feat: single session enforcement + UI improvements

- Add EnforceSingleSession field to Company model
- Add UserSession model for tracking active kasir sessions
- Add session_token to JWT claims
- Enforce single device login for kasir when feature is enabled
- Add Logout endpoint (POST /api/auth/logout)
- Add enforce_single_session to AdminUpdateCompanySettings
- Fix ListCompanies SELECT: include max_branches, max_cashiers, enforce_single_session
- Fix CompanyResponse: add EnforceSingleSession field + response mapping

controllers/auth_controller.go

@@ -1,6 +1,8 @@
 package controllers
 
 import (
+	crand "crypto/rand"
+	"encoding/hex"
 	"fmt"
 	"log"
 	"math/rand"
@@ -219,7 +221,35 @@ func Login(c *gin.Context) {
 		return
 	}
 
-	token, err := middleware.CreateAccessToken(user.ID, user.Role, user.CompanyID)
+	// --- Single Session Enforcement ---
+	var sessionTokenStr string
+	if user.Role == "kasir" && user.CompanyID != nil {
+		// Ambil company settings (termasuk enforce_single_session)
+		var company models.Company
+		if err := config.DB.Select("id, enforce_single_session").First(&company, *user.CompanyID).Error; err == nil {
+			if company.EnforceSingleSession {
+				// Generate secure session token
+				tokenBytes := make([]byte, 32)
+				crand.Read(tokenBytes)
+				sessionTokenStr = hex.EncodeToString(tokenBytes)
+
+				// Hapus semua session lama milik user ini
+				config.DB.Where("user_id = ?", user.ID).Delete(&models.UserSession{})
+
+				// Buat session baru
+				newSession := models.UserSession{
+					UserID:       user.ID,
+					SessionToken: sessionTokenStr,
+					UserAgent:    c.GetHeader("User-Agent"),
+					IPAddress:    c.ClientIP(),
+					ExpiresAt:    time.Now().Add(24 * time.Hour),
+				}
+				config.DB.Create(&newSession)
+			}
+		}
+	}
+
+	token, err := middleware.CreateAccessToken(user.ID, user.Role, user.CompanyID, sessionTokenStr)
 	if err != nil {
 		c.JSON(http.StatusInternalServerError, gin.H{"detail": "Gagal men-generate token"})
 		return
@@ -232,6 +262,20 @@ func Login(c *gin.Context) {
 	})
 }
 
+func Logout(c *gin.Context) {
+	userVal, exists := c.Get("user")
+	if !exists {
+		c.JSON(http.StatusOK, gin.H{"message": "Logged out"})
+		return
+	}
+	user := userVal.(*models.User)
+
+	// Hapus session dari DB (jika ada)
+	config.DB.Where("user_id = ?", user.ID).Delete(&models.UserSession{})
+
+	c.JSON(http.StatusOK, gin.H{"message": "Berhasil logout"})
+}
+
 func Register(c *gin.Context) {
 	var req RegisterRequest
 	if err := c.ShouldBindJSON(&req); err != nil {

controllers/company_controller.go

@@ -41,6 +41,7 @@ type CompanyResponse struct {
 	MaxBranches        int       `json:"max_branches"`
 	EnableMultiKasir   bool      `json:"enable_multi_kasir"`
 	MaxCashiers        int       `json:"max_cashiers"`
+	EnforceSingleSession bool    `json:"enforce_single_session"`
 	ApprovedAt        *time.Time `json:"approved_at"`
 	OwnerVerified     *bool      `json:"owner_verified,omitempty"`
 	OwnerName         string     `json:"owner_name,omitempty"`
@@ -108,7 +109,7 @@ func ListCompanies(c *gin.Context) {
 	searchQuery := c.Query("search")
 
 	query := config.DB.Model(&models.Company{}).
-		Select("id, name, bank_account_number, bank_name, address, email, phone, logo_url, is_active, fee_percentage, cash_fee_rules, qris_fee_percentage, qris_fee_fixed, qris_fee_min, qris_min_transaction, allow_qris_below_min, charge_fee_before_discount, wallet_balance, wallet_limit, enable_member, enable_voucher, enable_multi_branch, enable_multi_kasir, approved_at, created_at")
+		Select("id, name, bank_account_number, bank_name, address, email, phone, logo_url, is_active, fee_percentage, cash_fee_rules, qris_fee_rules, qris_fee_percentage, qris_fee_fixed, qris_fee_min, qris_min_transaction, allow_qris_below_min, charge_fee_before_discount, wallet_balance, wallet_limit, enable_member, enable_voucher, enable_multi_branch, max_branches, enable_multi_kasir, max_cashiers, enforce_single_session, approved_at, created_at")
 
 	if searchQuery != "" {
 		query = query.Where("name ILIKE ? OR email ILIKE ? OR phone ILIKE ? OR address ILIKE ?", 
@@ -225,6 +226,7 @@ func ListCompanies(c *gin.Context) {
 			MaxBranches:       comp.MaxBranches,
 			EnableMultiKasir:  comp.EnableMultiKasir,
 			MaxCashiers:       comp.MaxCashiers,
+			EnforceSingleSession: comp.EnforceSingleSession,
 			CreatedAt:         comp.CreatedAt,
 		})
 	}
@@ -979,6 +981,7 @@ type UpdateCompanySettingsRequest struct {
 	MaxBranches             *int  `json:"max_branches"`
 	EnableMultiKasir        *bool `json:"enable_multi_kasir"`
 	MaxCashiers             *int  `json:"max_cashiers"`
+	EnforceSingleSession    *bool `json:"enforce_single_session"`
 }
 
 func AdminUpdateCompanySettings(c *gin.Context) {
@@ -1022,6 +1025,17 @@ func AdminUpdateCompanySettings(c *gin.Context) {
 	if req.MaxCashiers != nil {
 		company.MaxCashiers = *req.MaxCashiers
 	}
+	if req.EnforceSingleSession != nil {
+		company.EnforceSingleSession = *req.EnforceSingleSession
+		// Jika fitur dimatikan, hapus semua sesi aktif kasir perusahaan ini
+		if !*req.EnforceSingleSession {
+			var kasirIDs []uint
+			config.DB.Model(&models.User{}).Where("company_id = ? AND role = ?", company.ID, "kasir").Pluck("id", &kasirIDs)
+			if len(kasirIDs) > 0 {
+				config.DB.Where("user_id IN ?", kasirIDs).Delete(&models.UserSession{})
+			}
+		}
+	}
 
 	if err := config.DB.Save(&company).Error; err != nil {
 		c.JSON(http.StatusInternalServerError, gin.H{"detail": "Gagal menyimpan pengaturan"})

main.go

@@ -41,6 +41,7 @@ func main() {
 		&models.TopupRequest{},
 		&models.Voucher{},
 		&models.PointHistory{},
+		&models.UserSession{},
 	)
 	if err != nil {
 		log.Fatalf("Gagal melakukan Auto-Migration: %v", err)
@@ -110,6 +111,7 @@ func main() {
 			auth.Use(middleware.GetCurrentUser())
 			{
 				auth.GET("/me", controllers.GetMe)
+				auth.POST("/logout", controllers.Logout)
 				auth.POST("/register", middleware.RequireSuperAdmin(), controllers.Register)
 				auth.GET("/users", middleware.RequireSuperAdmin(), controllers.ListUsers)
 				auth.PUT("/users/:user_id", middleware.RequireSuperAdmin(), controllers.UpdateUser)

middleware/auth.go

@@ -16,9 +16,10 @@ import (
 )
 
 type JWTClaims struct {
-	Sub       uint   `json:"sub"`
-	Role      string `json:"role"`
-	CompanyID *uint  `json:"company_id"`
+	Sub          uint   `json:"sub"`
+	Role         string `json:"role"`
+	CompanyID    *uint  `json:"company_id"`
+	SessionToken string `json:"session_token,omitempty"`
 	jwt.RegisteredClaims
 }
 
@@ -33,7 +34,7 @@ func VerifyPassword(password, hash string) bool {
 	return err == nil
 }
 
-func CreateAccessToken(userID uint, role string, companyID *uint) (string, error) {
+func CreateAccessToken(userID uint, role string, companyID *uint, sessionToken ...string) (string, error) {
 	expiryHours := config.GlobalConfig.JWTExpiryHours
 	if expiryHours == 0 {
 		expiryHours = 24
@@ -48,6 +49,9 @@ func CreateAccessToken(userID uint, role string, companyID *uint) (string, error
 			IssuedAt:  jwt.NewNumericDate(time.Now()),
 		},
 	}
+	if len(sessionToken) > 0 && sessionToken[0] != "" {
+		claims.SessionToken = sessionToken[0]
+	}
 
 	token := jwt.NewWithClaims(jwt.SigningMethodHS256, claims)
 	return token.SignedString([]byte(config.GlobalConfig.JWTSecretKey))
@@ -110,6 +114,32 @@ func GetCurrentUser() gin.HandlerFunc {
 			return
 		}
 
+		// Cek single session enforcement untuk kasir
+		if user.Role == "kasir" && user.CompanyID != nil {
+			var company models.Company
+			if err := config.DB.Select("enforce_single_session").First(&company, *user.CompanyID).Error; err == nil {
+				if company.EnforceSingleSession {
+					// Harus ada session_token di JWT
+					if claims.SessionToken == "" {
+						c.JSON(http.StatusUnauthorized, gin.H{"detail": "Sesi tidak valid, silakan login ulang.", "code": "SESSION_EXPIRED"})
+						c.Abort()
+						return
+					}
+					// Validasi session_token ke DB
+					var session models.UserSession
+					err := config.DB.Where(
+						"user_id = ? AND session_token = ? AND expires_at > ?",
+						user.ID, claims.SessionToken, time.Now(),
+					).First(&session).Error
+					if err != nil {
+						c.JSON(http.StatusUnauthorized, gin.H{"detail": "Sesi Anda sudah tidak aktif. Perangkat lain telah login dengan akun ini.", "code": "SESSION_EXPIRED"})
+						c.Abort()
+						return
+					}
+				}
+			}
+		}
+
 		// Simpan user ke context Gin
 		c.Set("user", &user)
 		c.Next()

models/models.go

@@ -35,8 +35,9 @@ type Company struct {
 	EnableVoucher      bool           `gorm:"default:true" json:"enable_voucher"`
 	EnableMultiBranch  bool           `gorm:"default:false" json:"enable_multi_branch"`
 	MaxBranches        int            `gorm:"default:0" json:"max_branches"`
-	EnableMultiKasir   bool           `gorm:"default:false" json:"enable_multi_kasir"`
-	MaxCashiers        int            `gorm:"default:0" json:"max_cashiers"`
+	EnableMultiKasir      bool           `gorm:"default:false" json:"enable_multi_kasir"`
+	MaxCashiers           int            `gorm:"default:0" json:"max_cashiers"`
+	EnforceSingleSession  bool           `gorm:"default:false" json:"enforce_single_session"`
 	PointRules         []PointRule    `gorm:"foreignKey:CompanyID;constraint:OnDelete:CASCADE" json:"point_rules"`
 	CreatedAt         time.Time      `gorm:"autoCreateTime" json:"created_at"`
 	Branches          []Branch       `gorm:"foreignKey:CompanyID;constraint:OnDelete:CASCADE" json:"-"`
@@ -237,6 +238,18 @@ type WalletTransaction struct {
 	Company   *Company  `gorm:"foreignKey:CompanyID" json:"company,omitempty"`
 }
 
+// UserSession tracks active login sessions for single-session enforcement
+type UserSession struct {
+	ID           uint      `gorm:"primaryKey" json:"id"`
+	UserID       uint      `gorm:"not null;index" json:"user_id"`
+	SessionToken string    `gorm:"type:varchar(64);not null;uniqueIndex" json:"session_token"`
+	UserAgent    string    `gorm:"type:varchar(255)" json:"user_agent"`
+	IPAddress    string    `gorm:"type:varchar(45)" json:"ip_address"`
+	ExpiresAt    time.Time `gorm:"not null" json:"expires_at"`
+	CreatedAt    time.Time `gorm:"autoCreateTime" json:"created_at"`
+	User         *User     `gorm:"foreignKey:UserID;constraint:OnDelete:CASCADE" json:"-"`
+}
+
 type TopupRequest struct {
 	ID        uint      `gorm:"primaryKey" json:"id"`
 	CompanyID uint      `gorm:"not null;index" json:"company_id"`