Firman Aprilian Sugiharto shiinobu

`{ about_me }`

Fullstack Engineer building secure, scalable and maintainable applications. I have spent 3+ years building and maintaining web applications for clients and internal teams, including CRM and POS systems in PHP and MySQL. On my own projects I write backends in Go and frontends in React and Next.js, aiming for the same three things in every one:

Secure: JWT authentication, bcrypt password hashing, role-based access control and validated file uploads.
Scalable: paginated, searchable and filterable list endpoints, and realtime updates pushed over WebSocket rather than page reloads.
Maintainable: a layered code structure, a unit-tested JWT helper, and go test and go vet running in GitHub Actions.

`{ stack }`

Backend
APIs & realtime
Databases
Frontend
Tooling

`{ projects }`

Device Monitoring System

Realtime device availability monitoring with a Go backend and a Next.js dashboard. A device is marked OFFLINE after 30 seconds without a heartbeat.

Disbursement API

REST API for fund disbursement requests, built around business rules rather than plain CRUD. Processed requests are final: a second attempt returns 409 Conflict.

Manufacture System API

REST API for users, customers, suppliers, products and purchase transactions, behind JWT (HS256) authentication middleware.

Tourism Management API

Laravel 8 REST API with a React 17 frontend for managing tourism destinations, with validated image uploads.

Device Monitoring System: details and flow

Devices send a heartbeat every 10 seconds. A background monitor checks every 5 seconds, marks a device OFFLINE after 30 seconds without one, and pushes the change to the dashboard over WebSocket.
JWT admin login, device CRUD, notifications, CSV export, a five-device simulator, and the whole stack in Docker Compose.

Components and step order: 1 the simulator sends a heartbeat every 10 seconds; 2 the heartbeat handler saves last_seen and sets ONLINE; 3 the status monitor checks every 5 seconds; 4 after more than 30 seconds without a heartbeat it sets OFFLINE; 5 the WebSocket hub broadcasts DEVICE_STATUS_CHANGED; 6 the Next.js dashboard updates its list and counters without a page refresh

Disbursement API: details and lifecycle

JWT authentication with bcrypt password hashing and admin / operator roles.
Amount validation, an admin fee by amount tier, pagination, search, status filtering and CSV export.

Request lifecycle: step 1 POST /api/disbursements creates a request, validated with an admin fee by amount tier; step 2 it is PENDING and can also be deleted; step 3 only an admin can set it to APPROVED or REJECTED, both final. Processing a request twice returns 409 Conflict

Status	Set by	Next
`PENDING`	Any signed-in user, on create	Can be approved, rejected or deleted
`APPROVED`	Admin only	Final: processing it again returns `409 Conflict`
`REJECTED`	Admin only	Final: processing it again returns `409 Conflict`

Manufacture System API: details, request path and structure

JWT (HS256) authentication middleware in front of the protected routes, built on Gorilla Mux and MySQL.
The JWT helper is unit tested (valid, expired, wrong secret, wrong signing method), and CI runs go test and go vet through GitHub Actions.

Request path in six numbered layers: the client sends REST and JSON with the JWT in the token header; Gorilla Mux routes it; the middleware checks the JWT (HS256) on every /api route; a controller per domain handles it; models and helpers run the queries; MySQL through go-sql-driver

app/
├── app.go                 server setup and CORS
├── routes/routes.go       Gorilla Mux routes
├── middleware/            JWT auth middleware
├── controllers/           auth, customer, product, purchase, supplier, user
├── models/                one package per domain
├── helpers/               database, jwt (with tests), logging, response
└── config/

Tourism Management API: details, layers and structure

CRUD with image upload and replacement, validated for type and size, with server-generated filenames.
Consistent JSON responses through Laravel API Resources.

Four numbered layers: the React 17 app in resources/js/wisata; the Laravel 8 REST API in routes/api.php with WisataController; Eloquent through WisataModel on the wisata table; MySQL for the records and the public disk for the uploaded photos

app/Http/Controllers/WisataController.php   CRUD, validation, image upload
app/Http/Resources/WisataResource.php       JSON shape
app/Models/WisataModel.php                  Eloquent model (table wisata)
routes/api.php                              /api/wisatas routes
resources/js/wisata/                        React app (pages in frontend/)
database/migrations/                        create_wisata_table

`{ connect }`

_{Firman Aprilian Sugiharto | Fullstack | Backend | Frontend}

Navigation Menu