feat: single session per akun — login kedua ditolak jika sesi aktif, middleware SingleSession menendang sesi lain, logout membersihkan token, tombol Paksa Logout di manajemen user; 5 feature test

2026-08-03 10:29:26 +07:00
parent 64863456ee
commit 0aa8beee83
9 changed files with 241 additions and 2 deletions
@@ -126,6 +126,26 @@ class UserController extends Controller
            ->with('success', 'Password untuk ' . $user->name . ' berhasil direset.');
    }

+    /**
+     * Akhiri sesi aktif user (single session) — user harus login ulang.
+     */
+    public function forceLogout(User $user): RedirectResponse
+    {
+        if ($user->id === auth()->id()) {
+            return back()->with('error', 'Tidak bisa memaksa logout diri sendiri.');
+        }
+
+        $token = $user->active_session_token;
+        $user->forceFill(['active_session_token' => null])->save();
+
+        // Hapus session file lama agar perangkat lama benar-benar terlempar
+        if ($token && config('session.driver') === 'file') {
+            @unlink(storage_path('framework/sessions/'.$token));
+        }
+
+        return back()->with('success', 'Sesi '.$user->name.' diakhiri — akun bisa login kembali.');
+    }
+
    /**
     * Kirim akun (link + username + password baru) ke nomor HP user via WhatsApp.
     * Password lama tidak bisa dikirim (tersimpan hash) — jadi dibuatkan password baru.