Harden Project 01 public endpoints

01/api/point/simpan.php

@@ -1,44 +1,40 @@
 <?php
-// api/point/simpan.php — Simpan POI baru
-header('Content-Type: application/json');
+require_once '../../auth/helper.php';
+require_once '../../includes/validation.php';
+
+require_admin_post();
 require_once '../../koneksi.php';
 
-if ($_SERVER['REQUEST_METHOD'] !== 'POST') {
-    echo json_encode(['status' => 'error', 'message' => 'Method not allowed']);
-    exit;
-}
-
-$nama = trim($_POST['nama_tempat'] ?? '');
-$wa = trim($_POST['no_wa'] ?? '');
-$buka24 = isset($_POST['buka_24jam']) ? (int) $_POST['buka_24jam'] : 0;
-$lat = (float) ($_POST['latitude'] ?? 0);
-$lng = (float) ($_POST['longitude'] ?? 0);
-
-if (!$nama) {
-    echo json_encode(['status' => 'error', 'message' => 'Nama tempat tidak boleh kosong']);
-    exit;
+$nama = clean_string($_POST['nama_tempat'] ?? '', 150);
+$wa = clean_string($_POST['no_wa'] ?? '', 30);
+$buka24 = (int)($_POST['buka_24jam'] ?? 0) === 1 ? 1 : 0;
+$coords = validate_lat_lng($_POST['latitude'] ?? null, $_POST['longitude'] ?? null);
+
+if ($nama === '' || $coords === null) {
+    json_error('Nama tempat dan koordinat valid wajib diisi.', 400);
 }
 
+[$lat, $lng] = $coords;
 $stmt = $conn->prepare("INSERT INTO lokasi_usaha (nama_tempat, no_wa, buka_24jam, latitude, longitude) VALUES (?, ?, ?, ?, ?)");
-$stmt->bind_param('ssidd', $nama, $wa, $buka24, $lat, $lng);
-
-if ($stmt->execute()) {
-    $id = $conn->insert_id;
-    echo json_encode([
-        'status' => 'success',
-        'message' => 'Data berhasil disimpan',
-        'data' => [
-            'id' => $id,
-            'nama_tempat' => $nama,
-            'no_wa' => $wa,
-            'buka_24jam' => $buka24,
-            'latitude' => $lat,
-            'longitude' => $lng
-        ]
-    ]);
-} else {
-    echo json_encode(['status' => 'error', 'message' => 'Gagal menyimpan: ' . $stmt->error]);
+if (!$stmt) {
+    error_log('Project 01 point insert prepare failed: ' . $conn->error);
+    json_error('Gagal menyimpan data.', 500);
 }
 
-$stmt->close();
-$conn->close();
+$stmt->bind_param('ssidd', $nama, $wa, $buka24, $lat, $lng);
+if (!$stmt->execute()) {
+    error_log('Project 01 point insert failed: ' . $stmt->error);
+    json_error('Gagal menyimpan data.', 500);
+}
+
+json_success([
+    'message' => 'Data berhasil disimpan',
+    'data' => [
+        'id' => $conn->insert_id,
+        'nama_tempat' => $nama,
+        'no_wa' => $wa,
+        'buka_24jam' => $buka24,
+        'latitude' => $lat,
+        'longitude' => $lng,
+    ],
+]);