feat: single session per akun — login kedua ditolak jika sesi aktif, middleware SingleSession menendang sesi lain, logout membersihkan token, tombol Paksa Logout di manajemen user; 5 feature test

app/Http/Controllers/Admin/UserController.php

@@ -126,6 +126,26 @@ class UserController extends Controller
             ->with('success', 'Password untuk ' . $user->name . ' berhasil direset.');
     }
 
+    /**
+     * Akhiri sesi aktif user (single session) — user harus login ulang.
+     */
+    public function forceLogout(User $user): RedirectResponse
+    {
+        if ($user->id === auth()->id()) {
+            return back()->with('error', 'Tidak bisa memaksa logout diri sendiri.');
+        }
+
+        $token = $user->active_session_token;
+        $user->forceFill(['active_session_token' => null])->save();
+
+        // Hapus session file lama agar perangkat lama benar-benar terlempar
+        if ($token && config('session.driver') === 'file') {
+            @unlink(storage_path('framework/sessions/'.$token));
+        }
+
+        return back()->with('success', 'Sesi '.$user->name.' diakhiri — akun bisa login kembali.');
+    }
+
     /**
      * Kirim akun (link + username + password baru) ke nomor HP user via WhatsApp.
      * Password lama tidak bisa dikirim (tersimpan hash) — jadi dibuatkan password baru.

app/Http/Controllers/Auth/LoginController.php

@@ -23,10 +23,22 @@ class LoginController extends Controller
         ]);
 
         if (Auth::attempt($credentials, $request->boolean('remember'))) {
+            $user = Auth::user();
+
+            // Single session: tolak login bila akun masih aktif di perangkat lain
+            if ($user->sessionTokenIsAlive()) {
+                Auth::logout();
+
+                return back()->withErrors([
+                    'username' => 'Akun ini sedang digunakan di perangkat lain. Silakan logout dari perangkat tersebut terlebih dahulu.',
+                ])->onlyInput('username');
+            }
+
             $request->session()->regenerate();
+            $user->forceFill(['active_session_token' => $request->session()->getId()])->save();
 
             // Role 'other' langsung ke presensi, bukan dashboard
-            if (Auth::user()->role === 'other') {
+            if ($user->role === 'other') {
                 return redirect()->route('attendances.index');
             }
 
@@ -40,6 +52,12 @@ class LoginController extends Controller
 
     public function logout(Request $request): RedirectResponse
     {
+        $user = Auth::user();
+
+        if ($user && $user->active_session_token === $request->session()->getId()) {
+            $user->forceFill(['active_session_token' => null])->save();
+        }
+
         Auth::logout();
         $request->session()->invalidate();
         $request->session()->regenerateToken();