Feature/bsas integration (#24)

Reviewed-on: #24
Co-authored-by: ISMAIL MASSERAN <ismail@koppkb.com>
Co-committed-by: ISMAIL MASSERAN <ismail@koppkb.com>

.env.docker

@@ -68,4 +68,15 @@ KAUNTER_URL=http://host.docker.internal:8081
 INTERNAL_NOTIFICATION_SECRET=erahn-local-notification-secret
 
 CACHE_DRIVER=file
-QUEUE_CONNECTION=sync
+QUEUE_CONNECTION=sync
+
+BSAS_BASE_URL=https://bsasdevapi.bursamalaysia.com/api
+BSAS_TOKEN_URL=https://bsasdevapi.bursamalaysia.com/oauth/token
+BSAS_CLIENT_ID=
+BSAS_CLIENT_SECRET=
+BSAS_MEMBER_SHORT_NAME=KOOPPKB
+BSAS_PRODUCT_CODE=CPO-MSIA-09
+BSAS_TENOR=00088
+BSAS_MAX_WAIT_TIME=10
+BSAS_HTTP_TIMEOUT=30
+BSAS_ORDER_RESULT_RETRIES=2

.env.example

@@ -107,4 +107,15 @@ WHATSAPP_TEMPLATE=hello_world
 WHATSAPP_TEMPLATE_LANG=en_US
 WHATSAPP_VERIFY_TOKEN= # webhook verify token
 WHATSAPP_APP_SECRET= # X-Hub-Signature-256 checks; need to be enable first
-ADMIN_PHONE_NUMBER=60193450165
+ADMIN_PHONE_NUMBER=60193450165
+
+BSAS_BASE_URL=https://bsasdevapi.bursamalaysia.com/api
+BSAS_TOKEN_URL=https://bsasdevapi.bursamalaysia.com/oauth/token
+BSAS_CLIENT_ID=
+BSAS_CLIENT_SECRET=
+BSAS_MEMBER_SHORT_NAME=KOOPPKB
+BSAS_PRODUCT_CODE=CPO-MSIA-09
+BSAS_TENOR=00088
+BSAS_MAX_WAIT_TIME=10
+BSAS_HTTP_TIMEOUT=30
+BSAS_ORDER_RESULT_RETRIES=2

app/BsasOrder.php

@@ -0,0 +1,44 @@
+<?php
+
+namespace App;
+
+use Illuminate\Database\Eloquent\Model;
+
+class BsasOrder extends Model
+{
+    protected $connection = 'mysql7';
+    protected $table = 'bsas_orders';
+
+    protected $fillable = [
+        'uuid',
+        'norujukan',
+        'kodcaw',
+        'serial_number',
+        'product_code',
+        'bid_value',
+        'otc_murabaha_value',
+        'otc_counter_party',
+        'status',
+        'status_code',
+        'status_message',
+        'e_cert_no',
+        'bid_ecert_response',
+        'otc_ecert_response',
+        'stb_ecert_response',
+        'request_payload',
+        'order_response',
+        'result_response',
+        'created_by',
+    ];
+
+    protected $casts = [
+        'bid_value' => 'decimal:2',
+        'otc_murabaha_value' => 'decimal:2',
+        'request_payload' => 'array',
+        'order_response' => 'array',
+        'result_response' => 'array',
+        'bid_ecert_response' => 'array',
+        'otc_ecert_response' => 'array',
+        'stb_ecert_response' => 'array',
+    ];
+}

app/Http/Controllers/GadaiController.php

@@ -158,6 +158,7 @@ class GadaiController extends Controller
     }
 
     public function create($kodcaw,Request $request){
+
         $master = new MasterServices($kodcaw);
         $response = $master->createGadai($request);
 
@@ -227,14 +228,11 @@ class GadaiController extends Controller
     }
 
 
-    public function daftarGadaiMarhun($kodcaw, $norujukan, Request $request)
-    {
-        if (\App\ShorakaTransaction::where('norujukan', $norujukan)->exists()) {
-            abort(409, 'Kontrak telah dihantar ke Shoraka dan tidak boleh diubah.');
-        }
-        $request->merge(['kodcaw' => $kodcaw, 'norujukan' => $norujukan]);
-        $master = new MasterServices($kodcaw);
-        $response = $master->createMarhunGadai($norujukan, $request);
+    public function daftarGadaiMarhun($norujukan,Request $request){
+        // dd("ggwp");
+        $master = new MasterServices($request->kodcaw);
+        $response = $master->createMarhunGadai($request->norujukan,$request);
+
         return response()->json($response, 200);
     }
 
@@ -371,9 +369,6 @@ class GadaiController extends Controller
     }
 
     public function batalGadai($kodcaw, $norujukan,Request $request){
-        if (\App\ShorakaTransaction::where('norujukan', $norujukan)->exists()) {
-            abort(409, 'Transaksi Shoraka telah dihantar. Semakan operasi diperlukan sebelum pembatalan.');
-        }
 
         $current = Carbon::now();
         $current = new Carbon();
@@ -411,11 +406,6 @@ class GadaiController extends Controller
     }
 
     public function pembelianKomuditi($kodcaw,$norujukan){
-        if (\App\ShorakaTransaction::where('norujukan', $norujukan)->exists()
-            || !\App\KomuditiTransaksi::on('mysql7')->where('norujukan', $norujukan)->exists()) {
-            app(\App\Services\ShorakaGadaiService::class)->assertCompleted($kodcaw, $norujukan);
-        }
-
         $cawangan = Cawangan::on('mysql7')->where('kodcaw','=',$kodcaw)->first();
 
         $gadai = Gadai::on($cawangan['mysql'])
@@ -428,10 +418,6 @@ class GadaiController extends Controller
     }
 
     public function cetakSAG($kodcaw,$norujukan,Request $request){
-        if (\App\ShorakaTransaction::where('norujukan', $norujukan)->exists()) {
-            app(\App\Services\ShorakaGadaiService::class)->assertCompleted($kodcaw, $norujukan);
-        }
-
         $harini = Carbon::now();
 
         $cawangan = Cawangan::on('mysql7')->where('kodcaw','=',$kodcaw)->first();
@@ -456,10 +442,6 @@ class GadaiController extends Controller
     }
 
     public function serahMarhun($kodcaw,$norujukan){
-        if (\App\ShorakaTransaction::where('norujukan', $norujukan)->exists()) {
-            app(\App\Services\ShorakaGadaiService::class)->assertCompleted($kodcaw, $norujukan);
-        }
-
         $cawangan = Cawangan::on('mysql7')->where('kodcaw','=',$kodcaw)->first();
         $gadai = Gadai::on($cawangan['mysql'])
                 ->where('norujukan','=',$norujukan)

app/Http/Controllers/KomuditiController.php

@@ -3,15 +3,18 @@
 namespace App\Http\Controllers;
 
 use App\Audit;
+use App\BsasOrder;
 use App\Komuditi;
 use App\KomuditiPurchase;
 use App\KomuditiTransaksi;
 use App\KomuditiProduk;
 use App\Cawangan;
+use App\Services\Bsas\BsasOrderService;
 use DB;
 
 use Illuminate\Http\Request;
 use Carbon\Carbon;
+use Illuminate\Support\Facades\Log;
 
 class KomuditiController extends Controller
 {
@@ -117,9 +120,6 @@ class KomuditiController extends Controller
     }
 
     public function updateKomuditi(Request $request){
-        if (\App\ShorakaTransaction::where('norujukan', $request->norujukan)->exists()) {
-            abort(409, 'Transaksi Shoraka memerlukan semakan operasi; stok lama tidak boleh diubah.');
-        }
         $current = Carbon::now();
         $current = new Carbon();
 
@@ -141,20 +141,37 @@ class KomuditiController extends Controller
         return response()->json($komuditi_transaksi);
     }
 
-    public function transaksiKomuditi(Request $request)
-    {
-        $this->validate($request, ['kodcaw' => 'required|string', 'norujukan' => 'required|string']);
-        return app(ShorakaGadaiController::class)->submitGadai(
-            $request->kodcaw, $request->norujukan,
-            app(\App\Services\ShorakaGadaiService::class),
-            app(\App\Services\ShorakaService::class)
-        );
+    public function transaksiKomuditi(Request $request){
+        $current = Carbon::now();
+        $current = new Carbon();
+
+        $komuditi_current = KomuditiPurchase::on('mysql7')->where('date_purchase','=',$current->toDateString())->orderBy('created_at','desc')->first();
+
+        $unit_current = $komuditi_current['unit_komuditi'];
+        $update_unit = $unit_current - $request->unit_komuditi;
+
+        $unit_current = round((float) $komuditi_current['unit_komuditi'], 2);
+        $unit_komuditi = round((float) $request->unit_komuditi, 2);
+        $update_unit = round($unit_current - $unit_komuditi, 2);
+
+        $update_komuditi = KomuditiPurchase::on('mysql7')->where('id','=',$komuditi_current['id'])->update([
+            'unit_komuditi' => $update_unit
+        ]);
+
+        $komuditi_transaksi = KomuditiTransaksi::on('mysql7')->create([
+            'unit_komuditi' => $unit_komuditi,
+            'nosijil'=>$komuditi_current['no_sijil'],
+            'norujukan' => $request->norujukan,
+            'kodcaw' => $request->kodcaw ,
+            'teller' => $request->teller ,
+            'masa' => $current->toTimeString(),
+            'tarikh' => $current->toDateString()
+        ]);
+
+        return response()->json($komuditi_transaksi);
     }
 
     public function batalKomuditi(Request $request){
-        if (\App\ShorakaTransaction::where('norujukan', $request->norujukan)->exists()) {
-            abort(409, 'Transaksi Shoraka memerlukan semakan operasi; stok lama tidak boleh diubah.');
-        }
 
         $komuditi_current = KomuditiPurchase::on('mysql7')->orderBy('created_at','desc')->first();
 
@@ -324,4 +341,195 @@ class KomuditiController extends Controller
         return response()->json($rekodkomoditi);
     }
 
+    /**
+     * List BSAS commodity orders for operasi rekod view.
+     */
+    public function listBsasOrders(Request $request)
+    {
+        $query = BsasOrder::on('mysql7')
+            ->select([
+                'id',
+                'uuid',
+                'norujukan',
+                'kodcaw',
+                'serial_number',
+                'product_code',
+                'bid_value',
+                'otc_murabaha_value',
+                'otc_counter_party',
+                'status',
+                'status_code',
+                'status_message',
+                'e_cert_no',
+                'bid_ecert_response',
+                'otc_ecert_response',
+                'stb_ecert_response',
+                'created_by',
+                'created_at',
+                'updated_at',
+            ])
+            ->orderBy('created_at', 'desc')
+            ->orderBy('id', 'desc');
+
+        if ($request->filled('status')) {
+            $query->where('status', $request->input('status'));
+        }
+
+        if ($request->filled('kodcaw')) {
+            $query->where('kodcaw', $request->input('kodcaw'));
+        }
+
+        if ($request->filled('limit_view')) {
+            $query->limit((int) $request->input('limit_view'));
+        }
+
+        $rows = $query->get()->map(function (BsasOrder $order) {
+            $payload = $order->toArray();
+            $payload['has_bid_ecert'] = !empty($order->bid_ecert_response);
+            $payload['has_otc_ecert'] = !empty($order->otc_ecert_response);
+            $payload['has_stb_ecert'] = !empty($order->stb_ecert_response);
+            unset($payload['bid_ecert_response'], $payload['otc_ecert_response'], $payload['stb_ecert_response']);
+
+            return $payload;
+        });
+
+        return response()->json($rows);
+    }
+
+    /**
+     * SAG-ready komoditi/product payload from confirmed BSAS order for a norujukan.
+     * Replaces daily KomuditiPurchase lookup for per-Terima BSAS purchases.
+     */
+    public function getBsasOrderByNorujukan($norujukan)
+    {
+        $order = BsasOrder::on('mysql7')
+            ->where('norujukan', $norujukan)
+            ->where('status', 'confirmed')
+            ->orderBy('id', 'desc')
+            ->first();
+
+        if (!$order) {
+            return response()->json(['message' => 'BSAS order tidak dijumpai untuk norujukan ini.'], 404);
+        }
+
+        $otc = is_array($order->otc_ecert_response) ? $order->otc_ecert_response : [];
+        $productCode = (string) ($order->product_code ?: config('bsas.product_code'));
+        $description = trim((string) ($otc['PNAME'] ?? ''));
+        if ($description === '') {
+            $produk = KomuditiProduk::on('mysql7')->where('kodproduk', $productCode)->first();
+            $description = $produk ? (string) $produk->description : $productCode;
+        }
+
+        $price = (float) ($otc['PRICE_MYR_EQUIVALENT'] ?? $otc['PRICE'] ?? 0);
+        $volume = (float) ($otc['PVOLUME'] ?? 0);
+        $pinjaman = (float) $order->bid_value;
+        if ($volume <= 0 && $price > 0 && $pinjaman > 0) {
+            $volume = round($pinjaman / $price, 4);
+        }
+
+        return response()->json([
+            'source' => 'bsas',
+            'uuid' => $order->uuid,
+            'komoditi' => [
+                'no_sijil' => $order->e_cert_no ?: $order->uuid,
+                'kodproduct' => $productCode,
+                'nilai' => $price > 0 ? $price : null,
+            ],
+            'product' => [
+                'product_code' => $productCode,
+                'kodproduk' => $productCode,
+                'description' => $description,
+                'unit' => 'TAN',
+            ],
+            'kuantiti' => $volume,
+        ]);
+    }
+
+    /**
+     * Return stored BSAS eCert payload only (no live BSAS refresh).
+     */
+    public function getBsasOrderEcert($uuid)
+    {
+        $order = BsasOrder::on('mysql7')->where('uuid', $uuid)->first();
+
+        if (!$order) {
+            return response()->json(['message' => 'BSAS order tidak dijumpai.'], 404);
+        }
+
+        if (empty($order->bid_ecert_response) && empty($order->otc_ecert_response) && empty($order->stb_ecert_response)) {
+            return response()->json(['message' => 'eCert belum tersedia untuk order ini.'], 404);
+        }
+
+        return response()->json([
+            'uuid' => $order->uuid,
+            'norujukan' => $order->norujukan,
+            'e_cert_no' => $order->e_cert_no,
+            'serial_number' => $order->serial_number,
+            'product_code' => $order->product_code,
+            'bid_value' => $order->bid_value,
+            'otc_murabaha_value' => $order->otc_murabaha_value,
+            'otc_counter_party' => $order->otc_counter_party,
+            'bid_ecert' => $order->bid_ecert_response,
+            'otc_ecert' => $order->otc_ecert_response,
+            'stb_ecert' => $order->stb_ecert_response,
+        ]);
+    }
+
+    /**
+     * Place BSAS commodity order for a gadai Terima, long-poll result, fetch eCert.
+     */
+    public function placeBsasOrder(Request $request)
+    {
+        try {
+            $service = new BsasOrderService();
+            $order = $service->placeAndConfirm([
+                'norujukan' => $request->input('norujukan'),
+                'kodcaw' => $request->input('kodcaw'),
+                'pinjaman' => $request->input('pinjaman'),
+                'hargajualan' => $request->input('hargajualan'),
+                'nama_pelanggan' => $request->input('nama_pelanggan'),
+                'teller' => $request->input('teller'),
+            ]);
+
+            return response()->json([
+                'message' => 'BSAS order confirmed',
+                'order' => $order,
+            ], 200);
+        } catch (\Throwable $e) {
+            Log::error('BSAS place order failed', [
+                'norujukan' => $request->input('norujukan'),
+                'error' => $e->getMessage(),
+            ]);
+
+            return response()->json([
+                'message' => $e->getMessage() ?: 'Gagal pembelian komoditi BSAS.',
+            ], 422);
+        }
+    }
+
+    /**
+     * Re-query BSAS orderResult / retry eCert by stored uuid.
+     */
+    public function getBsasOrder($uuid)
+    {
+        try {
+            $service = new BsasOrderService();
+            $order = $service->refreshByUuid($uuid);
+
+            return response()->json([
+                'message' => 'OK',
+                'order' => $order,
+            ], 200);
+        } catch (\Throwable $e) {
+            Log::error('BSAS refresh order failed', [
+                'uuid' => $uuid,
+                'error' => $e->getMessage(),
+            ]);
+
+            return response()->json([
+                'message' => $e->getMessage() ?: 'Gagal semak status BSAS.',
+            ], 422);
+        }
+    }
+
 }

app/Http/Controllers/MarhunController.php

@@ -59,11 +59,6 @@ class MarhunController extends Controller
 
     public function create($kodcaw,Request $request)
     {
-        $order = \App\ShorakaTransaction::where('norujukan', $request->norujukan)->first();
-        if ($order) {
-            abort(409, 'Kontrak Shoraka telah dihantar dan tidak boleh diubah.');
-        }
-
         $current = Carbon::now();
         $current = new Carbon();
 
@@ -132,10 +127,6 @@ class MarhunController extends Controller
 
     public function deletemarhun($kodcaw,$norujukan,Request $request)
     {
-        $order = \App\ShorakaTransaction::where('norujukan', $norujukan)->first();
-        if ($order) {
-            abort(409, 'Kontrak Shoraka telah dihantar dan tidak boleh diubah.');
-        }
 
         $current = Carbon::now();
         $current = new Carbon();
@@ -161,11 +152,6 @@ class MarhunController extends Controller
 
     public function editmarhun($kodcaw,$norujukan,Request $request)
     {
-        $order = \App\ShorakaTransaction::where('norujukan', $norujukan)->first();
-        if ($order) {
-            abort(409, 'Kontrak Shoraka telah dihantar dan tidak boleh diubah.');
-        }
-
 
 	    $current = Carbon::now();
         $current = new Carbon();

app/Http/Controllers/ShorakaController.php

@@ -1,291 +0,0 @@
-<?php
-
-namespace App\Http\Controllers;
-
-use App\ShorakaTransaction;
-use App\Services\ShorakaService;
-use Carbon\Carbon;
-use Illuminate\Database\QueryException;
-use Illuminate\Http\Request;
-use Illuminate\Support\Facades\Log;
-use Throwable;
-
-class ShorakaController extends Controller
-{
-    public function index(Request $request)
-    {
-        $this->validate($request, [
-            'kodcaw' => 'nullable|string|max:30',
-            'norujukan' => 'nullable|string|max:100',
-            'status' => 'nullable|string|max:30',
-            'date_from' => 'nullable|date_format:Y-m-d',
-            'date_to' => 'nullable|date_format:Y-m-d',
-            'per_page' => 'nullable|integer|min:1|max:100',
-            'page' => 'nullable|integer|min:1',
-            'branch_scope' => 'nullable|string|max:30',
-        ]);
-
-        $query = ShorakaTransaction::query();
-        foreach (['kodcaw', 'norujukan', 'status'] as $field) {
-            if ($request->filled($field)) {
-                $query->where($field, $request->input($field));
-            }
-        }
-        if ($request->filled('date_from')) {
-            $query->where('created_at', '>=', $request->input('date_from') . ' 00:00:00');
-        }
-        if ($request->filled('date_to')) {
-            $query->where('created_at', '<', Carbon::parse($request->input('date_to'))->addDay()->format('Y-m-d') . ' 00:00:00');
-        }
-        $records = $query->orderByDesc('created_at')->orderByDesc('id')
-            ->paginate(min(100, max(1, (int) $request->input('per_page', 25))));
-        $payload = [
-            'data' => $records->getCollection()->map(function (ShorakaTransaction $record) {
-                return [
-                    'id' => $record->id,
-                    'kodcaw' => $record->kodcaw,
-                    'norujukan' => $record->norujukan,
-                    'teller' => $record->teller,
-                    'status' => $record->status,
-                    'order_id' => $record->order_id,
-                    'created_at' => optional($record->created_at)->toDateTimeString(),
-                    'updated_at' => optional($record->updated_at)->toDateTimeString(),
-                ];
-            })->values(),
-            'total' => $records->total(),
-            'current_page' => $records->currentPage(),
-            'per_page' => $records->perPage(),
-            'last_page' => $records->lastPage(),
-        ];
-        if ($request->input('with_branches')) {
-            $branches = ShorakaTransaction::query()->whereNotNull('kodcaw');
-            if ($request->filled('branch_scope')) {
-                $branches->where('kodcaw', $request->input('branch_scope'));
-            }
-            $payload['branches'] = $branches->distinct()->orderBy('kodcaw')->pluck('kodcaw')->values();
-        }
-        return response()->json($payload);
-    }
-
-    public function submit(Request $request, ShorakaService $shoraka)
-    {
-        $validated = $this->validate($request, [
-            'norujukan' => 'required|string|max:255',
-            'ownership' => 'required|string|max:255',
-            'order_amount' => 'required|numeric|min:0.01|max:9999999999999.99',
-            'murabaha_amount' => 'required|numeric|min:0.01|max:9999999999999.99',
-            'tenor_other' => 'required|integer|min:1',
-            'teller' => 'nullable|string|max:255',
-        ]);
-        if (!$shoraka->configured()) {
-            return $this->unconfigured();
-        }
-
-        $existing = ShorakaTransaction::where('norujukan', $validated['norujukan'])->first();
-        if ($existing) {
-            return $this->duplicate($existing);
-        }
-
-        $payload = [
-            'product_type' => 'FINANCING',
-            'commodity_type' => '000-COPPER',
-            'ownership' => $validated['ownership'],
-            'ownership_doc_no' => $validated['norujukan'],
-            'value_date' => Carbon::now()->format('d/m/Y'),
-            'order_currency' => 'MYR',
-            'order_amount' => number_format((float) $validated['order_amount'], 2, '.', ''),
-            'murabaha_amount' => number_format((float) $validated['murabaha_amount'], 2, '.', ''),
-            // Appendix codes in v1.5: OTHERS and MONTH.
-            'tenor' => 'OTHERS',
-            'tenor_other' => $validated['tenor_other'],
-            'tenor_other_unit' => 'MONTH',
-            'order_type' => 'Buy & Sell',
-        ];
-
-        try {
-            // The unique norujukan index is the atomic claim for concurrent submissions.
-            $attributes = [
-                'norujukan' => $validated['norujukan'],
-                'kodcaw' => $request->attributes->get('shoraka_kodcaw'),
-                'teller' => $validated['teller'] ?? null,
-                'status' => 'PENDING',
-                'product_type' => $payload['product_type'],
-                'commodity_type' => $payload['commodity_type'],
-                'ownership_name' => $payload['ownership'],
-                'ownership_doc_no' => $payload['ownership_doc_no'],
-                'order_amount' => $payload['order_amount'],
-                'murabaha_amount' => $payload['murabaha_amount'],
-                'request_payload' => $payload,
-                'attempt_count' => 1,
-            ];
-            $transaction = ShorakaTransaction::create($attributes);
-        } catch (QueryException $exception) {
-            $existing = ShorakaTransaction::where('norujukan', $validated['norujukan'])->first();
-            if ($existing) {
-                return $this->duplicate($existing);
-            }
-            throw $exception;
-        }
-
-        try {
-            $response = $shoraka->submitOrder($payload);
-            $this->saveOrder($transaction, $response);
-
-            return response()->json([
-                'success' => true,
-                'message' => 'Order berjaya dihantar ke Shoraka.',
-                'data' => $this->orderData($transaction),
-            ]);
-        } catch (Throwable $exception) {
-            // A timeout or invalid response does not prove the remote trade failed.
-            // Block resubmission until this reference has been reconciled with Shoraka.
-            $transaction->update([
-                'status' => $transaction->order_id ? $transaction->status : 'UNKNOWN',
-                'error_message' => 'Submission outcome requires reconciliation with Shoraka.',
-            ]);
-
-            return $this->upstreamError('submit', $transaction, $exception);
-        }
-    }
-
-    public function refresh(string $norujukan, ShorakaService $shoraka)
-    {
-        if (!$shoraka->configured()) {
-            return $this->unconfigured();
-        }
-        $transaction = ShorakaTransaction::where('norujukan', $norujukan)->firstOrFail();
-        if (!$transaction->order_id) {
-            return $this->missingOrderId();
-        }
-
-        try {
-            $response = $shoraka->orderStatus($transaction->order_id);
-            $this->saveOrder($transaction, $response);
-
-            return response()->json(['success' => true, 'data' => $this->orderData($transaction)]);
-        } catch (Throwable $exception) {
-            return $this->upstreamError('status', $transaction, $exception);
-        }
-    }
-
-    public function certificate(string $norujukan, ShorakaService $shoraka)
-    {
-        if (!$shoraka->configured()) {
-            return $this->unconfigured();
-        }
-        $transaction = ShorakaTransaction::where('norujukan', $norujukan)->firstOrFail();
-        if (!$transaction->order_id) {
-            return $this->missingOrderId();
-        }
-
-        try {
-            $pdf = $shoraka->certificate($transaction->order_id);
-
-            return response($pdf, 200, [
-                'Content-Type' => 'application/pdf',
-                'Content-Disposition' => 'attachment; filename="shoraka-' . $transaction->id . '.pdf"',
-                'Cache-Control' => 'private, no-store',
-            ]);
-        } catch (Throwable $exception) {
-            return $this->upstreamError('certificate', $transaction, $exception);
-        }
-    }
-
-    public function callback(Request $request, ShorakaService $shoraka)
-    {
-        if (!$shoraka->configured()) {
-            return $this->unconfigured();
-        }
-        $payload = $request->json()->all();
-        if (!$shoraka->validCallback($payload)) {
-            return response()->json(['success' => false, 'message' => 'Invalid callback signature.'], 401);
-        }
-
-        // ownershipDocNo and certificateUrl are NOT signed. Never use them to link
-        // a callback to a local record or download a file.
-        $transaction = ShorakaTransaction::where('order_id', $payload['orderId'])->first();
-        if (!$transaction) {
-            return response()->json(['success' => false, 'message' => 'Order not found.'], 404);
-        }
-
-        try {
-            // There is no signed callback timestamp. Query the current order so a
-            // delayed/replayed callback cannot directly restore an old status.
-            $response = $shoraka->orderStatus($transaction->order_id);
-            unset($payload['signature']);
-            $this->saveOrder($transaction, $response, ['callback_payload' => $payload]);
-
-            // Exact acknowledgement required by section 6.
-            return response('OK', 200, ['Content-Type' => 'text/plain']);
-        } catch (Throwable $exception) {
-            return $this->upstreamError('callback', $transaction, $exception);
-        }
-    }
-
-    protected function saveOrder(ShorakaTransaction $transaction, array $response, array $extra = []): void
-    {
-        $transaction->update(array_merge([
-            'order_id' => (string) $response['orderId'],
-            'status' => $response['status'],
-            'certificate_url' => $response['certificateUrl'] ?? null,
-            'response_payload' => $response,
-            'submitted_at' => $transaction->submitted_at ?: Carbon::now(),
-            'completed_at' => $response['status'] === 'Completed'
-                ? ($transaction->completed_at ?: Carbon::now()) : $transaction->completed_at,
-            'error_message' => null,
-        ], $extra));
-        app(\App\Services\ShorakaGadaiService::class)->sync($transaction);
-    }
-
-    protected function orderData(ShorakaTransaction $transaction): array
-    {
-        return [
-            'norujukan' => $transaction->norujukan,
-            'kodcaw' => $transaction->kodcaw,
-            'teller' => $transaction->teller,
-            'order_id' => $transaction->order_id,
-            'status' => $transaction->status,
-            'certificate_url' => $transaction->certificate_url,
-        ];
-    }
-
-    protected function duplicate(ShorakaTransaction $transaction)
-    {
-        return response()->json([
-            'success' => false,
-            'message' => 'Transaksi telah direkodkan. Semak status dengan Shoraka sebelum penghantaran semula.',
-            'data' => $this->orderData($transaction),
-        ], 409);
-    }
-
-    protected function missingOrderId()
-    {
-        return response()->json([
-            'success' => false,
-            'message' => 'Order ID belum tersedia. Semakan dengan Shoraka diperlukan.',
-        ], 409);
-    }
-
-    protected function unconfigured()
-    {
-        return response()->json([
-            'success' => false,
-            'message' => 'API ID dan Secret Key Shoraka belum dikonfigurasi.',
-        ], 503);
-    }
-
-    protected function upstreamError(string $operation, ShorakaTransaction $transaction, Throwable $exception)
-    {
-        // Connection exceptions may include request details; log only the class.
-        Log::error('Shoraka request failed', [
-            'operation' => $operation,
-            'transaction_id' => $transaction->id,
-            'exception_type' => get_class($exception),
-        ]);
-
-        return response()->json([
-            'success' => false,
-            'message' => 'Permintaan Shoraka gagal. Semak status transaksi sebelum mencuba semula.',
-        ], 502);
-    }
-}

app/Http/Controllers/ShorakaGadaiController.php

@@ -1,76 +0,0 @@
-<?php
-
-namespace App\Http\Controllers;
-
-use App\KomuditiTransaksi;
-use App\Services\ShorakaGadaiService;
-use App\Services\ShorakaService;
-use Illuminate\Http\Request;
-
-class ShorakaGadaiController extends ShorakaController
-{
-    public function readiness(ShorakaService $shoraka)
-    {
-        try {
-            \App\ShorakaTransaction::query()->limit(1)->exists();
-            $storeReady = true;
-        } catch (\Throwable $exception) {
-            $storeReady = false;
-        }
-        return response()->json(['provider' => 'shoraka', 'ready' => $storeReady && $shoraka->configured()]);
-    }
-
-    public function showGadai(string $kodcaw, string $norujukan, ShorakaGadaiService $gadaiService)
-    {
-        $gadai = $gadaiService->gadai($kodcaw, $norujukan);
-        $order = $gadaiService->transaction($kodcaw, $norujukan);
-        return response()->json([
-            'success' => true,
-            'data' => [
-                'norujukan' => $norujukan, 'kodcaw' => $kodcaw,
-                'order_amount' => $gadai->pinjaman, 'murabaha_amount' => $gadai->hargajualan,
-                'order' => $order ? $this->orderData($order) : null,
-                'details' => $order ? $order->response_payload : null,
-                'simulation' => $order && strpos((string) $order->order_id, 'SIM-') === 0,
-                'can_complete' => $gadai->exists && $order && $order->status === 'Completed'
-                    && number_format((float) $gadai->pinjaman, 2, '.', '') === $order->order_amount
-                    && number_format((float) $gadai->hargajualan, 2, '.', '') === $order->murabaha_amount,
-            ],
-        ]);
-    }
-
-    public function submitGadai(string $kodcaw, string $norujukan, Request $request, ShorakaGadaiService $gadaiService, ShorakaService $shoraka)
-    {
-        $gadai = $gadaiService->gadai($kodcaw, $norujukan);
-        $existing = $gadaiService->transaction($kodcaw, $norujukan);
-        if ($existing) {
-            return $this->duplicate($existing);
-        }
-        // Historical commodity purchases must never be traded again.
-        if (KomuditiTransaksi::on('mysql7')->where('norujukan', $norujukan)->exists()
-            || $gadai->cetak || $gadai->sttebus) {
-            abort(409, 'Gadaian lama atau telah selesai tidak boleh dihantar sebagai order baharu.');
-        }
-        $payload = $gadaiService->payload($gadai);
-        $teller = $request->input('teller');
-        if (is_string($teller) && $teller !== '') {
-            $payload['teller'] = $teller;
-        }
-        $submission = new Request($payload);
-        $submission->attributes->set('shoraka_kodcaw', $kodcaw);
-        return $this->submit($submission, $shoraka);
-    }
-
-    public function refreshGadai(string $kodcaw, string $norujukan, ShorakaGadaiService $gadaiService, ShorakaService $shoraka)
-    {
-        $gadaiService->gadai($kodcaw, $norujukan);
-        $gadaiService->transaction($kodcaw, $norujukan);
-        return $this->refresh($norujukan, $shoraka);
-    }
-
-    public function certificateGadai(string $kodcaw, string $norujukan, ShorakaGadaiService $gadaiService, ShorakaService $shoraka)
-    {
-        $gadaiService->assertCompleted($kodcaw, $norujukan);
-        return $this->certificate($norujukan, $shoraka);
-    }
-}

app/Services/Bsas/BsasClient.php

@@ -0,0 +1,193 @@
+<?php
+
+namespace App\Services\Bsas;
+
+use Illuminate\Http\Client\PendingRequest;
+use Illuminate\Support\Facades\Cache;
+use Illuminate\Support\Facades\Http;
+use Illuminate\Support\Facades\Log;
+use RuntimeException;
+
+class BsasClient
+{
+    const TOKEN_CACHE_KEY = 'bsas.oauth.token';
+    const TOKEN_CACHE_SECONDS = 82800; // 23 hours
+
+    public function getAccessToken(): string
+    {
+        $cached = Cache::get(self::TOKEN_CACHE_KEY);
+        if (is_string($cached) && $cached !== '') {
+            return $cached;
+        }
+
+        // Drop bad cache entries (e.g. whole JSON array accidentally stored).
+        if ($cached !== null) {
+            Cache::forget(self::TOKEN_CACHE_KEY);
+        }
+
+        $tokenUrl = config('bsas.token_url');
+        $clientId = config('bsas.client_id');
+        $clientSecret = config('bsas.client_secret');
+
+        if (!$tokenUrl || !$clientId || !$clientSecret) {
+            throw new RuntimeException('BSAS OAuth is not configured (token_url / client_id / client_secret).');
+        }
+
+        $response = $this->http()
+            ->asForm()
+            ->post($tokenUrl, [
+                'grant_type' => 'client_credentials',
+                'client_id' => $clientId,
+                'client_secret' => $clientSecret,
+            ]);
+
+        $payload = $response->json();
+        if (!is_array($payload)) {
+            $payload = [];
+        }
+
+        if (!$response->successful()) {
+            Log::error('BSAS OAuth token request failed', [
+                'status' => $response->status(),
+                'body' => $payload ?: $response->body(),
+            ]);
+            throw new RuntimeException('Gagal mendapatkan BSAS access token.');
+        }
+
+        $token = $payload['access_token'] ?? null;
+        if (!is_string($token) || $token === '') {
+            Log::error('BSAS OAuth response missing string access_token', [
+                'body' => $payload,
+            ]);
+            throw new RuntimeException('BSAS OAuth response missing access_token.');
+        }
+
+        $expiresIn = (int) ($payload['expires_in'] ?? self::TOKEN_CACHE_SECONDS);
+        $ttl = max(60, min(self::TOKEN_CACHE_SECONDS, $expiresIn - 300));
+        Cache::put(self::TOKEN_CACHE_KEY, $token, $ttl);
+
+        return $token;
+    }
+
+    public function placeOrder(array $payload): array
+    {
+        return $this->requestJson('post', '/process/svc/bsas/order', $payload);
+    }
+
+    public function orderResult(string $uuid, array $body = []): array
+    {
+        $maxWait = (string) ($body['maxWaitTime'] ?? config('bsas.max_wait_time', 10));
+
+        $payload = [
+            'header' => [
+                'memberShortName' => config('bsas.member_short_name'),
+                'uuid' => $uuid,
+            ],
+            'body' => [
+                'serialNumbers' => (string) ($body['serialNumbers'] ?? '1'),
+                'forceYN' => (string) ($body['forceYN'] ?? 'Y'),
+                'maxWaitTime' => $maxWait,
+                'waitAllDoneYN' => (string) ($body['waitAllDoneYN'] ?? 'Y'),
+            ],
+        ];
+
+        // Long poll: client timeout must exceed BSAS maxWaitTime.
+        $timeout = max(
+            (int) config('bsas.http_timeout', 30),
+            (int) $maxWait + 20
+        );
+
+        return $this->requestJson('get', '/process/svc/bsas/orderResult', $payload, $timeout);
+    }
+
+    public function getBidEcert(string $ecertNo): array
+    {
+        return $this->requestEcert('/process/svc/bsas/bidXML', $ecertNo);
+    }
+
+    public function getOtcEcert(string $ecertNo): array
+    {
+        return $this->requestEcert('/process/svc/bsas/otcXML', $ecertNo);
+    }
+
+    public function getStbEcert(string $ecertNo): array
+    {
+        return $this->requestEcert('/process/svc/bsas/stbXML', $ecertNo);
+    }
+
+    protected function requestEcert(string $path, string $ecertNo): array
+    {
+        $payload = [
+            'input' => [
+                'ecertno' => $ecertNo,
+                'membershortname' => config('bsas.member_short_name'),
+            ],
+        ];
+
+        return $this->requestJson('get', $path, $payload);
+    }
+
+    protected function requestJson(string $method, string $path, array $payload, ?int $timeout = null): array
+    {
+        $url = rtrim(config('bsas.base_url'), '/') . '/' . ltrim($path, '/');
+        $timeout = $timeout ?? (int) config('bsas.http_timeout', 30);
+        $token = $this->getAccessToken();
+
+        $pending = $this->http($timeout)
+            ->withToken($token)
+            ->acceptJson();
+
+        if (strtolower($method) === 'get') {
+            $response = $pending
+                ->withHeaders(['Content-Type' => 'application/json'])
+                ->send('GET', $url, [
+                    'body' => json_encode($payload),
+                ]);
+        } else {
+            $response = $pending->asJson()->post($url, $payload);
+        }
+
+        $json = $response->json();
+        if (!is_array($json)) {
+            $body = $response->body();
+            $cloudflare = stripos($body, 'cloudflare') !== false || stripos($body, 'Attention Required') !== false;
+
+            if ($cloudflare) {
+                throw new RuntimeException(
+                    'BSAS blocked by Cloudflare (check IP whitelist). HTTP ' . $response->status()
+                );
+            }
+
+            throw new RuntimeException('BSAS returned invalid JSON response.');
+        }
+
+        if (!$response->successful()) {
+            Log::error('BSAS HTTP error', [
+                'method' => $method,
+                'url' => $url,
+                'status' => $response->status(),
+                'body' => $json,
+            ]);
+            throw new RuntimeException('BSAS request failed (HTTP ' . $response->status() . ').');
+        }
+
+        Log::info('BSAS API call', [
+            'method' => $method,
+            'path' => $path,
+            'status' => $response->status(),
+            'header' => $json['header'] ?? null,
+        ]);
+
+        return $json;
+    }
+
+    protected function http(?int $timeout = null): PendingRequest
+    {
+        $timeout = $timeout ?? (int) config('bsas.http_timeout', 30);
+
+        return Http::withOptions([
+            'timeout' => $timeout,
+            'connect_timeout' => min(15, $timeout),
+        ]);
+    }
+}

app/Services/Bsas/BsasOrderService.php

@@ -0,0 +1,374 @@
+<?php
+
+namespace App\Services\Bsas;
+
+use App\BsasOrder;
+use App\KomuditiTransaksi;
+use Carbon\Carbon;
+use Illuminate\Support\Facades\Log;
+use RuntimeException;
+
+class BsasOrderService
+{
+    /** @var BsasClient */
+    protected $client;
+
+    public function __construct(BsasClient $client = null)
+    {
+        $this->client = $client ?: new BsasClient();
+    }
+
+    /**
+     * Place BSAS order for a gadai Terima, long-poll result, fetch eCert.
+     *
+     * @param array $input norujukan, kodcaw, pinjaman, hargajualan, nama_pelanggan, teller
+     * @return BsasOrder
+     */
+    public function placeAndConfirm(array $input): BsasOrder
+    {
+        $norujukan = (string) ($input['norujukan'] ?? '');
+        $kodcaw = (string) ($input['kodcaw'] ?? '');
+        $pinjaman = round((float) ($input['pinjaman'] ?? 0), 2);
+        $hargajualan = round((float) ($input['hargajualan'] ?? 0), 2);
+        $counterParty = trim((string) ($input['nama_pelanggan'] ?? ''));
+        $createdBy = (string) ($input['teller'] ?? '');
+
+        if ($norujukan === '' || $kodcaw === '' || $pinjaman <= 0) {
+            throw new RuntimeException('BSAS order requires norujukan, kodcaw and pinjaman.');
+        }
+
+        $existing = BsasOrder::on('mysql7')
+            ->where('norujukan', $norujukan)
+            ->orderBy('id', 'desc')
+            ->first();
+
+        if ($existing && $existing->status === 'confirmed') {
+            if ($this->needsEcertFetch($existing)) {
+                $this->fetchAndStoreEcert($existing);
+            }
+            $this->ensureKomuditiTransaksi($existing, $createdBy);
+            return $existing->fresh();
+        }
+
+        if ($existing && in_array($existing->status, ['pending', 'submitted'], true) && !empty($existing->uuid)) {
+            return $this->completeSubmittedOrder($existing, $createdBy);
+        }
+
+        $serial = '1';
+        $payload = $this->buildOrderPayload($pinjaman, $hargajualan, $counterParty, $serial);
+
+        $order = BsasOrder::on('mysql7')->create([
+            'uuid' => null,
+            'norujukan' => $norujukan,
+            'kodcaw' => $kodcaw,
+            'serial_number' => $serial,
+            'product_code' => config('bsas.product_code'),
+            'bid_value' => $pinjaman,
+            'otc_murabaha_value' => $hargajualan,
+            'otc_counter_party' => $counterParty,
+            'status' => 'pending',
+            'request_payload' => $payload,
+            'created_by' => $createdBy,
+        ]);
+
+        try {
+            $orderResponse = $this->client->placeOrder($payload);
+        } catch (\Throwable $e) {
+            $order->status = 'failed';
+            $order->status_message = $e->getMessage();
+            $order->save();
+            throw $e;
+        }
+
+        $order->order_response = $orderResponse;
+        $uuid = data_get($orderResponse, 'header.uuid');
+        $errorCode = trim((string) data_get($orderResponse, 'header.errorCode', ''));
+        $errorMsg = trim((string) data_get($orderResponse, 'header.errorMsg', ''));
+
+        if ($errorCode !== '' || !$uuid) {
+            $order->status = 'failed';
+            $order->status_message = $errorMsg !== '' ? $errorMsg : 'BSAS order rejected (missing uuid or errorCode set).';
+            $order->save();
+            throw new RuntimeException($order->status_message);
+        }
+
+        $bodyStatus = data_get($orderResponse, 'body.0.statusCode');
+        if ($bodyStatus !== null && (int) $bodyStatus !== 0) {
+            $order->uuid = $uuid;
+            $order->status = 'failed';
+            $order->status_code = (int) $bodyStatus;
+            $order->status_message = (string) data_get($orderResponse, 'body.0.statusMessage', 'BSAS order body statusCode != 0');
+            $order->save();
+            throw new RuntimeException($order->status_message);
+        }
+
+        $order->uuid = $uuid;
+        $order->status = 'submitted';
+        $order->save();
+
+        return $this->completeSubmittedOrder($order, $createdBy);
+    }
+
+    /**
+     * Re-query orderResult / eCert for an existing uuid.
+     */
+    public function refreshByUuid(string $uuid): BsasOrder
+    {
+        $order = BsasOrder::on('mysql7')->where('uuid', $uuid)->first();
+        if (!$order) {
+            throw new RuntimeException('BSAS order not found for uuid.');
+        }
+
+        if ($order->status === 'confirmed') {
+            if ($this->needsEcertFetch($order)) {
+                $this->fetchAndStoreEcert($order);
+            }
+            return $order->fresh();
+        }
+
+        return $this->completeSubmittedOrder($order, (string) $order->created_by);
+    }
+
+    protected function completeSubmittedOrder(BsasOrder $order, string $createdBy): BsasOrder
+    {
+        if (empty($order->uuid)) {
+            throw new RuntimeException('BSAS order has no uuid to poll.');
+        }
+
+        $result = $this->longPollOrderResult($order->uuid, (string) $order->serial_number);
+        $order->result_response = $result;
+
+        $headerError = trim((string) data_get($result, 'header.errorCode', ''));
+        $headerMsg = trim((string) data_get($result, 'header.errorMsg', ''));
+        $statusCode = data_get($result, 'body.0.statusCode');
+        $statusMessage = (string) data_get($result, 'body.0.statusMessage', '');
+        $bidErrNo = trim((string) data_get($result, 'body.0.bidErrNo', ''));
+        $otcErrNo = trim((string) data_get($result, 'body.0.otcErrNo', ''));
+        $stbErrNo = trim((string) data_get($result, 'body.0.stbErrNo', ''));
+        $bidMsg = trim((string) data_get($result, 'body.0.bidMsg', ''));
+        $otcMsg = trim((string) data_get($result, 'body.0.otcMsg', ''));
+        $stbMsg = trim((string) data_get($result, 'body.0.stbMsg', ''));
+        $ecertNo = $this->extractEcertNo($result, $order->order_response);
+
+        if ($headerError !== '') {
+            $order->status = 'failed';
+            $order->status_code = is_numeric($statusCode) ? (int) $statusCode : null;
+            $order->status_message = $headerMsg !== '' ? $headerMsg : 'BSAS orderResult header errorCode set.';
+            $order->save();
+            throw new RuntimeException($order->status_message);
+        }
+
+        // Live BSAS result often has no statusCode; success is ecertNo and/or bid/otc/stb ErrNo=999 (OK).
+        $successByStatusCode = $statusCode !== null && (int) $statusCode === 0;
+        $successByErrNo = ($bidErrNo === '999' || strtoupper($bidMsg) === 'OK')
+            && ($otcErrNo === '999' || strtoupper($otcMsg) === 'OK')
+            && ($stbErrNo === '999' || strtoupper($stbMsg) === 'OK');
+        $successByEcert = $ecertNo !== null && $ecertNo !== '';
+
+        if (!$successByStatusCode && !$successByErrNo && !$successByEcert) {
+            if ($statusCode !== null && (int) $statusCode !== 0) {
+                $order->status = 'failed';
+                $order->status_code = (int) $statusCode;
+                $order->status_message = $statusMessage !== '' ? $statusMessage : 'BSAS orderResult statusCode != 0';
+                $order->save();
+                throw new RuntimeException($order->status_message);
+            }
+
+            $order->status = 'submitted';
+            $order->status_message = 'BSAS orderResult belum selesai / tiada ecert.';
+            $order->save();
+            throw new RuntimeException('BSAS orderResult belum selesai. Sila cuba semula.');
+        }
+
+        $order->status_code = $statusCode !== null ? (int) $statusCode : 0;
+        $order->status_message = $statusMessage !== '' ? $statusMessage : ($bidMsg ?: 'OK');
+        $order->status = 'confirmed';
+        if ($ecertNo) {
+            $order->e_cert_no = $ecertNo;
+        }
+        $order->save();
+
+        if ($this->needsEcertFetch($order)) {
+            $this->fetchAndStoreEcert($order);
+        }
+
+        if (empty($order->e_cert_no)) {
+            Log::warning('BSAS order confirmed but ecertno missing', [
+                'norujukan' => $order->norujukan,
+                'uuid' => $order->uuid,
+            ]);
+        }
+
+        $this->ensureKomuditiTransaksi($order, $createdBy);
+
+        return $order->fresh();
+    }
+
+    protected function longPollOrderResult(string $uuid, string $serial): array
+    {
+        $retries = max(1, (int) config('bsas.order_result_retries', 2));
+        $last = [];
+
+        for ($i = 0; $i < $retries; $i++) {
+            $last = $this->client->orderResult($uuid, [
+                'serialNumbers' => $serial,
+                'forceYN' => 'Y',
+                'maxWaitTime' => (string) config('bsas.max_wait_time', 10),
+                'waitAllDoneYN' => 'Y',
+            ]);
+
+            // Done when statusCode is set, or bid, OTC and STB have all reported.
+            $bidDone = trim((string) data_get($last, 'body.0.bidErrNo', '')) !== '';
+            $otcDone = trim((string) data_get($last, 'body.0.otcErrNo', '')) !== '';
+            $stbDone = trim((string) data_get($last, 'body.0.stbErrNo', '')) !== '';
+            $hasEcert = trim((string) data_get($last, 'body.0.ecertNo', '')) !== ''
+                || trim((string) data_get($last, 'body.0.eCertNo', '')) !== '';
+
+            if (
+                data_get($last, 'body.0.statusCode') !== null
+                || ($bidDone && $otcDone && $stbDone)
+                || ($hasEcert && $stbDone)
+            ) {
+                return $last;
+            }
+        }
+
+        return $last;
+    }
+
+    protected function needsEcertFetch(BsasOrder $order): bool
+    {
+        return empty($order->bid_ecert_response)
+            || empty($order->otc_ecert_response)
+            || empty($order->stb_ecert_response);
+    }
+
+    protected function fetchAndStoreEcert(BsasOrder $order): void
+    {
+        $ecertNo = $order->e_cert_no;
+        if (!$ecertNo) {
+            $ecertNo = $this->extractEcertNo($order->result_response, $order->order_response);
+            if ($ecertNo) {
+                $order->e_cert_no = $ecertNo;
+                $order->save();
+            }
+        }
+
+        if (!$ecertNo) {
+            return;
+        }
+
+        $calls = [
+            'bid_ecert_response' => 'getBidEcert',
+            'otc_ecert_response' => 'getOtcEcert',
+            'stb_ecert_response' => 'getStbEcert',
+        ];
+
+        foreach ($calls as $column => $method) {
+            if (!empty($order->{$column})) {
+                continue;
+            }
+
+            try {
+                $ecert = $this->client->{$method}($ecertNo);
+                $order->{$column} = $ecert;
+                if ($column === 'otc_ecert_response' && empty($order->e_cert_no) && !empty($ecert['ECERTNO'])) {
+                    $order->e_cert_no = $ecert['ECERTNO'];
+                }
+                $order->save();
+            } catch (\Throwable $e) {
+                Log::error('BSAS eCert fetch failed after confirmed order', [
+                    'norujukan' => $order->norujukan,
+                    'uuid' => $order->uuid,
+                    'e_cert_no' => $ecertNo,
+                    'certificate' => $column,
+                    'error' => $e->getMessage(),
+                ]);
+            }
+        }
+    }
+
+    protected function ensureKomuditiTransaksi(BsasOrder $order, string $teller): void
+    {
+        $exists = KomuditiTransaksi::on('mysql7')
+            ->where('norujukan', $order->norujukan)
+            ->first();
+
+        if ($exists) {
+            return;
+        }
+
+        $current = Carbon::now();
+        KomuditiTransaksi::on('mysql7')->create([
+            'unit_komuditi' => round((float) $order->bid_value, 2),
+            'nosijil' => $order->e_cert_no ?: $order->uuid,
+            'norujukan' => $order->norujukan,
+            'kodcaw' => $order->kodcaw,
+            'teller' => $teller !== '' ? $teller : $order->created_by,
+            'masa' => $current->toTimeString(),
+            'tarikh' => $current->toDateString(),
+        ]);
+    }
+
+    protected function buildOrderPayload(float $pinjaman, float $hargajualan, string $counterParty, string $serial): array
+    {
+        return [
+            'header' => [
+                'memberShortName' => config('bsas.member_short_name'),
+                'uuid' => $this->uuidV4(),
+            ],
+            'body' => [
+                'serialNumber' => $serial,
+                'bidOption' => 'Y',
+                'otcOption' => 'Y',
+                'stbOption' => 'Y',
+                'productCode' => config('bsas.product_code'),
+                'purchaseType' => 'P',
+                'clientName' => '',
+                'currency' => 'MYR',
+                'bidValue' => number_format($pinjaman, 2, '.', ''),
+                'valueDate' => Carbon::now()->format('Ymd'),
+                'tenor' => config('bsas.tenor'),
+                'otcCounterParty' => $counterParty,
+                'otcMurabaha' => '',
+                'otcMurabahaValue' => number_format($hargajualan, 2, '.', ''),
+                'eCertNo' => '',
+            ],
+        ];
+    }
+
+    /**
+     * Best-effort extract ecert number from result/order payloads.
+     */
+    protected function extractEcertNo($result, $orderResponse): ?string
+    {
+        $candidates = [
+            data_get($result, 'body.0.eCertNo'),
+            data_get($result, 'body.0.ecertNo'),
+            data_get($result, 'body.0.ECERTNO'),
+            data_get($result, 'body.0.ecertno'),
+            data_get($result, 'body.0.certificateNo'),
+            data_get($orderResponse, 'body.0.eCertNo'),
+            data_get($orderResponse, 'body.0.ecertNo'),
+            data_get($orderResponse, 'body.0.ECERTNO'),
+        ];
+
+        foreach ($candidates as $value) {
+            $value = trim((string) $value);
+            if ($value !== '') {
+                return $value;
+            }
+        }
+
+        return null;
+    }
+
+    protected function uuidV4(): string
+    {
+        $data = random_bytes(16);
+        $data[6] = chr((ord($data[6]) & 0x0f) | 0x40);
+        $data[8] = chr((ord($data[8]) & 0x3f) | 0x80);
+
+        return vsprintf('%s%s-%s-%s-%s-%s%s%s', str_split(bin2hex($data), 4));
+    }
+}

app/Services/ShorakaGadaiService.php

@@ -1,77 +0,0 @@
-<?php
-
-namespace App\Services;
-
-use App\Cawangan;
-use App\Customer;
-use App\Gadai;
-use App\ShorakaTransaction;
-use Illuminate\Validation\ValidationException;
-
-class ShorakaGadaiService
-{
-    public function gadai(string $kodcaw, string $norujukan): Gadai
-    {
-        $branch = Cawangan::on('mysql7')->where('kodcaw', $kodcaw)->firstOrFail();
-        return Gadai::on($branch->mysql)->where('kodcaw', $kodcaw)->where('norujukan', $norujukan)->first()
-            ?? abort(404, 'Maklumat gadaian tidak tersedia. Semakan diperlukan.');
-    }
-
-    public function payload(Gadai $gadai): array
-    {
-        $customer = Customer::on('mysql7')->where(function ($query) use ($gadai) {
-            $query->where('kpbaru', $gadai->nokp)->orWhere('kplama', $gadai->nokp);
-        })->firstOrFail();
-        if (!$customer->nama || $gadai->pinjaman <= 0 || $gadai->hargajualan < $gadai->pinjaman) {
-            throw ValidationException::withMessages([
-                'norujukan' => 'Nama pelanggan, pembiayaan dan harga jualan mesti lengkap.',
-            ]);
-        }
-
-        return [
-            'norujukan' => $gadai->norujukan,
-            'ownership' => $customer->nama,
-            'order_amount' => $gadai->pinjaman,
-            'murabaha_amount' => $gadai->hargajualan,
-            // Both GadaiV1 and GadaiV2 price the contract using upah12.
-            // "tempoh" is elapsed charge time, NOT the contractual tenor.
-            'tenor_other' => 12,
-        ];
-    }
-
-    public function transaction(string $kodcaw, string $norujukan)
-    {
-        $order = ShorakaTransaction::where('norujukan', $norujukan)->first();
-        if ($order && (string) $order->kodcaw !== $kodcaw) {
-            abort(409, 'Rekod Shoraka tidak dipadankan dengan cawangan ini.');
-        }
-        return $order;
-    }
-
-    public function sync(ShorakaTransaction $order): void
-    {
-        if (!$order->kodcaw) {
-            return;
-        }
-        $gadai = $this->gadai($order->kodcaw, $order->norujukan);
-        if (!$gadai->exists) {
-            return;
-        }
-        $sameAmounts = number_format((float) $gadai->pinjaman, 2, '.', '') === $order->order_amount
-            && number_format((float) $gadai->hargajualan, 2, '.', '') === $order->murabaha_amount;
-        $gadai->getConnection()->table('gadai')->where('norujukan', $order->norujukan)->update([
-            'tagkomuditi' => $order->status === 'Completed' && $sameAmounts ? 1 : 0,
-        ]);
-    }
-
-    public function assertCompleted(string $kodcaw, string $norujukan): void
-    {
-        $gadai = $this->gadai($kodcaw, $norujukan);
-        $order = $this->transaction($kodcaw, $norujukan);
-        if (!$gadai->exists || !$order || $order->status !== 'Completed'
-            || number_format((float) $gadai->pinjaman, 2, '.', '') !== $order->order_amount
-            || number_format((float) $gadai->hargajualan, 2, '.', '') !== $order->murabaha_amount) {
-            abort(409, 'Pembiayaan dan SAG ditahan sehingga transaksi Shoraka selesai dan amaun sepadan.');
-        }
-    }
-}

app/Services/ShorakaService.php

@@ -1,220 +0,0 @@
-<?php
-
-namespace App\Services;
-
-use Illuminate\Http\Client\Response;
-use Illuminate\Support\Facades\Http;
-use RuntimeException;
-
-class ShorakaService
-{
-    const STATUSES = ['Active', 'Completed', 'Cancelled', 'Pending Sell', 'Take Delivery'];
-
-    const CALLBACK_FIELDS = [
-        'orderId', 'status', 'bankName', 'ownershipName', 'commodityType',
-        'unit', 'volume', 'productType', 'valueDate', 'cancelDate', 'orderType',
-        'orderCurrency', 'orderAmount', 'murabahaAmount', 'tenor',
-        'tenorOther', 'tenorOtherUnit',
-    ];
-
-    protected $baseUrl;
-    protected $apiId;
-    protected $secretKey;
-    protected $timeout;
-
-    public function __construct()
-    {
-        $this->baseUrl = rtrim((string) config('services.shoraka.base_url'), '/');
-        $this->apiId = (string) config('services.shoraka.api_id');
-        $this->secretKey = (string) config('services.shoraka.secret_key');
-        $this->timeout = (int) config('services.shoraka.timeout', 60);
-    }
-
-    public function configured(): bool
-    {
-        if ($this->simulationRequested()) {
-            return $this->simulationAllowed() && in_array($this->simulationMode(), ['failed', 'pending'], true);
-        }
-        return $this->apiId !== '' && $this->secretKey !== '';
-    }
-
-    protected function simulationAllowed(): bool
-    {
-        return app()->environment('local', 'testing');
-    }
-
-    protected function simulationMode(): string
-    {
-        return strtolower(trim((string) config('services.shoraka.simulation', 'off')));
-    }
-
-    protected function simulationRequested(): bool
-    {
-        return !in_array($this->simulationMode(), ['', 'off'], true);
-    }
-
-    private function simulatedResponse(string $orderId): array
-    {
-        if (!$this->simulationAllowed()) {
-            throw new RuntimeException('Shoraka simulation is restricted to local/testing.');
-        }
-        if (strpos($orderId, 'SIM-FAILED-') === 0) {
-            return ['orderId' => $orderId, 'status' => 'Cancelled'];
-        }
-        if (strpos($orderId, 'SIM-PENDING-') === 0) {
-            return ['orderId' => $orderId, 'status' => 'Active'];
-        }
-        throw new RuntimeException('Invalid simulation order ID.');
-    }
-
-    public function submitOrder(array $data): array
-    {
-        if ($this->simulationRequested()) {
-            if (!$this->simulationAllowed() || !in_array($this->simulationMode(), ['failed', 'pending'], true)) {
-                throw new RuntimeException('Shoraka simulation configuration is not allowed.');
-            }
-            return $this->simulatedResponse('SIM-' . strtoupper($this->simulationMode()) . '-' . bin2hex(random_bytes(12)));
-        }
-
-        $payload = ['api_id' => $this->apiId];
-        foreach ([
-            'product_type', 'commodity_type', 'ownership', 'value_date',
-            'order_currency', 'order_amount', 'murabaha_amount', 'tenor',
-            'tenor_other', 'tenor_other_unit', 'order_type', 'ownership_doc_no',
-        ] as $field) {
-            $payload[$field] = $data[$field] ?? '';
-        }
-        foreach (['order_amount', 'murabaha_amount'] as $field) {
-            $payload[$field] = number_format((float) $payload[$field], 2, '.', '');
-        }
-
-        // ownership_doc_no is deliberately excluded by the v1.5 signature contract.
-        $signed = $payload;
-        unset($signed['api_id'], $signed['ownership_doc_no']);
-        $payload['signature'] = $this->signature(array_values($signed));
-
-        return $this->orderResponse($this->request()->post(
-            $this->baseUrl . '/api/submitorder', $payload
-        ));
-    }
-
-    public function orderStatus(string $orderId): array
-    {
-        if (strpos($orderId, 'SIM-') === 0) {
-            return $this->simulatedResponse($orderId); // Never send simulated references to the real provider.
-        }
-        if ($this->simulationRequested()) {
-            throw new RuntimeException('Real order status is unavailable while simulation is enabled.');
-        }
-
-        return $this->orderResponse($this->request()->post(
-            $this->baseUrl . '/api/orderstatus', $this->orderPayload($orderId)
-        ), $orderId);
-    }
-
-    public function certificate(string $orderId): string
-    {
-        if ($this->simulationRequested() || strpos($orderId, 'SIM-') === 0) {
-            throw new RuntimeException('Certificates are unavailable for simulation.');
-        }
-
-        // Section 5 specifies POST, despite GET in the document history.
-        $response = $this->request()->accept('application/pdf')->post(
-            $this->baseUrl . '/api/certificate', $this->orderPayload($orderId)
-        );
-        $this->checkResponse($response);
-        $type = strtolower(trim(explode(';', $response->header('Content-Type'))[0]));
-        if ($type !== 'application/pdf' || substr($response->body(), 0, 5) !== '%PDF-') {
-            throw new RuntimeException('Shoraka returned an invalid PDF certificate.');
-        }
-
-        return $response->body();
-    }
-
-    public function validCallback(array $payload): bool
-    {
-        if ($this->simulationRequested() || strpos((string) ($payload['orderId'] ?? ''), 'SIM-') === 0) {
-            return false;
-        }
-
-        if (!$this->configured()
-            || !isset($payload['apiId'], $payload['signature'])
-            || !is_string($payload['apiId'])
-            || !hash_equals($this->apiId, $payload['apiId'])
-            || !is_string($payload['signature'])
-            || !preg_match('/\A[0-9a-fA-F]{64}\z/', $payload['signature'])) {
-            return false;
-        }
-
-        $values = [];
-        foreach (self::CALLBACK_FIELDS as $field) {
-            // Preserve the original strings: decimal formatting affects the hash.
-            if (!array_key_exists($field, $payload) || !is_string($payload[$field])) {
-                return false;
-            }
-            $values[] = $payload[$field];
-        }
-
-        return $payload['orderId'] !== ''
-            && in_array($payload['status'], self::STATUSES, true)
-            && hash_equals($this->signature($values), strtolower($payload['signature']));
-    }
-
-    protected function signature(array $values): string
-    {
-        return hash('sha256', implode(';', array_merge(
-            [$this->secretKey, $this->apiId], $values
-        )));
-    }
-
-    protected function orderPayload(string $orderId): array
-    {
-        if ($orderId === '') {
-            throw new RuntimeException('Shoraka order ID is required.');
-        }
-
-        return [
-            'api_id' => $this->apiId,
-            'order_id' => $orderId,
-            'signature' => $this->signature([$orderId]),
-        ];
-    }
-
-    protected function request()
-    {
-        if (!$this->configured()) {
-            throw new RuntimeException('Shoraka credentials are not configured.');
-        }
-
-        // Never forward signed requests through redirects or retry a trade automatically.
-        return Http::asForm()->acceptJson()->timeout($this->timeout)
-            ->withOptions(['allow_redirects' => false]);
-    }
-
-    protected function checkResponse(Response $response): void
-    {
-        if (!$response->successful()) {
-            // Do not expose upstream bodies which may contain credentials or customer data.
-            throw new RuntimeException('Shoraka request failed. HTTP ' . $response->status());
-        }
-    }
-
-    protected function orderResponse(Response $response, string $expectedId = null): array
-    {
-        $this->checkResponse($response);
-        $data = $response->json();
-        if (!is_array($data)
-            || !isset($data['orderId'], $data['status'])
-            || !(is_string($data['orderId']) || is_int($data['orderId']))
-            || (string) $data['orderId'] === ''
-            || !in_array($data['status'], self::STATUSES, true)
-            || ($expectedId !== null && (string) $data['orderId'] !== $expectedId)) {
-            throw new RuntimeException('Shoraka returned an invalid order response.');
-        }
-        if (isset($data['certificateUrl']) && !is_string($data['certificateUrl'])) {
-            throw new RuntimeException('Shoraka returned an invalid certificate URL.');
-        }
-
-        return $data;
-    }
-}

app/ShorakaTransaction.php

@@ -1,41 +0,0 @@
-<?php
-
-namespace App;
-
-use Illuminate\Database\Eloquent\Model;
-
-class ShorakaTransaction extends Model
-{
-    protected $fillable = [
-        'norujukan',
-        'kodcaw',
-        'teller',
-        'order_id',
-        'status',
-        'product_type',
-        'commodity_type',
-        'ownership_name',
-        'ownership_doc_no',
-        'order_amount',
-        'murabaha_amount',
-        'certificate_url',
-        'certificate_path',
-        'request_payload',
-        'response_payload',
-        'callback_payload',
-        'attempt_count',
-        'error_message',
-        'submitted_at',
-        'completed_at',
-    ];
-
-    protected $casts = [
-        'order_amount' => 'decimal:2',
-        'murabaha_amount' => 'decimal:2',
-        'request_payload' => 'array',
-        'response_payload' => 'array',
-        'callback_payload' => 'array',
-        'submitted_at' => 'datetime',
-        'completed_at' => 'datetime',
-    ];
-}

app/Support/v1/GadaiV1.php

@@ -88,7 +88,9 @@ class GadaiV1
 
         $hargajualan = $request->pinjaman + $upah12;
 
-        $gadaiFields = array(
+        $gadai = Gadai::on($cawangan['mysql'])
+            ->where('norujukan','=',$norujukan)
+            ->update(array(
                 'nilaimarhun' => $total_nilai_marhun,
                 'berat'=> $total_berat,
                 'pinjaman' => $request->pinjaman,
@@ -113,8 +115,7 @@ class GadaiV1
                 'upahdibayar' => 0.00,
                 'tempohbayar' => 0.00,
                 'lelong_tawarruq' => 1
-            );
-        $gadai = Gadai::on($cawangan['mysql'])->where('norujukan', $norujukan)->update($gadaiFields);
+            ));
 
         $new_data = Gadai::on($cawangan['mysql'])->where('norujukan','=',$norujukan)->first();
 

app/Support/v1/Penebusan.php

@@ -11,6 +11,8 @@ use Carbon\Carbon;
 use App\Gadai;
 use App\HargaEmas;
 use App\InOutMar;
+use App\KomuditiPurchase;
+use App\KomuditiTransaksi;
 use App\Marhun;
 use App\Moratorium;
 use App\Palsu;
@@ -807,18 +809,19 @@ class Penebusan
         $array_tebus = $request->only(['jeniskeuntungan', 'nopelanggan','jenistebus','addpinjaman','nowakil','marhun','teller','bakipinjaman','bakiupah']);
         $array_trans = $request->only(['nopelanggan', 'noic','jenisAT','pinjaman','pinjamanbaru','marhun','teller','jenistebus']);
         $array_tebus_base = $request->only(['totalbayaran', 'bakiupah','jeniskeuntungan','bakipinjaman','jenistebus','teller','nowakil','duitpelanggan']);
+        $array_trans_base = $request->only(['pinjaman','teller','pinjamanbaru']);
 
         try{
             DB::connection($cawangan['mysql'])->beginTransaction();
             $this->saveTebus($kodcaw,$norujukan,$gadai,$cawangan,$array_tebus);
-            $newReference = $this->createTransaction($cawangan,$kodcaw,$norujukan,$array_trans);
+            $this->createTransaction($cawangan,$kodcaw,$norujukan,$array_trans);
 
             DB::connection('mysql7')->beginTransaction();
             $this->saveTebusBase($kodcaw,$norujukan,$gadai,$array_tebus_base);
+            $this->createTransactionBase($norujukan,$kodcaw,$array_trans_base);
             $array_response = [
                 'result' => 'success',
-                'data' => 1,
-                'norujukan_baru' => $newReference
+                'data' => 1
             ];
 
             DB::connection($cawangan['mysql'])->commit();
@@ -946,7 +949,7 @@ class Penebusan
         $gadaiTransaction = Gadai::on($cawangan['mysql'])->where('t_gadai','=',$current->toDateString())->orderBy('sirig', 'desc')->first();
         $gadaiTransaction = optional($gadaiTransaction)->toArray();
 
-        $new_sirig = (int) ($gadaiTransaction['sirig'] ?? 0) + 1;
+        $new_sirig = ($gadaiTransaction) ? $gadaiTransaction['sirig'] + 1 : 1;
         $curent_year = substr($current->year,2,2);
         $curent_month = sprintf("%02d", $current->month);
         $current_day = sprintf("%02d", $current->day);
@@ -1074,11 +1077,37 @@ class Penebusan
                 't_update' => $current->toDateString(),
             ));
 
-            return $new_sag_number;
         }catch(\Exception $e){
             throw new \Exception("Error in Transaction: " . $e->getMessage());
         }
 
     }
 
-}
+    private function createTransactionBase($norujukan,$kodcaw,$array_trans_base){
+        $current = Carbon::now();
+
+        $komuditi_current = KomuditiPurchase::on('mysql7')->where('date_purchase','=',$current->toDateString())->orderBy('created_at','desc')->first();
+
+        $unit_current = isset($komuditi_current['unit_komuditi']) ? $komuditi_current['unit_komuditi']: 0;
+
+        try{
+            $update_unit = $unit_current - $array_trans_base['pinjamanbaru'];
+
+            KomuditiPurchase::on('mysql7')->where('id','=',$komuditi_current['id'])->update([
+                'unit_komuditi' => $update_unit
+            ]);
+
+            KomuditiTransaksi::on('mysql7')->create([
+                'unit_komuditi' => $update_unit,
+                'nosijil'=>$komuditi_current['no_sijil'],
+                'norujukan' => $norujukan,
+                'kodcaw' => $kodcaw,
+                'teller' => $array_trans_base['teller'],
+                'masa' => $current->toTimeString(),
+                'tarikh' => $current->toDateString()
+            ]);
+        }catch(\Exception $e){
+            throw new \Exception("Error in TransactionBase: " . $e->getMessage());
+        }
+    }
+}

app/Support/v2/Penebusan.php

@@ -12,6 +12,8 @@ use Carbon\Carbon;
 use App\Gadai;
 use App\HargaEmas;
 use App\InOutMar;
+use App\KomuditiPurchase;
+use App\KomuditiTransaksi;
 use App\Marhun;
 use App\FailoverTransaction;
 use App\FailoverTransactionFailed;
@@ -982,19 +984,20 @@ class Penebusan
         $array_tebus = $request->only(['jeniskeuntungan', 'nopelanggan','jenistebus','addpinjaman','nowakil','marhun','teller']);
         $array_trans = $request->only(['nopelanggan', 'noic','jenisAT','pinjaman','pinjamanbaru','marhun','teller','jenistebus']);
         $array_tebus_base = $request->only(['totalbayaran', 'bakiupah','jeniskeuntungan','bakipinjaman','jenistebus','teller','nowakil','duitpelanggan']);
+        $array_trans_base = $request->only(['pinjaman','teller','pinjamanbaru']);
 
         try{
 
             DB::connection($cawangan['mysql'])->beginTransaction();
             $this->saveTebus($kodcaw,$norujukan,$gadai,$cawangan,$array_tebus);
-            $newReference = $this->createTransaction($cawangan,$kodcaw,$norujukan,$array_trans);
+            $this->createTransaction($cawangan,$kodcaw,$norujukan,$array_trans);
 
             DB::connection('mysql7')->beginTransaction();
             $this->saveTebusBase($kodcaw,$norujukan,$gadai,$array_tebus_base);
+            $this->createTransactionBase($norujukan,$kodcaw,$array_trans_base);
             $array_response = [
                 'result' => 'success',
-                'data' => 1,
-                'norujukan_baru' => $newReference
+                'data' => 1
             ];
 
             DB::connection($cawangan['mysql'])->commit();
@@ -1041,18 +1044,19 @@ class Penebusan
         $array_tebus = $request->only(['jeniskeuntungan', 'nopelanggan','jenistebus','addpinjaman','nowakil','marhun','teller']);
         $array_trans = $request->only(['nopelanggan', 'noic','pinjaman','pinjamanbaru','marhun','teller','jenistebus']);
         $array_tebus_base = $request->only(['totalbayaran', 'bakiupah','jeniskeuntungan','bakipinjaman','jenistebus','teller','nowakil','duitpelanggan']);
+        $array_trans_base = $request->only(['pinjaman','teller','pinjamanbaru']);
 
         try{
             DB::connection($cawangan['mysql'])->beginTransaction();
             $this->saveTebus($kodcaw,$norujukan,$gadai,$cawangan,$array_tebus);
-            $newReference = $this->createTransaction($cawangan,$kodcaw,$norujukan,$array_trans);
+            $this->createTransaction($cawangan,$kodcaw,$norujukan,$array_trans);
             DB::connection('mysql7')->beginTransaction();
             $this->saveTebusBase($kodcaw,$norujukan,$gadai,$array_tebus_base);
+            $this->createTransactionBase($norujukan,$kodcaw,$array_trans_base);
 
             $array_response = [
                 'result' => 'success',
-                'data' => 1,
-                'norujukan_baru' => $newReference
+                'data' => 1
             ];
 
             DB::connection($cawangan['mysql'])->commit();
@@ -1224,7 +1228,7 @@ class Penebusan
         $gadaiTransaction = Gadai::on($cawangan['mysql'])->where('t_gadai','=',$current->toDateString())->orderBy('sirig', 'desc')->first();
         $gadaiTransaction = optional($gadaiTransaction)->toArray();
 
-        $new_sirig = (int) ($gadaiTransaction['sirig'] ?? 0) + 1;
+        $new_sirig = ($gadaiTransaction) ? $gadaiTransaction['sirig'] + 1 : 1;
         $curent_year = substr($current->year,2,2);
         $curent_month = sprintf("%02d", $current->month);
         $current_day = sprintf("%02d", $current->day);
@@ -1352,11 +1356,39 @@ class Penebusan
                 't_update' => $current->toDateString(),
             ));
 
-            return $new_sag_number;
         }catch(\Exception $e){
             throw new \Exception("Error in Transaction: " . $e->getMessage());
         }
 
     }
 
-}
+    private function createTransactionBase($norujukan,$kodcaw,$array_trans_base){
+        $current = Carbon::now();
+
+        $komuditi_current = KomuditiPurchase::on('mysql7')->where('date_purchase','=',$current->toDateString())->orderBy('created_at','desc')->first();
+
+        $unit_current = isset($komuditi_current['unit_komuditi']) ? $komuditi_current['unit_komuditi']: 0;
+
+        try{
+            $update_unit = $unit_current - $array_trans_base['pinjamanbaru'];
+
+            KomuditiPurchase::on('mysql7')->where('id','=',$komuditi_current['id'])->update([
+                'unit_komuditi' => $update_unit
+            ]);
+
+            KomuditiTransaksi::on('mysql7')->create([
+                'unit_komuditi' => $update_unit,
+                'nosijil'=>$komuditi_current['no_sijil'],
+                'norujukan' => $norujukan,
+                'kodcaw' => $kodcaw,
+                'teller' => $array_trans_base['teller'],
+                'masa' => $current->toTimeString(),
+                'tarikh' => $current->toDateString()
+            ]);
+        }catch(\Exception $e){
+            throw new \Exception("Error in TransactionBase: " . $e->getMessage());
+        }
+    }
+
+
+}

bootstrap/app.php

@@ -87,7 +87,6 @@ $app->singleton(
 */
 
 $app->configure('app');
-$app->configure('services');
 $app->configure('logging');
 $app->configure('logviewer');
 $app->configure('tinker');
@@ -97,6 +96,7 @@ $app->configure('app_parameter');
 $app->configure('parameter');
 $app->configure('whatsapp');
 $app->configure('kaunter');
+$app->configure('bsas');
 /*
 |--------------------------------------------------------------------------
 | Register Middleware

config/bsas.php

@@ -0,0 +1,14 @@
+<?php
+
+return [
+    'base_url' => rtrim(env('BSAS_BASE_URL', 'https://bsasdevapi.bursamalaysia.com/api'), '/'),
+    'token_url' => env('BSAS_TOKEN_URL', 'https://bsasdevapi.bursamalaysia.com/oauth/token'),
+    'client_id' => env('BSAS_CLIENT_ID'),
+    'client_secret' => env('BSAS_CLIENT_SECRET'),
+    'member_short_name' => env('BSAS_MEMBER_SHORT_NAME', 'KOOPPKB'),
+    'product_code' => env('BSAS_PRODUCT_CODE', 'CPO-MSIA-09'),
+    'tenor' => env('BSAS_TENOR', '00088'),
+    'max_wait_time' => (int) env('BSAS_MAX_WAIT_TIME', 10),
+    'http_timeout' => (int) env('BSAS_HTTP_TIMEOUT', 30),
+    'order_result_retries' => (int) env('BSAS_ORDER_RESULT_RETRIES', 2),
+];

config/services.php

@@ -1,23 +0,0 @@
-<?php
-
-return [
-
-    'shoraka' => [
-        // Local UI tests only: off, failed or pending. Success is deliberately excluded.
-        'simulation' => env('SHORAKA_SIMULATION', 'off'),
-        'base_url' => env(
-            'SHORAKA_BASE_URL',
-            'https://uat2.shorakagroup.com'
-        ),
-
-        'api_id' => env('SHORAKA_API_ID'),
-
-        'secret_key' => env('SHORAKA_SECRET_KEY'),
-
-        'timeout' => env(
-            'SHORAKA_TIMEOUT',
-            60
-        ),
-    ],
-
-];

database/migrations/2026_09_15_094818_create_shoraka_transactions_table.php

@@ -1,87 +0,0 @@
-<?php
-
-use Illuminate\Database\Migrations\Migration;
-use Illuminate\Database\Schema\Blueprint;
-use Illuminate\Support\Facades\Schema;
-
-class CreateShorakaTransactionsTable extends Migration
-{
-    public function up()
-    {
-        Schema::create(
-            'shoraka_transactions',
-            function (Blueprint $table) {
-                $table->id();
-
-                // Rujukan pembiayaan dalam eRahn
-                $table->string('norujukan')->unique();
-
-                // Maklumat daripada Shoraka
-                $table->string('order_id')
-                    ->nullable()
-                    ->unique();
-
-                $table->string('status')
-                    ->default('PENDING');
-
-                $table->string('product_type')
-                    ->default('FINANCING');
-
-                $table->string('commodity_type');
-
-                $table->string('ownership_name');
-                $table->string('ownership_doc_no')
-                    ->nullable();
-
-                $table->decimal(
-                    'order_amount',
-                    15,
-                    2
-                );
-
-                $table->decimal(
-                    'murabaha_amount',
-                    15,
-                    2
-                );
-
-                $table->string('certificate_url')
-                    ->nullable();
-
-                $table->string('certificate_path')
-                    ->nullable();
-
-                // Simpan payload untuk audit dan troubleshooting
-                $table->json('request_payload')
-                    ->nullable();
-
-                $table->json('response_payload')
-                    ->nullable();
-
-                $table->json('callback_payload')
-                    ->nullable();
-
-                $table->unsignedInteger('attempt_count')
-                    ->default(0);
-
-                $table->text('error_message')
-                    ->nullable();
-
-                $table->timestamp('submitted_at')
-                    ->nullable();
-
-                $table->timestamp('completed_at')
-                    ->nullable();
-
-                $table->timestamps();
-
-                $table->index('status');
-            }
-        );
-    }
-
-    public function down()
-    {
-        Schema::dropIfExists('shoraka_transactions');
-    }
-}

database/migrations/2026_10_05_120000_add_kodcaw_to_shoraka_transactions.php

@@ -1,22 +0,0 @@
-<?php
-
-use Illuminate\Database\Migrations\Migration;
-use Illuminate\Database\Schema\Blueprint;
-use Illuminate\Support\Facades\Schema;
-
-class AddKodcawToShorakaTransactions extends Migration
-{
-    public function up()
-    {
-        Schema::table('shoraka_transactions', function (Blueprint $table) {
-            $table->string('kodcaw', 20)->nullable()->index();
-        });
-    }
-
-    public function down()
-    {
-        Schema::table('shoraka_transactions', function (Blueprint $table) {
-            $table->dropColumn('kodcaw');
-        });
-    }
-}

database/migrations/2026_10_13_160000_create_bsas_orders_table.php

@@ -0,0 +1,49 @@
+<?php
+
+use Illuminate\Database\Migrations\Migration;
+use Illuminate\Database\Schema\Blueprint;
+use Illuminate\Support\Facades\Schema;
+
+class CreateBsasOrdersTable extends Migration
+{
+    /**
+     * Master DB (mysql7) — per-Terima BSAS commodity orders.
+     */
+    public function up()
+    {
+        if (Schema::connection('mysql7')->hasTable('bsas_orders')) {
+            return;
+        }
+
+        Schema::connection('mysql7')->create('bsas_orders', function (Blueprint $table) {
+            $table->bigIncrements('id');
+            $table->string('uuid', 64)->nullable()->unique();
+            $table->string('norujukan', 50)->index();
+            $table->string('kodcaw', 20)->index();
+            $table->string('serial_number', 20)->default('1');
+            $table->string('product_code', 50)->nullable();
+            $table->decimal('bid_value', 14, 2)->nullable();
+            $table->decimal('otc_murabaha_value', 14, 2)->nullable();
+            $table->string('otc_counter_party', 150)->nullable();
+            $table->string('status', 30)->default('pending')->index();
+            $table->integer('status_code')->nullable();
+            $table->string('status_message', 255)->nullable();
+            $table->string('e_cert_no', 100)->nullable()->index();
+            $table->json('bid_ecert_response')->nullable();
+            $table->json('otc_ecert_response')->nullable();
+            $table->json('stb_ecert_response')->nullable();
+            $table->json('request_payload')->nullable();
+            $table->json('order_response')->nullable();
+            $table->json('result_response')->nullable();
+            $table->string('created_by', 100)->nullable();
+            $table->timestamps();
+
+            $table->index(['norujukan', 'status']);
+        });
+    }
+
+    public function down()
+    {
+        Schema::connection('mysql7')->dropIfExists('bsas_orders');
+    }
+}

database/migrations/2026_10_26_130000_add_teller_to_shoraka_transactions.php

@@ -1,23 +0,0 @@
-<?php
-
-use Illuminate\Database\Migrations\Migration;
-use Illuminate\Database\Schema\Blueprint;
-use Illuminate\Support\Facades\DB;
-use Illuminate\Support\Facades\Schema;
-
-class AddTellerToShorakaTransactions extends Migration
-{
-    public function up()
-    {
-        Schema::table('shoraka_transactions', function (Blueprint $table) {
-            $table->string('teller')->nullable();
-        });
-    }
-
-    public function down()
-    {
-        Schema::table('shoraka_transactions', function (Blueprint $table) {
-            $table->dropColumn('teller');
-        });
-    }
-}

docker/php/Dockerfile

@@ -2,15 +2,7 @@ FROM php:7.4-fpm AS base
 
 WORKDIR /var/www/html
 
-# Debian 11 (bullseye) is EOL; deb.debian.org returns 404 for security debs.
-RUN printf '%s\n' \
-  'deb http://archive.debian.org/debian bullseye main' \
-  'deb http://archive.debian.org/debian-security bullseye-security main' \
-  'deb http://archive.debian.org/debian bullseye-updates main' \
-  > /etc/apt/sources.list \
-  && printf 'Acquire::Check-Valid-Until "false";\n' \
-  > /etc/apt/apt.conf.d/99no-check-valid-until \
-  && apt-get update \
+RUN apt-get update \
   && apt-get install -y --no-install-recommends \
   git \
   pkg-config \
@@ -35,12 +27,9 @@ COPY --from=composer:2 /usr/bin/composer /usr/local/bin/composer
 COPY docker/php/php.ini /usr/local/etc/php/conf.d/app.ini
 COPY docker/php/zz-clear-env.conf /usr/local/etc/php-fpm.d/zz-clear-env.conf
 COPY docker/php/entrypoint.sh /usr/local/bin/app-entrypoint.sh
-COPY docker/php/certs/*.crt /usr/local/share/ca-certificates/
 
-RUN update-ca-certificates \
-  && chmod +x /usr/local/bin/app-entrypoint.sh \
-  && usermod -u 1000 www-data && groupmod -g 1000 www-data \
-  && chown www-data:www-data /usr/local/etc/php/conf.d/app.ini
+RUN chmod +x /usr/local/bin/app-entrypoint.sh \
+  && usermod -u 1000 www-data && groupmod -g 1000 www-data
 
 ENTRYPOINT ["app-entrypoint.sh"]
 CMD ["php-fpm"]

docker/php/certs/sectigo-public-server-authentication-ca-dv-r36.crt

@@ -1,36 +0,0 @@
------BEGIN CERTIFICATE-----
-MIIGTDCCBDSgAwIBAgIQOXpmzCdWNi4NqofKbqvjsTANBgkqhkiG9w0BAQwFADBf
-MQswCQYDVQQGEwJHQjEYMBYGA1UEChMPU2VjdGlnbyBMaW1pdGVkMTYwNAYDVQQD
-Ey1TZWN0aWdvIFB1YmxpYyBTZXJ2ZXIgQXV0aGVudGljYXRpb24gUm9vdCBSNDYw
-HhcNMjEwMzIyMDAwMDAwWhcNMzYwMzIxMjM1OTU5WjBgMQswCQYDVQQGEwJHQjEY
-MBYGA1UEChMPU2VjdGlnbyBMaW1pdGVkMTcwNQYDVQQDEy5TZWN0aWdvIFB1Ymxp
-YyBTZXJ2ZXIgQXV0aGVudGljYXRpb24gQ0EgRFYgUjM2MIIBojANBgkqhkiG9w0B
-AQEFAAOCAY8AMIIBigKCAYEAljZf2HIz7+SPUPQCQObZYcrxLTHYdf1ZtMRe7Yeq
-RPSwygz16qJ9cAWtWNTcuICc++p8Dct7zNGxCpqmEtqifO7NvuB5dEVexXn9RFFH
-12Hm+NtPRQgXIFjx6MSJcNWuVO3XGE57L1mHlcQYj+g4hny90aFh2SCZCDEVkAja
-EMMfYPKuCjHuuF+bzHFb/9gV8P9+ekcHENF2nR1efGWSKwnfG5RawlkaQDpRtZTm
-M64TIsv/r7cyFO4nSjs1jLdXYdz5q3a4L0NoabZfbdxVb+CUEHfB0bpulZQtH1Rv
-38e/lIdP7OTTIlZh6OYL6NhxP8So0/sht/4J9mqIGxRFc0/pC8suja+wcIUna0HB
-pXKfXTKpzgis+zmXDL06ASJf5E4A2/m+Hp6b84sfPAwQ766rI65mh50S0Di9E3Pn
-2WcaJc+PILsBmYpgtmgWTR9eV9otfKRUBfzHUHcVgarub/XluEpRlTtZudU5xbFN
-xx/DgMrXLUAPaI60fZ6wA+PTAgMBAAGjggGBMIIBfTAfBgNVHSMEGDAWgBRWc1hk
-lfmSGrASKgRieaFAFYghSTAdBgNVHQ4EFgQUaMASFhgOr872h6YyV6NGUV3LBycw
-DgYDVR0PAQH/BAQDAgGGMBIGA1UdEwEB/wQIMAYBAf8CAQAwHQYDVR0lBBYwFAYI
-KwYBBQUHAwEGCCsGAQUFBwMCMBsGA1UdIAQUMBIwBgYEVR0gADAIBgZngQwBAgEw
-VAYDVR0fBE0wSzBJoEegRYZDaHR0cDovL2NybC5zZWN0aWdvLmNvbS9TZWN0aWdv
-UHVibGljU2VydmVyQXV0aGVudGljYXRpb25Sb290UjQ2LmNybDCBhAYIKwYBBQUH
-AQEEeDB2ME8GCCsGAQUFBzAChkNodHRwOi8vY3J0LnNlY3RpZ28uY29tL1NlY3Rp
-Z29QdWJsaWNTZXJ2ZXJBdXRoZW50aWNhdGlvblJvb3RSNDYucDdjMCMGCCsGAQUF
-BzABhhdodHRwOi8vb2NzcC5zZWN0aWdvLmNvbTANBgkqhkiG9w0BAQwFAAOCAgEA
-YtOC9Fy+TqECFw40IospI92kLGgoSZGPOSQXMBqmsGWZUQ7rux7cj1du6d9rD6C8
-ze1B2eQjkrGkIL/OF1s7vSmgYVafsRoZd/IHUrkoQvX8FZwUsmPu7amgBfaY3g+d
-q1x0jNGKb6I6Bzdl6LgMD9qxp+3i7GQOnd9J8LFSietY6Z4jUBzVoOoz8iAU84OF
-h2HhAuiPw1ai0VnY38RTI+8kepGWVfGxfBWzwH9uIjeooIeaosVFvE8cmYUB4TSH
-5dUyD0jHct2+8ceKEtIoFU/FfHq/mDaVnvcDCZXtIgitdMFQdMZaVehmObyhRdDD
-4NQCs0gaI9AAgFj4L9QtkARzhQLNyRf87Kln+YU0lgCGr9HLg3rGO8q+Y4ppLsOd
-unQZ6ZxPNGIfOApbPVf5hCe58EZwiWdHIMn9lPP6+F404y8NNugbQixBber+x536
-WrZhFZLjEkhp7fFXf9r32rNPfb74X/U90Bdy4lzp3+X1ukh1BuMxA/EEhDoTOS3l
-7ABvc7BYSQubQ2490OcdkIzUh3ZwDrakMVrbaTxUM2p24N6dB+ns2zptWCva6jzW
-r8IWKIMxzxLPv5Kt3ePKcUdvkBU/smqujSczTzzSjIoR5QqQA6lN1ZRSnuHIWCvh
-JEltkYnTAH41QJ6SAWO66GrrUESwN/cgZzL4JLEqz1Y=
------END CERTIFICATE-----

docker/php/certs/sectigo-public-server-authentication-root-r46.crt

@@ -1,32 +0,0 @@
------BEGIN CERTIFICATE-----
-MIIFijCCA3KgAwIBAgIQdY39i658BwD6qSWn4cetFDANBgkqhkiG9w0BAQwFADBf
-MQswCQYDVQQGEwJHQjEYMBYGA1UEChMPU2VjdGlnbyBMaW1pdGVkMTYwNAYDVQQD
-Ey1TZWN0aWdvIFB1YmxpYyBTZXJ2ZXIgQXV0aGVudGljYXRpb24gUm9vdCBSNDYw
-HhcNMjEwMzIyMDAwMDAwWhcNNDYwMzIxMjM1OTU5WjBfMQswCQYDVQQGEwJHQjEY
-MBYGA1UEChMPU2VjdGlnbyBMaW1pdGVkMTYwNAYDVQQDEy1TZWN0aWdvIFB1Ymxp
-YyBTZXJ2ZXIgQXV0aGVudGljYXRpb24gUm9vdCBSNDYwggIiMA0GCSqGSIb3DQEB
-AQUAA4ICDwAwggIKAoICAQCTvtU2UnXYASOgHEdCSe5jtrch/cSV1UgrJnwUUxDa
-ef0rty2k1Cz66jLdScK5vQ9IPXtamFSvnl0xdE8H/FAh3aTPaE8bEmNtJZlMKpnz
-SDBh+oF8HqcIStw+KxwfGExxqjWMrfhu6DtK2eWUAtaJhBOqbchPM8xQljeSM9xf
-iOefVNlI8JhD1mb9nxc4Q8UBUQvX4yMPFF1bFOdLvt30yNoDN9HWOaEhUTCDsG3X
-ME6WW5HwcCSrv0WBZEMNvSE6Lzzpng3LILVCJ8zab5vuZDCQOc2TZYEhMbUjUDM3
-IuM47fgxMMxF/mL50V0yeUKH32rMVhlATc6qu/m1dkmU8Sf4kaWD5QazYw6A3OAS
-VYCmO2a0OYctyPDQ0RTp5A1NDvZdV3LFOxxHVp3i1fuBYYzMTYCQNFu31xR13NgE
-SJ/AwSiItOkcyqex8Va3e0lMWeUgFaiEAin6OJRpmkkGj80feRQXEgyDet4fsZfu
-+Zd4KKTIRJLpfSYFplhym3kT2BFfrsU4YjRosoYwjviQYZ4ybPUHNs2iTG7sijbt
-8uaZFURww3y8nDnAtOFr94MlI1fZEoDlSfB1D++N6xybVCi0ITz8fAr/73trdf+L
-HaAZBav6+CuBQug4urv7qv094PPK306Xlynt8xhW6aWWrL3DkJiy4Pmi1KZHQ3xt
-zwIDAQABo0IwQDAdBgNVHQ4EFgQUVnNYZJX5khqwEioEYnmhQBWIIUkwDgYDVR0P
-AQH/BAQDAgGGMA8GA1UdEwEB/wQFMAMBAf8wDQYJKoZIhvcNAQEMBQADggIBAC9c
-mTz8Bl6MlC5w6tIyMY208FHVvArzZJ8HXtXBc2hkeqK5Duj5XYUtqDdFqij0lgVQ
-YKlJfp/imTYpE0RHap1VIDzYm/EDMrraQKFz6oOht0SmDpkBm+S8f74TlH7Kph52
-gDY9hAaLMyZlbcp+nv4fjFg4exqDsQ+8FxG75gbMY/qB8oFM2gsQa6H61SilzwZA
-Fv97fRheORKkU55+MkIQpiGRqRxOF3yEvJ+M0ejf5lG5Nkc/kLnHvALcWxxPDkjB
-JYOcCj+esQMzEhonrPcibCTRAUH4WAP+JWgiH5paPHxsnnVI84HxZmduTILA7rpX
-DhjvLpr3Etiga+kFpaHpaPi8TD8SHkXoUsCjvxInebnMMTzD9joiFgOgyY9mpFui
-TdaBJQbpdqQACj7LzTWb4OE4y2BThihCQRxEV+ioratF4yUQvNs+ZUH7G6aXD+u5
-dHn5HrwdVw1Hr8Mvn4dGp+smWg9WY7ViYG4A++MnESLn/pmPNPW56MORcr3Ywx65
-LvKRRFHQV80MNNVIIb/bE/FmJUNS0nAiNs2fxBx1IK1jcmMGDw4nztJqDby1ORrp
-0XZ60Vzk50lJLVU3aPAaOpg+VBeHVOmmJ1CJeyAvP/+/oYtKR5j/K3tJPsMpRmAY
-QqszKbrAKbkTidOIijlBO8n9pu0f9GBj39ItVQGL
------END CERTIFICATE-----

docker/php/entrypoint.sh

@@ -3,15 +3,6 @@ set -e
 
 cd /var/www/html
 
-# Point PHP/cURL at the system CA bundle and trust Sectigo R36/R46 for Shoraka TLS.
-if [ -f docker/php/php.ini ]; then
-  cp docker/php/php.ini /usr/local/etc/php/conf.d/app.ini
-fi
-if [ -d docker/php/certs ]; then
-  cp docker/php/certs/*.crt /usr/local/share/ca-certificates/ 2>/dev/null || true
-  update-ca-certificates >/dev/null 2>&1 || true
-fi
-
 if [ "${USE_STAGING_ENV:-false}" = "true" ] && [ -f .env.staging ]; then
   cp .env.staging .env
 fi

docker/php/php.ini

@@ -2,5 +2,3 @@ memory_limit=512M
 upload_max_filesize=50M
 post_max_size=50M
 max_execution_time=120
-openssl.cafile=/etc/ssl/certs/ca-certificates.crt
-curl.cainfo=/etc/ssl/certs/ca-certificates.crt

routes/web.php

@@ -119,19 +119,6 @@ $router->group(['prefix'=>'api'], function () use ($router){
     $router->get('gadai/list/rekod/old',['uses'=>'GadaiController@rekodGadaian']);
     $router->get('gadai/online/search/detail',['uses'=>'GadaiController@searchGadaiOnline']);
 
-    $router->get('shoraka/readiness', ['uses' => 'ShorakaGadaiController@readiness']);
-    $router->get('shoraka/transactions', ['uses' => 'ShorakaController@index']);
-    $router->get('shoraka/gadai/{kodcaw}/{norujukan}', ['uses' => 'ShorakaGadaiController@showGadai']);
-    $router->post('shoraka/gadai/{kodcaw}/{norujukan}/submit', ['uses' => 'ShorakaGadaiController@submitGadai']);
-    $router->post('shoraka/gadai/{kodcaw}/{norujukan}/refresh', ['uses' => 'ShorakaGadaiController@refreshGadai']);
-    $router->get('shoraka/gadai/{kodcaw}/{norujukan}/certificate', ['uses' => 'ShorakaGadaiController@certificateGadai']);
-
-    // Shoraka Commodity API
-    $router->post('shoraka/orders',['uses' => 'ShorakaController@submit']);
-    $router->post('shoraka/orders/{norujukan}/refresh', ['uses' => 'ShorakaController@refresh']);
-    $router->get('shoraka/orders/{norujukan}/certificate', ['uses' => 'ShorakaController@certificate']);
-    $router->post('shoraka/callback', ['uses' => 'ShorakaController@callback']);
-
     $router->get('check/serah/gadai',['uses'=>'GadaiController@checkSerahGadaian']);
     $router->get('check/serah/tebus',['uses'=>'TebusController@checkSerahTebus']);
     $router->get('check/serah/lelong',['uses'=>'LelongController@checkSerahLelong']);
@@ -678,6 +665,13 @@ $router->group(['prefix'=>'api'], function () use ($router){
     $router->put('komuditi/transaksi',['uses'=>'KomuditiController@transaksiKomuditi']);
     $router->put('komuditi/batal',['uses'=>'KomuditiController@batalKomuditi']);
 
+    // BSAS per-Terima commodity order
+    $router->get('komuditi/bsas/orders',['uses'=>'KomuditiController@listBsasOrders']);
+    $router->post('komuditi/bsas/order',['uses'=>'KomuditiController@placeBsasOrder']);
+    $router->get('komuditi/bsas/order/norujukan/{norujukan}',['uses'=>'KomuditiController@getBsasOrderByNorujukan']);
+    $router->get('komuditi/bsas/order/{uuid}/ecert',['uses'=>'KomuditiController@getBsasOrderEcert']);
+    $router->get('komuditi/bsas/order/{uuid}',['uses'=>'KomuditiController@getBsasOrder']);
+
     $router->get('komuditi/produk',['uses'=>'KomuditiController@getKomuditiProduct']);
     $router->get('komuditi/unit',['uses'=>'KomuditiController@getKomuditiProductUnit']);
     $router->get('komuditi/description',['uses'=>'KomuditiController@getKomuditiProductDescription']);

tests/ShorakaGadaiTest.php

@@ -1,124 +0,0 @@
-<?php
-
-require_once __DIR__ . '/ShorakaIntegrationTest.php';
-
-use Illuminate\Support\Facades\DB;
-use Illuminate\Support\Facades\Schema;
-use Illuminate\Database\Schema\Blueprint;
-use Illuminate\Support\Facades\Http;
-use App\ShorakaTransaction;
-
-class ShorakaGadaiTest extends ShorakaIntegrationTest
-{
-    protected function setUp(): void
-    {
-        parent::setUp();
-        foreach (['mysql7', 'branch_test'] as $connection) {
-            $this->app['config']->set('database.connections.' . $connection, [
-                'driver' => 'sqlite', 'database' => ':memory:', 'prefix' => '',
-            ]);
-            DB::purge($connection);
-        }
-        Schema::connection('mysql7')->create('arrahn_master_db', function (Blueprint $table) {
-            $table->string('kodcaw'); $table->string('mysql');
-        });
-        Schema::connection('mysql7')->create('customer', function (Blueprint $table) {
-            $table->string('kpbaru'); $table->string('kplama')->nullable(); $table->string('nama');
-        });
-        Schema::connection('mysql7')->create('komuditi_transaksi', function (Blueprint $table) {
-            $table->string('norujukan');
-        });
-        Schema::connection('branch_test')->create('gadai', function (Blueprint $table) {
-            $table->string('norujukan'); $table->string('nokp'); $table->string('kodcaw');
-            $table->decimal('pinjaman', 15, 2); $table->decimal('hargajualan', 15, 2);
-            $table->integer('tagserah')->default(0);
-            $table->integer('tagkomuditi')->default(0); $table->integer('cetak')->default(0);
-            $table->string('sttebus')->default('');
-        });
-        DB::connection('mysql7')->table('arrahn_master_db')->insert([
-            ['kodcaw' => 'KB2', 'mysql' => 'branch_test'],
-            ['kodcaw' => 'KB3', 'mysql' => 'branch_test'],
-        ]);
-        DB::connection('mysql7')->table('customer')->insert(['kpbaru' => 'IC-1', 'nama' => 'Nama Database']);
-        DB::connection('branch_test')->table('gadai')->insert([
-            'norujukan' => 'SAG-001', 'kodcaw' => 'KB2', 'nokp' => 'IC-1',
-            'pinjaman' => 1000, 'hargajualan' => 1200,
-        ]);
-    }
-
-    public function testBranchSubmissionUsesDatabaseAmountsAndSynchronizesTag(): void
-    {
-        $this->fakeResponse(['orderId' => '9999', 'status' => 'Completed']);
-        $this->json('POST', '/api/shoraka/gadai/KB2/SAG-001/submit', [
-            'order_amount' => 1, 'ownership' => 'Tampered',
-        ])->seeStatusCode(200);
-        Http::assertSent(function ($request) {
-            return $request['order_amount'] === '1000.00'
-                && $request['murabaha_amount'] === '1200.00'
-                && $request['ownership'] === 'Nama Database'
-                && (int) $request['tenor_other'] === 12;
-        });
-        $this->assertSame('KB2', ShorakaTransaction::first()->kodcaw);
-        $this->assertEquals(1, DB::connection('branch_test')->table('gadai')->value('tagkomuditi'));
-        $this->json('GET', '/api/shoraka/gadai/KB2/SAG-001')->seeJson(['can_complete' => true]);
-    }
-
-    public function testPendingOrderKeepsTagUnsetAndBlocksSag(): void
-    {
-        $this->fakeResponse(['orderId' => '9999', 'status' => 'Active']);
-        $this->json('POST', '/api/shoraka/gadai/KB2/SAG-001/submit')->seeStatusCode(200);
-        $this->assertEquals(0, DB::connection('branch_test')->table('gadai')->value('tagkomuditi'));
-        $this->json('PUT', '/api/gadai/norujukan/cetak/KB2/SAG-001')->seeStatusCode(409);
-    }
-
-    public function testLegacyPurchaseCannotBeSubmittedAgain(): void
-    {
-        DB::connection('mysql7')->table('komuditi_transaksi')->insert(['norujukan' => 'SAG-001']);
-        Http::fake();
-        $this->json('POST', '/api/shoraka/gadai/KB2/SAG-001/submit')->seeStatusCode(409);
-        Http::assertNothingSent();
-    }
-
-    public function testChangedFinancingCannotBeCompleted(): void
-    {
-        $record = $this->transaction('Completed');
-        $record->update(['kodcaw' => 'KB2']);
-        DB::connection('branch_test')->table('gadai')->update(['pinjaman' => 900]);
-        $this->json('GET', '/api/shoraka/gadai/KB2/SAG-001')->seeJson(['can_complete' => false]);
-        $this->json('GET', '/api/shoraka/gadai/KB2/SAG-001/certificate')->seeStatusCode(409);
-    }
-
-    public function testDifferentBranchCannotReadOrder(): void
-    {
-        $record = $this->transaction('Completed');
-        $record->update(['kodcaw' => 'KB2']);
-        $this->json('GET', '/api/shoraka/gadai/KB3/SAG-001')->seeStatusCode(404);
-    }
-
-    public function testHistoricalFinancingWithoutCommodityLedgerCanStillBeHandedOver(): void
-    {
-        Http::fake();
-        $this->json('PUT', '/api/gadai/norujukan/serah/KB2/SAG-001')->seeStatusCode(200);
-        $this->assertEquals(1, DB::connection('branch_test')->table('gadai')->value('tagserah'));
-        Http::assertNothingSent();
-    }
-
-    public function testSubmittedContractCannotBeRegisteredAgain(): void
-    {
-        $this->transaction('Completed')->update(['kodcaw' => 'KB2']);
-        Http::fake();
-        $this->json('PUT', '/api/gadai/norujukan/KB2/SAG-001', [
-            'kodcaw' => 'KB2', 'norujukan' => 'SAG-001',
-        ])->seeStatusCode(409);
-        Http::assertNothingSent();
-    }
-
-    public function testShorakaOrderCannotUpdateOrCancelLegacyStock(): void
-    {
-        $this->transaction('Completed')->update(['kodcaw' => 'KB2']);
-        Http::fake();
-        $this->json('PUT', '/api/komuditi/update', ['norujukan' => 'SAG-001'])->seeStatusCode(409);
-        $this->json('PUT', '/api/komuditi/batal', ['norujukan' => 'SAG-001'])->seeStatusCode(409);
-        Http::assertNothingSent();
-    }
-}

tests/ShorakaIntegrationTest.php

@@ -1,260 +0,0 @@
-<?php
-
-use App\Services\ShorakaService;
-use App\ShorakaTransaction;
-use Illuminate\Support\Facades\DB;
-use Illuminate\Support\Facades\Http;
-use Illuminate\Http\Client\Factory;
-use Illuminate\Support\Facades\Log;
-
-class ShorakaIntegrationTest extends TestCase
-{
-    protected function setUp(): void
-    {
-        parent::setUp();
-        $this->app['config']->set('services.shoraka', [
-            'base_url' => 'https://shoraka.test',
-            'api_id' => 'API_ID',
-            'secret_key' => 'SECRET_KEY',
-            'timeout' => 5,
-        ]);
-        // All database writes stay in memory; never run migrations on branch databases.
-        $this->app['config']->set('database.default', 'shoraka_test');
-        $this->app['config']->set('database.connections.shoraka_test', [
-            'driver' => 'sqlite', 'database' => ':memory:', 'prefix' => '',
-        ]);
-        DB::purge('shoraka_test');
-        require_once __DIR__ . '/../database/migrations/2026_09_15_094818_create_shoraka_transactions_table.php';
-        (new CreateShorakaTransactionsTable())->up();
-        require_once __DIR__ . '/../database/migrations/2026_10_05_120000_add_kodcaw_to_shoraka_transactions.php';
-        (new AddKodcawToShorakaTransactions())->up();
-        require_once __DIR__ . '/../database/migrations/2026_10_26_130000_add_teller_to_shoraka_transactions.php';
-        (new AddTellerToShorakaTransactions())->up();
-        Http::swap(new Factory());
-        // Fail any HTTP request that a test did not explicitly stub.
-        Log::shouldReceive('error')->zeroOrMoreTimes();
-    }
-
-    protected function fakeResponse($body, array $headers = [], int $status = 200): void
-    {
-        Http::fake(function ($request) use ($body, $headers, $status) {
-            $this->assertStringStartsWith('https://shoraka.test/api/', $request->url());
-            return Http::response($body, $status, $headers);
-        });
-    }
-
-    protected function submission(): array
-    {
-        return [
-            'norujukan' => 'SAG-001', 'ownership' => 'Abu Samad',
-            'order_amount' => '1000.00', 'murabaha_amount' => '1200.00',
-            'tenor_other' => 6,
-        ];
-    }
-
-    protected function transaction(string $status = 'Active', $orderId = '9999'): ShorakaTransaction
-    {
-        return ShorakaTransaction::create([
-            'norujukan' => 'SAG-001', 'order_id' => $orderId, 'status' => $status,
-            'product_type' => 'FINANCING', 'commodity_type' => '000-COPPER',
-            'ownership_name' => 'Abu Samad', 'order_amount' => '1000.00',
-            'murabaha_amount' => '1200.00', 'attempt_count' => 1,
-        ]);
-    }
-
-    protected function callbackPayload(): array
-    {
-        // Published signature example, v1.5 page 14.
-        return [
-            'apiId' => 'API_ID', 'orderId' => '9999', 'status' => 'Completed',
-            'bankName' => 'Test Bank Bhd', 'ownershipName' => 'Abu Samad',
-            'commodityType' => '000-COPPER', 'unit' => 'Tonne', 'volume' => '245.678901',
-            'productType' => 'FINANCING', 'valueDate' => '08/12/2025', 'cancelDate' => '',
-            'orderType' => 'Buy & Sell', 'orderCurrency' => 'MYR',
-            'orderAmount' => '1000000.00', 'murabahaAmount' => '1000000.00',
-            'tenor' => 'O/N', 'tenorOther' => '', 'tenorOtherUnit' => '',
-            'signature' => 'bbc6f59e9c64aea9e30f3c03d30f63e8fc37898d2699c0cdd41e416a518aa122',
-        ];
-    }
-
-    public function testSubmitSignatureMatchesPublishedExample(): void
-    {
-        $this->fakeResponse(['orderId' => '12345', 'status' => 'Completed']);
-        (new ShorakaService())->submitOrder([
-            'product_type' => 'DEPOSIT', 'commodity_type' => '000-COPPER',
-            'ownership' => 'Abu Samad', 'value_date' => '10/11/2022',
-            'order_currency' => 'MYR', 'order_amount' => 1000000,
-            'murabaha_amount' => 1000000, 'tenor' => 'O/N',
-            'order_type' => 'Buy & Sell', 'ownership_doc_no' => 'SAG-001',
-        ]);
-        Http::assertSent(function ($request) {
-            return $request->method() === 'POST'
-                && $request->url() === 'https://shoraka.test/api/submitorder'
-                && $request->hasHeader('Content-Type', 'application/x-www-form-urlencoded')
-                && $request['order_amount'] === '1000000.00'
-                && $request['ownership_doc_no'] === 'SAG-001'
-                && $request['signature'] === '43970ac7a5c3867133af0dd92fd5eef9a7b415ebdb8b0d1025d4686bc25693bd';
-        });
-    }
-
-    public function testStatusUsesPublishedSignatureAndChecksOrderIdentity(): void
-    {
-        $this->fakeResponse(['orderId' => '12345', 'status' => 'Active']);
-        (new ShorakaService())->orderStatus('12345');
-        Http::assertSent(function ($request) {
-            return $request->method() === 'POST'
-                && $request->url() === 'https://shoraka.test/api/orderstatus'
-                && $request['signature'] === 'add9890b2a08cf47290e8869d4a25b7f4b73cb075c20aa95aa47d1bbfe6b62fc';
-        });
-        $this->expectException(RuntimeException::class);
-        (new ShorakaService())->orderStatus('another-order');
-    }
-
-    public function testCallbackSignatureMatchesPublishedExampleAndRejectsTampering(): void
-    {
-        $service = new ShorakaService();
-        $payload = $this->callbackPayload();
-        $this->assertTrue($service->validCallback($payload));
-        foreach (ShorakaService::CALLBACK_FIELDS as $field) {
-            $changed = $payload;
-            $changed[$field] .= 'x';
-            $this->assertFalse($service->validCallback($changed), $field);
-            $missing = $payload;
-            unset($missing[$field]);
-            $this->assertFalse($service->validCallback($missing), $field);
-        }
-        $payload['apiId'] = 'wrong';
-        $this->assertFalse($service->validCallback($payload));
-    }
-
-    public function testSubmitPersistsOrderAndRejectsDuplicate(): void
-    {
-        $this->fakeResponse(['orderId' => '9999', 'status' => 'Completed']);
-        $this->json('POST', '/api/shoraka/orders', $this->submission())->seeStatusCode(200);
-        $record = ShorakaTransaction::first();
-        $this->assertSame('9999', $record->order_id);
-        $this->assertSame('Completed', $record->status);
-        $this->assertNotNull($record->completed_at);
-        $this->assertArrayNotHasKey('signature', $record->request_payload);
-        $this->assertSame('OTHERS', $record->request_payload['tenor']);
-        $this->json('POST', '/api/shoraka/orders', $this->submission())->seeStatusCode(409);
-        Http::assertSentCount(1);
-    }
-
-    public function testAmbiguousFailureBlocksResubmissionAndHidesUpstreamBody(): void
-    {
-        $this->fakeResponse('SECRET_KEY confidential', [], 500);
-        $this->json('POST', '/api/shoraka/orders', $this->submission())->seeStatusCode(502);
-        $this->assertStringNotContainsString('SECRET_KEY', $this->response->getContent());
-        $record = ShorakaTransaction::first();
-        $this->assertSame('UNKNOWN', $record->status);
-        $this->assertStringNotContainsString('SECRET_KEY', $record->error_message);
-        $this->json('POST', '/api/shoraka/orders', $this->submission())->seeStatusCode(409);
-        Http::assertSentCount(1);
-    }
-
-    public function testPendingSubmissionCannotBeSubmittedAgain(): void
-    {
-        $this->transaction('PENDING', null);
-        Http::fake();
-        $this->json('POST', '/api/shoraka/orders', $this->submission())->seeStatusCode(409);
-        Http::assertNothingSent();
-    }
-
-    public function testRefreshUpdatesStatus(): void
-    {
-        $record = $this->transaction();
-        $this->fakeResponse(['orderId' => '9999', 'status' => 'Completed']);
-        $this->json('POST', '/api/shoraka/orders/SAG-001/refresh')->seeStatusCode(200);
-        $this->assertSame('Completed', $record->fresh()->status);
-        $this->assertNotNull($record->fresh()->completed_at);
-    }
-
-    public function testCallbackAcknowledgesAndUsesCurrentStatusNotUnsignedFields(): void
-    {
-        $record = $this->transaction();
-        $payload = $this->callbackPayload();
-        $payload['certificateUrl'] = 'https://untrusted.test/file';
-        $payload['ownershipDocNo'] = 'other-reference';
-        $this->fakeResponse([
-            'orderId' => '9999', 'status' => 'Cancelled',
-            'certificateUrl' => 'https://shoraka.test/certificate/9999',
-        ]);
-        $this->json('POST', '/api/shoraka/callback', $payload)->seeStatusCode(200);
-        $this->assertSame('OK', $this->response->getContent());
-        $this->assertSame('Cancelled', $record->fresh()->status);
-        $this->assertSame('https://shoraka.test/certificate/9999', $record->fresh()->certificate_url);
-        $this->assertArrayNotHasKey('signature', $record->fresh()->callback_payload);
-        // Repeated delivery is acknowledged without creating another order.
-        $this->json('POST', '/api/shoraka/callback', $payload)->seeStatusCode(200);
-        $this->assertSame(1, ShorakaTransaction::count());
-    }
-
-    public function testInvalidCallbackDoesNotMutateOrCallUpstream(): void
-    {
-        $record = $this->transaction();
-        Http::fake();
-        $payload = $this->callbackPayload();
-        $payload['status'] = 'Cancelled';
-        $this->json('POST', '/api/shoraka/callback', $payload)->seeStatusCode(401);
-        $this->assertSame('Active', $record->fresh()->status);
-        Http::assertNothingSent();
-    }
-
-    public function testUnknownCallbackIsNotAcknowledged(): void
-    {
-        Http::fake();
-        $this->json('POST', '/api/shoraka/callback', $this->callbackPayload())->seeStatusCode(404);
-        Http::assertNothingSent();
-    }
-
-    public function testFailedCallbackRefreshPreservesRecord(): void
-    {
-        $record = $this->transaction();
-        $this->fakeResponse('unavailable', [], 503);
-        $this->json('POST', '/api/shoraka/callback', $this->callbackPayload())->seeStatusCode(502);
-        $this->assertSame('Active', $record->fresh()->status);
-        $this->assertNull($record->fresh()->callback_payload);
-    }
-
-    public function testCertificateReturnsPdfFromFixedEndpoint(): void
-    {
-        $this->transaction('Completed', '12345');
-        $pdf = "%PDF-1.4\nexample";
-        $this->fakeResponse($pdf, ['Content-Type' => 'application/pdf']);
-        $this->get('/api/shoraka/orders/SAG-001/certificate')->seeStatusCode(200);
-        $this->assertSame($pdf, $this->response->getContent());
-        $this->assertSame('application/pdf', $this->response->headers->get('Content-Type'));
-        Http::assertSent(function ($request) {
-            return $request->method() === 'POST'
-                && $request->url() === 'https://shoraka.test/api/certificate'
-                && $request['signature'] === 'add9890b2a08cf47290e8869d4a25b7f4b73cb075c20aa95aa47d1bbfe6b62fc';
-        });
-    }
-
-    public function testCertificateRejectsNonPdf(): void
-    {
-        $this->transaction();
-        $this->fakeResponse(['error' => 'not ready']);
-        $this->get('/api/shoraka/orders/SAG-001/certificate')->seeStatusCode(502);
-    }
-
-    public function testMissingCredentialsPreventRequests(): void
-    {
-        $this->app['config']->set('services.shoraka.secret_key', '');
-        Http::fake();
-        $this->json('POST', '/api/shoraka/orders', $this->submission())->seeStatusCode(503);
-        $this->json('POST', '/api/shoraka/callback', $this->callbackPayload())->seeStatusCode(503);
-        $this->assertSame(0, ShorakaTransaction::count());
-        Http::assertNothingSent();
-    }
-
-    public function testMissingOrderIdCannotBeRefreshedOrDownloaded(): void
-    {
-        $this->transaction('UNKNOWN', null);
-        Http::fake();
-        $this->json('POST', '/api/shoraka/orders/SAG-001/refresh')->seeStatusCode(409);
-        $this->get('/api/shoraka/orders/SAG-001/certificate')->seeStatusCode(409);
-        Http::assertNothingSent();
-    }
-}