Merge branch 'main' of https://git.koppkb.com/KoPKB/api_arrahn into feature/shoraka-integration

Co-authored-by: afrina <afrina@koppkb.com>
Reviewed-on: #23

.env.annur

@@ -0,0 +1,28 @@
+APP_NAME=Lumen
+APP_ENV=production
+APP_KEY=WbPGkYNmXZ6ZQplGlvl0iZ7zyW1b09xa
+APP_DEBUG=true
+APP_URL=https://apiannurv2.erahn.com.my
+APP_TIMEZONE=Asia/Kuala_Lumpur
+
+LOG_CHANNEL=stack
+LOG_SLACK_WEBHOOK_URL=
+
+DB_CONNECTION_2=mysql
+DB_HOST_2=192.168.1.216
+DB_PORT_2=3306
+DB_DATABASE_2=annur_tampoi
+DB_USERNAME_2=spider
+DB_PASSWORD_2=arrahn@123
+
+DB_CONNECTION_7=mysql
+DB_HOST_7=192.168.1.216
+DB_PORT_7=3306
+DB_DATABASE_7=master_annur
+DB_USERNAME_7=spider
+DB_PASSWORD_7=arrahn@123
+
+CACHE_DRIVER=file
+QUEUE_CONNECTION=sync
+
+TENNANT_MASTER_DB=master_annur

.env.docker

@@ -4,6 +4,8 @@ APP_KEY=WbPGkYNmXZ6ZQplGlvl0iZ7zyW1b09xa
 APP_DEBUG=true
 APP_URL=http://localhost
 APP_TIMEZONE=Asia/Kuala_Lumpur
+API_ARRAHNBID=http://lelong.test/api/
+API_ARRAHNBID_ANNUR=http://lelong-annur.test/api/
 
 LOG_CHANNEL=stack
 LOG_LEVEL=debug
@@ -62,5 +64,8 @@ DB_PASSWORD_7=root
 TENNANT_MASTER_DB=master_erahn
 TENNANT_KAUNTER_DB=kaunter_erahn
 
+KAUNTER_URL=http://host.docker.internal:8081
+INTERNAL_NOTIFICATION_SECRET=erahn-local-notification-secret
+
 CACHE_DRIVER=file
 QUEUE_CONNECTION=sync

.env.example

@@ -5,6 +5,7 @@ APP_DEBUG=true
 APP_URL=http://api_arrahn.test
 APP_TIMEZONE=Asia/Kuala_Lumpur
 API_ARRAHNBID=http://lelong.test/api/
+API_ARRAHNBID_ANNUR=http://lelong-annur.test/api/
 
 LOG_CHANNEL=stack
 LOG_SLACK_WEBHOOK_URL=
@@ -86,172 +87,24 @@ DB_DATABASE_11=arrahn_pputeh
 DB_USERNAME_11=spider
 DB_PASSWORD_11=G0dz!ll42020
 
-DB_CONNECTION_12=mysql
-DB_HOST_12=127.0.0.1
-DB_PORT_12=3306
-DB_DATABASE_12=arrahn_rpanjang
-DB_USERNAME_12=spider
-DB_PASSWORD_12=G0dz!ll42020
-
-DB_CONNECTION_13=mysql
-DB_HOST_13=127.0.0.1
-DB_PORT_13=3306
-DB_DATABASE_13=arrahn_tmerah
-DB_USERNAME_13=spider
-DB_PASSWORD_13=G0dz!ll42020
-
-DB_CONNECTION_14=mysql
-DB_HOST_14=127.0.0.1
-DB_PORT_14=3306
-DB_DATABASE_14=arrahn_wb
-DB_USERNAME_14=spider
-DB_PASSWORD_14=G0dz!ll42020
-
-DB_CONNECTION_15=mysql
-DB_HOST_15=127.0.0.1
-DB_PORT_15=3306
-DB_DATABASE_15=arrahn_wcy
-DB_USERNAME_15=spider
-DB_PASSWORD_15=G0dz!ll42020
-
-DB_CONNECTION_16=mysql
-DB_HOST_16=127.0.0.1
-DB_PORT_16=3306
-DB_DATABASE_16=arrahn_bentong
-DB_USERNAME_16=spider
-DB_PASSWORD_16=G0dz!ll42020
-
-DB_CONNECTION_17=mysql
-DB_HOST_17=192.168.0.102
-DB_PORT_17=3306
-DB_DATABASE_17=arrahn_kajang
-DB_USERNAME_17=spider
-DB_PASSWORD_17=G0dz!ll42020
-
-DB_CONNECTION_18=mysql
-DB_HOST_18=192.168.0.102
-DB_PORT_18=3306
-DB_DATABASE_18=arrahn_kangar
-DB_USERNAME_18=spider
-DB_PASSWORD_18=G0dz!ll42020
-
-DB_CONNECTION_19=mysql
-DB_HOST_19=192.168.0.102
-DB_PORT_19=3306
-DB_DATABASE_19=arrahn_kuantan
-DB_USERNAME_19=spider
-DB_PASSWORD_19=G0dz!ll42020
-
-DB_CONNECTION_20=mysql
-DB_HOST_20=192.168.0.102
-DB_PORT_20=3306
-DB_DATABASE_20=arrahn_pgudang
-DB_USERNAME_20=spider
-DB_PASSWORD_20=G0dz!ll42020
-
-DB_CONNECTION_21=mysql
-DB_HOST_21=192.168.0.102
-DB_PORT_21=3306
-DB_DATABASE_21=arrahn_raub
-DB_USERNAME_21=spider
-DB_PASSWORD_21=G0dz!ll42020
-
-DB_CONNECTION_22=mysql
-DB_HOST_22=192.168.0.102
-DB_PORT_22=3306
-DB_DATABASE_22=arrahn_rlaut
-DB_USERNAME_22=spider
-DB_PASSWORD_22=G0dz!ll42020
-
-DB_CONNECTION_23=mysql
-DB_HOST_23=192.168.0.102
-DB_PORT_23=3306
-DB_DATABASE_23=arrahn_skudai
-DB_USERNAME_23=spider
-DB_PASSWORD_23=G0dz!ll42020
-
-DB_CONNECTION_24=mysql
-DB_HOST_24=192.168.0.102
-DB_PORT_24=3306
-DB_DATABASE_24=arrahn_spetani
-DB_USERNAME_24=spider
-DB_PASSWORD_24=G0dz!ll42020
-
-DB_CONNECTION_25=mysql
-DB_HOST_25=192.168.0.102
-DB_PORT_25=3306
-DB_DATABASE_25=arrahn_temerloh
-DB_USERNAME_25=spider
-DB_PASSWORD_25=G0dz!ll42020
-
-DB_CONNECTION_26=mysql
-DB_HOST_26=192.168.0.103
-DB_PORT_26=3306
-DB_DATABASE_26=arrahn_api2
-DB_USERNAME_26=spider
-DB_PASSWORD_26=G0dz!ll42020
-
-DB_CONNECTION_27=mysql
-DB_HOST_27=192.168.0.103
-DB_PORT_27=3306
-DB_DATABASE_27=arrahn_beaufort
-DB_USERNAME_27=spider
-DB_PASSWORD_27=G0dz!ll42020
-
-DB_CONNECTION_28=mysql
-DB_HOST_28=192.168.0.103
-DB_PORT_28=3306
-DB_DATABASE_28=arrahn_kbelud
-DB_USERNAME_28=spider
-DB_PASSWORD_28=G0dz!ll42020
-
-DB_CONNECTION_29=mysql
-DB_HOST_29=192.168.0.103
-DB_PORT_29=3306
-DB_DATABASE_29=arrahn_keningau
-DB_USERNAME_29=spider
-DB_PASSWORD_29=G0dz!ll42020
-
-DB_CONNECTION_30=mysql
-DB_HOST_30=192.168.0.103
-DB_PORT_30=3306
-DB_DATABASE_30=arrahn_putatan
-DB_USERNAME_30=spider
-DB_PASSWORD_30=G0dz!ll42020
-
-DB_CONNECTION_31=mysql
-DB_HOST_31=192.168.0.103
-DB_PORT_31=3306
-DB_DATABASE_31=arrahn_sandakan
-DB_USERNAME_31=spider
-DB_PASSWORD_31=G0dz!ll42020
-
-DB_CONNECTION_32=mysql
-DB_HOST_32=192.168.0.103
-DB_PORT_32=3306
-DB_DATABASE_32=arrahn_tawau
-DB_USERNAME_32=spider
-DB_PASSWORD_32=G0dz!ll42020
-
-DB_CONNECTION_33=mysql
-DB_HOST_33=192.168.0.103
-DB_PORT_33=3306
-DB_DATABASE_33=arrahn_tuaran
-DB_USERNAME_33=spider
-DB_PASSWORD_33=G0dz!ll42020
-
 CACHE_DRIVER=file
 QUEUE_CONNECTION=sync
 
-WABOT_API=https://md.wabot.my/api/send.php
-WABOT_INSTANCES_ID=63F40BD120DB4
-# WABOT_INSTANCES_ID=64892FD7440A6
-WABOT_TOKEN_KEYS=cbee7e95cf3ffbfa0531d5fddfd44f87
+MAX_MUTUEMAS=true
 
+TENNANT_MASTER_DB=master_erahn
+TENNANT_KAUNTER_DB=kaunter_erahn
 
-ONEWAYSMS_API=http://gateway.onewaysms.com.my:10001/api.aspx
-ONEWAYSMS_AUTH_USER=APIUK330HDAFO
-ONEWAYSMS_AUTH_PASS=APIUK330HDAFOUK330
+KAUNTER_URL=http://host.docker.internal:8081
+INTERNAL_NOTIFICATION_SECRET=
 
-ADMIN_PHONE_NUMBER=60178916936
-ACTIVE_JOB_SERVER=false
+LOGVIEWER_PASSWORD=
+
+WHATSAPP_TOKEN= # Paste token from Graph API explorer.
+WHATSAPP_PHONE_NUMBER_ID=1323449077519027
+WHATSAPP_API_VERSION=v25.0
+WHATSAPP_TEMPLATE=hello_world
+WHATSAPP_TEMPLATE_LANG=en_US
+WHATSAPP_VERIFY_TOKEN= # webhook verify token
+WHATSAPP_APP_SECRET= # X-Hub-Signature-256 checks; need to be enable first
+ADMIN_PHONE_NUMBER=60193450165

.env.production

@@ -0,0 +1,89 @@
+APP_NAME=Lumen
+APP_ENV=production
+APP_KEY=WbPGkYNmXZ6ZQplGlvl0iZ7zyW1b09xa
+APP_DEBUG=false
+APP_URL=https://apiujrah.erahn.com.my
+APP_TIMEZONE=Asia/Kuala_Lumpur
+API_ARRAHNBID=https://adminbid-kopkb.erahn.com.my/api/
+API_ARRAHNBID_ANNUR=https://adminbid-annur.erahn.com.my/api/
+
+LOG_CHANNEL=stack
+LOG_SLACK_WEBHOOK_URL=
+LOGVIEWER_PASSWORD="$2y$10$k7eiUyZdm3BruwAaT1gbmelTm.PPgZptOEQT1nlBjyiR84a4KBMlm"
+
+DB_CONNECTION_2=mysql
+DB_HOST_2=192.168.1.216
+DB_PORT_2=3306
+DB_DATABASE_2=erahn_xtra
+DB_USERNAME_2=spider
+DB_PASSWORD_2=arrahn@123
+
+DB_CONNECTION_3=mysql
+DB_HOST_3=192.168.1.216
+DB_PORT_3=3306
+DB_DATABASE_3=erahn_baling
+DB_USERNAME_3=spider
+DB_PASSWORD_3=arrahn@123
+
+DB_CONNECTION_4=mysql
+DB_HOST_4=192.168.1.216
+DB_PORT_4=3306
+DB_DATABASE_4=arrahn_ld
+DB_USERNAME_4=spider
+DB_PASSWORD_4=arrahn@123
+
+DB_CONNECTION_5=mysql
+DB_HOST_5=192.168.1.216
+DB_PORT_5=3306
+DB_DATABASE_5=erahn_segamat
+DB_USERNAME_5=spider
+DB_PASSWORD_5=arrahn@123
+
+DB_CONNECTION_6=mysql
+DB_HOST_6=192.168.1.216
+DB_PORT_6=3306
+DB_DATABASE_6=erahn_terengganu
+DB_USERNAME_6=spider
+DB_PASSWORD_6=arrahn@123
+
+DB_CONNECTION_8=mysql
+DB_HOST_8=192.168.1.216
+DB_PORT_8=3306
+DB_DATABASE_8=erahn_benoni
+DB_USERNAME_8=spider
+DB_PASSWORD_8=arrahn@123
+
+DB_CONNECTION_7=mysql
+DB_HOST_7=192.168.1.216
+DB_PORT_7=3306
+DB_DATABASE_7=master_erahn
+DB_USERNAME_7=spider
+DB_PASSWORD_7=arrahn@123
+
+DB_CONNECTION_9=mysql
+DB_HOST_9=192.168.1.216
+DB_PORT_9=3306
+DB_DATABASE_9=annur_tampoi
+DB_USERNAME_9=spider
+DB_PASSWORD_9=arrahn@123
+
+CACHE_DRIVER=file
+QUEUE_CONNECTION=sync
+
+MAX_MUTUEMAS=true
+
+TENNANT_MASTER_DB=master_erahn
+TENNANT_KAUNTER_DB=kaunter_erahn
+
+KAUNTER_URL=https://ujrah.erahn.com.my
+INTERNAL_NOTIFICATION_SECRET="nIDTe(u@6[)VLJyd"
+
+WHATSAPP_CLOUD_ENABLED=true
+WHATSAPP_TOKEN=EAAZAonT56AO0BSnZAhWLi4UXDRT6iAldbiybxSQZAnGrzIke1QiNWvQkZAbQQTjWeVZC5bL1gEBhW6ff3Shf79nowXiTQEwyxqgZAZB6ZATwFCeTs8MZA5H6ZA76IJBuVqRiAZBvZCfkeSurbUNpEWyi9W7zsT2GWiZCLX8meX0KCfDHu7cp4aBgVu1Ps5ZCRO3bP4ZCQZDZD
+WHATSAPP_PHONE_NUMBER_ID=1375899418935337
+WHATSAPP_API_VERSION=v25.0
+WHATSAPP_TEMPLATE=hebahan_pembiayaan_online
+WHATSAPP_TEMPLATE_LANG=ms
+WHATSAPP_VERIFY_TOKEN=418ed86d49422071681c76bed25ae1cb7e90456c794a92f1c9ea417945a35a0a
+WHATSAPP_APP_SECRET=
+ADMIN_PHONE_NUMBER=

.env.staging

@@ -4,15 +4,16 @@ APP_KEY=WbPGkYNmXZ6ZQplGlvl0iZ7zyW1b09xa
 APP_DEBUG=true
 APP_URL=http://127.0.0.1:8090
 APP_TIMEZONE=Asia/Kuala_Lumpur
+API_ARRAHNBID=http://lelong.test/api/
+API_ARRAHNBID_ANNUR=http://lelong-annur.test/api/
 
-# Unique host ports — change these if they collide with other containers on the server.
-# Host nginx should proxy the staging domain to 127.0.0.1:${HTTP_PORT}
 HTTP_PORT=8090
 MYSQL_PUBLISH_PORT=3308
 
 LOG_CHANNEL=stack
 LOG_LEVEL=debug
 LOG_SLACK_WEBHOOK_URL=
+LOGVIEWER_PASSWORD=test123
 
 DB_CONNECTION=mysql
 DB_HOST=mysql
@@ -70,15 +71,30 @@ DB_DATABASE_6=erahn_test
 DB_USERNAME_6=root
 DB_PASSWORD_6=root
 
-# DB_CONNECTION_8=mysql
-# DB_HOST_8=mysql
-# DB_PORT_8=3306
-# DB_DATABASE_8=arrahn_klanas
-# DB_USERNAME_8=spider
-# DB_PASSWORD_8=G0dz!ll42020
+DB_CONNECTION_9=mysql
+DB_HOST_9=mysql
+DB_PORT_9=3306
+DB_DATABASE_9=annur_tampoi
+DB_USERNAME_9=root
+DB_PASSWORD_9=root
+
+CACHE_DRIVER=file
+QUEUE_CONNECTION=sync
+
+MAX_MUTUEMAS=true
 
 TENNANT_MASTER_DB=master_erahn
 TENNANT_KAUNTER_DB=kaunter_erahn
 
-CACHE_DRIVER=file
-QUEUE_CONNECTION=sync
+KAUNTER_URL=https://staging.erahn.com.my/login
+INTERNAL_NOTIFICATION_SECRET=staging_noti_secret
+
+WHATSAPP_CLOUD_ENABLED=false
+WHATSAPP_TOKEN=EAAZAonT56AO0BSnZAhWLi4UXDRT6iAldbiybxSQZAnGrzIke1QiNWvQkZAbQQTjWeVZC5bL1gEBhW6ff3Shf79nowXiTQEwyxqgZAZB6ZATwFCeTs8MZA5H6ZA76IJBuVqRiAZBvZCfkeSurbUNpEWyi9W7zsT2GWiZCLX8meX0KCfDHu7cp4aBgVu1Ps5ZCRO3bP4ZCQZDZD
+WHATSAPP_PHONE_NUMBER_ID=1375899418935337
+WHATSAPP_API_VERSION=v25.0
+WHATSAPP_TEMPLATE=hebahan_pembiayaan_online
+WHATSAPP_TEMPLATE_LANG=ms
+WHATSAPP_VERIFY_TOKEN=418ed86d49422071681c76bed25ae1cb7e90456c794a92f1c9ea417945a35a0a
+WHATSAPP_APP_SECRET=
+ADMIN_PHONE_NUMBER=

.env.tukar

@@ -1,244 +0,0 @@
-APP_NAME=Lumen
-APP_ENV=local
-APP_KEY=WbPGkYNmXZ6ZQplGlvl0iZ7zyW1b09xa
-APP_DEBUG=false
-APP_URL=https://api.arrahn.com.my
-APP_TIMEZONE=Asia/Kuala_Lumpur
-
-
-LOG_CHANNEL=stack
-LOG_SLACK_WEBHOOK_URL=
-
-DB_CONNECTION=mysql
-DB_HOST=172.16.4.102
-DB_PORT=3306
-DB_DATABASE=arrahn_kb2
-DB_USERNAME=zone2
-DB_PASSWORD=G0dz!ll4@2020
-
-DB_CONNECTION_2=mysql
-DB_HOST_2=172.16.4.102
-DB_PORT_2=3306
-DB_DATABASE_2=arrahn_wcy
-DB_USERNAME_2=zone2
-DB_PASSWORD_2=G0dz!ll4@2020
-
-DB_CONNECTION_3=mysql
-DB_HOST_3=172.16.4.102
-DB_PORT_3=3306
-DB_DATABASE_3=arrahn_1stop
-DB_USERNAME_3=zone2
-DB_PASSWORD_3=G0dz!ll4@2020
-
-DB_CONNECTION_4=mysql
-DB_HOST_4=172.16.4.102
-DB_PORT_4=3306
-DB_DATABASE_4=arrahn_jlwt
-DB_USERNAME_4=zone2
-DB_PASSWORD_4=G0dz!ll4@2020
-
-DB_CONNECTION_5=mysql
-DB_HOST_5=172.16.4.102
-DB_PORT_5=3306
-DB_DATABASE_5=arrahn_wb
-DB_USERNAME_5=zone2
-DB_PASSWORD_5=G0dz!ll4@2020
-
-DB_CONNECTION_6=mysql
-DB_HOST_6=172.16.4.102
-DB_PORT_6=3306
-DB_DATABASE_6=arrahn_kls
-DB_USERNAME_6=zone2
-DB_PASSWORD_6=G0dz!ll4@2020
-
-DB_CONNECTION_7=mysql
-DB_HOST_7=172.16.4.102
-DB_PORT_7=3306
-DB_DATABASE_7=online_arrahn
-DB_USERNAME_7=zone2
-DB_PASSWORD_7=G0dz!ll4@2020
-
-DB_CONNECTION_8=mysql
-DB_HOST_8=172.16.4.102
-DB_PORT_8=3306
-DB_DATABASE_8=arrahn_pp
-DB_USERNAME_8=zone2
-DB_PASSWORD_8=G0dz!ll4@2020
-
-DB_CONNECTION_9=mysql
-DB_HOST_9=172.16.4.102
-DB_PORT_9=3306
-DB_DATABASE_9=arrahn_mace
-DB_USERNAME_9=zone2
-DB_PASSWORD_9=G0dz!ll4@2020 
-
-DB_CONNECTION_10=mysql
-DB_HOST_10=172.16.4.102
-DB_PORT_10=3306
-DB_DATABASE_10=arrahn_pm                                                                                                                           
-DB_USERNAME_10=zone2
-DB_PASSWORD_10=G0dz!ll4@2020
-
-DB_CONNECTION_11=mysql
-DB_HOST_11=172.16.4.102
-DB_PORT_11=3306
-DB_DATABASE_11=arrahn_gm
-DB_USERNAME_11=zone2
-DB_PASSWORD_11=G0dz!ll4@2020
-
-DB_CONNECTION_12=mysql
-DB_HOST_12172.16.4.102
-DB_PORT_12=3306
-DB_DATABASE_12=arrahn_gcl
-DB_USERNAME_12=zone2
-DB_PASSWORD_12=G0dz!ll4@2020
-
-DB_CONNECTION_13=mysql
-DB_HOST_13=172.16.4.102
-DB_PORT_13=3306
-DB_DATABASE_13=arrahn_jli
-DB_USERNAME_13=zone2
-DB_PASSWORD_13=G0dz!ll4@2020
-
-DB_CONNECTION_14=mysql
-DB_HOST_14=172.16.4.102
-DB_PORT_14=3306
-DB_DATABASE_14=arrahn_rp
-DB_USERNAME_14=zone2
-DB_PASSWORD_14=G0dz!ll4@2020
-
-DB_CONNECTION_15=mysql
-DB_HOST_15=172.16.4.102
-DB_PORT_15=3306
-DB_DATABASE_15=arrahn_ktn
-DB_USERNAME_15=zone2
-DB_PASSWORD_15=G0dz!ll4@2020
-
-DB_CONNECTION_16=mysql
-DB_HOST_16=172.16.4.102
-DB_PORT_16=3306
-DB_DATABASE_16=arrahn_pg
-DB_USERNAME_16=zone2
-DB_PASSWORD_16=G0dz!ll4@2020
-
-DB_CONNECTION_17=mysql
-DB_HOST_17=172.16.4.102
-DB_PORT_17=3306
-DB_DATABASE_17=arrahn_skudai
-DB_USERNAME_17=zone2
-DB_PASSWORD_17=G0dz!ll4@2020
-
-DB_CONNECTION_18=mysql
-DB_HOST_18=172.16.4.102
-DB_PORT_18=3306
-DB_DATABASE_18=arrahn_pttn
-DB_USERNAME_18=zone2
-DB_PASSWORD_18=G0dz!ll4@2020
-
-DB_CONNECTION_19=mysql
-DB_HOST_19=172.16.4.102
-DB_PORT_19=3306
-DB_DATABASE_19=arrahn_btg
-DB_USERNAME_19=zone2
-DB_PASSWORD_19=G0dz!ll4@2020
-
-DB_CONNECTION_20=mysql
-DB_HOST_20=172.16.4.102
-DB_PORT_20=3306
-DB_DATABASE_20=arrahn_raub
-DB_USERNAME_20=zone2
-DB_PASSWORD_20=G0dz!ll4@2020
-
-DB_CONNECTION_21=mysql
-DB_HOST_21=172.16.4.102
-DB_PORT_21=3306
-DB_DATABASE_21=arrahn_kgr
-DB_USERNAME_21=zone2
-DB_PASSWORD_21=G0dz!ll4@2020
-
-DB_CONNECTION_22=mysql
-DB_HOST_22=172.16.4.102
-DB_PORT_22=3306
-DB_DATABASE_22=arrahn_sdk
-DB_USERNAME_22=zone2
-DB_PASSWORD_22=G0dz!ll4@2020
-
-DB_CONNECTION_23=mysql
-DB_HOST_23=172.16.4.102
-DB_PORT_23=3306
-DB_DATABASE_23=arrahn_sp
-DB_USERNAME_23=zone2
-DB_PASSWORD_23=G0dz!ll4@2020
-
-DB_CONNECTION_24=mysql
-DB_HOST_24=172.16.4.102
-DB_PORT_24=3306
-DB_DATABASE_24=arrahn_twu
-DB_USERNAME_24=zone2
-DB_PASSWORD_24=G0dz!ll4@2020
-
-DB_CONNECTION_25=mysql
-DB_HOST_25=172.16.4.102
-DB_PORT_25=3306
-DB_DATABASE_25=arrahn_api2
-DB_USERNAME_25=zone2
-DB_PASSWORD_25=G0dz!ll4@2020
-
-DB_CONNECTION_26=mysql
-DB_HOST_26=172.16.4.102
-DB_PORT_26=3306
-DB_DATABASE_26=arrahn_kjg
-DB_USERNAME_26=zone2
-DB_PASSWORD_26=G0dz!ll4@2020
-
-DB_CONNECTION_27=mysql
-DB_HOST_27=172.16.4.102
-DB_PORT_27=3306
-DB_DATABASE_27=arrahn_rl
-DB_USERNAME_27=zone2
-DB_PASSWORD_27=G0dz!ll4@2020
-
-DB_CONNECTION_28=mysql
-DB_HOST_28=172.16.4.102
-DB_PORT_28=3306
-DB_DATABASE_28=arrahn_bfort
-DB_USERNAME_28=zone2
-DB_PASSWORD_28=G0dz!ll4@2020
-
-DB_CONNECTION_29=mysql
-DB_HOST_29=172.16.4.102
-DB_PORT_29=3306
-DB_DATABASE_29=arrahn_kbelud
-DB_USERNAME_29=zone2
-DB_PASSWORD_29=G0dz!ll4@2020
-
-DB_CONNECTION_30=mysql
-DB_HOST_30=172.16.4.102
-DB_PORT_30=3306
-DB_DATABASE_30=arrahn_tuaran
-DB_USERNAME_30=zone2
-DB_PASSWORD_30=G0dz!ll4@2020
-
-DB_CONNECTION_31=mysql
-DB_HOST_31=172.16.4.102
-DB_PORT_31=3306
-DB_DATABASE_31=arrahn_kngau
-DB_USERNAME_31=zone2
-DB_PASSWORD_31=G0dz!ll4@2020
-
-DB_CONNECTION_32=mysql
-DB_HOST_32=172.16.4.102
-DB_PORT_32=3306
-DB_DATABASE_32=arrahn_tm
-DB_USERNAME_32=zone2
-DB_PASSWORD_32=G0dz!ll4@2020
-
-DB_CONNECTION_33=mysql
-DB_HOST_33=172.16.4.102
-DB_PORT_33=3306
-DB_DATABASE_33=arrahn_tmlh
-DB_USERNAME_33=zone2
-DB_PASSWORD_33=G0dz!ll4@2020
-
-CACHE_DRIVER=file
-QUEUE_CONNECTION=sync

.gitea/workflows/deploy-staging.yml

@@ -1,6 +1,9 @@
 name: Deploy to Staging
 
 on:
+  push:
+    tags:
+      - "v*"
   workflow_dispatch:
     inputs:
       image_tag:
@@ -18,10 +21,22 @@ jobs:
     runs-on: host
 
     steps:
+      - name: Resolve image tag
+        id: resolve
+        run: |
+          set -e
+          if [ "${{ gitea.event_name }}" = "workflow_dispatch" ]; then
+            IMAGE_TAG="${{ inputs.image_tag }}"
+          else
+            IMAGE_TAG="${{ gitea.ref_name }}"
+          fi
+          echo "IMAGE_TAG=${IMAGE_TAG}" >> "$GITHUB_OUTPUT"
+          echo "Deploying image tag: ${IMAGE_TAG}"
+
       - name: Checkout repository
         uses: actions/checkout@v4
         with:
-          ref: ${{ inputs.image_tag }}
+          ref: ${{ steps.resolve.outputs.IMAGE_TAG }}
 
       - name: Login to Docker registry
         run: |
@@ -33,43 +48,47 @@ jobs:
       - name: Verify image exists in registry
         run: |
           set -e
-          IMAGE_TAG="${{ inputs.image_tag }}"
+          IMAGE_TAG="${{ steps.resolve.outputs.IMAGE_TAG }}"
           IMAGE="${APP_IMAGE}:${IMAGE_TAG}"
 
           echo "Checking if image exists: ${IMAGE}"
-          if ! docker manifest inspect "${IMAGE}" > /dev/null 2>&1; then
-            echo "ERROR: Image ${IMAGE} does not exist in registry!"
-            echo "Run the Build Docker Image workflow first."
-            exit 1
-          fi
-          echo "✓ ${IMAGE} found"
+          # Tag pushes build in parallel — wait for the image to appear
+          for i in $(seq 1 30); do
+            if docker manifest inspect "${IMAGE}" > /dev/null 2>&1; then
+              echo "✓ ${IMAGE} found"
+              exit 0
+            fi
+            echo "Image not ready yet (attempt ${i}/30), waiting 20s..."
+            sleep 20
+          done
+
+          echo "ERROR: Image ${IMAGE} does not exist in registry after waiting!"
+          echo "Run the Build Docker Image workflow first."
+          exit 1
 
       - name: Pull Docker image
         run: |
           set -e
-          IMAGE_TAG="${{ inputs.image_tag }}"
+          IMAGE_TAG="${{ steps.resolve.outputs.IMAGE_TAG }}"
           docker pull "${APP_IMAGE}:${IMAGE_TAG}"
           echo "✓ Image pulled successfully"
 
       - name: Sync compose file and deploy
         run: |
           set -e
-          IMAGE_TAG="${{ inputs.image_tag }}"
+          IMAGE_TAG="${{ steps.resolve.outputs.IMAGE_TAG }}"
 
           mkdir -p "${DEPLOY_DIR}/docker/nginx" "${DEPLOY_DIR}/docker/mysql"
           cp docker-compose.staging.yml "${DEPLOY_DIR}/docker-compose.yml"
           cp docker/nginx/default.conf "${DEPLOY_DIR}/docker/nginx/default.conf"
           cp -R docker/mysql/init "${DEPLOY_DIR}/docker/mysql/"
 
-          if [ ! -f "${DEPLOY_DIR}/.env.staging" ]; then
-            if [ -f .env.staging ]; then
-              cp .env.staging "${DEPLOY_DIR}/.env.staging"
-              echo "Copied .env.staging from repo (first deploy). Edit ${DEPLOY_DIR}/.env.staging on the server if needed."
-            else
-              echo "ERROR: ${DEPLOY_DIR}/.env.staging is missing on the server"
-              exit 1
-            fi
+          if [ ! -f .env.staging ]; then
+            echo "ERROR: .env.staging is missing in the repository"
+            exit 1
           fi
+          cp .env.staging "${DEPLOY_DIR}/.env.staging"
+          echo "✓ Synced .env.staging from repo"
 
           cd "${DEPLOY_DIR}"
 

README.md

@@ -21,7 +21,7 @@ Tebus=penyelesaian penuh/ansuran
 docker exec -i api_arrahn_staging_mysql mysql -uroot -proot erahn_test < erahn_test.sql
 ```
 
-## Disable the cawangan in arrahn_master_db
+## Disable the cawangan in arrahn_master_db using feature flag
 
 ## Feature Flag
 1. Register the flag in api_arrahn/app/Feature.php

app/Console/Commands/WhatsappTestSend.php

@@ -0,0 +1,56 @@
+<?php
+
+namespace App\Console\Commands;
+
+use App\Services\Whatsapp\WhatsappCloudClient;
+use Illuminate\Console\Command;
+
+class WhatsappTestSend extends Command
+{
+    protected $signature = 'whatsapp:test {--to= : Recipient MSISDN, default ADMIN_PHONE_NUMBER}';
+
+    protected $description = 'Send the configured WhatsApp Cloud template to a test number';
+
+    public function handle()
+    {
+        $client = new WhatsappCloudClient();
+
+        if (!$client->isConfigured()) {
+            $this->error('Set WHATSAPP_TOKEN and WHATSAPP_PHONE_NUMBER_ID in .env first.');
+            return 1;
+        }
+
+        $to = $client->normalizeMsisdn($this->option('to') ?: env('ADMIN_PHONE_NUMBER'));
+        if (!$to) {
+            $this->error('Pass --to=60193450165 or set ADMIN_PHONE_NUMBER.');
+            return 1;
+        }
+
+        $template = config('whatsapp.template', 'hello_world');
+        $lang = config('whatsapp.template_lang', 'en_US');
+        $bodyParams = [];
+
+        if (strtolower($template) !== 'hello_world') {
+            // pembiayaan_online_paid: SAG, amaun, bank, 4 digit akhir, tarikh, rujukan
+            $bodyParams = [
+                'TEST-SAG',
+                '100.00',
+                'Maybank',
+                '1234',
+                date('d/m/Y'),
+                'TEST-REF',
+            ];
+        }
+
+        $this->info("Sending {$template} ({$lang}) to {$to} …");
+        $response = $client->sendTemplate($to, $template, $lang, $bodyParams);
+
+        if ($response->successful()) {
+            $this->info('OK ' . $response->status() . ' ' . $response->body());
+            return 0;
+        }
+
+        $this->error('FAIL ' . $response->status() . ' ' . $response->body());
+        return 1;
+    }
+}

app/Console/Kernel.php

@@ -24,6 +24,7 @@ class Kernel extends ConsoleKernel
         Commands\ClearCachesAll::class,
         Commands\RestartSupervisor::class,
         Commands\InsertSempornaData::class,
+        Commands\WhatsappTestSend::class,
         //Commands\ImportCsv::class,
 
     ];

app/Feature.php

@@ -5,6 +5,7 @@ namespace App;
 class Feature
 {
     const PEMBIAYAAN_ONLINE = 'pembiayaan_online';
+    const REBET_ANNUR = 'rebet_annur';
 
     /**
      * Known flag keys. New features: add a constant here, then INSERT rows for pilot kodcaw.
@@ -15,6 +16,7 @@ class Feature
     {
         return [
             self::PEMBIAYAAN_ONLINE,
+            self::REBET_ANNUR,
         ];
     }
 
@@ -40,9 +42,32 @@ class Feature
     {
         return [
             self::PEMBIAYAAN_ONLINE => 'Pembiayaan Online',
+            self::REBET_ANNUR => 'Rebet / diskaun Annur',
         ];
     }
 
+    /**
+     * Lelong portal base URL for this branch. rebet_annur branches (Annur/Tampoi)
+     * use API_ARRAHNBID_ANNUR; everyone else uses API_ARRAHNBID.
+     *
+     * Always returned with a trailing slash so callers can append 'portalApi'.
+     *
+     * @param string $kodcaw
+     * @return string
+     */
+    public static function arrahnbidUrl($kodcaw)
+    {
+        $url = config('app_parameter.api_arrahnbid');
+        if ($kodcaw && self::enabled($kodcaw, self::REBET_ANNUR)) {
+            $annur = config('app_parameter.api_arrahnbid_annur');
+            if ($annur) {
+                $url = $annur;
+            }
+        }
+
+        return rtrim((string) $url, '/') . '/';
+    }
+
     /**
      * Missing row is off (fail closed).
      *

app/Gadai.php

@@ -9,6 +9,10 @@ class Gadai extends Model
     protected $table = 'gadai';
     public $timestamps = false;
 
+    protected $attributes = [
+        'cara_terima' => 'TUNAI',
+    ];
+
     /**
      * The attributes that are mass assignable.
      *
@@ -74,7 +78,9 @@ class Gadai extends Model
         'tagkomuditi',
         'tempohbayar',
         'lelong_tawarruq',
-        'tag_tebus'
+        'tag_tebus',
+        'kadarrebet',
+        'diskaun'
     ];
 
     /**

app/Http/Controllers/BarangkesController.php

@@ -59,7 +59,7 @@ class BarangkesController extends Controller
             $itemArray['gadaian_sudah_tebus'] = !is_null($item['tebus']);
 
             // Add nokp customer from gadai relationship
-            $itemArray['nokp'] = $item['gadai']['nokp'];
+            $itemArray['nokp'] = $item['gadai']['nokp'] ?? null;
 
             // Remove the tebus relationship data to keep response clean
             unset($itemArray['tebus']);

app/Http/Controllers/CawanganController.php

@@ -26,6 +26,7 @@ class CawanganController extends Controller
 
         $data = $cawangan->toArray();
         $data['features'] = Feature::mapFor($code_cawangan);
+        $data['api_arrahnbid'] = Feature::arrahnbidUrl($code_cawangan);
 
         return response()->json($data);
     }

app/Http/Controllers/GadaiController.php

@@ -158,7 +158,6 @@ class GadaiController extends Controller
     }
 
     public function create($kodcaw,Request $request){
-
         $master = new MasterServices($kodcaw);
         $response = $master->createGadai($request);
 
@@ -228,11 +227,14 @@ class GadaiController extends Controller
     }
 
 
-    public function daftarGadaiMarhun($norujukan,Request $request){
-        // dd("ggwp");
-        $master = new MasterServices($request->kodcaw);
-        $response = $master->createMarhunGadai($request->norujukan,$request);
-
+    public function daftarGadaiMarhun($kodcaw, $norujukan, Request $request)
+    {
+        if (\App\ShorakaTransaction::where('norujukan', $norujukan)->exists()) {
+            abort(409, 'Kontrak telah dihantar ke Shoraka dan tidak boleh diubah.');
+        }
+        $request->merge(['kodcaw' => $kodcaw, 'norujukan' => $norujukan]);
+        $master = new MasterServices($kodcaw);
+        $response = $master->createMarhunGadai($norujukan, $request);
         return response()->json($response, 200);
     }
 
@@ -369,6 +371,9 @@ class GadaiController extends Controller
     }
 
     public function batalGadai($kodcaw, $norujukan,Request $request){
+        if (\App\ShorakaTransaction::where('norujukan', $norujukan)->exists()) {
+            abort(409, 'Transaksi Shoraka telah dihantar. Semakan operasi diperlukan sebelum pembatalan.');
+        }
 
         $current = Carbon::now();
         $current = new Carbon();
@@ -406,6 +411,11 @@ class GadaiController extends Controller
     }
 
     public function pembelianKomuditi($kodcaw,$norujukan){
+        if (\App\ShorakaTransaction::where('norujukan', $norujukan)->exists()
+            || !\App\KomuditiTransaksi::on('mysql7')->where('norujukan', $norujukan)->exists()) {
+            app(\App\Services\ShorakaGadaiService::class)->assertCompleted($kodcaw, $norujukan);
+        }
+
         $cawangan = Cawangan::on('mysql7')->where('kodcaw','=',$kodcaw)->first();
 
         $gadai = Gadai::on($cawangan['mysql'])
@@ -418,6 +428,10 @@ class GadaiController extends Controller
     }
 
     public function cetakSAG($kodcaw,$norujukan,Request $request){
+        if (\App\ShorakaTransaction::where('norujukan', $norujukan)->exists()) {
+            app(\App\Services\ShorakaGadaiService::class)->assertCompleted($kodcaw, $norujukan);
+        }
+
         $harini = Carbon::now();
 
         $cawangan = Cawangan::on('mysql7')->where('kodcaw','=',$kodcaw)->first();
@@ -442,6 +456,10 @@ class GadaiController extends Controller
     }
 
     public function serahMarhun($kodcaw,$norujukan){
+        if (\App\ShorakaTransaction::where('norujukan', $norujukan)->exists()) {
+            app(\App\Services\ShorakaGadaiService::class)->assertCompleted($kodcaw, $norujukan);
+        }
+
         $cawangan = Cawangan::on('mysql7')->where('kodcaw','=',$kodcaw)->first();
         $gadai = Gadai::on($cawangan['mysql'])
                 ->where('norujukan','=',$norujukan)
@@ -537,7 +555,7 @@ class GadaiController extends Controller
 
     public function getLaporanGadai($kodcaw,$tarikh){
         $cawangan = Cawangan::on('mysql7')->where('kodcaw','=',$kodcaw)->first();
-        $gadai_data = Gadai::on($cawangan['mysql'])->select('t_gadai','norujukan','nokp','semakbarcode','masa','berat','nilaimarhun','pinjaman','upah12','percentpinj','teller','nokp','ujrah','onepercent')
+        $gadai_data = Gadai::on($cawangan['mysql'])->select('cara_terima','t_gadai','norujukan','nokp','semakbarcode','masa','berat','nilaimarhun','pinjaman','upah12','percentpinj','teller','nokp','ujrah','onepercent','kadarrebet','diskaun')
         ->where('t_gadai','=',$tarikh)
         ->orderBy('teller')
         ->orderBy('sirig')
@@ -551,6 +569,7 @@ class GadaiController extends Controller
                 array_push($gadai,[
                     "t_gadai"=> $gadaiData['t_gadai'],
                     "norujukan"=> $gadaiData['norujukan'],
+                    "cara_terima"=> $gadaiData['cara_terima'],
                     "nama"=> $customer_info['nama'],
                     "nokp"=> $gadaiData['nokp'],
                     "semakbarcode"=> $gadaiData['semakbarcode'],
@@ -563,7 +582,9 @@ class GadaiController extends Controller
                     "alamat1"=> $customer_info['alamat1'],
                     "teller"=> $gadaiData['teller'],
                     "onepercent"=> $gadaiData['onepercent'],
-                    "ujrah"=> $gadaiData['ujrah']
+                    "ujrah"=> $gadaiData['ujrah'],
+                    "kadarrebet"=> $gadaiData['kadarrebet'],
+                    "diskaun"=> $gadaiData['diskaun']
                 ]);
             }
         }
@@ -626,7 +647,7 @@ class GadaiController extends Controller
                 "alamat1" => optional($customer)->alamat1,
                 "t_gadai" => $g->t_gadai,
                 "norujukan" => $g->norujukan,
-                "norujukan"=> $g->norujukan,
+                "cara_terima" => strtoupper((string) ($g->cara_terima ?: 'TUNAI')),
               
                 "nokp"=> $g->nokp,
                 "semakbarcode"=> $g->semakbarcode,
@@ -640,6 +661,8 @@ class GadaiController extends Controller
                 "teller"=> $g->teller,
                 "ujrah"=> $g->ujrah,
                 "onepercent"=> $g->onepercent,
+                "kadarrebet"=> $g->kadarrebet,
+                "diskaun"=> $g->diskaun,
                 "tagbaru"=> $g->tagbaru,
                 "kodkerja"=> optional($customer)->kodkerja,
                 "bangsa"=> optional($customer)->bangsa,

app/Http/Controllers/KelulusanController.php

@@ -8,6 +8,7 @@ use App\Cawangan;
 use App\Mohonid;
 use App\MohonAnggota;
 use App\Customer;
+use App\Services\StaffNotificationClient;
 
 use Carbon\Carbon;
 
@@ -444,6 +445,8 @@ public function create(REQUEST $request,$kodcaw,$norujukan,$roles)
         $audit->updated_at = $harini;
         $audit->save();
 
+        $this->notifyOperasiAssignAnggota($kodcaw, $cawangan, $kelulusan, $request);
+
         // ✅ Return JSON response ke frontend
         return response()->json([
             'success' => true,
@@ -466,6 +469,58 @@ public function create(REQUEST $request,$kodcaw,$norujukan,$roles)
     }
 }
 
+    /**
+     * Inbox for all operasi staff. Failures must not block the teller request.
+     *
+     * @param  string  $kodcaw
+     * @param  \App\Cawangan  $cawangan
+     * @param  \App\MohonAnggota  $kelulusan
+     * @param  \Illuminate\Http\Request  $request
+     * @return void
+     */
+    protected function notifyOperasiAssignAnggota($kodcaw, $cawangan, $kelulusan, Request $request)
+    {
+        try {
+            $nama = trim((string) ($request->nama ?? ''));
+            if ($nama === '' && !empty($kelulusan->nokp)) {
+                $customer = Customer::on('mysql7')
+                    ->where('kpbaru', $kelulusan->nokp)
+                    ->orWhere('kplama', $kelulusan->nokp)
+                    ->first();
+                if ($customer && !empty($customer->nama)) {
+                    $nama = trim((string) $customer->nama);
+                }
+            }
+
+            $namaCaw = $kodcaw;
+            if ($cawangan) {
+                $resolved = trim((string) $cawangan->nama_cawangan);
+                if ($resolved !== '') {
+                    $namaCaw = $resolved;
+                }
+            }
+
+            app(StaffNotificationClient::class)->notify([
+                'type' => 'anggota.pending_operasi',
+                'cawangan' => $kodcaw,
+                'audience' => ['role' => 'operasi'],
+                'data' => [
+                    'id' => $kelulusan->id,
+                    'nokp' => $kelulusan->nokp,
+                    'nama' => $nama,
+                    'teller' => $kelulusan->teller,
+                    'komen' => $kelulusan->komen,
+                    'cawangan_nama' => $namaCaw,
+                ],
+            ]);
+        } catch (\Throwable $e) {
+            Log::warning('Assign anggota operasi notification failed: '.$e->getMessage(), [
+                'kodcaw' => $kodcaw,
+                'nokp' => isset($kelulusan->nokp) ? $kelulusan->nokp : null,
+            ]);
+        }
+    }
+
    //KEPOHONAN EDIT DAN HAPUS
 
    public function kepohonancreate(REQUEST $request,$kodcaw,$norujukan)
@@ -600,26 +655,86 @@ public function create(REQUEST $request,$kodcaw,$norujukan,$roles)
       return response()->json($arraykelulusan,200);
    }
 
-   public function listoperasikelulusan()
+   public function listoperasikelulusan(Request $request)
    {
-      $harini = Carbon::now();
-      $harini = new Carbon;
+      $dateFrom = $request->query('date_from');
+      $dateTo = $request->query('date_to');
+      $search = trim((string) $request->query('search', ''));
+
+      // Default to last 30 days to avoid loading entire history
+      if (!$dateFrom && !$dateTo) {
+         $dateTo = Carbon::now()->toDateString();
+         $dateFrom = Carbon::now()->subDays(30)->toDateString();
+      }
+
+      $cawangan_all = Cawangan::on('mysql7')
+         ->select('mysql', 'details_caw', 'kodcaw')
+         ->get();
 
-      $cawangan_all = Cawangan::on('mysql7')->get();
       $arraykelulusan = [];
 
-      foreach($cawangan_all as $index=>$cawangan){
-         $kelulusan=Mohon::on($cawangan['mysql'])
-               ->where('peloperasi','=','operasi')
-               ->where('operasi','!=','')
-               ->get();
+      foreach ($cawangan_all as $cawangan) {
+         $query = Mohon::on($cawangan['mysql'])
+            ->select([
+               'tarikh',
+               'norujukan',
+               'komen',
+               'jumpinj',
+               'nilaimarhun',
+               'berat',
+               'margin',
+               'status',
+               'operasi',
+               'masalulus',
+            ])
+            ->where('peloperasi', '=', 'operasi')
+            ->where('operasi', '!=', '');
 
-         if(sizeof($kelulusan) != 0){
-             array_push($arraykelulusan,["kelulusanall" => $kelulusan,"cawangan" => $cawangan['details_caw'],"cawangankod" => $cawangan['kodcaw']]);
+         if ($dateFrom) {
+            $query->where('tarikh', '>=', $dateFrom);
+         }
+         if ($dateTo) {
+            $query->where('tarikh', '<=', $dateTo);
+         }
+         if ($search !== '') {
+            $query->where(function ($q) use ($search) {
+               $q->where('norujukan', 'like', "%{$search}%")
+                  ->orWhere('operasi', 'like', "%{$search}%")
+                  ->orWhere('status', 'like', "%{$search}%")
+                  ->orWhere('komen', 'like', "%{$search}%");
+            });
          }
-     }
 
-      return response()->json($arraykelulusan,200);
+         $kelulusan = $query->orderBy('tarikh', 'desc')->get();
+
+         foreach ($kelulusan as $kel) {
+            $komenParts = explode('|', (string) ($kel->komen ?? ''));
+            $komenParts = array_values(array_filter($komenParts, function ($part) {
+               return $part !== '';
+            }));
+
+            $arraykelulusan[] = [
+               'tarikh' => $kel->tarikh ?? '-',
+               'norujukan' => $kel->norujukan ?? '-',
+               'status' => $kel->status ?? '-',
+               'komen' => $komenParts[0] ?? ($kel->komen ?: '-'),
+               'pinjaman' => $kel->jumpinj ?? '-',
+               'nilaimarhun' => $komenParts[1] ?? ($kel->nilaimarhun ?? '-'),
+               'berat' => $komenParts[2] ?? ($kel->berat ?? '-'),
+               'margin' => $komenParts[3] ?? ($kel->margin ?? '-'),
+               'pelulus' => $kel->operasi ?? '-',
+               'masalulus' => $kel->masalulus ?? '-',
+               'cawangan' => $cawangan['details_caw'],
+               'cawangankod' => $cawangan['kodcaw'],
+            ];
+         }
+      }
+
+      usort($arraykelulusan, function ($a, $b) {
+         return strcmp((string) ($b['tarikh'] ?? ''), (string) ($a['tarikh'] ?? ''));
+      });
+
+      return response()->json($arraykelulusan, 200);
    }
 
    public function UpdateHapusAnsuranOperasi(Request $request){

app/Http/Controllers/KomuditiController.php

@@ -117,6 +117,9 @@ class KomuditiController extends Controller
     }
 
     public function updateKomuditi(Request $request){
+        if (\App\ShorakaTransaction::where('norujukan', $request->norujukan)->exists()) {
+            abort(409, 'Transaksi Shoraka memerlukan semakan operasi; stok lama tidak boleh diubah.');
+        }
         $current = Carbon::now();
         $current = new Carbon();
 
@@ -138,37 +141,20 @@ class KomuditiController extends Controller
         return response()->json($komuditi_transaksi);
     }
 
-    public function transaksiKomuditi(Request $request){
-        $current = Carbon::now();
-        $current = new Carbon();
-
-        $komuditi_current = KomuditiPurchase::on('mysql7')->where('date_purchase','=',$current->toDateString())->orderBy('created_at','desc')->first();
-
-        $unit_current = $komuditi_current['unit_komuditi'];
-        $update_unit = $unit_current - $request->unit_komuditi;
-
-        $unit_current = round((float) $komuditi_current['unit_komuditi'], 2);
-        $unit_komuditi = round((float) $request->unit_komuditi, 2);
-        $update_unit = round($unit_current - $unit_komuditi, 2);
-
-        $update_komuditi = KomuditiPurchase::on('mysql7')->where('id','=',$komuditi_current['id'])->update([
-            'unit_komuditi' => $update_unit
-        ]);
-
-        $komuditi_transaksi = KomuditiTransaksi::on('mysql7')->create([
-            'unit_komuditi' => $unit_komuditi,
-            'nosijil'=>$komuditi_current['no_sijil'],
-            'norujukan' => $request->norujukan,
-            'kodcaw' => $request->kodcaw ,
-            'teller' => $request->teller ,
-            'masa' => $current->toTimeString(),
-            'tarikh' => $current->toDateString()
-        ]);
-
-        return response()->json($komuditi_transaksi);
+    public function transaksiKomuditi(Request $request)
+    {
+        $this->validate($request, ['kodcaw' => 'required|string', 'norujukan' => 'required|string']);
+        return app(ShorakaGadaiController::class)->submitGadai(
+            $request->kodcaw, $request->norujukan,
+            app(\App\Services\ShorakaGadaiService::class),
+            app(\App\Services\ShorakaService::class)
+        );
     }
 
     public function batalKomuditi(Request $request){
+        if (\App\ShorakaTransaction::where('norujukan', $request->norujukan)->exists()) {
+            abort(409, 'Transaksi Shoraka memerlukan semakan operasi; stok lama tidak boleh diubah.');
+        }
 
         $komuditi_current = KomuditiPurchase::on('mysql7')->orderBy('created_at','desc')->first();
 

app/Http/Controllers/LelongController.php

@@ -11,6 +11,7 @@ use App\Negeri;
 use App\Lelong;
 use App\Transaction;
 use App\Cawangan;
+use App\Feature;
 use App\Gadai;
 use App\TuntutBaki;
 use App\WTD;
@@ -26,6 +27,7 @@ use App\Tunai;
 use App\Audit;
 use App\GlDetail;
 use App\Pembeli;
+use Illuminate\Http\Client\ConnectionException;
 use Illuminate\Http\Request;
 use Illuminate\Support\Facades\Http;
 use App\Services\RingkasanHarianServices;
@@ -604,16 +606,7 @@ class LelongController extends Controller
         $cawangan = Cawangan::on('mysql7')->where('kodcaw','=',$request->kodcaw)->first();
 
         if($cawangan['tagarrahnbid'] == 1){
-            if(env('APP_ENV') != 'production'){
-                $link = 'https://adminbid-kopkb.erahn.com.my/api/portalApi';
-            }else{
-                $link = 'https://adminbid-kopkb.erahn.com.my/api/portalApi';
-            }
-
-            $lelong = Http::withOptions(['verify' => true])->get($link,[
-                'norujukan' => $request->norujukan
-            ])->json();
-            $lelong = ($lelong != null) ? $lelong['lelong'] : [];
+            $lelong = $this->fetchPortalLelong($request->kodcaw, $request->norujukan);
             if( $lelong == null )
             {
                 $lelong = Lelong::on($cawangan['mysql'])
@@ -656,10 +649,7 @@ class LelongController extends Controller
         $cawangan = Cawangan::on('mysql7')->where('kodcaw', '=', $request->kodcaw)->first();
 
         if ($cawangan['tagarrahnbid'] == 0){
-            $lelong = Http::withOptions(['verify' => true])->get(config('app_parameter.api_arrahnbid').'portalApi',[
-                'norujukan' => $request->norujukan
-            ])->json();
-            $lelong = ($lelong != null) ? $lelong['lelong'] : [];
+            $lelong = $this->fetchPortalLelong($request->kodcaw, $request->norujukan);
             if( $lelong == null )
             {
                 $lelong = Lelong::on($cawangan['mysql'])
@@ -729,8 +719,8 @@ class LelongController extends Controller
 
         if($cawangan['tagarrahnbid'] == 1)
         {
-            $lelong = Http::withOptions(['verify' => true])->get(config('app_parameter.api_arrahnbid').'portalApi',['norujukan' => $request->norujukan])->json();
-            $lelong = ($lelong != null) ? $lelong['lelong'] : [];
+            $lelong = $this->fetchPortalLelong($request->kodcaw, $request->norujukan);
+            $lelong = ($lelong != null) ? $lelong : [];
         }else{
             $lelong = Lelong::on($cawangan['mysql'])->where([['norujukan',$request->norujukan]])->first();
         }
@@ -2009,4 +1999,31 @@ class LelongController extends Controller
             ], 200);
     }
 
+    /**
+     * Fetch lelong status from arrahnbid. Returns null when the portal is
+     * unreachable so callers can fall back to the local lelong table.
+     */
+    private function fetchPortalLelong($kodcaw, $norujukan)
+    {
+        try {
+            $payload = Http::withOptions(['verify' => true])
+                ->timeout(5)
+                ->get(Feature::arrahnbidUrl($kodcaw).'portalApi', [
+                    'norujukan' => $norujukan,
+                ])
+                ->json();
+
+            return ($payload != null) ? ($payload['lelong'] ?? null) : null;
+        } catch (ConnectionException $e) {
+            Log::warning('Arrahnbid portal unreachable; falling back to local lelong.', [
+                'kodcaw' => $kodcaw,
+                'norujukan' => $norujukan,
+                'url' => Feature::arrahnbidUrl($kodcaw).'portalApi',
+                'error' => $e->getMessage(),
+            ]);
+
+            return null;
+        }
+    }
+
 }

app/Http/Controllers/MarhunController.php

@@ -3,6 +3,7 @@
 namespace App\Http\Controllers;
 
 use App\Marhun;
+use App\Gadai;
 use App\Jemas;
 use App\Cawangan;
 use Illuminate\Http\Request;
@@ -58,6 +59,11 @@ class MarhunController extends Controller
 
     public function create($kodcaw,Request $request)
     {
+        $order = \App\ShorakaTransaction::where('norujukan', $request->norujukan)->first();
+        if ($order) {
+            abort(409, 'Kontrak Shoraka telah dihantar dan tidak boleh diubah.');
+        }
+
         $current = Carbon::now();
         $current = new Carbon();
 
@@ -126,6 +132,10 @@ class MarhunController extends Controller
 
     public function deletemarhun($kodcaw,$norujukan,Request $request)
     {
+        $order = \App\ShorakaTransaction::where('norujukan', $norujukan)->first();
+        if ($order) {
+            abort(409, 'Kontrak Shoraka telah dihantar dan tidak boleh diubah.');
+        }
 
         $current = Carbon::now();
         $current = new Carbon();
@@ -151,6 +161,11 @@ class MarhunController extends Controller
 
     public function editmarhun($kodcaw,$norujukan,Request $request)
     {
+        $order = \App\ShorakaTransaction::where('norujukan', $norujukan)->first();
+        if ($order) {
+            abort(409, 'Kontrak Shoraka telah dihantar dan tidak boleh diubah.');
+        }
+
 
 	    $current = Carbon::now();
         $current = new Carbon();
@@ -160,39 +175,53 @@ class MarhunController extends Controller
 
         $cawangan = Cawangan::on('mysql7')->where('kodcaw','=',$kodcaw)->first();
 
-        $old_data = Marhun::on($cawangan['mysql'])->where([['recno','=',$request->recno],['norujukan','=',$norujukan]])->first();
+        // Lock the parent first so concurrent edits to this SAG are serialized.
+        (new Marhun)->setConnection($cawangan['mysql'])->getConnection()->transaction(function () use ($cawangan, $norujukan, $request, $harga, $nilai_marhun, $kodcaw, $current) {
+            Gadai::on($cawangan['mysql'])->where('norujukan', $norujukan)->lockForUpdate()->firstOrFail();
+            $old_data = Marhun::on($cawangan['mysql'])->where([['recno','=',$request->recno],['norujukan','=',$norujukan]])->firstOrFail();
 
-        $marhunToUpdate = [
-            'karat' => $request->karat,
-            'marhun' => $request->marhun,
-            'nota' => $request->nota,
-            'tag_permata' => $request->tag_permata,
-            'berat_batu_permata' => $request->berat_batu_permata,
-            'berat' => $request->berat,
-            'harga' => $harga['harga'],
-            'n_marhun' => $nilai_marhun,
-            'bil' => $request->kuantiti,
-        ];
+            $marhunToUpdate = [
+                'karat' => $request->karat,
+                'marhun' => $request->marhun,
+                'nota' => $request->nota,
+                'tag_permata' => $request->tag_permata,
+                'berat_batu_permata' => $request->berat_batu_permata,
+                'berat' => $request->berat,
+                'harga' => $harga['harga'],
+                'n_marhun' => $nilai_marhun,
+                'bil' => $request->kuantiti,
+            ];
 
-        // Set value berat_batu_permata to null if value passed is null
-        if($marhunToUpdate['berat_batu_permata'] == '') {
-            $marhunToUpdate['berat_batu_permata'] = null;
-        };
+            // Set value berat_batu_permata to null if value passed is null
+            if($marhunToUpdate['berat_batu_permata'] == '') {
+                $marhunToUpdate['berat_batu_permata'] = null;
+            };
 
-        $jemas = Marhun::on($cawangan['mysql'])->where([['recno','=',$request->recno],['norujukan','=',$norujukan]])->update($marhunToUpdate);
+            $jemas = Marhun::on($cawangan['mysql'])->where([['recno','=',$request->recno],['norujukan','=',$norujukan]])->update($marhunToUpdate);
 
-        $new_data = Marhun::on($cawangan['mysql'])->where([['recno','=',$request->recno],['norujukan','=',$norujukan]])->first();
+            // Recalculate from every item belonging to this SAG, after the edit.
+            $totals = Marhun::on($cawangan['mysql'])->where('norujukan', $norujukan)
+                ->selectRaw('COALESCE(SUM(berat), 0) AS total_berat, COALESCE(SUM(n_marhun), 0) AS total_nilai, COALESCE(SUM(bil), 0) AS total_kuantiti')
+                ->first();
+            Gadai::on($cawangan['mysql'])->where('norujukan', $norujukan)->update([
+                'berat' => $totals->total_berat,
+                'nilaimarhun' => $totals->total_nilai,
+                'kuantiti' => $totals->total_kuantiti,
+            ]);
 
-        $audit = new Audit();
-        $audit->users = $request->teller;
-        $audit->actions = 'Ubah Marhun';
-        $audit->norujukan = $norujukan;
-        $audit->old_data = $old_data;
-        $audit->new_data = $new_data;
-        $audit->kodcaw = $kodcaw;
-        $audit->created_at = $current;
-        $audit->updated_at = $current;
-        $audit->save();
+            $new_data = Marhun::on($cawangan['mysql'])->where([['recno','=',$request->recno],['norujukan','=',$norujukan]])->first();
+
+            $audit = new Audit();
+            $audit->users = $request->teller;
+            $audit->actions = 'Ubah Marhun';
+            $audit->norujukan = $norujukan;
+            $audit->old_data = $old_data;
+            $audit->new_data = $new_data;
+            $audit->kodcaw = $kodcaw;
+            $audit->created_at = $current;
+            $audit->updated_at = $current;
+            $audit->save();
+        });
 
         return response('Edit Successfully', 200);
     }

app/Http/Controllers/PembiayaanOnlineController.php

@@ -35,6 +35,14 @@ class PembiayaanOnlineController extends Controller
         return $this->respond($this->service->show($kodcaw, $norujukan));
     }
 
+    /**
+     * GET /api/pembiayaan-online/{kodcaw}/lines/{id}
+     */
+    public function showLine($kodcaw, $id)
+    {
+        return $this->respond($this->service->showLine($kodcaw, $id));
+    }
+
     /**
      * GET /api/pembiayaan-online/{kodcaw}/queue
      */
@@ -53,6 +61,8 @@ class PembiayaanOnlineController extends Controller
         foreach ([
             'kodbank', 'noakaun', 'nama_bank', 'nama_akaun', 'nota',
             'bukti_akaun_file_id', 'borang_file_id', 'update_customer_bank',
+            'bukti_akaun_data', 'bukti_akaun_filename', 'bukti_akaun_type',
+            'borang_data', 'borang_filename', 'borang_type',
         ] as $key) {
             if ($request->has($key)) {
                 $input[$key] = $request->input($key);
@@ -62,6 +72,26 @@ class PembiayaanOnlineController extends Controller
         return $this->respond($this->service->updateLine($kodcaw, $id, $input));
     }
 
+    /**
+     * POST /api/pembiayaan-online/{kodcaw}/lines/{id}/verify
+     */
+    public function verifyLine($kodcaw, $id, Request $request)
+    {
+        return $this->respond($this->service->verifyLine(
+            $kodcaw,
+            $id,
+            $request->input('pc_verified_by', '')
+        ));
+    }
+
+    /**
+     * POST /api/pembiayaan-online/{kodcaw}/lines/{id}/unverify
+     */
+    public function unverifyLine($kodcaw, $id)
+    {
+        return $this->respond($this->service->unverifyLine($kodcaw, $id));
+    }
+
     /**
      * GET /api/pembiayaan-online/{kodcaw}/batches
      */
@@ -177,6 +207,22 @@ class PembiayaanOnlineController extends Controller
         return $this->respond($this->service->getBukti($kodcaw, $id));
     }
 
+    /**
+     * GET /api/pembiayaan-online/{kodcaw}/lines/{id}/bukti-akaun
+     */
+    public function getBuktiAkaun($kodcaw, $id)
+    {
+        return $this->respond($this->service->getBuktiAkaun($kodcaw, $id));
+    }
+
+    /**
+     * GET /api/pembiayaan-online/{kodcaw}/lines/{id}/borang
+     */
+    public function getBorang($kodcaw, $id)
+    {
+        return $this->respond($this->service->getBorang($kodcaw, $id));
+    }
+
     /**
      * GET /api/pembiayaan-online/{kodcaw}/paid?blast_sent=0
      */

app/Http/Controllers/ShorakaController.php

@@ -0,0 +1,291 @@
+<?php
+
+namespace App\Http\Controllers;
+
+use App\ShorakaTransaction;
+use App\Services\ShorakaService;
+use Carbon\Carbon;
+use Illuminate\Database\QueryException;
+use Illuminate\Http\Request;
+use Illuminate\Support\Facades\Log;
+use Throwable;
+
+class ShorakaController extends Controller
+{
+    public function index(Request $request)
+    {
+        $this->validate($request, [
+            'kodcaw' => 'nullable|string|max:30',
+            'norujukan' => 'nullable|string|max:100',
+            'status' => 'nullable|string|max:30',
+            'date_from' => 'nullable|date_format:Y-m-d',
+            'date_to' => 'nullable|date_format:Y-m-d',
+            'per_page' => 'nullable|integer|min:1|max:100',
+            'page' => 'nullable|integer|min:1',
+            'branch_scope' => 'nullable|string|max:30',
+        ]);
+
+        $query = ShorakaTransaction::query();
+        foreach (['kodcaw', 'norujukan', 'status'] as $field) {
+            if ($request->filled($field)) {
+                $query->where($field, $request->input($field));
+            }
+        }
+        if ($request->filled('date_from')) {
+            $query->where('created_at', '>=', $request->input('date_from') . ' 00:00:00');
+        }
+        if ($request->filled('date_to')) {
+            $query->where('created_at', '<', Carbon::parse($request->input('date_to'))->addDay()->format('Y-m-d') . ' 00:00:00');
+        }
+        $records = $query->orderByDesc('created_at')->orderByDesc('id')
+            ->paginate(min(100, max(1, (int) $request->input('per_page', 25))));
+        $payload = [
+            'data' => $records->getCollection()->map(function (ShorakaTransaction $record) {
+                return [
+                    'id' => $record->id,
+                    'kodcaw' => $record->kodcaw,
+                    'norujukan' => $record->norujukan,
+                    'teller' => $record->teller,
+                    'status' => $record->status,
+                    'order_id' => $record->order_id,
+                    'created_at' => optional($record->created_at)->toDateTimeString(),
+                    'updated_at' => optional($record->updated_at)->toDateTimeString(),
+                ];
+            })->values(),
+            'total' => $records->total(),
+            'current_page' => $records->currentPage(),
+            'per_page' => $records->perPage(),
+            'last_page' => $records->lastPage(),
+        ];
+        if ($request->input('with_branches')) {
+            $branches = ShorakaTransaction::query()->whereNotNull('kodcaw');
+            if ($request->filled('branch_scope')) {
+                $branches->where('kodcaw', $request->input('branch_scope'));
+            }
+            $payload['branches'] = $branches->distinct()->orderBy('kodcaw')->pluck('kodcaw')->values();
+        }
+        return response()->json($payload);
+    }
+
+    public function submit(Request $request, ShorakaService $shoraka)
+    {
+        $validated = $this->validate($request, [
+            'norujukan' => 'required|string|max:255',
+            'ownership' => 'required|string|max:255',
+            'order_amount' => 'required|numeric|min:0.01|max:9999999999999.99',
+            'murabaha_amount' => 'required|numeric|min:0.01|max:9999999999999.99',
+            'tenor_other' => 'required|integer|min:1',
+            'teller' => 'nullable|string|max:255',
+        ]);
+        if (!$shoraka->configured()) {
+            return $this->unconfigured();
+        }
+
+        $existing = ShorakaTransaction::where('norujukan', $validated['norujukan'])->first();
+        if ($existing) {
+            return $this->duplicate($existing);
+        }
+
+        $payload = [
+            'product_type' => 'FINANCING',
+            'commodity_type' => '000-COPPER',
+            'ownership' => $validated['ownership'],
+            'ownership_doc_no' => $validated['norujukan'],
+            'value_date' => Carbon::now()->format('d/m/Y'),
+            'order_currency' => 'MYR',
+            'order_amount' => number_format((float) $validated['order_amount'], 2, '.', ''),
+            'murabaha_amount' => number_format((float) $validated['murabaha_amount'], 2, '.', ''),
+            // Appendix codes in v1.5: OTHERS and MONTH.
+            'tenor' => 'OTHERS',
+            'tenor_other' => $validated['tenor_other'],
+            'tenor_other_unit' => 'MONTH',
+            'order_type' => 'Buy & Sell',
+        ];
+
+        try {
+            // The unique norujukan index is the atomic claim for concurrent submissions.
+            $attributes = [
+                'norujukan' => $validated['norujukan'],
+                'kodcaw' => $request->attributes->get('shoraka_kodcaw'),
+                'teller' => $validated['teller'] ?? null,
+                'status' => 'PENDING',
+                'product_type' => $payload['product_type'],
+                'commodity_type' => $payload['commodity_type'],
+                'ownership_name' => $payload['ownership'],
+                'ownership_doc_no' => $payload['ownership_doc_no'],
+                'order_amount' => $payload['order_amount'],
+                'murabaha_amount' => $payload['murabaha_amount'],
+                'request_payload' => $payload,
+                'attempt_count' => 1,
+            ];
+            $transaction = ShorakaTransaction::create($attributes);
+        } catch (QueryException $exception) {
+            $existing = ShorakaTransaction::where('norujukan', $validated['norujukan'])->first();
+            if ($existing) {
+                return $this->duplicate($existing);
+            }
+            throw $exception;
+        }
+
+        try {
+            $response = $shoraka->submitOrder($payload);
+            $this->saveOrder($transaction, $response);
+
+            return response()->json([
+                'success' => true,
+                'message' => 'Order berjaya dihantar ke Shoraka.',
+                'data' => $this->orderData($transaction),
+            ]);
+        } catch (Throwable $exception) {
+            // A timeout or invalid response does not prove the remote trade failed.
+            // Block resubmission until this reference has been reconciled with Shoraka.
+            $transaction->update([
+                'status' => $transaction->order_id ? $transaction->status : 'UNKNOWN',
+                'error_message' => 'Submission outcome requires reconciliation with Shoraka.',
+            ]);
+
+            return $this->upstreamError('submit', $transaction, $exception);
+        }
+    }
+
+    public function refresh(string $norujukan, ShorakaService $shoraka)
+    {
+        if (!$shoraka->configured()) {
+            return $this->unconfigured();
+        }
+        $transaction = ShorakaTransaction::where('norujukan', $norujukan)->firstOrFail();
+        if (!$transaction->order_id) {
+            return $this->missingOrderId();
+        }
+
+        try {
+            $response = $shoraka->orderStatus($transaction->order_id);
+            $this->saveOrder($transaction, $response);
+
+            return response()->json(['success' => true, 'data' => $this->orderData($transaction)]);
+        } catch (Throwable $exception) {
+            return $this->upstreamError('status', $transaction, $exception);
+        }
+    }
+
+    public function certificate(string $norujukan, ShorakaService $shoraka)
+    {
+        if (!$shoraka->configured()) {
+            return $this->unconfigured();
+        }
+        $transaction = ShorakaTransaction::where('norujukan', $norujukan)->firstOrFail();
+        if (!$transaction->order_id) {
+            return $this->missingOrderId();
+        }
+
+        try {
+            $pdf = $shoraka->certificate($transaction->order_id);
+
+            return response($pdf, 200, [
+                'Content-Type' => 'application/pdf',
+                'Content-Disposition' => 'attachment; filename="shoraka-' . $transaction->id . '.pdf"',
+                'Cache-Control' => 'private, no-store',
+            ]);
+        } catch (Throwable $exception) {
+            return $this->upstreamError('certificate', $transaction, $exception);
+        }
+    }
+
+    public function callback(Request $request, ShorakaService $shoraka)
+    {
+        if (!$shoraka->configured()) {
+            return $this->unconfigured();
+        }
+        $payload = $request->json()->all();
+        if (!$shoraka->validCallback($payload)) {
+            return response()->json(['success' => false, 'message' => 'Invalid callback signature.'], 401);
+        }
+
+        // ownershipDocNo and certificateUrl are NOT signed. Never use them to link
+        // a callback to a local record or download a file.
+        $transaction = ShorakaTransaction::where('order_id', $payload['orderId'])->first();
+        if (!$transaction) {
+            return response()->json(['success' => false, 'message' => 'Order not found.'], 404);
+        }
+
+        try {
+            // There is no signed callback timestamp. Query the current order so a
+            // delayed/replayed callback cannot directly restore an old status.
+            $response = $shoraka->orderStatus($transaction->order_id);
+            unset($payload['signature']);
+            $this->saveOrder($transaction, $response, ['callback_payload' => $payload]);
+
+            // Exact acknowledgement required by section 6.
+            return response('OK', 200, ['Content-Type' => 'text/plain']);
+        } catch (Throwable $exception) {
+            return $this->upstreamError('callback', $transaction, $exception);
+        }
+    }
+
+    protected function saveOrder(ShorakaTransaction $transaction, array $response, array $extra = []): void
+    {
+        $transaction->update(array_merge([
+            'order_id' => (string) $response['orderId'],
+            'status' => $response['status'],
+            'certificate_url' => $response['certificateUrl'] ?? null,
+            'response_payload' => $response,
+            'submitted_at' => $transaction->submitted_at ?: Carbon::now(),
+            'completed_at' => $response['status'] === 'Completed'
+                ? ($transaction->completed_at ?: Carbon::now()) : $transaction->completed_at,
+            'error_message' => null,
+        ], $extra));
+        app(\App\Services\ShorakaGadaiService::class)->sync($transaction);
+    }
+
+    protected function orderData(ShorakaTransaction $transaction): array
+    {
+        return [
+            'norujukan' => $transaction->norujukan,
+            'kodcaw' => $transaction->kodcaw,
+            'teller' => $transaction->teller,
+            'order_id' => $transaction->order_id,
+            'status' => $transaction->status,
+            'certificate_url' => $transaction->certificate_url,
+        ];
+    }
+
+    protected function duplicate(ShorakaTransaction $transaction)
+    {
+        return response()->json([
+            'success' => false,
+            'message' => 'Transaksi telah direkodkan. Semak status dengan Shoraka sebelum penghantaran semula.',
+            'data' => $this->orderData($transaction),
+        ], 409);
+    }
+
+    protected function missingOrderId()
+    {
+        return response()->json([
+            'success' => false,
+            'message' => 'Order ID belum tersedia. Semakan dengan Shoraka diperlukan.',
+        ], 409);
+    }
+
+    protected function unconfigured()
+    {
+        return response()->json([
+            'success' => false,
+            'message' => 'API ID dan Secret Key Shoraka belum dikonfigurasi.',
+        ], 503);
+    }
+
+    protected function upstreamError(string $operation, ShorakaTransaction $transaction, Throwable $exception)
+    {
+        // Connection exceptions may include request details; log only the class.
+        Log::error('Shoraka request failed', [
+            'operation' => $operation,
+            'transaction_id' => $transaction->id,
+            'exception_type' => get_class($exception),
+        ]);
+
+        return response()->json([
+            'success' => false,
+            'message' => 'Permintaan Shoraka gagal. Semak status transaksi sebelum mencuba semula.',
+        ], 502);
+    }
+}

app/Http/Controllers/ShorakaGadaiController.php

@@ -0,0 +1,76 @@
+<?php
+
+namespace App\Http\Controllers;
+
+use App\KomuditiTransaksi;
+use App\Services\ShorakaGadaiService;
+use App\Services\ShorakaService;
+use Illuminate\Http\Request;
+
+class ShorakaGadaiController extends ShorakaController
+{
+    public function readiness(ShorakaService $shoraka)
+    {
+        try {
+            \App\ShorakaTransaction::query()->limit(1)->exists();
+            $storeReady = true;
+        } catch (\Throwable $exception) {
+            $storeReady = false;
+        }
+        return response()->json(['provider' => 'shoraka', 'ready' => $storeReady && $shoraka->configured()]);
+    }
+
+    public function showGadai(string $kodcaw, string $norujukan, ShorakaGadaiService $gadaiService)
+    {
+        $gadai = $gadaiService->gadai($kodcaw, $norujukan);
+        $order = $gadaiService->transaction($kodcaw, $norujukan);
+        return response()->json([
+            'success' => true,
+            'data' => [
+                'norujukan' => $norujukan, 'kodcaw' => $kodcaw,
+                'order_amount' => $gadai->pinjaman, 'murabaha_amount' => $gadai->hargajualan,
+                'order' => $order ? $this->orderData($order) : null,
+                'details' => $order ? $order->response_payload : null,
+                'simulation' => $order && strpos((string) $order->order_id, 'SIM-') === 0,
+                'can_complete' => $gadai->exists && $order && $order->status === 'Completed'
+                    && number_format((float) $gadai->pinjaman, 2, '.', '') === $order->order_amount
+                    && number_format((float) $gadai->hargajualan, 2, '.', '') === $order->murabaha_amount,
+            ],
+        ]);
+    }
+
+    public function submitGadai(string $kodcaw, string $norujukan, Request $request, ShorakaGadaiService $gadaiService, ShorakaService $shoraka)
+    {
+        $gadai = $gadaiService->gadai($kodcaw, $norujukan);
+        $existing = $gadaiService->transaction($kodcaw, $norujukan);
+        if ($existing) {
+            return $this->duplicate($existing);
+        }
+        // Historical commodity purchases must never be traded again.
+        if (KomuditiTransaksi::on('mysql7')->where('norujukan', $norujukan)->exists()
+            || $gadai->cetak || $gadai->sttebus) {
+            abort(409, 'Gadaian lama atau telah selesai tidak boleh dihantar sebagai order baharu.');
+        }
+        $payload = $gadaiService->payload($gadai);
+        $teller = $request->input('teller');
+        if (is_string($teller) && $teller !== '') {
+            $payload['teller'] = $teller;
+        }
+        $submission = new Request($payload);
+        $submission->attributes->set('shoraka_kodcaw', $kodcaw);
+        return $this->submit($submission, $shoraka);
+    }
+
+    public function refreshGadai(string $kodcaw, string $norujukan, ShorakaGadaiService $gadaiService, ShorakaService $shoraka)
+    {
+        $gadaiService->gadai($kodcaw, $norujukan);
+        $gadaiService->transaction($kodcaw, $norujukan);
+        return $this->refresh($norujukan, $shoraka);
+    }
+
+    public function certificateGadai(string $kodcaw, string $norujukan, ShorakaGadaiService $gadaiService, ShorakaService $shoraka)
+    {
+        $gadaiService->assertCompleted($kodcaw, $norujukan);
+        return $this->certificate($norujukan, $shoraka);
+    }
+}

app/Http/Controllers/TebusController.php

@@ -20,6 +20,7 @@ use App\Panjar;
 use App\HargaEmas;
 use App\Moratorium;
 use App\Audit;
+use App\Feature;
 use App\LookupWakil;
 
 use App\StokAudit1;
@@ -193,7 +194,7 @@ class TebusController extends Controller
         $cawangan = Cawangan::on('mysql7')->where('kodcaw','=',$kodcaw)->first();
 
         $tebus_data = Tebus::on($cawangan['mysql'])
-                ->select('tebus.t_tebus', 'gad.t_gadai','gad.hargajualan','gad.bakihargajualan','gad.bakipjm as gadaibakipjm','tebus.nilaimarhun','tebus.tagterima', 'tebus.teller','tebus.jenistebus','tebus.pinjaman','tebus.bakiupah','tebus.bakipjm','gad.norujukan','gad.nokp','tebus.jbg','tebus.ujrah','tebus.onepercent','gad.tagbaru')
+                ->select('tebus.t_tebus', 'gad.t_gadai','gad.hargajualan','gad.bakihargajualan','gad.bakipjm as gadaibakipjm','tebus.nilaimarhun','tebus.tagterima', 'tebus.teller','tebus.jenistebus','tebus.pinjaman','tebus.bakiupah','tebus.bakipjm','gad.norujukan','gad.nokp','tebus.jbg','tebus.ujrah','tebus.onepercent','gad.tagbaru','tebus.diskaun_rebate')
                 ->join('gadai as gad','gad.norujukan','=','tebus.norujukan')
                // ->join('online_arrahn.customer as cust', function($join)
                // {
@@ -232,7 +233,8 @@ class TebusController extends Controller
                     "nokp"=>$tebusData['nokp'],
                     "jbg"=>$tebusData['jbg'],
                     "ujrah"=>$trans['ujrah_rebet'],
-                    "onepercent"=>$trans['onepercent_rebet']
+                    "onepercent"=>$trans['onepercent_rebet'],
+                    "diskaun_rebate"=>$tebusData['diskaun_rebate'],
 
                 ]);
             }
@@ -274,7 +276,8 @@ class TebusController extends Controller
         'tebus.jbg',
         'tebus.ujrah',
         'tebus.onepercent',
-        'gad.tagbaru'
+        'gad.tagbaru',
+        'tebus.diskaun_rebate'
     )
     ->join('gadai as gad', 'gad.norujukan', '=', 'tebus.norujukan')
     ->where('tebus.t_tebus', '>=', $request->mula)
@@ -310,7 +313,8 @@ class TebusController extends Controller
                     "jbg"=>$tebusData['jbg'],
                     "ujrah"=>$trans['ujrah_rebet'],
                     "onepercent"=>$trans['onepercent_rebet'],
-                    "tagbaru"=>$tebusData['tagbaru']
+                    "tagbaru"=>$tebusData['tagbaru'],
+                    "diskaun_rebate"=>$tebusData['diskaun_rebate'],
 
                 ]);
             }
@@ -1672,6 +1676,53 @@ class TebusController extends Controller
         return response($rebet);
     }
 
+    public function RebetPromoCalculation($kodcaw, Request $request)
+    {
+        $kodcaw = $request->kodcaw ?: $kodcaw;
+        if (!Feature::enabled($kodcaw, Feature::REBET_ANNUR)) {
+            return response(0);
+        }
+
+        $cawangan = Cawangan::on('mysql7')->where('kodcaw', '=', $kodcaw)->first();
+
+        $rebet = Tebus::on($cawangan['mysql'])
+                ->join('gadai as db2', 'tebus.norujukan', '=', 'db2.norujukan')
+                ->where('tebus.t_tebus', '<=', $request->tarikh)
+                ->where('db2.hargajualan', '>', '0')
+                ->whereNotNull('db2.hargajualan')
+                ->sum('diskaun_rebate');
+
+        return response($rebet);
+    }
+
+    public function PelarasanRebate($kodcaw, Request $request)
+    {
+        $kodcaw = $request->kodcaw ?: $kodcaw;
+        if (!Feature::enabled($kodcaw, Feature::REBET_ANNUR)) {
+            return response(0);
+        }
+
+        $cawangan = Cawangan::on('mysql7')
+            ->where('kodcaw', $kodcaw)
+            ->first();
+
+        $tarikhLaporan = Carbon::parse($request->tarikh)->toDateString();
+        $tarikhTamatPelarasan = '2026-09-02';
+        $tarikhAkhir = $tarikhLaporan > $tarikhTamatPelarasan
+            ? $tarikhTamatPelarasan
+            : $tarikhLaporan;
+
+        $rebet = Tebus::on($cawangan['mysql'])
+            ->join('gadai as db2', 'tebus.norujukan', '=', 'db2.norujukan')
+            ->whereDate('tebus.t_tebus', '>=', '2025-05-13')
+            ->whereDate('tebus.t_tebus', '<=', $tarikhAkhir)
+            ->where('db2.hargajualan', '>', 0)
+            ->whereDate('db2.t_gadai', '>', '2023-05-21')
+            ->sum('tebus.diskaun_rebate');
+
+        return response($rebet);
+    }
+
     public function RebetCalculationLejer($kodcaw,Request $request)
     {
         $cawangan = Cawangan::on('mysql7')->where('kodcaw','=',$request->kodcaw)->first();
@@ -1687,6 +1738,26 @@ class TebusController extends Controller
         return response($rebet);
     }
 
+    public function RebetPromoCalculationLejer($kodcaw, Request $request)
+    {
+        $kodcaw = $request->kodcaw ?: $kodcaw;
+        if (!Feature::enabled($kodcaw, Feature::REBET_ANNUR)) {
+            return response(0);
+        }
+
+        $cawangan = Cawangan::on('mysql7')->where('kodcaw', '=', $kodcaw)->first();
+
+        $rebet = Tebus::on($cawangan['mysql'])
+                ->join('gadai as db2', 'tebus.norujukan', '=', 'db2.norujukan')
+                ->where('tebus.t_tebus', '>=', $request->mula)
+                ->where('tebus.t_tebus', '<=', $request->hingga)
+                ->where('db2.hargajualan', '>', '0')
+                ->whereNotNull('db2.hargajualan')
+                ->sum('diskaun_rebate');
+
+        return response($rebet);
+    }
+
     public function getUpahLamaToday($kodcaw,$norujukan)
     {
         $current = Carbon::now();

app/Http/Controllers/TunaiController.php

@@ -13,6 +13,7 @@ use App\Vault;
 use Auth0\SDK\API\Management\Users;
 use Illuminate\Http\Request;
 use Carbon\Carbon;
+use App\Services\StaffNotificationClient;
 use Illuminate\Support\Facades\Log;
 class TunaiController extends Controller
 {
@@ -476,10 +477,54 @@ class TunaiController extends Controller
         $audit->updated_at = $current;
         $audit->save();
 
+        $this->notifyKhazanahAliranTunai($kodcaw, $request, $reqteller);
 
         return response()->json($reqteller,200);
     }
 
+    /**
+     * Inbox for PC/PPC at the branch. Failures must not block the request.
+     *
+     * @param  string  $kodcaw
+     * @param  \Illuminate\Http\Request  $request
+     * @param  \App\RequestTeller  $reqteller
+     * @return void
+     */
+    protected function notifyKhazanahAliranTunai($kodcaw, Request $request, $reqteller)
+    {
+        try {
+            $cawangan = Cawangan::on('mysql7')->where('kodcaw', '=', $kodcaw)->first();
+            $namaCaw = $kodcaw;
+            if ($cawangan) {
+                $nama = trim((string) $cawangan->nama_cawangan);
+                if ($nama !== '') {
+                    $namaCaw = $nama;
+                }
+            }
+
+            $modal = (float) $request->modal;
+            $serahan = (float) $request->serahan;
+
+            app(StaffNotificationClient::class)->notify([
+                'type' => 'aliran_tunai.pending_khazanah',
+                'cawangan' => $kodcaw,
+                'audience' => ['role' => 'pc'],
+                'data' => [
+                    'request_no' => isset($reqteller->no) ? $reqteller->no : null,
+                    'kodlaluan' => $request->kodlaluan,
+                    'modal' => $modal,
+                    'serahan' => $serahan,
+                    'cawangan_nama' => $namaCaw,
+                ],
+            ]);
+        } catch (\Throwable $e) {
+            Log::warning('Aliran tunai khazanah notification failed: '.$e->getMessage(), [
+                'kodcaw' => $kodcaw,
+                'kodlaluan' => $request->kodlaluan,
+            ]);
+        }
+    }
+
     public function getTunaiSemalam($kodcaw)
     {
         $current = new Carbon();

app/Http/Controllers/VaultController.php

@@ -12,6 +12,7 @@ use App\GlDetail;
 use App\imbangdugalama;
 use App\GlCode;
 use App\Panjar;
+use App\ModalOnline;
 
 use Illuminate\Http\Request;
 use Carbon\Carbon;
@@ -168,37 +169,64 @@ class VaultController extends Controller
    return response()->json($updateVault, 200);
  }
 
- public function updateVaultDeletePendahuluanSerahan($kodcaw, Request $request)
- {
-   $current = Carbon::now();
-   $current = new Carbon();
-   $cawangan = Cawangan::on('mysql7')->where('kodcaw','=',$kodcaw)->first();
 
-   $vault=Vault::on($cawangan['mysql'])->where('kodcaw','=',$kodcaw)->where('tarikh','=',$current->toDateString())->orderby('tarikh','desc')->first();
+public function updateVaultDeletePendahuluanSerahan($kodcaw, Request $request)
+{
+    $current = new Carbon();
 
-   $bakiawal = $vault['bakiawal'];
-   $keluar = $vault['keluar'];
-   $masuk = $vault['masuk'];
-   $bakiakhir = $vault['bakiakhir'];
-   $bakieod = $vault['bakieod'];
-   $pendahuluan = $vault['pendahuluan'];
-   $serahan = $vault['serahan'];
-   $totpanjaran = $vault['totpanjar'];
+    $cawangan = Cawangan::on('mysql7')->where('kodcaw', '=', $kodcaw)->first();
 
-   $glpend = GlDetail::on($cawangan['mysql'])->where('tarikh','=', $current->toDateString())->sum('pendahuluan');
-   $glser = GlDetail::on($cawangan['mysql'])->where('tarikh','=', $current->toDateString())->where('teller','<>','ONLINE')->sum('serahan');
+    if (!$cawangan) {
+        return response()->json(['message' => 'Cawangan tidak dijumpai'], 404);
+    }
 
-   $bakiakhir = $bakiawal - $keluar + $masuk + $glpend - $glser - $totpanjaran;
+    $vault = Vault::on($cawangan['mysql'])
+        ->where('kodcaw', '=', $kodcaw)
+        ->where('tarikh', '=', $current->toDateString())
+        ->first();
 
-   $updateVault=Vault::on($cawangan['mysql'])->where([['tarikh','=',$current->toDateString()],['kodcaw','=', $kodcaw]])->update(array(
-      'pendahuluan' => $glpend,
-      'serahan' => $glser,
-      'bakiakhir'=>$bakiakhir,
-      'bakieod'=>$bakiakhir
-   ));
+    if (!$vault) {
+        return response()->json(['message' => 'Rekod vault hari ini tidak dijumpai'], 404);
+    }
 
-   return response()->json($updateVault, 200);
- }
+    $bakiawal    = $vault['bakiawal'];
+    $keluar      = $vault['keluar'];
+    $masuk       = $vault['masuk'];
+    $totpanjaran = $vault['totpanjar'];
+
+    // Pendahuluan HQ (dari GL)
+    $glpend = GlDetail::on($cawangan['mysql'])
+        ->where('tarikh', '=', $current->toDateString())
+        ->sum('pendahuluan');
+
+    // Serahan (GL, exclude teller ONLINE)
+    $glser = GlDetail::on($cawangan['mysql'])
+        ->where('tarikh', '=', $current->toDateString())
+        ->where('teller', '<>', 'ONLINE')
+        ->sum('serahan');
+
+    // Pendahuluan Online (had yang diluluskan hari ini)
+    $modalOnlineHad = ModalOnline::on($cawangan['mysql'])
+        ->where('kodcaw', '=', $kodcaw)
+        ->where('tarikh', '=', $current->toDateString())
+        ->value('had') ?? 0;
+
+    // Gabungan pendahuluan HQ + pendahuluan online
+    $totalPendahuluan = $glpend + $modalOnlineHad;
+
+    $bakiakhir = $bakiawal - $keluar + $masuk + $totalPendahuluan - $glser - $totpanjaran;
+
+    $updateVault = Vault::on($cawangan['mysql'])
+        ->where([['tarikh', '=', $current->toDateString()], ['kodcaw', '=', $kodcaw]])
+        ->update([
+            'pendahuluan' => $totalPendahuluan,
+            'serahan'     => $glser,
+            'bakiakhir'   => $bakiakhir,
+            'bakieod'     => $bakiakhir,
+        ]);
+
+    return response()->json($updateVault, 200);
+}
 
  public function create($kodcaw,Request $request)
  {
@@ -481,25 +509,24 @@ class VaultController extends Controller
    }
 
    public function CalculationPendahuluanSerahan($kodcaw,Request $request)
-   {
-      $cawangan = Cawangan::on('mysql7')->where('kodcaw','=',$kodcaw)->first();
+{
+   $cawangan = Cawangan::on('mysql7')->where('kodcaw','=',$kodcaw)->first();
 
-      $serahanpkb = '1000/020';
-      $serahanjmc = '1000/026';
-      $pendahuluanpkb = '7000/102';
-      $pendahuluanjmc = '7000/106';
-      $serahankoperasi = '1000/090';
+   $serahanpkb = '1000/020';
+   $serahanjmc = '1000/026';
+   $pendahuluanpkb = '7000/102';
+   $pendahuluanjmc = '7000/106';
+   $serahankoperasi = '1000/090';
 
-      //Selepas Tawarruq
+   //Selepas Tawarruq
 
-      $serahanpkbTawarruq = GlDetail::on($cawangan['mysql'])
-         ->where('ktacct','=',$serahanpkb)
-         ->where('tarikh','<=', $request->tarikh)
-         ->where('tarikh','>','2021-03-24')
-         ->sum('serahan');
+   $serahanpkbTawarruq = GlDetail::on($cawangan['mysql'])
+      ->where('ktacct','=',$serahanpkb)
+      ->where('tarikh','<=', $request->tarikh)
+      ->where('tarikh','>','2021-03-24')
+      ->sum('serahan');
 
-
-      //Sebelum Tawarruq
+       //Sebelum Tawarruq
       if($kodcaw == 'KB2' || $kodcaw == 'WCY' || $kodcaw == '1STOP' || $kodcaw == 'ARM' || $kodcaw == 'APM' || $kodcaw == '010621' || $kodcaw == '010915' || $kodcaw == '020303')
       {
          $serahanpkb = GlDetail::on($cawangan['mysql'])
@@ -546,47 +573,53 @@ class VaultController extends Controller
 
 
 
-      //Selepas Tawarruq
+   //Selepas Tawarruq
 
-      $pendahuluanPKBtawarruq = GlDetail::on($cawangan['mysql'])
+   $pendahuluanPKBtawarruq = GlDetail::on($cawangan['mysql'])
       ->where('ktacct','=',$pendahuluanpkb)
       ->where([['tarikh','<=', $request->tarikh],['tarikh','>','2021-03-24']])
       ->sum('pendahuluan');
 
-      //Sebelum Tawarruq
+   //Sebelum Tawarruq
 
-      $pendahuluanPKB = GlDetail::on($cawangan['mysql'])
-         ->where('ktacct','=',$pendahuluanpkb)
-         ->where([['tarikh','<=', $request->tarikh],['tarikh','>','2013-12-31']])
-         ->sum('amaun');
-
-      $pendahuluanJMC = GlDetail::on($cawangan['mysql'])
-         ->where('ktacct','=','7000/106')
-         ->where([['tarikh','<=', $request->tarikh],['tarikh','>','2013-12-31']])
-         ->sum('amaun');
-
-      $pendahuluanpkblama = imbangdugalama::on($cawangan['mysql'])
-         ->sum('pendahuluan_pkb');
-
-      $pendahuluanjmclama = imbangdugalama::on($cawangan['mysql'])
-         ->sum('pendahuluan_jmc');
-
-      $total = $pendahuluanPKBtawarruq + $pendahuluanjmclama + $pendahuluanpkblama + $pendahuluanPKB + $pendahuluanJMC;
-
-      $pindahkekpkb = GlCode::on($cawangan['mysql'])
-      ->where('glcode','=',$serahankoperasi)
+   $pendahuluanPKB = GlDetail::on($cawangan['mysql'])
+      ->where('ktacct','=',$pendahuluanpkb)
+      ->where([['tarikh','<=', $request->tarikh],['tarikh','>','2013-12-31']])
       ->sum('amaun');
 
-      if($kodcaw == '011229')
-         $totalserahan -= 0.10;
+   $pendahuluanJMC = GlDetail::on($cawangan['mysql'])
+      ->where('ktacct','=','7000/106')
+      ->where([['tarikh','<=', $request->tarikh],['tarikh','>','2013-12-31']])
+      ->sum('amaun');
 
-      if($kodcaw == '011013')
-         $totalserahan += 641000;
+   $pendahuluanpkblama = imbangdugalama::on($cawangan['mysql'])
+      ->sum('pendahuluan_pkb');
 
-      $arraypend = ['pendahuluan' => $total,'serahan' => $totalserahan,'pindahkekpkb' => $pindahkekpkb];
+   $pendahuluanjmclama = imbangdugalama::on($cawangan['mysql'])
+      ->sum('pendahuluan_jmc');
 
-      return response()->json($arraypend);
-   }
+   //Pendahuluan Online (had)
+   $modalOnlineHad = ModalOnline::on($cawangan['mysql'])
+      ->where('kodcaw','=', $kodcaw)
+      ->where('tarikh','=', $request->tarikh)
+      ->value('had') ?? 0;
+
+   $total = $pendahuluanPKBtawarruq + $pendahuluanjmclama + $pendahuluanpkblama + $pendahuluanPKB + $pendahuluanJMC + $modalOnlineHad;
+
+   $pindahkekpkb = GlCode::on($cawangan['mysql'])
+   ->where('glcode','=',$serahankoperasi)
+   ->sum('amaun');
+
+   if($kodcaw == '011229')
+      $totalserahan -= 0.10;
+
+   if($kodcaw == '011013')
+      $totalserahan += 641000;
+
+   $arraypend = ['pendahuluan' => $total,'serahan' => $totalserahan,'pindahkekpkb' => $pindahkekpkb];
+
+   return response()->json($arraypend);
+}
 
 
    public function CalculationPendahuluanSerahanLejer($kodcaw,Request $request)
@@ -732,5 +765,19 @@ class VaultController extends Controller
 
       return response()->json($vault);
    }
+public function CalculationModalOnlineLejer($kodcaw, Request $request)
+{
+    $cawangan = Cawangan::on('mysql7')->where('kodcaw','=',$kodcaw)->first();
 
+    $tarikh = $request->hingga;
+
+    $modal_online = ModalOnline::on($cawangan['mysql'])
+        ->where('kodcaw', '=', $kodcaw)
+        ->where('tarikh', '=', $tarikh)
+        ->first();
+
+    return response()->json([
+        'had' => $modal_online ? floatval($modal_online->had) : 0,
+    ]);
+}
 }

app/Http/Controllers/WhatsappWebhookController.php

@@ -0,0 +1,122 @@
+<?php
+
+namespace App\Http\Controllers;
+
+use Illuminate\Http\Request;
+use Illuminate\Support\Facades\Log;
+
+/**
+ * Meta WhatsApp Cloud webhook: verify challenge + acknowledge events.
+ * Sufficient for production onboarding; delivery statuses are logged only.
+ */
+class WhatsappWebhookController extends Controller
+{
+    /**
+     * GET /api/whatsapp/webhook
+     * Meta sends hub.mode, hub.verify_token, hub.challenge.
+     */
+    public function verify(Request $request)
+    {
+        $mode = $request->query('hub_mode', $request->query('hub.mode'));
+        $token = $request->query('hub_verify_token', $request->query('hub.verify_token'));
+        $challenge = $request->query('hub_challenge', $request->query('hub.challenge'));
+
+        $expected = (string) config('whatsapp.verify_token');
+
+        if ($mode === 'subscribe' && $expected !== '' && hash_equals($expected, (string) $token)) {
+            Log::info('WhatsApp webhook verified');
+            return response((string) $challenge, 200)
+                ->header('Content-Type', 'text/plain');
+        }
+
+        Log::warning('WhatsApp webhook verify failed', [
+            'mode' => $mode,
+            'token_match' => $expected !== '' && hash_equals($expected, (string) $token),
+        ]);
+
+        return response('Forbidden', 403);
+    }
+
+    /**
+     * POST /api/whatsapp/webhook
+     * Acknowledge quickly; optionally check X-Hub-Signature-256 when app secret is set.
+     */
+    public function handle(Request $request)
+    {
+        $raw = $request->getContent();
+
+        if (!$this->signatureOk($request, $raw)) {
+            Log::warning('WhatsApp webhook invalid signature');
+            return response('Invalid signature', 403);
+        }
+
+        $payload = json_decode($raw, true);
+        if (!is_array($payload)) {
+            return response('OK', 200);
+        }
+
+        try {
+            $this->logEvents($payload);
+        } catch (\Throwable $e) {
+            Log::error('WhatsApp webhook log failed: ' . $e->getMessage());
+        }
+
+        return response('OK', 200);
+    }
+
+    protected function signatureOk(Request $request, $raw)
+    {
+        $secret = trim((string) config('whatsapp.app_secret'));
+        if ($secret === '') {
+            return true;
+        }
+
+        $header = (string) $request->header('X-Hub-Signature-256', '');
+        if ($header === '' || strpos($header, 'sha256=') !== 0) {
+            return false;
+        }
+
+        $expected = 'sha256=' . hash_hmac('sha256', $raw, $secret);
+
+        return hash_equals($expected, $header);
+    }
+
+    protected function logEvents(array $payload)
+    {
+        $entries = $payload['entry'] ?? [];
+        if (!is_array($entries)) {
+            return;
+        }
+
+        foreach ($entries as $entry) {
+            $changes = $entry['changes'] ?? [];
+            if (!is_array($changes)) {
+                continue;
+            }
+
+            foreach ($changes as $change) {
+                $value = $change['value'] ?? [];
+                if (!is_array($value)) {
+                    continue;
+                }
+
+                foreach ($value['statuses'] ?? [] as $status) {
+                    Log::info('WhatsApp status', [
+                        'id' => $status['id'] ?? null,
+                        'status' => $status['status'] ?? null,
+                        'recipient' => $status['recipient_id'] ?? null,
+                        'errors' => $status['errors'] ?? null,
+                    ]);
+                }
+
+                foreach ($value['messages'] ?? [] as $message) {
+                    Log::info('WhatsApp inbound', [
+                        'from' => $message['from'] ?? null,
+                        'type' => $message['type'] ?? null,
+                        'id' => $message['id'] ?? null,
+                    ]);
+                }
+            }
+        }
+    }
+}

app/Http/Middleware/LogViewerPassword.php

@@ -0,0 +1,32 @@
+<?php
+
+namespace App\Http\Middleware;
+
+use Closure;
+
+class LogViewerPassword
+{
+    public function handle($request, Closure $next)
+    {
+        $passwordHash = config('logviewer.password');
+
+        if (!is_string($passwordHash) || $passwordHash === '') {
+            return response('Akses log belum dikonfigurasi.', 503)
+                ->header('Cache-Control', 'no-store');
+        }
+
+        $provided = $request->getPassword();
+        if ($request->getUser() !== 'logviewer' || !is_string($provided) ||
+            !password_verify($provided, $passwordHash)) {
+            return response('Kata laluan diperlukan untuk mengakses log.', 401, [
+                'WWW-Authenticate' => 'Basic realm="Log Viewer", charset="UTF-8"',
+                'Cache-Control' => 'no-store',
+            ]);
+        }
+
+        $response = $next($request);
+        $response->headers->set('Cache-Control', 'no-store');
+
+        return $response;
+    }
+}

app/Jobs/WhatsappPembiayaanOnlinePaid.php

@@ -0,0 +1,153 @@
+<?php
+
+namespace App\Jobs;
+
+use App\BlastWasap;
+use App\Customer;
+use App\Services\Whatsapp\WhatsappCloudClient;
+use Carbon\Carbon;
+use Illuminate\Support\Facades\Log;
+
+class WhatsappPembiayaanOnlinePaid extends Job
+{
+    public $kodcaw;
+    public $cawName;
+    public $nokp;
+    public $norujukan;
+    public $pinjaman;
+    public $namaBank;
+    public $noakaun;
+    public $tarikhBayaran;
+    public $noRujukanBayaran;
+
+    public function __construct(array $data)
+    {
+        $this->kodcaw = $data['kodcaw'] ?? null;
+        $this->cawName = $data['caw_name'] ?? null;
+        $this->nokp = $data['nokp'] ?? null;
+        $this->norujukan = $data['norujukan'] ?? null;
+        $this->pinjaman = $data['pinjaman'] ?? null;
+        $this->namaBank = $data['nama_bank'] ?? null;
+        $this->noakaun = $data['noakaun'] ?? null;
+        $this->tarikhBayaran = $data['tarikh_bayaran'] ?? null;
+        $this->noRujukanBayaran = $data['no_rujukan_bayaran'] ?? null;
+    }
+
+    public function handle()
+    {
+        $client = new WhatsappCloudClient();
+        $now = Carbon::now();
+
+        if (!$client->isConfigured()) {
+            Log::warning('WhatsApp Cloud skipped: token or phone_number_id missing', [
+                'norujukan' => $this->norujukan,
+            ]);
+            return;
+        }
+
+        $customer = Customer::on('mysql7')
+            ->where(function ($q) {
+                $q->where('kpbaru', $this->nokp)->orWhere('kplama', $this->nokp);
+            })
+            ->first();
+
+        $storedPhone = $customer ? ($customer->telefon ?: $customer->telefon2) : null;
+        $to = $client->normalizeMsisdn($storedPhone);
+
+        if (!config('whatsapp.whatsapp_cloud_enabled')) {
+            $admin = $client->normalizeMsisdn(env('ADMIN_PHONE_NUMBER'));
+            if (!$admin) {
+                Log::warning('WhatsApp Cloud skipped: ADMIN_PHONE_NUMBER required when WHATSAPP_ENABLED is false', [
+                    'norujukan' => $this->norujukan,
+                ]);
+                $this->logBlast($now, $storedPhone, 'skipped: ADMIN_PHONE_NUMBER empty');
+                return;
+            }
+            $to = $admin;
+        }
+
+        if (!$to) {
+            Log::warning('WhatsApp Cloud skipped: no phone', [
+                'nokp' => $this->nokp,
+                'norujukan' => $this->norujukan,
+            ]);
+            $this->logBlast($now, $storedPhone, 'skipped: no phone');
+            return;
+        }
+
+        $template = config('whatsapp.template', 'hello_world');
+        $lang = config('whatsapp.template_lang', 'en_US');
+        $bodyParams = $this->isHelloWorld($template) ? [] : $this->bodyParams();
+
+        try {
+            $response = $client->sendTemplate($to, $template, $lang, $bodyParams);
+            $this->logBlast($now, $to, $response->body());
+        } catch (\Throwable $e) {
+            Log::error('WhatsappPembiayaanOnlinePaid failed: ' . $e->getMessage(), [
+                'norujukan' => $this->norujukan,
+            ]);
+            $this->logBlast($now, $to, 'exception: ' . $e->getMessage());
+        }
+    }
+
+    protected function isHelloWorld($template)
+    {
+        return strtolower((string) $template) === 'hello_world';
+    }
+
+    /**
+     * Matches Meta template pembiayaan_online_paid (ms):
+     * AR-RAHN KoPKB: Pembiayaan bagi No. SAG *{{1}}* sebanyak *RM{{2}}*
+     * telah berjaya dikreditkan ke akaun *{{3}}* berakhir *{{4}}* pada *{{5}}*.
+     * Rujukan: *{{6}}*
+     *
+     * {{1}} SAG, {{2}} amaun, {{3}} nama bank/akaun, {{4}} 4 digit akhir, {{5}} tarikh, {{6}} rujukan bayaran
+     *
+     * @return array<int,string>
+     */
+    protected function bodyParams()
+    {
+        $bank = trim((string) $this->namaBank);
+        $tail = $this->accountTail($this->noakaun);
+
+        $tarikh = $this->tarikhBayaran
+            ? Carbon::parse($this->tarikhBayaran)->format('d/m/Y')
+            : Carbon::now()->format('d/m/Y');
+
+        return [
+            $this->norujukan ?: '-',
+            number_format((float) $this->pinjaman, 2, '.', ''),
+            $bank !== '' ? $bank : '-',
+            $tail !== '' ? $tail : '-',
+            $tarikh,
+            $this->noRujukanBayaran ?: '-',
+        ];
+    }
+
+    protected function accountTail($noakaun)
+    {
+        $digits = preg_replace('/\D+/', '', (string) $noakaun);
+        if ($digits === '') {
+            return '';
+        }
+
+        return substr($digits, -4);
+    }
+
+    protected function logBlast($now, $telefon, $status)
+    {
+        try {
+            $log = new BlastWasap();
+            $log->kodcaw = $this->kodcaw;
+            $log->nokp = $this->nokp;
+            $log->notelefon = $telefon;
+            $log->norujukan = $this->norujukan;
+            $log->status = is_string($status) ? $status : json_encode($status);
+            $log->created_at = $now;
+            $log->updated_at = $now;
+            $log->save();
+        } catch (\Throwable $e) {
+            Log::error('log_blast_wasap save failed: ' . $e->getMessage());
+        }
+    }
+}

app/KadarRebet.php

@@ -0,0 +1,18 @@
+<?php
+
+namespace App;
+
+use Illuminate\Database\Eloquent\Model;
+
+class KadarRebet extends Model
+{
+    protected $table = 'kadar_rebet';
+    protected $connection = 'mysql7';
+    public $timestamps = false;
+
+    protected $fillable = [
+        'pembiayaan_min',
+        'pembiayaan_max',
+        'kadarrebet',
+    ];
+}

app/PembiayaanOnline.php

@@ -32,6 +32,8 @@ class PembiayaanOnline extends Model
         'paid_at',
         'created_by',
         'pc_submitted_by',
+        'pc_verified_by',
+        'pc_verified_at',
         'ops_by',
         'nota',
         'blast_sent',

app/Services/PembiayaanOnline/ModalOnlineService.php

@@ -6,6 +6,7 @@ use App\Cawangan;
 use App\Feature;
 use App\ModalOnline;
 use App\RequestModalOnline;
+use App\Services\StaffNotificationClient;
 use Carbon\Carbon;
 use Illuminate\Support\Facades\DB;
 use Illuminate\Support\Facades\Log;
@@ -362,6 +363,8 @@ class ModalOnlineService
             'nota' => $nota,
         ]);
 
+        $this->notifyOperasiModalRequest($kodcaw, $request, $jenis);
+
         return [
             'ok' => true,
             'status' => 201,
@@ -373,6 +376,54 @@ class ModalOnlineService
         ];
     }
 
+    /**
+     * Inbox for all operasi staff. Failures must not block the request.
+     *
+     * @param  string  $kodcaw
+     * @param  \App\RequestModalOnline  $request
+     * @param  string  $jenis
+     * @return void
+     */
+    protected function notifyOperasiModalRequest($kodcaw, $request, $jenis)
+    {
+        try {
+            app(StaffNotificationClient::class)->notify([
+                'type' => 'modal_online.pending_operasi',
+                'cawangan' => $kodcaw,
+                'audience' => ['role' => 'operasi'],
+                'data' => [
+                    'request_id' => $request->id,
+                    'amaun' => (float) $request->amaun,
+                    'dimohon_oleh' => $request->dimohon_oleh,
+                    'jenis' => $jenis,
+                    'nota' => $request->nota,
+                    'cawangan_nama' => $this->cawanganNama($kodcaw),
+                ],
+            ]);
+        } catch (\Throwable $e) {
+            Log::warning('Operasi modal-online notification failed: '.$e->getMessage(), [
+                'kodcaw' => $kodcaw,
+                'request_id' => $request->id,
+            ]);
+        }
+    }
+
+    /**
+     * @param  string  $kodcaw
+     * @return string
+     */
+    protected function cawanganNama($kodcaw)
+    {
+        $cawangan = Cawangan::on('mysql7')->where('kodcaw', '=', $kodcaw)->first();
+        if (!$cawangan) {
+            return $kodcaw;
+        }
+
+        $nama = trim((string) $cawangan->nama_cawangan);
+
+        return $nama !== '' ? $nama : $kodcaw;
+    }
+
     /**
      * List top-up requests.
      * For PC: pass kodcaw. For Operasi: omit kodcaw (all branches).

app/Services/PembiayaanOnline/PembiayaanOnlineService.php

@@ -9,16 +9,21 @@ use App\Cawangan;
 use App\Customer;
 use App\Feature;
 use App\Gadai;
+use App\Jobs\WhatsappPembiayaanOnlinePaid;
 use App\PembiayaanOnline;
+use App\Services\StaffNotificationClient;
+use App\Services\Whatsapp\WhatsappCloudClient;
 use Carbon\Carbon;
 use Illuminate\Support\Facades\DB;
 use Illuminate\Support\Facades\Log;
 
 class PembiayaanOnlineService
 {
-    const MIN_PINJAMAN = 5000.00;
+    const MIN_PINJAMAN = 1.00;
     const MAX_PINJAMAN = 50000.00;
-    const PC_QUEUE_STATUSES = ['PENDING_PC', 'REJECTED_PC'];
+    const PC_QUEUE_STATUSES = ['PENDING_PC', 'REJECTED_PC', 'VERIFIED_PC'];
+    const PC_VERIFY_FROM_STATUSES = ['PENDING_PC', 'REJECTED_PC'];
+    const PC_SUBMITTABLE_STATUSES = ['VERIFIED_PC'];
 
     protected $modalOnlineService;
 
@@ -258,6 +263,36 @@ class PembiayaanOnlineService
         ];
     }
 
+    /**
+     * @return array{ok:bool,status:int,payload:mixed}
+     */
+    public function showLine($kodcaw, $id)
+    {
+        $resolved = $this->resolveMysql($kodcaw);
+        if (!$resolved['ok']) {
+            return $resolved;
+        }
+
+        $line = PembiayaanOnline::on($resolved['mysql'])
+            ->where('kodcaw', $kodcaw)
+            ->where('id', $id)
+            ->first();
+
+        if (!$line) {
+            return [
+                'ok' => false,
+                'status' => 404,
+                'payload' => ['message' => 'Pembiayaan online tidak dijumpai'],
+            ];
+        }
+
+        return [
+            'ok' => true,
+            'status' => 200,
+            'payload' => $line,
+        ];
+    }
+
     /**
      * @return array{ok:bool,status:int,payload:mixed}
      */
@@ -332,7 +367,7 @@ class PembiayaanOnlineService
                 'ok' => false,
                 'status' => 422,
                 'payload' => [
-                    'message' => 'Hanya rekod PENDING_PC / REJECTED_PC boleh dikemaskini',
+                    'message' => 'Hanya rekod PENDING_PC / REJECTED_PC / VERIFIED_PC boleh dikemaskini',
                     'status' => $line->status,
                 ],
             ];
@@ -368,6 +403,31 @@ class PembiayaanOnlineService
             $fields['borang_file_id'] = $input['borang_file_id'];
         }
 
+        if (!empty($input['bukti_akaun_data'])) {
+            $saved = $this->storeBuktiFile([
+                'data' => $input['bukti_akaun_data'],
+                'filename' => $input['bukti_akaun_filename'] ?? $input['filename'] ?? null,
+                'type' => $input['bukti_akaun_type'] ?? $input['type'] ?? null,
+            ]);
+            if (!$saved['ok']) {
+                return $saved;
+            }
+            $fields['bukti_akaun_file_id'] = $saved['payload']['id'];
+        }
+
+        if (!empty($input['borang_data'])) {
+            $saved = $this->storeBuktiFile([
+                'data' => $input['borang_data'],
+                'filename' => $input['borang_filename'] ?? null,
+                'type' => $input['borang_type'] ?? null,
+            ]);
+            if (!$saved['ok']) {
+                $saved['payload']['message'] = 'Borang pengesahan diperlukan: fail, nama fail dan jenis fail.';
+                return $saved;
+            }
+            $fields['borang_file_id'] = $saved['payload']['id'];
+        }
+
         if (empty($fields)) {
             return [
                 'ok' => false,
@@ -395,6 +455,12 @@ class PembiayaanOnlineService
             ? (bool) $input['update_customer_bank']
             : true;
 
+        if ($line->status === 'VERIFIED_PC') {
+            $fields['status'] = !empty($line->reject_reason) ? 'REJECTED_PC' : 'PENDING_PC';
+            $fields['pc_verified_by'] = null;
+            $fields['pc_verified_at'] = null;
+        }
+
         try {
             DB::connection($mysql)->transaction(function () use ($mysql, $line, $fields, $updateCustomerBank) {
                 PembiayaanOnline::on($mysql)->where('id', $line->id)->update($fields);
@@ -433,6 +499,159 @@ class PembiayaanOnlineService
         }
     }
 
+    /**
+     * PC confirms one queue line before it can be submitted to Operasi.
+     *
+     * @return array{ok:bool,status:int,payload:mixed}
+     */
+    public function verifyLine($kodcaw, $id, $pcBy)
+    {
+        $resolved = $this->resolveMysql($kodcaw);
+        if (!$resolved['ok']) {
+            return $resolved;
+        }
+        $mysql = $resolved['mysql'];
+
+        $pcBy = trim((string) $pcBy);
+        if ($pcBy === '') {
+            return [
+                'ok' => false,
+                'status' => 422,
+                'payload' => ['message' => 'pc_verified_by diperlukan'],
+            ];
+        }
+
+        try {
+            return DB::connection($mysql)->transaction(function () use ($mysql, $kodcaw, $id, $pcBy) {
+                $line = PembiayaanOnline::on($mysql)
+                    ->where('kodcaw', $kodcaw)
+                    ->where('id', $id)
+                    ->lockForUpdate()
+                    ->first();
+
+                if (!$line) {
+                    return [
+                        'ok' => false,
+                        'status' => 404,
+                        'payload' => ['message' => 'Pembiayaan online tidak dijumpai'],
+                    ];
+                }
+
+                if ($line->status === 'VERIFIED_PC') {
+                    return [
+                        'ok' => true,
+                        'status' => 200,
+                        'payload' => $line,
+                    ];
+                }
+
+                if (!in_array($line->status, self::PC_VERIFY_FROM_STATUSES, true)) {
+                    return [
+                        'ok' => false,
+                        'status' => 422,
+                        'payload' => [
+                            'message' => 'Hanya rekod PENDING_PC / REJECTED_PC boleh disemak',
+                            'status' => $line->status,
+                        ],
+                    ];
+                }
+
+                if (empty($line->kodbank) || empty($line->noakaun)) {
+                    return [
+                        'ok' => false,
+                        'status' => 422,
+                        'payload' => [
+                            'message' => 'Maklumat bank tidak lengkap. Kemaskini bank sebelum semak.',
+                            'id' => $line->id,
+                            'norujukan' => $line->norujukan,
+                        ],
+                    ];
+                }
+
+                PembiayaanOnline::on($mysql)->where('id', $line->id)->update([
+                    'status' => 'VERIFIED_PC',
+                    'pc_verified_by' => $pcBy,
+                    'pc_verified_at' => Carbon::now(),
+                ]);
+
+                return [
+                    'ok' => true,
+                    'status' => 200,
+                    'payload' => PembiayaanOnline::on($mysql)->where('id', $line->id)->first(),
+                ];
+            });
+        } catch (\Throwable $e) {
+            Log::error('PembiayaanOnline verifyLine failed: ' . $e->getMessage());
+            return [
+                'ok' => false,
+                'status' => 500,
+                'payload' => ['message' => 'Gagal semak pembiayaan online'],
+            ];
+        }
+    }
+
+    /**
+     * Undo PC verification so the line must be checked again.
+     *
+     * @return array{ok:bool,status:int,payload:mixed}
+     */
+    public function unverifyLine($kodcaw, $id)
+    {
+        $resolved = $this->resolveMysql($kodcaw);
+        if (!$resolved['ok']) {
+            return $resolved;
+        }
+        $mysql = $resolved['mysql'];
+
+        try {
+            return DB::connection($mysql)->transaction(function () use ($mysql, $kodcaw, $id) {
+                $line = PembiayaanOnline::on($mysql)
+                    ->where('kodcaw', $kodcaw)
+                    ->where('id', $id)
+                    ->lockForUpdate()
+                    ->first();
+
+                if (!$line) {
+                    return [
+                        'ok' => false,
+                        'status' => 404,
+                        'payload' => ['message' => 'Pembiayaan online tidak dijumpai'],
+                    ];
+                }
+
+                if ($line->status !== 'VERIFIED_PC') {
+                    return [
+                        'ok' => false,
+                        'status' => 422,
+                        'payload' => [
+                            'message' => 'Hanya rekod VERIFIED_PC boleh dibatalkan semakan',
+                            'status' => $line->status,
+                        ],
+                    ];
+                }
+
+                PembiayaanOnline::on($mysql)->where('id', $line->id)->update([
+                    'status' => !empty($line->reject_reason) ? 'REJECTED_PC' : 'PENDING_PC',
+                    'pc_verified_by' => null,
+                    'pc_verified_at' => null,
+                ]);
+
+                return [
+                    'ok' => true,
+                    'status' => 200,
+                    'payload' => PembiayaanOnline::on($mysql)->where('id', $line->id)->first(),
+                ];
+            });
+        } catch (\Throwable $e) {
+            Log::error('PembiayaanOnline unverifyLine failed: ' . $e->getMessage());
+            return [
+                'ok' => false,
+                'status' => 500,
+                'payload' => ['message' => 'Gagal batal semakan pembiayaan online'],
+            ];
+        }
+    }
+
     /**
      * @return array{ok:bool,status:int,payload:mixed}
      */
@@ -488,6 +707,26 @@ class PembiayaanOnlineService
             ->orderBy('id', 'asc')
             ->get();
 
+        // Fetch customer phone numbers in one query for the batch approval form.
+        $identityNumbers = $lines->pluck('nokp')->filter()->unique()->values()->all();
+        $phones = [];
+        if ($identityNumbers) {
+            $customers = Customer::on('mysql7')->select('kpbaru', 'kplama', 'telefon')
+                ->where(function ($query) use ($identityNumbers) {
+                    $query->whereIn('kpbaru', $identityNumbers)->orWhereIn('kplama', $identityNumbers);
+                })->get();
+            foreach ($customers as $customer) {
+                foreach ([$customer->kpbaru, $customer->kplama] as $identity) {
+                    if ($identity !== null && $identity !== '') {
+                        $phones[(string) $identity] = $customer->telefon;
+                    }
+                }
+            }
+        }
+        foreach ($lines as $line) {
+            $line->setAttribute('telefon', $phones[(string) $line->nokp] ?? null);
+        }
+
         return [
             'ok' => true,
             'status' => 200,
@@ -544,7 +783,7 @@ class PembiayaanOnlineService
         $tarikh = $now->toDateString();
 
         try {
-            return DB::connection($mysql)->transaction(function () use (
+            $result = DB::connection($mysql)->transaction(function () use (
                 $mysql,
                 $kodcaw,
                 $ids,
@@ -573,12 +812,12 @@ class PembiayaanOnlineService
                 }
 
                 foreach ($lines as $line) {
-                    if (!in_array($line->status, self::PC_QUEUE_STATUSES, true)) {
+                    if (!in_array($line->status, self::PC_SUBMITTABLE_STATUSES, true)) {
                         return [
                             'ok' => false,
                             'status' => 422,
                             'payload' => [
-                                'message' => 'Rekod bukan dalam queue PC',
+                                'message' => 'Rekod belum disemak PC. Sahkan satu-satu sebelum hantar ke Operasi.',
                                 'id' => $line->id,
                                 'norujukan' => $line->norujukan,
                                 'status' => $line->status,
@@ -652,6 +891,127 @@ class PembiayaanOnlineService
                 'payload' => ['message' => 'Gagal hantar batch pembiayaan online'],
             ];
         }
+
+        if (!empty($result['ok'])) {
+            $this->notifyOperasiBatchSubmitted($kodcaw, $ids, $pcBy, $result['payload']);
+        }
+
+        return $result;
+    }
+
+    /**
+     * Inbox for all operasi staff after PC submit. Failures must not block the batch.
+     *
+     * @param  string  $kodcaw
+     * @param  array  $ids
+     * @param  string  $pcBy
+     * @param  array  $payload
+     * @return void
+     */
+    protected function notifyOperasiBatchSubmitted($kodcaw, array $ids, $pcBy, array $payload)
+    {
+        $batch = isset($payload['batch']) ? $payload['batch'] : null;
+        if (!$batch) {
+            return;
+        }
+
+        $batchId = is_array($batch) ? ($batch['id'] ?? null) : $batch->id;
+        $batchNo = is_array($batch) ? ($batch['batch_no'] ?? '') : $batch->batch_no;
+        $slot = is_array($batch) ? ($batch['slot'] ?? '') : $batch->slot;
+        $bilangan = is_array($batch) ? ($batch['bilangan'] ?? 0) : $batch->bilangan;
+        $jumlah = is_array($batch) ? ($batch['jumlah_keseluruhan'] ?? 0) : $batch->jumlah_keseluruhan;
+
+        if (!$batchId) {
+            return;
+        }
+
+        try {
+            app(StaffNotificationClient::class)->notify([
+                'type' => 'pembiayaan_online.batch_operasi',
+                'cawangan' => $kodcaw,
+                'audience' => ['role' => 'operasi'],
+                'data' => [
+                    'batch_id' => $batchId,
+                    'batch_no' => $batchNo,
+                    'slot' => $slot,
+                    'appended' => !empty($payload['appended']),
+                    'submitted_count' => count($ids),
+                    'bilangan' => $bilangan,
+                    'jumlah_keseluruhan' => (float) $jumlah,
+                    'pc_submitted_by' => $pcBy,
+                    'cawangan_nama' => $this->cawanganNama($kodcaw),
+                ],
+            ]);
+        } catch (\Throwable $e) {
+            Log::warning('Operasi batch notification failed: '.$e->getMessage(), [
+                'kodcaw' => $kodcaw,
+                'batch_id' => $batchId,
+            ]);
+        }
+    }
+
+    /**
+     * @param  string  $kodcaw
+     * @return string
+     */
+    protected function cawanganNama($kodcaw)
+    {
+        $cawangan = Cawangan::on('mysql7')->where('kodcaw', '=', $kodcaw)->first();
+        if (!$cawangan) {
+            return $kodcaw;
+        }
+
+        $nama = trim((string) $cawangan->nama_cawangan);
+
+        return $nama !== '' ? $nama : $kodcaw;
+    }
+
+    /**
+     * Inbox for PC at this branch. Failures must not block the operasi action.
+     *
+     * @param  string  $kodcaw
+     * @param  string  $type
+     * @param  array  $data
+     * @return void
+     */
+    protected function notifyPcPembiayaanOnline($kodcaw, $type, array $data)
+    {
+        try {
+            app(StaffNotificationClient::class)->notify([
+                'type' => $type,
+                'cawangan' => $kodcaw,
+                'audience' => ['role' => 'pc'],
+                'data' => array_merge($data, [
+                    'cawangan_nama' => $this->cawanganNama($kodcaw),
+                ]),
+            ]);
+        } catch (\Throwable $e) {
+            Log::warning('PC pembiayaan-online notification failed: '.$e->getMessage(), [
+                'kodcaw' => $kodcaw,
+                'type' => $type,
+            ]);
+        }
+    }
+
+    /**
+     * @param  mixed  $line
+     * @return array
+     */
+    protected function lineNotifyFields($line)
+    {
+        if (!$line) {
+            return [];
+        }
+
+        $isArr = is_array($line);
+
+        return [
+            'norujukan' => $isArr ? ($line['norujukan'] ?? '') : $line->norujukan,
+            'nama_pelanggan' => $isArr ? ($line['nama_pelanggan'] ?? '') : $line->nama_pelanggan,
+            'pinjaman' => $isArr ? ($line['pinjaman'] ?? 0) : $line->pinjaman,
+            'ops_by' => $isArr ? ($line['ops_by'] ?? '') : $line->ops_by,
+            'reject_reason' => $isArr ? ($line['reject_reason'] ?? '') : $line->reject_reason,
+        ];
     }
 
     /**
@@ -826,7 +1186,7 @@ class PembiayaanOnlineService
         $now = Carbon::now();
 
         try {
-            return DB::connection($mysql)->transaction(function () use ($mysql, $kodcaw, $id, $opsBy, $reason, $now) {
+            $result = DB::connection($mysql)->transaction(function () use ($mysql, $kodcaw, $id, $opsBy, $reason, $now) {
                 $line = PembiayaanOnline::on($mysql)
                     ->where('kodcaw', $kodcaw)
                     ->where('id', $id)
@@ -869,6 +1229,8 @@ class PembiayaanOnlineService
                     'rejected_at' => $now,
                     'ops_by' => $opsBy,
                     'batch_id' => null,
+                    'pc_verified_by' => null,
+                    'pc_verified_at' => null,
                 ]);
 
                 $batch = null;
@@ -895,6 +1257,18 @@ class PembiayaanOnlineService
                 'payload' => ['message' => 'Gagal tolak pembiayaan online'],
             ];
         }
+
+        if (!empty($result['ok'])) {
+            $this->notifyPcPembiayaanOnline($kodcaw, 'pembiayaan_online.rejected_pc', array_merge(
+                $this->lineNotifyFields(isset($result['payload']['pembiayaan_online']) ? $result['payload']['pembiayaan_online'] : null),
+                [
+                    'ops_by' => $opsBy,
+                    'reject_reason' => $reason,
+                ]
+            ));
+        }
+
+        return $result;
     }
 
     /**
@@ -1015,7 +1389,7 @@ class PembiayaanOnlineService
         }
 
         try {
-            return DB::connection($mysql)->transaction(function () use (
+            $result = DB::connection($mysql)->transaction(function () use (
                 $mysql,
                 $kodcaw,
                 $id,
@@ -1114,6 +1488,18 @@ class PembiayaanOnlineService
                 'payload' => ['message' => 'Gagal tanda PAID / muat naik bukti'],
             ];
         }
+
+        if (!empty($result['ok'])) {
+            $this->notifyPcPembiayaanOnline($kodcaw, 'pembiayaan_online.paid_pc', array_merge(
+                $this->lineNotifyFields(isset($result['payload']['pembiayaan_online']) ? $result['payload']['pembiayaan_online'] : null),
+                [
+                    'paid_count' => 1,
+                    'ops_by' => $opsBy,
+                ]
+            ));
+        }
+
+        return $result;
     }
 
     /**
@@ -1159,7 +1545,7 @@ class PembiayaanOnlineService
         }
 
         try {
-            return DB::connection($mysql)->transaction(function () use (
+            $result = DB::connection($mysql)->transaction(function () use (
                 $mysql,
                 $kodcaw,
                 $batchId,
@@ -1251,6 +1637,19 @@ class PembiayaanOnlineService
                 'payload' => ['message' => 'Gagal tanda PAID batch'],
             ];
         }
+
+        if (!empty($result['ok'])) {
+            $batch = isset($result['payload']['batch']) ? $result['payload']['batch'] : null;
+            $this->notifyPcPembiayaanOnline($kodcaw, 'pembiayaan_online.paid_pc', [
+                'paid_count' => isset($result['payload']['dibayar']) ? (int) $result['payload']['dibayar'] : 0,
+                'batch_id' => $batch ? (is_array($batch) ? ($batch['id'] ?? null) : $batch->id) : $batchId,
+                'batch_no' => $batch ? (is_array($batch) ? ($batch['batch_no'] ?? '') : $batch->batch_no) : '',
+                'jumlah_keseluruhan' => $batch ? (is_array($batch) ? ($batch['jumlah_keseluruhan'] ?? 0) : $batch->jumlah_keseluruhan) : 0,
+                'ops_by' => $opsBy,
+            ]);
+        }
+
+        return $result;
     }
 
     /**
@@ -1314,6 +1713,124 @@ class PembiayaanOnlineService
         ];
     }
 
+    /**
+     * Get attached bank-account slip (bukti_akaun_file_id) for a line.
+     *
+     * @return array{ok:bool,status:int,payload:mixed}
+     */
+    public function getBuktiAkaun($kodcaw, $id)
+    {
+        $resolved = $this->resolveMysql($kodcaw);
+        if (!$resolved['ok']) {
+            return $resolved;
+        }
+
+        $line = PembiayaanOnline::on($resolved['mysql'])
+            ->where('kodcaw', $kodcaw)
+            ->where('id', $id)
+            ->first();
+
+        if (!$line) {
+            return [
+                'ok' => false,
+                'status' => 404,
+                'payload' => ['message' => 'Pembiayaan online tidak dijumpai'],
+            ];
+        }
+
+        if (empty($line->bukti_akaun_file_id)) {
+            return [
+                'ok' => false,
+                'status' => 404,
+                'payload' => ['message' => 'Slip bank belum dimuat naik'],
+            ];
+        }
+
+        $file = ARFiles::on('mysql7')->where('id', $line->bukti_akaun_file_id)->first();
+        if (!$file) {
+            return [
+                'ok' => false,
+                'status' => 404,
+                'payload' => ['message' => 'Fail slip bank tidak dijumpai'],
+            ];
+        }
+
+        return [
+            'ok' => true,
+            'status' => 200,
+            'payload' => [
+                'pembiayaan_online_id' => $line->id,
+                'norujukan' => $line->norujukan,
+                'file' => [
+                    'id' => $file->id,
+                    'filename' => $file->filename,
+                    'type' => $file->type,
+                    'tarikhmasa' => $file->tarikhmasa,
+                    'data' => $file->data,
+                ],
+            ],
+        ];
+    }
+
+    /**
+     * Get attached signed online-financing confirmation form (borang_file_id).
+     *
+     * @return array{ok:bool,status:int,payload:mixed}
+     */
+    public function getBorang($kodcaw, $id)
+    {
+        $resolved = $this->resolveMysql($kodcaw);
+        if (!$resolved['ok']) {
+            return $resolved;
+        }
+
+        $line = PembiayaanOnline::on($resolved['mysql'])
+            ->where('kodcaw', $kodcaw)
+            ->where('id', $id)
+            ->first();
+
+        if (!$line) {
+            return [
+                'ok' => false,
+                'status' => 404,
+                'payload' => ['message' => 'Pembiayaan online tidak dijumpai'],
+            ];
+        }
+
+        if (empty($line->borang_file_id)) {
+            return [
+                'ok' => false,
+                'status' => 404,
+                'payload' => ['message' => 'Borang pengesahan belum dimuat naik'],
+            ];
+        }
+
+        $file = ARFiles::on('mysql7')->where('id', $line->borang_file_id)->first();
+        if (!$file) {
+            return [
+                'ok' => false,
+                'status' => 404,
+                'payload' => ['message' => 'Fail borang pengesahan tidak dijumpai'],
+            ];
+        }
+
+        return [
+            'ok' => true,
+            'status' => 200,
+            'payload' => [
+                'pembiayaan_online_id' => $line->id,
+                'norujukan' => $line->norujukan,
+                'file' => [
+                    'id' => $file->id,
+                    'filename' => $file->filename,
+                    'type' => $file->type,
+                    'tarikhmasa' => $file->tarikhmasa,
+                    'data' => $file->data,
+                ],
+            ],
+        ];
+    }
+
     /**
      * PC list of PAID lines awaiting blast / tally.
      *
@@ -1349,8 +1866,8 @@ class PembiayaanOnlineService
     }
 
     /**
-     * PC marks PAID line(s) as tallied / blast done (blast_sent=1).
-     * Actual WhatsApp/SMS dispatch can be wired later.
+     * PC marks PAID line(s) as tallied / blast done (blast_sent=1),
+     * then queues WhatsApp Cloud template to each customer (or ADMIN_PHONE_NUMBER off-prod).
      *
      * @param array|int|string $ids
      * @return array{ok:bool,status:int,payload:mixed}
@@ -1379,7 +1896,7 @@ class PembiayaanOnlineService
         $updated = 0;
 
         try {
-            return DB::connection($mysql)->transaction(function () use ($mysql, $kodcaw, $ids, $blastBy, $now, &$updated) {
+            $result = DB::connection($mysql)->transaction(function () use ($mysql, $kodcaw, $ids, $blastBy, $now, &$updated) {
                 $lines = PembiayaanOnline::on($mysql)
                     ->where('kodcaw', $kodcaw)
                     ->whereIn('id', $ids)
@@ -1433,6 +1950,50 @@ class PembiayaanOnlineService
                 'payload' => ['message' => 'Gagal tanda blast/tally'],
             ];
         }
+
+        if (!empty($result['ok'])) {
+            $this->queuePaidWhatsapp($kodcaw, $result['payload']['data'] ?? []);
+        }
+
+        return $result;
+    }
+
+    /**
+     * Dispatch Cloud API jobs after tally commit. Failures are logged; tally stays PAID/blast_sent.
+     *
+     * @param \Illuminate\Support\Collection|array $lines
+     */
+    protected function queuePaidWhatsapp($kodcaw, $lines)
+    {
+        $client = new WhatsappCloudClient();
+        if (!$client->isConfigured()) {
+            Log::info('WhatsApp Cloud not configured; tally saved without send', ['kodcaw' => $kodcaw]);
+            return;
+        }
+
+        $cawangan = Cawangan::on('mysql7')->where('kodcaw', $kodcaw)->first();
+        $cawName = $cawangan ? $cawangan->nama_cawangan : $kodcaw;
+
+        foreach ($lines as $line) {
+            try {
+                dispatch(new WhatsappPembiayaanOnlinePaid([
+                    'kodcaw' => $kodcaw,
+                    'caw_name' => $cawName,
+                    'nokp' => $line->nokp ?? null,
+                    'norujukan' => $line->norujukan ?? null,
+                    'pinjaman' => $line->pinjaman ?? null,
+                    'nama_bank' => $line->nama_bank ?? null,
+                    'noakaun' => $line->noakaun ?? null,
+                    'tarikh_bayaran' => $line->tarikh_bayaran ?? null,
+                    'no_rujukan_bayaran' => $line->no_rujukan_bayaran ?? null,
+                ]));
+            } catch (\Throwable $e) {
+                Log::error('queuePaidWhatsapp dispatch failed: ' . $e->getMessage(), [
+                    'kodcaw' => $kodcaw,
+                    'id' => $line->id ?? null,
+                ]);
+            }
+        }
     }
 
     /**
@@ -1509,40 +2070,88 @@ class PembiayaanOnlineService
         return BatchPembiayaanOnline::on($mysql)->where('id', $batchId)->first();
     }
 
-    public function suggestSlot()
+    public function slotJadual()
     {
-        $now = Carbon::now();
-        $mins = ((int) $now->format('G')) * 60 + (int) $now->format('i');
-
-        if ($mins < 11 * 60) {
-            return [
+        return [
+            [
                 'slot' => 'BATCH1',
+                'label' => 'Batch 1',
+                'mula' => '00:00',
                 'cutoff' => '11:00',
                 'proses' => '12:30',
-                'lewat' => false,
-                'nota' => 'Dalam waktu Batch 1',
-            ];
-        }
-
-        if ($mins < 15 * 60) {
-            return [
+            ],
+            [
                 'slot' => 'BATCH2',
+                'label' => 'Batch 2',
+                'mula' => '11:00',
                 'cutoff' => '15:00',
                 'proses' => '16:30',
-                'lewat' => false,
-                'nota' => 'Dalam waktu Batch 2',
-            ];
+            ],
+        ];
+    }
+
+    public function suggestSlot()
+    {
+        $now = Carbon::now('Asia/Kuala_Lumpur');
+        $mins = ((int) $now->format('G')) * 60 + (int) $now->format('i');
+        $jadual = $this->slotJadual();
+        $batch1 = $jadual[0];
+        $batch2 = $jadual[1];
+        $cutoff1 = $this->hmToMinutes($batch1['cutoff']);
+        $cutoff2 = $this->hmToMinutes($batch2['cutoff']);
+
+        if ($mins < $cutoff1) {
+            return $this->slotPayload($batch1, false, $cutoff1 - $mins, 'Dalam waktu Batch 1', $now, $jadual);
         }
 
+        if ($mins < $cutoff2) {
+            return $this->slotPayload($batch2, false, $cutoff2 - $mins, 'Dalam waktu Batch 2', $now, $jadual);
+        }
+
+        $lewat = $this->slotPayload(
+            $batch2,
+            true,
+            0,
+            'Selepas cutoff Batch 2 — masih boleh hantar; Operasi mungkin proses esok',
+            $now,
+            $jadual
+        );
+        $lewat['proses'] = $batch2['proses'] . ' (hari berikutnya jika sudah lewat)';
+
+        return $lewat;
+    }
+
+    protected function slotPayload(array $batch, $lewat, $bakiMinit, $nota, Carbon $now, array $jadual)
+    {
+        $parts = explode(':', (string) $batch['cutoff']);
+        $cutoffAt = $now->copy()->setTime(
+            isset($parts[0]) ? (int) $parts[0] : 0,
+            isset($parts[1]) ? (int) $parts[1] : 0,
+            0
+        );
+
         return [
-            'slot' => 'BATCH2',
-            'cutoff' => '15:00',
-            'proses' => '16:30 (hari berikutnya jika sudah lewat)',
-            'lewat' => true,
-            'nota' => 'Selepas cutoff Batch 2 — masih boleh hantar; Operasi mungkin proses esok',
+            'slot' => $batch['slot'],
+            'cutoff' => $batch['cutoff'],
+            'cutoff_at' => $cutoffAt->toIso8601String(),
+            'server_now' => $now->toIso8601String(),
+            'proses' => $batch['proses'],
+            'lewat' => (bool) $lewat,
+            'baki_minit' => (int) $bakiMinit,
+            'nota' => $nota,
+            'jadual' => $jadual,
         ];
     }
 
+    protected function hmToMinutes($hm)
+    {
+        $parts = explode(':', (string) $hm);
+        $h = isset($parts[0]) ? (int) $parts[0] : 0;
+        $m = isset($parts[1]) ? (int) $parts[1] : 0;
+
+        return ($h * 60) + $m;
+    }
+
     /**
      * One batch per branch / day / slot (B1-001 or B2-001). Later submits append.
      *

app/Services/ShorakaGadaiService.php

@@ -0,0 +1,77 @@
+<?php
+
+namespace App\Services;
+
+use App\Cawangan;
+use App\Customer;
+use App\Gadai;
+use App\ShorakaTransaction;
+use Illuminate\Validation\ValidationException;
+
+class ShorakaGadaiService
+{
+    public function gadai(string $kodcaw, string $norujukan): Gadai
+    {
+        $branch = Cawangan::on('mysql7')->where('kodcaw', $kodcaw)->firstOrFail();
+        return Gadai::on($branch->mysql)->where('kodcaw', $kodcaw)->where('norujukan', $norujukan)->first()
+            ?? abort(404, 'Maklumat gadaian tidak tersedia. Semakan diperlukan.');
+    }
+
+    public function payload(Gadai $gadai): array
+    {
+        $customer = Customer::on('mysql7')->where(function ($query) use ($gadai) {
+            $query->where('kpbaru', $gadai->nokp)->orWhere('kplama', $gadai->nokp);
+        })->firstOrFail();
+        if (!$customer->nama || $gadai->pinjaman <= 0 || $gadai->hargajualan < $gadai->pinjaman) {
+            throw ValidationException::withMessages([
+                'norujukan' => 'Nama pelanggan, pembiayaan dan harga jualan mesti lengkap.',
+            ]);
+        }
+
+        return [
+            'norujukan' => $gadai->norujukan,
+            'ownership' => $customer->nama,
+            'order_amount' => $gadai->pinjaman,
+            'murabaha_amount' => $gadai->hargajualan,
+            // Both GadaiV1 and GadaiV2 price the contract using upah12.
+            // "tempoh" is elapsed charge time, NOT the contractual tenor.
+            'tenor_other' => 12,
+        ];
+    }
+
+    public function transaction(string $kodcaw, string $norujukan)
+    {
+        $order = ShorakaTransaction::where('norujukan', $norujukan)->first();
+        if ($order && (string) $order->kodcaw !== $kodcaw) {
+            abort(409, 'Rekod Shoraka tidak dipadankan dengan cawangan ini.');
+        }
+        return $order;
+    }
+
+    public function sync(ShorakaTransaction $order): void
+    {
+        if (!$order->kodcaw) {
+            return;
+        }
+        $gadai = $this->gadai($order->kodcaw, $order->norujukan);
+        if (!$gadai->exists) {
+            return;
+        }
+        $sameAmounts = number_format((float) $gadai->pinjaman, 2, '.', '') === $order->order_amount
+            && number_format((float) $gadai->hargajualan, 2, '.', '') === $order->murabaha_amount;
+        $gadai->getConnection()->table('gadai')->where('norujukan', $order->norujukan)->update([
+            'tagkomuditi' => $order->status === 'Completed' && $sameAmounts ? 1 : 0,
+        ]);
+    }
+
+    public function assertCompleted(string $kodcaw, string $norujukan): void
+    {
+        $gadai = $this->gadai($kodcaw, $norujukan);
+        $order = $this->transaction($kodcaw, $norujukan);
+        if (!$gadai->exists || !$order || $order->status !== 'Completed'
+            || number_format((float) $gadai->pinjaman, 2, '.', '') !== $order->order_amount
+            || number_format((float) $gadai->hargajualan, 2, '.', '') !== $order->murabaha_amount) {
+            abort(409, 'Pembiayaan dan SAG ditahan sehingga transaksi Shoraka selesai dan amaun sepadan.');
+        }
+    }
+}

app/Services/ShorakaService.php

@@ -0,0 +1,220 @@
+<?php
+
+namespace App\Services;
+
+use Illuminate\Http\Client\Response;
+use Illuminate\Support\Facades\Http;
+use RuntimeException;
+
+class ShorakaService
+{
+    const STATUSES = ['Active', 'Completed', 'Cancelled', 'Pending Sell', 'Take Delivery'];
+
+    const CALLBACK_FIELDS = [
+        'orderId', 'status', 'bankName', 'ownershipName', 'commodityType',
+        'unit', 'volume', 'productType', 'valueDate', 'cancelDate', 'orderType',
+        'orderCurrency', 'orderAmount', 'murabahaAmount', 'tenor',
+        'tenorOther', 'tenorOtherUnit',
+    ];
+
+    protected $baseUrl;
+    protected $apiId;
+    protected $secretKey;
+    protected $timeout;
+
+    public function __construct()
+    {
+        $this->baseUrl = rtrim((string) config('services.shoraka.base_url'), '/');
+        $this->apiId = (string) config('services.shoraka.api_id');
+        $this->secretKey = (string) config('services.shoraka.secret_key');
+        $this->timeout = (int) config('services.shoraka.timeout', 60);
+    }
+
+    public function configured(): bool
+    {
+        if ($this->simulationRequested()) {
+            return $this->simulationAllowed() && in_array($this->simulationMode(), ['failed', 'pending'], true);
+        }
+        return $this->apiId !== '' && $this->secretKey !== '';
+    }
+
+    protected function simulationAllowed(): bool
+    {
+        return app()->environment('local', 'testing');
+    }
+
+    protected function simulationMode(): string
+    {
+        return strtolower(trim((string) config('services.shoraka.simulation', 'off')));
+    }
+
+    protected function simulationRequested(): bool
+    {
+        return !in_array($this->simulationMode(), ['', 'off'], true);
+    }
+
+    private function simulatedResponse(string $orderId): array
+    {
+        if (!$this->simulationAllowed()) {
+            throw new RuntimeException('Shoraka simulation is restricted to local/testing.');
+        }
+        if (strpos($orderId, 'SIM-FAILED-') === 0) {
+            return ['orderId' => $orderId, 'status' => 'Cancelled'];
+        }
+        if (strpos($orderId, 'SIM-PENDING-') === 0) {
+            return ['orderId' => $orderId, 'status' => 'Active'];
+        }
+        throw new RuntimeException('Invalid simulation order ID.');
+    }
+
+    public function submitOrder(array $data): array
+    {
+        if ($this->simulationRequested()) {
+            if (!$this->simulationAllowed() || !in_array($this->simulationMode(), ['failed', 'pending'], true)) {
+                throw new RuntimeException('Shoraka simulation configuration is not allowed.');
+            }
+            return $this->simulatedResponse('SIM-' . strtoupper($this->simulationMode()) . '-' . bin2hex(random_bytes(12)));
+        }
+
+        $payload = ['api_id' => $this->apiId];
+        foreach ([
+            'product_type', 'commodity_type', 'ownership', 'value_date',
+            'order_currency', 'order_amount', 'murabaha_amount', 'tenor',
+            'tenor_other', 'tenor_other_unit', 'order_type', 'ownership_doc_no',
+        ] as $field) {
+            $payload[$field] = $data[$field] ?? '';
+        }
+        foreach (['order_amount', 'murabaha_amount'] as $field) {
+            $payload[$field] = number_format((float) $payload[$field], 2, '.', '');
+        }
+
+        // ownership_doc_no is deliberately excluded by the v1.5 signature contract.
+        $signed = $payload;
+        unset($signed['api_id'], $signed['ownership_doc_no']);
+        $payload['signature'] = $this->signature(array_values($signed));
+
+        return $this->orderResponse($this->request()->post(
+            $this->baseUrl . '/api/submitorder', $payload
+        ));
+    }
+
+    public function orderStatus(string $orderId): array
+    {
+        if (strpos($orderId, 'SIM-') === 0) {
+            return $this->simulatedResponse($orderId); // Never send simulated references to the real provider.
+        }
+        if ($this->simulationRequested()) {
+            throw new RuntimeException('Real order status is unavailable while simulation is enabled.');
+        }
+
+        return $this->orderResponse($this->request()->post(
+            $this->baseUrl . '/api/orderstatus', $this->orderPayload($orderId)
+        ), $orderId);
+    }
+
+    public function certificate(string $orderId): string
+    {
+        if ($this->simulationRequested() || strpos($orderId, 'SIM-') === 0) {
+            throw new RuntimeException('Certificates are unavailable for simulation.');
+        }
+
+        // Section 5 specifies POST, despite GET in the document history.
+        $response = $this->request()->accept('application/pdf')->post(
+            $this->baseUrl . '/api/certificate', $this->orderPayload($orderId)
+        );
+        $this->checkResponse($response);
+        $type = strtolower(trim(explode(';', $response->header('Content-Type'))[0]));
+        if ($type !== 'application/pdf' || substr($response->body(), 0, 5) !== '%PDF-') {
+            throw new RuntimeException('Shoraka returned an invalid PDF certificate.');
+        }
+
+        return $response->body();
+    }
+
+    public function validCallback(array $payload): bool
+    {
+        if ($this->simulationRequested() || strpos((string) ($payload['orderId'] ?? ''), 'SIM-') === 0) {
+            return false;
+        }
+
+        if (!$this->configured()
+            || !isset($payload['apiId'], $payload['signature'])
+            || !is_string($payload['apiId'])
+            || !hash_equals($this->apiId, $payload['apiId'])
+            || !is_string($payload['signature'])
+            || !preg_match('/\A[0-9a-fA-F]{64}\z/', $payload['signature'])) {
+            return false;
+        }
+
+        $values = [];
+        foreach (self::CALLBACK_FIELDS as $field) {
+            // Preserve the original strings: decimal formatting affects the hash.
+            if (!array_key_exists($field, $payload) || !is_string($payload[$field])) {
+                return false;
+            }
+            $values[] = $payload[$field];
+        }
+
+        return $payload['orderId'] !== ''
+            && in_array($payload['status'], self::STATUSES, true)
+            && hash_equals($this->signature($values), strtolower($payload['signature']));
+    }
+
+    protected function signature(array $values): string
+    {
+        return hash('sha256', implode(';', array_merge(
+            [$this->secretKey, $this->apiId], $values
+        )));
+    }
+
+    protected function orderPayload(string $orderId): array
+    {
+        if ($orderId === '') {
+            throw new RuntimeException('Shoraka order ID is required.');
+        }
+
+        return [
+            'api_id' => $this->apiId,
+            'order_id' => $orderId,
+            'signature' => $this->signature([$orderId]),
+        ];
+    }
+
+    protected function request()
+    {
+        if (!$this->configured()) {
+            throw new RuntimeException('Shoraka credentials are not configured.');
+        }
+
+        // Never forward signed requests through redirects or retry a trade automatically.
+        return Http::asForm()->acceptJson()->timeout($this->timeout)
+            ->withOptions(['allow_redirects' => false]);
+    }
+
+    protected function checkResponse(Response $response): void
+    {
+        if (!$response->successful()) {
+            // Do not expose upstream bodies which may contain credentials or customer data.
+            throw new RuntimeException('Shoraka request failed. HTTP ' . $response->status());
+        }
+    }
+
+    protected function orderResponse(Response $response, string $expectedId = null): array
+    {
+        $this->checkResponse($response);
+        $data = $response->json();
+        if (!is_array($data)
+            || !isset($data['orderId'], $data['status'])
+            || !(is_string($data['orderId']) || is_int($data['orderId']))
+            || (string) $data['orderId'] === ''
+            || !in_array($data['status'], self::STATUSES, true)
+            || ($expectedId !== null && (string) $data['orderId'] !== $expectedId)) {
+            throw new RuntimeException('Shoraka returned an invalid order response.');
+        }
+        if (isset($data['certificateUrl']) && !is_string($data['certificateUrl'])) {
+            throw new RuntimeException('Shoraka returned an invalid certificate URL.');
+        }
+
+        return $data;
+    }
+}

app/Services/StaffNotificationClient.php

@@ -0,0 +1,53 @@
+<?php
+
+namespace App\Services;
+
+use Illuminate\Support\Facades\Http;
+use Illuminate\Support\Facades\Log;
+
+class StaffNotificationClient
+{
+    /**
+     * Ask kaunter to persist a staff inbox row. Never throws.
+     *
+     * @param  array  $payload
+     * @return void
+     */
+    public function notify(array $payload)
+    {
+        $base = rtrim((string) config('kaunter.url'), '/');
+        $secret = (string) config('kaunter.notification_secret');
+
+        if ($base === '' || $secret === '') {
+            Log::info('Staff notification skipped: KAUNTER_URL or INTERNAL_NOTIFICATION_SECRET is empty');
+            return;
+        }
+
+        $timeout = (int) config('kaunter.notification_timeout', 3);
+        if ($timeout < 1) {
+            $timeout = 3;
+        }
+
+        try {
+            $response = Http::timeout($timeout)
+                ->withHeaders([
+                    'X-Internal-Token' => $secret,
+                    'Accept' => 'application/json',
+                ])
+                ->asJson()
+                ->post($base . '/internal/notifications', $payload);
+
+            if (!$response->successful()) {
+                Log::warning('Staff notification to kaunter failed', [
+                    'status' => $response->status(),
+                    'body' => $response->body(),
+                    'type' => isset($payload['type']) ? $payload['type'] : null,
+                ]);
+            }
+        } catch (\Throwable $e) {
+            Log::warning('Staff notification to kaunter errored: '.$e->getMessage(), [
+                'type' => isset($payload['type']) ? $payload['type'] : null,
+            ]);
+        }
+    }
+}

app/Services/Whatsapp/WhatsappCloudClient.php

@@ -0,0 +1,100 @@
+<?php
+
+namespace App\Services\Whatsapp;
+
+use Illuminate\Support\Facades\Http;
+use Illuminate\Support\Facades\Log;
+
+class WhatsappCloudClient
+{
+    public function isConfigured()
+    {
+        return trim((string) config('whatsapp.token')) !== ''
+            && trim((string) config('whatsapp.phone_number_id')) !== '';
+    }
+
+    /**
+     * Malaysia MSISDN for Graph API, e.g. 60193450165.
+     *
+     * @return string|null
+     */
+    public function normalizeMsisdn($raw)
+    {
+        $digits = preg_replace('/\D+/', '', (string) $raw);
+        if ($digits === '') {
+            return null;
+        }
+
+        if (strpos($digits, '60') === 0) {
+            return $digits;
+        }
+
+        if (strpos($digits, '0') === 0) {
+            return '60' . substr($digits, 1);
+        }
+
+        return '60' . $digits;
+    }
+
+    /**
+     * @param string $to
+     * @param string $templateName
+     * @param string $lang
+     * @param array<int,string> $bodyParams
+     * @return \Illuminate\Http\Client\Response
+     */
+    public function sendTemplate($to, $templateName, $lang, array $bodyParams = [])
+    {
+        $payload = [
+            'messaging_product' => 'whatsapp',
+            'to' => $to,
+            'type' => 'template',
+            'template' => [
+                'name' => $templateName,
+                'language' => ['code' => $lang],
+            ],
+        ];
+
+        if (count($bodyParams) > 0) {
+            $payload['template']['components'] = [[
+                'type' => 'body',
+                'parameters' => array_map(function ($text) {
+                    return [
+                        'type' => 'text',
+                        'text' => $this->sanitizeParam($text),
+                    ];
+                }, array_values($bodyParams)),
+            ]];
+        }
+
+        $version = config('whatsapp.api_version', 'v25.0');
+        $phoneId = config('whatsapp.phone_number_id');
+        $url = 'https://graph.facebook.com/' . $version . '/' . $phoneId . '/messages';
+
+        $response = Http::withToken(config('whatsapp.token'))
+            ->acceptJson()
+            ->asJson()
+            ->post($url, $payload);
+
+        if (!$response->successful()) {
+            Log::error('WhatsApp Cloud send failed', [
+                'to' => $to,
+                'template' => $templateName,
+                'status' => $response->status(),
+                'body' => $response->json() ?: $response->body(),
+            ]);
+        }
+
+        return $response;
+    }
+
+    protected function sanitizeParam($text)
+    {
+        $text = trim(preg_replace('/\s+/', ' ', (string) $text));
+        if ($text === '') {
+            return '-';
+        }
+
+        return mb_substr($text, 0, 200);
+    }
+}

app/ShorakaTransaction.php

@@ -0,0 +1,41 @@
+<?php
+
+namespace App;
+
+use Illuminate\Database\Eloquent\Model;
+
+class ShorakaTransaction extends Model
+{
+    protected $fillable = [
+        'norujukan',
+        'kodcaw',
+        'teller',
+        'order_id',
+        'status',
+        'product_type',
+        'commodity_type',
+        'ownership_name',
+        'ownership_doc_no',
+        'order_amount',
+        'murabaha_amount',
+        'certificate_url',
+        'certificate_path',
+        'request_payload',
+        'response_payload',
+        'callback_payload',
+        'attempt_count',
+        'error_message',
+        'submitted_at',
+        'completed_at',
+    ];
+
+    protected $casts = [
+        'order_amount' => 'decimal:2',
+        'murabaha_amount' => 'decimal:2',
+        'request_payload' => 'array',
+        'response_payload' => 'array',
+        'callback_payload' => 'array',
+        'submitted_at' => 'datetime',
+        'completed_at' => 'datetime',
+    ];
+}

app/Support/v1/GadaiV1.php

@@ -88,9 +88,7 @@ class GadaiV1
 
         $hargajualan = $request->pinjaman + $upah12;
 
-        $gadai = Gadai::on($cawangan['mysql'])
-            ->where('norujukan','=',$norujukan)
-            ->update(array(
+        $gadaiFields = array(
                 'nilaimarhun' => $total_nilai_marhun,
                 'berat'=> $total_berat,
                 'pinjaman' => $request->pinjaman,
@@ -115,7 +113,8 @@ class GadaiV1
                 'upahdibayar' => 0.00,
                 'tempohbayar' => 0.00,
                 'lelong_tawarruq' => 1
-            ));
+            );
+        $gadai = Gadai::on($cawangan['mysql'])->where('norujukan', $norujukan)->update($gadaiFields);
 
         $new_data = Gadai::on($cawangan['mysql'])->where('norujukan','=',$norujukan)->first();
 

app/Support/v1/Penebusan.php

@@ -11,8 +11,6 @@ use Carbon\Carbon;
 use App\Gadai;
 use App\HargaEmas;
 use App\InOutMar;
-use App\KomuditiPurchase;
-use App\KomuditiTransaksi;
 use App\Marhun;
 use App\Moratorium;
 use App\Palsu;
@@ -809,19 +807,18 @@ class Penebusan
         $array_tebus = $request->only(['jeniskeuntungan', 'nopelanggan','jenistebus','addpinjaman','nowakil','marhun','teller','bakipinjaman','bakiupah']);
         $array_trans = $request->only(['nopelanggan', 'noic','jenisAT','pinjaman','pinjamanbaru','marhun','teller','jenistebus']);
         $array_tebus_base = $request->only(['totalbayaran', 'bakiupah','jeniskeuntungan','bakipinjaman','jenistebus','teller','nowakil','duitpelanggan']);
-        $array_trans_base = $request->only(['pinjaman','teller','pinjamanbaru']);
 
         try{
             DB::connection($cawangan['mysql'])->beginTransaction();
             $this->saveTebus($kodcaw,$norujukan,$gadai,$cawangan,$array_tebus);
-            $this->createTransaction($cawangan,$kodcaw,$norujukan,$array_trans);
+            $newReference = $this->createTransaction($cawangan,$kodcaw,$norujukan,$array_trans);
 
             DB::connection('mysql7')->beginTransaction();
             $this->saveTebusBase($kodcaw,$norujukan,$gadai,$array_tebus_base);
-            $this->createTransactionBase($norujukan,$kodcaw,$array_trans_base);
             $array_response = [
                 'result' => 'success',
-                'data' => 1
+                'data' => 1,
+                'norujukan_baru' => $newReference
             ];
 
             DB::connection($cawangan['mysql'])->commit();
@@ -949,7 +946,7 @@ class Penebusan
         $gadaiTransaction = Gadai::on($cawangan['mysql'])->where('t_gadai','=',$current->toDateString())->orderBy('sirig', 'desc')->first();
         $gadaiTransaction = optional($gadaiTransaction)->toArray();
 
-        $new_sirig = ($gadaiTransaction) ? $gadaiTransaction['sirig'] + 1 : 1;
+        $new_sirig = (int) ($gadaiTransaction['sirig'] ?? 0) + 1;
         $curent_year = substr($current->year,2,2);
         $curent_month = sprintf("%02d", $current->month);
         $current_day = sprintf("%02d", $current->day);
@@ -1077,37 +1074,11 @@ class Penebusan
                 't_update' => $current->toDateString(),
             ));
 
+            return $new_sag_number;
         }catch(\Exception $e){
             throw new \Exception("Error in Transaction: " . $e->getMessage());
         }
 
     }
 
-    private function createTransactionBase($norujukan,$kodcaw,$array_trans_base){
-        $current = Carbon::now();
-
-        $komuditi_current = KomuditiPurchase::on('mysql7')->where('date_purchase','=',$current->toDateString())->orderBy('created_at','desc')->first();
-
-        $unit_current = isset($komuditi_current['unit_komuditi']) ? $komuditi_current['unit_komuditi']: 0;
-
-        try{
-            $update_unit = $unit_current - $array_trans_base['pinjamanbaru'];
-
-            KomuditiPurchase::on('mysql7')->where('id','=',$komuditi_current['id'])->update([
-                'unit_komuditi' => $update_unit
-            ]);
-
-            KomuditiTransaksi::on('mysql7')->create([
-                'unit_komuditi' => $update_unit,
-                'nosijil'=>$komuditi_current['no_sijil'],
-                'norujukan' => $norujukan,
-                'kodcaw' => $kodcaw,
-                'teller' => $array_trans_base['teller'],
-                'masa' => $current->toTimeString(),
-                'tarikh' => $current->toDateString()
-            ]);
-        }catch(\Exception $e){
-            throw new \Exception("Error in TransactionBase: " . $e->getMessage());
-        }
-    }
-}
+}

app/Support/v2/Calculation.php

@@ -2,8 +2,11 @@
 
 namespace App\Support\v2;
 
+use App\Feature;
+use App\KadarRebet;
 use App\KadarUpah;
 use Illuminate\Http\Request;
+use Illuminate\Support\Facades\Schema;
 
 class Calculation
 {
@@ -55,7 +58,7 @@ class Calculation
         return $ujrah_sebenar;
     }
 
-    public function kiraanKeuntunganRebet(float $pembiayaan = 0.0,float $nilaimarhun = 0.0,float $kadarujrah = 0.0,float $margin = 0.0){
+    public function kiraanKeuntunganRebet(float $pembiayaan = 0.0,float $nilaimarhun = 0.0,float $kadarujrah = 0.0,float $margin = 0.0, $kodcaw = null){
 
         $this->one_percent = $this->getKadarUpah($nilaimarhun);
 
@@ -66,8 +69,59 @@ class Calculation
         $ujrah_sebenar = (!empty($ujrah_sebenar)) ? $this->getRoundedMethod($ujrah_sebenar) : 0;
 
         $keuntungan = $onepercent + $ujrah_sebenar;
+        $annur = $this->kiraanDiskaunAnnur($kodcaw, $pembiayaan, $keuntungan);
 
-        return ['keuntungan' => $keuntungan,'onepercent' => $onepercent, 'ujrah' => $ujrah_sebenar];
+        return [
+            'keuntungan' => $keuntungan,
+            'onepercent' => $onepercent,
+            'ujrah' => $ujrah_sebenar,
+            'diskaun' => $annur['diskaun'],
+            'kadarrebet' => $annur['kadarrebet'],
+        ];
+    }
+
+    /**
+     * Annur promotional discount. Other cawangan get 0 unless rebet_annur is enabled.
+     */
+    public function kiraanDiskaunAnnur($kodcaw, float $pembiayaan = 0.0, float $keuntungan = 0.0)
+    {
+        $empty = ['kadarrebet' => 0, 'diskaun' => 0];
+
+        try {
+            if (!$kodcaw || !Feature::enabled($kodcaw, Feature::REBET_ANNUR)) {
+                return $empty;
+            }
+        } catch (\Exception $e) {
+            return $empty;
+        }
+
+        $percent = $this->kiraanRebetAnnur($pembiayaan);
+        if ($percent <= 0 || $keuntungan <= 0) {
+            return ['kadarrebet' => $percent, 'diskaun' => 0];
+        }
+
+        return [
+            'kadarrebet' => $percent,
+            'diskaun' => $this->getRoundedMethod($keuntungan * ($percent / 100)),
+        ];
+    }
+
+    private function kiraanRebetAnnur(float $pembiayaan = 0.0)
+    {
+        try {
+            if (!Schema::connection('mysql7')->hasTable('kadar_rebet')) {
+                return 0;
+            }
+
+            $kadarrebet = KadarRebet::on('mysql7')
+                ->where('pembiayaan_min', '<=', $pembiayaan)
+                ->where('pembiayaan_max', '>=', $pembiayaan)
+                ->sum('kadarrebet');
+
+            return (float) $kadarrebet;
+        } catch (\Exception $e) {
+            return 0;
+        }
     }
 
     public function kiraanKeuntunganSebenar(float $pembiayaan = 0.0,float $nilaimarhun = 0.0,float $kadarujrah = 0.0,float $margin = 0.0){

app/Support/v2/GadaiV2.php

@@ -5,6 +5,7 @@ namespace App\Support\v2;
 use App\Audit;
 use App\Cawangan;
 use App\Customer;
+use App\Feature;
 use App\KadarUpah;
 use App\Support\v2\Calculation;
 use Carbon\Carbon;
@@ -137,14 +138,13 @@ if (is_null($kadar_raw)) {
             $upah12 = $onepercentservices->getRoundedMethod($upah1 * 12);
             $ujrah = $onepercentservices->getRoundedMethod($keuntungan['ujrah']);
             $onepercent = $onepercentservices->getRoundedMethod($keuntungan['onepercent']);
+            $annur = $onepercentservices->kiraanDiskaunAnnur($request->kodcaw, $request->pinjaman, $keuntungan['keuntungan']);
 
             $hargajualan = $request->pinjaman + $upah12;
 
             $akrual = $this->kiraupahTawarruqStokAuditUjrahOnePercent(0.5,0,$kadar_raw,$request->pinjaman,$total_nilai_marhun,$margin_pinjam);
 
-            $gadai = Gadai::on($cawangan['mysql'])
-                ->where('norujukan','=',$norujukan)
-                ->update(array(
+            $gadaiFields = [
                     'nilaimarhun' => $total_nilai_marhun,
                     'berat'=> $total_berat,
                     'pinjaman' => $request->pinjaman,
@@ -176,7 +176,23 @@ if (is_null($kadar_raw)) {
                     'tagbaru' => 1,
                     'tunggakanujrah' => $akrual['ujrah'],
                     'tunggakanonepercent' => $akrual['keuntungan'],
-                ));
+                ];
+            if (Feature::enabled($request->kodcaw, Feature::REBET_ANNUR)) {
+                $requestedKadar = (float) $request->input('kadar_rebate', 0);
+                $requestedDiskaun = (float) $request->input('rebate', 0);
+
+                if ($requestedKadar > 0 || $requestedDiskaun > 0) {
+                    $gadaiFields['kadarrebet'] = $requestedKadar;
+                    $gadaiFields['diskaun'] = $requestedDiskaun;
+                } elseif (($request->transaction ?? '') === 'Daftar Gadai') {
+                    $gadaiFields['kadarrebet'] = $annur['kadarrebet'];
+                    $gadaiFields['diskaun'] = $annur['diskaun'];
+                }
+            }
+
+            $gadai = Gadai::on($cawangan['mysql'])
+                ->where('norujukan','=',$norujukan)
+                ->update($gadaiFields);
 
             $new_data = Gadai::on($cawangan['mysql'])->where('norujukan','=',$norujukan)->first();
 
@@ -240,14 +256,15 @@ if (is_null($kadar_raw)) {
         }
         $bilang_bln = $tempoh - $gadai_data['tempohbayar'];
 
-        $upah = $onepercentservices->kiraanKeuntunganRebet($gadai_data['bakipjm'],$gadai_data['nilaimarhun'],$gadai_data['kadarupah'],$gadai_data['margin_semasa']);
+        $upah = $onepercentservices->kiraanKeuntunganRebet($gadai_data['bakipjm'],$gadai_data['nilaimarhun'],$gadai_data['kadarupah'],$gadai_data['margin_semasa'], $this->kodcaw);
 
         //$upahrebet_raw = $bilang_bln * $upah['keuntungan'];
         $onepercent = $onepercentservices->getRoundedMethod($bilang_bln * $upah['onepercent']);
         $ujrah = $onepercentservices->getRoundedMethod($bilang_bln * $upah['ujrah']);
         $upahrebet_raw = $onepercent + $ujrah;
         $upahrebet_raw = $onepercentservices->getRoundedMethod($upahrebet_raw);
-        
+        $upahrebet_raw = $upahrebet_raw - ($upah['diskaun'] ?? 0);
+
         return $upahrebet_raw;
     }
 
@@ -282,7 +299,7 @@ if (is_null($kadar_raw)) {
 
             $margin_semasa = ($gadai['bakipjm'] / $gadai['nilaimarhun']) * 100;
 
-            $keuntungan = $onepercent->kiraanKeuntunganRebet($gadai['bakipjm'],$gadai['nilaimarhun'],$gadai['kadarupah'],$gadai['margin_semasa']);
+            $keuntungan = $onepercent->kiraanKeuntunganRebet($gadai['bakipjm'],$gadai['nilaimarhun'],$gadai['kadarupah'],$gadai['margin_semasa'], $kodcaw);
             $ujrahasal = $onepercent->kiraanUjrahSebenar($gadai['nilaimarhun'],$gadai['kadarupah'],$gadai['percentpinj']);
 
             $onepercentasal = $gadai['pinjaman'] * (1/100);
@@ -319,7 +336,7 @@ if (is_null($kadar_raw)) {
                     $keun = $onepercent->getRoundedMethod($onepercentasal * $bilang_bln);
                     $keuntungan_rebate = $onepercent->getRoundedMethod($keuntungan['onepercent'] * $bilang_bln);
 
-                    $transaction_upah = TransaksiKeuntungan::on('mysql7')->create([
+                    $transactionUpahFields = [
                         'norujukan' => $norujukan,
                         'bayaran_keuntungan' => $upahsemasa,
                         'bayaran_pembiayaan' => $baki_bayaran,
@@ -333,7 +350,12 @@ if (is_null($kadar_raw)) {
                         'tempoh' => $gadai['tempoh'],
                         'beza_tempoh' => $bilang_bln,
                         'margin_semasa' => $margin_semasa,
-                    ]);
+                    ];
+                    if (Feature::enabled($kodcaw, Feature::REBET_ANNUR)) {
+                        $transactionUpahFields['kadardiskaun'] = $keuntungan['diskaun'] ?? 0;
+                    }
+
+                    $transaction_upah = TransaksiKeuntungan::on('mysql7')->create($transactionUpahFields);
 
                     $transaksi_gadai = TransaksiGadai::on('mysql7')->create([
                         'kodcaw' => $old_data['kodcaw'],

app/Support/v2/Penebusan.php

@@ -5,14 +5,13 @@ namespace App\Support\v2;
 use App\Advansur;
 use App\Audit;
 use App\Cawangan;
+use App\Feature;
 use App\KadarUpah;
 use App\Support\v2\Calculation;
 use Carbon\Carbon;
 use App\Gadai;
 use App\HargaEmas;
 use App\InOutMar;
-use App\KomuditiPurchase;
-use App\KomuditiTransaksi;
 use App\Marhun;
 use App\FailoverTransaction;
 use App\FailoverTransactionFailed;
@@ -39,6 +38,32 @@ class Penebusan
         $this->cawangan_info = $cawangan_info;
     }
 
+    private function diskaunAnnur($kodcaw, $gadai)
+    {
+        try {
+            if (!Feature::enabled($kodcaw, Feature::REBET_ANNUR)) {
+                return 0.0;
+            }
+        } catch (\Exception $e) {
+            return 0.0;
+        }
+
+        return (float) ($gadai['diskaun'] ?? 0);
+    }
+
+    private function tebusAnnurFields($kodcaw, $diskaun)
+    {
+        try {
+            if (!Feature::enabled($kodcaw, Feature::REBET_ANNUR)) {
+                return [];
+            }
+        } catch (\Exception $e) {
+            return [];
+        }
+
+        return ['diskaun_rebate' => $diskaun];
+    }
+
     public function tebusTawarruq($kodcaw,$norujukan){
         $onepercentservices = new Calculation();
 
@@ -53,7 +78,8 @@ class Penebusan
         $jeniskeuntungan = ($gadai_data['tagbaru'] == 1) ? 'onepercent' : 'asal';
 
         $rebet = $this->rebetselepastawarruq($kodcaw,$norujukan,$jeniskeuntungan);
-        $harga_tebus = $gadai_data['bakihargajualan'] - $rebet;
+        $diskaun = $this->diskaunAnnur($kodcaw, $gadai_data);
+        $harga_tebus = $gadai_data['bakihargajualan'] - $rebet - $diskaun;
 
         // $hargatebus = round($harga_tebus,PHP_ROUND_HALF_UP);
         // $hargatebus = bcdiv(round($harga_tebus,2),1,1);
@@ -485,6 +511,8 @@ class Penebusan
 
         $gadai = Gadai::on($cawangan['mysql'])->where('norujukan','=',$norujukan)->first();
 
+        $diskaun = $this->diskaunAnnur($kodcaw, $gadai);
+
         //check duplicate
         $data = Transaction::on('mysql7')->where('norujukan','=',$norujukan)->whereIn('trans_type', ['P', 'T', 'S'])->first();
 
@@ -502,7 +530,6 @@ class Penebusan
             $harga_tebus = $this->hargaTebusTawarruq($kodcaw,$norujukan,$request->jeniskeuntungan);
             $upah_tebus = $this->kiraupahTawarruq($norujukan);
             $upah_rebet = $this->kiraUpahRebetSebenar($kodcaw,$norujukan);
-            $upah_rebet_sebenar = $harga_tebus['harga'] - $gadai['bakipjm'];
 
             if($request->jeniskeuntungan == 'onepercent'){
                 $array_onepercent = $this->kiraupahUjrahOnePercent($kodcaw,$norujukan);
@@ -514,10 +541,15 @@ class Penebusan
                 $ujrah = $array_onepercent['ujrah'];
                 $onepercent = $array_onepercent['onepercent'];
             }
+
+            $harga_tebus['harga'] -= $diskaun;
+            $upah_rebet_sebenar = $harga_tebus['harga'] - $gadai['bakipjm'];
         }
 
+        $bayaran_keuntungan_bersih = max(0, $upah_rebet_sebenar);
 
-        $create_tebus = Tebus::on($cawangan['mysql'])->create([
+
+        $create_tebus = Tebus::on($cawangan['mysql'])->create(array_merge([
             'kodcaw'=> $kodcaw,
             'norujukan'=> $norujukan,
             'nopelanggan' => $request->nopelanggan,
@@ -543,7 +575,7 @@ class Penebusan
             'teller' => $request->teller,
             'ujrah' => $ujrah_rebet,
             'onepercent' => $onepercent_rebet,
-        ]);
+        ], $this->tebusAnnurFields($kodcaw, $diskaun)));
 
         $create_inoutmar = InOutMar::on($cawangan['mysql'])->create([
             'tarikh' => $current->toDateString(),
@@ -561,7 +593,7 @@ class Penebusan
 
         $transaction_upah = TransaksiKeuntungan::on('mysql7')->create([
             'norujukan' => $norujukan,
-            'bayaran_keuntungan' => $upah_tebus,
+            'bayaran_keuntungan' => $bayaran_keuntungan_bersih,
             'bayaran_pembiayaan' => $gadai['bakipjm'],
             'keuntungan_rebet' => $upah_rebet_sebenar,
             'tarikh_bayaran'=> $current,
@@ -651,6 +683,8 @@ class Penebusan
 
         $gadai = Gadai::on($cawangan['mysql'])->where('norujukan','=',$norujukan)->first();
 
+        $diskaun = $this->diskaunAnnur($kodcaw, $gadai);
+
         //check duplicate
         $data = Transaction::on('mysql7')->where('norujukan','=',$norujukan)->where('trans_type','=','AT')->first();
 
@@ -668,7 +702,6 @@ class Penebusan
             $harga_tebus = $this->hargaTebusTawarruq($kodcaw,$norujukan,$request->jeniskeuntungan);
             $upah_tebus = $this->kiraupahTawarruq($norujukan);
             $upah_rebet = $this->kiraUpahRebetSebenar($kodcaw,$norujukan);
-            $upah_rebet_sebenar = $harga_tebus['harga'] - $gadai['bakipjm'];
 
             if($request->jeniskeuntungan == 'onepercent'){
                 $array_onepercent = $this->kiraupahUjrahOnePercent($kodcaw,$norujukan);
@@ -681,6 +714,9 @@ class Penebusan
                 $ujrah = $array_onepercent['ujrah'];
                 $onepercent = $array_onepercent['onepercent'];
             }
+
+            $harga_tebus['harga'] -= $diskaun;
+            $upah_rebet_sebenar = $harga_tebus['harga'] - $gadai['bakipjm'];
         }
 
         $update_gadai = Gadai::on($cawangan['mysql'])->where('norujukan','=',$norujukan)->update(array(
@@ -690,7 +726,7 @@ class Penebusan
 
         // $upah_rebet = $this->kiraUpahRebet($kodcaw,$norujukan);
 
-        $create_tebus = Tebus::on($cawangan['mysql'])->create([
+        $create_tebus = Tebus::on($cawangan['mysql'])->create(array_merge([
             'kodcaw'=> $kodcaw,
             'norujukan'=> $norujukan,
             'nopelanggan' => $request->nopelanggan,
@@ -716,7 +752,7 @@ class Penebusan
             'teller' => $request->teller,
             'ujrah' => $ujrah_rebet,
             'onepercent' => $onepercent_rebet,
-        ]);
+        ], $this->tebusAnnurFields($kodcaw, $diskaun)));
 
         $create_inoutmar = InOutMar::on($cawangan['mysql'])->create([
             'tarikh' => $current->toDateString(),
@@ -734,9 +770,11 @@ class Penebusan
 
         $bayaran_pembiayaan = $request->totalbayaran - $request->bakiupah;
 
+        $bayaran_keuntungan_bersih = max(0, $upah_rebet_sebenar);
+
         $transaction_upah = TransaksiKeuntungan::on('mysql7')->create([
             'norujukan' => $norujukan,
-            'bayaran_keuntungan' => $upah_tebus,
+            'bayaran_keuntungan' => $bayaran_keuntungan_bersih,
             'bayaran_pembiayaan' => $bayaran_pembiayaan,
             'keuntungan_rebet' => $upah_rebet_sebenar,
             'tarikh_bayaran'=> $current,
@@ -944,20 +982,19 @@ class Penebusan
         $array_tebus = $request->only(['jeniskeuntungan', 'nopelanggan','jenistebus','addpinjaman','nowakil','marhun','teller']);
         $array_trans = $request->only(['nopelanggan', 'noic','jenisAT','pinjaman','pinjamanbaru','marhun','teller','jenistebus']);
         $array_tebus_base = $request->only(['totalbayaran', 'bakiupah','jeniskeuntungan','bakipinjaman','jenistebus','teller','nowakil','duitpelanggan']);
-        $array_trans_base = $request->only(['pinjaman','teller','pinjamanbaru']);
 
         try{
 
             DB::connection($cawangan['mysql'])->beginTransaction();
             $this->saveTebus($kodcaw,$norujukan,$gadai,$cawangan,$array_tebus);
-            $this->createTransaction($cawangan,$kodcaw,$norujukan,$array_trans);
+            $newReference = $this->createTransaction($cawangan,$kodcaw,$norujukan,$array_trans);
 
             DB::connection('mysql7')->beginTransaction();
             $this->saveTebusBase($kodcaw,$norujukan,$gadai,$array_tebus_base);
-            $this->createTransactionBase($norujukan,$kodcaw,$array_trans_base);
             $array_response = [
                 'result' => 'success',
-                'data' => 1
+                'data' => 1,
+                'norujukan_baru' => $newReference
             ];
 
             DB::connection($cawangan['mysql'])->commit();
@@ -1004,19 +1041,18 @@ class Penebusan
         $array_tebus = $request->only(['jeniskeuntungan', 'nopelanggan','jenistebus','addpinjaman','nowakil','marhun','teller']);
         $array_trans = $request->only(['nopelanggan', 'noic','pinjaman','pinjamanbaru','marhun','teller','jenistebus']);
         $array_tebus_base = $request->only(['totalbayaran', 'bakiupah','jeniskeuntungan','bakipinjaman','jenistebus','teller','nowakil','duitpelanggan']);
-        $array_trans_base = $request->only(['pinjaman','teller','pinjamanbaru']);
 
         try{
             DB::connection($cawangan['mysql'])->beginTransaction();
             $this->saveTebus($kodcaw,$norujukan,$gadai,$cawangan,$array_tebus);
-            $this->createTransaction($cawangan,$kodcaw,$norujukan,$array_trans);
+            $newReference = $this->createTransaction($cawangan,$kodcaw,$norujukan,$array_trans);
             DB::connection('mysql7')->beginTransaction();
             $this->saveTebusBase($kodcaw,$norujukan,$gadai,$array_tebus_base);
-            $this->createTransactionBase($norujukan,$kodcaw,$array_trans_base);
 
             $array_response = [
                 'result' => 'success',
-                'data' => 1
+                'data' => 1,
+                'norujukan_baru' => $newReference
             ];
 
             DB::connection($cawangan['mysql'])->commit();
@@ -1131,12 +1167,16 @@ class Penebusan
         $onepercent_rebet = $array_onepercent_rebet['onepercent'] - $upah_rebet['onepercent'];
         $ujrah_rebet = $array_onepercent_rebet['ujrah'] - $upah_rebet['ujrah'];
 
+        $diskaun = $this->diskaunAnnur($kodcaw, $gadai);
+        $harga_tebus['harga'] -= $diskaun;
         $upah_rebet_sebenar = $harga_tebus['harga'] - $gadai['bakipjm'];
 
+        $bayaran_keuntungan_bersih = max(0, $upah_rebet_sebenar);
+
         try{
             TransaksiKeuntungan::on('mysql7')->create([
                 'norujukan' => $norujukan,
-                'bayaran_keuntungan' => $upah_tebus,
+                'bayaran_keuntungan' => $bayaran_keuntungan_bersih,
                 'bayaran_pembiayaan' => $bayaran_pembiayaan,
                 'keuntungan_rebet' => $upah_rebet_sebenar,
                 'tarikh_bayaran'=> $current,
@@ -1184,7 +1224,7 @@ class Penebusan
         $gadaiTransaction = Gadai::on($cawangan['mysql'])->where('t_gadai','=',$current->toDateString())->orderBy('sirig', 'desc')->first();
         $gadaiTransaction = optional($gadaiTransaction)->toArray();
 
-        $new_sirig = ($gadaiTransaction) ? $gadaiTransaction['sirig'] + 1 : 1;
+        $new_sirig = (int) ($gadaiTransaction['sirig'] ?? 0) + 1;
         $curent_year = substr($current->year,2,2);
         $curent_month = sprintf("%02d", $current->month);
         $current_day = sprintf("%02d", $current->day);
@@ -1312,39 +1352,11 @@ class Penebusan
                 't_update' => $current->toDateString(),
             ));
 
+            return $new_sag_number;
         }catch(\Exception $e){
             throw new \Exception("Error in Transaction: " . $e->getMessage());
         }
 
     }
 
-    private function createTransactionBase($norujukan,$kodcaw,$array_trans_base){
-        $current = Carbon::now();
-
-        $komuditi_current = KomuditiPurchase::on('mysql7')->where('date_purchase','=',$current->toDateString())->orderBy('created_at','desc')->first();
-
-        $unit_current = isset($komuditi_current['unit_komuditi']) ? $komuditi_current['unit_komuditi']: 0;
-
-        try{
-            $update_unit = $unit_current - $array_trans_base['pinjamanbaru'];
-
-            KomuditiPurchase::on('mysql7')->where('id','=',$komuditi_current['id'])->update([
-                'unit_komuditi' => $update_unit
-            ]);
-
-            KomuditiTransaksi::on('mysql7')->create([
-                'unit_komuditi' => $update_unit,
-                'nosijil'=>$komuditi_current['no_sijil'],
-                'norujukan' => $norujukan,
-                'kodcaw' => $kodcaw,
-                'teller' => $array_trans_base['teller'],
-                'masa' => $current->toTimeString(),
-                'tarikh' => $current->toDateString()
-            ]);
-        }catch(\Exception $e){
-            throw new \Exception("Error in TransactionBase: " . $e->getMessage());
-        }
-    }
-
-
-}
+}

app/Tebus.php

@@ -52,7 +52,8 @@ class Tebus extends Model
         'pinjamanterkini',
         'tarikhbyrn',
         'ujrah',
-        'onepercent'
+        'onepercent',
+        'diskaun_rebate'
     ];
 
     /**

app/TransaksiKeuntungan.php

@@ -14,7 +14,7 @@ class TransaksiKeuntungan extends Model
      * @var array
      */
     protected $fillable = [
-      'norujukan','bayaran_keuntungan','tarikh_bayaran','kodcaw','bayaran_pembiayaan','keuntungan_rebet','ujrah','ujrah_rebet','onepercent','onepercent_rebet','tempoh','beza_tempoh','margin_semasa','rounded'
+      'norujukan','bayaran_keuntungan','tarikh_bayaran','kodcaw','bayaran_pembiayaan','keuntungan_rebet','ujrah','ujrah_rebet','onepercent','onepercent_rebet','tempoh','beza_tempoh','margin_semasa','rounded','kadardiskaun'
     ];
 
     /**

bootstrap/app.php

@@ -87,12 +87,16 @@ $app->singleton(
 */
 
 $app->configure('app');
+$app->configure('services');
 $app->configure('logging');
+$app->configure('logviewer');
 $app->configure('tinker');
 $app->configure('tennant_database');
 $app->configure('report');
 $app->configure('app_parameter');
 $app->configure('parameter');
+$app->configure('whatsapp');
+$app->configure('kaunter');
 /*
 |--------------------------------------------------------------------------
 | Register Middleware
@@ -108,9 +112,9 @@ $app->configure('parameter');
 //     App\Http\Middleware\ExampleMiddleware::class
 // ]);
 
-// $app->routeMiddleware([
-//     'auth' => App\Http\Middleware\Authenticate::class,
-// ]);
+$app->routeMiddleware([
+    'logviewer.password' => App\Http\Middleware\LogViewerPassword::class,
+]);
 
 /*
 |--------------------------------------------------------------------------

composer_backuo.json

@@ -1,44 +0,0 @@
-{
-    "name": "laravel/lumen",
-    "description": "The Laravel Lumen Framework.",
-    "keywords": ["framework", "laravel", "lumen"],
-    "license": "MIT",
-    "type": "project",
-    "require": {
-        "php": "^7.2.5",
-        "auth0/auth0-php": "^7.4",
-        "laravel/lumen-framework": "^7.0",
-        "rap2hpoutre/laravel-log-viewer": "^1.7"
-    },
-    "require-dev": {
-        "fzaninotto/faker": "^1.9.1",
-        "mockery/mockery": "^1.3.1",
-        "phpunit/phpunit": "^8.5"
-    },
-    "autoload": {
-        "classmap": [
-            "database/seeds",
-            "database/factories"
-        ],
-        "psr-4": {
-            "App\\": "app/"
-        }
-    },
-    "autoload-dev": {
-        "classmap": [
-            "tests/"
-        ]
-    },
-    "config": {
-        "preferred-install": "dist",
-        "sort-packages": true,
-        "optimize-autoloader": true
-    },
-    "minimum-stability": "dev",
-    "prefer-stable": true,
-    "scripts": {
-        "post-root-package-install": [
-            "@php -r \"file_exists('.env') || copy('.env.example', '.env');\""
-        ]
-    }
-}

config/app_parameter.php

@@ -3,6 +3,7 @@
 return [
    'url' => env('APP_URL', 'http://localhost'),
    'api_arrahnbid' => env('API_ARRAHNBID', 'http://lelong.test/api/'),
+   'api_arrahnbid_annur' => env('API_ARRAHNBID_ANNUR', env('API_ARRAHNBID', 'http://lelong.test/api/')),
    'api_v3' => env('API_V3', 'http://apiv3.localhost/api/')
 ];
 

config/kaunter.php

@@ -0,0 +1,7 @@
+<?php
+
+return [
+    'url' => env('KAUNTER_URL', ''),
+    'notification_secret' => env('INTERNAL_NOTIFICATION_SECRET', ''),
+    'notification_timeout' => (int) env('KAUNTER_NOTIFICATION_TIMEOUT', 3),
+];

config/logviewer.php

@@ -0,0 +1,16 @@
+<?php
+
+return [
+    'password' => env('LOGVIEWER_PASSWORD'),
+    /*
+    |--------------------------------------------------------------------------
+    | Pattern and storage path settings
+    |--------------------------------------------------------------------------
+    |
+    | The env key for pattern and storage path with a default value
+    |
+    */
+    'max_file_size' => 52428800, // size in Byte
+    'pattern'       => env('LOGVIEWER_PATTERN', '*.log'),
+    'storage_path'  => env('LOGVIEWER_STORAGE_PATH', storage_path('logs')),
+];

config/services.php

@@ -0,0 +1,23 @@
+<?php
+
+return [
+
+    'shoraka' => [
+        // Local UI tests only: off, failed or pending. Success is deliberately excluded.
+        'simulation' => env('SHORAKA_SIMULATION', 'off'),
+        'base_url' => env(
+            'SHORAKA_BASE_URL',
+            'https://uat2.shorakagroup.com'
+        ),
+
+        'api_id' => env('SHORAKA_API_ID'),
+
+        'secret_key' => env('SHORAKA_SECRET_KEY'),
+
+        'timeout' => env(
+            'SHORAKA_TIMEOUT',
+            60
+        ),
+    ],
+
+];

config/whatsapp.php

@@ -0,0 +1,12 @@
+<?php
+
+return [
+    'whatsapp_cloud_enabled' => env('WHATSAPP_CLOUD_ENABLED', true),
+    'token' => env('WHATSAPP_TOKEN'),
+    'phone_number_id' => env('WHATSAPP_PHONE_NUMBER_ID'),
+    'api_version' => env('WHATSAPP_API_VERSION', 'v25.0'),
+    'template' => env('WHATSAPP_TEMPLATE', 'hello_world'),
+    'template_lang' => env('WHATSAPP_TEMPLATE_LANG', 'en_US'),
+    'verify_token' => env('WHATSAPP_VERIFY_TOKEN'),
+    'app_secret' => env('WHATSAPP_APP_SECRET'),
+];

database/migrations/2026_09_13_100000_create_kadar_rebet_table.php

@@ -0,0 +1,31 @@
+<?php
+
+use Illuminate\Database\Migrations\Migration;
+use Illuminate\Database\Schema\Blueprint;
+use Illuminate\Support\Facades\Schema;
+
+class CreateKadarRebetTable extends Migration
+{
+    /**
+     * Master DB (mysql7) — Annur rebet bands by pembiayaan range.
+     * Empty table + feature flag off = other cawangan unchanged.
+     */
+    public function up()
+    {
+        if (Schema::connection('mysql7')->hasTable('kadar_rebet')) {
+            return;
+        }
+
+        Schema::connection('mysql7')->create('kadar_rebet', function (Blueprint $table) {
+            $table->increments('id');
+            $table->decimal('pembiayaan_min', 12, 2)->default(0);
+            $table->decimal('pembiayaan_max', 12, 2)->default(0);
+            $table->decimal('kadarrebet', 8, 4)->default(0);
+        });
+    }
+
+    public function down()
+    {
+        Schema::connection('mysql7')->dropIfExists('kadar_rebet');
+    }
+}

database/migrations/2026_09_13_100001_add_annur_diskaun_columns.php

@@ -0,0 +1,102 @@
+<?php
+
+use Illuminate\Database\Migrations\Migration;
+use Illuminate\Database\Schema\Blueprint;
+use Illuminate\Support\Facades\DB;
+use Illuminate\Support\Facades\Schema;
+
+class AddAnnurDiskaunColumns extends Migration
+{
+    public function getActiveDB()
+    {
+        $config_db = array_keys(config('database.connections'));
+
+        return array_filter($config_db, function ($connection) {
+            try {
+                if ($connection === 'mysql7') {
+                    return false;
+                }
+                DB::connection($connection)->getPdo();
+                return true;
+            } catch (\Exception $e) {
+                return false;
+            }
+        });
+    }
+
+    public function up()
+    {
+        foreach ($this->getActiveDB() as $dbase) {
+            if (Schema::connection($dbase)->hasTable('gadai')) {
+                $addKadar = !Schema::connection($dbase)->hasColumn('gadai', 'kadarrebet');
+                $addDiskaun = !Schema::connection($dbase)->hasColumn('gadai', 'diskaun');
+                if ($addKadar || $addDiskaun) {
+                    Schema::connection($dbase)->table('gadai', function (Blueprint $table) use ($addKadar, $addDiskaun) {
+                        if ($addKadar) {
+                            $table->decimal('kadarrebet', 8, 4)->nullable()->default(0);
+                        }
+                        if ($addDiskaun) {
+                            $table->decimal('diskaun', 12, 2)->nullable()->default(0);
+                        }
+                    });
+                }
+            }
+
+            if (
+                Schema::connection($dbase)->hasTable('tebus')
+                && !Schema::connection($dbase)->hasColumn('tebus', 'diskaun_rebate')
+            ) {
+                Schema::connection($dbase)->table('tebus', function (Blueprint $table) {
+                    $table->decimal('diskaun_rebate', 12, 2)->nullable()->default(0);
+                });
+            }
+        }
+
+        if (
+            Schema::connection('mysql7')->hasTable('transaksi_keuntungan')
+            && !Schema::connection('mysql7')->hasColumn('transaksi_keuntungan', 'kadardiskaun')
+        ) {
+            Schema::connection('mysql7')->table('transaksi_keuntungan', function (Blueprint $table) {
+                $table->decimal('kadardiskaun', 12, 2)->nullable()->default(0);
+            });
+        }
+    }
+
+    public function down()
+    {
+        foreach ($this->getActiveDB() as $dbase) {
+            if (Schema::connection($dbase)->hasTable('gadai')) {
+                Schema::connection($dbase)->table('gadai', function (Blueprint $table) use ($dbase) {
+                    $drops = [];
+                    if (Schema::connection($dbase)->hasColumn('gadai', 'kadarrebet')) {
+                        $drops[] = 'kadarrebet';
+                    }
+                    if (Schema::connection($dbase)->hasColumn('gadai', 'diskaun')) {
+                        $drops[] = 'diskaun';
+                    }
+                    if ($drops) {
+                        $table->dropColumn($drops);
+                    }
+                });
+            }
+
+            if (
+                Schema::connection($dbase)->hasTable('tebus')
+                && Schema::connection($dbase)->hasColumn('tebus', 'diskaun_rebate')
+            ) {
+                Schema::connection($dbase)->table('tebus', function (Blueprint $table) {
+                    $table->dropColumn('diskaun_rebate');
+                });
+            }
+        }
+
+        if (
+            Schema::connection('mysql7')->hasTable('transaksi_keuntungan')
+            && Schema::connection('mysql7')->hasColumn('transaksi_keuntungan', 'kadardiskaun')
+        ) {
+            Schema::connection('mysql7')->table('transaksi_keuntungan', function (Blueprint $table) {
+                $table->dropColumn('kadardiskaun');
+            });
+        }
+    }
+}

database/migrations/2026_09_15_094818_create_shoraka_transactions_table.php

@@ -0,0 +1,87 @@
+<?php
+
+use Illuminate\Database\Migrations\Migration;
+use Illuminate\Database\Schema\Blueprint;
+use Illuminate\Support\Facades\Schema;
+
+class CreateShorakaTransactionsTable extends Migration
+{
+    public function up()
+    {
+        Schema::create(
+            'shoraka_transactions',
+            function (Blueprint $table) {
+                $table->id();
+
+                // Rujukan pembiayaan dalam eRahn
+                $table->string('norujukan')->unique();
+
+                // Maklumat daripada Shoraka
+                $table->string('order_id')
+                    ->nullable()
+                    ->unique();
+
+                $table->string('status')
+                    ->default('PENDING');
+
+                $table->string('product_type')
+                    ->default('FINANCING');
+
+                $table->string('commodity_type');
+
+                $table->string('ownership_name');
+                $table->string('ownership_doc_no')
+                    ->nullable();
+
+                $table->decimal(
+                    'order_amount',
+                    15,
+                    2
+                );
+
+                $table->decimal(
+                    'murabaha_amount',
+                    15,
+                    2
+                );
+
+                $table->string('certificate_url')
+                    ->nullable();
+
+                $table->string('certificate_path')
+                    ->nullable();
+
+                // Simpan payload untuk audit dan troubleshooting
+                $table->json('request_payload')
+                    ->nullable();
+
+                $table->json('response_payload')
+                    ->nullable();
+
+                $table->json('callback_payload')
+                    ->nullable();
+
+                $table->unsignedInteger('attempt_count')
+                    ->default(0);
+
+                $table->text('error_message')
+                    ->nullable();
+
+                $table->timestamp('submitted_at')
+                    ->nullable();
+
+                $table->timestamp('completed_at')
+                    ->nullable();
+
+                $table->timestamps();
+
+                $table->index('status');
+            }
+        );
+    }
+
+    public function down()
+    {
+        Schema::dropIfExists('shoraka_transactions');
+    }
+}

database/migrations/2026_09_17_100000_add_pc_verified_to_pembiayaan_online_table.php

@@ -0,0 +1,74 @@
+<?php
+
+use Illuminate\Database\Migrations\Migration;
+use Illuminate\Database\Schema\Blueprint;
+use Illuminate\Support\Facades\DB;
+use Illuminate\Support\Facades\Schema;
+
+class AddPcVerifiedToPembiayaanOnlineTable extends Migration
+{
+    public function getActiveDB()
+    {
+        return array_filter(
+            array_keys(config('database.connections')),
+            function ($connection) {
+                try {
+                    if ($connection === 'mysql7') {
+                        return false;
+                    }
+
+                    DB::connection($connection)->getPdo();
+
+                    return true;
+                } catch (\Exception $e) {
+                    return false;
+                }
+            }
+        );
+    }
+
+    public function up()
+    {
+        foreach ($this->getActiveDB() as $dbase) {
+            if (!Schema::connection($dbase)->hasTable('pembiayaan_online')) {
+                continue;
+            }
+
+            Schema::connection($dbase)->table('pembiayaan_online', function (Blueprint $table) use ($dbase) {
+                if (!Schema::connection($dbase)->hasColumn('pembiayaan_online', 'pc_verified_by')) {
+                    $table->string('pc_verified_by', 100)
+                        ->nullable()
+                        ->after('pc_submitted_by');
+                }
+
+                if (!Schema::connection($dbase)->hasColumn('pembiayaan_online', 'pc_verified_at')) {
+                    $table->timestamp('pc_verified_at')
+                        ->nullable()
+                        ->after('pc_verified_by');
+                }
+            });
+        }
+    }
+
+    public function down()
+    {
+        foreach ($this->getActiveDB() as $dbase) {
+            if (!Schema::connection($dbase)->hasTable('pembiayaan_online')) {
+                continue;
+            }
+
+            Schema::connection($dbase)->table('pembiayaan_online', function (Blueprint $table) use ($dbase) {
+                $cols = [];
+                if (Schema::connection($dbase)->hasColumn('pembiayaan_online', 'pc_verified_at')) {
+                    $cols[] = 'pc_verified_at';
+                }
+                if (Schema::connection($dbase)->hasColumn('pembiayaan_online', 'pc_verified_by')) {
+                    $cols[] = 'pc_verified_by';
+                }
+                if (!empty($cols)) {
+                    $table->dropColumn($cols);
+                }
+            });
+        }
+    }
+}

database/migrations/2026_10_05_120000_add_kodcaw_to_shoraka_transactions.php

@@ -0,0 +1,22 @@
+<?php
+
+use Illuminate\Database\Migrations\Migration;
+use Illuminate\Database\Schema\Blueprint;
+use Illuminate\Support\Facades\Schema;
+
+class AddKodcawToShorakaTransactions extends Migration
+{
+    public function up()
+    {
+        Schema::table('shoraka_transactions', function (Blueprint $table) {
+            $table->string('kodcaw', 20)->nullable()->index();
+        });
+    }
+
+    public function down()
+    {
+        Schema::table('shoraka_transactions', function (Blueprint $table) {
+            $table->dropColumn('kodcaw');
+        });
+    }
+}

database/migrations/2026_10_26_130000_add_teller_to_shoraka_transactions.php

@@ -0,0 +1,23 @@
+<?php
+
+use Illuminate\Database\Migrations\Migration;
+use Illuminate\Database\Schema\Blueprint;
+use Illuminate\Support\Facades\DB;
+use Illuminate\Support\Facades\Schema;
+
+class AddTellerToShorakaTransactions extends Migration
+{
+    public function up()
+    {
+        Schema::table('shoraka_transactions', function (Blueprint $table) {
+            $table->string('teller')->nullable();
+        });
+    }
+
+    public function down()
+    {
+        Schema::table('shoraka_transactions', function (Blueprint $table) {
+            $table->dropColumn('teller');
+        });
+    }
+}

docker-compose.yml

@@ -5,6 +5,8 @@ services:
       dockerfile: docker/php/Dockerfile
       target: development
     working_dir: /var/www/html
+    ports:
+      - "8080:8000"
     volumes:
       - ./:/var/www/html:cached
     environment:
@@ -12,16 +14,7 @@ services:
       APP_DEBUG: "true"
     depends_on:
       - mysql
-
-  web:
-    image: nginx:1.25-alpine
-    ports:
-      - "8080:80"
-    volumes:
-      - ./:/var/www/html:cached
-      - ./docker/nginx/default.conf:/etc/nginx/conf.d/default.conf:ro
-    depends_on:
-      - app
+    command: ["php", "-S", "0.0.0.0:8000", "-t", "public"]
 
   mysql:
     image: mysql:8.0

docker/php/Dockerfile

@@ -2,7 +2,15 @@ FROM php:7.4-fpm AS base
 
 WORKDIR /var/www/html
 
-RUN apt-get update \
+# Debian 11 (bullseye) is EOL; deb.debian.org returns 404 for security debs.
+RUN printf '%s\n' \
+  'deb http://archive.debian.org/debian bullseye main' \
+  'deb http://archive.debian.org/debian-security bullseye-security main' \
+  'deb http://archive.debian.org/debian bullseye-updates main' \
+  > /etc/apt/sources.list \
+  && printf 'Acquire::Check-Valid-Until "false";\n' \
+  > /etc/apt/apt.conf.d/99no-check-valid-until \
+  && apt-get update \
   && apt-get install -y --no-install-recommends \
   git \
   pkg-config \
@@ -27,9 +35,12 @@ COPY --from=composer:2 /usr/bin/composer /usr/local/bin/composer
 COPY docker/php/php.ini /usr/local/etc/php/conf.d/app.ini
 COPY docker/php/zz-clear-env.conf /usr/local/etc/php-fpm.d/zz-clear-env.conf
 COPY docker/php/entrypoint.sh /usr/local/bin/app-entrypoint.sh
+COPY docker/php/certs/*.crt /usr/local/share/ca-certificates/
 
-RUN chmod +x /usr/local/bin/app-entrypoint.sh \
-  && usermod -u 1000 www-data && groupmod -g 1000 www-data
+RUN update-ca-certificates \
+  && chmod +x /usr/local/bin/app-entrypoint.sh \
+  && usermod -u 1000 www-data && groupmod -g 1000 www-data \
+  && chown www-data:www-data /usr/local/etc/php/conf.d/app.ini
 
 ENTRYPOINT ["app-entrypoint.sh"]
 CMD ["php-fpm"]

docker/php/certs/sectigo-public-server-authentication-ca-dv-r36.crt

@@ -0,0 +1,36 @@
+-----BEGIN CERTIFICATE-----
+MIIGTDCCBDSgAwIBAgIQOXpmzCdWNi4NqofKbqvjsTANBgkqhkiG9w0BAQwFADBf
+MQswCQYDVQQGEwJHQjEYMBYGA1UEChMPU2VjdGlnbyBMaW1pdGVkMTYwNAYDVQQD
+Ey1TZWN0aWdvIFB1YmxpYyBTZXJ2ZXIgQXV0aGVudGljYXRpb24gUm9vdCBSNDYw
+HhcNMjEwMzIyMDAwMDAwWhcNMzYwMzIxMjM1OTU5WjBgMQswCQYDVQQGEwJHQjEY
+MBYGA1UEChMPU2VjdGlnbyBMaW1pdGVkMTcwNQYDVQQDEy5TZWN0aWdvIFB1Ymxp
+YyBTZXJ2ZXIgQXV0aGVudGljYXRpb24gQ0EgRFYgUjM2MIIBojANBgkqhkiG9w0B
+AQEFAAOCAY8AMIIBigKCAYEAljZf2HIz7+SPUPQCQObZYcrxLTHYdf1ZtMRe7Yeq
+RPSwygz16qJ9cAWtWNTcuICc++p8Dct7zNGxCpqmEtqifO7NvuB5dEVexXn9RFFH
+12Hm+NtPRQgXIFjx6MSJcNWuVO3XGE57L1mHlcQYj+g4hny90aFh2SCZCDEVkAja
+EMMfYPKuCjHuuF+bzHFb/9gV8P9+ekcHENF2nR1efGWSKwnfG5RawlkaQDpRtZTm
+M64TIsv/r7cyFO4nSjs1jLdXYdz5q3a4L0NoabZfbdxVb+CUEHfB0bpulZQtH1Rv
+38e/lIdP7OTTIlZh6OYL6NhxP8So0/sht/4J9mqIGxRFc0/pC8suja+wcIUna0HB
+pXKfXTKpzgis+zmXDL06ASJf5E4A2/m+Hp6b84sfPAwQ766rI65mh50S0Di9E3Pn
+2WcaJc+PILsBmYpgtmgWTR9eV9otfKRUBfzHUHcVgarub/XluEpRlTtZudU5xbFN
+xx/DgMrXLUAPaI60fZ6wA+PTAgMBAAGjggGBMIIBfTAfBgNVHSMEGDAWgBRWc1hk
+lfmSGrASKgRieaFAFYghSTAdBgNVHQ4EFgQUaMASFhgOr872h6YyV6NGUV3LBycw
+DgYDVR0PAQH/BAQDAgGGMBIGA1UdEwEB/wQIMAYBAf8CAQAwHQYDVR0lBBYwFAYI
+KwYBBQUHAwEGCCsGAQUFBwMCMBsGA1UdIAQUMBIwBgYEVR0gADAIBgZngQwBAgEw
+VAYDVR0fBE0wSzBJoEegRYZDaHR0cDovL2NybC5zZWN0aWdvLmNvbS9TZWN0aWdv
+UHVibGljU2VydmVyQXV0aGVudGljYXRpb25Sb290UjQ2LmNybDCBhAYIKwYBBQUH
+AQEEeDB2ME8GCCsGAQUFBzAChkNodHRwOi8vY3J0LnNlY3RpZ28uY29tL1NlY3Rp
+Z29QdWJsaWNTZXJ2ZXJBdXRoZW50aWNhdGlvblJvb3RSNDYucDdjMCMGCCsGAQUF
+BzABhhdodHRwOi8vb2NzcC5zZWN0aWdvLmNvbTANBgkqhkiG9w0BAQwFAAOCAgEA
+YtOC9Fy+TqECFw40IospI92kLGgoSZGPOSQXMBqmsGWZUQ7rux7cj1du6d9rD6C8
+ze1B2eQjkrGkIL/OF1s7vSmgYVafsRoZd/IHUrkoQvX8FZwUsmPu7amgBfaY3g+d
+q1x0jNGKb6I6Bzdl6LgMD9qxp+3i7GQOnd9J8LFSietY6Z4jUBzVoOoz8iAU84OF
+h2HhAuiPw1ai0VnY38RTI+8kepGWVfGxfBWzwH9uIjeooIeaosVFvE8cmYUB4TSH
+5dUyD0jHct2+8ceKEtIoFU/FfHq/mDaVnvcDCZXtIgitdMFQdMZaVehmObyhRdDD
+4NQCs0gaI9AAgFj4L9QtkARzhQLNyRf87Kln+YU0lgCGr9HLg3rGO8q+Y4ppLsOd
+unQZ6ZxPNGIfOApbPVf5hCe58EZwiWdHIMn9lPP6+F404y8NNugbQixBber+x536
+WrZhFZLjEkhp7fFXf9r32rNPfb74X/U90Bdy4lzp3+X1ukh1BuMxA/EEhDoTOS3l
+7ABvc7BYSQubQ2490OcdkIzUh3ZwDrakMVrbaTxUM2p24N6dB+ns2zptWCva6jzW
+r8IWKIMxzxLPv5Kt3ePKcUdvkBU/smqujSczTzzSjIoR5QqQA6lN1ZRSnuHIWCvh
+JEltkYnTAH41QJ6SAWO66GrrUESwN/cgZzL4JLEqz1Y=
+-----END CERTIFICATE-----

docker/php/certs/sectigo-public-server-authentication-root-r46.crt

@@ -0,0 +1,32 @@
+-----BEGIN CERTIFICATE-----
+MIIFijCCA3KgAwIBAgIQdY39i658BwD6qSWn4cetFDANBgkqhkiG9w0BAQwFADBf
+MQswCQYDVQQGEwJHQjEYMBYGA1UEChMPU2VjdGlnbyBMaW1pdGVkMTYwNAYDVQQD
+Ey1TZWN0aWdvIFB1YmxpYyBTZXJ2ZXIgQXV0aGVudGljYXRpb24gUm9vdCBSNDYw
+HhcNMjEwMzIyMDAwMDAwWhcNNDYwMzIxMjM1OTU5WjBfMQswCQYDVQQGEwJHQjEY
+MBYGA1UEChMPU2VjdGlnbyBMaW1pdGVkMTYwNAYDVQQDEy1TZWN0aWdvIFB1Ymxp
+YyBTZXJ2ZXIgQXV0aGVudGljYXRpb24gUm9vdCBSNDYwggIiMA0GCSqGSIb3DQEB
+AQUAA4ICDwAwggIKAoICAQCTvtU2UnXYASOgHEdCSe5jtrch/cSV1UgrJnwUUxDa
+ef0rty2k1Cz66jLdScK5vQ9IPXtamFSvnl0xdE8H/FAh3aTPaE8bEmNtJZlMKpnz
+SDBh+oF8HqcIStw+KxwfGExxqjWMrfhu6DtK2eWUAtaJhBOqbchPM8xQljeSM9xf
+iOefVNlI8JhD1mb9nxc4Q8UBUQvX4yMPFF1bFOdLvt30yNoDN9HWOaEhUTCDsG3X
+ME6WW5HwcCSrv0WBZEMNvSE6Lzzpng3LILVCJ8zab5vuZDCQOc2TZYEhMbUjUDM3
+IuM47fgxMMxF/mL50V0yeUKH32rMVhlATc6qu/m1dkmU8Sf4kaWD5QazYw6A3OAS
+VYCmO2a0OYctyPDQ0RTp5A1NDvZdV3LFOxxHVp3i1fuBYYzMTYCQNFu31xR13NgE
+SJ/AwSiItOkcyqex8Va3e0lMWeUgFaiEAin6OJRpmkkGj80feRQXEgyDet4fsZfu
++Zd4KKTIRJLpfSYFplhym3kT2BFfrsU4YjRosoYwjviQYZ4ybPUHNs2iTG7sijbt
+8uaZFURww3y8nDnAtOFr94MlI1fZEoDlSfB1D++N6xybVCi0ITz8fAr/73trdf+L
+HaAZBav6+CuBQug4urv7qv094PPK306Xlynt8xhW6aWWrL3DkJiy4Pmi1KZHQ3xt
+zwIDAQABo0IwQDAdBgNVHQ4EFgQUVnNYZJX5khqwEioEYnmhQBWIIUkwDgYDVR0P
+AQH/BAQDAgGGMA8GA1UdEwEB/wQFMAMBAf8wDQYJKoZIhvcNAQEMBQADggIBAC9c
+mTz8Bl6MlC5w6tIyMY208FHVvArzZJ8HXtXBc2hkeqK5Duj5XYUtqDdFqij0lgVQ
+YKlJfp/imTYpE0RHap1VIDzYm/EDMrraQKFz6oOht0SmDpkBm+S8f74TlH7Kph52
+gDY9hAaLMyZlbcp+nv4fjFg4exqDsQ+8FxG75gbMY/qB8oFM2gsQa6H61SilzwZA
+Fv97fRheORKkU55+MkIQpiGRqRxOF3yEvJ+M0ejf5lG5Nkc/kLnHvALcWxxPDkjB
+JYOcCj+esQMzEhonrPcibCTRAUH4WAP+JWgiH5paPHxsnnVI84HxZmduTILA7rpX
+DhjvLpr3Etiga+kFpaHpaPi8TD8SHkXoUsCjvxInebnMMTzD9joiFgOgyY9mpFui
+TdaBJQbpdqQACj7LzTWb4OE4y2BThihCQRxEV+ioratF4yUQvNs+ZUH7G6aXD+u5
+dHn5HrwdVw1Hr8Mvn4dGp+smWg9WY7ViYG4A++MnESLn/pmPNPW56MORcr3Ywx65
+LvKRRFHQV80MNNVIIb/bE/FmJUNS0nAiNs2fxBx1IK1jcmMGDw4nztJqDby1ORrp
+0XZ60Vzk50lJLVU3aPAaOpg+VBeHVOmmJ1CJeyAvP/+/oYtKR5j/K3tJPsMpRmAY
+QqszKbrAKbkTidOIijlBO8n9pu0f9GBj39ItVQGL
+-----END CERTIFICATE-----

docker/php/entrypoint.sh

@@ -3,6 +3,15 @@ set -e
 
 cd /var/www/html
 
+# Point PHP/cURL at the system CA bundle and trust Sectigo R36/R46 for Shoraka TLS.
+if [ -f docker/php/php.ini ]; then
+  cp docker/php/php.ini /usr/local/etc/php/conf.d/app.ini
+fi
+if [ -d docker/php/certs ]; then
+  cp docker/php/certs/*.crt /usr/local/share/ca-certificates/ 2>/dev/null || true
+  update-ca-certificates >/dev/null 2>&1 || true
+fi
+
 if [ "${USE_STAGING_ENV:-false}" = "true" ] && [ -f .env.staging ]; then
   cp .env.staging .env
 fi

docker/php/php.ini

@@ -2,3 +2,5 @@ memory_limit=512M
 upload_max_filesize=50M
 post_max_size=50M
 max_execution_time=120
+openssl.cafile=/etc/ssl/certs/ca-certificates.crt
+curl.cainfo=/etc/ssl/certs/ca-certificates.crt

env test

@@ -1,257 +0,0 @@
- APP_NAME=Lumen
-APP_ENV=local
-APP_KEY=WbPGkYNmXZ6ZQplGlvl0iZ7zyW1b09xa
-APP_DEBUG=true
-APP_URL=http://api-arrahn.test
-APP_TIMEZONE=Asia/Kuala_Lumpur
-
-LOG_CHANNEL=stack
-LOG_SLACK_WEBHOOK_URL=
-
-DB_CONNECTION_36=mysql
-DB_HOST_36=127.0.0.1
-DB_PORT_36=3306
-DB_DATABASE_36=arrahn_kb2
-DB_USERNAME_36=root
-DB_PASSWORD_36=
-
-DB_CONNECTION_2=mysql
-DB_HOST_2=127.0.0.1
-DB_PORT_2=3306
-DB_DATABASE_2=arrahn_wcy
-DB_USERNAME_2=root
-DB_PASSWORD_2=
-
-DB_CONNECTION_3=mysql
-DB_HOST_3=127.0.0.1
-DB_PORT_3=3306
-DB_DATABASE_3=arrahn_1stop
-DB_USERNAME_3=root
-DB_PASSWORD_3=
-
-DB_CONNECTION_4=mysql
-DB_HOST_4=127.0.0.1
-DB_PORT_4=3306
-DB_DATABASE_4=arrahn_jlwt
-DB_USERNAME_4=root
-DB_PASSWORD_4=
-
-DB_CONNECTION_5=mysql
-DB_HOST_5=127.0.0.1
-DB_PORT_5=3306
-DB_DATABASE_5=arrahn_wb
-DB_USERNAME_5=root
-DB_PASSWORD_5=
-
-DB_CONNECTION_6=mysql
-DB_HOST_6=127.0.0.1
-DB_PORT_6=3306
-DB_DATABASE_6=arrahn_kls
-DB_USERNAME_6=root
-DB_PASSWORD_6=
-
-DB_CONNECTION_7=mysql
-DB_HOST_7=127.0.0.1
-DB_PORT_7=3306
-DB_DATABASE_7=online_arrahn
-DB_USERNAME_7=root
-DB_PASSWORD_7=
-
-DB_CONNECTION_8=mysql
-DB_HOST_8=127.0.0.1
-DB_PORT_8=3306
-DB_DATABASE_8=arrahn_pp
-DB_USERNAME_8=root
-DB_PASSWORD_8=
-
-DB_CONNECTION_9=mysql
-DB_HOST_9=127.0.0.1
-DB_PORT_9=3306
-DB_DATABASE_9=arrahn_mace
-DB_USERNAME_9=root
-DB_PASSWORD_9= 
-
-DB_CONNECTION_10=mysql
-DB_HOST_10=127.0.0.1
-DB_PORT_10=3306
-DB_DATABASE_10=arrahn_pm                                                                                                   $
-DB_USERNAME_10=root
-DB_PASSWORD_10=
-
-DB_CONNECTION_11=mysql
-DB_HOST_11=127.0.0.1
-DB_PORT_11=3306
-DB_DATABASE_11=arrahn_gm
-DB_USERNAME_11=root
-DB_PASSWORD_11=
-
-DB_CONNECTION_12=mysql
-DB_HOST_12=127.0.0.1
-DB_PORT_12=3306
-DB_DATABASE_12=arrahn_gcl
-DB_USERNAME_12=root
-DB_PASSWORD_12=
-
-DB_CONNECTION_13=mysql
-DB_HOST_13=127.0.0.1
-DB_PORT_13=3306
-DB_DATABASE_13=arrahn_jli
-DB_USERNAME_13=root
-DB_PASSWORD_13=
-
-DB_CONNECTION_14=mysql
-DB_HOST_14=127.0.0.1
-DB_PORT_14=3306
-DB_DATABASE_14=arrahn_rp
-DB_USERNAME_14=root
-DB_PASSWORD_14=
-
-DB_CONNECTION_15=mysql
-DB_HOST_15=127.0.0.1
-DB_PORT_15=3306
-DB_DATABASE_15=arrahn_ktn
-DB_USERNAME_15=root
-DB_PASSWORD_15=
-
-DB_CONNECTION_16=mysql
-DB_HOST_16=127.0.0.1
-DB_PORT_16=3306
-DB_DATABASE_16=arrahn_pg
-DB_USERNAME_16=root
-DB_PASSWORD_16=
-
-DB_CONNECTION_17=mysql
-DB_HOST_17=127.0.0.1
-DB_PORT_17=3306
-DB_DATABASE_17=arrahn_skudai
-DB_USERNAME_17=root
-DB_PASSWORD_17=
-
-DB_CONNECTION_18=mysql
-DB_HOST_18=127.0.0.1
-DB_PORT_18=3306
-DB_DATABASE_18=arrahn_pttn
-DB_USERNAME_18=root
-DB_PASSWORD_18=
-
-DB_CONNECTION_19=mysql
-DB_HOST_19=127.0.0.1
-DB_PORT_19=3306
-DB_DATABASE_19=arrahn_btg
-DB_USERNAME_19=root
-DB_PASSWORD_19=
-
-DB_CONNECTION_20=mysql
-DB_HOST_20=127.0.0.1
-DB_PORT_20=3306
-DB_DATABASE_20=arrahn_raub
-DB_USERNAME_20=root
-DB_PASSWORD_20=
-
-DB_CONNECTION_21=mysql
-DB_HOST_21=127.0.0.1
-DB_PORT_21=3306
-DB_DATABASE_21=arrahn_kgr
-DB_USERNAME_21=root
-DB_PASSWORD_21=
-
-DB_CONNECTION_22=mysql
-DB_HOST_22=127.0.0.1
-DB_PORT_22=3306
-DB_DATABASE_22=arrahn_sdk
-DB_USERNAME_22=root
-DB_PASSWORD_22=
-
-DB_CONNECTION_23=mysql
-DB_HOST_23=127.0.0.1
-DB_PORT_23=3306
-DB_DATABASE_23=arrahn_sp
-DB_USERNAME_23=root
-DB_PASSWORD_23=
-
-DB_CONNECTION_24=mysql
-DB_HOST_24=127.0.0.1
-DB_PORT_24=3306
-DB_DATABASE_24=arrahn_twu
-DB_USERNAME_24=root
-DB_PASSWORD_24=
-
-DB_CONNECTION_25=mysql
-DB_HOST_25=127.0.0.1
-DB_PORT_25=3306
-DB_DATABASE_25=arrahn_api2
-DB_USERNAME_25=root
-DB_PASSWORD_25=
-
-DB_CONNECTION_26=mysql
-DB_HOST_26=127.0.0.1
-DB_PORT_26=3306
-DB_DATABASE_26=arrahn_kjg
-DB_USERNAME_26=root
-DB_PASSWORD_26=
-
-DB_CONNECTION_27=mysql
-DB_HOST_27=127.0.0.1
-DB_PORT_27=3306
-DB_DATABASE_27=arrahn_rl
-DB_USERNAME_27=root
-DB_PASSWORD_27=
-
-DB_CONNECTION_28=mysql
-DB_HOST_28=127.0.0.1
-DB_PORT_28=3306
-DB_DATABASE_28=arrahn_bfort
-DB_USERNAME_28=root
-DB_PASSWORD_28=
-
-DB_CONNECTION_29=mysql
-DB_HOST_29=127.0.0.1
-DB_PORT_29=3306
-DB_DATABASE_29=arrahn_kbelud
-DB_USERNAME_29=root
-DB_PASSWORD_29=
-
-DB_CONNECTION_30=mysql
-DB_HOST_30=127.0.0.1
-DB_PORT_30=3306
-DB_DATABASE_30=arrahn_tuaran
-DB_USERNAME_30=root
-DB_PASSWORD_30=
-
-DB_CONNECTION_31=mysql
-DB_HOST_31=127.0.0.1
-DB_PORT_31=3306
-DB_DATABASE_31=arrahn_kngau
-DB_USERNAME_31=root
-DB_PASSWORD_31=
-
-DB_CONNECTION_32=mysql
-DB_HOST_32=127.0.0.1
-DB_PORT_32=3306
-DB_DATABASE_32=arrahn_tm
-DB_USERNAME_32=root
-DB_PASSWORD_32=
-
-DB_CONNECTION_33=mysql
-DB_HOST_33=127.0.0.1
-DB_PORT_33=3306
-DB_DATABASE_33=arrahn_tmlh
-DB_USERNAME_33=root
-DB_PASSWORD_33=
-
-DB_CONNECTION_34=mysql
-DB_HOST_34=127.0.0.1
-DB_PORT_34=3306
-DB_DATABASE_34=arrahn_semporna
-DB_USERNAME_34=root
-DB_PASSWORD_34=
-
-DB_CONNECTION_35=mysql
-DB_HOST_35=127.0.0.1
-DB_PORT_35=3306
-DB_DATABASE_35=arrahn_kb1
-DB_USERNAME_35=root
-DB_PASSWORD_35=
-
-CACHE_DRIVER=file
-QUEUE_CONNECTION=sync

env.docker.example/base.env

@@ -1,286 +0,0 @@
-APP_NAME=Lumen
-APP_ENV=localhost
-APP_KEY=WbPGkYNmXZ6ZQplGlvl0iZ7zyW1b09xa
-APP_DEBUG=true
-APP_URL=http://apiujrah.arrahn
-APP_TIMEZONE=Asia/Kuala_Lumpur
-
-
-LOG_CHANNEL=stack
-LOG_SLACK_WEBHOOK_URL=
-
-#tukar 12-09-23
-#DB_CONNECTION=mysql
-#DB_HOST=127.0.0.1
-#DB_PORT=3306
-#DB_DATABASE=arrahn_kb2
-#DB_USERNAME=root
-#DB_PASSWORD=secret
-
-DB_CONNECTION_36=mysql
-DB_HOST_36=database_zone1
-DB_PORT_36=3306
-DB_DATABASE_36=arrahn_kb2
-DB_USERNAME_36=root
-DB_PASSWORD_36=secret
-
-DB_CONNECTION_2=mysql
-DB_HOST_2=database_zone1
-DB_PORT_2=3306
-DB_DATABASE_2=arrahn_wcy
-DB_USERNAME_2=root
-DB_PASSWORD_2=secret
-
-DB_CONNECTION_3=mysql
-DB_HOST_3=database_zone1
-DB_PORT_3=3306
-DB_DATABASE_3=arrahn_1stop
-DB_USERNAME_3=root
-DB_PASSWORD_3=secret
-
-DB_CONNECTION_4=mysql
-DB_HOST_4=database_zone1
-DB_PORT_4=3306
-DB_DATABASE_4=arrahn_jlwt
-DB_USERNAME_4=root
-DB_PASSWORD_4=secret
-
-DB_CONNECTION_5=mysql
-DB_HOST_5=database_zone1
-DB_PORT_5=3306
-DB_DATABASE_5=arrahn_wb
-DB_USERNAME_5=root
-DB_PASSWORD_5=secret
-
-DB_CONNECTION_6=mysql
-DB_HOST_6=database_zone1
-DB_PORT_6=3306
-DB_DATABASE_6=arrahn_kls
-DB_USERNAME_6=root
-DB_PASSWORD_6=secret
-
-DB_CONNECTION_7=mysql
-DB_HOST_7=database_zone1
-DB_PORT_7=3306
-DB_DATABASE_7=online_arrahn
-DB_USERNAME_7=root
-DB_PASSWORD_7=secret
-
-DB_CONNECTION_8=mysql
-DB_HOST_8=database_zone1
-DB_PORT_8=3306
-DB_DATABASE_8=arrahn_pp
-DB_USERNAME_8=root
-DB_PASSWORD_8=secret
-
-DB_CONNECTION_9=mysql
-DB_HOST_9=database_zone1
-DB_PORT_9=3306
-DB_DATABASE_9=arrahn_mace
-DB_USERNAME_9=root
-DB_PASSWORD_9=secret
-
-DB_CONNECTION_10=mysql
-DB_HOST_10=database_zone1
-DB_PORT_10=3306
-DB_DATABASE_10=arrahn_pm
-DB_USERNAME_10=root
-DB_PASSWORD_10=secret
-
-DB_CONNECTION_11=mysql
-DB_HOST_11=database_zone1
-DB_PORT_11=3306
-DB_DATABASE_11=arrahn_gm
-DB_USERNAME_11=root
-DB_PASSWORD_11=secret
-
-DB_CONNECTION_12=mysql
-DB_HOST_12=database_zone1
-DB_PORT_12=3306
-DB_DATABASE_12=arrahn_gcl
-DB_USERNAME_12=root
-DB_PASSWORD_12=secret
-
-DB_CONNECTION_13=mysql
-DB_HOST_13=database_zone1
-DB_PORT_13=3306
-DB_DATABASE_13=arrahn_jli
-DB_USERNAME_13=root
-DB_PASSWORD_13=secret
-
-DB_CONNECTION_14=mysql
-DB_HOST_14=database_zone1
-DB_PORT_14=3306
-DB_DATABASE_14=arrahn_rp
-DB_USERNAME_14=root
-DB_PASSWORD_14=secret
-
-DB_CONNECTION_15=mysql
-DB_HOST_15=database_zone2
-DB_PORT_15=3306
-DB_DATABASE_15=arrahn_ktn
-DB_USERNAME_15=root
-DB_PASSWORD_15=secret
-
-DB_CONNECTION_16=mysql
-DB_HOST_16=database_zone2
-DB_PORT_16=3306
-DB_DATABASE_16=arrahn_pg
-DB_USERNAME_16=root
-DB_PASSWORD_16=secret
-
-DB_CONNECTION_17=mysql
-DB_HOST_17=database_zone2
-DB_PORT_17=3306
-DB_DATABASE_17=arrahn_skudai
-DB_USERNAME_17=root
-DB_PASSWORD_17=secret
-
-DB_CONNECTION_18=mysql
-DB_HOST_18=database_zone2
-DB_PORT_18=3306
-DB_DATABASE_18=arrahn_pttn
-DB_USERNAME_18=root
-DB_PASSWORD_18=secret
-
-DB_CONNECTION_19=mysql
-DB_HOST_19=database_zone2
-DB_PORT_19=3306
-DB_DATABASE_19=arrahn_btg
-DB_USERNAME_19=root
-DB_PASSWORD_19=secret
-
-DB_CONNECTION_20=mysql
-DB_HOST_20=database_zone2
-DB_PORT_20=3306
-DB_DATABASE_20=arrahn_raub
-DB_USERNAME_20=root
-DB_PASSWORD_20=secret
-
-DB_CONNECTION_21=mysql
-DB_HOST_21=database_zone2
-DB_PORT_21=3306
-DB_DATABASE_21=arrahn_kgr
-DB_USERNAME_21=root
-DB_PASSWORD_21=secret
-
-DB_CONNECTION_22=mysql
-DB_HOST_22=database_zone2
-DB_PORT_22=3306
-DB_DATABASE_22=arrahn_sdk
-DB_USERNAME_22=root
-DB_PASSWORD_22=secret
-
-DB_CONNECTION_23=mysql
-DB_HOST_23=database_zone2
-DB_PORT_23=3306
-DB_DATABASE_23=arrahn_sp
-DB_USERNAME_23=root
-DB_PASSWORD_23=secret
-
-DB_CONNECTION_24=mysql
-DB_HOST_24=database_zone2
-DB_PORT_24=3306
-DB_DATABASE_24=arrahn_twu
-DB_USERNAME_24=root
-DB_PASSWORD_24=secret
-
-DB_CONNECTION_25=mysql
-DB_HOST_25=database_zone2
-DB_PORT_25=3306
-DB_DATABASE_25=arrahn_api2
-DB_USERNAME_25=root
-DB_PASSWORD_25=secret
-
-DB_CONNECTION_26=mysql
-DB_HOST_26=database_zone2
-DB_PORT_26=3306
-DB_DATABASE_26=arrahn_kjg
-DB_USERNAME_26=root
-DB_PASSWORD_26=secret
-
-DB_CONNECTION_27=mysql
-DB_HOST_27=database_zone2
-DB_PORT_27=3306
-DB_DATABASE_27=arrahn_rl
-DB_USERNAME_27=root
-DB_PASSWORD_27=secret
-
-DB_CONNECTION_28=mysql
-DB_HOST_28=database_zone2
-DB_PORT_28=3306
-DB_DATABASE_28=arrahn_bfort
-DB_USERNAME_28=root
-DB_PASSWORD_28=secret
-
-DB_CONNECTION_29=mysql
-DB_HOST_29=database_zone2
-DB_PORT_29=3306
-DB_DATABASE_29=arrahn_kbelud
-DB_USERNAME_29=root
-DB_PASSWORD_29=secret
-
-DB_CONNECTION_30=mysql
-DB_HOST_30=database_zone2
-DB_PORT_30=3306
-DB_DATABASE_30=arrahn_tuaran
-DB_USERNAME_30=root
-DB_PASSWORD_30=secret
-
-DB_CONNECTION_31=mysql
-DB_HOST_31=database_zone2
-DB_PORT_31=3306
-DB_DATABASE_31=arrahn_kngau
-DB_USERNAME_31=root
-DB_PASSWORD_31=secret
-
-DB_CONNECTION_32=mysql
-DB_HOST_32=database_zone1
-DB_PORT_32=3306
-DB_DATABASE_32=arrahn_tm
-DB_USERNAME_32=root
-DB_PASSWORD_32=secret
-
-DB_CONNECTION_33=mysql
-DB_HOST_33=database_zone2
-DB_PORT_33=3306
-DB_DATABASE_33=arrahn_tmlh
-DB_USERNAME_33=root
-DB_PASSWORD_33=secret
-
-
-DB_CONNECTION_34=mysql
-DB_HOST_34=database_zone2
-DB_PORT_34=3306
-DB_DATABASE_34=arrahn_semporna
-DB_USERNAME_34=root
-DB_PASSWORD_34=secret
-
-DB_CONNECTION_35=mysql
-DB_HOST_35=database_zone1
-DB_PORT_35=3306
-DB_DATABASE_35=arrahn_kb1
-DB_USERNAME_35=root
-DB_PASSWORD_35=secret
-
-#DB_CONNECTION_37=mysql
-#DB_HOST_37=database_zone2
-#DB_PORT_37=3306
-#DB_DATABASE_37=arrahn_ld
-#DB_USERNAME_37=root
-#DB_PASSWORD_37=secret
-
-DB_CONNECTION_38=mysql
-DB_HOST_38=database_zone2
-DB_PORT_38=3306
-DB_DATABASE_38=arrahn_pttn2
-DB_USERNAME_38=root
-DB_PASSWORD_38=secret
-
-CACHE_DRIVER=file
-QUEUE_CONNECTION=database
-
-WABOT_API=https://app.wabot.my/api/send.php
-WABOT_INSTANCES_ID=67B69A20D329B
-WABOT_TOKEN_KEYS=66a08339284bc
-ACTIVE_JOB_SERVER=true

env.docker.example/kgmk.env

@@ -1,54 +0,0 @@
-APP_NAME=Lumen
-APP_ENV=localhost
-APP_KEY=WbPGkYNmXZ6ZQplGlvl0iZ7zyW1b09xa
-APP_DEBUG=true
-APP_URL=http://apiujrah.arrahn
-APP_TIMEZONE=Asia/Kuala_Lumpur
-
-
-LOG_CHANNEL=stack
-LOG_SLACK_WEBHOOK_URL=
-
-#tukar 12-09-23
-#DB_CONNECTION=mysql
-#DB_HOST=127.0.0.1
-#DB_PORT=3306
-#DB_DATABASE=arrahn_kb2
-#DB_USERNAME=root
-#DB_PASSWORD=secret
-
-DB_CONNECTION_2=mysql
-DB_HOST_2=database_zone_franchise
-DB_PORT_2=3306
-DB_DATABASE_2=kguru_kb
-DB_USERNAME_2=root
-DB_PASSWORD_2=secret
-
-DB_CONNECTION_3=mysql
-DB_HOST_3=database_zone_franchise
-DB_PORT_3=3306
-DB_DATABASE_3=Kguru_melor
-DB_USERNAME_3=root
-DB_PASSWORD_3=secret
-
-DB_CONNECTION_4=mysql
-DB_HOST_4=database_zone_franchise
-DB_PORT_4=3306
-DB_DATABASE_4=kguru_tumpat
-DB_USERNAME_4=root
-DB_PASSWORD_4=secret
-
-DB_CONNECTION_7=mysql
-DB_HOST_7=database_zone_franchise
-DB_PORT_7=3306
-DB_DATABASE_7=master_koopguru
-DB_USERNAME_7=root
-DB_PASSWORD_7=secret
-
-CACHE_DRIVER=file
-QUEUE_CONNECTION=database
-
-WABOT_API=https://app.wabot.my/api/send.php
-WABOT_INSTANCES_ID=67B69A20D329B
-WABOT_TOKEN_KEYS=66a08339284bc
-ACTIVE_JOB_SERVER=true

env.docker.example/krk.env

@@ -1,54 +0,0 @@
-APP_NAME=Lumen
-APP_ENV=localhost
-APP_KEY=WbPGkYNmXZ6ZQplGlvl0iZ7zyW1b09xa
-APP_DEBUG=true
-APP_URL=http://apiujrah.arrahn
-APP_TIMEZONE=Asia/Kuala_Lumpur
-
-
-LOG_CHANNEL=stack
-LOG_SLACK_WEBHOOK_URL=
-
-#tukar 12-09-23
-#DB_CONNECTION=mysql
-#DB_HOST=127.0.0.1
-#DB_PORT=3306
-#DB_DATABASE=arrahn_kb2
-#DB_USERNAME=root
-#DB_PASSWORD=secret
-
-DB_CONNECTION_3=mysql
-DB_HOST_3=database-zone-franchise
-DB_PORT_3=3306
-DB_DATABASE_3=krk_losong
-DB_USERNAME_3=root
-DB_PASSWORD_3=secret
-
-DB_CONNECTION_4=mysql
-DB_HOST_4=database-zone-franchise
-DB_PORT_4=3306
-DB_DATABASE_4=krk_kemaman
-DB_USERNAME_4=root
-DB_PASSWORD_4=secret
-
-DB_CONNECTION_5=mysql
-DB_HOST_5=database-zone-franchise
-DB_PORT_5=3306
-DB_DATABASE_5=krk_tokbali
-DB_USERNAME_5=root
-DB_PASSWORD_5=secret
-
-DB_CONNECTION_7=mysql
-DB_HOST_7=database-zone-franchise
-DB_PORT_7=3306
-DB_DATABASE_7=master_krk
-DB_USERNAME_7=root
-DB_PASSWORD_7=secret
-
-CACHE_DRIVER=file
-QUEUE_CONNECTION=database
-
-WABOT_API=https://app.wabot.my/api/send.php
-WABOT_INSTANCES_ID=67B69A20D329B
-WABOT_TOKEN_KEYS=66a08339284bc
-ACTIVE_JOB_SERVER=true

routes/web.php

@@ -25,7 +25,10 @@ $router->get('/health', function () {
     return response()->json(['status' => 'ok']);
 });
 
-$router->group(['namespace' => '\Rap2hpoutre\LaravelLogViewer'], function() use ($router) {
+$router->group([
+    'namespace' => '\Rap2hpoutre\LaravelLogViewer',
+    'middleware' => 'logviewer.password',
+], function () use ($router) {
     $router->get('logs', 'LogViewerController@index');
 });
 
@@ -116,6 +119,19 @@ $router->group(['prefix'=>'api'], function () use ($router){
     $router->get('gadai/list/rekod/old',['uses'=>'GadaiController@rekodGadaian']);
     $router->get('gadai/online/search/detail',['uses'=>'GadaiController@searchGadaiOnline']);
 
+    $router->get('shoraka/readiness', ['uses' => 'ShorakaGadaiController@readiness']);
+    $router->get('shoraka/transactions', ['uses' => 'ShorakaController@index']);
+    $router->get('shoraka/gadai/{kodcaw}/{norujukan}', ['uses' => 'ShorakaGadaiController@showGadai']);
+    $router->post('shoraka/gadai/{kodcaw}/{norujukan}/submit', ['uses' => 'ShorakaGadaiController@submitGadai']);
+    $router->post('shoraka/gadai/{kodcaw}/{norujukan}/refresh', ['uses' => 'ShorakaGadaiController@refreshGadai']);
+    $router->get('shoraka/gadai/{kodcaw}/{norujukan}/certificate', ['uses' => 'ShorakaGadaiController@certificateGadai']);
+
+    // Shoraka Commodity API
+    $router->post('shoraka/orders',['uses' => 'ShorakaController@submit']);
+    $router->post('shoraka/orders/{norujukan}/refresh', ['uses' => 'ShorakaController@refresh']);
+    $router->get('shoraka/orders/{norujukan}/certificate', ['uses' => 'ShorakaController@certificate']);
+    $router->post('shoraka/callback', ['uses' => 'ShorakaController@callback']);
+
     $router->get('check/serah/gadai',['uses'=>'GadaiController@checkSerahGadaian']);
     $router->get('check/serah/tebus',['uses'=>'TebusController@checkSerahTebus']);
     $router->get('check/serah/lelong',['uses'=>'LelongController@checkSerahLelong']);
@@ -580,6 +596,8 @@ $router->group(['prefix'=>'api'], function () use ($router){
     $router->get('CalculationPendahuluanSerahan/{kodcaw}',['uses'=>'VaultController@CalculationPendahuluanSerahan']);
     $router->get('KeuntunganArRahn/{kodcaw}',['uses'=>'GadaiController@CalculationKeuntungan']);
     $router->get('RebetCalculation/{kodcaw}',['uses'=>'TebusController@RebetCalculation']);
+    $router->get('RebetPromoCalculation/{kodcaw}',['uses'=>'TebusController@RebetPromoCalculation']);
+    $router->get('PelarasanRebate/{kodcaw}',['uses'=>'TebusController@PelarasanRebate']);
 
     //-- Harta Semasa --//
     $router->get('PinjamanDiberi/{kodcaw}',['uses'=>'GadaiController@CalculationPinjamanDiberi']);
@@ -607,8 +625,10 @@ $router->group(['prefix'=>'api'], function () use ($router){
 
     //Dua-Dua Table
     $router->get('PendahuluanSerahanLejer/{kodcaw}',['uses'=>'VaultController@CalculationPendahuluanSerahanLejer']);
+    $router->get('ModalOnlineLejer/{kodcaw}', ['uses' => 'VaultController@CalculationModalOnlineLejer']);
     $router->get('KeuntunganArRahnLejer/{kodcaw}',['uses'=>'GadaiController@CalculationKeuntunganLejer']);
     $router->get('RebetCalculationLejer/{kodcaw}',['uses'=>'TebusController@RebetCalculationLejer']);
+    $router->get('RebetPromoCalculationLejer/{kodcaw}',['uses'=>'TebusController@RebetPromoCalculationLejer']);
     $router->get('cajlelongLejer/{kodcaw}',['uses'=>'LelongController@cajlelongcalculationLejer']);
 
     // //-- Harta Semasa --//
@@ -695,6 +715,9 @@ $router->group(['prefix'=>'api'], function () use ($router){
     $router->get('initiate/modal-online', ['uses' => 'ModalOnlineController@initiate']);
 
     // Operasi kelulusan pembiayaan online (must be before {kodcaw} routes)
+    $router->get('whatsapp/webhook', ['uses' => 'WhatsappWebhookController@verify']);
+    $router->post('whatsapp/webhook', ['uses' => 'WhatsappWebhookController@handle']);
+
     $router->get('pembiayaan-online/operasi/batches', ['uses' => 'PembiayaanOnlineController@operasiListBatches']);
     $router->get('pembiayaan-online/operasi/{kodcaw}/batches/{batchId}', ['uses' => 'PembiayaanOnlineController@operasiShowBatch']);
     $router->post('pembiayaan-online/operasi/{kodcaw}/lines/{id}/approve', ['uses' => 'PembiayaanOnlineController@operasiApproveLine']);
@@ -709,7 +732,12 @@ $router->group(['prefix'=>'api'], function () use ($router){
     $router->get('pembiayaan-online/{kodcaw}/paid', ['uses' => 'PembiayaanOnlineController@paidQueue']);
     $router->post('pembiayaan-online/{kodcaw}/paid/blast', ['uses' => 'PembiayaanOnlineController@markBlastSent']);
     $router->put('pembiayaan-online/{kodcaw}/lines/{id}', ['uses' => 'PembiayaanOnlineController@updateLine']);
+    $router->post('pembiayaan-online/{kodcaw}/lines/{id}/verify', ['uses' => 'PembiayaanOnlineController@verifyLine']);
+    $router->post('pembiayaan-online/{kodcaw}/lines/{id}/unverify', ['uses' => 'PembiayaanOnlineController@unverifyLine']);
     $router->get('pembiayaan-online/{kodcaw}/lines/{id}/bukti', ['uses' => 'PembiayaanOnlineController@getBukti']);
+    $router->get('pembiayaan-online/{kodcaw}/lines/{id}/bukti-akaun', ['uses' => 'PembiayaanOnlineController@getBuktiAkaun']);
+    $router->get('pembiayaan-online/{kodcaw}/lines/{id}/borang', ['uses' => 'PembiayaanOnlineController@getBorang']);
+    $router->get('pembiayaan-online/{kodcaw}/lines/{id}', ['uses' => 'PembiayaanOnlineController@showLine']);
     $router->get('pembiayaan-online/{kodcaw}/batches', ['uses' => 'PembiayaanOnlineController@listBatches']);
     $router->get('pembiayaan-online/{kodcaw}/batches/{batchId}', ['uses' => 'PembiayaanOnlineController@showBatch']);
     $router->post('pembiayaan-online/{kodcaw}/batches/submit', ['uses' => 'PembiayaanOnlineController@submitBatch']);

tests/ShorakaGadaiTest.php

@@ -0,0 +1,124 @@
+<?php
+
+require_once __DIR__ . '/ShorakaIntegrationTest.php';
+
+use Illuminate\Support\Facades\DB;
+use Illuminate\Support\Facades\Schema;
+use Illuminate\Database\Schema\Blueprint;
+use Illuminate\Support\Facades\Http;
+use App\ShorakaTransaction;
+
+class ShorakaGadaiTest extends ShorakaIntegrationTest
+{
+    protected function setUp(): void
+    {
+        parent::setUp();
+        foreach (['mysql7', 'branch_test'] as $connection) {
+            $this->app['config']->set('database.connections.' . $connection, [
+                'driver' => 'sqlite', 'database' => ':memory:', 'prefix' => '',
+            ]);
+            DB::purge($connection);
+        }
+        Schema::connection('mysql7')->create('arrahn_master_db', function (Blueprint $table) {
+            $table->string('kodcaw'); $table->string('mysql');
+        });
+        Schema::connection('mysql7')->create('customer', function (Blueprint $table) {
+            $table->string('kpbaru'); $table->string('kplama')->nullable(); $table->string('nama');
+        });
+        Schema::connection('mysql7')->create('komuditi_transaksi', function (Blueprint $table) {
+            $table->string('norujukan');
+        });
+        Schema::connection('branch_test')->create('gadai', function (Blueprint $table) {
+            $table->string('norujukan'); $table->string('nokp'); $table->string('kodcaw');
+            $table->decimal('pinjaman', 15, 2); $table->decimal('hargajualan', 15, 2);
+            $table->integer('tagserah')->default(0);
+            $table->integer('tagkomuditi')->default(0); $table->integer('cetak')->default(0);
+            $table->string('sttebus')->default('');
+        });
+        DB::connection('mysql7')->table('arrahn_master_db')->insert([
+            ['kodcaw' => 'KB2', 'mysql' => 'branch_test'],
+            ['kodcaw' => 'KB3', 'mysql' => 'branch_test'],
+        ]);
+        DB::connection('mysql7')->table('customer')->insert(['kpbaru' => 'IC-1', 'nama' => 'Nama Database']);
+        DB::connection('branch_test')->table('gadai')->insert([
+            'norujukan' => 'SAG-001', 'kodcaw' => 'KB2', 'nokp' => 'IC-1',
+            'pinjaman' => 1000, 'hargajualan' => 1200,
+        ]);
+    }
+
+    public function testBranchSubmissionUsesDatabaseAmountsAndSynchronizesTag(): void
+    {
+        $this->fakeResponse(['orderId' => '9999', 'status' => 'Completed']);
+        $this->json('POST', '/api/shoraka/gadai/KB2/SAG-001/submit', [
+            'order_amount' => 1, 'ownership' => 'Tampered',
+        ])->seeStatusCode(200);
+        Http::assertSent(function ($request) {
+            return $request['order_amount'] === '1000.00'
+                && $request['murabaha_amount'] === '1200.00'
+                && $request['ownership'] === 'Nama Database'
+                && (int) $request['tenor_other'] === 12;
+        });
+        $this->assertSame('KB2', ShorakaTransaction::first()->kodcaw);
+        $this->assertEquals(1, DB::connection('branch_test')->table('gadai')->value('tagkomuditi'));
+        $this->json('GET', '/api/shoraka/gadai/KB2/SAG-001')->seeJson(['can_complete' => true]);
+    }
+
+    public function testPendingOrderKeepsTagUnsetAndBlocksSag(): void
+    {
+        $this->fakeResponse(['orderId' => '9999', 'status' => 'Active']);
+        $this->json('POST', '/api/shoraka/gadai/KB2/SAG-001/submit')->seeStatusCode(200);
+        $this->assertEquals(0, DB::connection('branch_test')->table('gadai')->value('tagkomuditi'));
+        $this->json('PUT', '/api/gadai/norujukan/cetak/KB2/SAG-001')->seeStatusCode(409);
+    }
+
+    public function testLegacyPurchaseCannotBeSubmittedAgain(): void
+    {
+        DB::connection('mysql7')->table('komuditi_transaksi')->insert(['norujukan' => 'SAG-001']);
+        Http::fake();
+        $this->json('POST', '/api/shoraka/gadai/KB2/SAG-001/submit')->seeStatusCode(409);
+        Http::assertNothingSent();
+    }
+
+    public function testChangedFinancingCannotBeCompleted(): void
+    {
+        $record = $this->transaction('Completed');
+        $record->update(['kodcaw' => 'KB2']);
+        DB::connection('branch_test')->table('gadai')->update(['pinjaman' => 900]);
+        $this->json('GET', '/api/shoraka/gadai/KB2/SAG-001')->seeJson(['can_complete' => false]);
+        $this->json('GET', '/api/shoraka/gadai/KB2/SAG-001/certificate')->seeStatusCode(409);
+    }
+
+    public function testDifferentBranchCannotReadOrder(): void
+    {
+        $record = $this->transaction('Completed');
+        $record->update(['kodcaw' => 'KB2']);
+        $this->json('GET', '/api/shoraka/gadai/KB3/SAG-001')->seeStatusCode(404);
+    }
+
+    public function testHistoricalFinancingWithoutCommodityLedgerCanStillBeHandedOver(): void
+    {
+        Http::fake();
+        $this->json('PUT', '/api/gadai/norujukan/serah/KB2/SAG-001')->seeStatusCode(200);
+        $this->assertEquals(1, DB::connection('branch_test')->table('gadai')->value('tagserah'));
+        Http::assertNothingSent();
+    }
+
+    public function testSubmittedContractCannotBeRegisteredAgain(): void
+    {
+        $this->transaction('Completed')->update(['kodcaw' => 'KB2']);
+        Http::fake();
+        $this->json('PUT', '/api/gadai/norujukan/KB2/SAG-001', [
+            'kodcaw' => 'KB2', 'norujukan' => 'SAG-001',
+        ])->seeStatusCode(409);
+        Http::assertNothingSent();
+    }
+
+    public function testShorakaOrderCannotUpdateOrCancelLegacyStock(): void
+    {
+        $this->transaction('Completed')->update(['kodcaw' => 'KB2']);
+        Http::fake();
+        $this->json('PUT', '/api/komuditi/update', ['norujukan' => 'SAG-001'])->seeStatusCode(409);
+        $this->json('PUT', '/api/komuditi/batal', ['norujukan' => 'SAG-001'])->seeStatusCode(409);
+        Http::assertNothingSent();
+    }
+}

tests/ShorakaIntegrationTest.php

@@ -0,0 +1,260 @@
+<?php
+
+use App\Services\ShorakaService;
+use App\ShorakaTransaction;
+use Illuminate\Support\Facades\DB;
+use Illuminate\Support\Facades\Http;
+use Illuminate\Http\Client\Factory;
+use Illuminate\Support\Facades\Log;
+
+class ShorakaIntegrationTest extends TestCase
+{
+    protected function setUp(): void
+    {
+        parent::setUp();
+        $this->app['config']->set('services.shoraka', [
+            'base_url' => 'https://shoraka.test',
+            'api_id' => 'API_ID',
+            'secret_key' => 'SECRET_KEY',
+            'timeout' => 5,
+        ]);
+        // All database writes stay in memory; never run migrations on branch databases.
+        $this->app['config']->set('database.default', 'shoraka_test');
+        $this->app['config']->set('database.connections.shoraka_test', [
+            'driver' => 'sqlite', 'database' => ':memory:', 'prefix' => '',
+        ]);
+        DB::purge('shoraka_test');
+        require_once __DIR__ . '/../database/migrations/2026_09_15_094818_create_shoraka_transactions_table.php';
+        (new CreateShorakaTransactionsTable())->up();
+        require_once __DIR__ . '/../database/migrations/2026_10_05_120000_add_kodcaw_to_shoraka_transactions.php';
+        (new AddKodcawToShorakaTransactions())->up();
+        require_once __DIR__ . '/../database/migrations/2026_10_26_130000_add_teller_to_shoraka_transactions.php';
+        (new AddTellerToShorakaTransactions())->up();
+        Http::swap(new Factory());
+        // Fail any HTTP request that a test did not explicitly stub.
+        Log::shouldReceive('error')->zeroOrMoreTimes();
+    }
+
+    protected function fakeResponse($body, array $headers = [], int $status = 200): void
+    {
+        Http::fake(function ($request) use ($body, $headers, $status) {
+            $this->assertStringStartsWith('https://shoraka.test/api/', $request->url());
+            return Http::response($body, $status, $headers);
+        });
+    }
+
+    protected function submission(): array
+    {
+        return [
+            'norujukan' => 'SAG-001', 'ownership' => 'Abu Samad',
+            'order_amount' => '1000.00', 'murabaha_amount' => '1200.00',
+            'tenor_other' => 6,
+        ];
+    }
+
+    protected function transaction(string $status = 'Active', $orderId = '9999'): ShorakaTransaction
+    {
+        return ShorakaTransaction::create([
+            'norujukan' => 'SAG-001', 'order_id' => $orderId, 'status' => $status,
+            'product_type' => 'FINANCING', 'commodity_type' => '000-COPPER',
+            'ownership_name' => 'Abu Samad', 'order_amount' => '1000.00',
+            'murabaha_amount' => '1200.00', 'attempt_count' => 1,
+        ]);
+    }
+
+    protected function callbackPayload(): array
+    {
+        // Published signature example, v1.5 page 14.
+        return [
+            'apiId' => 'API_ID', 'orderId' => '9999', 'status' => 'Completed',
+            'bankName' => 'Test Bank Bhd', 'ownershipName' => 'Abu Samad',
+            'commodityType' => '000-COPPER', 'unit' => 'Tonne', 'volume' => '245.678901',
+            'productType' => 'FINANCING', 'valueDate' => '08/12/2025', 'cancelDate' => '',
+            'orderType' => 'Buy & Sell', 'orderCurrency' => 'MYR',
+            'orderAmount' => '1000000.00', 'murabahaAmount' => '1000000.00',
+            'tenor' => 'O/N', 'tenorOther' => '', 'tenorOtherUnit' => '',
+            'signature' => 'bbc6f59e9c64aea9e30f3c03d30f63e8fc37898d2699c0cdd41e416a518aa122',
+        ];
+    }
+
+    public function testSubmitSignatureMatchesPublishedExample(): void
+    {
+        $this->fakeResponse(['orderId' => '12345', 'status' => 'Completed']);
+        (new ShorakaService())->submitOrder([
+            'product_type' => 'DEPOSIT', 'commodity_type' => '000-COPPER',
+            'ownership' => 'Abu Samad', 'value_date' => '10/11/2022',
+            'order_currency' => 'MYR', 'order_amount' => 1000000,
+            'murabaha_amount' => 1000000, 'tenor' => 'O/N',
+            'order_type' => 'Buy & Sell', 'ownership_doc_no' => 'SAG-001',
+        ]);
+        Http::assertSent(function ($request) {
+            return $request->method() === 'POST'
+                && $request->url() === 'https://shoraka.test/api/submitorder'
+                && $request->hasHeader('Content-Type', 'application/x-www-form-urlencoded')
+                && $request['order_amount'] === '1000000.00'
+                && $request['ownership_doc_no'] === 'SAG-001'
+                && $request['signature'] === '43970ac7a5c3867133af0dd92fd5eef9a7b415ebdb8b0d1025d4686bc25693bd';
+        });
+    }
+
+    public function testStatusUsesPublishedSignatureAndChecksOrderIdentity(): void
+    {
+        $this->fakeResponse(['orderId' => '12345', 'status' => 'Active']);
+        (new ShorakaService())->orderStatus('12345');
+        Http::assertSent(function ($request) {
+            return $request->method() === 'POST'
+                && $request->url() === 'https://shoraka.test/api/orderstatus'
+                && $request['signature'] === 'add9890b2a08cf47290e8869d4a25b7f4b73cb075c20aa95aa47d1bbfe6b62fc';
+        });
+        $this->expectException(RuntimeException::class);
+        (new ShorakaService())->orderStatus('another-order');
+    }
+
+    public function testCallbackSignatureMatchesPublishedExampleAndRejectsTampering(): void
+    {
+        $service = new ShorakaService();
+        $payload = $this->callbackPayload();
+        $this->assertTrue($service->validCallback($payload));
+        foreach (ShorakaService::CALLBACK_FIELDS as $field) {
+            $changed = $payload;
+            $changed[$field] .= 'x';
+            $this->assertFalse($service->validCallback($changed), $field);
+            $missing = $payload;
+            unset($missing[$field]);
+            $this->assertFalse($service->validCallback($missing), $field);
+        }
+        $payload['apiId'] = 'wrong';
+        $this->assertFalse($service->validCallback($payload));
+    }
+
+    public function testSubmitPersistsOrderAndRejectsDuplicate(): void
+    {
+        $this->fakeResponse(['orderId' => '9999', 'status' => 'Completed']);
+        $this->json('POST', '/api/shoraka/orders', $this->submission())->seeStatusCode(200);
+        $record = ShorakaTransaction::first();
+        $this->assertSame('9999', $record->order_id);
+        $this->assertSame('Completed', $record->status);
+        $this->assertNotNull($record->completed_at);
+        $this->assertArrayNotHasKey('signature', $record->request_payload);
+        $this->assertSame('OTHERS', $record->request_payload['tenor']);
+        $this->json('POST', '/api/shoraka/orders', $this->submission())->seeStatusCode(409);
+        Http::assertSentCount(1);
+    }
+
+    public function testAmbiguousFailureBlocksResubmissionAndHidesUpstreamBody(): void
+    {
+        $this->fakeResponse('SECRET_KEY confidential', [], 500);
+        $this->json('POST', '/api/shoraka/orders', $this->submission())->seeStatusCode(502);
+        $this->assertStringNotContainsString('SECRET_KEY', $this->response->getContent());
+        $record = ShorakaTransaction::first();
+        $this->assertSame('UNKNOWN', $record->status);
+        $this->assertStringNotContainsString('SECRET_KEY', $record->error_message);
+        $this->json('POST', '/api/shoraka/orders', $this->submission())->seeStatusCode(409);
+        Http::assertSentCount(1);
+    }
+
+    public function testPendingSubmissionCannotBeSubmittedAgain(): void
+    {
+        $this->transaction('PENDING', null);
+        Http::fake();
+        $this->json('POST', '/api/shoraka/orders', $this->submission())->seeStatusCode(409);
+        Http::assertNothingSent();
+    }
+
+    public function testRefreshUpdatesStatus(): void
+    {
+        $record = $this->transaction();
+        $this->fakeResponse(['orderId' => '9999', 'status' => 'Completed']);
+        $this->json('POST', '/api/shoraka/orders/SAG-001/refresh')->seeStatusCode(200);
+        $this->assertSame('Completed', $record->fresh()->status);
+        $this->assertNotNull($record->fresh()->completed_at);
+    }
+
+    public function testCallbackAcknowledgesAndUsesCurrentStatusNotUnsignedFields(): void
+    {
+        $record = $this->transaction();
+        $payload = $this->callbackPayload();
+        $payload['certificateUrl'] = 'https://untrusted.test/file';
+        $payload['ownershipDocNo'] = 'other-reference';
+        $this->fakeResponse([
+            'orderId' => '9999', 'status' => 'Cancelled',
+            'certificateUrl' => 'https://shoraka.test/certificate/9999',
+        ]);
+        $this->json('POST', '/api/shoraka/callback', $payload)->seeStatusCode(200);
+        $this->assertSame('OK', $this->response->getContent());
+        $this->assertSame('Cancelled', $record->fresh()->status);
+        $this->assertSame('https://shoraka.test/certificate/9999', $record->fresh()->certificate_url);
+        $this->assertArrayNotHasKey('signature', $record->fresh()->callback_payload);
+        // Repeated delivery is acknowledged without creating another order.
+        $this->json('POST', '/api/shoraka/callback', $payload)->seeStatusCode(200);
+        $this->assertSame(1, ShorakaTransaction::count());
+    }
+
+    public function testInvalidCallbackDoesNotMutateOrCallUpstream(): void
+    {
+        $record = $this->transaction();
+        Http::fake();
+        $payload = $this->callbackPayload();
+        $payload['status'] = 'Cancelled';
+        $this->json('POST', '/api/shoraka/callback', $payload)->seeStatusCode(401);
+        $this->assertSame('Active', $record->fresh()->status);
+        Http::assertNothingSent();
+    }
+
+    public function testUnknownCallbackIsNotAcknowledged(): void
+    {
+        Http::fake();
+        $this->json('POST', '/api/shoraka/callback', $this->callbackPayload())->seeStatusCode(404);
+        Http::assertNothingSent();
+    }
+
+    public function testFailedCallbackRefreshPreservesRecord(): void
+    {
+        $record = $this->transaction();
+        $this->fakeResponse('unavailable', [], 503);
+        $this->json('POST', '/api/shoraka/callback', $this->callbackPayload())->seeStatusCode(502);
+        $this->assertSame('Active', $record->fresh()->status);
+        $this->assertNull($record->fresh()->callback_payload);
+    }
+
+    public function testCertificateReturnsPdfFromFixedEndpoint(): void
+    {
+        $this->transaction('Completed', '12345');
+        $pdf = "%PDF-1.4\nexample";
+        $this->fakeResponse($pdf, ['Content-Type' => 'application/pdf']);
+        $this->get('/api/shoraka/orders/SAG-001/certificate')->seeStatusCode(200);
+        $this->assertSame($pdf, $this->response->getContent());
+        $this->assertSame('application/pdf', $this->response->headers->get('Content-Type'));
+        Http::assertSent(function ($request) {
+            return $request->method() === 'POST'
+                && $request->url() === 'https://shoraka.test/api/certificate'
+                && $request['signature'] === 'add9890b2a08cf47290e8869d4a25b7f4b73cb075c20aa95aa47d1bbfe6b62fc';
+        });
+    }
+
+    public function testCertificateRejectsNonPdf(): void
+    {
+        $this->transaction();
+        $this->fakeResponse(['error' => 'not ready']);
+        $this->get('/api/shoraka/orders/SAG-001/certificate')->seeStatusCode(502);
+    }
+
+    public function testMissingCredentialsPreventRequests(): void
+    {
+        $this->app['config']->set('services.shoraka.secret_key', '');
+        Http::fake();
+        $this->json('POST', '/api/shoraka/orders', $this->submission())->seeStatusCode(503);
+        $this->json('POST', '/api/shoraka/callback', $this->callbackPayload())->seeStatusCode(503);
+        $this->assertSame(0, ShorakaTransaction::count());
+        Http::assertNothingSent();
+    }
+
+    public function testMissingOrderIdCannotBeRefreshedOrDownloaded(): void
+    {
+        $this->transaction('UNKNOWN', null);
+        Http::fake();
+        $this->json('POST', '/api/shoraka/orders/SAG-001/refresh')->seeStatusCode(409);
+        $this->get('/api/shoraka/orders/SAG-001/certificate')->seeStatusCode(409);
+        Http::assertNothingSent();
+    }
+}