manjapro_v6/controller/update_withdraw.php

<?php

include '../config/connect.php';

header('Content-Type: application/json; charset=utf-8');

$response = [
    "success" => false,
    "message" => "Terjadi kesalahan"
];

if ($_SERVER['REQUEST_METHOD'] !== 'POST') {
    http_response_code(405);

    echo json_encode([
        "success" => false,
        "message" => "Method tidak diizinkan"
    ]);
    exit;
}

$id = intval($_POST['id'] ?? 0);

if ($id <= 0) {
    http_response_code(400);

    echo json_encode([
        "success" => false,
        "message" => "ID tidak valid"
    ]);
    exit;
}

/*
|--------------------------------------------------------------------------
| Validasi upload
|--------------------------------------------------------------------------
*/

if (
    !isset($_FILES['bukti_success']) ||
    !is_array($_FILES['bukti_success']) ||
    $_FILES['bukti_success']['error'] !== UPLOAD_ERR_OK
) {
    http_response_code(400);

    echo json_encode([
        "success" => false,
        "message" => "File gambar tidak ditemukan atau gagal diupload"
    ]);
    exit;
}

$file = $_FILES['bukti_success'];

/*
|--------------------------------------------------------------------------
| Pastikan benar-benar file hasil HTTP upload
|--------------------------------------------------------------------------
*/

if (!is_uploaded_file($file['tmp_name'])) {
    http_response_code(400);

    echo json_encode([
        "success" => false,
        "message" => "File upload tidak valid"
    ]);
    exit;
}

/*
|--------------------------------------------------------------------------
| Batasi ukuran file - maksimal 5 MB
|--------------------------------------------------------------------------
*/

$maxFileSize = 5 * 1024 * 1024;

if ($file['size'] <= 0 || $file['size'] > $maxFileSize) {
    http_response_code(400);

    echo json_encode([
        "success" => false,
        "message" => "Ukuran gambar maksimal 5 MB"
    ]);
    exit;
}

/*
|--------------------------------------------------------------------------
| Validasi MIME berdasarkan ISI FILE
| Jangan percaya extension / Content-Type dari browser
|--------------------------------------------------------------------------
*/

$finfo = new finfo(FILEINFO_MIME_TYPE);
$mimeType = $finfo->file($file['tmp_name']);

$allowedMimeTypes = [
    'image/jpeg' => 'jpg',
    'image/png'  => 'png',
    'image/webp' => 'webp',
];

if (!isset($allowedMimeTypes[$mimeType])) {
    http_response_code(400);

    echo json_encode([
        "success" => false,
        "message" => "Format file tidak diizinkan. Gunakan JPG, PNG, atau WEBP."
    ]);
    exit;
}

/*
|--------------------------------------------------------------------------
| Pastikan file memang dapat dibaca sebagai gambar
|--------------------------------------------------------------------------
*/

$imageInfo = @getimagesize($file['tmp_name']);

if ($imageInfo === false) {
    http_response_code(400);

    echo json_encode([
        "success" => false,
        "message" => "File bukan gambar yang valid"
    ]);
    exit;
}

/*
|--------------------------------------------------------------------------
| Tentukan folder upload
|--------------------------------------------------------------------------
*/

$uploadDir = __DIR__ . '/../img/bukti_success/';

if (!is_dir($uploadDir)) {
    if (!mkdir($uploadDir, 0755, true)) {
        http_response_code(500);

        echo json_encode([
            "success" => false,
            "message" => "Folder upload tidak dapat dibuat"
        ]);
        exit;
    }
}

/*
|--------------------------------------------------------------------------
| Nama file dibuat SERVER
| Extension berasal dari MIME hasil pemeriksaan server
|--------------------------------------------------------------------------
*/

$extension = $allowedMimeTypes[$mimeType];

try {
    $randomName = bin2hex(random_bytes(16));
} catch (Exception $e) {
    http_response_code(500);

    echo json_encode([
        "success" => false,
        "message" => "Gagal membuat nama file"
    ]);
    exit;
}

$fileName = 'bukti_' . $id . '_' . $randomName . '.' . $extension;
$filePath = $uploadDir . $fileName;

/*
|--------------------------------------------------------------------------
| Simpan file
|--------------------------------------------------------------------------
*/

if (!move_uploaded_file($file['tmp_name'], $filePath)) {
    http_response_code(500);

    echo json_encode([
        "success" => false,
        "message" => "Gagal upload file"
    ]);
    exit;
}

/*
|--------------------------------------------------------------------------
| Permission file hasil upload
|--------------------------------------------------------------------------
*/

chmod($filePath, 0644);

/*
|--------------------------------------------------------------------------
| Update transaksi withdraw
|--------------------------------------------------------------------------
*/

try {
    $sql = "UPDATE transaksi_withdraw
            SET status = 'success',
                bukti_success = :bukti,
                update_time = :update_time
            WHERE id = :id";

    $stmt = $pdo->prepare($sql);

    $stmt->execute([
        ":bukti" => "img/bukti_success/" . $fileName,
        ":update_time" => date('Y-m-d H:i:s'),
        ":id" => $id
    ]);

    /*
    |--------------------------------------------------------------------------
    | Ambil transaksi yang baru diupdate
    |--------------------------------------------------------------------------
    */

    $stmt = $pdo->prepare(
        "SELECT * FROM transaksi_withdraw WHERE id = :id"
    );

    $stmt->bindParam(':id', $id, PDO::PARAM_INT);
    $stmt->execute();

    $row = $stmt->fetch(PDO::FETCH_ASSOC);

    if ($row) {
        $numid = date('Y_md') . $id;

        $keterangan =
            "Withdraw Pendapatan Voucher Auto Pilot reff_" . $numid;

        /*
        |--------------------------------------------------------------------------
        | Cek transaksi duplikat
        |--------------------------------------------------------------------------
        */

        $stmt = $pdo->prepare(
            "SELECT keterangan
             FROM transaksi
             WHERE keterangan = :keterangan"
        );

        $stmt->bindParam(
            ':keterangan',
            $keterangan,
            PDO::PARAM_STR
        );

        $stmt->execute();

        $tagid = $stmt->fetchColumn();

        if ($tagid === false) {

            $sql = "INSERT INTO transaksi
                    (
                        id_data_server,
                        keterangan,
                        pemasukan,
                        start_time,
                        metode_pembayaran,
                        status
                    )
                    VALUES
                    (
                        :idds,
                        :keterangan,
                        :pemasukan,
                        :start_time,
                        :metode,
                        'Pendapatan Hotspot'
                    )";

            $stmt = $pdo->prepare($sql);

            $stmt->bindParam(
                ':idds',
                $row['id_data_server'],
                PDO::PARAM_INT
            );

            $stmt->bindParam(
                ':keterangan',
                $keterangan,
                PDO::PARAM_STR
            );

            $stmt->bindParam(
                ':pemasukan',
                $row['nominal'],
                PDO::PARAM_STR
            );

            $stmt->bindValue(
                ':start_time',
                date('Y-m-d H:i:s')
            );

            $stmt->bindValue(
                ':metode',
                'API Payment'
            );

            $stmt->execute();
        }
    }

    $response = [
        "success" => true,
        "message" => "Update berhasil"
    ];

} catch (Throwable $e) {

    /*
    |--------------------------------------------------------------------------
    | DB gagal → hapus file yang tadi sudah terupload
    |--------------------------------------------------------------------------
    */

    if (is_file($filePath)) {
        unlink($filePath);
    }

    http_response_code(500);

    $response = [
        "success" => false,
        "message" => "Terjadi kesalahan saat menyimpan data"
    ];
}

echo json_encode($response);