A2-PENGADAAN BARANG

.gitignore

@@ -59,3 +59,10 @@ typings/
 
 # next.js build output
 .next
+
+# Playwright
+/test-results/
+/playwright-report/
+/blob-report/
+/playwright/.cache/
+/playwright/.auth/

GEMINI.md

@@ -53,7 +53,7 @@ To protect a route with a specific permission (or any one of multiple permission
 const { checkPermission } = require('../middlewares/acl');
 
 // Single permission
-router.get('/admin/users', checkPermission('manage_users'), userController.list);
+router.get('/reports', checkPermission('view_reports'), reportController.index);
 
 // Multiple permissions (user must have at least one)
 router.get('/reports', checkPermission(['view_reports', 'manage_all']), reportController.index);

README.md

@@ -0,0 +1,93 @@
+# Facultyware
+
+Facultyware adalah aplikasi web sistem informasi pengadaan barang untuk lingkungan fakultas. Aplikasi ini membantu proses pengajuan usulan pengadaan barang oleh Ketua Departemen, pengelolaan permohonan oleh Pengelola Aset/Pengelola Sistem, serta proses persetujuan atau penolakan oleh Wakil Dekan.
+
+Fitur utama aplikasi meliputi pengajuan usulan pengadaan, edit dan hapus usulan, pemantauan status usulan, pengelolaan permohonan pengadaan, penambahan barang hasil pengadaan ke sistem, dashboard tiap role, laporan rekapan, dan endpoint API JSON.
+
+## Cara Instalasi
+
+1. Pastikan Node.js dan MySQL sudah terpasang.
+
+2. Masuk ke folder project:
+
+   ```bash
+   cd facultyware
+   ```
+
+3. Install dependency:
+
+   ```bash
+   npm install
+   ```
+
+4. Buat atau sesuaikan file `.env`:
+
+   ```env
+   DB_HOST=localhost
+   DB_USER=root
+   DB_PASSWORD=
+   DB_NAME=facultyware
+   SESSION_SECRET=facultyware-secret
+   PORT=3000
+   ```
+
+5. Buat database MySQL dengan nama sesuai `DB_NAME`.
+
+6. Jalankan script inisialisasi atau seed database jika diperlukan:
+
+   ```bash
+   node scripts/init_db.js
+   node scripts/seed_data.js
+   ```
+
+   Jika menggunakan seed SQL pengadaan, jalankan file:
+
+   ```text
+   database/seed_procurement_roles.sql
+   ```
+
+## Cara Menjalankan Aplikasi
+
+Jalankan aplikasi dengan perintah:
+
+```bash
+npm start
+```
+
+Setelah server berjalan, buka aplikasi melalui browser:
+
+```text
+http://localhost:3000
+```
+
+Untuk mode development, gunakan:
+
+```bash
+npm run dev
+```
+
+## Pembagian Tugas Anggota
+
+| No | Fitur | NIM | Nama Anggota |
+| --- | --- | --- | --- |
+| 1 | Ketua Departemen dapat menginputkan pengajuan usulan pengadaan barang | 2411521017 | Diva Ramadhani |
+| 2 | Ketua Departemen dapat mengedit usulan pengadaan barang | 2411521017 | Diva Ramadhani |
+| 3 | Ketua Departemen dapat melihat status usulan pengadaan barang | 2411521017 | Diva Ramadhani |
+| 4 | Ketua Departemen dapat menghapus usulan pengadaan barang | 2411521017 | Diva Ramadhani |
+| 5 | Ketua Departemen dapat mengenerate file laporan rekapan pengadaan barang | 2411521017 | Diva Ramadhani |
+| 6 | Sistem dapat memberikan response semua riwayat pengajuan pengadaan barang oleh Ketua Departemen dalam format JSON (API) | 2411521017 | Diva Ramadhani |
+| 7 | Ketua Departemen dapat melihat dashboard | 2411521017 | Diva Ramadhani |
+| 8 | Pengelola sistem dapat menerima usulan pengadaan barang | 2411522006 | Kevin Rahmat Illahi |
+| 9 | Pengelola Aset dapat menginputkan permohonan pengadaan barang | 2411522006 | Kevin Rahmat Illahi |
+| 10 | Pengelola Aset dapat menambahkan data barang yang disetujui hasil dari pengadaan ke sistem | 2411522006 | Kevin Rahmat Illahi |
+| 11 | Pengelola Aset dapat mengenerate file laporan rekapan pengadaan barang | 2411522006 | Kevin Rahmat Illahi |
+| 12 | Pengelola Aset dapat merubah status usulan pengadaan barang | 2411522006 | Kevin Rahmat Illahi |
+| 13 | Pengelola Aset dapat melihat data barang pengadaan melalui API | 2411522006 | Kevin Rahmat Illahi |
+| 14 | Pengelola Aset dapat melihat dashboard | 2411522006 | Kevin Rahmat Illahi |
+| 15 | Wakil Dekan dapat melihat daftar permohonan pengadaan barang | 2411522013 | Aldo Septia Elvawan |
+| 16 | Wakil Dekan dapat melihat detail permohonan pengadaan barang | 2411522013 | Aldo Septia Elvawan |
+| 17 | Wakil Dekan dapat memberikan keputusan persetujuan/penolakan permohonan pengadaan barang | 2411522013 | Aldo Septia Elvawan |
+| 18 | Wakil Dekan dapat melihat riwayat keputusan permohonan pengadaan barang | 2411522013 | Aldo Septia Elvawan |
+| 19 | Wakil Dekan dapat mengenerate file laporan rekapan pengadaan barang | 2411522013 | Aldo Septia Elvawan |
+| 20 | Sistem dapat memberikan response data permohonan pengadaan barang dalam format JSON (API) | 2411522013 | Aldo Septia Elvawan |
+| 21 | Wakil Dekan dapat melihat dashboard | 2411522013 | Aldo Septia Elvawan |

app.js

@@ -1,18 +1,21 @@
-require('dotenv').config();
+const path = require('path');
+require('dotenv').config({ path: path.join(__dirname, '.env') });
 var express = require('express');
-var path = require('path');
 var cookieParser = require('cookie-parser');
 var logger = require('morgan');
 var session = require('express-session');
 var MySQLStore = require('express-mysql-session')(session);
 
-var indexRouter = require('./routes/index');
-var usersRouter = require('./routes/users');
+var authRouter = require('./routes/auth/index');
+var pengelolaAsetDashboardRouter = require('./routes/pengelola-aset/dashboard');
+var procurementsRouter = require('./routes/pengelola-aset/procurements');
+var apiProcurementsRouter = require('./routes/pengelola-aset/apiProcurements');
 const { notFoundHandler, errorHandler } = require('./middlewares/error');
+const usulanRouter = require('./routes/usulan');
+const wakildekanRouter = require('./routes/wakildekan');
 
 var app = express();
 
-// view engine setup
 app.set('views', path.join(__dirname, 'views'));
 app.set('view engine', 'ejs');
 
@@ -22,32 +25,51 @@ app.use(express.urlencoded({ extended: false }));
 app.use(cookieParser());
 app.use(express.static(path.join(__dirname, 'public')));
 
-// Session configuration
-const sessionStore = new MySQLStore({
-  host: process.env.DB_HOST,
-  user: process.env.DB_USER,
-  password: process.env.DB_PASSWORD,
-  database: process.env.DB_NAME,
-});
+// Default pakai MemoryStore supaya tidak bentrok dengan tabel sessions Laravel
+// yang memiliki kolom payload/last_activity, bukan data/expires.
+let sessionStore;
+if (process.env.USE_MYSQL_SESSION === 'true') {
+  sessionStore = new MySQLStore({
+    host: process.env.DB_HOST,
+    user: process.env.DB_USER,
+    password: process.env.DB_PASSWORD,
+    database: process.env.DB_NAME,
+    createDatabaseTable: false,
+    schema: {
+      tableName: process.env.EXPRESS_SESSION_TABLE || 'express_sessions',
+      columnNames: {
+        session_id: 'session_id',
+        expires: 'expires',
+        data: 'data'
+      }
+    }
+  });
+}
 
 app.use(session({
-  key: 'session_cookie_name',
-  secret: process.env.SESSION_SECRET || 'secret',
+  key: 'facultyware_session',
+  secret: process.env.SESSION_SECRET || 'facultyware-secret',
   store: sessionStore,
   resave: false,
   saveUninitialized: false,
-  cookie: {
-    maxAge: 1000 * 60 * 60 * 24 // 1 day
-  }
+  cookie: { maxAge: 1000 * 60 * 60 * 24 }
 }));
 
-app.use('/', indexRouter);
-app.use('/users', usersRouter);
+app.use((req, res, next) => {
+  res.locals.currentUser = req.session.user || null;
+  res.locals.flash = req.session.flash || null;
+  delete req.session.flash;
+  next();
+});
+
+app.use('/', authRouter);
+app.use('/', pengelolaAsetDashboardRouter);
+app.use('/usulan', usulanRouter);
+app.use('/wakildekan', wakildekanRouter);
+app.use('/procurements', procurementsRouter);
+app.use('/api', apiProcurementsRouter);
 
-// catch 404 and forward to error handler
 app.use(notFoundHandler);
-
-// error handler
 app.use(errorHandler);
 
 module.exports = app;

controllers/auth/authController.js

@@ -0,0 +1,76 @@
+const bcrypt = require('bcryptjs');
+const db = require('../../lib/db');
+
+const index = (req, res) => res.redirect('/home');
+
+const renderLogin = (res, overrides = {}) => {
+  res.render('auth/login', {
+    title: 'Login',
+    error: null,
+    success: null,
+    form: { email: '' },
+    ...overrides
+  });
+};
+
+const loginPage = (req, res) => {
+  if (req.session.userId) return res.redirect('/home');
+  renderLogin(res);
+};
+
+const login = async (req, res, next) => {
+  const email = String(req.body.email || req.body.username || '').trim();
+  const password = String(req.body.password || '');
+
+  try {
+    const [rows] = await db.query('SELECT * FROM users WHERE email = ? OR name = ? LIMIT 1', [email, email]);
+    if (!rows.length) {
+      return renderLogin(res, { error: 'Email atau password tidak valid.', form: { email } });
+    }
+
+    const user = rows[0];
+    const isBcrypt = String(user.password || '').startsWith('$2');
+    const isMatch = isBcrypt ? await bcrypt.compare(password, user.password) : password === user.password;
+    if (!isMatch) {
+      return renderLogin(res, { error: 'Email atau password tidak valid.', form: { email } });
+    }
+
+    const [employeeRows] = await db.query('SELECT id, name FROM employees WHERE id = ? LIMIT 1', [user.id]);
+    const [roleRows] = await db.query(`
+      SELECT r.name
+      FROM roles r
+      JOIN model_has_roles mhr ON mhr.role_id = r.id
+      WHERE mhr.model_id = ?
+    `, [user.id]);
+
+    req.session.userId = user.id;
+    req.session.username = user.name;
+    req.session.email = user.email;
+    req.session.employeeId = employeeRows[0]?.id || user.id;
+    req.session.roles = roleRows.map(row => row.name);
+    req.session.user = {
+      id: user.id,
+      name: user.name,
+      email: user.email,
+      employeeId: req.session.employeeId,
+      roles: req.session.roles
+    };
+
+    if (req.session.roles.includes('Wakil Dekan') || req.session.roles.includes('wakildekan')) {
+      return res.redirect('/wakildekan/permohonan');
+    }
+
+    res.redirect('/home');
+  } catch (err) {
+    next(err);
+  }
+};
+
+const logout = (req, res, next) => {
+  req.session.destroy((err) => {
+    if (err) return next(err);
+    res.redirect('/login');
+  });
+};
+
+module.exports = { index, loginPage, login, logout };