PanoricamLaravel

Imported from FikoAbdgst/PanoricamLaravel (AGENTS.md). Install upstream with npx skills add FikoAbdgst/PanoricamLaravel. Copyright stays with the author.

AGENTS.md

Project Overview

PanoricamLaravel — a Laravel 12 photobooth web app. Users browse frame templates, pick a frame, take photos in-browser (camera → canvas compositing → GIF), and receive the finished PNG + GIF strip by email. Paid frames require users to submit a payment proof which an admin manually approves. Admin panel manages frames, categories, transactions, and testimonials.

Indonesian-language UI throughout (validation messages, flash messages, controller responses).

Tech Stack

• PHP 8.2+, Laravel 12, SQLite (default DB)
• Tailwind CSS 4 + Vite 6 (via @tailwindcss/vite), laravel-vite-plugin
• midtrans/midtrans-php is installed in composer.json but never used — no Midtrans\Config setup, no MIDTRANS_* env keys, no references anywhere. Do not search for the Midtrans integration; payment is manual proof upload.
• PHPUnit 11 (tests use SQLite in-memory)
• vercel.json is empty — deployment is not actually configured

Key Commands

# Full dev stack (artisan serve + queue:listen + pail + vite, via concurrently)
composer dev

# Build frontend assets only
npm run build

# Run tests (clears config cache first, then php artisan test)
composer test
php artisan test
php artisan test --filter=test_method_name

# Create a frame template from default
php artisan frame:template {frameId}   # interactive; asks to overwrite

# DB seed (only seeder is AdminSeeder)
php artisan db:seed

php artisan config:clear   # sometimes needed if config changes aren't picked up

Architecture

Models & Relationships

• Category → hasMany Frame (fillable: name, icon)
• Frame → belongsTo Category, hasMany Testimoni; fillable: name, slug, category_id, image_path, price, used; helpers isFree() (price == 0), getTemplatePath() (falls back to default), scopeWithAverageRating/scopeOrderByRating
• Transaction → belongsTo Frame; fillable: order_id, frame_id, customer_name, whatsapp_number, payment_method, amount, payment_proof, status, approved_at; status: pending → approved/rejected; order_id format is ORD{YYYYMMDD}{6 random uppercased chars} (unique, regenerated in a loop)
• Testimoni → belongsTo Frame; fillable: rating (1–5), emoji, name, message, frame_id
• Admin — standalone model, not linked to User

Admin Auth

There is no auth middleware anywhere — bootstrap/app.php is stock (empty middleware closures). Auth is raw session:

• Login: AdminController::login validates, checks Hash::check, then Session::put(['admin_id','admin_name','admin_email']). Logout forgets them.
• Credits only exist in the seeder: database/seeders/AdminSeeder.php creates admin123@gmail.com / Admin123 (hashed).
• Guards are hand-rolled per controller method: Admin\FrameController and Admin\CategoryController each define a private checkAdminAuth() and return redirect()->route('admin.login') if session()->has('admin_id') is false.
• Gotchas: Admin\TestimoniController has no auth checks at all, and AdminController::dashboard()/transactions() also do not check auth. AdminController::checkAdminLogin() is a dead static method nobody calls. Follow the existing per-method session-check convention — do not reach for middleware unless adding it consistently.

Public Flow (routes in routes/web.php)

1. / HomeController::index — home with categories, frames, top-3 by used
2. /frame FrameTempController::index — frame catalog filtered by ?category=, ?free=true, ?sort_rating= / ?sort_popular=
3. Free frame → straight to /booth?frame_id=X. Paid frame → payment form posts to POST /payment/create
4. POST /payment/create → validates (rejects payment_method not one of bank_transfer/qris), uploads proof to storage/app/public/payment_proofs/, creates Transaction (pending), returns JSON with order_id
5. Admin approves via POST /admin/transactions/{id}/approve or rejects via .../{id}/reject (both return JSON, only work on pending)
6. /booth?frame_id=X&order_id=Y — PhotoboothController::index verifies: frame_id required, then if frame is paid it requires an approved transaction matching order_id+frame_id, else redirects back to /frame with an error.
7. /chear-check-status of transaction via GET /check-payment-status/{orderId} → JSON {success, status}
8. AJAX helpers the frontends hit: GET /get-frame-template/{id} (rendered overlay HTML), GET /get-frame-status/{id} (price/isFree JSON), POST /save-frame-photos (no-op, returns success), POST /submitTestimoni, GET /api/testimonis, GET /api/testimoni-stats

Frame Templates

Each frame slug has a matching Blade view at resources/views/admin/frames/templates/{slug}.blade.php — 84 files total (default.blade.php + 83 custom). New templates are scaffolded from default.blade.php by php artisan frame:template {id} (str-replaces the root class and title).

Template anatomy (important for editing/creating templates):

• A full-bleed <div> overlay; photo slots are absolutely-positioned [data-photo-index="N"] wrappers containing .photo-slot with <img id="photo{N}">
• Per-slot retake/recrop buttons: .retake-button and .recrop-button with data-index
• The booth page JS stamps captured photos into img#photo{N} and renders the overlay — no backend rendering of strip content
• If {slug}.blade.php doesn't exist for the requested frame, PhotoboothController::index and HomeController::getFrameTemplate use default and Log::warning(...) (these controllers duplicate the fallback logic inline; Frame::getTemplatePath()/Frame::templateExists() exist but are not used by the controllers)

Photo Capture & Email Delivery

The entire booth UI + camera/canvas/GIF logic lives client-side in the massive resources/views/booth/index.blade.php (~5800 lines). Same story for the catalog in resources/views/frame.blade.php (~3200 lines) and resources/views/components/content.blade.php (~1700 lines). Boot/setup JS is negligible (resources/js/app.js is nearly pristine). JS is NOT in resources/js — edit the blade files.

• POST /savePhoto (route name savePhoto) and POST /save-photo are both registered to PhotoboothController::savePhoto — it only validates the in-memory photo payload and increment('used') on the frame. The base64 photos/final_image are not persisted.
• POST /booth/reset-used → PhotoboothController::resetUsedStatus sets frame.used = 0 (no auth).
• Delivery: the frontend POSTs photo (PNG), gif, email, frame_id to DriveController::uploadToDrive (POST /upload-to-drive). Despite the name it just sends an email with both files attached via raw Mail::send, no Mailable class, no Google Drive. Max 10MB per file.

Email Config

config/mail.php is stock; default MAIL_MAILER=log in .env.example (emails go to the log file, "success" is fake). Real delivery needs MAIL_MAILER=smtp + SMTP creds in .env. On SMTP failure the controller returns a friendly "masalah konfigurasi email server" message.

Testing

• PHPUnit with Unit/Feature suites; phpunit.xml hardcodes DB_CONNECTION=sqlite + DB_DATABASE=:memory:, MAIL_MAILER=array, SESSION_DRIVER=array
• Only default tests/Feature/ExampleTest.php exists; RefreshDatabase is still commented out — enabling it only matters if you add real tests
• Run focused tests: php artisan test --filter=... or php artisan test tests/Feature/ExampleTest.php
• No lint CI; Pint is available (vendor/bin/pint) but not wired into any script

Gotchas

• .env is committed and tracked in git (lives in .gitignore? No — .gitignore does not exclude it). It's currently modified in the working tree. Never commit new secrets or the modified .env.
• composer.phar is committed to the repo (unusual — keep it).
• public/build (compiled assets) and public/hot are tracked; delete public/hot locally if stale.
• The frontend references POST /notify-download (booth/index.blade.php) which has no route — it 404s by design (incomplete feature), don't hunt for a handler.
• Route::fallback returns a plain "halaman tidak ada" string.
• No RefreshDatabase-based test infra; the app DB is the file database/database.sqlite.
• Dev Vite server binds 0.0.0.0 + HMR localhost for ngrok/tunnel usage — don't "fix" that.
• UI copy, comments, and JSON messages are Indonesian — keep new messages in Indonesian for consistency.