fix: menu Riwayat Poin pindah ke seksi Administrasi, akses khusus admin (revoke semua role non-admin)

database/migrations/2026_08_03_091948_revoke_point_audit_non_admin.php

@@ -0,0 +1,36 @@
+<?php
+
+use Illuminate\Database\Migrations\Migration;
+use Illuminate\Support\Facades\DB;
+
+return new class extends Migration
+{
+    /**
+     * Riwayat Poin khusus ADMIN: cabut akses dari semua role non-admin.
+     * Admin tetap bisa via User::isAdmin() (canPermission selalu true).
+     */
+    public function up(): void
+    {
+        $permissionId = DB::table('permissions')->where('key', 'view-point-audit')->value('id');
+        if (! $permissionId) {
+            return;
+        }
+
+        DB::table('role_permissions')->where('permission_id', $permissionId)->delete();
+    }
+
+    public function down(): void
+    {
+        $permissionId = DB::table('permissions')->where('key', 'view-point-audit')->value('id');
+        if (! $permissionId) {
+            return;
+        }
+
+        foreach (['bk', 'waka_kesiswaan', 'ketua_tim', 'kepala_sekolah', 'wali_kelas', 'staff'] as $role) {
+            DB::table('role_permissions')->updateOrInsert(
+                ['role' => $role, 'permission_id' => $permissionId],
+                ['created_at' => now(), 'updated_at' => now()]
+            );
+        }
+    }
+};

resources/views/layouts/app.blade.php

@@ -171,10 +171,6 @@
                 <x-nav-item href="{{ route('reports.violations') }}" icon="file-lines" :active="request()->routeIs('reports.violations*')">Laporan</x-nav-item>
                 @endcanPermission
 
-                @canPermission('view-point-audit')
-                <x-nav-item href="{{ route('point-audit.index') }}" icon="clock-rotate-left" :active="request()->routeIs('point-audit.*')">Riwayat Poin</x-nav-item>
-                @endcanPermission
-
                 @canPermission('categories-manage')
                 <div class="pt-4 mt-4 border-t border-gray-200">
                     <p class="px-3 text-xs font-semibold text-gray-500 uppercase tracking-wider">Master Data</p>
@@ -194,6 +190,9 @@
                     <p class="px-3 text-xs font-semibold text-gray-500 uppercase tracking-wider">Administrasi</p>
                 </div>
                 @endcanPermission
+                @canPermission('view-point-audit')
+                <x-nav-item href="{{ route('point-audit.index') }}" icon="clock-rotate-left" :active="request()->routeIs('point-audit.*')">Riwayat Poin</x-nav-item>
+                @endcanPermission
                 @canPermission('sync-data')
                 <x-nav-item href="{{ route('settings.sync') }}" icon="refresh" :active="request()->routeIs('settings.sync*')">Sinkronisasi</x-nav-item>
                 @endcanPermission

tests/Feature/PointAuditTest.php

@@ -120,7 +120,8 @@ class PointAuditTest extends TestCase
             'violation_date' => '2026-08-01',
         ], $this->bk->id);
 
-        $this->actingAs($this->bk)
+        // Riwayat Poin khusus admin
+        $this->actingAs(User::factory()->create(['roles' => ['admin']]))
             ->get('/point-audit')
             ->assertOk()
             ->assertSee('Riwayat Perubahan Poin')
@@ -128,4 +129,9 @@ class PointAuditTest extends TestCase
             ->assertSee('Pencatatan')
             ->assertSee('Terlambat 15 menit');
     }
+
+    public function test_bk_tidak_bisa_membuka_riwayat_poin(): void
+    {
+        $this->actingAs($this->bk)->get('/point-audit')->assertForbidden();
+    }
 }