BAB 50. SECURITY ARCHITECTURE

Tujuan

Menjamin keamanan data siswa, guru, dan sekolah yang tersimpan dalam sistem TemuBelajar sesuai dengan prinsip CIA Triad dan regulasi perlindungan data.

---

Prinsip Keamanan

Prinsip	Deskripsi
Confidentiality	Data hanya bisa diakses oleh yang berwenang
Integrity	Data tidak dapat diubah tanpa otorisasi
Availability	Sistem selalu dapat diakses saat dibutuhkan
Accountability	Setiap aksi tercatat dan dapat diaudit
Non-Repudiation	Pengguna tidak dapat menyangkal tindakannya

---

Arsitektur Keamanan Berlapis

flowchart TD
    U["👤 User"] --> HTTPS["🔒 HTTPS / TLS 1.3"]
    HTTPS --> RL["⏱️ Rate Limiter"]
    RL --> SCT["🎫 Laravel Sanctum\nToken Validation"]
    SCT --> MW["🛡️ Role Middleware\n+ School Context"]
    MW --> POL["📋 Laravel Policy\n(Resource Authorization)"]
    POL --> C["🎛️ Controller"]
    C --> SVC["⚙️ Service"]
    SVC --> REPO["🗄️ Repository"]
    REPO --> DB[("💾 Encrypted at Rest\nMySQL")]

    style HTTPS fill:#dc2626,color:#fff
    style SCT fill:#b45309,color:#fff
    style POL fill:#7c3aed,color:#fff
    style DB fill:#1f2937,color:#9ca3af

---

Komponen Keamanan

1. Authentication

Mekanisme	Implementasi
Token-based Auth	Laravel Sanctum Personal Access Token
Password Hash	Bcrypt (cost factor 12) / Argon2id
First Login	Paksa ganti password via flag
Token Storage	Flutter Secure Storage (encrypted)

2. Authorization (RBAC)

Mekanisme	Implementasi
Role-Based	Middleware role:{roleName}
Resource Policy	Laravel Policy per model
Gate	Laravel Gate untuk aksi global
School Isolation	school_id scoping di semua query

3. Input Validation & Sanitization

Ancaman	Mitigasi
SQL Injection	Eloquent ORM + parameter binding
XSS	Auto-escaping di Blade, sanitasi input
Mass Assignment	$fillable di setiap model
File Upload	MIME type + size validation

4. API Security

Fitur	Nilai
HTTPS	Wajib di production (HSTS)
Rate Limit Login	5 percobaan per menit per IP
Rate Limit API	60 request per menit
CORS	Whitelist domain yang diizinkan
CSRF	Untuk endpoint web (Blade admin panel)

---

Audit Log

Setiap aksi penting otomatis dicatat ke tabel audit_logs via Laravel Observer.

Tabel audit_logs:

Kolom	Tipe	Deskripsi
id	bigint	Primary Key
user_id	bigint	Pelaku aksi (nullable untuk system)
action	varchar	create, update, delete, login, logout
module	varchar	Nama modul (requests, bookings, dll)
record_id	bigint	ID record yang terpengaruh
old_values	json	Nilai sebelum perubahan
new_values	json	Nilai setelah perubahan
ip_address	varchar	Alamat IP pengguna
user_agent	text	Device/browser info
created_at	timestamp	Waktu kejadian

---

Threat Mitigation Matrix

Ancaman	Deskripsi	Mitigasi
SQL Injection	Query berbahaya via input	Eloquent ORM + prepared statements
XSS	Script injection di output	Auto-escape Blade + CSP header
CSRF	Cross-site request forgery	Token CSRF (Web)
Brute Force	Login berulang	Rate Limiter 5x/menit + lockout
Session Hijacking	Token dicuri	Sanctum + HTTPS + Secure Storage
Fake Check-In	GPS/QR palsu	QR one-time + GPS radius + mock detection
Unauthorized Access	Akses data tanpa izin	Policy + Middleware + school_id scope
Data Breach	Database dicuri	Hashed passwords + encrypted at rest
Privilege Escalation	Ubah role sendiri	Role hanya bisa diubah oleh admin
API Abuse	Flood request	Rate limiter + throttle middleware

---

Security Headers

// app/Http/Middleware/SecurityHeaders.php

$response->headers->set('X-Content-Type-Options', 'nosniff');
$response->headers->set('X-Frame-Options', 'DENY');
$response->headers->set('X-XSS-Protection', '1; mode=block');
$response->headers->set('Strict-Transport-Security', 'max-age=31536000; includeSubDomains');
$response->headers->set('Content-Security-Policy', "default-src 'self'");
$response->headers->set('Referrer-Policy', 'strict-origin-when-cross-origin');

---

:::important Penting Dokumen BAB 41–50 menjadi fondasi implementasi backend Laravel, middleware keamanan, repository & service layer, queue processing, notifikasi realtime, chat WebSocket, validasi QR & GPS, serta arsitektur keamanan TemuBelajar yang siap dikembangkan ke lingkungan produksi. :::