to release/v0.6.75 (#415).

[roncodes]

Follow-up: the root cause, which is spaces getting into generated numbers at all, is fixed in #416, stacked on this PR. As well as the prefix, the region suffix could contain spaces (...NEW YORK when the pickup has no country). #416 also changes the prefix to take the first three letters or digits after removing punctuation (ALN instead of AL). Your lookup change stays as is for numbers already issued.