feat: single session per akun — login kedua ditolak jika sesi aktif, middleware SingleSession menendang sesi lain, logout membersihkan token, tombol Paksa Logout di manajemen user; 5 feature test

app/Http/Controllers/Admin/UserController.php

@@ -126,6 +126,26 @@ class UserController extends Controller
             ->with('success', 'Password untuk ' . $user->name . ' berhasil direset.');
     }
 
+    /**
+     * Akhiri sesi aktif user (single session) — user harus login ulang.
+     */
+    public function forceLogout(User $user): RedirectResponse
+    {
+        if ($user->id === auth()->id()) {
+            return back()->with('error', 'Tidak bisa memaksa logout diri sendiri.');
+        }
+
+        $token = $user->active_session_token;
+        $user->forceFill(['active_session_token' => null])->save();
+
+        // Hapus session file lama agar perangkat lama benar-benar terlempar
+        if ($token && config('session.driver') === 'file') {
+            @unlink(storage_path('framework/sessions/'.$token));
+        }
+
+        return back()->with('success', 'Sesi '.$user->name.' diakhiri — akun bisa login kembali.');
+    }
+
     /**
      * Kirim akun (link + username + password baru) ke nomor HP user via WhatsApp.
      * Password lama tidak bisa dikirim (tersimpan hash) — jadi dibuatkan password baru.

app/Http/Controllers/Auth/LoginController.php

@@ -23,10 +23,22 @@ class LoginController extends Controller
         ]);
 
         if (Auth::attempt($credentials, $request->boolean('remember'))) {
+            $user = Auth::user();
+
+            // Single session: tolak login bila akun masih aktif di perangkat lain
+            if ($user->sessionTokenIsAlive()) {
+                Auth::logout();
+
+                return back()->withErrors([
+                    'username' => 'Akun ini sedang digunakan di perangkat lain. Silakan logout dari perangkat tersebut terlebih dahulu.',
+                ])->onlyInput('username');
+            }
+
             $request->session()->regenerate();
+            $user->forceFill(['active_session_token' => $request->session()->getId()])->save();
 
             // Role 'other' langsung ke presensi, bukan dashboard
-            if (Auth::user()->role === 'other') {
+            if ($user->role === 'other') {
                 return redirect()->route('attendances.index');
             }
 
@@ -40,6 +52,12 @@ class LoginController extends Controller
 
     public function logout(Request $request): RedirectResponse
     {
+        $user = Auth::user();
+
+        if ($user && $user->active_session_token === $request->session()->getId()) {
+            $user->forceFill(['active_session_token' => null])->save();
+        }
+
         Auth::logout();
         $request->session()->invalidate();
         $request->session()->regenerateToken();

app/Http/Middleware/SingleSession.php

@@ -0,0 +1,41 @@
+<?php
+
+namespace App\Http\Middleware;
+
+use Closure;
+use Illuminate\Http\Request;
+use Illuminate\Support\Facades\Auth;
+use Illuminate\Support\Facades\Session;
+use Symfony\Component\HttpFoundation\Response;
+
+/**
+ * Satu akun = satu sesi aktif.
+ *
+ * Jika user sudah login di perangkat lain (active_session_token berbeda),
+ * sesi ini dianggap tidak sah → logout otomatis + arahkan ke halaman login.
+ */
+class SingleSession
+{
+    public function handle(Request $request, Closure $next): Response
+    {
+        $user = Auth::user();
+
+        if (! $user) {
+            return $next($request);
+        }
+
+        $token = $user->active_session_token;
+
+        if ($token && $token !== Session::getId()) {
+            Auth::logout();
+            $request->session()->invalidate();
+            $request->session()->regenerateToken();
+
+            return redirect()->route('login')
+                ->withErrors(['username' => 'Sesi berakhir: akun ini sedang digunakan di perangkat lain.'])
+                ->onlyInput('username');
+        }
+
+        return $next($request);
+    }
+}

app/Models/User.php

@@ -13,7 +13,7 @@ class User extends Authenticatable
     public const ROLES = ['admin', 'bk', 'wali_kelas', 'staff', 'other', 'kepala_sekolah', 'waka_kesiswaan', 'ketua_tim'];
 
     protected $fillable = [
-        'name', 'username', 'email', 'phone', 'password', 'role', 'roles', 'is_active',
+        'name', 'username', 'email', 'phone', 'password', 'role', 'roles', 'is_active', 'active_session_token',
     ];
 
     protected $hidden = ['password', 'remember_token'];
@@ -150,4 +150,24 @@ class User extends Authenticatable
     {
         return $this->hasMany(ViolationHandling::class, 'created_by');
     }
+
+    /**
+     * Cek apakah token sesi aktif masih "hidup" (session file/DB masih ada).
+     * Driver array/lain → dianggap hidup (aman, tolak login ganda).
+     */
+    public function sessionTokenIsAlive(): bool
+    {
+        $token = $this->active_session_token;
+        if (! $token) {
+            return false;
+        }
+
+        return match (config('session.driver')) {
+            'file' => file_exists(storage_path('framework/sessions/'.$token)),
+            'database' => \Illuminate\Support\Facades\DB::table(config('session.table', 'sessions'))
+                ->where('id', $token)
+                ->exists(),
+            default => true,
+        };
+    }
 }

bootstrap/app.php

@@ -23,6 +23,9 @@ return Application::configure(basePath: dirname(__DIR__))
             'role' => \App\Http\Middleware\CheckRole::class,
             'permission' => \App\Http\Middleware\PermissionMiddleware::class,
         ]);
+        $middleware->web(append: [
+            \App\Http\Middleware\SingleSession::class,
+        ]);
     })
     ->withExceptions(function (Exceptions $exceptions): void {
         $exceptions->shouldRenderJsonWhen(

database/migrations/2026_08_03_102109_add_active_session_token_to_users.php

@@ -0,0 +1,28 @@
+<?php
+
+use Illuminate\Database\Migrations\Migration;
+use Illuminate\Database\Schema\Blueprint;
+use Illuminate\Support\Facades\Schema;
+
+return new class extends Migration
+{
+    /**
+     * Run the migrations.
+     */
+    public function up(): void
+    {
+        Schema::table('users', function (Blueprint $table) {
+            $table->string('active_session_token', 191)->nullable()->after('phone');
+        });
+    }
+
+    /**
+     * Reverse the migrations.
+     */
+    public function down(): void
+    {
+        Schema::table('users', function (Blueprint $table) {
+            $table->dropColumn('active_session_token');
+        });
+    }
+};

resources/views/users/index.blade.php

@@ -131,6 +131,17 @@
                                         <i class="fa-solid fa-key"></i>
                                     </button>
                                     @if($user->id !== auth()->id())
+                                    <form action="{{ route('users.force-logout', $user->id) }}" method="POST" class="inline"
+                                          x-data x-on:submit.prevent="if(await window.confirmSwal({text:'Akhiri sesi login ' + '{{ addslashes($user->name) }}' + '? User harus login ulang.'})) $el.submit()">
+                                        @csrf
+                                        <button type="submit"
+                                            class="p-2 rounded-lg transition {{ $user->active_session_token ? 'text-slate-500 hover:bg-slate-100' : 'text-gray-300 cursor-not-allowed' }}"
+                                            title="{{ $user->active_session_token ? 'Paksa logout (akhiri sesi aktif)' : 'Tidak ada sesi aktif' }}"
+                                            @if(!$user->active_session_token) disabled @endif>
+                                            <i class="fa-solid fa-right-from-bracket"></i>
+                                        </button>
+                                    </form>
+                                    @endif
                                     <form action="{{ route('users.send-wa', $user->id) }}" method="POST" class="inline"
                                           x-data="sendWaData({{ $user->id }}, '{{ addslashes($user->name) }}', {{ $user->phone ? 'true' : 'false' }})"
                                           x-on:submit.prevent="confirmAndSubmit()">

routes/web.php

@@ -175,6 +175,7 @@ Route::middleware('auth')->group(function () {
         Route::delete('/users/{user}', [UserController::class, 'destroy'])->name('users.destroy');
         Route::post('/users/{user}/reset-password', [UserController::class, 'resetPassword'])->name('users.reset-password');
         Route::post('/users/{user}/send-wa', [UserController::class, 'sendWa'])->name('users.send-wa');
+        Route::post('/users/{user}/force-logout', [UserController::class, 'forceLogout'])->name('users.force-logout');
 
         Route::get('/settings/permissions', [\App\Http\Controllers\Admin\PermissionController::class, 'index'])->name('settings.permissions');
         Route::post('/settings/permissions', [\App\Http\Controllers\Admin\PermissionController::class, 'update'])->name('settings.permissions.update');

tests/Feature/SingleSessionTest.php

@@ -0,0 +1,97 @@
+<?php
+
+namespace Tests\Feature;
+
+use App\Models\User;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Tests\TestCase;
+
+class SingleSessionTest extends TestCase
+{
+    use RefreshDatabase;
+
+    protected function setUp(): void
+    {
+        parent::setUp();
+        $this->admin = User::factory()->create(['roles' => ['admin']]);
+    }
+
+    protected function makeUser(): User
+    {
+        return User::factory()->create([
+            'roles' => ['bk'],
+            'username' => 'bksession',
+            'password' => 'rahasia123',
+        ]);
+    }
+
+    public function test_login_menyimpan_token_sesi_aktif(): void
+    {
+        $user = $this->makeUser();
+
+        $this->post('/login', [
+            'username' => 'bksession',
+            'password' => 'rahasia123',
+        ])->assertRedirect();
+
+        $this->assertNotNull($user->refresh()->active_session_token);
+    }
+
+    public function test_login_kedua_ditolak_saat_akun_masih_aktif(): void
+    {
+        $user = $this->makeUser();
+        // Simulasikan sudah login di perangkat lain (token sesi aktif)
+        $user->forceFill(['active_session_token' => 'sesi-perangkat-lain'])->save();
+
+        $this->post('/login', [
+            'username' => 'bksession',
+            'password' => 'rahasia123',
+        ])->assertSessionHasErrors('username');
+
+        $this->assertGuest();
+        $this->assertSame('sesi-perangkat-lain', $user->refresh()->active_session_token);
+    }
+
+    public function test_middleware_mengeluarkan_sesi_yang_bukan_pemilik_token(): void
+    {
+        $user = $this->makeUser();
+        $user->forceFill(['active_session_token' => 'sesi-perangkat-lain'])->save();
+
+        // User ini "login" dengan sesi berbeda → harus ditendang ke halaman login
+        $this->actingAs($user)
+            ->get('/dashboard')
+            ->assertRedirect(route('login'));
+
+        $this->assertGuest();
+    }
+
+    public function test_logout_menghapus_token_sesi(): void
+    {
+        $user = $this->makeUser();
+        $sessionId = str_repeat('a', 40); // id sesi valid (format 40 char)
+        $user->forceFill(['active_session_token' => $sessionId])->save();
+
+        // Uji logika controller logout langsung (session id = token)
+        $request = \Illuminate\Http\Request::create('/logout', 'POST');
+        $request->setLaravelSession($this->app['session.store']);
+        $this->app['session.store']->setId($sessionId);
+        $this->actingAs($user);
+
+        (new \App\Http\Controllers\Auth\LoginController())->logout($request);
+
+        $this->assertNull($user->refresh()->active_session_token);
+    }
+
+    public function test_force_logout_membersihkan_token(): void
+    {
+        $user = $this->makeUser();
+        $user->forceFill(['active_session_token' => 'sesi-lama'])->save();
+
+        $this->actingAs($this->admin)
+            ->post("/users/{$user->id}/force-logout")
+            ->assertRedirect()
+            ->assertSessionHas('success');
+
+        $this->assertNull($user->refresh()->active_session_token);
+    }
+}