Upload perdana untuk deploy

point/hapus.php

@@ -1,4 +1,13 @@
 <?php
+session_start();
+// Role check: hanya admin yang boleh menghapus
+if (!isset($_SESSION['role']) || $_SESSION['role'] !== 'admin') {
+    header('Content-Type: application/json');
+    http_response_code(403);
+    echo json_encode(['status'=>'error','message'=>'Akses ditolak. Hanya admin yang dapat menghapus data.']);
+    exit;
+}
+
 include '../koneksi.php';
 header('Content-Type: application/json');
 

point/simpan.php

@@ -1,4 +1,13 @@
 <?php
+session_start();
+// Role check: hanya admin dan petugas yang boleh menyimpan
+if (!isset($_SESSION['role']) || !in_array($_SESSION['role'], ['admin', 'petugas'])) {
+    header('Content-Type: application/json');
+    http_response_code(403);
+    echo json_encode(['status'=>'error','message'=>'Akses ditolak. Hanya admin/petugas yang dapat menambah data.']);
+    exit;
+}
+
 // point/simpan.php
 include '../koneksi.php';
 header('Content-Type: application/json');

point/update.php

@@ -1,4 +1,12 @@
 <?php
+session_start();
+if (!isset($_SESSION['role']) || !in_array($_SESSION['role'], ['admin', 'petugas'])) {
+    header('Content-Type: application/json');
+    http_response_code(403);
+    echo json_encode(['status'=>'error','message'=>'Akses ditolak.']);
+    exit;
+}
+
 include '../koneksi.php';
 header('Content-Type: application/json');
 

point/update_lokasi.php

@@ -0,0 +1,26 @@
+<?php
+session_start();
+include '../koneksi.php';
+
+if (!isset($_SESSION['user_id'])) {
+    echo json_encode(['status' => 'error', 'message' => 'Unauthorized']);
+    exit;
+}
+
+$id = $_POST['id'] ?? '';
+$latitude = $_POST['latitude'] ?? '';
+$longitude = $_POST['longitude'] ?? '';
+
+if (!$id || !$latitude || !$longitude) {
+    echo json_encode(['status' => 'error', 'message' => 'Data tidak lengkap']);
+    exit;
+}
+
+try {
+    $stmt = $pdo->prepare("UPDATE points SET latitude = ?, longitude = ? WHERE id = ?");
+    $stmt->execute([$latitude, $longitude, $id]);
+    
+    echo json_encode(['status' => 'success']);
+} catch (PDOException $e) {
+    echo json_encode(['status' => 'error', 'message' => 'Database error']);
+}