Daftar bug dan inkonsistensi yang ditemukan saat riset dokumentasi dazoapp. Diurutkan per modul. Status: 🔴 belum diperbaiki / 🟡 dikonfirmasi / 🟢 diperbaiki.
Order
| # | Bug | Lokasi | Status |
|---|---|---|---|
| 1 | change_payment_status tunggal pakai mass update — tidak picu OrderObserver. Stok & wallet tidak ter-update | OrderController.php:1260 | 🔴 |
| 2 | change_payment_status_multiple pakai save() — picu observer. Inkonsistensi dengan #1 | OrderController.php:1280 | 🔴 |
| 3 | Route POST /order/change_payment_status bentrok — OrderController vs OrderpaymentController | routes/api.php:222 vs :243 | 🔴 |
| 4 | Route PUT /order/update_order_column terdaftar 2x | routes/api.php:231 & :238 | 🔴 |
| 5 | DigitalProductService::sendMessage hardcode localhost:8081 untuk produksi — tidak pakai properti controller | DigitalProductService.php:274-280 | 🔴 |
| 6 | Enum StatusOrder tidak dipakai sebagai validasi — controller bebas tulis string | OrderController.php | 🟡 |
| 7 | Typo utm_campaing (seharusnya utm_campaign) | OrderController.php:1798 | 🟡 |
Wallet & Payment
| # | Bug | Lokasi | Status |
|---|---|---|---|
| 8 | PIN lock bypass — WalletController::withdraw() verify via Hash::check langsung, tidak lewat WalletService::verifyPin(). Brute force tidak terkunci | WalletController.php:253 | 🔴 |
| 9 | Inkonsistensi type transaksi — service pakai 'withdrawal', controller pakai 'withdraw'. Accessor Wallet.php cuma match 'withdraw' | WalletService.php vs WalletController.php:282 | 🔴 |
| 10 | Inkonsistensi status case — konstanta 'pending' (lowercase), controller 'PENDING' (uppercase) | WalletTransaction.php vs WalletController.php:286 | 🔴 |
| 11 | available_balance accessor panggil DOKU HTTP tiap dibaca — berbahaya saat serialisasi JSON | Wallet.php:100-123 | 🟡 |
| 12 | Aspire credentials hardcode di source code (client_id, client_secret) | AspireController.php:74-75 | 🔴 |
| 13 | Duitku callback hanya update invoice — logic upgrade/downgrade store butuh manual call frontend | DuitkuController.php:670 | 🔴 |
| 14 | Midtrans tidak terdaftar webhook — notification() butuh Auth::user(), tidak cocok untuk webhook | MidtransController.php:50 | 🔴 |
| 15 | max_withdrawal_basic/premium di config tapi tidak di-enforce | config/doku.php | 🟡 |
| 16 | min_withdrawal dua nilai — config 10000, controller 50000 | config/doku.php vs WalletController.php:212 | 🟡 |
| 17 | WalletService::requestWithdrawal() tidak terhubung route — logic lengkap tapi tidak dipakai | WalletService.php:211 | 🟡 |
WhatsApp & Device
| # | Bug | Lokasi | Status |
|---|---|---|---|
| 18 | Host produksi engine WhatsApp tidak konsisten — engine.dazo.id vs engine-wa.dazo.id | 7+ controller | 🔴 |
| 19 | AgentAiController tambah /api/ di URL produksi tapi tidak di lokal | AgentAiController.php:34-38 | 🔴 |
| 20 | ChatList model extends MongoDB tapi data sebenarnya di MySQL | ChatList.php + LiveChatController::connectSqlDB | 🟡 |
Live Chat
| # | Bug | Lokasi | Status |
|---|---|---|---|
| 21 | requestHandleGudang bug — loop menimpa $data_input, asumsi “kirim ke semua gudang” tidak tercapai | LiveChatController.php:892-913 | 🔴 |
| 22 | getRotator mode same bug — loop tanpa break, $team_id selalu team terakhir | LiveChatController.php:1129-1136 | 🔴 |
| 23 | chaptureAddress parser rapuh — explode(':') asumsikan urutan field kaku | LiveChatController.php:659-705 | 🟡 |
Broadcast
| # | Bug | Lokasi | Status |
|---|---|---|---|
| 24 | updatestatus duplikat changeStatus — tanpa return response | BroadcastscedularController.php:1105 | 🔴 |
| 25 | segment_list hanya pakai index [0] — pilih multiple segment tidak ter-support | BroadcastscedularController.php:241 | 🟡 |
| 26 | Auto-disable scheduler di retrieved — tiap load tulis DB, bisa conflict concurrent | BroadcastSceduler.php:28-35 | 🟡 |
| 27 | Typo persisten Sceduler (seharusnya Scheduler) — merasuk ke nama file/controller/route | banyak file | 🟡 |
Contact (Kontak)
| # | Bug | Lokasi | Status |
|---|---|---|---|
| 28 | store() double-create Customer — 2x Customer::create() dengan tag/wa tidak konsisten | ContactController.php:629-640 | 🔴 |
| 29 | Validasi wa regex tidak konsisten — store tanpa +, updateContact dengan + | ContactController.php:587 vs :1882 | 🔴 |
| 30 | profitRputationData query tanpa store_id — reputation lintas toko, potensi bocor ke merchant lain | ContactController.php:2267-2273 | 🟡 |
| 31 | chats() relasi return query builder — tidak bisa eager load, N+1 manual | Customer.php:63-65 | 🟡 |
Biolink & Shortlink
| # | Bug | Lokasi | Status |
|---|---|---|---|
| 32 | eval() di evaluateExpression — risiko injeksi PHP code dari input produk | ShortlinkController.php:617 | 🔴 |
| 33 | ssl() tulis nginx config hardcoded — path /var/www/nginx-configs/... tanpa error handling | BiolinkController.php:808-837 | 🔴 |
| 34 | CustomDomainController@store permission check di-comment — semua user bisa buat custom domain | CustomDomainController.php:112-115 | 🔴 |
| 35 | Route duplikat — GET /{id} 2x, POST /store/{id} 2x | web.php:490,503 & api.php:669,708 | 🔴 |
| 36 | storeNew validasi unique di tabel user_stores — seharusnya biolinks | BiolinkController.php:466 | 🟡 |
| 37 | pratinjau duplikasi 100% open — copy-paste tanpa perbedaan logik | BiolinkController.php:331-395 | 🟡 |
Shipping
| # | Bug | Lokasi | Status |
|---|---|---|---|
| 38 | API key Rajaongkir 51cx1jEXf3... hardcoded di 5 lokasi — tidak dari .env | RajaongkirController.php:52,89,135,167,196 | 🔴 |
| 39 | Basic Auth Apikurir 22c8afb1-... hardcoded — tidak dari .env | ShippingController.php:18-21 | 🔴 |
| 40 | HandleGudangController.php kosong — hanya deklarasi class | HandleGudangController.php | 🟡 |
| 41 | sync_courier dead code — di waybill langsung strtolower, tidak pakai method | RajaongkirController.php:207 | 🟡 |
| 42 | Typo otomatic (seharusnya automatic) tersebar di setting shipping | SettingController.php | 🟡 |
Subscription
| # | Bug | Lokasi | Status |
|---|---|---|---|
| 43 | SubscriptionNotif scope variabel salah — semua notif terkirim ke store/owner yang salah | SubscriptionNotif.php:33-72 | 🔴 |
| 44 | PaymentTimer job dispatch tanpa queue worker — QUEUE_CONNECTION=sync, delay tidak berfungsi | SubscriptionController.php:243 | 🔴 |
| 45 | Downgrade dead code — handleDowngradeAiAgent, handleDowngradeBroadcast, handleDowngradeOrder tidak dipanggil | Downgrade.php:405,421,437 | 🟡 |
| 46 | Downgrade duplikasi eksekusi — downgrade dijalankan 2x untuk store dalam masa downgrade | Downgrade.php:36-84 | 🟡 |
| 47 | get_features seluruhnya di-comment — route aktif tapi return null | SubscriptionController.php:462-486 | 🔴 |
| 48 | Typo pyment di route (web.php:305) — user yang ketik payment akan 404 | web.php:305 | 🟡 |
| 49 | Permission check tidak konsisten — buy, send, failed_transaction tidak authorize | SubscriptionController.php | 🟡 |
Report
| # | Bug | Lokasi | Status |
|---|---|---|---|
| 50 | Route /api/report/chat ada dalam prefix /report — full path jadi /api/report/api/report/chat | api.php:355 | 🔴 |
| 51 | Typo show_prduct_performance di nama route | web.php:278 | 🟡 |
| 52 | Paginasi manual via array_slice — seluruh aggregate dimuat ke memori dulu | ReportController.php:509-527 | 🟡 |
| 53 | save_groupreport simpan setting tapi tidak ada pelaksanaan jadwal — fitur auto report setengah jadi | ReportController.php:1082 | 🟡 |
Team
| # | Bug | Lokasi | Status |
|---|---|---|---|
| 54 | destroy bug — Store::where('user_id', $user->id) hanya jalan untuk Owner. Bisa return null untuk Admin/CS | TeamController.php:508 | 🔴 |
| 55 | store assign permission tanpa validasi struktur — bisa inject permission tanpa batas | TeamController.php:319 | 🔴 |
| 56 | TeamchatController::store kredensial hardcoded — password time(), key 21aOfjTBLDhFx6AoMqH | TeamchatController.php:18-19 | 🔴 |
| 57 | destroy set email null via raw DB::table('users') — bypass model, bentrok dengan soft delete | TeamController.php:671-673 | 🟡 |
| 58 | mark_read route duplikat — POST /mark_read terdaftar 2x | api.php:663-664 | 🟡 |
Marketing / Pixel
| # | Bug | Lokasi | Status |
|---|---|---|---|
| 59 | Dua controller paralel — PixelController (lama) vs TrackingToolController (baru). Route keduanya aktif | api.php:575 & :583 | 🟡 |
| 60 | access_token Meta disimpan plain — tidak dienkripsi. Secret untuk Conversions API | Pixel.php | 🔴 |
| 61 | PixelController::store & update tidak return response — frontend tidak tahu sukses/gagal | PixelController.php:70,110 | 🟡 |
| 62 | PixelController::destroy return 200 walau data tidak ditemukan | PixelController.php:122 | 🟡 |
| 63 | ConversionController::paid bulk update tidak sync — change_payment_status_multiple meng-comment call | OrderController.php:1287 | 🔴 |
| 64 | Conversion & Checkout.conversion duplikasi data — counter di dua tempat, sync manual | Conversion.php + Checkout.php | 🟡 |
AI Agent
| # | Bug | Lokasi | Status |
|---|---|---|---|
| 65 | generalPrompt() rusak — deklarasi string tanpa return. Return null. Mendekati dead code | AgentAiController.php:1208-1240 | 🟡 |
| 66 | Permission AI agent dimatikan — semua cek findPermissionByName dikomentari | AgentAiController.php:51-53 | 🟡 |
| 67 | Route /agent/store & /agent/upload mati — tidak ada method di controller | api.php | 🔴 |
| 68 | updateQna cari by question string — kalau duplikat, hanya pertama yang terupdate | AgentAiController.php:665,687 | 🟡 |
Digital Store
| # | Bug | Lokasi | Status |
|---|---|---|---|
| 69 | DraftStoresDigital orphan — model tidak dipakai, warisan refactor | DraftStoresDigital.php | 🟡 |
| 70 | ensurePaymentMethods hardcode 4 method — tambah metode wajib edit kode | DigitalStoreService.php | 🟡 |
| 71 | generateConfig inject string ke nginx tanpa escaping — risiko path traversal | DigitalStoreService.php:1536-1540 | 🔴 |
Infrastruktur / Lintas modul
| # | Bug | Lokasi | Status |
|---|---|---|---|
| 72 | API token Cloudflare hardcoded di 4 file | Dns.php:74, CompareDnsRecords.php:17, MigrateCloudflareTolightsail.php:28, WelcomeController.php:846 | 🔴 |
| 73 | Route login-as-user diamankan path acak — security by obscurity, menerbitkan JWT tanpa auth | api.php:92-93 | 🔴 |
| 74 | state/store.js:4 import salah — notification from './modules/layout' (harusnya ./modules/notification) | state/store.js:4 | 🔴 |
| 75 | FILESYSTEM_DISK dua kali di .env — nilai terakhir menang | .env | 🟡 |
| 76 | QUEUE_CONNECTION=sync — job berjalan blocking dalam request | .env | 🟡 |
| 77 | .env.example tertinggal 87 variabel — tidak sinkron dengan kode | .env.example | 🟡 |
| 78 | 106 file mengandung console.log / dd() / var_dump() | banyak file | 🟡 |
| 79 | Backup service di source tree — DokuApiService_backup_20260602_110428.php | app/Services/ | 🟡 |
Status legenda
| Simbol | Arti |
|---|---|
| 🔴 | Belum diperbaiki |
| 🟡 | Dikonfirmasi / diketahui (mungkin by design, atau risiko rendah) |
| 🟢 | Diperbaiki |
Cara menambah bug baru
Saat menemukan bug baru, tambahkan ke tabel modul terkait. Format:
| # | Deskripsi singkat | `file:line` | 🔴 |Jangan hapus entry yang sudah diperbaiki — ubah statusnya jadi 🟢 dan tambahkan catatan commit fix.