# Authentication & Authorization System

## 🔐 Overview

Sistem autentikasi dan otorisasi ASETQU V.2 menggunakan Laravel authentication dengan role-based access control.

## 👥 User Roles

Terdapat 2 role user dalam sistem:

| Role     | Description                      | Dashboard URL |
| -------- | -------------------------------- | ------------- |
| `admin`  | Administrator dengan akses penuh | `/admin`      |
| `member` | Member terdaftar (default)       | `/dashboard`  |

**Note:** Role `member` adalah default role untuk user yang register baru.

## 🛡️ Middleware

### 1. AdminMiddleware

Melindungi route yang hanya dapat diakses oleh admin.

```php
// Usage in routes
Route::middleware(['auth', 'admin'])->group(function () {
    // Admin routes
});
```

### 2. RoleMiddleware

Melindungi route berdasarkan role tertentu.

```php
// Usage in routes
Route::middleware(['auth', 'role:admin'])->group(function () {
    // Admin only routes
});

Route::middleware(['auth', 'role:member'])->group(function () {
    // Member only routes
});
```

## 🔄 Login Flow & Redirect

### Login Redirect by Role

Setelah login berhasil, user akan diarahkan ke:

-   **Admin** → `/admin` (Admin Dashboard)
-   **Member** → `/dashboard` (User Dashboard)

**Admin Auto-Redirect:**

-   Jika admin mengakses `/dashboard`, akan otomatis redirect ke `/admin`
-   Ini ditangani oleh middleware `redirect.if.admin`

### Implementation in AuthController

```php
protected function getRedirectUrlByRole(User $user): string
{
    return match ($user->role) {
        'admin' => '/admin',
        'member' => '/dashboard',
        default => '/dashboard',
    };
}
```

## 📝 User Model Methods

### Role Checking Methods

```php
// Check if user is admin
if (auth()->user()->isAdmin()) {
    // Admin only code
}

// Check if user is member
if (auth()->user()->isMember()) {
    // Member only code
}

// Get dashboard URL based on role
$dashboardUrl = auth()->user()->getDashboardUrl();
```

## 🚪 Protected Routes

### Admin Routes

```php
// File: Modules/Admin/routes/web.php
Route::prefix('admin')->middleware(['auth', 'admin'])->group(function () {
    Route::get('/', [AdminController::class, 'dashboard']);
    Route::get('/wallet', [AdminController::class, 'walletIndex']);
    Route::get('/event', [AdminController::class, 'eventIndex']);
    Route::get('/academy', [AdminController::class, 'academyIndex']);
    // ... other admin routes
});
```

### User Dashboard Routes

```php
// File: Modules/Dashboard/routes/web.php
Route::prefix('dashboard')->middleware(['auth', 'redirect.if.admin'])->group(function () {
    // Admin akan otomatis redirect ke /admin
    Route::get('/', [DashboardController::class, 'index']);
    Route::get('/game', [DashboardController::class, 'game']);
    Route::get('/wallet', [DashboardController::class, 'wallet']);
    Route::get('/profile', [DashboardController::class, 'profile']);
    // ... other dashboard routes
});
```

## 🔒 Access Denied (403)

Ketika user mencoba mengakses halaman yang tidak diizinkan:

-   Menampilkan halaman 403 custom
-   Pesan error yang jelas
-   Tombol kembali ke dashboard sesuai role
-   Untuk guest user: tombol kembali ke homepage dan login

## 🧪 Testing Credentials

Gunakan credentials berikut untuk testing:

### Admin Account

-   Email: `admin@asetqu.com`
-   Password: `password`
-   Access: Full admin panel access

### Member Account

-   Email: `member@asetqu.com`
-   Password: `password`
-   Access: User dashboard only

### Member Account 2

-   Email: `member2@asetqu.com`
-   Password: `password`
-   Access: User dashboard only

## 📋 Guest Redirect

User yang belum login akan diarahkan ke:

```
/?login=required
```

Homepage akan otomatis membuka modal login.

## 🔐 Security Features

1. **CSRF Protection**: Semua form dilindungi dengan CSRF token
2. **Password Hashing**: Password di-hash menggunakan bcrypt
3. **Session Regeneration**: Session ID diregenerasi setelah login
4. **Cloudflare Turnstile**: Verifikasi anti-bot pada login/register
5. **Remember Me**: Opsi untuk tetap login
6. **Rate Limiting**: Throttling untuk mencegah brute force

## 🎯 Usage Examples

### Protecting Routes in Controllers

```php
// In constructor
public function __construct()
{
    $this->middleware('auth');
    $this->middleware('admin')->only(['adminMethod']);
}
```

### In Blade Templates

```blade
@auth
    @if(auth()->user()->isAdmin())
        <a href="/admin">Admin Panel</a>
    @else
        <a href="/dashboard">Dashboard</a>
    @endif
@endauth

@guest
    <a href="/?login=required">Login</a>
@endguest
```

### Checking in Controllers

```php
public function index()
{
    if (!auth()->user()->isAdmin()) {
        abort(403, 'Unauthorized access');
    }

    return view('admin.index');
}
```

---

_Last Updated: January 2026_
