# Urutan Pembacaan Login - AHSP

> Dokumentasi flow login dari request sampai dashboard

---

## Diagram Alur Login

\Browser
  |
  | GET /login
  v
[1] Route::get('/login')
  |  middleware: guest, ip.block
  v
[2] IpBlockMiddleware
  |  Cek apakah IP diblokir di tabel blocked_ips
  |  Jika diblokir --> tampilkan auth.blocked (403)
  v
[3] Guest Middleware
  |  Jika sudah login --> redirect ke dashboard
  v
[4] LoginController::index()
  |  Baca AppSetting (template, warna, mode, dll)
  v
[5] View auth.login (extends layouts.auth)
  |  Render halaman login dengan template (classic/ocean/mint)
  v
[HALAMAN LOGIN TAMPIL]


Browser
  |
  | POST /login (email + password + _token)
  v
[6] Route::post('/login')
  |  middleware: guest, ip.block
  v
[7] IpBlockMiddleware (cek IP lagi)
  v
[8] LoginController::store()
  |
  v
[9] Cek Mode Maintenance
  |  Jika mode == maintenance:
  |    - Cari user berdasarkan email
  |    - Cek apakah user punya role administrator/super-admin
  |    - Jika BUKAN admin --> tolak: Login sementara ditutup
  v
[10] Validasi Input
  |  email: required, email format
  |  password: required, string
  |  Jika gagal --> back() dengan error validasi
  v
[11] Cari User Candidate
  |  Query: LOWER(email) = email_input
  |  Menggunakan model dari config auth.providers.users.model
  v
[12] Cek Active Role
  |  hasActiveRole(): user punya minimal 1 role dengan pivot.is_active = true?
  |  Jika TIDAK --> tolak: Akun login dinonaktifkan. Hubungi administrator.
  v
[13] Auth::attempt()
  |  Laravel builtin auth: cek email + password hash
  |  Jika BERHASIL:
  |    - session()->regenerate() (security: anti session fixation)
  |    - redirect()->intended(route('dashboard'))
  |  Jika GAGAL:
  |    - back() dengan error: Email atau password salah.
  v
[DASHBOARD]
\
---

## Detail Setiap Tahap

### [1] Route Definition
- **File**: routes/web.php
- **GET /login**: LoginController@index --> tampilkan form
- **POST /login**: LoginController@store --> proses login
- **GET /login/refresh-token**: LoginController@refreshToken --> refresh CSRF token
- **POST /logout**: LoginController@logout --> proses logout

### [2] IpBlockMiddleware
- **File**: app/Http/Middleware/IpBlockMiddleware.php
- Cek IP request terhadap tabel blocked_ips (kolom ip_address, is_active)
- Jika IP diblokir:
  - User sudah login? Force logout + invalidate session
  - Request JSON? Return 403 JSON
  - Request biasa? Return view auth.blocked (403)

### [3] Guest Middleware
- Bawaan Laravel
- Jika user SUDAH login, redirect ke halaman yang dituju (dashboard)
- Hanya guest yang bisa akses halaman login

### [4] LoginController::index() - Tampilkan Form
- **File**: app/Http/Controllers/LoginController.php
- Membaca settings dari tabel app_settings:

| Key Setting | Default | Fungsi |
|-------------|---------|--------|
| login.template | classic | Template tampilan (classic / ocean / mint) |
| login.primary_color | #6f4cc3 | Warna utama |
| login.visual_image_url | (kosong) | URL gambar visual di panel kiri |
| company.name | TheCubeFactory | Nama perusahaan |
| login.mode | login | Mode: login / maintenance |
| login.announcement_title | (kosong) | Judul pengumuman |
| login.announcement_message | (kosong) | Isi pengumuman |

- Melempar data ke view auth.login

### [5] View auth.login
- **File**: resources/views/auth/login.blade.php
- **Layout**: resources/views/layouts/auth.blade.php
- Layout menggunakan AdminLTE + Source Sans 3 font + FontAwesome
- Tampilan split-panel: panel kiri (visual/branding) + panel kanan (form)
- 3 tema warna: classic (ungu), ocean (biru), mint (hijau)
- Di local environment: menampilkan demo email dan password

### [6-7] POST /login + Middleware
- Sama seperti GET, melewati IpBlockMiddleware dan Guest middleware

### [8-9] LoginController::store() - Mode Maintenance
- Baca login.mode dari app_settings
- Jika maintenance:
  - Hanya user dengan role administrator atau super-admin yang bisa login
  - Cek berdasarkan slug atau name role
  - User lain ditolak dengan pesan: Login sementara ditutup

### [10] Validasi Input
- email: wajib, format email valid
- password: wajib, string
- Jika gagal: kembali ke form dengan error dan input lama

### [11] Pencarian User
- Mencari user berdasarkan email (case-insensitive)
- Menggunakan LOWER(email) = ? untuk pencarian
- Model diambil dari config auth.providers.users.model

### [12] Cek Active Role - hasActiveRole()
- Load relasi roles pada user
- Cek apakah minimal 1 role memiliki pivot.is_active = true
- Jika tidak ada role aktif: Akun login dinonaktifkan. Hubungi administrator.
- Mencegah user yang sudah dinonaktifkan role-nya tapi masih ada di database

### [13] Auth::attempt()
- Laravel native authentication
- Menggunakan guard default (session-based)
- Parameter: credentials (email, password) + remember (boolean)
- Jika berhasil:
  - session()->regenerate() - mencegah session fixation attack
  - redirect()->intended(route('dashboard')) - ke dashboard atau halaman sebelumnya
- Jika gagal:
  - Kembali ke form dengan error: Email atau password salah.

---

## Fitur Tambahan

### Refresh CSRF Token
- **Route**: GET /login/refresh-token
- **Method**: LoginController@refreshToken()
- Menyimpan login_page_last_seen_at di session
- Regenerate CSRF token (berguna jika halaman login dibiarkan lama)
- Return JSON: csrf_token, refreshed_at, session_lifetime_minutes

### Logout
- **Route**: POST /logout
- **Method**: LoginController@logout()
- Mendukung redirect_to parameter untuk menyimpan intended URL
- Keamanan: validate redirect URL (hanya path relatif atau same-host)
- Auth::logout() + session invalidate + session regenerateToken
- Redirect ke login route

---

## File yang Terlibat

| File | Peran |
|------|-------|
| routes/web.php | Definisi route login/logout |
| app/Http/Controllers/LoginController.php | Controller utama login |
| app/Http/Middleware/IpBlockMiddleware.php | Cek IP diblokir |
| app/Http/Middleware/MenuAccessMiddleware.php | Middleware setelah login |
| app/Models/BlockedIp.php | Model IP terblokir |
| app/Models/AppSetting.php | Model pengaturan aplikasi |
| app/Models/UserModels.php | Model user |
| app/Models/RoleModels.php | Model role |
| resources/views/auth/login.blade.php | View form login |
| resources/views/auth/blocked.blade.php | View IP blocked |
| resources/views/auth/maintenance.blade.php | View maintenance mode |
| resources/views/layouts/auth.blade.php | Layout auth |
| config/auth.php | Auth configuration |

---

## Urutan Ringkas (Quick Reference)

\1.  User buka /login
2.  IpBlockMiddleware cek IP
3.  Guest middleware cek sudah login?
4.  LoginController::index() load settings
5.  Render view auth.login
6.  User submit form (POST /login)
7.  IpBlockMiddleware cek IP (lagi)
8.  Cek mode maintenance (hanya admin boleh)
9.  Validasi email dan password
10. Cari user by email (case-insensitive)
11. Cek user punya active role
12. Auth::attempt() (email + password hash)
13. Session regenerate + redirect dashboard
\