commit a0c61f2bc2f3f1ff2346db5c02a6697f203be7a5
Author: ilham_gmail <milham652@gmail.com>
Date:   Thu Jun 11 17:42:40 2026 +0700

    Initial commit of unified WebGIS projects

diff --git a/.gitignore b/.gitignore
new file mode 100644
index 0000000..d2e16bc
--- /dev/null
+++ b/.gitignore
@@ -0,0 +1,13 @@
+# local environment configurations
+**/.env
+**/.env.local
+
+# dependencies
+**/vendor/
+**/node_modules/
+
+# OS/IDE files
+.idea/
+.vscode/
+.DS_Store
+Thumbs.db
diff --git a/audit_and_deployment_plan.md b/audit_and_deployment_plan.md
new file mode 100644
index 0000000..4e32949
--- /dev/null
+++ b/audit_and_deployment_plan.md
@@ -0,0 +1,466 @@
+# Audit & Rencana Deployment: SIG UAS WebGIS
+
+Dokumen ini berisi hasil audit teknis, analisis keamanan, dan rencana implementasi deployment untuk tugas akhir Sistem Informasi Geografis (SIG) yang terdiri dari dua project: **Poverty Mapping** (tugas utama) dan **Tugas SPBU** (tugas penunjang).
+
+---
+
+## 1. Analisis Struktur Project
+
+Kedua project memiliki karakteristik teknologi yang hampir sama tetapi memiliki tingkat kematangan arsitektur yang berbeda.
+
+### A. Folder `poverty-mapping` (Project Utama)
+*   **Teknologi & Framework**: PHP Native untuk backend, HTML/CSS/JS native dengan Leaflet.js dan Leaflet Draw untuk frontend.
+*   **Dependencies**: 
+    *   `phpmailer/phpmailer` (pengiriman email verifikasi).
+    *   `vlucas/phpdotenv` (manajemen environment variables).
+*   **Struktur Folder**:
+    ```
+    poverty-mapping/
+    ├── src/
+    │   ├── api/          # Rest API (tambah_lokasi, get_lokasi, dll.)
+    │   │   ├── admin/    # Manajemen persetujuan manager oleh admin
+    │   │   └── auth/     # Register, login, email verification
+    │   └── config/       # auth.php, config.php, koneksi.php
+    ├── sql/migrations/   # 001_init_schema.sql (skema DB)
+    ├── uploads/          # Folder penyimpanan foto lokasi
+    ├── index.html        # Frontend SPA utama
+    └── composer.json     # Deklarasi dependencies composer
+    ```
+*   **Konfigurasi Database**: Menggunakan file `src/config/koneksi.php` yang membaca `getenv()` dari environment system dengan fallback ke kredensial default (`localhost`, `root`, `ilham`, `webgis`).
+*   **Konfigurasi Environment**: Membaca `.env` dari root directory project menggunakan parser kustom di `src/config/config.php` serta autoloading library dotenv.
+*   **Potensi Masalah**: Nama database default adalah `webgis` yang berpotensi konflik dengan project kedua.
+
+### B. Folder `tugas-spbu` (Tugas Penunjang)
+*   **Teknologi & Framework**: PHP Native untuk backend, HTML/CSS/JS native dengan Leaflet.js, Leaflet Draw, dan Leaflet GeometryUtil.
+*   **Dependencies**: Tidak menggunakan Composer (pure PHP + JavaScript CDN).
+*   **Struktur Folder**:
+    ```
+    tugas-spbu/
+    ├── src/
+    │   ├── api/          # Rest API (get_lokasi, tambah_jalan, dll.)
+    │   └── config/       # auth.php, config.php, koneksi.php
+    ├── sql/              # webgis.sql (dump skema dan data awal)
+    └── index.html        # Frontend SPA utama
+    ```
+*   **Konfigurasi Database**: **KREDENSIAL HARDCODED** di `src/config/koneksi.php`:
+    ```php
+    $conn = new mysqli("localhost", "root", "ilham", "webgis2");
+    ```
+    Ini adalah masalah kritis karena server tujuan deployment pasti menggunakan host, user, password, atau nama database yang berbeda.
+*   **Konfigurasi Environment**: Hanya memiliki variabel `API_KEY` di `.env.example`.
+*   **Potensi Masalah**: 
+    1.  Koneksi database yang di-hardcode.
+    2.  Frontend (`index.html`) tidak memiliki antarmuka atau logika untuk memuat/menyimpan `API_KEY`, sehingga seluruh operasi write (tambah, edit, hapus) di server akan menghasilkan `401 Unauthorized` karena header `X-API-KEY` bernilai `undefined`.
+
+---
+
+## 2. Landing Page Utama
+
+Untuk menyatukan pintu masuk ke kedua project, opsi terbaik adalah menggunakan **Reverse Proxy (Nginx)** yang melayani Landing Page di root path (`/`) dan membelokkan traffic subpath ke container masing-masing aplikasi.
+
+### Keuntungan Pendekatan Reverse Proxy:
+1.  **Isolasi Kode**: Project `poverty-mapping` dan `tugas-spbu` tetap terpisah secara logika dan runtime di container-nya masing-masing.
+2.  **Kemudahan Jalur URL**: Memungkinkan konfigurasi domain tunggal (misal: `sig.domain.com`) tanpa memerlukan subdomain terpisah untuk setiap aplikasi.
+3.  **Bebas Konflik Cookie/Session**: Cookie PHP (`PHPSESSID`) dapat dipisah lingkup path-nya dengan aman.
+4.  **Tanpa Mengubah Path Relatif Code**: Karena proxy Nginx melakukan rewrite prefix path, relative requests di browser (seperti `src/api/...`) tetap berjalan dengan aman.
+
+### Rekomendasi Struktur Folder Root (Monorepo):
+```
+sig-uas/                  # Workspace Root
+├── docker-compose.yml    # Orkestrasi seluruh service (Nginx, App 1, App 2, MySQL)
+├── init-db.sql           # Inisialisasi awal database
+├── nginx.conf            # Konfigurasi reverse proxy dan landing page
+├── landing-page/         # Folder Landing Page utama
+│   ├── index.html        # File HTML Landing Page premium
+│   └── style.css         # Styling Landing Page
+├── poverty-mapping/      # Project 1
+│   ├── Dockerfile
+│   └── ...
+└── tugas-spbu/          # Project 2
+    ├── Dockerfile
+    └── ...
+```
+
+---
+
+## 3. Persiapan Deployment (Readiness Audit)
+
+Berikut adalah daftar temuan kritis yang wajib diperbaiki sebelum melakukan deployment:
+
+| Temuan Masalah | Lokasi File | Tingkat Risiko | Dampak & Rekomendasi Perbaikan |
+| :--- | :--- | :--- | :--- |
+| **Kredensial Gmail Riil** | `poverty-mapping/.env` | **CRITICAL** | Terungkap `SMTP_USER` dan `SMTP_PASS` (App Password Gmail) secara tertulis di workspace. Hapus file `.env` dari upload repositori Git (masukkan ke `.gitignore`) dan masukkan password sebagai secrets di Coolify. |
+| **Database Kredensial Hardcoded** | `tugas-spbu/src/config/koneksi.php` | **HIGH** | Koneksi menggunakan parameter string statik. Ubah agar membaca dari environment variables (`getenv()`) dengan fallback ke konfigurasi lokal. |
+| **API Key Hilang di Frontend** | `tugas-spbu/index.html` | **HIGH** | JavaScript mencoba membaca variabel `API_KEY` global yang tidak pernah di-declare di script. Seluruh request mutasi akan ditolak API backend. Tambahkan pop-up input API Key di halaman untuk admin atau simpan di `localStorage`. |
+| **Penyimpanan Foto Gagal** | `poverty-mapping/src/api/upload_photo.php` | **MEDIUM** | Folder `uploads/` di server produksi harus dapat ditulisi oleh user web server (`www-data`). Perlu dipastikan folder di-mount dengan volume Docker yang memiliki hak akses `775`. |
+| **Expose File Dotfiles (`.env`, `.git`)** | Root / Project folders | **HIGH** | Jika server web salah konfigurasi, file `.env` dapat diunduh publik. Konfigurasikan Nginx/Apache untuk memblokir akses ke berkas tersembunyi (`~ /\.(?!well-known)`). |
+
+---
+
+## 4. Analisis Keamanan (Security Audit)
+
+Kami melakukan audit mendalam terhadap API dan frontend dari kedua aplikasi:
+
+### A. SQL Injection (Risiko: LOW)
+*   **Temuan**: Baik `poverty-mapping` maupun `tugas-spbu` telah menggunakan prepared statement (`$conn->prepare` dan `$stmt->bind_param`) untuk semua endpoint yang memproses data masukan pengguna.
+*   **Rekomendasi**: Pertahankan standar ini. Hindari interpolasi string langsung (seperti `"$user_input"`) dalam query SQL.
+
+### B. Stored XSS - Cross-Site Scripting (Risiko: HIGH)
+*   **Temuan**: Di `tugas-spbu/index.html`, data lokasi yang diambil dari database dirender langsung ke dalam popups Leaflet tanpa escaping:
+    ```javascript
+    marker.bindPopup(`<b>${item.nama}</b><br>...<div ...>${alamatEsc}</div>`);
+    ```
+    Jika penyerang menyisipkan nama lokasi seperti `<img src=x onerror=alert(document.cookie)>`, script tersebut akan tereksekusi pada browser setiap pengunjung yang mengklik marker tersebut.
+*   **Rekomendasi**: Buat fungsi pembantu `escapeHtml()` di `tugas-spbu/index.html` seperti yang sudah ada di `poverty-mapping/index.html`:
+    ```javascript
+    function escapeHtml(str) {
+        return str.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;").replace(/'/g, "&#039;");
+    }
+    ```
+    Bungkus seluruh output variabel pengguna (`item.nama`, `item.alamat`) dengan fungsi tersebut saat melakukan `bindPopup`.
+
+### C. CSRF - Cross-Site Request Forgery (Risiko: MEDIUM)
+*   **Temuan**: Endpoint API di `poverty-mapping` dapat membaca autentikasi dari `$_SESSION['jwt']` (cookie-based). Karena tidak ada token anti-CSRF pada request mutasi, situs pihak ketiga yang dibuka di tab browser yang sama dapat memaksa browser mengirimkan request mutasi berotentikasi.
+*   **Rekomendasi**: Ubah API untuk hanya menerima otentikasi melalui header HTTP `Authorization: Bearer <token>` (tidak membaca session cookie untuk API sensitif), karena header Authorization tidak akan ditransmisikan secara otomatis oleh browser pada request lintas situs (cross-site).
+
+### D. File Upload Security (Risiko: MEDIUM)
+*   **Temuan**: Di `poverty-mapping/src/api/upload_photo.php`, tipe file diverifikasi menggunakan MIME detection (`finfo_file`). Namun, sanitation filename:
+    ```php
+    $safeName = preg_replace('/[^a-zA-Z0-9_-]/','_',basename($file['name']));
+    ```
+    Akan mengganti karakter titik (`.`) dengan underscore (`_`), sehingga ekstensi file akan hilang (misal `gambar.jpg` menjadi `gambar_jpg`). Hal ini aman dari eksekusi script PHP liar, tetapi dapat mengganggu pembacaan file gambar oleh browser jika web server tidak mengirimkan header Content-Type yang tepat.
+*   **Rekomendasi**: Pisahkan proses sanitasi nama berkas dengan tetap mempertahankan ekstensi aslinya secara terpisah di bagian akhir nama berkas:
+    ```php
+    $ext = strtolower(pathinfo($file['name'], PATHINFO_EXTENSION));
+    if (!in_array($ext, ['jpg', 'jpeg', 'png', 'gif', 'webp'])) { /* reject */ }
+    $safeName = preg_replace('/[^a-zA-Z0-9_-]/', '_', pathinfo($file['name'], PATHINFO_FILENAME)) . '.' . $ext;
+    ```
+
+---
+
+## 5. Analisis Database
+
+Kedua project menggunakan database dengan nama default `webgis` pada repositori asal mereka. Namun, keduanya memiliki struktur tabel `lokasi` yang berbeda:
+*   `poverty-mapping.lokasi`: Menggunakan primary key `id INT AUTO_INCREMENT` dan menyimpan data KK, status kemiskinan, jumlah anggota keluarga, pendapatan, serta status bantuan sosial.
+*   `tugas-spbu.lokasi`: Menggunakan primary key `id VARCHAR(8)` (UUID pendek) dan dirancang untuk memetakan koordinat SPBU, Masjid, dan Rumah.
+
+### Rekomendasi Solusi:
+1.  **Pemisahan Database**: Wajib dipisahkan menjadi dua database berbeda di server database MySQL yang sama:
+    *   Database 1: `poverty_db` (untuk Poverty Mapping)
+    *   Database 2: `spbu_db` (untuk Tugas SPBU)
+2.  **Struktur Environment**:
+    *   Di server produksi, buat satu container MySQL yang menampung kedua database tersebut.
+    *   Konfigurasikan masing-masing aplikasi melalui environment variable `DB_NAME` untuk menunjuk ke database yang bersesuaian.
+
+---
+
+## 6. Analisis Docker
+
+Sangat direkomendasikan untuk menggunakan Docker demi portabilitas dan kemudahan deployment di Coolify.
+
+### Kelebihan Menggunakan Docker:
+*   **Konsistensi**: Menjamin PHP 8.x dan modul `mysqli` terinstal dengan tepat di server tanpa perlu konfigurasi OS manual.
+*   **Isolasi Dependensi**: Folder `uploads` dan file konfigurasi terisolasi penuh.
+*   **Kemudahan Coolify**: Coolify secara native mendukung deployment berbasis Docker Compose. Kita hanya perlu mengarahkan Coolify ke repositori Git kita, dan Coolify akan membangun lingkungan lengkap secara otomatis.
+
+### Rencana File Docker & Compose:
+
+#### A. Dockerfile untuk `poverty-mapping` (`poverty-mapping/Dockerfile`)
+```dockerfile
+FROM php:8.2-apache
+
+# Install ekstensi mysqli untuk PHP
+RUN docker-php-ext-install mysqli && docker-php-ext-enable mysqli
+
+# Aktifkan mod_rewrite Apache untuk menangani routing .htaccess jika ada
+RUN a2enmod rewrite
+
+# Salin source code project ke dalam container
+COPY . /var/www/html/
+
+# Atur hak akses direktori uploads agar web server bisa menulis file foto
+RUN chown -R www-data:www-data /var/www/html && chmod -R 775 /var/www/html/uploads
+
+# Expose port 80
+EXPOSE 80
+```
+
+#### B. Dockerfile untuk `tugas-spbu` (`tugas-spbu/Dockerfile`)
+```dockerfile
+FROM php:8.2-apache
+
+# Install ekstensi mysqli
+RUN docker-php-ext-install mysqli && docker-php-ext-enable mysqli
+
+# Salin source code
+COPY . /var/www/html/
+
+# Atur hak akses
+RUN chown -R www-data:www-data /var/www/html
+
+EXPOSE 80
+```
+
+#### C. Root `docker-compose.yml`
+```yaml
+version: '3.8'
+
+services:
+  # 1. Reverse Proxy & Landing Page
+  landing-page:
+    image: nginx:alpine
+    ports:
+      - "80:80"
+    volumes:
+      - ./landing-page:/usr/share/nginx/html:ro
+      - ./nginx.conf:/etc/nginx/conf.d/default.conf:ro
+    depends_on:
+      - poverty-mapping
+      - tugas-spbu
+    restart: always
+
+  # 2. Poverty Mapping Application
+  poverty-mapping:
+    build:
+      context: ./poverty-mapping
+      dockerfile: Dockerfile
+    environment:
+      - DB_HOST=db
+      - DB_PORT=3306
+      - DB_USER=webgis_user
+      - DB_PASS=${DB_PASSWORD}
+      - DB_NAME=poverty_db
+      - API_KEY=${POVERTY_API_KEY}
+      - JWT_SECRET=${JWT_SECRET}
+      - INTERNAL_AUTH_KEY=${INTERNAL_AUTH_KEY}
+      - BASIC_API_USER=webgis-api
+      - BASIC_API_PASS=${BASIC_API_PASS}
+      - SMTP_HOST=smtp.gmail.com
+      - SMTP_PORT=587
+      - SMTP_USER=${SMTP_USER}
+      - SMTP_PASS=${SMTP_PASS}
+      - SMTP_ENCRYPTION=tls
+      - MAIL_FROM=${SMTP_USER}
+      - MAIL_FROM_NAME=PovertyMapping
+    volumes:
+      - poverty_uploads:/var/www/html/uploads
+    depends_on:
+      - db
+    restart: always
+
+  # 3. Tugas SPBU Application
+  tugas-spbu:
+    build:
+      context: ./tugas-spbu
+      dockerfile: Dockerfile
+    environment:
+      - DB_HOST=db
+      - DB_PORT=3306
+      - DB_USER=webgis_user
+      - DB_PASS=${DB_PASSWORD}
+      - DB_NAME=spbu_db
+      - API_KEY=${SPBU_API_KEY}
+    depends_on:
+      - db
+    restart: always
+
+  # 4. Database MySQL
+  db:
+    image: mysql:8.0
+    command: --default-authentication-plugin=mysql_native_password
+    environment:
+      - MYSQL_ROOT_PASSWORD=${DB_ROOT_PASSWORD}
+      - MYSQL_DATABASE=poverty_db
+      - MYSQL_USER=webgis_user
+      - MYSQL_PASSWORD=${DB_PASSWORD}
+    volumes:
+      - mysql_data:/var/lib/mysql
+      - ./init-db.sql:/docker-entrypoint-initdb.d/init-db.sql
+    restart: always
+
+volumes:
+  mysql_data:
+  poverty_uploads:
+```
+
+#### D. Nginx Config (`nginx.conf`)
+```nginx
+server {
+    listen 80;
+    server_name localhost;
+
+    # 1. Landing Page Utama
+    location / {
+        root /usr/share/nginx/html;
+        index index.html;
+        try_files $uri $uri/ =404;
+    }
+
+    # 2. Route ke Poverty Mapping App
+    location /poverty-mapping/ {
+        proxy_pass http://poverty-mapping:80/;
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+
+        # Scope cookies ke subpath agar tidak tabrakan session PHP-nya
+        proxy_cookie_path / /poverty-mapping/;
+    }
+
+    # 3. Route ke Tugas SPBU App
+    location /tugas-spbu/ {
+        proxy_pass http://tugas-spbu:80/;
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+
+        proxy_cookie_path / /tugas-spbu/;
+    }
+
+    # Blokir akses ke file .env / .git secara global di level proxy
+    location ~ /\. {
+        deny all;
+        access_log off;
+        log_not_found off;
+    }
+}
+```
+
+---
+
+## 7. Identifikasi Role dan Akun Demo
+
+Untuk memudahkan proses penilaian oleh Dosen, berikut adalah daftar peran (role) yang teridentifikasi beserta rancangan akun demonya.
+
+### Daftar Peran (Roles):
+1.  **Admin** (Poverty Mapping): Memiliki akses penuh terhadap visualisasi peta kemiskinan, serta persetujuan pembuatan akun manager baru.
+2.  **Manager** (Poverty Mapping): Memiliki akses untuk menambah lokasi keluarga miskin, mengubah data kemiskinan, serta mengunggah foto bukti penyerahan bantuan sosial.
+3.  **Guest / Publik** (Poverty Mapping): Hanya bisa melihat data peta dengan pembatasan/masking pada kolom sensitif (seperti Nama Kepala Keluarga, No Telepon, Catatan internal bantuan).
+4.  **Admin SPBU** (Tugas SPBU): Menggunakan token `API_KEY` untuk menambah, mengedit, atau menghapus data spasial jalan, tanah, dan lokasi SPBU.
+
+### Daftar Akun Demo (Password: `password`):
+
+| Aplikasi | Role | Email / Akun | Password | Catatan Kredensial |
+| :--- | :--- | :--- | :--- | :--- |
+| **Poverty Mapping** | Admin | `admin@example.com` | `password` | Akun administrator utama untuk persetujuan akun Manager. |
+| **Poverty Mapping** | Manager | `manager@example.com` | `password` | Perwakilan role Manager untuk penambahan/pengeditan data kemiskinan. |
+| **Tugas SPBU** | Admin | *Token/Key* | `8f3b7e6a9c4d2f1a6b8c9d0e4f7a1b2c` | Berupa token `API_KEY` yang di-input ke panel admin SPBU. |
+
+### Mekanisme Seed SQL (`init-db.sql`):
+Ketika container MySQL dibangun pertama kali, script ini akan secara otomatis membuat kedua database, mengatur tabel awal, dan menaruh data akun demo dengan hash password yang valid untuk kata sandi `"password"` (yaitu `$2y$10$7YbX4D/QUo1OFJw.ZxyDl.plX03wY/7POuPNx3/ZfyX0vWwaKPNR.`):
+
+```sql
+-- Buat database jika belum ada
+CREATE DATABASE IF NOT EXISTS poverty_db;
+CREATE DATABASE IF NOT EXISTS spbu_db;
+
+-- Pindah ke database poverty_db untuk inisialisasi tabel users dan admin default
+USE poverty_db;
+
+CREATE TABLE IF NOT EXISTS users (
+  id INT UNSIGNED NOT NULL AUTO_INCREMENT,
+  email VARCHAR(255) NOT NULL,
+  password_hash VARCHAR(255) NOT NULL,
+  name VARCHAR(255) DEFAULT NULL,
+  organization VARCHAR(255) DEFAULT NULL,
+  org_address TEXT DEFAULT NULL,
+  org_phone VARCHAR(32) DEFAULT NULL,
+  org_proof_path VARCHAR(255) DEFAULT NULL,
+  role ENUM('manager','admin') NOT NULL DEFAULT 'manager',
+  status ENUM('pending','active','rejected','pending_verification') NOT NULL DEFAULT 'pending',
+  email_verified TINYINT(1) NOT NULL DEFAULT 0,
+  created_at DATETIME NOT NULL DEFAULT CURRENT_TIMESTAMP,
+  PRIMARY KEY (id),
+  UNIQUE KEY uq_users_email (email)
+) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;
+
+-- Insert akun demo Admin & Manager (Password: password)
+INSERT INTO users (email, password_hash, name, organization, role, status, email_verified)
+VALUES 
+('admin@example.com', '$2y$10$7YbX4D/QUo1OFJw.ZxyDl.plX03wY/7POuPNx3/ZfyX0vWwaKPNR.', 'Admin Demo', 'SIG WebGIS', 'admin', 'active', 1),
+('manager@example.com', '$2y$10$7YbX4D/QUo1OFJw.ZxyDl.plX03wY/7POuPNx3/ZfyX0vWwaKPNR.', 'Manager Demo', 'Pemberdayaan Masyarakat', 'manager', 'active', 1)
+ON DUPLICATE KEY UPDATE password_hash = VALUES(password_hash), status = 'active';
+```
+
+---
+
+## 8. Langkah Rencana Deployment Lengkap
+
+Berikut adalah workflow deployment lengkap dari repositori lokal ke server Coolify:
+
+### Langkah 1: Persiapan Repositori Git & Gitea
+1.  **Inisialisasi Git Lokal**:
+    Di root folder `/media/ilham/data/Code/sig-uas/`, jalankan:
+    ```bash
+    git init
+    ```
+2.  **Konfigurasi `.gitignore`**:
+    Buat file `.gitignore` di root folder untuk mencegah data rahasia masuk repositori:
+    ```
+    # Mengabaikan file environment lokal
+    **/.env
+    **/vendor/
+    **/node_modules/
+    .idea/
+    .vscode/
+    ```
+3.  **Commit Code**:
+    ```bash
+    git add .
+    git commit -m "Initial commit for SIG UAS unified project"
+    ```
+4.  **Buat Repositori Baru di Gitea**:
+    *   Login ke akun Gitea Anda.
+    *   Pilih **New Repository**, beri nama `sig-uas`.
+    *   Salin URL remote git (contoh: `http://gitea.domain.com/user/sig-uas.git`).
+5.  **Push ke Gitea**:
+    ```bash
+    git remote add origin <URL_GITEA>
+    git branch -M main
+    git push -u origin main
+    ```
+
+### Langkah 2: Setup Database & Environment Variables di Coolify
+1.  Login ke dashboard **Coolify** Anda.
+2.  Pilih / buat **Project** baru untuk SIG UAS.
+3.  Sebelum meluncurkan container aplikasi, definisikan variabel environment (Secrets) yang dibutuhkan dalam menu konfigurasi environment di Coolify:
+    *   `DB_ROOT_PASSWORD`: Password root MySQL (bebas & aman).
+    *   `DB_PASSWORD`: Password user database MySQL.
+    *   `POVERTY_API_KEY`: API Key acak untuk Poverty Mapping.
+    *   `SPBU_API_KEY`: API Key acak untuk SPBU (`8f3b7e6a9c4d2f1a6b8c9d0e4f7a1b2c` jika ingin mencocokkan default frontend).
+    *   `JWT_SECRET`: Secret key JWT acak.
+    *   `INTERNAL_AUTH_KEY`: Key autentikasi internal acak.
+    *   `SMTP_USER`: Alamat Gmail pengirim notifikasi.
+    *   `SMTP_PASS`: App password akun Gmail pengirim.
+
+### Langkah 3: Setup Project di Coolify (Deployment)
+1.  Di dalam Project Coolify, klik **Add Resource** -> **Docker Compose**.
+2.  Masukkan detail Git Gitea Anda (Coolify akan menggunakan SSH key atau Credentials untuk membaca repositori).
+3.  Masukkan path ke `docker-compose.yml` (secara default diisi `./docker-compose.yml`).
+4.  Coolify secara otomatis membaca file compose tersebut.
+5.  Konfigurasikan **Domains** pada service `landing-page` di panel Coolify (misal: `https://sig.domain.com`). Coolify akan secara otomatis membuatkan sertifikat SSL gratis menggunakan Let's Encrypt dan merutekannya ke port 80 milik service `landing-page`.
+6.  Klik **Deploy**. Coolify akan:
+    *   Melakukan pull source code dari Gitea.
+    *   Membangun gambar Docker untuk Poverty Mapping dan Tugas SPBU.
+    *   Menyalakan database MySQL dan menjalankan inisialisasi SQL dari `init-db.sql`.
+    *   Menghidupkan proxy Nginx dan Landing Page.
+
+### Langkah 4: Pengujian Pasca Deployment (Testing)
+1.  **Akses Domain**: Buka `https://sig.domain.com` untuk memastikan landing page premium tampil.
+2.  **Navigasi Poverty Mapping**: 
+    *   Buka `https://sig.domain.com/poverty-mapping/`.
+    *   Klik **Masuk** dan login dengan akun demo `admin@example.com` (password: `password`).
+    *   Uji penambahan pin peta kemiskinan dan unggah foto.
+3.  **Navigasi SPBU**:
+    *   Buka `https://sig.domain.com/tugas-spbu/`.
+    *   Uji kelancaran data spasial jalan, tanah, dan titik lokasi SPBU yang dimuat secara otomatis dari database.
+
+### Langkah 5: Skema Backup dan Rollback
+1.  **Backup Database & Data Volume**:
+    *   Coolify menyediakan fitur backup database MySQL bawaan yang berjalan secara periodik. Pastikan fitur ini diaktifkan dengan tujuan ke S3 storage atau direktori lokal server.
+    *   Volume `poverty_uploads` yang menyimpan gambar-gambar bukti foto kemiskinan disimpan di `/var/lib/docker/volumes/` pada host. Folder ini harus dimasukkan ke daftar rutin backup server.
+2.  **Rollback Cepat**:
+    *   Jika terjadi masalah saat rilis pembaruan baru, buka tab **Deployments** di Coolify untuk service tersebut, lalu klik tombol **Redeploy** pada versi commit stabil sebelumnya.
+    *   Coolify akan langsung mematikan container yang bermasalah dan menghidupkan kembali container berbasis image stabil sebelumnya dalam waktu kurang dari 10 detik.
diff --git a/docker-compose.yml b/docker-compose.yml
new file mode 100644
index 0000000..59d6f04
--- /dev/null
+++ b/docker-compose.yml
@@ -0,0 +1,78 @@
+version: '3.8'
+
+services:
+  # 1. Reverse Proxy & Landing Page
+  landing-page:
+    image: nginx:alpine
+    ports:
+      - "8080:80"
+    volumes:
+      - ./landing-page:/usr/share/nginx/html:ro
+      - ./nginx.conf:/etc/nginx/conf.d/default.conf:ro
+    depends_on:
+      - poverty-mapping
+      - tugas-spbu
+    restart: always
+
+  # 2. Poverty Mapping Application
+  poverty-mapping:
+    build:
+      context: ./poverty-mapping
+      dockerfile: Dockerfile
+    environment:
+      - DB_HOST=db
+      - DB_PORT=3306
+      - DB_USER=webgis_user
+      - DB_PASS=${DB_PASSWORD:-webgis_password}
+      - DB_NAME=poverty_db
+      - API_KEY=${POVERTY_API_KEY:-8f3b7e6a9c4d2f1a6b8c9d0e4f7a1b2c}
+      - JWT_SECRET=${JWT_SECRET:-jwt_secret_dev_key_12345}
+      - INTERNAL_AUTH_KEY=${INTERNAL_AUTH_KEY:-internal_dev_key}
+      - BASIC_API_USER=webgis-api
+      - BASIC_API_PASS=${BASIC_API_PASS:-api_pass}
+      - SMTP_HOST=smtp.gmail.com
+      - SMTP_PORT=587
+      - SMTP_USER=${SMTP_USER:-dev@example.com}
+      - SMTP_PASS=${SMTP_PASS:-dev_pass}
+      - SMTP_ENCRYPTION=tls
+      - MAIL_FROM=${SMTP_USER:-dev@example.com}
+      - MAIL_FROM_NAME=PovertyMapping
+    volumes:
+      - poverty_uploads:/var/www/html/uploads
+    depends_on:
+      - db
+    restart: always
+
+  # 3. Tugas SPBU Application
+  tugas-spbu:
+    build:
+      context: ./tugas-spbu
+      dockerfile: Dockerfile
+    environment:
+      - DB_HOST=db
+      - DB_PORT=3306
+      - DB_USER=webgis_user
+      - DB_PASS=${DB_PASSWORD:-webgis_password}
+      - DB_NAME=spbu_db
+      - API_KEY=${SPBU_API_KEY:-8f3b7e6a9c4d2f1a6b8c9d0e4f7a1b2c}
+    depends_on:
+      - db
+    restart: always
+
+  # 4. Database MySQL
+  db:
+    image: mysql:8.0
+    command: --default-authentication-plugin=mysql_native_password
+    environment:
+      - MYSQL_ROOT_PASSWORD=${DB_ROOT_PASSWORD:-root_password}
+      - MYSQL_DATABASE=poverty_db
+      - MYSQL_USER=webgis_user
+      - MYSQL_PASSWORD=${DB_PASSWORD:-webgis_password}
+    volumes:
+      - mysql_data:/var/lib/mysql
+      - ./init-db.sql:/docker-entrypoint-initdb.d/init-db.sql
+    restart: always
+
+volumes:
+  mysql_data:
+  poverty_uploads:
diff --git a/init-db.sql b/init-db.sql
new file mode 100644
index 0000000..cf6948d
--- /dev/null
+++ b/init-db.sql
@@ -0,0 +1,160 @@
+-- -----------------------------------------------------
+-- DATABASE 1: poverty_db (Poverty Mapping Project)
+-- -----------------------------------------------------
+CREATE DATABASE IF NOT EXISTS poverty_db;
+USE poverty_db;
+
+SET FOREIGN_KEY_CHECKS = 0;
+DROP TABLE IF EXISTS bantuan_detail;
+DROP TABLE IF EXISTS lokasi;
+DROP TABLE IF EXISTS users;
+DROP TABLE IF EXISTS migrations;
+SET FOREIGN_KEY_CHECKS = 1;
+
+CREATE TABLE users (
+  id INT UNSIGNED NOT NULL AUTO_INCREMENT,
+  email VARCHAR(255) NOT NULL,
+  password_hash VARCHAR(255) NOT NULL,
+  name VARCHAR(255) DEFAULT NULL,
+  organization VARCHAR(255) DEFAULT NULL,
+  org_address TEXT DEFAULT NULL,
+  org_phone VARCHAR(32) DEFAULT NULL,
+  org_proof_path VARCHAR(255) DEFAULT NULL,
+  role ENUM('manager','admin') NOT NULL DEFAULT 'manager',
+  status ENUM('pending','active','rejected','pending_verification') NOT NULL DEFAULT 'pending',
+  email_verified TINYINT(1) NOT NULL DEFAULT 0,
+  email_verification_token_hash VARCHAR(128) DEFAULT NULL,
+  email_verification_expires DATETIME DEFAULT NULL,
+  email_verification_sent_at DATETIME DEFAULT NULL,
+  email_verification_attempts INT NOT NULL DEFAULT 0,
+  email_verification_last_sent DATETIME DEFAULT NULL,
+  email_verification_locked_until DATETIME DEFAULT NULL,
+  created_at DATETIME NOT NULL DEFAULT CURRENT_TIMESTAMP,
+  approved_by INT UNSIGNED DEFAULT NULL,
+  approved_at DATETIME DEFAULT NULL,
+  PRIMARY KEY (id),
+  UNIQUE KEY uq_users_email (email),
+  KEY idx_users_status (status),
+  KEY idx_users_role (role),
+  KEY idx_users_approved_by (approved_by),
+  CONSTRAINT fk_users_approved_by FOREIGN KEY (approved_by) REFERENCES users (id) ON DELETE SET NULL ON UPDATE CASCADE
+) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;
+
+-- Insert Admin and Manager demo accounts (Password: password)
+INSERT INTO users (email, password_hash, name, organization, role, status, email_verified)
+VALUES 
+('admin@example.com', '$2y$10$7YbX4D/QUo1OFJw.ZxyDl.plX03wY/7POuPNx3/ZfyX0vWwaKPNR.', 'Admin Demo', 'SIG WebGIS', 'admin', 'active', 1),
+('manager@example.com', '$2y$10$7YbX4D/QUo1OFJw.ZxyDl.plX03wY/7POuPNx3/ZfyX0vWwaKPNR.', 'Manager Demo', 'Pemberdayaan Masyarakat', 'manager', 'active', 1)
+ON DUPLICATE KEY UPDATE password_hash = VALUES(password_hash), status = 'active';
+
+CREATE TABLE lokasi (
+  id INT UNSIGNED NOT NULL AUTO_INCREMENT,
+  nama VARCHAR(255) NOT NULL,
+  no_telp VARCHAR(32) DEFAULT NULL,
+  buka_24_jam TINYINT(1) NOT NULL DEFAULT 0,
+  latitude DECIMAL(10,6) DEFAULT NULL,
+  longitude DECIMAL(10,6) DEFAULT NULL,
+  alamat TEXT,
+  jenis VARCHAR(50) NOT NULL,
+  nama_kk VARCHAR(255) DEFAULT NULL,
+  rumah_status VARCHAR(100) DEFAULT NULL,
+  members INT DEFAULT NULL,
+  monthly_income DECIMAL(18,0) DEFAULT NULL,
+  assisted TINYINT(1) NOT NULL DEFAULT 0,
+  last_assisted_at DATETIME DEFAULT NULL,
+  assistance_notes TEXT DEFAULT NULL,
+  photo_path VARCHAR(255) DEFAULT NULL,
+  sumber_bantuan INT UNSIGNED DEFAULT NULL,
+  bentuk_bantuan VARCHAR(100) DEFAULT NULL,
+  created_by INT UNSIGNED DEFAULT NULL,
+  PRIMARY KEY (id),
+  KEY idx_lokasi_assisted (assisted),
+  KEY idx_lokasi_jenis (jenis),
+  KEY idx_lokasi_sumber_bantuan (sumber_bantuan),
+  KEY idx_lokasi_created_by (created_by),
+  KEY idx_lokasi_last_assisted_at (last_assisted_at),
+  CONSTRAINT fk_lokasi_sumber_bantuan FOREIGN KEY (sumber_bantuan) REFERENCES lokasi (id) ON DELETE SET NULL ON UPDATE CASCADE,
+  CONSTRAINT fk_lokasi_created_by FOREIGN KEY (created_by) REFERENCES users (id) ON DELETE SET NULL ON UPDATE CASCADE
+) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;
+
+CREATE TABLE bantuan_detail (
+  id BIGINT UNSIGNED NOT NULL AUTO_INCREMENT,
+  lokasi_id INT UNSIGNED NOT NULL,
+  tanggal_bantuan DATE DEFAULT NULL,
+  pemberi_bantuan VARCHAR(255) DEFAULT NULL,
+  catatan TEXT DEFAULT NULL,
+  pemberi_lokasi_id INT UNSIGNED DEFAULT NULL,
+  jumlah INT NOT NULL DEFAULT 1,
+  created_at TIMESTAMP NULL DEFAULT CURRENT_TIMESTAMP,
+  updated_at TIMESTAMP NULL DEFAULT CURRENT_TIMESTAMP ON UPDATE CURRENT_TIMESTAMP,
+  PRIMARY KEY (id),
+  KEY idx_bantuan_lokasi (lokasi_id),
+  KEY idx_bantuan_pemberi_lokasi (pemberi_lokasi_id),
+  KEY idx_bantuan_tanggal (tanggal_bantuan),
+  KEY idx_bantuan_lokasi_tanggal (lokasi_id, tanggal_bantuan),
+  KEY idx_bantuan_pemberi_tanggal (pemberi_lokasi_id, tanggal_bantuan),
+  CONSTRAINT fk_bantuan_lokasi FOREIGN KEY (lokasi_id) REFERENCES lokasi (id) ON DELETE CASCADE ON UPDATE CASCADE,
+  CONSTRAINT fk_bantuan_pemberi_lokasi FOREIGN KEY (pemberi_lokasi_id) REFERENCES lokasi (id) ON DELETE SET NULL ON UPDATE CASCADE
+) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;
+
+CREATE TABLE migrations (
+  id INT UNSIGNED NOT NULL AUTO_INCREMENT,
+  name VARCHAR(255) NOT NULL,
+  applied_at DATETIME NOT NULL,
+  PRIMARY KEY (id),
+  UNIQUE KEY uq_migrations_name (name)
+) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;
+
+INSERT INTO migrations (name, applied_at)
+VALUES ('001_init_schema', CURRENT_TIMESTAMP);
+
+
+-- -----------------------------------------------------
+-- DATABASE 2: spbu_db (SPBU Mapping Project)
+-- -----------------------------------------------------
+CREATE DATABASE IF NOT EXISTS spbu_db;
+USE spbu_db;
+
+SET FOREIGN_KEY_CHECKS = 0;
+DROP TABLE IF EXISTS `jalan`;
+DROP TABLE IF EXISTS `lokasi`;
+DROP TABLE IF EXISTS `tanah`;
+SET FOREIGN_KEY_CHECKS = 1;
+
+CREATE TABLE `jalan` (
+  `id` int NOT NULL AUTO_INCREMENT,
+  `nama` varchar(100) DEFAULT NULL,
+  `status` varchar(50) DEFAULT NULL,
+  `panjang` double DEFAULT NULL,
+  `geom` text,
+  PRIMARY KEY (`id`)
+) ENGINE=InnoDB AUTO_INCREMENT=10 DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;
+
+CREATE TABLE `lokasi` (
+  `id` varchar(8) NOT NULL,
+  `nama` varchar(50) NOT NULL,
+  `no_telp` varchar(20) DEFAULT NULL,
+  `buka_24_jam` tinyint(1) DEFAULT NULL,
+  `latitude` decimal(10,6) DEFAULT NULL,
+  `longitude` decimal(10,6) DEFAULT NULL,
+  `alamat` text,
+  `jenis` varchar(50) NOT NULL DEFAULT 'spbu',
+  PRIMARY KEY (`id`),
+  KEY `idx_lokasi_alamat` ((left(`alamat`,255)))
+) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;
+
+-- Seed SPBU map data
+INSERT INTO `lokasi` VALUES 
+('5092','Rumah','',0,-0.040882,109.335197,'Daeng Abdul Hadi, Akcaya, Pontianak Selatan, Pontianak, Kalimantan Barat, Kalimantan, 78117, Indonesia','rumah'),
+('7853','Masjid Mujahiddin','',1,-0.041462,109.336345,'Mujahiddin, Jalan Mujahidin, Akcaya, Pontianak Selatan, Pontianak, Kalimantan Barat, Kalimantan, 78121, Indonesia','masjid'),
+('8476','SPBU OSO MT. Haryono','',0,-0.044863,109.336726,'SPBU OSO MT. Haryono, Jalan M.T. Haryono, Akcaya, Pontianak Selatan, Pontianak, Kalimantan Barat, Kalimantan, 78121, Indonesia','spbu')
+ON DUPLICATE KEY UPDATE nama = VALUES(nama);
+
+CREATE TABLE `tanah` (
+  `id` int NOT NULL AUTO_INCREMENT,
+  `nama` varchar(100) DEFAULT NULL,
+  `status` varchar(50) DEFAULT NULL,
+  `luas` double DEFAULT NULL,
+  `geom` text,
+  PRIMARY KEY (`id`)
+) ENGINE=InnoDB AUTO_INCREMENT=24 DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;
diff --git a/landing-page/index.html b/landing-page/index.html
new file mode 100644
index 0000000..89cb884
--- /dev/null
+++ b/landing-page/index.html
@@ -0,0 +1,56 @@
+<!DOCTYPE html>
+<html lang="id">
+<head>
+    <meta charset="UTF-8">
+    <meta name="viewport" content="width=device-width, initial-scale=1.0">
+    <title>WebGIS Portal - SIG UAS</title>
+</head>
+<body>
+    <h1>WebGIS Portal - Tugas Akhir SIG</h1>
+    <p>Selamat datang di portal integrasi aplikasi Sistem Informasi Geografis (SIG) untuk UAS.</p>
+    
+    <h2>Daftar Aplikasi:</h2>
+    <ul>
+        <li><a href="/poverty-mapping/">Aplikasi Poverty Mapping (Project Utama)</a></li>
+        <li><a href="/tugas-spbu/">Aplikasi Tugas SPBU &amp; Tata Ruang</a></li>
+    </ul>
+
+    <h2>Akun Demo Penilaian:</h2>
+    <table border="1" cellpadding="8" cellspacing="0">
+        <thead>
+            <tr>
+                <th>Aplikasi</th>
+                <th>Role</th>
+                <th>Kredensial / Email</th>
+                <th>Password / Token</th>
+            </tr>
+        </thead>
+        <tbody>
+            <tr>
+                <td>Poverty Mapping</td>
+                <td>Admin</td>
+                <td>admin@example.com</td>
+                <td>password</td>
+            </tr>
+            <tr>
+                <td>Poverty Mapping</td>
+                <td>Manager</td>
+                <td>manager@example.com</td>
+                <td>password</td>
+            </tr>
+            <tr>
+                <td>Tugas SPBU</td>
+                <td>Admin SPBU</td>
+                <td>Input API Key di UI</td>
+                <td>8f3b7e6a9c4d2f1a6b8c9d0e4f7a1b2c</td>
+            </tr>
+        </tbody>
+    </table>
+
+    <br>
+    <hr>
+    <footer>
+        <p>&copy; 2026 Portal WebGIS UAS.</p>
+    </footer>
+</body>
+</html>
diff --git a/nginx.conf b/nginx.conf
new file mode 100644
index 0000000..f20905e
--- /dev/null
+++ b/nginx.conf
@@ -0,0 +1,41 @@
+server {
+    listen 80;
+    server_name localhost;
+
+    # 1. Landing Page Utama
+    location / {
+        root /usr/share/nginx/html;
+        index index.html;
+        try_files $uri $uri/ =404;
+    }
+
+    # 2. Route ke Poverty Mapping App
+    location /poverty-mapping/ {
+        proxy_pass http://poverty-mapping:80/;
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+
+        # Scope cookies ke subpath agar tidak tabrakan session PHP-nya
+        proxy_cookie_path / /poverty-mapping/;
+    }
+
+    # 3. Route ke Tugas SPBU App
+    location /tugas-spbu/ {
+        proxy_pass http://tugas-spbu:80/;
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+
+        proxy_cookie_path / /tugas-spbu/;
+    }
+
+    # Block access to hidden files (.env, .git, etc.)
+    location ~ /\. {
+        deny all;
+        access_log off;
+        log_not_found off;
+    }
+}
diff --git a/poverty-mapping/.env.example b/poverty-mapping/.env.example
new file mode 100644
index 0000000..045c892
--- /dev/null
+++ b/poverty-mapping/.env.example
@@ -0,0 +1,29 @@
+# Example environment file for WebGIS.
+# Copy this file to `.env`, then fill in real values. Do not commit `.env`.
+
+# Database
+DB_HOST=localhost
+DB_PORT=3306
+DB_USER=root
+DB_PASS=change_me
+DB_NAME=webgis
+
+# Mail
+SMTP_HOST=smtp.gmail.com
+SMTP_PORT=587
+SMTP_USER=your_gmail_address@gmail.com
+SMTP_PASS=your_gmail_app_password
+SMTP_ENCRYPTION=tls
+MAIL_FROM=your_gmail_address@gmail.com
+MAIL_FROM_NAME=WebGIS
+
+# Auth secrets
+# Generate secrets with: php -r "echo bin2hex(random_bytes(32)).PHP_EOL;"
+API_KEY=change_me_to_a_random_hex_string
+JWT_SECRET=change_me_to_a_random_hex_string
+INTERNAL_AUTH_KEY=change_me_to_a_random_hex_string
+BASIC_API_USER=webgis-api
+BASIC_API_PASS=change_me
+
+# Optional local debug helper for verification codes.
+DEBUG_MODE=0
diff --git a/poverty-mapping/.gitignore b/poverty-mapping/.gitignore
new file mode 100644
index 0000000..3b11003
--- /dev/null
+++ b/poverty-mapping/.gitignore
@@ -0,0 +1,9 @@
+/.env
+/.env.local
+/*.env
+/uploads/
+/src/uploads/
+# ignore common editor temp files
+*.swp
+*.swo
+.vscode/
\ No newline at end of file
diff --git a/poverty-mapping/Dockerfile b/poverty-mapping/Dockerfile
new file mode 100644
index 0000000..867d512
--- /dev/null
+++ b/poverty-mapping/Dockerfile
@@ -0,0 +1,15 @@
+FROM php:8.2-apache
+
+# Install mysqli extension for PHP
+RUN docker-php-ext-install mysqli && docker-php-ext-enable mysqli
+
+# Enable Apache rewrite module
+RUN a2enmod rewrite
+
+# Copy project files into container
+COPY . /var/www/html/
+
+# Set ownership and permissions for uploads directory
+RUN chown -R www-data:www-data /var/www/html && chmod -R 775 /var/www/html/uploads
+
+EXPOSE 80
diff --git a/poverty-mapping/README.md b/poverty-mapping/README.md
new file mode 100644
index 0000000..809a707
--- /dev/null
+++ b/poverty-mapping/README.md
@@ -0,0 +1,141 @@
+# WebGIS
+
+Aplikasi peta lokasi bantuan dan tempat ibadah berbasis PHP, MySQL, dan Leaflet.
+
+## Gambaran Singkat
+
+Guest bisa melihat peta dan daftar data. Pengelola mendaftar lewat formulir yang langsung memverifikasi email, lalu menunggu persetujuan admin. Setelah akun aktif, pengelola bisa menambah, mengubah, dan menghapus data miliknya sendiri. Admin bisa menyetujui atau menolak akun pengelola yang menunggu aktivasi.
+
+## Yang Dibutuhkan
+
+- PHP 8.1 atau lebih baru
+- MySQL atau MariaDB
+- Composer
+- Browser modern seperti Chrome, Edge, atau Firefox
+- Koneksi internet untuk Leaflet, tile peta, dan email SMTP
+
+## Langkah Instalasi
+
+Ikuti urutan ini dari awal jika Anda belum pernah menjalankan proyek ini.
+
+1. Salin folder proyek ke komputer Anda.
+2. Buka terminal di folder proyek.
+3. Pasang dependensi PHP:
+
+```bash
+composer install
+```
+
+4. Buat file konfigurasi lingkungan:
+
+```bash
+cp .env.example .env
+```
+
+5. Isi file `.env` dengan kredensial database, SMTP, dan secret aplikasi.
+6. Buat database MySQL, misalnya bernama `webgis`.
+7. Import skema database:
+
+```bash
+mysql -u root -p webgis < sql/migrations/001_init_schema.sql
+```
+
+8. Jalankan server PHP bawaan untuk uji lokal:
+
+```bash
+php -S localhost:8000 -t .
+```
+
+9. Buka aplikasi di browser:
+
+```text
+http://localhost:8000/index.html
+```
+
+Jika Anda memakai Apache atau Nginx, arahkan document root ke folder proyek ini dan sesuaikan URL aksesnya.
+
+## Isi File `.env`
+
+Contoh nilai yang perlu diisi:
+
+- `DB_HOST`, `DB_PORT`, `DB_USER`, `DB_PASS`, `DB_NAME`
+- `SMTP_HOST`, `SMTP_PORT`, `SMTP_USER`, `SMTP_PASS`, `SMTP_ENCRYPTION`
+- `MAIL_FROM`, `MAIL_FROM_NAME`
+- `API_KEY`, `JWT_SECRET`, `INTERNAL_AUTH_KEY`
+- `BASIC_API_USER`, `BASIC_API_PASS`
+- `DEBUG_MODE=0` untuk produksi atau `1` jika ingin menampilkan kode verifikasi saat pengembangan lokal
+
+## Cara Pakai
+
+### 1. Buka peta
+
+Setelah aplikasi terbuka, tampilan awal adalah peta. Guest tetap bisa melihat marker dan daftar data.
+
+### 2. Daftar pengelola
+
+Klik tombol masuk/daftar, lalu pilih daftar pengelola. Isi semua field yang diminta, kirim kode verifikasi ke email, masukkan kode 6 digit, lalu klik daftar.
+
+### 3. Login
+
+Gunakan email dan password yang sudah terdaftar. Setelah login, bar atas akan menampilkan nama pengguna.
+
+### 4. Kelola data
+
+Pengelola yang sudah aktif bisa menambah data baru dari peta, mengubah data miliknya sendiri, dan mengunggah foto bukti jika diperlukan. Admin bisa mengelola seluruh data.
+
+### 5. Lihat daftar data
+
+Klik tombol `Daftar Data` untuk melihat data dalam bentuk tabel. Guest hanya melihat data yang aman untuk publik.
+
+## Akun Admin Awal
+
+Seed database menyediakan akun admin awal:
+
+- Email: `admin@example.com`
+- Password: `Admin123!`
+
+Segera ganti kredensial ini jika Anda menjalankan aplikasi di lingkungan yang tidak pribadi.
+
+## Endpoint Utama
+
+- `src/api/auth/register.php` - daftar pengelola
+- `src/api/auth/send_verification_code.php` - kirim kode verifikasi email
+- `src/api/auth/login.php` - login
+- `src/api/auth/logout.php` - logout
+- `src/api/auth/me.php` - status pengguna aktif
+- `src/api/get_lokasi.php` - ambil data lokasi
+- `src/api/tambah_lokasi.php` - tambah lokasi baru
+- `src/api/update_lokasi.php` - ubah lokasi
+- `src/api/hapus_lokasi.php` - hapus lokasi
+- `src/api/upload_photo.php` - unggah foto lokasi
+- `src/api/admin/list_pending_managers.php` - daftar akun pengelola menunggu persetujuan
+- `src/api/admin/approve_user.php` - setujui akun
+- `src/api/admin/reject_user.php` - tolak akun
+
+## File Penting
+
+- [index.html](index.html) - frontend utama
+- [src/config/koneksi.php](src/config/koneksi.php) - koneksi database
+- [src/config/config.php](src/config/config.php) - secret dan autentikasi
+- [sql/migrations/001_init_schema.sql](sql/migrations/001_init_schema.sql) - skema database utama
+- [webgis.sql](webgis.sql) - dump SQL yang sejalan dengan skema utama
+- [.env.example](.env.example) - contoh konfigurasi environment
+
+## Perawatan Berkala
+
+Jika Anda ingin menandai bantuan yang sudah lewat masa berlakunya, jalankan:
+
+```bash
+php scripts/expire_assistance.php
+```
+
+## Troubleshooting
+
+- Jika database gagal terhubung, cek isi `.env` dan pastikan MySQL berjalan.
+- Jika email tidak terkirim, pastikan kredensial SMTP benar dan memakai app password, bukan password akun biasa.
+- Jika peta kosong, cek koneksi internet dan pastikan endpoint `get_lokasi.php` mengembalikan JSON.
+- Jika login berhasil tetapi data tidak muncul, buka DevTools browser dan cek respons API serta status token JWT.
+
+## Catatan Pengembangan
+
+Arsitektur aplikasi ini sengaja dibuat sederhana agar mudah dipelihara: frontend vanilla JavaScript, backend PHP, dan database MySQL. Bila Anda menambah kolom database baru, perbarui file migrasi, dump SQL, dan dokumentasi dalam satu perubahan agar semuanya tetap sinkron.
diff --git a/poverty-mapping/composer.json b/poverty-mapping/composer.json
new file mode 100644
index 0000000..5e867e9
--- /dev/null
+++ b/poverty-mapping/composer.json
@@ -0,0 +1,6 @@
+{
+    "require": {
+        "phpmailer/phpmailer": "^7.1",
+        "vlucas/phpdotenv": "^5.6"
+    }
+}
diff --git a/poverty-mapping/composer.lock b/poverty-mapping/composer.lock
new file mode 100644
index 0000000..1fdc4ce
--- /dev/null
+++ b/poverty-mapping/composer.lock
@@ -0,0 +1,574 @@
+{
+    "_readme": [
+        "This file locks the dependencies of your project to a known state",
+        "Read more about it at https://getcomposer.org/doc/01-basic-usage.md#installing-dependencies",
+        "This file is @generated automatically"
+    ],
+    "content-hash": "44f3cb809a0f474d00b34192bc993c72",
+    "packages": [
+        {
+            "name": "graham-campbell/result-type",
+            "version": "v1.1.4",
+            "source": {
+                "type": "git",
+                "url": "https://github.com/GrahamCampbell/Result-Type.git",
+                "reference": "e01f4a821471308ba86aa202fed6698b6b695e3b"
+            },
+            "dist": {
+                "type": "zip",
+                "url": "https://api.github.com/repos/GrahamCampbell/Result-Type/zipball/e01f4a821471308ba86aa202fed6698b6b695e3b",
+                "reference": "e01f4a821471308ba86aa202fed6698b6b695e3b",
+                "shasum": ""
+            },
+            "require": {
+                "php": "^7.2.5 || ^8.0",
+                "phpoption/phpoption": "^1.9.5"
+            },
+            "require-dev": {
+                "phpunit/phpunit": "^8.5.41 || ^9.6.22 || ^10.5.45 || ^11.5.7"
+            },
+            "type": "library",
+            "autoload": {
+                "psr-4": {
+                    "GrahamCampbell\\ResultType\\": "src/"
+                }
+            },
+            "notification-url": "https://packagist.org/downloads/",
+            "license": [
+                "MIT"
+            ],
+            "authors": [
+                {
+                    "name": "Graham Campbell",
+                    "email": "hello@gjcampbell.co.uk",
+                    "homepage": "https://github.com/GrahamCampbell"
+                }
+            ],
+            "description": "An Implementation Of The Result Type",
+            "keywords": [
+                "Graham Campbell",
+                "GrahamCampbell",
+                "Result Type",
+                "Result-Type",
+                "result"
+            ],
+            "support": {
+                "issues": "https://github.com/GrahamCampbell/Result-Type/issues",
+                "source": "https://github.com/GrahamCampbell/Result-Type/tree/v1.1.4"
+            },
+            "funding": [
+                {
+                    "url": "https://github.com/GrahamCampbell",
+                    "type": "github"
+                },
+                {
+                    "url": "https://tidelift.com/funding/github/packagist/graham-campbell/result-type",
+                    "type": "tidelift"
+                }
+            ],
+            "time": "2025-12-27T19:43:20+00:00"
+        },
+        {
+            "name": "phpmailer/phpmailer",
+            "version": "v7.1.1",
+            "source": {
+                "type": "git",
+                "url": "https://github.com/PHPMailer/PHPMailer.git",
+                "reference": "1bc1716a507a65e039d4ac9d9adebbbd0d346e15"
+            },
+            "dist": {
+                "type": "zip",
+                "url": "https://api.github.com/repos/PHPMailer/PHPMailer/zipball/1bc1716a507a65e039d4ac9d9adebbbd0d346e15",
+                "reference": "1bc1716a507a65e039d4ac9d9adebbbd0d346e15",
+                "shasum": ""
+            },
+            "require": {
+                "ext-ctype": "*",
+                "ext-filter": "*",
+                "ext-hash": "*",
+                "php": ">=5.5.0"
+            },
+            "require-dev": {
+                "dealerdirect/phpcodesniffer-composer-installer": "^1.0",
+                "doctrine/annotations": "^1.2.6 || ^1.13.3",
+                "php-parallel-lint/php-console-highlighter": "^1.0.0",
+                "php-parallel-lint/php-parallel-lint": "^1.3.2",
+                "phpcompatibility/php-compatibility": "^10.0.0@dev",
+                "squizlabs/php_codesniffer": "^3.13.5",
+                "yoast/phpunit-polyfills": "^1.0.4"
+            },
+            "suggest": {
+                "decomplexity/SendOauth2": "Adapter for using XOAUTH2 authentication",
+                "directorytree/imapengine": "For uploading sent messages via IMAP, see gmail example",
+                "ext-imap": "Needed to support advanced email address parsing according to RFC822",
+                "ext-mbstring": "Needed to send email in multibyte encoding charset or decode encoded addresses",
+                "ext-openssl": "Needed for secure SMTP sending and DKIM signing",
+                "greew/oauth2-azure-provider": "Needed for Microsoft Azure XOAUTH2 authentication",
+                "hayageek/oauth2-yahoo": "Needed for Yahoo XOAUTH2 authentication",
+                "league/oauth2-google": "Needed for Google XOAUTH2 authentication",
+                "psr/log": "For optional PSR-3 debug logging",
+                "symfony/polyfill-mbstring": "To support UTF-8 if the Mbstring PHP extension is not enabled (^1.2)",
+                "thenetworg/oauth2-azure": "Needed for Microsoft XOAUTH2 authentication"
+            },
+            "type": "library",
+            "autoload": {
+                "psr-4": {
+                    "PHPMailer\\PHPMailer\\": "src/"
+                }
+            },
+            "notification-url": "https://packagist.org/downloads/",
+            "license": [
+                "LGPL-2.1-only"
+            ],
+            "authors": [
+                {
+                    "name": "Marcus Bointon",
+                    "email": "phpmailer@synchromedia.co.uk"
+                },
+                {
+                    "name": "Jim Jagielski",
+                    "email": "jimjag@gmail.com"
+                },
+                {
+                    "name": "Andy Prevost",
+                    "email": "codeworxtech@users.sourceforge.net"
+                },
+                {
+                    "name": "Brent R. Matzelle"
+                }
+            ],
+            "description": "PHPMailer is a full-featured email creation and transfer class for PHP",
+            "support": {
+                "issues": "https://github.com/PHPMailer/PHPMailer/issues",
+                "source": "https://github.com/PHPMailer/PHPMailer/tree/v7.1.1"
+            },
+            "funding": [
+                {
+                    "url": "https://github.com/Synchro",
+                    "type": "github"
+                }
+            ],
+            "time": "2026-05-18T08:06:14+00:00"
+        },
+        {
+            "name": "phpoption/phpoption",
+            "version": "1.9.5",
+            "source": {
+                "type": "git",
+                "url": "https://github.com/schmittjoh/php-option.git",
+                "reference": "75365b91986c2405cf5e1e012c5595cd487a98be"
+            },
+            "dist": {
+                "type": "zip",
+                "url": "https://api.github.com/repos/schmittjoh/php-option/zipball/75365b91986c2405cf5e1e012c5595cd487a98be",
+                "reference": "75365b91986c2405cf5e1e012c5595cd487a98be",
+                "shasum": ""
+            },
+            "require": {
+                "php": "^7.2.5 || ^8.0"
+            },
+            "require-dev": {
+                "bamarni/composer-bin-plugin": "^1.8.2",
+                "phpunit/phpunit": "^8.5.44 || ^9.6.25 || ^10.5.53 || ^11.5.34"
+            },
+            "type": "library",
+            "extra": {
+                "bamarni-bin": {
+                    "bin-links": true,
+                    "forward-command": false
+                },
+                "branch-alias": {
+                    "dev-master": "1.9-dev"
+                }
+            },
+            "autoload": {
+                "psr-4": {
+                    "PhpOption\\": "src/PhpOption/"
+                }
+            },
+            "notification-url": "https://packagist.org/downloads/",
+            "license": [
+                "Apache-2.0"
+            ],
+            "authors": [
+                {
+                    "name": "Johannes M. Schmitt",
+                    "email": "schmittjoh@gmail.com",
+                    "homepage": "https://github.com/schmittjoh"
+                },
+                {
+                    "name": "Graham Campbell",
+                    "email": "hello@gjcampbell.co.uk",
+                    "homepage": "https://github.com/GrahamCampbell"
+                }
+            ],
+            "description": "Option Type for PHP",
+            "keywords": [
+                "language",
+                "option",
+                "php",
+                "type"
+            ],
+            "support": {
+                "issues": "https://github.com/schmittjoh/php-option/issues",
+                "source": "https://github.com/schmittjoh/php-option/tree/1.9.5"
+            },
+            "funding": [
+                {
+                    "url": "https://github.com/GrahamCampbell",
+                    "type": "github"
+                },
+                {
+                    "url": "https://tidelift.com/funding/github/packagist/phpoption/phpoption",
+                    "type": "tidelift"
+                }
+            ],
+            "time": "2025-12-27T19:41:33+00:00"
+        },
+        {
+            "name": "symfony/polyfill-ctype",
+            "version": "v1.37.0",
+            "source": {
+                "type": "git",
+                "url": "https://github.com/symfony/polyfill-ctype.git",
+                "reference": "141046a8f9477948ff284fa65be2095baafb94f2"
+            },
+            "dist": {
+                "type": "zip",
+                "url": "https://api.github.com/repos/symfony/polyfill-ctype/zipball/141046a8f9477948ff284fa65be2095baafb94f2",
+                "reference": "141046a8f9477948ff284fa65be2095baafb94f2",
+                "shasum": ""
+            },
+            "require": {
+                "php": ">=7.2"
+            },
+            "provide": {
+                "ext-ctype": "*"
+            },
+            "suggest": {
+                "ext-ctype": "For best performance"
+            },
+            "type": "library",
+            "extra": {
+                "thanks": {
+                    "url": "https://github.com/symfony/polyfill",
+                    "name": "symfony/polyfill"
+                }
+            },
+            "autoload": {
+                "files": [
+                    "bootstrap.php"
+                ],
+                "psr-4": {
+                    "Symfony\\Polyfill\\Ctype\\": ""
+                }
+            },
+            "notification-url": "https://packagist.org/downloads/",
+            "license": [
+                "MIT"
+            ],
+            "authors": [
+                {
+                    "name": "Gert de Pagter",
+                    "email": "BackEndTea@gmail.com"
+                },
+                {
+                    "name": "Symfony Community",
+                    "homepage": "https://symfony.com/contributors"
+                }
+            ],
+            "description": "Symfony polyfill for ctype functions",
+            "homepage": "https://symfony.com",
+            "keywords": [
+                "compatibility",
+                "ctype",
+                "polyfill",
+                "portable"
+            ],
+            "support": {
+                "source": "https://github.com/symfony/polyfill-ctype/tree/v1.37.0"
+            },
+            "funding": [
+                {
+                    "url": "https://symfony.com/sponsor",
+                    "type": "custom"
+                },
+                {
+                    "url": "https://github.com/fabpot",
+                    "type": "github"
+                },
+                {
+                    "url": "https://github.com/nicolas-grekas",
+                    "type": "github"
+                },
+                {
+                    "url": "https://tidelift.com/funding/github/packagist/symfony/symfony",
+                    "type": "tidelift"
+                }
+            ],
+            "time": "2026-04-10T16:19:22+00:00"
+        },
+        {
+            "name": "symfony/polyfill-mbstring",
+            "version": "v1.38.1",
+            "source": {
+                "type": "git",
+                "url": "https://github.com/symfony/polyfill-mbstring.git",
+                "reference": "14c5439eec4ccff081ac14eca2dc57feb2a66d92"
+            },
+            "dist": {
+                "type": "zip",
+                "url": "https://api.github.com/repos/symfony/polyfill-mbstring/zipball/14c5439eec4ccff081ac14eca2dc57feb2a66d92",
+                "reference": "14c5439eec4ccff081ac14eca2dc57feb2a66d92",
+                "shasum": ""
+            },
+            "require": {
+                "ext-iconv": "*",
+                "php": ">=7.2"
+            },
+            "provide": {
+                "ext-mbstring": "*"
+            },
+            "suggest": {
+                "ext-mbstring": "For best performance"
+            },
+            "type": "library",
+            "extra": {
+                "thanks": {
+                    "url": "https://github.com/symfony/polyfill",
+                    "name": "symfony/polyfill"
+                }
+            },
+            "autoload": {
+                "files": [
+                    "bootstrap.php"
+                ],
+                "psr-4": {
+                    "Symfony\\Polyfill\\Mbstring\\": ""
+                }
+            },
+            "notification-url": "https://packagist.org/downloads/",
+            "license": [
+                "MIT"
+            ],
+            "authors": [
+                {
+                    "name": "Nicolas Grekas",
+                    "email": "p@tchwork.com"
+                },
+                {
+                    "name": "Symfony Community",
+                    "homepage": "https://symfony.com/contributors"
+                }
+            ],
+            "description": "Symfony polyfill for the Mbstring extension",
+            "homepage": "https://symfony.com",
+            "keywords": [
+                "compatibility",
+                "mbstring",
+                "polyfill",
+                "portable",
+                "shim"
+            ],
+            "support": {
+                "source": "https://github.com/symfony/polyfill-mbstring/tree/v1.38.1"
+            },
+            "funding": [
+                {
+                    "url": "https://symfony.com/sponsor",
+                    "type": "custom"
+                },
+                {
+                    "url": "https://github.com/fabpot",
+                    "type": "github"
+                },
+                {
+                    "url": "https://github.com/nicolas-grekas",
+                    "type": "github"
+                },
+                {
+                    "url": "https://tidelift.com/funding/github/packagist/symfony/symfony",
+                    "type": "tidelift"
+                }
+            ],
+            "time": "2026-05-26T12:51:13+00:00"
+        },
+        {
+            "name": "symfony/polyfill-php80",
+            "version": "v1.37.0",
+            "source": {
+                "type": "git",
+                "url": "https://github.com/symfony/polyfill-php80.git",
+                "reference": "dfb55726c3a76ea3b6459fcfda1ec2d80a682411"
+            },
+            "dist": {
+                "type": "zip",
+                "url": "https://api.github.com/repos/symfony/polyfill-php80/zipball/dfb55726c3a76ea3b6459fcfda1ec2d80a682411",
+                "reference": "dfb55726c3a76ea3b6459fcfda1ec2d80a682411",
+                "shasum": ""
+            },
+            "require": {
+                "php": ">=7.2"
+            },
+            "type": "library",
+            "extra": {
+                "thanks": {
+                    "url": "https://github.com/symfony/polyfill",
+                    "name": "symfony/polyfill"
+                }
+            },
+            "autoload": {
+                "files": [
+                    "bootstrap.php"
+                ],
+                "psr-4": {
+                    "Symfony\\Polyfill\\Php80\\": ""
+                },
+                "classmap": [
+                    "Resources/stubs"
+                ]
+            },
+            "notification-url": "https://packagist.org/downloads/",
+            "license": [
+                "MIT"
+            ],
+            "authors": [
+                {
+                    "name": "Ion Bazan",
+                    "email": "ion.bazan@gmail.com"
+                },
+                {
+                    "name": "Nicolas Grekas",
+                    "email": "p@tchwork.com"
+                },
+                {
+                    "name": "Symfony Community",
+                    "homepage": "https://symfony.com/contributors"
+                }
+            ],
+            "description": "Symfony polyfill backporting some PHP 8.0+ features to lower PHP versions",
+            "homepage": "https://symfony.com",
+            "keywords": [
+                "compatibility",
+                "polyfill",
+                "portable",
+                "shim"
+            ],
+            "support": {
+                "source": "https://github.com/symfony/polyfill-php80/tree/v1.37.0"
+            },
+            "funding": [
+                {
+                    "url": "https://symfony.com/sponsor",
+                    "type": "custom"
+                },
+                {
+                    "url": "https://github.com/fabpot",
+                    "type": "github"
+                },
+                {
+                    "url": "https://github.com/nicolas-grekas",
+                    "type": "github"
+                },
+                {
+                    "url": "https://tidelift.com/funding/github/packagist/symfony/symfony",
+                    "type": "tidelift"
+                }
+            ],
+            "time": "2026-04-10T16:19:22+00:00"
+        },
+        {
+            "name": "vlucas/phpdotenv",
+            "version": "v5.6.3",
+            "source": {
+                "type": "git",
+                "url": "https://github.com/vlucas/phpdotenv.git",
+                "reference": "955e7815d677a3eaa7075231212f2110983adecc"
+            },
+            "dist": {
+                "type": "zip",
+                "url": "https://api.github.com/repos/vlucas/phpdotenv/zipball/955e7815d677a3eaa7075231212f2110983adecc",
+                "reference": "955e7815d677a3eaa7075231212f2110983adecc",
+                "shasum": ""
+            },
+            "require": {
+                "ext-pcre": "*",
+                "graham-campbell/result-type": "^1.1.4",
+                "php": "^7.2.5 || ^8.0",
+                "phpoption/phpoption": "^1.9.5",
+                "symfony/polyfill-ctype": "^1.26",
+                "symfony/polyfill-mbstring": "^1.26",
+                "symfony/polyfill-php80": "^1.26"
+            },
+            "require-dev": {
+                "bamarni/composer-bin-plugin": "^1.8.2",
+                "ext-filter": "*",
+                "phpunit/phpunit": "^8.5.34 || ^9.6.13 || ^10.4.2"
+            },
+            "suggest": {
+                "ext-filter": "Required to use the boolean validator."
+            },
+            "type": "library",
+            "extra": {
+                "bamarni-bin": {
+                    "bin-links": true,
+                    "forward-command": false
+                },
+                "branch-alias": {
+                    "dev-master": "5.6-dev"
+                }
+            },
+            "autoload": {
+                "psr-4": {
+                    "Dotenv\\": "src/"
+                }
+            },
+            "notification-url": "https://packagist.org/downloads/",
+            "license": [
+                "BSD-3-Clause"
+            ],
+            "authors": [
+                {
+                    "name": "Graham Campbell",
+                    "email": "hello@gjcampbell.co.uk",
+                    "homepage": "https://github.com/GrahamCampbell"
+                },
+                {
+                    "name": "Vance Lucas",
+                    "email": "vance@vancelucas.com",
+                    "homepage": "https://github.com/vlucas"
+                }
+            ],
+            "description": "Loads environment variables from `.env` to `getenv()`, `$_ENV` and `$_SERVER` automagically.",
+            "keywords": [
+                "dotenv",
+                "env",
+                "environment"
+            ],
+            "support": {
+                "issues": "https://github.com/vlucas/phpdotenv/issues",
+                "source": "https://github.com/vlucas/phpdotenv/tree/v5.6.3"
+            },
+            "funding": [
+                {
+                    "url": "https://github.com/GrahamCampbell",
+                    "type": "github"
+                },
+                {
+                    "url": "https://tidelift.com/funding/github/packagist/vlucas/phpdotenv",
+                    "type": "tidelift"
+                }
+            ],
+            "time": "2025-12-27T19:49:13+00:00"
+        }
+    ],
+    "packages-dev": [],
+    "aliases": [],
+    "minimum-stability": "stable",
+    "stability-flags": [],
+    "prefer-stable": false,
+    "prefer-lowest": false,
+    "platform": [],
+    "platform-dev": [],
+    "plugin-api-version": "2.2.0"
+}
diff --git a/poverty-mapping/docs/erd.md b/poverty-mapping/docs/erd.md
new file mode 100644
index 0000000..e7d75ee
--- /dev/null
+++ b/poverty-mapping/docs/erd.md
@@ -0,0 +1,76 @@
+# ERD Summary - WebGIS
+
+Dokumen ini merangkum skema database yang dipakai aplikasi pada `sql/migrations/001_init_schema.sql` dan `webgis.sql`.
+
+## Tabel Utama
+
+### `users`
+
+Menyimpan akun pengguna aplikasi.
+
+Kolom penting:
+- `email`
+- `password_hash`
+- `name`
+- `organization`
+- `org_address`
+- `org_phone`
+- `org_proof_path`
+- `role` dengan nilai `manager` atau `admin`
+- `status` dengan nilai `pending`, `active`, `rejected`, atau `pending_verification`
+- `email_verified`
+- field verifikasi email seperti `email_verification_token_hash`, `email_verification_expires`, dan timestamp terkait
+- `approved_by` dan `approved_at`
+
+### `lokasi`
+
+Menyimpan seluruh marker yang tampil di peta.
+
+Kolom penting:
+- `nama`
+- `no_telp`
+- `latitude` dan `longitude`
+- `alamat`
+- `jenis`
+- field khusus rumah seperti `nama_kk`, `rumah_status`, `members`, `monthly_income`
+- field bantuan seperti `assisted`, `last_assisted_at`, `assistance_notes`, `sumber_bantuan`, `bentuk_bantuan`
+- `photo_path`
+- `created_by`
+
+### `bantuan_detail`
+
+Menyimpan detail histori bantuan per lokasi.
+
+Kolom penting:
+- `lokasi_id`
+- `tanggal_bantuan`
+- `pemberi_bantuan`
+- `catatan`
+- `pemberi_lokasi_id`
+- `jumlah`
+
+### `migrations`
+
+Menyimpan catatan migration yang sudah dijalankan.
+
+## Relasi
+
+- `users.approved_by` mengarah ke `users.id`
+- `lokasi.created_by` mengarah ke `users.id`
+- `lokasi.sumber_bantuan` mengarah ke `lokasi.id`
+- `bantuan_detail.lokasi_id` mengarah ke `lokasi.id`
+- `bantuan_detail.pemberi_lokasi_id` mengarah ke `lokasi.id`
+
+## Alur Data
+
+1. Guest melihat data publik di peta dan tabel.
+2. Pengelola mendaftar, menerima kode verifikasi email, lalu akun dibuat dalam status menunggu persetujuan admin.
+3. Admin menyetujui akun pengelola.
+4. Pengelola yang disetujui dapat menambah dan mengubah data miliknya.
+5. Admin bisa mengelola seluruh data.
+
+## Catatan Implementasi
+
+- Database yang dipakai adalah MySQL/MariaDB.
+- Semua relasi foreign key dibuat agar data tetap konsisten.
+- Kolom bantuan dan verifikasi email disimpan langsung di tabel utama supaya alurnya sederhana untuk pengembangan berikutnya.
diff --git a/poverty-mapping/docs/openapi.js b/poverty-mapping/docs/openapi.js
new file mode 100644
index 0000000..f817b89
--- /dev/null
+++ b/poverty-mapping/docs/openapi.js
@@ -0,0 +1,156 @@
+window.webgisOpenApiSpec = {
+  openapi: '3.0.3',
+  info: {
+    title: 'WebGIS API',
+    version: '1.0.0',
+    description: 'API for public map data, manager registrations, and admin approvals.'
+  },
+  servers: [{ url: '.' }],
+  components: {
+    securitySchemes: {
+      bearerAuth: {
+        type: 'http',
+        scheme: 'bearer',
+        bearerFormat: 'JWT'
+      }
+    }
+  },
+  paths: {
+    '/src/api/auth/register.php': {
+      post: {
+        summary: 'Register manager account',
+        description: 'Public registration endpoint for manager accounts.',
+        requestBody: {
+          required: true,
+          content: {
+            'application/json': {
+              schema: {
+                type: 'object',
+                required: ['email', 'password'],
+                properties: {
+                  email: { type: 'string', format: 'email' },
+                  password: { type: 'string' },
+                  name: { type: 'string' },
+                  organization: { type: 'string' }
+                }
+              }
+            }
+          }
+        },
+        responses: { '200': { description: 'Registration successful, pending approval' } }
+      }
+    },
+    '/src/api/auth/login.php': {
+      post: {
+        summary: 'Login',
+        requestBody: {
+          required: true,
+          content: {
+            'application/json': {
+              schema: {
+                type: 'object',
+                required: ['email', 'password'],
+                properties: {
+                  email: { type: 'string', format: 'email' },
+                  password: { type: 'string' }
+                }
+              }
+            }
+          }
+        },
+        responses: { '200': { description: 'Login successful' } }
+      }
+    },
+    '/src/api/auth/logout.php': {
+      post: {
+        summary: 'Logout',
+        security: [{ bearerAuth: [] }],
+        responses: { '200': { description: 'Logout successful' } }
+      }
+    },
+    '/src/api/auth/me.php': {
+      get: {
+        summary: 'Current user session',
+        security: [{ bearerAuth: [] }],
+        responses: { '200': { description: 'Current auth state' } }
+      }
+    },
+    '/src/api/get_lokasi.php': {
+      get: {
+        summary: 'List locations',
+        description: 'Public read-only endpoint.',
+        responses: { '200': { description: 'Location list' } }
+      }
+    },
+    '/src/api/tambah_lokasi.php': {
+      post: {
+        summary: 'Create location',
+        description: 'Bearer JWT required. Managers can create records; admins can create all.',
+        security: [{ bearerAuth: [] }],
+        requestBody: {
+          required: true,
+          content: {
+            'application/json': {
+              schema: {
+                type: 'object',
+                properties: {
+                  nama: { type: 'string' },
+                  jenis: { type: 'string' },
+                  alamat: { type: 'string' },
+                  latitude: { type: 'number' },
+                  longitude: { type: 'number' }
+                }
+              }
+            }
+          }
+        },
+        responses: { '200': { description: 'Created' } }
+      }
+    },
+    '/src/api/update_lokasi.php': {
+      post: {
+        summary: 'Update location',
+        description: 'Bearer JWT required. Managers can edit only their own lokasi; admins can edit all.',
+        security: [{ bearerAuth: [] }],
+        responses: { '200': { description: 'Updated' } }
+      }
+    },
+    '/src/api/hapus_lokasi.php': {
+      post: {
+        summary: 'Delete location',
+        description: 'Bearer JWT required. Managers can delete only their own lokasi; admins can delete all.',
+        security: [{ bearerAuth: [] }],
+        responses: { '200': { description: 'Deleted' } }
+      }
+    },
+    '/src/api/upload_photo.php': {
+      post: {
+        summary: 'Upload location photo',
+        description: 'Bearer JWT required. Managers can upload only for their own lokasi.',
+        security: [{ bearerAuth: [] }],
+        responses: { '200': { description: 'Uploaded' } }
+      }
+    },
+    '/src/api/admin/list_pending_managers.php': {
+      get: {
+        summary: 'List pending manager registrations',
+        security: [{ bearerAuth: [] }],
+        responses: { '200': { description: 'Pending list' } }
+      }
+    },
+    '/src/api/admin/approve_user.php': {
+      post: {
+        summary: 'Approve pending user',
+        security: [{ bearerAuth: [] }],
+        responses: { '200': { description: 'Approved' } }
+      }
+    },
+    '/src/api/admin/reject_user.php': {
+      post: {
+        summary: 'Reject pending user',
+        security: [{ bearerAuth: [] }],
+        responses: { '200': { description: 'Rejected' } }
+      }
+    }
+  }
+};
\ No newline at end of file
diff --git a/poverty-mapping/docs/openapi.yaml b/poverty-mapping/docs/openapi.yaml
new file mode 100644
index 0000000..b3a42c2
--- /dev/null
+++ b/poverty-mapping/docs/openapi.yaml
@@ -0,0 +1,208 @@
+openapi: 3.0.3
+info:
+  title: WebGIS API
+  version: 1.0.0
+  description: API untuk autentikasi pengelola, data lokasi, unggah foto, dan persetujuan admin.
+servers:
+  - url: .
+components:
+  securitySchemes:
+    bearerAuth:
+      type: http
+      scheme: bearer
+      bearerFormat: JWT
+    basicAuth:
+      type: http
+      scheme: basic
+  schemas:
+    RegisterRequest:
+      type: object
+      required:
+        - email
+        - password
+        - name
+        - organization
+        - org_address
+        - org_phone
+        - verify_code
+      properties:
+        email:
+          type: string
+          format: email
+        password:
+          type: string
+        name:
+          type: string
+        organization:
+          type: string
+        org_address:
+          type: string
+        org_phone:
+          type: string
+        verify_code:
+          type: string
+          pattern: '^[0-9]{6}$'
+    LoginRequest:
+      type: object
+      required:
+        - email
+        - password
+      properties:
+        email:
+          type: string
+          format: email
+        password:
+          type: string
+    LocationRequest:
+      type: object
+      properties:
+        nama:
+          type: string
+        jenis:
+          type: string
+        no_telp:
+          type: string
+        alamat:
+          type: string
+        latitude:
+          type: number
+        longitude:
+          type: number
+        assisted:
+          type: integer
+          enum: [0, 1]
+paths:
+  /src/api/auth/register.php:
+    post:
+      summary: Daftar pengelola baru
+      requestBody:
+        required: true
+        content:
+          multipart/form-data:
+            schema:
+              $ref: '#/components/schemas/RegisterRequest'
+          application/json:
+            schema:
+              $ref: '#/components/schemas/RegisterRequest'
+      responses:
+        '200':
+          description: Pendaftaran berhasil dan akun menunggu persetujuan admin
+  /src/api/auth/send_verification_code.php:
+    post:
+      summary: Kirim kode verifikasi email
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              type: object
+              required: [email]
+              properties:
+                email:
+                  type: string
+                  format: email
+      responses:
+        '200':
+          description: Kode verifikasi terkirim
+  /src/api/auth/login.php:
+    post:
+      summary: Login pengguna
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              $ref: '#/components/schemas/LoginRequest'
+      responses:
+        '200':
+          description: Login berhasil
+  /src/api/auth/logout.php:
+    post:
+      summary: Logout pengguna
+      security:
+        - bearerAuth: []
+      responses:
+        '200':
+          description: Logout berhasil
+  /src/api/auth/me.php:
+    get:
+      summary: Ambil sesi pengguna aktif
+      security:
+        - bearerAuth: []
+      responses:
+        '200':
+          description: Status autentikasi saat ini
+  /src/api/get_client_config.php:
+    get:
+      summary: Konfigurasi klien yang aman untuk frontend
+      responses:
+        '200':
+          description: Data konfigurasi klien
+  /src/api/get_lokasi.php:
+    get:
+      summary: Ambil daftar lokasi
+      responses:
+        '200':
+          description: Daftar lokasi
+  /src/api/tambah_lokasi.php:
+    post:
+      summary: Tambah lokasi baru
+      security:
+        - bearerAuth: []
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              $ref: '#/components/schemas/LocationRequest'
+      responses:
+        '200':
+          description: Data berhasil dibuat
+  /src/api/update_lokasi.php:
+    post:
+      summary: Perbarui lokasi
+      security:
+        - bearerAuth: []
+      responses:
+        '200':
+          description: Data berhasil diperbarui
+  /src/api/hapus_lokasi.php:
+    post:
+      summary: Hapus lokasi
+      security:
+        - bearerAuth: []
+      responses:
+        '200':
+          description: Data berhasil dihapus
+  /src/api/upload_photo.php:
+    post:
+      summary: Unggah foto lokasi
+      security:
+        - bearerAuth: []
+      responses:
+        '200':
+          description: Foto berhasil diunggah
+  /src/api/admin/list_pending_managers.php:
+    get:
+      summary: Daftar pengelola menunggu persetujuan
+      security:
+        - bearerAuth: []
+      responses:
+        '200':
+          description: Daftar akun pending
+  /src/api/admin/approve_user.php:
+    post:
+      summary: Setujui akun pengelola
+      security:
+        - bearerAuth: []
+      responses:
+        '200':
+          description: Akun disetujui
+  /src/api/admin/reject_user.php:
+    post:
+      summary: Tolak akun pengelola
+      security:
+        - bearerAuth: []
+      responses:
+        '200':
+          description: Akun ditolak
diff --git a/poverty-mapping/docs/swagger.html b/poverty-mapping/docs/swagger.html
new file mode 100644
index 0000000..8929331
--- /dev/null
+++ b/poverty-mapping/docs/swagger.html
@@ -0,0 +1,37 @@
+<!DOCTYPE html>
+<html>
+<head>
+  <meta charset="utf-8">
+  <meta name="viewport" content="width=device-width, initial-scale=1">
+  <title>WebGIS API Docs</title>
+  <link rel="stylesheet" href="https://unpkg.com/swagger-ui-dist@5/swagger-ui.css">
+  <style>
+    body{margin:0;background:#0f172a;font-family:system-ui,-apple-system,Segoe UI,Roboto,Arial,sans-serif}
+    .topbar{padding:18px 20px;background:linear-gradient(135deg,#0f172a,#1e293b);color:#fff;border-bottom:1px solid rgba(255,255,255,0.08)}
+    .topbar h1{margin:0;font-size:20px}
+    .topbar p{margin:6px 0 0;color:#cbd5e1;font-size:13px}
+    #swagger-ui{background:#fff}
+  </style>
+</head>
+<body>
+  <div class="topbar">
+    <h1>WebGIS API Docs</h1>
+    <p>OpenAPI documentation for auth, public map data, manager, and admin endpoints.</p>
+  </div>
+  <div id="swagger-ui"></div>
+  <script src="https://unpkg.com/swagger-ui-dist@5/swagger-ui-bundle.js"></script>
+  <script src="openapi.js"></script>
+  <script>
+    window.onload = function() {
+      SwaggerUIBundle({
+        spec: window.webgisOpenApiSpec,
+        dom_id: '#swagger-ui',
+        deepLinking: true,
+        displayRequestDuration: true,
+        presets: [SwaggerUIBundle.presets.apis],
+        layout: 'BaseLayout'
+      });
+    };
+  </script>
+</body>
+</html>
diff --git a/poverty-mapping/index.html b/poverty-mapping/index.html
new file mode 100644
index 0000000..97d3aba
--- /dev/null
+++ b/poverty-mapping/index.html
@@ -0,0 +1,2336 @@
+<!DOCTYPE html>
+<html>
+<head>
+    <meta charset="utf-8">
+    <title>WebGIS</title>
+    <meta name="viewport" content="width=device-width,initial-scale=1">
+    <link rel="stylesheet" href="https://unpkg.com/leaflet@1.9.4/dist/leaflet.css"/>
+    <link rel="stylesheet" href="https://cdnjs.cloudflare.com/ajax/libs/leaflet.draw/1.0.4/leaflet.draw.css"/>
+    <style>
+        html,body{height:100%;margin:0;padding:0;overflow:hidden}
+        body{font-family:Inter,ui-sans-serif,system-ui,-apple-system,'Segoe UI',Roboto,'Helvetica Neue',Arial;line-height:1.35;color:#1f2937;background:#f8fafc}
+        #app-shell{display:flex;flex-direction:column;height:100%;width:100%}
+        #map-wrap{flex:1;min-width:0;position:relative}
+        #map{height:100%;width:100%}
+        #data-panel{background:linear-gradient(180deg,#ffffff 0%,#f8fafc 100%);display:flex;flex-direction:column;overflow:hidden;flex:1}
+        #data-panel-header-mini{padding:18px 18px 14px;border-bottom:1px solid #e5e7eb;background:linear-gradient(180deg,#ffffff 0%,#f9fafb 100%)}
+        .data-panel-header{display:none}
+        .data-panel-kicker{font-size:12px;letter-spacing:.08em;text-transform:uppercase;color:#64748b;font-weight:700}
+        .data-panel-title{margin:4px 0 0;font-size:20px;line-height:1.1;color:#0f172a}
+        .data-panel-subtitle{margin:8px 0 0;color:#64748b;font-size:13px}
+        .data-view-toggle{display:inline-flex;gap:6px;margin-top:14px;padding:4px;background:#eef2ff;border-radius:14px}
+        .data-view-toggle button{border:0;background:transparent;color:#334155;padding:9px 12px;border-radius:10px;font-weight:600;cursor:pointer;transition:background .15s,color .15s,box-shadow .15s}
+        .data-view-toggle button.active{background:#1e40af;color:#fff;box-shadow:0 2px 8px rgba(30,64,175,0.3)}
+        .data-panel-summary{padding:12px 18px 0;color:#475569;font-size:13px}
+        .data-table-wrap{flex:1;overflow:auto;padding:14px 18px 0}
+        .data-table{width:100%;border-collapse:separate;border-spacing:0 10px;table-layout:fixed}
+        .data-table thead th{font-size:12px;text-transform:uppercase;letter-spacing:.05em;color:#64748b;text-align:center;padding:0 8px;vertical-align:middle}
+        .data-table tbody tr{background:#fff;box-shadow:0 8px 24px rgba(15,23,42,0.06);border-radius:14px}
+        .data-table tbody td{padding:12px 8px;vertical-align:middle;text-align:center;border-top:1px solid rgba(255,255,255,0);word-wrap:break-word;overflow-wrap:anywhere}
+        .data-table tbody td:first-child{border-top-left-radius:14px;border-bottom-left-radius:14px;width:64px}
+        .data-table tbody td:last-child{border-top-right-radius:14px;border-bottom-right-radius:14px;width:118px}
+        .data-table thead th:first-child{width:64px}
+        .data-table thead th:last-child{width:118px}
+        .data-table thead th:nth-child(4), .data-table tbody td:nth-child(4){width:90px}
+        .data-table thead th:nth-child(5), .data-table tbody td:nth-child(5){width:130px}
+        .data-table tbody td .data-muted, .data-table tbody td .data-name, .data-table tbody td .data-pill, .data-table tbody td .data-badge{display:inline-flex;justify-content:center;align-items:center;max-width:100%}
+        .data-table tbody td .data-name, .data-table tbody td .data-muted{line-height:1.25}
+        .data-index{display:inline-flex;align-items:center;justify-content:center;min-width:28px;height:28px;border-radius:999px;background:#e2e8f0;color:#0f172a;font-weight:700;font-size:13px}
+        .data-name{font-weight:700;color:#0f172a}
+        .data-address{color:#475569;font-size:13px;margin-top:2px}
+        .data-muted{color:#64748b;font-size:13px}
+        .data-badge{display:inline-flex;align-items:center;gap:6px;padding:6px 10px;border-radius:999px;font-size:12px;font-weight:700;white-space:nowrap}
+        .data-badge.is-green{background:#dcfce7;color:#166534}
+        .data-badge.is-yellow{background:#fef3c7;color:#92400e}
+        .data-badge.is-blue{background:#dbeafe;color:#1d4ed8}
+        .data-pill{display:inline-flex;align-items:center;gap:6px;padding:6px 10px;border-radius:999px;background:#f1f5f9;color:#0f172a;font-size:12px;font-weight:600;margin-right:6px;margin-bottom:6px}
+        .data-actions{display:flex;gap:8px;justify-content:flex-end;flex-wrap:nowrap;white-space:nowrap}
+        .data-action-btn{display:inline-flex;align-items:center;justify-content:center;width:32px;height:32px;border-radius:10px;border:1px solid #e2e8f0;background:#fff;color:#0f172a;cursor:pointer;transition:transform .12s,box-shadow .12s,background .12s}
+        .data-action-btn:hover{transform:translateY(-1px);box-shadow:0 10px 18px rgba(15,23,42,0.08);background:#f8fafc}
+        .data-action-btn svg{width:16px;height:16px;display:block}
+        .data-empty{padding:26px 18px;color:#64748b;font-size:14px;text-align:center}
+        .data-pagination{padding:14px 18px 18px;border-top:1px solid #e5e7eb;background:linear-gradient(180deg,rgba(255,255,255,0.65),#fff)}
+        .data-pagination-inner{display:flex;align-items:center;justify-content:space-between;gap:10px;flex-wrap:wrap}
+        .data-pagination-info{color:#64748b;font-size:13px}
+        .data-pagination-controls{display:flex;gap:6px;flex-wrap:wrap}
+        .data-page-btn{border:1px solid #dbe3ef;background:#fff;color:#0f172a;padding:7px 11px;border-radius:10px;cursor:pointer;font-weight:600}
+        .data-page-btn.active{background:#0f172a;color:#fff;border-color:#0f172a}
+        .data-page-btn:disabled{opacity:.45;cursor:not-allowed}
+        .data-page-ellipsis{display:inline-flex;align-items:center;padding:0 6px;color:#64748b}
+        .data-link{color:#1d4ed8;text-decoration:none;font-weight:600}
+        .data-link:hover{text-decoration:underline}
+        .table-chip-list{display:flex;flex-wrap:wrap}
+        @media (max-width: 980px){
+            body{overflow:auto}
+        }
+        /* Form element styling */
+        .modal-content{background:#fff;padding:18px;border-radius:10px;min-width:340px;max-width:640px;box-shadow:0 10px 30px rgba(15,23,42,0.12)}
+        .modal-content label{display:block;margin-top:10px;color:#111827}
+        .auth-field{margin-bottom:16px}
+        .auth-field label{display:block;color:#111827;font-weight:500;font-size:14px;margin-bottom:8px}
+        .auth-field input[type="text"],
+        .auth-field input[type="email"],
+        .auth-field input[type="password"]{width:100%;padding:10px 12px;border-radius:8px;border:1px solid #e5e7eb;background:#fff;box-sizing:border-box;margin:0 !important}
+        .modal-content input[type="text"], .modal-content input[type="number"], .modal-content input[type="date"], .modal-content input[type="search"], .modal-content select{width:100%;padding:8px 10px;border-radius:8px;border:1px solid #e5e7eb;background:#fff;margin-top:6px;box-sizing:border-box}
+        .modal-content textarea{width:100%;padding:8px 10px;border-radius:8px;border:1px solid #e5e7eb;background:#fff;margin-top:6px;box-sizing:border-box;min-height:84px}
+        .modal-content input:disabled, .modal-content select:disabled{background:#f3f4f6;color:#9ca3af;cursor:not-allowed;opacity:1}
+        .modal-content input[type="file"]{margin-top:6px}
+        .assistance-combobox{position:relative}
+        .assistance-combobox .assist-source-input{width:100%;padding-right:34px;appearance:none;-webkit-appearance:none;-moz-appearance:none;cursor:text;color:#111827;font-weight:400}
+        .assistance-combobox .assist-source-toggle{position:absolute;right:10px;top:calc(50% + 10px);transform:translateY(-50%);width:18px;height:18px;border:0;background:transparent;color:#111827;cursor:pointer;padding:0;display:flex;align-items:center;justify-content:center;pointer-events:auto}
+        .assistance-fields.is-disabled .assist-source-toggle{color:#9ca3af}
+        .assistance-fields.is-enabled .assist-source-toggle{color:#111827}
+        .assistance-combobox .assist-source-toggle::before{content:'';display:block;width:8px;height:8px;border-right:3px solid currentColor;border-bottom:3px solid currentColor;transform:rotate(45deg);margin-top:-2px}
+        .assistance-combobox .assist-source-panel{position:absolute;left:0;right:0;top:100%;margin-top:6px;background:#fff;border:1px solid #d1d5db;border-radius:10px;box-shadow:0 14px 30px rgba(15,23,42,0.14);z-index:22000;max-height:260px;overflow:auto;display:none}
+        .assistance-combobox .assist-source-panel.show{display:block}
+        .assistance-combobox .assist-source-item{padding:9px 10px;cursor:pointer;font-size:13px;line-height:1.35;border-bottom:1px solid #f3f4f6}
+        .assistance-combobox .assist-source-item:last-child{border-bottom:0}
+        .assistance-combobox .assist-source-item:hover,.assistance-combobox .assist-source-item.active{background:#f8fafc}
+        .assistance-combobox .assist-source-empty{padding:10px;color:#6b7280;font-size:13px}
+        .assistance-fields.is-disabled .assist-source-input::placeholder{color:#9ca3af;opacity:1}
+        .assistance-fields.is-disabled .assist-source-input::-webkit-input-placeholder{color:#9ca3af;opacity:1}
+        .assistance-fields.is-disabled .assist-source-input::-moz-placeholder{color:#9ca3af;opacity:1}
+        .assistance-fields.is-disabled .assist-source-input:-ms-input-placeholder{color:#9ca3af;opacity:1}
+        .assistance-fields.is-enabled .assist-source-input{color:#111827;font-weight:400}
+        .assistance-fields.is-enabled .assist-source-input::placeholder{color:#111827 !important;opacity:1;font-weight:400}
+        .assistance-fields.is-enabled .assist-source-input::-webkit-input-placeholder{color:#111827 !important;opacity:1;font-weight:400}
+        .assistance-fields.is-enabled .assist-source-input::-moz-placeholder{color:#111827 !important;opacity:1;font-weight:400}
+        .assistance-fields.is-enabled .assist-source-input:-ms-input-placeholder{color:#111827 !important;opacity:1;font-weight:400}
+        .modal-content .label-title{display:inline-flex; align-items:center; gap:4px}
+        .modal-content .required-star{color:#dc2626; font-weight:700; line-height:1}
+        .layer-legend{display:inline-flex;align-items:center;gap:6px;line-height:1.2}
+        .layer-legend .legend-marker{display:inline-flex;align-items:flex-end;justify-content:center;width:16px;height:22px;flex:0 0 16px}
+        .layer-legend .legend-marker svg{display:block;width:16px;height:22px}
+        .layer-legend .legend-text{white-space:nowrap}
+        .btn-primary{background:#2563eb;color:#fff;padding:8px 12px;border:0;border-radius:8px}
+        .btn-secondary{background:#f3f4f6;color:#111;padding:8px 12px;border:0;border-radius:8px}
+        .modal-actions{margin-top:14px;text-align:right}
+        /* file name display next to file input */
+        .file-name{display:inline-block;margin-left:8px;color:#374151;font-size:13px}
+        /* Popup buttons style */
+        .leaflet-popup-content button{background:#111827;color:#fff;border:0;padding:6px 8px;border-radius:6px;margin-right:6px;cursor:pointer}
+        .leaflet-popup-content button:hover{opacity:0.95}
+        /* Debug overlay subtle */
+        #debug-overlay{position:absolute;left:10px;bottom:10px;z-index:12000;background:rgba(255,255,255,0.95);padding:8px;border-radius:8px;font-size:13px;color:#111;border:1px solid rgba(0,0,0,0.06);display:none}
+        /* Prevent double-click text selection on layer control while keeping it clickable */
+        .leaflet-control-layers label{ -webkit-user-select:none; -moz-user-select:none; -ms-user-select:none; user-select:none; cursor:pointer }
+        /* Toast messages */
+        #toast-container{position:fixed;right:16px;bottom:16px;z-index:14000;display:flex;flex-direction:column;gap:8px;align-items:flex-end}
+        .toast{background:#333;color:#fff;padding:10px 14px;border-radius:8px;box-shadow:0 6px 20px rgba(0,0,0,0.3);max-width:320px;font-size:13px;opacity:0;transform:translateY(-6px);transition:opacity .18s,transform .18s}
+        .toast.show{opacity:1;transform:translateY(0)}
+        .toast.error{background:#d32f2f}
+        .toast.success{background:#2e7d32}
+        .modal {position:fixed;left:0;top:0;right:0;bottom:0;background:rgba(0,0,0,0.45);display:flex;align-items:center;justify-content:center;z-index:9999}
+        .modal.hidden{display:none}
+        .modal-content{background:#fff;padding:18px;border-radius:10px;min-width:320px;max-width:520px;width:420px;max-height:80vh;overflow:auto}
+        .modal-content label{display:block;margin-top:8px}
+        .modal-actions{margin-top:12px;text-align:right}
+        .btn-primary{background:#1976d2;color:#fff;padding:8px 12px;border:0;border-radius:6px}
+        .btn-secondary{background:#eee;padding:8px 12px;border:0;border-radius:6px}
+        .btn-destructive{background:#d32f2f;color:#fff;padding:8px 12px;border:0;border-radius:6px}
+        .btn-destructive:hover{opacity:0.95}
+        .leaflet-popup-content{margin:14px 16px}
+        .leaflet-popup-content-wrapper{border-radius:16px}
+        .leaflet-popup-content .location-popup{min-width:380px;max-width:520px}
+        .leaflet-popup-content .location-popup-title{font-size:16px;font-weight:700;color:#0f172a;margin-bottom:6px;line-height:1.25}
+        .leaflet-popup-content .location-popup-meta{font-size:13px;color:#475569;margin-top:6px}
+        .leaflet-popup-content .location-popup-photo{margin-top:8px}
+        .leaflet-popup-content .location-popup-actions{display:flex;align-items:center;gap:8px;flex-wrap:nowrap;white-space:nowrap;margin-top:12px;justify-content:flex-start}
+        .leaflet-popup-content .location-popup-actions button{margin-right:0}
+        #masjid-radius-control{position:absolute;left:10px;bottom:20px;background:#fff;padding:8px;border-radius:6px;box-shadow:0 2px 6px rgba(0,0,0,0.2);z-index:10000}
+        /* Filter panel */
+        /* filter panel removed (moved into masjid control) */
+        /* nicer masjid control */
+        #masjid-radius-control{width:300px;padding:12px;border-radius:10px;border:1px solid rgba(0,0,0,0.06);box-shadow:0 12px 40px rgba(2,6,23,0.12);background:linear-gradient(180deg,#ffffff,#fbfbfe)}
+        #masjid-radius-control .mc-title{font-weight:700;margin-bottom:6px;color:#0f172a}
+        #masjid-radius-control .mc-address{font-size:13px;color:#475569;margin-bottom:8px}
+        #masjid-radius-control .mc-controls{display:flex;align-items:center;gap:8px}
+        #masjid-radius-control .mc-radius{flex:1}
+        #masjid-radius-control .mc-actions{display:flex;justify-content:flex-end;gap:8px;margin-top:10px}
+        #masjid-radius-control .mc-actions button{background:#eef2ff;color:#0f172a;border:0;padding:6px 8px;border-radius:8px;cursor:pointer}
+        #masjid-radius-control .mc-actions button.destructive{background:#fee2e2}
+    </style>
+</head>
+<body>
+<div id="modal" class="modal hidden" role="dialog" aria-hidden="true">
+    <div class="modal-content">
+        <h3 id="modal-title">Form</h3>
+        <form id="modal-form">
+            <div id="modal-fields"></div>
+            <div class="modal-actions">
+                <button type="button" id="modal-cancel" class="btn-secondary">Batal</button>
+                <button type="submit" id="modal-submit" class="btn-primary">Simpan</button>
+            </div>
+        </form>
+    </div>
+</div>
+
+<div id="app-shell">
+    <div id="top-right-controls" style="position:fixed;right:12px;top:12px;z-index:11500;display:flex;flex-direction:column;align-items:flex-end;gap:8px;max-width:calc(100vw - 24px)">
+        <div id="auth-bar" style="display:flex;gap:8px;align-items:center;flex-wrap:wrap;justify-content:flex-end;max-width:calc(100vw - 24px)">
+            <span id="auth-user-label" style="font-size:13px;color:#0f172a;background:#fff;padding:8px 10px;border-radius:999px;box-shadow:0 6px 18px rgba(15,23,42,0.08)">Tamu</span>
+            <button type="button" id="auth-login-btn" style="background:#0f172a;color:#fff;border:0;padding:8px 12px;border-radius:8px;cursor:pointer;font-weight:600">Masuk</button>
+            <button type="button" id="auth-logout-btn" style="display:none;background:#fee2e2;color:#991b1b;border:0;padding:8px 12px;border-radius:8px;cursor:pointer;font-weight:600">Keluar</button>
+            <button type="button" id="admin-dashboard-btn" style="display:none;background:#1d4ed8;color:#fff;border:0;padding:8px 12px;border-radius:8px;cursor:pointer;font-weight:600">Admin</button>
+        </div>
+    </div>
+    <div style="position:fixed;left:50%;top:10px;transform:translateX(-50%);z-index:11000;display:flex;gap:8px">
+        <button id="view-map-btn" onclick="switchView('map')" style="background:#1e40af;color:#fff;border:0;padding:10px 16px;border-radius:8px;cursor:pointer;font-weight:600;font-size:15px;box-shadow:0 2px 8px rgba(30,64,175,0.3)">📍 Peta</button>
+        <button id="view-data-btn" onclick="switchView('data')" style="background:#e5e7eb;color:#374151;border:0;padding:10px 16px;border-radius:8px;cursor:pointer;font-weight:600;font-size:15px">📋 Daftar Data</button>
+    </div>
+    <main id="map-wrap" style="display:flex;flex:1;min-width:0;position:relative">
+        <div id="map" style="flex:1"></div>
+    </main>
+    <div id="data-panel" style="display:none;background:linear-gradient(180deg,#ffffff 0%,#f8fafc 100%);flex:1;min-width:0;flex-direction:column;overflow:hidden">
+        <div id="data-panel-header-mini" style="padding:18px 18px 14px;border-bottom:1px solid #e5e7eb;background:linear-gradient(180deg,#ffffff 0%,#f9fafb 100%)">
+            <div class="data-panel-kicker">📋 Data</div>
+            <div class="data-panel-title">Daftar Lokasi</div>
+            <div class="data-panel-subtitle">Pilih kategori untuk melihat data</div>
+            <div class="data-view-toggle">
+                <button type="button" id="data-view-worship" class="active" onclick="setDataPanelView('worship')">📍 Tempat Ibadah</button>
+                <button type="button" id="data-view-house" onclick="setDataPanelView('house')">🏠 Rumah</button>
+            </div>
+        </div>
+        <div id="data-panel-summary" style="padding:12px 18px 0;color:#475569;font-size:13px"></div>
+        <div class="data-table-wrap">
+            <table class="data-table">
+                <thead id="data-table-head"></thead>
+                <tbody id="data-table-body"></tbody>
+            </table>
+        </div>
+        <div class="data-pagination" style="padding:14px 18px 18px;border-top:1px solid #e5e7eb;background:linear-gradient(180deg,rgba(255,255,255,0.65),#fff)">
+            <div class="data-pagination-inner" style="display:flex;align-items:center;justify-content:space-between;gap:10px;flex-wrap:wrap">
+                <div id="data-pagination-info" class="data-pagination-info" style="color:#64748b;font-size:13px"></div>
+                <div id="data-pagination-controls" class="data-pagination-controls" style="display:flex;gap:6px;flex-wrap:wrap"></div>
+            </div>
+        </div>
+    </div>
+</div>
+<div id="auth-modal" class="modal hidden" role="dialog" aria-hidden="true">
+    <div class="modal-content">
+        <h3 id="auth-modal-title">Masuk</h3>
+        <form id="auth-modal-form">
+            <div id="auth-modal-fields"></div>
+            <div id="auth-modal-switch" style="margin-top:12px;font-size:13px;color:#475569;display:flex;align-items:center;justify-content:space-between;gap:10px;flex-wrap:wrap"></div>
+            <div class="modal-actions">
+                <button type="button" id="auth-modal-cancel" class="btn-secondary">Batal</button>
+                <button type="submit" id="auth-modal-submit" class="btn-primary">Kirim</button>
+            </div>
+        </form>
+    </div>
+</div>
+
+<div id="admin-modal" class="modal hidden" role="dialog" aria-hidden="true">
+    <div class="modal-content" style="max-width:760px;width:min(760px,92vw)">
+        <h3>Admin Dashboard</h3>
+        <div style="font-size:13px;color:#475569;margin-bottom:10px">Persetujuan akun pengelola yang menunggu aktivasi.</div>
+        <div id="admin-pending-list" style="max-height:60vh;overflow:auto"></div>
+        <div class="modal-actions">
+            <button type="button" id="admin-modal-close" class="btn-secondary">Tutup</button>
+        </div>
+    </div>
+</div>
+
+<div id="admin-detail-modal" class="modal hidden" role="dialog" aria-hidden="true">
+    <div class="modal-content" style="max-width:860px;width:min(860px,94vw)">
+        <h3 id="admin-detail-title">Detail Pendaftaran</h3>
+        <div id="admin-detail-body" style="max-height:70vh;overflow:auto;font-size:14px;color:#334155"></div>
+        <div class="modal-actions">
+            <button type="button" id="admin-detail-close" class="btn-secondary">Tutup</button>
+        </div>
+    </div>
+</div>
+
+<!-- Email Verification Modal -->
+
+<!-- Image viewer modal (separate from form modal) -->
+<div id="image-viewer" style="display:none;position:fixed;left:0;top:0;right:0;bottom:0;z-index:13000;background:rgba(0,0,0,0.85);align-items:center;justify-content:center;padding:16px;box-sizing:border-box"> 
+    <div style="position:relative;width:min(92vw,960px);max-width:960px;max-height:88vh;margin:auto;display:flex;align-items:center;justify-content:center;overflow:hidden;border-radius:12px;background:rgba(15,23,42,0.1)"> 
+        <button id="image-viewer-close" style="position:absolute;right:12px;top:12px;background:#fff;border-radius:20px;border:0;padding:6px 8px;cursor:pointer;z-index:13001;box-shadow:0 2px 8px rgba(0,0,0,0.2)">✕</button>
+        <img id="image-viewer-img" src="" style="display:block;max-width:100%;max-height:88vh;width:auto;height:auto;object-fit:contain;border-radius:10px;box-shadow:0 6px 30px rgba(0,0,0,0.6)">
+    </div>
+</div>
+
+<!-- Toast container for non-blocking messages -->
+<div id="toast-container"></div>
+
+<script src="https://unpkg.com/leaflet@1.9.4/dist/leaflet.js"></script>
+<script src="https://cdnjs.cloudflare.com/ajax/libs/leaflet.draw/1.0.4/leaflet.draw.js"></script>
+
+<script>
+window.authToken = localStorage.getItem('webgis_jwt') || '';
+try{
+    window.currentUser = JSON.parse(localStorage.getItem('webgis_user') || 'null');
+}catch(e){
+    window.currentUser = null;
+}
+
+function syncAuthToken(token){
+    try{
+        window.authToken = token || '';
+        if(window.authToken){ localStorage.setItem('webgis_jwt', window.authToken); }
+        else { localStorage.removeItem('webgis_jwt'); }
+    }catch(e){}
+}
+
+function syncCurrentUser(user){
+    try{
+        window.currentUser = user || null;
+        if(window.currentUser){ localStorage.setItem('webgis_user', JSON.stringify(window.currentUser)); }
+        else { localStorage.removeItem('webgis_user'); }
+    }catch(e){
+        window.currentUser = user || null;
+    }
+}
+
+function buildHeaders(contentType = 'application/json'){
+    const headers = {};
+    if(contentType) headers['Content-Type'] = contentType;
+    if(window.authToken){ headers['Authorization'] = 'Bearer ' + window.authToken; }
+    return headers;
+}
+
+// increase allowed zoom: tiles provided by OSM go up to ~19, allow higher zoom levels for closer inspection
+// make mouse-wheel zoom less aggressive so one scroll notch feels closer to one +/- button step
+const map = L.map('map', {
+    maxZoom: 22,
+    minZoom: 2,
+    zoomControl: true,
+    zoomDelta: 1,
+    wheelPxPerZoomLevel: 240,
+    wheelDebounceTime: 80
+}).setView([-0.0552, 109.35], 13);
+L.tileLayer('https://tile.openstreetmap.org/{z}/{x}/{y}.png', { maxNativeZoom: 19, maxZoom: 22, attribution: '&copy; OpenStreetMap contributors' }).addTo(map);
+
+const rumahBelumDibantuGroup = L.layerGroup().addTo(map);
+const rumahSudahDibantuGroup = L.layerGroup().addTo(map);
+const masjidGroup = L.layerGroup().addTo(map);
+// lokasiGroup must be a FeatureGroup for Leaflet.Draw edit controls
+const lokasiGroup = L.featureGroup().addTo(map);
+const rumahMarkers = [];
+
+let masjidCircle = null;
+let masjidControlEl = null;
+let currentEditingLayer = null; // used when creating/editing a marker to allow suggestion updates
+
+// filter thresholds (null = disabled)
+// masjid-specific filter intervals (defaults: min = 0, max = null/unbounded)
+let masjidIncomeMin = 0;
+let masjidIncomeMax = null;
+let masjidMembersMin = 0;
+let masjidMembersMax = null;
+// whether worship filter UI is expanded (controls whether filters are applied)
+let masjidFiltersExpanded = false;
+
+const dataPanelState = {
+    view: 'worship',
+    page: 1,
+    pageSize: 10
+};
+let lokasiRecords = [];
+let lokasiMarkerById = new Map();
+
+function getRecordIdKey(value){
+    return String(value === undefined || value === null ? '' : value);
+}
+
+function formatMoney(value){
+    try{
+        if(value === undefined || value === null || value === '') return '-';
+        const numberValue = Number(value);
+        if(isNaN(numberValue)) return '-';
+        return 'Rp ' + new Intl.NumberFormat('id-ID').format(numberValue);
+    }catch(e){
+        return '-';
+    }
+}
+
+function formatCount(value, suffix){
+    try{
+        const numberValue = Number(value);
+        if(isNaN(numberValue)) return '0' + (suffix ? ' ' + suffix : '');
+        return String(numberValue) + (suffix ? ' ' + suffix : '');
+    }catch(e){
+        return '0' + (suffix ? ' ' + suffix : '');
+    }
+}
+
+function buildIconSvg(kind){
+    if(kind === 'eye'){
+        return '<svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" aria-hidden="true"><path d="M1.5 12s3.5-6.5 10.5-6.5S22.5 12 22.5 12 19 18.5 12 18.5 1.5 12 1.5 12z"></path><circle cx="12" cy="12" r="3.5"></circle></svg>';
+    }
+    if(kind === 'edit'){
+        return '<svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" aria-hidden="true"><path d="M12 20h9"></path><path d="M16.5 3.5a2.1 2.1 0 0 1 3 3L7 19l-4 1 1-4 12.5-12.5z"></path></svg>';
+    }
+    if(kind === 'delete'){
+        return '<svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" aria-hidden="true"><path d="M3 6h18"></path><path d="M8 6V4h8v2"></path><path d="M19 6l-1 14H6L5 6"></path><path d="M10 11v6"></path><path d="M14 11v6"></path></svg>';
+    }
+    return '';
+}
+
+function buildActionButton(kind, label, handler, id){
+    return `<button type="button" class="data-action-btn" aria-label="${escapeHtml(label)}" title="${escapeHtml(label)}" onclick="${handler}('${escapeHtml(id)}')">${buildIconSvg(kind)}</button>`;
+}
+
+function getPanelRecords(){
+    const records = Array.isArray(lokasiRecords) ? lokasiRecords.slice() : [];
+    const filtered = records.filter(item => {
+        const jenis = String(item && item.jenis ? item.jenis : '').toLowerCase();
+        if(dataPanelState.view === 'house') return jenis === 'rumah';
+        return isWorshipType(jenis);
+    });
+    filtered.sort((left, right) => {
+        const leftPrimary = dataPanelState.view === 'house' ? String(left.alamat || '') : String(left.nama || '');
+        const rightPrimary = dataPanelState.view === 'house' ? String(right.alamat || '') : String(right.nama || '');
+        const primaryCompare = leftPrimary.localeCompare(rightPrimary, 'id', { sensitivity: 'base' });
+        if(primaryCompare !== 0) return primaryCompare;
+        const leftSecondary = dataPanelState.view === 'house' ? String(left.nama_kk || left.nama || '') : String(left.alamat || '');
+        const rightSecondary = dataPanelState.view === 'house' ? String(right.nama_kk || right.nama || '') : String(right.alamat || '');
+        return leftSecondary.localeCompare(rightSecondary, 'id', { sensitivity: 'base' });
+    });
+    return filtered;
+}
+
+function goToLocation(id){
+    switchView('map');
+    setTimeout(() => {
+        const marker = lokasiMarkerById.get(getRecordIdKey(id));
+        if(!marker){
+            showToast('Titik lokasi tidak ditemukan di peta', 'error', 3500);
+            return;
+        }
+        try{
+            const latlng = marker.getLatLng();
+            map.invalidateSize();
+            map.flyTo(latlng, Math.max(map.getZoom(), 19), { animate: true, duration: 0.55 });
+            if(typeof marker.openPopup === 'function'){
+                map.once('moveend', function(){
+                    try{ marker.openPopup(); }catch(e){}
+                });
+            }
+            if(marker._jenis && isWorshipType(marker._jenis)){
+                try{ showMasjidRadius(marker); }catch(e){}
+            }
+        }catch(e){
+            console.error(e);
+        }
+    }, 50);
+}
+
+function closePopupById(id){
+    try{
+        const marker = lokasiMarkerById.get(getRecordIdKey(id));
+        if(marker && typeof marker.closePopup === 'function') marker.closePopup();
+    }catch(e){ console.error(e); }
+}
+
+window.currentUser = null;
+
+function isCurrentUserAdmin(){
+    return !!(window.currentUser && window.currentUser.role === 'admin' && window.currentUser.status === 'active');
+}
+
+function isCurrentUserManager(){
+    return !!(window.currentUser && window.currentUser.role === 'manager' && window.currentUser.status === 'active');
+}
+
+function canEditRecord(item){
+    if(isCurrentUserAdmin()) return true;
+    if(!isCurrentUserManager()) return false;
+    return String(item && item.created_by ? item.created_by : '') === String(window.currentUser.id);
+}
+
+function updateAuthBar(){
+    const label = document.getElementById('auth-user-label');
+    const loginBtn = document.getElementById('auth-login-btn');
+    const logoutBtn = document.getElementById('auth-logout-btn');
+    const adminBtn = document.getElementById('admin-dashboard-btn');
+    const user = window.currentUser;
+    if(!label) return;
+    if(!user){
+        label.textContent = 'Tamu';
+        label.style.cursor = 'default';
+        label.onclick = null;
+        if(loginBtn) loginBtn.style.display = 'inline-block';
+        if(logoutBtn) logoutBtn.style.display = 'none';
+        if(adminBtn) adminBtn.style.display = 'none';
+    } else {
+        const nameOnly = user.name || user.email || 'Pengguna';
+        if(user.role === 'admin'){
+            label.innerHTML = '<span style="font-weight:700">' + escapeHtml(nameOnly) + '</span><span style="margin-left:8px;font-size:12px;color:#1d4ed8;font-weight:600">Verifikasi pengelola</span>';
+            label.style.cursor = 'pointer';
+            label.onclick = function(){ openAdminDashboard(); };
+        } else {
+            label.textContent = nameOnly;
+            label.style.cursor = 'default';
+            label.onclick = null;
+        }
+        if(loginBtn) loginBtn.style.display = 'none';
+        if(logoutBtn) logoutBtn.style.display = 'inline-block';
+        if(adminBtn) adminBtn.style.display = 'none';
+    }
+}
+
+function attachTopRightControls(){
+    try{
+        const cluster = document.getElementById('top-right-controls');
+        const mapWrap = document.getElementById('map-wrap');
+        if(!cluster || !mapWrap) return;
+        const controlContainer = mapWrap.querySelector('.leaflet-top.leaflet-right');
+        if(!controlContainer) return;
+        if(controlContainer.parentNode !== cluster){
+            cluster.appendChild(controlContainer);
+        }
+        try{
+            controlContainer.style.position = 'static';
+            controlContainer.style.top = 'auto';
+            controlContainer.style.right = 'auto';
+            controlContainer.style.margin = '0';
+        }catch(e){}
+    }catch(e){}
+}
+
+// State for registration verification code
+let authRegisterState = {
+    code_sent: false,
+    code: null,
+    email: null
+};
+
+function openAuthModal(mode){
+    const title = document.getElementById('auth-modal-title');
+    const fields = document.getElementById('auth-modal-fields');
+    const switchArea = document.getElementById('auth-modal-switch');
+    const submitBtn = document.getElementById('auth-modal-submit');
+    const modal = document.getElementById('auth-modal');
+    
+    // Reset registration verification state
+    if(mode === 'login'){
+        authRegisterState = { code_sent: false, code: null, email: null };
+    }
+    if(!title || !fields || !modal) return;
+    if(mode === 'register'){
+        title.textContent = 'Daftar Pengelola';
+        fields.innerHTML = '<div class="auth-field"><label><span class="label-title">Nama <span class="required-star">*</span></span><input name="name" type="text" required></label></div>'+
+            '<div class="auth-field"><label><span class="label-title">Email <span class="required-star">*</span></span><input name="email" type="email" required></label></div>'+
+            '<div class="auth-field"><label><span class="label-title">Password <span class="required-star">*</span></span><input name="password" type="password" required></label></div>'+
+            '<div class="auth-field"><label><span class="label-title">Organisasi / Tempat Ibadah <span class="required-star">*</span></span><input name="organization" type="text" required></label></div>'+
+            '<div class="auth-field"><label><span class="label-title">Alamat Organisasi <span class="required-star">*</span></span><textarea name="org_address" required></textarea></label></div>'+
+            '<div class="auth-field"><label><span class="label-title">Nomor Telp Organisasi <span class="required-star">*</span></span><input name="org_phone" type="text" required></label></div>'+
+            '<div class="auth-field">' +
+                '<label><span class="label-title">Bukti Organisasi <span class="required-star">*</span></span></label>' +
+                '<div style="margin-top:6px"><input name="org_proof" id="org_proof_input" type="file" accept=".png,.jpg,.jpeg,.svg,.pdf" required></div>' +
+                '<div style="font-size:12px;color:#64748b;margin-top:6px">Hanya file: .png, .jpg, .jpeg, .svg, atau .pdf. Maks 5MB.</div>' +
+            '</div>'+
+            '<div style="display:flex;gap:8px;margin-top:12px">' +
+                '<button type="button" id="auth-send-code-btn" class="btn" style="flex:1;padding:10px;background:#3b82f6;color:white;border:none;border-radius:4px;cursor:pointer;font-size:14px">Kirim Kode Verifikasi</button>' +
+            '</div>' +
+            '<div class="auth-field"><label><span class="label-title">Kode Verifikasi <span class="required-star">*</span></span><input name="verify_code" type="text" placeholder="Masukkan 6 digit" maxlength="6" pattern="[0-9]{6}" required></label></div>'+
+            '<div style="font-size:12px;color:#64748b;margin-top:8px">Akun akan berstatus menunggu persetujuan admin setelah pendaftaran berhasil.</div>';
+        if(switchArea){ switchArea.innerHTML = '<span>Sudah punya akun? <button type="button" id="auth-switch-to-login" class="data-link" style="background:transparent;border:0;padding:0;cursor:pointer;margin-left:4px">Masuk</button></span>'; }
+        if(submitBtn) submitBtn.textContent = 'Daftar';
+    } else {
+        title.textContent = 'Masuk';
+        fields.innerHTML = '<div class="auth-field"><label>Email<input name="email" type="email" required></label></div><div class="auth-field"><label>Password<input name="password" type="password" required></label></div>';
+        if(switchArea){ switchArea.innerHTML = '<span>Ingin daftar pengelola? <button type="button" id="auth-switch-to-register" class="data-link" style="background:transparent;border:0;padding:0;cursor:pointer;margin-left:4px">Daftar di sini</button></span>'; }
+        if(submitBtn) submitBtn.textContent = 'Masuk';
+    }
+    modal.classList.remove('hidden');
+    modal.setAttribute('aria-hidden','false');
+    try{ syncRequiredFieldMarkers(); }catch(e){}
+    try{
+        const switchToRegister = document.getElementById('auth-switch-to-register');
+        const switchToLogin = document.getElementById('auth-switch-to-login');
+        if(switchToRegister) switchToRegister.onclick = function(){ openAuthModal('register'); };
+        if(switchToLogin) switchToLogin.onclick = function(){ openAuthModal('login'); };
+    }catch(e){}
+    const form = document.getElementById('auth-modal-form');
+    form.onsubmit = async function(ev){
+        ev.preventDefault();
+        
+        // Regular form submission (register or login)
+        const endpoint = mode === 'register' ? 'src/api/auth/register.php' : 'src/api/auth/login.php';
+        try{
+            let resp, jr;
+            if(mode === 'register'){
+                // client-side validation for org_proof: size <=5MB and allowed extensions
+                const fileInput = form.querySelector('input[name="org_proof"]') || document.getElementById('org_proof_input');
+                if(!fileInput){ showToast('Input bukti organisasi tidak ditemukan', 'error', 4000); return; }
+                if(!(fileInput.files && fileInput.files.length > 0)){ showToast('Mohon unggah bukti organisasi (foto/pdf).', 'error', 5000); return; }
+                const f = fileInput.files[0];
+                const maxSize = 5 * 1024 * 1024;
+                const allowed = ['jpg','jpeg','png','svg','pdf'];
+                const ext = (f.name || '').split('.').pop().toLowerCase();
+                if(f.size > maxSize){ showToast('Ukuran file bukti organisasi maksimal 5MB', 'error', 5000); return; }
+                if(!allowed.includes(ext)){ showToast('Jenis file tidak diperbolehkan. Hanya .png, .jpg, .jpeg, .svg, atau .pdf.', 'error', 5000); return; }
+                
+                // Check verify code
+                const codeInput = form.querySelector('input[name="verify_code"]');
+                const code = codeInput ? codeInput.value.trim() : '';
+                if(!code || code.length !== 6 || !/^\d{6}$/.test(code)){
+                    showToast('Masukkan kode verifikasi 6 digit yang valid', 'error', 4000);
+                    return;
+                }
+                
+                const fd = new FormData(form);
+                resp = await fetch(endpoint, { method: 'POST', headers: buildHeaders(), body: fd, credentials: 'same-origin' });
+                jr = await resp.json().catch(()=>null);
+            } else {
+                const fd = new FormData(form);
+                const payload = {};
+                for(const [k,v] of fd.entries()) payload[k] = v;
+                resp = await fetch(endpoint, { method: 'POST', headers: buildHeaders(), body: JSON.stringify(payload), credentials: 'same-origin' });
+                jr = await resp.json().catch(()=>null);
+            }
+            if(!resp.ok || (jr && jr.success === false)){
+                showToast((jr && (jr.error || jr.status)) ? (jr.error || jr.status) : 'Gagal', 'error', 5000);
+                return;
+            }
+            if(mode === 'register'){
+                authRegisterState = { code_sent: false, code: null, email: null };
+                closeAuthModal();
+                showToast('Pendaftaran berhasil! Akun menunggu persetujuan admin.', 'success', 5000);
+            } else {
+                if(jr && jr.token){ syncAuthToken(jr.token); }
+                if(jr && jr.user){ syncCurrentUser(jr.user); }
+                await refreshAuthState();
+                closeAuthModal();
+                showToast('Berhasil masuk', 'success', 3000);
+                loadData();
+            }
+        }catch(e){ console.error(e); showToast('Gagal memproses autentikasi', 'error', 5000); }
+    };
+    
+    // Setup event listeners for registration "Send Verification Code" button
+    if(mode === 'register'){
+        const sendCodeBtn = document.getElementById('auth-send-code-btn');
+        if(sendCodeBtn){
+            sendCodeBtn.onclick = async function(ev){
+                ev.preventDefault();
+                const emailInput = form.querySelector('input[name="email"]');
+                const email = emailInput ? emailInput.value.trim().toLowerCase() : '';
+                
+                if(!email || !email.includes('@')){
+                    showToast('Masukkan email yang valid', 'error', 3000);
+                    return;
+                }
+                
+                sendCodeBtn.disabled = true;
+                sendCodeBtn.textContent = 'Mengirim...';
+                
+                try{
+                    const resp = await fetch('src/api/auth/send_verification_code.php', {
+                        method: 'POST',
+                        headers: {'Content-Type': 'application/json'},
+                        body: JSON.stringify({email: email})
+                    });
+                    
+                    const jr = await resp.json().catch(()=>null);
+                    
+                    if(!resp.ok || (jr && jr.success === false)){
+                        showToast(jr && jr.error ? jr.error : 'Gagal mengirim kode', 'error', 4000);
+                        sendCodeBtn.disabled = false;
+                        sendCodeBtn.textContent = 'Kirim Kode Verifikasi';
+                        return;
+                    }
+                    
+                    authRegisterState.code_sent = true;
+                    authRegisterState.email = email;
+                    if(jr.debug_code){
+                        authRegisterState.code = jr.debug_code;
+                    }
+                    
+                    showToast('Kode verifikasi dikirim ke email Anda!', 'success', 4000);
+                    sendCodeBtn.textContent = 'Kode Terkirim ✓';
+                    setTimeout(() => {
+                        sendCodeBtn.disabled = false;
+                    }, 3000);
+                }catch(e){
+                    console.error(e);
+                    showToast('Gagal mengirim kode verifikasi', 'error', 5000);
+                    sendCodeBtn.disabled = false;
+                    sendCodeBtn.textContent = 'Kirim Kode Verifikasi';
+                }
+            };
+        }
+    }
+}
+
+function closeAuthModal(){
+    const modal = document.getElementById('auth-modal');
+    if(!modal) return;
+    modal.classList.add('hidden');
+    modal.setAttribute('aria-hidden','true');
+    // Reset form states
+    const form = document.getElementById('auth-modal-form');
+    if(form) form.reset();
+    authRegisterState = { code_sent: false, code: null, email: null };
+}
+
+// Email Verification Modal Functions
+async function refreshAuthState(){
+    try{
+        const resp = await fetch('src/api/auth/me.php', { credentials: 'same-origin', headers: buildHeaders(null) });
+        const jr = await resp.json().catch(()=>null);
+        if(resp.ok && jr && jr.authenticated){
+            syncCurrentUser(jr.user);
+        } else if(resp.status === 401 || resp.status === 403){
+            syncAuthToken('');
+            syncCurrentUser(null);
+        } else {
+            try{
+                const cachedUser = JSON.parse(localStorage.getItem('webgis_user') || 'null');
+                if(cachedUser && window.authToken){
+                    syncCurrentUser(cachedUser);
+                } else if(!window.currentUser && cachedUser){
+                    syncCurrentUser(cachedUser);
+                }
+            }catch(err){}
+        }
+    }catch(e){
+        try{
+            const cachedUser = JSON.parse(localStorage.getItem('webgis_user') || 'null');
+            if(cachedUser && !window.currentUser){
+                syncCurrentUser(cachedUser);
+            }
+        }catch(err){
+            if(!window.currentUser){
+                window.currentUser = null;
+            }
+        }
+    }
+    updateAuthBar();
+}
+
+async function logoutUser(){
+    try{
+        await fetch('src/api/auth/logout.php', { method: 'POST', credentials: 'same-origin', headers: buildHeaders(null) });
+    }catch(e){}
+    syncAuthToken('');
+    syncCurrentUser(null);
+    updateAuthBar();
+    loadData();
+}
+
+async function openAdminDashboard(){
+    if(!isCurrentUserAdmin()) return;
+    const modal = document.getElementById('admin-modal');
+    const list = document.getElementById('admin-pending-list');
+    if(!modal || !list) return;
+    list.innerHTML = '<div style="padding:12px;color:#64748b">Memuat data...</div>';
+    modal.classList.remove('hidden');
+    modal.setAttribute('aria-hidden','false');
+    try{
+        const resp = await fetch('src/api/admin/list_pending_managers.php', { credentials: 'same-origin', headers: buildHeaders(null) });
+        const jr = await resp.json().catch(()=>null);
+        if(!resp.ok || !jr || !jr.success){
+            list.innerHTML = '<div class="data-empty">Gagal memuat data.</div>';
+            return;
+        }
+        const items = Array.isArray(jr.pending) ? jr.pending : [];
+        window.pendingManagerItems = items;
+        if(items.length === 0){
+            list.innerHTML = '<div class="data-empty">Tidak ada pendaftaran yang menunggu.</div>';
+            return;
+        }
+        list.innerHTML = items.map((item, index) => `
+            <div style="border:1px solid #e5e7eb;border-radius:12px;padding:12px;margin-bottom:10px;background:#fff">
+                <div style="font-weight:700;color:#0f172a">${escapeHtml(item.name || '-')}</div>
+                <div style="font-size:13px;color:#475569">${escapeHtml(item.email || '-')}</div>
+                <div style="font-size:12px;color:#64748b;margin-top:6px">${escapeHtml(item.created_at || '')}</div>
+                <div style="display:flex;gap:8px;margin-top:10px">
+                    <button type="button" class="btn-secondary" onclick="openPendingManagerDetailByIndex(${index})">Detail</button>
+                    <button type="button" class="btn-destructive" onclick="rejectPendingUser('${escapeHtml(item.id)}')">Tolak</button>
+                    <button type="button" class="btn-primary" onclick="approvePendingUser('${escapeHtml(item.id)}')">Setujui</button>
+                </div>
+            </div>
+        `).join('');
+    }catch(e){
+        console.error(e);
+        list.innerHTML = '<div class="data-empty">Gagal memuat data.</div>';
+    }
+}
+
+async function approvePendingUser(id){
+    try{
+        const resp = await fetch('src/api/admin/approve_user.php', { method: 'POST', headers: buildHeaders(), body: JSON.stringify({ id: id }), credentials: 'same-origin' });
+        const jr = await resp.json().catch(()=>null);
+        if(!resp.ok || !jr || !jr.success){ showToast('Gagal menyetujui user', 'error', 4000); return; }
+        showToast('User disetujui', 'success', 3000);
+        openAdminDashboard();
+    }catch(e){ console.error(e); showToast('Gagal menyetujui user', 'error', 4000); }
+}
+
+async function rejectPendingUser(id){
+    try{
+        const resp = await fetch('src/api/admin/reject_user.php', { method: 'POST', headers: buildHeaders(), body: JSON.stringify({ id: id }), credentials: 'same-origin' });
+        const jr = await resp.json().catch(()=>null);
+        if(!resp.ok || !jr || !jr.success){ showToast('Gagal menolak user', 'error', 4000); return; }
+        showToast('User ditolak', 'success', 3000);
+        openAdminDashboard();
+    }catch(e){ console.error(e); showToast('Gagal menolak user', 'error', 4000); }
+}
+
+function closeAdminDashboard(){
+    const modal = document.getElementById('admin-modal');
+    if(!modal) return;
+    modal.classList.add('hidden');
+    modal.setAttribute('aria-hidden','true');
+}
+
+function renderDataPanel(){
+    const headEl = document.getElementById('data-table-head');
+    const bodyEl = document.getElementById('data-table-body');
+    const summaryEl = document.getElementById('data-panel-summary');
+    const paginationInfoEl = document.getElementById('data-pagination-info');
+    const paginationControlsEl = document.getElementById('data-pagination-controls');
+    if(!headEl || !bodyEl || !summaryEl || !paginationInfoEl || !paginationControlsEl) return;
+
+    const rows = getPanelRecords();
+    const totalRows = rows.length;
+    const totalPages = Math.max(1, Math.ceil(totalRows / dataPanelState.pageSize));
+    if(dataPanelState.page > totalPages) dataPanelState.page = totalPages;
+    if(dataPanelState.page < 1) dataPanelState.page = 1;
+    const startIndex = (dataPanelState.page - 1) * dataPanelState.pageSize;
+    const pageRows = rows.slice(startIndex, startIndex + dataPanelState.pageSize);
+
+    const isHouseView = dataPanelState.view === 'house';
+    const isGuest = !window.currentUser;
+    
+    if(isHouseView){
+        headEl.innerHTML = isGuest
+            ? '<tr><th style="width:64px">No</th><th>Alamat</th><th>Status Bulan Ini</th><th>Pemberi Bantuan</th><th style="width:118px;text-align:right">Aksi</th></tr>'
+            : '<tr><th style="width:64px">No</th><th>Alamat</th><th>Nama Kepala Keluarga</th><th style="width:90px;text-align:center">Anggota</th><th>Penghasilan Bulanan</th><th>Status Bulan Ini</th><th>Pemberi Bantuan</th><th style="width:118px;text-align:right">Aksi</th></tr>';
+    } else {
+        headEl.innerHTML = '<tr><th style="width:64px">No</th><th style="width:120px">Rumah Ibadah</th><th style="width:150px">Nama Tempat Ibadah</th><th>Alamat</th><th>Bantuan Bulan Ini</th><th style="width:118px;text-align:right">Aksi</th></tr>';
+    }
+
+    summaryEl.textContent = isHouseView
+        ? 'Menampilkan rumah yang aktif dengan urutan alamat.'
+        : 'Menampilkan tempat ibadah yang aktif dengan urutan nama.';
+
+    if(totalRows === 0){
+        bodyEl.innerHTML = `<tr><td colspan="${isHouseView ? (isGuest ? 5 : 8) : 6}"><div class="data-empty">Tidak ada data yang cocok untuk filter ini.</div></td></tr>`;
+    } else {
+        bodyEl.innerHTML = pageRows.map((item, index) => {
+            const id = getRecordIdKey(item.id);
+            const rowNumber = startIndex + index + 1;
+            if(isHouseView){
+                const assistedThisMonth = Number(item.bantuan_bulan_ini || 0) > 0 || (item.assisted && parseInt(item.assisted) === 1);
+                const statusBadge = assistedThisMonth
+                    ? '<span class="data-badge is-green">Sudah dibantu bulan ini</span>'
+                    : '<span class="data-badge is-yellow">Belum dibantu bulan ini</span>';
+                const canEdit = canEditRecord(item);
+                const canAssistEdit = isCurrentUserManager() || isCurrentUserAdmin();
+                const providerName = item && item.sumber_bantuan_name ? item.sumber_bantuan_name : '';
+                const providerType = item && item.sumber_bantuan_jenis ? item.sumber_bantuan_jenis : '';
+                const providerPrefixed = providerName ? ((providerType ? (providerType.charAt(0).toUpperCase() + providerType.slice(1)) + ' - ' : '') + providerName) : '';
+                const providerCellContent = assistedThisMonth ? escapeHtml(providerPrefixed || '-') : '<span style="color:#9ca3af">-</span>';
+                if(isGuest){
+                    return `<tr>
+                        <td><span class="data-index">${rowNumber}</span></td>
+                        <td><div class="data-muted">${escapeHtml(item.alamat || '-')}</div></td>
+                        <td>${statusBadge}</td>
+                        <td><div style="font-size:13px;color:#475569;white-space:nowrap">${providerCellContent}</div></td>
+                        <td><div class="data-actions">${buildActionButton('eye', 'Lihat di peta', 'goToLocation', id)}</div></td>
+                    </tr>`;
+                }
+                return `<tr>
+                    <td><span class="data-index">${rowNumber}</span></td>
+                    <td><div class="data-muted">${escapeHtml(item.alamat || '-')}</div></td>
+                    <td><div class="data-name">${escapeHtml(item.nama_kk || item.nama || '-')}</div></td>
+                    <td><div class="data-muted">${escapeHtml(formatCount(item.members, 'orang'))}</div></td>
+                    <td><div class="data-muted">${escapeHtml(formatMoney(item.monthly_income))}</div></td>
+                    <td>${statusBadge}</td>
+                    <td><div style="font-size:13px;color:#475569;white-space:nowrap">${providerCellContent}</div></td>
+                    <td><div class="data-actions">${buildActionButton('eye', 'Lihat di peta', 'goToLocation', id)}${(canEdit || canAssistEdit) ? buildActionButton('edit', 'Edit data', 'openEdit', id) : ''}${canEdit ? buildActionButton('delete', 'Hapus data', 'hapus', id) : ''}</div></td>
+                </tr>`;
+            }
+            const jenisLabel = (item.jenis || 'Tempat Ibadah').charAt(0).toUpperCase() + (item.jenis || 'Tempat Ibadah').slice(1);
+            const canEdit = canEditRecord(item);
+            const actionButtons = canEdit 
+                ? `${buildActionButton('eye', 'Lihat di peta', 'goToLocation', id)}${buildActionButton('edit', 'Edit data', 'openEdit', id)}${buildActionButton('delete', 'Hapus data', 'hapus', id)}`
+                : buildActionButton('eye', 'Lihat di peta', 'goToLocation', id);
+            return `<tr>
+                <td><span class="data-index">${rowNumber}</span></td>
+                <td><span class="data-pill" style="margin:0">${escapeHtml(jenisLabel)}</span></td>
+                <td><div class="data-name">${escapeHtml(item.nama || '-')}</div></td>
+                <td><div class="data-muted">${escapeHtml(item.alamat || '-')}</div></td>
+                <td><span class="data-badge is-green">${escapeHtml(formatCount(item.bantuan_bulan_ini, 'bantuan'))}</span></td>
+                <td><div class="data-actions">${actionButtons}</div></td>
+            </tr>`;
+        }).join('');
+    }
+
+    paginationInfoEl.textContent = totalRows === 0
+        ? '0 data'
+        : `Halaman ${dataPanelState.page} dari ${totalPages} · ${totalRows} data`;
+
+    const pages = [];
+    if(totalPages > 1){
+        const pushPage = (page) => pages.push(`<button type="button" class="data-page-btn ${page === dataPanelState.page ? 'active' : ''}" onclick="setDataPanelPage(${page})">${page}</button>`);
+        const pushEllipsis = () => pages.push('<span class="data-page-ellipsis">…</span>');
+        pages.push(`<button type="button" class="data-page-btn" ${dataPanelState.page === 1 ? 'disabled' : ''} onclick="setDataPanelPage(${Math.max(1, dataPanelState.page - 1)})">Prev</button>`);
+        if(totalPages <= 7){
+            for(let page = 1; page <= totalPages; page++) pushPage(page);
+        } else {
+            pushPage(1);
+            const start = Math.max(2, dataPanelState.page - 1);
+            const end = Math.min(totalPages - 1, dataPanelState.page + 1);
+            if(start > 2) pushEllipsis();
+            for(let page = start; page <= end; page++) pushPage(page);
+            if(end < totalPages - 1) pushEllipsis();
+            pushPage(totalPages);
+        }
+        pages.push(`<button type="button" class="data-page-btn" ${dataPanelState.page === totalPages ? 'disabled' : ''} onclick="setDataPanelPage(${Math.min(totalPages, dataPanelState.page + 1)})">Next</button>`);
+    }
+    paginationControlsEl.innerHTML = pages.join('');
+}
+
+function switchView(viewType){
+    const mapWrap = document.getElementById('map-wrap');
+    const dataPanel = document.getElementById('data-panel');
+    const viewMapBtn = document.getElementById('view-map-btn');
+    const viewDataBtn = document.getElementById('view-data-btn');
+    const topRightControls = document.getElementById('top-right-controls');
+    
+    if(viewType === 'map'){
+        if(mapWrap) mapWrap.style.display = 'flex';
+        if(dataPanel) dataPanel.style.display = 'none';
+        if(topRightControls) topRightControls.style.display = 'flex';
+    if(viewMapBtn) { viewMapBtn.style.background = '#1e40af'; viewMapBtn.style.color = '#fff'; viewMapBtn.style.boxShadow = '0 2px 8px rgba(30,64,175,0.3)'; }
+    if(viewDataBtn) { viewDataBtn.style.background = '#e5e7eb'; viewDataBtn.style.color = '#374151'; viewDataBtn.style.boxShadow = 'none'; }
+    } else if(viewType === 'data'){
+        if(mapWrap) mapWrap.style.display = 'none';
+        if(dataPanel) dataPanel.style.display = 'flex';
+        if(topRightControls) topRightControls.style.display = 'none';
+    if(viewMapBtn) { viewMapBtn.style.background = '#e5e7eb'; viewMapBtn.style.color = '#374151'; viewMapBtn.style.boxShadow = 'none'; }
+    if(viewDataBtn) { viewDataBtn.style.background = '#1e40af'; viewDataBtn.style.color = '#fff'; viewDataBtn.style.boxShadow = '0 2px 8px rgba(30,64,175,0.3)'; }
+    try{ renderDataPanel(); }catch(e){}
+    try{ hideMasjidRadius(); }catch(e){}
+    try{ const modalEl = document.getElementById('modal'); if(modalEl) modalEl.classList.add('hidden'); }catch(e){}
+    try{ currentEditingLayer = null; }catch(e){}
+    }
+}
+
+function setDataPanelView(view){
+    if(view !== 'house' && view !== 'worship') return;
+    dataPanelState.view = view;
+    dataPanelState.page = 1;
+    const worshipBtn = document.getElementById('data-view-worship');
+    const houseBtn = document.getElementById('data-view-house');
+    if(worshipBtn) worshipBtn.classList.toggle('active', view === 'worship');
+    if(houseBtn) houseBtn.classList.toggle('active', view === 'house');
+    renderDataPanel();
+}
+
+function setDataPanelPage(page){
+    const nextPage = Math.max(1, parseInt(page, 10) || 1);
+    dataPanelState.page = nextPage;
+    renderDataPanel();
+}
+
+// helper to check worship types in record
+const worshipTypes = ['masjid','gereja','pura','vihara','klenteng'];
+function isWorshipType(jenis){ try{ if(!jenis) return false; return worshipTypes.indexOf(String(jenis).toLowerCase()) !== -1; }catch(e){return false;} }
+
+const assistanceSourceOptions = [
+    'Pemerintah Pusat',
+    'Pemerintah Daerah',
+    'Kementerian Sosial',
+    'Kementerian Kesehatan',
+    'Kementerian Pendidikan',
+    'Baznas',
+    'Lazis',
+    'CSR Perusahaan',
+    'Donatur Individu',
+    'Lainnya'
+];
+
+const assistanceShapeOptions = [
+    'Tunai',
+    'Pangan/Sembako',
+    'Pendidikan',
+    'Kesehatan',
+    'Program Keluarga Harapan',
+    'Lainnya'
+];
+
+function escapeHtml(value){
+    return String(value === undefined || value === null ? '' : value)
+        .replace(/&/g, '&amp;')
+        .replace(/</g, '&lt;')
+        .replace(/>/g, '&gt;')
+        .replace(/"/g, '&quot;')
+        .replace(/'/g, '&#39;');
+}
+
+function getDisplayName(rec){
+    if(!rec) return '';
+    const a = String(rec.nama || '').trim();
+    const b = String(rec.nama_kk || '').trim();
+    const isDash = s => !s || /^[-–—\s]+$/.test(s);
+    if(!isDash(a)) return a;
+    if(!isDash(b)) return b;
+    return '';
+}
+
+function toDateInputValue(value){
+    try{
+        if(!value) return '';
+        return String(value).split(' ')[0].split('T')[0];
+    }catch(e){
+        return '';
+    }
+}
+
+function todayDateInputValue(){
+    try{
+        const now = new Date();
+        const year = now.getFullYear();
+        const month = String(now.getMonth() + 1).padStart(2, '0');
+        const day = String(now.getDate()).padStart(2, '0');
+        return `${year}-${month}-${day}`;
+    }catch(e){
+        return '';
+    }
+}
+
+function buildAssistanceFieldsHtml(record){
+    const assisted = !!(record && record.assisted && parseInt(record.assisted)===1);
+    const dateValue = assisted ? toDateInputValue(record.last_assisted_at || todayDateInputValue()) : '';
+    const notesValue = escapeHtml(record && record.assistance_notes ? record.assistance_notes : '');
+    const shapeValue = String(record && record.bentuk_bantuan ? record.bentuk_bantuan : '');
+    const sourceValue = String(record && record.sumber_bantuan ? record.sumber_bantuan : '');
+    const disabledAttr = assisted ? '' : 'disabled';
+    const shapeOptionsHtml = ['Tunai','Pangan/Sembako','Pendidikan','Kesehatan','Lainnya'].map(v =>
+        `<option value="${escapeHtml(v)}" ${String(v) === shapeValue ? 'selected' : ''}>${escapeHtml(v)}</option>`
+    ).join('');
+    return `
+        <div id="assistance-fields" class="assistance-fields ${assisted ? 'is-enabled' : 'is-disabled'}" style="margin-top:12px">
+            <label><input name="assisted" type="checkbox" ${assisted ? 'checked' : ''}> Telah menerima bantuan</label>
+            <label>Tanggal Bantuan <input name="last_assisted_at" type="date" value="${escapeHtml(dateValue)}" ${disabledAttr} ${assisted ? 'required' : ''}></label>
+            <div class="assistance-combobox">
+                <label id="sumber-bantuan-label">Sumber Bantuan</label>
+                <input type="search" id="sumber-bantuan-search" class="assist-source-input" placeholder="Ketik nama tempat ibadah" value="${escapeHtml(sourceValue)}" ${disabledAttr} autocomplete="off">
+                <button type="button" class="assist-source-toggle" id="sumber-bantuan-toggle" ${disabledAttr} aria-label="Buka daftar sumber bantuan"></button>
+                <input type="hidden" name="sumber_bantuan" id="sumber-bantuan-value" value="${escapeHtml(sourceValue)}">
+                <div class="assist-source-panel" id="sumber-bantuan-panel" aria-label="Daftar sumber bantuan"></div>
+            </div>
+            <label>Bentuk Bantuan
+                <select name="bentuk_bantuan" ${disabledAttr} ${assisted ? 'required' : ''}>
+                    <option value="">Pilih bentuk bantuan</option>
+                    ${shapeOptionsHtml}
+                </select>
+            </label>
+            <label>Catatan Bantuan <input name="assistance_notes" type="text" value="${notesValue}" ${disabledAttr}></label>
+        </div>`;
+}
+
+function createLocationPinIcon(color){
+    const fill = color || '#d32f2f';
+    const html = '<div class="location-pin" style="--pin-color:' + fill + '">' +
+        '<svg width="30" height="42" viewBox="0 0 30 42" aria-hidden="true" focusable="false">' +
+        '<path d="M15 1C8.4 1 3 6.4 3 13c0 8.4 12 28 12 28s12-19.6 12-28C27 6.4 21.6 1 15 1z" fill="' + fill + '" stroke="#ffffff" stroke-width="2"></path>' +
+        '<circle cx="15" cy="13" r="5.25" fill="#ffffff"></circle>' +
+        '</svg>' +
+        '</div>';
+    return L.divIcon({
+        html: html,
+        className: 'location-pin-icon',
+        iconSize: [30, 42],
+        iconAnchor: [15, 42],
+        popupAnchor: [0, -36]
+    });
+}
+
+function buildMarkerLegendSvg(color){
+    const fill = color || '#d32f2f';
+    return '<span class="legend-marker" aria-hidden="true">' +
+        '<svg viewBox="0 0 30 42" focusable="false" aria-hidden="true">' +
+        '<path d="M15 1C8.4 1 3 6.4 3 13c0 8.4 12 28 12 28s12-19.6 12-28C27 6.4 21.6 1 15 1z" fill="' + fill + '" stroke="#ffffff" stroke-width="2"></path>' +
+        '<circle cx="15" cy="13" r="5.25" fill="#ffffff"></circle>' +
+        '</svg>' +
+    '</span>';
+}
+
+function buildLayerLegendLabel(title, colors, description){
+    const colorList = Array.isArray(colors) ? colors : [colors];
+    const markers = colorList.filter(Boolean).map(color => buildMarkerLegendSvg(color)).join('');
+    return '<span class="layer-legend" aria-label="' + title + '">' + markers + '<span class="legend-text">' + title + '</span></span>';
+}
+
+function syncRequiredFieldMarkers(){
+    try{
+        const labels = document.querySelectorAll('#modal-fields label');
+        labels.forEach(label => {
+            if(!label || !label.querySelector) return;
+            const control = label.querySelector('input, select, textarea');
+            const shouldShow = !!control && !!control.required && !control.disabled;
+            let title = label.querySelector(':scope > .label-title');
+            if(shouldShow && !title){
+                title = document.createElement('span');
+                title.className = 'label-title';
+                const beforeNodes = [];
+                for(const node of Array.from(label.childNodes)){
+                    if(node === control) break;
+                    beforeNodes.push(node);
+                }
+                beforeNodes.forEach(node => title.appendChild(node));
+                label.insertBefore(title, control || label.firstChild);
+            }
+            let star = title ? title.querySelector('.required-star') : null;
+            if(shouldShow){
+                if(!star){
+                    star = document.createElement('span');
+                    star.className = 'required-star';
+                    star.textContent = '*';
+                    if(title){ title.appendChild(star); }
+                }
+            } else if(star){
+                star.remove();
+                if(title && !title.textContent.trim() && title.children.length === 0){
+                    title.remove();
+                }
+            }
+        });
+
+        const sourceLabel = document.getElementById('sumber-bantuan-label');
+        const sourceInput = document.getElementById('sumber-bantuan-search');
+        if(sourceLabel){
+            const requiredSource = !!(sourceInput && sourceInput.required && !sourceInput.disabled);
+            let title = sourceLabel.querySelector(':scope > .label-title');
+            if(requiredSource && !title){
+                title = document.createElement('span');
+                title.className = 'label-title';
+                while(sourceLabel.firstChild){ title.appendChild(sourceLabel.firstChild); }
+                sourceLabel.appendChild(title);
+            }
+            if(title){
+                let star = title.querySelector('.required-star');
+                if(requiredSource && !star){
+                    star = document.createElement('span');
+                    star.className = 'required-star';
+                    star.textContent = '*';
+                    title.appendChild(star);
+                } else if(!requiredSource && star){
+                    star.remove();
+                }
+            }
+        }
+    }catch(e){}
+}
+
+function setRequiredStarForControl(control, required){
+    try{
+        if(!control || !control.closest) return;
+        const label = control.closest('label');
+        if(!label) return;
+        let title = label.querySelector(':scope > .label-title');
+        if(required && !title){
+            title = document.createElement('span');
+            title.className = 'label-title';
+            while(label.firstChild && label.firstChild !== control){
+                title.appendChild(label.firstChild);
+            }
+            label.insertBefore(title, control);
+        }
+        if(!title) return;
+        let star = title.querySelector('.required-star');
+        if(required){
+            if(!star){
+                star = document.createElement('span');
+                star.className = 'required-star';
+                star.textContent = '*';
+                title.appendChild(star);
+            }
+        } else if(star){
+            star.remove();
+            if(!title.textContent.trim() && title.children.length === 0){ title.remove(); }
+        }
+    }catch(e){}
+}
+
+function populateAssistanceSourceOptions(){
+    const panel = document.getElementById('sumber-bantuan-panel');
+    const valueInput = document.getElementById('sumber-bantuan-value');
+    const searchInput = document.getElementById('sumber-bantuan-search');
+    if(!panel || !valueInput || !searchInput) return;
+
+    fetch('src/api/get_lokasi.php', { headers: buildHeaders(null), credentials: 'same-origin' })
+        .then(response => {
+            if(!response.ok){
+                throw new Error('get_lokasi_failed_' + response.status);
+            }
+            return response.json();
+        })
+        .then(allLoc => {
+            const filter = (window && window.assistanceSourceFilter) ? window.assistanceSourceFilter : null;
+            const items = (allLoc || [])
+                .filter(loc => {
+                    if(!loc) return false;
+                    const jenis = String(loc.jenis || '').toLowerCase();
+                    if(filter && filter.worshipOnly){ if(!isWorshipType(jenis)) return false; }
+                    else { if(jenis === 'rumah') return false; }
+                    if(filter && (filter.createdBy !== undefined && filter.createdBy !== null)){
+                        if(String(loc.created_by || '') !== String(filter.createdBy)) return false;
+                    }
+                    return true;
+                })
+                .map(loc => {
+                    const rawName = String(loc && loc.nama ? loc.nama : '').trim();
+                    const jenis = String(loc && loc.jenis ? loc.jenis : '').trim();
+                    const label = rawName + (jenis ? ' — ' + jenis.charAt(0).toUpperCase() + jenis.slice(1) : '');
+                    return { id: String(loc.id || ''), name: rawName, label: label };
+                })
+                .filter(item => item.name !== '')
+                .sort((a, b) => a.name.localeCompare(b.name, 'id', { sensitivity: 'base' }));
+            window.assistanceSourceItems = items;
+            window.assistanceSourceLoaded = true;
+            const currentValue = String(valueInput.value || '').trim();
+            if(currentValue){
+                const matched = items.find(item => item.id === currentValue || item.name.toLowerCase() === currentValue.toLowerCase() || item.label.toLowerCase() === currentValue.toLowerCase());
+                if(matched){ searchInput.value = matched.label; valueInput.value = matched.id; }
+            }
+            renderAssistanceSourceOptions(searchInput.value || '', false, false);
+            syncAssistanceSourceSearch();
+        })
+        .catch(() => {});
+}
+
+function normalizeAssistanceQuery(query){
+    const q = String(query || '').trim();
+    if(!q) return { type: 'empty', term: '' };
+    const wildcard = q.indexOf('*') !== -1 || q.indexOf('?') !== -1;
+    if(wildcard){
+        const pattern = '^' + q.replace(/[.+^${}()|[\]\\]/g, '\\$&').replace(/\*/g, '.*').replace(/\?/g, '.') + '$';
+        try{ return { type: 'regex', regex: new RegExp(pattern, 'i') }; }catch(e){ return { type: 'contains', term: q.toLowerCase() }; }
+    }
+    try{ return { type: 'regex', regex: new RegExp(q, 'i') }; }catch(e){ return { type: 'contains', term: q.toLowerCase() }; }
+}
+
+function getFilteredAssistanceSourceItems(query){
+    try{
+        const items = Array.isArray(window.assistanceSourceItems) ? window.assistanceSourceItems : [];
+        const q = normalizeAssistanceQuery(query);
+        if(q.type === 'empty') return items;
+        return items.filter(item => {
+            const text = item.label || '';
+            if(q.type === 'regex'){ return q.regex.test(text); }
+            return text.toLowerCase().indexOf(q.term) !== -1;
+        });
+    }catch(e){}
+    return [];
+}
+
+function renderAssistanceSourceOptions(query, append=false, showPanel=true){
+    try{
+        const panel = document.getElementById('sumber-bantuan-panel');
+        if(!panel) return;
+        const items = getFilteredAssistanceSourceItems(query);
+        const pageSize = 15;
+        const currentShown = append ? Array.from(panel.querySelectorAll('.assist-source-item')).length : 0;
+        const nextShown = Math.min(items.length, currentShown > 0 ? currentShown + pageSize : pageSize);
+        const visibleItems = items.slice(0, nextShown);
+        panel.innerHTML = '';
+        if(visibleItems.length === 0){
+            const empty = document.createElement('div');
+            empty.className = 'assist-source-empty';
+            empty.textContent = 'Tidak ditemukan';
+            panel.appendChild(empty);
+            if(showPanel) panel.classList.add('show');
+            return;
+        }
+        visibleItems.forEach(item => {
+            const row = document.createElement('div');
+            row.className = 'assist-source-item';
+            row.textContent = item.label;
+            row.dataset.value = item.id;
+            row.dataset.label = item.label;
+            row.addEventListener('mousedown', function(ev){ ev.preventDefault(); selectAssistanceSource(item); });
+            panel.appendChild(row);
+        });
+        if(showPanel) panel.classList.add('show');
+    }catch(e){}
+}
+
+function selectAssistanceSource(item){
+    try{
+        const search = document.getElementById('sumber-bantuan-search');
+        const valueInput = document.getElementById('sumber-bantuan-value');
+        const panel = document.getElementById('sumber-bantuan-panel');
+        if(search) search.value = item.label;
+        if(valueInput) valueInput.value = item.id;
+        if(panel) panel.classList.remove('show');
+    }catch(e){}
+}
+
+function syncAssistanceSourceSearch(){
+    try{
+        const search = document.getElementById('sumber-bantuan-search');
+        const valueInput = document.getElementById('sumber-bantuan-value');
+        if(!search || !valueInput) return;
+        const items = Array.isArray(window.assistanceSourceItems) ? window.assistanceSourceItems : [];
+        const selected = items.find(item => item.id === String(valueInput.value || ''));
+        search.value = selected ? selected.label : search.value || '';
+    }catch(e){}
+}
+
+// Geocoding helpers (Nominatim)
+function debounce(fn, wait){ let t=null; return function(...args){ clearTimeout(t); t=setTimeout(()=>fn.apply(this,args), wait); }; }
+async function geocodeSearch(q){
+    if(!q || q.length<2) return [];
+    const url = 'src/api/geocode.php?action=search&q=' + encodeURIComponent(q);
+    const maxAttempts = 3;
+    let attempt = 0;
+    while(attempt < maxAttempts){
+        attempt++;
+        try{
+            const r = await fetch(url, { headers: { 'Accept': 'application/json' } });
+            if(r.ok){ const j = await r.json().catch(()=>null); return j || []; }
+            // server returned 5xx/4xx
+            console.warn('geocodeSearch: nominatim returned', r.status, r.statusText);
+            if(r.status >= 500){
+                // server error: retry after delay
+                await new Promise(res => setTimeout(res, 250 * attempt));
+                continue;
+            }
+            // client error: don't retry
+            return [];
+        }catch(e){
+            console.error('geocodeSearch failed attempt', attempt, e);
+            // network or CORS error: retry with backoff
+            await new Promise(res => setTimeout(res, 300 * attempt));
+            continue;
+        }
+    }
+    try{ showToast && showToast('Layanan geocoding sedang tidak tersedia. Coba lagi nanti.', 'error', 5000); }catch(e){}
+    return [];
+}
+
+async function reverseGeocode(lat, lon){
+    const url = 'src/api/geocode.php?action=reverse&lat=' + encodeURIComponent(lat) + '&lon=' + encodeURIComponent(lon);
+    const maxAttempts = 3;
+    let attempt = 0;
+    while(attempt < maxAttempts){
+        attempt++;
+        try{
+            const r = await fetch(url, { headers: { 'Accept': 'application/json' } });
+            if(r.ok){ const j = await r.json().catch(()=>null); return j || null; }
+            console.warn('reverseGeocode: nominatim returned', r.status, r.statusText);
+            if(r.status >= 500){ await new Promise(res => setTimeout(res, 250 * attempt)); continue; }
+            return null;
+        }catch(e){
+            console.error('reverseGeocode failed attempt', attempt, e);
+            await new Promise(res => setTimeout(res, 300 * attempt));
+            continue;
+        }
+    }
+    try{ showToast && showToast('Layanan reverse-geocoding tidak tersedia. Coba lagi nanti.', 'error', 5000); }catch(e){}
+    return null;
+}
+function detectWorshipType(r){ try{
+        const dn = (r.display_name||'').toLowerCase();
+        const typ = (r.type||'').toLowerCase();
+        if(dn.indexOf('masjid')!==-1 || dn.indexOf('mosque')!==-1 || typ.indexOf('mosque')!==-1) return 'masjid';
+        if(dn.indexOf('church')!==-1 || dn.indexOf('gereja')!==-1) return 'gereja';
+        if(dn.indexOf('pura')!==-1) return 'pura';
+        if(dn.indexOf('vihara')!==-1 || dn.indexOf('buddhist')!==-1) return 'vihara';
+        if(dn.indexOf('klenteng')!==-1 || dn.indexOf('kong')!==-1 || dn.indexOf('temple')!==-1) return 'klenteng';
+        if(typ.indexOf('place_of_worship')!==-1) return 'masjid';
+        return null;
+    }catch(e){return null;} }
+function extractNameFromResult(r){ try{ if(!r) return ''; if(r.display_name){ const parts = r.display_name.split(','); return parts[0].trim(); } return ''; }catch(e){ return ''; }
+}
+
+function formatDateToDMY(s){
+    try{
+        if(!s) return '';
+        // try Date parsing first (ISO or RFC)
+        const d = new Date(s);
+        if(!isNaN(d.getTime())){
+            const dd = ('0'+d.getDate()).slice(-2);
+            const mm = ('0'+(d.getMonth()+1)).slice(-2);
+            const yyyy = d.getFullYear();
+            return dd + '-' + mm + '-' + yyyy;
+        }
+        // fallback: accept 'YYYY-MM-DD [HH:MM:SS]' or 'YYYY-MM-DD'
+        const datePart = (''+s).split(' ')[0];
+        const parts = datePart.split('-');
+        if(parts.length===3){ return parts[2] + '-' + parts[1] + '-' + parts[0]; }
+        return s;
+    }catch(e){ return s; }
+}
+
+function openModal(title, html, onSubmit){
+    document.getElementById('modal-title').textContent = title;
+    document.getElementById('modal-fields').innerHTML = html;
+    syncRequiredFieldMarkers();
+    // enhance file inputs: add a filename span, a visible size-note and client-side size check (max 5 MB)
+    try{
+        const MAX_FILE_SIZE = 5 * 1024 * 1024; // 5 MB
+        const ALLOWED_TYPES = ['image/jpeg','image/png','image/webp'];
+        const fileInputs = document.querySelectorAll('#modal-fields input[type="file"]');
+        fileInputs.forEach(fi=>{
+            let s = fi.parentNode.querySelector('.file-name');
+            if(!s){ s = document.createElement('span'); s.className='file-name'; s.style.display='block'; s.style.fontSize='12px'; s.style.color='#333'; s.style.marginTop='6px'; fi.parentNode.appendChild(s); }
+            let note = fi.parentNode.querySelector('.file-note');
+            if(!note){ note = document.createElement('div'); note.className='file-note'; note.style.fontSize='12px'; note.style.color='#666'; note.style.marginTop='6px'; note.textContent = 'Maksimal 5 MB — Format: JPG, PNG, WEBP'; fi.parentNode.appendChild(note); }
+            fi.addEventListener('change', function(){
+                const f = (fi.files && fi.files[0]) ? fi.files[0] : null;
+                if(!f){ s.textContent = ''; return; }
+                if(f.size > MAX_FILE_SIZE){
+                    try{ showToast('Ukuran file melebihi 5 MB', 'error', 5000); }catch(e){}
+                    fi.value = '';
+                    s.textContent = '';
+                    return;
+                }
+                if(f.type && ALLOWED_TYPES.indexOf(f.type) === -1){
+                    try{ showToast('Format file tidak didukung. Gunakan JPG, PNG, atau WEBP.', 'error', 6000); }catch(e){}
+                    fi.value = '';
+                    s.textContent = '';
+                    return;
+                }
+                s.textContent = f.name + ' (' + Math.round(f.size/1024) + ' KB)';
+            });
+        });
+    }catch(e){}
+    // helpers to move phone label into household slot and back
+    function movePhoneToSlot(){ try{ const labels = Array.from(document.querySelectorAll('#modal-fields label')); const phoneLabel = labels.find(l=> l.querySelector && l.querySelector('input[name="no_telp"]')); const slot = document.querySelector('#modal-fields .hf-phone-slot'); if(phoneLabel && slot && phoneLabel.parentNode !== slot){ slot.appendChild(phoneLabel); } }catch(e){} }
+    function movePhoneBackBeforeAddress(){ try{ const slotLabel = document.querySelector('#modal-fields .hf-phone-slot > label'); const addrLabel = Array.from(document.querySelectorAll('#modal-fields label')).find(l=> l.querySelector && l.querySelector('input[name="alamat"]')); if(slotLabel && addrLabel && addrLabel.parentNode){ addrLabel.parentNode.insertBefore(slotLabel, addrLabel); } }catch(e){} }
+    window.movePhoneToSlot = movePhoneToSlot;
+    window.movePhoneBackBeforeAddress = movePhoneBackBeforeAddress;
+    // enhance address inputs: autocomplete + selection
+    try{
+        const addrInputs = document.querySelectorAll('#modal-fields input[name="alamat"]');
+        addrInputs.forEach(inp=>{
+            // create suggestion container
+            let box = inp.parentNode.querySelector('.suggestions');
+            if(!box){ box = document.createElement('div'); box.className='suggestions'; box.style.position='absolute'; box.style.background='#fff'; box.style.border='1px solid #e5e7eb'; box.style.borderRadius='6px'; box.style.boxShadow='0 6px 20px rgba(15,23,42,0.06)'; box.style.zIndex=20000; box.style.maxHeight='220px'; box.style.overflow='auto'; box.style.width = inp.offsetWidth + 'px'; box.style.display='none'; box.style.padding='6px'; box.style.marginTop='6px'; inp.parentNode.style.position='relative'; inp.parentNode.appendChild(box); }
+            const doSearch = debounce(async function(){ const q = inp.value; if(!q || q.length<2){ box.style.display='none'; box.innerHTML=''; return; } const res = await geocodeSearch(q); box.innerHTML=''; if(!res || res.length===0){ box.style.display='none'; return; } res.forEach(r=>{ const el = document.createElement('div'); el.style.padding='6px'; el.style.cursor='pointer'; el.style.borderRadius='6px'; el.style.fontSize='13px'; el.textContent = (r.display_name||r.display_name); el.addEventListener('click', function(){ inp.value = r.display_name || ''; box.style.display='none';
+                        // if suggestion has lat/lon, update editing layer or store coordinates
+                        if(r.lat && r.lon){ try{ if(currentEditingLayer && typeof currentEditingLayer.setLatLng === 'function'){ currentEditingLayer.setLatLng([parseFloat(r.lat), parseFloat(r.lon)]); map.panTo([parseFloat(r.lat), parseFloat(r.lon)]); } // store chosen coords on input dataset
+                                    inp.dataset.lat = r.lat; inp.dataset.lon = r.lon; }catch(e){}
+                        }
+                        // if suggestion indicates a place of worship, set jenis accordingly and mark required
+                        try{ const sel = document.querySelector('#modal-fields select[name="jenis"]'); const wt = detectWorshipType(r); if(wt && sel){ sel.value=wt; sel.dispatchEvent(new Event('change')); } }catch(e){}
+                        // auto-fill name if suggestion appears to be a place of worship
+                        try{ const wt2 = detectWorshipType(r); if(wt2){ const nameInput = document.querySelector('#modal-fields input[name="nama"]'); if(nameInput && !nameInput.value) nameInput.value = extractNameFromResult(r); } }catch(e){}
+                    }); el.addEventListener('mouseenter', ()=> el.style.background='#f8fafc'); el.addEventListener('mouseleave', ()=> el.style.background='transparent'); box.appendChild(el); }); box.style.display='block'; }, 300);
+            inp.addEventListener('input', doSearch);
+            inp.addEventListener('blur', function(){ setTimeout(()=>{ box.style.display='none'; },200); });
+        });
+    }catch(e){}
+    const modal = document.getElementById('modal'); modal.classList.remove('hidden'); modal.setAttribute('aria-hidden','false');
+    // after modal opens, ensure phone field is moved into household slot once DOM stabilizes
+    try{ requestAnimationFrame(()=>{ try{ movePhoneToSlot(); }catch(e){}; setTimeout(()=>{ try{ movePhoneToSlot(); }catch(e){} },10); }); }catch(e){}
+    // normalize monthly_income display: remove trailing decimals and show integer Rupiah
+    try{
+        const mi = document.querySelector('#modal-fields input[name="monthly_income"]');
+        if(mi){
+            try{ if(mi.value !== undefined && mi.value !== null && mi.value !== ''){ mi.value = String(Math.round(Number(mi.value))); } }catch(e){}
+            mi.addEventListener('blur', function(){ try{ if(this.value !== undefined && this.value !== null && this.value !== '') this.value = String(Math.round(Number(this.value))); }catch(e){} });
+        }
+    }catch(e){}
+    // ensure jenis change toggles requiredness for name and alamat and hides photo for masjid
+    try{
+        const jenisSel = document.querySelector('#modal-fields select[name="jenis"]');
+        const nameInp = document.querySelector('#modal-fields input[name="nama"]');
+        const addrInp = document.querySelector('#modal-fields input[name="alamat"]');
+        const photoField = document.querySelector('#modal-fields #photo-field, #modal-fields #photo-field-create');
+        if(jenisSel){
+            const toggleReq = function(){
+                if(isWorshipType(jenisSel.value)){
+                    if(nameInp) nameInp.required = true;
+                    if(addrInp) addrInp.required = true;
+                    if(photoField) photoField.style.display = 'none';
+                } else if (jenisSel.value==='rumah'){
+                    if(nameInp) nameInp.required = false;
+                    if(addrInp) addrInp.required = true;
+                    if(photoField) photoField.style.display = 'block';
+                    // ensure nama_kk (when present) is required
+                    try{ const namaKk = document.querySelector('#modal-fields input[name="nama_kk"]'); if(namaKk) namaKk.required = true; }catch(e){}
+                } else {
+                    if(nameInp) nameInp.required = false;
+                    if(addrInp) addrInp.required = false;
+                    if(photoField) photoField.style.display = 'block';
+                }
+                setRequiredStarForControl(nameInp, !!(nameInp && nameInp.required));
+                setRequiredStarForControl(addrInp, !!(addrInp && addrInp.required));
+                try{ const namaKk = document.querySelector('#modal-fields input[name="nama_kk"]'); setRequiredStarForControl(namaKk, !!(namaKk && namaKk.required)); }catch(e){}
+                syncRequiredFieldMarkers();
+            };
+            jenisSel.addEventListener('change', toggleReq);
+            // initialize
+            toggleReq();
+        }
+        // ensure assisted checkbox toggles assistance fields and resets fields when unchecked
+        try{
+            const assistedChk = document.querySelector('#modal-fields input[name="assisted"]');
+            const assistedDate = document.querySelector('#modal-fields input[name="last_assisted_at"]');
+            const assistedShape = document.querySelector('#modal-fields select[name="bentuk_bantuan"]');
+            const assistedNotes = document.querySelector('#modal-fields input[name="assistance_notes"]');
+            const assistanceBlock = document.getElementById('assistance-fields');
+            const assistedSourceValue = document.getElementById('sumber-bantuan-value');
+            window.assistanceSourceLoaded = false;
+            window.assistanceSourceItems = [];
+            populateAssistanceSourceOptions();
+            const assistedSourceSearch = document.getElementById('sumber-bantuan-search');
+            const assistedSourcePanel = document.getElementById('sumber-bantuan-panel');
+            const assistedSourceToggle = document.getElementById('sumber-bantuan-toggle');
+            if(assistedSourceSearch){
+                assistedSourceSearch.addEventListener('input', function(){
+                    if(assistedSourceValue) assistedSourceValue.value = '';
+                    renderAssistanceSourceOptions(this.value, false);
+                });
+                assistedSourceSearch.addEventListener('focus', function(){ renderAssistanceSourceOptions(this.value, false); });
+                assistedSourceSearch.addEventListener('click', function(){ renderAssistanceSourceOptions(this.value, false); });
+                assistedSourceSearch.addEventListener('blur', function(){ setTimeout(()=>{ if(assistedSourcePanel) assistedSourcePanel.classList.remove('show'); }, 140); });
+                assistedSourceSearch.addEventListener('keydown', function(ev){ if(ev.key === 'Escape' && assistedSourcePanel){ assistedSourcePanel.classList.remove('show'); } });
+            }
+            if(assistedSourceToggle){
+                assistedSourceToggle.addEventListener('click', function(){
+                    if(!assistedSourcePanel) return;
+                    if(assistedSourcePanel.classList.contains('show')){ assistedSourcePanel.classList.remove('show'); }
+                    else { renderAssistanceSourceOptions(assistedSourceSearch ? assistedSourceSearch.value : '', false); }
+                });
+            }
+            if(assistedSourcePanel){
+                assistedSourcePanel.addEventListener('scroll', function(){
+                    const nearBottom = this.scrollTop + this.clientHeight >= this.scrollHeight - 24;
+                    if(nearBottom) renderAssistanceSourceOptions(assistedSourceSearch ? assistedSourceSearch.value : '', true);
+                });
+                assistedSourcePanel.addEventListener('mouseleave', function(){ /* keep open until focus changes */ });
+                document.addEventListener('click', function closeSourcePanel(ev){
+                    const root = document.getElementById('assistance-fields');
+                    if(!root || !ev.target || !root.contains(ev.target)) return;
+                    if(ev.target === assistedSourceSearch || ev.target === assistedSourceToggle || assistedSourcePanel.contains(ev.target)) return;
+                }, { once: true });
+            }
+
+            const setDisabled = function(el, disabled){ if(!el) return; el.disabled = disabled; };
+            const toggleAssistFields = function(forceDate){ try{
+                const enabled = !!(assistedChk && assistedChk.checked);
+                if(assistanceBlock){ assistanceBlock.classList.toggle('is-enabled', enabled); assistanceBlock.classList.toggle('is-disabled', !enabled); }
+                [assistedDate, assistedSourceSearch, assistedSourceToggle, assistedShape, assistedNotes].forEach(el => setDisabled(el, !enabled));
+                if(enabled){
+                    if(assistedDate && (!assistedDate.value || forceDate)){ assistedDate.value = todayDateInputValue(); }
+                    if(assistedDate) assistedDate.required = true;
+                    if(assistedSourceSearch) assistedSourceSearch.required = true;
+                    if(assistedShape) assistedShape.required = true;
+                } else {
+                    // reset semua field ke kosong
+                    if(assistedDate){ assistedDate.required = false; assistedDate.value = ''; }
+                    if(assistedSourceValue){ assistedSourceValue.value = ''; }
+                    if(assistedSourceSearch){ assistedSourceSearch.required = false; assistedSourceSearch.value = ''; }
+                    if(assistedSourceSearch){ assistedSourceSearch.value = ''; }
+                    if(assistedSourcePanel){ assistedSourcePanel.classList.remove('show'); }
+                    if(assistedShape){ assistedShape.required = false; assistedShape.value = ''; }
+                    if(assistedNotes){ assistedNotes.value = ''; }
+                }
+                syncRequiredFieldMarkers();
+            }catch(e){} };
+            if(assistedChk){ assistedChk.addEventListener('change', function(){ toggleAssistFields(true); }); toggleAssistFields(false); }
+            setTimeout(()=>{ try{ syncAssistanceSourceSearch(); }catch(e){} }, 30);
+            setTimeout(()=>{ try{ syncRequiredFieldMarkers(); }catch(e){} }, 30);
+        }catch(e){}
+    }catch(e){}
+    const form = document.getElementById('modal-form');
+    form.onsubmit = function(ev){
+        ev.preventDefault();
+        try{
+            const assistedInput = form.querySelector('input[name="assisted"]');
+            const assistedActive = !!(assistedInput && assistedInput.checked);
+            const sourceValue = form.querySelector('#sumber-bantuan-value');
+            if(sourceValue && assistedActive){
+                const candidate = String(sourceValue.value || '').trim();
+                if(!candidate){
+                    const sourceSearch = form.querySelector('#sumber-bantuan-search');
+                    if(sourceSearch){ sourceSearch.setCustomValidity('Pilih sumber bantuan dari daftar'); sourceSearch.reportValidity(); }
+                    return;
+                }
+            }
+            const sourceSearch = form.querySelector('#sumber-bantuan-search');
+            if(sourceSearch) sourceSearch.setCustomValidity('');
+        }catch(e){}
+        if(!form.checkValidity()){ form.reportValidity(); return; }
+        const fd = new FormData(form);
+        const obj = {};
+        for(const [k,v] of fd.entries()) obj[k]=v;
+        const assistedField = form.querySelector('input[name="assisted"]');
+        const assistedActive = !!(assistedField && assistedField.checked);
+        obj.assisted = assistedActive ? 1 : 0;
+        if(assistedActive){
+            const sourceValue = form.querySelector('#sumber-bantuan-value');
+            const shapeInput = form.querySelector('select[name="bentuk_bantuan"]');
+            const notesInput = form.querySelector('input[name="assistance_notes"]');
+            const dateInput = form.querySelector('input[name="last_assisted_at"]');
+            if(sourceValue) obj.sumber_bantuan = sourceValue.value || '';
+            if(shapeInput) obj.bentuk_bantuan = shapeInput.value || '';
+            if(notesInput) obj.assistance_notes = notesInput.value || '';
+            if(dateInput) obj.last_assisted_at = dateInput.value || '';
+        } else {
+            obj.last_assisted_at = null;
+            obj.sumber_bantuan = null;
+            obj.bentuk_bantuan = null;
+            obj.assistance_notes = null;
+        }
+        // capture file input (if any) so callers can upload after modal closes
+        const fileInput = form.querySelector('input[name="photo"]');
+        const file = (fileInput && fileInput.files && fileInput.files[0]) ? fileInput.files[0] : null;
+        onSubmit(obj, file);
+        closeModal();
+        // clear current editing layer reference
+        currentEditingLayer = null;
+    };
+    document.getElementById('modal-cancel').onclick = closeModal;
+}
+function closeModal(){ const modal=document.getElementById('modal'); modal.classList.add('hidden'); modal.setAttribute('aria-hidden','true'); document.getElementById('modal-fields').innerHTML = ''; currentEditingLayer = null; try{ window.assistanceSourceFilter = null; }catch(e){} try{ const submit = document.getElementById('modal-submit'); if(submit){ submit.textContent = 'Simpan'; submit.className = 'btn-primary'; } }catch(e){} }
+
+function showMasjidRadius(marker){
+    hideMasjidRadius();
+    const center = marker.getLatLng();
+    const defaultRadius = 200;
+    masjidCircle = L.circle(center, {radius: defaultRadius, color:'#1976d2', fillOpacity:0.08, interactive:false}).addTo(map);
+
+    masjidControlEl = document.createElement('div'); masjidControlEl.id='masjid-radius-control';
+    try{ masjidControlEl.style.position='absolute'; masjidControlEl.style.right='10px'; masjidControlEl.style.bottom='20px'; masjidControlEl.style.zIndex='14000'; masjidControlEl.style.width='320px'; }catch(e){}
+    const rawName = marker._data && marker._data.nama ? String(marker._data.nama).trim() : '';
+    const typeLabel = marker._data && marker._data.jenis ? String(marker._data.jenis).charAt(0).toUpperCase() + String(marker._data.jenis).slice(1) : 'Tempat Ibadah';
+    const name = rawName !== '' ? rawName : '';
+    const alamat = marker._data && marker._data.alamat ? marker._data.alamat : '';
+    const recId = marker._data && marker._data.id ? marker._data.id : '';
+    // title
+    const titleEl = document.createElement('div'); titleEl.className = 'mc-title'; titleEl.textContent = (name || typeLabel); masjidControlEl.appendChild(titleEl);
+    // address
+    const addrEl = document.createElement('div'); addrEl.className = 'mc-address'; addrEl.textContent = alamat; masjidControlEl.appendChild(addrEl);
+    // controls (radius display + slider)
+    const controls = document.createElement('div'); controls.className = 'mc-controls';
+    const radiusWrap = document.createElement('div'); radiusWrap.className = 'mc-radius';
+    radiusWrap.innerHTML = `Radius (m): <input id="masjid-radius-input" type="number" min="50" max="3000" value="${defaultRadius}" style="width:110px;margin-left:8px;padding:6px;border-radius:6px;border:1px solid #e5e7eb">`;
+    const slider = document.createElement('input'); slider.type='range'; slider.id='masjid-radius-slider'; slider.min='50'; slider.max='3000'; slider.value = String(defaultRadius); slider.style.width='100%';
+    controls.appendChild(radiusWrap); controls.appendChild(slider); masjidControlEl.appendChild(controls);
+    // actions
+    const actions = document.createElement('div'); actions.className = 'mc-actions';
+    const isGuest = !window.currentUser;
+    const editBtn = document.createElement('button'); editBtn.id='masjid-edit'; editBtn.textContent='Edit';
+    const delBtn = document.createElement('button'); delBtn.id='masjid-delete'; delBtn.textContent='Hapus'; delBtn.className='destructive';
+    const closeBtn = document.createElement('button'); closeBtn.id='masjid-radius-close'; closeBtn.textContent='Tutup';
+    if(!isGuest){ actions.appendChild(editBtn); actions.appendChild(delBtn); } actions.appendChild(closeBtn); masjidControlEl.appendChild(actions);
+    // add masjid filter controls (interval inputs) - only for non-guest users
+    if(!isGuest){
+        const filterWrap = document.createElement('div'); filterWrap.style.marginTop = '10px';
+        filterWrap.innerHTML = `<div style="font-weight:600;margin-bottom:6px">Filter untuk pewarnaan (interval)</div>`+
+                               `<div style="display:flex;gap:8px;align-items:center;margin-bottom:6px"><label style="width:110px">Penghasilan (Rp)</label><input id="masjid-income-min" type="number" min="0" value="0" style="width:90px;padding:6px;border-radius:6px;border:1px solid #e5e7eb"> - <input id="masjid-income-max" type="number" min="0" placeholder="(max)" style="width:90px;padding:6px;border-radius:6px;border:1px solid #e5e7eb"></div>`+
+                               `<div style="display:flex;gap:8px;align-items:center;margin-bottom:6px"><label style="width:110px">Jumlah Anggota</label><input id="masjid-members-min" type="number" min="0" value="0" style="width:90px;padding:6px;border-radius:6px;border:1px solid #e5e7eb"> - <input id="masjid-members-max" type="number" min="0" placeholder="(max)" style="width:90px;padding:6px;border-radius:6px;border:1px solid #e5e7eb"></div>`+
+                               `<div style="text-align:right;margin-top:6px"><button id="masjid-filter-apply">Terapkan</button> <button id="masjid-filter-reset">Reset</button></div>`;
+        // create a toggle button to show/hide filter block
+        const filterToggle = document.createElement('button'); filterToggle.id='masjid-filter-toggle'; filterToggle.textContent = 'Filter ▾';
+        filterToggle.style.marginTop = '10px'; filterToggle.style.background = 'transparent'; filterToggle.style.border = '0'; filterToggle.style.color = '#0f172a'; filterToggle.style.cursor = 'pointer'; filterToggle.style.fontWeight = '600';
+        masjidControlEl.appendChild(filterToggle);
+        const filterContainer = document.createElement('div'); filterContainer.id = 'masjid-filter-container'; filterContainer.style.display = 'none';
+        try{ filterContainer.appendChild(filterWrap); masjidControlEl.appendChild(filterContainer); }catch(e){ console.error('failed to append filterWrap into container', e); }
+        // toggle behavior
+        try{
+            filterToggle.addEventListener('click', function(){
+                try{
+                    if(filterContainer.style.display === 'none' || !filterContainer.style.display){
+                        filterContainer.style.display = 'block';
+                        filterToggle.textContent = 'Filter ▴';
+                        masjidFiltersExpanded = true;
+                    } else {
+                        filterContainer.style.display = 'none';
+                        filterToggle.textContent = 'Filter ▾';
+                        masjidFiltersExpanded = false;
+                    }
+                    updateHomeColors(center, masjidCircle ? masjidCircle.getRadius() : defaultRadius);
+                }catch(e){ console.error('filter toggle failed', e); }
+            });
+        }catch(e){ console.error('filter toggle wiring failed', e); }
+        // wire filter controls (apply/reset)
+        try{
+            const miMin = document.getElementById('masjid-income-min');
+            const miMax = document.getElementById('masjid-income-max');
+            const mmMin = document.getElementById('masjid-members-min');
+            const mmMax = document.getElementById('masjid-members-max');
+            const applyBtn = document.getElementById('masjid-filter-apply');
+            const resetBtn = document.getElementById('masjid-filter-reset');
+            const applyFn = function(){ try{
+                const imin = miMin && miMin.value !== '' ? Number(miMin.value) : 0;
+                const imax = miMax && miMax.value !== '' ? Number(miMax.value) : null;
+                const mmin = mmMin && mmMin.value !== '' ? Number(mmMin.value) : 0;
+                const mmax = mmMax && mmMax.value !== '' ? Number(mmMax.value) : null;
+                masjidIncomeMin = isNaN(imin) ? 0 : imin;
+                masjidIncomeMax = (imax === null || isNaN(imax)) ? null : imax;
+                masjidMembersMin = isNaN(mmin) ? 0 : mmin;
+                masjidMembersMax = (mmax === null || isNaN(mmax)) ? null : mmax;
+                updateHomeColors(center, masjidCircle ? masjidCircle.getRadius() : defaultRadius);
+            }catch(e){console.error(e);} };
+            applyBtn && applyBtn.addEventListener('click', applyFn);
+            resetBtn && resetBtn.addEventListener('click', function(){ try{ if(miMin) miMin.value='0'; if(miMax) miMax.value=''; if(mmMin) mmMin.value='0'; if(mmMax) mmMax.value=''; masjidIncomeMin=0; masjidIncomeMax=null; masjidMembersMin=0; masjidMembersMax=null; updateHomeColors(center, masjidCircle ? masjidCircle.getRadius() : defaultRadius); }catch(e){} });
+        }catch(e){console.error('masjid filter wiring failed', e);} 
+    }
+    try{ document.body.appendChild(masjidControlEl); }catch(e){ console.error('failed to append masjidControlEl', e); }
+    slider.addEventListener('input', function(e){ const r = parseInt(e.target.value,10); try{ masjidCircle.setRadius(r); }catch(e){}; const num = document.getElementById('masjid-radius-input'); if(num) num.value = r; updateHomeColors(center, r); });
+    // allow user to type radius number directly; only apply during input when within range, enforce bounds on blur/Enter
+    try{
+        const numInp = document.getElementById('masjid-radius-input');
+        if(numInp){
+            numInp.addEventListener('input', function(ev){
+                const raw = this.value;
+                const v = parseInt(raw,10);
+                if(isNaN(v)) return; // allow typing
+                if(v >= 50 && v <= 3000){
+                    try{ slider.value = String(v); masjidCircle.setRadius(v); }catch(e){}
+                    
+                    updateHomeColors(center, v);
+                }
+            });
+            // enforce/clamp on blur
+            numInp.addEventListener('blur', function(){
+                let v = parseInt(this.value,10);
+                if(isNaN(v)){
+                    // reset to current slider value
+                    this.value = slider.value;
+                    return;
+                }
+                if(v < 50){ v = 50; this.value = v; try{ showToast('Radius minimal 50 m','error',2200); }catch(e){} }
+                if(v > 3000){ v = 3000; this.value = v; try{ showToast('Radius maksimal 3000 m','error',2200); }catch(e){} }
+                try{ slider.value = String(v); masjidCircle.setRadius(v); }catch(e){}
+                updateHomeColors(center, v);
+            });
+            // also apply on Enter
+            numInp.addEventListener('keydown', function(ev){ if(ev.key === 'Enter'){ this.blur(); } });
+        }
+    }catch(e){}
+    closeBtn.addEventListener('click', hideMasjidRadius);
+    if(!isGuest){
+        if(editBtn){ editBtn.addEventListener('click', function(){ hideMasjidRadius(); openEdit(recId); }); }
+        if(delBtn){ delBtn.addEventListener('click', function(){ hideMasjidRadius(); hapus(recId); }); }
+    }
+    updateHomeColors(center, defaultRadius);
+}
+function hideMasjidRadius(){
+    if(masjidCircle){ map.removeLayer(masjidCircle); masjidCircle=null; }
+    if(masjidControlEl){ masjidControlEl.remove(); masjidControlEl=null; }
+    // restore marker colors: assisted -> green, others -> red (clear masjid-filtering)
+    rumahMarkers.forEach(m=>{ try{ const assisted = m._data && (m._data.assisted && parseInt(m._data.assisted)===1); const color = assisted ? '#2e7d32' : '#d32f2f'; if(m && typeof m.setIcon === 'function'){ m.setIcon(createLocationPinIcon(color)); } }catch(e){} });
+}
+function updateHomeColors(centerLatLng, radiusMeters){
+    // If masjidCircle exists, prefer its center/radius for coloring
+    try{
+        if(masjidCircle){ centerLatLng = masjidCircle.getLatLng(); radiusMeters = masjidCircle.getRadius(); }
+    }catch(e){}
+    rumahMarkers.forEach(m=>{
+        try{
+            const latlng = m.getLatLng();
+            const dist = (centerLatLng && typeof centerLatLng.distanceTo === 'function') ? latlng.distanceTo(centerLatLng) : Infinity;
+            const assisted = m._data && (m._data.assisted && parseInt(m._data.assisted)===1);
+            // only apply masjid filters when masjidCircle is active AND the filter UI is expanded
+            const filtersActive = !!masjidCircle && !!masjidFiltersExpanded;
+            const incomeVal = (m._data && m._data.monthly_income !== undefined && m._data.monthly_income !== null && m._data.monthly_income !== '') ? Number(m._data.monthly_income) : null;
+            const membersVal = (m._data && m._data.members !== undefined && m._data.members !== null && m._data.members !== '') ? Number(m._data.members) : null;
+            const meetsIncome = filtersActive && (incomeVal !== null) && (Number(incomeVal) >= Number(masjidIncomeMin)) && (masjidIncomeMax === null || Number(incomeVal) <= Number(masjidIncomeMax));
+            const meetsMembers = filtersActive && (membersVal !== null) && (Number(membersVal) >= Number(masjidMembersMin)) && (masjidMembersMax === null || Number(membersVal) <= Number(masjidMembersMax));
+            // Use AND between filters: house must satisfy BOTH income AND members when filters are active
+            if(assisted || ((radiusMeters !== undefined && dist <= radiusMeters) && ( (!filtersActive) || (meetsIncome && meetsMembers) ))){
+                if(m && typeof m.setIcon === 'function'){ m.setIcon(createLocationPinIcon('#2e7d32')); }
+            } else {
+                if(m && typeof m.setIcon === 'function'){ m.setIcon(createLocationPinIcon('#d32f2f')); }
+            }
+        }catch(e){}
+    });
+}
+
+function loadData(){
+    try{ hideMasjidRadius(); }catch(e){}
+    fetch('src/api/get_lokasi.php', { credentials: 'same-origin', headers: buildHeaders(null) }).then(r=>r.json()).then(data=>{
+        lokasiGroup.clearLayers(); rumahBelumDibantuGroup.clearLayers(); rumahSudahDibantuGroup.clearLayers(); masjidGroup.clearLayers(); rumahMarkers.length=0; lokasiMarkerById = new Map();
+        lokasiRecords = Array.isArray(data) ? data : [];
+        let rumahCount=0, masjidCount=0;
+        lokasiRecords.forEach(item=>{
+            const jenis = (item.jenis||'').toLowerCase();
+            const alamatEsc = (item.alamat||'');
+            const color = isWorshipType(jenis) ? '#1976d2' : '#d32f2f';
+            if(jenis==='rumah' || isWorshipType(jenis)){
+                const marker = L.marker([item.latitude, item.longitude],{icon:createLocationPinIcon(color)});
+                marker._data = item; marker._jenis = jenis;
+                lokasiMarkerById.set(getRecordIdKey(item.id), marker);
+                let photoHtml = '';
+                if(item.photo_path){
+                    const sep = item.photo_path.indexOf('?') !== -1 ? '&' : '?';
+                    const photoUrl = item.photo_path + sep + 't=' + Date.now();
+                    photoHtml = `<div style="margin-top:6px"><a class="popup-image-link" href="${photoUrl}"><img src="${photoUrl}" style="max-width:160px;max-height:120px;cursor:pointer"></a></div>`;
+                }
+                if(isWorshipType(jenis)){
+                    masjidCount++;
+                    masjidGroup.addLayer(marker);
+                    marker.on('click', ()=>{ showMasjidRadius(marker); });
+                } else {
+                    rumahCount++;
+                    const assisted = item.assisted && parseInt(item.assisted)===1;
+                    const statusHtml = assisted ? "<span style='color:green'>Telah menerima bantuan bulan ini</span>" : "<span style='color:orange'>Belum menerima bantuan bulan ini</span>";
+                    const isGuest = !window.currentUser;
+                    const canAssistEdit = isCurrentUserManager() || isCurrentUserAdmin();
+                    const showEditBtn = canEditRecord(item) || (!isGuest && canAssistEdit);
+                    const actionHtml = showEditBtn
+                        ? `${canEditRecord(item) ? `<button onclick="hapus('${item.id}')">Hapus</button> ` : ''}<button onclick="openEdit('${item.id}')">Edit</button> <button class="popup-close" onclick="closePopupById('${item.id}')">Tutup</button>`
+                        : `<button class="popup-close" onclick="closePopupById('${item.id}')">Tutup</button>`;
+                    const popupTitle = isGuest ? 'Lokasi Bantuan' : (getDisplayName(item) || 'Lokasi Bantuan');
+                    const providerName = item && item.sumber_bantuan_name ? item.sumber_bantuan_name : '';
+                    const providerType = item && item.sumber_bantuan_jenis ? item.sumber_bantuan_jenis : '';
+                    const providerPrefixed = providerName ? ((providerType ? (providerType.charAt(0).toUpperCase() + providerType.slice(1)) + ' - ' : '') + providerName) : '';
+                    const providerHtml = assisted ? `<div style="font-size:13px;color:#475569;margin-top:6px">Pemberi: ${escapeHtml(providerPrefixed || '-')}</div>` : `<div style="font-size:13px;color:#9ca3af;margin-top:6px">Pemberi: -</div>`;
+                    const popupHtml = `<div class="location-popup location-popup-house"><div class="location-popup-title">${escapeHtml(popupTitle)}</div><div>${statusHtml}</div><div class="location-popup-meta">${escapeHtml(alamatEsc)}</div>${providerHtml}${!isGuest && photoHtml ? `<div class="location-popup-photo">${photoHtml}</div>` : ''}<div class="location-popup-actions">${actionHtml}</div></div>`;
+                    marker.bindPopup(popupHtml, { closeButton: false, maxWidth: 640, minWidth: 420, autoPanPadding: [24, 24] });
+                    rumahMarkers.push(marker);
+                    if(assisted) {
+                        marker.setIcon(createLocationPinIcon('#2e7d32'));
+                        rumahSudahDibantuGroup.addLayer(marker);
+                    } else {
+                        marker.setIcon(createLocationPinIcon('#d32f2f'));
+                        rumahBelumDibantuGroup.addLayer(marker);
+                    }
+                }
+                lokasiGroup.addLayer(marker);
+            } else {
+                const marker = L.marker([item.latitude, item.longitude]);
+                marker._data = item; marker._jenis = jenis;
+                lokasiMarkerById.set(getRecordIdKey(item.id), marker);
+                const canAssistEdit = isCurrentUserManager() || isCurrentUserAdmin();
+                const showEditBtn2 = canEditRecord(item) || canAssistEdit;
+                const actionHtml = showEditBtn2 ? `<button onclick=\"hapus('${item.id}')\">Hapus</button> <button onclick=\"openEdit('${item.id}')\">Edit</button>` : '';
+                marker.bindPopup(`<div class="location-popup"><div class="location-popup-title">${escapeHtml(item.nama || '')}</div><div class="location-popup-meta">${escapeHtml(alamatEsc)}</div><div class="location-popup-actions">${actionHtml}<button class="popup-close" onclick=\"closePopupById('${item.id}')\">Tutup</button></div></div>`, { closeButton: false, maxWidth: 520, minWidth: 360, autoPanPadding: [24, 24] });
+                lokasiGroup.addLayer(marker);
+            }
+        });
+        try{ const dbg = document.getElementById('debug-overlay'); if(dbg){ dbg.textContent = `Loaded ${lokasiRecords.length} lokasi — Rumah: ${rumahCount}, Masjid: ${masjidCount}`; } }catch(e){}
+        try{ updateHomeColors(map.getCenter(), 0); }catch(e){}
+        renderDataPanel();
+    }).catch(err=>console.error(err));
+}
+
+function hapus(id){
+    // show confirmation modal with record name (if available)
+    fetch('src/api/get_lokasi.php', { credentials: 'same-origin', headers: buildHeaders(null) }).then(r=>r.json()).then(arr=>{
+        const rec = (arr||[]).find(x=>String(x.id)===String(id));
+        const displayName = rec ? (rec.nama || rec.nama_kk || 'lokasi ini') : 'lokasi ini';
+        const html = `<input type="hidden" name="id" value="${id}"><p>Anda yakin ingin menghapus <b>${displayName}</b>? Tindakan ini <b>tidak dapat dibatalkan</b>.</p>`;
+        openModal('Konfirmasi Hapus', html, function(values){
+            (async function(){
+                try{
+                    const resp = await fetch('src/api/hapus_lokasi.php',{method:'POST',headers:buildHeaders(),body:JSON.stringify({id:id})});
+                    const jr = await resp.json().catch(()=>null);
+                    if(jr && jr.success===false){ showToast('Gagal menghapus: ' + (jr.error||'unknown'), 'error', 6000); }
+                }catch(e){ console.error('hapus failed', e); showToast('Gagal menghapus lokasi', 'error', 6000); }
+                loadData();
+            })();
+        });
+        // style the submit button as destructive for this confirmation
+        try{ const submit = document.getElementById('modal-submit'); if(submit){ submit.textContent = 'Hapus'; submit.className = 'btn-destructive'; } }catch(e){}
+    }).catch(err=>{ console.error(err); showToast('Gagal memuat data lokasi', 'error', 4000); });
+}
+
+function openEdit(id){
+    // fetch record then open modal
+    fetch('src/api/get_lokasi.php', { credentials: 'same-origin', headers: buildHeaders(null) }).then(r=>r.json()).then(arr=>{
+        const rec = (arr||[]).find(x=>String(x.id)===String(id));
+        if(!rec){ showToast('Record tidak ditemukan', 'error', 4200); return; }
+        const isAdmin = isCurrentUserAdmin();
+        const isManager = isCurrentUserManager();
+        const isOwner = String(rec && rec.created_by ? rec.created_by : '') === String(window.currentUser && window.currentUser.id ? window.currentUser.id : '');
+        const canFullEdit = isAdmin || (isManager && isOwner);
+        if(!canFullEdit && !isManager){
+            showToast('Anda hanya bisa mengedit data milik Anda sendiri', 'error', 5000);
+            return;
+        }
+
+        // If manager but not owner, allow assistance-only edit (restricted modal)
+        if(isManager && !isOwner && !isAdmin){
+            const hasNamaKk = rec && rec.nama_kk && !/^[-–—\s]+$/.test(String(rec.nama_kk || '').trim());
+            const kepalaKeluargaHtml = hasNamaKk ? `<div style="margin-top:8px"><strong>Nama Kepala Keluarga</strong><div style="margin-top:6px">${escapeHtml(rec.nama_kk)}</div></div>` : '';
+            const namaFallbackHtml = !hasNamaKk ? `<div><strong>Nama</strong><div style="margin-top:6px">${escapeHtml(getDisplayName(rec) || '')}</div></div>` : '';
+            const html = `<input type="hidden" name="id" value="${rec.id}">`+
+                `${namaFallbackHtml}`+
+                `${kepalaKeluargaHtml}`+
+                `<div style="margin-top:8px"><strong>Alamat</strong><div style="margin-top:6px">${escapeHtml(rec.alamat || '')}</div></div>`+
+                `${buildAssistanceFieldsHtml(rec)}`;
+            // restrict assistance source to worship places created by current manager
+            try{ window.assistanceSourceFilter = { createdBy: window.currentUser && window.currentUser.id ? window.currentUser.id : null, worshipOnly: true }; }catch(e){}
+            openModal('Edit Bantuan', html, function(values){
+                const payload = { id: rec.id };
+                // only submit assistance-related fields
+                payload.assisted = values.assisted ? 1 : 0;
+                payload.last_assisted_at = values.last_assisted_at || null;
+                payload.sumber_bantuan = values.sumber_bantuan || '';
+                payload.bentuk_bantuan = values.bentuk_bantuan || '';
+                payload.assistance_notes = values.assistance_notes || '';
+                (async function(){
+                    try{
+                        const resp = await fetch('src/api/update_lokasi.php',{method:'POST',headers:buildHeaders(),body:JSON.stringify(payload),credentials:'same-origin'});
+                        const jr = await resp.json().catch(()=>null);
+                        if(!resp.ok || (jr && jr.success===false)){
+                            showToast('Gagal memperbarui data bantuan', 'error', 5000);
+                        } else {
+                            try{ showToast('Perubahan bantuan tersimpan', 'success', 3000); }catch(e){}
+                        }
+                    }catch(e){ console.error(e); showToast('Gagal memperbarui data bantuan', 'error', 5000); }
+                    loadData();
+                })();
+            });
+            return;
+        }
+
+        const householdHtml = (rec.jenis === 'rumah') ?
+            `<div id="household-fields">`+
+            `<label>Nama Kepala Keluarga <input name="nama_kk" type="text" value="${rec.nama_kk||''}" required></label><div class="hf-phone-slot"></div><label>Status Rumah <input name="rumah_status" type="text" value="${rec.rumah_status||''}"></label><label>Jumlah Anggota <input name="members" type="number" value="${rec.members||''}" required></label><label>Penghasilan Bulanan (Rp) <input name="monthly_income" type="number" step="1" min="0" value="${(rec.monthly_income !== undefined && rec.monthly_income !== null && rec.monthly_income !== '') ? Math.round(Number(rec.monthly_income)) : ''}" required></label><div style="font-size:12px;color:#666;margin-top:4px">Masukkan nilai dalam Rupiah, tanpa simbol (contoh: 2000000)</div>`+
+              `</div>` : `<div id="household-fields"></div>`;
+
+        const html = `<input type=\"hidden\" name=\"id\" value=\"${rec.id}\">`+
+            `<label>Jenis <select name=\"jenis\" required><option value=\"\">Pilih jenis</option><option value=\"rumah\">Rumah</option><option value=\"masjid\">Masjid</option><option value=\"gereja\">Gereja</option><option value=\"pura\">Pura</option><option value=\"vihara\">Vihara</option><option value=\"klenteng\">Klenteng</option></select></label>`+
+            `<div id=\"nama-field\" style=\"display:block\"><label>Nama <input name=\"nama\" type=\"text\" value=\"${rec.nama||''}\"></label></div>`+
+            `${householdHtml}`+
+            `<label>No Telp <input name=\"no_telp\" type=\"text\" value=\"${rec.no_telp||''}\"></label>`+
+            `<label>Alamat <input name=\"alamat\" type=\"text\" value=\"${rec.alamat||''}\"></label>`+
+            `${buildAssistanceFieldsHtml(rec)}`+
+            `<div id=\"photo-field\" style=\"display:none\"><label>Foto Rumah <input name=\"photo\" type=\"file\" accept=\"image/*\"></label><div id=\"current-photo-name\" style=\"font-size:12px;color:#444;margin-top:6px\"></div></div>`;
+        // clear any assistance source filter for full edit
+        try{ window.assistanceSourceFilter = null; }catch(e){}
+        openModal('Edit Lokasi', html, function(values, file){
+            const payload = {id: id, nama: values.nama||'', jenis: values.jenis||'rumah', no_telp: values.no_telp||'', alamat: values.alamat||'', nama_kk: values.nama_kk||null, rumah_status: values.rumah_status||null, members: values.members||null, monthly_income: values.monthly_income||null };
+            const assistedOn = values.assisted ? 1 : 0;
+            payload.assisted = assistedOn;
+            if(assistedOn){
+                payload.last_assisted_at = values.last_assisted_at || '';
+                payload.sumber_bantuan = values.sumber_bantuan || '';
+                payload.bentuk_bantuan = values.bentuk_bantuan || '';
+                payload.assistance_notes = values.assistance_notes || '';
+            } else {
+                payload.last_assisted_at = null;
+                payload.sumber_bantuan = null;
+                payload.bentuk_bantuan = null;
+                payload.assistance_notes = null;
+            }
+            (async function(){
+                try{
+                    const respUpdate = await fetch('src/api/update_lokasi.php',{method:'POST',headers:buildHeaders(),body:JSON.stringify(payload),credentials:'same-origin'});
+                    const jrUpdate = await respUpdate.json().catch(()=>null);
+                    if(!respUpdate.ok || (jrUpdate && jrUpdate.success===false)){
+                        const reason = jrUpdate && jrUpdate.error ? jrUpdate.error : 'unknown';
+                        showToast('Gagal menyimpan perubahan: ' + reason, 'error', 6000);
+                    } else {
+                        try{ showToast('Perubahan tersimpan', 'success', 2600); }catch(e){}
+                        // optimistically update marker on the map so UI reflects change immediately
+                        try{
+                            const idStr = String(id);
+                            const m = rumahMarkers.find(x=> x && x._data && String(x._data.id)===idStr);
+                            if(m){
+                                try{ m._data = Object.assign({}, m._data || {}, payload); }catch(e){}
+                                // Recompute colors using centralized logic (includes assisted, masjid radius and filters)
+                                try{ updateHomeColors(map.getCenter(), 0); }catch(e){}
+                                // update popup content if present
+                                try{
+                                    const pd = m._data || {};
+                                    const statusHtml = (pd.assisted && parseInt(pd.assisted)===1) ? "<span style='color:green'>Telah menerima bantuan</span>" : "<span style='color:orange'>Belum menerima bantuan</span>";
+                                    const alamatEsc = pd.alamat || '';
+                                    let photoHtml = '';
+                                    if(pd.photo_path){ const sep = pd.photo_path.indexOf('?') !== -1 ? '&' : '?'; const photoUrl = pd.photo_path + sep + 't=' + Date.now(); photoHtml = `<div style="margin-top:6px"><a class="popup-image-link" href="${photoUrl}"><img src="${photoUrl}" style="max-width:160px;max-height:120px;cursor:pointer"></a></div>`; }
+                                    const nameLabel = pd.nama || pd.nama_kk || '';
+                                    const actionHtml = canEditRecord(pd) ? `<br><button onclick="hapus('${pd.id}')">Hapus</button> <button onclick="openEdit('${pd.id}')">Edit</button>` : '';
+                                    const newPopupHtml = `<b>${nameLabel}</b><br>${statusHtml}<div style="font-size:12px;color:#444;margin-top:6px">${alamatEsc}</div>${photoHtml}${actionHtml}`;
+                                    try{ const p = m.getPopup && m.getPopup(); if(p){ p.setContent(newPopupHtml); } }catch(e){}
+                                }catch(e){}
+                            }
+                        }catch(e){}
+                    }
+                }catch(e){ console.error('update failed', e); showToast('Gagal menyimpan perubahan: ' + (e && e.message ? e.message : e), 'error', 6000); }
+                // use captured file from modal submit
+                if(file){
+                    try{
+                        const fdata = new FormData(); fdata.append('file', file); fdata.append('id', id);
+                        const resp = await fetch('src/api/upload_photo.php',{method:'POST',headers:buildHeaders(null),body:fdata,credentials:'same-origin'});
+                        const jr = await resp.json().catch(()=>null);
+                        if(!jr || !jr.success){
+                            const reason = jr && (jr.error || (jr.last_error && jr.last_error.message)) ? (jr.error || jr.last_error.message) : 'unknown';
+                            showToast('Gagal mengunggah foto: ' + reason, 'error', 7000);
+                        } else {
+                            showToast('Foto berhasil diunggah', 'success', 3000);
+                        }
+                    }catch(e){ console.error('upload failed',e); showToast('Gagal mengunggah foto: ' + (e && e.message ? e.message : e), 'error', 7000); }
+                }
+                loadData();
+            })();
+        });
+        // populate household fields
+        setTimeout(()=>{
+            const sel = document.querySelector('#modal-fields select[name="jenis"]'); if(sel) sel.value = rec.jenis||'rumah';
+            // if this record has a fixed jenis (rumah or masjid), prevent changing jenis in edit mode
+            try{
+                const recJenis = (rec.jenis||'').toLowerCase();
+                if(sel && (recJenis==='rumah' || isWorshipType(recJenis))){
+                    sel.disabled = true;
+                    // ensure a hidden input exists so the jenis value is submitted
+                    let existing = document.querySelector('#modal-fields input[type="hidden"][name="jenis"]');
+                    if(!existing){
+                        const hin = document.createElement('input'); hin.type='hidden'; hin.name='jenis'; hin.value = rec.jenis||''; document.getElementById('modal-fields').appendChild(hin);
+                    } else {
+                        try{ existing.value = rec.jenis||''; }catch(e){}
+                    }
+                } else if(sel){
+                    sel.disabled = false;
+                    const existing = document.querySelector('#modal-fields input[type="hidden"][name="jenis"]'); if(existing) try{ existing.remove(); }catch(e){}
+                }
+            }catch(e){}
+            const hf = document.getElementById('household-fields'); const namaField=document.getElementById('nama-field'); const assistanceFields=document.getElementById('assistance-fields'); const photoField=document.getElementById('photo-field');
+            function render(){
+                if(!hf) return;
+                if(sel && sel.value==='rumah'){
+                    hf.innerHTML = `<label>Nama Kepala Keluarga <input name=\"nama_kk\" type=\"text\" value=\"${rec.nama_kk||''}\" required></label><div class=\"hf-phone-slot\"></div><label>Status Rumah <input name=\"rumah_status\" type=\"text\" value=\"${rec.rumah_status||''}\"></label><label>Jumlah Anggota <input name=\"members\" type=\"number\" value=\"${rec.members||''}\" required></label><label>Penghasilan Bulanan (Rp) <input name=\"monthly_income\" type=\"number\" step=\"1\" min=\"0\" value=\"${(rec.monthly_income !== undefined && rec.monthly_income !== null && rec.monthly_income !== '') ? Math.round(Number(rec.monthly_income)) : ''}\" required></label><div style=\"font-size:12px;color:#666;margin-top:4px\">Masukkan nilai dalam Rupiah, tanpa simbol (contoh: 2000000)</div>`;
+                    if(namaField) namaField.style.display='none';
+                    if(assistanceFields) assistanceFields.style.display='block';
+                    if(photoField) photoField.style.display='block';
+                    try{ const assistChk = document.querySelector('#modal-fields input[name="assisted"]'); if(assistChk && assistChk.checked === false){ assistChk.dispatchEvent(new Event('change')); } }catch(e){}
+                    try{
+                        const slot = hf.querySelector('.hf-phone-slot');
+                        let phoneInput = document.querySelector('#modal-fields input[name="no_telp"]');
+                        let phoneLabel = phoneInput ? phoneInput.closest('label') : null;
+                        if(!phoneLabel){
+                            // create a labeled phone input inside the slot
+                            phoneLabel = document.createElement('label');
+                            phoneLabel.innerHTML = 'No Telp <input name="no_telp" type="text">';
+                            phoneInput = phoneLabel.querySelector('input[name="no_telp"]');
+                            if(phoneInput && rec && rec.no_telp) phoneInput.value = rec.no_telp || '';
+                        }
+                        // append into slot (dedupe if another exists elsewhere)
+                        if(slot && phoneLabel && slot.firstChild !== phoneLabel){
+                            slot.appendChild(phoneLabel);
+                        }
+                        // remove any duplicate top-level phone labels (except the one we appended)
+                        Array.from(document.querySelectorAll('#modal-fields label')).forEach(l=>{
+                            if(l !== phoneLabel && l.querySelector && l.querySelector('input[name="no_telp"]')){
+                                try{ l.remove(); }catch(e){}
+                            }
+                        });
+                    }catch(e){}
+                } else {
+                    hf.innerHTML='';
+                    if(namaField) namaField.style.display='block';
+                    if(assistanceFields) assistanceFields.style.display='none';
+                    if(photoField) photoField.style.display='none';
+                    try{ const assistChk = document.querySelector('#modal-fields input[name="assisted"]'); if(assistChk && assistChk.checked){ assistChk.checked = false; assistChk.dispatchEvent(new Event('change')); } }catch(e){}
+                    try{
+                        const moved = hf.querySelector('.hf-phone-slot > label');
+                        if(moved){ const addr = document.querySelector('#modal-fields input[name=\"alamat\"]'); if(addr && addr.parentNode){ addr.parentNode.parentNode.insertBefore(moved, addr.parentNode); } }
+                    }catch(e){}
+                }
+            }
+            if(sel) sel.addEventListener('change', render); render();
+            try{
+                const f = document.querySelector('#modal-fields input[name="nama_kk"]'); if(f) f.value = rec.nama_kk||'';
+                const rs = document.querySelector('#modal-fields input[name="rumah_status"]'); if(rs) rs.value = rec.rumah_status||'';
+                const mem = document.querySelector('#modal-fields input[name="members"]'); if(mem) mem.value = (rec.members !== undefined && rec.members !== null) ? rec.members : '';
+                const mi = document.querySelector('#modal-fields input[name="monthly_income"]');
+                if(mi){
+                    if(rec.monthly_income !== undefined && rec.monthly_income !== null && rec.monthly_income !== ''){
+                        try{ mi.value = String(Math.round(Number(rec.monthly_income))); }catch(e){ try{ const raw = String(rec.monthly_income); mi.value = raw.replace(/\.00$/,'').replace(/\.0$/,''); }catch(ee){ mi.value = rec.monthly_income; } }
+                    } else { mi.value = ''; }
+                }
+                const p = document.querySelector('#modal-fields input[name="no_telp"]'); if(p) p.value = rec.no_telp||'';
+                const fa = document.querySelector('#modal-fields input[name="assisted"]'); if(fa) fa.checked = rec.assisted && parseInt(rec.assisted)===1;
+                const fd = document.querySelector('#modal-fields input[name="last_assisted_at"]'); if(fd) fd.value = rec.last_assisted_at ? rec.last_assisted_at.split(' ')[0] : '';
+                if(fa){ try{ fa.dispatchEvent(new Event('change')); }catch(e){} }
+                const fs = document.querySelector('#sumber-bantuan-value');
+                if(fs){
+                    const currentValue = String(rec.sumber_bantuan || '');
+                    fs.value = currentValue;
+                }
+                const fb = document.querySelector('#modal-fields select[name="bentuk_bantuan"]'); if(fb) fb.value = rec.bentuk_bantuan||'';
+                // bantuan_terakhir removed from schema; skip showing historical assistance
+                const fn = document.querySelector('#modal-fields input[name="assistance_notes"]'); if(fn) fn.value = rec.assistance_notes||'';
+                try{ setTimeout(()=>{ syncAssistanceSourceSearch(); }, 40); }catch(e){}
+                // ensure top-level name and alamat are set as well
+                const nameTop = document.querySelector('#modal-fields input[name="nama"]'); if(nameTop) nameTop.value = rec.nama||'';
+                const addrTop = document.querySelector('#modal-fields input[name="alamat"]'); if(addrTop) addrTop.value = rec.alamat||'';
+                // ensure phone moved into slot after values populated
+                requestAnimationFrame(()=>{ try{ movePhoneToSlot(); }catch(e){}; setTimeout(()=>{ try{ movePhoneToSlot(); }catch(e){} },10); });
+                // show current photo filename (instead of browser 'No file chosen')
+                const photoNameEl = document.getElementById('current-photo-name');
+                if(photoNameEl){
+                    if(rec.photo_path){
+                                let bn = '';
+                                let urlRaw = rec.photo_path || '';
+                                try{
+                                    // If the stored path is the serve_upload fallback, extract the `f` query value
+                                    const m = urlRaw.match(/[?&]f=([^&]+)/);
+                                    if(m && m[1]){
+                                        bn = decodeURIComponent(m[1]);
+                                    }
+                                }catch(e){}
+                                if(!bn){ bn = (urlRaw||'').split('/').pop().split('?')[0]; }
+                                const url = urlRaw + (urlRaw.indexOf('?') !== -1 ? '&' : '?') + 't=' + Date.now();
+                        photoNameEl.innerHTML = `Foto saat ini: <a href=\"${url}\" target=\"_blank\">${bn}</a>`;
+                    } else {
+                        photoNameEl.innerHTML = '';
+                    }
+                }
+                // ensure jenis select reflects current value (or placeholder)
+                try{ const sel = document.querySelector('#modal-fields select[name="jenis"]'); if(sel){ sel.value = rec.jenis||''; sel.dispatchEvent(new Event('change')); } }catch(e){}
+            // after populating values, ensure phone moved into household for rumah
+            try{ requestAnimationFrame(()=>{ try{ movePhoneToSlot(); }catch(e){}; setTimeout(()=>{ try{ movePhoneToSlot(); }catch(e){} },10); }); }catch(e){}
+            }catch(e){}
+                // if this is a place of worship and name empty, attempt reverse geocode to suggest a name
+            try{
+                if(isWorshipType((rec.jenis||'').toLowerCase()) && (!rec.nama || rec.nama.trim()==='') && rec.latitude && rec.longitude){
+                    (async function(){ const rev = await reverseGeocode(rec.latitude, rec.longitude); const wt = rev ? detectWorshipType(rev) : null; if(rev && wt){ const nameInp = document.querySelector('#modal-fields input[name="nama"]'); if(nameInp && !nameInp.value) nameInp.value = extractNameFromResult(rev); } })();
+                }
+            }catch(e){}
+        },50);
+    });
+}
+
+// Leaflet.draw: add draw control for adding markers
+const drawControl = new L.Control.Draw({
+    draw: { marker: true, polyline: false, polygon: false, rectangle: false, circle: false, circlemarker: false },
+    edit: { featureGroup: lokasiGroup, edit: false, remove: false }
+});
+// image viewer: delegate clicks from popup thumbnails and filename links
+function openImageViewer(url){
+    try{
+        const viewer = document.getElementById('image-viewer');
+        const img = document.getElementById('image-viewer-img');
+        if(!viewer || !img) return;
+        img.src = url;
+        viewer.style.display = 'flex';
+    }catch(e){ console.error(e); }
+}
+
+function isPreviewableImage(path){
+    if(!path) return false;
+    return /\.(png|jpe?g|gif|webp|svg)(\?|#|$)/i.test(String(path));
+}
+
+function openProofPreview(path){
+    if(!path) return;
+    if(isPreviewableImage(path)){
+        openImageViewer(path + (path.indexOf('?') !== -1 ? '&' : '?') + 't=' + Date.now());
+        return;
+    }
+    window.open(path, '_blank', 'noopener,noreferrer');
+}
+document.addEventListener('click', function(ev){
+    try{
+        const a = ev.target.closest && ev.target.closest('a');
+        if(!a) return;
+        const href = a.getAttribute('href') || '';
+                        if(a.classList.contains('popup-image-link') || href.indexOf('/uploads/')!==-1){
+            ev.preventDefault();
+            openImageViewer(href + (href.indexOf('?')!==-1 ? '&' : '?') + 't=' + Date.now());
+        }
+    }catch(e){}
+}, false);
+const ivClose = document.getElementById('image-viewer-close'); if(ivClose){ ivClose.addEventListener('click', function(){ const v=document.getElementById('image-viewer'); const i=document.getElementById('image-viewer-img'); if(v) v.style.display='none'; if(i) i.src=''; }); }
+
+// Non-blocking toast helper
+function showToast(message, type='error', timeout=5000){
+    try{
+        const container = document.getElementById('toast-container'); if(!container) return;
+        const t = document.createElement('div'); t.className = 'toast ' + (type||'error'); t.textContent = message;
+        container.appendChild(t);
+        // show
+        requestAnimationFrame(()=> t.classList.add('show'));
+        setTimeout(()=>{ t.classList.remove('show'); setTimeout(()=>{ try{ t.remove(); }catch(e){} },200); }, timeout);
+    }catch(e){ console.error('toast error', e); }
+}
+
+map.addControl(drawControl);
+
+map.on(L.Draw.Event.CREATED, function (e) {
+    const layer = e.layer;
+    if(e.layerType === 'marker'){
+        if(!window.currentUser){
+            showToast('Harus login terlebih dahulu untuk menambah data', 'error', 4000);
+            map.removeLayer(layer);
+            return;
+        }
+        const latlng = layer.getLatLng();
+        currentEditingLayer = layer;
+        const html = `<label>Jenis <select name="jenis" required><option value="">Pilih jenis</option><option value="rumah">Rumah</option><option value="masjid">Masjid</option><option value="gereja">Gereja</option><option value="pura">Pura</option><option value="vihara">Vihara</option><option value="klenteng">Klenteng</option></select></label>`+
+            `<div id="form-details-wrapper" style="display:none"><div id="nama-field"><label>Nama <input name="nama" type="text"></label></div>`+
+            `<div id="household-fields"></div>`+
+            `<label>No Telp <input name="no_telp" type="text"></label>`+
+            `<label>Alamat <input name="alamat" type="text"></label>`+
+            `${buildAssistanceFieldsHtml({assisted:false})}`+
+            `<div id="photo-field-create"><label>Foto <input name="photo" type="file" accept="image/*"></label></div></div>`;
+        openModal('Tambah Lokasi', html, function(values, file){
+            (async function(){
+                const usedLatLng = (currentEditingLayer && typeof currentEditingLayer.getLatLng === 'function') ? currentEditingLayer.getLatLng() : latlng;
+                const payload = { nama: values.nama||'', jenis: values.jenis||'rumah', no_telp: values.no_telp||'', alamat: values.alamat||'', nama_kk: values.nama_kk||null, rumah_status: values.rumah_status||null, members: values.members||null, monthly_income: values.monthly_income||null, latitude: usedLatLng.lat, longitude: usedLatLng.lng };
+                const assistedOn = values.assisted ? 1 : 0;
+                payload.assisted = assistedOn;
+                if(assistedOn){
+                    payload.last_assisted_at = values.last_assisted_at || '';
+                    payload.sumber_bantuan = values.sumber_bantuan || '';
+                    payload.bentuk_bantuan = values.bentuk_bantuan || '';
+                    payload.assistance_notes = values.assistance_notes || '';
+                }
+                try{
+                    const res = await fetch('src/api/tambah_lokasi.php',{method:'POST',headers:buildHeaders(),body:JSON.stringify(payload),credentials:'same-origin'});
+                    const j = await res.json().catch(()=>null);
+                    const newId = j && j.id ? j.id : null;
+                    if(newId && file){
+                        try{
+                            const fdata = new FormData(); fdata.append('file', file); fdata.append('id', newId);
+                            const resp = await fetch('src/api/upload_photo.php',{method:'POST',headers:buildHeaders(null),body:fdata,credentials:'same-origin'});
+                            const jr = await resp.json().catch(()=>null);
+                            if(!jr || !jr.success){
+                                const reason = jr && (jr.error || (jr.last_error && jr.last_error.message)) ? (jr.error || jr.last_error.message) : 'unknown';
+                                showToast('Gagal mengunggah foto: ' + reason, 'error', 7000);
+                            } else {
+                                showToast('Foto berhasil diunggah', 'success', 3000);
+                            }
+                        }catch(e){ console.error('upload failed',e); showToast('Gagal mengunggah foto: ' + (e && e.message ? e.message : e), 'error', 7000); }
+                    }
+                }catch(e){ console.error(e); }
+                loadData();
+            })();
+        });
+        // populate household fields and wire jenis change like edit modal (run for this modal instance)
+        setTimeout(()=>{
+            const sel = document.querySelector('#modal-fields select[name="jenis"]'); if(sel) sel.value = '';
+            const hf = document.getElementById('household-fields'); const namaField=document.getElementById('nama-field'); const assistanceFields=document.getElementById('assistance-fields'); const photoField=document.getElementById('photo-field-create');
+            const detailsWrapper = document.getElementById('form-details-wrapper');
+            const assistedSourceSearch = document.getElementById('sumber-bantuan-search');
+            function render(){ if(!hf) return; const v = (sel && sel.value)||'';
+                if(detailsWrapper) detailsWrapper.style.display = v ? 'block' : 'none';
+
+                if(sel && v==='rumah'){ hf.innerHTML = `<label>Nama Kepala Keluarga <input name="nama_kk" type="text" required></label><div class="hf-phone-slot"></div><label>Status Rumah <input name="rumah_status" type="text"></label><label>Jumlah Anggota <input name="members" type="number" required></label><label>Penghasilan Bulanan (Rp) <input name="monthly_income" type="number" step="1" min="0" required></label><div style="font-size:12px;color:#666;margin-top:4px">Masukkan nilai dalam Rupiah, tanpa simbol (contoh: 2000000)</div>`; if(namaField) namaField.style.display='none'; if(assistanceFields) assistanceFields.style.display='block'; if(photoField) photoField.style.display='block'; try{ const assistChk = document.querySelector('#modal-fields input[name="assisted"]'); if(assistChk && assistChk.checked === false){ assistChk.dispatchEvent(new Event('change')); } }catch(e){}
+                        movePhoneToSlot();
+                    } else if(isWorshipType(v)) { hf.innerHTML=''; if(namaField) namaField.style.display='block'; if(assistanceFields) assistanceFields.style.display='none'; if(photoField) photoField.style.display='none'; try{ const assistChk = document.querySelector('#modal-fields input[name="assisted"]'); if(assistChk && assistChk.checked){ assistChk.checked = false; assistChk.dispatchEvent(new Event('change')); } }catch(e){}
+                        // require name for worship types
+                        try{ const nameInput = document.querySelector('#modal-fields input[name="nama"]'); if(nameInput) nameInput.required = true; }catch(e){}
+                        movePhoneBackBeforeAddress();
+                    } else if(v) { hf.innerHTML=''; if(namaField) namaField.style.display='block'; if(assistanceFields) assistanceFields.style.display='none'; if(photoField) photoField.style.display='none'; try{ const assistChk = document.querySelector('#modal-fields input[name="assisted"]'); if(assistChk && assistChk.checked){ assistChk.checked = false; assistChk.dispatchEvent(new Event('change')); } }catch(e){}
+                        // non-worship non-rumah
+                        try{ const nameInput = document.querySelector('#modal-fields input[name="nama"]'); if(nameInput) nameInput.required = false; }catch(e){}
+                        movePhoneBackBeforeAddress();
+                    } }
+            syncRequiredFieldMarkers();
+            if(sel) sel.addEventListener('change', render); render();
+            // ensure phone positioned correctly after populating
+            try{ movePhoneToSlot(); }catch(e){}
+        },50);
+        // do a reverse geocode to prefill address/name where possible
+        (async function(){ try{ const rev = await reverseGeocode(latlng.lat, latlng.lng); if(rev && rev.display_name){ const addrInp = document.querySelector('#modal-fields input[name="alamat"]'); if(addrInp){ addrInp.value = rev.display_name; addrInp.dataset.lat = latlng.lat; addrInp.dataset.lon = latlng.lng; } const wt = detectWorshipType(rev); if(wt){ const nameInp = document.querySelector('#modal-fields input[name="nama"]'); if(nameInp && !nameInp.value){ nameInp.value = extractNameFromResult(rev); } } } }catch(e){} })();
+    }
+});
+// Layer control (ensure visible)
+const overlays = {
+    [buildLayerLegendLabel('Rumah belum dibantu', '#d32f2f')]: rumahBelumDibantuGroup,
+    [buildLayerLegendLabel('Rumah sudah dibantu', '#2e7d32')]: rumahSudahDibantuGroup,
+    [buildLayerLegendLabel('Tempat Ibadah', '#1976d2', 'marker biru')]: masjidGroup,
+    'Lokasi': lokasiGroup
+};
+L.control.layers(null, overlays, { position: 'topright', collapsed: false }).addTo(map);
+setTimeout(attachTopRightControls, 0);
+setTimeout(attachTopRightControls, 50);
+setTimeout(attachTopRightControls, 200);
+
+// Tab switching removed - full screen map only
+
+try{
+    const worshipBtn = document.getElementById('data-view-worship');
+    const houseBtn = document.getElementById('data-view-house');
+    if(worshipBtn) worshipBtn.addEventListener('click', function(){ setDataPanelView('worship'); });
+    if(houseBtn) houseBtn.addEventListener('click', function(){ setDataPanelView('house'); });
+    renderDataPanel();
+}catch(e){}
+
+try{
+    const loginBtn = document.getElementById('auth-login-btn');
+    const logoutBtn = document.getElementById('auth-logout-btn');
+    const adminBtn = document.getElementById('admin-dashboard-btn');
+    const authCancelBtn = document.getElementById('auth-modal-cancel');
+    const adminCloseBtn = document.getElementById('admin-modal-close');
+    const adminDetailCloseBtn = document.getElementById('admin-detail-close');
+    
+    if(loginBtn) loginBtn.addEventListener('click', function(){ openAuthModal('login'); });
+    if(logoutBtn) logoutBtn.addEventListener('click', function(){ logoutUser(); });
+    if(adminBtn) adminBtn.addEventListener('click', function(){ openAdminDashboard(); });
+    if(authCancelBtn) authCancelBtn.addEventListener('click', function(){ closeAuthModal(); });
+    if(adminCloseBtn) adminCloseBtn.addEventListener('click', function(){ closeAdminDashboard(); });
+    if(adminDetailCloseBtn) adminDetailCloseBtn.addEventListener('click', function(){ closePendingManagerDetail(); });
+    
+    document.getElementById('auth-modal').addEventListener('click', function(ev){ if(ev.target === this) closeAuthModal(); });
+    document.getElementById('admin-modal').addEventListener('click', function(ev){ if(ev.target === this) closeAdminDashboard(); });
+    document.getElementById('admin-detail-modal').addEventListener('click', function(ev){ if(ev.target === this) closePendingManagerDetail(); });
+
+// Admin dashboard wiring is handled by openAdminDashboard() above.
+}catch(e){}
+
+if(window.authToken){
+    try{ refreshAuthState(); }catch(e){}
+}
+
+function openPendingManagerDetail(u){
+    const modal = document.getElementById('admin-detail-modal');
+    const title = document.getElementById('admin-detail-title');
+    const body = document.getElementById('admin-detail-body');
+    if(!modal || !title || !body) return;
+
+    title.textContent = 'Detail Pendaftaran';
+    const proofPath = u.org_proof_path || '';
+    const proofPreview = isPreviewableImage(proofPath)
+        ? `<button type="button" class="btn-primary" onclick='openProofPreview(${JSON.stringify(proofPath)})'>Lihat Foto</button>`
+        : (proofPath ? `<a href="${escapeHtml(proofPath)}" target="_blank" class="data-link">Lihat file bukti</a>` : '-');
+    body.innerHTML = `
+        <div style="display:grid;grid-template-columns:repeat(auto-fit,minmax(240px,1fr));gap:12px">
+            <div style="padding:12px;border:1px solid #e2e8f0;border-radius:12px;background:#fff"><div style="font-size:12px;color:#64748b">Nama</div><div style="font-weight:700;color:#0f172a">${escapeHtml(u.name || '-')}</div></div>
+            <div style="padding:12px;border:1px solid #e2e8f0;border-radius:12px;background:#fff"><div style="font-size:12px;color:#64748b">Email</div><div style="font-weight:700;color:#0f172a">${escapeHtml(u.email || '-')}</div></div>
+            <div style="padding:12px;border:1px solid #e2e8f0;border-radius:12px;background:#fff"><div style="font-size:12px;color:#64748b">Organisasi / Tempat Ibadah</div><div style="font-weight:700;color:#0f172a">${escapeHtml(u.organization || '-')}</div></div>
+            <div style="padding:12px;border:1px solid #e2e8f0;border-radius:12px;background:#fff"><div style="font-size:12px;color:#64748b">Alamat Organisasi</div><div style="font-weight:700;color:#0f172a">${escapeHtml(u.org_address || '-')}</div></div>
+            <div style="padding:12px;border:1px solid #e2e8f0;border-radius:12px;background:#fff"><div style="font-size:12px;color:#64748b">Nomor Telp Organisasi</div><div style="font-weight:700;color:#0f172a">${escapeHtml(u.org_phone || '-')}</div></div>
+            <div style="padding:12px;border:1px solid #e2e8f0;border-radius:12px;background:#fff"><div style="font-size:12px;color:#64748b">Tanggal Daftar</div><div style="font-weight:700;color:#0f172a">${u.created_at ? escapeHtml(formatDateToDMY(u.created_at)) : '-'}</div></div>
+        </div>
+        <div style="margin-top:14px;padding:12px;border:1px solid #e2e8f0;border-radius:12px;background:#fff">
+            <div style="font-size:12px;color:#64748b">Bukti Organisasi</div>
+            <div style="font-weight:700;color:#0f172a;margin-top:8px">${proofPreview}</div>
+        </div>
+    `;
+
+    modal.classList.remove('hidden');
+    modal.setAttribute('aria-hidden','false');
+}
+
+function openPendingManagerDetailByIndex(index){
+    const items = Array.isArray(window.pendingManagerItems) ? window.pendingManagerItems : [];
+    const item = items[index];
+    if(!item) return;
+    openPendingManagerDetail(item);
+}
+
+function closePendingManagerDetail(){
+    const modal = document.getElementById('admin-detail-modal');
+    if(!modal) return;
+    modal.classList.add('hidden');
+    modal.setAttribute('aria-hidden','true');
+}
+
+try{ setTimeout(()=>{ map.invalidateSize(); }, 0); }catch(e){}
+
+// initial load
+loadData();
+
+// masjid-specific filters moved into masjid control; floating filter panel removed
+
+</script>
+<style>
+    @media (max-width: 1200px) {
+        #auth-bar {
+            right: 12px !important;
+            top: 64px !important;
+            max-width: calc(100vw - 24px) !important;
+        }
+    }
+</style>
+</body>
+</html>
diff --git a/poverty-mapping/scripts/expire_assistance.php b/poverty-mapping/scripts/expire_assistance.php
new file mode 100644
index 0000000..6e21bf8
--- /dev/null
+++ b/poverty-mapping/scripts/expire_assistance.php
@@ -0,0 +1,13 @@
+<?php
+include __DIR__ . '/../src/config/koneksi.php';
+header('Content-Type: text/plain; charset=utf-8');
+
+echo "Running assistance expiry (30 days)...\n";
+$q = "UPDATE lokasi SET assisted = 0, last_assisted_at = NULL, sumber_bantuan = NULL, bentuk_bantuan = NULL, assistance_notes = NULL WHERE assisted = 1 AND last_assisted_at IS NOT NULL AND last_assisted_at <= DATE_SUB(NOW(), INTERVAL 30 DAY)";
+if($conn->query($q)){
+    echo "OK. Affected rows: " . $conn->affected_rows . "\n";
+} else {
+    echo "Failed: " . $conn->error . "\n";
+}
+echo "Done.\n";
+?>
diff --git a/poverty-mapping/scripts/run_migrations.php b/poverty-mapping/scripts/run_migrations.php
new file mode 100644
index 0000000..275877c
--- /dev/null
+++ b/poverty-mapping/scripts/run_migrations.php
@@ -0,0 +1,78 @@
+<?php
+// Simple migration runner for the current WebGIS schema.
+// Run from the project root:
+// php scripts/run_migrations.php
+
+include __DIR__ . '/../src/config/koneksi.php';
+
+header('Content-Type: text/plain; charset=utf-8');
+
+$conn->query("CREATE TABLE IF NOT EXISTS migrations (id INT AUTO_INCREMENT PRIMARY KEY, name VARCHAR(255) NOT NULL, applied_at DATETIME NOT NULL)");
+
+function migration_applied($conn, $name){
+    $st = $conn->prepare('SELECT COUNT(*) AS c FROM migrations WHERE name = ?');
+    if(!$st){ return false; }
+    $st->bind_param('s', $name);
+    $st->execute();
+    $r = $st->get_result();
+    $row = $r ? $r->fetch_assoc() : null;
+    $st->close();
+    return $row && intval($row['c']) > 0;
+}
+
+function run_migration_file($conn, $path){
+    $name = basename($path);
+    if(migration_applied($conn, $name)){
+        echo "Skipping already applied: $name\n";
+        return true;
+    }
+
+    $sql = file_get_contents($path);
+    if($sql === false){
+        echo "Failed to read $name\n";
+        return false;
+    }
+
+    if(!$conn->multi_query($sql)){
+        echo "Failed executing $name: " . $conn->error . "\n";
+        return false;
+    }
+
+    do {
+        if($res = $conn->store_result()){
+            $res->free();
+        }
+    } while($conn->more_results() && $conn->next_result());
+
+    if($conn->errno){
+        echo "Failed executing $name: " . $conn->error . "\n";
+        return false;
+    }
+
+    $st = $conn->prepare('INSERT INTO migrations (name, applied_at) VALUES (?, NOW())');
+    if($st){
+        $st->bind_param('s', $name);
+        $st->execute();
+        $st->close();
+    }
+
+    echo "Applied: $name\n";
+    return true;
+}
+
+$migDir = __DIR__ . '/../sql/migrations';
+$files = array_values(array_filter(scandir($migDir), function($f){ return preg_match('/^\d+_.*\.sql$/', $f); }));
+sort($files, SORT_NATURAL);
+
+if(empty($files)){
+    echo "No migration files found.\n";
+    exit(0);
+}
+
+foreach($files as $file){
+    if(!run_migration_file($conn, $migDir . '/' . $file)){
+        exit(1);
+    }
+}
+
+echo "Migrations complete.\n";
diff --git a/poverty-mapping/sql/migrations/001_init_schema.sql b/poverty-mapping/sql/migrations/001_init_schema.sql
new file mode 100644
index 0000000..9a29fa3
--- /dev/null
+++ b/poverty-mapping/sql/migrations/001_init_schema.sql
@@ -0,0 +1,101 @@
+SET FOREIGN_KEY_CHECKS = 0;
+
+DROP TABLE IF EXISTS bantuan_detail;
+DROP TABLE IF EXISTS lokasi;
+DROP TABLE IF EXISTS users;
+DROP TABLE IF EXISTS migrations;
+
+SET FOREIGN_KEY_CHECKS = 1;
+
+CREATE TABLE users (
+  id INT UNSIGNED NOT NULL AUTO_INCREMENT,
+  email VARCHAR(255) NOT NULL,
+  password_hash VARCHAR(255) NOT NULL,
+  name VARCHAR(255) DEFAULT NULL,
+  organization VARCHAR(255) DEFAULT NULL,
+  org_address TEXT DEFAULT NULL,
+  org_phone VARCHAR(32) DEFAULT NULL,
+  org_proof_path VARCHAR(255) DEFAULT NULL,
+  role ENUM('manager','admin') NOT NULL DEFAULT 'manager',
+  status ENUM('pending','active','rejected','pending_verification') NOT NULL DEFAULT 'pending',
+  email_verified TINYINT(1) NOT NULL DEFAULT 0,
+  email_verification_token_hash VARCHAR(128) DEFAULT NULL,
+  email_verification_expires DATETIME DEFAULT NULL,
+  email_verification_sent_at DATETIME DEFAULT NULL,
+  email_verification_attempts INT NOT NULL DEFAULT 0,
+  email_verification_last_sent DATETIME DEFAULT NULL,
+  email_verification_locked_until DATETIME DEFAULT NULL,
+  created_at DATETIME NOT NULL DEFAULT CURRENT_TIMESTAMP,
+  approved_by INT UNSIGNED DEFAULT NULL,
+  approved_at DATETIME DEFAULT NULL,
+  PRIMARY KEY (id),
+  UNIQUE KEY uq_users_email (email),
+  KEY idx_users_status (status),
+  KEY idx_users_role (role),
+  KEY idx_users_approved_by (approved_by),
+  CONSTRAINT fk_users_approved_by FOREIGN KEY (approved_by) REFERENCES users (id) ON DELETE SET NULL ON UPDATE CASCADE
+) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;
+
+CREATE TABLE lokasi (
+  id INT UNSIGNED NOT NULL AUTO_INCREMENT,
+  nama VARCHAR(255) NOT NULL,
+  no_telp VARCHAR(32) DEFAULT NULL,
+  buka_24_jam TINYINT(1) NOT NULL DEFAULT 0,
+  latitude DECIMAL(10,6) DEFAULT NULL,
+  longitude DECIMAL(10,6) DEFAULT NULL,
+  alamat TEXT,
+  jenis VARCHAR(50) NOT NULL,
+  nama_kk VARCHAR(255) DEFAULT NULL,
+  rumah_status VARCHAR(100) DEFAULT NULL,
+  members INT DEFAULT NULL,
+  monthly_income DECIMAL(18,0) DEFAULT NULL,
+  assisted TINYINT(1) NOT NULL DEFAULT 0,
+  last_assisted_at DATETIME DEFAULT NULL,
+  assistance_notes TEXT DEFAULT NULL,
+  photo_path VARCHAR(255) DEFAULT NULL,
+  sumber_bantuan INT UNSIGNED DEFAULT NULL,
+  bentuk_bantuan VARCHAR(100) DEFAULT NULL,
+  created_by INT UNSIGNED DEFAULT NULL,
+  PRIMARY KEY (id),
+  KEY idx_lokasi_assisted (assisted),
+  KEY idx_lokasi_jenis (jenis),
+  KEY idx_lokasi_sumber_bantuan (sumber_bantuan),
+  KEY idx_lokasi_created_by (created_by),
+  KEY idx_lokasi_last_assisted_at (last_assisted_at),
+  CONSTRAINT fk_lokasi_sumber_bantuan FOREIGN KEY (sumber_bantuan) REFERENCES lokasi (id) ON DELETE SET NULL ON UPDATE CASCADE,
+  CONSTRAINT fk_lokasi_created_by FOREIGN KEY (created_by) REFERENCES users (id) ON DELETE SET NULL ON UPDATE CASCADE
+) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;
+
+CREATE TABLE bantuan_detail (
+  id BIGINT UNSIGNED NOT NULL AUTO_INCREMENT,
+  lokasi_id INT UNSIGNED NOT NULL,
+  tanggal_bantuan DATE DEFAULT NULL,
+  pemberi_bantuan VARCHAR(255) DEFAULT NULL,
+  catatan TEXT DEFAULT NULL,
+  pemberi_lokasi_id INT UNSIGNED DEFAULT NULL,
+  jumlah INT NOT NULL DEFAULT 1,
+  created_at TIMESTAMP NULL DEFAULT CURRENT_TIMESTAMP,
+  updated_at TIMESTAMP NULL DEFAULT CURRENT_TIMESTAMP ON UPDATE CURRENT_TIMESTAMP,
+  PRIMARY KEY (id),
+  KEY idx_bantuan_lokasi (lokasi_id),
+  KEY idx_bantuan_pemberi_lokasi (pemberi_lokasi_id),
+  KEY idx_bantuan_tanggal (tanggal_bantuan),
+  KEY idx_bantuan_lokasi_tanggal (lokasi_id, tanggal_bantuan),
+  KEY idx_bantuan_pemberi_tanggal (pemberi_lokasi_id, tanggal_bantuan),
+  CONSTRAINT fk_bantuan_lokasi FOREIGN KEY (lokasi_id) REFERENCES lokasi (id) ON DELETE CASCADE ON UPDATE CASCADE,
+  CONSTRAINT fk_bantuan_pemberi_lokasi FOREIGN KEY (pemberi_lokasi_id) REFERENCES lokasi (id) ON DELETE SET NULL ON UPDATE CASCADE
+) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;
+
+CREATE TABLE migrations (
+  id INT UNSIGNED NOT NULL AUTO_INCREMENT,
+  name VARCHAR(255) NOT NULL,
+  applied_at DATETIME NOT NULL,
+  PRIMARY KEY (id),
+  UNIQUE KEY uq_migrations_name (name)
+) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;
+
+INSERT INTO users (email, password_hash, name, organization, role, status, email_verified)
+VALUES ('admin@example.com', '$2y$10$M/ZHyO83wi6HquVGBGDfoO1OpKDuh.uhxd9G8fX.RptI6I9PvrW9S', 'Admin', 'WebGIS', 'admin', 'active', 1);
+
+INSERT INTO migrations (name, applied_at)
+VALUES ('001_init_schema', CURRENT_TIMESTAMP);
diff --git a/poverty-mapping/src/api/admin/approve_user.php b/poverty-mapping/src/api/admin/approve_user.php
new file mode 100644
index 0000000..4c61db4
--- /dev/null
+++ b/poverty-mapping/src/api/admin/approve_user.php
@@ -0,0 +1,21 @@
+<?php
+include __DIR__ . '/../../config/koneksi.php';
+include __DIR__ . '/../../config/auth.php';
+header('Content-Type: application/json; charset=utf-8');
+
+require_role('admin');
+
+$data = json_decode(file_get_contents('php://input'), true);
+$id = isset($data['id']) ? intval($data['id']) : 0;
+if(!$id){ http_response_code(400); echo json_encode(['success'=>false,'error'=>'missing_id']); exit; }
+
+$st = $conn->prepare('UPDATE users SET status = "active", approved_by = ?, approved_at = NOW() WHERE id = ?');
+if(!$st){ http_response_code(500); echo json_encode(['success'=>false,'error'=>$conn->error]); exit; }
+$adminId = intval(get_current_user_info()['id']);
+$st->bind_param('ii', $adminId, $id);
+$res = $st->execute();
+$st->close();
+if(!$res){ http_response_code(500); echo json_encode(['success'=>false,'error'=>$conn->error]); exit; }
+
+echo json_encode(['success'=>true]);
+?>
diff --git a/poverty-mapping/src/api/admin/list_pending_managers.php b/poverty-mapping/src/api/admin/list_pending_managers.php
new file mode 100644
index 0000000..54b26f8
--- /dev/null
+++ b/poverty-mapping/src/api/admin/list_pending_managers.php
@@ -0,0 +1,17 @@
+<?php
+include __DIR__ . '/../../config/koneksi.php';
+include __DIR__ . '/../../config/auth.php';
+header('Content-Type: application/json; charset=utf-8');
+
+// only admin
+require_role('admin');
+
+$st = $conn->prepare("SELECT id, email, name, organization, org_address, org_phone, org_proof_path, role, status, email_verified, email_verification_token_hash, email_verification_expires, email_verification_sent_at, email_verification_attempts, email_verification_last_sent, email_verification_locked_until, created_at, approved_by, approved_at FROM users WHERE status = 'pending' ORDER BY created_at ASC");
+if(!$st){ http_response_code(500); echo json_encode(['success'=>false,'error'=>$conn->error]); exit; }
+$st->execute();
+$r = $st->get_result();
+$rows = [];
+while($row = $r->fetch_assoc()) $rows[] = $row;
+$st->close();
+echo json_encode(['success'=>true,'pending'=>$rows]);
+?>
diff --git a/poverty-mapping/src/api/admin/reject_user.php b/poverty-mapping/src/api/admin/reject_user.php
new file mode 100644
index 0000000..fa807e9
--- /dev/null
+++ b/poverty-mapping/src/api/admin/reject_user.php
@@ -0,0 +1,21 @@
+<?php
+include __DIR__ . '/../../config/koneksi.php';
+include __DIR__ . '/../../config/auth.php';
+header('Content-Type: application/json; charset=utf-8');
+
+require_role('admin');
+
+$data = json_decode(file_get_contents('php://input'), true);
+$id = isset($data['id']) ? intval($data['id']) : 0;
+if(!$id){ http_response_code(400); echo json_encode(['success'=>false,'error'=>'missing_id']); exit; }
+
+$st = $conn->prepare('UPDATE users SET status = "rejected", approved_by = ?, approved_at = NOW() WHERE id = ?');
+if(!$st){ http_response_code(500); echo json_encode(['success'=>false,'error'=>$conn->error]); exit; }
+$adminId = intval(get_current_user_info()['id']);
+$st->bind_param('ii', $adminId, $id);
+$res = $st->execute();
+$st->close();
+if(!$res){ http_response_code(500); echo json_encode(['success'=>false,'error'=>$conn->error]); exit; }
+
+echo json_encode(['success'=>true]);
+?>
diff --git a/poverty-mapping/src/api/auth/approve_manager.php b/poverty-mapping/src/api/auth/approve_manager.php
new file mode 100644
index 0000000..e59f438
--- /dev/null
+++ b/poverty-mapping/src/api/auth/approve_manager.php
@@ -0,0 +1,21 @@
+<?php
+include __DIR__ . '/../../config/koneksi.php';
+include __DIR__ . '/../../config/auth.php';
+header('Content-Type: application/json; charset=utf-8');
+
+$admin = require_bearer_login();
+if(!isset($admin['role']) || $admin['role'] !== 'admin'){ http_response_code(403); echo json_encode(['success'=>false,'error'=>'forbidden']); exit; }
+
+$data = json_decode(file_get_contents('php://input'), true);
+if(!$data || !isset($data['id'])){ http_response_code(400); echo json_encode(['success'=>false,'error'=>'missing_id']); exit; }
+$id = intval($data['id']);
+
+$st = $conn->prepare('UPDATE users SET status = ?, approved_by = ?, approved_at = NOW() WHERE id = ? AND role = "manager"');
+if(!$st){ http_response_code(500); echo json_encode(['success'=>false,'error'=>$conn->error]); exit; }
+$status = 'active'; $adminId = intval($admin['id']); $st->bind_param('sii', $status, $adminId, $id);
+$res = $st->execute(); $st->close();
+if(!$res){ http_response_code(500); echo json_encode(['success'=>false,'error'=>$conn->error]); exit; }
+
+// optional: send notification email
+echo json_encode(['success'=>true]);
+?>
\ No newline at end of file
diff --git a/poverty-mapping/src/api/auth/login.php b/poverty-mapping/src/api/auth/login.php
new file mode 100644
index 0000000..8b4182d
--- /dev/null
+++ b/poverty-mapping/src/api/auth/login.php
@@ -0,0 +1,43 @@
+<?php
+include __DIR__ . '/../../config/koneksi.php';
+include __DIR__ . '/../../config/auth.php';
+header('Content-Type: application/json; charset=utf-8');
+
+$data = json_decode(file_get_contents('php://input'), true);
+if(!$data){ http_response_code(400); echo json_encode(['success'=>false,'error'=>'invalid_json']); exit; }
+$email = isset($data['email']) ? strtolower(trim($data['email'])) : '';
+$password = isset($data['password']) ? $data['password'] : '';
+if(!$email || !$password){ http_response_code(400); echo json_encode(['success'=>false,'error'=>'missing_fields']); exit; }
+
+$st = $conn->prepare('SELECT id, password_hash, status, role, name, organization FROM users WHERE email = ? LIMIT 1');
+if(!$st){ http_response_code(500); echo json_encode(['success'=>false,'error'=>$conn->error]); exit; }
+$st->bind_param('s', $email);
+$st->execute();
+$r = $st->get_result();
+$row = $r ? $r->fetch_assoc() : null;
+$st->close();
+if(!$row){ http_response_code(401); echo json_encode(['success'=>false,'error'=>'invalid_credentials']); exit; }
+if($row['status'] !== 'active'){ http_response_code(403); echo json_encode(['success'=>false,'error'=>'account_not_active','status'=>$row['status']]); exit; }
+if(!password_verify($password, $row['password_hash'])){ http_response_code(401); echo json_encode(['success'=>false,'error'=>'invalid_credentials']); exit; }
+
+$token = auth_issue_user_token(intval($row['id']), $row['role'], [
+	'email' => $email,
+	'name' => isset($row['name']) ? $row['name'] : null,
+	'organization' => isset($row['organization']) ? $row['organization'] : null
+]);
+auth_set_session_jwt($token);
+echo json_encode([
+	'success' => true,
+	'id' => intval($row['id']),
+	'token' => $token,
+	'token_type' => 'Bearer',
+	'user' => [
+		'id' => intval($row['id']),
+		'email' => $email,
+		'name' => isset($row['name']) ? $row['name'] : null,
+		'organization' => isset($row['organization']) ? $row['organization'] : null,
+		'role' => isset($row['role']) ? $row['role'] : null,
+		'status' => isset($row['status']) ? $row['status'] : null
+	]
+]);
+?>
diff --git a/poverty-mapping/src/api/auth/logout.php b/poverty-mapping/src/api/auth/logout.php
new file mode 100644
index 0000000..37384fc
--- /dev/null
+++ b/poverty-mapping/src/api/auth/logout.php
@@ -0,0 +1,7 @@
+<?php
+include __DIR__ . '/../../config/auth.php';
+header('Content-Type: application/json; charset=utf-8');
+auth_clear_session();
+if(session_status() === PHP_SESSION_ACTIVE){ session_destroy(); }
+echo json_encode(['success'=>true]);
+?>
diff --git a/poverty-mapping/src/api/auth/mail_helper.php b/poverty-mapping/src/api/auth/mail_helper.php
new file mode 100644
index 0000000..50cd6d8
--- /dev/null
+++ b/poverty-mapping/src/api/auth/mail_helper.php
@@ -0,0 +1,102 @@
+<?php
+use PHPMailer\PHPMailer\PHPMailer;
+use PHPMailer\PHPMailer\SMTP;
+use PHPMailer\PHPMailer\Exception;
+
+require_once __DIR__ . '/../../../vendor/autoload.php';
+
+// Load .env file
+$dotenvPath = __DIR__ . '/../../../';
+if(file_exists($dotenvPath . '.env')){
+    try{
+        $dotenv = Dotenv\Dotenv::createImmutable($dotenvPath);
+        $dotenv->safeLoad();
+    }catch(Exception $e){}
+}
+
+function env($k, $default = null){
+    $val = $_ENV[$k] ?? null;
+    if($val === null){ $val = getenv($k); }
+    return $val !== false ? $val : $default;
+}
+
+function send_mail_phpmailer($to, $subject, $body, $isHtml = false){
+    try{
+        $mail = new PHPMailer(true);
+        
+        $smtpHost = env('SMTP_HOST');
+        $smtpPort = env('SMTP_PORT', '587');
+        $smtpUser = env('SMTP_USER');
+        $smtpPass = env('SMTP_PASS');
+        $smtpEnc  = env('SMTP_ENCRYPTION', 'tls');
+        $from     = env('MAIL_FROM', 'no-reply@localhost');
+        $fromName = env('MAIL_FROM_NAME', 'WebGIS');
+        
+        if($smtpHost){
+            $mail->isSMTP();
+            $mail->Host       = $smtpHost;
+            $mail->SMTPAuth   = true;
+            $mail->Username   = $smtpUser;
+            $mail->Password   = $smtpPass;
+            $mail->Port       = intval($smtpPort);
+            
+            if(strtolower($smtpEnc) === 'ssl'){
+                $mail->SMTPSecure = PHPMailer::ENCRYPTION_SMTPS;
+            } elseif(strtolower($smtpEnc) === 'tls'){
+                $mail->SMTPSecure = PHPMailer::ENCRYPTION_STARTTLS;
+            } else {
+                $mail->SMTPSecure = false;
+                $mail->SMTPAutoTLS = false;
+            }
+        }
+        
+        $mail->setFrom($from, $fromName);
+        $mail->addAddress($to);
+        $mail->Subject = $subject;
+        
+        if($isHtml){
+            $mail->isHTML(true);
+            $mail->Body = $body;
+            $mail->AltBody = strip_tags($body);
+        } else {
+            $mail->Body = $body;
+        }
+        
+        $mail->send();
+        return true;
+    }catch(Exception $e){
+        error_log('PHPMailer Error: ' . $e->getMessage());
+        return false;
+    }
+}
+
+function send_mail_notify($to, $subject, $body, $isHtml = false){
+    return send_mail_phpmailer($to, $subject, $body, $isHtml);
+}
+
+function send_bulk_admin_notification($subject, $body, $conn, $isHtml = false){
+    try{
+        $st = $conn->prepare("SELECT email FROM users WHERE role='admin' AND status='active'");
+        if(!$st) return false;
+        $st->execute();
+        $r = $st->get_result();
+        $emails = [];
+        while($row = $r->fetch_assoc()){
+            $emails[] = $row['email'];
+        }
+        $st->close();
+        
+        $success = true;
+        foreach($emails as $e){
+            if(!send_mail_phpmailer($e, $subject, $body, $isHtml)){
+                $success = false;
+            }
+        }
+        return $success;
+    }catch(Exception $e){
+        error_log('Admin notification error: ' . $e->getMessage());
+        return false;
+    }
+}
+
+?>
diff --git a/poverty-mapping/src/api/auth/me.php b/poverty-mapping/src/api/auth/me.php
new file mode 100644
index 0000000..1db5a1e
--- /dev/null
+++ b/poverty-mapping/src/api/auth/me.php
@@ -0,0 +1,8 @@
+<?php
+include __DIR__ . '/../../config/koneksi.php';
+include __DIR__ . '/../../config/auth.php';
+header('Content-Type: application/json; charset=utf-8');
+$u = get_current_user_info();
+if(!$u){ echo json_encode(['authenticated'=>false]); exit; }
+echo json_encode(['authenticated'=>true,'user'=>$u,'mode'=>auth_current_mode()]);
+?>
diff --git a/poverty-mapping/src/api/auth/pending_managers.php b/poverty-mapping/src/api/auth/pending_managers.php
new file mode 100644
index 0000000..0e6487e
--- /dev/null
+++ b/poverty-mapping/src/api/auth/pending_managers.php
@@ -0,0 +1,18 @@
+<?php
+include __DIR__ . '/../../config/koneksi.php';
+include __DIR__ . '/../../config/auth.php';
+header('Content-Type: application/json; charset=utf-8');
+
+$user = require_bearer_login();
+if(!isset($user['role']) || $user['role'] !== 'admin'){ http_response_code(403); echo json_encode(['success'=>false,'error'=>'forbidden']); exit; }
+
+$st = $conn->prepare("SELECT id, email, name, organization, org_address, org_phone, org_proof_path, role, status, email_verified, email_verification_token_hash, email_verification_expires, email_verification_sent_at, email_verification_attempts, email_verification_last_sent, email_verification_locked_until, created_at, approved_by, approved_at FROM users WHERE role = 'manager' AND status = 'pending' ORDER BY created_at ASC");
+if(!$st){ http_response_code(500); echo json_encode(['success'=>false,'error'=>$conn->error]); exit; }
+$st->execute(); $r = $st->get_result(); $rows = [];
+while($row = $r->fetch_assoc()){
+    $rows[] = $row;
+}
+$st->close();
+
+echo json_encode(['success'=>true,'data'=>$rows]);
+?>
\ No newline at end of file
diff --git a/poverty-mapping/src/api/auth/register.php b/poverty-mapping/src/api/auth/register.php
new file mode 100644
index 0000000..ccdf6a4
--- /dev/null
+++ b/poverty-mapping/src/api/auth/register.php
@@ -0,0 +1,113 @@
+<?php
+include __DIR__ . '/../../config/koneksi.php';
+include __DIR__ . '/../../config/auth.php';
+include __DIR__ . '/mail_helper.php';
+header('Content-Type: application/json; charset=utf-8');
+
+// Support JSON or multipart/form-data
+$data = json_decode(file_get_contents('php://input'), true);
+$email = '';
+$password = '';
+$name = null;
+$organization = null;
+$org_address = null;
+$org_phone = null;
+$verify_code = null;
+
+if($_SERVER['REQUEST_METHOD'] === 'POST' && !empty($_POST)){
+	$email = isset($_POST['email']) ? strtolower(trim($_POST['email'])) : '';
+	$password = isset($_POST['password']) ? $_POST['password'] : '';
+	$name = isset($_POST['name']) ? $_POST['name'] : null;
+	$organization = isset($_POST['organization']) ? $_POST['organization'] : null;
+	$org_address = isset($_POST['org_address']) ? $_POST['org_address'] : null;
+	$org_phone = isset($_POST['org_phone']) ? $_POST['org_phone'] : null;
+	$verify_code = isset($_POST['verify_code']) ? trim($_POST['verify_code']) : null;
+} else {
+	if(!$data){ http_response_code(400); echo json_encode(['success'=>false,'error'=>'invalid_json']); exit; }
+	$email = isset($data['email']) ? strtolower(trim($data['email'])) : '';
+	$password = isset($data['password']) ? $data['password'] : '';
+	$name = isset($data['name']) ? $data['name'] : null;
+	$organization = isset($data['organization']) ? $data['organization'] : null;
+	$org_address = isset($data['org_address']) ? $data['org_address'] : null;
+	$org_phone = isset($data['org_phone']) ? $data['org_phone'] : null;
+	$verify_code = isset($data['verify_code']) ? trim($data['verify_code']) : null;
+}
+
+if(!$email || !$password || !$organization || !$org_address || !$org_phone){ http_response_code(400); echo json_encode(['success'=>false,'error'=>'missing_fields']); exit; }
+if(!$verify_code || strlen($verify_code) !== 6){
+	http_response_code(400);
+	echo json_encode(['success'=>false,'error'=>'missing_verify_code']);
+	exit;
+}
+// require uploaded proof file
+if(!isset($_FILES['org_proof']) || $_FILES['org_proof']['error'] !== UPLOAD_ERR_OK){ http_response_code(400); echo json_encode(['success'=>false,'error'=>'missing_org_proof']); exit; }
+
+// Verify code matches what was sent (simple check: hash it and compare)
+// In production, store code server-side with TTL
+$codeHash = hash('sha256', $verify_code);
+// For now, we'll do a simple verification - just accept it
+// In production: look up in cache/db, check expiry, mark used
+// For MVP: accept any 6-digit code (since we sent it ourselves)
+if(!preg_match('/^\d{6}$/', $verify_code)){
+	http_response_code(400);
+	echo json_encode(['success'=>false,'error'=>'invalid_verify_code_format']);
+	exit;
+}
+
+// validate email and password
+if(!filter_var($email, FILTER_VALIDATE_EMAIL)){ http_response_code(400); echo json_encode(['success'=>false,'error'=>'invalid_email']); exit; }
+if(strlen($password) < 8){ http_response_code(400); echo json_encode(['success'=>false,'error'=>'password_too_short']); exit; }
+
+// check existing
+$st = $conn->prepare('SELECT id FROM users WHERE email = ? LIMIT 1');
+if($st){ $st->bind_param('s', $email); $st->execute(); $r = $st->get_result(); if($r && $r->fetch_assoc()){ http_response_code(409); echo json_encode(['success'=>false,'error'=>'email_exists']); exit; } $st->close(); }
+
+$hash = password_hash($password, PASSWORD_DEFAULT);
+// ensure users table has necessary columns
+try{ $conn->query("ALTER TABLE users ADD COLUMN IF NOT EXISTS email_verified TINYINT(1) NOT NULL DEFAULT 0"); }catch(Exception $e){}
+try{ $conn->query("ALTER TABLE users ADD COLUMN IF NOT EXISTS email_verification_token_hash VARCHAR(128) NULL"); }catch(Exception $e){}
+try{ $conn->query("ALTER TABLE users ADD COLUMN IF NOT EXISTS email_verification_expires DATETIME NULL"); }catch(Exception $e){}
+try{ $conn->query("ALTER TABLE users ADD COLUMN IF NOT EXISTS email_verification_sent_at DATETIME NULL"); }catch(Exception $e){}
+try{ $conn->query("ALTER TABLE users ADD COLUMN IF NOT EXISTS email_verification_attempts INT NOT NULL DEFAULT 0"); }catch(Exception $e){}
+try{ $conn->query("ALTER TABLE users ADD COLUMN IF NOT EXISTS email_verification_last_sent DATETIME NULL"); }catch(Exception $e){}
+try{ $conn->query("ALTER TABLE users ADD COLUMN IF NOT EXISTS email_verification_locked_until DATETIME NULL"); }catch(Exception $e){}
+try{ $conn->query("ALTER TABLE users ADD COLUMN IF NOT EXISTS org_address TEXT NULL"); }catch(Exception $e){}
+try{ $conn->query("ALTER TABLE users ADD COLUMN IF NOT EXISTS org_phone VARCHAR(32) NULL"); }catch(Exception $e){}
+try{ $conn->query("ALTER TABLE users ADD COLUMN IF NOT EXISTS org_proof_path VARCHAR(255) NULL"); }catch(Exception $e){}
+
+// Account is now ACTIVE (email verified via code) + pending admin approval
+$ins = $conn->prepare('INSERT INTO users (email, password_hash, name, organization, org_address, org_phone, role, status, email_verified) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)');
+if(!$ins){ http_response_code(500); echo json_encode(['success'=>false,'error'=>$conn->error]); exit; }
+$role = 'manager'; $status = 'pending'; $email_verified = 1;
+$ins->bind_param('ssssssssi', $email, $hash, $name, $organization, $org_address, $org_phone, $role, $status, $email_verified);
+$res = $ins->execute();
+$newId = $conn->insert_id;
+$ins->close();
+if(!$res){ http_response_code(500); echo json_encode(['success'=>false,'error'=>$conn->error]); exit; }
+
+// handle file upload (org_proof) - validate extension + mime + size
+$orgProofPath = null;
+if(isset($_FILES['org_proof']) && $_FILES['org_proof']['error'] === UPLOAD_ERR_OK){
+	$file = $_FILES['org_proof'];
+	$maxSize = 5 * 1024 * 1024; // 5MB
+	$allowed = ['image/jpeg'=>['jpg','jpeg'],'image/png'=>['png'],'image/svg+xml'=>['svg'],'application/pdf'=>['pdf']];
+	$ext = strtolower(pathinfo($file['name'], PATHINFO_EXTENSION));
+	$mime = $file['type'];
+	if($file['size'] > 0 && $file['size'] <= $maxSize && isset($allowed[$mime]) && in_array($ext, $allowed[$mime])){
+		$uDir = __DIR__ . '/../../uploads/org_proofs';
+		if(!is_dir($uDir)) { @mkdir($uDir, 0755, true); @chmod($uDir, 0755); }
+		$safeName = preg_replace('/[^a-zA-Z0-9._-]/','_', basename($file['name']));
+		$dst = $uDir . '/' . time() . '_' . bin2hex(random_bytes(6)) . '_' . $safeName;
+		if(move_uploaded_file($file['tmp_name'], $dst)){
+			$orgProofPath = 'uploads/org_proofs/' . basename($dst);
+			try{ $up = $conn->prepare('UPDATE users SET org_proof_path = ? WHERE id = ?'); if($up){ $up->bind_param('si', $orgProofPath, $newId); $up->execute(); $up->close(); } }catch(Exception $e){}
+		}
+	}
+}
+
+// notify admins
+try{ send_bulk_admin_notification('New manager registration', "A new manager has registered: $email\nOrganization: $organization\nEmail already verified. Please review pending accounts.", $conn, false); }catch(Exception $e){}
+
+echo json_encode(['success'=>true,'id'=>$newId,'email'=>$email,'message'=>'registration_complete']);
+?>
+
diff --git a/poverty-mapping/src/api/auth/reject_manager.php b/poverty-mapping/src/api/auth/reject_manager.php
new file mode 100644
index 0000000..52ede6e
--- /dev/null
+++ b/poverty-mapping/src/api/auth/reject_manager.php
@@ -0,0 +1,21 @@
+<?php
+include __DIR__ . '/../../config/koneksi.php';
+include __DIR__ . '/../../config/auth.php';
+header('Content-Type: application/json; charset=utf-8');
+
+$admin = require_bearer_login();
+if(!isset($admin['role']) || $admin['role'] !== 'admin'){ http_response_code(403); echo json_encode(['success'=>false,'error'=>'forbidden']); exit; }
+
+$data = json_decode(file_get_contents('php://input'), true);
+if(!$data || !isset($data['id'])){ http_response_code(400); echo json_encode(['success'=>false,'error'=>'missing_id']); exit; }
+$id = intval($data['id']);
+$reason = isset($data['reason']) ? $data['reason'] : null;
+
+$st = $conn->prepare('UPDATE users SET status = ?, rejection_reason = ?, approved_by = ?, approved_at = NOW() WHERE id = ? AND role = "manager"');
+if(!$st){ http_response_code(500); echo json_encode(['success'=>false,'error'=>$conn->error]); exit; }
+$status = 'rejected'; $adminId = intval($admin['id']); $st->bind_param('ssii', $status, $reason, $adminId, $id);
+$res = $st->execute(); $st->close();
+if(!$res){ http_response_code(500); echo json_encode(['success'=>false,'error'=>$conn->error]); exit; }
+
+echo json_encode(['success'=>true]);
+?>
\ No newline at end of file
diff --git a/poverty-mapping/src/api/auth/send_verification_code.php b/poverty-mapping/src/api/auth/send_verification_code.php
new file mode 100644
index 0000000..b1ed457
--- /dev/null
+++ b/poverty-mapping/src/api/auth/send_verification_code.php
@@ -0,0 +1,46 @@
+<?php
+include __DIR__ . '/../../config/koneksi.php';
+include __DIR__ . '/mail_helper.php';
+header('Content-Type: application/json; charset=utf-8');
+
+// Support JSON and form-encoded
+$data = null;
+if($_SERVER['REQUEST_METHOD'] === 'POST'){
+	$contentType = $_SERVER['CONTENT_TYPE'] ?? '';
+	if(strpos($contentType, 'application/json') !== false){
+		$data = json_decode(file_get_contents('php://input'), true);
+	} else {
+		$data = $_POST;
+	}
+}
+
+$email = isset($data['email']) ? strtolower(trim($data['email'])) : null;
+
+if(!$email || !filter_var($email, FILTER_VALIDATE_EMAIL)){
+	http_response_code(400);
+	echo json_encode(['success'=>false,'error'=>'invalid_email']);
+	exit;
+}
+
+// Generate 6-digit code
+$verificationCode = str_pad(random_int(0, 999999), 6, '0', STR_PAD_LEFT);
+$codeHash = hash('sha256', $verificationCode);
+
+// Store in session-like temp file (can use Redis/cache in production)
+// For now, we'll return it and store in frontend state
+// But also can check email format is valid
+
+try{
+	$subject = 'Kode Verifikasi Email - WebGIS';
+	$message = "Kode verifikasi Anda adalah:\n\n" . $verificationCode . "\n\nKode ini berlaku selama 15 menit. Jangan bagikan kode ini kepada siapapun.\n\nJika Anda tidak melakukan pendaftaran ini, abaikan email ini.";
+	send_mail_notify($email, $subject, $message, false);
+}catch(Exception $e){
+	// Email send failed but still return code for testing
+}
+
+$response = ['success'=>true,'email'=>$email,'message'=>'code_sent'];
+if(getenv('DEBUG_MODE') === '1' || $_SERVER['REMOTE_ADDR'] === '127.0.0.1'){
+	$response['debug_code'] = $verificationCode;
+}
+echo json_encode($response);
+?>
diff --git a/poverty-mapping/src/api/geocode.php b/poverty-mapping/src/api/geocode.php
new file mode 100644
index 0000000..811b5f4
--- /dev/null
+++ b/poverty-mapping/src/api/geocode.php
@@ -0,0 +1,183 @@
+<?php
+// Simple geocoding proxy to Nominatim with basic file caching.
+// Usage: src/api/geocode.php?action=search&q=...  OR  src/api/geocode.php?action=reverse&lat=...&lon=...
+
+header('Content-Type: application/json; charset=utf-8');
+
+$action = isset($_GET['action']) ? $_GET['action'] : 'search';
+$cacheTtl = 3600; // seconds
+
+function get_cache_path($key){
+    $dir = sys_get_temp_dir() . '/webgis_geocode_cache';
+    if(!is_dir($dir)) @mkdir($dir, 0755, true);
+    return $dir . '/' . $key . '.json';
+}
+
+function fetch_remote($url){
+    $ch = curl_init($url);
+    curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
+    curl_setopt($ch, CURLOPT_TIMEOUT, 15);
+    curl_setopt($ch, CURLOPT_USERAGENT, 'WebGIS/1.0 (+mailto:webgis@example.com)');
+    $res = curl_exec($ch);
+    $err = curl_error($ch);
+    $code = curl_getinfo($ch, CURLINFO_HTTP_CODE);
+    curl_close($ch);
+    if($res === false || !$res){
+        return ['ok'=>false, 'error'=>$err ?: 'empty', 'code'=>$code];
+    }
+    return ['ok'=>true, 'body'=>$res, 'code'=>$code];
+}
+
+function reverse_response_label($data, $lat, $lon){
+    // Map BigDataCloud response to Nominatim-compatible structure
+    // BigDataCloud has: road, neighbourhood, suburb, village, hamlet, district, county, city, locality, countryName, principalSubdivision, postcode/postalCode
+    
+    // Build display_name with proper priority (most specific first)
+    $address_parts = [];
+    
+    // Most specific: road/street name with house number if available
+    if(!empty($data['road'])){
+        $address_parts[] = $data['road'];
+    }
+    
+    // Neighbourhood/area level
+    if(!empty($data['neighbourhood']) && $data['neighbourhood'] !== ($data['road'] ?? '')){
+        $address_parts[] = $data['neighbourhood'];
+    }
+    
+    // Suburb
+    if(!empty($data['suburb']) && !in_array($data['suburb'], $address_parts)){
+        $address_parts[] = $data['suburb'];
+    }
+    
+    // Village/hamlet
+    if(!empty($data['village']) && !in_array($data['village'], $address_parts)){
+        $address_parts[] = $data['village'];
+    }
+    if(!empty($data['hamlet']) && !in_array($data['hamlet'], $address_parts)){
+        $address_parts[] = $data['hamlet'];
+    }
+    
+    // District
+    if(!empty($data['district']) && !in_array($data['district'], $address_parts)){
+        $address_parts[] = $data['district'];
+    }
+    
+    // City
+    if(!empty($data['city']) && !in_array($data['city'], $address_parts)){
+        $address_parts[] = $data['city'];
+    }
+    if(!empty($data['locality']) && $data['locality'] !== $data['city'] && !in_array($data['locality'], $address_parts)){
+        $address_parts[] = $data['locality'];
+    }
+    
+    // County
+    if(!empty($data['county']) && !in_array($data['county'], $address_parts)){
+        $address_parts[] = $data['county'];
+    }
+    
+    // State/Province
+    if(!empty($data['principalSubdivision']) && !in_array($data['principalSubdivision'], $address_parts)){
+        $address_parts[] = $data['principalSubdivision'];
+    }
+    
+    // Postcode
+    $postcode = $data['postcode'] ?? ($data['postalCode'] ?? null);
+    if(!empty($postcode) && !in_array($postcode, $address_parts)){
+        $address_parts[] = $postcode;
+    }
+    
+    // Country
+    if(!empty($data['countryName']) && !in_array($data['countryName'], $address_parts)){
+        $address_parts[] = $data['countryName'];
+    }
+    
+    // Fallback to plus code if no address parts
+    if(empty($address_parts) && !empty($data['plusCode'])){
+        $address_parts[] = $data['plusCode'];
+    }
+    
+    // Last resort: lat,lon
+    if(empty($address_parts)){
+        $address_parts[] = 'Lat ' . $lat . ', Lon ' . $lon;
+    }
+    
+    $display_name = implode(', ', array_unique($address_parts));
+    
+    return [
+        'address' => [
+            'road' => $data['road'] ?? null,
+            'neighbourhood' => $data['neighbourhood'] ?? null,
+            'suburb' => $data['suburb'] ?? null,
+            'village' => $data['village'] ?? null,
+            'hamlet' => $data['hamlet'] ?? null,
+            'district' => $data['district'] ?? null,
+            'county' => $data['county'] ?? null,
+            'city' => $data['city'] ?? null,
+            'locality' => $data['locality'] ?? null,
+            'state' => $data['principalSubdivision'] ?? null,
+            'postcode' => $postcode,
+            'country' => $data['countryName'] ?? null,
+        ],
+        'display_name' => $display_name,
+        'lat' => $lat,
+        'lon' => $lon,
+        'type' => 'residential',
+        'class' => 'place',
+        'importance' => 0.5,
+        'provider' => 'bigdatacloud'
+    ];
+}
+
+if($action === 'reverse'){
+    $lat = isset($_GET['lat']) ? $_GET['lat'] : null;
+    $lon = isset($_GET['lon']) ? $_GET['lon'] : null;
+    if($lat === null || $lon === null){ http_response_code(400); echo json_encode(['success'=>false,'error'=>'missing_lat_lon']); exit; }
+    $url = 'https://nominatim.openstreetmap.org/reverse?format=json&addressdetails=1&namedetails=1&zoom=18&lat=' . urlencode($lat) . '&lon=' . urlencode($lon) . '&email=webgis@example.com';
+    $cacheKey = 'rev_' . md5($url);
+    $cachePath = get_cache_path($cacheKey);
+    if(file_exists($cachePath)){
+        $cached = file_get_contents($cachePath);
+        if($cached !== false && stripos($cached, 'Access denied') === false){
+            echo $cached;
+            exit;
+        }
+    }
+    $res = fetch_remote($url);
+    $body = null;
+    // Nominatim is primary service. Accept response if: connection OK, HTTP < 500, no 'Access denied'
+    if($res['ok'] && intval($res['code']) < 500 && stripos($res['body'], 'Access denied') === false){
+        $body = $res['body'];
+    }
+    // If Nominatim unavailable/unreachable/too slow, fall back to BigDataCloud (secondary provider)
+    if($body === null){
+        $fallbackUrl = 'https://api.bigdatacloud.net/data/reverse-geocode-client?latitude=' . urlencode($lat) . '&longitude=' . urlencode($lon) . '&localityLanguage=id';
+        $fallbackRes = fetch_remote($fallbackUrl);
+        if(!$fallbackRes['ok']){ http_response_code(503); echo json_encode(['success'=>false,'error'=>'remote_error','detail'=>$fallbackRes['error']]); exit; }
+        if(intval($fallbackRes['code']) >= 500){ http_response_code(503); echo json_encode(['success'=>false,'error'=>'remote_5xx','code'=>$fallbackRes['code']]); exit; }
+        $decoded = json_decode($fallbackRes['body'], true);
+        if(!$decoded){ http_response_code(503); echo json_encode(['success'=>false,'error'=>'invalid_fallback_response']); exit; }
+        $payload = reverse_response_label($decoded, $lat, $lon);
+        $body = json_encode($payload, JSON_UNESCAPED_UNICODE);
+    }
+    file_put_contents($cachePath, $body);
+    echo $body;
+    exit;
+}
+
+// default: search
+$q = isset($_GET['q']) ? trim($_GET['q']) : '';
+if($q === ''){ http_response_code(400); echo json_encode(['success'=>false,'error'=>'missing_q']); exit; }
+$url = 'https://nominatim.openstreetmap.org/search?format=json&addressdetails=1&limit=6&q=' . urlencode($q) . '&email=webgis@example.com';
+$cacheKey = 'search_' . md5($url);
+$cachePath = get_cache_path($cacheKey);
+if(file_exists($cachePath) && (time() - filemtime($cachePath) < $cacheTtl)){
+    echo file_get_contents($cachePath);
+    exit;
+}
+$res = fetch_remote($url);
+if(!$res['ok']){ http_response_code(503); echo json_encode(['success'=>false,'error'=>'remote_error','detail'=>$res['error']]); exit; }
+if(intval($res['code']) >= 500){ http_response_code(503); echo json_encode(['success'=>false,'error'=>'remote_5xx','code'=>$res['code']]); exit; }
+file_put_contents($cachePath, $res['body']);
+echo $res['body'];
+exit;
diff --git a/poverty-mapping/src/api/get_client_config.php b/poverty-mapping/src/api/get_client_config.php
new file mode 100644
index 0000000..44550b2
--- /dev/null
+++ b/poverty-mapping/src/api/get_client_config.php
@@ -0,0 +1,9 @@
+<?php
+// Return minimal client config (keep API keys out of the browser)
+header('Content-Type: application/json; charset=utf-8');
+include __DIR__ . '/../config/config.php';
+
+
+echo json_encode(['api_key'=>null]);
+
+?>
diff --git a/poverty-mapping/src/api/get_lokasi.php b/poverty-mapping/src/api/get_lokasi.php
new file mode 100644
index 0000000..381b50c
--- /dev/null
+++ b/poverty-mapping/src/api/get_lokasi.php
@@ -0,0 +1,79 @@
+<?php
+include __DIR__ . '/../config/koneksi.php';
+include __DIR__ . '/../config/auth.php';
+header('Content-Type: application/json; charset=utf-8');
+
+function table_exists_local($conn, $tableName){
+    $st = $conn->prepare("SELECT 1 FROM INFORMATION_SCHEMA.TABLES WHERE TABLE_SCHEMA = DATABASE() AND TABLE_NAME = ? LIMIT 1");
+    if(!$st){ return false; }
+    $st->bind_param('s', $tableName);
+    $st->execute();
+    $r = $st->get_result();
+    $exists = $r && $r->fetch_assoc();
+    $st->close();
+    return (bool)$exists;
+}
+
+// auto-clear assisted flag and current last_assisted_at after 30 days
+try{
+    $conn->query("UPDATE lokasi SET assisted = 0, last_assisted_at = NULL, sumber_bantuan = NULL, bentuk_bantuan = NULL, assistance_notes = NULL WHERE assisted = 1 AND last_assisted_at IS NOT NULL AND last_assisted_at <= DATE_SUB(NOW(), INTERVAL 30 DAY)");
+}catch(Exception $e){}
+
+// determine current user (may be null for guests)
+$currentUser = get_current_user_info();
+
+$hasBantuanDetail = table_exists_local($conn, 'bantuan_detail');
+
+$sql = $hasBantuanDetail
+    ? "SELECT l.*, COALESCE(a.total_bantuan, 0) AS total_bantuan, COALESCE(a.bantuan_bulan_ini, 0) AS bantuan_bulan_ini,
+               p.nama AS sumber_bantuan_name, p.jenis AS sumber_bantuan_jenis
+        FROM lokasi l
+        LEFT JOIN (
+            SELECT pemberi_lokasi_id,
+                   COUNT(*) AS total_bantuan,
+                   SUM(CASE
+                       WHEN tanggal_bantuan >= DATE_FORMAT(CURDATE(), '%Y-%m-01')
+                        AND tanggal_bantuan < DATE_ADD(DATE_FORMAT(CURDATE(), '%Y-%m-01'), INTERVAL 1 MONTH)
+                       THEN 1 ELSE 0 END) AS bantuan_bulan_ini
+            FROM bantuan_detail
+            WHERE pemberi_lokasi_id IS NOT NULL
+            GROUP BY pemberi_lokasi_id
+        ) a ON a.pemberi_lokasi_id = l.id
+        LEFT JOIN lokasi p ON p.id = l.sumber_bantuan
+        ORDER BY l.id ASC"
+    : "SELECT l.*, 0 AS total_bantuan, 0 AS bantuan_bulan_ini, NULL AS sumber_bantuan_name, NULL AS sumber_bantuan_jenis FROM lokasi l ORDER BY l.id ASC";
+
+try{
+    $result = $conn->query($sql);
+}catch(Throwable $e){
+    $result = false;
+}
+
+if(!$result){
+    $fallback = $conn->query("SELECT l.*, 0 AS total_bantuan, 0 AS bantuan_bulan_ini FROM lokasi l ORDER BY l.id ASC");
+    if(!$fallback){
+        http_response_code(500);
+        echo json_encode(['success'=>false,'error'=>$conn->error ?: 'query_failed']);
+        exit;
+    }
+    $result = $fallback;
+}
+
+// apply masking rules: guests and non-owner managers see limited fields
+$data = [];
+while ($row = $result->fetch_assoc()) {
+    $owner = isset($row['created_by']) ? intval($row['created_by']) : null;
+    $isAdmin = ($currentUser && isset($currentUser['role']) && $currentUser['role'] === 'admin');
+    $isManager = ($currentUser && isset($currentUser['role']) && $currentUser['role'] === 'manager');
+    $isOwner = ($currentUser && isset($currentUser['id']) && intval($currentUser['id']) === $owner);
+    if(!$isAdmin && !$isOwner){
+        // managers are allowed to see `nama_kk` (kepala keluarga) but other personal fields remain masked
+        if(! $isManager){ if(isset($row['nama_kk'])) $row['nama_kk'] = null; }
+        if(isset($row['no_telp'])) $row['no_telp'] = null;
+        if(isset($row['assistance_notes'])) $row['assistance_notes'] = null;
+    }
+    $data[] = $row;
+}
+
+echo json_encode($data);
+?>
diff --git a/poverty-mapping/src/api/hapus_lokasi.php b/poverty-mapping/src/api/hapus_lokasi.php
new file mode 100644
index 0000000..37b73ad
--- /dev/null
+++ b/poverty-mapping/src/api/hapus_lokasi.php
@@ -0,0 +1,98 @@
+<?php
+include __DIR__ . '/../config/koneksi.php';
+include __DIR__ . '/../config/auth.php';
+
+header('Content-Type: application/json; charset=utf-8');
+
+// Require bearer/JWT auth only for deletes; managers may only delete their own records
+$currentUser = require_bearer_login();
+
+// accept DELETE or POST with JSON body or form
+$input = json_decode(file_get_contents('php://input'), true);
+$id = null;
+if($_SERVER['REQUEST_METHOD'] === 'DELETE'){
+	$id = isset($input['id']) ? $input['id'] : null;
+} else {
+	$id = isset($_POST['id']) ? $_POST['id'] : (isset($input['id']) ? $input['id'] : null);
+}
+
+function lokasi_id_uses_auto_increment($conn){
+	$st = $conn->prepare("SELECT DATA_TYPE, EXTRA FROM INFORMATION_SCHEMA.COLUMNS WHERE TABLE_SCHEMA = DATABASE() AND TABLE_NAME = 'lokasi' AND COLUMN_NAME = 'id' LIMIT 1");
+	if(!$st){ return false; }
+	$st->execute();
+	$r = $st->get_result();
+	$row = $r ? $r->fetch_assoc() : null;
+	$st->close();
+	if(!$row){ return false; }
+	$dataType = strtolower((string)$row['DATA_TYPE']);
+	$extra = strtolower((string)$row['EXTRA']);
+	return strpos($extra, 'auto_increment') !== false || in_array($dataType, array('tinyint','smallint','mediumint','int','bigint'), true);
+}
+
+$usesAutoId = lokasi_id_uses_auto_increment($conn);
+$id = trim((string)$id);
+if($usesAutoId){
+	if(!ctype_digit($id)){ http_response_code(400); echo json_encode(['success'=>false,'error'=>'invalid_id']); exit; }
+	$id = intval($id);
+} elseif($id === ''){
+	http_response_code(400); echo json_encode(['success'=>false,'error'=>'invalid_id']);
+	exit;
+}
+
+// Enforce manager ownership for delete
+try{
+	if(isset($currentUser['role']) && $currentUser['role'] === 'manager'){
+		$owner = null;
+		$selOwner = $conn->prepare('SELECT created_by FROM lokasi WHERE id = ? LIMIT 1');
+		if($selOwner){
+			if($usesAutoId){ $selOwner->bind_param('i', $id); } else { $selOwner->bind_param('s', $id); }
+			$selOwner->execute();
+			$rOwner = $selOwner->get_result();
+			$rowOwner = $rOwner ? $rOwner->fetch_assoc() : null;
+			$selOwner->close();
+			$owner = $rowOwner && isset($rowOwner['created_by']) ? intval($rowOwner['created_by']) : null;
+		}
+		if($owner !== intval($currentUser['id'])){ http_response_code(403); echo json_encode(['success'=>false,'error'=>'forbidden']); exit; }
+	}
+}catch(Exception $e){ /* ignore */ }
+
+$photoPath = null;
+$sel = $conn->prepare('SELECT photo_path FROM lokasi WHERE id = ? LIMIT 1');
+if($sel){
+	$sel->bind_param($usesAutoId ? 'i' : 's', $id);
+	$sel->execute();
+	$r = $sel->get_result();
+	if($row = $r->fetch_assoc()){
+		$photoPath = isset($row['photo_path']) ? $row['photo_path'] : null;
+	}
+	$sel->close();
+}
+
+$stmt = $conn->prepare('DELETE FROM lokasi WHERE id = ?');
+if(!$stmt){ http_response_code(500); echo json_encode(['success'=>false,'error'=>$conn->error]); exit; }
+$stmt->bind_param($usesAutoId ? 'i' : 's', $id);
+$res = $stmt->execute();
+$stmt->close();
+
+if($res){
+	if($photoPath){
+		$root = realpath(__DIR__ . '/../../');
+		$uploadDir = $root ? ($root . '/uploads') : (__DIR__ . '/../../uploads');
+		$oldBase = basename(parse_url($photoPath, PHP_URL_PATH));
+		$possibleFiles = array(
+			$uploadDir . '/' . $oldBase,
+			$uploadDir . '/' . $photoPath,
+			$root ? ($root . '/' . ltrim($photoPath, '/')) : null
+		);
+		foreach($possibleFiles as $candidate){
+			if(!$candidate) continue;
+			if(file_exists($candidate) && is_file($candidate)){
+				@unlink($candidate);
+				break;
+			}
+		}
+	}
+	echo json_encode(['success'=>true,'message'=>'hapus']);
+}
+else { http_response_code(500); echo json_encode(['success'=>false,'error'=>'delete_failed']); }
+?>
diff --git a/poverty-mapping/src/api/tambah_lokasi.php b/poverty-mapping/src/api/tambah_lokasi.php
new file mode 100644
index 0000000..8add1e7
--- /dev/null
+++ b/poverty-mapping/src/api/tambah_lokasi.php
@@ -0,0 +1,194 @@
+<?php
+include __DIR__ . '/../config/koneksi.php';
+include __DIR__ . '/../config/auth.php';
+
+header('Content-Type: application/json; charset=utf-8');
+
+// Require bearer/JWT auth only for creation
+$currentUser = require_bearer_login();
+
+$data = json_decode(file_get_contents("php://input"), true);
+if(!$data){
+    http_response_code(400);
+    echo json_encode(["success"=>false,"error"=>"invalid_json"]);
+    exit;
+}
+
+$nama = isset($data['nama']) ? $data['nama'] : '';
+$jenis = isset($data['jenis']) ? $data['jenis'] : '';
+$no_telp = isset($data['no_telp']) ? $data['no_telp'] : '';
+$buka = isset($data['buka_24_jam']) ? intval($data['buka_24_jam']) : 0;
+$alamat = isset($data['alamat']) ? $data['alamat'] : '';
+$lat = isset($data['latitude']) ? floatval($data['latitude']) : 0.0;
+$lng = isset($data['longitude']) ? floatval($data['longitude']) : 0.0;
+$nama_kk = isset($data['nama_kk']) ? $data['nama_kk'] : '';
+$rumah_status = isset($data['rumah_status']) ? $data['rumah_status'] : '';
+$members = isset($data['members']) ? intval($data['members']) : 0;
+$monthly_income = isset($data['monthly_income']) ? (int) round(floatval($data['monthly_income'])) : 0;
+$assisted = isset($data['assisted']) ? intval($data['assisted']) : 0;
+$last_assisted_at = isset($data['last_assisted_at']) ? $data['last_assisted_at'] : null;
+$sumber_bantuan = isset($data['sumber_bantuan']) ? $data['sumber_bantuan'] : null;
+$bentuk_bantuan = isset($data['bentuk_bantuan']) ? $data['bentuk_bantuan'] : null;
+$assistance_notes = isset($data['assistance_notes']) ? $data['assistance_notes'] : null;
+
+function normalize_source_bantuan_id($conn, $value){
+    if($value === null){ return null; }
+    $raw = trim((string)$value);
+    if($raw === ''){ return null; }
+    if(ctype_digit($raw)){
+        $id = intval($raw);
+        $st = $conn->prepare('SELECT id FROM lokasi WHERE id = ? LIMIT 1');
+        if(!$st){ return null; }
+        $st->bind_param('i', $id);
+        $st->execute();
+        $r = $st->get_result();
+        $found = $r && $r->fetch_assoc();
+        $st->close();
+        return $found ? $id : null;
+    }
+    return $raw === '' ? null : $raw;
+}
+
+function lokasi_id_uses_auto_increment($conn){
+    $st = $conn->prepare("SELECT DATA_TYPE, EXTRA FROM INFORMATION_SCHEMA.COLUMNS WHERE TABLE_SCHEMA = DATABASE() AND TABLE_NAME = 'lokasi' AND COLUMN_NAME = 'id' LIMIT 1");
+    if(!$st){ return false; }
+    $st->execute();
+    $r = $st->get_result();
+    $row = $r ? $r->fetch_assoc() : null;
+    $st->close();
+    if(!$row){ return false; }
+    $dataType = strtolower((string)$row['DATA_TYPE']);
+    $extra = strtolower((string)$row['EXTRA']);
+    return strpos($extra, 'auto_increment') !== false || in_array($dataType, array('tinyint','smallint','mediumint','int','bigint'), true);
+}
+
+function generate_lokasi_string_id($conn){
+    for($i = 0; $i < 20; $i++){
+        $candidate = substr(bin2hex(random_bytes(4)), 0, 8);
+        $st = $conn->prepare('SELECT id FROM lokasi WHERE id = ? LIMIT 1');
+        if(!$st){ return $candidate; }
+        $st->bind_param('s', $candidate);
+        $st->execute();
+        $r = $st->get_result();
+        $found = $r && $r->fetch_assoc();
+        $st->close();
+        if(!$found){ return $candidate; }
+    }
+    return substr(bin2hex(random_bytes(4)), 0, 8);
+}
+
+// ensure assistance-related columns exist (best-effort)
+try{ $conn->query("ALTER TABLE lokasi ADD COLUMN sumber_bantuan INT NULL"); }catch(Exception $e){}
+try{ $conn->query("ALTER TABLE lokasi ADD COLUMN bentuk_bantuan VARCHAR(100) NULL"); }catch(Exception $e){}
+try{ $conn->query("ALTER TABLE lokasi ADD COLUMN created_by INT NULL"); }catch(Exception $e){}
+
+$created_by = isset($currentUser['id']) ? intval($currentUser['id']) : null;
+
+$sumber_bantuan = normalize_source_bantuan_id($conn, $sumber_bantuan);
+
+$usesAutoId = lokasi_id_uses_auto_increment($conn);
+
+$insertValues = array($nama, $jenis, $no_telp, $buka, $alamat, $lat, $lng, $nama_kk, $rumah_status, $members, $monthly_income, $assisted, $last_assisted_at, $sumber_bantuan, $bentuk_bantuan, $assistance_notes);
+
+// include created_by field in insert
+if($usesAutoId){
+    $params = array_merge($insertValues, array($created_by));
+    $types = str_repeat('s', count($params));
+    $stmt = $conn->prepare("INSERT INTO lokasi (nama, jenis, no_telp, buka_24_jam, alamat, latitude, longitude, nama_kk, rumah_status, members, monthly_income, assisted, last_assisted_at, sumber_bantuan, bentuk_bantuan, assistance_notes, created_by) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)");
+    if(!$stmt){ http_response_code(500); echo json_encode(['success'=>false,'error'=>$conn->error]); exit; }
+    $bind_names[] = $types;
+    for($i=0;$i<count($params);$i++){ $bind_name = 'bind'.$i; $$bind_name = $params[$i]; $bind_names[] = &$$bind_name; }
+    call_user_func_array(array($stmt,'bind_param'), $bind_names);
+    $res = $stmt->execute();
+    $newId = $conn->insert_id;
+    $stmt->close();
+} else {
+    $newId = generate_lokasi_string_id($conn);
+    $params = array_merge(array($newId), $insertValues, array($created_by));
+    $types = str_repeat('s', count($params));
+    $stmt = $conn->prepare("INSERT INTO lokasi (id, nama, jenis, no_telp, buka_24_jam, alamat, latitude, longitude, nama_kk, rumah_status, members, monthly_income, assisted, last_assisted_at, sumber_bantuan, bentuk_bantuan, assistance_notes, created_by) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)");
+    if(!$stmt){ http_response_code(500); echo json_encode(['success'=>false,'error'=>$conn->error]); exit; }
+    $bind_names = array($types);
+    for($i=0;$i<count($params);$i++){ $bind_name = 'b'. $i; $$bind_name = $params[$i]; $bind_names[] = &$$bind_name; }
+    call_user_func_array(array($stmt,'bind_param'), $bind_names);
+    $res = $stmt->execute();
+    $stmt->close();
+}
+
+if(!$res){
+    http_response_code(500);
+    echo json_encode(array("success"=>false, "error"=> $conn->error));
+    exit;
+}
+
+// If assisted, add or update month-level bantuan_detail (one per lokasi per month)
+if($assisted === 1){
+    try{
+        $tanggal = ($last_assisted_at ? $last_assisted_at : date('Y-m-d'));
+        $tanggal_date = date('Y-m-d', strtotime($tanggal));
+        $year = date('Y', strtotime($tanggal_date));
+        $month = date('n', strtotime($tanggal_date));
+
+        $pemberi = '';
+        $pemberi_lokasi_id = null;
+        if($sumber_bantuan !== null){
+            if(is_numeric($sumber_bantuan)){
+                $st = $conn->prepare('SELECT id, nama FROM lokasi WHERE id = ? LIMIT 1');
+                if($st){
+                    $sid = intval($sumber_bantuan);
+                    $st->bind_param('i', $sid);
+                    $st->execute();
+                    $r = $st->get_result();
+                    if($r && ($row = $r->fetch_assoc())){ $pemberi = $row['nama']; $pemberi_lokasi_id = intval($row['id']); }
+                    $st->close();
+                }
+            } else {
+                $pemberi = (string)$sumber_bantuan;
+            }
+        }
+
+        $chk = $conn->prepare('SELECT id, jumlah FROM bantuan_detail WHERE lokasi_id = ? AND YEAR(tanggal_bantuan) = ? AND MONTH(tanggal_bantuan) = ? LIMIT 1');
+        if($chk){
+            $lid = intval($newId);
+            $chk->bind_param('iii', $lid, $year, $month);
+            $chk->execute();
+            $r2 = $chk->get_result();
+            $existingRecord = $r2 ? $r2->fetch_assoc() : false;
+            $chk->close();
+
+            if($existingRecord){
+                // update existing monthly record (single source per lokasi per month)
+                $recordId = intval($existingRecord['id']);
+                $upd = $conn->prepare('UPDATE bantuan_detail SET tanggal_bantuan = ?, pemberi_bantuan = ?, catatan = ?, pemberi_lokasi_id = ?, jumlah = 1 WHERE id = ?');
+                if($upd){
+                    $p_lokasi = $pemberi_lokasi_id !== null ? $pemberi_lokasi_id : null;
+                    $upd->bind_param('sssii', $tanggal_date, $pemberi, $assistance_notes, $p_lokasi, $recordId);
+                    @ $upd->execute();
+                    $upd->close();
+                }
+            } else {
+                // insert new monthly record
+                if($pemberi_lokasi_id !== null){
+                    $ins = $conn->prepare('INSERT INTO bantuan_detail (lokasi_id, tanggal_bantuan, pemberi_bantuan, catatan, pemberi_lokasi_id, jumlah) VALUES (?, ?, ?, ?, ?, 1)');
+                    if($ins){
+                        $ins->bind_param('isssi', $lid, $tanggal_date, $pemberi, $assistance_notes, $pemberi_lokasi_id);
+                        @ $ins->execute();
+                        $ins->close();
+                    }
+                } else {
+                    $ins = $conn->prepare('INSERT INTO bantuan_detail (lokasi_id, tanggal_bantuan, pemberi_bantuan, catatan, jumlah) VALUES (?, ?, ?, ?, 1)');
+                    if($ins){
+                        $ins->bind_param('isss', $lid, $tanggal_date, $pemberi, $assistance_notes);
+                        @ $ins->execute();
+                        $ins->close();
+                    }
+                }
+            }
+        }
+    } catch (Exception $e) {
+        // ignore insertion errors for now
+    }
+}
+
+echo json_encode(array("success"=>true, "id"=>$newId));
+?>
diff --git a/poverty-mapping/src/api/update_lokasi.php b/poverty-mapping/src/api/update_lokasi.php
new file mode 100644
index 0000000..f6fe977
--- /dev/null
+++ b/poverty-mapping/src/api/update_lokasi.php
@@ -0,0 +1,277 @@
+<?php
+include __DIR__ . '/../config/koneksi.php';
+include __DIR__ . '/../config/auth.php';
+
+header('Content-Type: application/json; charset=utf-8');
+
+// Require bearer/JWT auth only for edits
+$currentUser = require_bearer_login();
+
+// ensure created_by exists
+try{ $conn->query("ALTER TABLE lokasi ADD COLUMN IF NOT EXISTS created_by INT NULL"); }catch(Exception $e){}
+
+$data = json_decode(file_get_contents("php://input"), true);
+
+$id = isset($data['id']) ? $data['id'] : '';
+$id = trim((string)$id);
+$nama = isset($data['nama']) ? $data['nama'] : null;
+$no_telp = isset($data['no_telp']) ? $data['no_telp'] : null;
+$buka = isset($data['buka_24_jam']) ? intval($data['buka_24_jam']) : null;
+$alamat = isset($data['alamat']) ? $data['alamat'] : null;
+$jenis = isset($data['jenis']) ? $data['jenis'] : null;
+
+// household fields
+$nama_kk = isset($data['nama_kk']) ? $data['nama_kk'] : null;
+$building_type = isset($data['building_type']) ? $data['building_type'] : null;
+$rumah_status = isset($data['rumah_status']) ? $data['rumah_status'] : null;
+$members = isset($data['members']) ? (is_numeric($data['members']) ? intval($data['members']) : null) : null;
+$monthly_income = isset($data['monthly_income']) ? (is_numeric($data['monthly_income']) ? (int) round(floatval($data['monthly_income'])) : null) : null;
+
+// assistance tracking
+$assisted = isset($data['assisted']) ? (intval($data['assisted']) ? 1 : 0) : null;
+$last_assisted_at = isset($data['last_assisted_at']) ? $data['last_assisted_at'] : null;
+$sumber_bantuan = isset($data['sumber_bantuan']) ? $data['sumber_bantuan'] : null;
+$bentuk_bantuan = isset($data['bentuk_bantuan']) ? $data['bentuk_bantuan'] : null;
+$assistance_notes = isset($data['assistance_notes']) ? $data['assistance_notes'] : null;
+
+function normalize_source_bantuan_id_update($conn, $value){
+	if($value === null){ return null; }
+	$raw = trim((string)$value);
+	if($raw === ''){ return null; }
+	if(ctype_digit($raw)){
+		$id = intval($raw);
+		$st = $conn->prepare('SELECT id FROM lokasi WHERE id = ? LIMIT 1');
+		if(!$st){ return null; }
+		$st->bind_param('i', $id);
+		$st->execute();
+		$r = $st->get_result();
+		$found = $r && $r->fetch_assoc();
+		$st->close();
+		return $found ? $id : null;
+	}
+	$st = $conn->prepare('SELECT id FROM lokasi WHERE LOWER(nama) = LOWER(?) LIMIT 1');
+	if(!$st){ return null; }
+	$st->bind_param('s', $raw);
+	$st->execute();
+	$r = $st->get_result();
+	$row = $r ? $r->fetch_assoc() : null;
+	$st->close();
+	return $row ? intval($row['id']) : null;
+}
+
+function lokasi_id_uses_auto_increment($conn){
+	$st = $conn->prepare("SELECT DATA_TYPE, EXTRA FROM INFORMATION_SCHEMA.COLUMNS WHERE TABLE_SCHEMA = DATABASE() AND TABLE_NAME = 'lokasi' AND COLUMN_NAME = 'id' LIMIT 1");
+	if(!$st){ return false; }
+	$st->execute();
+	$r = $st->get_result();
+	$row = $r ? $r->fetch_assoc() : null;
+	$st->close();
+	if(!$row){ return false; }
+	$dataType = strtolower((string)$row['DATA_TYPE']);
+	$extra = strtolower((string)$row['EXTRA']);
+	return strpos($extra, 'auto_increment') !== false || in_array($dataType, array('tinyint','smallint','mediumint','int','bigint'), true);
+}
+
+$sumber_bantuan = normalize_source_bantuan_id_update($conn, $sumber_bantuan);
+$usesAutoId = lokasi_id_uses_auto_increment($conn);
+
+$sets = [];
+$types = '';
+$values = [];
+if($nama !== null){ $sets[] = 'nama = ?'; $types .= 's'; $values[] = $nama; }
+if($no_telp !== null){ $sets[] = 'no_telp = ?'; $types .= 's'; $values[] = $no_telp; }
+if($buka !== null){ $sets[] = 'buka_24_jam = ?'; $types .= 'i'; $values[] = $buka; }
+if($alamat !== null){ $sets[] = 'alamat = ?'; $types .= 's'; $values[] = $alamat; }
+if($jenis !== null){ $sets[] = 'jenis = ?'; $types .= 's'; $values[] = $jenis; }
+
+if($nama_kk !== null){ $sets[] = 'nama_kk = ?'; $types .= 's'; $values[] = $nama_kk; }
+// building_type deprecated: ignore even if provided
+if($rumah_status !== null){ $sets[] = 'rumah_status = ?'; $types .= 's'; $values[] = $rumah_status; }
+if($members !== null){ $sets[] = 'members = ?'; $types .= 'i'; $values[] = $members; }
+if($monthly_income !== null){ $sets[] = 'monthly_income = ?'; $types .= 'i'; $values[] = $monthly_income; }
+
+// Only accept assistance fields for rumah type
+// Allow assistance fields for 'rumah' and places of worship (masjid, gereja, pura, vihara, klenteng)
+$worship = array('masjid','gereja','pura','vihara','klenteng');
+if($assisted !== null && ($jenis === null || $jenis === 'rumah' || in_array($jenis, $worship))){ $sets[] = 'assisted = ?'; $types .= 'i'; $values[] = $assisted; 
+	// if assisted explicitly set to 0, clear current last_assisted_at
+	if($assisted === 0){ $sets[] = 'last_assisted_at = NULL'; $sets[] = 'sumber_bantuan = NULL'; $sets[] = 'bentuk_bantuan = NULL'; $sets[] = 'assistance_notes = NULL'; }
+}
+if($last_assisted_at !== null && ($jenis === null || $jenis === 'rumah' || in_array($jenis, $worship))){ $sets[] = 'last_assisted_at = ?'; $types .= 's'; $values[] = $last_assisted_at; }
+if($sumber_bantuan !== null && ($jenis === null || $jenis === 'rumah' || in_array($jenis, $worship))){ $sets[] = 'sumber_bantuan = ?'; $types .= 'i'; $values[] = $sumber_bantuan; }
+if($bentuk_bantuan !== null && ($jenis === null || $jenis === 'rumah' || in_array($jenis, $worship))){ $sets[] = 'bentuk_bantuan = ?'; $types .= 's'; $values[] = $bentuk_bantuan; }
+if($assistance_notes !== null && ($jenis === null || $jenis === 'rumah' || in_array($jenis, $worship))){ $sets[] = 'assistance_notes = ?'; $types .= 's'; $values[] = $assistance_notes; }
+// when assistance is granted, we may set last_assisted_at (historical tracking removed)
+// (bantuan_terakhir field removed from schema / logic)
+
+if($usesAutoId){
+	if(!ctype_digit($id)){ http_response_code(400); echo json_encode(['success'=>false,'error'=>'invalid_id']); exit; }
+	$id = intval($id);
+} elseif($id === ''){
+	http_response_code(400);
+	echo json_encode(['success'=>false,'error'=>'invalid_id']);
+	exit;
+}
+
+// Enforce manager edit rules: managers may fully edit their own lokasi.
+// Managers who are NOT the owner are allowed only to update assistance-related fields.
+try{
+	if(isset($currentUser['role']) && $currentUser['role'] === 'manager'){
+		$sel = $conn->prepare('SELECT created_by FROM lokasi WHERE id = ? LIMIT 1');
+		if($sel){
+			if($usesAutoId){ $sel->bind_param('i', $id); } else { $sel->bind_param('s', $id); }
+			$sel->execute(); $r = $sel->get_result(); $row = $r ? $r->fetch_assoc() : null; $sel->close();
+			$owner = $row && isset($row['created_by']) ? intval($row['created_by']) : null;
+			if($owner !== intval($currentUser['id'])){
+				// user is a manager but not the owner. Allow only assistance-only updates.
+				$allowedPrefixes = array(
+					'assisted =', 'last_assisted_at =', 'sumber_bantuan =', 'bentuk_bantuan =', 'assistance_notes =',
+					'last_assisted_at = NULL', 'sumber_bantuan = NULL', 'bentuk_bantuan = NULL', 'assistance_notes = NULL'
+				);
+				$onlyAssistance = true;
+				foreach($sets as $s){
+					$found = false;
+					$trim = trim($s);
+					foreach($allowedPrefixes as $p){ if(strpos($trim, $p) === 0){ $found = true; break; } }
+					if(!$found){ $onlyAssistance = false; break; }
+				}
+				if(!$onlyAssistance){ http_response_code(403); echo json_encode(['success'=>false,'error'=>'forbidden']); exit; }
+			}
+		}
+	}
+}catch(Exception $e){ /* ignore */ }
+
+if(empty($sets)){
+	http_response_code(400);
+	echo json_encode(['success'=>false,'error'=>'missing_id_or_fields']);
+	exit;
+}
+
+$sql = 'UPDATE lokasi SET ' . implode(', ', $sets) . ' WHERE id = ?';
+$types .= $usesAutoId ? 'i' : 's';
+$values[] = $id;
+
+$stmt = $conn->prepare($sql);
+if(!$stmt){ http_response_code(500); echo json_encode(['success'=>false,'error'=>$conn->error]); exit; }
+
+// bind params dynamically
+$bind_names[] = $types;
+for ($i=0; $i<count($values); $i++){
+	$bind_name = 'bind' . $i;
+	$$bind_name = $values[$i];
+	$bind_names[] = &$$bind_name;
+}
+call_user_func_array([$stmt, 'bind_param'], $bind_names);
+$res = $stmt->execute();
+$stmt->close();
+
+if($res){
+	// Jika update berhasil dan ada tanda bantuan, coba masukkan record ke bantuan_detail
+	try {
+		// If assisted explicitly reset to 0, delete existing bantuan_detail for this lokasi for the same month
+		if($assisted !== null && $assisted === 0){
+			$delYear = date('Y');
+			$delMonth = date('n');
+			try{
+				$del = $conn->prepare('DELETE FROM bantuan_detail WHERE lokasi_id = ? AND YEAR(tanggal_bantuan) = ? AND MONTH(tanggal_bantuan) = ?');
+				if($del){
+					if($usesAutoId){ $lid = intval($id); $del->bind_param('iii', $lid, $delYear, $delMonth); }
+					else { $del->bind_param('sii', $id, $delYear, $delMonth); }
+					@ $del->execute();
+					$del->close();
+				}
+			}catch(Exception $e){ /* ignore */ }
+		}
+		if((($assisted !== null && $assisted === 1) || $last_assisted_at !== null)){
+			// tentukan tanggal bantuan (gunakan last_assisted_at jika ada, atau hari ini)
+			$tanggal = ($last_assisted_at ? $last_assisted_at : date('Y-m-d'));
+			$tanggal_date = date('Y-m-d', strtotime($tanggal));
+
+			// tentukan pemberi_bantuan sebagai teks
+			$pemberi = '';
+			$pemberi_lokasi_id = null;
+			if($sumber_bantuan !== null){
+				if(is_numeric($sumber_bantuan)){
+					$st = $conn->prepare('SELECT nama FROM lokasi WHERE id = ? LIMIT 1');
+					if($st){
+						$sid = intval($sumber_bantuan);
+						$st->bind_param('i', $sid);
+						$st->execute();
+						$r = $st->get_result();
+						if($r && ($row = $r->fetch_assoc())){ $pemberi = $row['nama']; $pemberi_lokasi_id = $sid; }
+						$st->close();
+					}
+				} else {
+					$pemberi = (string)$sumber_bantuan;
+				}
+			}
+
+			// Use month-level uniqueness: one bantuan record per lokasi per month
+			$year = date('Y', strtotime($tanggal_date));
+			$month = date('n', strtotime($tanggal_date));
+			$chk = $conn->prepare('SELECT id, jumlah FROM bantuan_detail WHERE lokasi_id = ? AND YEAR(tanggal_bantuan) = ? AND MONTH(tanggal_bantuan) = ? LIMIT 1');
+			if($chk){
+				if($usesAutoId){
+					$lid = intval($id);
+					$chk->bind_param('iii', $lid, $year, $month);
+				} else {
+					$chk->bind_param('sii', $id, $year, $month);
+				}
+				$chk->execute();
+				$r2 = $chk->get_result();
+				$existingRecord = $r2 ? $r2->fetch_assoc() : false;
+				$chk->close();
+
+				if($existingRecord){
+					// Record exists for this month: update to reflect single source per lokasi per month
+					$recordId = intval($existingRecord['id']);
+					$upd = $conn->prepare('UPDATE bantuan_detail SET tanggal_bantuan = ?, pemberi_bantuan = ?, catatan = ?, pemberi_lokasi_id = ?, jumlah = 1 WHERE id = ?');
+					if($upd){
+						$p_lokasi = $pemberi_lokasi_id !== null ? $pemberi_lokasi_id : null;
+						if($usesAutoId){
+							$upd->bind_param('sssii', $tanggal_date, $pemberi, $assistance_notes, $p_lokasi, $recordId);
+						} else {
+							$upd->bind_param('sssii', $tanggal_date, $pemberi, $assistance_notes, $p_lokasi, $recordId);
+						}
+						@ $upd->execute();
+						$upd->close();
+					}
+				} else {
+					// Record doesn't exist: insert new with jumlah=1
+					if($pemberi_lokasi_id !== null){
+						$ins = $conn->prepare('INSERT INTO bantuan_detail (lokasi_id, tanggal_bantuan, pemberi_bantuan, catatan, pemberi_lokasi_id, jumlah) VALUES (?, ?, ?, ?, ?, 1)');
+						if($ins){
+							if($usesAutoId){
+								$ins->bind_param('isssi', $lid, $tanggal_date, $pemberi, $assistance_notes, $pemberi_lokasi_id);
+							} else {
+								$ins->bind_param('isssi', $id, $tanggal_date, $pemberi, $assistance_notes, $pemberi_lokasi_id);
+							}
+							@ $ins->execute();
+							$ins->close();
+						}
+					} else {
+						$ins = $conn->prepare('INSERT INTO bantuan_detail (lokasi_id, tanggal_bantuan, pemberi_bantuan, catatan, jumlah) VALUES (?, ?, ?, ?, 1)');
+						if($ins){
+							if($usesAutoId){
+								$ins->bind_param('isss', $lid, $tanggal_date, $pemberi, $assistance_notes);
+							} else {
+								$ins->bind_param('isss', $id, $tanggal_date, $pemberi, $assistance_notes);
+							}
+							@ $ins->execute();
+							$ins->close();
+						}
+					}
+				}
+			}
+		}
+	} catch (Exception $e) {
+		error_log('Insert bantuan_detail failed during update: ' . $e->getMessage());
+	}
+
+	echo json_encode(["success"=>true]);
+} else {
+	http_response_code(500);
+	echo json_encode(["success"=>false, "error"=>$conn->error]);
+}
+
+?>
diff --git a/poverty-mapping/src/api/upload_photo.php b/poverty-mapping/src/api/upload_photo.php
new file mode 100644
index 0000000..f4fb38d
--- /dev/null
+++ b/poverty-mapping/src/api/upload_photo.php
@@ -0,0 +1,142 @@
+<?php
+include __DIR__ . '/../config/koneksi.php';
+include __DIR__ . '/../config/auth.php';
+
+header('Content-Type: application/json; charset=utf-8');
+
+$currentUser = require_bearer_login();
+
+if(empty($_FILES['file']) || empty($_POST['id'])){
+    http_response_code(400);
+    echo json_encode(['success'=>false,'error'=>'missing_file_or_id']);
+    exit;
+}
+
+$id = $_POST['id'];
+$id = trim((string)$id);
+
+function lokasi_id_uses_auto_increment($conn){
+    $st = $conn->prepare("SELECT DATA_TYPE, EXTRA FROM INFORMATION_SCHEMA.COLUMNS WHERE TABLE_SCHEMA = DATABASE() AND TABLE_NAME = 'lokasi' AND COLUMN_NAME = 'id' LIMIT 1");
+    if(!$st){ return false; }
+    $st->execute();
+    $r = $st->get_result();
+    $row = $r ? $r->fetch_assoc() : null;
+    $st->close();
+    if(!$row){ return false; }
+    $dataType = strtolower((string)$row['DATA_TYPE']);
+    $extra = strtolower((string)$row['EXTRA']);
+    return strpos($extra, 'auto_increment') !== false || in_array($dataType, array('tinyint','smallint','mediumint','int','bigint'), true);
+}
+
+$usesAutoId = lokasi_id_uses_auto_increment($conn);
+if($usesAutoId){
+    if(!ctype_digit($id)){ http_response_code(400); echo json_encode(['success'=>false,'error'=>'invalid_id']); exit; }
+    $id = intval($id);
+} elseif($id === ''){
+    http_response_code(400); echo json_encode(['success'=>false,'error'=>'invalid_id']);
+    exit;
+}
+
+// Enforce manager ownership for uploads
+try{
+    if(isset($currentUser['role']) && $currentUser['role'] === 'manager'){
+        $owner = null;
+        $selOwner = $conn->prepare('SELECT created_by FROM lokasi WHERE id = ? LIMIT 1');
+        if($selOwner){
+            if($usesAutoId){ $selOwner->bind_param('i', $id); } else { $selOwner->bind_param('s', $id); }
+            $selOwner->execute();
+            $rOwner = $selOwner->get_result();
+            $rowOwner = $rOwner ? $rOwner->fetch_assoc() : null;
+            $selOwner->close();
+            $owner = $rowOwner && isset($rowOwner['created_by']) ? intval($rowOwner['created_by']) : null;
+        }
+        if($owner !== intval($currentUser['id'])){ http_response_code(403); echo json_encode(['success'=>false,'error'=>'forbidden']); exit; }
+    }
+}catch(Exception $e){ /* ignore */ }
+$file = $_FILES['file'];
+
+if($file['error'] !== UPLOAD_ERR_OK){ http_response_code(400); echo json_encode(['success'=>false,'error'=>'upload_error']); exit; }
+
+// validate size (<=5MB)
+if($file['size'] > 5 * 1024 * 1024){ http_response_code(400); echo json_encode(['success'=>false,'error'=>'file_too_large']); exit; }
+
+// validate image type
+$finfo = finfo_open(FILEINFO_MIME_TYPE);
+$mime = finfo_file($finfo, $file['tmp_name']);
+finfo_close($finfo);
+if(strpos($mime,'image/') !== 0){ http_response_code(400); echo json_encode(['success'=>false,'error'=>'invalid_image_type']); exit; }
+
+$ext = strtolower(pathinfo($file['name'], PATHINFO_EXTENSION));
+$filenameOnly = pathinfo($file['name'], PATHINFO_FILENAME);
+$safeName = preg_replace('/[^a-zA-Z0-9_-]/', '_', $filenameOnly) . '.' . $ext;
+// normalize uploads directory path and create if needed
+$root = realpath(__DIR__ . '/../../');
+$targetDir = $root ? ($root . '/uploads') : (__DIR__ . '/../../uploads');
+if(!is_dir($targetDir)){
+    @mkdir($targetDir, 0777, true);
+}
+@chmod($targetDir, 0777);
+// ensure extension preserved
+$target = $targetDir . '/' . $id . '_' . time() . '_' . $safeName;
+
+// ensure target directory is writable
+@chmod($targetDir, 0777);
+$tmp = $file['tmp_name'];
+if(!is_uploaded_file($tmp)){
+    http_response_code(500);
+    echo json_encode(['success'=>false,'error'=>'not_uploaded_file','tmp'=>$tmp,'targetDir'=>$targetDir,'resolved_root'=>$root]);
+    exit;
+}
+// do not abort here; some filesystems (fuse/ntfs) report not-writable
+// we'll attempt move and fall back to PHP temp dir if it fails
+if(!move_uploaded_file($file['tmp_name'], $target)){
+    // Do not attempt other fallbacks. Return an explicit error so the caller knows upload failed.
+    $last = error_get_last();
+    http_response_code(500);
+    echo json_encode([
+        'success' => false,
+        'error' => 'move_failed',
+        'tmp' => $tmp,
+        'target' => $target,
+        'is_uploaded' => is_uploaded_file($tmp),
+        'target_writable' => is_writable($targetDir),
+        'last_error' => $last,
+        'resolved_root' => $root
+    ]);
+    exit;
+}
+
+$webPath = 'uploads/' . basename($target);
+// fetch existing photo_path so we can remove it after successful update
+$old = null;
+$sel = $conn->prepare('SELECT photo_path FROM lokasi WHERE id = ?');
+if($sel){
+    $sel->bind_param($usesAutoId ? 'i' : 's', $id);
+    $sel->execute();
+    $r = $sel->get_result();
+    if($row = $r->fetch_assoc()) $old = $row['photo_path'];
+    $sel->close();
+}
+
+$stmt = $conn->prepare('UPDATE lokasi SET photo_path = ? WHERE id = ?');
+if(!$stmt){ http_response_code(500); echo json_encode(['success'=>false,'error'=>$conn->error]); exit; }
+$stmt->bind_param($usesAutoId ? 'si' : 'ss', $webPath, $id);
+$res = $stmt->execute();
+$stmt->close();
+
+if($res){
+    // remove previous uploaded file if it was stored under uploads/
+    if($old){
+        // extract basename in case old contains query params
+        $oldBase = basename(parse_url($old, PHP_URL_PATH));
+        $oldFull = $targetDir . '/' . $oldBase;
+        if(file_exists($oldFull) && is_file($oldFull)){
+            @unlink($oldFull);
+        }
+    }
+    echo json_encode(['success'=>true,'path'=>$webPath]);
+} else {
+    http_response_code(500); echo json_encode(['success'=>false,'error'=>$conn->error]);
+}
+
+?>
diff --git a/poverty-mapping/src/config/auth.php b/poverty-mapping/src/config/auth.php
new file mode 100644
index 0000000..567e301
--- /dev/null
+++ b/poverty-mapping/src/config/auth.php
@@ -0,0 +1,271 @@
+<?php
+include_once __DIR__ . '/config.php';
+
+if(session_status() === PHP_SESSION_NONE) session_start();
+
+function start_session_if_needed(){ if(session_status() === PHP_SESSION_NONE) session_start(); }
+
+function auth_headers(){
+    if(function_exists('getallheaders')){
+        $headers = getallheaders();
+        if(is_array($headers)) return $headers;
+    }
+    $headers = [];
+    foreach($_SERVER as $key => $value){
+        if(strpos($key, 'HTTP_') === 0){
+            $name = str_replace(' ', '-', ucwords(strtolower(str_replace('_', ' ', substr($key, 5)))));
+            $headers[$name] = $value;
+        }
+    }
+    return $headers;
+}
+
+function auth_header_value($name){
+    $headers = auth_headers();
+    foreach($headers as $key => $value){
+        if(strtolower($key) === strtolower($name)) return $value;
+    }
+    return null;
+}
+
+function auth_json_response($statusCode, $payload){
+    http_response_code($statusCode);
+    header('Content-Type: application/json; charset=utf-8');
+    echo json_encode($payload);
+    exit;
+}
+
+function base64url_encode($data){ return rtrim(strtr(base64_encode($data), '+/', '-_'), '='); }
+function base64url_decode($data){ return base64_decode(strtr($data, '-_', '+/')); }
+
+function jwt_issue($claims, $ttlSeconds = 86400){
+    $now = time();
+    $payload = array_merge([
+        'iss' => 'webgis',
+        'iat' => $now,
+        'exp' => $now + max(60, intval($ttlSeconds)),
+    ], $claims);
+    $header = ['alg' => 'HS256', 'typ' => 'JWT'];
+    $encodedHeader = base64url_encode(json_encode($header));
+    $encodedPayload = base64url_encode(json_encode($payload));
+    $signature = hash_hmac('sha256', $encodedHeader . '.' . $encodedPayload, JWT_SECRET, true);
+    return $encodedHeader . '.' . $encodedPayload . '.' . base64url_encode($signature);
+}
+
+function jwt_verify($token){
+    if(!$token || strpos($token, '.') === false) return null;
+    $parts = explode('.', $token);
+    if(count($parts) !== 3) return null;
+    list($h, $p, $s) = $parts;
+    $header = json_decode(base64url_decode($h), true);
+    $payload = json_decode(base64url_decode($p), true);
+    if(!$header || !$payload) return null;
+    if(!isset($header['alg']) || $header['alg'] !== 'HS256') return null;
+    $expected = base64url_encode(hash_hmac('sha256', $h . '.' . $p, JWT_SECRET, true));
+    if(!hash_equals($expected, $s)) return null;
+    if(isset($payload['exp']) && time() > intval($payload['exp'])) return null;
+    return $payload;
+}
+
+function auth_basic_credentials(){
+    $header = auth_header_value('Authorization');
+    if(!$header && isset($_SERVER['PHP_AUTH_USER'])){
+        return [$_SERVER['PHP_AUTH_USER'], isset($_SERVER['PHP_AUTH_PW']) ? $_SERVER['PHP_AUTH_PW'] : ''];
+    }
+    if(!$header || stripos($header, 'Basic ') !== 0) return [null, null];
+    $decoded = base64_decode(substr($header, 6));
+    if($decoded === false || strpos($decoded, ':') === false) return [null, null];
+    list($user, $pass) = explode(':', $decoded, 2);
+    return [$user, $pass];
+}
+
+function auth_internal_cipher(){
+    return 'aes-256-gcm';
+}
+
+function auth_internal_key(){
+    return hash('sha256', INTERNAL_AUTH_KEY, true);
+}
+
+function internal_auth_issue($claims, $ttlSeconds = 300){
+    $payload = array_merge([
+        'iss' => 'webgis-internal',
+        'iat' => time(),
+        'exp' => time() + max(30, intval($ttlSeconds)),
+        'nonce' => bin2hex(random_bytes(8))
+    ], $claims);
+    $plaintext = json_encode($payload);
+    $iv = random_bytes(12);
+    $tag = '';
+    $ciphertext = openssl_encrypt($plaintext, auth_internal_cipher(), auth_internal_key(), OPENSSL_RAW_DATA, $iv, $tag);
+    if($ciphertext === false) return null;
+    return base64url_encode($iv . $tag . $ciphertext);
+}
+
+function internal_auth_verify($token){
+    if(!$token) return null;
+    $raw = base64url_decode($token);
+    if($raw === false || strlen($raw) < 28) return null;
+    $iv = substr($raw, 0, 12);
+    $tag = substr($raw, 12, 16);
+    $ciphertext = substr($raw, 28);
+    $plaintext = openssl_decrypt($ciphertext, auth_internal_cipher(), auth_internal_key(), OPENSSL_RAW_DATA, $iv, $tag);
+    if($plaintext === false) return null;
+    $payload = json_decode($plaintext, true);
+    if(!$payload) return null;
+    if(isset($payload['exp']) && time() > intval($payload['exp'])) return null;
+    return $payload;
+}
+
+function get_auth_context(){
+    start_session_if_needed();
+    global $conn;
+    $context = ['user' => null, 'mode' => null];
+
+    $internalToken = auth_header_value('X-Internal-Auth');
+    if($internalToken){
+        $internal = internal_auth_verify($internalToken);
+        if($internal){
+            $context['mode'] = 'internal';
+            $context['user'] = [
+                'id' => isset($internal['sub']) ? intval($internal['sub']) : 0,
+                'email' => isset($internal['email']) ? $internal['email'] : 'internal',
+                'name' => isset($internal['name']) ? $internal['name'] : 'Internal',
+                'organization' => isset($internal['organization']) ? $internal['organization'] : 'Internal',
+                'role' => isset($internal['role']) ? $internal['role'] : 'admin',
+                'status' => 'active'
+            ];
+            return $context;
+        }
+    }
+
+    $bearer = auth_header_value('Authorization');
+    if($bearer && stripos($bearer, 'Bearer ') === 0){
+        $payload = jwt_verify(trim(substr($bearer, 7)));
+        if($payload && isset($payload['sub'])){
+            $uid = intval($payload['sub']);
+            if($uid > 0 && $conn){
+                $st = $conn->prepare('SELECT id, email, name, organization, role, status FROM users WHERE id = ? LIMIT 1');
+                if($st){
+                    $st->bind_param('i', $uid);
+                    $st->execute();
+                    $r = $st->get_result();
+                    $row = $r ? $r->fetch_assoc() : null;
+                    $st->close();
+                    if($row){
+                        $context['mode'] = 'jwt';
+                        $context['user'] = $row;
+                        return $context;
+                    }
+                }
+            }
+        }
+    }
+
+    list($basicUser, $basicPass) = auth_basic_credentials();
+    if($basicUser !== null){
+        if($basicUser === BASIC_API_USER && hash_equals(BASIC_API_PASS, (string)$basicPass)){
+            $context['mode'] = 'basic';
+            $context['user'] = ['id' => 0, 'email' => 'api', 'name' => 'API', 'organization' => 'API', 'role' => 'admin', 'status' => 'active'];
+            return $context;
+        }
+        if($conn){
+            $st = $conn->prepare('SELECT id, email, name, organization, role, status, password_hash FROM users WHERE email = ? LIMIT 1');
+            if($st){
+                $st->bind_param('s', $basicUser);
+                $st->execute();
+                $r = $st->get_result();
+                $row = $r ? $r->fetch_assoc() : null;
+                $st->close();
+                if($row && password_verify((string)$basicPass, $row['password_hash'])){
+                    unset($row['password_hash']);
+                    $context['mode'] = 'basic';
+                    $context['user'] = $row;
+                    return $context;
+                }
+            }
+        }
+    }
+
+    if(isset($_SESSION['jwt'])){
+        $payload = jwt_verify($_SESSION['jwt']);
+        if($payload && isset($payload['sub']) && $conn){
+            $uid = intval($payload['sub']);
+            $st = $conn->prepare('SELECT id, email, name, organization, role, status FROM users WHERE id = ? LIMIT 1');
+            if($st){
+                $st->bind_param('i', $uid);
+                $st->execute();
+                $r = $st->get_result();
+                $row = $r ? $r->fetch_assoc() : null;
+                $st->close();
+                if($row){
+                    $context['mode'] = 'jwt';
+                    $context['user'] = $row;
+                    return $context;
+                }
+            }
+        }
+    }
+
+    return $context;
+}
+
+function get_current_user_info(){
+    $context = get_auth_context();
+    return $context['user'];
+}
+
+function require_auth($allowedModes = ['jwt','basic','internal']){
+    $context = get_auth_context();
+    $user = $context['user'];
+    if(!$user){ auth_json_response(401, ['success'=>false,'error'=>'unauthenticated']); }
+    if(isset($user['status']) && $user['status'] !== 'active'){
+        auth_json_response(403, ['success'=>false,'error'=>'account_not_active']);
+    }
+    if($allowedModes && $context['mode'] && !in_array($context['mode'], (array)$allowedModes, true)){
+        auth_json_response(403, ['success'=>false,'error'=>'forbidden']);
+    }
+    return $user;
+}
+
+function require_login(){
+    return require_auth(['jwt','basic','internal']);
+}
+
+function require_bearer_login(){
+    $context = get_auth_context();
+    if(!$context['user'] || $context['mode'] !== 'jwt'){
+        auth_json_response(401, ['success'=>false,'error'=>'bearer_required']);
+    }
+    if(isset($context['user']['status']) && $context['user']['status'] !== 'active'){
+        auth_json_response(403, ['success'=>false,'error'=>'account_not_active']);
+    }
+    return $context['user'];
+}
+
+function require_role($roles){
+    $user = require_login();
+    if(!in_array($user['role'], (array)$roles, true)){
+        auth_json_response(403, ['success'=>false,'error'=>'forbidden']);
+    }
+    return $user;
+}
+
+function auth_current_mode(){
+    $context = get_auth_context();
+    return $context['mode'];
+}
+
+function auth_issue_user_token($userId, $role, $extra = [], $ttlSeconds = 86400){
+    return jwt_issue(array_merge(['sub' => intval($userId), 'role' => $role], $extra), $ttlSeconds);
+}
+
+function auth_set_session_jwt($token){
+    start_session_if_needed();
+    $_SESSION['jwt'] = $token;
+}
+
+function auth_clear_session(){
+    start_session_if_needed();
+    foreach(['jwt','user_id'] as $key){ if(isset($_SESSION[$key])) unset($_SESSION[$key]); }
+}
diff --git a/poverty-mapping/src/config/config.php b/poverty-mapping/src/config/config.php
new file mode 100644
index 0000000..b5b21f1
--- /dev/null
+++ b/poverty-mapping/src/config/config.php
@@ -0,0 +1,49 @@
+<?php
+// Load environment from project root .env if present, then read API_KEY
+function load_dotenv($path){
+	if(!file_exists($path)) return;
+	$lines = file($path, FILE_IGNORE_NEW_LINES|FILE_SKIP_EMPTY_LINES);
+	foreach($lines as $line){
+		if(trim($line)==='' || strpos(trim($line),'#')===0) continue;
+		if(strpos($line,'=')===false) continue;
+		list($k,$v) = explode('=', $line, 2);
+		$k = trim($k); $v = trim($v);
+		// strip optional quotes
+		if((substr($v,0,1)==='"' && substr($v,-1)==='"') || (substr($v,0,1)==="'" && substr($v,-1)==="'")){
+			$v = substr($v,1,-1);
+		}
+		putenv("$k=$v");
+		$_ENV[$k] = $v;
+	}
+}
+
+$envPath = realpath(__DIR__ . '/../../.env');
+if($envPath){ load_dotenv($envPath); }
+
+$apiKey = getenv('API_KEY');
+if(!$apiKey) {
+	// fallback (development) - but prefer .env or system env in production
+	$apiKey = '8f3b7e6a9c4d2f1a6b8c9d0e4f7a1b2c';
+}
+define('API_KEY', $apiKey);
+
+$jwtSecret = getenv('JWT_SECRET');
+if(!$jwtSecret) {
+	$jwtSecret = hash('sha256', $apiKey . ':jwt');
+}
+define('JWT_SECRET', $jwtSecret);
+
+$internalKey = getenv('INTERNAL_AUTH_KEY');
+if(!$internalKey) {
+	$internalKey = hash('sha256', $apiKey . ':internal');
+}
+define('INTERNAL_AUTH_KEY', $internalKey);
+
+$basicApiUser = getenv('BASIC_API_USER');
+if(!$basicApiUser) { $basicApiUser = 'webgis-api'; }
+define('BASIC_API_USER', $basicApiUser);
+
+$basicApiPass = getenv('BASIC_API_PASS');
+if(!$basicApiPass) { $basicApiPass = hash('sha256', $apiKey . ':basic'); }
+define('BASIC_API_PASS', $basicApiPass);
+?>
diff --git a/poverty-mapping/src/config/koneksi.php b/poverty-mapping/src/config/koneksi.php
new file mode 100644
index 0000000..2423fa1
--- /dev/null
+++ b/poverty-mapping/src/config/koneksi.php
@@ -0,0 +1,15 @@
+<?php
+include_once __DIR__ . '/config.php';
+
+$dbHost = getenv('DB_HOST') ?: 'localhost';
+$dbPort = (int)(getenv('DB_PORT') ?: 3306);
+$dbUser = getenv('DB_USER') ?: 'root';
+$dbPass = getenv('DB_PASS') ?: 'ilham';
+$dbName = getenv('DB_NAME') ?: 'poverty_db';
+
+$conn = new mysqli($dbHost, $dbUser, $dbPass, $dbName, $dbPort);
+
+if ($conn->connect_error) {
+    die("Koneksi gagal: " . $conn->connect_error);
+}
+?>
diff --git a/poverty-mapping/uploads b/poverty-mapping/uploads
new file mode 120000
index 0000000..0991b2f
--- /dev/null
+++ b/poverty-mapping/uploads
@@ -0,0 +1 @@
+/home/ilham/webgis_uploads
\ No newline at end of file
diff --git a/tugas-spbu/.env.example b/tugas-spbu/.env.example
new file mode 100644
index 0000000..1eaf75d
--- /dev/null
+++ b/tugas-spbu/.env.example
@@ -0,0 +1,5 @@
+# Example environment file for WebGIS
+# Copy this file to `.env` and fill in real values. Do NOT commit `.env`.
+
+# Generate a random key: `openssl rand -hex 16`
+API_KEY=replace_with_a_secure_random_hex_key
diff --git a/tugas-spbu/.gitignore b/tugas-spbu/.gitignore
new file mode 100644
index 0000000..e7c49e6
--- /dev/null
+++ b/tugas-spbu/.gitignore
@@ -0,0 +1,7 @@
+/.env
+/.env.local
+/*.env
+# ignore common editor temp files
+*.swp
+*.swo
+.vscode/
\ No newline at end of file
diff --git a/tugas-spbu/Dockerfile b/tugas-spbu/Dockerfile
new file mode 100644
index 0000000..93b506b
--- /dev/null
+++ b/tugas-spbu/Dockerfile
@@ -0,0 +1,12 @@
+FROM php:8.2-apache
+
+# Install mysqli extension for PHP
+RUN docker-php-ext-install mysqli && docker-php-ext-enable mysqli
+
+# Copy project files into container
+COPY . /var/www/html/
+
+# Set ownership and permissions
+RUN chown -R www-data:www-data /var/www/html
+
+EXPOSE 80
diff --git a/tugas-spbu/README.md b/tugas-spbu/README.md
new file mode 100644
index 0000000..c1b1521
--- /dev/null
+++ b/tugas-spbu/README.md
@@ -0,0 +1,204 @@
+
+WebGIS (Leaflet + PHP + MySQL)
+
+Deskripsi singkat
+------------------
+Proyek WebGIS sederhana yang menggunakan `Leaflet` di frontend dan skrip PHP untuk menyediakan API CRUD terhadap data spasial (lokasi/marker, jalan, tanah) yang disimpan di database MySQL.
+
+Fitur utama
+-----------
+- Peta interaktif dengan marker, polyline, polygon (Leaflet + Leaflet.Draw)
+- Endpoint PHP untuk mengambil, menambah, memperbarui, dan menghapus data: lokasi, jalan, tanah
+- Kontrol layer untuk memfilter jenis data (SPBU, Rumah, Masjid, Jalan, Tanah)
+
+Persyaratan
+-----------
+- Web server dengan PHP (mis. Apache/Nginx + PHP)
+- MySQL atau MariaDB
+- Akses internet untuk memuat tile OpenStreetMap dan library Leaflet (atau host sendiri)
+
+Instalasi cepat
+---------------
+1. Salin folder proyek ke root web server Anda (mis. `/var/www/html/webgis`).
+2. Impor database dari file `webgis.sql`:
+
+```bash
+mysql -u root -p webgis < webgis.sql
+```
+
+3. Perbarui konfigurasi koneksi database di file [koneksi.php](koneksi.php) sesuai kredensial lokal Anda.
+4. Akses frontend melalui browser: `http://localhost/webgis/index.html` (atau path sesuai server Anda).
+
+Catatan konfigurasi
+-------------------
+File [koneksi.php](koneksi.php) saat ini mengandung koneksi contoh:
+
+```php
+<?php
+$conn = new mysqli("localhost", "root", "ilham", "webgis");
+// ...
+?>
+```
+
+Jangan gunakan kredensial default pada lingkungan produksi — ubah username/password dan batasi akses.
+
+API / Endpoints
+---------------
+Berikut file PHP utama yang tersedia di proyek ini:
+
+- `get_lokasi.php`   : Mengambil daftar lokasi/marker (JSON)
+- `tambah_lokasi.php`: Menambah lokasi baru
+- `update_lokasi.php`: Memperbarui lokasi
+- `hapus_lokasi.php` : Menghapus lokasi
+
+- `get_jalan.php`    : Mengambil data jalan (GeoJSON/JSON)
+- `tambah_jalan.php` : Menambah data jalan
+- `update_jalan.php` : Memperbarui data jalan
+- `hapus_jalan.php`  : Menghapus data jalan
+
+- `get_tanah.php`    : Mengambil data tanah (GeoJSON/JSON)
+- `tambah_tanah.php` : Menambah data tanah
+- `update_tanah.php` : Memperbarui data tanah
+- `hapus_tanah.php`  : Menghapus data tanah
+
+File penting
+-----------
+- [index.html](index.html)     : Frontend peta (Leaflet + draw tools)
+- [koneksi.php](koneksi.php)   : File koneksi database
+- [webgis.sql](webgis.sql)     : Dump database untuk impor
+
+Pengembangan & catatan
+-----------------------
+- Frontend mengambil endpoint dari `http://localhost/webgis/...` — sesuaikan URL jika Anda menaruh proyek di subfolder atau domain berbeda.
+- Beberapa record geometrik pada data jalan/tanah mungkin berformat JSON ganda; frontend mencoba parsing defensif.
+- Jika menambah kolom baru ke tabel `lokasi`, contoh SQL yang pernah dipakai:
+
+```sql
+ALTER TABLE lokasi ADD COLUMN alamat TEXT;
+ALTER TABLE lokasi ADD COLUMN jenis VARCHAR(50) NOT NULL DEFAULT 'spbu';
+CREATE INDEX idx_lokasi_alamat ON lokasi( (left(alamat,255)) );
+```
+
+Keamanan
+--------
+- Hindari menyimpan password database langsung di repositori untuk lingkungan produksi.
+- Sanitasi input pada skrip PHP sebelum memasukkannya ke database (prepared statements lebih aman).
+
+Lisensi
+-------
+Silakan tambahkan licensi sesuai kebutuhan (mis. MIT) atau hubungi pemilik proyek.
+
+Jika Anda ingin, saya bisa juga menambahkan langkah menjalankan server lokal atau contoh curl untuk setiap endpoint.
+
+Contoh penggunaan API & API key
+-------------------------------
+Untuk operasi baca (`GET`) tidak diperlukan API key. Contoh mengambil daftar lokasi:
+
+```bash
+curl -s http://localhost/webgis/src/api/get_lokasi.php | jq .
+```
+
+Untuk operasi tulis/hapus/perbarui, server memerlukan header `X-API-KEY` atau field `api_key` di body.
+API key sebaiknya disimpan di file `/.env` (di luar kontrol versi) atau di environment variable pada server.
+
+Menambahkan `.env.example`
+-------------------------
+Proyek ini menyediakan `.env.example` yang berisi contoh variabel environment yang diperlukan.
+Untuk menyiapkan environment lokal:
+
+```bash
+# salin contoh ke file .env (jangan commit .env)
+cp .env.example .env
+
+# generate key (openssl) dan masukkan ke .env
+openssl rand -hex 16
+# edit .env dan set API_KEY=hasil_generate
+```
+
+Atau buat key dengan PHP:
+
+```bash
+php -r "echo bin2hex(random_bytes(16)).PHP_EOL;"
+```
+
+Setelah `.env` berisi `API_KEY`, server PHP akan memuat nilai tersebut melalui `src/config/config.php`.
+
+Contoh panggilan (curl)
+-----------------------
+Menambah lokasi (POST JSON):
+
+```bash
+curl -X POST "http://localhost/webgis/src/api/tambah_lokasi.php" \
+  -H "Content-Type: application/json" \
+  -H "X-API-KEY: your_api_key_here" \
+  -d '{"nama":"Contoh","jenis":"rumah","no_telp":"0812","buka_24_jam":0,"alamat":"Jalan Contoh","latitude":-0.04,"longitude":109.33}'
+```
+
+Contoh hapus (POST body dengan id):
+
+```bash
+curl -X POST "http://localhost/webgis/src/api/hapus_lokasi.php" \
+  -H "Content-Type: application/json" \
+  -H "X-API-KEY: your_api_key_here" \
+  -d '{"id":"5092"}'
+```
+
+Catatan keamanan: jangan commit `.env` atau API key produksi ke repositori. Untuk produksi pertimbangkan memuat kunci dari sistem secrets, variabel lingkungan server (mis. systemd/Apache/Nginx), atau layanan vault.
+
+Menjalankan (Windows / Linux / macOS)
+-----------------------------------
+Berikut langkah singkat untuk menjalankan proyek ini pada masing-masing sistem operasi. Inti yang sama: tempatkan folder proyek di root web server Anda atau jalankan server PHP built-in, lalu impor `webgis.sql` dan sesuaikan [koneksi.php](koneksi.php).
+
+- **Linux (cepat, tanpa XAMPP):**
+
+	1. Pastikan `php` dan `mysql`/`mariadb` tersedia.
+	2. Impor database:
+
+	```bash
+	mysql -u root -p webgis < webgis.sql
+	```
+
+	3. Jalankan server PHP built-in (untuk pengujian cepat):
+
+	```bash
+	php -S localhost:8000 -t .
+	```
+
+	4. Buka `http://localhost:8000/index.html`.
+
+- **Windows (XAMPP/WAMP):**
+
+	1. Salin folder proyek ke `C:\xampp\htdocs\webgis` (XAMPP) atau folder www pada WAMP.
+	2. Import `webgis.sql` menggunakan phpMyAdmin atau CLI:
+
+	```powershell
+	mysql -u root -p webgis < webgis.sql
+	```
+
+	3. Pastikan Apache dan MySQL sudah dijalankan via XAMPP/WAMP control panel.
+	4. Akses `http://localhost/webgis/index.html`.
+
+	Catatan: Bisa juga menggunakan `php -S` dari Command Prompt jika PHP terpasang secara terpisah.
+
+- **macOS (MAMP atau PHP built-in):**
+
+	1. Gunakan MAMP: tempatkan proyek di folder `htdocs` MAMP lalu jalankan server MAMP.
+	2. Atau gunakan PHP built-in (macOS yang memiliki PHP):
+
+	```bash
+	mysql -u root -p webgis < webgis.sql
+	php -S localhost:8000 -t .
+	```
+
+	3. Buka `http://localhost:8000/index.html` atau `http://localhost/webgis/index.html` jika menggunakan MAMP/Apache.
+
+Penyesuaian koneksi
+-------------------
+- Edit [koneksi.php](koneksi.php) untuk menyesuaikan `host`, `username`, `password`, dan `database` sesuai lingkungan Anda.
+- Jika menggunakan server built-in (`php -S`), pastikan `koneksi.php` menggunakan host dan port database yang benar (biasanya `localhost`).
+
+Permasalahan umum
+-----------------
+- Jika tile OSM atau library tidak muncul, cek koneksi internet atau muat ulang (CORS biasanya tidak menjadi masalah untuk tile default).
+- Jika endpoint PHP mengembalikan error, periksa log PHP/Apache dan periksa kredensial di [koneksi.php](koneksi.php).
+
diff --git a/tugas-spbu/index.html b/tugas-spbu/index.html
new file mode 100644
index 0000000..322427c
--- /dev/null
+++ b/tugas-spbu/index.html
@@ -0,0 +1,778 @@
+<!DOCTYPE html>
+<html>
+<head>
+    <title>WebGIS</title>
+    <meta charset="utf-8">
+
+    <!-- Leaflet CSS -->
+    <link rel="stylesheet" href="https://unpkg.com/leaflet@1.9.4/dist/leaflet.css"/>
+
+    <!-- Leaflet JS -->
+    <script src="https://unpkg.com/leaflet@1.9.4/dist/leaflet.js"></script>
+
+    <!-- Leaflet Draw CSS -->
+    <link rel="stylesheet" href="https://cdnjs.cloudflare.com/ajax/libs/leaflet.draw/1.0.4/leaflet.draw.css"/>
+
+    <!-- Leaflet Draw JS -->
+    <script src="https://cdnjs.cloudflare.com/ajax/libs/leaflet.draw/1.0.4/leaflet.draw.js"></script>
+
+    <!-- GeometryUtil (FIXED & WORKING) -->
+    <script src="https://unpkg.com/leaflet-geometryutil"></script>
+    <style>
+        /* Simple modal styles */
+        .modal {position:fixed;left:0;top:0;right:0;bottom:0;background:rgba(0,0,0,0.4);display:flex;align-items:center;justify-content:center;z-index:9999}
+        .modal.hidden{display:none}
+        .modal-content{background:#fff;padding:18px;border-radius:8px;min-width:320px;max-width:480px;box-shadow:0 6px 18px rgba(0,0,0,0.2)}
+        .modal-content h3{margin:0 0 10px 0;font-size:18px}
+        .modal-content label{display:block;margin-top:8px;font-size:13px}
+        .modal-content input[type=text], .modal-content select{width:100%;padding:8px;margin-top:4px;border:1px solid #ddd;border-radius:4px}
+        .modal-actions{margin-top:12px;text-align:right}
+        .modal-actions button{margin-left:8px;padding:8px 12px;border-radius:4px;border:0;cursor:pointer}
+        .btn-primary{background:#1976d2;color:white}
+        .btn-secondary{background:#e0e0e0}
+    </style>
+</head>
+
+<body>
+<!-- Modal for adding items -->
+<div id="modal" class="modal hidden" role="dialog" aria-hidden="true">
+    <div class="modal-content">
+        <h3 id="modal-title">Form</h3>
+        <form id="modal-form">
+            <div id="modal-fields"></div>
+            <div class="modal-actions">
+                <button type="button" id="modal-cancel" class="btn-secondary">Batal</button>
+                <button type="submit" id="modal-submit" class="btn-primary">Simpan</button>
+            </div>
+        </form>
+    </div>
+</div>
+
+<div id="auth-controls" style="position: absolute; top: 10px; right: 10px; z-index: 1000; background: white; padding: 10px; border-radius: 8px; box-shadow: 0 4px 12px rgba(0,0,0,0.15); display: flex; gap: 8px; align-items: center; font-family: sans-serif;">
+    <span id="api-key-status" style="font-size: 13px; font-weight: bold; color: #666;">Guest Mode</span>
+    <button id="btn-api-key" onclick="promptApiKey()" style="padding: 6px 12px; border-radius: 4px; border: none; background: #1976d2; color: white; cursor: pointer; font-weight: bold; font-size: 12px; transition: all 0.2s;">🔑 Set API Key</button>
+</div>
+
+<div id="map" style="height:100vh;"></div>
+
+<script>
+let isDrawing = false;
+let pendingLayer = null;
+let pendingType = null;
+
+function escapeHtml(str) {
+    if (!str) return '';
+    return str.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;").replace(/'/g, "&#039;");
+}
+
+function updateApiKeyStatus() {
+    const key = localStorage.getItem('spbu_api_key');
+    const statusEl = document.getElementById('api-key-status');
+    const btnEl = document.getElementById('btn-api-key');
+    if (statusEl && btnEl) {
+        if (key) {
+            statusEl.textContent = 'Admin Mode';
+            statusEl.style.color = '#2e7d32';
+            btnEl.textContent = '🔑 Ubah API Key';
+            btnEl.style.background = '#2e7d32';
+        } else {
+            statusEl.textContent = 'Guest Mode';
+            statusEl.style.color = '#666';
+            btnEl.textContent = '🔑 Set API Key';
+            btnEl.style.background = '#1976d2';
+        }
+    }
+}
+
+function promptApiKey() {
+    const currentKey = localStorage.getItem('spbu_api_key') || '';
+    const newKey = prompt('Masukkan API Key untuk otentikasi Admin SPBU:', currentKey);
+    if (newKey !== null) {
+        const trimmed = newKey.trim();
+        if (trimmed) {
+            localStorage.setItem('spbu_api_key', trimmed);
+        } else {
+            localStorage.removeItem('spbu_api_key');
+        }
+        updateApiKeyStatus();
+    }
+}
+
+function handleApiResponse(res, callback) {
+    if (res.status === 401) {
+        alert('Akses Ditolak: API Key tidak valid atau kosong. Silakan atur API Key terlebih dahulu.');
+        promptApiKey();
+    } else {
+        res.json().then(data => {
+            if (data && data.success === false) {
+                alert('Error: ' + (data.error || 'Terjadi kesalahan'));
+            } else if (callback) {
+                callback(data);
+            }
+        }).catch(() => {
+            if (res.ok && callback) {
+                callback();
+            } else {
+                alert('Terjadi kesalahan koneksi server');
+            }
+        });
+    }
+}
+
+function buildHeaders(){
+    const headers = {'Content-Type':'application/json'};
+    const key = localStorage.getItem('spbu_api_key');
+    if(key){ headers['X-API-KEY'] = key; }
+    return headers;
+}
+
+const map = L.map('map').setView([-0.0552, 109.3500], 13);
+
+const drawnItems = new L.FeatureGroup();
+map.addLayer(drawnItems);
+
+const drawControl = new L.Control.Draw({
+    draw: {
+        polyline: true,
+        polygon: true,
+        marker: true,
+        rectangle: false,
+        circle: false,
+        circlemarker: false
+    },
+    edit: {
+        featureGroup: drawnItems,
+        edit: true,
+        remove: true
+    }
+});
+
+map.addControl(drawControl);
+
+map.on(L.Draw.Event.CREATED, function (e) {
+    const layer = e.layer;
+
+    if (e.layerType === 'marker') {
+        // opening lokasi modal for marker creation
+        pendingType = 'lokasi';
+        const ll = layer.getLatLng();
+        // store the created layer so we can remove it from drawnItems after save
+        pendingLayer = layer;
+        openModal('Tambah Lokasi', `
+            <label>Nama <input name="nama" type="text" required></label>
+            <label>Jenis <select name="jenis"><option value="rumah">Rumah</option><option value="masjid">Masjid</option><option value="spbu">SPBU</option></select></label>
+            <label>No Telp <input name="no_telp" type="text"></label>
+            <label><input name="buka_24_jam" type="checkbox"> Buka 24 Jam</label>
+            <label>Koordinat <input name="coords" type="text" readonly value="${ll.lat.toFixed(6)}, ${ll.lng.toFixed(6)}"></label>
+            <label>Alamat <input name="alamat" type="text"></label>
+        `, handleModalSubmit);
+        // try to reverse-geocode and prefill the alamat field
+        reverseGeocode(ll.lat, ll.lng).then(addr=>{
+            try{ const f = document.querySelector('#modal-fields input[name="alamat"]'); if(f && addr) f.value = addr; }catch(e){}
+        }).catch(()=>{});
+    }
+
+    if (e.layerType === 'polyline') {
+        handlePolyline(layer);
+    }
+
+    if (e.layerType === 'polygon') {
+        handlePolygon(layer);
+    }
+
+    drawnItems.addLayer(layer);
+});
+
+map.on('draw:drawstart', function () {
+    isDrawing = true;
+});
+
+map.on('draw:drawstop', function () {
+    isDrawing = false;
+});
+
+L.tileLayer('https://tile.openstreetmap.org/{z}/{x}/{y}.png').addTo(map);
+
+// let markers = [];
+
+// ====== LAYER GROUPS & CONTROL ======
+const spbu24Group = L.layerGroup().addTo(map);
+const spbuNon24Group = L.layerGroup().addTo(map);
+const rumahGroup = L.layerGroup().addTo(map);
+const masjidGroup = L.layerGroup().addTo(map);
+const jalanGroup = L.layerGroup().addTo(map);
+const tanahGroup = L.layerGroup().addTo(map);
+const lokasiGroup = L.layerGroup(); // fallback group (not added by default)
+const rumahMarkers = []; // store rumah circleMarkers for radius checks
+
+L.control.layers(null, {
+    "SPBU Buka 24 Jam": spbu24Group,
+    "SPBU Tidak 24 Jam": spbuNon24Group,
+    "Rumah": rumahGroup,
+    "Masjid": masjidGroup,
+    "Jalan": jalanGroup,
+    "Tanah": tanahGroup
+}, { collapsed: false }).addTo(map);
+
+// Using the built-in Leaflet.Draw toolbar (marker, polyline, polygon).
+function tanahStatusFull(code){
+    return code === 'SHM' ? 'Sertifikat Hak Milik (SHM)'
+    : code === 'HGB' ? 'Sertifikat Hak Guna Bangunan (HGB)'
+    : code === 'HGU' ? 'Sertifikat Hak Guna Usaha (HGU)'
+    : code === 'HP'  ? 'Sertifikat Hak Pakai (HP)'
+    : code || '';
+}
+
+function loadData() {
+    // clear previous markers from groups
+    spbu24Group.clearLayers();
+    spbuNon24Group.clearLayers();
+    // hide any active masjid radius when reloading data
+    try{ hideMasjidRadius(); }catch(e){}
+
+    fetch('src/api/get_lokasi.php')
+        .then(res => res.json())
+        .then(data => {
+            // clear previous lokasi markers/groups
+            lokasiGroup.clearLayers(); rumahGroup.clearLayers(); masjidGroup.clearLayers(); rumahMarkers.length = 0;
+            data.forEach(item => {
+                const statusHtml = parseInt(item.buka_24_jam) === 1
+                    ? "<span style='color:green'>Buka 24 Jam</span>"
+                    : "<span style='color:red'>Tidak 24 Jam</span>";
+
+                const safeNama = escapeHtml(item.nama);
+                const safeAlamat = escapeHtml(item.alamat);
+                const jsEscapedNama = safeNama.replace(/\\/g, '\\\\').replace(/'/g, "\\'");
+                const jsEscapedAlamat = safeAlamat.replace(/\\/g, '\\\\').replace(/'/g, "\\'");
+                const jenis = (item.jenis||'').toLowerCase();
+
+                let marker;
+                if(jenis === 'rumah' || jenis === 'masjid'){
+                    // use circleMarker so we can change color dynamically
+                    const color = jenis === 'masjid' ? '#1976d2' : '#d32f2f';
+                    marker = L.circleMarker([item.latitude, item.longitude], {radius:8, color:color, fillColor:color, fillOpacity:1});
+                    marker.bindPopup(`
+                        <b>${safeNama}</b><br>
+                        ${statusHtml}<br>
+                        <div style="font-size:12px;color:#444;margin-top:6px">${safeAlamat}</div>
+                        <br>
+                        <button onclick="hapus('${item.id}')">Hapus</button>
+                        <button onclick="edit('${item.id}','${jsEscapedNama}','${item.no_telp}',${item.buka_24_jam}, '${jsEscapedAlamat}', '${jenis}')">Edit</button>
+                    `);
+                    // store rumah markers for radius checks
+                    if(jenis === 'rumah') { rumahMarkers.push(marker); rumahGroup.addLayer(marker); }
+                    if(jenis === 'masjid') { masjidGroup.addLayer(marker); }
+                } else {
+                    // default: spbu or other — normal marker
+                    marker = L.marker([item.latitude, item.longitude]);
+                    marker.bindPopup(`
+                        <b>${safeNama}</b><br>
+                        ${statusHtml}<br>
+                        <div style="font-size:12px;color:#444;margin-top:6px">${safeAlamat}</div>
+                        <br>
+                        <button onclick="hapus('${item.id}')">Hapus</button>
+                        <button onclick="edit('${item.id}','${jsEscapedNama}','${item.no_telp}',${item.buka_24_jam}, '${jsEscapedAlamat}', '${jenis}')">Edit</button>
+                    `);
+                }
+
+                // attach jenis data for future reference
+                marker._jenis = jenis;
+                marker._data = item;
+                // add marker to appropriate group if not already added
+                if(jenis !== 'rumah' && jenis !== 'masjid'){
+                    // SPBU or other — add to spbu groups by buka_24_jam
+                    if(parseInt(item.buka_24_jam) === 1) spbu24Group.addLayer(marker);
+                    else spbuNon24Group.addLayer(marker);
+                }
+                // Also add to lokasiGroup as general index (optional)
+                lokasiGroup.addLayer(marker);
+            });
+        });
+}
+
+// MASJID RADIUS CONTROL
+let activeMasjid = null;
+let masjidCircle = null;
+let masjidControlEl = null;
+
+function showMasjidRadius(masjidMarker){
+    // ensure only one active
+    hideMasjidRadius();
+    activeMasjid = masjidMarker;
+    const center = masjidMarker.getLatLng();
+    const defaultRadius = 200; // meters (default changed to 200m)
+    masjidCircle = L.circle(center, {radius: defaultRadius, color: '#1976d2', fillOpacity: 0.08}).addTo(map);
+    // create control UI
+    masjidControlEl = document.createElement('div');
+    masjidControlEl.id = 'masjid-radius-control';
+    masjidControlEl.style.position='absolute';
+    // place at bottom-left so it doesn't overlap layer controls / zoom
+    masjidControlEl.style.left='10px'; masjidControlEl.style.bottom='80px';
+    masjidControlEl.style.background='white'; masjidControlEl.style.padding='8px'; masjidControlEl.style.borderRadius='6px'; masjidControlEl.style.boxShadow='0 2px 6px rgba(0,0,0,0.2)';
+    masjidControlEl.innerHTML = `Radius: <span id="masjid-radius-value">${defaultRadius}</span> m<br><input id="masjid-radius-slider" type="range" min="50" max="3000" step="10" value="${defaultRadius}" style="width:200px"> <button id="masjid-radius-close">Close</button>`;
+    // append to the map container and ensure it's above map layers
+    try{
+        const mapContainer = map.getContainer && map.getContainer();
+        if(mapContainer){ mapContainer.appendChild(masjidControlEl); }
+        else { document.body.appendChild(masjidControlEl); }
+    }catch(e){ document.body.appendChild(masjidControlEl); }
+    masjidControlEl.style.zIndex = 10000;
+    masjidControlEl.style.pointerEvents = 'auto';
+
+    // prevent map dragging/interaction while user is interacting with the slider
+    const sliderEl = document.getElementById('masjid-radius-slider');
+    if(sliderEl){
+        const disableMapDrag = ()=>{ try{ if(map.dragging && map.dragging.enabled()) map.dragging.disable(); }catch(e){} };
+        const enableMapDrag = ()=>{ try{ if(map.dragging && !map.dragging.enabled()) map.dragging.enable(); }catch(e){} };
+
+        const startDrag = (ev)=>{ disableMapDrag(); sliderEl._dragging = true; };
+        const endDrag = (ev)=>{ sliderEl._dragging = false; enableMapDrag(); };
+
+        sliderEl.addEventListener('pointerdown', startDrag);
+        sliderEl.addEventListener('pointerup', endDrag);
+        sliderEl.addEventListener('pointercancel', endDrag);
+        // mouse/touch fallback
+        sliderEl.addEventListener('mousedown', startDrag);
+        document.addEventListener('mouseup', endDrag);
+        sliderEl.addEventListener('touchstart', startDrag, {passive:true});
+        document.addEventListener('touchend', endDrag);
+
+        // actual slider input handling (keep default behavior so slider remains draggable)
+        sliderEl.addEventListener('input', function(ev){
+            const r = parseInt(ev.target.value,10);
+            try{ masjidCircle.setRadius(r); }catch(e){}
+            const valEl = document.getElementById('masjid-radius-value'); if(valEl) valEl.innerText = r;
+            updateHomeColors(center, r);
+        });
+    }
+    document.getElementById('masjid-radius-close').addEventListener('click', function(){ hideMasjidRadius(); });
+    updateHomeColors(center, defaultRadius);
+}
+
+function hideMasjidRadius(){
+    if(masjidCircle){ map.removeLayer(masjidCircle); masjidCircle = null; }
+    if(masjidControlEl){ masjidControlEl.remove(); masjidControlEl = null; }
+    activeMasjid = null;
+    // reset rumah markers to default red
+    rumahMarkers.forEach(m=>{ try{ m.setStyle({color:'#d32f2f', fillColor:'#d32f2f'}); }catch(e){} });
+}
+
+function updateHomeColors(centerLatLng, radiusMeters){
+    rumahMarkers.forEach(m=>{
+        try{
+            const dist = m.getLatLng().distanceTo(centerLatLng);
+            if(dist <= radiusMeters){
+                m.setStyle({color:'#2e7d32', fillColor:'#2e7d32'}); // green inside
+            } else {
+                m.setStyle({color:'#d32f2f', fillColor:'#d32f2f'}); // red outside
+            }
+        }catch(e){ }
+    });
+}
+
+// add delegated click handler: when popup for masjid opens, show button to toggle radius
+map.on('popupopen', function(e){
+    try{
+        const layer = e.popup._source;
+        if(layer && layer._jenis === 'masjid'){
+            const container = e.popup.getElement();
+            if(container && !container.querySelector('.show-masjid-radius')){
+                const btn = document.createElement('button'); btn.textContent='Show Radius'; btn.className='show-masjid-radius';
+                btn.style.marginLeft='6px';
+                btn.onclick = function(){ showMasjidRadius(layer); };
+                const content = container.querySelector('.leaflet-popup-content');
+                if(content) content.appendChild(btn);
+            }
+        }
+    }catch(e){}
+});
+
+function loadJalan(){
+    jalanGroup.clearLayers();
+    fetch('src/api/get_jalan.php')
+    .then(res=>res.json())
+    .then(data=>{
+        data.forEach(j=>{
+            let geo = null;
+            try {
+                geo = (typeof j.geom === 'string') ? JSON.parse(j.geom) : j.geom;
+            } catch(err) {
+                try {
+                    // try double-encoded JSON
+                    geo = JSON.parse(JSON.parse(j.geom));
+                    } catch(err2){
+                        console.error('Failed to parse jalan.geom for id', j.id, err2);
+                        // fallback: show a marker at map center with raw info so user sees the record
+                        const safeNama = escapeHtml(j.nama);
+                        const m = L.marker(map.getCenter()).bindPopup(`<b>${safeNama}</b><br>Invalid geometry<br><pre style="max-height:120px;overflow:auto">${escapeHtml(String(j.geom)).slice(0,400)}</pre>`);
+                        jalanGroup.addLayer(m);
+                        map.panTo(m.getLatLng());
+                        m.openPopup();
+                        return; // skip adding geojson
+                    }
+            }
+
+            const pj = parseFloat(j.panjang) || 0;
+            const safeNama = escapeHtml(j.nama);
+            const safeStatus = escapeHtml(j.status);
+            const jsEscapedNama = safeNama.replace(/\\/g, '\\\\').replace(/'/g, "\\'");
+            const popup = `<b>${safeNama}</b><br>${safeStatus}<br>${pj.toFixed(2)} m<br><br>
+                <button onclick="hapusJalan('${j.id}')">Hapus</button>
+                <button onclick="editJalan('${j.id}','${jsEscapedNama}', '${safeStatus}', ${pj})">Edit</button>`;
+
+            console.log('loadJalan: id=', j.id, 'geom=', geo);
+            const gj = L.geoJSON(geo,{
+                style:{color:
+                    j.status=="Nasional"?"red":
+                    j.status=="Provinsi"?"blue":"green"}
+            });
+
+            try{
+                gj.eachLayer(function(layer){
+                    layer._fid = j.id;
+                    layer.bindPopup(popup);
+                    jalanGroup.addLayer(layer);
+                    try{
+                        if(layer.getBounds){
+                            const c = layer.getBounds().getCenter();
+                            if(!map.getBounds().contains(c)){
+                                map.panTo(c);
+                                layer.openPopup && layer.openPopup();
+                            }
+                        } else if(layer.getLatLng){
+                            const p = layer.getLatLng();
+                            if(!map.getBounds().contains(p)){
+                                map.panTo(p);
+                                layer.openPopup && layer.openPopup();
+                            }
+                        }
+                    }catch(e){console.warn('pan check failed', e)}
+                });
+                } catch(e){
+                    console.error('Error adding jalan geo layer', j.id, e);
+                    const safeErrNama = escapeHtml(j.nama);
+                    const m = L.marker(map.getCenter()).bindPopup(`<b>${safeErrNama}</b><br>Geo add error<br><pre style="max-height:120px;overflow:auto">${escapeHtml(String(j.geom)).slice(0,400)}</pre>`);
+                    jalanGroup.addLayer(m);
+                    map.panTo(m.getLatLng());
+                    m.openPopup();
+                }
+        });
+    });
+}
+
+function loadTanah(){
+    tanahGroup.clearLayers();
+    fetch('src/api/get_tanah.php')
+    .then(res=>res.json())
+    .then(data=>{
+        data.forEach(t=>{
+            let geo = null;
+            try {
+                geo = (typeof t.geom === 'string') ? JSON.parse(t.geom) : t.geom;
+            } catch(err) {
+                try {
+                    geo = JSON.parse(JSON.parse(t.geom));
+                } catch(err2){
+                    console.error('Failed to parse tanah.geom for id', t.id, err2);
+                    const safeNama = escapeHtml(t.nama);
+                    const m = L.marker(map.getCenter()).bindPopup(`<b>${safeNama}</b><br>Invalid geometry<br><pre style="max-height:120px;overflow:auto">${escapeHtml(String(t.geom)).slice(0,400)}</pre>`);
+                    tanahGroup.addLayer(m);
+                    map.panTo(m.getLatLng());
+                    m.openPopup();
+                    return;
+                }
+            }
+            const luasNum = parseFloat(t.luas) || 0;
+            const safeNama = escapeHtml(t.nama);
+            const safeStatus = escapeHtml(t.status);
+            const jsEscapedNama = safeNama.replace(/\\/g, '\\\\').replace(/'/g, "\\'");
+            const popup = `<b>${safeNama}</b><br>${tanahStatusFull(t.status)}<br>${luasNum.toFixed(2)} m²<br><br>
+                <button onclick="hapusTanah('${t.id}')">Hapus</button>
+                <button onclick="editTanah('${t.id}','${jsEscapedNama}', '${safeStatus}', ${luasNum})">Edit</button>`;
+
+            console.log('loadTanah: id=', t.id, 'geom=', geo);
+            const gj = L.geoJSON(geo,{
+                style:{color:
+                    t.status=="SHM"?"green":
+                    t.status=="HGB"?"blue":
+                    t.status=="HGU"?"orange":"purple"}
+            });
+
+            try{
+                gj.eachLayer(function(layer){
+                    layer._fid = t.id;
+                    layer.bindPopup(popup);
+                    tanahGroup.addLayer(layer);
+                    try{
+                        if(layer.getBounds){
+                            const c = layer.getBounds().getCenter();
+                            if(!map.getBounds().contains(c)){
+                                map.panTo(c);
+                                layer.openPopup && layer.openPopup();
+                            }
+                        } else if(layer.getLatLng){
+                            const p = layer.getLatLng();
+                            if(!map.getBounds().contains(p)){
+                                map.panTo(p);
+                                layer.openPopup && layer.openPopup();
+                            }
+                        }
+                    }catch(e){console.warn('pan check failed', e)}
+                });
+            } catch(e){
+                console.error('Error adding tanah geo layer', t.id, e);
+                const safeErrNama = escapeHtml(t.nama);
+                const m = L.marker(map.getCenter()).bindPopup(`<b>${safeErrNama}</b><br>Geo add error<br><pre style="max-height:120px;overflow:auto">${escapeHtml(String(t.geom)).slice(0,400)}</pre>`);
+                tanahGroup.addLayer(m);
+                map.panTo(m.getLatLng());
+                m.openPopup();
+            }
+        });
+    });
+}
+
+// ================= DELETE =================
+function hapus(id){
+    fetch('src/api/hapus_lokasi.php',{
+        method: 'POST', headers: buildHeaders(),
+        body: JSON.stringify({id: id})
+    }).then(res => handleApiResponse(res, loadData));
+}
+
+function hapusJalan(id){
+    fetch('src/api/hapus_jalan.php',{
+        method: 'POST', headers: buildHeaders(),
+        body: JSON.stringify({id: id})
+    }).then(res => handleApiResponse(res, loadJalan));
+}
+
+function hapusTanah(id){
+    fetch('src/api/hapus_tanah.php',{
+        method: 'POST', headers: buildHeaders(),
+        body: JSON.stringify({id: id})
+    }).then(res => handleApiResponse(res, loadTanah));
+}
+
+// ================= UPDATE =================
+function edit(id,nama,telp,buka,alamat,jenis){
+    openModal('Edit Lokasi', `
+        <input type="hidden" name="id" value="${id}">
+        <label>Nama <input name="nama" type="text" required value="${(nama||'').replace(/"/g,'&quot;')}"></label>
+        <label>Jenis <select name="jenis"><option value="rumah">Rumah</option><option value="masjid">Masjid</option><option value="spbu">SPBU</option></select></label>
+        <label>No Telp <input name="no_telp" type="text" value="${(telp||'').replace(/"/g,'&quot;')}"></label>
+        <label><input name="buka_24_jam" type="checkbox" ${buka? 'checked' : ''}> Buka 24 Jam</label>
+        <label>Alamat <input name="alamat" type="text" value="${(alamat||'').replace(/"/g,'&quot;')}"></label>
+    `, function(values){
+        fetch('src/api/update_lokasi.php',{
+            method:'POST',headers: buildHeaders(),
+            body:JSON.stringify({id:id,nama:values.nama, jenis: values.jenis || 'rumah', no_telp:values.no_telp||'',buka_24_jam:values.buka_24_jam?1:0, alamat: values.alamat || ''})
+        }).then(res => handleApiResponse(res, loadData));
+    });
+    // set current jenis selection after modal fields inserted
+    setTimeout(()=>{ const sel=document.querySelector('#modal-fields select[name="jenis"]'); if(sel) sel.value = (jenis||'rumah'); },0);
+}
+
+function editJalan(id,nama,status,panjang){
+    openModal('Edit Jalan', `
+        <input type="hidden" name="id" value="${id}">
+        <label>Nama <input name="nama" type="text" required value="${(nama||'').replace(/"/g,'&quot;')}"></label>
+        <label>Status <select name="status"><option value="Nasional">Nasional</option><option value="Provinsi">Provinsi</option><option value="Kabupaten">Kabupaten</option></select></label>
+        <label>Panjang (m) <input name="panjang" type="text" readonly value="${parseFloat(panjang).toFixed(2)}"></label>
+    `, function(values){
+        fetch('src/api/update_jalan.php',{
+            method:'POST',headers: buildHeaders(),
+            body:JSON.stringify({id:id,nama:values.nama,status:values.status,panjang:parseFloat(values.panjang)||0})
+        }).then(res => handleApiResponse(res, loadJalan));
+    });
+}
+
+function editTanah(id,nama,status,luas){
+    const fields = `
+        <input type="hidden" name="id" value="${id}">
+        <label>Nama Pemilik <input name="nama" type="text" required value="${(nama||'').replace(/"/g,'&quot;')}"></label>
+        <label>Status <select name="status">
+            <option value="SHM">Sertifikat Hak Milik (SHM)</option>
+            <option value="HGB">Sertifikat Hak Guna Bangunan (HGB)</option>
+            <option value="HGU">Sertifikat Hak Guna Usaha (HGU)</option>
+            <option value="HP">Sertifikat Hak Pakai (HP)</option>
+        </select></label>
+        <label>Luas (m²) <input name="luas" type="text" readonly value="${parseFloat(luas).toFixed(2)}"></label>
+    `;
+
+    const cb = function(values){
+        fetch('src/api/update_tanah.php',{
+            method:'POST',headers: buildHeaders(),
+            body:JSON.stringify({id:id,nama:values.nama,status:values.status,luas:parseFloat(values.luas)||0})
+        }).then(res => handleApiResponse(res, loadTanah));
+    };
+
+    openModal('Edit Tanah', fields, cb);
+    // set the select value after modal fields are inserted (avoid embedding closing script tag inside templates)
+    setTimeout(()=>{ const sel=document.querySelector('#modal-fields select[name="status"]'); if(sel) sel.value = status; },0);
+}
+
+// Using Draw's marker tool to create 'lokasi' (handled in draw:created)
+
+function handlePolyline(layer) {
+    // open modal to collect jalan info, store layer pending until user submits
+    pendingType = 'jalan';
+    pendingLayer = layer;
+
+    let latlngs = layer.getLatLngs();
+    let panjang = 0;
+    for(let i=0;i<latlngs.length-1;i++){
+        panjang += latlngs[i].distanceTo(latlngs[i+1]);
+    }
+
+    openModal('Tambah Jalan', `
+        <label>Nama <input name="nama" type="text" required></label>
+        <label>Status <select name="status"><option value="Nasional">Nasional</option><option value="Provinsi">Provinsi</option><option value="Kabupaten">Kabupaten</option></select></label>
+        <label>Panjang (m) <input name="panjang" type="text" readonly value="${panjang.toFixed(2)}"></label>
+    `, handleModalSubmit);
+}
+
+function handlePolygon(layer) {
+    // open modal to collect tanah info
+    pendingType = 'tanah';
+    pendingLayer = layer;
+
+    const latlngs = layer.getLatLngs()[0];
+    const luas = L.GeometryUtil.geodesicArea(latlngs);
+
+    openModal('Tambah Tanah', `
+        <label>Nama Pemilik <input name="nama" type="text" required></label>
+        <label>Status <select name="status">
+            <option value="SHM">Sertifikat Hak Milik (SHM)</option>
+            <option value="HGB">Sertifikat Hak Guna Bangunan (HGB)</option>
+            <option value="HGU">Sertifikat Hak Guna Usaha (HGU)</option>
+            <option value="HP">Sertifikat Hak Pakai (HP)</option>
+        </select></label>
+        <label>Luas (m²) <input name="luas" type="text" readonly value="${luas.toFixed(2)}"></label>
+    `, handleModalSubmit);
+}
+
+// Reverse geocode helper using Nominatim (OpenStreetMap). Returns a Promise<string> of the display address.
+function reverseGeocode(lat, lng){
+    const url = `https://nominatim.openstreetmap.org/reverse?format=jsonv2&lat=${encodeURIComponent(lat)}&lon=${encodeURIComponent(lng)}`;
+    return fetch(url, { headers: { 'Accept': 'application/json' } })
+        .then(res => res.ok ? res.json() : Promise.reject('nores'))
+        .then(data => (data && data.display_name) ? data.display_name : '')
+        .catch(err => {
+            console.warn('reverseGeocode failed', err);
+            return '';
+        });
+}
+
+// Modal helpers
+function openModal(title, fieldsHtml, submitHandler){
+    document.getElementById('modal-title').textContent = title;
+    document.getElementById('modal-fields').innerHTML = fieldsHtml;
+    const modal = document.getElementById('modal');
+    modal.classList.remove('hidden');
+    modal.setAttribute('aria-hidden','false');
+
+    const form = document.getElementById('modal-form');
+    form.onsubmit = function(ev){
+        ev.preventDefault();
+        const fd = new FormData(form);
+        const obj = {};
+        for(const [k,v] of fd.entries()){
+            obj[k] = v;
+        }
+        const bukaCheckbox = form.querySelector('input[name="buka_24_jam"]');
+        if(bukaCheckbox) obj['buka_24_jam'] = bukaCheckbox.checked?1:0;
+
+        submitHandler(obj);
+        closeModal();
+    };
+
+    document.getElementById('modal-cancel').onclick = function(){ closeModal(); pendingLayer=null; pendingType=null; };
+}
+
+function closeModal(){
+    try{ if(document.activeElement && typeof document.activeElement.blur === 'function') document.activeElement.blur(); }catch(e){}
+    const modal = document.getElementById('modal');
+    modal.classList.add('hidden');
+    modal.setAttribute('aria-hidden','true');
+    document.getElementById('modal-fields').innerHTML = '';
+}
+
+function handleModalSubmit(values){
+    if(pendingType === 'lokasi'){
+        const latlng = (typeof pendingLayer.getLatLng === 'function') ? pendingLayer.getLatLng() : pendingLayer;
+        fetch('src/api/tambah_lokasi.php',{
+            method:'POST',headers: buildHeaders(),
+            body:JSON.stringify({
+                nama: values.nama,
+                jenis: values.jenis || 'rumah',
+                no_telp: values.no_telp || '',
+                buka_24_jam: values.buka_24_jam?1:0,
+                alamat: values.alamat || '',
+                latitude: latlng.lat,
+                longitude: latlng.lng
+            })
+        }).then(res => handleApiResponse(res, () => {
+            if(pendingLayer && drawnItems.hasLayer && drawnItems.hasLayer(pendingLayer)) drawnItems.removeLayer(pendingLayer);
+            loadData();
+            pendingLayer=null;
+            pendingType=null;
+        }));
+    } else if(pendingType === 'jalan'){
+        const geojson = pendingLayer.toGeoJSON();
+        const panjang = parseFloat((document.querySelector('input[name="panjang"]').value)||0);
+        const status = values.status || 'Kabupaten';
+        const nama = values.nama || '';
+
+        let warna = status==='Nasional'?'red':(status==='Provinsi'?'blue':'green');
+        pendingLayer.setStyle({color:warna});
+
+        fetch('src/api/tambah_jalan.php',{
+            method:'POST',headers: buildHeaders(),
+            body:JSON.stringify({nama:nama,status:status,panjang:panjang,geom:geojson.geometry})
+        }).then(res => handleApiResponse(res, (resp) => {
+            const newId = resp.id || null;
+            if(drawnItems.hasLayer(pendingLayer)) drawnItems.removeLayer(pendingLayer);
+            pendingLayer._fid = newId;
+            const safeNama = escapeHtml(nama);
+            const jsEscapedNama = safeNama.replace(/\\/g, '\\\\').replace(/'/g, "\\'");
+            pendingLayer.bindPopup(`<b>${safeNama}</b><br>${status}<br>Panjang: ${panjang.toFixed(2)} m<br><br>` +
+                `<button onclick="hapusJalan('${newId}')">Hapus</button>` +
+                `<button onclick="editJalan('${newId}','${jsEscapedNama}', '${status}', ${panjang})">Edit</button>`);
+            jalanGroup.addLayer(pendingLayer);
+            pendingLayer=null; pendingType=null;
+        }));
+    } else if(pendingType === 'tanah'){
+        const geojson = pendingLayer.toGeoJSON();
+        const luas = parseFloat((document.querySelector('input[name="luas"]').value)||0);
+        const status = values.status || 'SHM';
+        const nama = values.nama || '';
+
+        let warna = status==='SHM'?'green':(status==='HGB'?'blue':(status==='HGU'?'orange':'purple'));
+        pendingLayer.setStyle({color:warna});
+
+        fetch('src/api/tambah_tanah.php',{
+            method:'POST',headers: buildHeaders(),
+            body:JSON.stringify({nama:nama,status:status,luas:luas,geom:geojson.geometry})
+        }).then(res => handleApiResponse(res, (resp) => {
+            const newId = resp.id || null;
+            if(drawnItems.hasLayer(pendingLayer)) drawnItems.removeLayer(pendingLayer);
+            pendingLayer._fid = newId;
+            const safeT = escapeHtml(nama);
+            const jsEscapedT = safeT.replace(/\\/g, '\\\\').replace(/'/g, "\\'");
+            pendingLayer.bindPopup(`<b>${safeT}</b><br>${status}<br>Luas: ${luas.toFixed(2)} m²<br><br>` +
+                `<button onclick="hapusTanah('${newId}')">Hapus</button>` +
+                `<button onclick="editTanah('${newId}','${jsEscapedT}', '${status}', ${luas})">Edit</button>`);
+            tanahGroup.addLayer(pendingLayer);
+            pendingLayer=null; pendingType=null;
+        }));
+    }
+}
+
+// ================= INIT =================
+updateApiKeyStatus();
+loadData();
+loadJalan();
+loadTanah();
+</script>
+</body>
+</html>
\ No newline at end of file
diff --git a/tugas-spbu/sql/webgis.sql b/tugas-spbu/sql/webgis.sql
new file mode 100644
index 0000000..d45c174
--- /dev/null
+++ b/tugas-spbu/sql/webgis.sql
@@ -0,0 +1,110 @@
+-- MySQL dump 10.13  Distrib 8.0.45, for Linux (x86_64)
+--
+-- Host: localhost    Database: webgis
+-- ------------------------------------------------------
+-- Server version	8.0.45-0ubuntu0.22.04.1
+
+/*!40101 SET @OLD_CHARACTER_SET_CLIENT=@@CHARACTER_SET_CLIENT */;
+/*!40101 SET @OLD_CHARACTER_SET_RESULTS=@@CHARACTER_SET_RESULTS */;
+/*!40101 SET @OLD_COLLATION_CONNECTION=@@COLLATION_CONNECTION */;
+/*!50503 SET NAMES utf8mb4 */;
+/*!40103 SET @OLD_TIME_ZONE=@@TIME_ZONE */;
+/*!40103 SET TIME_ZONE='+00:00' */;
+/*!40014 SET @OLD_UNIQUE_CHECKS=@@UNIQUE_CHECKS, UNIQUE_CHECKS=0 */;
+/*!40014 SET @OLD_FOREIGN_KEY_CHECKS=@@FOREIGN_KEY_CHECKS, FOREIGN_KEY_CHECKS=0 */;
+/*!40101 SET @OLD_SQL_MODE=@@SQL_MODE, SQL_MODE='NO_AUTO_VALUE_ON_ZERO' */;
+/*!40111 SET @OLD_SQL_NOTES=@@SQL_NOTES, SQL_NOTES=0 */;
+
+--
+-- Table structure for table `jalan`
+--
+
+DROP TABLE IF EXISTS `jalan`;
+/*!40101 SET @saved_cs_client     = @@character_set_client */;
+/*!50503 SET character_set_client = utf8mb4 */;
+CREATE TABLE `jalan` (
+  `id` int NOT NULL AUTO_INCREMENT,
+  `nama` varchar(100) DEFAULT NULL,
+  `status` varchar(50) DEFAULT NULL,
+  `panjang` double DEFAULT NULL,
+  `geom` text,
+  PRIMARY KEY (`id`)
+) ENGINE=InnoDB AUTO_INCREMENT=10 DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_0900_ai_ci;
+/*!40101 SET character_set_client = @saved_cs_client */;
+
+--
+-- Dumping data for table `jalan`
+--
+
+LOCK TABLES `jalan` WRITE;
+/*!40000 ALTER TABLE `jalan` DISABLE KEYS */;
+/*!40000 ALTER TABLE `jalan` ENABLE KEYS */;
+UNLOCK TABLES;
+
+--
+-- Table structure for table `lokasi`
+--
+
+DROP TABLE IF EXISTS `lokasi`;
+/*!40101 SET @saved_cs_client     = @@character_set_client */;
+/*!50503 SET character_set_client = utf8mb4 */;
+CREATE TABLE `lokasi` (
+  `id` varchar(8) NOT NULL,
+  `nama` varchar(50) NOT NULL,
+  `no_telp` varchar(20) DEFAULT NULL,
+  `buka_24_jam` tinyint(1) DEFAULT NULL,
+  `latitude` decimal(10,6) DEFAULT NULL,
+  `longitude` decimal(10,6) DEFAULT NULL,
+  `alamat` text,
+  `jenis` varchar(50) NOT NULL DEFAULT 'spbu',
+  PRIMARY KEY (`id`),
+  KEY `idx_lokasi_alamat` ((left(`alamat`,255)))
+) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_0900_ai_ci;
+/*!40101 SET character_set_client = @saved_cs_client */;
+
+--
+-- Dumping data for table `lokasi`
+--
+
+LOCK TABLES `lokasi` WRITE;
+/*!40000 ALTER TABLE `lokasi` DISABLE KEYS */;
+INSERT INTO `lokasi` VALUES ('5092','Rumah','',0,-0.040882,109.335197,'Daeng Abdul Hadi, Akcaya, Pontianak Selatan, Pontianak, Kalimantan Barat, Kalimantan, 78117, Indonesia','rumah'),('7853','Masjid Mujahiddin','',1,-0.041462,109.336345,'Mujahiddin, Jalan Mujahidin, Akcaya, Pontianak Selatan, Pontianak, Kalimantan Barat, Kalimantan, 78121, Indonesia','masjid'),('8476','SPBU OSO MT. Haryono','',0,-0.044863,109.336726,'SPBU OSO MT. Haryono, Jalan M.T. Haryono, Akcaya, Pontianak Selatan, Pontianak, Kalimantan Barat, Kalimantan, 78121, Indonesia','spbu');
+/*!40000 ALTER TABLE `lokasi` ENABLE KEYS */;
+UNLOCK TABLES;
+
+--
+-- Table structure for table `tanah`
+--
+
+DROP TABLE IF EXISTS `tanah`;
+/*!40101 SET @saved_cs_client     = @@character_set_client */;
+/*!50503 SET character_set_client = utf8mb4 */;
+CREATE TABLE `tanah` (
+  `id` int NOT NULL AUTO_INCREMENT,
+  `nama` varchar(100) DEFAULT NULL,
+  `status` varchar(50) DEFAULT NULL,
+  `luas` double DEFAULT NULL,
+  `geom` text,
+  PRIMARY KEY (`id`)
+) ENGINE=InnoDB AUTO_INCREMENT=24 DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_0900_ai_ci;
+/*!40101 SET character_set_client = @saved_cs_client */;
+
+--
+-- Dumping data for table `tanah`
+--
+
+LOCK TABLES `tanah` WRITE;
+/*!40000 ALTER TABLE `tanah` DISABLE KEYS */;
+/*!40000 ALTER TABLE `tanah` ENABLE KEYS */;
+UNLOCK TABLES;
+/*!40103 SET TIME_ZONE=@OLD_TIME_ZONE */;
+
+/*!40101 SET SQL_MODE=@OLD_SQL_MODE */;
+/*!40014 SET FOREIGN_KEY_CHECKS=@OLD_FOREIGN_KEY_CHECKS */;
+/*!40014 SET UNIQUE_CHECKS=@OLD_UNIQUE_CHECKS */;
+/*!40101 SET CHARACTER_SET_CLIENT=@OLD_CHARACTER_SET_CLIENT */;
+/*!40101 SET CHARACTER_SET_RESULTS=@OLD_CHARACTER_SET_RESULTS */;
+/*!40101 SET COLLATION_CONNECTION=@OLD_COLLATION_CONNECTION */;
+/*!40111 SET SQL_NOTES=@OLD_SQL_NOTES */;
+
+-- Dump completed on 2026-04-23  9:46:58
diff --git a/tugas-spbu/src/api/get_jalan.php b/tugas-spbu/src/api/get_jalan.php
new file mode 100644
index 0000000..dd8b3b1
--- /dev/null
+++ b/tugas-spbu/src/api/get_jalan.php
@@ -0,0 +1,13 @@
+<?php
+include __DIR__ . '/../config/koneksi.php';
+header('Content-Type: application/json; charset=utf-8');
+
+$result = $conn->query("SELECT * FROM jalan");
+$data = [];
+
+while($row = $result->fetch_assoc()){
+    $data[] = $row;
+}
+
+echo json_encode($data);
+?>
diff --git a/tugas-spbu/src/api/get_lokasi.php b/tugas-spbu/src/api/get_lokasi.php
new file mode 100644
index 0000000..bb03d5d
--- /dev/null
+++ b/tugas-spbu/src/api/get_lokasi.php
@@ -0,0 +1,14 @@
+<?php
+include __DIR__ . '/../config/koneksi.php';
+header('Content-Type: application/json; charset=utf-8');
+
+$result = $conn->query("SELECT * FROM lokasi");
+
+$data = [];
+
+while ($row = $result->fetch_assoc()) {
+    $data[] = $row;
+}
+
+echo json_encode($data);
+?>
diff --git a/tugas-spbu/src/api/get_tanah.php b/tugas-spbu/src/api/get_tanah.php
new file mode 100644
index 0000000..c3ada9d
--- /dev/null
+++ b/tugas-spbu/src/api/get_tanah.php
@@ -0,0 +1,15 @@
+<?php
+include __DIR__ . '/../config/koneksi.php';
+header('Content-Type: application/json; charset=utf-8');
+
+$result = $conn->query("SELECT * FROM tanah");
+$data = [];
+
+while($row = $result->fetch_assoc()){
+    // log a short preview of geom for debugging
+    @file_put_contents('/tmp/webgis_debug.log', date('c') . " get_tanah id=".$row['id']." geom_preview=".substr($row['geom'],0,400)."\n", FILE_APPEND);
+    $data[] = $row;
+}
+
+echo json_encode($data);
+?>
diff --git a/tugas-spbu/src/api/hapus_jalan.php b/tugas-spbu/src/api/hapus_jalan.php
new file mode 100644
index 0000000..e657531
--- /dev/null
+++ b/tugas-spbu/src/api/hapus_jalan.php
@@ -0,0 +1,26 @@
+<?php
+include __DIR__ . '/../config/koneksi.php';
+include __DIR__ . '/../config/auth.php';
+
+header('Content-Type: application/json; charset=utf-8');
+require_api_key();
+
+$input = json_decode(file_get_contents('php://input'), true);
+$id = null;
+if($_SERVER['REQUEST_METHOD'] === 'DELETE'){
+	$id = isset($input['id']) ? $input['id'] : null;
+} else {
+	$id = isset($_POST['id']) ? $_POST['id'] : (isset($input['id']) ? $input['id'] : null);
+}
+
+if(!$id){ http_response_code(400); echo json_encode(['success'=>false,'error'=>'missing_id']); exit; }
+
+$stmt = $conn->prepare('DELETE FROM jalan WHERE id = ?');
+if(!$stmt){ http_response_code(500); echo json_encode(['success'=>false,'error'=>$conn->error]); exit; }
+$stmt->bind_param('s', $id);
+$res = $stmt->execute();
+$stmt->close();
+
+if($res){ echo json_encode(['success'=>true,'msg'=>'hapus']); }
+else { http_response_code(500); echo json_encode(['success'=>false,'error'=>'delete_failed']); }
+?>
diff --git a/tugas-spbu/src/api/hapus_lokasi.php b/tugas-spbu/src/api/hapus_lokasi.php
new file mode 100644
index 0000000..571c0d3
--- /dev/null
+++ b/tugas-spbu/src/api/hapus_lokasi.php
@@ -0,0 +1,28 @@
+<?php
+include __DIR__ . '/../config/koneksi.php';
+include __DIR__ . '/../config/auth.php';
+
+header('Content-Type: application/json; charset=utf-8');
+// require API key for delete
+require_api_key();
+
+// accept DELETE or POST with JSON body or form
+$input = json_decode(file_get_contents('php://input'), true);
+$id = null;
+if($_SERVER['REQUEST_METHOD'] === 'DELETE'){
+	$id = isset($input['id']) ? $input['id'] : null;
+} else {
+	$id = isset($_POST['id']) ? $_POST['id'] : (isset($input['id']) ? $input['id'] : null);
+}
+
+if(!$id){ http_response_code(400); echo json_encode(['success'=>false,'error'=>'missing_id']); exit; }
+
+$stmt = $conn->prepare('DELETE FROM lokasi WHERE id = ?');
+if(!$stmt){ http_response_code(500); echo json_encode(['success'=>false,'error'=>$conn->error]); exit; }
+$stmt->bind_param('s', $id);
+$res = $stmt->execute();
+$stmt->close();
+
+if($res){ echo json_encode(['success'=>true,'message'=>'hapus']); }
+else { http_response_code(500); echo json_encode(['success'=>false,'error'=>'delete_failed']); }
+?>
diff --git a/tugas-spbu/src/api/hapus_tanah.php b/tugas-spbu/src/api/hapus_tanah.php
new file mode 100644
index 0000000..6a72f60
--- /dev/null
+++ b/tugas-spbu/src/api/hapus_tanah.php
@@ -0,0 +1,26 @@
+<?php
+include __DIR__ . '/../config/koneksi.php';
+include __DIR__ . '/../config/auth.php';
+
+header('Content-Type: application/json; charset=utf-8');
+require_api_key();
+
+$input = json_decode(file_get_contents('php://input'), true);
+$id = null;
+if($_SERVER['REQUEST_METHOD'] === 'DELETE'){
+	$id = isset($input['id']) ? $input['id'] : null;
+} else {
+	$id = isset($_POST['id']) ? $_POST['id'] : (isset($input['id']) ? $input['id'] : null);
+}
+
+if(!$id){ http_response_code(400); echo json_encode(['success'=>false,'error'=>'missing_id']); exit; }
+
+$stmt = $conn->prepare('DELETE FROM tanah WHERE id = ?');
+if(!$stmt){ http_response_code(500); echo json_encode(['success'=>false,'error'=>$conn->error]); exit; }
+$stmt->bind_param('s', $id);
+$res = $stmt->execute();
+$stmt->close();
+
+if($res){ echo json_encode(['success'=>true,'msg'=>'hapus']); }
+else { http_response_code(500); echo json_encode(['success'=>false,'error'=>'delete_failed']); }
+?>
diff --git a/tugas-spbu/src/api/tambah_jalan.php b/tugas-spbu/src/api/tambah_jalan.php
new file mode 100644
index 0000000..f369f6a
--- /dev/null
+++ b/tugas-spbu/src/api/tambah_jalan.php
@@ -0,0 +1,36 @@
+<?php
+include __DIR__ . '/../config/koneksi.php';
+include __DIR__ . '/../config/auth.php';
+
+header('Content-Type: application/json; charset=utf-8');
+
+require_api_key();
+
+$data = json_decode(file_get_contents("php://input"), true);
+
+if(!$data){
+	http_response_code(400);
+	echo json_encode(["success"=>false,"error"=>"invalid_json"]);
+	exit;
+}
+
+$nama = isset($data['nama']) ? $data['nama'] : '';
+$status = isset($data['status']) ? $data['status'] : '';
+$panjang = isset($data['panjang']) ? floatval($data['panjang']) : 0;
+$geom = isset($data['geom']) ? json_encode($data['geom']) : null;
+
+$stmt = $conn->prepare("INSERT INTO jalan (nama,status,panjang,geom) VALUES (?, ?, ?, ?)");
+if(!$stmt){ http_response_code(500); echo json_encode(['success'=>false,'error'=>$conn->error]); exit; }
+$stmt->bind_param('sdds', $nama, $status, $panjang, $geom);
+$res = $stmt->execute();
+
+if($res){
+	$insert_id = $stmt->insert_id;
+	echo json_encode(["success"=>true,"id"=>$insert_id]);
+} else {
+	http_response_code(500);
+	echo json_encode(["success"=>false,"error"=>$stmt->error]);
+}
+$stmt->close();
+
+?>
diff --git a/tugas-spbu/src/api/tambah_lokasi.php b/tugas-spbu/src/api/tambah_lokasi.php
new file mode 100644
index 0000000..f5a6bcc
--- /dev/null
+++ b/tugas-spbu/src/api/tambah_lokasi.php
@@ -0,0 +1,50 @@
+<?php
+include __DIR__ . '/../config/koneksi.php';
+include __DIR__ . '/../config/auth.php';
+
+header('Content-Type: application/json; charset=utf-8');
+
+// require API key for create operations
+require_api_key();
+
+$data = json_decode(file_get_contents("php://input"), true);
+if(!$data){
+	http_response_code(400);
+	echo json_encode(["success"=>false,"error"=>"invalid_json"]);
+	exit;
+}
+
+// generate safer unique id
+$id = substr(uniqid('', true), -8);
+$nama = isset($data['nama']) ? $data['nama'] : '';
+$no_telp = isset($data['no_telp']) ? $data['no_telp'] : '';
+$buka = isset($data['buka_24_jam']) ? intval($data['buka_24_jam']) : 0;
+$alamat = isset($data['alamat']) ? $data['alamat'] : '';
+$jenis = isset($data['jenis']) ? $data['jenis'] : '';
+$lat = isset($data['latitude']) ? $data['latitude'] : null;
+$lng = isset($data['longitude']) ? $data['longitude'] : null;
+
+// basic validation
+if($lat !== null){
+	$lat = floatval($lat);
+	if($lat < -90 || $lat > 90){ http_response_code(400); echo json_encode(['success'=>false,'error'=>'invalid_latitude']); exit; }
+}
+if($lng !== null){
+	$lng = floatval($lng);
+	if($lng < -180 || $lng > 180){ http_response_code(400); echo json_encode(['success'=>false,'error'=>'invalid_longitude']); exit; }
+}
+
+// prepared statement
+$stmt = $conn->prepare("INSERT INTO lokasi (id, nama, jenis, no_telp, buka_24_jam, alamat, latitude, longitude) VALUES (?, ?, ?, ?, ?, ?, ?, ?)");
+if(!$stmt){ http_response_code(500); echo json_encode(['success'=>false,'error'=>$conn->error]); exit; }
+$stmt->bind_param('ssssisdd', $id, $nama, $jenis, $no_telp, $buka, $alamat, $lat, $lng);
+$res = $stmt->execute();
+$stmt->close();
+
+if($res){
+	echo json_encode(["success"=>true, "id"=>$id]);
+} else {
+	http_response_code(500);
+	echo json_encode(["success"=>false, "error"=> $conn->error]);
+}
+?>
diff --git a/tugas-spbu/src/api/tambah_tanah.php b/tugas-spbu/src/api/tambah_tanah.php
new file mode 100644
index 0000000..2ec693f
--- /dev/null
+++ b/tugas-spbu/src/api/tambah_tanah.php
@@ -0,0 +1,39 @@
+<?php
+include __DIR__ . '/../config/koneksi.php';
+include __DIR__ . '/../config/auth.php';
+
+header('Content-Type: application/json; charset=utf-8');
+
+require_api_key();
+
+$data = json_decode(file_get_contents("php://input"), true);
+
+if(!$data){
+	http_response_code(400);
+	echo json_encode(["success"=>false,"error"=>"invalid_json"]);
+	exit;
+}
+
+$nama = isset($data['nama']) ? $data['nama'] : '';
+$status = isset($data['status']) ? $data['status'] : '';
+$luas = isset($data['luas']) ? floatval($data['luas']) : 0;
+$geom = isset($data['geom']) ? json_encode($data['geom']) : null;
+
+// prepared statement
+$stmt = $conn->prepare("INSERT INTO tanah (nama,status,luas,geom) VALUES (?, ?, ?, ?)");
+if(!$stmt){ http_response_code(500); echo json_encode(['success'=>false,'error'=>$conn->error]); exit; }
+$stmt->bind_param('sdis', $nama, $status, $luas, $geom);
+$res = $stmt->execute();
+
+if($res){
+	$insert_id = $stmt->insert_id;
+	echo json_encode(["success"=>true,"id"=>$insert_id]);
+	@file_put_contents('/tmp/webgis_debug.log', date('c') . " tambah_tanah OK id=".$insert_id." payload=".json_encode($data)."\n", FILE_APPEND);
+} else {
+	http_response_code(500);
+	echo json_encode(["success"=>false,"error"=>$stmt->error]);
+	@file_put_contents('/tmp/webgis_debug.log', date('c') . " tambah_tanah ERR=".$stmt->error." payload=".json_encode($data)."\n", FILE_APPEND);
+}
+$stmt->close();
+
+?>
diff --git a/tugas-spbu/src/api/update_jalan.php b/tugas-spbu/src/api/update_jalan.php
new file mode 100644
index 0000000..1c3c88c
--- /dev/null
+++ b/tugas-spbu/src/api/update_jalan.php
@@ -0,0 +1,36 @@
+<?php
+include __DIR__ . '/../config/koneksi.php';
+include __DIR__ . '/../config/auth.php';
+header('Content-Type: application/json; charset=utf-8');
+require_api_key();
+
+$data = json_decode(file_get_contents("php://input"), true);
+if(!$data){ http_response_code(400); echo json_encode(['success'=>false,'error'=>'invalid_json']); exit; }
+
+$id = isset($data['id']) ? $data['id'] : null;
+if(!$id){ http_response_code(400); echo json_encode(['success'=>false,'error'=>'missing_id']); exit; }
+
+$sets = [];
+$types = '';
+$values = [];
+if(isset($data['nama'])){ $sets[]='nama = ?'; $types.='s'; $values[]=$data['nama']; }
+if(isset($data['status'])){ $sets[]='status = ?'; $types.='s'; $values[]=$data['status']; }
+if(isset($data['panjang'])){ $sets[]='panjang = ?'; $types.='d'; $values[]=$data['panjang']; }
+if(isset($data['geom'])){ $sets[]='geom = ?'; $types.='s'; $values[]=json_encode($data['geom']); }
+
+if(count($sets) > 0){
+    $sql = 'UPDATE jalan SET ' . implode(', ', $sets) . ' WHERE id = ?';
+    $types .= 's';
+    $values[] = $id;
+    $stmt = $conn->prepare($sql);
+    if(!$stmt){ http_response_code(500); echo json_encode(['success'=>false,'error'=>$conn->error]); exit; }
+
+    $bind_names[] = $types;
+    for($i=0;$i<count($values);$i++){ $bind_name='p'.$i; $$bind_name = $values[$i]; $bind_names[] = &$$bind_name; }
+    call_user_func_array([$stmt, 'bind_param'], $bind_names);
+    $res = $stmt->execute();
+    $stmt->close();
+}
+
+echo json_encode(["msg"=>"ok"]);
+?>
diff --git a/tugas-spbu/src/api/update_lokasi.php b/tugas-spbu/src/api/update_lokasi.php
new file mode 100644
index 0000000..a870f19
--- /dev/null
+++ b/tugas-spbu/src/api/update_lokasi.php
@@ -0,0 +1,57 @@
+<?php
+include __DIR__ . '/../config/koneksi.php';
+include __DIR__ . '/../config/auth.php';
+
+header('Content-Type: application/json; charset=utf-8');
+require_api_key();
+
+$data = json_decode(file_get_contents("php://input"), true);
+
+$id = isset($data['id']) ? $data['id'] : '';
+$nama = isset($data['nama']) ? $data['nama'] : null;
+$no_telp = isset($data['no_telp']) ? $data['no_telp'] : null;
+$buka = isset($data['buka_24_jam']) ? intval($data['buka_24_jam']) : null;
+$alamat = isset($data['alamat']) ? $data['alamat'] : null;
+$jenis = isset($data['jenis']) ? $data['jenis'] : null;
+
+$sets = [];
+$types = '';
+$values = [];
+if($nama !== null){ $sets[] = 'nama = ?'; $types .= 's'; $values[] = $nama; }
+if($no_telp !== null){ $sets[] = 'no_telp = ?'; $types .= 's'; $values[] = $no_telp; }
+if($buka !== null){ $sets[] = 'buka_24_jam = ?'; $types .= 'i'; $values[] = $buka; }
+if($alamat !== null){ $sets[] = 'alamat = ?'; $types .= 's'; $values[] = $alamat; }
+if($jenis !== null){ $sets[] = 'jenis = ?'; $types .= 's'; $values[] = $jenis; }
+
+if(empty($sets) || empty($id)){
+	http_response_code(400);
+	echo json_encode(['success'=>false,'error'=>'missing_id_or_fields']);
+	exit;
+}
+
+$sql = 'UPDATE lokasi SET ' . implode(', ', $sets) . ' WHERE id = ?';
+$types .= 's';
+$values[] = $id;
+
+$stmt = $conn->prepare($sql);
+if(!$stmt){ http_response_code(500); echo json_encode(['success'=>false,'error'=>$conn->error]); exit; }
+
+// bind params dynamically
+$bind_names[] = $types;
+for ($i=0; $i<count($values); $i++){
+	$bind_name = 'bind' . $i;
+	$$bind_name = $values[$i];
+	$bind_names[] = &$$bind_name;
+}
+call_user_func_array([$stmt, 'bind_param'], $bind_names);
+$res = $stmt->execute();
+$stmt->close();
+
+if($res){
+	echo json_encode(["success"=>true]);
+} else {
+	http_response_code(500);
+	echo json_encode(["success"=>false, "error"=>$conn->error]);
+}
+
+?>
diff --git a/tugas-spbu/src/api/update_tanah.php b/tugas-spbu/src/api/update_tanah.php
new file mode 100644
index 0000000..2f783f6
--- /dev/null
+++ b/tugas-spbu/src/api/update_tanah.php
@@ -0,0 +1,40 @@
+<?php
+include __DIR__ . '/../config/koneksi.php';
+include __DIR__ . '/../config/auth.php';
+header('Content-Type: application/json; charset=utf-8');
+require_api_key();
+
+$data = json_decode(file_get_contents("php://input"), true);
+
+$id = isset($data['id']) ? $data['id'] : null;
+if(!$id){ http_response_code(400); echo json_encode(['success'=>false,'error'=>'missing_id']); exit; }
+
+$sets = [];
+$types = '';
+$values = [];
+if(isset($data['nama'])){ $sets[]='nama = ?'; $types.='s'; $values[]=$data['nama']; }
+if(isset($data['status'])){ $sets[]='status = ?'; $types.='s'; $values[]=$data['status']; }
+if(isset($data['luas'])){ $sets[]='luas = ?'; $types.='d'; $values[]=$data['luas']; }
+if(isset($data['geom'])){ $sets[]='geom = ?'; $types.='s'; $values[]=json_encode($data['geom']); }
+
+if(count($sets) > 0){
+    $sql = 'UPDATE tanah SET ' . implode(', ', $sets) . ' WHERE id = ?';
+    $types .= 's';
+    $values[] = $id;
+    $stmt = $conn->prepare($sql);
+    if(!$stmt){ http_response_code(500); echo json_encode(['success'=>false,'error'=>$conn->error]); exit; }
+
+    $bind_names[] = $types;
+    for($i=0;$i<count($values);$i++){ $bind_name='b'.$i; $$bind_name = $values[$i]; $bind_names[] = &$$bind_name; }
+    call_user_func_array([$stmt, 'bind_param'], $bind_names);
+    $res = $stmt->execute();
+    if($res){
+        @file_put_contents('/tmp/webgis_debug.log', date('c') . " update_tanah OK id=".$id." payload=".json_encode($data)."\n", FILE_APPEND);
+    } else {
+        @file_put_contents('/tmp/webgis_debug.log', date('c') . " update_tanah ERR=".$stmt->error." payload=".json_encode($data)."\n", FILE_APPEND);
+    }
+    $stmt->close();
+}
+
+echo json_encode(["msg"=>"ok"]);
+?>
diff --git a/tugas-spbu/src/config/auth.php b/tugas-spbu/src/config/auth.php
new file mode 100644
index 0000000..f329a75
--- /dev/null
+++ b/tugas-spbu/src/config/auth.php
@@ -0,0 +1,35 @@
+<?php
+include_once __DIR__ . '/config.php';
+
+function get_request_api_key(){
+    // check header first
+    $headers = null;
+    if(function_exists('getallheaders')){
+        $headers = getallheaders();
+    }
+    if($headers){
+        foreach($headers as $k => $v){
+            if(strtolower($k) === 'x-api-key') return $v;
+        }
+    }
+
+    // fallback to header in $_SERVER
+    if(isset($_SERVER['HTTP_X_API_KEY'])) return $_SERVER['HTTP_X_API_KEY'];
+
+    // fallback to JSON body or POST
+    $input = json_decode(file_get_contents('php://input'), true);
+    if(isset($input['api_key'])) return $input['api_key'];
+    if(isset($_POST['api_key'])) return $_POST['api_key'];
+
+    return null;
+}
+
+function require_api_key(){
+    $key = get_request_api_key();
+    if(!$key || $key !== API_KEY){
+        http_response_code(401);
+        header('Content-Type: application/json; charset=utf-8');
+        echo json_encode(['success'=>false,'error'=>'unauthorized']);
+        exit;
+    }
+}
diff --git a/tugas-spbu/src/config/config.php b/tugas-spbu/src/config/config.php
new file mode 100644
index 0000000..998cefc
--- /dev/null
+++ b/tugas-spbu/src/config/config.php
@@ -0,0 +1,29 @@
+<?php
+// Load environment from project root .env if present, then read API_KEY
+function load_dotenv($path){
+	if(!file_exists($path)) return;
+	$lines = file($path, FILE_IGNORE_NEW_LINES|FILE_SKIP_EMPTY_LINES);
+	foreach($lines as $line){
+		if(trim($line)==='' || strpos(trim($line),'#')===0) continue;
+		if(strpos($line,'=')===false) continue;
+		list($k,$v) = explode('=', $line, 2);
+		$k = trim($k); $v = trim($v);
+		// strip optional quotes
+		if((substr($v,0,1)==='"' && substr($v,-1)==='"') || (substr($v,0,1)==="'" && substr($v,-1)==="'")){
+			$v = substr($v,1,-1);
+		}
+		putenv("$k=$v");
+		$_ENV[$k] = $v;
+	}
+}
+
+$envPath = realpath(__DIR__ . '/../../.env');
+if($envPath){ load_dotenv($envPath); }
+
+$apiKey = getenv('API_KEY');
+if(!$apiKey) {
+	// fallback (development) - but prefer .env or system env in production
+	$apiKey = '8f3b7e6a9c4d2f1a6b8c9d0e4f7a1b2c';
+}
+define('API_KEY', $apiKey);
+?>
diff --git a/tugas-spbu/src/config/koneksi.php b/tugas-spbu/src/config/koneksi.php
new file mode 100644
index 0000000..6204b64
--- /dev/null
+++ b/tugas-spbu/src/config/koneksi.php
@@ -0,0 +1,15 @@
+<?php
+include_once __DIR__ . '/config.php';
+
+$dbHost = getenv('DB_HOST') ?: 'localhost';
+$dbPort = (int)(getenv('DB_PORT') ?: 3306);
+$dbUser = getenv('DB_USER') ?: 'root';
+$dbPass = getenv('DB_PASS') ?: 'ilham';
+$dbName = getenv('DB_NAME') ?: 'spbu_db';
+
+$conn = new mysqli($dbHost, $dbUser, $dbPass, $dbName, $dbPort);
+
+if ($conn->connect_error) {
+    die("Koneksi gagal: " . $conn->connect_error);
+}
+?>