perf: completely fix N+1 query problem and select * in ListCompanies, ListBranches, and GetCurrentUser middleware

controllers/auth_controller.go

@@ -493,7 +493,7 @@ func ListKasir(c *gin.Context) {
 	owner := userVal.(*models.User)
 
 	var kasir []models.User
-	if err := config.DB.Preload("Branch").Where("company_id = ? AND role = ?", *owner.CompanyID, "kasir").Find(&kasir).Error; err != nil {
+	if err := config.DB.Select("id, name, email, phone, role, company_id, branch_id, is_active, created_at").Preload("Branch").Where("company_id = ? AND role = ?", *owner.CompanyID, "kasir").Find(&kasir).Error; err != nil {
 		c.JSON(http.StatusInternalServerError, gin.H{"detail": "Gagal mengambil data kasir"})
 		return
 	}

controllers/company_controller.go

@@ -76,7 +76,8 @@ func ListCompanies(c *gin.Context) {
 	skipStr := c.Query("skip")
 	searchQuery := c.Query("search")
 
-	query := config.DB.Model(&models.Company{})
+	query := config.DB.Model(&models.Company{}).
+		Select("id, name, bank_account_number, bank_name, address, email, phone, logo_url, is_active, fee_percentage, approved_at, created_at")
 
 	if searchQuery != "" {
 		query = query.Where("name ILIKE ? OR email ILIKE ? OR phone ILIKE ? OR address ILIKE ?", 
@@ -103,23 +104,59 @@ func ListCompanies(c *gin.Context) {
 		return
 	}
 
-	resp := []CompanyResponse{}
+	if len(companies) == 0 {
+		c.JSON(http.StatusOK, []CompanyResponse{})
+		return
+	}
+
+	var companyIDs []uint
 	for _, comp := range companies {
-		var owner models.User
-		err := config.DB.Where("company_id = ? AND role = ?", comp.ID, "owner").First(&owner).Error
+		companyIDs = append(companyIDs, comp.ID)
+	}
+
+	// Ambil semua owner user dalam 1 query (hanya kolom yang diperlukan)
+	var owners []models.User
+	config.DB.Select("id, name, email, phone, company_id").
+		Where("company_id IN ? AND role = ?", companyIDs, "owner").
+		Find(&owners)
+
+	// Map company_id -> owner
+	ownerMap := make(map[uint]models.User)
+	var ownerPhones []string
+	for _, o := range owners {
+		if o.CompanyID != nil {
+			ownerMap[*o.CompanyID] = o
+			if o.Phone != "" {
+				ownerPhones = append(ownerPhones, o.Phone)
+			}
+		}
+	}
+
+	// Ambil status verifikasi OTP semua owner dalam 1 query
+	otpMap := make(map[string]bool)
+	if len(ownerPhones) > 0 {
+		var otps []models.OTP
+		config.DB.Select("phone_number").
+			Where("phone_number IN ? AND is_verified = ?", ownerPhones, true).
+			Find(&otps)
+		for _, otp := range otps {
+			otpMap[otp.PhoneNumber] = true
+		}
+	}
 
+	resp := []CompanyResponse{}
+	for _, comp := range companies {
+		owner, hasOwner := ownerMap[comp.ID]
 		var ownerVerified *bool
 		var ownerName, ownerEmail, ownerPhone string
 
-		if err == nil {
+		if hasOwner {
 			ownerName = owner.Name
 			ownerEmail = owner.Email
 			ownerPhone = owner.Phone
 
 			if owner.Phone != "" {
-				var otp models.OTP
-				otpErr := config.DB.Where("phone_number = ? AND is_verified = ?", owner.Phone, true).First(&otp).Error
-				isVerified := otpErr == nil
+				isVerified := otpMap[owner.Phone]
 				ownerVerified = &isVerified
 			}
 		}
@@ -454,7 +491,7 @@ func ListBranches(c *gin.Context) {
 	owner := userVal.(*models.User)
 
 	var branches []models.Branch
-	if err := config.DB.Where("company_id = ?", *owner.CompanyID).Find(&branches).Error; err != nil {
+	if err := config.DB.Select("id, company_id, name, address, phone, is_active, created_at").Where("company_id = ?", *owner.CompanyID).Find(&branches).Error; err != nil {
 		c.JSON(http.StatusInternalServerError, gin.H{"detail": "Gagal mengambil data cabang"})
 		return
 	}

middleware/auth.go

@@ -98,7 +98,7 @@ func GetCurrentUser() gin.HandlerFunc {
 		}
 
 		var user models.User
-		if err := config.DB.Preload("Company").Preload("Branch").First(&user, claims.Sub).Error; err != nil {
+		if err := config.DB.Select("id, name, email, phone, role, company_id, branch_id, is_active, created_at").First(&user, claims.Sub).Error; err != nil {
 			c.JSON(http.StatusUnauthorized, gin.H{"detail": "User tidak ditemukan"})
 			c.Abort()
 			return