update lisensi prosess

app/Http/Controllers/Administration/BillingOrderController.php

@@ -0,0 +1,30 @@
+<?php
+
+namespace App\Http\Controllers\Administration;
+
+use App\Http\Controllers\Controller;
+use App\Models\BillingOrder;
+use App\Services\BillingService;
+use Illuminate\Http\RedirectResponse;
+use Illuminate\Http\Request;
+use Inertia\Inertia;
+use Inertia\Response;
+
+class BillingOrderController extends Controller
+{
+    public function index(Request $request): Response
+    {
+        abort_unless($request->user()->is_platform_admin, 403);
+
+        return Inertia::render('administration/billing/index', ['orders' => BillingOrder::withoutGlobalScope('tenant')->with('tenant:id,name')->latest()->paginate(30)]);
+    }
+
+    public function approve(Request $request, BillingOrder $order, BillingService $billing): RedirectResponse
+    {
+        abort_unless($request->user()->is_platform_admin, 403);
+        abort_unless($order->status === 'pending', 422, 'Order sudah diproses.');
+        $billing->activate($order, $request->user()->id);
+
+        return back()->with('success', 'Pembayaran dikonfirmasi dan lisensi diperpanjang satu bulan.');
+    }
+}

app/Http/Controllers/Administration/TenantController.php

@@ -7,6 +7,7 @@ use App\Http\Requests\Administration\StoreTenantRequest;
 use App\Http\Requests\Administration\UpdateTenantRequest;
 use App\Models\Tenant;
 use App\Models\User;
+use App\Services\LicenseEntitlementService;
 use App\Services\TenantProvisioningService;
 use Illuminate\Http\RedirectResponse;
 use Inertia\Inertia;
@@ -21,6 +22,7 @@ class TenantController extends Controller
         $tenants = Tenant::query()
             ->withCount('users')
             ->with('installations:id,tenant_id,deployment_type,domain,status,last_seen_at')
+            ->with(['licenses' => fn ($query) => $query->latest('created_at')])
             ->orderBy('name')
             ->paginate(15)
             ->withQueryString();
@@ -32,12 +34,12 @@ class TenantController extends Controller
     {
         $this->authorize('create', Tenant::class);
 
-        return Inertia::render('administration/tenants/create');
+        return Inertia::render('administration/tenants/create', ['plans' => config('billing.plans')]);
     }
 
     public function store(StoreTenantRequest $request, TenantProvisioningService $service): RedirectResponse
     {
-        $tenant = $service->createWithOwner($request->validated());
+        $tenant = $service->createWithOwner($request->validated() + ['activate_license' => true, 'issued_by' => $request->user()->id]);
 
         return to_route('administration.tenants.edit', $tenant)
             ->with('success', 'Tenant dan Tenant Owner berhasil dibuat.');
@@ -57,6 +59,8 @@ class TenantController extends Controller
             'tenant' => $tenant,
             'users' => $users,
             'installation' => $tenant->installations()->first(['id', 'deployment_type', 'domain', 'status', 'last_seen_at']),
+            'license' => $tenant->licenses()->latest('created_at')->first(),
+            'plans' => config('billing.plans'),
         ]);
     }
 
@@ -71,6 +75,12 @@ class TenantController extends Controller
                 'domain' => $data['deployment_domain'] ?? null,
             ]);
         }
+        $currentLicense = $tenant->licenses()->latest('created_at')->first();
+        if (! empty($data['plan_code']) && $currentLicense?->plan !== $data['plan_code']) {
+            $installation = $tenant->installations()->firstOrFail();
+            $tenant->licenses()->whereIn('status', ['active', 'grace'])->update(['status' => 'revoked']);
+            app(LicenseEntitlementService::class)->provisionInitial($tenant, $installation, $data['plan_code'], true, $request->user()->id);
+        }
 
         return back()->with('success', 'Tenant berhasil diperbarui.');
     }

app/Http/Controllers/Administration/UserController.php

@@ -9,6 +9,7 @@ use App\Http\Requests\Administration\StoreUserRequest;
 use App\Http\Requests\Administration\UpdateUserRequest;
 use App\Models\Tenant;
 use App\Models\User;
+use App\Services\LicenseEntitlementService;
 use Illuminate\Http\RedirectResponse;
 use Inertia\Inertia;
 use Inertia\Response;
@@ -33,11 +34,12 @@ class UserController extends Controller
     {
         abort_unless(request()->user()->can('user.create'), 403);
 
-        return Inertia::render('administration/users/create', ['tenant' => $tenant]);
+        return Inertia::render('administration/users/create', ['tenant' => $tenant, 'canManageRoles' => request()->user()->is_platform_admin]);
     }
 
     public function store(StoreUserRequest $request, Tenant $tenant): RedirectResponse
     {
+        app(LicenseEntitlementService::class)->assertCanAddUser($tenant->id);
         $data = $request->validated();
         $user = User::create([
             'tenant_id' => $tenant->id,
@@ -47,7 +49,8 @@ class UserController extends Controller
             'is_active' => $data['is_active'] ?? true,
         ]);
         $user->forceFill(['email_verified_at' => now()])->save();
-        $user->assignRole(SystemRole::TenantUser->value);
+        $role = $request->user()->is_platform_admin ? ($data['role'] ?? SystemRole::TenantUser->value) : SystemRole::TenantUser->value;
+        $user->assignRole($role);
 
         return to_route('administration.users.index', $tenant)->with('success', 'User berhasil dibuat.');
     }
@@ -60,6 +63,7 @@ class UserController extends Controller
         return Inertia::render('administration/users/edit', [
             'tenant' => $tenant,
             'managedUser' => $user->load('roles:id,name'),
+            'canManageRoles' => request()->user()->is_platform_admin,
         ]);
     }
 
@@ -68,6 +72,9 @@ class UserController extends Controller
         $this->ensureManageableUser($tenant, $user);
         $data = $request->validated();
         $user->update(['name' => $data['name'], 'email' => $data['email']]);
+        if ($request->user()->is_platform_admin && isset($data['role'])) {
+            $user->syncRoles([$data['role']]);
+        }
 
         return back()->with('success', 'User berhasil diperbarui.');
     }

app/Http/Controllers/BillingController.php

@@ -0,0 +1,56 @@
+<?php
+
+namespace App\Http\Controllers;
+
+use App\Enums\SystemRole;
+use App\Models\BillingOrder;
+use App\Models\DeploymentInstallation;
+use App\Services\LicenseEntitlementService;
+use Illuminate\Http\RedirectResponse;
+use Illuminate\Http\Request;
+use Illuminate\Validation\Rule;
+use Inertia\Inertia;
+use Inertia\Response;
+
+class BillingController extends Controller
+{
+    public function index(Request $request, LicenseEntitlementService $entitlements): Response
+    {
+        abort_unless($request->user()->hasRole(SystemRole::TenantAdmin->value), 403);
+        $installation = DeploymentInstallation::query()->firstOrFail();
+        $license = $entitlements->current($request->user()->tenant_id);
+
+        return Inertia::render('billing/index', [
+            'installation' => ['deployment_type' => $installation->deployment_type->value, 'status' => $installation->status],
+            'license' => $license ? ['plan' => $license->plan, 'status' => $license->status->value, 'max_devices' => $license->max_devices, 'max_users' => $license->max_users, 'expires_at' => $license->expires_at?->toIso8601String(), 'grace_until' => $license->grace_until?->toIso8601String()] : null,
+            'plans' => collect(config('billing.plans'))->filter(fn ($plan) => $plan['deployment'] === $installation->deployment_type->value)->map(fn ($plan, $code) => ['code' => $code, ...$plan])->values(),
+            'orders' => BillingOrder::query()->latest()->limit(20)->get(['uuid', 'plan_code', 'gateway', 'status', 'total', 'currency', 'checkout_url', 'created_at', 'expires_at']),
+            'pendingOrder' => BillingOrder::query()->where('status', 'pending')->where('expires_at', '>', now())->latest()->first(['uuid', 'plan_code', 'total', 'currency', 'expires_at']),
+            'gateways' => [config('billing.default_gateway')],
+        ]);
+    }
+
+    public function store(Request $request): RedirectResponse
+    {
+        abort_unless($request->user()->hasRole(SystemRole::TenantAdmin->value), 403);
+        $data = $request->validate([
+            'plan_code' => ['required', Rule::in(array_keys(config('billing.plans')))],
+            'gateway' => ['required', Rule::in(array_keys(config('billing.gateways')))],
+        ]);
+        $plan = config("billing.plans.{$data['plan_code']}");
+        $installation = DeploymentInstallation::query()->firstOrFail();
+        abort_unless($plan['deployment'] === $installation->deployment_type->value, 422, 'Paket tidak sesuai dengan deployment tenant.');
+        abort_if($plan['price'] === 0, 422, 'Paket gratis tidak membutuhkan checkout.');
+        BillingOrder::query()->where('status', 'pending')->where('expires_at', '<=', now())->update(['status' => 'expired']);
+        $pending = BillingOrder::query()->where('status', 'pending')->where('expires_at', '>', now())->latest()->first();
+        if ($pending) {
+            return to_route('checkout.show', $pending->uuid)->with('info', 'Selesaikan pembayaran yang masih pending sebelum membuat perpanjangan baru.');
+        }
+        $order = BillingOrder::create([
+            'tenant_id' => $request->user()->tenant_id, 'plan_code' => $data['plan_code'], 'gateway' => $data['gateway'],
+            'status' => 'pending', 'subtotal' => $plan['price'], 'tax' => 0, 'total' => $plan['price'], 'currency' => 'IDR', 'expires_at' => now()->addDay(),
+        ]);
+
+        return to_route('checkout.show', $order->uuid);
+    }
+}

app/Http/Controllers/CheckoutController.php

@@ -0,0 +1,70 @@
+<?php
+
+namespace App\Http\Controllers;
+
+use App\Billing\PaymentGatewayManager;
+use App\Models\BillingOrder;
+use Illuminate\Http\RedirectResponse;
+use Illuminate\Http\Request;
+use Inertia\Inertia;
+use Inertia\Response;
+use Throwable;
+
+class CheckoutController extends Controller
+{
+    public function show(string $order): Response
+    {
+        return $this->render($order);
+    }
+
+    public function returned(string $order): Response
+    {
+        return $this->render($order);
+    }
+
+    public function retry(Request $request, string $order, PaymentGatewayManager $gateways): RedirectResponse
+    {
+        $billingOrder = BillingOrder::withoutGlobalScope('tenant')->where('uuid', $order)->where('status', 'pending')->firstOrFail();
+        try {
+            $driver = $gateways->driver($billingOrder->gateway);
+            $methods = collect($driver->paymentMethods($billingOrder));
+            if ($methods->isNotEmpty()) {
+                $data = $request->validate(['payment_method' => ['required', 'string']]);
+                abort_unless($methods->contains('code', $data['payment_method']), 422, 'Kanal pembayaran tidak tersedia.');
+                $billingOrder->update(['payment_method' => $data['payment_method']]);
+            }
+            $billingOrder->update($driver->createCheckout($billingOrder->fresh()));
+            $billingOrder->update(['metadata' => collect($billingOrder->metadata ?? [])->except('gateway_error')->all()]);
+        } catch (Throwable $exception) {
+            report($exception);
+
+            return back()->withErrors(['payment' => str($exception->getMessage())->after(':')->trim()->toString() ?: 'Gateway pembayaran belum siap.']);
+        }
+
+        return redirect()->away($billingOrder->checkout_url);
+    }
+
+    private function render(string $uuid): Response
+    {
+        $order = BillingOrder::withoutGlobalScope('tenant')->where('uuid', $uuid)->firstOrFail();
+        $plan = config("billing.plans.{$order->plan_code}");
+        $methods = [];
+        $gatewayError = null;
+        if ($order->status === 'pending' && ! $order->checkout_url) {
+            try {
+                $methods = app(PaymentGatewayManager::class)->driver($order->gateway)->paymentMethods($order);
+            } catch (Throwable $exception) {
+                report($exception);
+                $gatewayError = str($exception->getMessage())->after(':')->trim()->toString();
+            }
+        }
+
+        return Inertia::render('checkout/show', ['order' => [
+            'uuid' => $order->uuid, 'plan' => $plan['name'], 'status' => $order->status,
+            'total' => $order->total, 'currency' => $order->currency, 'checkout_url' => $order->checkout_url,
+            'expires_at' => $order->expires_at?->toIso8601String(), 'gateway' => $order->gateway,
+            'payment_method' => $order->payment_method, 'payment_methods' => $methods,
+            'gateway_error' => $gatewayError,
+        ]]);
+    }
+}

app/Http/Controllers/DashboardController.php

@@ -39,6 +39,8 @@ class DashboardController extends Controller
         return Inertia::render('dashboard', [
             'role' => $role,
             'tenant' => $user->tenant?->only(['id', 'name', 'slug', 'is_active']),
+            'installation' => DeploymentInstallation::query()->first()?->only(['deployment_type', 'domain', 'status', 'activated_at']),
+            'license' => License::query()->latest('created_at')->first()?->only(['plan', 'status', 'max_devices', 'max_users', 'expires_at', 'grace_until']),
             'stats' => [
                 'users' => User::count(),
                 'activeUsers' => User::where('is_active', true)->count(),

app/Http/Controllers/DeviceController.php

@@ -11,6 +11,7 @@ use App\Models\DeviceModel;
 use App\Models\DeviceType;
 use App\Models\DeviceVendor;
 use App\Models\TenantDevicePolicy;
+use App\Services\LicenseEntitlementService;
 use Illuminate\Http\RedirectResponse;
 use Illuminate\Http\Request;
 use Illuminate\Support\Facades\DB;
@@ -54,6 +55,7 @@ class DeviceController extends Controller
     public function store(StoreDeviceRequest $request): RedirectResponse
     {
         $this->authorizeCreate();
+        app(LicenseEntitlementService::class)->assertCanAddDevice($request->user()->tenant_id);
         $this->validateModelCombination($request);
         $data = $request->validated();
         $username = $data['initial_username'];

app/Http/Controllers/PaymentWebhookController.php

@@ -0,0 +1,30 @@
+<?php
+
+namespace App\Http\Controllers;
+
+use App\Billing\PaymentGatewayManager;
+use App\Models\BillingOrder;
+use App\Services\BillingService;
+use Illuminate\Http\JsonResponse;
+use Illuminate\Http\Request;
+
+class PaymentWebhookController extends Controller
+{
+    public function __invoke(string $gateway, Request $request, PaymentGatewayManager $gateways, BillingService $billing): JsonResponse
+    {
+        $driver = $gateways->driver($gateway);
+        $payload = $request->all();
+        abort_unless($driver->verifyWebhook($payload, $request->headers->all()), 401, 'Invalid payment signature.');
+        $externalId = $driver->externalIdFromWebhook($payload);
+        $order = BillingOrder::withoutGlobalScope('tenant')->where('gateway', $gateway)->where('external_id', $externalId)->firstOrFail();
+        abort_unless((int) ($payload['amount'] ?? 0) === (int) $order->total, 422, 'Payment amount mismatch.');
+        $status = $driver->statusFromWebhook($payload);
+        if ($status === 'paid') {
+            $billing->activate($order);
+        } elseif ($order->status === 'pending') {
+            $order->update(['status' => $status]);
+        }
+
+        return response()->json(['success' => true]);
+    }
+}

app/Http/Middleware/EnsureTenantLicense.php

@@ -0,0 +1,33 @@
+<?php
+
+namespace App\Http\Middleware;
+
+use App\Enums\LicenseStatus;
+use App\Models\License;
+use Closure;
+use Illuminate\Http\Request;
+use Illuminate\Support\Facades\Auth;
+use Symfony\Component\HttpFoundation\Response;
+
+class EnsureTenantLicense
+{
+    public function handle(Request $request, Closure $next): Response
+    {
+        $user = $request->user();
+        if (! $user || $user->is_platform_admin || ! $user->tenant_id) {
+            return $next($request);
+        }
+        $license = License::withoutGlobalScope('tenant')->where('tenant_id', $user->tenant_id)->latest('created_at')->first();
+        $allowed = $license && in_array($license->status->value, [LicenseStatus::Active->value, LicenseStatus::Grace->value], true)
+            && ($license->grace_until ?? $license->expires_at)->isFuture();
+        if (! $allowed) {
+            Auth::guard('web')->logout();
+            $request->session()->invalidate();
+            $request->session()->regenerateToken();
+
+            return to_route('login')->with('status', 'Lisensi tenant telah berakhir. Hubungi Master Admin RADIQ untuk perpanjangan.');
+        }
+
+        return $next($request);
+    }
+}

app/Http/Requests/Administration/StoreTenantRequest.php

@@ -32,6 +32,7 @@ class StoreTenantRequest extends FormRequest
             'owner_password' => ['required', 'confirmed', Password::min(12)->mixedCase()->numbers()->symbols()],
             'deployment_type' => ['sometimes', 'in:managed_cloud,self_hosted'],
             'deployment_domain' => ['nullable', 'string', 'max:255'],
+            'plan_code' => ['sometimes', 'string', 'in:cloud_free,cloud_micro,cloud_isp,local_micro,local_isp'],
         ];
     }
 }

app/Http/Requests/Administration/StoreUserRequest.php

@@ -28,6 +28,7 @@ class StoreUserRequest extends FormRequest
             'email' => ['required', 'email', 'max:255', 'unique:users,email'],
             'password' => ['required', 'confirmed', Password::min(12)->mixedCase()->numbers()->symbols()],
             'is_active' => ['sometimes', 'boolean'],
+            'role' => ['sometimes', 'in:TENANT ADMIN,TENANT USER'],
         ];
     }
 }

app/Http/Requests/Administration/UpdateTenantRequest.php

@@ -28,6 +28,7 @@ class UpdateTenantRequest extends FormRequest
             'is_active' => ['required', 'boolean'],
             'deployment_type' => ['sometimes', 'in:managed_cloud,self_hosted'],
             'deployment_domain' => ['nullable', 'string', 'max:255'],
+            'plan_code' => ['nullable', 'string', 'in:cloud_free,cloud_micro,cloud_isp,local_micro,local_isp'],
         ];
     }
 }

app/Http/Requests/Administration/UpdateUserRequest.php

@@ -26,6 +26,7 @@ class UpdateUserRequest extends FormRequest
         return [
             'name' => ['required', 'string', 'max:255'],
             'email' => ['required', 'email', 'max:255', Rule::unique('users', 'email')->ignore($this->route('user')->id)],
+            'role' => ['sometimes', 'in:TENANT ADMIN,TENANT USER'],
         ];
     }
 }

app/Http/Responses/RegisterResponse.php

@@ -0,0 +1,25 @@
+<?php
+
+namespace App\Http\Responses;
+
+use App\Models\BillingOrder;
+use Illuminate\Support\Facades\Auth;
+use Laravel\Fortify\Contracts\RegisterResponse as RegisterResponseContract;
+
+class RegisterResponse implements RegisterResponseContract
+{
+    public function toResponse($request)
+    {
+        $user = $request->user();
+        $order = $user?->tenant_id ? BillingOrder::withoutGlobalScope('tenant')->where('tenant_id', $user->tenant_id)->latest()->first() : null;
+        if ($order) {
+            Auth::guard('web')->logout();
+            $request->session()->invalidate();
+            $request->session()->regenerateToken();
+
+            return redirect()->route('checkout.show', $order->uuid);
+        }
+
+        return redirect()->intended(config('fortify.home'));
+    }
+}