- Add admin_id FK to kontrakans table
- Add authorization checks to KontrakanController (edit, update, destroy, bulkDestroy)
- Add authorization checks to BookingController (store, bulkDestroy)
- Fix EnsureRole middleware to use auth:admin guard
- Fix booking index stats to filter by admin ownership
- Add model relationships: Admin.kontrakans(), Admin.isSuperAdmin(), Admin.isAdmin()
- Ensure admin biasa sees only their data, super_admin sees all data
- Secure bulk delete operations with per-item admin validation
- Add rate limiting (api:60/min, login:5/min, register:3/hour, saw:30/min)
- Implement centralized JSON error handler for all API exceptions
- Create 6 Form Request classes for input validation
- Fix N+1 query problems with withCount and eager loading
- Add caching for kriteria queries (1 hour cache)
- Create /api/health and /api/docs documentation endpoints
- Fix export system: CSV export instead of Excel (package not installed)
- Restrict CORS to specific origins, set Sanctum token expiration (30 days)
- Add error_code fields to all API responses
- Update pagination views to remove large arrow icons, replace with text buttons
- Fix field name consistency: use correct database columns
- Add SQL injection prevention via sort column whitelist
- Optimize pagination UI for Activity Logs and other pages
micko samawa