diff --git a/ambil.php b/ambil.php
index cb31dce..049c103 100644
--- a/ambil.php
+++ b/ambil.php
@@ -2,14 +2,30 @@
 error_reporting(0);
 ini_set('display_errors', 0);
 header('Content-Type: application/json; charset=UTF-8');
+
+include 'auth.php'; // Middleware auth
 include 'koneksi.php';
+
 if (!$conn) {
     echo json_encode(array("status" => "error", "message" => "Gagal konek DB"));
     exit;
 }
+
+$isAdmin = isAdminPemerintah();
+$userIbadahId = getUserIbadahId();
+
 if ($_SERVER['REQUEST_METHOD'] === 'GET') {
     $res = array("ibadah" => array(), "penduduk" => array());
-    $qI = mysqli_query($conn, "SELECT id, nama, latitude, longitude, radius FROM tabel_ibadah");
+    
+    // Filter ibadah: admin pemerintah lihat semua, admin ibadah lihat miliknya saja
+    $sqlIbadah = "SELECT id, nama, latitude, longitude, radius FROM tabel_ibadah";
+    if (!$isAdmin && $userIbadahId > 0) {
+        $sqlIbadah .= " WHERE id = $userIbadahId";
+    } else if (!$isAdmin) {
+        $sqlIbadah .= " WHERE id = 0"; // Jika tidak ada id_rumah_ibadah, jangan tampilkan apa-apa
+    }
+
+    $qI = mysqli_query($conn, $sqlIbadah);
     if($qI){
         while($r = mysqli_fetch_assoc($qI)) {
             $res["ibadah"][] = array(
@@ -21,7 +37,9 @@ if ($_SERVER['REQUEST_METHOD'] === 'GET') {
             );
         }
     }
-    $qP = mysqli_query($conn, "SELECT id, nama, latitude, longitude, status_warna FROM tabel_penduduk");
+
+    // Ambil data penduduk (termasuk status_bantuan)
+    $qP = mysqli_query($conn, "SELECT id, nama, latitude, longitude, status_warna, status_bantuan FROM tabel_penduduk");
     if($qP){
         while($r = mysqli_fetch_assoc($qP)) {
             $res["penduduk"][] = array(
@@ -29,32 +47,56 @@ if ($_SERVER['REQUEST_METHOD'] === 'GET') {
                 "nama_penduduk" => $r['nama'],
                 "latitude" => (float)$r['latitude'],
                 "longitude" => (float)$r['longitude'],
-                "status_warna" => $r['status_warna']
+                "status_warna" => $r['status_warna'],
+                "status_bantuan" => $r['status_bantuan'] ?? 'Belum'
             );
         }
     }
+    
     echo json_encode($res);
     exit;
 }
+
 if ($_SERVER['REQUEST_METHOD'] === 'POST') {
+    // Tambah Ibadah (Hanya Admin Rumah Ibadah)
     if (isset($_POST['type']) && $_POST['type'] === 'ibadah') {
+        if ($isAdmin) {
+            echo json_encode(array("status" => "error", "message" => "Hanya Admin Rumah Ibadah yang dapat menambah data ini")); exit;
+        }
+        
+        // Opsional: cegah jika admin ibadah sudah punya rumah ibadah
+        if (isset($_SESSION['id_rumah_ibadah']) && $_SESSION['id_rumah_ibadah'] > 0) {
+            echo json_encode(array("status" => "error", "message" => "Anda sudah mengelola satu rumah ibadah. Hapus yang lama terlebih dahulu jika ingin mengganti.")); exit;
+        }
+
         $nama = mysqli_real_escape_string($conn, $_POST['nama_ibadah']);
         $lat  = (float)$_POST['latitude'];
         $lng  = (float)$_POST['longitude'];
         $rad  = (int)$_POST['radius'];
+        
         $sql = "INSERT INTO tabel_ibadah (nama, latitude, longitude, radius) VALUES ('$nama', $lat, $lng, $rad)";
         if (mysqli_query($conn, $sql)) {
-            echo json_encode(array("status" => "success", "message" => "Berhasil Simpan"));
+            $new_id = mysqli_insert_id($conn);
+            $user_id = $_SESSION['user_id'];
+            mysqli_query($conn, "UPDATE users SET id_rumah_ibadah = $new_id WHERE id = $user_id");
+            $_SESSION['id_rumah_ibadah'] = $new_id;
+            
+            echo json_encode(array("status" => "success", "message" => "Berhasil Simpan Rumah Ibadah"));
         } else {
             echo json_encode(array("status" => "error", "message" => mysqli_error($conn)));
         }
         exit;
     }
+
+    // Tambah Penduduk (Hanya Admin Pemerintah)
     if (isset($_POST['type']) && $_POST['type'] === 'penduduk') {
+        if (!$isAdmin) {
+            echo json_encode(array("status" => "error", "message" => "Tidak ada akses")); exit;
+        }
         $nama = mysqli_real_escape_string($conn, $_POST['nama_penduduk']);
         $lat  = (float)$_POST['latitude'];
         $lng  = (float)$_POST['longitude'];
-        $sql = "INSERT INTO tabel_penduduk (nama, latitude, longitude, status_warna) VALUES ('$nama', $lat, $lng, 'Merah')";
+        $sql = "INSERT INTO tabel_penduduk (nama, latitude, longitude, status_warna, status_bantuan) VALUES ('$nama', $lat, $lng, 'Merah', 'Belum')";
         if (mysqli_query($conn, $sql)) {
             echo json_encode(array("status" => "success", "message" => "Berhasil Simpan"));
         } else {
@@ -62,6 +104,8 @@ if ($_SERVER['REQUEST_METHOD'] === 'POST') {
         }
         exit;
     }
+
+    // Update Warna (Boleh siapa saja, otomatis oleh sistem radius.php)
     if (isset($_POST['action']) && $_POST['action'] === 'update_warna') {
         $id = (int)$_POST['id'];
         $warna = mysqli_real_escape_string($conn, $_POST['status_warna']);
@@ -73,19 +117,82 @@ if ($_SERVER['REQUEST_METHOD'] === 'POST') {
         }
         exit;
     }
-
-    // Hapus Data
-    if (isset($_POST['action']) && $_POST['action'] === 'hapus') {
+    
+    // Update Radius Ibadah
+    if (isset($_POST['action']) && $_POST['action'] === 'update_radius') {
         $id = (int)$_POST['id'];
-        $type = $_POST['type_hapus'];
-        $table = ($type === 'ibadah') ? 'tabel_ibadah' : 'tabel_penduduk';
+        $rad = (int)$_POST['radius'];
         
-        $sql = "DELETE FROM $table WHERE id = $id";
+        // Hanya Admin Ibadah untuk miliknya
+        if ($isAdmin) {
+             echo json_encode(array("status" => "error", "message" => "Admin Pemerintah tidak bisa mengubah radius")); exit;
+        }
+        if ($id !== $userIbadahId) {
+            echo json_encode(array("status" => "error", "message" => "Akses ditolak")); exit;
+        }
+        
+        $sql = "UPDATE tabel_ibadah SET radius = $rad WHERE id = $id";
         if (mysqli_query($conn, $sql)) {
-            echo json_encode(array("status" => "success", "message" => "Data berhasil dihapus"));
+            echo json_encode(array("status" => "success", "message" => "Radius berhasil diubah"));
         } else {
             echo json_encode(array("status" => "error", "message" => mysqli_error($conn)));
         }
         exit;
     }
+    
+    // Konfirmasi Penyaluran Bantuan
+    if (isset($_POST['action']) && $_POST['action'] === 'konfirmasi_bantuan') {
+        $id = (int)$_POST['id'];
+        // Hanya admin ibadah yg biasa mengonfirmasi (atau pemerintah juga boleh)
+        $sql = "UPDATE tabel_penduduk SET status_bantuan = 'Sudah' WHERE id = $id";
+        if (mysqli_query($conn, $sql)) {
+            echo json_encode(array("status" => "success", "message" => "Bantuan berhasil dikonfirmasi"));
+        } else {
+            echo json_encode(array("status" => "error", "message" => mysqli_error($conn)));
+        }
+        exit;
+    }
+
+    // Hapus Data
+    if (isset($_POST['action']) && $_POST['action'] === 'hapus') {
+        $id = (int)$_POST['id'];
+        $type = $_POST['type_hapus'];
+        
+        if ($type === 'ibadah') {
+            // Hanya Admin Ibadah yang bisa menghapus rumah ibadah miliknya
+            if ($isAdmin) {
+                echo json_encode(array("status" => "error", "message" => "Admin Pemerintah tidak diizinkan menghapus data rumah ibadah")); exit;
+            }
+            if ($id !== (int)$_SESSION['id_rumah_ibadah']) {
+                echo json_encode(array("status" => "error", "message" => "Tidak ada akses untuk menghapus rumah ibadah ini")); exit;
+            }
+            $table = 'tabel_ibadah';
+            
+            $sql = "DELETE FROM $table WHERE id = $id";
+            if (mysqli_query($conn, $sql)) {
+                // Jika yang hapus adalah admin ibadah (pemilik), hapus keterkaitannya
+                if (!$isAdmin) {
+                    $user_id = $_SESSION['user_id'];
+                    mysqli_query($conn, "UPDATE users SET id_rumah_ibadah = NULL WHERE id = $user_id");
+                    $_SESSION['id_rumah_ibadah'] = null;
+                }
+                echo json_encode(array("status" => "success", "message" => "Data berhasil dihapus"));
+            } else {
+                echo json_encode(array("status" => "error", "message" => mysqli_error($conn)));
+            }
+        } else {
+            // Hapus penduduk hanya untuk admin pemerintah
+            if (!$isAdmin) {
+                echo json_encode(array("status" => "error", "message" => "Tidak ada akses menghapus data penduduk")); exit;
+            }
+            $table = 'tabel_penduduk';
+            $sql = "DELETE FROM $table WHERE id = $id";
+            if (mysqli_query($conn, $sql)) {
+                echo json_encode(array("status" => "success", "message" => "Data berhasil dihapus"));
+            } else {
+                echo json_encode(array("status" => "error", "message" => mysqli_error($conn)));
+            }
+        }
+        exit;
+    }
 }
diff --git a/auth.php b/auth.php
new file mode 100644
index 0000000..868df5e
--- /dev/null
+++ b/auth.php
@@ -0,0 +1,58 @@
+<?php
+/**
+ * auth.php — Middleware Autentikasi & Otorisasi
+ * Include file ini di setiap halaman yang memerlukan login.
+ */
+session_start();
+
+// Redirect ke login jika belum login
+if (!isset($_SESSION['user_id'])) {
+    header("Location: login.php");
+    exit;
+}
+
+/**
+ * Cek apakah user adalah Admin Pemerintah
+ */
+function isAdminPemerintah() {
+    return isset($_SESSION['role']) && $_SESSION['role'] === 'admin_pemerintah';
+}
+
+/**
+ * Cek apakah user adalah Admin Rumah Ibadah
+ */
+function isAdminIbadah() {
+    return isset($_SESSION['role']) && $_SESSION['role'] === 'admin_ibadah';
+}
+
+/**
+ * Ambil ID rumah ibadah milik user (untuk admin_ibadah)
+ */
+function getUserIbadahId() {
+    return isset($_SESSION['id_rumah_ibadah']) ? (int)$_SESSION['id_rumah_ibadah'] : 0;
+}
+
+/**
+ * Ambil nama user yang sedang login
+ */
+function getUserNama() {
+    return isset($_SESSION['nama']) ? $_SESSION['nama'] : 'User';
+}
+
+/**
+ * Ambil role user yang sedang login
+ */
+function getUserRole() {
+    return isset($_SESSION['role']) ? $_SESSION['role'] : '';
+}
+
+/**
+ * Require role tertentu, redirect ke dashboard jika tidak sesuai
+ */
+function requireRole($role) {
+    if (!isset($_SESSION['role']) || $_SESSION['role'] !== $role) {
+        header("Location: dashboard.php");
+        exit;
+    }
+}
+?>
diff --git a/dashboard.php b/dashboard.php
new file mode 100644
index 0000000..9e2050e
--- /dev/null
+++ b/dashboard.php
@@ -0,0 +1,141 @@
+<?php
+include 'auth.php';
+include 'koneksi.php';
+
+$role = getUserRole();
+$nama = getUserNama();
+$isAdmin = isAdminPemerintah();
+
+// Ambil statistik
+$totalIbadah = 0; $totalPenduduk = 0; $totalTercakup = 0; $totalBelum = 0;
+$q1 = mysqli_query($conn, "SELECT COUNT(*) as c FROM tabel_ibadah");
+if($q1) $totalIbadah = mysqli_fetch_assoc($q1)['c'];
+
+$q2 = mysqli_query($conn, "SELECT COUNT(*) as c FROM tabel_penduduk");
+if($q2) $totalPenduduk = mysqli_fetch_assoc($q2)['c'];
+
+$q3 = mysqli_query($conn, "SELECT COUNT(*) as c FROM tabel_penduduk WHERE status_warna='Hijau'");
+if($q3) $totalTercakup = mysqli_fetch_assoc($q3)['c'];
+
+$totalBelum = $totalPenduduk - $totalTercakup;
+
+// Untuk admin ibadah, ambil nama rumah ibadah miliknya
+$namaIbadah = '-';
+if (isAdminIbadah() && getUserIbadahId() > 0) {
+    $idIb = getUserIbadahId();
+    $qIb = mysqli_query($conn, "SELECT nama FROM tabel_ibadah WHERE id=$idIb");
+    if ($qIb && mysqli_num_rows($qIb) > 0) {
+        $namaIbadah = mysqli_fetch_assoc($qIb)['nama'];
+    }
+}
+
+$roleLabel = $isAdmin ? 'Admin Pemerintah' : 'Admin Rumah Ibadah';
+?>
+<!DOCTYPE html>
+<html lang="id">
+<head>
+    <meta charset="UTF-8">
+    <meta name="viewport" content="width=device-width, initial-scale=1.0">
+    <title>Dashboard — WebGIS Poverty Mapping</title>
+    <link href="https://fonts.googleapis.com/css2?family=Plus+Jakarta+Sans:wght@400;600;700;800&display=swap" rel="stylesheet">
+    <link rel="stylesheet" href="https://cdn.jsdelivr.net/npm/bootstrap-icons@1.11.1/font/bootstrap-icons.css">
+    <style>
+        *,*::before,*::after{box-sizing:border-box;margin:0;padding:0}
+        body{font-family:'Plus Jakarta Sans',sans-serif;background:#0b132b;color:#fff;min-height:100vh}
+        .topbar{background:rgba(14,23,44,0.9);backdrop-filter:blur(16px);border-bottom:1px solid rgba(255,255,255,0.06);padding:16px 32px;display:flex;align-items:center;justify-content:space-between;position:sticky;top:0;z-index:100}
+        .topbar-brand{display:flex;align-items:center;gap:12px}
+        .topbar-logo{width:40px;height:40px;border-radius:12px;background:linear-gradient(135deg,#5bc0be,#3a506b);display:flex;align-items:center;justify-content:center;font-size:1.1rem}
+        .topbar-brand h2{font-size:1rem;font-weight:800;letter-spacing:-0.3px}
+        .topbar-right{display:flex;align-items:center;gap:16px}
+        .user-info{text-align:right}
+        .user-info .uname{font-size:0.85rem;font-weight:700}
+        .user-info .urole{font-size:0.68rem;color:#5bc0be;text-transform:uppercase;letter-spacing:1px}
+        .btn-logout{background:rgba(231,76,60,0.12);border:1px solid rgba(231,76,60,0.3);color:#e74c3c;padding:10px 18px;border-radius:10px;font-size:0.8rem;font-weight:700;font-family:inherit;cursor:pointer;transition:all .3s;text-decoration:none;display:flex;align-items:center;gap:8px}
+        .btn-logout:hover{background:#e74c3c;color:#fff}
+        .container{max-width:1100px;margin:0 auto;padding:32px 24px}
+        .welcome{margin-bottom:32px}
+        .welcome h1{font-size:1.6rem;font-weight:800;margin-bottom:6px}
+        .welcome p{color:#78909c;font-size:0.88rem}
+        .stats{display:grid;grid-template-columns:repeat(auto-fit,minmax(200px,1fr));gap:16px;margin-bottom:36px}
+        .stat{background:rgba(14,23,44,0.7);backdrop-filter:blur(12px);border:1px solid rgba(255,255,255,0.06);border-radius:16px;padding:22px 24px;transition:transform .3s}
+        .stat:hover{transform:translateY(-3px)}
+        .stat-icon{width:44px;height:44px;border-radius:12px;display:flex;align-items:center;justify-content:center;font-size:1.2rem;margin-bottom:14px}
+        .stat-icon.ib{background:rgba(91,192,190,0.15);color:#5bc0be}
+        .stat-icon.pd{background:rgba(243,156,18,0.15);color:#f39c12}
+        .stat-icon.ok{background:rgba(46,204,113,0.15);color:#2ecc71}
+        .stat-icon.no{background:rgba(231,76,60,0.15);color:#e74c3c}
+        .stat .val{font-size:2rem;font-weight:800;line-height:1}
+        .stat .lbl{font-size:0.7rem;color:#78909c;text-transform:uppercase;letter-spacing:1px;margin-top:4px}
+        .nav-title{font-size:0.72rem;font-weight:800;color:#5bc0be;text-transform:uppercase;letter-spacing:2px;margin-bottom:16px}
+        .nav-grid{display:grid;grid-template-columns:repeat(auto-fit,minmax(280px,1fr));gap:16px}
+        .nav-card{background:rgba(14,23,44,0.7);backdrop-filter:blur(12px);border:1px solid rgba(255,255,255,0.06);border-radius:16px;padding:24px;text-decoration:none;color:#fff;transition:all .3s;display:flex;align-items:flex-start;gap:16px}
+        .nav-card:hover{border-color:rgba(91,192,190,0.3);transform:translateY(-3px);box-shadow:0 8px 30px rgba(0,0,0,0.3)}
+        .nav-card-icon{width:48px;height:48px;border-radius:14px;background:linear-gradient(135deg,#1c2541,#3a506b);display:flex;align-items:center;justify-content:center;font-size:1.3rem;flex-shrink:0;color:#6fffe9}
+        .nav-card-body h3{font-size:0.95rem;font-weight:700;margin-bottom:4px}
+        .nav-card-body p{font-size:0.78rem;color:#78909c;line-height:1.5}
+        .ib-info{background:rgba(91,192,190,0.08);border:1px solid rgba(91,192,190,0.15);border-radius:14px;padding:18px 22px;margin-bottom:32px;display:flex;align-items:center;gap:14px}
+        .ib-info i{font-size:1.4rem;color:#5bc0be}
+        .ib-info .ib-det h4{font-size:0.9rem;font-weight:700;margin-bottom:2px}
+        .ib-info .ib-det p{font-size:0.76rem;color:#78909c}
+    </style>
+</head>
+<body>
+<div class="topbar">
+    <div class="topbar-brand">
+        <div class="topbar-logo"><i class="bi bi-globe-asia-australia"></i></div>
+        <h2>WebGIS Poverty Mapping</h2>
+    </div>
+    <div class="topbar-right">
+        <div class="user-info">
+            <div class="uname"><?= htmlspecialchars($nama) ?></div>
+            <div class="urole"><?= $roleLabel ?></div>
+        </div>
+        <a href="logout.php" class="btn-logout"><i class="bi bi-box-arrow-right"></i> Logout</a>
+    </div>
+</div>
+<div class="container">
+    <div class="welcome">
+        <h1>Selamat Datang, <?= htmlspecialchars($nama) ?>!</h1>
+        <p>Anda login sebagai <strong><?= $roleLabel ?></strong>. Pilih menu di bawah untuk mulai mengelola data.</p>
+    </div>
+
+    <?php if(isAdminIbadah() && getUserIbadahId() > 0): ?>
+    <div class="ib-info">
+        <i class="bi bi-building-fill"></i>
+        <div class="ib-det">
+            <h4><?= htmlspecialchars($namaIbadah) ?></h4>
+            <p>Rumah ibadah yang Anda kelola</p>
+        </div>
+    </div>
+    <?php endif; ?>
+
+    <?php if($isAdmin): ?>
+    <div class="stats">
+        <div class="stat"><div class="stat-icon ib"><i class="bi bi-building"></i></div><div class="val"><?= $totalIbadah ?></div><div class="lbl">Rumah Ibadah</div></div>
+        <div class="stat"><div class="stat-icon pd"><i class="bi bi-people-fill"></i></div><div class="val"><?= $totalPenduduk ?></div><div class="lbl">Penduduk Miskin</div></div>
+        <div class="stat"><div class="stat-icon ok"><i class="bi bi-check-circle-fill"></i></div><div class="val"><?= $totalTercakup ?></div><div class="lbl">Tercakup</div></div>
+        <div class="stat"><div class="stat-icon no"><i class="bi bi-x-circle-fill"></i></div><div class="val"><?= $totalBelum ?></div><div class="lbl">Belum Tercakup</div></div>
+    </div>
+    <?php endif; ?>
+
+    <p class="nav-title">Menu Navigasi</p>
+    <div class="nav-grid">
+        <?php if($isAdmin): ?>
+        <a href="index.php" class="nav-card">
+            <div class="nav-card-icon"><i class="bi bi-map-fill"></i></div>
+            <div class="nav-card-body"><h3>Peta Utama</h3><p>Kelola data SPBU, jalan, dan parsil tanah pada peta.</p></div>
+        </a>
+        <a href="radius.php" class="nav-card">
+            <div class="nav-card-icon"><i class="bi bi-broadcast-pin"></i></div>
+            <div class="nav-card-body"><h3>Analisis Radius Bantuan</h3><p>Kelola rumah ibadah, penduduk, dan analisis radius jangkauan.</p></div>
+        </a>
+        <?php else: ?>
+        <a href="radius.php" class="nav-card">
+            <div class="nav-card-icon"><i class="bi bi-broadcast-pin"></i></div>
+            <div class="nav-card-body"><h3>Rumah Ibadah Saya</h3><p>Lihat peta, atur radius, dan konfirmasi penyaluran bantuan.</p></div>
+        </a>
+        <?php endif; ?>
+    </div>
+</div>
+</body>
+</html>
diff --git a/database/migrate_users.sql b/database/migrate_users.sql
new file mode 100644
index 0000000..b838f8a
--- /dev/null
+++ b/database/migrate_users.sql
@@ -0,0 +1,24 @@
+-- ================================================================
+-- Migration: Autentikasi & Otorisasi WebGIS
+-- Jalankan di database: webgis
+-- ================================================================
+
+-- 1. Ubah kolom role dari enum('admin','operator') ke enum baru
+ALTER TABLE `users`
+  MODIFY `role` enum('admin_pemerintah','admin_ibadah') NOT NULL DEFAULT 'admin_ibadah';
+
+-- 2. Tambah kolom id_rumah_ibadah (nullable, untuk menghubungkan admin_ibadah ke rumah ibadah)
+ALTER TABLE `users`
+  ADD COLUMN `id_rumah_ibadah` INT(11) DEFAULT NULL AFTER `role`;
+
+-- 3. Migrasi data user lama
+UPDATE `users` SET `role` = 'admin_pemerintah' WHERE `username` = 'admin';
+UPDATE `users` SET `role` = 'admin_ibadah' WHERE `username` = 'operator';
+
+-- 4. Tambah kolom status_bantuan di tabel_penduduk untuk fitur konfirmasi penyaluran bantuan
+ALTER TABLE `tabel_penduduk`
+  ADD COLUMN `status_bantuan` ENUM('Belum','Sudah') NOT NULL DEFAULT 'Belum';
+
+-- 5. (Opsional) Hubungkan user operator ke rumah ibadah tertentu
+-- Jalankan setelah tabel_ibadah memiliki data, ganti ID sesuai kebutuhan
+-- UPDATE `users` SET `id_rumah_ibadah` = 1 WHERE `username` = 'operator';
diff --git a/hapus_jalan.php b/hapus_jalan.php
index 96a0513..7e89106 100644
--- a/hapus_jalan.php
+++ b/hapus_jalan.php
@@ -1,4 +1,6 @@
 <?php
+include 'auth.php';
+if (!isAdminPemerintah()) { header("HTTP/1.1 403 Forbidden"); exit; }
 include 'koneksi.php';
 
 if (isset($_GET['id'])) {
diff --git a/hapus_parsil.php b/hapus_parsil.php
index 6b85afc..135131c 100644
--- a/hapus_parsil.php
+++ b/hapus_parsil.php
@@ -1,4 +1,6 @@
 <?php
+include 'auth.php';
+if (!isAdminPemerintah()) { header("HTTP/1.1 403 Forbidden"); exit; }
 include 'koneksi.php';
 
 if (isset($_GET['id'])) {
diff --git a/hapus_spbu.php b/hapus_spbu.php
index 90ed0d2..9c27bed 100644
--- a/hapus_spbu.php
+++ b/hapus_spbu.php
@@ -1,4 +1,6 @@
 <?php
+include 'auth.php';
+if (!isAdminPemerintah()) { header("HTTP/1.1 403 Forbidden"); exit; }
 include 'koneksi.php';
 
 if (isset($_GET['id'])) {
diff --git a/hash.php b/hash.php
new file mode 100644
index 0000000..111c5f8
--- /dev/null
+++ b/hash.php
@@ -0,0 +1,4 @@
+<?php
+echo "admin: " . password_hash("admin", PASSWORD_DEFAULT) . "\n";
+echo "operator: " . password_hash("operator", PASSWORD_DEFAULT) . "\n";
+?>
diff --git a/index.php b/index.php
index be39b19..4875072 100644
--- a/index.php
+++ b/index.php
@@ -1,4 +1,10 @@
 <?php 
+include 'auth.php';
+// Hanya Admin Pemerintah yang bisa mengakses halaman ini
+if (!isAdminPemerintah()) {
+    header("Location: dashboard.php");
+    exit;
+}
 include 'koneksi.php'; 
 ?>
 <!DOCTYPE html>
@@ -143,6 +149,13 @@ include 'koneksi.php';
             <button class="btn-mode" id="mode-parsil" onclick="changeMode('parsil')">
                 <i class="bi bi-square-fill text-primary"></i> Kelola Tanah
             </button>
+            <hr style="border:none;border-top:1px solid rgba(255,255,255,0.08);margin:8px 0;">
+            <a href="dashboard.php" class="btn-mode" style="text-decoration:none;">
+                <i class="bi bi-speedometer2" style="color:#f39c12"></i> Dashboard
+            </a>
+            <a href="logout.php" class="btn-mode" style="text-decoration:none;" onclick="return confirm('Yakin ingin logout?')">
+                <i class="bi bi-box-arrow-right" style="color:#e74c3c"></i> Logout
+            </a>
         </div>
     </div>
 
diff --git a/login.php b/login.php
new file mode 100644
index 0000000..165cb1a
--- /dev/null
+++ b/login.php
@@ -0,0 +1,105 @@
+<?php
+session_start();
+if (isset($_SESSION['user_id'])) { header("Location: dashboard.php"); exit; }
+include 'koneksi.php';
+$error = '';
+if ($_SERVER['REQUEST_METHOD'] === 'POST') {
+    $username = mysqli_real_escape_string($conn, trim($_POST['username']));
+    $password = trim($_POST['password']);
+    if (empty($username) || empty($password)) {
+        $error = 'Username dan password tidak boleh kosong.';
+    } else {
+        $sql = "SELECT * FROM users WHERE username = '$username' LIMIT 1";
+        $result = mysqli_query($conn, $sql);
+        if ($result && mysqli_num_rows($result) === 1) {
+            $user = mysqli_fetch_assoc($result);
+            if (password_verify($password, $user['password'])) {
+                $_SESSION['user_id']         = (int)$user['id'];
+                $_SESSION['username']        = $user['username'];
+                $_SESSION['nama']            = $user['nama'];
+                $_SESSION['role']            = $user['role'];
+                $_SESSION['id_rumah_ibadah'] = $user['id_rumah_ibadah'] ? (int)$user['id_rumah_ibadah'] : null;
+                header("Location: dashboard.php");
+                exit;
+            } else { $error = 'Password salah.'; }
+        } else { $error = 'Username tidak ditemukan.'; }
+    }
+}
+?>
+<!DOCTYPE html>
+<html lang="id">
+<head>
+    <meta charset="UTF-8">
+    <meta name="viewport" content="width=device-width, initial-scale=1.0">
+    <title>Login — WebGIS Poverty Mapping</title>
+    <link href="https://fonts.googleapis.com/css2?family=Plus+Jakarta+Sans:wght@400;600;700;800&display=swap" rel="stylesheet">
+    <link rel="stylesheet" href="https://cdn.jsdelivr.net/npm/bootstrap-icons@1.11.1/font/bootstrap-icons.css">
+    <style>
+        *,*::before,*::after{box-sizing:border-box;margin:0;padding:0}
+        body{font-family:'Plus Jakarta Sans',sans-serif;background:#0b132b;color:#fff;min-height:100vh;display:flex;align-items:center;justify-content:center;overflow:hidden}
+        .bg-anim{position:fixed;top:0;left:0;width:100%;height:100%;z-index:0;overflow:hidden}
+        .bg-anim .c{position:absolute;border-radius:50%;background:radial-gradient(circle,rgba(91,192,190,0.08),transparent 70%);animation:fl 20s infinite ease-in-out}
+        .bg-anim .c:nth-child(1){width:600px;height:600px;top:-200px;left:-100px}
+        .bg-anim .c:nth-child(2){width:400px;height:400px;bottom:-100px;right:-80px;animation-delay:-7s;background:radial-gradient(circle,rgba(111,255,233,0.06),transparent 70%)}
+        .bg-anim .c:nth-child(3){width:300px;height:300px;top:50%;left:60%;animation-delay:-14s}
+        @keyframes fl{0%,100%{transform:translate(0,0) scale(1)}33%{transform:translate(30px,-30px) scale(1.05)}66%{transform:translate(-20px,20px) scale(0.95)}}
+        .login-wrap{position:relative;z-index:1;width:100%;max-width:420px;padding:20px}
+        .login-card{background:rgba(14,23,44,0.85);backdrop-filter:blur(20px);-webkit-backdrop-filter:blur(20px);border:1px solid rgba(255,255,255,0.08);border-radius:24px;padding:44px 36px;box-shadow:0 20px 60px rgba(0,0,0,0.5);animation:cs .6s ease-out}
+        @keyframes cs{from{opacity:0;transform:translateY(30px)}to{opacity:1;transform:translateY(0)}}
+        .brand{text-align:center;margin-bottom:36px}
+        .brand-icon{width:64px;height:64px;border-radius:18px;background:linear-gradient(135deg,#5bc0be,#3a506b);display:inline-flex;align-items:center;justify-content:center;font-size:1.8rem;margin-bottom:16px;box-shadow:0 8px 24px rgba(91,192,190,0.3)}
+        .brand h1{font-size:1.3rem;font-weight:800;letter-spacing:-0.5px;margin-bottom:6px}
+        .brand p{font-size:0.78rem;color:#78909c;letter-spacing:0.5px}
+        .form-group{margin-bottom:20px}
+        .form-label{font-size:0.68rem;font-weight:700;color:#5bc0be;text-transform:uppercase;letter-spacing:1.5px;display:block;margin-bottom:8px}
+        .input-wrap{position:relative}
+        .input-wrap>i{position:absolute;left:16px;top:50%;transform:translateY(-50%);color:#5bc0be;font-size:1rem;pointer-events:none}
+        .form-input{width:100%;background:rgba(0,0,0,0.25);border:1px solid rgba(255,255,255,0.08);border-radius:12px;padding:14px 16px 14px 46px;font-size:0.9rem;color:#fff;font-family:inherit;transition:all .3s}
+        .form-input:focus{outline:none;border-color:#5bc0be;background:rgba(0,0,0,0.4);box-shadow:0 0 0 3px rgba(91,192,190,0.1)}
+        .form-input::placeholder{color:rgba(255,255,255,0.3)}
+        .toggle-pw{position:absolute;right:14px;top:50%;transform:translateY(-50%);background:none;border:none;color:#78909c;cursor:pointer;font-size:1.1rem;padding:4px}
+        .toggle-pw:hover{color:#5bc0be}
+        .error-msg{background:rgba(231,76,60,0.12);border:1px solid rgba(231,76,60,0.3);border-radius:10px;padding:12px 16px;font-size:0.82rem;color:#e74c3c;margin-bottom:20px;display:flex;align-items:center;gap:10px;animation:shake .4s ease-out}
+        @keyframes shake{0%,100%{transform:translateX(0)}25%{transform:translateX(-6px)}75%{transform:translateX(6px)}}
+        .btn-login{width:100%;padding:15px;border:none;border-radius:12px;background:linear-gradient(135deg,#5bc0be,#3a506b);color:#fff;font-size:0.95rem;font-weight:700;font-family:inherit;cursor:pointer;transition:all .3s;display:flex;align-items:center;justify-content:center;gap:10px}
+        .btn-login:hover{transform:translateY(-2px);box-shadow:0 8px 25px rgba(91,192,190,0.4)}
+        .login-footer{text-align:center;margin-top:24px;font-size:0.72rem;color:#4a5568}
+    </style>
+</head>
+<body>
+<div class="bg-anim"><div class="c"></div><div class="c"></div><div class="c"></div></div>
+<div class="login-wrap">
+    <div class="login-card">
+        <div class="brand">
+            <div class="brand-icon"><i class="bi bi-globe-asia-australia"></i></div>
+            <h1>WebGIS Poverty Mapping</h1>
+            <p>Sistem Informasi Geografis Pemetaan Kemiskinan</p>
+        </div>
+        <?php if($error): ?>
+        <div class="error-msg"><i class="bi bi-exclamation-triangle-fill"></i> <?= htmlspecialchars($error) ?></div>
+        <?php endif; ?>
+        <form method="POST" action="login.php" autocomplete="off">
+            <div class="form-group">
+                <label class="form-label">Username</label>
+                <div class="input-wrap">
+                    <i class="bi bi-person-fill"></i>
+                    <input type="text" name="username" class="form-input" placeholder="Masukkan username" value="<?= isset($_POST['username'])?htmlspecialchars($_POST['username']):'' ?>" required autofocus>
+                </div>
+            </div>
+            <div class="form-group">
+                <label class="form-label">Password</label>
+                <div class="input-wrap">
+                    <i class="bi bi-lock-fill"></i>
+                    <input type="password" name="password" id="pw" class="form-input" placeholder="Masukkan password" required>
+                    <button type="button" class="toggle-pw" onclick="var i=document.getElementById('pw'),e=document.getElementById('eye');if(i.type==='password'){i.type='text';e.className='bi bi-eye-slash-fill'}else{i.type='password';e.className='bi bi-eye-fill'}">
+                        <i class="bi bi-eye-fill" id="eye"></i>
+                    </button>
+                </div>
+            </div>
+            <button type="submit" class="btn-login"><i class="bi bi-box-arrow-in-right"></i> Masuk ke Sistem</button>
+        </form>
+        <div class="login-footer">&copy; 2026 WebGIS Poverty Mapping — Pontianak</div>
+    </div>
+</div>
+</body>
+</html>
diff --git a/logout.php b/logout.php
new file mode 100644
index 0000000..ea82c68
--- /dev/null
+++ b/logout.php
@@ -0,0 +1,7 @@
+<?php
+session_start();
+session_unset();
+session_destroy();
+header("Location: login.php");
+exit;
+?>
diff --git a/radius.php b/radius.php
index 3db467d..a5b1de9 100644
--- a/radius.php
+++ b/radius.php
@@ -1,3 +1,10 @@
+<?php
+include 'auth.php';
+include 'koneksi.php';
+$userRole = getUserRole();
+$userIbadahId = getUserIbadahId();
+$isAdmin = isAdminPemerintah();
+?>
 <!DOCTYPE html>
 <html lang="id">
 <head>
@@ -160,12 +167,15 @@
         <button class="btn-mode active" id="btn-view" onclick="setMode('view')">
             <i class="bi bi-eye-fill"></i> Mode Lihat
         </button>
-        <button class="btn-mode" id="btn-ibadah" onclick="setMode('ibadah')">
-            <i class="bi bi-building-fill" style="color:#6fffe9"></i> Tambah Rumah Ibadah
-        </button>
+        <?php if($isAdmin): ?>
         <button class="btn-mode" id="btn-penduduk" onclick="setMode('penduduk')">
             <i class="bi bi-person-fill" style="color:#f39c12"></i> Tambah Penduduk
         </button>
+        <?php else: ?>
+        <button class="btn-mode" id="btn-ibadah" onclick="setMode('ibadah')">
+            <i class="bi bi-building-fill" style="color:#6fffe9"></i> Tambah Rumah Ibadah
+        </button>
+        <?php endif; ?>
         <hr class="divider">
         <p class="section-label">Legenda</p>
         <div class="legend">
@@ -178,6 +188,13 @@
         <button class="btn-mode" onclick="loadData()" style="color:#6fffe9;">
             <i class="bi bi-arrow-clockwise"></i> Refresh Data
         </button>
+        <hr class="divider">
+        <a href="dashboard.php" class="btn-mode" style="text-decoration:none;">
+            <i class="bi bi-speedometer2" style="color:#f39c12"></i> Dashboard
+        </a>
+        <a href="logout.php" class="btn-mode" style="text-decoration:none;" onclick="return confirm('Yakin ingin logout?')">
+            <i class="bi bi-box-arrow-right" style="color:#e74c3c"></i> Logout
+        </a>
     </div>
 </div>
 
@@ -205,6 +222,11 @@
 <script src="https://unpkg.com/leaflet@1.9.4/dist/leaflet.js"></script>
 <script src="https://cdn.jsdelivr.net/npm/@turf/turf@6/turf.min.js"></script>
 <script>
+// ===== ROLE CONFIG (dari PHP) =====
+const USER_ROLE = '<?= $userRole ?>';
+const USER_IBADAH_ID = <?= $userIbadahId ? $userIbadahId : 'null' ?>;
+const IS_ADMIN = <?= $isAdmin ? 'true' : 'false' ?>;
+
 // ===== INIT MAP =====
 const map = L.map('map', { zoomControl: false }).setView([-0.0263, 109.3425], 13);
 L.control.zoom({ position: 'bottomright' }).addTo(map);
@@ -308,13 +330,27 @@ function renderIbadah() {
             fillOpacity: 0.08, weight: 1.5, dashArray: '6,4'
         });
 
+        // Tombol ubah radius: hanya admin_ibadah (pemilik)
+        const canEditRadius = (!IS_ADMIN && USER_IBADAH_ID === d.id);
+        const radiusBtn = canEditRadius ? `
+            <label class="f-label" style="margin-top:12px">Ubah Radius (meter)</label>
+            <div style="display:flex;gap:8px">
+                <input type="number" id="edit-radius-${d.id}" class="f-input" value="${d.radius}" min="50" max="50000" style="margin-bottom:0;flex:1">
+                <button class="btn-submit" style="width:auto;padding:0 16px" onclick="updateRadius(${d.id})"><i class="bi bi-check-lg"></i></button>
+            </div>` : '';
+
+        // Tombol hapus: hanya admin_ibadah (pemilik) yang bisa menghapus
+        const hapusBtn = (!IS_ADMIN && USER_IBADAH_ID === d.id) ? `
+            <button class="btn-submit" style="background: rgba(231,76,60,0.1); color: #e74c3c; border: 1px solid #e74c3c; margin-top: 12px; box-shadow: none;" onclick="hapusData('ibadah', ${d.id})"><i class="bi bi-trash"></i> Hapus Rumah Ibadah</button>` : '';
+
         marker.bindPopup(`
             <div class="p-header"><i class="bi bi-building-fill"></i> Rumah Ibadah</div>
             <div class="p-body">
                 <div class="info-row"><span class="key">Nama</span><span class="val">${d.nama_ibadah}</span></div>
                 <div class="info-row"><span class="key">Radius</span><span class="val">${d.radius.toLocaleString()} m</span></div>
                 <div class="info-row"><span class="key">Koordinat</span><span class="val">${d.latitude.toFixed(5)}, ${d.longitude.toFixed(5)}</span></div>
-                <button class="btn-submit" style="background: rgba(231,76,60,0.1); color: #e74c3c; border: 1px solid #e74c3c; margin-top: 12px; box-shadow: none;" onclick="hapusData('ibadah', ${d.id})"><i class="bi bi-trash"></i> Hapus Rumah Ibadah</button>
+                ${radiusBtn}
+                ${hapusBtn}
             </div>
         `);
 
@@ -333,13 +369,27 @@ function renderPenduduk() {
             ? '<span class="badge-warna badge-hijau">Tercakup</span>'
             : '<span class="badge-warna badge-merah">Belum Tercakup</span>';
 
+        // Tombol hapus: hanya admin_pemerintah
+        const hapusBtn = IS_ADMIN ? `
+            <button class="btn-submit" style="background: rgba(231,76,60,0.1); color: #e74c3c; border: 1px solid #e74c3c; margin-top: 12px; box-shadow: none;" onclick="hapusData('penduduk', ${d.id})"><i class="bi bi-trash"></i> Hapus Data Penduduk</button>` : '';
+
+        // Tombol konfirmasi bantuan: admin_ibadah saja, hanya penduduk tercakup
+        const bantuanStatus = d.status_bantuan || 'Belum';
+        const bantuanBadge = bantuanStatus === 'Sudah'
+            ? '<span class="badge-warna badge-hijau">Sudah Disalurkan</span>'
+            : '<span class="badge-warna badge-merah">Belum Disalurkan</span>';
+        const konfirmasiBtn = (!IS_ADMIN && d.status_warna === 'Hijau' && bantuanStatus === 'Belum') ? `
+            <button class="btn-submit" style="background: rgba(46,204,113,0.1); color: #2ecc71; border: 1px solid #2ecc71; margin-top: 8px; box-shadow: none;" onclick="konfirmasiBantuan(${d.id})"><i class="bi bi-check-circle"></i> Konfirmasi Bantuan</button>` : '';
+
         marker.bindPopup(`
             <div class="p-header"><i class="bi bi-person-fill"></i> Data Penduduk</div>
             <div class="p-body">
                 <div class="info-row"><span class="key">Nama</span><span class="val">${d.nama_penduduk}</span></div>
                 <div class="info-row"><span class="key">Status</span>${badge}</div>
+                <div class="info-row"><span class="key">Bantuan</span>${bantuanBadge}</div>
                 <div class="info-row"><span class="key">Koordinat</span><span class="val">${d.latitude.toFixed(5)}, ${d.longitude.toFixed(5)}</span></div>
-                <button class="btn-submit" style="background: rgba(231,76,60,0.1); color: #e74c3c; border: 1px solid #e74c3c; margin-top: 12px; box-shadow: none;" onclick="hapusData('penduduk', ${d.id})"><i class="bi bi-trash"></i> Hapus Data Penduduk</button>
+                ${hapusBtn}
+                ${konfirmasiBtn}
             </div>
         `);
         layerPenduduk.addLayer(marker);
@@ -531,6 +581,67 @@ async function simpanPenduduk(lat, lng) {
     }
 }
 
+// ===== UPDATE RADIUS =====
+async function updateRadius(id) {
+    const input = document.getElementById('edit-radius-' + id);
+    const radius = parseInt(input?.value);
+    
+    if (!radius || radius < 50) { showToast('<i class="bi bi-exclamation"></i> Radius minimal 50m!', '#e74c3c'); return; }
+
+    try {
+        const fd = new FormData();
+        fd.append('action', 'update_radius');
+        fd.append('id', id);
+        fd.append('radius', radius);
+
+        const res  = await fetch('ambil.php', { method: 'POST', body: fd });
+        const text = await res.text();
+        
+        try {
+            const data = JSON.parse(text);
+            if (data.status === 'success') {
+                map.closePopup();
+                showToast(`<i class="bi bi-check-circle-fill"></i> ${data.message}`, '#2ecc71');
+                await loadData();
+            } else {
+                showToast(`<i class="bi bi-x-circle"></i> ${data.message}`, '#e74c3c');
+            }
+        } catch(e) {
+            showToast(`<i class="bi bi-bug"></i> Error Server`, '#e74c3c');
+        }
+    } catch(e) {
+        showToast('<i class="bi bi-wifi-off"></i> Gagal update radius', '#e74c3c');
+    }
+}
+
+// ===== KONFIRMASI BANTUAN =====
+async function konfirmasiBantuan(id) {
+    if(!confirm("Konfirmasi bahwa bantuan telah disalurkan?")) return;
+    try {
+        const fd = new FormData();
+        fd.append('action', 'konfirmasi_bantuan');
+        fd.append('id', id);
+
+        const res  = await fetch('ambil.php', { method: 'POST', body: fd });
+        const text = await res.text();
+        
+        try {
+            const data = JSON.parse(text);
+            if (data.status === 'success') {
+                map.closePopup();
+                showToast(`<i class="bi bi-check-circle-fill"></i> ${data.message}`, '#2ecc71');
+                await loadData();
+            } else {
+                showToast(`<i class="bi bi-x-circle"></i> ${data.message}`, '#e74c3c');
+            }
+        } catch(e) {
+            showToast(`<i class="bi bi-bug"></i> Error Server`, '#e74c3c');
+        }
+    } catch(e) {
+        showToast('<i class="bi bi-wifi-off"></i> Gagal konfirmasi bantuan', '#e74c3c');
+    }
+}
+
 // ===== BOOT =====
 loadData();
 </script>
diff --git a/simpan_jalan.php b/simpan_jalan.php
index c27e25a..5b378fd 100644
--- a/simpan_jalan.php
+++ b/simpan_jalan.php
@@ -1,4 +1,6 @@
 <?php
+include 'auth.php';
+if (!isAdminPemerintah()) { header("HTTP/1.1 403 Forbidden"); exit; }
 include 'koneksi.php';
 
 if ($_POST) {
diff --git a/simpan_parsil.php b/simpan_parsil.php
index 0976132..7dee2b9 100644
--- a/simpan_parsil.php
+++ b/simpan_parsil.php
@@ -1,4 +1,6 @@
 <?php
+include 'auth.php';
+if (!isAdminPemerintah()) { header("HTTP/1.1 403 Forbidden"); exit; }
 include 'koneksi.php';
 
 if ($_POST) {
diff --git a/simpan_spbu.php b/simpan_spbu.php
index 97b7f6c..e42ee8f 100644
--- a/simpan_spbu.php
+++ b/simpan_spbu.php
@@ -1,4 +1,6 @@
 <?php
+include 'auth.php';
+if (!isAdminPemerintah()) { header("HTTP/1.1 403 Forbidden"); exit; }
 include 'koneksi.php';
 
 if ($_SERVER['REQUEST_METHOD'] == 'POST') {
diff --git a/test_hash.php b/test_hash.php
new file mode 100644
index 0000000..b4f1be5
--- /dev/null
+++ b/test_hash.php
@@ -0,0 +1,11 @@
+<?php
+$hash1 = '$2y$10$nFJFuwzpHgTOgkMimoOaEOhdGvDg5LaO5aycHlKRKxRbeSYEL.lLS';
+$hash2 = '$2y$10$xFvFSy4mVkLznYgORN/vb.UDlrFrUlQ4wgXm08vRxN54of9LDGlEW';
+
+$words = ['admin', 'operator', '123456', 'password', '12345', 'admin123', 'operator123'];
+
+foreach ($words as $w) {
+    if (password_verify($w, $hash1)) echo "admin password is: $w\n";
+    if (password_verify($w, $hash2)) echo "operator password is: $w\n";
+}
+?>
diff --git a/update_posisi.php b/update_posisi.php
index 58f7cf6..85239d8 100644
--- a/update_posisi.php
+++ b/update_posisi.php
@@ -1,4 +1,6 @@
 <?php
+include 'auth.php';
+if (!isAdminPemerintah()) { header("HTTP/1.1 403 Forbidden"); exit; }
 include 'koneksi.php';
 
 if (isset($_POST['id']) && isset($_POST['lat']) && isset($_POST['lng'])) {