Proyek Akhir Fase 5

toko-api/
├── drizzle/                 # file migrasi hasil drizzle-kit (di-commit)
├── scripts/smoke.js         # cek cepat setelah deploy
├── src/
│   ├── config.js            # baca + validasi environment variable
│   ├── errors.js            # HttpError
│   ├── upload.js            # multer + cek magic bytes
│   ├── app.js               # merakit Express (tanpa listen)
│   ├── server.js            # listen + graceful shutdown
│   ├── seed-admin.js        # buat akun admin pertama
│   ├── db/schema.js         # tabel + relasi Drizzle
│   ├── db/index.js          # koneksi + migrasi
│   ├── middleware/auth.js   # JWT cookie, requireAuth, requireRole
│   ├── middleware/validate.js
│   └── routes/auth.js | products.js | orders.js
├── test/api.test.js         # Vitest + Supertest
├── uploads/                 # gambar produk (tidak di-commit)
├── .env.example  .gitignore  .dockerignore  Dockerfile  ecosystem.config.cjs
├── drizzle.config.js
└── package.json

mkdir toko-api && cd toko-api
npm init -y && npm pkg set type=module
npm install express@5.3.0 drizzle-orm@0.45.4 better-sqlite3@13.0.3 zod@4.6.7 jose@6.2.13 \
  argon2@0.45.1 helmet@8.3.0 cors@2.8.6 express-rate-limit@8.7.1 multer@2.5.0 \
  pino@10.4.0 pino-http@11.0.0 cookie-parser@1.4.7
npm install -D drizzle-kit@0.31.11 vitest@5.0.5 supertest@7.3.1
mkdir -p src/db src/middleware src/routes test uploads scripts && touch uploads/.gitkeep

{
  "name": "toko-api",
  "version": "1.0.0",
  "scripts": {
    "dev": "node --watch --env-file-if-exists=.env src/server.js",
    "start": "node src/server.js",
    "db:generate": "drizzle-kit generate",
    "seed:admin": "node --env-file-if-exists=.env src/seed-admin.js",
    "test": "vitest run"
  },
  "type": "module",
  "dependencies": {
    "argon2": "^0.45.1",
    "better-sqlite3": "^13.0.3",
    "cookie-parser": "^1.4.7",
    "cors": "^2.8.6",
    "drizzle-orm": "^0.45.4",
    "express": "^5.3.0",
    "express-rate-limit": "^8.7.1",
    "helmet": "^8.3.0",
    "jose": "^6.2.13",
    "multer": "^2.5.0",
    "pino": "^10.4.0",
    "pino-http": "^11.0.0",
    "zod": "^4.6.7"
  },
  "devDependencies": {
    "drizzle-kit": "^0.31.11",
    "supertest": "^7.3.1",
    "vitest": "^5.0.5"
  },
  "engines": {
    "node": ">=24"
  },
  "private": true
}

# .env.example
NODE_ENV=development
PORT=3000
DATABASE_FILE=toko.db
# buat dengan: node -e "console.log(require('node:crypto').randomBytes(48).toString('base64url'))"
JWT_SECRET=ganti-dengan-string-acak-minimal-32-karakter
CORS_ORIGIN=http://localhost:5173
UPLOAD_DIR=uploads
LOG_LEVEL=info
AUTH_RATE_LIMIT=10

# .gitignore
node_modules
.env
*.db
*.db-*
uploads/*
!uploads/.gitkeep

import { defineConfig } from 'drizzle-kit';

export default defineConfig({
  dialect: 'sqlite',
  schema: './src/db/schema.js',
  out: './drizzle',
  dbCredentials: { url: process.env.DATABASE_FILE ?? 'toko.db' },
});

// src/config.js, baca & validasi environment variable SEKALI saat start
import { z } from 'zod';

const EnvSchema = z.object({
  NODE_ENV: z.enum(['development', 'test', 'production']).default('development'),
  PORT: z.coerce.number().int().default(3000),
  DATABASE_FILE: z.string().default('toko.db'),
  JWT_SECRET: z.string().min(32, 'JWT_SECRET minimal 32 karakter'),
  CORS_ORIGIN: z.string().default('http://localhost:5173'),
  UPLOAD_DIR: z.string().default('uploads'),
  LOG_LEVEL: z.enum(['fatal', 'error', 'warn', 'info', 'debug', 'trace', 'silent']).default('info'),
  AUTH_RATE_LIMIT: z.coerce.number().int().default(10),
});

export function loadConfig(env = process.env) {
  const hasil = EnvSchema.safeParse(env);
  if (!hasil.success) {
    console.error('Konfigurasi tidak valid:', z.flattenError(hasil.error).fieldErrors);
    process.exit(1); // gagal cepat: lebih baik mati saat start daripada error aneh di tengah jalan
  }
  const c = hasil.data;
  return { ...c, isProd: c.NODE_ENV === 'production', corsOrigins: c.CORS_ORIGIN.split(',') };
}

// src/db/schema.js, struktur tabel toko online
import { sqliteTable, integer, text } from 'drizzle-orm/sqlite-core';
import { relations, sql } from 'drizzle-orm';

export const users = sqliteTable('users', {
  id: integer('id').primaryKey({ autoIncrement: true }),
  email: text('email').notNull().unique(),
  name: text('name').notNull(),
  passwordHash: text('password_hash').notNull(),
  role: text('role', { enum: ['user', 'admin'] }).notNull().default('user'),
  createdAt: text('created_at').notNull().default(sql`(CURRENT_TIMESTAMP)`),
});

export const products = sqliteTable('products', {
  id: integer('id').primaryKey({ autoIncrement: true }),
  name: text('name').notNull(),
  description: text('description').notNull().default(''),
  price: integer('price').notNull(), // dalam rupiah, integer (hindari float untuk uang)
  stock: integer('stock').notNull().default(0),
  imageUrl: text('image_url'),
});

export const orders = sqliteTable('orders', {
  id: integer('id').primaryKey({ autoIncrement: true }),
  userId: integer('user_id').notNull().references(() => users.id),
  total: integer('total').notNull(),
  status: text('status', { enum: ['pending', 'paid', 'shipped'] }).notNull().default('pending'),
  createdAt: text('created_at').notNull().default(sql`(CURRENT_TIMESTAMP)`),
});

export const orderItems = sqliteTable('order_items', {
  id: integer('id').primaryKey({ autoIncrement: true }),
  orderId: integer('order_id').notNull().references(() => orders.id, { onDelete: 'cascade' }),
  productId: integer('product_id').notNull().references(() => products.id),
  quantity: integer('quantity').notNull(),
  price: integer('price').notNull(), // harga SAAT dibeli, bukan harga sekarang
});

export const usersRelations = relations(users, ({ many }) => ({ orders: many(orders) }));
export const ordersRelations = relations(orders, ({ one, many }) => ({
  user: one(users, { fields: [orders.userId], references: [users.id] }),
  items: many(orderItems),
}));
export const orderItemsRelations = relations(orderItems, ({ one }) => ({
  order: one(orders, { fields: [orderItems.orderId], references: [orders.id] }),
  product: one(products, { fields: [orderItems.productId], references: [products.id] }),
}));

// src/db/index.js, buka koneksi + jalankan migrasi
import Database from 'better-sqlite3';
import { drizzle } from 'drizzle-orm/better-sqlite3';
import { migrate } from 'drizzle-orm/better-sqlite3/migrator';
import * as schema from './schema.js';

export function createDb(file) {
  const sqlite = new Database(file);           // ':memory:' untuk tes
  sqlite.pragma('journal_mode = WAL');         // baca & tulis bisa jalan bersamaan
  sqlite.pragma('foreign_keys = ON');          // SQLite TIDAK menegakkan foreign key kalau ini tidak dinyalakan
  const db = drizzle({ client: sqlite, schema });
  migrate(db, { migrationsFolder: 'drizzle' });
  return db;
}

// src/errors.js, error dengan status HTTP
export class HttpError extends Error {
  constructor(status, message) { super(message); this.status = status; }
}

// src/middleware/validate.js, validasi body dengan Zod
import { z } from 'zod';

export const validate = (schema) => (req, res, next) => {
  const hasil = schema.safeParse(req.body);
  if (!hasil.success) {
    return res.status(400).json({ error: 'Input tidak valid', detail: z.flattenError(hasil.error).fieldErrors });
  }
  req.body = hasil.data; // pakai data yang sudah dibersihkan (field asing dibuang)
  next();
};

// src/middleware/auth.js, token JWT di cookie httpOnly
import { SignJWT, jwtVerify } from 'jose';

export const COOKIE_NAME = 'token';

export function makeAuth(config) {
  const key = new TextEncoder().encode(config.JWT_SECRET);

  async function signToken(user) {
    return new SignJWT({ role: user.role })
      .setProtectedHeader({ alg: 'HS256' })
      .setSubject(String(user.id))   // "sub" = id user
      .setIssuedAt()
      .setExpirationTime('2h')
      .sign(key);
  }

  function setAuthCookie(res, token) {
    res.cookie(COOKIE_NAME, token, {
      httpOnly: true,               // JavaScript di browser tidak bisa membaca
      secure: config.isProd,        // hanya lewat HTTPS di produksi
      sameSite: 'lax',              // mengurangi risiko CSRF
      maxAge: 2 * 60 * 60 * 1000,   // 2 jam, samakan dengan exp token
      path: '/',
    });
  }

  // 401: "kamu siapa?", belum login / token rusak / kedaluwarsa
  async function requireAuth(req, res, next) {
    const token = req.cookies?.[COOKIE_NAME];
    if (!token) return res.status(401).json({ error: 'Belum login' });
    try {
      const { payload } = await jwtVerify(token, key, { algorithms: ['HS256'] });
      req.user = { id: Number(payload.sub), role: payload.role };
      next();
    } catch {
      return res.status(401).json({ error: 'Sesi tidak valid atau kedaluwarsa' });
    }
  }

  // 403: "aku tahu kamu siapa, tapi kamu tidak boleh"
  function requireRole(...roles) {
    return (req, res, next) => {
      if (!roles.includes(req.user?.role)) {
        return res.status(403).json({ error: 'Akses ditolak' });
      }
      next();
    };
  }

  return { signToken, setAuthCookie, requireAuth, requireRole };
}

// src/upload.js, konfigurasi multer untuk gambar produk
import multer from 'multer';
import crypto from 'node:crypto';
import fs from 'node:fs/promises';

const EKSTENSI = { 'image/jpeg': '.jpg', 'image/png': '.png', 'image/webp': '.webp' };

export function makeUpload(uploadDir) {
  const storage = multer.diskStorage({
    destination: uploadDir,
    // nama file BUATAN SERVER, bukan nama dari user (hindari ../../ dan bentrok nama)
    filename: (req, file, cb) => cb(null, crypto.randomUUID() + EKSTENSI[file.mimetype]),
  });
  return multer({
    storage,
    limits: { fileSize: 2 * 1024 * 1024, files: 1 }, // maks 2 MB, 1 file
    fileFilter: (req, file, cb) => {
      if (EKSTENSI[file.mimetype]) return cb(null, true);
      const err = new multer.MulterError('LIMIT_UNEXPECTED_FILE', file.fieldname);
      err.message = 'Hanya JPG, PNG, atau WEBP';
      cb(err);
    },
  });
}

// mimetype dikirim browser = bisa dipalsukan. Cek "magic bytes" isi file yang asli.
export async function isRealImage(path) {
  const fh = await fs.open(path);
  const { buffer } = await fh.read(Buffer.alloc(12), 0, 12, 0);
  await fh.close();
  const hex = buffer.toString('hex');
  return hex.startsWith('ffd8ff')                       // JPEG
    || hex.startsWith('89504e47')                       // PNG
    || (hex.startsWith('52494646') && hex.slice(16, 24) === '57454250'); // RIFF....WEBP
}

// src/routes/auth.js, register, login, logout, me
import { Router } from 'express';
import argon2 from 'argon2';
import { z } from 'zod';
import { eq } from 'drizzle-orm';
import { users } from '../db/schema.js';
import { validate } from '../middleware/validate.js';
import { COOKIE_NAME } from '../middleware/auth.js';

const RegisterSchema = z.object({
  email: z.email().transform((e) => e.toLowerCase()),
  name: z.string().trim().min(2).max(60),
  password: z.string().min(8).max(128),
});
const LoginSchema = z.object({
  email: z.email().transform((e) => e.toLowerCase()),
  password: z.string().min(1).max(128),
});

// hash palsu untuk menyamakan waktu respons saat email tidak terdaftar
const DUMMY_HASH = await argon2.hash('password-palsu-untuk-timing');

const publicUser = (u) => ({ id: u.id, email: u.email, name: u.name, role: u.role });

export function authRouter({ db, auth, authLimiter }) {
  const r = Router();

  r.post('/register', authLimiter, validate(RegisterSchema), async (req, res) => {
    const { email, name, password } = req.body;
    const ada = db.select({ id: users.id }).from(users).where(eq(users.email, email)).get();
    if (ada) return res.status(409).json({ error: 'Email sudah terdaftar' });

    const passwordHash = await argon2.hash(password); // argon2id, salt otomatis
    // role TIDAK diambil dari body: user tidak boleh mendaftarkan diri jadi admin
    const user = db.insert(users).values({ email, name, passwordHash }).returning().get();
    auth.setAuthCookie(res, await auth.signToken(user));
    res.status(201).json(publicUser(user));
  });

  r.post('/login', authLimiter, validate(LoginSchema), async (req, res) => {
    const { email, password } = req.body;
    const user = db.select().from(users).where(eq(users.email, email)).get();
    const cocok = await argon2.verify(user?.passwordHash ?? DUMMY_HASH, password);
    if (!user || !cocok) {
      // pesan SAMA untuk email salah & password salah
      return res.status(401).json({ error: 'Email atau password salah' });
    }
    auth.setAuthCookie(res, await auth.signToken(user));
    res.json(publicUser(user));
  });

  r.post('/logout', (req, res) => {
    res.clearCookie(COOKIE_NAME, { path: '/' });
    res.status(204).end();
  });

  r.get('/me', auth.requireAuth, (req, res) => {
    const user = db.select().from(users).where(eq(users.id, req.user.id)).get();
    if (!user) return res.status(401).json({ error: 'User tidak ada' });
    res.json(publicUser(user));
  });

  return r;
}

// src/routes/products.js, katalog publik + CRUD khusus admin
import { Router } from 'express';
import { z } from 'zod';
import fs from 'node:fs/promises';
import { eq, like, asc } from 'drizzle-orm';
import { products } from '../db/schema.js';
import { validate } from '../middleware/validate.js';
import { isRealImage } from '../upload.js';

const ProductSchema = z.object({
  name: z.string().trim().min(2).max(100),
  description: z.string().max(2000).default(''),
  price: z.number().int().positive(),
  stock: z.number().int().min(0).default(0),
});
const QuerySchema = z.object({
  q: z.string().max(50).optional(),
  page: z.coerce.number().int().min(1).default(1),
  limit: z.coerce.number().int().min(1).max(50).default(20),
});
const IdSchema = z.coerce.number().int().positive();

export function productsRouter({ db, auth, upload }) {
  const r = Router();
  const adminOnly = [auth.requireAuth, auth.requireRole('admin')];

  r.get('/', (req, res) => {
    const parsed = QuerySchema.safeParse(req.query);
    if (!parsed.success) return res.status(400).json({ error: 'Query tidak valid' });
    const { q, page, limit } = parsed.data;
    const rows = db.select().from(products)
      .where(q ? like(products.name, `%${q}%`) : undefined) // tetap parameterized, aman
      .orderBy(asc(products.id))
      .limit(limit).offset((page - 1) * limit)
      .all();
    res.json({ data: rows, page, limit });
  });

  r.get('/:id', (req, res) => {
    const id = IdSchema.safeParse(req.params.id);
    if (!id.success) return res.status(400).json({ error: 'ID tidak valid' });
    const p = db.select().from(products).where(eq(products.id, id.data)).get();
    if (!p) return res.status(404).json({ error: 'Produk tidak ditemukan' });
    res.json(p);
  });

  r.post('/', ...adminOnly, validate(ProductSchema), (req, res) => {
    const p = db.insert(products).values(req.body).returning().get();
    res.status(201).json(p);
  });

  r.patch('/:id', ...adminOnly, validate(ProductSchema.partial()), (req, res) => {
    const id = IdSchema.safeParse(req.params.id);
    if (!id.success) return res.status(400).json({ error: 'ID tidak valid' });
    const p = db.update(products).set(req.body).where(eq(products.id, id.data)).returning().get();
    if (!p) return res.status(404).json({ error: 'Produk tidak ditemukan' });
    res.json(p);
  });

  r.delete('/:id', ...adminOnly, (req, res) => {
    const id = IdSchema.safeParse(req.params.id);
    if (!id.success) return res.status(400).json({ error: 'ID tidak valid' });
    const hasil = db.delete(products).where(eq(products.id, id.data)).run();
    if (hasil.changes === 0) return res.status(404).json({ error: 'Produk tidak ditemukan' });
    res.status(204).end();
  });

  r.post('/:id/image', ...adminOnly, upload.single('image'), async (req, res) => {
    if (!req.file) return res.status(400).json({ error: 'File gambar wajib (field "image")' });
    const id = IdSchema.safeParse(req.params.id);
    if (!id.success || !(await isRealImage(req.file.path))) {
      await fs.unlink(req.file.path); // buang file yang ditolak
      return res.status(400).json({ error: id.success ? 'Isi file bukan gambar' : 'ID tidak valid' });
    }
    const imageUrl = `/uploads/${req.file.filename}`;
    const p = db.update(products).set({ imageUrl }).where(eq(products.id, id.data)).returning().get();
    if (!p) {
      await fs.unlink(req.file.path);
      return res.status(404).json({ error: 'Produk tidak ditemukan' });
    }
    res.json(p);
  });

  return r;
}

// src/routes/orders.js, checkout (transaksi) + riwayat pesanan
import { Router } from 'express';
import { z } from 'zod';
import { eq, and, gte, sql, inArray, desc } from 'drizzle-orm';
import { products, orders, orderItems } from '../db/schema.js';
import { validate } from '../middleware/validate.js';
import { HttpError } from '../errors.js';

const OrderSchema = z.object({
  items: z.array(z.object({
    productId: z.number().int().positive(),
    quantity: z.number().int().min(1).max(100),
  })).min(1).max(50),
});

export function ordersRouter({ db, auth }) {
  const r = Router();
  r.use(auth.requireAuth); // semua endpoint pesanan wajib login

  r.post('/', validate(OrderSchema), (req, res) => {
    // better-sqlite3 = sinkron, jadi callback transaksi juga sinkron (tanpa async/await)
    const order = db.transaction((tx) => {
      const ids = req.body.items.map((i) => i.productId);
      const daftar = tx.select().from(products).where(inArray(products.id, ids)).all();
      const byId = new Map(daftar.map((p) => [p.id, p]));

      let total = 0;
      for (const item of req.body.items) {
        const p = byId.get(item.productId);
        if (!p) throw new HttpError(400, `Produk ${item.productId} tidak ada`);
        // kurangi stok HANYA kalau stoknya cukup (cek & kurangi dalam satu UPDATE)
        const upd = tx.update(products)
          .set({ stock: sql`${products.stock} - ${item.quantity}` })
          .where(and(eq(products.id, p.id), gte(products.stock, item.quantity)))
          .run();
        if (upd.changes === 0) throw new HttpError(409, `Stok ${p.name} tidak cukup`);
        total += p.price * item.quantity; // harga dari DB, BUKAN dari body request
      }

      const o = tx.insert(orders).values({ userId: req.user.id, total }).returning().get();
      tx.insert(orderItems).values(req.body.items.map((i) => ({
        orderId: o.id, productId: i.productId, quantity: i.quantity, price: byId.get(i.productId).price,
      }))).run();
      return o;
    }); // kalau ada throw di dalam → ROLLBACK otomatis, stok kembali seperti semula
    res.status(201).json(order);
  });

  r.get('/', (req, res) => {
    // admin melihat semua, user hanya miliknya sendiri
    const where = req.user.role === 'admin' ? undefined : eq(orders.userId, req.user.id);
    res.json(db.select().from(orders).where(where).orderBy(desc(orders.id)).all());
  });

  r.get('/:id', (req, res) => {
    const id = Number(req.params.id);
    const order = db.query.orders.findFirst({
      where: eq(orders.id, id),
      with: { items: { with: { product: { columns: { name: true } } } } },
    }).sync();
    // bukan milikmu → 404 (bukan 403) supaya tidak membocorkan bahwa pesanan itu ada
    if (!order || (order.userId !== req.user.id && req.user.role !== 'admin')) {
      return res.status(404).json({ error: 'Pesanan tidak ditemukan' });
    }
    res.json(order);
  });

  return r;
}

// src/app.js, merakit aplikasi (TANPA listen, supaya bisa dites)
import express from 'express';
import helmet from 'helmet';
import cors from 'cors';
import cookieParser from 'cookie-parser';
import { rateLimit } from 'express-rate-limit';
import { pinoHttp } from 'pino-http';
import pino from 'pino';
import crypto from 'node:crypto';
import multer from 'multer';
import { makeAuth } from './middleware/auth.js';
import { makeUpload } from './upload.js';
import { authRouter } from './routes/auth.js';
import { productsRouter } from './routes/products.js';
import { ordersRouter } from './routes/orders.js';

export function createApp({ db, config }) {
  const app = express();
  const logger = pino({ level: config.LOG_LEVEL, redact: ['req.headers.cookie', 'req.headers.authorization'] });
  const auth = makeAuth(config);
  const upload = makeUpload(config.UPLOAD_DIR);
  const authLimiter = rateLimit({
    windowMs: 15 * 60 * 1000, limit: config.AUTH_RATE_LIMIT,
    standardHeaders: 'draft-8', legacyHeaders: false,
    message: { error: 'Terlalu banyak percobaan, coba lagi nanti' },
  });

  app.disable('x-powered-by');
  if (config.isProd) app.set('trust proxy', 1); // di belakang Nginx: IP asli dari X-Forwarded-For
  app.use(pinoHttp({
    logger,
    genReqId: (req, res) => {
      const id = req.headers['x-request-id'] ?? crypto.randomUUID();
      res.setHeader('X-Request-Id', id);
      return id;
    },
  }));
  app.use(helmet({ crossOriginResourcePolicy: { policy: 'cross-origin' } })); // gambar boleh dipakai frontend di origin lain
  app.use(cors({ origin: config.corsOrigins, credentials: true }));
  app.use(express.json({ limit: '100kb' }));
  app.use(cookieParser());

  app.get('/health', (req, res) => {
    try {
      db.$client.prepare('SELECT 1').get(); // pastikan database masih hidup
      res.json({ status: 'ok', uptime: Math.round(process.uptime()) });
    } catch (err) {
      req.log.error({ err }, 'health check gagal');
      res.status(503).json({ status: 'error' }); // 503 = jangan kirimi trafik dulu
    }
  });
  app.use('/uploads', express.static(config.UPLOAD_DIR, { maxAge: '7d', index: false }));
  app.use('/api/auth', authRouter({ db, auth, authLimiter }));
  app.use('/api/products', productsRouter({ db, auth, upload }));
  app.use('/api/orders', ordersRouter({ db, auth }));

  app.use((req, res) => res.status(404).json({ error: 'Endpoint tidak ditemukan' }));

  // error handler: 4 parameter. Express 5 otomatis meneruskan error dari async handler ke sini.
  app.use((err, req, res, next) => {
    if (err instanceof multer.MulterError) {
      const status = err.code === 'LIMIT_FILE_SIZE' ? 413 : 400;
      return res.status(status).json({ error: err.code === 'LIMIT_FILE_SIZE' ? 'File maksimal 2 MB' : err.message });
    }
    if (err.type === 'entity.parse.failed') return res.status(400).json({ error: 'JSON rusak' });
    if (err.type === 'entity.too.large') return res.status(413).json({ error: 'Body terlalu besar' });
    const status = err.status ?? 500;
    if (status >= 500) req.log.error({ err }, 'error tak terduga');
    // jangan kirim stack trace / pesan internal ke klien
    res.status(status).json({ error: status >= 500 ? 'Terjadi kesalahan di server' : err.message });
  });

  return app;
}

// src/server.js, titik masuk: load config, buka DB, listen, graceful shutdown
import { loadConfig } from './config.js';
import { createDb } from './db/index.js';
import { createApp } from './app.js';

const config = loadConfig();
const db = createDb(config.DATABASE_FILE);
const app = createApp({ db, config });

const server = app.listen(config.PORT, () => {
  console.log(`API jalan di http://localhost:${config.PORT} (${config.NODE_ENV})`);
});

function shutdown(signal) {
  console.log(`${signal} diterima, menutup server...`);
  server.close(() => {          // berhenti terima koneksi baru, tunggu request yang sedang jalan
    db.$client.close();         // tutup database dengan rapi
    console.log('Selesai. Sampai jumpa.');
    process.exit(0);
  });
  setTimeout(() => process.exit(1), 10_000).unref(); // paksa keluar kalau macet > 10 detik
}
process.on('SIGTERM', shutdown); // dikirim Docker/systemd/PM2 saat stop
process.on('SIGINT', shutdown);  // Ctrl+C

// src/seed-admin.js, buat akun admin pertama: node --env-file=.env src/seed-admin.js email password
import argon2 from 'argon2';
import { loadConfig } from './config.js';
import { createDb } from './db/index.js';
import { users } from './db/schema.js';

const [email, password] = process.argv.slice(2);
if (!email || !password || password.length < 8) {
  console.error('Pakai: node src/seed-admin.js <email> <password-min-8>');
  process.exit(1);
}
const db = createDb(loadConfig().DATABASE_FILE);
const passwordHash = await argon2.hash(password);
const u = db.insert(users).values({ email: email.toLowerCase(), name: 'Admin', passwordHash, role: 'admin' })
  .onConflictDoUpdate({ target: users.email, set: { role: 'admin', passwordHash } })
  .returning().get();
console.log(`Admin siap: ${u.email} (id ${u.id})`);
db.$client.close();

// test/api.test.js, tes endpoint dengan database in-memory yang bersih
import { describe, it, expect, beforeEach, afterAll } from 'vitest';
import request from 'supertest';
import argon2 from 'argon2';
import fs from 'node:fs';
import os from 'node:os';
import path from 'node:path';
import { createDb } from '../src/db/index.js';
import { createApp } from '../src/app.js';
import { users } from '../src/db/schema.js';

const uploadDir = fs.mkdtempSync(path.join(os.tmpdir(), 'toko-upload-'));
const config = {
  NODE_ENV: 'test', isProd: false, LOG_LEVEL: 'silent', AUTH_RATE_LIMIT: 1000,
  JWT_SECRET: 'rahasia-khusus-tes-yang-panjangnya-lebih-dari-32',
  corsOrigins: ['http://localhost:5173'], UPLOAD_DIR: uploadDir,
};
// PNG 1x1 piksel asli (magic bytes 89 50 4E 47)
const PNG = Buffer.from('iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAADUlEQVR4nGNgYGD4DwABBAEAwS2OUAAAAABJRU5ErkJggg==', 'base64');

let app, db;
beforeEach(async () => {
  db = createDb(':memory:'); // DB baru tiap tes → tes tidak saling mengganggu
  app = createApp({ db, config });
  db.insert(users).values({ email: 'admin@toko.id', name: 'Admin', role: 'admin', passwordHash: await argon2.hash('admin12345') }).run();
});
afterAll(() => fs.rmSync(uploadDir, { recursive: true, force: true }));

// agent = "browser" yang menyimpan cookie antar request
async function loginAs(email, password) {
  const agent = request.agent(app);
  await agent.post('/api/auth/login').send({ email, password }).expect(200);
  return agent;
}
async function registerUser(email = 'budi@mail.com') {
  const agent = request.agent(app);
  await agent.post('/api/auth/register').send({ email, name: 'Budi', password: 'rahasia123' }).expect(201);
  return agent;
}
async function buatProduk(admin, data = {}) {
  const res = await admin.post('/api/products').send({ name: 'Kaos Polos', price: 75000, stock: 5, ...data }).expect(201);
  return res.body;
}

describe('auth', () => {
  it('register memasang cookie httpOnly dan tidak mengembalikan hash', async () => {
    const res = await request(app).post('/api/auth/register')
      .send({ email: 'Budi@Mail.com', name: 'Budi', password: 'rahasia123', role: 'admin' });
    expect(res.status).toBe(201);
    expect(res.body).toEqual({ id: 2, email: 'budi@mail.com', name: 'Budi', role: 'user' }); // role dari body diabaikan
    expect(res.headers['set-cookie'][0]).toMatch(/HttpOnly/);
  });

  it('email dobel → 409, input jelek → 400', async () => {
    await registerUser();
    await request(app).post('/api/auth/register').send({ email: 'budi@mail.com', name: 'Budi', password: 'rahasia123' }).expect(409);
    const res = await request(app).post('/api/auth/register').send({ email: 'bukan-email', name: 'B', password: '123' });
    expect(res.status).toBe(400);
    expect(Object.keys(res.body.detail).sort()).toEqual(['email', 'name', 'password']);
  });

  it('password salah → 401, /me tanpa cookie → 401', async () => {
    await request(app).post('/api/auth/login').send({ email: 'admin@toko.id', password: 'salah-salah' }).expect(401);
    await request(app).get('/api/auth/me').expect(401);
    const admin = await loginAs('admin@toko.id', 'admin12345');
    const me = await admin.get('/api/auth/me').expect(200);
    expect(me.body.role).toBe('admin');
  });
});

describe('produk & role', () => {
  it('user biasa tidak boleh membuat produk (403), tamu 401', async () => {
    const user = await registerUser();
    await user.post('/api/products').send({ name: 'X', price: 1 }).expect(403);
    await request(app).post('/api/products').send({ name: 'X', price: 1 }).expect(401);
  });

  it('admin CRUD produk, publik bisa membaca & mencari', async () => {
    const admin = await loginAs('admin@toko.id', 'admin12345');
    const p = await buatProduk(admin);
    await buatProduk(admin, { name: 'Topi Rimba', price: 50000 });
    await admin.patch(`/api/products/${p.id}`).send({ price: 80000 }).expect(200);
    const list = await request(app).get('/api/products?q=kaos').expect(200);
    expect(list.body.data).toHaveLength(1);
    expect(list.body.data[0].price).toBe(80000);
    await admin.delete(`/api/products/${p.id}`).expect(204);
    await request(app).get(`/api/products/${p.id}`).expect(404);
  });

  it('upload gambar: PNG asli diterima, teks menyamar jadi PNG ditolak', async () => {
    const admin = await loginAs('admin@toko.id', 'admin12345');
    const p = await buatProduk(admin);
    const ok = await admin.post(`/api/products/${p.id}/image`).attach('image', PNG, { filename: 'kaos.png', contentType: 'image/png' });
    expect(ok.status).toBe(200);
    expect(ok.body.imageUrl).toMatch(/^\/uploads\/[0-9a-f-]+\.png$/);
    await request(app).get(ok.body.imageUrl).expect(200).expect('content-type', 'image/png');

    const palsu = await admin.post(`/api/products/${p.id}/image`).attach('image', Buffer.from('<?php echo 1; ?>'), { filename: 'x.png', contentType: 'image/png' });
    expect(palsu.status).toBe(400);
    const pdf = await admin.post(`/api/products/${p.id}/image`).attach('image', Buffer.from('%PDF'), { filename: 'x.pdf', contentType: 'application/pdf' });
    expect(pdf.status).toBe(400);
  });
});

describe('pesanan', () => {
  it('checkout mengurangi stok, total dihitung server', async () => {
    const admin = await loginAs('admin@toko.id', 'admin12345');
    const p = await buatProduk(admin);
    const user = await registerUser();
    const res = await user.post('/api/orders').send({ items: [{ productId: p.id, quantity: 2 }] }).expect(201);
    expect(res.body.total).toBe(150000);
    const sesudah = await request(app).get(`/api/products/${p.id}`);
    expect(sesudah.body.stock).toBe(3);
  });

  it('stok kurang → 409 dan TIDAK ada perubahan (rollback)', async () => {
    const admin = await loginAs('admin@toko.id', 'admin12345');
    const a = await buatProduk(admin, { name: 'Produk A', stock: 10 });
    const b = await buatProduk(admin, { name: 'Produk B', stock: 1 });
    const user = await registerUser();
    await user.post('/api/orders').send({ items: [{ productId: a.id, quantity: 3 }, { productId: b.id, quantity: 5 }] }).expect(409);
    expect((await request(app).get(`/api/products/${a.id}`)).body.stock).toBe(10); // stok A kembali utuh
    expect((await user.get('/api/orders')).body).toHaveLength(0);
  });

  it('user lain tidak bisa melihat pesanan orang (404), admin bisa', async () => {
    const admin = await loginAs('admin@toko.id', 'admin12345');
    const p = await buatProduk(admin);
    const budi = await registerUser('budi@mail.com');
    const siti = await registerUser('siti@mail.com');
    const order = (await budi.post('/api/orders').send({ items: [{ productId: p.id, quantity: 1 }] })).body;
    await siti.get(`/api/orders/${order.id}`).expect(404);
    const detail = await budi.get(`/api/orders/${order.id}`).expect(200);
    expect(detail.body.items[0].product.name).toBe('Kaos Polos');
    await admin.get(`/api/orders/${order.id}`).expect(200);
  });
});

describe('keamanan dasar', () => {
  it('header helmet terpasang dan x-powered-by hilang', async () => {
    const res = await request(app).get('/health').expect(200);
    expect(res.headers['x-content-type-options']).toBe('nosniff');
    expect(res.headers['x-powered-by']).toBeUndefined();
    expect(res.headers['x-request-id']).toBeDefined();
  });
  it('JSON rusak → 400 rapi, bukan stack trace', async () => {
    const res = await request(app).post('/api/auth/login').set('content-type', 'application/json').send('{"email":');
    expect(res.status).toBe(400);
    expect(res.body).toEqual({ error: 'JSON rusak' });
  });
});