---

Daftar Isi

Part	Bab	Topik
I — Fundasi	1	Pendahuluan & Gambaran Umum
	2	Arsitektur Teknologi
	3	Struktur Database & Relasi
II — Alur	4	Alur Booking Multi-Step
	5	Sistem Autentikasi
III — Fitur	6	Fitur Web
	7	Panel Admin & Dashboard
	8	Role & Akses
IV — Pengembangan	9	Security Assessment
	10	Rekomendasi
Lampiran	A-C	File Structure, Routes, Change Log

Bab 1: Pendahuluan

1.1 4W+1H

Aspek	Deskripsi
Apa	Aplikasi booking servis AC berbasis web untuk perusahaan Top Airconditioner.
Mengapa	Mempermudah pelanggan booking layanan servis AC secara online.
Siapa	Admin, Customer, Pemilik, Staff/Teknisi
Kapan	Dikembangkan Juli 2026. Berdiri sejak 1977.
Bagaimana	CodeIgniter 3 + PHP 8.2 + MySQL + Bootstrap + Poppins

1.2 Pengguna & Role

Role	Login	Dashboard	Keterangan
Admin	email + MD5	/dashboard	Internal Pengelola penuh
Customer	email + MD5	/home	External Booking servis
Pemilik	email + MD5	/dashboard_pimpinan	Owner Laporan
Staff	username + bcrypt	/dashboard_teknisi	Internal Teknisi lapangan

1.3 Fitur Utama

#	Fitur	Status
1	Multi-step Booking (3 langkah + pembayaran)	Aktif
2	Login & Register	Aktif
3	Upload Bukti Pembayaran	Aktif
4	Admin Booking Management & Approve	Aktif
5	Staff: Update Status & Upload Hasil	Aktif
6	Laporan Booking & Hasil Kerja	Aktif
7	CRUD User, Staff, Service	Aktif

Bab 2: Arsitektur Teknologi

2.1 Tech Stack

Komponen	Teknologi	Keterangan
Backend	CodeIgniter 3.1.13	PHP MVC Framework
PHP	PHP 8.2.12	CI3 belum fully compatible
Database	MySQL / MariaDB	db_top
Frontend	Bootstrap 5 + Custom CSS	Responsive
Font	Poppins	Google Fonts
Password (Users)	MD5	⚠ Insecure
Password (Staff)	bcrypt	✅ Aman
Session	CI Files Driver	cache/sessions/

2.2 Environment & Config

Setting	Nilai	Keterangan
ENVIRONMENT	development	Error reporting aktif
base_url	http://localhost/top/
csrf_protection	FALSE	⚠ CSRF tidak aktif
encryption_key	top_aircon_secure_key_2026	Session/cookie

Bab 3: Struktur Database

3.1 users

Column	Type	Keterangan
id	int(11) PK AI
name	varchar(100)	Nama lengkap
email	varchar(100) UNIQUE	Login credential
password	varchar(255)	MD5 hash
role	enum('admin','customer','pemilik')	Default: customer

3.2 staff

Column	Type	Keterangan
id_staff	int(11) PK AI
name	varchar(100)	Nama teknisi
username	varchar(20)	Login credential
password	varchar(255)	bcrypt hash
specialist	varchar(100)	Keahlian
image_staff	varchar(255)	Foto teknisi

3.3 services

Column	Type	Keterangan
id	int(11) PK AI
name	varchar(100)	Nama layanan
type	varchar(100)	Jenis layanan
price	decimal(12,2)	Harga
status	varchar(15)	active/inactive

3.4 booking

Column	Type	Keterangan
id	int(11) PK AI
booking_code	varchar(20) UNIQUE	BK{date}{random}
service	varchar(50)	FK → services.id
status	enum(...)	6 status: pending_payment s.d. expired
payment_proof	varchar(255)	Bukti bayar
expires_at	datetime	30 menit dari pembuatan

3.5 booking_result

Column	Type	Keterangan
id_result	int(11) PK AI
booking_id	int(11)	FK → booking.id
id_staff	int(11)	FK → staff.id_staff
pekerjaan	text	Deskripsi pekerjaan
sparepart	text	Suku cadang
foto_hasil	varchar(255)	Foto hasil kerja

3.6 Relasi Antar Tabel

users 1---* booking (via email)
staff 1---* booking (via id_staf)
services 1---* booking (via service FK)
booking 1---1 booking_result (via booking_id)
staff 1---* booking_result (via id_staff)

Bab 4: Alur Booking Multi-Step

4.1 Alur Booking

Step 1: Pilih Service + Tanggal + Jam
   ↓
Step 2: Isi Data Diri (nama, email, telepon, alamat, catatan)
   ↓
Step 3: Konfirmasi Semua Data
   ↓
Confirm: Buat Booking (status: pending_payment, expires: 30 menit)
   ↓
Payment: Upload Bukti Bayar → status: paid → Receipt

4.2 Status Booking

Status	Keterangan	Oleh
pending_payment	Menunggu pembayaran (30 menit)	System
paid	Pembayaran dikonfirmasi	Customer
assigned	Staff ditugaskan	Admin
maintenance	Sedang dikerjakan	Staff
completed	Selesai	Staff
expired	Kedaluwarsa	System

4.3 Endpoint Booking

Method	URL	Controller	Keterangan
GET	/booking	Booking::index	Step 1
POST	/booking/submit	Booking::submit	Simpan step 1
POST	/booking/save_step2	Booking::save_step2	Simpan step 2
GET	/booking/step3	Booking::step3	Konfirmasi
GET	/booking/confirm	Booking::confirm	Buat booking
GET	/booking/payment/{id}	Booking::payment	Halaman bayar
POST	/booking/upload_payment/{id}	Booking::upload_payment	Upload bukti
GET	/booking/print_receipt/{id}	Booking::print_receipt	Struk

Bab 5: Sistem Autentikasi

5.1 Login Methods

Metode	Input	Hash	Redirect
User Login	email + password	MD5	By role
Staff Login	username + password	bcrypt	/dashboard_teknisi
Register	name + email + password	MD5	→ /auth/login

5.2 Session Data

Key	Value	Digunakan
user_id	User ID	Auth check
user_email	Email	Booking confirm
role	Role string	Menu, redirect
staff_id	Staff ID	Teknisi dashboard

5.3 Login Flow

Auth::login()
  ├─ Cek users table (MD5) → set session → redirect by role
  ├─ Cek staff table (bcrypt) → set session → redirect /dashboard_teknisi
  └─ Gagal → error "Email or password is incorrect"

Bab 6: Fitur Web

6.1 Halaman Publik

Halaman	URL	Keterangan
Homepage	/home	Landing page
Profil	/about	Profil perusahaan
Service	/servis	Daftar layanan
Booking	/booking	Membutuhkan login
Login	/auth/login	Form login
Register	/auth/register	Form daftar

6.2 Navigasi Menu

Menu	Tampil Ketika	Link
Home	Selalu	/home
Profil	Selalu	/about
Service	Selalu	/servis
Booking	Selalu	/booking
Doc App	Selalu	/dokumentasi
Dashboard	Login + non-customer	/dashboard
Transaksi	Login	/transaksi
Login	Belum login	/auth/login
Daftar	Belum login	/auth/register
Logout	Login	/auth/logout

Bab 7: Panel Admin

7.1 Admin Dashboard

Menu	URL	Keterangan
Dashboard	/dashboard	Stats: booking, pending, paid, assigned, completed
Booking Management	/booking_admin/bookings	List booking, filter
Approve Booking	POST /dashboard/approve	Assign staff
Hasil Pekerjaan	/booking_admin/hasil	List hasil kerja
Cetak Booking	/booking_admin/cetak_booking	Print laporan

7.2 CRUD Management

Manajemen	URL	Fitur
User	/user	List, tambah (MD5), hapus
Staff	/staff	List, tambah (bcrypt), edit, hapus, foto
Service	/services	List, tambah, edit, hapus

7.3 Dashboard per Role

Role	Dashboard	Fitur Utama
Admin	/dashboard	Stats, approve, CRUD, laporan
Customer	/home	Layanan, booking, riwayat
Pemilik	/dashboard_pimpinan	Laporan booking & hasil
Staff	/dashboard_teknisi	Booking ditugaskan, upload hasil

Bab 8: Role & Akses

8.1 Matrix Akses

Menu / Fitur	Admin	Customer	Pemilik	Staff
Homepage	✓	✓	✓	✓
Booking (form)	✓	✓	✓	✗
Transaksi	✗	✓	✗	✗
Dashboard Admin	✓	✗	✗	✗
CRUD User/Staff/Service	✓	✗	✗	✗
Laporan	✓	✗	✓	✗
Teknisi Dashboard	✗	✗	✗	✓
Upload Hasil Kerja	✗	✗	✗	✓

Bab 9: Security Assessment

9.1 Masalah Keamanan

#	Masalah	Severity
1	Password user pakai MD5	CRITICAL
2	CSRF Protection dimatikan	CRITICAL
3	Tidak ada input sanitization / XSS filtering	CRITICAL
4	Controller Staff tidak ada auth check	CRITICAL
5	Session tidak di-regenerate setelah login	HIGH
6	Tidak ada rate limiting pada login	HIGH
7	Development mode di production	HIGH
8	Cookie HttpOnly = FALSE	HIGH
9	Booking code hanya 900 kemungkinan/hari	MEDIUM
10	Tidak ada FOREIGN KEY constraints	MEDIUM

Bab 10: Rekomendasi

10.1 Prioritas Perbaikan

#	Rekomendasi	Prioritas
1	Ganti MD5 → bcrypt (password_hash())	URGENT
2	Enable CSRF protection	URGENT
3	Tambah auth check di semua controller	URGENT
4	Gunakan htmlspecialchars() di output	URGENT
5	Set ENVIRONMENT ke production	HIGH
6	Enable cookie_httponly = TRUE	HIGH
7	Tambah rate limiting login	HIGH
8	Regenerate session ID setelah login	HIGH
9	Tambah FOREIGN KEY constraints	MEDIUM
10	Fix Booking_model undefined variables	MEDIUM

10.2 Contoh Perbaikan Password

// SEBELUM (MD5 - insecure)
$password = md5($this->input->post('password'));

// SESUDAH (bcrypt - aman)
$password = password_hash($this->input->post('password'), PASSWORD_DEFAULT);

Lampiran A: File Structure

top/
├── index.php                    (Front controller)
├── db_top.sql                   (Database dump)
├── application/
│   ├── config/                  (autoload, config, routes)
│   ├── controllers/             (21 controllers)
│   ├── models/                  (5 models)
│   ├── views/                   (49 views)
│   │   ├── layout/              (header, footer, sidebar)
│   │   ├── auth/                (login, register)
│   │   ├── booking_admin/       (bookings, cetak, hasil)
│   │   ├── pimpinan/            (dashboard, laporan)
│   │   └── teknisi/             (dashboard)
│   └── cache/sessions/
├── system/                      (CI3 framework)
├── assets/
│   ├── css/style.css
│   └── img/
└── uploads/
    ├── payment/                 (Bukti bayar)
    └── hasil/                   (Foto hasil kerja)

Lampiran B: Routes

Route	Maps To	Keterangan
/	home	Homepage
about	about	Profil
servis	servis	Daftar service
booking	booking	Halaman booking
dashboard	dashboard	Admin dashboard
dokumentasi	dokumentasi	Doc App
login	auth/login	Login
logout	auth/logout	Logout

Lampiran C: Change Log

Tanggal	Versi	Perubahan
Juli 2026	1.0.0	Initial release: booking, admin, staff, CRUD, laporan, pembayaran