# Checklist Perbaikan Modul Biaya (`pettycast`)

Target: kompatibel dengan `PHP 5.6` dan `CodeIgniter 3`.

## P0 - Risiko Tertinggi (Keamanan & Integritas Data)

### 1. Hilangkan deserialisasi langsung dari input request
- [x] Ganti pola `unserialize(base64_decode($_GET[...] ))` menjadi payload aman (`json_decode(..., true)` + validasi tipe).
- [x] Terapkan whitelist field input.
- [x] Tolak payload invalid dengan response error terstruktur.
- File terlibat:
- `application/modules/pettycast/controllers/ActivityReport.php`
- `application/modules/pettycast/controllers/History.php`
- `application/modules/pettycast/controllers/Transaksi.php`
- `application/modules/pettycast/controllers/_processSelectBiaya.php`
- `application/modules/pettycast/controllers/_processSelectPlafonPettycash.php`
- `application/modules/pettycast/controllers/_processSelectProduct.php`
- `application/modules/pettycast/controllers/_processSelectProductKomposit.php`
- `application/modules/pettycast/controllers/_shoppingCart.php`

### 2. Tutup SQL injection pada query raw/konkatenasi string
- [x] Refactor ke Query Builder CI3 atau binding parameter (`$this->db->query($sql, $binds)`).
- [x] Pastikan semua ID numerik di-cast `(int)` sebelum dipakai query.
- [x] Hindari interpolasi string langsung ke SQL.
- File terlibat prioritas:
- `application/modules/pettycast/controllers/Create.php`
- `application/modules/pettycast/controllers/Create_total.php`
- `application/modules/pettycast/controllers/FollowUp.php`
- `application/modules/pettycast/controllers/__Create.php`
- `application/modules/pettycast/controllers/__FollowUp.php`
- `application/modules/pettycast/controllers/Transaksi.php`
- `application/modules/pettycast/controllers/History.php`
- `application/modules/pettycast/controllers/ActivityReport.php`
- `application/modules/pettycast/controllers/_processSelectBiaya.php`
- `application/modules/pettycast/controllers/_processSelectNota.php`
- `application/modules/pettycast/controllers/_processSelectNotaItem.php`
- `application/modules/pettycast/controllers/_processSelectPlafonPettycash.php`
- `application/modules/pettycast/controllers/_processSelectProduct.php`
- `application/modules/pettycast/controllers/_processSelectProductKomposit.php`
- `application/modules/pettycast/controllers/_processSelectProductPpn.php`
- `application/modules/pettycast/controllers/_shoppingCart.php`

### 3. Perkuat otorisasi endpoint kritikal
- [x] Pastikan seluruh endpoint mutasi data punya cek login + role/privilege.
- [x] Sentralisasi guard akses di `Modul_Controller.php`.
- [x] Batasi/disable `Debug.php` di environment produksi.
- File terlibat:
- `application/modules/pettycast/controllers/Modul_Controller.php`
- `application/modules/pettycast/controllers/Debug.php`
- `application/modules/pettycast/controllers/Create.php`
- `application/modules/pettycast/controllers/FollowUp.php`
- `application/modules/pettycast/controllers/Transaksi.php`
- `application/modules/pettycast/controllers/History.php`
- `application/modules/pettycast/controllers/ActivityReport.php`

## P1 - Risiko Tinggi (Persistence & Konsistensi)

### 4. Rapikan boundary transaksi database
- [x] Pastikan flow multi-query berada dalam satu transaksi (`trans_start`, `trans_complete`, `trans_status`).
- [x] Rollback eksplisit saat ada kegagalan.
- [x] Hindari commit parsial.
- File terlibat:
- `application/modules/pettycast/controllers/Create.php`
- `application/modules/pettycast/controllers/Create_total.php`
- `application/modules/pettycast/controllers/FollowUp.php`
- `application/modules/pettycast/controllers/__Create.php`
- `application/modules/pettycast/controllers/__FollowUp.php`
- `application/modules/pettycast/controllers/_shoppingCart.php`
- `application/modules/pettycast/controllers/Transaksi.php`

### 5. Cegah double submit & duplikasi simpan
- [x] Tambahkan request idempotency key per aksi simpan.
- [x] Tambahkan guard duplicate check sebelum insert/update.
- [x] Pastikan unique rule diterapkan di level data/logika.
- File terlibat:
- `application/modules/pettycast/controllers/Create.php`
- `application/modules/pettycast/controllers/Create_total.php`
- `application/modules/pettycast/controllers/FollowUp.php`
- `application/modules/pettycast/controllers/_shoppingCart.php`
- `application/modules/pettycast/controllers/Transaksi.php`

### 6. Mitigasi race condition
- [x] Lindungi update state/nilai agregat dengan locking atau version check sederhana.
- [x] Konsolidasikan read-modify-write ke transaksi yang sama.
- File terlibat:
- `application/modules/pettycast/controllers/Create.php`
- `application/modules/pettycast/controllers/Create_total.php`
- `application/modules/pettycast/controllers/FollowUp.php`
- `application/modules/pettycast/controllers/Transaksi.php`
- `application/modules/pettycast/controllers/History.php`

## P2 - Risiko Menengah (Laten/Maintainability)

### 7. Hapus penghenti proses mendadak (`die`) dan debug helper
- [ ] Ganti `die(...)` dengan error handler terstruktur + logging.
- [ ] Bersihkan helper debug di jalur produksi.
- File terlibat:
- `application/modules/pettycast/controllers/Create.php`
- `application/modules/pettycast/controllers/FollowUp.php`
- `application/modules/pettycast/controllers/Transaksi.php`
- `application/modules/pettycast/controllers/History.php`
- `application/modules/pettycast/controllers/ActivityReport.php`
- `application/modules/pettycast/controllers/Debug.php`

### 8. Tangani file legacy/duplikasi
- [ ] Tetapkan status file `__*` dan `*_OLD.php` (aktif/deprecated).
- [ ] Bila aktif, samakan patch keamanan dengan file utama.
- [ ] Bila deprecated, dokumentasikan dan nonaktifkan rute aksesnya.
- File terlibat:
- `application/modules/pettycast/controllers/__Create.php`
- `application/modules/pettycast/controllers/__FollowUp.php`
- `application/modules/pettycast/views/shoppingCart_OLD.php`
- `application/modules/pettycast/views/transaksi_OLD.php`

## P3 - Risiko Rendah (Quality Gate)

### 9. Uji regresi modul biaya
- [ ] Buat checklist uji manual untuk alur: create, follow up, transaksi, history, printing.
- [ ] Uji skenario rollback saat error DB.
- [ ] Verifikasi output view/template tetap benar.
- File terlibat:
- Semua controller/view/template modul `pettycast`.

### 10. Dokumentasi operasional
- [ ] Dokumentasikan kontrak input endpoint penting.
- [ ] Dokumentasikan konfigurasi modul biaya.
- [ ] Siapkan SOP release dan rollback.
- File terlibat:
- `application/modules/pettycast/config/_coTransaksiCore.php`
- `application/modules/pettycast/config/coTransaksiCore.php`
- `application/modules/pettycast/config/coTransaksiLayout.php`
- `application/modules/pettycast/config/coTransaksiUi.php`
- `application/modules/pettycast/config/coTransaksiValues.php`

## Cakupan File Modul (Checklist Lengkap)

### Config
- [ ] `application/modules/pettycast/config/_coTransaksiCore.php`
- [ ] `application/modules/pettycast/config/coTransaksiCore.php`
- [ ] `application/modules/pettycast/config/coTransaksiLayout.php`
- [ ] `application/modules/pettycast/config/coTransaksiUi.php`
- [ ] `application/modules/pettycast/config/coTransaksiValues.php`

### Controllers
- [ ] `application/modules/pettycast/controllers/__Create.php`
- [ ] `application/modules/pettycast/controllers/__FollowUp.php`
- [ ] `application/modules/pettycast/controllers/_construct_file.php`
- [ ] `application/modules/pettycast/controllers/_followupLiveEdit.php`
- [ ] `application/modules/pettycast/controllers/_processPihak.php`
- [ ] `application/modules/pettycast/controllers/_processPihakMain.php`
- [ ] `application/modules/pettycast/controllers/_processSelectBiaya.php`
- [ ] `application/modules/pettycast/controllers/_processSelectNota.php`
- [ ] `application/modules/pettycast/controllers/_processSelectNotaItem.php`
- [ ] `application/modules/pettycast/controllers/_processSelectPlafonPettycash.php`
- [ ] `application/modules/pettycast/controllers/_processSelectProduct.php`
- [ ] `application/modules/pettycast/controllers/_processSelectProductKomposit.php`
- [ ] `application/modules/pettycast/controllers/_processSelectProductPpn.php`
- [ ] `application/modules/pettycast/controllers/_selectorItem.php`
- [ ] `application/modules/pettycast/controllers/_selectorPihak.php`
- [ ] `application/modules/pettycast/controllers/_selectorPihakMain.php`
- [ ] `application/modules/pettycast/controllers/_shoppingCart.php`
- [ ] `application/modules/pettycast/controllers/ActivityReport.php`
- [ ] `application/modules/pettycast/controllers/Create.php`
- [ ] `application/modules/pettycast/controllers/Create_total.php`
- [ ] `application/modules/pettycast/controllers/Debug.php`
- [ ] `application/modules/pettycast/controllers/FollowUp.php`
- [ ] `application/modules/pettycast/controllers/History.php`
- [ ] `application/modules/pettycast/controllers/Modul_Controller.php`
- [ ] `application/modules/pettycast/controllers/Pembelian.php`
- [ ] `application/modules/pettycast/controllers/Printing.php`
- [ ] `application/modules/pettycast/controllers/Transaksi.php`
- [ ] `application/modules/pettycast/controllers/ViewDetails.php`

### Template
- [ ] `application/modules/pettycast/template/1671.html`
- [ ] `application/modules/pettycast/template/1671r.html`
- [ ] `application/modules/pettycast/template/1771.html`
- [ ] `application/modules/pettycast/template/671.html`
- [ ] `application/modules/pettycast/template/671r.html`
- [ ] `application/modules/pettycast/template/672.html`
- [ ] `application/modules/pettycast/template/672r.html`
- [ ] `application/modules/pettycast/template/771.html`
- [ ] `application/modules/pettycast/template/abReport.html`
- [ ] `application/modules/pettycast/template/history.html`
- [ ] `application/modules/pettycast/template/history_status.html`
- [ ] `application/modules/pettycast/template/outstanding.html`
- [ ] `application/modules/pettycast/template/outstandingConsolidate.html`
- [ ] `application/modules/pettycast/template/payment.html`
- [ ] `application/modules/pettycast/template/transaksi.html`
- [ ] `application/modules/pettycast/template/transaksi_extern.html`
- [ ] `application/modules/pettycast/template/transaksi_fullfill.html`
- [ ] `application/modules/pettycast/template/transaksi_index.html`
- [ ] `application/modules/pettycast/template/transaksi_nopihak.html`
- [ ] `application/modules/pettycast/template/transaksi_nopihak1.html`
- [ ] `application/modules/pettycast/template/transaksi_pettycash.html`
- [ ] `application/modules/pettycast/template/transaksi-modul.html`
- [ ] `application/modules/pettycast/template/viewdetails.html`

### Views
- [ ] `application/modules/pettycast/views/_selector.php`
- [ ] `application/modules/pettycast/views/activityReports.php`
- [ ] `application/modules/pettycast/views/history.php`
- [ ] `application/modules/pettycast/views/printing.php`
- [ ] `application/modules/pettycast/views/shoppingCart.php`
- [ ] `application/modules/pettycast/views/shoppingCart_OLD.php`
- [ ] `application/modules/pettycast/views/transaksi.php`
- [ ] `application/modules/pettycast/views/transaksi_modul.php`
- [ ] `application/modules/pettycast/views/transaksi_OLD.php`
- [ ] `application/modules/pettycast/views/viewdetails.php`