feat: single session per akun — login kedua ditolak jika sesi aktif, middleware SingleSession menendang sesi lain, logout membersihkan token, tombol Paksa Logout di manajemen user; 5 feature test

app/Http/Controllers/Admin/UserController.php

@@ -126,6 +126,26 @@ class UserController extends Controller
             ->with('success', 'Password untuk ' . $user->name . ' berhasil direset.');
     }
 
+    /**
+     * Akhiri sesi aktif user (single session) — user harus login ulang.
+     */
+    public function forceLogout(User $user): RedirectResponse
+    {
+        if ($user->id === auth()->id()) {
+            return back()->with('error', 'Tidak bisa memaksa logout diri sendiri.');
+        }
+
+        $token = $user->active_session_token;
+        $user->forceFill(['active_session_token' => null])->save();
+
+        // Hapus session file lama agar perangkat lama benar-benar terlempar
+        if ($token && config('session.driver') === 'file') {
+            @unlink(storage_path('framework/sessions/'.$token));
+        }
+
+        return back()->with('success', 'Sesi '.$user->name.' diakhiri — akun bisa login kembali.');
+    }
+
     /**
      * Kirim akun (link + username + password baru) ke nomor HP user via WhatsApp.
      * Password lama tidak bisa dikirim (tersimpan hash) — jadi dibuatkan password baru.

app/Http/Controllers/Auth/LoginController.php

@@ -23,10 +23,22 @@ class LoginController extends Controller
         ]);
 
         if (Auth::attempt($credentials, $request->boolean('remember'))) {
+            $user = Auth::user();
+
+            // Single session: tolak login bila akun masih aktif di perangkat lain
+            if ($user->sessionTokenIsAlive()) {
+                Auth::logout();
+
+                return back()->withErrors([
+                    'username' => 'Akun ini sedang digunakan di perangkat lain. Silakan logout dari perangkat tersebut terlebih dahulu.',
+                ])->onlyInput('username');
+            }
+
             $request->session()->regenerate();
+            $user->forceFill(['active_session_token' => $request->session()->getId()])->save();
 
             // Role 'other' langsung ke presensi, bukan dashboard
-            if (Auth::user()->role === 'other') {
+            if ($user->role === 'other') {
                 return redirect()->route('attendances.index');
             }
 
@@ -40,6 +52,12 @@ class LoginController extends Controller
 
     public function logout(Request $request): RedirectResponse
     {
+        $user = Auth::user();
+
+        if ($user && $user->active_session_token === $request->session()->getId()) {
+            $user->forceFill(['active_session_token' => null])->save();
+        }
+
         Auth::logout();
         $request->session()->invalidate();
         $request->session()->regenerateToken();

app/Http/Middleware/SingleSession.php

@@ -0,0 +1,41 @@
+<?php
+
+namespace App\Http\Middleware;
+
+use Closure;
+use Illuminate\Http\Request;
+use Illuminate\Support\Facades\Auth;
+use Illuminate\Support\Facades\Session;
+use Symfony\Component\HttpFoundation\Response;
+
+/**
+ * Satu akun = satu sesi aktif.
+ *
+ * Jika user sudah login di perangkat lain (active_session_token berbeda),
+ * sesi ini dianggap tidak sah → logout otomatis + arahkan ke halaman login.
+ */
+class SingleSession
+{
+    public function handle(Request $request, Closure $next): Response
+    {
+        $user = Auth::user();
+
+        if (! $user) {
+            return $next($request);
+        }
+
+        $token = $user->active_session_token;
+
+        if ($token && $token !== Session::getId()) {
+            Auth::logout();
+            $request->session()->invalidate();
+            $request->session()->regenerateToken();
+
+            return redirect()->route('login')
+                ->withErrors(['username' => 'Sesi berakhir: akun ini sedang digunakan di perangkat lain.'])
+                ->onlyInput('username');
+        }
+
+        return $next($request);
+    }
+}

app/Models/User.php

@@ -13,7 +13,7 @@ class User extends Authenticatable
     public const ROLES = ['admin', 'bk', 'wali_kelas', 'staff', 'other', 'kepala_sekolah', 'waka_kesiswaan', 'ketua_tim'];
 
     protected $fillable = [
-        'name', 'username', 'email', 'phone', 'password', 'role', 'roles', 'is_active',
+        'name', 'username', 'email', 'phone', 'password', 'role', 'roles', 'is_active', 'active_session_token',
     ];
 
     protected $hidden = ['password', 'remember_token'];
@@ -150,4 +150,24 @@ class User extends Authenticatable
     {
         return $this->hasMany(ViolationHandling::class, 'created_by');
     }
+
+    /**
+     * Cek apakah token sesi aktif masih "hidup" (session file/DB masih ada).
+     * Driver array/lain → dianggap hidup (aman, tolak login ganda).
+     */
+    public function sessionTokenIsAlive(): bool
+    {
+        $token = $this->active_session_token;
+        if (! $token) {
+            return false;
+        }
+
+        return match (config('session.driver')) {
+            'file' => file_exists(storage_path('framework/sessions/'.$token)),
+            'database' => \Illuminate\Support\Facades\DB::table(config('session.table', 'sessions'))
+                ->where('id', $token)
+                ->exists(),
+            default => true,
+        };
+    }
 }