fix: auto-discover MySQL users table column names for login authentication

backend/app/database.py

@@ -308,23 +308,57 @@ def verify_user_mysql(email: str, password_input: str) -> dict:
     """
     Verify user credential using MySQL 'users' table.
     Checks email, bcrypt password hash (Laravel format), and validates super_admin/admin role.
+    Auto-discovers actual column names from INFORMATION_SCHEMA to handle varying schemas.
     Returns user dict on success, raises Exception otherwise.
     """
     with engine.connect() as conn:
-        # Note: Laravel default users table contains id, name, email, password, role, etc.
-        # Let's select id, name, email, password, and role.
-        # Sometimes Laravel uses 'name' instead of 'nama', let's handle both or fallbacks.
-        # Let's inspect the users table columns by running a query or write it robustly.
+        # Step 1: Discover actual column names in the 'users' table
         try:
-            query = text("SELECT id, name, email, password, role FROM users WHERE email = :email LIMIT 1")
-            res = conn.execute(query, {"email": email}).fetchone()
+            col_query = text("""
+                SELECT COLUMN_NAME FROM INFORMATION_SCHEMA.COLUMNS
+                WHERE TABLE_SCHEMA = DATABASE() AND TABLE_NAME = 'users'
+            """)
+            columns = [row[0].lower() for row in conn.execute(col_query).fetchall()]
+        except Exception as e:
+            raise Exception(f"Gagal membaca skema tabel users: {str(e)}")
+
+        if not columns:
+            raise Exception("Tabel 'users' tidak ditemukan di database")
+
+        # Step 2: Map logical fields to actual column names
+        # Name column: could be 'name', 'nama', 'full_name', 'username'
+        name_col = None
+        for candidate in ['name', 'nama', 'full_name', 'username', 'nama_lengkap']:
+            if candidate in columns:
+                name_col = candidate
+                break
+        if not name_col:
+            name_col = 'email'  # fallback to email as display name
+
+        # Password column: could be 'password', 'kata_sandi', 'sandi', 'passwd'
+        password_col = None
+        for candidate in ['password', 'kata_sandi', 'sandi', 'passwd', 'pass']:
+            if candidate in columns:
+                password_col = candidate
+                break
+        if not password_col:
+            raise Exception(f"Kolom password tidak ditemukan di tabel users. Kolom yang ada: {', '.join(columns)}")
+
+        # Role column: could be 'role', 'roles', 'user_role', 'level', 'tipe'
+        role_col = None
+        for candidate in ['role', 'roles', 'user_role', 'level', 'tipe', 'type']:
+            if candidate in columns:
+                role_col = candidate
+                break
+        if not role_col:
+            raise Exception(f"Kolom role tidak ditemukan di tabel users. Kolom yang ada: {', '.join(columns)}")
+
+        # Step 3: Build and execute the query
+        try:
+            sql = f"SELECT id, `{name_col}` as name, email, `{password_col}` as password, `{role_col}` as role FROM users WHERE email = :email LIMIT 1"
+            res = conn.execute(text(sql), {"email": email}).fetchone()
         except Exception as e:
-            # Fallback in case columns are slightly different, e.g., 'nama' instead of 'name'
-            try:
-                query = text("SELECT id, nama as name, email, password, role FROM users WHERE email = :email LIMIT 1")
-                res = conn.execute(query, {"email": email}).fetchone()
-            except Exception as e2:
-                raise Exception(f"Database error querying users table: {str(e2)}")
+            raise Exception(f"Database error querying users table: {str(e)}")
 
         if not res:
             raise Exception("Email tidak terdaftar")
@@ -334,7 +368,7 @@ def verify_user_mysql(email: str, password_input: str) -> dict:
         if not hashed_password:
             raise Exception("Password hash tidak ditemukan di database")
 
-        # Verify password using bcrypt
+        # Step 4: Verify password using bcrypt
         try:
             # Laravel uses $2y$ prefix, python bcrypt expects $2b$ or $2a$
             compat_hash = hashed_password
@@ -351,8 +385,8 @@ def verify_user_mysql(email: str, password_input: str) -> dict:
         if not is_valid:
             raise Exception("Password salah")
 
-        # Check role - must be admin or super_admin
-        role = user_data.get("role", "").lower()
+        # Step 5: Check role - must be admin or super_admin
+        role = str(user_data.get("role", "")).lower().strip()
         if role not in ["admin", "super_admin", "superadmin", "super-admin"]:
             raise Exception(f"Akses ditolak: Role '{role}' tidak memiliki izin administrator")