Merge pull request 'amalia/30-apr-26' (#41) from amalia/30-apr-26 into join

Reviewed-on: #41

.env.example

@@ -42,6 +42,12 @@ VAPID_PRIVATE_KEY="UHDY8M3-0beVIA2kt2zL3ZeMStJ0j6zVkVd2Cfqpgrc"
 # API key for file operations (upload, delete, copy, view directory)
 WS_APIKEY="your-websocket-api-key"
 
+# ===========================================
+# MONITORING API
+# ===========================================
+# API key untuk akses endpoint /api/monitoring (header: x-api-key)
+MONITORING_API_KEY="your-monitoring-api-key"
+
 # ===========================================
 # APPLICATION SETTINGS
 # ===========================================

.mcp/deploy-stg/server.ts

@@ -197,7 +197,7 @@ server.setRequestHandler(CallToolRequestSchema, async (request) => {
 
       // 3. Push to build remote (GitHub)
       const currentBranch = GIT(["rev-parse", "--abbrev-ref", "HEAD"]);
-      GIT(["push", "build", `${currentBranch}:main`, "--force"]);
+      GIT(["push", "build", `${currentBranch}:stg`, "--force"]);
 
       // 4. Trigger publish
       GH([

package.json

@@ -1,6 +1,6 @@
 {
   "name": "sistem-desa-mandiri",
-  "version": "0.1.6",
+  "version": "0.1.7",
   "private": true,
   "scripts": {
     "dev": "next dev --experimental-https",

prisma/migrations/20260430070147_auto/migration.sql

@@ -0,0 +1 @@
+-- This is an empty migration.

src/app/api/monitoring/[[...slug]]/route.ts

@@ -25,6 +25,18 @@ const MonitoringServer = new Elysia({ prefix: "/api/monitoring" })
          }
       }
    }))
+   .onBeforeHandle(({ request, set, path }) => {
+      // Docs tidak perlu API key
+      if (path.startsWith("/api/monitoring/docs")) return;
+
+      const apiKey = process.env.MONITORING_API_KEY;
+      const incoming = request.headers.get("x-api-key");
+
+      if (!apiKey || incoming !== apiKey) {
+         set.status = 401;
+         return { success: false, message: "Unauthorized" };
+      }
+   })
 
    .get("/grid-overview", async ({ query, set }) => {
       try {
@@ -1503,7 +1515,7 @@ const MonitoringServer = new Elysia({ prefix: "/api/monitoring" })
             idUserRole: t.String({ description: "ID Role" }),
             idVillage: t.String({ description: "ID Desa" }),
             idGroup: t.String({ description: "ID Group" }),
-            idPosition: t.Optional(t.String({ description: "ID Posisi" })),
+            idPosition: t.Optional(t.Union([t.String(), t.Null()], { description: "ID Posisi" })),
             isActive: t.Boolean({ description: "Aktif" }),
             isWithoutOTP: t.Boolean({ description: "Tanpa OTP" }),
          }),