prn2026/docs/progress-log.md

Progress Log

2026-05-28 - Phase 0: Project Inspection and Planning

Status: Completed

Completed:

• Inspected workspace.
• Confirmed workspace is currently empty.
• Confirmed no git repository is initialized.
• Confirmed no existing Laravel application is present.
• Confirmed no AGENTS.md project instruction file is present.
• Checked local tooling:
  • PHP 8.5.1 available.
  • Composer 2.9.4 available.
  • Node 25.1.0 available.
  • npm.cmd 11.14.1 available.
  • npm PowerShell shim blocked by execution policy.
  • MySQL CLI not available in PATH.
• Created Phase 0 planning documentation.

Changed files:

• docs/00-project-brief.md
• docs/01-development-plan.md
• docs/02-architecture.md
• docs/03-database-design.md
• docs/04-rbac-permission-matrix.md
• docs/05-workflow-design.md
• docs/06-ui-ux-plan.md
• docs/07-testing-plan.md
• docs/08-deployment-notes.md
• docs/decision-log.md
• docs/progress-log.md
• docs/changelog.md

Pending items:

• Initialize or create Laravel project in Phase 1.
• Confirm exact Laravel version during install.
• Confirm MySQL server credentials and connectivity.
• Verify package compatibility during Composer/npm installation.
• Initialize git repository if desired.

Next step:

• Proceed to Phase 1 only after approval: Laravel setup, authentication scaffolding, Bootstrap 5 base layout, roles, permissions, and base dashboards.

Manual testing for this phase:

• Review documentation files for completeness.
• Confirm assumptions in docs/decision-log.md.

2026-05-28 - Phase 0 Review Before Implementation

Status: Completed

Completed:

• Reviewed all Phase 0 documentation files against the original requirement.
• Confirmed the required documentation set is present.
• Clarified Phase 1 package baseline in the development plan.
• Clarified election_settings.is_registration_open in database and workflow design.
• Recorded optional Telescope and DOMPDF decisions.

Changed files:

• docs/01-development-plan.md
• docs/03-database-design.md
• docs/05-workflow-design.md
• docs/decision-log.md
• docs/progress-log.md

Pending items:

• Proceed with Phase 1 implementation.

Next step:

• Scaffold Laravel, install packages, configure authentication, Bootstrap layout, roles/permissions, and base dashboards.

2026-05-28 - Phase 1: Laravel Setup and Authentication

Status: Completed

Completed:

• Scaffolded Laravel application.
• Installed Laravel framework 13.12.0.
• Installed Laravel Breeze authentication scaffolding.
• Disabled generic public account registration route.
• Installed and configured Bootstrap 5 layout through Vite.
• Installed Bootstrap Icons, jQuery, SweetAlert2, Tom Select, Flatpickr, and DataTables Bootstrap packages.
• Installed spatie/laravel-permission and published migrations/config.
• Installed spatie/laravel-activitylog and published migrations/config.
• Installed simplesoftwareio/simple-qrcode.
• Attempted maatwebsite/excel; Composer rejected it for PHP 8.5.1/Laravel 13 compatibility.
• Installed openspout/openspout as compatible spreadsheet export foundation.
• Installed Larastan/PHPStan.
• Added role middleware aliases.
• Added User HasRoles support.
• Added role and permission seeder.
• Added default Admin seeding through config/prn.php.
• Added role-based dashboard routes and base dashboard UI.
• Updated auth/profile/welcome views to Bootstrap.
• Updated .env.example for MySQL.
• Set application timezone to Asia/Kuala_Lumpur.
• Kept local .env on SQLite because MySQL server credentials are not yet available.
• Added tests for disabled registration and dashboard role protection.

Changed files:

• Laravel application scaffold files.
• app/Http/Controllers/DashboardController.php
• app/Models/User.php
• bootstrap/app.php
• config/activitylog.php
• config/permission.php
• config/prn.php
• config/app.php
• database/migrations/*permission*
• database/migrations/*activity_log*
• database/seeders/DatabaseSeeder.php
• database/seeders/RolePermissionSeeder.php
• resources/css/app.css
• resources/js/app.js
• resources/views/auth/*.blade.php
• resources/views/dashboards/index.blade.php
• resources/views/layouts/*.blade.php
• resources/views/profile/edit.blade.php
• resources/views/welcome.blade.php
• routes/auth.php
• routes/web.php
• tests/Feature/Auth/RegistrationTest.php
• tests/Feature/DashboardAccessTest.php
• .env.example
• .gitignore
• composer.json
• composer.lock
• package.json
• package-lock.json
• phpstan.neon
• docs/*

Verification:

• php artisan migrate --seed completed after seeder correction.
• php artisan db:seed completed.
• npm.cmd run build passed.
• php artisan route:list passed.
• php artisan test passed: 27 tests, 64 assertions.
• vendor\bin\pint.bat --test passed.
• vendor\bin\phpstan.bat analyse --memory-limit=1G passed.

Pending items:

• Confirm MySQL database credentials and switch local .env to MySQL when available.
• Implement Phase 2 core domain migrations/models/seeders.
• Replace OpenSpout with maatwebsite/excel only if a compatible release becomes available or runtime PHP target changes.

Manual testing:

• Visit /.
• Log in as seeded Admin:
  • email: admin@prn.local
  • password: password
• Confirm /dashboard redirects Admin to /admin/dashboard.
• Confirm /register is not available.
• Resize browser to confirm mobile navbar behavior.

Next step:

• Phase 2: Core database and seeders for election hierarchy, positions, quotas, applications, assignments, and operational records.

2026-05-28 - Phase 2: Core Database and Seeders

Status: Completed

Completed:

• Added core election-domain migration.
• Added user_profiles, election hierarchy, position/quota, application/document/history, assignment/history, representative, wheelchair, attendance, finance, export, and note tables.
• Added domain models and Eloquent relationships.
• Added baseline factories for election hierarchy, positions, applications, and assignments.
• Added PositionSeeder.
• Added SampleElectionSeeder.
• Updated DatabaseSeeder to seed roles, positions, Admin user, and sample election data.
• Seeded sample election PRN2026.
• Seeded one Bahagian Pilihanraya, one Daerah Mengundi, one Pusat Mengundi, and three Saluran Mengundi.
• Seeded 9 default positions and 17 sample quotas.
• Seeded sample Admin Kewangan, PPM, and KTM users.
• Seeded sample dual-role assignment where one user is both PPM and KTM.
• Seeded sample wheelchair allocation.
• Added feature test for core domain seeder output and dual-role assignment.
• Confirmed MySQL connection through Laravel/PDO.
• Shortened long composite index names for MySQL compatibility.

Changed files:

• database/migrations/2026_05_28_030000_create_phase2_core_domain_tables.php
• app/Models/*.php
• database/factories/*.php
• database/seeders/DatabaseSeeder.php
• database/seeders/PositionSeeder.php
• database/seeders/SampleElectionSeeder.php
• tests/Feature/CoreDomainSeederTest.php
• docs/00-project-brief.md
• docs/01-development-plan.md
• docs/03-database-design.md
• docs/07-testing-plan.md
• docs/08-deployment-notes.md
• docs/decision-log.md
• docs/progress-log.md
• docs/changelog.md

Verification:

• php artisan migrate:fresh --seed passed on MySQL database prn2026.
• php artisan test passed: 28 tests, 80 assertions.
• vendor\bin\pint.bat --test passed.
• vendor\bin\phpstan.bat analyse --memory-limit=1G passed.

Manual testing:

• Log in as admin@prn.local / password.
• Confirm base dashboard loads after fresh seed.
• Optional sample accounts:
  • kewangan@prn.local / password
  • ppm@prn.local / password
  • ktm@prn.local / password
• Confirm /dashboard redirects based on each user's role.

Pending items:

• Phase 3 Admin setup module UI and CRUD.
• Implement policy-level ownership checks when domain UI routes are added.
• Add business-rule services for vacancy and registration period calculations in later phases.

Next step:

• Phase 3: Admin setup module for CRUD Bahagian, Daerah, Pusat, Saluran, Jawatan/quota setup, PPM assignment, and QR generation.

2026-05-29 - Phase 3: Admin Setup Module

Status: Completed

Completed:

• Added Admin setup routes under /admin/setup.
• Added setup overview page.
• Added CRUD controllers, Form Requests, and Blade views for Bahagian Pilihanraya, Daerah Mengundi, Pusat Mengundi, Saluran Mengundi, Jawatan, and Kekosongan Jawatan.
• Added Pusat Mengundi detail page with saluran list, QR registration link, QR preview, and PPM assignment form.
• Added QR generation service using public UUID registration URLs.
• Added Admin-protected QR SVG serving route.
• Added public QR placeholder route /pohon/{pusatMengundi:public_uuid}.
• Added PPM assignment service using staff_assignments, assignment history, RBAC role assignment, and activity logging.
• Added quota validation to prevent assigning a Saluran Mengundi from a different Pusat Mengundi.
• Added public Blade layout for QR-facing pages.
• Linked Admin dashboard action to Election setup.
• Added feature tests for Admin setup module behavior.

Changed files:

• app/Http/Controllers/Admin/Setup/AdminSetupController.php
• app/Http/Controllers/Admin/Setup/BahagianPilihanrayaController.php
• app/Http/Controllers/Admin/Setup/DaerahMengundiController.php
• app/Http/Controllers/Admin/Setup/PositionController.php
• app/Http/Controllers/Admin/Setup/PositionQuotaController.php
• app/Http/Controllers/Admin/Setup/PusatMengundiController.php
• app/Http/Controllers/Admin/Setup/SaluranMengundiController.php
• app/Http/Controllers/DashboardController.php
• app/Http/Controllers/PublicApplicationPlaceholderController.php
• app/Http/Requests/Admin/Setup/*.php
• app/Services/Admin/PpmAssignmentService.php
• app/Services/Admin/PusatQrCodeService.php
• resources/views/admin/setup/**/*.blade.php
• resources/views/dashboards/index.blade.php
• resources/views/layouts/public.blade.php
• resources/views/public/application-placeholder.blade.php
• routes/web.php
• tests/Feature/AdminSetupTest.php
• docs/01-development-plan.md
• docs/05-workflow-design.md
• docs/decision-log.md
• docs/progress-log.md
• docs/changelog.md

Verification:

• php artisan route:list --except-vendor passed and shows 65 routes.
• php artisan test --filter=AdminSetupTest passed: 4 tests, 24 assertions.
• php artisan test passed: 32 tests, 104 assertions.
• vendor\bin\pint.bat --test passed.
• vendor\bin\phpstan.bat analyse --memory-limit=1G passed.
• npm.cmd run build passed.

Manual testing:

• Log in as admin@prn.local / password.
• Open /admin/setup.
• Create or edit Bahagian, Daerah, Pusat, Saluran, Jawatan, and Kuota records.
• Open a Pusat Mengundi detail page, generate QR, and assign PPM.
• Open the generated /pohon/{uuid} public link and confirm it shows the intended Pusat Mengundi.
• Log in as ktm@prn.local / password and confirm /admin/setup is forbidden.

Pending items:

• Full public application form and document upload in Phase 4.
• Registration-period enforcement for public and KTM-created applications in Phase 4 and Phase 6.
• Representative management for Police, KKM, and JKM in the later Admin management phase.
• Rich filters for very large setup lists if operational data volume requires them.

Next step:

• Phase 4: Public application module using QR link, registration-period rules, document uploads, KTM selection for KP/KPDP, and duplicate IC blocking.

2026-05-29 - Phase 4: Public Application Module

Status: Completed

Completed:

• Replaced QR placeholder flow with public application form on /pohon/{pusatMengundi:public_uuid}.
• Added public success page using application public UUID.
• Added RegistrationPeriodService for registration open/closed checks.
• Added KtmVacancyService for KP/KPDP KTM selection and vacancy calculation.
• Added PublicApplicationSubmissionService for transactional application creation, private document storage, status history, bank verification initialization, and activity logging.
• Added StorePublicApplicationRequest with validation for applicant fields, IC normalization, required documents, public roles, duplicate IC, KTM-created blocking rule, and KTM vacancy recheck.
• Added responsive public Blade form for applicant details, role selection, KTM selection, bank data, and document upload.
• Added closed-registration page.
• Stored IC document and bank statement metadata in application_documents.
• Created pending bank_verifications row for public submissions.
• Added Phase 4 feature tests and unit tests.

Changed files:

• app/Http/Controllers/PublicApplicationController.php
• app/Http/Requests/Public/StorePublicApplicationRequest.php
• app/Services/RegistrationPeriodService.php
• app/Services/Public/KtmVacancyService.php
• app/Services/Public/PublicApplicationSubmissionService.php
• resources/views/layouts/public.blade.php
• resources/views/public/applications/create.blade.php
• resources/views/public/applications/closed.blade.php
• resources/views/public/applications/success.blade.php
• routes/web.php
• tests/Feature/PublicApplicationTest.php
• tests/Unit/KtmVacancyServiceTest.php
• tests/Unit/RegistrationPeriodServiceTest.php
• docs/01-development-plan.md
• docs/03-database-design.md
• docs/05-workflow-design.md
• docs/07-testing-plan.md
• docs/decision-log.md
• docs/progress-log.md
• docs/changelog.md

Verification:

• php artisan route:list --except-vendor passed and shows 67 routes.
• php artisan test --filter=PublicApplicationTest passed: 6 tests, 27 assertions.
• php artisan test passed: 41 tests, 137 assertions.
• vendor\bin\pint.bat --test passed.
• vendor\bin\phpstan.bat analyse --memory-limit=1G passed.
• npm.cmd run build passed.

Manual testing:

• Open a generated /pohon/{uuid} QR link.
• Submit a KTM or PAPM application with IC document and bank statement.
• Submit KP with an available KTM selection.
• Try submitting without IC document or bank statement and confirm validation blocks it.
• Set registration end date to a past date and confirm public form shows closed-registration message.
• Create a created_by_ktm application for an IC and confirm public self-registration with the same IC is blocked.

Pending items:

• Phase 5 PPM review, approval/rejection, role change, and assignment of submitted public applications.
• Phase 6 KTM-created application deletion flow and email notification.
• Authorized document viewing/downloading for PPM/Admin/Admin Kewangan.
• Public application status portal if later required.

Next step:

• Phase 5: PPM review and assignment module.

2026-05-29 - Phase 5: PPM Review and Assignment Module

Status: Completed

Completed:

• Added PPM application review routes under /ppm/applications.
• Added PPM-scoped application list and detail screens.
• Added ApplicationPolicy and PpmScopeService for record-level PPM access control.
• Added PpmApplicationReviewService for transactional approve/reject behavior.
• Added AssignmentVacancyService for Pusat/Saluran quota checks.
• Extended KtmVacancyService to ignore the current application during PPM approval vacancy checks.
• Added PPM approval form allowing role change before approval.
• Implemented KTM assignment to available Saluran Mengundi.
• Implemented KP/KPDP assignment to active KTM with remaining vacancy.
• Implemented PAPM assignment at Pusat Mengundi level.
• Implemented rejection with required reason.
• Added authorized private document download for PPM-owned applications.
• Added PPM dashboard metrics and link to the review queue.
• Added representative display sections for Police, KKM, and JKM records.
• Added AuthorizesRequests to the base controller for policy authorization.
• Added Phase 5 feature tests.

Changed files:

• app/Http/Controllers/Controller.php
• app/Http/Controllers/DashboardController.php
• app/Http/Controllers/Ppm/ApplicationReviewController.php
• app/Http/Requests/Ppm/ApproveApplicationRequest.php
• app/Http/Requests/Ppm/RejectApplicationRequest.php
• app/Models/PusatMengundi.php
• app/Policies/ApplicationPolicy.php
• app/Services/Ppm/AssignmentVacancyService.php
• app/Services/Ppm/PpmApplicationReviewService.php
• app/Services/Ppm/PpmScopeService.php
• app/Services/Public/KtmVacancyService.php
• resources/views/ppm/applications/index.blade.php
• resources/views/ppm/applications/show.blade.php
• routes/web.php
• tests/Feature/PpmApplicationReviewTest.php
• docs/01-development-plan.md
• docs/04-rbac-permission-matrix.md
• docs/05-workflow-design.md
• docs/07-testing-plan.md
• docs/decision-log.md
• docs/progress-log.md
• docs/changelog.md

Verification:

• php artisan route:list --except-vendor passed and shows 72 routes.
• php artisan test --filter=PpmApplicationReviewTest passed: 6 tests, 24 assertions.
• php artisan test passed: 47 tests, 161 assertions.
• vendor\bin\pint.bat --test passed.
• vendor\bin\phpstan.bat analyse --memory-limit=1G passed.
• npm.cmd run build passed.

Manual testing:

• Log in as ppm@prn.local / password.
• Open /ppm/applications.
• Submit a public application through QR first, then confirm it appears in the PPM queue.
• Open the application detail page and download uploaded documents.
• Approve a KTM application into an available Saluran.
• Approve a KP/KPDP application under an active KTM.
• Change an applicant role before approval and confirm assignment is created.
• Reject an application with a reason.
• Confirm a PPM cannot access an application outside their assigned Pusat Mengundi.

Pending items:

• Phase 6 KTM flow for KP registration/approval, deletion of KTM-created records, and email notification.
• Admin/Admin Kewangan document viewing routes.
• Admin global management and post-registration notes in Phase 7.
• Attendance module in Phase 10.

Next step:

• Phase 6: KTM flow for assigned Saluran, KP registration, KP approval, KTM-created deletion, and email notification.

2026-05-29 - Phase 6: KTM Flow

Status: Completed

Completed:

• Added KTM application routes under /ktm/applications.
• Added KtmScopeService for active KTM assignment ownership checks.
• Added KtmApplicationService for KTM KP registration, KP approval, and KTM-created deletion.
• Added queued Markdown Mailable KtmCreatedApplicantMail.
• Added KTM team list showing assigned Saluran, active KP team members, and KP vacancy.
• Added KTM KP registration form.
• Added KTM application detail page with approve/delete actions.
• Enforced KTM registration period on KP registration and approval.
• Enforced KP-only creation and approval for KTM.
• Enforced own-team-only approval/deletion.
• Implemented source = created_by_ktm for KTM-created records.
• Implemented delete flow that sets deleted_by_ktm, records status history, and soft deletes the KTM-created application.
• Updated KTM dashboard with live metrics and navigation links.
• Added Phase 6 feature tests.

Changed files:

• app/Http/Controllers/DashboardController.php
• app/Http/Controllers/Ktm/TeamController.php
• app/Http/Requests/Ktm/RegisterKpApplicantRequest.php
• app/Mail/KtmCreatedApplicantMail.php
• app/Services/Ktm/KtmApplicationService.php
• app/Services/Ktm/KtmScopeService.php
• app/Services/Public/KtmVacancyService.php
• resources/views/emails/ktm/created-applicant.blade.php
• resources/views/ktm/applications/create.blade.php
• resources/views/ktm/applications/index.blade.php
• resources/views/ktm/applications/show.blade.php
• routes/web.php
• tests/Feature/KtmFlowTest.php
• docs/01-development-plan.md
• docs/04-rbac-permission-matrix.md
• docs/05-workflow-design.md
• docs/07-testing-plan.md
• docs/decision-log.md
• docs/progress-log.md
• docs/changelog.md

Verification:

• php artisan route:list --except-vendor passed and shows 78 routes.
• php artisan test --filter=KtmFlowTest passed: 6 tests, 25 assertions.
• php artisan test passed: 53 tests, 186 assertions.
• vendor\bin\pint.bat --test passed.
• vendor\bin\phpstan.bat analyse --memory-limit=1G passed.
• npm.cmd run build passed.

Manual testing:

• Log in as ktm@prn.local / password.
• Open /ktm/applications.
• Confirm assigned Saluran and KP vacancy are shown.
• Register a KP and confirm email is queued/sent according to local mail configuration.
• Approve a KP under own team and confirm active assignment is created.
• Try approving KP from another KTM team and confirm it is blocked.
• Try approving a non-KP application and confirm it is blocked.
• Set registration end date to the past and confirm KTM registration/approval is blocked.
• Delete an unassigned KTM-created applicant and confirm public self-registration with the same IC is no longer blocked.

Pending items:

• Phase 7 Admin global management/manual entry and post-registration notes.
• Admin/Admin Kewangan document viewing routes.
• Finance verification module in Phase 8.
• Attendance module in Phase 10.

Next step:

• Phase 7: Admin management and manual entry.

2026-05-29 - Phase 7: Admin Management and Manual Entry

Status: Completed

Completed:

• Added Admin management routes under /admin/management.
• Added Admin management overview dashboard.
• Added global application list with filters.
• Added Admin manual application entry with source = admin_manual.
• Added Admin application edit screen.
• Added direct assignment from Admin application edit screen.
• Added global staff assignment list and assignment edit screen.
• Added post-registration catatan enforcement through AdminPostCloseNoteService.
• Added system_notes records for accepted post-closing Admin changes.
• Added assignment/application history and activity log entries for Admin changes.
• Added Police, KKM, and JKM representative entry/deletion screen.
• Updated Admin dashboard with live counts and management module links.
• Added Phase 7 feature tests.

Changed files:

• app/Http/Controllers/Admin/Management/AdminManagementController.php
• app/Http/Controllers/Admin/Management/ManagedApplicationController.php
• app/Http/Controllers/Admin/Management/RepresentativeController.php
• app/Http/Controllers/Admin/Management/StaffAssignmentController.php
• app/Http/Controllers/DashboardController.php
• app/Http/Requests/Admin/Management/*.php
• app/Services/Admin/Management/*.php
• resources/views/admin/management/**/*.blade.php
• routes/web.php
• tests/Feature/AdminManagementTest.php
• docs/01-development-plan.md
• docs/04-rbac-permission-matrix.md
• docs/05-workflow-design.md
• docs/07-testing-plan.md
• docs/decision-log.md
• docs/progress-log.md
• docs/changelog.md

Verification:

• php artisan route:list --except-vendor passed and shows 91 routes.
• php artisan test --filter=AdminManagementTest passed: 5 tests, 18 assertions.
• php artisan test passed: 58 tests, 204 assertions.
• vendor\bin\phpstan.bat analyse --memory-limit=1G passed.
• vendor\bin\pint.bat --test passed.
• npm.cmd run build passed.

Manual testing:

• Log in as admin@prn.local / password.
• Open /admin/management.
• Create a manual application.
• Edit a manual or public application.
• Direct assign an application to a Pusat, Saluran, or KTM team.
• Edit an existing staff assignment.
• Create Police, KKM, and JKM representative records.
• Close the registration period for the election and confirm Admin changes require catatan.
• Log in as kewangan@prn.local / password and confirm /admin/management/assignments is forbidden.

Pending items:

• Admin document viewing route for IC/bank statement remains for the finance/document module.
• Excel export implementation remains in later finance/export phases.
• More granular representative edit forms can be added if operational users need inline correction instead of delete/recreate.

Next step:

• Phase 8: Admin Kewangan module for bank verification, finance filters, and finance export.

2026-05-29 - Phase 8: Admin Kewangan

Status: Completed

Completed:

• Added finance bank verification routes under /kewangan/bank.
• Added Admin Kewangan list of approved/assigned staff bank records.
• Added filters for status, Pusat Mengundi, role, missing bank statement, missing account number, and keyword.
• Added bank verification detail screen.
• Added finance status update with finance note, verified by, and verified at.
• Added activity log for finance verification changes.
• Added sensitive display masking helper.
• Added finance XLSX export using OpenSpout.
• Added export log creation for finance exports.
• Updated Admin Kewangan dashboard with live counts and module links.
• Added Phase 8 feature tests.

Changed files:

• app/Exports/FinanceVerificationExport.php
• app/Http/Controllers/DashboardController.php
• app/Http/Controllers/Kewangan/BankVerificationController.php
• app/Http/Requests/Kewangan/UpdateBankVerificationRequest.php
• app/Services/Finance/BankVerificationService.php
• app/Services/Finance/FinanceExportService.php
• app/Services/Finance/FinanceVerificationQuery.php
• app/Support/SensitiveData.php
• resources/views/kewangan/bank/index.blade.php
• resources/views/kewangan/bank/show.blade.php
• routes/web.php
• tests/Feature/FinanceModuleTest.php
• docs/01-development-plan.md
• docs/04-rbac-permission-matrix.md
• docs/05-workflow-design.md
• docs/07-testing-plan.md
• docs/decision-log.md
• docs/progress-log.md
• docs/changelog.md

Verification:

• php artisan route:list --except-vendor passed and shows 95 routes.
• php artisan test --filter=FinanceModuleTest passed: 5 tests, 18 assertions.
• php artisan test passed: 63 tests, 222 assertions.
• vendor\bin\phpstan.bat analyse --memory-limit=1G passed.
• vendor\bin\pint.bat --test passed.
• npm.cmd run build passed.

Manual testing:

• Log in as kewangan@prn.local / password.
• Open /kewangan/bank.
• Filter records by Pusat, role, status, missing bank statement, and missing account number.
• Open a bank verification record.
• Mark it verified, rejected, or requires correction with a finance note.
• Export the finance list and confirm a file downloads.
• Confirm /admin/management/assignments is forbidden for Admin Kewangan.

Pending items:

• Admin/Admin Kewangan authorized document download for bank statement remains to be added when document review UX is finalized.
• Additional finance export formats can be added if official template is provided.

Next step:

• Phase 9: Wheelchair management.

2026-05-29 - Phase 9: Wheelchair Management

Status: Completed

Completed:

• Added Admin wheelchair management routes under /admin/management/wheelchairs.
• Added allocation upsert per election and Pusat Mengundi.
• Added wheelchair management service for allocation and transaction rules.
• Added taken transaction recording with quantity, time, person taking, and notes.
• Added return transaction recording with quantity, time, condition, and notes.
• Added quantity guards for allocation, available balance, and outstanding return balance.
• Added activity logging for allocation and transaction changes.
• Added wheelchair list and detail screens.
• Updated Admin management dashboard and navigation.
• Added Phase 9 feature tests.

Changed files:

• app/Http/Controllers/Admin/Management/AdminManagementController.php
• app/Http/Controllers/Admin/Management/WheelchairController.php
• app/Http/Requests/Admin/Management/StoreWheelchairTransactionRequest.php
• app/Http/Requests/Admin/Management/UpsertWheelchairAllocationRequest.php
• app/Services/Admin/Management/WheelchairManagementService.php
• resources/views/admin/management/_nav.blade.php
• resources/views/admin/management/index.blade.php
• resources/views/admin/management/wheelchairs/index.blade.php
• resources/views/admin/management/wheelchairs/show.blade.php
• routes/web.php
• tests/Feature/WheelchairManagementTest.php
• docs/01-development-plan.md
• docs/04-rbac-permission-matrix.md
• docs/05-workflow-design.md
• docs/07-testing-plan.md
• docs/decision-log.md
• docs/progress-log.md
• docs/changelog.md

Verification:

• php artisan route:list --except-vendor passed and shows 100 routes.
• php artisan test --filter=WheelchairManagementTest passed: 6 tests, 16 assertions.
• php artisan test passed: 69 tests, 238 assertions.
• vendor\bin\phpstan.bat analyse --memory-limit=1G passed.
• vendor\bin\pint.bat --test passed.
• npm.cmd run build passed.

Manual testing:

• Log in as admin@prn.local / password.
• Open /admin/management/wheelchairs.
• Create or update a wheelchair allocation for a Pusat Mengundi.
• Open the allocation detail screen.
• Record wheelchair taken transaction.
• Record wheelchair returned transaction with condition baik or rosak.
• Try taking more than available and confirm validation blocks it.
• Try returning more than outstanding and confirm validation blocks it.
• Try lowering allocation below outstanding and confirm validation blocks it.
• Log in as kewangan@prn.local / password and confirm wheelchair management is forbidden.

Pending items:

• Phase 10 attendance module.
• Optional wheelchair export/report if later required.

Next step:

• Phase 10: Attendance module.

2026-05-29 - Phase 10: Attendance Module

Status: Completed

Completed:

• Added PPM attendance routes under /ppm/attendance.
• Added PPM attendance list for assigned Pusat Mengundi.
• Added PPM attendance recording screen for active staff under own Pusat Mengundi.
• Added attendance activation guard using election_settings.is_attendance_active.
• Added bulk attendance recording service.
• Added activity log entries for attendance updates.
• Added Admin attendance routes under /admin/attendance.
• Added Admin attendance dashboard by Pusat Mengundi.
• Added Admin attendance detail view with staff, role, Saluran, status, check-in time, notes, and recorded by.
• Added attendance summary service with totals and role-level summary.
• Added attendance detail XLSX export using OpenSpout.
• Added export log creation for attendance exports.
• Updated Admin and PPM dashboard links/metrics.
• Added Phase 10 feature and unit tests.

Changed files:

• app/Exports/AttendanceDetailExport.php
• app/Http/Controllers/Admin/AttendanceController.php
• app/Http/Controllers/DashboardController.php
• app/Http/Controllers/Ppm/AttendanceController.php
• app/Http/Requests/Ppm/RecordAttendanceRequest.php
• app/Services/Attendance/AttendanceExportService.php
• app/Services/Attendance/AttendanceRecordingService.php
• app/Services/Attendance/AttendanceSummaryService.php
• resources/views/admin/attendance/index.blade.php
• resources/views/admin/attendance/show.blade.php
• resources/views/ppm/attendance/index.blade.php
• resources/views/ppm/attendance/show.blade.php
• routes/web.php
• tests/Feature/AttendanceModuleTest.php
• tests/Unit/AttendanceSummaryServiceTest.php
• docs/01-development-plan.md
• docs/04-rbac-permission-matrix.md
• docs/05-workflow-design.md
• docs/07-testing-plan.md
• docs/decision-log.md
• docs/progress-log.md
• docs/changelog.md

Verification:

• php artisan route:list --except-vendor passed and shows 106 routes.
• php artisan test --filter=Attendance passed: 7 tests, 21 assertions.
• php artisan test passed: 76 tests, 259 assertions.
• vendor\bin\phpstan.bat analyse --memory-limit=1G passed.
• vendor\bin\pint.bat --test passed.
• npm.cmd run build passed.

Manual testing:

• Activate attendance for the election in database/settings.
• Log in as ppm@prn.local / password.
• Open /ppm/attendance.
• Record present/absent/not recorded statuses for staff under own Pusat Mengundi.
• Confirm PPM cannot access or record another Pusat Mengundi.
• Log in as admin@prn.local / password.
• Open /admin/attendance.
• View Pusat Mengundi summary and detail.
• Export attendance detail and confirm file downloads.
• Log in as kewangan@prn.local / password and confirm Admin attendance dashboard is forbidden.

Pending items:

• Admin settings UI to toggle is_attendance_active if operational users need UI control.
• Official attendance report template can replace the current export layout when provided.

Next step:

• Phase 11: Testing, polish, security review, performance review, and final hardening.

2026-05-29 - Phase 11: Testing, Polish, and Hardening

Status: Completed

Completed:

• Reviewed authorization, private document access, sensitive data masking, exports, and quality gates.
• Added Admin document download route for private application documents.
• Added Admin Kewangan bank statement download route.
• Restricted finance document downloads to bank_statement only.
• Added activity logging for Admin and finance document downloads.
• Added secure document links to Admin application edit and finance bank detail screens.
• Added feature tests for Admin/Admin Kewangan/unauthorized document access.
• Added unit test for sensitive data masking.
• Updated deployment notes with final quality gate commands and document storage hardening notes.
• Updated Phase 11 documentation and release notes.

Changed files:

• app/Http/Controllers/DocumentDownloadController.php
• app/Http/Controllers/Admin/Management/ManagedApplicationController.php
• resources/views/admin/management/applications/edit.blade.php
• resources/views/kewangan/bank/show.blade.php
• routes/web.php
• tests/Feature/DocumentDownloadAuthorizationTest.php
• tests/Unit/SensitiveDataTest.php
• docs/01-development-plan.md
• docs/07-testing-plan.md
• docs/08-deployment-notes.md
• docs/decision-log.md
• docs/progress-log.md
• docs/changelog.md

Verification:

• php artisan test --filter=DocumentDownloadAuthorizationTest passed: 3 tests, 4 assertions.
• php artisan test --filter=SensitiveDataTest passed: 1 test, 4 assertions.
• php artisan route:list --except-vendor passed and shows 108 routes.
• php artisan test passed: 80 tests, 267 assertions.
• vendor\bin\phpstan.bat analyse --memory-limit=1G passed.
• vendor\bin\pint.bat --test passed.
• npm.cmd run build passed.

Manual testing:

• Log in as admin@prn.local / password.
• Open an application with uploaded documents and download IC/bank documents.
• Log in as kewangan@prn.local / password.
• Open bank verification detail and download bank statement.
• Confirm Admin Kewangan cannot download IC document through finance document route.
• Run end-to-end smoke test from QR application to attendance export.

Pending items:

• Replace current exports with official report templates if/when provided.
• Add Admin UI toggle for attendance activation if operational users need it outside database/settings maintenance.

Next step:

• Production readiness review with real environment credentials, mail transport, queue worker, HTTPS, backup plan, and user acceptance testing.

2026-05-31 - Penambahbaikan daftar Pusat Mengundi

Selesai

• Membuang keperluan nama Saluran daripada borang dan validasi setup Saluran.
• Menambah sepuluh input bilangan operasi pada borang daftar Pusat Mengundi.
• Menjana Saluran bernombor serta kuota Pusat dan Saluran secara automatik semasa daftar Pusat.
• Menukar istilah Calon Simpanan kepada Calon Tambahan dengan migrasi data.
• Menambah ujian ciri untuk penciptaan Pusat, Saluran tanpa nama dan kuota operasi.

Fail berubah

• app/Services/Admin/PusatOperationalSetupService.php
• app/Http/Controllers/Admin/Setup/PusatMengundiController.php
• app/Http/Requests/Admin/Setup/UpsertPusatMengundiRequest.php
• app/Http/Requests/Admin/Setup/UpsertSaluranMengundiRequest.php
• resources/views/admin/setup/pusat/_form.blade.php
• resources/views/admin/setup/saluran/_form.blade.php
• database/migrations/2026_05_31_000000_rename_calon_simpanan_position_to_calon_tambahan.php
• database/seeders/PositionSeeder.php
• database/seeders/SampleElectionSeeder.php
• tests/Feature/Admin/PusatOperationalSetupTest.php

Semakan manual

• Buka /admin/setup/pusat/create, pastikan sepuluh medan bilangan operasi dipaparkan.
• Daftar Pusat baharu dan pastikan Saluran bernombor dijana tanpa meminta nama Saluran.

Seterusnya

• Jalankan migrasi, ujian automatik dan semakan statik selepas shell runner tersedia.

2026-06-02 - Perancangan Fasa 12–15: Pembetulan dan Penambahbaikan

Status: Selesai (perancangan)

Selesai:

• Menjalankan semakan kod menyeluruh ke atas keseluruhan sistem selepas Phase 11 dan penambahbaikan 2026-05-31.
• Mengenal pasti lapan isu meliputi keselamatan, prestasi, pengalaman pengguna, dan pengurusan data.
• Menyusun isu-isu tersebut kepada empat fasa penambahbaikan berprioritikan (Fasa 12–15).
• Mendokumentasikan plan penuh dalam docs/09-improvement-plan.md.
• Mengemas kini docs/01-development-plan.md dengan ringkasan Fasa 12–15.

Fail berubah:

• docs/09-improvement-plan.md (baharu)
• docs/01-development-plan.md
• docs/progress-log.md
• docs/changelog.md

Isu yang dikenal pasti:

• 12-A: Tiada UI toggle untuk is_attendance_active dan is_registration_open_override — memerlukan edit database terus dalam produksi.
• 12-B: Semakan IC duplikasi mungkin tidak mengecualikan soft-deleted records secara eksplisit dan konsisten.
• 12-C: AdminPostCloseNoteService boleh dipintas jika controller baharu lupa memanggilnya.
• 12-D: SampleElectionSeeder mungkin masih mengandungi rujukan kepada CALON_SIMPANAN selepas migration rename Phase 11.
• 12-E: Semakan jenis dokumen pada path download tidak sepenuhnya konsisten antara peranan.
• 13-A: Composite indexes belum wujud pada applications, staff_assignments, bank_verifications — boleh perlahan apabila data besar.
• 14-A: Tiada halaman status permohonan untuk pemohon awam — mereka perlu hubungi Admin untuk semak status.
• 15-A: Fail XLSX eksport sensitif disimpan tanpa had masa — polisi purge automatik diperlukan.

Seterusnya:

• Mulakan Fasa 12 dengan 12-A (Admin Settings UI) kerana ia paling mendesak untuk kebolehgunaan dalam persekitaran produksi.

2026-06-02 - Fasa 12-A: Admin Settings UI dan 12-D: Pembetulan Seeder

Status: Selesai

Selesai:

• Tambah halaman Admin Settings di /admin/setup/settings/{election} untuk toggle is_attendance_active dan is_registration_open_override tanpa perlu edit database.
• Tambah ElectionSettingsController, ElectionSettingsService, UpdateElectionSettingsRequest.
• Tambah view admin/setup/settings/edit.blade.php dengan toggle radio untuk kedua-dua tetapan, badge status semasa, dan amaran override aktif.
• Tambah pautan "Tetapan" (kuning) ke admin/setup/_nav.blade.php dan setup index actions.
• Perubahan tetapan direkod dalam activity_log dengan nilai sebelum dan selepas.
• Betulkan bug 12-D: SampleElectionSeeder::seedQuotas() masih query CALON_SIMPANAN — ditukar kepada CALON_TAMBAHAN.
• Betulkan AdminSetupTest: tambah medan operasi yang diperlukan untuk pusat.store, dan tukar nombor saluran dari '1' ke '3' untuk elak konflik dengan saluran auto-jana.
• Betulkan anotasi PHPDoc pada UpdateElectionSettingsRequest::prepareForValidation().
• Tambah anotasi @var ElectionSetting pada ElectionSettingsService untuk PHPStan.
• Jalankan pint (auto-fix 2 fail) dan phpstan (0 error).

Fail berubah:

• app/Http/Controllers/Admin/Setup/ElectionSettingsController.php (baharu)
• app/Http/Requests/Admin/Setup/UpdateElectionSettingsRequest.php (baharu)
• app/Services/Admin/ElectionSettingsService.php (baharu)
• resources/views/admin/setup/settings/edit.blade.php (baharu)
• resources/views/admin/setup/_nav.blade.php
• resources/views/admin/setup/index.blade.php
• routes/web.php
• database/seeders/SampleElectionSeeder.php
• tests/Feature/Admin/ElectionSettingsTest.php (baharu)
• tests/Feature/AdminSetupTest.php
• docs/04-rbac-permission-matrix.md
• docs/05-workflow-design.md
• docs/09-improvement-plan.md
• docs/decision-log.md
• docs/progress-log.md
• docs/changelog.md

Semakan:

• php artisan route:list --except-vendor — 110 routes (tambah 2).
• php artisan test — 90 tests, 310 assertions (selesai, semua lulus).
• vendor\bin\pint.bat --test — lulus.
• vendor\bin\phpstan.bat analyse --memory-limit=1G — lulus, 0 error.

Seterusnya:

• 12-B: Semak dan betulkan query IC duplikasi untuk pastikan soft-deleted records dikecualikan.
• 12-C: Perkukuh enforcement nota catatan post-pendaftaran.
• 12-E: Konsistensikan semakan jenis dokumen download.

2026-06-02 - Fasa 12-B: Pembetulan Semakan IC Soft-Deleted

Status: Selesai

Selesai:

• Audit menyeluruh semua lokasi semakan IC duplikasi: StorePublicApplicationRequest::validateDuplicateIc(), KtmApplicationService::registerKp(), KtmVacancyService::remainingVacancy(), dan AssignmentVacancyService.
• Disahkan bahawa kedua-dua query IC menggunakan SoftDeletes scope (mengecualikan deleted_at IS NOT NULL) DAN whereNotIn('status', ['cancelled', 'deleted_by_ktm']) — perlindungan dua lapis yang betul.
• cancelled records: dikecualikan oleh whereNotIn sahaja (bukan soft-deleted).
• deleted_by_ktm records: dikecualikan oleh kedua-dua SoftDeletes scope DAN whereNotIn (redundant safety layer).
• Tambah comment eksplisit pada kedua-dua query IC untuk mendokumentasikan intent perlindungan dua lapis ini.
• Tambah 2 ujian baharu dalam PublicApplicationTest:
  • test_public_registration_is_unblocked_after_ktm_deletes_applicant: KTM cipta rekod, KTM delete (soft-delete + status deleted_by_ktm), pemohon awam dengan IC yang sama boleh daftar semula.
  • test_cancelled_application_does_not_block_new_registration: Rekod cancelled (bukan soft-deleted) tidak menyekat pendaftaran IC yang sama.
• KtmVacancyService dan AssignmentVacancyService disahkan betul — menggunakan whitelist status dan StaffAssignment queries tidak melibatkan soft-deleted Application records secara salah.

Fail berubah:

• app/Http/Requests/Public/StorePublicApplicationRequest.php — tambah comment
• app/Services/Ktm/KtmApplicationService.php — tambah comment
• tests/Feature/PublicApplicationTest.php — tambah 2 ujian
• docs/09-improvement-plan.md
• docs/progress-log.md
• docs/changelog.md

Semakan:

• php artisan test — 92 tests, 316 assertions (semua lulus).
• vendor\bin\pint.bat --test — lulus.
• vendor\bin\phpstan.bat analyse --memory-limit=1G — lulus, 0 error.

Seterusnya:

• 12-C: Perkukuh enforcement nota catatan post-pendaftaran.
• 12-E: Konsistensikan semakan jenis dokumen download.

2026-06-02 - Fasa 12-C: Perkukuh Enforcement Nota Catatan Post-Pendaftaran

Status: Selesai

Selesai:

• Audit semua 6 service methods yang mengubah rekod domain selepas pendaftaran tutup — kesemua sudah memanggil AdminPostCloseNoteService::requireIfClosed() dengan betul.
• Masalah: enforcement bergantung pada konvensyen — controller baharu boleh lupa panggil service tersebut.
• Tambah middleware RequireAdminPostCloseNote sebagai safety net automatik pada route group admin/management.
• Middleware menyemak election_id dari request body (untuk create routes) atau active election (untuk edit/delete routes). Jika pendaftaran ditutup dan note kosong, redirect balik dengan ralat validasi.
• Daftarkan alias admin.post_close_note dalam bootstrap/app.php.
• Apply middleware ke ['auth', 'role:Admin', 'admin.post_close_note'] dalam routes/web.php.
• Tambah 5 ujian baharu dalam AdminManagementTest:
  • test_admin_create_application_after_registration_closed_requires_catatan
  • test_admin_update_assignment_after_registration_closed_requires_catatan
  • test_admin_create_representative_after_registration_closed_requires_catatan
  • test_admin_delete_representative_after_registration_closed_requires_catatan
  • test_middleware_does_not_block_when_registration_is_open

Fail berubah:

• app/Http/Middleware/RequireAdminPostCloseNote.php (baharu)
• bootstrap/app.php — alias middleware baharu
• routes/web.php — middleware pada route group management
• tests/Feature/AdminManagementTest.php — tambah 5 ujian
• docs/decision-log.md
• docs/09-improvement-plan.md
• docs/progress-log.md
• docs/changelog.md

Semakan:

• php artisan test — 97 tests, 337 assertions (semua lulus).
• vendor\bin\pint.bat --test — lulus.
• vendor\bin\phpstan.bat analyse --memory-limit=1G — lulus, 0 error.

Seterusnya:

• 12-E: Konsistensikan semakan jenis dokumen download.

2026-06-02 - Fasa 13-A: Composite Indexes Pangkalan Data

Status: Selesai

Selesai:

• Audit index sedia ada berbanding query kritikal dalam KtmVacancyService, AssignmentVacancyService, ManagedApplicationController, dan DashboardController.
• Dapatan: dua index yang disenaraikan dalam plan sudah wujud — (election_id, ic_number) dan (election_id, pusat_mengundi_id, status) pada applications, serta dua index komposit pada staff_assignments.
• bank_verifications tiada kolum election_id — index (election_id, status) yang diancangkan dalam plan tidak relevan dan tidak ditambah.
• Tiga index baharu yang benar-benar diperlukan ditambah melalui migration 2026_06_02_000000_add_performance_indexes.php:
  • applications.app_election_status_idx — (election_id, status) untuk dashboard count queries
  • applications.app_ktm_position_idx — (selected_ktm_assignment_id, requested_position_id) untuk KtmVacancyService reserved count
  • staff_assignments.sa_reports_to_pos_status_idx — (reports_to_assignment_id, position_id, status) untuk KtmVacancyService assigned count
• Dokumentasi index lengkap ditambah dalam docs/03-database-design.md.
• Arahan verifikasi index dengan SHOW INDEX dan EXPLAIN ditambah dalam docs/08-deployment-notes.md.

Fail berubah:

• database/migrations/2026_06_02_000000_add_performance_indexes.php (baharu)
• docs/03-database-design.md
• docs/08-deployment-notes.md
• docs/decision-log.md
• docs/09-improvement-plan.md
• docs/progress-log.md
• docs/changelog.md

Semakan:

• php artisan migrate — lulus, 2 migration dijalankan.
• php artisan test — 97 tests, 337 assertions (semua lulus).
• vendor\bin\pint.bat --test — lulus.
• vendor\bin\phpstan.bat analyse --memory-limit=1G — lulus, 0 error.

Seterusnya:

• 12-E: Konsistensikan semakan jenis dokumen download.
• Fasa 14: Portal status permohonan pemohon awam.
• Fasa 15: Purge automatik fail eksport sensitif.

2026-06-02 - Fasa 12-E: Konsistensikan Semakan Jenis Dokumen Download

Status: Selesai

Selesai:

• Audit tiga path download dokumen — PPM, Admin, Finance (Admin Kewangan).
• Dapatan:
  • PPM: tiada type check eksplisit, tiada activity log, ownership failure pakai 404 (patut 403).
  • Admin: tiada type check eksplisit (senyap allow semua jenis).
  • Finance: sudah betul — explicit bank_statement check, log activity, pakai 403.
• Tambah ApplicationDocument::TYPE_IC_DOCUMENT, TYPE_BANK_STATEMENT, ALLOWED_FOR_ADMIN, ALLOWED_FOR_PPM, ALLOWED_FOR_FINANCE sebagai constants dalam model — satu tempat yang autoriti untuk semua rules.
• Kemaskini DocumentDownloadController::admin() guna ALLOWED_FOR_ADMIN — jenis baharu perlu didaftarkan secara eksplisit untuk Admin dapat akses.
• Kemaskini DocumentDownloadController::finance() guna ALLOWED_FOR_FINANCE — logik sama, kini guna constant.
• Kemaskini ApplicationReviewController::downloadDocument():
  • Tambah ALLOWED_FOR_PPM type check → 403 jika jenis tidak dibenarkan.
  • Tukar ownership check dari 404 → 403 (tidak mendedahkan kewujudan ID dokumen).
  • Tambah activity log document_downloaded_by_ppm.
• Tambah 9 ujian baharu dalam DocumentDownloadAuthorizationTest meliputi semua tiga path dan kes utama:
  • Admin: ic_document ✓, bank_statement ✓, peranan tidak dibenarkan ✗.
  • Finance: bank_statement ✓, ic_document ✗.
  • PPM: ic_document (pusat sendiri) ✓, bank_statement (pusat sendiri) ✓, dokumen pusat lain ✗, activity log disimpan.

Fail berubah:

• app/Models/ApplicationDocument.php — tambah type constants dan allowlist
• app/Http/Controllers/DocumentDownloadController.php — explicit type checks via constants
• app/Http/Controllers/Ppm/ApplicationReviewController.php — type check, 403, activity log
• tests/Feature/DocumentDownloadAuthorizationTest.php — tulis semula dengan 9 ujian komprehensif
• docs/04-rbac-permission-matrix.md
• docs/decision-log.md
• docs/09-improvement-plan.md
• docs/progress-log.md
• docs/changelog.md

Semakan:

• php artisan test — 103 tests, 342 assertions (semua lulus).
• vendor\bin\pint.bat --test — lulus.
• vendor\bin\phpstan.bat analyse --memory-limit=1G — lulus, 0 error.

Seterusnya:

• Fasa 14: Portal status permohonan pemohon awam.
• Fasa 15: Purge automatik fail eksport sensitif.

2026-06-02 - Fasa 14-A: Portal Status Permohonan Pemohon Awam

Status: Selesai

Selesai:

• Tambah route GET /permohonan/{publicUuid}/status tanpa route model binding untuk elak 404 mendedahkan kewujudan UUID.
• Tambah PublicApplicationController::status() yang mengendalikan semua kes dengan selamat:
  • UUID tidak wujud → 200 dengan mesej generik.
  • Rekod soft-deleted → 200 dengan mesej generik.
  • Status deleted_by_ktm → 200 dengan mesej generik (tidak dedahkan status dalaman).
  • Rekod aktif → 200 dengan data terhad.
• Tambah SensitiveData::maskName() — tunjuk 3 aksara pertama sahaja.
• Cipta view public/applications/status.blade.php memaparkan: nama disamarkan, jawatan dipohon, jawatan diluluskan (jika berbeza), pusat mengundi, badge status dengan warna, sebab penolakan (jika ditolak), nombor rujukan UUID.
• Kemaskini success.blade.php dengan panel simpan pautan status dan butang salin URL ke clipboard.
• Tambah 9 ujian baharu dalam PublicApplicationStatusTest:
  • submitted, assigned, rejected (dengan sebab), UUID tidak dikenali, deleted_by_ktm, soft-deleted — semuanya.
  • Nama penuh tidak dipaparkan, IC tidak dipaparkan.
  • Halaman boleh dicapai tanpa log masuk.
  • Success page paparkan pautan status.

Fail berubah:

• app/Http/Controllers/PublicApplicationController.php — tambah status()
• app/Support/SensitiveData.php — tambah maskName()
• resources/views/public/applications/status.blade.php (baharu)
• resources/views/public/applications/success.blade.php — tambah panel pautan status
• routes/web.php — route baharu
• tests/Feature/PublicApplicationStatusTest.php (baharu)
• docs/05-workflow-design.md
• docs/06-ui-ux-plan.md
• docs/decision-log.md
• docs/09-improvement-plan.md
• docs/progress-log.md
• docs/changelog.md

Semakan:

• php artisan test — 112 tests, 364 assertions (semua lulus).
• vendor\bin\pint.bat --test — lulus.
• vendor\bin\phpstan.bat analyse --memory-limit=1G — lulus, 0 error.

Seterusnya:

• Fasa 15: Purge automatik fail eksport sensitif.

2026-06-02 - Fasa 15-A: Purge Automatik Fail Eksport Sensitif

Status: Selesai

Selesai:

• Tambah kolum purged_at (nullable timestamp) dan purged_by_user_id (nullable FK) pada export_logs melalui migration 2026_06_02_000001_add_purged_at_to_export_logs.php.
• Kemaskini model ExportLog dengan cast purged_at dan relationship purgedBy().
• Cipta Artisan command ExportPurgeCommand (php artisan exports:purge --days=30):
  • Query export_logs di mana created_at < now - days DAN purged_at IS NULL.
  • Padam fail dari storage disk yang berkaitan.
  • Rekod yang filenya sudah tiada di disk tetap ditandakan purged_at supaya tidak diproses semula.
  • Log aktiviti export_file_purged untuk setiap rekod.
  • Lapor bilangan fail dipadamkan dan rekod tiada fail.
• Daftarkan command sebagai scheduled task harian pada 00:00 dalam routes/console.php (--days=30, withoutOverlapping, runInBackground).
• Tambah 7 ujian baharu dalam ExportPurgeCommandTest:
  • Fail lama dipadamkan, purged_at ditetapkan.
  • Fail dalam tempoh simpanan tidak disentuh.
  • Rekod tanpa fail (missing) tetap ditandakan purged_at.
  • Rekod yang sudah purged_at tidak diproses semula.
  • --days custom berfungsi.
  • Activity log direkod.
  • --days=0 gagal dengan exit code bukan 0.

Fail berubah:

• database/migrations/2026_06_02_000001_add_purged_at_to_export_logs.php (baharu)
• app/Models/ExportLog.php — tambah cast + relationship
• app/Console/Commands/ExportPurgeCommand.php (baharu)
• routes/console.php — scheduled task
• tests/Feature/ExportPurgeCommandTest.php (baharu)
• docs/03-database-design.md
• docs/08-deployment-notes.md
• docs/decision-log.md
• docs/09-improvement-plan.md
• docs/progress-log.md
• docs/changelog.md

Semakan:

• php artisan migrate — lulus.
• php artisan test — 119 tests, 388 assertions (semua lulus).
• vendor\bin\pint.bat --test — lulus.
• vendor\bin\phpstan.bat analyse --memory-limit=1G — lulus, 0 error.

Semua fasa selesai (12-A hingga 15-A). Sistem sedia untuk UAT.