Merge pull request 'amalia/28-mei-26' (#54) from amalia/28-mei-26 into join

Reviewed-on: #54

package.json

@@ -1,6 +1,6 @@
 {
   "name": "sistem-desa-mandiri",
-  "version": "0.1.11",
+  "version": "0.1.18",
   "private": true,
   "scripts": {
     "dev": "next dev --experimental-https",

prisma/migrations/20260515030040_auto/migration.sql

@@ -0,0 +1 @@
+-- This is an empty migration.

prisma/migrations/20260515031651_auto/migration.sql

@@ -0,0 +1 @@
+-- This is an empty migration.

prisma/migrations/20260518071507_auto/migration.sql

@@ -0,0 +1 @@
+-- This is an empty migration.

prisma/migrations/20260519080535_auto/migration.sql

@@ -0,0 +1 @@
+-- This is an empty migration.

prisma/migrations/20260521030721_auto/migration.sql

@@ -0,0 +1 @@
+-- This is an empty migration.

prisma/migrations/20260522064632_auto/migration.sql

@@ -0,0 +1 @@
+-- This is an empty migration.

prisma/migrations/20260525073630_auto/migration.sql

@@ -0,0 +1 @@
+-- This is an empty migration.

src/app/api/ai/[[...slug]]/route.ts

@@ -1,3 +1,4 @@
+import { isValidApiKey } from "@/lib/apiKey";
 import { prisma } from "@/module/_global";
 import cors from "@elysiajs/cors";
 import { swagger } from "@elysiajs/swagger";
@@ -6,20 +7,6 @@ import _ from "lodash";
 import moment from "moment";
 import "moment/locale/id";
 
-const CACHE_TTL_MS = 60_000;
-let apiKeyCache: Set<string> = new Set();
-let cacheExpiresAt = 0;
-
-async function isValidApiKey(incoming: string): Promise<boolean> {
-   const now = Date.now();
-   if (now > cacheExpiresAt) {
-      const rows = await prisma.apiKey.findMany({ where: { isActive: true }, select: { key: true } });
-      apiKeyCache = new Set(rows.map((r) => r.key));
-      cacheExpiresAt = now + CACHE_TTL_MS;
-   }
-   return apiKeyCache.has(incoming);
-}
-
 const AiServer = new Elysia({ prefix: "/api/ai" })
    .use(cors({
       origin: "*",

src/app/api/mobile/project/task/[id]/approval/route.ts

@@ -96,13 +96,13 @@ async function sendNotification({
     }
 }
 
-async function getApproversInVillage(idVillage: string): Promise<NotifTarget[]> {
+async function getApproversInVillage(idVillage: string, idGroup: string): Promise<NotifTarget[]> {
     const approvers = await prisma.user.findMany({
         where: {
             isActive: true,
             idVillage,
             OR: [
-                { isApprover: true },
+                { isApprover: true, idGroup },
                 { UserRole: { id: 'supadmin' } }
             ]
         },
@@ -198,7 +198,10 @@ export async function POST(request: Request, context: { params: { id: string } }
 
         const task = await prisma.projectTask.findUnique({
             where: { id, isActive: true },
-            select: { id: true, status: true, idProject: true, title: true }
+            select: {
+                id: true, status: true, title: true,
+                Project: { select: { id: true, idGroup: true } }
+            }
         });
 
         if (!task) {
@@ -227,14 +230,14 @@ export async function POST(request: Request, context: { params: { id: string } }
             })
         ]);
 
-        await recalculateProjectStatus(task.idProject);
+        await recalculateProjectStatus(task.Project.id);
 
-        // Notifikasi ke semua approver
-        const approverTargets = await getApproversInVillage(String(userMobile.idVillage));
+        // Notifikasi ke semua approver di desa dan group yang sama
+        const approverTargets = await getApproversInVillage(String(userMobile.idVillage), task.Project.idGroup);
         await sendNotification({
             targets: approverTargets,
             idUserFrom: userMobile.id,
-            idContent: task.idProject,
+            idContent: task.Project.id,
             title: 'Pengajuan Penyelesaian Tugas',
             desc: task.title,
         });
@@ -271,7 +274,7 @@ export async function PUT(request: Request, context: { params: { id: string } })
 
         const task = await prisma.projectTask.findUnique({
             where: { id, isActive: true },
-            select: { id: true, status: true, idProject: true, title: true }
+            select: { id: true, status: true, title: true, Project: { select: { id: true } } }
         });
 
         if (!task) {
@@ -304,7 +307,7 @@ export async function PUT(request: Request, context: { params: { id: string } })
                 })
             ]);
 
-            await recalculateProjectStatus(task.idProject);
+            await recalculateProjectStatus(task.Project.id);
 
             // Notifikasi ke submitter
             const submitterTarget = await getUserNotifTarget(pendingApproval.idUser);
@@ -312,7 +315,7 @@ export async function PUT(request: Request, context: { params: { id: string } })
                 await sendNotification({
                     targets: [submitterTarget],
                     idUserFrom: userMobile.id,
-                    idContent: task.idProject,
+                    idContent: task.Project.id,
                     title: 'Tugas Disetujui',
                     desc: task.title,
                 });
@@ -339,7 +342,7 @@ export async function PUT(request: Request, context: { params: { id: string } })
             })
         ]);
 
-        await recalculateProjectStatus(task.idProject);
+        await recalculateProjectStatus(task.Project.id);
 
         // Notifikasi ke submitter
         const submitterTarget = await getUserNotifTarget(pendingApproval.idUser);
@@ -347,7 +350,7 @@ export async function PUT(request: Request, context: { params: { id: string } })
             await sendNotification({
                 targets: [submitterTarget],
                 idUserFrom: userMobile.id,
-                idContent: task.idProject,
+                idContent: task.Project.id,
                 title: 'Tugas Ditolak',
                 desc: task.title,
             });

src/app/api/mobile/task/[id]/route.ts

@@ -25,6 +25,9 @@ export async function GET(request: Request, context: { params: { id: string } })
          where: {
             id: String(id),
             isActive: true
+         },
+         include: {
+            Division: { select: { idGroup: true } }
          }
       });
 
@@ -33,7 +36,7 @@ export async function GET(request: Request, context: { params: { id: string } })
       }
 
       if (kategori == "data") {
-         allData = data
+         allData = { ...data, idGroup: data.Division.idGroup }
       } else if (kategori == "progress") {
          const dataProgress = await prisma.divisionProjectTask.findMany({
             where: {

src/app/api/mobile/task/tugas/[id]/approval/route.ts

@@ -96,13 +96,19 @@ async function sendNotification({
 }
 
 async function getApproversForDivision(idVillage: string, idDivision: string): Promise<NotifTarget[]> {
+    const division = await prisma.division.findUnique({
+        where: { id: idDivision },
+        select: { idGroup: true }
+    });
+    const idGroup = division?.idGroup;
+
     const [globalApprovers, divisionAdmins] = await Promise.all([
         prisma.user.findMany({
             where: {
                 isActive: true,
                 idVillage,
                 OR: [
-                    { isApprover: true },
+                    { isApprover: true, idGroup },
                     { UserRole: { id: 'supadmin' } }
                 ]
             },
@@ -285,23 +291,35 @@ export async function PUT(request: Request, context: { params: { id: string } })
             return NextResponse.json({ success: false, message: "Anda harus login untuk mengakses ini" }, { status: 200 });
         }
 
-        const canApprove = await getApproverStatus(userMobile.id);
-        if (!canApprove) {
-            // Check if division admin
-            const task = await prisma.divisionProjectTask.findUnique({
-                where: { id, isActive: true },
-                select: { idDivision: true }
-            });
-            if (task) {
-                const isDivAdmin = await prisma.divisionMember.count({
-                    where: { idDivision: task.idDivision, idUser: userMobile.id, isAdmin: true, isActive: true }
-                });
-                if (isDivAdmin === 0) {
-                    return NextResponse.json({ success: false, message: "Anda tidak memiliki izin untuk menyetujui atau menolak tugas" }, { status: 200 });
-                }
-            } else {
-                return NextResponse.json({ success: false, message: "Tugas tidak ditemukan" }, { status: 200 });
-            }
+        const taskForAuth = await prisma.divisionProjectTask.findUnique({
+            where: { id, isActive: true },
+            select: { idDivision: true }
+        });
+        if (!taskForAuth) {
+            return NextResponse.json({ success: false, message: "Tugas tidak ditemukan" }, { status: 200 });
+        }
+
+        const [division, userFull, isDivAdmin] = await Promise.all([
+            prisma.division.findUnique({
+                where: { id: taskForAuth.idDivision },
+                select: { idGroup: true, idVillage: true }
+            }),
+            prisma.user.findUnique({
+                where: { id: userMobile.id },
+                select: { isApprover: true, idGroup: true, idVillage: true, UserRole: { select: { id: true } } }
+            }),
+            prisma.divisionMember.count({
+                where: { idDivision: taskForAuth.idDivision, idUser: userMobile.id, isAdmin: true, isActive: true }
+            })
+        ]);
+
+        const isSupadmin = APPROVER_ROLES.includes(userFull?.UserRole?.id ?? '');
+        const isGroupApprover = !!(userFull?.isApprover &&
+            userFull.idVillage === division?.idVillage &&
+            userFull.idGroup === division?.idGroup);
+
+        if (!isSupadmin && !isGroupApprover && isDivAdmin === 0) {
+            return NextResponse.json({ success: false, message: "Anda tidak memiliki izin untuk menyetujui atau menolak tugas" }, { status: 200 });
         }
 
         const task = await prisma.divisionProjectTask.findUnique({

src/app/api/noc/[[...slug]]/route.ts

@@ -1,3 +1,4 @@
+import { isValidApiKey } from "@/lib/apiKey";
 import { prisma } from "@/module/_global";
 import cors from "@elysiajs/cors";
 import { swagger } from "@elysiajs/swagger";
@@ -11,20 +12,40 @@ const NocServer = new Elysia({ prefix: "/api/noc" })
    .use(cors({
       origin: "*",
       methods: ["GET", "POST", "OPTIONS"],
+      allowedHeaders: ["Content-Type", "x-api-key"],
    }))
    .use(swagger({
-      path: "/docs", // Karena prefix instance adalah /api/noc, maka ini akan diakses di /api/noc/docs
+      path: "/docs",
       documentation: {
          info: {
             title: "Sistem Desa Mandiri - NOC API",
             version: "1.0.0",
             description: "API Khusus untuk kebutuhan NOC (Network Operation Center) dan Monitoring Desa",
          },
+         components: {
+            securitySchemes: {
+               ApiKeyAuth: {
+                  type: "apiKey",
+                  in: "header",
+                  name: "x-api-key",
+               },
+            },
+         },
+         security: [{ ApiKeyAuth: [] }],
          tags: [
             { name: "NOC", description: "Endpoint khusus monitoring" }
          ]
       }
    }))
+   .onBeforeHandle(async ({ request, set, path }) => {
+      if (path.startsWith("/api/noc/docs")) return;
+
+      const incoming = request.headers.get("x-api-key");
+      if (!incoming || !(await isValidApiKey(incoming))) {
+         set.status = 401;
+         return { success: false, message: "Unauthorized" };
+      }
+   })
 
    // ── GET /api/noc/active-divisions ──────────────────────────────────────────
    .get(

src/lib/apiKey.ts

@@ -0,0 +1,15 @@
+import { prisma } from "@/module/_global";
+
+const CACHE_TTL_MS = 60_000;
+let apiKeyCache: Set<string> = new Set();
+let cacheExpiresAt = 0;
+
+export async function isValidApiKey(incoming: string): Promise<boolean> {
+   const now = Date.now();
+   if (now > cacheExpiresAt) {
+      const rows = await prisma.apiKey.findMany({ where: { isActive: true }, select: { key: true } });
+      apiKeyCache = new Set(rows.map((r) => r.key));
+      cacheExpiresAt = now + CACHE_TTL_MS;
+   }
+   return apiKeyCache.has(incoming);
+}