fix: exclude lanjut and ansuran from stok audit khas blast

Reviewed-on: #24
Co-authored-by: ISMAIL MASSERAN <ismail@koppkb.com>
Co-committed-by: ISMAIL MASSERAN <ismail@koppkb.com>

.env.docker

@@ -68,4 +68,15 @@ KAUNTER_URL=http://host.docker.internal:8081
 INTERNAL_NOTIFICATION_SECRET=erahn-local-notification-secret
 
 CACHE_DRIVER=file
-QUEUE_CONNECTION=sync
+QUEUE_CONNECTION=sync
+
+BSAS_BASE_URL=https://bsasdevapi.bursamalaysia.com/api
+BSAS_TOKEN_URL=https://bsasdevapi.bursamalaysia.com/oauth/token
+BSAS_CLIENT_ID=
+BSAS_CLIENT_SECRET=
+BSAS_MEMBER_SHORT_NAME=KOOPPKB
+BSAS_PRODUCT_CODE=CPO-MSIA-09
+BSAS_TENOR=00088
+BSAS_MAX_WAIT_TIME=10
+BSAS_HTTP_TIMEOUT=30
+BSAS_ORDER_RESULT_RETRIES=2

.env.example

@@ -107,4 +107,15 @@ WHATSAPP_TEMPLATE=hello_world
 WHATSAPP_TEMPLATE_LANG=en_US
 WHATSAPP_VERIFY_TOKEN= # webhook verify token
 WHATSAPP_APP_SECRET= # X-Hub-Signature-256 checks; need to be enable first
-ADMIN_PHONE_NUMBER=60193450165
+ADMIN_PHONE_NUMBER=60193450165
+
+BSAS_BASE_URL=https://bsasdevapi.bursamalaysia.com/api
+BSAS_TOKEN_URL=https://bsasdevapi.bursamalaysia.com/oauth/token
+BSAS_CLIENT_ID=
+BSAS_CLIENT_SECRET=
+BSAS_MEMBER_SHORT_NAME=KOOPPKB
+BSAS_PRODUCT_CODE=CPO-MSIA-09
+BSAS_TENOR=00088
+BSAS_MAX_WAIT_TIME=10
+BSAS_HTTP_TIMEOUT=30
+BSAS_ORDER_RESULT_RETRIES=2

.env.staging

@@ -13,7 +13,7 @@ MYSQL_PUBLISH_PORT=3308
 LOG_CHANNEL=stack
 LOG_LEVEL=debug
 LOG_SLACK_WEBHOOK_URL=
-LOGVIEWER_PASSWORD=
+LOGVIEWER_PASSWORD=test123
 
 DB_CONNECTION=mysql
 DB_HOST=mysql

.gitea/workflows/deploy-staging.yml

@@ -1,6 +1,9 @@
 name: Deploy to Staging
 
 on:
+  push:
+    tags:
+      - "v*"
   workflow_dispatch:
     inputs:
       image_tag:
@@ -18,10 +21,22 @@ jobs:
     runs-on: host
 
     steps:
+      - name: Resolve image tag
+        id: resolve
+        run: |
+          set -e
+          if [ "${{ gitea.event_name }}" = "workflow_dispatch" ]; then
+            IMAGE_TAG="${{ inputs.image_tag }}"
+          else
+            IMAGE_TAG="${{ gitea.ref_name }}"
+          fi
+          echo "IMAGE_TAG=${IMAGE_TAG}" >> "$GITHUB_OUTPUT"
+          echo "Deploying image tag: ${IMAGE_TAG}"
+
       - name: Checkout repository
         uses: actions/checkout@v4
         with:
-          ref: ${{ inputs.image_tag }}
+          ref: ${{ steps.resolve.outputs.IMAGE_TAG }}
 
       - name: Login to Docker registry
         run: |
@@ -33,43 +48,47 @@ jobs:
       - name: Verify image exists in registry
         run: |
           set -e
-          IMAGE_TAG="${{ inputs.image_tag }}"
+          IMAGE_TAG="${{ steps.resolve.outputs.IMAGE_TAG }}"
           IMAGE="${APP_IMAGE}:${IMAGE_TAG}"
 
           echo "Checking if image exists: ${IMAGE}"
-          if ! docker manifest inspect "${IMAGE}" > /dev/null 2>&1; then
-            echo "ERROR: Image ${IMAGE} does not exist in registry!"
-            echo "Run the Build Docker Image workflow first."
-            exit 1
-          fi
-          echo "✓ ${IMAGE} found"
+          # Tag pushes build in parallel — wait for the image to appear
+          for i in $(seq 1 30); do
+            if docker manifest inspect "${IMAGE}" > /dev/null 2>&1; then
+              echo "✓ ${IMAGE} found"
+              exit 0
+            fi
+            echo "Image not ready yet (attempt ${i}/30), waiting 20s..."
+            sleep 20
+          done
+
+          echo "ERROR: Image ${IMAGE} does not exist in registry after waiting!"
+          echo "Run the Build Docker Image workflow first."
+          exit 1
 
       - name: Pull Docker image
         run: |
           set -e
-          IMAGE_TAG="${{ inputs.image_tag }}"
+          IMAGE_TAG="${{ steps.resolve.outputs.IMAGE_TAG }}"
           docker pull "${APP_IMAGE}:${IMAGE_TAG}"
           echo "✓ Image pulled successfully"
 
       - name: Sync compose file and deploy
         run: |
           set -e
-          IMAGE_TAG="${{ inputs.image_tag }}"
+          IMAGE_TAG="${{ steps.resolve.outputs.IMAGE_TAG }}"
 
           mkdir -p "${DEPLOY_DIR}/docker/nginx" "${DEPLOY_DIR}/docker/mysql"
           cp docker-compose.staging.yml "${DEPLOY_DIR}/docker-compose.yml"
           cp docker/nginx/default.conf "${DEPLOY_DIR}/docker/nginx/default.conf"
           cp -R docker/mysql/init "${DEPLOY_DIR}/docker/mysql/"
 
-          if [ ! -f "${DEPLOY_DIR}/.env.staging" ]; then
-            if [ -f .env.staging ]; then
-              cp .env.staging "${DEPLOY_DIR}/.env.staging"
-              echo "Copied .env.staging from repo (first deploy). Edit ${DEPLOY_DIR}/.env.staging on the server if needed."
-            else
-              echo "ERROR: ${DEPLOY_DIR}/.env.staging is missing on the server"
-              exit 1
-            fi
+          if [ ! -f .env.staging ]; then
+            echo "ERROR: .env.staging is missing in the repository"
+            exit 1
           fi
+          cp .env.staging "${DEPLOY_DIR}/.env.staging"
+          echo "✓ Synced .env.staging from repo"
 
           cd "${DEPLOY_DIR}"
 

app/BsasOrder.php

@@ -0,0 +1,44 @@
+<?php
+
+namespace App;
+
+use Illuminate\Database\Eloquent\Model;
+
+class BsasOrder extends Model
+{
+    protected $connection = 'mysql7';
+    protected $table = 'bsas_orders';
+
+    protected $fillable = [
+        'uuid',
+        'norujukan',
+        'kodcaw',
+        'serial_number',
+        'product_code',
+        'bid_value',
+        'otc_murabaha_value',
+        'otc_counter_party',
+        'status',
+        'status_code',
+        'status_message',
+        'e_cert_no',
+        'bid_ecert_response',
+        'otc_ecert_response',
+        'stb_ecert_response',
+        'request_payload',
+        'order_response',
+        'result_response',
+        'created_by',
+    ];
+
+    protected $casts = [
+        'bid_value' => 'decimal:2',
+        'otc_murabaha_value' => 'decimal:2',
+        'request_payload' => 'array',
+        'order_response' => 'array',
+        'result_response' => 'array',
+        'bid_ecert_response' => 'array',
+        'otc_ecert_response' => 'array',
+        'stb_ecert_response' => 'array',
+    ];
+}

app/Customer.php

@@ -63,7 +63,8 @@ class Customer extends Model
         'nota_pekerjaan',
         'tagpelanggan',
         'tag_anggota',
-        'gambar_mykad'
+        'gambar_mykad',
+        'scan_ic'
     ];
 
     /**

app/Http/Controllers/CustomerController.php

@@ -370,6 +370,7 @@ class CustomerController extends Controller
         ]);
 
         $this->attachMykadPhoto($customer, $request);
+        $this->attachIcScan($customer, $request);
 
         $audit = new Audit();
         $audit->users = $request->teller;
@@ -1160,6 +1161,81 @@ public function AdminsearchCustomerBySAG(Request $request)
         ], 200);
     }
 
+    /**
+     * Store or replace the scanned IC / passport document for a customer.
+     */
+    public function storeIcScan($ic, Request $request)
+    {
+        $customer = Customer::on('mysql7')
+            ->where('kplama', '=', $ic)
+            ->orWhere('kpbaru', '=', $ic)
+            ->first();
+
+        if (!$customer) {
+            return response()->json(['error' => 'Customer not found.', 'stored' => false], 404);
+        }
+
+        $fileId = $this->storeCustomerDocument(
+            $this->fileBase64FromRequest($request),
+            $request->input('file_mime', $request->json('file_mime')),
+            $request->input('filename', $request->json('filename')),
+            $customer,
+            'scan-ic',
+            4 * 1024 * 1024
+        );
+
+        if (!$fileId) {
+            return response()->json([
+                'error' => 'Fail scan IC tidak sah. Sila muat naik JPG, PNG atau PDF (maks 4MB).',
+                'stored' => false,
+            ], 422);
+        }
+
+        Customer::on('mysql7')
+            ->where('kpbaru', $customer->kpbaru)
+            ->where('kplama', $customer->kplama)
+            ->update(['scan_ic' => $fileId]);
+
+        $customer->scan_ic = $fileId;
+
+        return response()->json([
+            'message' => 'Scan dokumen IC berjaya dimuat naik.',
+            'scan_ic' => $customer->scan_ic,
+            'has_scan_ic' => true,
+            'stored' => true,
+        ], 200);
+    }
+
+    public function showIcScan($ic)
+    {
+        $customer = Customer::on('mysql7')
+            ->where('kplama', '=', $ic)
+            ->orWhere('kpbaru', '=', $ic)
+            ->first();
+
+        if (!$customer) {
+            return response()->json(['error' => 'Customer not found.'], 404);
+        }
+
+        if (empty($customer->scan_ic)) {
+            return response()->json(['error' => 'Scan IC belum dimuat naik.'], 404);
+        }
+
+        $file = ARFiles::on('mysql7')->where('id', $customer->scan_ic)->first();
+        if (!$file || empty($file->data)) {
+            return response()->json(['error' => 'Fail scan IC tidak dijumpai.'], 404);
+        }
+
+        return response()->json([
+            'file' => [
+                'data' => $file->data,
+                'type' => $file->type ?: 'application/octet-stream',
+                'filename' => $file->filename ?: 'scan-ic',
+            ],
+            'has_scan_ic' => true,
+        ]);
+    }
+
     /**
      * Save MyKad photo into arrahn_files and link it on customer.gambar_mykad.
      */
@@ -1191,6 +1267,41 @@ public function AdminsearchCustomerBySAG(Request $request)
         }
     }
 
+    protected function attachIcScan($customer, Request $request)
+    {
+        if (!$customer) {
+            return;
+        }
+
+        $raw = $this->fileBase64FromRequest($request);
+        if ($raw === '') {
+            return;
+        }
+
+        try {
+            $fileId = $this->storeCustomerDocument(
+                $raw,
+                $request->input('file_mime', $request->json('file_mime')),
+                $request->input('filename', $request->json('filename')),
+                $customer,
+                'scan-ic',
+                4 * 1024 * 1024
+            );
+            if (!$fileId) {
+                return;
+            }
+
+            Customer::on('mysql7')
+                ->where('kpbaru', $customer->kpbaru)
+                ->where('kplama', $customer->kplama)
+                ->update(['scan_ic' => $fileId]);
+
+            $customer->scan_ic = $fileId;
+        } catch (\Throwable $e) {
+            Log::error('Failed to attach IC scan: ' . $e->getMessage());
+        }
+    }
+
     protected function photoBase64FromRequest(Request $request)
     {
         $raw = $request->input('photo_base64');
@@ -1254,20 +1365,102 @@ public function AdminsearchCustomerBySAG(Request $request)
         $payload = $customer->toArray();
         $payload['photo_base64'] = null;
         $payload['photo_mime'] = null;
+        $payload['has_scan_ic'] = !empty($customer->scan_ic);
+        $payload['scan_ic'] = $customer->scan_ic;
+        $payload['scan_ic_mime'] = null;
+        $payload['scan_ic_filename'] = null;
 
-        if (empty($customer->gambar_mykad)) {
-            return $payload;
+        if (!empty($customer->scan_ic)) {
+            $scanFile = ARFiles::on('mysql7')->select('type', 'filename')->where('id', $customer->scan_ic)->first();
+            if ($scanFile) {
+                $payload['scan_ic_mime'] = $scanFile->type ?: null;
+                $payload['scan_ic_filename'] = $scanFile->filename ?: null;
+            }
         }
 
-        $file = ARFiles::on('mysql7')->where('id', $customer->gambar_mykad)->first();
-        if ($file && $file->data) {
-            $payload['photo_base64'] = $file->data;
-            $payload['photo_mime'] = $file->type ?: 'image/jpeg';
+        if (!empty($customer->gambar_mykad)) {
+            $file = ARFiles::on('mysql7')->where('id', $customer->gambar_mykad)->first();
+            if ($file && $file->data) {
+                $payload['photo_base64'] = $file->data;
+                $payload['photo_mime'] = $file->type ?: 'image/jpeg';
+            }
         }
 
         return $payload;
     }
 
+    protected function fileBase64FromRequest(Request $request)
+    {
+        $raw = $request->input('file_base64');
+        if ($raw === null || $raw === '') {
+            $raw = $request->json('file_base64');
+        }
+        if ($raw === null || $raw === '') {
+            $raw = $this->photoBase64FromRequest($request);
+        }
+
+        return is_string($raw) ? $raw : '';
+    }
+
+    protected function storeCustomerDocument($raw, $mime, $filename, $customer, $fallbackName, $maxBytes)
+    {
+        $commaPos = strpos($raw, ',');
+        if ($commaPos !== false) {
+            $raw = substr($raw, $commaPos + 1);
+        }
+        $raw = preg_replace('/\s+/', '', $raw);
+
+        if ($raw === '') {
+            return null;
+        }
+
+        $decoded = base64_decode($raw, true);
+        if ($decoded === false || $decoded === '') {
+            Log::warning('Customer document skipped: invalid base64');
+            return null;
+        }
+
+        if (strlen($decoded) > $maxBytes) {
+            Log::warning('Customer document skipped: payload too large');
+            return null;
+        }
+
+        $allowed = [
+            'image/jpeg' => 'jpg',
+            'image/jpg' => 'jpg',
+            'image/png' => 'png',
+            'application/pdf' => 'pdf',
+        ];
+        $finfo = finfo_open(FILEINFO_MIME_TYPE);
+        $detected = $finfo ? finfo_buffer($finfo, $decoded) : false;
+        if ($finfo) {
+            finfo_close($finfo);
+        }
+        $detected = strtolower((string) ($detected ?: ''));
+        $claimed = strtolower((string) ($mime ?: ''));
+        if (isset($allowed[$detected])) {
+            $mime = $detected;
+        } elseif (isset($allowed[$claimed]) && ($claimed === 'image/jpg' || $claimed === $detected)) {
+            $mime = $claimed;
+        } else {
+            return null;
+        }
+
+        $nric = preg_replace('/[^0-9A-Za-z]/', '', (string) ($customer->kpbaru ?: $customer->kplama ?: ''));
+        $ext = $allowed[$mime];
+        $safeName = $filename ? pathinfo((string) $filename, PATHINFO_FILENAME) : '';
+        $safeName = preg_replace('/[^0-9A-Za-z_-]/', '', $safeName);
+
+        $file = new ARFiles();
+        $file->data = $raw;
+        $file->filename = ($nric !== '' ? $nric . '-' : '') . ($safeName !== '' ? $safeName : $fallbackName) . '.' . $ext;
+        $file->type = $mime;
+        $file->tarikhmasa = Carbon::now()->toDateTimeString();
+        $file->save();
+
+        return $file->id;
+    }
+
 //     public function createNotaArcc($kodcaw, Request $request)
 // {
 //     $current = Carbon::now();

app/Http/Controllers/KomuditiController.php

@@ -3,15 +3,18 @@
 namespace App\Http\Controllers;
 
 use App\Audit;
+use App\BsasOrder;
 use App\Komuditi;
 use App\KomuditiPurchase;
 use App\KomuditiTransaksi;
 use App\KomuditiProduk;
 use App\Cawangan;
+use App\Services\Bsas\BsasOrderService;
 use DB;
 
 use Illuminate\Http\Request;
 use Carbon\Carbon;
+use Illuminate\Support\Facades\Log;
 
 class KomuditiController extends Controller
 {
@@ -338,4 +341,195 @@ class KomuditiController extends Controller
         return response()->json($rekodkomoditi);
     }
 
+    /**
+     * List BSAS commodity orders for operasi rekod view.
+     */
+    public function listBsasOrders(Request $request)
+    {
+        $query = BsasOrder::on('mysql7')
+            ->select([
+                'id',
+                'uuid',
+                'norujukan',
+                'kodcaw',
+                'serial_number',
+                'product_code',
+                'bid_value',
+                'otc_murabaha_value',
+                'otc_counter_party',
+                'status',
+                'status_code',
+                'status_message',
+                'e_cert_no',
+                'bid_ecert_response',
+                'otc_ecert_response',
+                'stb_ecert_response',
+                'created_by',
+                'created_at',
+                'updated_at',
+            ])
+            ->orderBy('created_at', 'desc')
+            ->orderBy('id', 'desc');
+
+        if ($request->filled('status')) {
+            $query->where('status', $request->input('status'));
+        }
+
+        if ($request->filled('kodcaw')) {
+            $query->where('kodcaw', $request->input('kodcaw'));
+        }
+
+        if ($request->filled('limit_view')) {
+            $query->limit((int) $request->input('limit_view'));
+        }
+
+        $rows = $query->get()->map(function (BsasOrder $order) {
+            $payload = $order->toArray();
+            $payload['has_bid_ecert'] = !empty($order->bid_ecert_response);
+            $payload['has_otc_ecert'] = !empty($order->otc_ecert_response);
+            $payload['has_stb_ecert'] = !empty($order->stb_ecert_response);
+            unset($payload['bid_ecert_response'], $payload['otc_ecert_response'], $payload['stb_ecert_response']);
+
+            return $payload;
+        });
+
+        return response()->json($rows);
+    }
+
+    /**
+     * SAG-ready komoditi/product payload from confirmed BSAS order for a norujukan.
+     * Replaces daily KomuditiPurchase lookup for per-Terima BSAS purchases.
+     */
+    public function getBsasOrderByNorujukan($norujukan)
+    {
+        $order = BsasOrder::on('mysql7')
+            ->where('norujukan', $norujukan)
+            ->where('status', 'confirmed')
+            ->orderBy('id', 'desc')
+            ->first();
+
+        if (!$order) {
+            return response()->json(['message' => 'BSAS order tidak dijumpai untuk norujukan ini.'], 404);
+        }
+
+        $otc = is_array($order->otc_ecert_response) ? $order->otc_ecert_response : [];
+        $productCode = (string) ($order->product_code ?: config('bsas.product_code'));
+        $description = trim((string) ($otc['PNAME'] ?? ''));
+        if ($description === '') {
+            $produk = KomuditiProduk::on('mysql7')->where('kodproduk', $productCode)->first();
+            $description = $produk ? (string) $produk->description : $productCode;
+        }
+
+        $price = (float) ($otc['PRICE_MYR_EQUIVALENT'] ?? $otc['PRICE'] ?? 0);
+        $volume = (float) ($otc['PVOLUME'] ?? 0);
+        $pinjaman = (float) $order->bid_value;
+        if ($volume <= 0 && $price > 0 && $pinjaman > 0) {
+            $volume = round($pinjaman / $price, 4);
+        }
+
+        return response()->json([
+            'source' => 'bsas',
+            'uuid' => $order->uuid,
+            'komoditi' => [
+                'no_sijil' => $order->e_cert_no ?: $order->uuid,
+                'kodproduct' => $productCode,
+                'nilai' => $price > 0 ? $price : null,
+            ],
+            'product' => [
+                'product_code' => $productCode,
+                'kodproduk' => $productCode,
+                'description' => $description,
+                'unit' => 'TAN',
+            ],
+            'kuantiti' => $volume,
+        ]);
+    }
+
+    /**
+     * Return stored BSAS eCert payload only (no live BSAS refresh).
+     */
+    public function getBsasOrderEcert($uuid)
+    {
+        $order = BsasOrder::on('mysql7')->where('uuid', $uuid)->first();
+
+        if (!$order) {
+            return response()->json(['message' => 'BSAS order tidak dijumpai.'], 404);
+        }
+
+        if (empty($order->bid_ecert_response) && empty($order->otc_ecert_response) && empty($order->stb_ecert_response)) {
+            return response()->json(['message' => 'eCert belum tersedia untuk order ini.'], 404);
+        }
+
+        return response()->json([
+            'uuid' => $order->uuid,
+            'norujukan' => $order->norujukan,
+            'e_cert_no' => $order->e_cert_no,
+            'serial_number' => $order->serial_number,
+            'product_code' => $order->product_code,
+            'bid_value' => $order->bid_value,
+            'otc_murabaha_value' => $order->otc_murabaha_value,
+            'otc_counter_party' => $order->otc_counter_party,
+            'bid_ecert' => $order->bid_ecert_response,
+            'otc_ecert' => $order->otc_ecert_response,
+            'stb_ecert' => $order->stb_ecert_response,
+        ]);
+    }
+
+    /**
+     * Place BSAS commodity order for a gadai Terima, long-poll result, fetch eCert.
+     */
+    public function placeBsasOrder(Request $request)
+    {
+        try {
+            $service = new BsasOrderService();
+            $order = $service->placeAndConfirm([
+                'norujukan' => $request->input('norujukan'),
+                'kodcaw' => $request->input('kodcaw'),
+                'pinjaman' => $request->input('pinjaman'),
+                'hargajualan' => $request->input('hargajualan'),
+                'nama_pelanggan' => $request->input('nama_pelanggan'),
+                'teller' => $request->input('teller'),
+            ]);
+
+            return response()->json([
+                'message' => 'BSAS order confirmed',
+                'order' => $order,
+            ], 200);
+        } catch (\Throwable $e) {
+            Log::error('BSAS place order failed', [
+                'norujukan' => $request->input('norujukan'),
+                'error' => $e->getMessage(),
+            ]);
+
+            return response()->json([
+                'message' => $e->getMessage() ?: 'Gagal pembelian komoditi BSAS.',
+            ], 422);
+        }
+    }
+
+    /**
+     * Re-query BSAS orderResult / retry eCert by stored uuid.
+     */
+    public function getBsasOrder($uuid)
+    {
+        try {
+            $service = new BsasOrderService();
+            $order = $service->refreshByUuid($uuid);
+
+            return response()->json([
+                'message' => 'OK',
+                'order' => $order,
+            ], 200);
+        } catch (\Throwable $e) {
+            Log::error('BSAS refresh order failed', [
+                'uuid' => $uuid,
+                'error' => $e->getMessage(),
+            ]);
+
+            return response()->json([
+                'message' => $e->getMessage() ?: 'Gagal semak status BSAS.',
+            ], 422);
+        }
+    }
+
 }

app/Http/Controllers/MarhunController.php

@@ -3,6 +3,7 @@
 namespace App\Http\Controllers;
 
 use App\Marhun;
+use App\Gadai;
 use App\Jemas;
 use App\Cawangan;
 use Illuminate\Http\Request;
@@ -160,39 +161,53 @@ class MarhunController extends Controller
 
         $cawangan = Cawangan::on('mysql7')->where('kodcaw','=',$kodcaw)->first();
 
-        $old_data = Marhun::on($cawangan['mysql'])->where([['recno','=',$request->recno],['norujukan','=',$norujukan]])->first();
+        // Lock the parent first so concurrent edits to this SAG are serialized.
+        (new Marhun)->setConnection($cawangan['mysql'])->getConnection()->transaction(function () use ($cawangan, $norujukan, $request, $harga, $nilai_marhun, $kodcaw, $current) {
+            Gadai::on($cawangan['mysql'])->where('norujukan', $norujukan)->lockForUpdate()->firstOrFail();
+            $old_data = Marhun::on($cawangan['mysql'])->where([['recno','=',$request->recno],['norujukan','=',$norujukan]])->firstOrFail();
 
-        $marhunToUpdate = [
-            'karat' => $request->karat,
-            'marhun' => $request->marhun,
-            'nota' => $request->nota,
-            'tag_permata' => $request->tag_permata,
-            'berat_batu_permata' => $request->berat_batu_permata,
-            'berat' => $request->berat,
-            'harga' => $harga['harga'],
-            'n_marhun' => $nilai_marhun,
-            'bil' => $request->kuantiti,
-        ];
+            $marhunToUpdate = [
+                'karat' => $request->karat,
+                'marhun' => $request->marhun,
+                'nota' => $request->nota,
+                'tag_permata' => $request->tag_permata,
+                'berat_batu_permata' => $request->berat_batu_permata,
+                'berat' => $request->berat,
+                'harga' => $harga['harga'],
+                'n_marhun' => $nilai_marhun,
+                'bil' => $request->kuantiti,
+            ];
 
-        // Set value berat_batu_permata to null if value passed is null
-        if($marhunToUpdate['berat_batu_permata'] == '') {
-            $marhunToUpdate['berat_batu_permata'] = null;
-        };
+            // Set value berat_batu_permata to null if value passed is null
+            if($marhunToUpdate['berat_batu_permata'] == '') {
+                $marhunToUpdate['berat_batu_permata'] = null;
+            };
 
-        $jemas = Marhun::on($cawangan['mysql'])->where([['recno','=',$request->recno],['norujukan','=',$norujukan]])->update($marhunToUpdate);
+            $jemas = Marhun::on($cawangan['mysql'])->where([['recno','=',$request->recno],['norujukan','=',$norujukan]])->update($marhunToUpdate);
 
-        $new_data = Marhun::on($cawangan['mysql'])->where([['recno','=',$request->recno],['norujukan','=',$norujukan]])->first();
+            // Recalculate from every item belonging to this SAG, after the edit.
+            $totals = Marhun::on($cawangan['mysql'])->where('norujukan', $norujukan)
+                ->selectRaw('COALESCE(SUM(berat), 0) AS total_berat, COALESCE(SUM(n_marhun), 0) AS total_nilai, COALESCE(SUM(bil), 0) AS total_kuantiti')
+                ->first();
+            Gadai::on($cawangan['mysql'])->where('norujukan', $norujukan)->update([
+                'berat' => $totals->total_berat,
+                'nilaimarhun' => $totals->total_nilai,
+                'kuantiti' => $totals->total_kuantiti,
+            ]);
 
-        $audit = new Audit();
-        $audit->users = $request->teller;
-        $audit->actions = 'Ubah Marhun';
-        $audit->norujukan = $norujukan;
-        $audit->old_data = $old_data;
-        $audit->new_data = $new_data;
-        $audit->kodcaw = $kodcaw;
-        $audit->created_at = $current;
-        $audit->updated_at = $current;
-        $audit->save();
+            $new_data = Marhun::on($cawangan['mysql'])->where([['recno','=',$request->recno],['norujukan','=',$norujukan]])->first();
+
+            $audit = new Audit();
+            $audit->users = $request->teller;
+            $audit->actions = 'Ubah Marhun';
+            $audit->norujukan = $norujukan;
+            $audit->old_data = $old_data;
+            $audit->new_data = $new_data;
+            $audit->kodcaw = $kodcaw;
+            $audit->created_at = $current;
+            $audit->updated_at = $current;
+            $audit->save();
+        });
 
         return response('Edit Successfully', 200);
     }

app/Http/Controllers/PembiayaanOnlineController.php

@@ -62,6 +62,7 @@ class PembiayaanOnlineController extends Controller
             'kodbank', 'noakaun', 'nama_bank', 'nama_akaun', 'nota',
             'bukti_akaun_file_id', 'borang_file_id', 'update_customer_bank',
             'bukti_akaun_data', 'bukti_akaun_filename', 'bukti_akaun_type',
+            'borang_data', 'borang_filename', 'borang_type',
         ] as $key) {
             if ($request->has($key)) {
                 $input[$key] = $request->input($key);
@@ -214,6 +215,14 @@ class PembiayaanOnlineController extends Controller
         return $this->respond($this->service->getBuktiAkaun($kodcaw, $id));
     }
 
+    /**
+     * GET /api/pembiayaan-online/{kodcaw}/lines/{id}/borang
+     */
+    public function getBorang($kodcaw, $id)
+    {
+        return $this->respond($this->service->getBorang($kodcaw, $id));
+    }
+
     /**
      * GET /api/pembiayaan-online/{kodcaw}/paid?blast_sent=0
      */

app/Http/Controllers/StokAuditController.php

@@ -53,7 +53,6 @@ class StokAuditController extends Controller
         $hinggatempoh = $request->hinggatempoh;
         $cawangan = Cawangan::on('mysql7')->where('kodcaw', '=', $request->kodcaw)->first();
 
-        // Query asal gadai
         $audit = Gadai::on($cawangan['mysql'])
             ->where([
                 ['tagpalsu', '=', 0],
@@ -66,47 +65,7 @@ class StokAuditController extends Controller
             ->orderBy('sirig', 'ASC')
             ->get();
 
-        // Dapatkan semua norujukan awal
-        $arraynorujukan = $audit->pluck('norujukan')->toArray();
-
-        // Dapatkan tarikh terkini untuk setiap norujukan ikut trans_type T
-        $tarikhTerkiniT = Transaction::on('mysql7')
-            ->select('norujukan', DB::raw('MAX(created_at) as tarikh_max'))
-            ->where('trans_type', 'T')
-            ->whereIn('norujukan', $arraynorujukan)
-            ->groupBy('norujukan')
-            ->pluck('tarikh_max', 'norujukan')
-            ->toArray();
-
-        // Dapatkan tarikh terkini untuk setiap norujukan ikut trans_type A
-        $tarikhTerkiniA = Transaction::on('mysql7')
-            ->select('norujukan', DB::raw('MAX(created_at) as tarikh_max'))
-            ->where('trans_type', 'A')
-            ->whereIn('norujukan', $arraynorujukan)
-            ->groupBy('norujukan')
-            ->pluck('tarikh_max', 'norujukan')
-            ->toArray();
-    
-        // Filter audit ikut tarikh masing-masing
-        $rekodaudit = $audit->filter(function ($item) use ($tarikhTerkiniT, $tarikhTerkiniA) {
-            $norujukan = $item->norujukan;
-
-            $adaTebusTerkini = isset($tarikhTerkiniT[$norujukan]) &&
-                Transaction::on('mysql7')
-                ->where('norujukan', $norujukan)
-                ->where('trans_type', 'T')
-                ->whereDate('created_at', '>=', date('Y-m-d', strtotime($tarikhTerkiniT[$norujukan])))
-                ->exists();
-
-            $adaAnsuranTerkini = isset($tarikhTerkiniA[$norujukan]) &&
-                Transaction::on('mysql7')
-                ->where('norujukan', $norujukan)
-                ->where('trans_type', 'A')
-                ->whereDate('created_at', '>=', date('Y-m-d', strtotime($tarikhTerkiniA[$norujukan])))
-                ->exists();
-
-            return !$adaTebusTerkini && !$adaAnsuranTerkini;
-        })->values();
+        $rekodaudit = $this->filterRekodAuditKhas($audit);
 
         // Gunakan hanya norujukan yang dah ditapis
         $arraynorujukan = $rekodaudit->pluck('norujukan')->toArray();
@@ -179,13 +138,17 @@ class StokAuditController extends Controller
         $audit = Gadai::on($cawangan['mysql'])
             ->where([['tagpalsu','=',0],['tempoh','>=',$daritempoh],['tempoh','<=',$hinggatempoh],['sttebus','=',''],['taglel','=',0]])
             ->orderBy('t_gadai', 'ASC')
-            ->orderBy('sirig', 'ASC');
-            // ->get();
-        // dd($audit);
-        $rekodaudit = $audit->get();
-        $arraynorujukan = $audit->pluck('norujukan')->toArray();
+            ->orderBy('sirig', 'ASC')
+            ->get();
+
+        $rekodaudit = $this->filterRekodAuditKhas($audit);
+        $arraynorujukan = $rekodaudit->pluck('norujukan')->toArray();
         $keybynorujukan = $rekodaudit->keyBy('norujukan');
-        
+
+        if (empty($arraynorujukan)) {
+            return response()->json('success');
+        }
+
         $gadainokp = Gadai::on($cawangan['mysql'])->whereIn('norujukan', $arraynorujukan)
         ->select('nokp')
         ->groupBy('nokp')
@@ -261,12 +224,17 @@ class StokAuditController extends Controller
         $audit = Gadai::on($cawangan['mysql'])
             ->where([['tagpalsu','=',0],['tempoh','>=',$daritempoh],['tempoh','<=',$hinggatempoh],['sttebus','=',''],['taglel','=',0]])
             ->orderBy('t_gadai', 'ASC')
-            ->orderBy('sirig', 'ASC');
+            ->orderBy('sirig', 'ASC')
+            ->get();
 
-        $rekodaudit = $audit->get();
-        $arraynorujukan = $audit->pluck('norujukan')->toArray();
+        $rekodaudit = $this->filterRekodAuditKhas($audit);
+        $arraynorujukan = $rekodaudit->pluck('norujukan')->toArray();
         $keybynorujukan = $rekodaudit->keyBy('norujukan');
-        
+
+        if (empty($arraynorujukan)) {
+            return response()->json('success');
+        }
+
         $gadainokp = Gadai::on($cawangan['mysql'])->whereIn('norujukan', $arraynorujukan)
         // ->select('nokp')
         // ->groupBy('nokp')
@@ -441,7 +409,6 @@ class StokAuditController extends Controller
 
         $cawangan = Cawangan::on('mysql7')->where('kodcaw', '=', $request->kodcaw)->first();
 
-        // Ambil semua rekod gadai asas
         $audit = Gadai::on($cawangan['mysql'])
             ->where([
                 ['tagpalsu', '=', 0],
@@ -450,52 +417,10 @@ class StokAuditController extends Controller
                 ['sttebus', '=', ''],
                 ['taglel', '=', 0],
             ])
-            ->orderBy('norujukan', 'ASC')   // susun ikut norujukan
+            ->orderBy('norujukan', 'ASC')
             ->get();
 
-        $arraynorujukan = $audit->pluck('norujukan')->toArray();
-
-        // Tarikh terkini ikut trans_type T
-        $tarikhTerkiniT = Transaction::on('mysql7')
-            ->select('norujukan', DB::raw('MAX(created_at) as tarikh_max'))
-            ->where('trans_type', 'T')
-            ->whereIn('norujukan', $arraynorujukan)
-            ->groupBy('norujukan')
-            ->pluck('tarikh_max', 'norujukan')
-            ->toArray();
-
-        // Tarikh terkini ikut trans_type A
-        $tarikhTerkiniA = Transaction::on('mysql7')
-            ->select('norujukan', DB::raw('MAX(created_at) as tarikh_max'))
-            ->where('trans_type', 'A')
-            ->whereIn('norujukan', $arraynorujukan)
-            ->groupBy('norujukan')
-            ->pluck('tarikh_max', 'norujukan')
-            ->toArray();
-
-        // Filter audit
-        $rekodaudit = $audit->filter(function ($item) use ($tarikhTerkiniT, $tarikhTerkiniA) {
-            if ($item->lelong_tawarruq == 0) {
-                return true;
-            }
-            $norujukan = $item->norujukan;
-
-            $adaTebusTerkini = isset($tarikhTerkiniT[$norujukan]) &&
-                Transaction::on('mysql7')
-                    ->where('norujukan', $norujukan)
-                    ->where('trans_type', 'T')
-                    ->whereDate('created_at', '>=', date('Y-m-d', strtotime($tarikhTerkiniT[$norujukan])))
-                    ->exists();
-
-            $adaAnsuranTerkini = isset($tarikhTerkiniA[$norujukan]) &&
-                Transaction::on('mysql7')
-                    ->where('norujukan', $norujukan)
-                    ->where('trans_type', 'A')
-                    ->whereDate('created_at', '>=', date('Y-m-d', strtotime($tarikhTerkiniA[$norujukan])))
-                    ->exists();
-
-            return !$adaTebusTerkini && !$adaAnsuranTerkini;
-        })->values();
+        $rekodaudit = $this->filterRekodAuditKhas($audit);
 
         // Attach customer info + blast untuk setiap norujukan
         foreach ($rekodaudit as $index => $rekod) {
@@ -563,7 +488,50 @@ class StokAuditController extends Controller
         return ['ujrah' => $ujrah_semasa, 'onepercent' => $onepercent_semasa];
     }
 
-    // dalam Controller (private/protected)
+    /**
+     * SAG untuk blast Stok Audit Khas:
+     * - Fasa 1 (belum lanjut): buang jika dah ada tebus (T) atau bayaran ansuran (A).
+     * - Fasa 2 (dah lanjut, lelong_tawarruq=0): buang jika masih sekitar matang pertama (tempoh < 11).
+     *   Kekalkan tempoh >= 11 untuk peringatan tamat kontrak.
+     */
+    private function filterRekodAuditKhas($audit)
+    {
+        $arraynorujukan = $audit->pluck('norujukan')->filter()->unique()->values()->all();
+
+        $norujukanWithT = [];
+        $norujukanWithA = [];
+
+        if (!empty($arraynorujukan)) {
+            $norujukanWithT = array_flip(
+                Transaction::on('mysql7')
+                    ->where('trans_type', 'T')
+                    ->whereIn('norujukan', $arraynorujukan)
+                    ->distinct()
+                    ->pluck('norujukan')
+                    ->all()
+            );
+
+            $norujukanWithA = array_flip(
+                Transaction::on('mysql7')
+                    ->where('trans_type', 'A')
+                    ->whereIn('norujukan', $arraynorujukan)
+                    ->distinct()
+                    ->pluck('norujukan')
+                    ->all()
+            );
+        }
+
+        return $audit->filter(function ($item) use ($norujukanWithT, $norujukanWithA) {
+            if ((int) $item->lelong_tawarruq === 0) {
+                return (float) $item->tempoh >= 11;
+            }
+
+            $norujukan = $item->norujukan;
+
+            return !isset($norujukanWithT[$norujukan]) && !isset($norujukanWithA[$norujukan]);
+        })->values();
+    }
+
     private function floorTo5SenFrom2dp($amount)
     {
         // pastikan numeric

app/Services/Bsas/BsasClient.php

@@ -0,0 +1,193 @@
+<?php
+
+namespace App\Services\Bsas;
+
+use Illuminate\Http\Client\PendingRequest;
+use Illuminate\Support\Facades\Cache;
+use Illuminate\Support\Facades\Http;
+use Illuminate\Support\Facades\Log;
+use RuntimeException;
+
+class BsasClient
+{
+    const TOKEN_CACHE_KEY = 'bsas.oauth.token';
+    const TOKEN_CACHE_SECONDS = 82800; // 23 hours
+
+    public function getAccessToken(): string
+    {
+        $cached = Cache::get(self::TOKEN_CACHE_KEY);
+        if (is_string($cached) && $cached !== '') {
+            return $cached;
+        }
+
+        // Drop bad cache entries (e.g. whole JSON array accidentally stored).
+        if ($cached !== null) {
+            Cache::forget(self::TOKEN_CACHE_KEY);
+        }
+
+        $tokenUrl = config('bsas.token_url');
+        $clientId = config('bsas.client_id');
+        $clientSecret = config('bsas.client_secret');
+
+        if (!$tokenUrl || !$clientId || !$clientSecret) {
+            throw new RuntimeException('BSAS OAuth is not configured (token_url / client_id / client_secret).');
+        }
+
+        $response = $this->http()
+            ->asForm()
+            ->post($tokenUrl, [
+                'grant_type' => 'client_credentials',
+                'client_id' => $clientId,
+                'client_secret' => $clientSecret,
+            ]);
+
+        $payload = $response->json();
+        if (!is_array($payload)) {
+            $payload = [];
+        }
+
+        if (!$response->successful()) {
+            Log::error('BSAS OAuth token request failed', [
+                'status' => $response->status(),
+                'body' => $payload ?: $response->body(),
+            ]);
+            throw new RuntimeException('Gagal mendapatkan BSAS access token.');
+        }
+
+        $token = $payload['access_token'] ?? null;
+        if (!is_string($token) || $token === '') {
+            Log::error('BSAS OAuth response missing string access_token', [
+                'body' => $payload,
+            ]);
+            throw new RuntimeException('BSAS OAuth response missing access_token.');
+        }
+
+        $expiresIn = (int) ($payload['expires_in'] ?? self::TOKEN_CACHE_SECONDS);
+        $ttl = max(60, min(self::TOKEN_CACHE_SECONDS, $expiresIn - 300));
+        Cache::put(self::TOKEN_CACHE_KEY, $token, $ttl);
+
+        return $token;
+    }
+
+    public function placeOrder(array $payload): array
+    {
+        return $this->requestJson('post', '/process/svc/bsas/order', $payload);
+    }
+
+    public function orderResult(string $uuid, array $body = []): array
+    {
+        $maxWait = (string) ($body['maxWaitTime'] ?? config('bsas.max_wait_time', 10));
+
+        $payload = [
+            'header' => [
+                'memberShortName' => config('bsas.member_short_name'),
+                'uuid' => $uuid,
+            ],
+            'body' => [
+                'serialNumbers' => (string) ($body['serialNumbers'] ?? '1'),
+                'forceYN' => (string) ($body['forceYN'] ?? 'Y'),
+                'maxWaitTime' => $maxWait,
+                'waitAllDoneYN' => (string) ($body['waitAllDoneYN'] ?? 'Y'),
+            ],
+        ];
+
+        // Long poll: client timeout must exceed BSAS maxWaitTime.
+        $timeout = max(
+            (int) config('bsas.http_timeout', 30),
+            (int) $maxWait + 20
+        );
+
+        return $this->requestJson('get', '/process/svc/bsas/orderResult', $payload, $timeout);
+    }
+
+    public function getBidEcert(string $ecertNo): array
+    {
+        return $this->requestEcert('/process/svc/bsas/bidXML', $ecertNo);
+    }
+
+    public function getOtcEcert(string $ecertNo): array
+    {
+        return $this->requestEcert('/process/svc/bsas/otcXML', $ecertNo);
+    }
+
+    public function getStbEcert(string $ecertNo): array
+    {
+        return $this->requestEcert('/process/svc/bsas/stbXML', $ecertNo);
+    }
+
+    protected function requestEcert(string $path, string $ecertNo): array
+    {
+        $payload = [
+            'input' => [
+                'ecertno' => $ecertNo,
+                'membershortname' => config('bsas.member_short_name'),
+            ],
+        ];
+
+        return $this->requestJson('get', $path, $payload);
+    }
+
+    protected function requestJson(string $method, string $path, array $payload, ?int $timeout = null): array
+    {
+        $url = rtrim(config('bsas.base_url'), '/') . '/' . ltrim($path, '/');
+        $timeout = $timeout ?? (int) config('bsas.http_timeout', 30);
+        $token = $this->getAccessToken();
+
+        $pending = $this->http($timeout)
+            ->withToken($token)
+            ->acceptJson();
+
+        if (strtolower($method) === 'get') {
+            $response = $pending
+                ->withHeaders(['Content-Type' => 'application/json'])
+                ->send('GET', $url, [
+                    'body' => json_encode($payload),
+                ]);
+        } else {
+            $response = $pending->asJson()->post($url, $payload);
+        }
+
+        $json = $response->json();
+        if (!is_array($json)) {
+            $body = $response->body();
+            $cloudflare = stripos($body, 'cloudflare') !== false || stripos($body, 'Attention Required') !== false;
+
+            if ($cloudflare) {
+                throw new RuntimeException(
+                    'BSAS blocked by Cloudflare (check IP whitelist). HTTP ' . $response->status()
+                );
+            }
+
+            throw new RuntimeException('BSAS returned invalid JSON response.');
+        }
+
+        if (!$response->successful()) {
+            Log::error('BSAS HTTP error', [
+                'method' => $method,
+                'url' => $url,
+                'status' => $response->status(),
+                'body' => $json,
+            ]);
+            throw new RuntimeException('BSAS request failed (HTTP ' . $response->status() . ').');
+        }
+
+        Log::info('BSAS API call', [
+            'method' => $method,
+            'path' => $path,
+            'status' => $response->status(),
+            'header' => $json['header'] ?? null,
+        ]);
+
+        return $json;
+    }
+
+    protected function http(?int $timeout = null): PendingRequest
+    {
+        $timeout = $timeout ?? (int) config('bsas.http_timeout', 30);
+
+        return Http::withOptions([
+            'timeout' => $timeout,
+            'connect_timeout' => min(15, $timeout),
+        ]);
+    }
+}

app/Services/Bsas/BsasOrderService.php

@@ -0,0 +1,374 @@
+<?php
+
+namespace App\Services\Bsas;
+
+use App\BsasOrder;
+use App\KomuditiTransaksi;
+use Carbon\Carbon;
+use Illuminate\Support\Facades\Log;
+use RuntimeException;
+
+class BsasOrderService
+{
+    /** @var BsasClient */
+    protected $client;
+
+    public function __construct(BsasClient $client = null)
+    {
+        $this->client = $client ?: new BsasClient();
+    }
+
+    /**
+     * Place BSAS order for a gadai Terima, long-poll result, fetch eCert.
+     *
+     * @param array $input norujukan, kodcaw, pinjaman, hargajualan, nama_pelanggan, teller
+     * @return BsasOrder
+     */
+    public function placeAndConfirm(array $input): BsasOrder
+    {
+        $norujukan = (string) ($input['norujukan'] ?? '');
+        $kodcaw = (string) ($input['kodcaw'] ?? '');
+        $pinjaman = round((float) ($input['pinjaman'] ?? 0), 2);
+        $hargajualan = round((float) ($input['hargajualan'] ?? 0), 2);
+        $counterParty = trim((string) ($input['nama_pelanggan'] ?? ''));
+        $createdBy = (string) ($input['teller'] ?? '');
+
+        if ($norujukan === '' || $kodcaw === '' || $pinjaman <= 0) {
+            throw new RuntimeException('BSAS order requires norujukan, kodcaw and pinjaman.');
+        }
+
+        $existing = BsasOrder::on('mysql7')
+            ->where('norujukan', $norujukan)
+            ->orderBy('id', 'desc')
+            ->first();
+
+        if ($existing && $existing->status === 'confirmed') {
+            if ($this->needsEcertFetch($existing)) {
+                $this->fetchAndStoreEcert($existing);
+            }
+            $this->ensureKomuditiTransaksi($existing, $createdBy);
+            return $existing->fresh();
+        }
+
+        if ($existing && in_array($existing->status, ['pending', 'submitted'], true) && !empty($existing->uuid)) {
+            return $this->completeSubmittedOrder($existing, $createdBy);
+        }
+
+        $serial = '1';
+        $payload = $this->buildOrderPayload($pinjaman, $hargajualan, $counterParty, $serial);
+
+        $order = BsasOrder::on('mysql7')->create([
+            'uuid' => null,
+            'norujukan' => $norujukan,
+            'kodcaw' => $kodcaw,
+            'serial_number' => $serial,
+            'product_code' => config('bsas.product_code'),
+            'bid_value' => $pinjaman,
+            'otc_murabaha_value' => $hargajualan,
+            'otc_counter_party' => $counterParty,
+            'status' => 'pending',
+            'request_payload' => $payload,
+            'created_by' => $createdBy,
+        ]);
+
+        try {
+            $orderResponse = $this->client->placeOrder($payload);
+        } catch (\Throwable $e) {
+            $order->status = 'failed';
+            $order->status_message = $e->getMessage();
+            $order->save();
+            throw $e;
+        }
+
+        $order->order_response = $orderResponse;
+        $uuid = data_get($orderResponse, 'header.uuid');
+        $errorCode = trim((string) data_get($orderResponse, 'header.errorCode', ''));
+        $errorMsg = trim((string) data_get($orderResponse, 'header.errorMsg', ''));
+
+        if ($errorCode !== '' || !$uuid) {
+            $order->status = 'failed';
+            $order->status_message = $errorMsg !== '' ? $errorMsg : 'BSAS order rejected (missing uuid or errorCode set).';
+            $order->save();
+            throw new RuntimeException($order->status_message);
+        }
+
+        $bodyStatus = data_get($orderResponse, 'body.0.statusCode');
+        if ($bodyStatus !== null && (int) $bodyStatus !== 0) {
+            $order->uuid = $uuid;
+            $order->status = 'failed';
+            $order->status_code = (int) $bodyStatus;
+            $order->status_message = (string) data_get($orderResponse, 'body.0.statusMessage', 'BSAS order body statusCode != 0');
+            $order->save();
+            throw new RuntimeException($order->status_message);
+        }
+
+        $order->uuid = $uuid;
+        $order->status = 'submitted';
+        $order->save();
+
+        return $this->completeSubmittedOrder($order, $createdBy);
+    }
+
+    /**
+     * Re-query orderResult / eCert for an existing uuid.
+     */
+    public function refreshByUuid(string $uuid): BsasOrder
+    {
+        $order = BsasOrder::on('mysql7')->where('uuid', $uuid)->first();
+        if (!$order) {
+            throw new RuntimeException('BSAS order not found for uuid.');
+        }
+
+        if ($order->status === 'confirmed') {
+            if ($this->needsEcertFetch($order)) {
+                $this->fetchAndStoreEcert($order);
+            }
+            return $order->fresh();
+        }
+
+        return $this->completeSubmittedOrder($order, (string) $order->created_by);
+    }
+
+    protected function completeSubmittedOrder(BsasOrder $order, string $createdBy): BsasOrder
+    {
+        if (empty($order->uuid)) {
+            throw new RuntimeException('BSAS order has no uuid to poll.');
+        }
+
+        $result = $this->longPollOrderResult($order->uuid, (string) $order->serial_number);
+        $order->result_response = $result;
+
+        $headerError = trim((string) data_get($result, 'header.errorCode', ''));
+        $headerMsg = trim((string) data_get($result, 'header.errorMsg', ''));
+        $statusCode = data_get($result, 'body.0.statusCode');
+        $statusMessage = (string) data_get($result, 'body.0.statusMessage', '');
+        $bidErrNo = trim((string) data_get($result, 'body.0.bidErrNo', ''));
+        $otcErrNo = trim((string) data_get($result, 'body.0.otcErrNo', ''));
+        $stbErrNo = trim((string) data_get($result, 'body.0.stbErrNo', ''));
+        $bidMsg = trim((string) data_get($result, 'body.0.bidMsg', ''));
+        $otcMsg = trim((string) data_get($result, 'body.0.otcMsg', ''));
+        $stbMsg = trim((string) data_get($result, 'body.0.stbMsg', ''));
+        $ecertNo = $this->extractEcertNo($result, $order->order_response);
+
+        if ($headerError !== '') {
+            $order->status = 'failed';
+            $order->status_code = is_numeric($statusCode) ? (int) $statusCode : null;
+            $order->status_message = $headerMsg !== '' ? $headerMsg : 'BSAS orderResult header errorCode set.';
+            $order->save();
+            throw new RuntimeException($order->status_message);
+        }
+
+        // Live BSAS result often has no statusCode; success is ecertNo and/or bid/otc/stb ErrNo=999 (OK).
+        $successByStatusCode = $statusCode !== null && (int) $statusCode === 0;
+        $successByErrNo = ($bidErrNo === '999' || strtoupper($bidMsg) === 'OK')
+            && ($otcErrNo === '999' || strtoupper($otcMsg) === 'OK')
+            && ($stbErrNo === '999' || strtoupper($stbMsg) === 'OK');
+        $successByEcert = $ecertNo !== null && $ecertNo !== '';
+
+        if (!$successByStatusCode && !$successByErrNo && !$successByEcert) {
+            if ($statusCode !== null && (int) $statusCode !== 0) {
+                $order->status = 'failed';
+                $order->status_code = (int) $statusCode;
+                $order->status_message = $statusMessage !== '' ? $statusMessage : 'BSAS orderResult statusCode != 0';
+                $order->save();
+                throw new RuntimeException($order->status_message);
+            }
+
+            $order->status = 'submitted';
+            $order->status_message = 'BSAS orderResult belum selesai / tiada ecert.';
+            $order->save();
+            throw new RuntimeException('BSAS orderResult belum selesai. Sila cuba semula.');
+        }
+
+        $order->status_code = $statusCode !== null ? (int) $statusCode : 0;
+        $order->status_message = $statusMessage !== '' ? $statusMessage : ($bidMsg ?: 'OK');
+        $order->status = 'confirmed';
+        if ($ecertNo) {
+            $order->e_cert_no = $ecertNo;
+        }
+        $order->save();
+
+        if ($this->needsEcertFetch($order)) {
+            $this->fetchAndStoreEcert($order);
+        }
+
+        if (empty($order->e_cert_no)) {
+            Log::warning('BSAS order confirmed but ecertno missing', [
+                'norujukan' => $order->norujukan,
+                'uuid' => $order->uuid,
+            ]);
+        }
+
+        $this->ensureKomuditiTransaksi($order, $createdBy);
+
+        return $order->fresh();
+    }
+
+    protected function longPollOrderResult(string $uuid, string $serial): array
+    {
+        $retries = max(1, (int) config('bsas.order_result_retries', 2));
+        $last = [];
+
+        for ($i = 0; $i < $retries; $i++) {
+            $last = $this->client->orderResult($uuid, [
+                'serialNumbers' => $serial,
+                'forceYN' => 'Y',
+                'maxWaitTime' => (string) config('bsas.max_wait_time', 10),
+                'waitAllDoneYN' => 'Y',
+            ]);
+
+            // Done when statusCode is set, or bid, OTC and STB have all reported.
+            $bidDone = trim((string) data_get($last, 'body.0.bidErrNo', '')) !== '';
+            $otcDone = trim((string) data_get($last, 'body.0.otcErrNo', '')) !== '';
+            $stbDone = trim((string) data_get($last, 'body.0.stbErrNo', '')) !== '';
+            $hasEcert = trim((string) data_get($last, 'body.0.ecertNo', '')) !== ''
+                || trim((string) data_get($last, 'body.0.eCertNo', '')) !== '';
+
+            if (
+                data_get($last, 'body.0.statusCode') !== null
+                || ($bidDone && $otcDone && $stbDone)
+                || ($hasEcert && $stbDone)
+            ) {
+                return $last;
+            }
+        }
+
+        return $last;
+    }
+
+    protected function needsEcertFetch(BsasOrder $order): bool
+    {
+        return empty($order->bid_ecert_response)
+            || empty($order->otc_ecert_response)
+            || empty($order->stb_ecert_response);
+    }
+
+    protected function fetchAndStoreEcert(BsasOrder $order): void
+    {
+        $ecertNo = $order->e_cert_no;
+        if (!$ecertNo) {
+            $ecertNo = $this->extractEcertNo($order->result_response, $order->order_response);
+            if ($ecertNo) {
+                $order->e_cert_no = $ecertNo;
+                $order->save();
+            }
+        }
+
+        if (!$ecertNo) {
+            return;
+        }
+
+        $calls = [
+            'bid_ecert_response' => 'getBidEcert',
+            'otc_ecert_response' => 'getOtcEcert',
+            'stb_ecert_response' => 'getStbEcert',
+        ];
+
+        foreach ($calls as $column => $method) {
+            if (!empty($order->{$column})) {
+                continue;
+            }
+
+            try {
+                $ecert = $this->client->{$method}($ecertNo);
+                $order->{$column} = $ecert;
+                if ($column === 'otc_ecert_response' && empty($order->e_cert_no) && !empty($ecert['ECERTNO'])) {
+                    $order->e_cert_no = $ecert['ECERTNO'];
+                }
+                $order->save();
+            } catch (\Throwable $e) {
+                Log::error('BSAS eCert fetch failed after confirmed order', [
+                    'norujukan' => $order->norujukan,
+                    'uuid' => $order->uuid,
+                    'e_cert_no' => $ecertNo,
+                    'certificate' => $column,
+                    'error' => $e->getMessage(),
+                ]);
+            }
+        }
+    }
+
+    protected function ensureKomuditiTransaksi(BsasOrder $order, string $teller): void
+    {
+        $exists = KomuditiTransaksi::on('mysql7')
+            ->where('norujukan', $order->norujukan)
+            ->first();
+
+        if ($exists) {
+            return;
+        }
+
+        $current = Carbon::now();
+        KomuditiTransaksi::on('mysql7')->create([
+            'unit_komuditi' => round((float) $order->bid_value, 2),
+            'nosijil' => $order->e_cert_no ?: $order->uuid,
+            'norujukan' => $order->norujukan,
+            'kodcaw' => $order->kodcaw,
+            'teller' => $teller !== '' ? $teller : $order->created_by,
+            'masa' => $current->toTimeString(),
+            'tarikh' => $current->toDateString(),
+        ]);
+    }
+
+    protected function buildOrderPayload(float $pinjaman, float $hargajualan, string $counterParty, string $serial): array
+    {
+        return [
+            'header' => [
+                'memberShortName' => config('bsas.member_short_name'),
+                'uuid' => $this->uuidV4(),
+            ],
+            'body' => [
+                'serialNumber' => $serial,
+                'bidOption' => 'Y',
+                'otcOption' => 'Y',
+                'stbOption' => 'Y',
+                'productCode' => config('bsas.product_code'),
+                'purchaseType' => 'P',
+                'clientName' => '',
+                'currency' => 'MYR',
+                'bidValue' => number_format($pinjaman, 2, '.', ''),
+                'valueDate' => Carbon::now()->format('Ymd'),
+                'tenor' => config('bsas.tenor'),
+                'otcCounterParty' => $counterParty,
+                'otcMurabaha' => '',
+                'otcMurabahaValue' => number_format($hargajualan, 2, '.', ''),
+                'eCertNo' => '',
+            ],
+        ];
+    }
+
+    /**
+     * Best-effort extract ecert number from result/order payloads.
+     */
+    protected function extractEcertNo($result, $orderResponse): ?string
+    {
+        $candidates = [
+            data_get($result, 'body.0.eCertNo'),
+            data_get($result, 'body.0.ecertNo'),
+            data_get($result, 'body.0.ECERTNO'),
+            data_get($result, 'body.0.ecertno'),
+            data_get($result, 'body.0.certificateNo'),
+            data_get($orderResponse, 'body.0.eCertNo'),
+            data_get($orderResponse, 'body.0.ecertNo'),
+            data_get($orderResponse, 'body.0.ECERTNO'),
+        ];
+
+        foreach ($candidates as $value) {
+            $value = trim((string) $value);
+            if ($value !== '') {
+                return $value;
+            }
+        }
+
+        return null;
+    }
+
+    protected function uuidV4(): string
+    {
+        $data = random_bytes(16);
+        $data[6] = chr((ord($data[6]) & 0x0f) | 0x40);
+        $data[8] = chr((ord($data[8]) & 0x3f) | 0x80);
+
+        return vsprintf('%s%s-%s-%s-%s-%s%s%s', str_split(bin2hex($data), 4));
+    }
+}

app/Services/PembiayaanOnline/PembiayaanOnlineService.php

@@ -415,6 +415,19 @@ class PembiayaanOnlineService
             $fields['bukti_akaun_file_id'] = $saved['payload']['id'];
         }
 
+        if (!empty($input['borang_data'])) {
+            $saved = $this->storeBuktiFile([
+                'data' => $input['borang_data'],
+                'filename' => $input['borang_filename'] ?? null,
+                'type' => $input['borang_type'] ?? null,
+            ]);
+            if (!$saved['ok']) {
+                $saved['payload']['message'] = 'Borang pengesahan diperlukan: fail, nama fail dan jenis fail.';
+                return $saved;
+            }
+            $fields['borang_file_id'] = $saved['payload']['id'];
+        }
+
         if (empty($fields)) {
             return [
                 'ok' => false,
@@ -694,6 +707,26 @@ class PembiayaanOnlineService
             ->orderBy('id', 'asc')
             ->get();
 
+        // Fetch customer phone numbers in one query for the batch approval form.
+        $identityNumbers = $lines->pluck('nokp')->filter()->unique()->values()->all();
+        $phones = [];
+        if ($identityNumbers) {
+            $customers = Customer::on('mysql7')->select('kpbaru', 'kplama', 'telefon')
+                ->where(function ($query) use ($identityNumbers) {
+                    $query->whereIn('kpbaru', $identityNumbers)->orWhereIn('kplama', $identityNumbers);
+                })->get();
+            foreach ($customers as $customer) {
+                foreach ([$customer->kpbaru, $customer->kplama] as $identity) {
+                    if ($identity !== null && $identity !== '') {
+                        $phones[(string) $identity] = $customer->telefon;
+                    }
+                }
+            }
+        }
+        foreach ($lines as $line) {
+            $line->setAttribute('telefon', $phones[(string) $line->nokp] ?? null);
+        }
+
         return [
             'ok' => true,
             'status' => 200,
@@ -1739,6 +1772,65 @@ class PembiayaanOnlineService
         ];
     }
 
+    /**
+     * Get attached signed online-financing confirmation form (borang_file_id).
+     *
+     * @return array{ok:bool,status:int,payload:mixed}
+     */
+    public function getBorang($kodcaw, $id)
+    {
+        $resolved = $this->resolveMysql($kodcaw);
+        if (!$resolved['ok']) {
+            return $resolved;
+        }
+
+        $line = PembiayaanOnline::on($resolved['mysql'])
+            ->where('kodcaw', $kodcaw)
+            ->where('id', $id)
+            ->first();
+
+        if (!$line) {
+            return [
+                'ok' => false,
+                'status' => 404,
+                'payload' => ['message' => 'Pembiayaan online tidak dijumpai'],
+            ];
+        }
+
+        if (empty($line->borang_file_id)) {
+            return [
+                'ok' => false,
+                'status' => 404,
+                'payload' => ['message' => 'Borang pengesahan belum dimuat naik'],
+            ];
+        }
+
+        $file = ARFiles::on('mysql7')->where('id', $line->borang_file_id)->first();
+        if (!$file) {
+            return [
+                'ok' => false,
+                'status' => 404,
+                'payload' => ['message' => 'Fail borang pengesahan tidak dijumpai'],
+            ];
+        }
+
+        return [
+            'ok' => true,
+            'status' => 200,
+            'payload' => [
+                'pembiayaan_online_id' => $line->id,
+                'norujukan' => $line->norujukan,
+                'file' => [
+                    'id' => $file->id,
+                    'filename' => $file->filename,
+                    'type' => $file->type,
+                    'tarikhmasa' => $file->tarikhmasa,
+                    'data' => $file->data,
+                ],
+            ],
+        ];
+    }
+
     /**
      * PC list of PAID lines awaiting blast / tally.
      *

bootstrap/app.php

@@ -96,6 +96,7 @@ $app->configure('app_parameter');
 $app->configure('parameter');
 $app->configure('whatsapp');
 $app->configure('kaunter');
+$app->configure('bsas');
 /*
 |--------------------------------------------------------------------------
 | Register Middleware

composer_backuo.json

@@ -1,44 +0,0 @@
-{
-    "name": "laravel/lumen",
-    "description": "The Laravel Lumen Framework.",
-    "keywords": ["framework", "laravel", "lumen"],
-    "license": "MIT",
-    "type": "project",
-    "require": {
-        "php": "^7.2.5",
-        "auth0/auth0-php": "^7.4",
-        "laravel/lumen-framework": "^7.0",
-        "rap2hpoutre/laravel-log-viewer": "^1.7"
-    },
-    "require-dev": {
-        "fzaninotto/faker": "^1.9.1",
-        "mockery/mockery": "^1.3.1",
-        "phpunit/phpunit": "^8.5"
-    },
-    "autoload": {
-        "classmap": [
-            "database/seeds",
-            "database/factories"
-        ],
-        "psr-4": {
-            "App\\": "app/"
-        }
-    },
-    "autoload-dev": {
-        "classmap": [
-            "tests/"
-        ]
-    },
-    "config": {
-        "preferred-install": "dist",
-        "sort-packages": true,
-        "optimize-autoloader": true
-    },
-    "minimum-stability": "dev",
-    "prefer-stable": true,
-    "scripts": {
-        "post-root-package-install": [
-            "@php -r \"file_exists('.env') || copy('.env.example', '.env');\""
-        ]
-    }
-}

config/bsas.php

@@ -0,0 +1,14 @@
+<?php
+
+return [
+    'base_url' => rtrim(env('BSAS_BASE_URL', 'https://bsasdevapi.bursamalaysia.com/api'), '/'),
+    'token_url' => env('BSAS_TOKEN_URL', 'https://bsasdevapi.bursamalaysia.com/oauth/token'),
+    'client_id' => env('BSAS_CLIENT_ID'),
+    'client_secret' => env('BSAS_CLIENT_SECRET'),
+    'member_short_name' => env('BSAS_MEMBER_SHORT_NAME', 'KOOPPKB'),
+    'product_code' => env('BSAS_PRODUCT_CODE', 'CPO-MSIA-09'),
+    'tenor' => env('BSAS_TENOR', '00088'),
+    'max_wait_time' => (int) env('BSAS_MAX_WAIT_TIME', 10),
+    'http_timeout' => (int) env('BSAS_HTTP_TIMEOUT', 30),
+    'order_result_retries' => (int) env('BSAS_ORDER_RESULT_RETRIES', 2),
+];

database/migrations/2026_10_13_160000_create_bsas_orders_table.php

@@ -0,0 +1,49 @@
+<?php
+
+use Illuminate\Database\Migrations\Migration;
+use Illuminate\Database\Schema\Blueprint;
+use Illuminate\Support\Facades\Schema;
+
+class CreateBsasOrdersTable extends Migration
+{
+    /**
+     * Master DB (mysql7) — per-Terima BSAS commodity orders.
+     */
+    public function up()
+    {
+        if (Schema::connection('mysql7')->hasTable('bsas_orders')) {
+            return;
+        }
+
+        Schema::connection('mysql7')->create('bsas_orders', function (Blueprint $table) {
+            $table->bigIncrements('id');
+            $table->string('uuid', 64)->nullable()->unique();
+            $table->string('norujukan', 50)->index();
+            $table->string('kodcaw', 20)->index();
+            $table->string('serial_number', 20)->default('1');
+            $table->string('product_code', 50)->nullable();
+            $table->decimal('bid_value', 14, 2)->nullable();
+            $table->decimal('otc_murabaha_value', 14, 2)->nullable();
+            $table->string('otc_counter_party', 150)->nullable();
+            $table->string('status', 30)->default('pending')->index();
+            $table->integer('status_code')->nullable();
+            $table->string('status_message', 255)->nullable();
+            $table->string('e_cert_no', 100)->nullable()->index();
+            $table->json('bid_ecert_response')->nullable();
+            $table->json('otc_ecert_response')->nullable();
+            $table->json('stb_ecert_response')->nullable();
+            $table->json('request_payload')->nullable();
+            $table->json('order_response')->nullable();
+            $table->json('result_response')->nullable();
+            $table->string('created_by', 100)->nullable();
+            $table->timestamps();
+
+            $table->index(['norujukan', 'status']);
+        });
+    }
+
+    public function down()
+    {
+        Schema::connection('mysql7')->dropIfExists('bsas_orders');
+    }
+}

database/migrations/2026_10_27_120000_add_scan_ic_to_customer_table.php

@@ -0,0 +1,46 @@
+<?php
+
+use Illuminate\Database\Migrations\Migration;
+use Illuminate\Database\Schema\Blueprint;
+use Illuminate\Support\Facades\Schema;
+
+class AddScanIcToCustomerTable extends Migration
+{
+    /**
+     * Master DB (mysql7) — stores arrahn_files.id for the scanned IC document.
+     *
+     * @return void
+     */
+    public function up()
+    {
+        if (
+            Schema::connection('mysql7')->hasTable('customer')
+            && !Schema::connection('mysql7')->hasColumn('customer', 'scan_ic')
+        ) {
+            Schema::connection('mysql7')->table('customer', function (Blueprint $table) {
+                if (Schema::connection('mysql7')->hasColumn('customer', 'gambar_mykad')) {
+                    $table->unsignedBigInteger('scan_ic')->nullable()->after('gambar_mykad');
+                } else {
+                    $table->unsignedBigInteger('scan_ic')->nullable();
+                }
+            });
+        }
+    }
+
+    /**
+     * Reverse the migrations.
+     *
+     * @return void
+     */
+    public function down()
+    {
+        if (
+            Schema::connection('mysql7')->hasTable('customer')
+            && Schema::connection('mysql7')->hasColumn('customer', 'scan_ic')
+        ) {
+            Schema::connection('mysql7')->table('customer', function (Blueprint $table) {
+                $table->dropColumn('scan_ic');
+            });
+        }
+    }
+}

docker-compose.yml

@@ -5,6 +5,8 @@ services:
       dockerfile: docker/php/Dockerfile
       target: development
     working_dir: /var/www/html
+    ports:
+      - "8080:8000"
     volumes:
       - ./:/var/www/html:cached
     environment:
@@ -12,16 +14,7 @@ services:
       APP_DEBUG: "true"
     depends_on:
       - mysql
-
-  web:
-    image: nginx:1.25-alpine
-    ports:
-      - "8080:80"
-    volumes:
-      - ./:/var/www/html:cached
-      - ./docker/nginx/default.conf:/etc/nginx/conf.d/default.conf:ro
-    depends_on:
-      - app
+    command: ["php", "-S", "0.0.0.0:8000", "-t", "public"]
 
   mysql:
     image: mysql:8.0

env test

@@ -1,257 +0,0 @@
- APP_NAME=Lumen
-APP_ENV=local
-APP_KEY=WbPGkYNmXZ6ZQplGlvl0iZ7zyW1b09xa
-APP_DEBUG=true
-APP_URL=http://api-arrahn.test
-APP_TIMEZONE=Asia/Kuala_Lumpur
-
-LOG_CHANNEL=stack
-LOG_SLACK_WEBHOOK_URL=
-
-DB_CONNECTION_36=mysql
-DB_HOST_36=127.0.0.1
-DB_PORT_36=3306
-DB_DATABASE_36=arrahn_kb2
-DB_USERNAME_36=root
-DB_PASSWORD_36=
-
-DB_CONNECTION_2=mysql
-DB_HOST_2=127.0.0.1
-DB_PORT_2=3306
-DB_DATABASE_2=arrahn_wcy
-DB_USERNAME_2=root
-DB_PASSWORD_2=
-
-DB_CONNECTION_3=mysql
-DB_HOST_3=127.0.0.1
-DB_PORT_3=3306
-DB_DATABASE_3=arrahn_1stop
-DB_USERNAME_3=root
-DB_PASSWORD_3=
-
-DB_CONNECTION_4=mysql
-DB_HOST_4=127.0.0.1
-DB_PORT_4=3306
-DB_DATABASE_4=arrahn_jlwt
-DB_USERNAME_4=root
-DB_PASSWORD_4=
-
-DB_CONNECTION_5=mysql
-DB_HOST_5=127.0.0.1
-DB_PORT_5=3306
-DB_DATABASE_5=arrahn_wb
-DB_USERNAME_5=root
-DB_PASSWORD_5=
-
-DB_CONNECTION_6=mysql
-DB_HOST_6=127.0.0.1
-DB_PORT_6=3306
-DB_DATABASE_6=arrahn_kls
-DB_USERNAME_6=root
-DB_PASSWORD_6=
-
-DB_CONNECTION_7=mysql
-DB_HOST_7=127.0.0.1
-DB_PORT_7=3306
-DB_DATABASE_7=online_arrahn
-DB_USERNAME_7=root
-DB_PASSWORD_7=
-
-DB_CONNECTION_8=mysql
-DB_HOST_8=127.0.0.1
-DB_PORT_8=3306
-DB_DATABASE_8=arrahn_pp
-DB_USERNAME_8=root
-DB_PASSWORD_8=
-
-DB_CONNECTION_9=mysql
-DB_HOST_9=127.0.0.1
-DB_PORT_9=3306
-DB_DATABASE_9=arrahn_mace
-DB_USERNAME_9=root
-DB_PASSWORD_9= 
-
-DB_CONNECTION_10=mysql
-DB_HOST_10=127.0.0.1
-DB_PORT_10=3306
-DB_DATABASE_10=arrahn_pm                                                                                                   $
-DB_USERNAME_10=root
-DB_PASSWORD_10=
-
-DB_CONNECTION_11=mysql
-DB_HOST_11=127.0.0.1
-DB_PORT_11=3306
-DB_DATABASE_11=arrahn_gm
-DB_USERNAME_11=root
-DB_PASSWORD_11=
-
-DB_CONNECTION_12=mysql
-DB_HOST_12=127.0.0.1
-DB_PORT_12=3306
-DB_DATABASE_12=arrahn_gcl
-DB_USERNAME_12=root
-DB_PASSWORD_12=
-
-DB_CONNECTION_13=mysql
-DB_HOST_13=127.0.0.1
-DB_PORT_13=3306
-DB_DATABASE_13=arrahn_jli
-DB_USERNAME_13=root
-DB_PASSWORD_13=
-
-DB_CONNECTION_14=mysql
-DB_HOST_14=127.0.0.1
-DB_PORT_14=3306
-DB_DATABASE_14=arrahn_rp
-DB_USERNAME_14=root
-DB_PASSWORD_14=
-
-DB_CONNECTION_15=mysql
-DB_HOST_15=127.0.0.1
-DB_PORT_15=3306
-DB_DATABASE_15=arrahn_ktn
-DB_USERNAME_15=root
-DB_PASSWORD_15=
-
-DB_CONNECTION_16=mysql
-DB_HOST_16=127.0.0.1
-DB_PORT_16=3306
-DB_DATABASE_16=arrahn_pg
-DB_USERNAME_16=root
-DB_PASSWORD_16=
-
-DB_CONNECTION_17=mysql
-DB_HOST_17=127.0.0.1
-DB_PORT_17=3306
-DB_DATABASE_17=arrahn_skudai
-DB_USERNAME_17=root
-DB_PASSWORD_17=
-
-DB_CONNECTION_18=mysql
-DB_HOST_18=127.0.0.1
-DB_PORT_18=3306
-DB_DATABASE_18=arrahn_pttn
-DB_USERNAME_18=root
-DB_PASSWORD_18=
-
-DB_CONNECTION_19=mysql
-DB_HOST_19=127.0.0.1
-DB_PORT_19=3306
-DB_DATABASE_19=arrahn_btg
-DB_USERNAME_19=root
-DB_PASSWORD_19=
-
-DB_CONNECTION_20=mysql
-DB_HOST_20=127.0.0.1
-DB_PORT_20=3306
-DB_DATABASE_20=arrahn_raub
-DB_USERNAME_20=root
-DB_PASSWORD_20=
-
-DB_CONNECTION_21=mysql
-DB_HOST_21=127.0.0.1
-DB_PORT_21=3306
-DB_DATABASE_21=arrahn_kgr
-DB_USERNAME_21=root
-DB_PASSWORD_21=
-
-DB_CONNECTION_22=mysql
-DB_HOST_22=127.0.0.1
-DB_PORT_22=3306
-DB_DATABASE_22=arrahn_sdk
-DB_USERNAME_22=root
-DB_PASSWORD_22=
-
-DB_CONNECTION_23=mysql
-DB_HOST_23=127.0.0.1
-DB_PORT_23=3306
-DB_DATABASE_23=arrahn_sp
-DB_USERNAME_23=root
-DB_PASSWORD_23=
-
-DB_CONNECTION_24=mysql
-DB_HOST_24=127.0.0.1
-DB_PORT_24=3306
-DB_DATABASE_24=arrahn_twu
-DB_USERNAME_24=root
-DB_PASSWORD_24=
-
-DB_CONNECTION_25=mysql
-DB_HOST_25=127.0.0.1
-DB_PORT_25=3306
-DB_DATABASE_25=arrahn_api2
-DB_USERNAME_25=root
-DB_PASSWORD_25=
-
-DB_CONNECTION_26=mysql
-DB_HOST_26=127.0.0.1
-DB_PORT_26=3306
-DB_DATABASE_26=arrahn_kjg
-DB_USERNAME_26=root
-DB_PASSWORD_26=
-
-DB_CONNECTION_27=mysql
-DB_HOST_27=127.0.0.1
-DB_PORT_27=3306
-DB_DATABASE_27=arrahn_rl
-DB_USERNAME_27=root
-DB_PASSWORD_27=
-
-DB_CONNECTION_28=mysql
-DB_HOST_28=127.0.0.1
-DB_PORT_28=3306
-DB_DATABASE_28=arrahn_bfort
-DB_USERNAME_28=root
-DB_PASSWORD_28=
-
-DB_CONNECTION_29=mysql
-DB_HOST_29=127.0.0.1
-DB_PORT_29=3306
-DB_DATABASE_29=arrahn_kbelud
-DB_USERNAME_29=root
-DB_PASSWORD_29=
-
-DB_CONNECTION_30=mysql
-DB_HOST_30=127.0.0.1
-DB_PORT_30=3306
-DB_DATABASE_30=arrahn_tuaran
-DB_USERNAME_30=root
-DB_PASSWORD_30=
-
-DB_CONNECTION_31=mysql
-DB_HOST_31=127.0.0.1
-DB_PORT_31=3306
-DB_DATABASE_31=arrahn_kngau
-DB_USERNAME_31=root
-DB_PASSWORD_31=
-
-DB_CONNECTION_32=mysql
-DB_HOST_32=127.0.0.1
-DB_PORT_32=3306
-DB_DATABASE_32=arrahn_tm
-DB_USERNAME_32=root
-DB_PASSWORD_32=
-
-DB_CONNECTION_33=mysql
-DB_HOST_33=127.0.0.1
-DB_PORT_33=3306
-DB_DATABASE_33=arrahn_tmlh
-DB_USERNAME_33=root
-DB_PASSWORD_33=
-
-DB_CONNECTION_34=mysql
-DB_HOST_34=127.0.0.1
-DB_PORT_34=3306
-DB_DATABASE_34=arrahn_semporna
-DB_USERNAME_34=root
-DB_PASSWORD_34=
-
-DB_CONNECTION_35=mysql
-DB_HOST_35=127.0.0.1
-DB_PORT_35=3306
-DB_DATABASE_35=arrahn_kb1
-DB_USERNAME_35=root
-DB_PASSWORD_35=
-
-CACHE_DRIVER=file
-QUEUE_CONNECTION=sync

env.docker.example/base.env

@@ -1,286 +0,0 @@
-APP_NAME=Lumen
-APP_ENV=localhost
-APP_KEY=WbPGkYNmXZ6ZQplGlvl0iZ7zyW1b09xa
-APP_DEBUG=true
-APP_URL=http://apiujrah.arrahn
-APP_TIMEZONE=Asia/Kuala_Lumpur
-
-
-LOG_CHANNEL=stack
-LOG_SLACK_WEBHOOK_URL=
-
-#tukar 12-09-23
-#DB_CONNECTION=mysql
-#DB_HOST=127.0.0.1
-#DB_PORT=3306
-#DB_DATABASE=arrahn_kb2
-#DB_USERNAME=root
-#DB_PASSWORD=secret
-
-DB_CONNECTION_36=mysql
-DB_HOST_36=database_zone1
-DB_PORT_36=3306
-DB_DATABASE_36=arrahn_kb2
-DB_USERNAME_36=root
-DB_PASSWORD_36=secret
-
-DB_CONNECTION_2=mysql
-DB_HOST_2=database_zone1
-DB_PORT_2=3306
-DB_DATABASE_2=arrahn_wcy
-DB_USERNAME_2=root
-DB_PASSWORD_2=secret
-
-DB_CONNECTION_3=mysql
-DB_HOST_3=database_zone1
-DB_PORT_3=3306
-DB_DATABASE_3=arrahn_1stop
-DB_USERNAME_3=root
-DB_PASSWORD_3=secret
-
-DB_CONNECTION_4=mysql
-DB_HOST_4=database_zone1
-DB_PORT_4=3306
-DB_DATABASE_4=arrahn_jlwt
-DB_USERNAME_4=root
-DB_PASSWORD_4=secret
-
-DB_CONNECTION_5=mysql
-DB_HOST_5=database_zone1
-DB_PORT_5=3306
-DB_DATABASE_5=arrahn_wb
-DB_USERNAME_5=root
-DB_PASSWORD_5=secret
-
-DB_CONNECTION_6=mysql
-DB_HOST_6=database_zone1
-DB_PORT_6=3306
-DB_DATABASE_6=arrahn_kls
-DB_USERNAME_6=root
-DB_PASSWORD_6=secret
-
-DB_CONNECTION_7=mysql
-DB_HOST_7=database_zone1
-DB_PORT_7=3306
-DB_DATABASE_7=online_arrahn
-DB_USERNAME_7=root
-DB_PASSWORD_7=secret
-
-DB_CONNECTION_8=mysql
-DB_HOST_8=database_zone1
-DB_PORT_8=3306
-DB_DATABASE_8=arrahn_pp
-DB_USERNAME_8=root
-DB_PASSWORD_8=secret
-
-DB_CONNECTION_9=mysql
-DB_HOST_9=database_zone1
-DB_PORT_9=3306
-DB_DATABASE_9=arrahn_mace
-DB_USERNAME_9=root
-DB_PASSWORD_9=secret
-
-DB_CONNECTION_10=mysql
-DB_HOST_10=database_zone1
-DB_PORT_10=3306
-DB_DATABASE_10=arrahn_pm
-DB_USERNAME_10=root
-DB_PASSWORD_10=secret
-
-DB_CONNECTION_11=mysql
-DB_HOST_11=database_zone1
-DB_PORT_11=3306
-DB_DATABASE_11=arrahn_gm
-DB_USERNAME_11=root
-DB_PASSWORD_11=secret
-
-DB_CONNECTION_12=mysql
-DB_HOST_12=database_zone1
-DB_PORT_12=3306
-DB_DATABASE_12=arrahn_gcl
-DB_USERNAME_12=root
-DB_PASSWORD_12=secret
-
-DB_CONNECTION_13=mysql
-DB_HOST_13=database_zone1
-DB_PORT_13=3306
-DB_DATABASE_13=arrahn_jli
-DB_USERNAME_13=root
-DB_PASSWORD_13=secret
-
-DB_CONNECTION_14=mysql
-DB_HOST_14=database_zone1
-DB_PORT_14=3306
-DB_DATABASE_14=arrahn_rp
-DB_USERNAME_14=root
-DB_PASSWORD_14=secret
-
-DB_CONNECTION_15=mysql
-DB_HOST_15=database_zone2
-DB_PORT_15=3306
-DB_DATABASE_15=arrahn_ktn
-DB_USERNAME_15=root
-DB_PASSWORD_15=secret
-
-DB_CONNECTION_16=mysql
-DB_HOST_16=database_zone2
-DB_PORT_16=3306
-DB_DATABASE_16=arrahn_pg
-DB_USERNAME_16=root
-DB_PASSWORD_16=secret
-
-DB_CONNECTION_17=mysql
-DB_HOST_17=database_zone2
-DB_PORT_17=3306
-DB_DATABASE_17=arrahn_skudai
-DB_USERNAME_17=root
-DB_PASSWORD_17=secret
-
-DB_CONNECTION_18=mysql
-DB_HOST_18=database_zone2
-DB_PORT_18=3306
-DB_DATABASE_18=arrahn_pttn
-DB_USERNAME_18=root
-DB_PASSWORD_18=secret
-
-DB_CONNECTION_19=mysql
-DB_HOST_19=database_zone2
-DB_PORT_19=3306
-DB_DATABASE_19=arrahn_btg
-DB_USERNAME_19=root
-DB_PASSWORD_19=secret
-
-DB_CONNECTION_20=mysql
-DB_HOST_20=database_zone2
-DB_PORT_20=3306
-DB_DATABASE_20=arrahn_raub
-DB_USERNAME_20=root
-DB_PASSWORD_20=secret
-
-DB_CONNECTION_21=mysql
-DB_HOST_21=database_zone2
-DB_PORT_21=3306
-DB_DATABASE_21=arrahn_kgr
-DB_USERNAME_21=root
-DB_PASSWORD_21=secret
-
-DB_CONNECTION_22=mysql
-DB_HOST_22=database_zone2
-DB_PORT_22=3306
-DB_DATABASE_22=arrahn_sdk
-DB_USERNAME_22=root
-DB_PASSWORD_22=secret
-
-DB_CONNECTION_23=mysql
-DB_HOST_23=database_zone2
-DB_PORT_23=3306
-DB_DATABASE_23=arrahn_sp
-DB_USERNAME_23=root
-DB_PASSWORD_23=secret
-
-DB_CONNECTION_24=mysql
-DB_HOST_24=database_zone2
-DB_PORT_24=3306
-DB_DATABASE_24=arrahn_twu
-DB_USERNAME_24=root
-DB_PASSWORD_24=secret
-
-DB_CONNECTION_25=mysql
-DB_HOST_25=database_zone2
-DB_PORT_25=3306
-DB_DATABASE_25=arrahn_api2
-DB_USERNAME_25=root
-DB_PASSWORD_25=secret
-
-DB_CONNECTION_26=mysql
-DB_HOST_26=database_zone2
-DB_PORT_26=3306
-DB_DATABASE_26=arrahn_kjg
-DB_USERNAME_26=root
-DB_PASSWORD_26=secret
-
-DB_CONNECTION_27=mysql
-DB_HOST_27=database_zone2
-DB_PORT_27=3306
-DB_DATABASE_27=arrahn_rl
-DB_USERNAME_27=root
-DB_PASSWORD_27=secret
-
-DB_CONNECTION_28=mysql
-DB_HOST_28=database_zone2
-DB_PORT_28=3306
-DB_DATABASE_28=arrahn_bfort
-DB_USERNAME_28=root
-DB_PASSWORD_28=secret
-
-DB_CONNECTION_29=mysql
-DB_HOST_29=database_zone2
-DB_PORT_29=3306
-DB_DATABASE_29=arrahn_kbelud
-DB_USERNAME_29=root
-DB_PASSWORD_29=secret
-
-DB_CONNECTION_30=mysql
-DB_HOST_30=database_zone2
-DB_PORT_30=3306
-DB_DATABASE_30=arrahn_tuaran
-DB_USERNAME_30=root
-DB_PASSWORD_30=secret
-
-DB_CONNECTION_31=mysql
-DB_HOST_31=database_zone2
-DB_PORT_31=3306
-DB_DATABASE_31=arrahn_kngau
-DB_USERNAME_31=root
-DB_PASSWORD_31=secret
-
-DB_CONNECTION_32=mysql
-DB_HOST_32=database_zone1
-DB_PORT_32=3306
-DB_DATABASE_32=arrahn_tm
-DB_USERNAME_32=root
-DB_PASSWORD_32=secret
-
-DB_CONNECTION_33=mysql
-DB_HOST_33=database_zone2
-DB_PORT_33=3306
-DB_DATABASE_33=arrahn_tmlh
-DB_USERNAME_33=root
-DB_PASSWORD_33=secret
-
-
-DB_CONNECTION_34=mysql
-DB_HOST_34=database_zone2
-DB_PORT_34=3306
-DB_DATABASE_34=arrahn_semporna
-DB_USERNAME_34=root
-DB_PASSWORD_34=secret
-
-DB_CONNECTION_35=mysql
-DB_HOST_35=database_zone1
-DB_PORT_35=3306
-DB_DATABASE_35=arrahn_kb1
-DB_USERNAME_35=root
-DB_PASSWORD_35=secret
-
-#DB_CONNECTION_37=mysql
-#DB_HOST_37=database_zone2
-#DB_PORT_37=3306
-#DB_DATABASE_37=arrahn_ld
-#DB_USERNAME_37=root
-#DB_PASSWORD_37=secret
-
-DB_CONNECTION_38=mysql
-DB_HOST_38=database_zone2
-DB_PORT_38=3306
-DB_DATABASE_38=arrahn_pttn2
-DB_USERNAME_38=root
-DB_PASSWORD_38=secret
-
-CACHE_DRIVER=file
-QUEUE_CONNECTION=database
-
-WABOT_API=https://app.wabot.my/api/send.php
-WABOT_INSTANCES_ID=67B69A20D329B
-WABOT_TOKEN_KEYS=66a08339284bc
-ACTIVE_JOB_SERVER=true

env.docker.example/kgmk.env

@@ -1,54 +0,0 @@
-APP_NAME=Lumen
-APP_ENV=localhost
-APP_KEY=WbPGkYNmXZ6ZQplGlvl0iZ7zyW1b09xa
-APP_DEBUG=true
-APP_URL=http://apiujrah.arrahn
-APP_TIMEZONE=Asia/Kuala_Lumpur
-
-
-LOG_CHANNEL=stack
-LOG_SLACK_WEBHOOK_URL=
-
-#tukar 12-09-23
-#DB_CONNECTION=mysql
-#DB_HOST=127.0.0.1
-#DB_PORT=3306
-#DB_DATABASE=arrahn_kb2
-#DB_USERNAME=root
-#DB_PASSWORD=secret
-
-DB_CONNECTION_2=mysql
-DB_HOST_2=database_zone_franchise
-DB_PORT_2=3306
-DB_DATABASE_2=kguru_kb
-DB_USERNAME_2=root
-DB_PASSWORD_2=secret
-
-DB_CONNECTION_3=mysql
-DB_HOST_3=database_zone_franchise
-DB_PORT_3=3306
-DB_DATABASE_3=Kguru_melor
-DB_USERNAME_3=root
-DB_PASSWORD_3=secret
-
-DB_CONNECTION_4=mysql
-DB_HOST_4=database_zone_franchise
-DB_PORT_4=3306
-DB_DATABASE_4=kguru_tumpat
-DB_USERNAME_4=root
-DB_PASSWORD_4=secret
-
-DB_CONNECTION_7=mysql
-DB_HOST_7=database_zone_franchise
-DB_PORT_7=3306
-DB_DATABASE_7=master_koopguru
-DB_USERNAME_7=root
-DB_PASSWORD_7=secret
-
-CACHE_DRIVER=file
-QUEUE_CONNECTION=database
-
-WABOT_API=https://app.wabot.my/api/send.php
-WABOT_INSTANCES_ID=67B69A20D329B
-WABOT_TOKEN_KEYS=66a08339284bc
-ACTIVE_JOB_SERVER=true

env.docker.example/krk.env

@@ -1,54 +0,0 @@
-APP_NAME=Lumen
-APP_ENV=localhost
-APP_KEY=WbPGkYNmXZ6ZQplGlvl0iZ7zyW1b09xa
-APP_DEBUG=true
-APP_URL=http://apiujrah.arrahn
-APP_TIMEZONE=Asia/Kuala_Lumpur
-
-
-LOG_CHANNEL=stack
-LOG_SLACK_WEBHOOK_URL=
-
-#tukar 12-09-23
-#DB_CONNECTION=mysql
-#DB_HOST=127.0.0.1
-#DB_PORT=3306
-#DB_DATABASE=arrahn_kb2
-#DB_USERNAME=root
-#DB_PASSWORD=secret
-
-DB_CONNECTION_3=mysql
-DB_HOST_3=database-zone-franchise
-DB_PORT_3=3306
-DB_DATABASE_3=krk_losong
-DB_USERNAME_3=root
-DB_PASSWORD_3=secret
-
-DB_CONNECTION_4=mysql
-DB_HOST_4=database-zone-franchise
-DB_PORT_4=3306
-DB_DATABASE_4=krk_kemaman
-DB_USERNAME_4=root
-DB_PASSWORD_4=secret
-
-DB_CONNECTION_5=mysql
-DB_HOST_5=database-zone-franchise
-DB_PORT_5=3306
-DB_DATABASE_5=krk_tokbali
-DB_USERNAME_5=root
-DB_PASSWORD_5=secret
-
-DB_CONNECTION_7=mysql
-DB_HOST_7=database-zone-franchise
-DB_PORT_7=3306
-DB_DATABASE_7=master_krk
-DB_USERNAME_7=root
-DB_PASSWORD_7=secret
-
-CACHE_DRIVER=file
-QUEUE_CONNECTION=database
-
-WABOT_API=https://app.wabot.my/api/send.php
-WABOT_INSTANCES_ID=67B69A20D329B
-WABOT_TOKEN_KEYS=66a08339284bc
-ACTIVE_JOB_SERVER=true

routes/web.php

@@ -58,6 +58,8 @@ $router->group(['prefix'=>'api'], function () use ($router){
     $router->get('customers/{ic}/gadai/{status}/{kodcaw}',['uses'=>'CustomerController@showOneCustomerGadaiByCawangan']);
     $router->post('customers/create/{kodcaw}',['uses'=>'CustomerController@createCustomer']);
     $router->post('customers/{ic}/mykad-photo', ['uses' => 'CustomerController@storeMykadPhotoIfMissing']);
+    $router->post('customers/{ic}/ic-scan', ['uses' => 'CustomerController@storeIcScan']);
+    $router->get('customers/{ic}/ic-scan', ['uses' => 'CustomerController@showIcScan']);
     $router->delete('customers/{kodcaw}/{nokp}', ['uses' => 'CustomerController@delete']);
     $router->put('customers/update/{nokp}', ['uses' => 'CustomerController@customerUpdate']);
     $router->put('customers/update/kaunter/{nokp}/{kodcaw}', ['uses' => 'CustomerController@customerUpdateKaunter']);
@@ -665,6 +667,13 @@ $router->group(['prefix'=>'api'], function () use ($router){
     $router->put('komuditi/transaksi',['uses'=>'KomuditiController@transaksiKomuditi']);
     $router->put('komuditi/batal',['uses'=>'KomuditiController@batalKomuditi']);
 
+    // BSAS per-Terima commodity order
+    $router->get('komuditi/bsas/orders',['uses'=>'KomuditiController@listBsasOrders']);
+    $router->post('komuditi/bsas/order',['uses'=>'KomuditiController@placeBsasOrder']);
+    $router->get('komuditi/bsas/order/norujukan/{norujukan}',['uses'=>'KomuditiController@getBsasOrderByNorujukan']);
+    $router->get('komuditi/bsas/order/{uuid}/ecert',['uses'=>'KomuditiController@getBsasOrderEcert']);
+    $router->get('komuditi/bsas/order/{uuid}',['uses'=>'KomuditiController@getBsasOrder']);
+
     $router->get('komuditi/produk',['uses'=>'KomuditiController@getKomuditiProduct']);
     $router->get('komuditi/unit',['uses'=>'KomuditiController@getKomuditiProductUnit']);
     $router->get('komuditi/description',['uses'=>'KomuditiController@getKomuditiProductDescription']);
@@ -723,6 +732,7 @@ $router->group(['prefix'=>'api'], function () use ($router){
     $router->post('pembiayaan-online/{kodcaw}/lines/{id}/unverify', ['uses' => 'PembiayaanOnlineController@unverifyLine']);
     $router->get('pembiayaan-online/{kodcaw}/lines/{id}/bukti', ['uses' => 'PembiayaanOnlineController@getBukti']);
     $router->get('pembiayaan-online/{kodcaw}/lines/{id}/bukti-akaun', ['uses' => 'PembiayaanOnlineController@getBuktiAkaun']);
+    $router->get('pembiayaan-online/{kodcaw}/lines/{id}/borang', ['uses' => 'PembiayaanOnlineController@getBorang']);
     $router->get('pembiayaan-online/{kodcaw}/lines/{id}', ['uses' => 'PembiayaanOnlineController@showLine']);
     $router->get('pembiayaan-online/{kodcaw}/batches', ['uses' => 'PembiayaanOnlineController@listBatches']);
     $router->get('pembiayaan-online/{kodcaw}/batches/{batchId}', ['uses' => 'PembiayaanOnlineController@showBatch']);