composer require midtrans/midtrans-php

MIDTRANS_SERVER_KEY=SB-Mid-server-xxxxxxxxxxxxxxxxxxxx
MIDTRANS_CLIENT_KEY=SB-Mid-client-xxxxxxxxxxxxxxxxxxxx
MIDTRANS_IS_PRODUCTION=false

<?php

return [
    'serverKey' => env('MIDTRANS_SERVER_KEY'),
    'clientKey' => env('MIDTRANS_CLIENT_KEY'),
    'isProduction' => env('MIDTRANS_IS_PRODUCTION', false),
];

php artisan make:migration create_transactions_table

Schema::create('transactions', function (Blueprint $table) {
    $table->id();
    $table->foreignId('user_id')->constrained()->onDelete('cascade');
    $table->foreignId('product_id')->constrained()->onDelete('cascade');
    $table->integer('qty');
    $table->string('status');
    $table->string('payment_type')->nullable();
    $table->string('midtrans_order_id')->nullable();
    $table->string('snap_token')->nullable();
    $table->integer('total_price');
    $table->timestamps();
});

php artisan migrate

php artisan make:model Transaction

<?php

namespace App\Models;

use Illuminate\Database\Eloquent\Factories\HasFactory;
use Illuminate\Database\Eloquent\Model;

class Transaction extends Model
{
    use HasFactory;

    protected $guarded = [];

    /**
     * Relasi ke User (pembeli)
     */
    public function user()
    {
        return $this->belongsTo(User::class);
    }

    /**
     * Relasi ke Product (produk yang dibeli)
     */
    public function product()
    {
        return $this->belongsTo(Product::class);
    }
}

php artisan make:middleware UserMiddleware

<?php

namespace App\Http\Middleware;

use Closure;
use Illuminate\Http\Request;
use Illuminate\Support\Facades\Auth;
use Symfony\Component\HttpFoundation\Response;

class UserMiddleware
{
    public function handle(Request $request, Closure $next): Response
    {
        $user = Auth::user();
        
        if ($user->role !== 'member') {
            return response()->json([
                'message' => 'User only'
            ], 403);
        }

        return $next($request);
    }
}

->withMiddleware(function (Middleware $middleware) {
    $middleware->alias([
        'admin' => \App\Http\Middleware\AdminMiddleware::class,
        'user' => \App\Http\Middleware\UserMiddleware::class,
    ]);
})

php artisan make:controller TransactionController --resource

<?php

namespace App\Http\Controllers;

use App\Models\Product;
use App\Models\Transaction;
use Illuminate\Http\Request;

class TransactionController extends Controller
{
    /**
     * Get Semua Transaksi (ADMIN ONLY)
     */
    public function index()
    {
        $transactions = Transaction::with(['user', 'product'])->get();
        return response()->json($transactions);
    }

    /**
     * Get Transaksi by User (USER ONLY)
     * Mengambil riwayat transaksi user yang sedang login
     */
    public function getByUser(Request $request)
    {
        $transactions = Transaction::with('product')
            ->where('user_id', $request->user()->id)
            ->get();
            
        return response()->json($transactions);
    }

    /**
     * Create Transaksi Baru (USER ONLY)
     * Membuat transaksi dan mendapatkan Snap Token dari Midtrans
     */
    public function create(Request $request)
    {
        // Konfigurasi Midtrans
        \Midtrans\Config::$serverKey = config('midtrans.serverKey');
        \Midtrans\Config::$isProduction = config('midtrans.isProduction');
        \Midtrans\Config::$isSanitized = true;
        \Midtrans\Config::$is3ds = true;

        // Validasi input
        $request->validate([
            'product_id' => 'required|exists:products,id',
            'qty' => 'required|integer|min:1',
        ]);

        $product = Product::findOrFail($request->product_id);

        // Validasi stock
        if ($request->qty > $product->stock) {
            return response()->json([
                'message' => 'Stock tidak mencukupi'
            ], 400);
        }

        // Generate Order ID unik
        $orderId = 'ORDER-' . uniqid();

        // Simpan transaksi ke database
        $transaction = Transaction::create([
            'user_id' => $request->user()->id,
            'product_id' => $product->id,
            'qty' => $request->qty,
            'status' => 'pending',
            'midtrans_order_id' => $orderId,
            'total_price' => $product->price * $request->qty,
        ]);

        // Siapkan parameter untuk Midtrans
        $params = [
            'transaction_details' => [
                'order_id' => $orderId,
                'gross_amount' => $transaction->total_price,
            ],
            'item_details' => [
                [
                    'id' => $product->id,
                    'price' => $product->price,
                    'quantity' => $request->qty,
                    'name' => $product->name,
                ]
            ],
            'customer_details' => [
                'first_name' => $request->user()->fullname,
                'email' => $request->user()->email,
                'phone' => $request->user()->no_telp,
            ]
        ];

        // Dapatkan Snap Token dari Midtrans
        $snapToken = \Midtrans\Snap::getSnapToken($params);

        // Update transaksi dengan Snap Token
        $transaction->update([
            'snap_token' => $snapToken
        ]);

        return response()->json([
            'message' => 'Transaction created successfully',
            'snap_token' => $snapToken,
            'transaction' => $transaction
        ], 201);
    }

    /**
     * Callback / Webhook Midtrans (PUBLIC)
     * Endpoint yang dipanggil Midtrans saat status pembayaran berubah
     */
    public function callback(Request $request)
    {
        $orderId = $request->order_id;
        $status = $request->transaction_status;
        $paymentType = $request->payment_type;

        $transaction = Transaction::where('midtrans_order_id', $orderId)->first();

        if (!$transaction) {
            return response()->json(['message' => 'Transaction not found'], 404);
        }

        // Cegah double update
        if ($transaction->status === 'success') {
            return response()->json(['message' => 'Already processed']);
        }

        // Update status berdasarkan response Midtrans
        if ($status === 'settlement' || $status === 'capture') {
            $transaction->status = 'success';
            $transaction->payment_type = $paymentType;
            $transaction->save();

            // Kurangi stock produk
            $product = Product::find($transaction->product_id);
            if ($product && $product->stock >= $transaction->qty) {
                $product->stock -= $transaction->qty;
                $product->save();
            }
        } elseif ($status === 'pending') {
            $transaction->status = 'pending';
            $transaction->save();
        } elseif (in_array($status, ['deny', 'expire', 'cancel'])) {
            $transaction->status = 'failed';
            $transaction->save();
        }

        return response()->json(['message' => 'OK']);
    }

    /**
     * Update Status Transaksi (ADMIN ONLY)
     * Manual update status oleh admin
     */
    public function update(Request $request, Transaction $transaction)
    {
        $request->validate([
            'status' => 'required|in:pending,success,failed',
        ]);

        $transaction->update([
            'status' => $request->status,
        ]);

        return response()->json([
            'message' => 'Transaction updated successfully',
            'transaction' => $transaction
        ]);
    }

    // Method kosong (tidak digunakan)
    public function store(Request $request) {}
    public function show(Transaction $transaction) {}
    public function edit(Transaction $transaction) {}
    public function destroy(Transaction $transaction) {}
}

<?php

use App\Http\Controllers\ProductController;
use App\Http\Controllers\AuthController;
use App\Http\Controllers\TransactionController;
use App\Http\Middleware\AdminMiddleware;
use App\Http\Middleware\UserMiddleware;

// ==========================================
// PUBLIC ROUTES
// ==========================================
Route::get('/products', [ProductController::class, 'index']);
Route::get('/products/{product}', [ProductController::class, 'show']);

// Public Auth Routes
Route::post('/register', [AuthController::class, 'register']);
Route::post('/login', [AuthController::class, 'login']);

// Midtrans Webhook (PUBLIC - dipanggil oleh Midtrans)
Route::post('/payment/callback', [TransactionController::class, 'callback']);

// ==========================================
// PROTECTED ROUTES (Perlu Login)
// ==========================================
Route::middleware('auth:sanctum')->group(function () {
    
    // User Routes (umum)
    Route::get('/user', [AuthController::class, 'user']);
    Route::post('/logout', [AuthController::class, 'logout']);
    
    // ==========================================
    // ADMIN ONLY ROUTES
    // ==========================================
    Route::middleware([AdminMiddleware::class])->group(function () {
        // Product Management
        Route::post('/products', [ProductController::class, 'store']);
        Route::put('/products/{product}', [ProductController::class, 'update']);
        Route::delete('/products/{product}', [ProductController::class, 'destroy']);
        
        // Transaction Management (Admin)
        Route::get('/transactions', [TransactionController::class, 'index']);
        Route::put('/transactions/{transaction}', [TransactionController::class, 'update']);
    });
    
    // ==========================================
    // USER ONLY ROUTES (Member)
    // ==========================================
    Route::middleware([UserMiddleware::class])->group(function () {
        // Transaction (User)
        Route::post('/transactions', [TransactionController::class, 'create']);
        Route::get('/transactions/user', [TransactionController::class, 'getByUser']);
    });
});