From e815bd28d5202b0fd8d934e1d39b87e6c3063505 Mon Sep 17 00:00:00 2001
From: Novy San87 <novysan87@smkn1-wonorejo.sch.id>
Date: Mon, 3 Aug 2026 14:13:09 +0700
Subject: [PATCH] Admin dikecualikan dari aturan 1 akun 1 sesi
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- LoginController: admin tidak ditolak saat login kedua (multi-sesi boleh)
- Middleware SingleSession: admin tidak ditendang walau sesi ≠ token aktif
- Alasan: admin terkunci = tidak ada yang bisa Paksa Logout akun lain
- 2 test baru (login kedua admin diterima; middleware tidak menendang admin)
---
 app/Http/Controllers/Auth/LoginController.php |  6 ++--
 app/Http/Middleware/SingleSession.php         |  6 ++++
 tests/Feature/SingleSessionTest.php           | 35 +++++++++++++++++++
 3 files changed, 45 insertions(+), 2 deletions(-)

diff --git a/app/Http/Controllers/Auth/LoginController.php b/app/Http/Controllers/Auth/LoginController.php
index 306052d..67d7293 100644
--- a/app/Http/Controllers/Auth/LoginController.php
+++ b/app/Http/Controllers/Auth/LoginController.php
@@ -25,8 +25,10 @@ class LoginController extends Controller
         if (Auth::attempt($credentials, $request->boolean('remember'))) {
             $user = Auth::user();
 
-            // Single session: tolak login bila akun masih aktif di perangkat lain
-            if ($user->sessionTokenIsAlive()) {
+            // Single session: tolak login bila akun masih aktif di perangkat lain.
+            // Admin dikecualikan (bisa multi-sesi) — kalau admin ikut terkunci,
+            // tidak ada yang bisa menyelamatkan akun lain lewat Paksa Logout.
+            if (! $user->isAdmin() && $user->sessionTokenIsAlive()) {
                 Auth::logout();
 
                 return back()->withErrors([
diff --git a/app/Http/Middleware/SingleSession.php b/app/Http/Middleware/SingleSession.php
index 5d65ec5..b26c81b 100644
--- a/app/Http/Middleware/SingleSession.php
+++ b/app/Http/Middleware/SingleSession.php
@@ -24,6 +24,12 @@ class SingleSession
             return $next($request);
         }
 
+        // Admin dikecualikan dari aturan satu-sesi — boleh login di banyak
+        // perangkat sekaligus (pengaman: admin tidak boleh ikut terkunci).
+        if ($user->isAdmin()) {
+            return $next($request);
+        }
+
         $token = $user->active_session_token;
 
         if ($token && $token !== Session::getId()) {
diff --git a/tests/Feature/SingleSessionTest.php b/tests/Feature/SingleSessionTest.php
index 1b24973..d073b74 100644
--- a/tests/Feature/SingleSessionTest.php
+++ b/tests/Feature/SingleSessionTest.php
@@ -138,4 +138,39 @@ class SingleSessionTest extends TestCase
         $this->assertTrue($user->refresh()->sessionTokenIsAlive());
         @unlink($file);
     }
+
+    public function test_admin_boleh_login_kedua_kali(): void
+    {
+        $admin = User::factory()->create([
+            'roles' => ['admin'],
+            'username' => 'adminsession',
+            'password' => 'rahasia123',
+        ]);
+        $admin->forceFill(['active_session_token' => 'sesi-perangkat-lain'])->save();
+
+        // Admin dgn token aktif di perangkat lain → login tetap DITERIMA
+        $this->post('/login', [
+            'username' => 'adminsession',
+            'password' => 'rahasia123',
+        ])->assertRedirect();
+
+        $this->assertAuthenticatedAs($admin);
+    }
+
+    public function test_admin_tidak_ditendang_middleware(): void
+    {
+        $admin = User::factory()->create([
+            'roles' => ['admin'],
+            'username' => 'adminsession2',
+            'password' => 'rahasia123',
+        ]);
+        $admin->forceFill(['active_session_token' => 'sesi-perangkat-lain'])->save();
+
+        // Sesi berbeda dari token aktif → admin tetap boleh masuk dashboard
+        $this->actingAs($admin)
+            ->get('/dashboard')
+            ->assertOk();
+
+        $this->assertAuthenticatedAs($admin);
+    }
 }