feat: migrate warungpos backend to Go with Tripay

.env.example

@@ -0,0 +1,27 @@
+# Database (PostgreSQL)
+# Catatan: Gunakan driver postgres:// untuk Go, bukan postgresql+psycopg://
+DATABASE_URL=postgres://warungpos:warungpos123@127.0.0.1:5432/warungpos_db?sslmode=disable
+
+# Tripay Payment Gateway
+TRIPAY_MERCHANT_CODE=Txxxx
+TRIPAY_API_KEY=your-api-key-here
+TRIPAY_PRIVATE_KEY=your-private-key-here
+TRIPAY_IS_PRODUCTION=false
+
+# App
+PORT=7860
+APP_PORT=8003
+APP_BASE_URL=http://localhost:8003
+STORE_NAME=Warung POS
+
+# JWT
+JWT_SECRET_KEY=change-me-to-a-secure-secret-key-32-chars
+JWT_EXPIRY_HOURS=24
+
+# WhatsApp Notification via Fonnte
+FONNTE_TOKEN=your-fonnte-token-here
+
+# Cloudinary (Media Storage)
+CLOUDINARY_CLOUD_NAME=your-cloud-name
+CLOUDINARY_API_KEY=your-api-key
+CLOUDINARY_API_SECRET=your-api-secret

.gitignore

@@ -0,0 +1,29 @@
+# Binaries
+main_bin
+server_bin
+*.exe
+*.exe~
+*.dll
+*.so
+*.dylib
+bin/
+
+# Environment variables (contains sensitive secrets!)
+.env
+.env.local
+.env.development.local
+.env.test.local
+.env.production.local
+
+# IDEs and editors
+.idea/
+.vscode/
+*.suo
+*.ntvs*
+*.njsproj
+*.sln
+*.sw?
+
+# OS files
+.DS_Store
+Thumbs.db

Dockerfile

@@ -0,0 +1,36 @@
+# Stage 1: Build the Go binary
+FROM golang:1.22-alpine AS builder
+
+# Install build dependencies
+RUN apk add --no-cache git
+
+WORKDIR /app
+
+# Copy module files and download dependencies
+COPY go.mod go.sum ./
+RUN go mod download
+
+# Copy the rest of the application source code
+COPY . .
+
+# Compile a static Go binary optimized for linux
+RUN CGO_ENABLED=0 GOOS=linux go build -ldflags="-w -s" -o main .
+
+# Stage 2: Create a minimal production container
+FROM alpine:3.19
+
+WORKDIR /app
+
+# Install timezone data and CA certificates (essential for Midtrans/Fonnte HTTPS)
+RUN apk --no-cache add ca-certificates tzdata
+ENV TZ=Asia/Jakarta
+
+# Copy the compiled binary from the builder stage
+COPY --from=builder /app/main .
+
+# Expose port 7860 (Hugging Face Spaces requirement)
+ENV PORT=7860
+EXPOSE 7860
+
+# Run the Go binary
+CMD ["./main"]

config/config.go

@@ -0,0 +1,85 @@
+package config
+
+import (
+	"log"
+	"os"
+	"strconv"
+
+	"github.com/joho/godotenv"
+)
+
+type Config struct {
+	DatabaseURL          string
+	TripayMerchantCode   string
+	TripayAPIKey         string
+	TripayPrivateKey     string
+	TripayIsProduction   bool
+	AppPort              int
+	Port                 string // Hugging Face Spaces port (default 7860)
+	AppBaseURL           string
+	JWTSecretKey         string
+	JWTExpiryHours       int
+	FonnteToken          string
+	StoreName            string
+	CloudinaryCloudName  string
+	CloudinaryAPIKey     string
+	CloudinaryAPISecret  string
+}
+
+var GlobalConfig *Config
+
+func LoadConfig() {
+	// Muat file .env jika ada (terutama untuk dev lokal)
+	if err := godotenv.Load(); err != nil {
+		log.Println("Info: File .env tidak ditemukan, menggunakan variable OS")
+	}
+
+	GlobalConfig = &Config{
+		DatabaseURL:          getEnv("DATABASE_URL", "postgresql://warungpos:warungpos123@db:5432/warungpos_db"),
+		TripayMerchantCode:   getEnv("TRIPAY_MERCHANT_CODE", ""),
+		TripayAPIKey:         getEnv("TRIPAY_API_KEY", ""),
+		TripayPrivateKey:     getEnv("TRIPAY_PRIVATE_KEY", ""),
+		TripayIsProduction:   getEnvBool("TRIPAY_IS_PRODUCTION", false),
+		AppPort:              getEnvInt("APP_PORT", 8003),
+		Port:                 getEnv("PORT", "7860"), // Default port Hugging Face Spaces
+		AppBaseURL:           getEnv("APP_BASE_URL", "http://localhost:8003"),
+		JWTSecretKey:         getEnv("JWT_SECRET_KEY", "default-secret-key-change-me"),
+		JWTExpiryHours:       getEnvInt("JWT_EXPIRY_HOURS", 24),
+		FonnteToken:          getEnv("FONNTE_TOKEN", ""),
+		StoreName:            getEnv("STORE_NAME", "WarungPOS"),
+		CloudinaryCloudName:  getEnv("CLOUDINARY_CLOUD_NAME", ""),
+		CloudinaryAPIKey:     getEnv("CLOUDINARY_API_KEY", ""),
+		CloudinaryAPISecret:  getEnv("CLOUDINARY_API_SECRET", ""),
+	}
+}
+
+func getEnv(key, fallback string) string {
+	if value, exists := os.LookupEnv(key); exists {
+		return value
+	}
+	return fallback
+}
+
+func getEnvInt(key string, fallback int) int {
+	str := getEnv(key, "")
+	if str == "" {
+		return fallback
+	}
+	val, err := strconv.Atoi(str)
+	if err != nil {
+		return fallback
+	}
+	return val
+}
+
+func getEnvBool(key string, fallback bool) bool {
+	str := getEnv(key, "")
+	if str == "" {
+		return fallback
+	}
+	val, err := strconv.ParseBool(str)
+	if err != nil {
+		return fallback
+	}
+	return val
+}

config/database.go

@@ -0,0 +1,63 @@
+package config
+
+import (
+	"log"
+	"strings"
+	"time"
+
+	"gorm.io/driver/postgres"
+	"gorm.io/gorm"
+	"gorm.io/gorm/logger"
+)
+
+var DB *gorm.DB
+
+func ConnectDatabase() {
+	dsn := GlobalConfig.DatabaseURL
+
+	// Bersihkan skema psycopg dari Python jika ada
+	if strings.HasPrefix(dsn, "postgresql+psycopg://") {
+		dsn = strings.Replace(dsn, "postgresql+psycopg://", "postgres://", 1)
+	} else if strings.HasPrefix(dsn, "postgresql://") {
+		dsn = strings.Replace(dsn, "postgresql://", "postgres://", 1)
+	}
+
+	log.Printf("Connecting to database: %s", sanitizeDSN(dsn))
+
+	var err error
+	DB, err = gorm.Open(postgres.Open(dsn), &gorm.Config{
+		Logger: logger.Default.LogMode(logger.Info),
+	})
+
+	if err != nil {
+		log.Fatalf("Gagal menghubungkan ke database: %v", err)
+	}
+
+	log.Println("Berhasil terhubung ke database!")
+
+	// Konfigurasi connection pool
+	sqlDB, err := DB.DB()
+	if err != nil {
+		log.Fatalf("Gagal mengambil instance SQL DB: %v", err)
+	}
+
+	// Atur batas pool
+	sqlDB.SetMaxIdleConns(10)
+	sqlDB.SetMaxOpenConns(50)
+	sqlDB.SetConnMaxLifetime(time.Hour)
+}
+
+func sanitizeDSN(dsn string) string {
+	// Sembunyikan password dalam log demi alasan keamanan
+	if strings.Contains(dsn, "@") {
+		parts := strings.Split(dsn, "@")
+		credentials := strings.Split(parts[0], "://")
+		if len(credentials) == 2 {
+			userPass := strings.Split(credentials[1], ":")
+			if len(userPass) == 2 {
+				return credentials[0] + "://" + userPass[0] + ":******@" + parts[1]
+			}
+		}
+	}
+	return dsn
+}

controllers/auth_controller.go

@@ -0,0 +1,576 @@
+package controllers
+
+import (
+	"fmt"
+	"log"
+	"math/rand"
+	"net/http"
+	"strconv"
+	"time"
+
+	"service-warungpos-go/config"
+	"service-warungpos-go/middleware"
+	"service-warungpos-go/models"
+	"service-warungpos-go/services"
+
+	"github.com/gin-gonic/gin"
+)
+
+// SeedDefaultAdmin inisialisasi default super admin jika belum ada
+func SeedDefaultAdmin() {
+	var count int64
+	config.DB.Model(&models.User{}).Where("email = ?", "admin@warungpos.com").Count(&count)
+	if count == 0 {
+		hashedPassword, _ := middleware.HashPassword("admin123")
+		admin := models.User{
+			Name:      "Admin WarungPOS",
+			Email:     "admin@warungpos.com",
+			Password:  hashedPassword,
+			Role:      "super_admin",
+			CompanyID: nil,
+			BranchID:  nil,
+			IsActive:  true,
+		}
+		if err := config.DB.Create(&admin).Error; err != nil {
+			log.Printf("[SEED] Gagal membuat default admin: %v", err)
+		} else {
+			log.Println("[SEED] Sukses membuat default admin!")
+		}
+	} else {
+		log.Println("[SEED] Admin default sudah terbuat.")
+	}
+}
+
+// Request & Response DTOs
+type LoginRequest struct {
+	Email    string `json:"email" binding:"required"`
+	Password string `json:"password" binding:"required"`
+}
+
+type UserResponse struct {
+	ID          uint       `json:"id"`
+	Name        string     `json:"name"`
+	Email       string     `json:"email"`
+	Phone       string     `json:"phone"`
+	Role        string     `json:"role"`
+	CompanyID   *uint      `json:"company_id"`
+	BranchID    *uint      `json:"branch_id"`
+	IsActive    bool       `json:"is_active"`
+	CompanyName string     `json:"company_name,omitempty"`
+	BranchName  string     `json:"branch_name,omitempty"`
+	CreatedAt   time.Time  `json:"created_at"`
+}
+
+type TokenResponse struct {
+	AccessToken string       `json:"access_token"`
+	TokenType   string       `json:"token_type"`
+	User        UserResponse `json:"user"`
+}
+
+type RegisterRequest struct {
+	Name      string `json:"name" binding:"required"`
+	Email     string `json:"email" binding:"required,email"`
+	Password  string `json:"password" binding:"required"`
+	Role      string `json:"role"`
+	CompanyID *uint  `json:"company_id"`
+	BranchID  *uint  `json:"branch_id"`
+}
+
+type TenantRegistrationRequest struct {
+	CompanyName       string `json:"company_name" binding:"required"`
+	OwnerName         string `json:"owner_name" binding:"required"`
+	OwnerEmail        string `json:"owner_email" binding:"required,email"`
+	OwnerPhone        string `json:"owner_phone" binding:"required"`
+	OwnerPassword     string `json:"owner_password" binding:"required"`
+	BankAccountNumber string `json:"bank_account_number"`
+	BankName          string `json:"bank_name"`
+}
+
+type VerifyOTPRequest struct {
+	Phone   string `json:"phone" binding:"required"`
+	OTPCode string `json:"otp_code" binding:"required"`
+}
+
+type ResendOTPRequest struct {
+	Phone string `json:"phone" binding:"required"`
+}
+
+type UpdateUserRequest struct {
+	Name     string `json:"name"`
+	Email    string `json:"email"`
+	Password string `json:"password"`
+	Role     string `json:"role"`
+	IsActive *bool  `json:"is_active"`
+}
+
+type UpdateKasirRequest struct {
+	Name     string `json:"name"`
+	Email    string `json:"email"`
+	Password string `json:"password"`
+	BranchID *uint  `json:"branch_id"`
+	IsActive *bool  `json:"is_active"`
+}
+
+func toUserResponse(user *models.User) UserResponse {
+	resp := UserResponse{
+		ID:        user.ID,
+		Name:      user.Name,
+		Email:     user.Email,
+		Phone:     user.Phone,
+		Role:      user.Role,
+		CompanyID: user.CompanyID,
+		BranchID:  user.BranchID,
+		IsActive:  user.IsActive,
+		CreatedAt: user.CreatedAt,
+	}
+	if user.Company != nil {
+		resp.CompanyName = user.Company.Name
+	}
+	if user.Branch != nil {
+		resp.BranchName = user.Branch.Name
+	}
+	return resp
+}
+
+// Route Handlers
+func Login(c *gin.Context) {
+	var req LoginRequest
+	if err := c.ShouldBindJSON(&req); err != nil {
+		c.JSON(http.StatusBadRequest, gin.H{"detail": "Data tidak valid"})
+		return
+	}
+
+	var user models.User
+	if err := config.DB.Preload("Company").Preload("Branch").Where("email = ?", req.Email).First(&user).Error; err != nil {
+		c.JSON(http.StatusUnauthorized, gin.H{"detail": "Email atau password salah"})
+		return
+	}
+
+	if !middleware.VerifyPassword(req.Password, user.Password) {
+		c.JSON(http.StatusUnauthorized, gin.H{"detail": "Email atau password salah"})
+		return
+	}
+
+	// Cek status keaktifan user
+	if !user.IsActive {
+		if user.Role == "owner" && user.CompanyID != nil {
+			var company models.Company
+			if err := config.DB.First(&company, *user.CompanyID).Error; err == nil {
+				if company.ApprovedAt != nil {
+					// Pernah diapprove tapi sekarang dinonaktifkan
+					c.JSON(http.StatusUnauthorized, gin.H{"detail": "ACCOUNT_DEACTIVATED"})
+					return
+				} else {
+					// Belum diapprove super_admin
+					c.JSON(http.StatusUnauthorized, gin.H{"detail": "PENDING_APPROVAL"})
+					return
+				}
+			}
+		}
+		c.JSON(http.StatusForbidden, gin.H{"detail": "Akun tidak aktif, hubungi admin"})
+		return
+	}
+
+	token, err := middleware.CreateAccessToken(user.ID, user.Role, user.CompanyID)
+	if err != nil {
+		c.JSON(http.StatusInternalServerError, gin.H{"detail": "Gagal men-generate token"})
+		return
+	}
+
+	c.JSON(http.StatusOK, TokenResponse{
+		AccessToken: token,
+		TokenType:   "bearer",
+		User:        toUserResponse(&user),
+	})
+}
+
+func Register(c *gin.Context) {
+	var req RegisterRequest
+	if err := c.ShouldBindJSON(&req); err != nil {
+		c.JSON(http.StatusBadRequest, gin.H{"detail": err.Error()})
+		return
+	}
+
+	var existingCount int64
+	config.DB.Model(&models.User{}).Where("email = ?", req.Email).Count(&existingCount)
+	if existingCount > 0 {
+		c.JSON(http.StatusBadRequest, gin.H{"detail": "Email sudah terdaftar"})
+		return
+	}
+
+	hashedPassword, _ := middleware.HashPassword(req.Password)
+	role := "kasir"
+	if req.Role != "" {
+		role = req.Role
+	}
+
+	newUser := models.User{
+		Name:      req.Name,
+		Email:     req.Email,
+		Password:  hashedPassword,
+		Role:      role,
+		CompanyID: req.CompanyID,
+		BranchID:  req.BranchID,
+		IsActive:  true,
+	}
+
+	if err := config.DB.Create(&newUser).Error; err != nil {
+		c.JSON(http.StatusInternalServerError, gin.H{"detail": "Gagal menyimpan user"})
+		return
+	}
+
+	c.JSON(http.StatusCreated, toUserResponse(&newUser))
+}
+
+func RegisterTenant(c *gin.Context) {
+	var req TenantRegistrationRequest
+	if err := c.ShouldBindJSON(&req); err != nil {
+		c.JSON(http.StatusBadRequest, gin.H{"detail": err.Error()})
+		return
+	}
+
+	var existingCount int64
+	config.DB.Model(&models.User{}).Where("email = ?", req.OwnerEmail).Count(&existingCount)
+	if existingCount > 0 {
+		c.JSON(http.StatusBadRequest, gin.H{"detail": "Email sudah digunakan!"})
+		return
+	}
+
+	tx := config.DB.Begin()
+	defer func() {
+		if r := recover(); r != nil {
+			tx.Rollback()
+		}
+	}()
+
+	// 1. Buat Company
+	comp := models.Company{
+		Name:              req.CompanyName,
+		BankAccountNumber: req.BankAccountNumber,
+		BankName:          req.BankName,
+		Email:             req.OwnerEmail,
+		Phone:             req.OwnerPhone,
+		IsActive:          false,
+	}
+	if err := tx.Create(&comp).Error; err != nil {
+		tx.Rollback()
+		c.JSON(http.StatusInternalServerError, gin.H{"detail": "Gagal membuat perusahaan"})
+		return
+	}
+
+	// 2. Buat Owner User
+	hashedPassword, _ := middleware.HashPassword(req.OwnerPassword)
+	owner := models.User{
+		Name:      req.OwnerName,
+		Email:     req.OwnerEmail,
+		Password:  hashedPassword,
+		Phone:     req.OwnerPhone,
+		Role:      "owner",
+		CompanyID: &comp.ID,
+		IsActive:  false,
+	}
+	if err := tx.Create(&owner).Error; err != nil {
+		tx.Rollback()
+		c.JSON(http.StatusInternalServerError, gin.H{"detail": "Gagal membuat akun owner"})
+		return
+	}
+
+	// 3. Buat OTP Entry
+	code := fmt.Sprintf("%06d", rand.Intn(900000)+100000)
+	otpEntry := models.OTP{
+		PhoneNumber: req.OwnerPhone,
+		OTPCode:     code,
+		IsVerified:  false,
+		ExpiresAt:   time.Now().Add(5 * time.Minute),
+	}
+	if err := tx.Create(&otpEntry).Error; err != nil {
+		tx.Rollback()
+		c.JSON(http.StatusInternalServerError, gin.H{"detail": "Gagal membuat OTP"})
+		return
+	}
+
+	if err := tx.Commit().Error; err != nil {
+		tx.Rollback()
+		c.JSON(http.StatusInternalServerError, gin.H{"detail": "Gagal melakukan registrasi"})
+		return
+	}
+
+	// Kirim Notifikasi OTP via WA secara async agar request HTTP cepat
+	go services.SendOtpWa(req.OwnerPhone, code)
+
+	c.JSON(http.StatusCreated, gin.H{
+		"status":  "success",
+		"message": "OTP sent to phone",
+	})
+}
+
+func VerifyOTP(c *gin.Context) {
+	var req VerifyOTPRequest
+	if err := c.ShouldBindJSON(&req); err != nil {
+		c.JSON(http.StatusBadRequest, gin.H{"detail": err.Error()})
+		return
+	}
+
+	var record models.OTP
+	if err := config.DB.Where("phone_number = ? AND otp_code = ? AND is_verified = ?", req.Phone, req.OTPCode, false).Order("id desc").First(&record).Error; err != nil {
+		c.JSON(http.StatusBadRequest, gin.H{"detail": "Kode OTP salah atau tidak ditemukan"})
+		return
+	}
+
+	if record.ExpiresAt.Before(time.Now()) {
+		c.JSON(http.StatusBadRequest, gin.H{"detail": "Kode OTP sudah kadaluarsa"})
+		return
+	}
+
+	record.IsVerified = true
+	config.DB.Save(&record)
+
+	c.JSON(http.StatusOK, gin.H{
+		"status":  "success",
+		"message": "Nomor Hape diverifikasi! Tunggu Approve Super Admin.",
+	})
+}
+
+func ResendOTP(c *gin.Context) {
+	var req ResendOTPRequest
+	if err := c.ShouldBindJSON(&req); err != nil {
+		c.JSON(http.StatusBadRequest, gin.H{"detail": err.Error()})
+		return
+	}
+
+	var lastOTP models.OTP
+	err := config.DB.Where("phone_number = ? AND is_verified = ?", req.Phone, false).Order("id desc").First(&lastOTP).Error
+	if err == nil {
+		// Cooldown 3 menit (ExpiresAt - 5 menit = CreatedAt)
+		createdAt := lastOTP.ExpiresAt.Add(-5 * time.Minute)
+		timeSince := time.Since(createdAt)
+		if timeSince < 3*time.Minute {
+			remaining := int(180 - timeSince.Seconds())
+			c.JSON(http.StatusTooManyRequests, gin.H{
+				"detail": fmt.Sprintf("Tunggu %d detik lagi sebelum kirim ulang OTP", remaining),
+			})
+			return
+		}
+	}
+
+	code := fmt.Sprintf("%06d", rand.Intn(900000)+100000)
+	otpEntry := models.OTP{
+		PhoneNumber: req.Phone,
+		OTPCode:     code,
+		IsVerified:  false,
+		ExpiresAt:   time.Now().Add(5 * time.Minute),
+	}
+	if err := config.DB.Create(&otpEntry).Error; err != nil {
+		c.JSON(http.StatusInternalServerError, gin.H{"detail": "Gagal mengirim ulang OTP"})
+		return
+	}
+
+	go services.SendOtpWa(req.Phone, code)
+
+	c.JSON(http.StatusOK, gin.H{
+		"status":  "success",
+		"message": "OTP baru telah dikirim ke WhatsApp Anda",
+	})
+}
+
+func GetMe(c *gin.Context) {
+	userVal, _ := c.Get("user")
+	user := userVal.(*models.User)
+
+	resp := toUserResponse(user)
+
+	// Attach Company & Branch name jika ada
+	if user.CompanyID != nil {
+		var company models.Company
+		if err := config.DB.First(&company, *user.CompanyID).Error; err == nil {
+			resp.CompanyName = company.Name
+		}
+	}
+
+	if user.BranchID != nil {
+		var branch models.Branch
+		if err := config.DB.First(&branch, *user.BranchID).Error; err == nil {
+			resp.BranchName = branch.Name
+		}
+	}
+
+	c.JSON(http.StatusOK, resp)
+}
+
+func ListUsers(c *gin.Context) {
+	var users []models.User
+	if err := config.DB.Preload("Company").Preload("Branch").Find(&users).Error; err != nil {
+		c.JSON(http.StatusInternalServerError, gin.H{"detail": "Gagal mengambil data user"})
+		return
+	}
+
+	var resp []UserResponse
+	for _, u := range users {
+		resp = append(resp, toUserResponse(&u))
+	}
+	c.JSON(http.StatusOK, resp)
+}
+
+func UpdateUser(c *gin.Context) {
+	userIDStr := c.Param("user_id")
+	userID, err := strconv.Atoi(userIDStr)
+	if err != nil {
+		c.JSON(http.StatusBadRequest, gin.H{"detail": "ID user tidak valid"})
+		return
+	}
+
+	var req UpdateUserRequest
+	if err := c.ShouldBindJSON(&req); err != nil {
+		c.JSON(http.StatusBadRequest, gin.H{"detail": err.Error()})
+		return
+	}
+
+	var user models.User
+	if err := config.DB.First(&user, userID).Error; err != nil {
+		c.JSON(http.StatusNotFound, gin.H{"detail": "User tidak ditemukan"})
+		return
+	}
+
+	if req.Name != "" {
+		user.Name = req.Name
+	}
+	if req.Email != "" {
+		var count int64
+		config.DB.Model(&models.User{}).Where("email = ? AND id != ?", req.Email, userID).Count(&count)
+		if count > 0 {
+			c.JSON(http.StatusBadRequest, gin.H{"detail": "Email sudah digunakan user lain"})
+			return
+		}
+		user.Email = req.Email
+	}
+	if req.Password != "" {
+		hashed, _ := middleware.HashPassword(req.Password)
+		user.Password = hashed
+	}
+	if req.Role != "" {
+		user.Role = req.Role
+	}
+	if req.IsActive != nil {
+		user.IsActive = *req.IsActive
+	}
+
+	if err := config.DB.Save(&user).Error; err != nil {
+		c.JSON(http.StatusInternalServerError, gin.H{"detail": "Gagal meng-update user"})
+		return
+	}
+
+	c.JSON(http.StatusOK, toUserResponse(&user))
+}
+
+// Owner endpoints for Kasir Management
+func ListKasir(c *gin.Context) {
+	userVal, _ := c.Get("user")
+	owner := userVal.(*models.User)
+
+	var kasir []models.User
+	if err := config.DB.Preload("Branch").Where("company_id = ? AND role = ?", *owner.CompanyID, "kasir").Find(&kasir).Error; err != nil {
+		c.JSON(http.StatusInternalServerError, gin.H{"detail": "Gagal mengambil data kasir"})
+		return
+	}
+
+	var resp []UserResponse
+	for _, k := range kasir {
+		resp = append(resp, toUserResponse(&k))
+	}
+	c.JSON(http.StatusOK, resp)
+}
+
+func CreateKasir(c *gin.Context) {
+	userVal, _ := c.Get("user")
+	owner := userVal.(*models.User)
+
+	var req RegisterRequest
+	if err := c.ShouldBindJSON(&req); err != nil {
+		c.JSON(http.StatusBadRequest, gin.H{"detail": err.Error()})
+		return
+	}
+
+	if req.Role != "" && req.Role != "kasir" {
+		c.JSON(http.StatusBadRequest, gin.H{"detail": "Owner hanya bisa membuat role 'kasir'"})
+		return
+	}
+
+	var existingCount int64
+	config.DB.Model(&models.User{}).Where("email = ?", req.Email).Count(&existingCount)
+	if existingCount > 0 {
+		c.JSON(http.StatusBadRequest, gin.H{"detail": "Email sudah terdaftar"})
+		return
+	}
+
+	hashedPassword, _ := middleware.HashPassword(req.Password)
+	newUser := models.User{
+		Name:      req.Name,
+		Email:     req.Email,
+		Password:  hashedPassword,
+		Role:      "kasir",
+		CompanyID: owner.CompanyID,
+		BranchID:  req.BranchID,
+		IsActive:  true,
+	}
+
+	if err := config.DB.Create(&newUser).Error; err != nil {
+		c.JSON(http.StatusInternalServerError, gin.H{"detail": "Gagal menyimpan kasir"})
+		return
+	}
+
+	c.JSON(http.StatusCreated, toUserResponse(&newUser))
+}
+
+func UpdateKasir(c *gin.Context) {
+	userVal, _ := c.Get("user")
+	owner := userVal.(*models.User)
+
+	kasirIDStr := c.Param("user_id")
+	kasirID, err := strconv.Atoi(kasirIDStr)
+	if err != nil {
+		c.JSON(http.StatusBadRequest, gin.H{"detail": "ID kasir tidak valid"})
+		return
+	}
+
+	var req UpdateKasirRequest
+	if err := c.ShouldBindJSON(&req); err != nil {
+		c.JSON(http.StatusBadRequest, gin.H{"detail": err.Error()})
+		return
+	}
+
+	var kasir models.User
+	if err := config.DB.Where("id = ? AND company_id = ? AND role = ?", kasirID, *owner.CompanyID, "kasir").First(&kasir).Error; err != nil {
+		c.JSON(http.StatusNotFound, gin.H{"detail": "Kasir tidak ditemukan di perusahaan ini"})
+		return
+	}
+
+	if req.Name != "" {
+		kasir.Name = req.Name
+	}
+	if req.Email != "" {
+		var count int64
+		config.DB.Model(&models.User{}).Where("email = ? AND id != ?", req.Email, kasirID).Count(&count)
+		if count > 0 {
+			c.JSON(http.StatusBadRequest, gin.H{"detail": "Email sudah digunakan user lain"})
+			return
+		}
+		kasir.Email = req.Email
+	}
+	if req.Password != "" {
+		hashed, _ := middleware.HashPassword(req.Password)
+		kasir.Password = hashed
+	}
+	if req.BranchID != nil {
+		kasir.BranchID = req.BranchID
+	}
+	if req.IsActive != nil {
+		kasir.IsActive = *req.IsActive
+	}
+
+	if err := config.DB.Save(&kasir).Error; err != nil {
+		c.JSON(http.StatusInternalServerError, gin.H{"detail": "Gagal meng-update kasir"})
+		return
+	}
+
+	c.JSON(http.StatusOK, toUserResponse(&kasir))
+}

controllers/company_controller.go

@@ -0,0 +1,675 @@
+package controllers
+
+import (
+	"fmt"
+	"net/http"
+	"strconv"
+	"time"
+
+	"service-warungpos-go/config"
+	"service-warungpos-go/models"
+	"service-warungpos-go/services"
+
+	"github.com/gin-gonic/gin"
+)
+
+// DTOs & Custom Structs
+type CompanyResponse struct {
+	ID                uint       `json:"id"`
+	Name              string     `json:"name"`
+	BankAccountNumber string     `json:"bank_account_number"`
+	BankName          string     `json:"bank_name"`
+	Address           string     `json:"address"`
+	Email             string     `json:"email"`
+	Phone             string     `json:"phone"`
+	LogoURL           string     `json:"logo_url"`
+	IsActive          bool       `json:"is_active"`
+	FeePercentage     float64    `json:"fee_percentage"`
+	ApprovedAt        *time.Time `json:"approved_at"`
+	OwnerVerified     *bool      `json:"owner_verified,omitempty"`
+	OwnerName         string     `json:"owner_name,omitempty"`
+	OwnerEmail        string     `json:"owner_email,omitempty"`
+	OwnerPhone        string     `json:"owner_phone,omitempty"`
+	CreatedAt         time.Time  `json:"created_at"`
+}
+
+type CompanyCreateRequest struct {
+	Name              string  `json:"name" binding:"required"`
+	BankAccountNumber string  `json:"bank_account_number"`
+	BankName          string  `json:"bank_name"`
+	Address           string  `json:"address"`
+	Email             string  `json:"email"`
+	Phone             string  `json:"phone"`
+	LogoURL           string  `json:"logo_url"`
+	FeePercentage     float64 `json:"fee_percentage"`
+}
+
+type BranchCreateRequest struct {
+	Name    string `json:"name" binding:"required"`
+	Address string `json:"address"`
+	Phone   string `json:"phone"`
+}
+
+type BranchResponse struct {
+	ID        uint      `json:"id"`
+	CompanyID uint      `json:"company_id"`
+	Name      string    `json:"name"`
+	Address   string    `json:"address"`
+	Phone     string    `json:"phone"`
+	IsActive  bool      `json:"is_active"`
+	CreatedAt time.Time `json:"created_at"`
+}
+
+type BranchProductResponse struct {
+	ID          uint   `json:"id"`
+	Name        string `json:"name"`
+	Price       int    `json:"price"`
+	CategoryID  *uint  `json:"category_id"`
+	ImageURL    string `json:"image_url"`
+	IsAvailable bool   `json:"is_available"`
+}
+
+// ==================== COMPANY CONTROLLER ====================
+
+func ListCompanies(c *gin.Context) {
+	var companies []models.Company
+	if err := config.DB.Find(&companies).Error; err != nil {
+		c.JSON(http.StatusInternalServerError, gin.H{"detail": "Gagal mengambil data perusahaan"})
+		return
+	}
+
+	var resp []CompanyResponse
+	for _, comp := range companies {
+		var owner models.User
+		err := config.DB.Where("company_id = ? AND role = ?", comp.ID, "owner").First(&owner).Error
+
+		var ownerVerified *bool
+		var ownerName, ownerEmail, ownerPhone string
+
+		if err == nil {
+			ownerName = owner.Name
+			ownerEmail = owner.Email
+			ownerPhone = owner.Phone
+
+			if owner.Phone != "" {
+				var otp models.OTP
+				otpErr := config.DB.Where("phone_number = ? AND is_verified = ?", owner.Phone, true).First(&otp).Error
+				isVerified := otpErr == nil
+				ownerVerified = &isVerified
+			}
+		}
+
+		resp = append(resp, CompanyResponse{
+			ID:                comp.ID,
+			Name:              comp.Name,
+			BankAccountNumber: comp.BankAccountNumber,
+			BankName:          comp.BankName,
+			Address:           comp.Address,
+			Email:             comp.Email,
+			Phone:             comp.Phone,
+			LogoURL:           comp.LogoURL,
+			IsActive:          comp.IsActive,
+			FeePercentage:     comp.FeePercentage,
+			ApprovedAt:        comp.ApprovedAt,
+			OwnerVerified:     ownerVerified,
+			OwnerName:         ownerName,
+			OwnerEmail:        ownerEmail,
+			OwnerPhone:        ownerPhone,
+			CreatedAt:         comp.CreatedAt,
+		})
+	}
+
+	c.JSON(http.StatusOK, resp)
+}
+
+func GetMyCompany(c *gin.Context) {
+	userVal, _ := c.Get("user")
+	user := userVal.(*models.User)
+
+	if user.CompanyID == nil {
+		c.JSON(http.StatusNotFound, gin.H{"detail": "Tidak terhubung ke perusahaan"})
+		return
+	}
+
+	var company models.Company
+	if err := config.DB.First(&company, *user.CompanyID).Error; err != nil {
+		c.JSON(http.StatusNotFound, gin.H{"detail": "Perusahaan tidak ditemukan"})
+		return
+	}
+
+	c.JSON(http.StatusOK, company)
+}
+
+func GetCompany(c *gin.Context) {
+	companyIDStr := c.Param("company_id")
+	companyID, err := strconv.Atoi(companyIDStr)
+	if err != nil {
+		c.JSON(http.StatusBadRequest, gin.H{"detail": "ID perusahaan tidak valid"})
+		return
+	}
+
+	var company models.Company
+	if err := config.DB.First(&company, companyID).Error; err != nil {
+		c.JSON(http.StatusNotFound, gin.H{"detail": "Company not found"})
+		return
+	}
+
+	c.JSON(http.StatusOK, company)
+}
+
+func CreateCompany(c *gin.Context) {
+	var req CompanyCreateRequest
+	if err := c.ShouldBindJSON(&req); err != nil {
+		c.JSON(http.StatusBadRequest, gin.H{"detail": err.Error()})
+		return
+	}
+
+	var count int64
+	config.DB.Model(&models.Company{}).Where("name = ?", req.Name).Count(&count)
+	if count > 0 {
+		c.JSON(http.StatusBadRequest, gin.H{"detail": "Company name already exists"})
+		return
+	}
+
+	newComp := models.Company{
+		Name:              req.Name,
+		BankAccountNumber: req.BankAccountNumber,
+		BankName:          req.BankName,
+		Address:           req.Address,
+		Email:             req.Email,
+		Phone:             req.Phone,
+		LogoURL:           req.LogoURL,
+		IsActive:          true,
+		FeePercentage:     req.FeePercentage,
+	}
+
+	if err := config.DB.Create(&newComp).Error; err != nil {
+		c.JSON(http.StatusInternalServerError, gin.H{"detail": "Gagal membuat perusahaan baru"})
+		return
+	}
+
+	c.JSON(http.StatusCreated, newComp)
+}
+
+func UpdateCompany(c *gin.Context) {
+	companyIDStr := c.Param("company_id")
+	companyID, err := strconv.Atoi(companyIDStr)
+	if err != nil {
+		c.JSON(http.StatusBadRequest, gin.H{"detail": "ID perusahaan tidak valid"})
+		return
+	}
+
+	var req CompanyCreateRequest
+	if err := c.ShouldBindJSON(&req); err != nil {
+		c.JSON(http.StatusBadRequest, gin.H{"detail": err.Error()})
+		return
+	}
+
+	var company models.Company
+	if err := config.DB.First(&company, companyID).Error; err != nil {
+		c.JSON(http.StatusNotFound, gin.H{"detail": "Company not found"})
+		return
+	}
+
+	if req.Name != "" {
+		var count int64
+		config.DB.Model(&models.Company{}).Where("name = ? AND id != ?", req.Name, companyID).Count(&count)
+		if count > 0 {
+			c.JSON(http.StatusBadRequest, gin.H{"detail": "Company name already exists"})
+			return
+		}
+		company.Name = req.Name
+	}
+
+	company.BankAccountNumber = req.BankAccountNumber
+	company.BankName = req.BankName
+	company.Address = req.Address
+	company.Email = req.Email
+	company.Phone = req.Phone
+	company.LogoURL = req.LogoURL
+	company.FeePercentage = req.FeePercentage
+
+	if err := config.DB.Save(&company).Error; err != nil {
+		c.JSON(http.StatusInternalServerError, gin.H{"detail": "Gagal meng-update perusahaan"})
+		return
+	}
+
+	c.JSON(http.StatusOK, company)
+}
+
+func ToggleActiveCompany(c *gin.Context) {
+	companyIDStr := c.Param("company_id")
+	companyID, err := strconv.Atoi(companyIDStr)
+	if err != nil {
+		c.JSON(http.StatusBadRequest, gin.H{"detail": "ID perusahaan tidak valid"})
+		return
+	}
+
+	var company models.Company
+	if err := config.DB.First(&company, companyID).Error; err != nil {
+		c.JSON(http.StatusNotFound, gin.H{"detail": "Company not found"})
+		return
+	}
+
+	tx := config.DB.Begin()
+	defer func() {
+		if r := recover(); r != nil {
+			tx.Rollback()
+		}
+	}()
+
+	company.IsActive = !company.IsActive
+	tx.Save(&company)
+
+	// Ubah status keaktifan owner juga
+	var owner models.User
+	if err := tx.Where("company_id = ? AND role = ?", companyID, "owner").First(&owner).Error; err == nil {
+		owner.IsActive = company.IsActive
+		tx.Save(&owner)
+	}
+
+	if err := tx.Commit().Error; err != nil {
+		tx.Rollback()
+		c.JSON(http.StatusInternalServerError, gin.H{"detail": "Gagal melakukan toggle status"})
+		return
+	}
+
+	status := "dinonaktifkan"
+	if company.IsActive {
+		status = "diaktifkan"
+	}
+
+	c.JSON(http.StatusOK, gin.H{
+		"message":   fmt.Sprintf("Perusahaan %s berhasil %s", company.Name, status),
+		"is_active": company.IsActive,
+	})
+}
+
+func DeleteCompany(c *gin.Context) {
+	companyIDStr := c.Param("company_id")
+	companyID, err := strconv.Atoi(companyIDStr)
+	if err != nil {
+		c.JSON(http.StatusBadRequest, gin.H{"detail": "ID perusahaan tidak valid"})
+		return
+	}
+
+	var company models.Company
+	if err := config.DB.First(&company, companyID).Error; err != nil {
+		c.JSON(http.StatusNotFound, gin.H{"detail": "Company not found"})
+		return
+	}
+
+	tx := config.DB.Begin()
+	defer func() {
+		if r := recover(); r != nil {
+			tx.Rollback()
+		}
+	}()
+
+	// Ambil semua user terkait company ini, lalu hapus record OTP mereka
+	var users []models.User
+	tx.Where("company_id = ?", companyID).Find(&users)
+	for _, u := range users {
+		if u.Phone != "" {
+			tx.Where("phone_number = ?", u.Phone).Delete(&models.OTP{})
+		}
+	}
+
+	// Cascading deletes Company (users, branches, products, categories, dll)
+	if err := tx.Delete(&company).Error; err != nil {
+		tx.Rollback()
+		c.JSON(http.StatusInternalServerError, gin.H{"detail": "Gagal menghapus data perusahaan"})
+		return
+	}
+
+	tx.Commit()
+
+	c.JSON(http.StatusOK, gin.H{
+		"message": fmt.Sprintf("Perusahaan '%s' dan seluruh data terkait berhasil dihapus", company.Name),
+	})
+}
+
+func RejectCompany(c *gin.Context) {
+	companyIDStr := c.Param("company_id")
+	companyID, err := strconv.Atoi(companyIDStr)
+	if err != nil {
+		c.JSON(http.StatusBadRequest, gin.H{"detail": "ID perusahaan tidak valid"})
+		return
+	}
+
+	var company models.Company
+	if err := config.DB.First(&company, companyID).Error; err != nil {
+		c.JSON(http.StatusNotFound, gin.H{"detail": "Company not found"})
+		return
+	}
+
+	if company.IsActive {
+		c.JSON(http.StatusBadRequest, gin.H{"detail": "Tidak bisa menolak perusahaan yang sudah aktif"})
+		return
+	}
+
+	tx := config.DB.Begin()
+	defer func() {
+		if r := recover(); r != nil {
+			tx.Rollback()
+		}
+	}()
+
+	var users []models.User
+	tx.Where("company_id = ?", companyID).Find(&users)
+	for _, u := range users {
+		if u.Phone != "" {
+			tx.Where("phone_number = ?", u.Phone).Delete(&models.OTP{})
+		}
+	}
+
+	tx.Delete(&company)
+	tx.Commit()
+
+	c.JSON(http.StatusOK, gin.H{
+		"message": fmt.Sprintf("Pendaftaran '%s' ditolak dan dihapus dari sistem", company.Name),
+	})
+}
+
+func ApproveCompany(c *gin.Context) {
+	companyIDStr := c.Param("company_id")
+	companyID, err := strconv.Atoi(companyIDStr)
+	if err != nil {
+		c.JSON(http.StatusBadRequest, gin.H{"detail": "ID perusahaan tidak valid"})
+		return
+	}
+
+	tx := config.DB.Begin()
+	defer func() {
+		if r := recover(); r != nil {
+			tx.Rollback()
+		}
+	}()
+
+	var company models.Company
+	if err := tx.First(&company, companyID).Error; err != nil {
+		tx.Rollback()
+		c.JSON(http.StatusNotFound, gin.H{"detail": "Company not found"})
+		return
+	}
+
+	var owner models.User
+	if err := tx.Where("company_id = ? AND role = ?", companyID, "owner").First(&owner).Error; err != nil {
+		tx.Rollback()
+		c.JSON(http.StatusBadRequest, gin.H{"detail": "Company ini belum memiliki Owner"})
+		return
+	}
+
+	now := time.Now()
+	company.IsActive = true
+	company.ApprovedAt = &now
+	tx.Save(&company)
+
+	owner.IsActive = true
+	tx.Save(&owner)
+
+	if err := tx.Commit().Error; err != nil {
+		tx.Rollback()
+		c.JSON(http.StatusInternalServerError, gin.H{"detail": "Gagal menyetujui perusahaan"})
+		return
+	}
+
+	// Kirim Notifikasi WA (Async)
+	go services.SendApprovalWa(owner.Phone, company.Name, owner.Email)
+
+	c.JSON(http.StatusOK, gin.H{
+		"message": "Perusahaan dan owner berhasil disetujui",
+	})
+}
+
+// ==================== BRANCH CONTROLLER ====================
+
+func ListBranches(c *gin.Context) {
+	userVal, _ := c.Get("user")
+	owner := userVal.(*models.User)
+
+	var branches []models.Branch
+	if err := config.DB.Where("company_id = ?", *owner.CompanyID).Find(&branches).Error; err != nil {
+		c.JSON(http.StatusInternalServerError, gin.H{"detail": "Gagal mengambil data cabang"})
+		return
+	}
+
+	c.JSON(http.StatusOK, branches)
+}
+
+func CreateBranch(c *gin.Context) {
+	userVal, _ := c.Get("user")
+	owner := userVal.(*models.User)
+
+	var req BranchCreateRequest
+	if err := c.ShouldBindJSON(&req); err != nil {
+		c.JSON(http.StatusBadRequest, gin.H{"detail": err.Error()})
+		return
+	}
+
+	var count int64
+	config.DB.Model(&models.Branch{}).Where("company_id = ? AND name = ?", *owner.CompanyID, req.Name).Count(&count)
+	if count > 0 {
+		c.JSON(http.StatusBadRequest, gin.H{"detail": "Nama cabang sudah ada"})
+		return
+	}
+
+	newBranch := models.Branch{
+		CompanyID: *owner.CompanyID,
+		Name:      req.Name,
+		Address:   req.Address,
+		Phone:     req.Phone,
+		IsActive:  true,
+	}
+
+	if err := config.DB.Create(&newBranch).Error; err != nil {
+		c.JSON(http.StatusInternalServerError, gin.H{"detail": "Gagal menyimpan cabang baru"})
+		return
+	}
+
+	c.JSON(http.StatusCreated, newBranch)
+}
+
+func UpdateBranch(c *gin.Context) {
+	userVal, _ := c.Get("user")
+	owner := userVal.(*models.User)
+
+	branchIDStr := c.Param("branch_id")
+	branchID, err := strconv.Atoi(branchIDStr)
+	if err != nil {
+		c.JSON(http.StatusBadRequest, gin.H{"detail": "ID cabang tidak valid"})
+		return
+	}
+
+	var req BranchCreateRequest
+	if err := c.ShouldBindJSON(&req); err != nil {
+		c.JSON(http.StatusBadRequest, gin.H{"detail": err.Error()})
+		return
+	}
+
+	var branch models.Branch
+	if err := config.DB.Where("id = ? AND company_id = ?", branchID, *owner.CompanyID).First(&branch).Error; err != nil {
+		c.JSON(http.StatusNotFound, gin.H{"detail": "Cabang tidak ditemukan"})
+		return
+	}
+
+	if req.Name != "" {
+		var count int64
+		config.DB.Model(&models.Branch{}).Where("company_id = ? AND name = ? AND id != ?", *owner.CompanyID, req.Name, branchID).Count(&count)
+		if count > 0 {
+			c.JSON(http.StatusBadRequest, gin.H{"detail": "Nama cabang sudah ada"})
+			return
+		}
+		branch.Name = req.Name
+	}
+
+	branch.Address = req.Address
+	branch.Phone = req.Phone
+
+	if err := config.DB.Save(&branch).Error; err != nil {
+		c.JSON(http.StatusInternalServerError, gin.H{"detail": "Gagal meng-update cabang"})
+		return
+	}
+
+	c.JSON(http.StatusOK, branch)
+}
+
+func DeleteBranch(c *gin.Context) {
+	userVal, _ := c.Get("user")
+	owner := userVal.(*models.User)
+
+	branchIDStr := c.Param("branch_id")
+	branchID, err := strconv.Atoi(branchIDStr)
+	if err != nil {
+		c.JSON(http.StatusBadRequest, gin.H{"detail": "ID cabang tidak valid"})
+		return
+	}
+
+	var branch models.Branch
+	if err := config.DB.Where("id = ? AND company_id = ?", branchID, *owner.CompanyID).First(&branch).Error; err != nil {
+		c.JSON(http.StatusNotFound, gin.H{"detail": "Cabang tidak ditemukan"})
+		return
+	}
+
+	branch.IsActive = false
+	config.DB.Save(&branch)
+
+	c.JSON(http.StatusOK, gin.H{"message": "Cabang dinonaktifkan"})
+}
+
+func ToggleBranchStatus(c *gin.Context) {
+	userVal, _ := c.Get("user")
+	owner := userVal.(*models.User)
+
+	branchIDStr := c.Param("branch_id")
+	branchID, err := strconv.Atoi(branchIDStr)
+	if err != nil {
+		c.JSON(http.StatusBadRequest, gin.H{"detail": "ID cabang tidak valid"})
+		return
+	}
+
+	var branch models.Branch
+	if err := config.DB.Where("id = ? AND company_id = ?", branchID, *owner.CompanyID).First(&branch).Error; err != nil {
+		c.JSON(http.StatusNotFound, gin.H{"detail": "Cabang tidak ditemukan"})
+		return
+	}
+
+	branch.IsActive = !branch.IsActive
+	config.DB.Save(&branch)
+
+	status := "dinonaktifkan"
+	if branch.IsActive {
+		status = "diaktifkan"
+	}
+
+	c.JSON(http.StatusOK, gin.H{
+		"message":   fmt.Sprintf("Cabang berhasil %s", status),
+		"is_active": branch.IsActive,
+	})
+}
+
+func GetBranchProducts(c *gin.Context) {
+	userVal, _ := c.Get("user")
+	owner := userVal.(*models.User)
+
+	branchIDStr := c.Param("branch_id")
+	branchID, err := strconv.Atoi(branchIDStr)
+	if err != nil {
+		c.JSON(http.StatusBadRequest, gin.H{"detail": "ID cabang tidak valid"})
+		return
+	}
+
+	// Pastikan cabang milik perusahaan owner
+	var branch models.Branch
+	if err := config.DB.Where("id = ? AND company_id = ?", branchID, *owner.CompanyID).First(&branch).Error; err != nil {
+		c.JSON(http.StatusNotFound, gin.H{"detail": "Cabang tidak ditemukan"})
+		return
+	}
+
+	// Ambil semua produk aktif
+	var products []models.Product
+	if err := config.DB.Where("company_id = ? AND is_active = ?", *owner.CompanyID, true).Find(&products).Error; err != nil {
+		c.JSON(http.StatusInternalServerError, gin.H{"detail": "Gagal mengambil data produk"})
+		return
+	}
+
+	// Ambil relasi availability
+	var branchProducts []models.BranchProduct
+	config.DB.Where("branch_id = ?", branchID).Find(&branchProducts)
+
+	bpMap := make(map[uint]bool)
+	for _, bp := range branchProducts {
+		bpMap[bp.ProductID] = bp.IsAvailable
+	}
+
+	var resp []BranchProductResponse
+	for _, p := range products {
+		isAvailable, exists := bpMap[p.ID]
+		if !exists {
+			isAvailable = true // Default tersedia
+		}
+
+		resp = append(resp, BranchProductResponse{
+			ID:          p.ID,
+			Name:        p.Name,
+			Price:       p.Price,
+			CategoryID:  p.CategoryID,
+			ImageURL:    p.ImageURL,
+			IsAvailable: isAvailable,
+		})
+	}
+
+	c.JSON(http.StatusOK, resp)
+}
+
+func ToggleProductAvailability(c *gin.Context) {
+	userVal, _ := c.Get("user")
+	owner := userVal.(*models.User)
+
+	branchIDStr := c.Param("branch_id")
+	branchID, err := strconv.Atoi(branchIDStr)
+	if err != nil {
+		c.JSON(http.StatusBadRequest, gin.H{"detail": "ID cabang tidak valid"})
+		return
+	}
+
+	productIDStr := c.Param("product_id")
+	productID, err := strconv.Atoi(productIDStr)
+	if err != nil {
+		c.JSON(http.StatusBadRequest, gin.H{"detail": "ID produk tidak valid"})
+		return
+	}
+
+	var branch models.Branch
+	if err := config.DB.Where("id = ? AND company_id = ?", branchID, *owner.CompanyID).First(&branch).Error; err != nil {
+		c.JSON(http.StatusNotFound, gin.H{"detail": "Cabang tidak ditemukan"})
+		return
+	}
+
+	var product models.Product
+	if err := config.DB.Where("id = ? AND company_id = ?", productID, *owner.CompanyID).First(&product).Error; err != nil {
+		c.JSON(http.StatusNotFound, gin.H{"detail": "Produk tidak ditemukan"})
+		return
+	}
+
+	var bp models.BranchProduct
+	err = config.DB.Where("branch_id = ? AND product_id = ?", branchID, productID).First(&bp).Error
+
+	if err == nil {
+		bp.IsAvailable = !bp.IsAvailable
+		config.DB.Save(&bp)
+	} else {
+		// Belum pernah diset -> default True, jadi toggle = False
+		bp = models.BranchProduct{
+			BranchID:    uint(branchID),
+			ProductID:   uint(productID),
+			IsAvailable: false,
+		}
+		config.DB.Create(&bp)
+	}
+
+	c.JSON(http.StatusOK, gin.H{
+		"message":      "Status diperbarui",
+		"is_available": bp.IsAvailable,
+	})
+}

controllers/fee_controller.go

@@ -0,0 +1,243 @@
+package controllers
+
+import (
+	"fmt"
+	"net/http"
+	"strconv"
+	"time"
+
+	"service-warungpos-go/config"
+	"service-warungpos-go/models"
+
+	"github.com/gin-gonic/gin"
+)
+
+type FeeSummaryData struct {
+	TotalTransactions int64 `json:"total_transactions"`
+	TotalRevenue      int   `json:"total_revenue"`
+	TotalFee          int   `json:"total_fee"`
+	TotalCash         int   `json:"total_cash"`
+	TotalMidtrans     int   `json:"total_midtrans"`
+	FeeCash           int   `json:"fee_cash"`
+	FeeMidtrans       int   `json:"fee_midtrans"`
+}
+
+type CompanyFeeRow struct {
+	CompanyID         uint    `json:"company_id"`
+	CompanyName       string  `json:"company_name"`
+	FeePercentage     float64 `json:"fee_percentage"`
+	TotalTransactions int64   `json:"total_transactions"`
+	TotalRevenue      int     `json:"total_revenue"`
+	TotalFee          int     `json:"total_fee"`
+	TotalCash         int     `json:"total_cash"`
+	TotalMidtrans     int     `json:"total_midtrans"`
+}
+
+type BranchFeeRow struct {
+	CompanyID         uint    `json:"company_id"`
+	CompanyName       string  `json:"company_name"`
+	BranchID          *uint   `json:"branch_id"`
+	BranchName        string  `json:"branch_name"`
+	TotalTransactions int64   `json:"total_transactions"`
+	TotalRevenue      int     `json:"total_revenue"`
+	TotalFee          int     `json:"total_fee"`
+	TotalCash         int     `json:"total_cash"`
+	TotalMidtrans     int     `json:"total_midtrans"`
+}
+
+type DailyFeeRow struct {
+	Day               time.Time `json:"day"`
+	CompanyID         uint      `json:"company_id"`
+	CompanyName       string    `json:"company_name"`
+	FeePercentage     float64   `json:"fee_percentage"`
+	TotalTransactions int64     `json:"total_transactions"`
+	TotalRevenue      int       `json:"total_revenue"`
+	TotalFee          int       `json:"total_fee"`
+}
+
+func GetFeeReport(c *gin.Context) {
+	dateFrom := c.Query("date_from")
+	dateTo := c.Query("date_to")
+	companyIDStr := c.Query("company_id")
+
+	today := time.Now()
+	var dFrom, dTo time.Time
+	var err error
+
+	if dateFrom != "" {
+		dFrom, err = time.Parse("2006-01-02", dateFrom)
+		if err != nil {
+			c.JSON(http.StatusBadRequest, gin.H{"detail": "Format date_from salah, gunakan YYYY-MM-DD"})
+			return
+		}
+	} else {
+		// Default 30 hari lalu
+		dFrom = today.AddDate(0, 0, -29)
+	}
+
+	if dateTo != "" {
+		dTo, err = time.Parse("2006-01-02", dateTo)
+		if err != nil {
+			c.JSON(http.StatusBadRequest, gin.H{"detail": "Format date_to salah, gunakan YYYY-MM-DD"})
+			return
+		}
+	} else {
+		dTo = today
+	}
+
+	loc, _ := time.LoadLocation("Asia/Jakarta")
+	if loc == nil {
+		loc = time.Local
+	}
+	startDt := time.Date(dFrom.Year(), dFrom.Month(), dFrom.Day(), 0, 0, 0, 0, loc)
+	endDt := time.Date(dTo.Year(), dTo.Month(), dTo.Day(), 23, 59, 59, 0, loc)
+
+	baseQuery := config.DB.Table("orders").
+		Where("orders.payment_status = ? AND orders.created_at >= ? AND orders.created_at <= ?", "paid", startDt, endDt)
+
+	if companyIDStr != "" {
+		if cID, err := strconv.Atoi(companyIDStr); err == nil {
+			baseQuery = baseQuery.Where("orders.company_id = ?", cID)
+		}
+	}
+
+	// 1. Summary keseluruhan
+	var summary FeeSummaryData
+	baseQuery.Select(`
+		count(orders.id) as total_transactions,
+		coalesce(sum(orders.total_amount), 0) as total_revenue,
+		coalesce(sum(orders.platform_fee), 0) as total_fee,
+		coalesce(sum(case when orders.payment_method = 'cash' then orders.total_amount else 0 end), 0) as total_cash,
+		coalesce(sum(case when orders.payment_method = 'midtrans' then orders.total_amount else 0 end), 0) as total_midtrans,
+		coalesce(sum(case when orders.payment_method = 'cash' then orders.platform_fee else 0 end), 0) as fee_cash,
+		coalesce(sum(case when orders.payment_method = 'midtrans' then orders.platform_fee else 0 end), 0) as fee_midtrans
+	`).Scan(&summary)
+
+	// 2. Summary per perusahaan
+	var perCompany []CompanyFeeRow
+	baseQuery.Select(`
+		orders.company_id,
+		companies.name as company_name,
+		companies.fee_percentage,
+		count(orders.id) as total_transactions,
+		coalesce(sum(orders.total_amount), 0) as total_revenue,
+		coalesce(sum(orders.platform_fee), 0) as total_fee,
+		coalesce(sum(case when orders.payment_method = 'cash' then orders.total_amount else 0 end), 0) as total_cash,
+		coalesce(sum(case when orders.payment_method = 'midtrans' then orders.total_amount else 0 end), 0) as total_midtrans
+	`).
+		Joins("join companies on companies.id = orders.company_id").
+		Group("orders.company_id, companies.name, companies.fee_percentage").
+		Order("total_fee desc").
+		Scan(&perCompany)
+
+	// 3. Summary per cabang
+	var perBranch []BranchFeeRow
+	baseQuery.Select(`
+		orders.company_id,
+		companies.name as company_name,
+		orders.branch_id,
+		coalesce(branches.name, 'Tanpa Cabang') as branch_name,
+		count(orders.id) as total_transactions,
+		coalesce(sum(orders.total_amount), 0) as total_revenue,
+		coalesce(sum(orders.platform_fee), 0) as total_fee,
+		coalesce(sum(case when orders.payment_method = 'cash' then orders.total_amount else 0 end), 0) as total_cash,
+		coalesce(sum(case when orders.payment_method = 'midtrans' then orders.total_amount else 0 end), 0) as total_midtrans
+	`).
+		Joins("join companies on companies.id = orders.company_id").
+		Joins("left join branches on branches.id = orders.branch_id").
+		Group("orders.company_id, companies.name, orders.branch_id, branches.name").
+		Order("orders.company_id, total_revenue desc").
+		Scan(&perBranch)
+
+	// 4. Daily breakdown
+	var dailyBreakdown []DailyFeeRow
+	// SQL DATE(created_at) di PostgreSQL
+	baseQuery.Select(`
+		DATE(orders.created_at) as day,
+		orders.company_id,
+		companies.name as company_name,
+		companies.fee_percentage,
+		count(orders.id) as total_transactions,
+		coalesce(sum(orders.total_amount), 0) as total_revenue,
+		coalesce(sum(orders.platform_fee), 0) as total_fee
+	`).
+		Joins("join companies on companies.id = orders.company_id").
+		Group("DATE(orders.created_at), orders.company_id, companies.name, companies.fee_percentage").
+		Order("day desc").
+		Scan(&dailyBreakdown)
+
+	// Buat daily_breakdown response yang clean format tanggalnya
+	type DailyBreakdownResp struct {
+		Date              string  `json:"date"`
+		CompanyID         uint    `json:"company_id"`
+		CompanyName       string  `json:"company_name"`
+		FeePercentage     float64 `json:"fee_percentage"`
+		TotalTransactions int64   `json:"total_transactions"`
+		TotalRevenue      int     `json:"total_revenue"`
+		TotalFee          int     `json:"total_fee"`
+	}
+
+	var dailyResp []DailyBreakdownResp
+	for _, row := range dailyBreakdown {
+		dailyResp = append(dailyResp, DailyBreakdownResp{
+			Date:              row.Day.Format("2006-01-02"),
+			CompanyID:         row.CompanyID,
+			CompanyName:       row.CompanyName,
+			FeePercentage:     row.FeePercentage,
+			TotalTransactions: row.TotalTransactions,
+			TotalRevenue:      row.TotalRevenue,
+			TotalFee:          row.TotalFee,
+		})
+	}
+
+	c.JSON(http.StatusOK, gin.H{
+		"period": gin.H{
+			"date_from": dFrom.Format("2006-01-02"),
+			"date_to":   dTo.Format("2006-01-02"),
+		},
+		"summary":         summary,
+		"per_company":     perCompany,
+		"per_branch":      perBranch,
+		"daily_breakdown": dailyResp,
+	})
+}
+
+func SetCompanyFee(c *gin.Context) {
+	companyIDStr := c.Param("company_id")
+	companyID, err := strconv.Atoi(companyIDStr)
+	if err != nil {
+		c.JSON(http.StatusBadRequest, gin.H{"detail": "ID perusahaan tidak valid"})
+		return
+	}
+
+	feePctStr := c.Query("fee_percentage")
+	if feePctStr == "" {
+		c.JSON(http.StatusBadRequest, gin.H{"detail": "Query parameter fee_percentage wajib diisi"})
+		return
+	}
+
+	feePct, err := strconv.ParseFloat(feePctStr, 64)
+	if err != nil || feePct < 0 || feePct > 100 {
+		c.JSON(http.StatusBadRequest, gin.H{"detail": "Fee percentage harus berupa angka antara 0 dan 100"})
+		return
+	}
+
+	var company models.Company
+	if err := config.DB.First(&company, companyID).Error; err != nil {
+		c.JSON(http.StatusNotFound, gin.H{"detail": "Perusahaan tidak ditemukan"})
+		return
+	}
+
+	company.FeePercentage = feePct
+	if err := config.DB.Save(&company).Error; err != nil {
+		c.JSON(http.StatusInternalServerError, gin.H{"detail": "Gagal menyimpan fee perusahaan"})
+		return
+	}
+
+	c.JSON(http.StatusOK, gin.H{
+		"message":        fmt.Sprintf("Fee perusahaan '%s' berhasil diatur ke %.2f%%", company.Name, company.FeePercentage),
+		"company_id":     company.ID,
+		"company_name":   company.Name,
+		"fee_percentage": company.FeePercentage,
+	})
+}

controllers/order_controller.go

@@ -0,0 +1,759 @@
+package controllers
+
+import (
+	"encoding/json"
+	"fmt"
+	"io"
+	"log"
+	"math/rand"
+	"net/http"
+	"strconv"
+	"time"
+
+	"service-warungpos-go/config"
+	"service-warungpos-go/models"
+	"service-warungpos-go/services"
+
+	"github.com/gin-gonic/gin"
+	"gorm.io/gorm"
+)
+
+// DTOs untuk Order & Payment
+type OrderItemCreate struct {
+	ProductID uint `json:"product_id" binding:"required"`
+	Quantity  int  `json:"quantity" binding:"required,gt=0"`
+}
+
+type OrderCreateRequest struct {
+	BranchID *uint             `json:"branch_id"`
+	Items    []OrderItemCreate `json:"items" binding:"required,dive"`
+}
+
+type OrderItemResponse struct {
+	ID          uint   `json:"id"`
+	ProductID   uint   `json:"product_id"`
+	ProductName string `json:"product_name"`
+	Quantity    int    `json:"quantity"`
+	UnitPrice   int    `json:"unit_price"`
+	Subtotal    int    `json:"subtotal"`
+}
+
+type OrderResponse struct {
+	ID              uint                `json:"id"`
+	OrderNumber     string              `json:"order_number"`
+	BranchID        *uint               `json:"branch_id"`
+	BranchName      string              `json:"branch_name"`
+	TotalAmount     int                 `json:"total_amount"`
+	PaidAmount      int                 `json:"paid_amount"`
+	ChangeAmount    int                 `json:"change_amount"`
+	PaymentMethod   string              `json:"payment_method"`
+	PaymentStatus   string              `json:"payment_status"`
+	MidtransOrderID string              `json:"midtrans_order_id"`
+	MidtransToken   string              `json:"midtrans_token"`
+	Items           []OrderItemResponse `json:"items"`
+	CreatedAt       time.Time           `json:"created_at"`
+}
+
+type CashPaymentRequest struct {
+	OrderID       uint   `json:"order_id" binding:"required"`
+	PaidAmount    int    `json:"paid_amount" binding:"required,gt=0"`
+	CustomerName  string `json:"customer_name"`
+	CustomerPhone string `json:"customer_phone"`
+}
+
+type MidtransPaymentRequest struct {
+	OrderID       uint   `json:"order_id" binding:"required"`
+	CustomerName  string `json:"customer_name"`
+	CustomerEmail string `json:"customer_email"`
+	CustomerPhone string `json:"customer_phone"`
+}
+
+type PaymentStatusResponse struct {
+	OrderID       uint   `json:"order_id"`
+	OrderNumber   string `json:"order_number"`
+	PaymentStatus string `json:"payment_status"`
+	PaymentMethod string `json:"payment_method"`
+	TotalAmount   int    `json:"total_amount"`
+	PaidAmount    int    `json:"paid_amount"`
+	ChangeAmount  int    `json:"change_amount"`
+}
+
+func generateOrderNumber() string {
+	now := time.Now()
+	dateStr := now.Format("20060102")
+	// Hex unik dari random number
+	uniqueVal := rand.Intn(65536)
+	return fmt.Sprintf("WP-%s-%04X", dateStr, uniqueVal)
+}
+
+func toOrderResponse(order *models.Order) OrderResponse {
+	var itemsResp []OrderItemResponse
+	for _, item := range order.Items {
+		pName := "Produk Terhapus"
+		if item.Product != nil {
+			pName = item.Product.Name
+		}
+		itemsResp = append(itemsResp, OrderItemResponse{
+			ID:          item.ID,
+			ProductID:   item.ProductID,
+			ProductName: pName,
+			Quantity:    item.Quantity,
+			UnitPrice:   item.UnitPrice,
+			Subtotal:    item.Subtotal,
+		})
+	}
+
+	bName := ""
+	if order.Branch != nil {
+		bName = order.Branch.Name
+	}
+
+	return OrderResponse{
+		ID:              order.ID,
+		OrderNumber:     order.OrderNumber,
+		BranchID:        order.BranchID,
+		BranchName:      bName,
+		TotalAmount:     order.TotalAmount,
+		PaidAmount:      order.PaidAmount,
+		ChangeAmount:    order.ChangeAmount,
+		PaymentMethod:   order.PaymentMethod,
+		PaymentStatus:   order.PaymentStatus,
+		MidtransOrderID: order.MidtransOrderID,
+		MidtransToken:   order.MidtransToken,
+		Items:           itemsResp,
+		CreatedAt:       order.CreatedAt,
+	}
+}
+
+// ==================== ORDER CONTROLLER ====================
+
+func CreateOrder(c *gin.Context) {
+	userVal, _ := c.Get("user")
+	user := userVal.(*models.User)
+
+	var req OrderCreateRequest
+	if err := c.ShouldBindJSON(&req); err != nil {
+		c.JSON(http.StatusBadRequest, gin.H{"detail": err.Error()})
+		return
+	}
+
+	// Tentukan branch_id yang berlaku
+	var effectiveBranchID *uint
+	if user.Role == "owner" {
+		effectiveBranchID = req.BranchID
+	} else {
+		effectiveBranchID = user.BranchID
+	}
+
+	orderNumber := generateOrderNumber()
+
+	tx := config.DB.Begin()
+	defer func() {
+		if r := recover(); r != nil {
+			tx.Rollback()
+		}
+	}()
+
+	order := models.Order{
+		CompanyID:     *user.CompanyID,
+		BranchID:      effectiveBranchID,
+		OrderNumber:   orderNumber,
+		TotalAmount:   0,
+		PaymentStatus: "pending",
+	}
+
+	if err := tx.Create(&order).Error; err != nil {
+		tx.Rollback()
+		c.JSON(http.StatusInternalServerError, gin.H{"detail": "Gagal menyimpan order"})
+		return
+	}
+
+	total := 0
+	for _, item := range req.Items {
+		var product models.Product
+		if err := tx.Where("id = ? AND company_id = ?", item.ProductID, *user.CompanyID).First(&product).Error; err != nil {
+			tx.Rollback()
+			c.JSON(http.StatusBadRequest, gin.H{"detail": fmt.Sprintf("Produk dengan ID %d tidak ditemukan", item.ProductID)})
+			return
+		}
+
+		if !product.IsActive {
+			tx.Rollback()
+			c.JSON(http.StatusBadRequest, gin.H{"detail": fmt.Sprintf("Produk '%s' sudah tidak aktif", product.Name)})
+			return
+		}
+
+		// Periksa dan kurangi stok jika stok terbatas (bukan unlimited)
+		if !product.IsUnlimitedStock {
+			if product.Stock < item.Quantity {
+				tx.Rollback()
+				c.JSON(http.StatusBadRequest, gin.H{"detail": fmt.Sprintf("Stok '%s' tidak cukup (sisa: %d)", product.Name, product.Stock)})
+				return
+			}
+			product.Stock -= item.Quantity
+			if err := tx.Save(&product).Error; err != nil {
+				tx.Rollback()
+				c.JSON(http.StatusInternalServerError, gin.H{"detail": "Gagal memperbarui stok produk"})
+				return
+			}
+		}
+
+		subtotal := product.Price * item.Quantity
+		orderItem := models.OrderItem{
+			OrderID:   order.ID,
+			ProductID: product.ID,
+			Quantity:  item.Quantity,
+			UnitPrice: product.Price,
+			Subtotal:  subtotal,
+		}
+		if err := tx.Create(&orderItem).Error; err != nil {
+			tx.Rollback()
+			c.JSON(http.StatusInternalServerError, gin.H{"detail": "Gagal menyimpan item order"})
+			return
+		}
+
+		total += subtotal
+	}
+
+	// Update total amount order
+	order.TotalAmount = total
+	if err := tx.Save(&order).Error; err != nil {
+		tx.Rollback()
+		c.JSON(http.StatusInternalServerError, gin.H{"detail": "Gagal meng-update total transaksi"})
+		return
+	}
+
+	if err := tx.Commit().Error; err != nil {
+		tx.Rollback()
+		c.JSON(http.StatusInternalServerError, gin.H{"detail": "Gagal memproses transaksi"})
+		return
+	}
+
+	// Load relationships untuk response
+	config.DB.Preload("Branch").Preload("Items.Product").First(&order, order.ID)
+
+	c.JSON(http.StatusCreated, toOrderResponse(&order))
+}
+
+func ListOrders(c *gin.Context) {
+	userVal, _ := c.Get("user")
+	user := userVal.(*models.User)
+
+	skipStr := c.DefaultQuery("skip", "0")
+	limitStr := c.DefaultQuery("limit", "50")
+	dateFrom := c.Query("date_from") // YYYY-MM-DD
+	dateTo := c.Query("date_to")     // YYYY-MM-DD
+	branchFilter := c.Query("branch_id")
+
+	skip, _ := strconv.Atoi(skipStr)
+	limit, _ := strconv.Atoi(limitStr)
+
+	query := config.DB.Preload("Branch").Preload("Items.Product").
+		Where("company_id = ?", *user.CompanyID).
+		Order("created_at desc")
+
+	if dateFrom != "" {
+		dtFrom, err := time.Parse("2006-01-02", dateFrom)
+		if err == nil {
+			// Awal hari (00:00:00)
+			query = query.Where("created_at >= ?", dtFrom)
+		}
+	}
+
+	if dateTo != "" {
+		dtTo, err := time.Parse("2006-01-02", dateTo)
+		if err == nil {
+			// Akhir hari (23:59:59)
+			dtToEnd := dtTo.Add(23*time.Hour + 59*time.Minute + 59*time.Second)
+			query = query.Where("created_at <= ?", dtToEnd)
+		}
+	}
+
+	if branchFilter != "" {
+		if bID, err := strconv.Atoi(branchFilter); err == nil {
+			query = query.Where("branch_id = ?", bID)
+		}
+	}
+
+	var orders []models.Order
+	if err := query.Offset(skip).Limit(limit).Find(&orders).Error; err != nil {
+		c.JSON(http.StatusInternalServerError, gin.H{"detail": "Gagal mengambil histori order"})
+		return
+	}
+
+	var resp []OrderResponse
+	for _, o := range orders {
+		resp = append(resp, toOrderResponse(&o))
+	}
+
+	c.JSON(http.StatusOK, resp)
+}
+
+func GetOrder(c *gin.Context) {
+	userVal, _ := c.Get("user")
+	user := userVal.(*models.User)
+
+	orderIDStr := c.Param("order_id")
+	orderID, err := strconv.Atoi(orderIDStr)
+	if err != nil {
+		c.JSON(http.StatusBadRequest, gin.H{"detail": "ID order tidak valid"})
+		return
+	}
+
+	var order models.Order
+	if err := config.DB.Preload("Branch").Preload("Items.Product").Where("id = ? AND company_id = ?", orderID, *user.CompanyID).First(&order).Error; err != nil {
+		c.JSON(http.StatusNotFound, gin.H{"detail": "Order tidak ditemukan"})
+		return
+	}
+
+	c.JSON(http.StatusOK, toOrderResponse(&order))
+}
+
+// ==================== PAYMENT CONTROLLER ====================
+
+func PayCash(c *gin.Context) {
+	userVal, _ := c.Get("user")
+	user := userVal.(*models.User)
+
+	var req CashPaymentRequest
+	if err := c.ShouldBindJSON(&req); err != nil {
+		c.JSON(http.StatusBadRequest, gin.H{"detail": err.Error()})
+		return
+	}
+
+	tx := config.DB.Begin()
+	defer func() {
+		if r := recover(); r != nil {
+			tx.Rollback()
+		}
+	}()
+
+	var order models.Order
+	if err := tx.Preload("Items.Product").Where("id = ? AND company_id = ?", req.OrderID, *user.CompanyID).First(&order).Error; err != nil {
+		tx.Rollback()
+		c.JSON(http.StatusNotFound, gin.H{"detail": "Order tidak ditemukan"})
+		return
+	}
+
+	if order.PaymentStatus == "paid" {
+		tx.Rollback()
+		c.JSON(http.StatusBadRequest, gin.H{"detail": "Order sudah dibayar"})
+		return
+	}
+
+	if req.PaidAmount < order.TotalAmount {
+		tx.Rollback()
+		c.JSON(http.StatusBadRequest, gin.H{
+			"detail": fmt.Sprintf("Uang kurang! Total: %s, Dibayar: %s, Kurang: %s",
+				fmtRupiah(order.TotalAmount),
+				fmtRupiah(req.PaidAmount),
+				fmtRupiah(order.TotalAmount-req.PaidAmount),
+			),
+		})
+		return
+	}
+
+	// Update order data
+	order.PaymentMethod = "cash"
+	order.PaymentStatus = "paid"
+	order.PaidAmount = req.PaidAmount
+	order.ChangeAmount = req.PaidAmount - order.TotalAmount
+
+	// Hitung fee platform berdasarkan Company
+	var company models.Company
+	if err := tx.First(&company, *user.CompanyID).Error; err == nil {
+		order.PlatformFee = int(float64(order.TotalAmount) * company.FeePercentage / 100)
+	}
+
+	if err := tx.Save(&order).Error; err != nil {
+		tx.Rollback()
+		c.JSON(http.StatusInternalServerError, gin.H{"detail": "Gagal menyelesaikan pembayaran"})
+		return
+	}
+
+	if err := tx.Commit().Error; err != nil {
+		tx.Rollback()
+		c.JSON(http.StatusInternalServerError, gin.H{"detail": "Gagal memproses pembayaran"})
+		return
+	}
+
+	// Kirim Notifikasi WA (Async)
+	if req.CustomerPhone != "" {
+		go func() {
+			var waItems []services.WAItem
+			for _, item := range order.Items {
+				pName := "Item"
+				if item.Product != nil {
+					pName = item.Product.Name
+				}
+				waItems = append(waItems, services.WAItem{
+					Name:     pName,
+					Quantity: item.Quantity,
+					Price:    item.UnitPrice,
+				})
+			}
+
+			var branchName string
+			if order.BranchID != nil {
+				var branch models.Branch
+				if err := config.DB.First(&branch, *order.BranchID).Error; err == nil {
+					branchName = branch.Name
+				}
+			}
+
+			services.SendPaymentNotification(
+				req.CustomerPhone,
+				order.OrderNumber,
+				order.TotalAmount,
+				"cash",
+				req.CustomerName,
+				waItems,
+				order.ChangeAmount,
+				company.Name,
+				branchName,
+			)
+		}()
+	}
+
+	c.JSON(http.StatusOK, PaymentStatusResponse{
+		OrderID:       order.ID,
+		OrderNumber:   order.OrderNumber,
+		PaymentStatus: order.PaymentStatus,
+		PaymentMethod: order.PaymentMethod,
+		TotalAmount:   order.TotalAmount,
+		PaidAmount:    order.PaidAmount,
+		ChangeAmount:  order.ChangeAmount,
+	})
+}
+
+func PayTripay(c *gin.Context) {
+	userVal, _ := c.Get("user")
+	user := userVal.(*models.User)
+
+	var req MidtransPaymentRequest // Gunakan request DTO yang sama karena field input sama
+	if err := c.ShouldBindJSON(&req); err != nil {
+		c.JSON(http.StatusBadRequest, gin.H{"detail": err.Error()})
+		return
+	}
+
+	var order models.Order
+	if err := config.DB.Where("id = ? AND company_id = ?", req.OrderID, *user.CompanyID).First(&order).Error; err != nil {
+		c.JSON(http.StatusNotFound, gin.H{"detail": "Order tidak ditemukan"})
+		return
+	}
+
+	if order.PaymentStatus == "paid" {
+		c.JSON(http.StatusBadRequest, gin.H{"detail": "Order sudah dibayar"})
+		return
+	}
+
+	// Load order items untuk dikirim ke Tripay
+	var orderItems []models.OrderItem
+	config.DB.Preload("Product").Where("order_id = ?", order.ID).Find(&orderItems)
+
+	var tripayItems []services.TripayItem
+	for _, item := range orderItems {
+		skuStr := ""
+		if item.Product != nil && item.Product.SKU != nil {
+			skuStr = *item.Product.SKU
+		}
+		pName := "Product"
+		if item.Product != nil {
+			pName = item.Product.Name
+		}
+		tripayItems = append(tripayItems, services.TripayItem{
+			SKU:      skuStr,
+			Name:     pName,
+			Price:    item.UnitPrice,
+			Quantity: item.Quantity,
+		})
+	}
+
+	// Request Tripay Transaction (Default ke QRIS yang paling populer)
+	tripayRes, err := services.CreateTripayTransaction(
+		order.OrderNumber,
+		order.TotalAmount,
+		"QRIS",
+		req.CustomerName,
+		req.CustomerEmail,
+		req.CustomerPhone,
+		tripayItems,
+	)
+	if err != nil {
+		c.JSON(http.StatusBadRequest, gin.H{"detail": fmt.Sprintf("Gagal membuat transaksi Tripay: %v", err)})
+		return
+	}
+
+	// Simpan Tripay details ke DB
+	order.MidtransOrderID = tripayRes.Data.Reference // Simpan nomor referensi Tripay di midtrans_order_id demi kecocokan DB
+	order.MidtransToken = tripayRes.Data.CheckoutURL // Simpan checkout_url di midtrans_token demi kecocokan DB
+	order.PaymentMethod = "tripay"
+	config.DB.Save(&order)
+
+	// Kembalikan JSON yang kompatibel dengan format respons frontend agar tidak merusak UI kasir
+	c.JSON(http.StatusOK, gin.H{
+		"order_id":     order.ID,
+		"order_number": order.OrderNumber,
+		"snap_token":   tripayRes.Data.Reference,
+		"redirect_url": tripayRes.Data.CheckoutURL,
+		"total_amount": order.TotalAmount,
+	})
+}
+
+func TripayWebhook(c *gin.Context) {
+	// Baca raw body untuk verifikasi signature
+	rawBody, err := io.ReadAll(c.Request.Body)
+	if err != nil {
+		c.JSON(http.StatusBadRequest, gin.H{"detail": "Gagal membaca request body"})
+		return
+	}
+
+	// Parse JSON manual
+	var notification map[string]interface{}
+	if err := json.Unmarshal(rawBody, &notification); err != nil {
+		c.JSON(http.StatusBadRequest, gin.H{"detail": "Request body harus berupa JSON yang valid"})
+		return
+	}
+
+	// Validasi header signature
+	signature := c.GetHeader("X-Callback-Signature")
+	if signature == "" {
+		c.JSON(http.StatusBadRequest, gin.H{"detail": "Header X-Callback-Signature tidak ditemukan"})
+		return
+	}
+
+	log.Printf("[WEBHOOK] Tripay payload: %s", string(rawBody))
+
+	// Verifikasi Signature keaslian Tripay
+	if !services.VerifyTripaySignature(rawBody, signature) {
+		c.JSON(http.StatusUnauthorized, gin.H{"detail": "Signature verifikasi gagal/tidak valid"})
+		return
+	}
+
+	merchantRefVal, ok := notification["merchant_ref"]
+	if !ok || merchantRefVal == nil {
+		c.JSON(http.StatusBadRequest, gin.H{"detail": "Payload webhook tidak valid: merchant_ref wajib ada"})
+		return
+	}
+
+	merchantRefStr := merchantRefVal.(string)
+	tripayStatus, _ := notification["status"].(string)
+
+	log.Printf("[WEBHOOK] Tripay: merchant_ref=%s, status=%s", merchantRefStr, tripayStatus)
+
+	tx := config.DB.Begin()
+	defer func() {
+		if r := recover(); r != nil {
+			tx.Rollback()
+		}
+	}()
+
+	var order models.Order
+	if err := tx.Preload("Items.Product").Where("order_number = ?", merchantRefStr).First(&order).Error; err != nil {
+		tx.Rollback()
+		c.JSON(http.StatusNotFound, gin.H{"detail": "Order tidak ditemukan"})
+		return
+	}
+
+	oldStatus := order.PaymentStatus
+
+	// Map status Tripay: PAID, EXPIRED, FAILED
+	switch tripayStatus {
+	case "PAID":
+		order.PaymentStatus = "paid"
+		order.PaidAmount = order.TotalAmount
+	case "EXPIRED", "FAILED":
+		order.PaymentStatus = "failed"
+		if oldStatus != "failed" {
+			restoreStock(tx, &order)
+		}
+	}
+
+	// Jika sukses terbayar, hitung platform fee
+	if order.PaymentStatus == "paid" && oldStatus != "paid" {
+		var company models.Company
+		if err := tx.First(&company, order.CompanyID).Error; err == nil {
+			order.PlatformFee = int(float64(order.TotalAmount) * company.FeePercentage / 100)
+		}
+	}
+
+	if err := tx.Save(&order).Error; err != nil {
+		tx.Rollback()
+		c.JSON(http.StatusInternalServerError, gin.H{"detail": "Gagal memproses status webhook"})
+		return
+	}
+
+	if err := tx.Commit().Error; err != nil {
+		tx.Rollback()
+		c.JSON(http.StatusInternalServerError, gin.H{"detail": "Gagal menyelesaikan commit webhook"})
+		return
+	}
+
+	log.Printf("[WEBHOOK] Order %s di-update via Tripay: %s -> %s", order.OrderNumber, oldStatus, order.PaymentStatus)
+
+	// Kirim Notifikasi WA struk belanja jika pembayaran berhasil
+	if order.PaymentStatus == "paid" && oldStatus != "paid" {
+		go func() {
+			custPhone, _ := notification["customer_phone"].(string)
+			custName, _ := notification["customer_name"].(string)
+			if custName == "" {
+				custName = "Customer"
+			}
+
+			var waItems []services.WAItem
+			for _, item := range order.Items {
+				pName := "Item"
+				if item.Product != nil {
+					pName = item.Product.Name
+				}
+				waItems = append(waItems, services.WAItem{
+					Name:     pName,
+					Quantity: item.Quantity,
+					Price:    item.UnitPrice,
+				})
+			}
+
+			var company models.Company
+			config.DB.First(&company, order.CompanyID)
+
+			var branchName string
+			if order.BranchID != nil {
+				var branch models.Branch
+				if err := config.DB.First(&branch, *order.BranchID).Error; err == nil {
+					branchName = branch.Name
+				}
+			}
+
+			if custPhone != "" {
+				services.SendPaymentNotification(
+					custPhone,
+					order.OrderNumber,
+					order.TotalAmount,
+					"tripay",
+					custName,
+					waItems,
+					0,
+					company.Name,
+					branchName,
+				)
+			}
+		}()
+	}
+
+	c.JSON(http.StatusOK, gin.H{
+		"success":      true,
+		"order_number": order.OrderNumber,
+	})
+}
+
+func GetPaymentStatus(c *gin.Context) {
+	userVal, _ := c.Get("user")
+	user := userVal.(*models.User)
+
+	orderIDStr := c.Param("order_id")
+	orderID, err := strconv.Atoi(orderIDStr)
+	if err != nil {
+		c.JSON(http.StatusBadRequest, gin.H{"detail": "ID order tidak valid"})
+		return
+	}
+
+	var order models.Order
+	if err := config.DB.Where("id = ? AND company_id = ?", orderID, *user.CompanyID).First(&order).Error; err != nil {
+		c.JSON(http.StatusNotFound, gin.H{"detail": "Order tidak ditemukan"})
+		return
+	}
+
+	c.JSON(http.StatusOK, PaymentStatusResponse{
+		OrderID:       order.ID,
+		OrderNumber:   order.OrderNumber,
+		PaymentStatus: order.PaymentStatus,
+		PaymentMethod: order.PaymentMethod,
+		TotalAmount:   order.TotalAmount,
+		PaidAmount:    order.PaidAmount,
+		ChangeAmount:  order.ChangeAmount,
+	})
+}
+
+func CancelMidtransOrder(c *gin.Context) {
+	userVal, _ := c.Get("user")
+	user := userVal.(*models.User)
+
+	orderIDStr := c.Param("order_id")
+	orderID, err := strconv.Atoi(orderIDStr)
+	if err != nil {
+		c.JSON(http.StatusBadRequest, gin.H{"detail": "ID order tidak valid"})
+		return
+	}
+
+	tx := config.DB.Begin()
+	defer func() {
+		if r := recover(); r != nil {
+			tx.Rollback()
+		}
+	}()
+
+	var order models.Order
+	if err := tx.Preload("Items.Product").Where("id = ? AND company_id = ?", orderID, *user.CompanyID).First(&order).Error; err != nil {
+		tx.Rollback()
+		c.JSON(http.StatusNotFound, gin.H{"detail": "Order tidak ditemukan"})
+		return
+	}
+
+	if order.PaymentStatus == "paid" {
+		tx.Rollback()
+		c.JSON(http.StatusBadRequest, gin.H{"detail": "Order sudah dibayar"})
+		return
+	}
+
+	if order.PaymentStatus == "cancelled" {
+		tx.Rollback()
+		c.JSON(http.StatusOK, gin.H{
+			"status":         "cancelled",
+			"order_id":       order.ID,
+			"order_number":   order.OrderNumber,
+			"payment_status": order.PaymentStatus,
+		})
+		return
+	}
+
+	oldStatus := order.PaymentStatus
+	order.PaymentStatus = "cancelled"
+
+	if oldStatus != "cancelled" {
+		restoreStock(tx, &order)
+	}
+
+	if err := tx.Save(&order).Error; err != nil {
+		tx.Rollback()
+		c.JSON(http.StatusInternalServerError, gin.H{"detail": "Gagal membatalkan order"})
+		return
+	}
+
+	if err := tx.Commit().Error; err != nil {
+		tx.Rollback()
+		c.JSON(http.StatusInternalServerError, gin.H{"detail": "Gagal menyelesaikan proses pembatalan"})
+		return
+	}
+
+	c.JSON(http.StatusOK, gin.H{
+		"status":         "cancelled",
+		"order_id":       order.ID,
+		"order_number":   order.OrderNumber,
+		"payment_status": order.PaymentStatus,
+	})
+}
+
+// Helpers
+func restoreStock(tx *gorm.DB, order *models.Order) {
+	// GORM raw query atau update
+	for _, item := range order.Items {
+		var product models.Product
+		if err := tx.First(&product, item.ProductID).Error; err == nil {
+			if !product.IsUnlimitedStock {
+				product.Stock += item.Quantity
+				tx.Save(&product)
+				log.Printf("[RESTORE] Stok '%s' dikembalikan +%d (sekarang: %d)", product.Name, item.Quantity, product.Stock)
+			}
+		}
+	}
+}

controllers/product_controller.go

@@ -0,0 +1,483 @@
+package controllers
+
+import (
+	"fmt"
+	"net/http"
+	"strconv"
+
+	"service-warungpos-go/config"
+	"service-warungpos-go/models"
+	"service-warungpos-go/services"
+
+	"github.com/gin-gonic/gin"
+)
+
+// DTOs untuk Kategori & Produk
+type CategoryCreateRequest struct {
+	Name        string `json:"name" binding:"required"`
+	Description string `json:"description"`
+}
+
+type CategoryResponse struct {
+	ID          uint      `json:"id"`
+	CompanyID   uint      `json:"company_id"`
+	Name        string    `json:"name"`
+	Description string    `json:"description"`
+	CreatedAt   string    `json:"created_at"`
+}
+
+type ProductCreateRequest struct {
+	Name             string  `json:"name" binding:"required"`
+	SKU              *string `json:"sku"`
+	Price            int     `json:"price" binding:"required"`
+	Stock            int     `json:"stock"`
+	IsUnlimitedStock bool    `json:"is_unlimited_stock"`
+	CategoryID       *uint   `json:"category_id"`
+	ImageURL         string  `json:"image_url"`
+}
+
+// ==================== IMAGE UPLOAD ====================
+
+func UploadProductImage(c *gin.Context) {
+	file, err := c.FormFile("file")
+	if err != nil {
+		c.JSON(http.StatusBadRequest, gin.H{"detail": "File tidak ditemukan dalam request"})
+		return
+	}
+
+	// Validasi jenis file
+	allowedTypes := map[string]bool{
+		"image/jpeg": true,
+		"image/png":  true,
+		"image/webp": true,
+		"image/gif":  true,
+	}
+
+	contentType := file.Header.Get("Content-Type")
+	if !allowedTypes[contentType] {
+		c.JSON(http.StatusBadRequest, gin.H{"detail": "Hanya file gambar (JPG, PNG, WebP, GIF) yang diizinkan"})
+		return
+	}
+
+	// Validasi ukuran (maksimal 5MB)
+	if file.Size > 5*1024*1024 {
+		c.JSON(http.StatusBadRequest, gin.H{"detail": "Ukuran gambar maksimal 5MB"})
+		return
+	}
+
+	// Upload langsung ke Cloudinary
+	secureURL, err := services.UploadToCloudinary(file)
+	if err != nil {
+		c.JSON(http.StatusInternalServerError, gin.H{"detail": fmt.Sprintf("Gagal upload gambar: %v", err)})
+		return
+	}
+
+	c.JSON(http.StatusOK, gin.H{
+		"image_url": secureURL,
+	})
+}
+
+// ==================== CATEGORY CONTROLLER ====================
+
+func ListCategories(c *gin.Context) {
+	userVal, _ := c.Get("user")
+	user := userVal.(*models.User)
+
+	var branchID *uint
+	// Periksa query param branch_id
+	if qBranchID := c.Query("branch_id"); qBranchID != "" {
+		if val, err := strconv.ParseUint(qBranchID, 10, 32); err == nil {
+			uVal := uint(val)
+			branchID = &uVal
+		}
+	}
+
+	// Jika kasir, paksa filter berdasarkan branch_id kasir
+	if user.Role == "kasir" && user.BranchID != nil {
+		branchID = user.BranchID
+	}
+
+	var allCategories []models.Category
+	if err := config.DB.Where("company_id = ?", *user.CompanyID).Find(&allCategories).Error; err != nil {
+		c.JSON(http.StatusInternalServerError, gin.H{"detail": "Gagal mengambil data kategori"})
+		return
+	}
+
+	// Jika tidak ada filter branch_id, kembalikan semua kategori langsung
+	if branchID == nil {
+		c.JSON(http.StatusOK, allCategories)
+		return
+	}
+
+	// Ambil daftar product_id yang tidak tersedia di cabang ini
+	var unavailableProductIDs []uint
+	config.DB.Model(&models.BranchProduct{}).
+		Where("branch_id = ? AND is_available = ?", *branchID, false).
+		Pluck("product_id", &unavailableProductIDs)
+
+	// Cari kategori dari produk aktif yang tersedia di cabang ini
+	var availableCategoryIDs []uint
+	query := config.DB.Model(&models.Product{}).
+		Where("company_id = ? AND is_active = ?", *user.CompanyID, true)
+
+	if len(unavailableProductIDs) > 0 {
+		query = query.Where("id NOT IN ?", unavailableProductIDs)
+	}
+
+	query.Pluck("distinct category_id", &availableCategoryIDs)
+
+	// Filter allCategories agar hanya mengembalikan kategori yang memiliki produk tersedia di cabang
+	catMap := make(map[uint]bool)
+	for _, catID := range availableCategoryIDs {
+		catMap[catID] = true
+	}
+
+	var resp []models.Category
+	for _, cat := range allCategories {
+		if catMap[cat.ID] {
+			resp = append(resp, cat)
+		}
+	}
+
+	c.JSON(http.StatusOK, resp)
+}
+
+func GetCategory(c *gin.Context) {
+	userVal, _ := c.Get("user")
+	user := userVal.(*models.User)
+
+	catIDStr := c.Param("category_id")
+	catID, err := strconv.Atoi(catIDStr)
+	if err != nil {
+		c.JSON(http.StatusBadRequest, gin.H{"detail": "ID kategori tidak valid"})
+		return
+	}
+
+	var category models.Category
+	if err := config.DB.Where("id = ? AND company_id = ?", catID, *user.CompanyID).First(&category).Error; err != nil {
+		c.JSON(http.StatusNotFound, gin.H{"detail": "Kategori tidak ditemukan"})
+		return
+	}
+
+	c.JSON(http.StatusOK, category)
+}
+
+func CreateCategory(c *gin.Context) {
+	userVal, _ := c.Get("user")
+	user := userVal.(*models.User)
+
+	var req CategoryCreateRequest
+	if err := c.ShouldBindJSON(&req); err != nil {
+		c.JSON(http.StatusBadRequest, gin.H{"detail": err.Error()})
+		return
+	}
+
+	// Cek duplikasi nama kategori di perusahaan yang sama
+	var count int64
+	config.DB.Model(&models.Category{}).Where("name = ? AND company_id = ?", req.Name, *user.CompanyID).Count(&count)
+	if count > 0 {
+		c.JSON(http.StatusBadRequest, gin.H{"detail": fmt.Sprintf("Kategori '%s' sudah ada", req.Name)})
+		return
+	}
+
+	newCat := models.Category{
+		CompanyID:   *user.CompanyID,
+		Name:        req.Name,
+		Description: req.Description,
+	}
+
+	if err := config.DB.Create(&newCat).Error; err != nil {
+		c.JSON(http.StatusInternalServerError, gin.H{"detail": "Gagal menyimpan kategori baru"})
+		return
+	}
+
+	c.JSON(http.StatusCreated, newCat)
+}
+
+func UpdateCategory(c *gin.Context) {
+	userVal, _ := c.Get("user")
+	user := userVal.(*models.User)
+
+	catIDStr := c.Param("category_id")
+	catID, err := strconv.Atoi(catIDStr)
+	if err != nil {
+		c.JSON(http.StatusBadRequest, gin.H{"detail": "ID kategori tidak valid"})
+		return
+	}
+
+	var req CategoryCreateRequest
+	if err := c.ShouldBindJSON(&req); err != nil {
+		c.JSON(http.StatusBadRequest, gin.H{"detail": err.Error()})
+		return
+	}
+
+	var category models.Category
+	if err := config.DB.Where("id = ? AND company_id = ?", catID, *user.CompanyID).First(&category).Error; err != nil {
+		c.JSON(http.StatusNotFound, gin.H{"detail": "Kategori tidak ditemukan"})
+		return
+	}
+
+	if req.Name != "" {
+		var count int64
+		config.DB.Model(&models.Category{}).Where("name = ? AND company_id = ? AND id != ?", req.Name, *user.CompanyID, catID).Count(&count)
+		if count > 0 {
+			c.JSON(http.StatusBadRequest, gin.H{"detail": fmt.Sprintf("Kategori '%s' sudah ada", req.Name)})
+			return
+		}
+		category.Name = req.Name
+	}
+	category.Description = req.Description
+
+	if err := config.DB.Save(&category).Error; err != nil {
+		c.JSON(http.StatusInternalServerError, gin.H{"detail": "Gagal meng-update kategori"})
+		return
+	}
+
+	c.JSON(http.StatusOK, category)
+}
+
+func DeleteCategory(c *gin.Context) {
+	userVal, _ := c.Get("user")
+	user := userVal.(*models.User)
+
+	catIDStr := c.Param("category_id")
+	catID, err := strconv.Atoi(catIDStr)
+	if err != nil {
+		c.JSON(http.StatusBadRequest, gin.H{"detail": "ID kategori tidak valid"})
+		return
+	}
+
+	var category models.Category
+	if err := config.DB.Preload("Products").Where("id = ? AND company_id = ?", catID, *user.CompanyID).First(&category).Error; err != nil {
+		c.JSON(http.StatusNotFound, gin.H{"detail": "Kategori tidak ditemukan"})
+		return
+	}
+
+	// Cek apakah masih ada produk aktif/tidak aktif terikat ke kategori ini
+	if len(category.Products) > 0 {
+		c.JSON(http.StatusBadRequest, gin.H{"detail": fmt.Sprintf("Kategori masih memiliki %d produk. Pindahkan produk dulu.", len(category.Products))})
+		return
+	}
+
+	if err := config.DB.Delete(&category).Error; err != nil {
+		c.JSON(http.StatusInternalServerError, gin.H{"detail": "Gagal menghapus kategori"})
+		return
+	}
+
+	c.JSON(http.StatusOK, gin.H{
+		"message": fmt.Sprintf("Kategori '%s' berhasil dihapus", category.Name),
+	})
+}
+
+// ==================== PRODUCT CONTROLLER ====================
+
+func ListProducts(c *gin.Context) {
+	userVal, _ := c.Get("user")
+	user := userVal.(*models.User)
+
+	var branchID *uint
+	// Cek filter branch_id query param (owner di POS)
+	if qBranchID := c.Query("branch_id"); qBranchID != "" {
+		if val, err := strconv.ParseUint(qBranchID, 10, 32); err == nil {
+			uVal := uint(val)
+			branchID = &uVal
+		}
+	}
+
+	// Kasir terikat branch
+	if user.Role == "kasir" && user.BranchID != nil {
+		branchID = user.BranchID
+	}
+
+	categoryFilter := c.Query("category_id")
+	activeOnlyStr := c.DefaultQuery("active_only", "true")
+	activeOnly := activeOnlyStr == "true"
+
+	var products []models.Product
+	query := config.DB.Preload("Category").Where("company_id = ?", *user.CompanyID)
+
+	if activeOnly {
+		query = query.Where("is_active = ?", true)
+	}
+
+	if categoryFilter != "" {
+		if catID, err := strconv.Atoi(categoryFilter); err == nil {
+			query = query.Where("category_id = ?", catID)
+		}
+	}
+
+	if err := query.Find(&products).Error; err != nil {
+		c.JSON(http.StatusInternalServerError, gin.H{"detail": "Gagal mengambil data produk"})
+		return
+	}
+
+	// Filter ketersediaan cabang (BranchProduct)
+	if branchID != nil {
+		var branchProducts []models.BranchProduct
+		config.DB.Where("branch_id = ?", *branchID).Find(&branchProducts)
+
+		bpMap := make(map[uint]bool)
+		for _, bp := range branchProducts {
+			bpMap[bp.ProductID] = bp.IsAvailable
+		}
+
+		var filteredProducts []models.Product
+		for _, p := range products {
+			isAvailable, exists := bpMap[p.ID]
+			// Jika belum disetting di cabang (exists=false), default-nya adalah tersedia (isAvailable=true)
+			if !exists || isAvailable {
+				filteredProducts = append(filteredProducts, p)
+			}
+		}
+		c.JSON(http.StatusOK, filteredProducts)
+		return
+	}
+
+	c.JSON(http.StatusOK, products)
+}
+
+func GetProduct(c *gin.Context) {
+	userVal, _ := c.Get("user")
+	user := userVal.(*models.User)
+
+	productIDStr := c.Param("product_id")
+	productID, err := strconv.Atoi(productIDStr)
+	if err != nil {
+		c.JSON(http.StatusBadRequest, gin.H{"detail": "ID produk tidak valid"})
+		return
+	}
+
+	var product models.Product
+	if err := config.DB.Preload("Category").Where("id = ? AND company_id = ?", productID, *user.CompanyID).First(&product).Error; err != nil {
+		c.JSON(http.StatusNotFound, gin.H{"detail": "Produk tidak ditemukan"})
+		return
+	}
+
+	c.JSON(http.StatusOK, product)
+}
+
+func CreateProduct(c *gin.Context) {
+	userVal, _ := c.Get("user")
+	user := userVal.(*models.User)
+
+	var req ProductCreateRequest
+	if err := c.ShouldBindJSON(&req); err != nil {
+		c.JSON(http.StatusBadRequest, gin.H{"detail": err.Error()})
+		return
+	}
+
+	// Verifikasi SKU jika diisi
+	if req.SKU != nil && *req.SKU != "" {
+		var count int64
+		config.DB.Model(&models.Product{}).Where("sku = ?", *req.SKU).Count(&count)
+		if count > 0 {
+			c.JSON(http.StatusBadRequest, gin.H{"detail": fmt.Sprintf("Produk dengan SKU '%s' sudah ada", *req.SKU)})
+			return
+		}
+	}
+
+	newProduct := models.Product{
+		CompanyID:        *user.CompanyID,
+		Name:             req.Name,
+		SKU:              req.SKU,
+		Price:            req.Price,
+		Stock:            req.Stock,
+		IsUnlimitedStock: req.IsUnlimitedStock,
+		CategoryID:       req.CategoryID,
+		ImageURL:         req.ImageURL,
+		IsActive:         true,
+	}
+
+	if err := config.DB.Create(&newProduct).Error; err != nil {
+		c.JSON(http.StatusInternalServerError, gin.H{"detail": "Gagal menyimpan produk baru"})
+		return
+	}
+
+	// Preload Category sebelum me-return response agar response-nya lengkap
+	config.DB.Preload("Category").First(&newProduct, newProduct.ID)
+
+	c.JSON(http.StatusCreated, newProduct)
+}
+
+func UpdateProduct(c *gin.Context) {
+	userVal, _ := c.Get("user")
+	user := userVal.(*models.User)
+
+	productIDStr := c.Param("product_id")
+	productID, err := strconv.Atoi(productIDStr)
+	if err != nil {
+		c.JSON(http.StatusBadRequest, gin.H{"detail": "ID produk tidak valid"})
+		return
+	}
+
+	var req ProductCreateRequest
+	if err := c.ShouldBindJSON(&req); err != nil {
+		c.JSON(http.StatusBadRequest, gin.H{"detail": err.Error()})
+		return
+	}
+
+	var product models.Product
+	if err := config.DB.Where("id = ? AND company_id = ?", productID, *user.CompanyID).First(&product).Error; err != nil {
+		c.JSON(http.StatusNotFound, gin.H{"detail": "Produk tidak ditemukan"})
+		return
+	}
+
+	// Verifikasi SKU jika berubah
+	if req.SKU != nil && *req.SKU != "" && (product.SKU == nil || *product.SKU != *req.SKU) {
+		var count int64
+		config.DB.Model(&models.Product{}).Where("sku = ? AND id != ?", *req.SKU, productID).Count(&count)
+		if count > 0 {
+			c.JSON(http.StatusBadRequest, gin.H{"detail": fmt.Sprintf("Produk dengan SKU '%s' sudah ada", *req.SKU)})
+			return
+		}
+		product.SKU = req.SKU
+	}
+
+	product.Name = req.Name
+	product.Price = req.Price
+	product.Stock = req.Stock
+	product.IsUnlimitedStock = req.IsUnlimitedStock
+	product.CategoryID = req.CategoryID
+
+	if req.ImageURL != "" {
+		product.ImageURL = req.ImageURL
+	}
+
+	if err := config.DB.Save(&product).Error; err != nil {
+		c.JSON(http.StatusInternalServerError, gin.H{"detail": "Gagal meng-update produk"})
+		return
+	}
+
+	config.DB.Preload("Category").First(&product, product.ID)
+
+	c.JSON(http.StatusOK, product)
+}
+
+func DeleteProduct(c *gin.Context) {
+	userVal, _ := c.Get("user")
+	user := userVal.(*models.User)
+
+	productIDStr := c.Param("product_id")
+	productID, err := strconv.Atoi(productIDStr)
+	if err != nil {
+		c.JSON(http.StatusBadRequest, gin.H{"detail": "ID produk tidak valid"})
+		return
+	}
+
+	var product models.Product
+	if err := config.DB.Where("id = ? AND company_id = ?", productID, *user.CompanyID).First(&product).Error; err != nil {
+		c.JSON(http.StatusNotFound, gin.H{"detail": "Produk tidak ditemukan"})
+		return
+	}
+
+	// Soft delete (matikan is_active)
+	product.IsActive = false
+	if err := config.DB.Save(&product).Error; err != nil {
+		c.JSON(http.StatusInternalServerError, gin.H{"detail": "Gagal menghapus produk"})
+		return
+	}
+
+	c.JSON(http.StatusOK, gin.H{
+		"message": "Produk berhasil dinonaktifkan",
+	})
+}

controllers/report_controller.go

@@ -0,0 +1,240 @@
+package controllers
+
+import (
+	"fmt"
+	"net/http"
+	"strconv"
+	"strings"
+	"time"
+
+	"service-warungpos-go/config"
+	"service-warungpos-go/models"
+
+	"github.com/gin-gonic/gin"
+)
+
+type TopProductRow struct {
+	ProductName   string `json:"product_name"`
+	TotalQuantity int    `json:"total_quantity"`
+	TotalRevenue  int    `json:"total_revenue"`
+}
+
+type SummaryTopProduct struct {
+	Name         string `json:"name"`
+	TotalSold    int    `json:"total_sold"`
+	TotalRevenue int    `json:"total_revenue"`
+}
+
+type ReportOrderRow struct {
+	OrderNumber   string    `json:"order_number"`
+	TotalAmount   int       `json:"total_amount"`
+	PaymentMethod string    `json:"payment_method"`
+	CreatedAt     time.Time `json:"created_at"`
+}
+
+func getDayRange(targetDate time.Time) (time.Time, time.Time) {
+	// Buat range awal dan akhir hari di timezone lokal/WIB (Asia/Jakarta)
+	loc, _ := time.LoadLocation("Asia/Jakarta")
+	if loc == nil {
+		loc = time.Local
+	}
+	start := time.Date(targetDate.Year(), targetDate.Month(), targetDate.Day(), 0, 0, 0, 0, loc)
+	end := start.Add(24 * time.Hour)
+	return start, end
+}
+
+func fmtRupiah(amount int) string {
+	// Helper formatting rupiah untuk internal log atau respons
+	str := fmt.Sprintf("%d", amount)
+	var result []string
+	length := len(str)
+	for i := length; i > 0; i -= 3 {
+		start := i - 3
+		if start < 0 {
+			start = 0
+		}
+		result = append([]string{str[start:i]}, result...)
+	}
+	return "Rp " + strings.Join(result, ".")
+}
+
+// Helper strings.Join untuk formatting di atas
+
+func DailyReport(c *gin.Context) {
+	userVal, _ := c.Get("user")
+	user := userVal.(*models.User)
+
+	dateQuery := c.Query("date") // YYYY-MM-DD
+	branchQuery := c.Query("branch_id")
+
+	var targetDate time.Time
+	var err error
+	if dateQuery != "" {
+		targetDate, err = time.Parse("2006-01-02", dateQuery)
+		if err != nil {
+			c.JSON(http.StatusBadRequest, gin.H{"detail": "Format tanggal salah, gunakan YYYY-MM-DD"})
+			return
+		}
+	} else {
+		// Default: Hari ini
+		targetDate = time.Now()
+	}
+
+	startDt, endDt := getDayRange(targetDate)
+
+	query := config.DB.Where("company_id = ? AND created_at >= ? AND created_at < ? AND payment_status = ?", *user.CompanyID, startDt, endDt, "paid")
+
+	if branchQuery != "" {
+		if bID, err := strconv.Atoi(branchQuery); err == nil {
+			query = query.Where("branch_id = ?", bID)
+		}
+	}
+
+	var orders []models.Order
+	if err := query.Find(&orders).Error; err != nil {
+		c.JSON(http.StatusInternalServerError, gin.H{"detail": "Gagal mengambil data laporan harian"})
+		return
+	}
+
+	totalRevenue := 0
+	totalCash := 0
+	totalMidtrans := 0
+	totalPlatformFee := 0
+
+	var orderRows []ReportOrderRow
+	for _, o := range orders {
+		totalRevenue += o.TotalAmount
+		if o.PaymentMethod == "cash" {
+			totalCash += o.TotalAmount
+		} else if o.PaymentMethod == "midtrans" {
+			totalMidtrans += o.TotalAmount
+		}
+		totalPlatformFee += o.PlatformFee
+
+		orderRows = append(orderRows, ReportOrderRow{
+			OrderNumber:   o.OrderNumber,
+			TotalAmount:   o.TotalAmount,
+			PaymentMethod: o.PaymentMethod,
+			CreatedAt:     o.CreatedAt,
+		})
+	}
+
+	// Query Top 5 produk terlaris hari ini
+	var topProducts []TopProductRow
+	topQuery := config.DB.Table("products").
+		Select("products.name as product_name, sum(order_items.quantity) as total_quantity, sum(order_items.subtotal) as total_revenue").
+		Joins("join order_items on products.id = order_items.product_id").
+		Joins("join orders on order_items.order_id = orders.id").
+		Where("orders.company_id = ? AND orders.payment_status = ? AND orders.created_at >= ? AND orders.created_at < ?", *user.CompanyID, "paid", startDt, endDt)
+
+	if branchQuery != "" {
+		if bID, err := strconv.Atoi(branchQuery); err == nil {
+			topQuery = topQuery.Where("orders.branch_id = ?", bID)
+		}
+	}
+
+	topQuery.Group("products.name").
+		Order("total_quantity desc").
+		Limit(5).
+		Scan(&topProducts)
+
+	c.JSON(http.StatusOK, gin.H{
+		"date":               targetDate.Format("2006-01-02"),
+		"total_transactions": len(orders),
+		"total_revenue":      totalRevenue,
+		"total_cash":         totalCash,
+		"total_midtrans":     totalMidtrans,
+		"total_platform_fee": totalPlatformFee,
+		"top_products":       topProducts,
+		"orders":             orderRows,
+	})
+}
+
+func SummaryReport(c *gin.Context) {
+	userVal, _ := c.Get("user")
+	user := userVal.(*models.User)
+
+	branchQuery := c.Query("branch_id")
+
+	// 1. Total Semua Transaksi Sukses
+	totalOrders := int64(0)
+	totalRevenue := int64(0)
+
+	totalQuery := config.DB.Model(&models.Order{}).
+		Where("company_id = ? AND payment_status = ?", *user.CompanyID, "paid")
+
+	if branchQuery != "" {
+		if bID, err := strconv.Atoi(branchQuery); err == nil {
+			totalQuery = totalQuery.Where("branch_id = ?", bID)
+		}
+	}
+
+	totalQuery.Count(&totalOrders)
+	totalQuery.Select("coalesce(sum(total_amount), 0)").Row().Scan(&totalRevenue)
+
+	// 2. Total Produk Aktif yang Tersedia
+	var totalProducts int64
+	prodQuery := config.DB.Model(&models.Product{}).
+		Where("company_id = ? AND is_active = ?", *user.CompanyID, true)
+
+	if branchQuery != "" {
+		if bID, err := strconv.Atoi(branchQuery); err == nil {
+			// Subquery pengecualian produk tidak aktif di cabang ini
+			subQuery := config.DB.Model(&models.BranchProduct{}).
+				Select("product_id").
+				Where("branch_id = ? AND is_available = ?", bID, false)
+			prodQuery = prodQuery.Where("id NOT IN (?)", subQuery)
+		}
+	}
+	prodQuery.Count(&totalProducts)
+
+	// 3. Top 5 Produk Terlaris All-Time
+	var topProducts []SummaryTopProduct
+	topQuery := config.DB.Table("products").
+		Select("products.name as name, sum(order_items.quantity) as total_sold, sum(order_items.subtotal) as total_revenue").
+		Joins("join order_items on products.id = order_items.product_id").
+		Joins("join orders on order_items.order_id = orders.id").
+		Where("orders.company_id = ? AND orders.payment_status = ?", *user.CompanyID, "paid")
+
+	if branchQuery != "" {
+		if bID, err := strconv.Atoi(branchQuery); err == nil {
+			topQuery = topQuery.Where("orders.branch_id = ?", bID)
+		}
+	}
+
+	topQuery.Group("products.name").
+		Order("total_sold desc").
+		Limit(5).
+		Scan(&topProducts)
+
+	// 4. Laporan Hari Ini
+	todayOrders := int64(0)
+	todayRevenue := int64(0)
+
+	startToday, endToday := getDayRange(time.Now())
+
+	todayQuery := config.DB.Model(&models.Order{}).
+		Where("company_id = ? AND payment_status = ? AND created_at >= ? AND created_at < ?", *user.CompanyID, "paid", startToday, endToday)
+
+	if branchQuery != "" {
+		if bID, err := strconv.Atoi(branchQuery); err == nil {
+			todayQuery = todayQuery.Where("branch_id = ?", bID)
+		}
+	}
+
+	todayQuery.Count(&todayOrders)
+	todayQuery.Select("coalesce(sum(total_amount), 0)").Row().Scan(&todayRevenue)
+
+	c.JSON(http.StatusOK, gin.H{
+		"all_time": gin.H{
+			"total_orders":  totalOrders,
+			"total_revenue": totalRevenue,
+		},
+		"today": gin.H{
+			"total_orders":  todayOrders,
+			"total_revenue": todayRevenue,
+		},
+		"total_products": totalProducts,
+		"top_products":   topProducts,
+	})
+}

go.mod

@@ -0,0 +1,52 @@
+module service-warungpos-go
+
+go 1.26.3
+
+require (
+	github.com/bytedance/gopkg v0.1.3 // indirect
+	github.com/bytedance/sonic v1.15.0 // indirect
+	github.com/bytedance/sonic/loader v0.5.0 // indirect
+	github.com/cloudinary/cloudinary-go/v2 v2.16.0 // indirect
+	github.com/cloudwego/base64x v0.1.6 // indirect
+	github.com/creasty/defaults v1.7.0 // indirect
+	github.com/gabriel-vasile/mimetype v1.4.12 // indirect
+	github.com/gin-contrib/sse v1.1.0 // indirect
+	github.com/gin-gonic/gin v1.12.0 // indirect
+	github.com/go-playground/locales v0.14.1 // indirect
+	github.com/go-playground/universal-translator v0.18.1 // indirect
+	github.com/go-playground/validator/v10 v10.30.1 // indirect
+	github.com/goccy/go-json v0.10.5 // indirect
+	github.com/goccy/go-yaml v1.19.2 // indirect
+	github.com/golang-jwt/jwt/v5 v5.3.1 // indirect
+	github.com/google/uuid v1.5.0 // indirect
+	github.com/gorilla/schema v1.4.1 // indirect
+	github.com/jackc/pgpassfile v1.0.0 // indirect
+	github.com/jackc/pgservicefile v0.0.0-20240606120523-5a60cdf6a761 // indirect
+	github.com/jackc/pgx/v5 v5.6.0 // indirect
+	github.com/jackc/puddle/v2 v2.2.2 // indirect
+	github.com/jinzhu/inflection v1.0.0 // indirect
+	github.com/jinzhu/now v1.1.5 // indirect
+	github.com/joho/godotenv v1.5.1 // indirect
+	github.com/json-iterator/go v1.1.12 // indirect
+	github.com/klauspost/cpuid/v2 v2.3.0 // indirect
+	github.com/leodido/go-urn v1.4.0 // indirect
+	github.com/mattn/go-isatty v0.0.20 // indirect
+	github.com/midtrans/midtrans-go v1.3.8 // indirect
+	github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd // indirect
+	github.com/modern-go/reflect2 v1.0.2 // indirect
+	github.com/pelletier/go-toml/v2 v2.2.4 // indirect
+	github.com/quic-go/qpack v0.6.0 // indirect
+	github.com/quic-go/quic-go v0.59.0 // indirect
+	github.com/twitchyliquid64/golang-asm v0.15.1 // indirect
+	github.com/ugorji/go/codec v1.3.1 // indirect
+	go.mongodb.org/mongo-driver/v2 v2.5.0 // indirect
+	golang.org/x/arch v0.22.0 // indirect
+	golang.org/x/crypto v0.52.0 // indirect
+	golang.org/x/net v0.54.0 // indirect
+	golang.org/x/sync v0.20.0 // indirect
+	golang.org/x/sys v0.45.0 // indirect
+	golang.org/x/text v0.37.0 // indirect
+	google.golang.org/protobuf v1.36.10 // indirect
+	gorm.io/driver/postgres v1.6.0 // indirect
+	gorm.io/gorm v1.31.1 // indirect
+)

go.sum

@@ -0,0 +1,111 @@
+github.com/bytedance/gopkg v0.1.3 h1:TPBSwH8RsouGCBcMBktLt1AymVo2TVsBVCY4b6TnZ/M=
+github.com/bytedance/gopkg v0.1.3/go.mod h1:576VvJ+eJgyCzdjS+c4+77QF3p7ubbtiKARP3TxducM=
+github.com/bytedance/sonic v1.15.0 h1:/PXeWFaR5ElNcVE84U0dOHjiMHQOwNIx3K4ymzh/uSE=
+github.com/bytedance/sonic v1.15.0/go.mod h1:tFkWrPz0/CUCLEF4ri4UkHekCIcdnkqXw9VduqpJh0k=
+github.com/bytedance/sonic/loader v0.5.0 h1:gXH3KVnatgY7loH5/TkeVyXPfESoqSBSBEiDd5VjlgE=
+github.com/bytedance/sonic/loader v0.5.0/go.mod h1:AR4NYCk5DdzZizZ5djGqQ92eEhCCcdf5x77udYiSJRo=
+github.com/cloudinary/cloudinary-go/v2 v2.16.0 h1:0irPbKwRB6V6sdP9+a4P4D5sRUYHXriG5GfTjVq4YBI=
+github.com/cloudinary/cloudinary-go/v2 v2.16.0/go.mod h1:ireC4gqVetsjVhYlwjUJwKTbZuWjEIynbR9zQTlqsvo=
+github.com/cloudwego/base64x v0.1.6 h1:t11wG9AECkCDk5fMSoxmufanudBtJ+/HemLstXDLI2M=
+github.com/cloudwego/base64x v0.1.6/go.mod h1:OFcloc187FXDaYHvrNIjxSe8ncn0OOM8gEHfghB2IPU=
+github.com/creasty/defaults v1.7.0 h1:eNdqZvc5B509z18lD8yc212CAqJNvfT1Jq6L8WowdBA=
+github.com/creasty/defaults v1.7.0/go.mod h1:iGzKe6pbEHnpMPtfDXZEr0NVxWnPTjb1bbDy08fPzYM=
+github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
+github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
+github.com/gabriel-vasile/mimetype v1.4.12 h1:e9hWvmLYvtp846tLHam2o++qitpguFiYCKbn0w9jyqw=
+github.com/gabriel-vasile/mimetype v1.4.12/go.mod h1:d+9Oxyo1wTzWdyVUPMmXFvp4F9tea18J8ufA774AB3s=
+github.com/gin-contrib/sse v1.1.0 h1:n0w2GMuUpWDVp7qSpvze6fAu9iRxJY4Hmj6AmBOU05w=
+github.com/gin-contrib/sse v1.1.0/go.mod h1:hxRZ5gVpWMT7Z0B0gSNYqqsSCNIJMjzvm6fqCz9vjwM=
+github.com/gin-gonic/gin v1.12.0 h1:b3YAbrZtnf8N//yjKeU2+MQsh2mY5htkZidOM7O0wG8=
+github.com/gin-gonic/gin v1.12.0/go.mod h1:VxccKfsSllpKshkBWgVgRniFFAzFb9csfngsqANjnLc=
+github.com/go-playground/locales v0.14.1 h1:EWaQ/wswjilfKLTECiXz7Rh+3BjFhfDFKv/oXslEjJA=
+github.com/go-playground/locales v0.14.1/go.mod h1:hxrqLVvrK65+Rwrd5Fc6F2O76J/NuW9t0sjnWqG1slY=
+github.com/go-playground/universal-translator v0.18.1 h1:Bcnm0ZwsGyWbCzImXv+pAJnYK9S473LQFuzCbDbfSFY=
+github.com/go-playground/universal-translator v0.18.1/go.mod h1:xekY+UJKNuX9WP91TpwSH2VMlDf28Uj24BCp08ZFTUY=
+github.com/go-playground/validator/v10 v10.30.1 h1:f3zDSN/zOma+w6+1Wswgd9fLkdwy06ntQJp0BBvFG0w=
+github.com/go-playground/validator/v10 v10.30.1/go.mod h1:oSuBIQzuJxL//3MelwSLD5hc2Tu889bF0Idm9Dg26cM=
+github.com/goccy/go-json v0.10.5 h1:Fq85nIqj+gXn/S5ahsiTlK3TmC85qgirsdTP/+DeaC4=
+github.com/goccy/go-json v0.10.5/go.mod h1:oq7eo15ShAhp70Anwd5lgX2pLfOS3QCiwU/PULtXL6M=
+github.com/goccy/go-yaml v1.19.2 h1:PmFC1S6h8ljIz6gMRBopkjP1TVT7xuwrButHID66PoM=
+github.com/goccy/go-yaml v1.19.2/go.mod h1:XBurs7gK8ATbW4ZPGKgcbrY1Br56PdM69F7LkFRi1kA=
+github.com/golang-jwt/jwt/v5 v5.3.1 h1:kYf81DTWFe7t+1VvL7eS+jKFVWaUnK9cB1qbwn63YCY=
+github.com/golang-jwt/jwt/v5 v5.3.1/go.mod h1:fxCRLWMO43lRc8nhHWY6LGqRcf+1gQWArsqaEUEa5bE=
+github.com/google/gofuzz v1.0.0/go.mod h1:dBl0BpW6vV/+mYPU4Po3pmUjxk6FQPldtuIdl/M65Eg=
+github.com/google/uuid v1.5.0 h1:1p67kYwdtXjb0gL0BPiP1Av9wiZPo5A8z2cWkTZ+eyU=
+github.com/google/uuid v1.5.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
+github.com/gorilla/schema v1.4.1 h1:jUg5hUjCSDZpNGLuXQOgIWGdlgrIdYvgQ0wZtdK1M3E=
+github.com/gorilla/schema v1.4.1/go.mod h1:Dg5SSm5PV60mhF2NFaTV1xuYYj8tV8NOPRo4FggUMnM=
+github.com/jackc/pgpassfile v1.0.0 h1:/6Hmqy13Ss2zCq62VdNG8tM1wchn8zjSGOBJ6icpsIM=
+github.com/jackc/pgpassfile v1.0.0/go.mod h1:CEx0iS5ambNFdcRtxPj5JhEz+xB6uRky5eyVu/W2HEg=
+github.com/jackc/pgservicefile v0.0.0-20240606120523-5a60cdf6a761 h1:iCEnooe7UlwOQYpKFhBabPMi4aNAfoODPEFNiAnClxo=
+github.com/jackc/pgservicefile v0.0.0-20240606120523-5a60cdf6a761/go.mod h1:5TJZWKEWniPve33vlWYSoGYefn3gLQRzjfDlhSJ9ZKM=
+github.com/jackc/pgx/v5 v5.6.0 h1:SWJzexBzPL5jb0GEsrPMLIsi/3jOo7RHlzTjcAeDrPY=
+github.com/jackc/pgx/v5 v5.6.0/go.mod h1:DNZ/vlrUnhWCoFGxHAG8U2ljioxukquj7utPDgtQdTw=
+github.com/jackc/puddle/v2 v2.2.2 h1:PR8nw+E/1w0GLuRFSmiioY6UooMp6KJv0/61nB7icHo=
+github.com/jackc/puddle/v2 v2.2.2/go.mod h1:vriiEXHvEE654aYKXXjOvZM39qJ0q+azkZFrfEOc3H4=
+github.com/jinzhu/inflection v1.0.0 h1:K317FqzuhWc8YvSVlFMCCUb36O/S9MCKRDI7QkRKD/E=
+github.com/jinzhu/inflection v1.0.0/go.mod h1:h+uFLlag+Qp1Va5pdKtLDYj+kHp5pxUVkryuEj+Srlc=
+github.com/jinzhu/now v1.1.5 h1:/o9tlHleP7gOFmsnYNz3RGnqzefHA47wQpKrrdTIwXQ=
+github.com/jinzhu/now v1.1.5/go.mod h1:d3SSVoowX0Lcu0IBviAWJpolVfI5UJVZZ7cO71lE/z8=
+github.com/joho/godotenv v1.5.1 h1:7eLL/+HRGLY0ldzfGMeQkb7vMd0as4CfYvUVzLqw0N0=
+github.com/joho/godotenv v1.5.1/go.mod h1:f4LDr5Voq0i2e/R5DDNOoa2zzDfwtkZa6DnEwAbqwq4=
+github.com/json-iterator/go v1.1.12 h1:PV8peI4a0ysnczrg+LtxykD8LfKY9ML6u2jnxaEnrnM=
+github.com/json-iterator/go v1.1.12/go.mod h1:e30LSqwooZae/UwlEbR2852Gd8hjQvJoHmT4TnhNGBo=
+github.com/klauspost/cpuid/v2 v2.3.0 h1:S4CRMLnYUhGeDFDqkGriYKdfoFlDnMtqTiI/sFzhA9Y=
+github.com/klauspost/cpuid/v2 v2.3.0/go.mod h1:hqwkgyIinND0mEev00jJYCxPNVRVXFQeu1XKlok6oO0=
+github.com/leodido/go-urn v1.4.0 h1:WT9HwE9SGECu3lg4d/dIA+jxlljEa1/ffXKmRjqdmIQ=
+github.com/leodido/go-urn v1.4.0/go.mod h1:bvxc+MVxLKB4z00jd1z+Dvzr47oO32F/QSNjSBOlFxI=
+github.com/mattn/go-isatty v0.0.20 h1:xfD0iDuEKnDkl03q4limB+vH+GxLEtL/jb4xVJSWWEY=
+github.com/mattn/go-isatty v0.0.20/go.mod h1:W+V8PltTTMOvKvAeJH7IuucS94S2C6jfK/D7dTCTo3Y=
+github.com/midtrans/midtrans-go v1.3.8 h1:r6eq51LJwbMQ05dBF3Twg99u45G3pLxP5INYoqOoNzU=
+github.com/midtrans/midtrans-go v1.3.8/go.mod h1:5hN2oiZDP3/SwSBxHPTg8eC/RVoRE9DXQOY1Ah9au10=
+github.com/modern-go/concurrent v0.0.0-20180228061459-e0a39a4cb421/go.mod h1:6dJC0mAP4ikYIbvyc7fijjWJddQyLn8Ig3JB5CqoB9Q=
+github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd h1:TRLaZ9cD/w8PVh93nsPXa1VrQ6jlwL5oN8l14QlcNfg=
+github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd/go.mod h1:6dJC0mAP4ikYIbvyc7fijjWJddQyLn8Ig3JB5CqoB9Q=
+github.com/modern-go/reflect2 v1.0.2 h1:xBagoLtFs94CBntxluKeaWgTMpvLxC4ur3nMaC9Gz0M=
+github.com/modern-go/reflect2 v1.0.2/go.mod h1:yWuevngMOJpCy52FWWMvUC8ws7m/LJsjYzDa0/r8luk=
+github.com/pelletier/go-toml/v2 v2.2.4 h1:mye9XuhQ6gvn5h28+VilKrrPoQVanw5PMw/TB0t5Ec4=
+github.com/pelletier/go-toml/v2 v2.2.4/go.mod h1:2gIqNv+qfxSVS7cM2xJQKtLSTLUE9V8t9Stt+h56mCY=
+github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
+github.com/quic-go/qpack v0.6.0 h1:g7W+BMYynC1LbYLSqRt8PBg5Tgwxn214ZZR34VIOjz8=
+github.com/quic-go/qpack v0.6.0/go.mod h1:lUpLKChi8njB4ty2bFLX2x4gzDqXwUpaO1DP9qMDZII=
+github.com/quic-go/quic-go v0.59.0 h1:OLJkp1Mlm/aS7dpKgTc6cnpynnD2Xg7C1pwL6vy/SAw=
+github.com/quic-go/quic-go v0.59.0/go.mod h1:upnsH4Ju1YkqpLXC305eW3yDZ4NfnNbmQRCMWS58IKU=
+github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
+github.com/stretchr/objx v0.4.0/go.mod h1:YvHI0jy2hoMjB+UWwv71VJQ9isScKT/TqJzVSSt89Yw=
+github.com/stretchr/objx v0.5.0/go.mod h1:Yh+to48EsGEfYuaHDzXPcE3xhTkx73EhmCGUpEOglKo=
+github.com/stretchr/objx v0.5.2/go.mod h1:FRsXN1f5AsAjCGJKqEizvkpNtU+EGNCLh3NxZ/8L+MA=
+github.com/stretchr/testify v1.3.0/go.mod h1:M5WIy9Dh21IEIfnGCwXGc5bZfKNJtfHm1UVUgZn+9EI=
+github.com/stretchr/testify v1.7.0/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
+github.com/stretchr/testify v1.7.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
+github.com/stretchr/testify v1.8.0/go.mod h1:yNjHg4UonilssWZ8iaSj1OCr/vHnekPRkoO+kdMU+MU=
+github.com/stretchr/testify v1.8.4/go.mod h1:sz/lmYIOXD/1dqDmKjjqLyZ2RngseejIcXlSw2iwfAo=
+github.com/stretchr/testify v1.10.0/go.mod h1:r2ic/lqez/lEtzL7wO/rwa5dbSLXVDPFyf8C91i36aY=
+github.com/twitchyliquid64/golang-asm v0.15.1 h1:SU5vSMR7hnwNxj24w34ZyCi/FmDZTkS4MhqMhdFk5YI=
+github.com/twitchyliquid64/golang-asm v0.15.1/go.mod h1:a1lVb/DtPvCB8fslRZhAngC2+aY1QWCk3Cedj/Gdt08=
+github.com/ugorji/go/codec v1.3.1 h1:waO7eEiFDwidsBN6agj1vJQ4AG7lh2yqXyOXqhgQuyY=
+github.com/ugorji/go/codec v1.3.1/go.mod h1:pRBVtBSKl77K30Bv8R2P+cLSGaTtex6fsA2Wjqmfxj4=
+go.mongodb.org/mongo-driver/v2 v2.5.0 h1:yXUhImUjjAInNcpTcAlPHiT7bIXhshCTL3jVBkF3xaE=
+go.mongodb.org/mongo-driver/v2 v2.5.0/go.mod h1:yOI9kBsufol30iFsl1slpdq1I0eHPzybRWdyYUs8K/0=
+golang.org/x/arch v0.22.0 h1:c/Zle32i5ttqRXjdLyyHZESLD/bB90DCU1g9l/0YBDI=
+golang.org/x/arch v0.22.0/go.mod h1:dNHoOeKiyja7GTvF9NJS1l3Z2yntpQNzgrjh1cU103A=
+golang.org/x/crypto v0.52.0 h1:RMs7fP2rXdep0CftQlK8Uf+kibLm7qkCcradZWYz988=
+golang.org/x/crypto v0.52.0/go.mod h1:1QgfPxDqh0T2M/elOJtp9RvuR95kVjir0e6/BvEmGbc=
+golang.org/x/net v0.54.0 h1:2zJIZAxAHV/OHCDTCOHAYehQzLfSXuf/5SoL/Dv6w/w=
+golang.org/x/net v0.54.0/go.mod h1:Sj4oj8jK6XmHpBZU/zWHw3BV3abl4Kvi+Ut7cQcY+cQ=
+golang.org/x/sync v0.20.0 h1:e0PTpb7pjO8GAtTs2dQ6jYa5BWYlMuX047Dco/pItO4=
+golang.org/x/sync v0.20.0/go.mod h1:9xrNwdLfx4jkKbNva9FpL6vEN7evnE43NNNJQ2LF3+0=
+golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.45.0 h1:dO4czNzziLiiXplLQgBCEpCvXQ3dnkn0SdaZSYdQ+FY=
+golang.org/x/sys v0.45.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
+golang.org/x/text v0.37.0 h1:Cqjiwd9eSg8e0QAkyCaQTNHFIIzWtidPahFWR83rTrc=
+golang.org/x/text v0.37.0/go.mod h1:a5sjxXGs9hsn/AJVwuElvCAo9v8QYLzvavO5z2PiM38=
+google.golang.org/protobuf v1.36.10 h1:AYd7cD/uASjIL6Q9LiTjz8JLcrh/88q5UObnmY3aOOE=
+google.golang.org/protobuf v1.36.10/go.mod h1:HTf+CrKn2C3g5S8VImy6tdcUvCska2kB7j23XfzDpco=
+gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
+gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
+gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
+gorm.io/driver/postgres v1.6.0 h1:2dxzU8xJ+ivvqTRph34QX+WrRaJlmfyPqXmoGVjMBa4=
+gorm.io/driver/postgres v1.6.0/go.mod h1:vUw0mrGgrTK+uPHEhAdV4sfFELrByKVGnaVRkXDhtWo=
+gorm.io/gorm v1.31.1 h1:7CA8FTFz/gRfgqgpeKIBcervUn3xSyPUmr6B2WXJ7kg=
+gorm.io/gorm v1.31.1/go.mod h1:XyQVbO2k6YkOis7C2437jSit3SsDK72s7n7rsSHd+Gs=

main.go

@@ -0,0 +1,210 @@
+package main
+
+import (
+	"log"
+	"net/http"
+
+	"service-warungpos-go/config"
+	"service-warungpos-go/controllers"
+	"service-warungpos-go/middleware"
+	"service-warungpos-go/models"
+
+	"github.com/gin-gonic/gin"
+)
+
+func main() {
+	log.Println("Starting WarungPOS Go Service...")
+
+	// 1. Muat Config
+	config.LoadConfig()
+
+	// 2. Koneksi Database Supabase
+	config.ConnectDatabase()
+
+	// 3. Auto-Migration GORM untuk kelancaran Supabase DB
+	log.Println("Running Auto-Migration...")
+	err := config.DB.AutoMigrate(
+		&models.Company{},
+		&models.Branch{},
+		&models.User{},
+		&models.Category{},
+		&models.Product{},
+		&models.BranchProduct{},
+		&models.Order{},
+		&models.OrderItem{},
+		&models.OTP{},
+	)
+	if err != nil {
+		log.Fatalf("Gagal melakukan Auto-Migration: %v", err)
+	}
+	log.Println("Auto-Migration Selesai dengan Sukses!")
+
+	// 4. Seeding super_admin default jika belum ada
+	controllers.SeedDefaultAdmin()
+
+	// 5. Tripay integration (No SDK init needed, we use plain HTTP Client!)
+
+	// 6. Router Setup menggunakan Gin
+	r := gin.New()
+
+	// Global Middlewares
+	r.Use(gin.Logger())
+	r.Use(gin.Recovery())
+	r.Use(middleware.CORSMiddleware())
+
+	// Health Checks & Health check root
+	r.GET("/", func(c *gin.Context) {
+		c.JSON(http.StatusOK, gin.H{
+			"service": "WarungPOS API (Go Version)",
+			"version": "1.0.0",
+			"status":  "running",
+			"docs":    "/docs",
+		})
+	})
+
+	r.GET("/health", func(c *gin.Context) {
+		c.JSON(http.StatusOK, gin.H{"status": "healthy"})
+	})
+
+	// API Routing Group
+	api := r.Group("/api")
+	{
+		// === AUTHENTICATION ROUTES ===
+		auth := api.Group("/auth")
+		{
+			auth.POST("/login", controllers.Login)
+			auth.POST("/register-tenant", controllers.RegisterTenant)
+			auth.POST("/verify-otp", controllers.VerifyOTP)
+			auth.POST("/resend-otp", controllers.ResendOTP)
+
+			// Authenticated Auth Routes
+			auth.Use(middleware.GetCurrentUser())
+			{
+				auth.GET("/me", controllers.GetMe)
+				auth.POST("/register", middleware.RequireSuperAdmin(), controllers.Register)
+				auth.GET("/users", middleware.RequireSuperAdmin(), controllers.ListUsers)
+				auth.PUT("/users/:user_id", middleware.RequireSuperAdmin(), controllers.UpdateUser)
+
+				// Owner routes for kasir
+				auth.GET("/kasir", middleware.RequireOwner(), controllers.ListKasir)
+				auth.POST("/kasir", middleware.RequireOwner(), controllers.CreateKasir)
+				auth.PUT("/kasir/:user_id", middleware.RequireOwner(), controllers.UpdateKasir)
+			}
+		}
+
+		// === COMPANY & BRANCH ROUTES ===
+		companies := api.Group("/companies")
+		{
+			companies.Use(middleware.GetCurrentUser())
+			{
+				companies.GET("/me", controllers.GetMyCompany)
+				companies.GET("/", middleware.RequireSuperAdmin(), controllers.ListCompanies)
+				companies.GET("/:company_id", middleware.RequireSuperAdmin(), controllers.GetCompany)
+				companies.POST("/", middleware.RequireSuperAdmin(), controllers.CreateCompany)
+				companies.PUT("/:company_id", middleware.RequireSuperAdmin(), controllers.UpdateCompany)
+				companies.PUT("/:company_id/toggle-active", middleware.RequireSuperAdmin(), controllers.ToggleActiveCompany)
+				companies.DELETE("/:company_id", middleware.RequireSuperAdmin(), controllers.DeleteCompany)
+				companies.PUT("/:company_id/reject", middleware.RequireSuperAdmin(), controllers.RejectCompany)
+				companies.PUT("/:company_id/approve", middleware.RequireSuperAdmin(), controllers.ApproveCompany)
+			}
+		}
+
+		branches := api.Group("/branches")
+		{
+			branches.Use(middleware.GetCurrentUser(), middleware.RequireOwner())
+			{
+				branches.GET("/", controllers.ListBranches)
+				branches.POST("/", controllers.CreateBranch)
+				branches.PUT("/:branch_id", controllers.UpdateBranch)
+				branches.DELETE("/:branch_id", controllers.DeleteBranch)
+				branches.PUT("/:branch_id/toggle", controllers.ToggleBranchStatus)
+				branches.GET("/:branch_id/products", controllers.GetBranchProducts)
+				branches.PUT("/:branch_id/products/:product_id", controllers.ToggleProductAvailability)
+			}
+		}
+
+		// === PRODUCTS & CATEGORIES ROUTES ===
+		products := api.Group("/products")
+		{
+			products.Use(middleware.GetCurrentUser())
+			{
+				products.POST("/upload-image", middleware.RequireOwner(), controllers.UploadProductImage)
+				products.GET("/", middleware.RequireTenantContext(), controllers.ListProducts)
+				products.GET("/:product_id", middleware.RequireTenantContext(), controllers.GetProduct)
+				products.POST("/", middleware.RequireOwner(), controllers.CreateProduct)
+				products.PUT("/:product_id", middleware.RequireOwner(), controllers.UpdateProduct)
+				products.DELETE("/:product_id", middleware.RequireOwner(), controllers.DeleteProduct)
+			}
+		}
+
+		categories := api.Group("/categories")
+		{
+			categories.Use(middleware.GetCurrentUser())
+			{
+				categories.GET("/", middleware.RequireTenantContext(), controllers.ListCategories)
+				categories.GET("/:category_id", middleware.RequireTenantContext(), controllers.GetCategory)
+				categories.POST("/", middleware.RequireOwner(), controllers.CreateCategory)
+				categories.PUT("/:category_id", middleware.RequireOwner(), controllers.UpdateCategory)
+				categories.DELETE("/:category_id", middleware.RequireOwner(), controllers.DeleteCategory)
+			}
+		}
+
+		// === ORDERS ROUTES ===
+		orders := api.Group("/orders")
+		{
+			orders.Use(middleware.GetCurrentUser(), middleware.RequireTenantContext())
+			{
+				orders.POST("/", controllers.CreateOrder)
+				orders.GET("/", controllers.ListOrders)
+				orders.GET("/:order_id", controllers.GetOrder)
+			}
+		}
+
+		// === PAYMENTS ROUTES ===
+		payments := api.Group("/payments")
+		{
+			// Webhook Tripay harus publik agar server Tripay bisa mengirim callbacks
+			payments.POST("/webhook", controllers.TripayWebhook)
+
+			payments.Use(middleware.GetCurrentUser(), middleware.RequireTenantContext())
+			{
+				payments.POST("/cash", controllers.PayCash)
+				payments.POST("/midtrans", controllers.PayTripay) // Keep /midtrans for backwards compatibility with front-end
+				payments.POST("/tripay", controllers.PayTripay)   // Also expose /tripay natively
+				payments.GET("/:order_id/status", controllers.GetPaymentStatus)
+				payments.POST("/:order_id/cancel", controllers.CancelMidtransOrder)
+			}
+		}
+
+		// === REPORTS ROUTES ===
+		reports := api.Group("/reports")
+		{
+			reports.Use(middleware.GetCurrentUser(), middleware.RequireTenantContext())
+			{
+				reports.GET("/daily", controllers.DailyReport)
+				reports.GET("/summary", controllers.SummaryReport)
+			}
+		}
+
+		// === FEES (SUPER ADMIN ONLY) ROUTES ===
+		fees := api.Group("/fees")
+		{
+			fees.Use(middleware.GetCurrentUser(), middleware.RequireSuperAdmin())
+			{
+				fees.GET("/report", controllers.GetFeeReport)
+				fees.PUT("/companies/:company_id/set-fee", controllers.SetCompanyFee)
+			}
+		}
+	}
+
+	// 7. Mulai Server (Membaca dinamis port Hugging Face Spaces jika ada)
+	serverPort := config.GlobalConfig.Port
+	if serverPort == "" {
+		serverPort = "8003"
+	}
+
+	log.Printf("WarungPOS Go Server berjalan di port: %s", serverPort)
+	if err := r.Run(":" + serverPort); err != nil {
+		log.Fatalf("Gagal menjalankan server Gin: %v", err)
+	}
+}

middleware/auth.go

@@ -0,0 +1,189 @@
+package middleware
+
+import (
+	"errors"
+	"fmt"
+	"net/http"
+	"strings"
+	"time"
+
+	"service-warungpos-go/config"
+	"service-warungpos-go/models"
+
+	"github.com/gin-gonic/gin"
+	"github.com/golang-jwt/jwt/v5"
+	"golang.org/x/crypto/bcrypt"
+)
+
+type JWTClaims struct {
+	Sub       uint   `json:"sub"`
+	Role      string `json:"role"`
+	CompanyID *uint  `json:"company_id"`
+	jwt.RegisteredClaims
+}
+
+// Security Helpers
+func HashPassword(password string) (string, error) {
+	bytes, err := bcrypt.GenerateFromPassword([]byte(password), bcrypt.DefaultCost)
+	return string(bytes), err
+}
+
+func VerifyPassword(password, hash string) bool {
+	err := bcrypt.CompareHashAndPassword([]byte(hash), []byte(password))
+	return err == nil
+}
+
+func CreateAccessToken(userID uint, role string, companyID *uint) (string, error) {
+	expiryHours := config.GlobalConfig.JWTExpiryHours
+	if expiryHours == 0 {
+		expiryHours = 24
+	}
+
+	claims := JWTClaims{
+		Sub:       userID,
+		Role:      role,
+		CompanyID: companyID,
+		RegisteredClaims: jwt.RegisteredClaims{
+			ExpiresAt: jwt.NewNumericDate(time.Now().Add(time.Duration(expiryHours) * time.Hour)),
+			IssuedAt:  jwt.NewNumericDate(time.Now()),
+		},
+	}
+
+	token := jwt.NewWithClaims(jwt.SigningMethodHS256, claims)
+	return token.SignedString([]byte(config.GlobalConfig.JWTSecretKey))
+}
+
+func ParseToken(tokenString string) (*JWTClaims, error) {
+	token, err := jwt.ParseWithClaims(tokenString, &JWTClaims{}, func(token *jwt.Token) (interface{}, error) {
+		if _, ok := token.Method.(*jwt.SigningMethodHMAC); !ok {
+			return nil, fmt.Errorf("unexpected signing method: %v", token.Header["alg"])
+		}
+		return []byte(config.GlobalConfig.JWTSecretKey), nil
+	})
+
+	if err != nil {
+		return nil, err
+	}
+
+	if claims, ok := token.Claims.(*JWTClaims); ok && token.Valid {
+		return claims, nil
+	}
+
+	return nil, errors.New("invalid token claims")
+}
+
+// Gin Middlewares
+func GetCurrentUser() gin.HandlerFunc {
+	return func(c *gin.Context) {
+		authHeader := c.GetHeader("Authorization")
+		if authHeader == "" {
+			c.JSON(http.StatusUnauthorized, gin.H{"detail": "Token otorisasi diperlukan"})
+			c.Abort()
+			return
+		}
+
+		parts := strings.Split(authHeader, " ")
+		if len(parts) != 2 || parts[0] != "Bearer" {
+			c.JSON(http.StatusUnauthorized, gin.H{"detail": "Format token otorisasi salah"})
+			c.Abort()
+			return
+		}
+
+		tokenString := parts[1]
+		claims, err := ParseToken(tokenString)
+		if err != nil {
+			c.JSON(http.StatusUnauthorized, gin.H{"detail": fmt.Sprintf("Token error: %v", err)})
+			c.Abort()
+			return
+		}
+
+		var user models.User
+		if err := config.DB.Preload("Company").Preload("Branch").First(&user, claims.Sub).Error; err != nil {
+			c.JSON(http.StatusUnauthorized, gin.H{"detail": "User tidak ditemukan"})
+			c.Abort()
+			return
+		}
+
+		if !user.IsActive {
+			c.JSON(http.StatusForbidden, gin.H{"detail": "Akun Anda dinonaktifkan. Hubungi Administrator."})
+			c.Abort()
+			return
+		}
+
+		// Simpan user ke context Gin
+		c.Set("user", &user)
+		c.Next()
+	}
+}
+
+func RequireSuperAdmin() gin.HandlerFunc {
+	return func(c *gin.Context) {
+		userVal, exists := c.Get("user")
+		if !exists {
+			c.JSON(http.StatusUnauthorized, gin.H{"detail": "Hubungan otorisasi gagal"})
+			c.Abort()
+			return
+		}
+
+		user := userVal.(*models.User)
+		if user.Role != "super_admin" {
+			c.JSON(http.StatusForbidden, gin.H{"detail": "Akses ditolak: Hanya super_admin yang memiliki izin."})
+			c.Abort()
+			return
+		}
+
+		c.Next()
+	}
+}
+
+func RequireOwner() gin.HandlerFunc {
+	return func(c *gin.Context) {
+		userVal, exists := c.Get("user")
+		if !exists {
+			c.JSON(http.StatusUnauthorized, gin.H{"detail": "Hubungan otorisasi gagal"})
+			c.Abort()
+			return
+		}
+
+		user := userVal.(*models.User)
+		if user.Role != "owner" && user.Role != "super_admin" { // Super admin biasakan lolos untuk CRUD company
+			c.JSON(http.StatusForbidden, gin.H{"detail": "Akses ditolak: Hanya owner yang memiliki izin."})
+			c.Abort()
+			return
+		}
+
+		c.Next()
+	}
+}
+
+func RequireTenantContext() gin.HandlerFunc {
+	return func(c *gin.Context) {
+		userVal, exists := c.Get("user")
+		if !exists {
+			c.JSON(http.StatusUnauthorized, gin.H{"detail": "Hubungan otorisasi gagal"})
+			c.Abort()
+			return
+		}
+
+		user := userVal.(*models.User)
+		if user.CompanyID == nil {
+			c.JSON(http.StatusForbidden, gin.H{"detail": "Akses ditolak: User tidak terikat ke perusahaan/toko manapun."})
+			c.Abort()
+			return
+		}
+
+		c.Next()
+	}
+}
+
+func RequireAuthenticated() gin.HandlerFunc {
+	return func(c *gin.Context) {
+		_, exists := c.Get("user")
+		if !exists {
+			c.JSON(http.StatusUnauthorized, gin.H{"detail": "Hubungan otorisasi gagal"})
+			c.Abort()
+			return
+		}
+		c.Next()
+	}
+}

middleware/cors.go

@@ -0,0 +1,21 @@
+package middleware
+
+import (
+	"github.com/gin-gonic/gin"
+)
+
+func CORSMiddleware() gin.HandlerFunc {
+	return func(c *gin.Context) {
+		c.Writer.Header().Set("Access-Control-Allow-Origin", "*")
+		c.Writer.Header().Set("Access-Control-Allow-Credentials", "true")
+		c.Writer.Header().Set("Access-Control-Allow-Headers", "Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, accept, origin, Cache-Control, X-Requested-With")
+		c.Writer.Header().Set("Access-Control-Allow-Methods", "POST, OPTIONS, GET, PUT, DELETE")
+
+		if c.Request.Method == "OPTIONS" {
+			c.AbortWithStatus(204)
+			return
+		}
+
+		c.Next()
+	}
+}

models/models.go

@@ -0,0 +1,129 @@
+package models
+
+import (
+	"time"
+)
+
+type Company struct {
+	ID                uint           `gorm:"primaryKey" json:"id"`
+	Name              string         `gorm:"type:varchar(100);not null" json:"name"`
+	BankAccountNumber string         `gorm:"type:varchar(50)" json:"bank_account_number"`
+	BankName          string         `gorm:"type:varchar(100)" json:"bank_name"`
+	Address           string         `gorm:"type:varchar(255)" json:"address"`
+	Email             string         `gorm:"type:varchar(100)" json:"email"`
+	Phone             string         `gorm:"type:varchar(20)" json:"phone"`
+	LogoURL           string         `gorm:"type:varchar(255)" json:"logo_url"`
+	IsActive          bool           `gorm:"default:true" json:"is_active"`
+	FeePercentage     float64        `gorm:"type:float;default:0.0;not null" json:"fee_percentage"`
+	ApprovedAt        *time.Time     `json:"approved_at"`
+	CreatedAt         time.Time      `gorm:"autoCreateTime" json:"created_at"`
+	Branches          []Branch       `gorm:"foreignKey:CompanyID;constraint:OnDelete:CASCADE" json:"-"`
+	Users             []User         `gorm:"foreignKey:CompanyID;constraint:OnDelete:CASCADE" json:"-"`
+	Categories        []Category     `gorm:"foreignKey:CompanyID;constraint:OnDelete:CASCADE" json:"-"`
+	Products          []Product      `gorm:"foreignKey:CompanyID;constraint:OnDelete:CASCADE" json:"-"`
+	Orders            []Order        `gorm:"foreignKey:CompanyID;constraint:OnDelete:CASCADE" json:"-"`
+}
+
+type Branch struct {
+	ID             uint            `gorm:"primaryKey" json:"id"`
+	CompanyID      uint            `gorm:"not null;index" json:"company_id"`
+	Name           string          `gorm:"type:varchar(100);not null" json:"name"`
+	Address        string          `gorm:"type:varchar(255)" json:"address"`
+	Phone          string          `gorm:"type:varchar(20)" json:"phone"`
+	IsActive       bool            `gorm:"default:true" json:"is_active"`
+	CreatedAt      time.Time       `gorm:"autoCreateTime" json:"created_at"`
+	Company        *Company        `gorm:"foreignKey:CompanyID" json:"company,omitempty"`
+	Users          []User          `gorm:"foreignKey:BranchID;constraint:OnDelete:SET NULL" json:"-"`
+	Orders         []Order         `gorm:"foreignKey:BranchID;constraint:OnDelete:SET NULL" json:"-"`
+	BranchProducts []BranchProduct `gorm:"foreignKey:BranchID;constraint:OnDelete:CASCADE" json:"-"`
+}
+
+type User struct {
+	ID        uint      `gorm:"primaryKey" json:"id"`
+	Name      string    `gorm:"type:varchar(100);not null" json:"name"`
+	Email     string    `gorm:"type:varchar(100);uniqueIndex;not null" json:"email"`
+	Password  string    `gorm:"type:varchar(255);not null" json:"-"`
+	Phone     string    `gorm:"type:varchar(20)" json:"phone"`
+	Role      string    `gorm:"type:varchar(20);default:'kasir'" json:"role"` // "super_admin", "owner", "kasir"
+	CompanyID *uint     `json:"company_id"`
+	BranchID  *uint     `json:"branch_id"`
+	IsActive  bool      `gorm:"default:true" json:"is_active"`
+	CreatedAt time.Time `gorm:"autoCreateTime" json:"created_at"`
+	Company   *Company  `gorm:"foreignKey:CompanyID" json:"company,omitempty"`
+	Branch    *Branch   `gorm:"foreignKey:BranchID" json:"branch,omitempty"`
+}
+
+type Category struct {
+	ID          uint      `gorm:"primaryKey" json:"id"`
+	CompanyID   uint      `gorm:"not null" json:"company_id"`
+	Name        string    `gorm:"type:varchar(100);not null" json:"name"`
+	Description string    `gorm:"type:varchar(255)" json:"description"`
+	CreatedAt   time.Time `gorm:"autoCreateTime" json:"created_at"`
+	Company     *Company  `gorm:"foreignKey:CompanyID" json:"company,omitempty"`
+	Products    []Product `gorm:"foreignKey:CategoryID" json:"products,omitempty"`
+}
+
+type Product struct {
+	ID               uint            `gorm:"primaryKey" json:"id"`
+	CompanyID        uint            `gorm:"not null" json:"company_id"`
+	Name             string          `gorm:"type:varchar(200);not null" json:"name"`
+	SKU              *string         `gorm:"type:varchar(50);uniqueIndex" json:"sku"`
+	Price            int             `gorm:"not null" json:"price"`
+	Stock            int             `gorm:"not null;default:0" json:"stock"`
+	IsUnlimitedStock bool            `gorm:"default:false" json:"is_unlimited_stock"`
+	CategoryID       *uint           `json:"category_id"`
+	ImageURL         string          `gorm:"type:text" json:"image_url"`
+	IsActive         bool            `gorm:"default:true" json:"is_active"`
+	CreatedAt        time.Time       `gorm:"autoCreateTime" json:"created_at"`
+	UpdatedAt        time.Time       `gorm:"autoUpdateTime" json:"updated_at"`
+	Company          *Company        `gorm:"foreignKey:CompanyID" json:"company,omitempty"`
+	Category         *Category       `gorm:"foreignKey:CategoryID" json:"category,omitempty"`
+	BranchProducts   []BranchProduct `gorm:"foreignKey:ProductID;constraint:OnDelete:CASCADE" json:"-"`
+}
+
+type BranchProduct struct {
+	ID          uint    `gorm:"primaryKey" json:"id"`
+	BranchID    uint    `gorm:"uniqueIndex:uq_branch_product;not null" json:"branch_id"`
+	ProductID   uint    `gorm:"uniqueIndex:uq_branch_product;not null" json:"product_id"`
+	IsAvailable bool    `gorm:"default:true" json:"is_available"`
+	Branch      *Branch `gorm:"foreignKey:BranchID" json:"branch,omitempty"`
+	Product     *Product `gorm:"foreignKey:ProductID" json:"product,omitempty"`
+}
+
+type Order struct {
+	ID              uint        `gorm:"primaryKey" json:"id"`
+	CompanyID       uint        `gorm:"not null" json:"company_id"`
+	BranchID        *uint       `json:"branch_id"`
+	OrderNumber     string      `gorm:"type:varchar(50);not null;index" json:"order_number"`
+	TotalAmount     int         `gorm:"not null;default:0" json:"total_amount"`
+	PaidAmount      int         `gorm:"not null;default:0" json:"paid_amount"`
+	ChangeAmount    int         `gorm:"not null;default:0" json:"change_amount"`
+	PaymentMethod   string      `gorm:"type:varchar(20)" json:"payment_method"`
+	PaymentStatus   string      `gorm:"type:varchar(20);default:'pending'" json:"payment_status"` // pending, paid, failed, expired, refunded, cancelled
+	MidtransOrderID string      `gorm:"type:varchar(100)" json:"midtrans_order_id"`
+	MidtransToken   string      `gorm:"type:varchar(255)" json:"midtrans_token"`
+	PlatformFee     int         `gorm:"not null;default:0" json:"platform_fee"`
+	CreatedAt       time.Time   `gorm:"autoCreateTime" json:"created_at"`
+	Company         *Company    `gorm:"foreignKey:CompanyID" json:"company,omitempty"`
+	Branch          *Branch     `gorm:"foreignKey:BranchID" json:"branch,omitempty"`
+	Items           []OrderItem `gorm:"foreignKey:OrderID;constraint:OnDelete:CASCADE" json:"items"`
+}
+
+type OrderItem struct {
+	ID        uint     `gorm:"primaryKey" json:"id"`
+	OrderID   uint     `gorm:"not null" json:"order_id"`
+	ProductID uint     `gorm:"not null" json:"product_id"`
+	Quantity  int      `gorm:"not null;default:1" json:"quantity"`
+	UnitPrice int      `gorm:"not null" json:"unit_price"`
+	Subtotal  int      `gorm:"not null" json:"subtotal"`
+	Product   *Product `gorm:"foreignKey:ProductID" json:"product,omitempty"`
+}
+
+type OTP struct {
+	ID          uint      `gorm:"primaryKey" json:"id"`
+	PhoneNumber string    `gorm:"type:varchar(20);not null;index" json:"phone_number"`
+	OTPCode     string    `gorm:"type:varchar(10);not null" json:"otp_code"`
+	IsVerified  bool      `gorm:"default:false" json:"is_verified"`
+	CreatedAt   time.Time `gorm:"autoCreateTime" json:"created_at"`
+	ExpiresAt   time.Time `gorm:"not null" json:"expires_at"`
+}

services/cloudinary.go

@@ -0,0 +1,81 @@
+package services
+
+import (
+	"bytes"
+	"context"
+	"fmt"
+	"image"
+	"image/jpeg"
+	_ "image/png" // Support PNG decoding
+	"io"
+	"log"
+	"mime/multipart"
+	"service-warungpos-go/config"
+
+	"github.com/cloudinary/cloudinary-go/v2"
+	"github.com/cloudinary/cloudinary-go/v2/api/uploader"
+)
+
+// UploadToCloudinary mengompresi gambar dan mengunggahnya ke Cloudinary
+func UploadToCloudinary(fileHeader *multipart.FileHeader) (string, error) {
+	// Buka file dari fileHeader
+	file, err := fileHeader.Open()
+	if err != nil {
+		return "", fmt.Errorf("gagal membuka file: %v", err)
+	}
+	defer file.Close()
+
+	// Baca seluruh bytes file
+	contents, err := io.ReadAll(file)
+	if err != nil {
+		return "", fmt.Errorf("gagal membaca file: %v", err)
+	}
+
+	// Kompresi gambar ke JPEG dengan quality 75
+	compressedBytes, err := compressImage(contents)
+	if err != nil {
+		log.Printf("[CLOUDINARY] Gagal kompresi, menggunakan file asli: %v", err)
+		compressedBytes = contents
+	}
+
+	// Inisialisasi Cloudinary dari parameter config
+	cld, err := cloudinary.NewFromParams(
+		config.GlobalConfig.CloudinaryAPIKey,
+		config.GlobalConfig.CloudinaryAPISecret,
+		config.GlobalConfig.CloudinaryCloudName,
+	)
+	if err != nil {
+		return "", fmt.Errorf("gagal inisialisasi Cloudinary: %v", err)
+	}
+
+	ctx := context.Background()
+
+	// Gunakan Reader dari compressedBytes untuk upload
+	resp, err := cld.Upload.Upload(ctx, bytes.NewReader(compressedBytes), uploader.UploadParams{
+		Folder: "warungpos/products",
+	})
+	if err != nil {
+		return "", fmt.Errorf("gagal upload ke Cloudinary: %v", err)
+	}
+
+	log.Printf("[CLOUDINARY] Upload sukses! URL: %s", resp.SecureURL)
+	return resp.SecureURL, nil
+}
+
+// compressImage mengompresi gambar ke JPEG (kualitas 75)
+func compressImage(imgBytes []byte) ([]byte, error) {
+	// Decode gambar (mendukung JPEG/PNG/WebP jika didaftarkan)
+	img, _, err := image.Decode(bytes.NewReader(imgBytes))
+	if err != nil {
+		return nil, err
+	}
+
+	// Encode ulang sebagai JPEG dengan kualitas 75
+	var buf bytes.Buffer
+	err = jpeg.Encode(&buf, img, &jpeg.Options{Quality: 75})
+	if err != nil {
+		return nil, err
+	}
+
+	return buf.Bytes(), nil
+}

services/tripay.go

@@ -0,0 +1,170 @@
+package services
+
+import (
+	"bytes"
+	"crypto/hmac"
+	"crypto/sha256"
+	"encoding/hex"
+	"encoding/json"
+	"fmt"
+	"io"
+	"log"
+	"net/http"
+	"time"
+
+	"service-warungpos-go/config"
+)
+
+type TripayItem struct {
+	SKU      string `json:"sku"`
+	Name     string `json:"name"`
+	Price    int    `json:"price"`
+	Quantity int    `json:"quantity"`
+}
+
+type TripayCreateRequest struct {
+	Method        string       `json:"method"`
+	MerchantRef   string       `json:"merchant_ref"`
+	Amount        int          `json:"amount"`
+	CustomerName  string       `json:"customer_name"`
+	CustomerEmail string       `json:"customer_email"`
+	CustomerPhone string       `json:"customer_phone"`
+	OrderItems    []TripayItem `json:"order_items"`
+	Signature     string       `json:"signature"`
+}
+
+type TripayCreateResponse struct {
+	Success bool   `json:"success"`
+	Message string `json:"message"`
+	Data    struct {
+		Reference     string `json:"reference"`
+		MerchantRef   string `json:"merchant_ref"`
+		PaymentMethod string `json:"payment_method"`
+		PaymentName   string `json:"payment_name"`
+		Amount        int    `json:"amount"`
+		TotalAmount   int    `json:"total_amount"`
+		CheckoutURL   string `json:"checkout_url"`
+		QrURL         string `json:"qr_url"`     // Untuk QRIS
+		QrString      string `json:"qr_string"`  // Untuk QRIS string raw
+		PaymentCode   string `json:"payment_code"` // Untuk VA / Retail Outlet
+		Status        string `json:"status"` // UNPAID, PAID, EXPIRED, FAILED
+	} `json:"data"`
+}
+
+func getTripayBaseURL() string {
+	if config.GlobalConfig.TripayIsProduction {
+		return "https://tripay.co.id/api"
+	}
+	return "https://tripay.co.id/api-sandbox"
+}
+
+// CalculateSignature menghitung signature HMAC-SHA256 untuk request transaksi ke Tripay
+func CalculateSignature(merchantRef string, amount int) string {
+	merchantCode := config.GlobalConfig.TripayMerchantCode
+	privateKey := config.GlobalConfig.TripayPrivateKey
+
+	// Format: merchant_code + merchant_ref + amount
+	data := merchantCode + merchantRef + fmt.Sprintf("%d", amount)
+
+	h := hmac.New(sha256.New, []byte(privateKey))
+	h.Write([]byte(data))
+	return hex.EncodeToString(h.Sum(nil))
+}
+
+// CreateTripayTransaction membuat tagihan pembayaran nontunai baru di Tripay
+func CreateTripayTransaction(
+	orderNumber string,
+	amount int,
+	paymentMethod string,
+	customerName string,
+	customerEmail string,
+	customerPhone string,
+	items []TripayItem,
+) (*TripayCreateResponse, error) {
+	// Fallback input default
+	if paymentMethod == "" {
+		paymentMethod = "QRIS" // Default ke QRIS yang paling populer
+	}
+	if customerName == "" {
+		customerName = "Customer"
+	}
+	if customerEmail == "" {
+		customerEmail = "customer@mail.com"
+	}
+	if customerPhone == "" {
+		customerPhone = "081234567890"
+	}
+
+	// Hitung signature
+	signature := CalculateSignature(orderNumber, amount)
+
+	// Persiapkan payload request
+	payload := TripayCreateRequest{
+		Method:        paymentMethod,
+		MerchantRef:   orderNumber,
+		Amount:        amount,
+		CustomerName:  customerName,
+		CustomerEmail: customerEmail,
+		CustomerPhone: customerPhone,
+		OrderItems:    items,
+		Signature:     signature,
+	}
+
+	jsonBytes, err := json.Marshal(payload)
+	if err != nil {
+		return nil, fmt.Errorf("gagal merancang payload Tripay: %v", err)
+	}
+
+	apiURL := getTripayBaseURL() + "/transaction/create"
+	log.Printf("[TRIPAY] Mengirim request tagihan ke: %s", apiURL)
+
+	client := &http.Client{Timeout: 15 * time.Second}
+	req, err := http.NewRequest("POST", apiURL, bytes.NewBuffer(jsonBytes))
+	if err != nil {
+		return nil, fmt.Errorf("gagal membuat http request: %v", err)
+	}
+
+	// Atur headers
+	req.Header.Set("Content-Type", "application/json")
+	req.Header.Set("Authorization", "Bearer "+config.GlobalConfig.TripayAPIKey)
+
+	resp, err := client.Do(req)
+	if err != nil {
+		return nil, fmt.Errorf("koneksi HTTP ke Tripay gagal: %v", err)
+	}
+	defer resp.Body.Close()
+
+	bodyBytes, err := io.ReadAll(resp.Body)
+	if err != nil {
+		return nil, fmt.Errorf("gagal membaca response body Tripay: %v", err)
+	}
+
+	if resp.StatusCode != http.StatusOK && resp.StatusCode != http.StatusCreated {
+		log.Printf("[TRIPAY] Response error: Status=%d, Body=%s", resp.StatusCode, string(bodyBytes))
+		return nil, fmt.Errorf("tripay mengembalikan status error %d", resp.StatusCode)
+	}
+
+	var tripayResp TripayCreateResponse
+	if err := json.Unmarshal(bodyBytes, &tripayResp); err != nil {
+		return nil, fmt.Errorf("gagal parse JSON response Tripay: %v", err)
+	}
+
+	if !tripayResp.Success {
+		return nil, fmt.Errorf("tripay gagal memproses: %s", tripayResp.Message)
+	}
+
+	log.Printf("[TRIPAY] Sukses membuat transaksi! Ref=%s, URL=%s", tripayResp.Data.Reference, tripayResp.Data.CheckoutURL)
+	return &tripayResp, nil
+}
+
+// VerifyTripaySignature memvalidasi keaslian callback webhook dari Tripay
+func VerifyTripaySignature(rawJSONBody []byte, receivedSignature string) bool {
+	privateKey := config.GlobalConfig.TripayPrivateKey
+
+	// Tripay Webhook Signature: HMAC-SHA256 dari raw JSON request body menggunakan Private Key
+	h := hmac.New(sha256.New, []byte(privateKey))
+	h.Write(rawJSONBody)
+	expectedSignature := hex.EncodeToString(h.Sum(nil))
+
+	return hmac.Equal([]byte(receivedSignature), []byte(expectedSignature))
+}

services/whatsapp.go

@@ -0,0 +1,214 @@
+package services
+
+import (
+	"bytes"
+	"encoding/json"
+	"fmt"
+	"io"
+	"log"
+	"net/http"
+	"net/url"
+	"strings"
+	"time"
+
+	"service-warungpos-go/config"
+)
+
+const FonnteAPIURL = "https://api.fonnte.com/send"
+
+func formatPhone(phone string) string {
+	phone = strings.TrimSpace(phone)
+	phone = strings.ReplaceAll(phone, " ", "")
+	phone = strings.ReplaceAll(phone, "-", "")
+
+	if strings.HasPrefix(phone, "0") {
+		phone = "62" + phone[1:]
+	} else if strings.HasPrefix(phone, "+") {
+		phone = phone[1:]
+	}
+	return phone
+}
+
+func fmtRupiah(amount int) string {
+	// Format ribuan dengan titik (contoh: 15000 menjadi Rp 15.000)
+	str := fmt.Sprintf("%d", amount)
+	var result []string
+	length := len(str)
+	for i := length; i > 0; i -= 3 {
+		start := i - 3
+		if start < 0 {
+			start = 0
+		}
+		result = append([]string{str[start:i]}, result...)
+	}
+	return "Rp " + strings.Join(result, ".")
+}
+
+func divider(char string, length int) string {
+	return strings.Repeat(char, length)
+}
+
+type WAItem struct {
+	Name     string `json:"name"`
+	Quantity int    `json:"quantity"`
+	Price    int    `json:"price"`
+}
+
+func SendPaymentNotification(
+	phone string,
+	orderNumber string,
+	totalAmount int,
+	paymentMethod string,
+	customerName string,
+	items []WAItem,
+	changeAmount int,
+	storeName string,
+	branchName string,
+) bool {
+	if config.GlobalConfig.FonnteToken == "" {
+		log.Println("[WHATSAPP] Token Fonnte tidak dikonfigurasi, lewati kirim WhatsApp")
+		return false
+	}
+
+	if phone == "" {
+		log.Println("[WHATSAPP] Nomor telepon customer kosong, lewati kirim WhatsApp")
+		return false
+	}
+
+	formattedPhone := formatPhone(phone)
+	baseStore := storeName
+	if baseStore == "" {
+		baseStore = config.GlobalConfig.StoreName
+	}
+	if baseStore == "" {
+		baseStore = "WarungPOS"
+	}
+
+	displayName := baseStore
+	if branchName != "" {
+		displayName = baseStore + " - " + branchName
+	}
+
+	methodLabel := "Nontunai"
+	if paymentMethod == "cash" {
+		methodLabel = "Tunai (Cash)"
+	}
+
+	// Buat isi pesan
+	var lines []string
+	lines = append(lines, "*"+displayName+"*")
+	lines = append(lines, "_Struk Pembayaran_")
+	lines = append(lines, divider("-", 30))
+
+	lines = append(lines, fmt.Sprintf("No. Order  : ```%s```", orderNumber))
+	lines = append(lines, fmt.Sprintf("Customer   : %s", customerName))
+	lines = append(lines, fmt.Sprintf("Metode     : %s", methodLabel))
+	lines = append(lines, divider("-", 30))
+
+	if len(items) > 0 {
+		lines = append(lines, "*Daftar Pesanan*")
+		for _, item := range items {
+			subtotal := item.Price * item.Quantity
+			lines = append(lines, fmt.Sprintf("  %s x%d", item.Name, item.Quantity))
+			lines = append(lines, fmt.Sprintf("    %20s", fmtRupiah(subtotal)))
+		}
+		lines = append(lines, divider("-", 30))
+	}
+
+	lines = append(lines, fmt.Sprintf("*Total      : %s*", fmtRupiah(totalAmount)))
+
+	if paymentMethod == "cash" {
+		lines = append(lines, fmt.Sprintf("Dibayar    : %s", fmtRupiah(totalAmount+changeAmount)))
+		lines = append(lines, fmt.Sprintf("*Kembalian  : %s*", fmtRupiah(changeAmount)))
+	}
+
+	lines = append(lines, divider("-", 30))
+	lines = append(lines, fmt.Sprintf("_Terima kasih telah berbelanja di %s._", displayName))
+
+	message := strings.Join(lines, "\n")
+
+	return postFonnte(formattedPhone, message)
+}
+
+func SendOtpWa(phone string, otpCode string) bool {
+	if config.GlobalConfig.FonnteToken == "" {
+		return false
+	}
+
+	formattedPhone := formatPhone(phone)
+	storeName := config.GlobalConfig.StoreName
+	if storeName == "" {
+		storeName = "WarungPOS SaaS"
+	}
+
+	message := fmt.Sprintf("*%s*\n\nKode OTP Registrasi Anda adalah:\n*%s*\n\nKode ini berlaku selama 5 menit. Jangan berikan kode ini kepada siapa pun.", storeName, otpCode)
+
+	return postFonnte(formattedPhone, message)
+}
+
+func SendApprovalWa(phone string, storeName string, email string) bool {
+	if config.GlobalConfig.FonnteToken == "" || phone == "" {
+		return false
+	}
+
+	formattedPhone := formatPhone(phone)
+	message := fmt.Sprintf("✅ *SELAMAT! AKUN ANDA TELAH DISETUJUI*\n\nPerusahaan/Toko *%s* sudah diaktifkan!\nAnda dapat mencoba login ke Dashboard Kasir sekarang menggunakan email:\n_%s_\n\nSukses Selalu,\nTim Pengelola WarungPOS SaaS.", storeName, email)
+
+	return postFonnte(formattedPhone, message)
+}
+
+func postFonnte(target string, message string) bool {
+	// Gunakan http client bawaan Go dengan timeout 15 detik
+	client := &http.Client{Timeout: 15 * time.Second}
+
+	// Payload dikirim sebagai form url encoded
+	data := url.Values{}
+	data.Set("target", target)
+	data.Set("message", message)
+	data.Set("countryCode", "62")
+
+	req, err := http.NewRequest("POST", FonnteAPIURL, bytes.NewBufferString(data.Encode()))
+	if err != nil {
+		log.Printf("[WHATSAPP] Gagal membuat request Fonnte: %v", err)
+		return false
+	}
+
+	req.Header.Set("Authorization", config.GlobalConfig.FonnteToken)
+	req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
+
+	resp, err := client.Do(req)
+	if err != nil {
+		log.Printf("[WHATSAPP] Error kirim Fonnte: %v", err)
+		return false
+	}
+	defer resp.Body.Close()
+
+	bodyBytes, err := io.ReadAll(resp.Body)
+	if err != nil {
+		log.Printf("[WHATSAPP] Gagal membaca response Fonnte: %v", err)
+		return false
+	}
+
+	var responseData map[string]interface{}
+	if err := json.Unmarshal(bodyBytes, &responseData); err != nil {
+		log.Printf("[WHATSAPP] Gagal parse JSON Fonnte: %v", err)
+		return false
+	}
+
+	status, ok := responseData["status"].(bool)
+	if ok && status {
+		log.Printf("[WHATSAPP] Notification terkirim ke target %s", maskPhone(target))
+		return true
+	}
+
+	reason := responseData["reason"]
+	log.Printf("[WHATSAPP] Fonnte gagal mengirim: %v", reason)
+	return false
+}
+
+func maskPhone(phone string) string {
+	if len(phone) <= 6 {
+		return phone
+	}
+	return phone[:4] + "****" + phone[len(phone)-2:]
+}