Belajar Go,
pelan-pelan saja.

Dari /home/sysadmin, tuliskan perintah untuk berpindah ke folder kursus belajar-golang, lalu cetak isinya.

cd /home/sysadmin/lab/belajar-golang
pwd
ls
cd 0-inisialisasi
pwd
cd ..

Tanpa membuka isinya, sebutkan tiga file yang wajib ada di setiap bab mulai bab 2, dan jelaskan fungsi masing-masing dalam satu kalimat.

Jalankan perintah untuk menampilkan versi Go yang terpasang. Tuliskan hasilnya.

go version

Jelaskan: kenapa setelah Cara B kita perlu menambahkan /usr/local/go/bin ke PATH?

Jalankan tiga perintah pemeriksaan sekaligus (lokasi biner, versi, GOPATH) dan simpulkan apakah instalasi sehat.

command -v go && go version && go env GOPATH

2-hello-world-dan-modul/contoh/go.mod

module bab02-hello

go 1.26

2-hello-world-dan-modul/contoh/main.go

package main

import "fmt"

func main() {
	fmt.Println("Halo, Go!")
}

Ubah pesan agar mencetak nama kamu: Halo, <namamu>!. Jalankan ulang dengan go run ..

package main

import "fmt"

func main() {
	fmt.Println("Halo, Rani!")
}

Cetak dua baris: sapaan dan tanggal belajar. Gunakan dua pemanggilan fmt.Println.

package main

import "fmt"

func main() {
	fmt.Println("Halo, Rani!")
	fmt.Println("Hari: Senin")
}

Bangun biner dengan go build -o bin/halo ., lalu jalankan biner itu. Bedanya dengan go run . apa?

go build -o bin/halo .
./bin/halo

3-variabel-dan-tipe-data/contoh/go.mod

module bab03-variabel

go 1.26

3-variabel-dan-tipe-data/contoh/main.go

package main

import (
	"fmt"
	"strconv"
)

const batasJudul = 200

func statusTeks(selesai bool) string {
	if selesai {
		return "selesai"
	}
	return "belum"
}

func main() {
	// Variabel dengan bentuk panjang dan pendek.
	var id int64 = 1
	judul := "Belajar Go"
	selesai := false

	fmt.Printf("Tugas #%d: %s (%s)\n", id, judul, statusTeks(selesai))

	// Zero value: setiap variabel baru selalu punya nilai bawaan.
	var jumlah int
	var lagi bool
	fmt.Println("zero:", jumlah, lagi)

	// Konversi tipe eksplisit.
	var jml64 int64 = 5
	n := int(jml64)
	harga := 9.5
	fmt.Printf("konversi: %d %d %.1f\n", n, jml64, harga)

	// Konversi teks ke angka dengan strconv.
	durasi, err := strconv.Atoi("90")
	if err != nil {
		fmt.Println("bukan angka:", err)
		return
	}
	fmt.Println("Durasi:", durasi, "menit")
	fmt.Println("Batas judul:", batasJudul)
}

Tambahkan variabel untuk tugas kedua (id 2, judul bebas, belum selesai) dan cetak dengan format yang sama seperti tugas pertama.

id2 := int64(2)
judul2 := "Latihan konversi"
selesai2 := false
fmt.Printf("Tugas #%d: %s (%s)\n", id2, judul2, statusTeks(selesai2))

Simpan durasi belajar sebagai teks "90", ubah menjadi int dengan strconv.Atoi, lalu cetak Durasi: 90 menit. Tangani errornya.

durasi, err := strconv.Atoi("90")
if err != nil {
	fmt.Println("bukan angka:", err)
	return
}
fmt.Println("Durasi:", durasi, "menit")

Buat konstanta jamBelajarPerHari = 2 dan cetak total jam belajar dalam seminggu (7 hari) tanpa mengubah konstantanya.

const jamBelajarPerHari = 2
fmt.Println("Total jam per minggu:", jamBelajarPerHari*7)

4-fungsi-dan-control-flow/contoh/go.mod

module bab04-fungsi

go 1.26

4-fungsi-dan-control-flow/contoh/main.go

package main

import (
	"errors"
	"fmt"
)

func statusTeks(selesai bool) string {
	if selesai {
		return "selesai"
	}
	return "belum"
}

func bagi(a, b int) (int, error) {
	if b == 0 {
		return 0, errors.New("pembagi nol")
	}
	return a / b, nil
}

func jumlahkan(angka ...int) int {
	total := 0
	for _, a := range angka {
		total += a
	}
	return total
}

func main() {
	// if dengan pernyataan singkat.
	judul := "Belajar Go"
	if jumlah := len(judul); jumlah > 5 {
		fmt.Println("judul panjang:", jumlah, "huruf")
	}

	// for: empat gaya.
	i := 0
	for i < 3 {
		fmt.Println("gaya1:", i)
		i++
	}
	for j := 0; j < 3; j++ {
		fmt.Println("gaya2:", j)
	}
	n := 0
	for {
		n++
		if n > 2 {
			break
		}
	}
	fmt.Println("gaya3 selesai:", n)

	daftar := []string{"tulis", "jalankan", "uji"}
	for indeks, isi := range daftar {
		fmt.Println("gaya4:", indeks, isi)
	}

	// switch.
	status := "baru"
	switch status {
	case "baru":
		fmt.Println("mulai dikerjakan")
	case "selesai":
		fmt.Println("sudah beres")
	default:
		fmt.Println("sedang dikerjakan")
	}

	// multi-return + error.
	hasil, err := bagi(8, 2)
	if err != nil {
		fmt.Println("error:", err)
	} else {
		fmt.Println("8/2 =", hasil)
	}
	if _, err := bagi(8, 0); err != nil {
		fmt.Println("8/0 error:", err)
	}

	// variadic + closure.
	fmt.Println("jumlahkan:", jumlahkan(1, 2, 3))
	basis := 10
	tambahBasis := func(x int) int { return basis + x }
	fmt.Println("closure:", tambahBasis(5))

	fmt.Println("status:", statusTeks(false), "/", statusTeks(true))
}

Buat fungsi statusTeks(selesai bool) string yang mengembalikan "selesai" atau "belum", lalu pakai untuk mencetak beberapa tugas.

func statusTeks(selesai bool) string {
	if selesai {
		return "selesai"
	}
	return "belum"
}

Cetak nomor 1 sampai 5 dalam format Tugas #1 ... Tugas #5 memakai satu loop for.

for i := 1; i <= 5; i++ {
	fmt.Printf("Tugas #%d\n", i)
}

Buat fungsi bagi(a, b int) (int, error): kalau b nol, kembalikan error; selain itu kembalikan hasilnya. Panggil untuk 8, 2 dan 8, 0, lalu cetak hasil atau errornya.

func bagi(a, b int) (int, error) {
	if b == 0 {
		return 0, errors.New("pembagi nol")
	}
	return a / b, nil
}

hasil, err := bagi(8, 2)
if err != nil {
	fmt.Println("error:", err)
} else {
	fmt.Println("hasil:", hasil)
}

5-pointer-dan-reference/contoh/go.mod

module bab05-pointer

go 1.26

5-pointer-dan-reference/contoh/main.go

package main

import "fmt"

type Tugas struct {
	Judul   string
	selesai bool
}

func (t *Tugas) Selesaikan() {
	t.selesai = true
}

func (t Tugas) Status() string {
	if t.selesai {
		return "selesai"
	}
	return "belum"
}

func ubah(x int) {
	x = 99
}

func ubahLewatPointer(p *int) {
	*p = 99
}

func main() {
	// Pointer: alamat dan dereference.
	angka := 42
	p := &angka
	fmt.Println("alamat dibaca:", *p)
	*p = 7
	fmt.Println("setelah *p = 7:", angka)

	// Pass-by-value vs pass-by-pointer.
	n := 1
	ubah(n)
	fmt.Println("setelah ubah:", n) // tetap 1
	ubahLewatPointer(&n)
	fmt.Println("setelah ubahLewatPointer:", n) // 99

	// Slice berbagi data (reference).
	a := []int{1, 2}
	b := a
	b[0] = 99
	fmt.Println("slice a[0]:", a[0])

	// Map juga berbagi data.
	m := map[string]int{"satu": 1}
	m2 := m
	m2["satu"] = 100
	fmt.Println("map:", m["satu"])

	// Struct: value copy vs pointer receiver.
	t := Tugas{Judul: "Belajar Go"}
	fmt.Println("awal:", t.Status())
	t.Selesaikan()
	fmt.Println("akhir:", t.Status())

	// Nilai kosong pointer adalah nil.
	var kosong *int
	fmt.Println("pointer nil:", kosong == nil)
}

Buat fungsi gandakan(p *int) yang melipatgandakan nilai di alamat p. Panggil dengan variabel biasa dan cetak sebelum/sesudah.

func gandakan(p *int) {
	*p = *p * 2
}

n := 21
gandakan(&n)
fmt.Println(n) // 42

Buat slice daftar := []string{"a", "b"}. Salin ke kedua := daftar, ubah kedua[0] = "z", lalu cetak daftar[0]. Jelaskan hasilnya.

daftar := []string{"a", "b"}
kedua := daftar
kedua[0] = "z"
fmt.Println(daftar[0]) // "z"

Buat struct Tugas{Judul string; Selesai bool} dengan method BalikStatus() ber-receiver pointer, dan TeksStatus() ber-receiver value. Pakai keduanya dan tunjukkan perbedaannya.

type Tugas struct {
	Judul   string
	Selesai bool
}

func (t *Tugas) BalikStatus() {
	t.Selesai = !t.Selesai
}

func (t Tugas) TeksStatus() string {
	if t.Selesai {
		return "selesai"
	}
	return "belum"
}

6-string-rune-dan-koleksi/contoh/go.mod

module bab06-koleksi

go 1.26

6-string-rune-dan-koleksi/contoh/main.go

package main

import (
	"fmt"
	"strings"
)

func main() {
	// String, byte, rune.
	kata := "halo"
	fmt.Println("len halo:", len(kata))

	emoji := "✓"
	fmt.Println("len emoji:", len(emoji))
	fmt.Println("rune emoji:", len([]rune(emoji)))

	teks := "Halo ✓"
	fmt.Println("karakter:", len([]rune(teks)))
	for i, r := range teks {
		fmt.Printf("  offset %d: %c\n", i, r)
	}

	// strings.
	judul := "  Belajar Go  "
	judul = strings.TrimSpace(judul)
	fmt.Println("trim:", judul)
	fmt.Println("upper:", strings.ToUpper(judul))
	fmt.Println("contains:", strings.Contains(judul, "Go"))
	fmt.Println("join:", strings.Join([]string{"a", "b"}, "-"))
	fmt.Println("split:", strings.Split("a-b", "-"))

	// Slice.
	daftar := []string{"tulis", "jalankan", "uji"}
	daftar = append(daftar, "deploy")
	fmt.Println("slice:", daftar)
	fmt.Println("potong [1:3]:", daftar[1:3])

	d := make([]string, 0, 4)
	d = append(d, "a", "b")
	fmt.Println("panjang/kapasitas:", len(d), cap(d))

	// Map.
	status := map[int]string{1: "baru", 2: "selesai"}
	status[3] = "dikerjakan"
	nilai, ada := status[9]
	fmt.Println("kunci 9 ada:", ada, "nilai:", nilai)
	delete(status, 2)
	for id, s := range status {
		fmt.Println("map:", id, s)
	}
}

Buat teks "Halo ✓ 世界" lalu cetak jumlah byte dan jumlah karakter (rune). Mengapa keduanya berbeda?

teks := "Halo ✓ 世界"
fmt.Println("byte:", len(teks))
fmt.Println("rune:", len([]rune(teks)))

Buat fungsi judulBersih(s string) string yang mengembalikan teks setelah strings.TrimSpace. Coba dengan " belajar ".

func judulBersih(s string) string {
	return strings.TrimSpace(s)
}

fmt.Printf("%q\n", judulBersih("   belajar   ")) // "belajar"

Buat map map[string]int, isi dengan kata-kata, lalu cetak kata yang frekuensinya paling besar.

frekuensi := map[string]int{"go": 3, "rust": 1, "web": 5}
terbanyak := ""
maks := 0
for kata, jumlah := range frekuensi {
	if jumlah > maks {
		maks = jumlah
		terbanyak = kata
	}
}
fmt.Println("terbanyak:", terbanyak, maks)

7-struct-method-dan-interface/contoh/go.mod

module bab07-struct

go 1.26

7-struct-method-dan-interface/contoh/main.go

package main

import (
	"fmt"
	"time"
)

type Meta struct {
	DibuatPada time.Time
}

type Tugas struct {
	ID      int64  `json:"id"`
	Judul   string `json:"title"`
	Selesai bool   `json:"completed"`
	Meta
}

func TugasBaru(id int64, judul string) Tugas {
	return Tugas{ID: id, Judul: judul}
}

func (t Tugas) StatusTeks() string {
	if t.Selesai {
		return "selesai"
	}
	return "belum"
}

func (t *Tugas) Selesaikan() {
	t.Selesai = true
}

type Pencetak interface {
	Cetak() string
}

func (t Tugas) Cetak() string {
	return fmt.Sprintf("#%d %s (%s)", t.ID, t.Judul, t.StatusTeks())
}

func tampilkan(p Pencetak) {
	fmt.Println(p.Cetak())
}

func main() {
	t := TugasBaru(1, "Belajar Go")
	t.DibuatPada = time.Now()
	tampilkan(t)

	t.Selesaikan()
	fmt.Println("setelah selesai:", t.StatusTeks())

	// Interface kosong any + type assertion.
	var apaSaja any = t
	if tugas, ok := apaSaja.(Tugas); ok {
		fmt.Println("dari any:", tugas.Judul)
	}
}

Buat struct User{ID int64; Nama string} dengan method Sapaan() string mengembalikan "Halo, <Nama>!".

type User struct {
	ID   int64
	Nama string
}

func (u User) Sapaan() string {
	return fmt.Sprintf("Halo, %s!", u.Nama)
}

Buat interface Pencetak{Cetak() string}. Buat dua tipe yang memenuhinya (Tugas dan User) dan satu fungsi tampilkan(Pencetak) yang mencetaknya.

type Pencetak interface {
	Cetak() string
}

func (t Tugas) Cetak() string {
	return fmt.Sprintf("#%d %s", t.ID, t.Judul)
}

func (u User) Cetak() string {
	return u.Sapaan()
}

func tampilkan(p Pencetak) {
	fmt.Println(p.Cetak())
}

Buat struct Meta{DibuatPada time.Time} dan embed ke Tugas. Buat tugas, isi DibuatPada, dan cetak.

type Meta struct {
	DibuatPada time.Time
}

type Tugas struct {
	ID    int64
	Judul string
	Meta
}

t := Tugas{ID: 1, Judul: "Embedding"}
t.DibuatPada = time.Now()
fmt.Println(t.Judul, t.DibuatPada.Format("15:04"))

8-error-handling/contoh/go.mod

module bab08-error

go 1.26

8-error-handling/contoh/main.go

package main

import (
	"errors"
	"fmt"
	"os"
	"strings"
)

var ErrTidakDitemukan = errors.New("tidak ditemukan")

type ErrValidasi struct {
	Field string
	Pesan string
}

func (e ErrValidasi) Error() string {
	return fmt.Sprintf("%s: %s", e.Field, e.Pesan)
}

func validasiJudul(judul string) error {
	if strings.TrimSpace(judul) == "" {
		return ErrValidasi{Field: "judul", Pesan: "tidak boleh kosong"}
	}
	if len([]rune(judul)) > 200 {
		return ErrValidasi{Field: "judul", Pesan: "maksimal 200 karakter"}
	}
	return nil
}

func cariUser(id int64) (string, error) {
	if id <= 0 {
		return "", ErrTidakDitemukan
	}
	return "rani", nil
}

func bacaKonfigurasi(jalur string) error {
	_, err := os.ReadFile(jalur)
	if err != nil {
		return fmt.Errorf("buka konfigurasi %s: %w", jalur, err)
	}
	return nil
}

func main() {
	// Pola dasar (hasil, error).
	nama, err := cariUser(1)
	if err != nil {
		fmt.Println("gagal:", err)
		return
	}
	fmt.Println("user:", nama)

	// errors.Is untuk sentinel error.
	if _, err := cariUser(0); errors.Is(err, ErrTidakDitemukan) {
		fmt.Println("sentinel terdeteksi")
	}

	// Custom error + errors.As.
	if err := validasiJudul("   "); err != nil {
		var ev ErrValidasi
		if errors.As(err, &ev) {
			fmt.Printf("validasi gagal pada %s: %s\n", ev.Field, ev.Pesan)
		}
	}

	// Wrapping %w + errors.Is menembus rantai.
	if err := bacaKonfigurasi("app.env"); err != nil {
		fmt.Println("error:", err)
		if errors.Is(err, os.ErrNotExist) {
			fmt.Println("file tidak ada")
		}
	}
}

Buat fungsi validasiJudul(judul string) error yang mengembalikan error bila judul kosong atau lebih dari 200 karakter.

func validasiJudul(judul string) error {
	if strings.TrimSpace(judul) == "" {
		return ErrValidasi{Field: "judul", Pesan: "tidak boleh kosong"}
	}
	if len([]rune(judul)) > 200 {
		return ErrValidasi{Field: "judul", Pesan: "maksimal 200 karakter"}
	}
	return nil
}

Buat fungsi bacaFile(jalur string) error yang membungkus error os.ReadFile dengan fmt.Errorf("...: %w", err). Panggil dengan file yang tidak ada dan cetak errornya.

func bacaFile(jalur string) error {
	_, err := os.ReadFile(jalur)
	if err != nil {
		return fmt.Errorf("baca file %s: %w", jalur, err)
	}
	return nil
}

err := bacaFile("tidak-ada.txt")
fmt.Println(err)

Dengan hasil latihan 8.2, gunakan errors.Is(err, os.ErrNotExist) untuk mencetak "file tidak ada" bila penyebabnya memang file tidak ditemukan.

if errors.Is(err, os.ErrNotExist) {
	fmt.Println("file tidak ada")
}

9-package-dan-module/contoh/go.mod

module bab09-package

go 1.26

9-package-dan-module/contoh/tugas/tugas.go

package tugas

type Status string

const (
	StatusBaru       Status = "baru"
	StatusDikerjakan Status = "dikerjakan"
	StatusSelesai    Status = "selesai"
)

type Tugas struct {
	ID     int64
	judul  string
	Status Status
}

func TugasBaru(id int64, judul string) Tugas {
	return Tugas{ID: id, judul: judul, Status: StatusBaru}
}

func (t Tugas) Judul() string {
	return t.judul
}

func (t *Tugas) Selesaikan() {
	t.Status = StatusSelesai
}

func internalTeks() string {
	return "internal"
}

9-package-dan-module/contoh/tugas/daftar.go

package tugas

import "fmt"

type Daftar struct {
	item []Tugas
}

func DaftarBaru() Daftar {
	return Daftar{}
}

func (d *Daftar) Tambah(t Tugas) {
	d.item = append(d.item, t)
}

func (d Daftar) Semua() []Tugas {
	return d.item
}

func (d Daftar) Cetak() {
	fmt.Println("jumlah tugas:", len(d.item), internalTeks())
}

9-package-dan-module/contoh/main.go

package main

import (
	"fmt"

	"bab09-package/tugas"
)

func main() {
	d := tugas.DaftarBaru()
	t := tugas.TugasBaru(1, "Belajar Go")
	fmt.Println("judul:", t.Judul())
	d.Tambah(t)
	d.Cetak()

	t.Selesaikan()
	fmt.Println("status:", t.Status)
}

Buat folder model/ berisi package model dengan struct User{ID int64; Nama string} dan konstruktor UserBaru. Impor dari main.go dan cetak.

// model/model.go
package model

type User struct {
	ID   int64
	Nama string
}

func UserBaru(id int64, nama string) User {
	return User{ID: id, Nama: nama}
}

// main.go
import "bab09-package/model"

u := model.UserBaru(1, "Rani")
fmt.Println(u.Nama)

Di package model, tambahkan field private umur int dan method ekspor UlangTahun() yang menambah umur. Dari main, panggil UlangTahun dan jelaskan kenapa umur tidak bisa diakses langsung.

type User struct {
	ID   int64
	Nama string
	umur int
}

func (u *User) UlangTahun() {
	u.umur++
}

Buat tipe Status string dengan konstanta StatusBaru, StatusDikerjakan, StatusSelesai. Pakai sebagai field struct Tugas.

type Status string

const (
	StatusBaru       Status = "baru"
	StatusDikerjakan Status = "dikerjakan"
	StatusSelesai    Status = "selesai"
)

type Tugas struct {
	ID     int64
	Judul  string
	Status Status
}

10-generics/contoh/go.mod

module bab10-generics

go 1.26

10-generics/contoh/main.go

package main

import "fmt"

type Kotak[T any] struct {
	Isi T
}

func (k Kotak[T]) Ambil() T {
	return k.Isi
}

func Pertama[T any](daftar []T) (T, bool) {
	var zero T
	if len(daftar) == 0 {
		return zero, false
	}
	return daftar[0], true
}

func Sama[T comparable](a, b T) bool {
	return a == b
}

func Berisi[T comparable](daftar []T, cari T) bool {
	for _, v := range daftar {
		if v == cari {
			return true
		}
	}
	return false
}

func Jumlah[T ~int | ~int64 | ~float64](daftar []T) T {
	var total T
	for _, v := range daftar {
		total += v
	}
	return total
}

func Petakan[T, U any](daftar []T, f func(T) U) []U {
	hasil := make([]U, 0, len(daftar))
	for _, v := range daftar {
		hasil = append(hasil, f(v))
	}
	return hasil
}

func main() {
	k := Kotak[string]{Isi: "isi kotak"}
	fmt.Println("kotak:", k.Ambil())

	pertama, ok := Pertama([]int{10, 20})
	fmt.Println("pertama:", pertama, ok)

	fmt.Println("sama:", Sama(1, 1), Sama("a", "b"))
	fmt.Println("berisi:", Berisi([]string{"a", "b"}, "b"))

	fmt.Println("jumlah int:", Jumlah([]int{1, 2, 3}))
	fmt.Println("jumlah float:", Jumlah([]float64{1.5, 2.5}))

	judul := Petakan([]string{"go", "rust"}, func(s string) int { return len(s) })
	fmt.Println("panjang:", judul)
}

Buat fungsi Pertama[T any](daftar []T) (T, bool) yang mengembalikan elemen pertama dan true, atau zero value + false bila kosong.

func Pertama[T any](daftar []T) (T, bool) {
	var zero T
	if len(daftar) == 0 {
		return zero, false
	}
	return daftar[0], true
}

Buat fungsi Berisi[T comparable](daftar []T, cari T) bool yang memeriksa apakah cari ada di dalam daftar.

func Berisi[T comparable](daftar []T, cari T) bool {
	for _, v := range daftar {
		if v == cari {
			return true
		}
	}
	return false
}

Buat fungsi Jumlah[T ~int | ~int64 | ~float64](daftar []T) T yang menjumlahkan semua elemen. Uji dengan []int dan []float64.

func Jumlah[T ~int | ~int64 | ~float64](daftar []T) T {
	var total T
	for _, v := range daftar {
		total += v
	}
	return total
}

fmt.Println(Jumlah([]int{1, 2, 3}))
fmt.Println(Jumlah([]float64{1.5, 2.5}))

11-testing-dan-debugging/contoh/go.mod

module bab11-testing

go 1.26

11-testing-dan-debugging/contoh/main.go

package main

import "strings"

func judulBersih(s string) string {
	return strings.TrimSpace(s)
}

func kebalik(s string) string {
	r := []rune(s)
	for i, j := 0, len(r)-1; i < j; i, j = i+1, j-1 {
		r[i], r[j] = r[j], r[i]
	}
	return string(r)
}

func main() {
	println(judulBersih("  halo  "))
	println(kebalik("abc"))
}

11-testing-dan-debugging/contoh/main_test.go

package main

import "testing"

func TestJudulBersih(t *testing.T) {
	tabel := []struct {
		nama  string
		input string
		ingin string
	}{
		{"sudah bersih", "belajar", "belajar"},
		{"ada spasi", "  belajar  ", "belajar"},
		{"kosong", "   ", ""},
	}

	for _, kasus := range tabel {
		t.Run(kasus.nama, func(t *testing.T) {
			hasil := judulBersih(kasus.input)
			if hasil != kasus.ingin {
				t.Fatalf("ingin %q, dapat %q", kasus.ingin, hasil)
			}
		})
	}
}

func TestKebalik(t *testing.T) {
	tabel := []struct {
		nama  string
		input string
		ingin string
	}{
		{"biasa", "abc", "cba"},
		{"kosong", "", ""},
		{"satu karakter", "a", "a"},
		{"unicode", "Go ✓", "✓ oG"},
	}
	for _, kasus := range tabel {
		t.Run(kasus.nama, func(t *testing.T) {
			if hasil := kebalik(kasus.input); hasil != kasus.ingin {
				t.Fatalf("ingin %q, dapat %q", kasus.ingin, hasil)
			}
		})
	}
}

func BenchmarkJudulBersih(b *testing.B) {
	for i := 0; i < b.N; i++ {
		judulBersih("  belajar  ")
	}
}

Buat fungsi kebalik(s string) string dan test TestKebalik dengan beberapa kasus: "abc" → "cba", "" → "", "a" → "a".

func kebalik(s string) string {
	r := []rune(s)
	for i, j := 0, len(r)-1; i < j; i, j = i+1, j-1 {
		r[i], r[j] = r[j], r[i]
	}
	return string(r)
}

func TestKebalik(t *testing.T) {
	if kebalik("abc") != "cba" {
		t.Errorf("abc -> %q", kebalik("abc"))
	}
	if kebalik("") != "" {
		t.Errorf("kosong -> %q", kebalik(""))
	}
	if kebalik("a") != "a" {
		t.Errorf("a -> %q", kebalik("a"))
	}
}

Ubah test 11.1 menjadi table-driven dengan t.Run per kasus.

func TestKebalik(t *testing.T) {
	tabel := []struct {
		nama  string
		input string
		ingin string
	}{
		{"biasa", "abc", "cba"},
		{"kosong", "", ""},
		{"satu karakter", "a", "a"},
	}
	for _, kasus := range tabel {
		t.Run(kasus.nama, func(t *testing.T) {
			if hasil := kebalik(kasus.input); hasil != kasus.ingin {
				t.Fatalf("ingin %q, dapat %q", kasus.ingin, hasil)
			}
		})
	}
}

Jalankan go test -v -race -cover ./... di folder contoh/ dan jelaskan arti tiga flag itu.

go test -v -race -cover ./...

12-proyek-cli-task-manager/contoh/go.mod

module bab12-cli

go 1.26

12-proyek-cli-task-manager/contoh/tugas.go

package main

import (
	"encoding/json"
	"fmt"
	"os"
)

type Tugas struct {
	ID      int64  `json:"id"`
	Judul   string `json:"title"`
	Selesai bool   `json:"completed"`
}

func Tambah(daftar []Tugas, judul string) []Tugas {
	id := int64(len(daftar) + 1)
	return append(daftar, Tugas{ID: id, Judul: judul})
}

func Selesaikan(daftar []Tugas, id int64) ([]Tugas, bool) {
	for i := range daftar {
		if daftar[i].ID == id {
			daftar[i].Selesai = true
			return daftar, true
		}
	}
	return daftar, false
}

func Simpan(jalur string, daftar []Tugas) error {
	data, err := json.MarshalIndent(daftar, "", "  ")
	if err != nil {
		return fmt.Errorf("ubah ke json: %w", err)
	}
	if err := os.WriteFile(jalur, data, 0o644); err != nil {
		return fmt.Errorf("simpan file: %w", err)
	}
	return nil
}

func Muat(jalur string) ([]Tugas, error) {
	data, err := os.ReadFile(jalur)
	if err != nil {
		if os.IsNotExist(err) {
			return []Tugas{}, nil
		}
		return nil, fmt.Errorf("baca file: %w", err)
	}
	var daftar []Tugas
	if err := json.Unmarshal(data, &daftar); err != nil {
		return nil, fmt.Errorf("baca json: %w", err)
	}
	return daftar, nil
}

12-proyek-cli-task-manager/contoh/main.go

package main

import (
	"flag"
	"fmt"
	"strings"
)

func main() {
	perintah := flag.String("perintah", "daftar", "perintah: daftar/tambah/selesai")
	judul := flag.String("judul", "", "judul tugas (untuk tambah)")
	id := flag.Int64("id", 0, "id tugas (untuk selesai)")
	jalur := flag.String("file", "tugas.json", "file penyimpanan")
	flag.Parse()

	daftar, err := Muat(*jalur)
	if err != nil {
		fmt.Println("gagal memuat:", err)
		return
	}

	switch *perintah {
	case "daftar":
		if len(daftar) == 0 {
			fmt.Println("belum ada tugas")
			return
		}
		for _, t := range daftar {
			status := "belum"
			if t.Selesai {
				status = "selesai"
			}
			fmt.Printf("#%d %s (%s)\n", t.ID, t.Judul, status)
		}

	case "tambah":
		j := strings.TrimSpace(*judul)
		if j == "" {
			fmt.Println("judul tidak boleh kosong")
			return
		}
		daftar = Tambah(daftar, j)
		if err := Simpan(*jalur, daftar); err != nil {
			fmt.Println("gagal menyimpan:", err)
			return
		}
		fmt.Println("tersimpan:", j)

	case "selesai":
		var ok bool
		daftar, ok = Selesaikan(daftar, *id)
		if !ok {
			fmt.Println("id tidak ditemukan")
			return
		}
		if err := Simpan(*jalur, daftar); err != nil {
			fmt.Println("gagal menyimpan:", err)
			return
		}
		fmt.Println("ditandai selesai:", *id)

	default:
		fmt.Println("perintah tidak dikenal:", *perintah)
	}
}

Tambahkan perintah hapus dengan flag -id yang menghapus tugas dari daftar lalu menyimpan ulang ke file.

case "hapus":
	id := *idFlag
	baru := make([]Tugas, 0, len(daftar))
	for _, t := range daftar {
		if t.ID != id {
			baru = append(baru, t)
		}
	}
	if len(baru) == len(daftar) {
		fmt.Println("id tidak ditemukan")
		return
	}
	if err := Simpan(jalur, baru); err != nil {
		fmt.Println(err)
	}

Tambahkan validasi: judul tidak boleh kosong. Kalau kosong, cetak pesan dan keluar tanpa menyimpan.

judul := strings.TrimSpace(*judulFlag)
if judul == "" {
	fmt.Println("judul tidak boleh kosong")
	return
}

Tambahkan perintah ringkas yang hanya mencetak jumlah total tugas dan jumlah yang sudah selesai.

case "ringkas":
	total := len(daftar)
	selesai := 0
	for _, t := range daftar {
		if t.Selesai {
			selesai++
		}
	}
	fmt.Printf("%d tugas (%d selesai)\n", total, selesai)

13-concurrency-goroutine-dan-channel/contoh/go.mod

module bab13-concurrency

go 1.26

13-concurrency-goroutine-dan-channel/contoh/main.go

package main

import (
	"fmt"
	"sync"
	"time"
)

func seduh(nama string, detik time.Duration) string {
	time.Sleep(detik)
	return nama + " siap"
}

func main() {
	// Goroutine langsung.
	go func() {
		for i := 0; i < 3; i++ {
			fmt.Println("kopi", i)
			time.Sleep(50 * time.Millisecond)
		}
	}()
	go func() {
		for i := 0; i < 3; i++ {
			fmt.Println("teh", i)
			time.Sleep(50 * time.Millisecond)
		}
	}()
	time.Sleep(250 * time.Millisecond)

	// WaitGroup.
	var wg sync.WaitGroup
	for _, nama := range []string{"susu", "cokelat", "jahe"} {
		wg.Add(1)
		go func(n string) {
			defer wg.Done()
			fmt.Println(seduh(n, 30*time.Millisecond))
		}(nama)
	}
	wg.Wait()
	fmt.Println("semua selesai")

	// Channel unbuffered.
	ch := make(chan string)
	go func() {
		ch <- "hasil dari goroutine"
	}()
	fmt.Println("terima:", <-ch)

	// Channel buffered.
	antrian := make(chan int, 2)
	antrian <- 1
	antrian <- 2
	fmt.Println("antrian:", <-antrian, <-antrian)

	// close + range.
	hasil := make(chan int)
	go func() {
		for i := 1; i <= 3; i++ {
			hasil <- i
		}
		close(hasil)
	}()
	for v := range hasil {
		fmt.Println("range:", v)
	}

	// select + timeout.
	lambat := make(chan string)
	go func() {
		time.Sleep(2 * time.Second)
		lambat <- "terlambat"
	}()
	select {
	case v := <-lambat:
		fmt.Println("dapat:", v)
	case <-time.After(500 * time.Millisecond):
		fmt.Println("timeout")
	}
}

Jalankan tiga goroutine yang masing-masing mencetak namanya tiga kali, dan tunggu semuanya selesai dengan sync.WaitGroup sebelum mencetak "selesai".

var wg sync.WaitGroup
for _, nama := range []string{"kopi", "teh", "susu"} {
	wg.Add(1)
	go func(n string) {
		defer wg.Done()
		for i := 0; i < 3; i++ {
			fmt.Println(n, i)
		}
	}(nama)
}
wg.Wait()
fmt.Println("selesai")

Buat goroutine yang menghitung jumlahkan([]int{1,2,3}) lalu mengirim hasilnya lewat channel. Terima dan cetak di main.

ch := make(chan int)
go func() {
	ch <- jumlahkan([]int{1, 2, 3})
}()
fmt.Println("hasil:", <-ch)

Buat goroutine yang "lama" (sleep 3 detik) lalu mengirim hasil. Di main, pakai select dengan time.After(1 * time.Second) untuk timeout.

ch := make(chan string)
go func() {
	time.Sleep(3 * time.Second)
	ch <- "terlambat"
}()
select {
case hasil := <-ch:
	fmt.Println("hasil:", hasil)
case <-time.After(1 * time.Second):
	fmt.Println("timeout")
}

14-http-json/contoh/go.mod

module bab14-http

go 1.26

14-http-json/contoh/main.go

package main

import (
	"encoding/json"
	"fmt"
	"net/http"
)

type Todo struct {
	UserID    int    `json:"userId"`
	ID        int    `json:"id"`
	Title     string `json:"title"`
	Completed bool   `json:"completed"`
}

func ambilTodo(id int) (Todo, error) {
	var todo Todo

	url := fmt.Sprintf("https://jsonplaceholder.typicode.com/todos/%d", id)
	resp, err := http.Get(url)
	if err != nil {
		return todo, fmt.Errorf("request gagal: %w", err)
	}
	defer resp.Body.Close()

	if resp.StatusCode != http.StatusOK {
		return todo, fmt.Errorf("status tidak diharapkan: %s", resp.Status)
	}

	if err := json.NewDecoder(resp.Body).Decode(&todo); err != nil {
		return todo, fmt.Errorf("decode gagal: %w", err)
	}
	return todo, nil
}

func main() {
	todo, err := ambilTodo(1)
	if err != nil {
		fmt.Println("error:", err)
		return
	}
	fmt.Printf("#%d %s (selesai=%t)\n", todo.ID, todo.Title, todo.Completed)

	// Marshal: struct -> JSON.
	data, err := json.MarshalIndent(todo, "", "  ")
	if err != nil {
		fmt.Println("marshal gagal:", err)
		return
	}
	fmt.Println(string(data))
}

Ambil satu todo dari https://jsonplaceholder.typicode.com/todos/1, decode ke struct Todo, dan cetak title-nya.

resp, err := http.Get("https://jsonplaceholder.typicode.com/todos/1")
if err != nil {
	fmt.Println("gagal:", err)
	return
}
defer resp.Body.Close()

var todo Todo
if err := json.NewDecoder(resp.Body).Decode(&todo); err != nil {
	fmt.Println("decode gagal:", err)
	return
}
fmt.Println("judul:", todo.Title)

Ubah kode agar mencetak pesan berbeda bila status bukan 200.

if resp.StatusCode != http.StatusOK {
	fmt.Printf("status tidak diharapkan: %d %s\n", resp.StatusCode, resp.Status)
	return
}

Buat struct Todo{UserID, ID, Title, Completed} berisi data, ubah ke JSON dengan json.MarshalIndent, dan cetak.

todo := Todo{UserID: 1, ID: 201, Title: "Belajar Go", Completed: false}
data, err := json.MarshalIndent(todo, "", "  ")
if err != nil {
	fmt.Println(err)
	return
}
fmt.Println(string(data))

15-api-pertama-net-http/contoh/go.mod

module bab15-api

go 1.26

15-api-pertama-net-http/contoh/main.go

package main

import (
	"encoding/json"
	"fmt"
	"net/http"
	"strconv"
)

type Tugas struct {
	ID      int64  `json:"id"`
	Judul   string `json:"title"`
	Selesai bool   `json:"completed"`
}

func tulisJSON(w http.ResponseWriter, status int, nilai any) {
	w.Header().Set("Content-Type", "application/json")
	w.WriteHeader(status)
	if err := json.NewEncoder(w).Encode(nilai); err != nil {
		fmt.Println("gagal encode:", err)
	}
}

func handleHealth(w http.ResponseWriter, r *http.Request) {
	tulisJSON(w, http.StatusOK, map[string]string{"status": "ok"})
}

func handleSatuTask(w http.ResponseWriter, r *http.Request) {
	id := r.PathValue("id")
	angka, err := strconv.Atoi(id)
	if err != nil || angka < 1 {
		http.Error(w, `{"error":"id tidak valid"}`, http.StatusBadRequest)
		return
	}
	tugas := Tugas{ID: int64(angka), Judul: "Belajar Go", Selesai: false}
	tulisJSON(w, http.StatusOK, tugas)
}

func router() *http.ServeMux {
	mux := http.NewServeMux()
	mux.HandleFunc("GET /health", handleHealth)
	mux.HandleFunc("GET /tasks/{id}", handleSatuTask)
	return mux
}

func main() {
	mux := router()
	fmt.Println("server berjalan di http://localhost:3000")
	if err := http.ListenAndServe(":3000", mux); err != nil {
		fmt.Println("server berhenti:", err)
	}
}

15-api-pertama-net-http/contoh/main_test.go

package main

import (
	"encoding/json"
	"net/http"
	"net/http/httptest"
	"testing"
)

func TestHealth(t *testing.T) {
	srv := httptest.NewServer(router())
	defer srv.Close()

	resp, err := http.Get(srv.URL + "/health")
	if err != nil {
		t.Fatal(err)
	}
	defer resp.Body.Close()

	if resp.StatusCode != http.StatusOK {
		t.Fatalf("ingin 200, dapat %d", resp.StatusCode)
	}
	var isi map[string]string
	if err := json.NewDecoder(resp.Body).Decode(&isi); err != nil {
		t.Fatal(err)
	}
	if isi["status"] != "ok" {
		t.Fatalf("ingin status ok, dapat %q", isi["status"])
	}
}

func TestSatuTask(t *testing.T) {
	srv := httptest.NewServer(router())
	defer srv.Close()

	resp, err := http.Get(srv.URL + "/tasks/3")
	if err != nil {
		t.Fatal(err)
	}
	defer resp.Body.Close()

	if resp.StatusCode != http.StatusOK {
		t.Fatalf("ingin 200, dapat %d", resp.StatusCode)
	}
	var tugas Tugas
	if err := json.NewDecoder(resp.Body).Decode(&tugas); err != nil {
		t.Fatal(err)
	}
	if tugas.ID != 3 {
		t.Fatalf("ingin id 3, dapat %d", tugas.ID)
	}
}

func TestSatuTaskIDTidakValid(t *testing.T) {
	srv := httptest.NewServer(router())
	defer srv.Close()

	resp, err := http.Get(srv.URL + "/tasks/abc")
	if err != nil {
		t.Fatal(err)
	}
	defer resp.Body.Close()

	if resp.StatusCode != http.StatusBadRequest {
		t.Fatalf("ingin 400, dapat %d", resp.StatusCode)
	}
}

Tambahkan rute GET /sapa/{nama} yang membalas JSON {"pesan":"halo <nama>"}.

mux.HandleFunc("GET /sapa/{nama}", func(w http.ResponseWriter, r *http.Request) {
	tulisJSON(w, http.StatusOK, map[string]string{"pesan": "halo " + r.PathValue("nama")})
})

Tambahkan rute GET /jumlah/{a}/{b} yang membalas JSON berisi jumlah dua angka path (validasi angka).

mux.HandleFunc("GET /jumlah/{a}/{b}", func(w http.ResponseWriter, r *http.Request) {
	a, errA := strconv.Atoi(r.PathValue("a"))
	b, errB := strconv.Atoi(r.PathValue("b"))
	if errA != nil || errB != nil {
		http.Error(w, `{"error":"angka tidak valid"}`, http.StatusBadRequest)
		return
	}
	tulisJSON(w, http.StatusOK, map[string]int{"jumlah": a + b})
})

Jalankan server dan uji ketiga endpoint (health, sapa, jumlah) dengan curl, termasuk kasus angka tidak valid.

go run .
curl -i http://localhost:3000/health
curl -i http://localhost:3000/sapa/rani
curl -i http://localhost:3000/jumlah/3/4      # {"jumlah":7}
curl -i http://localhost:3000/jumlah/3/abc    # 400

16-crud-in-memory/contoh/go.mod

module bab16-crud

go 1.26

16-crud-in-memory/contoh/main.go

package main

import (
	"encoding/json"
	"fmt"
	"net/http"
	"strconv"
	"strings"
	"sync"
)

type Tugas struct {
	ID      int64  `json:"id"`
	Judul   string `json:"title"`
	Selesai bool   `json:"completed"`
}

type TaskStore struct {
	mu    sync.Mutex
	tugas map[int64]Tugas
	next  int64
}

func NewTaskStore() *TaskStore {
	return &TaskStore{tugas: make(map[int64]Tugas)}
}

func (s *TaskStore) Tambah(t Tugas) Tugas {
	s.mu.Lock()
	defer s.mu.Unlock()
	s.next++
	t.ID = s.next
	s.tugas[t.ID] = t
	return t
}

func (s *TaskStore) Semua() []Tugas {
	s.mu.Lock()
	defer s.mu.Unlock()
	daftar := make([]Tugas, 0, len(s.tugas))
	for _, t := range s.tugas {
		daftar = append(daftar, t)
	}
	return daftar
}

func (s *TaskStore) Cari(id int64) (Tugas, bool) {
	s.mu.Lock()
	defer s.mu.Unlock()
	t, ok := s.tugas[id]
	return t, ok
}

func (s *TaskStore) Ubah(id int64, t Tugas) (Tugas, bool) {
	s.mu.Lock()
	defer s.mu.Unlock()
	if _, ok := s.tugas[id]; !ok {
		return Tugas{}, false
	}
	t.ID = id
	s.tugas[id] = t
	return t, true
}

func (s *TaskStore) Hapus(id int64) bool {
	s.mu.Lock()
	defer s.mu.Unlock()
	if _, ok := s.tugas[id]; !ok {
		return false
	}
	delete(s.tugas, id)
	return true
}

type API struct {
	store *TaskStore
}

func tulisJSON(w http.ResponseWriter, status int, nilai any) {
	w.Header().Set("Content-Type", "application/json")
	w.WriteHeader(status)
	if err := json.NewEncoder(w).Encode(nilai); err != nil {
		fmt.Println("gagal encode:", err)
	}
}

func idDariPath(w http.ResponseWriter, r *http.Request) (int64, bool) {
	angka, err := strconv.ParseInt(r.PathValue("id"), 10, 64)
	if err != nil || angka < 1 {
		http.Error(w, `{"error":"id tidak valid"}`, http.StatusBadRequest)
		return 0, false
	}
	return angka, true
}

func validasiJudul(judul string) (string, bool) {
	judul = strings.TrimSpace(judul)
	if judul == "" {
		return "", false
	}
	if len([]rune(judul)) > 200 {
		return "", false
	}
	return judul, true
}

func (a *API) health(w http.ResponseWriter, r *http.Request) {
	tulisJSON(w, http.StatusOK, map[string]string{"status": "ok"})
}

func (a *API) daftarTugas(w http.ResponseWriter, r *http.Request) {
	tulisJSON(w, http.StatusOK, a.store.Semua())
}

func (a *API) buatTugas(w http.ResponseWriter, r *http.Request) {
	var input struct {
		Judul string `json:"title"`
	}
	if err := json.NewDecoder(r.Body).Decode(&input); err != nil {
		http.Error(w, `{"error":"body json tidak valid"}`, http.StatusBadRequest)
		return
	}
	judul, ok := validasiJudul(input.Judul)
	if !ok {
		http.Error(w, `{"error":"title wajib diisi, maksimal 200 karakter"}`, http.StatusBadRequest)
		return
	}
	tugas := a.store.Tambah(Tugas{Judul: judul})
	tulisJSON(w, http.StatusCreated, tugas)
}

func (a *API) satuTugas(w http.ResponseWriter, r *http.Request) {
	id, ok := idDariPath(w, r)
	if !ok {
		return
	}
	tugas, ada := a.store.Cari(id)
	if !ada {
		http.Error(w, `{"error":"tugas tidak ditemukan"}`, http.StatusNotFound)
		return
	}
	tulisJSON(w, http.StatusOK, tugas)
}

func (a *API) ubahTugas(w http.ResponseWriter, r *http.Request) {
	id, ok := idDariPath(w, r)
	if !ok {
		return
	}
	var input struct {
		Judul   string `json:"title"`
		Selesai bool   `json:"completed"`
	}
	if err := json.NewDecoder(r.Body).Decode(&input); err != nil {
		http.Error(w, `{"error":"body json tidak valid"}`, http.StatusBadRequest)
		return
	}
	judul, ok := validasiJudul(input.Judul)
	if !ok {
		http.Error(w, `{"error":"title wajib diisi, maksimal 200 karakter"}`, http.StatusBadRequest)
		return
	}
	tugas, ada := a.store.Ubah(id, Tugas{Judul: judul, Selesai: input.Selesai})
	if !ada {
		http.Error(w, `{"error":"tugas tidak ditemukan"}`, http.StatusNotFound)
		return
	}
	tulisJSON(w, http.StatusOK, tugas)
}

func (a *API) hapusTugas(w http.ResponseWriter, r *http.Request) {
	id, ok := idDariPath(w, r)
	if !ok {
		return
	}
	if !a.store.Hapus(id) {
		http.Error(w, `{"error":"tugas tidak ditemukan"}`, http.StatusNotFound)
		return
	}
	w.WriteHeader(http.StatusNoContent)
}

func (a *API) router() *http.ServeMux {
	mux := http.NewServeMux()
	mux.HandleFunc("GET /health", a.health)
	mux.HandleFunc("GET /tasks", a.daftarTugas)
	mux.HandleFunc("POST /tasks", a.buatTugas)
	mux.HandleFunc("GET /tasks/{id}", a.satuTugas)
	mux.HandleFunc("PUT /tasks/{id}", a.ubahTugas)
	mux.HandleFunc("DELETE /tasks/{id}", a.hapusTugas)
	return mux
}

func main() {
	api := &API{store: NewTaskStore()}
	fmt.Println("server berjalan di http://localhost:3000")
	if err := http.ListenAndServe(":3000", api.router()); err != nil {
		fmt.Println("server berhenti:", err)
	}
}

16-crud-in-memory/contoh/main_test.go

package main

import (
	"encoding/json"
	"net/http"
	"net/http/httptest"
	"strings"
	"testing"
)

func TestAlurCRUD(t *testing.T) {
	api := &API{store: NewTaskStore()}
	srv := httptest.NewServer(api.router())
	defer srv.Close()

	// POST: buat tugas.
	body := strings.NewReader(`{"title":"Belajar Go"}`)
	resp, err := http.Post(srv.URL+"/tasks", "application/json", body)
	if err != nil {
		t.Fatal(err)
	}
	if resp.StatusCode != http.StatusCreated {
		t.Fatalf("POST ingin 201, dapat %d", resp.StatusCode)
	}
	var dibuat Tugas
	if err := json.NewDecoder(resp.Body).Decode(&dibuat); err != nil {
		t.Fatal(err)
	}
	resp.Body.Close()

	// GET satu.
	resp, err = http.Get(srv.URL + "/tasks/1")
	if err != nil {
		t.Fatal(err)
	}
	if resp.StatusCode != http.StatusOK {
		t.Fatalf("GET ingin 200, dapat %d", resp.StatusCode)
	}
	resp.Body.Close()

	// PUT ubah.
	req, _ := http.NewRequest(http.MethodPut, srv.URL+"/tasks/1",
		strings.NewReader(`{"title":"Belajar Fiber","completed":true}`))
	resp, err = http.DefaultClient.Do(req)
	if err != nil {
		t.Fatal(err)
	}
	if resp.StatusCode != http.StatusOK {
		t.Fatalf("PUT ingin 200, dapat %d", resp.StatusCode)
	}
	resp.Body.Close()

	// DELETE hapus.
	req, _ = http.NewRequest(http.MethodDelete, srv.URL+"/tasks/1", nil)
	resp, err = http.DefaultClient.Do(req)
	if err != nil {
		t.Fatal(err)
	}
	if resp.StatusCode != http.StatusNoContent {
		t.Fatalf("DELETE ingin 204, dapat %d", resp.StatusCode)
	}
	resp.Body.Close()
}

func TestValidasiJudul(t *testing.T) {
	api := &API{store: NewTaskStore()}
	srv := httptest.NewServer(api.router())
	defer srv.Close()

	resp, err := http.Post(srv.URL+"/tasks", "application/json",
		strings.NewReader(`{"title":"   "}`))
	if err != nil {
		t.Fatal(err)
	}
	defer resp.Body.Close()
	if resp.StatusCode != http.StatusBadRequest {
		t.Fatalf("ingin 400, dapat %d", resp.StatusCode)
	}
}

func TestUbahTidakAda(t *testing.T) {
	api := &API{store: NewTaskStore()}
	srv := httptest.NewServer(api.router())
	defer srv.Close()

	req, _ := http.NewRequest(http.MethodPut, srv.URL+"/tasks/999",
		strings.NewReader(`{"title":"x"}`))
	resp, err := http.DefaultClient.Do(req)
	if err != nil {
		t.Fatal(err)
	}
	defer resp.Body.Close()
	if resp.StatusCode != http.StatusNotFound {
		t.Fatalf("ingin 404, dapat %d", resp.StatusCode)
	}
}

Tambahkan validasi: judul maksimal 200 karakter → 400.

if len([]rune(judul)) > 200 {
	http.Error(w, `{"error":"title maksimal 200 karakter"}`, http.StatusBadRequest)
	return
}

Tulis test: PUT ke ID yang tidak ada harus 404; DELETE ID yang tidak ada juga 404.

func TestUbahTidakAda(t *testing.T) {
	api := &API{store: NewTaskStore()}
	srv := httptest.NewServer(api.router())
	defer srv.Close()

	body := strings.NewReader(`{"title":"x"}`)
	req, _ := http.NewRequest(http.MethodPut, srv.URL+"/tasks/999", body)
	resp, err := http.DefaultClient.Do(req)
	if err != nil {
		t.Fatal(err)
	}
	defer resp.Body.Close()
	if resp.StatusCode != http.StatusNotFound {
		t.Fatalf("ingin 404, dapat %d", resp.StatusCode)
	}
}

Jalankan go test -race ./... dan pastikan lulus. Jelaskan kenapa -race penting untuk bab ini.

go test -race ./...

17-mariadb-dan-database-sql/contoh/go.mod

module bab17-mariadb

go 1.26

require github.com/go-sql-driver/mysql v1.9.3

require filippo.io/edwards25519 v1.1.0 // indirect

17-mariadb-dan-database-sql/contoh/main.go

package main

import (
	"database/sql"
	"fmt"
	"os"

	_ "github.com/go-sql-driver/mysql"
)

type Tugas struct {
	ID      int64  `json:"id"`
	Judul   string `json:"title"`
	Selesai bool   `json:"completed"`
}

const skema = `
CREATE TABLE IF NOT EXISTS tasks (
    id BIGINT AUTO_INCREMENT PRIMARY KEY,
    title VARCHAR(200) NOT NULL,
    completed BOOLEAN NOT NULL DEFAULT FALSE
) CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci;`

func bukaDB() (*sql.DB, error) {
	url := os.Getenv("DATABASE_URL")
	if url == "" {
		url = "task_app:ganti-dengan-sandi-kuat@tcp(127.0.0.1:3306)/belajar_go?parseTime=true&multiStatements=true"
	}

	db, err := sql.Open("mysql", url)
	if err != nil {
		return nil, fmt.Errorf("buka db: %w", err)
	}
	if err := db.Ping(); err != nil {
		db.Close()
		return nil, fmt.Errorf("ping db: %w", err)
	}
	if _, err := db.Exec(skema); err != nil {
		db.Close()
		return nil, fmt.Errorf("buat tabel: %w", err)
	}
	return db, nil
}

func tambahTugas(db *sql.DB, judul string) (Tugas, error) {
	hasil, err := db.Exec("INSERT INTO tasks (title) VALUES (?)", judul)
	if err != nil {
		return Tugas{}, err
	}
	id, err := hasil.LastInsertId()
	if err != nil {
		return Tugas{}, err
	}
	return Tugas{ID: id, Judul: judul}, nil
}

func semuaTugas(db *sql.DB) ([]Tugas, error) {
	rows, err := db.Query("SELECT id, title, completed FROM tasks ORDER BY id")
	if err != nil {
		return nil, err
	}
	defer rows.Close()

	var daftar []Tugas
	for rows.Next() {
		var t Tugas
		if err := rows.Scan(&t.ID, &t.Judul, &t.Selesai); err != nil {
			return nil, err
		}
		daftar = append(daftar, t)
	}
	return daftar, rows.Err()
}

func cariTugas(db *sql.DB, id int64) (Tugas, error) {
	var t Tugas
	err := db.QueryRow(
		"SELECT id, title, completed FROM tasks WHERE id = ?", id,
	).Scan(&t.ID, &t.Judul, &t.Selesai)
	return t, err
}

func selesaikanTugas(db *sql.DB, id int64) (int64, error) {
	res, err := db.Exec("UPDATE tasks SET completed = TRUE WHERE id = ?", id)
	if err != nil {
		return 0, err
	}
	return res.RowsAffected()
}

func hapusTugas(db *sql.DB, id int64) (int64, error) {
	res, err := db.Exec("DELETE FROM tasks WHERE id = ?", id)
	if err != nil {
		return 0, err
	}
	return res.RowsAffected()
}

func main() {
	db, err := bukaDB()
	if err != nil {
		fmt.Println("error:", err)
		fmt.Println("Petunjuk: nyalakan MariaDB dan set DATABASE_URL (lihat README bab 17).")
		os.Exit(1)
	}
	defer db.Close()

	t, err := tambahTugas(db, "Belajar Go")
	if err != nil {
		fmt.Println("error:", err)
		return
	}
	fmt.Println("ditambah:", t)

	daftar, err := semuaTugas(db)
	if err != nil {
		fmt.Println("error:", err)
		return
	}
	for _, item := range daftar {
		fmt.Printf("#%d %s (selesai=%t)\n", item.ID, item.Judul, item.Selesai)
	}

	if n, err := selesaikanTugas(db, t.ID); err != nil || n == 0 {
		fmt.Println("gagal menyelesaikan:", err)
	} else {
		fmt.Println("diselesaikan:", t.ID)
	}

	if n, err := hapusTugas(db, t.ID); err != nil || n == 0 {
		fmt.Println("gagal menghapus:", err)
	} else {
		fmt.Println("dihapus:", t.ID)
	}
}

Jalankan langkah setup: buat database belajar_go, user task_app, dan grant. Tulis perintah SQL-nya.

sudo mysql

-- Masuk sebagai root: sudo mysql
CREATE DATABASE belajar_go CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci;
CREATE USER 'task_app'@'localhost' IDENTIFIED BY 'ganti-dengan-sandi-kuat';
GRANT ALL PRIVILEGES ON belajar_go.* TO 'task_app'@'localhost';
FLUSH PRIVILEGES;

Tulis fungsi CariTugas(db *sql.DB, id int64) (Tugas, error) yang membalas sql.ErrNoRows bila tidak ada.

func CariTugas(db *sql.DB, id int64) (Tugas, error) {
	var t Tugas
	err := db.QueryRow(
		"SELECT id, title, completed FROM tasks WHERE id = ?", id,
	).Scan(&t.ID, &t.Judul, &t.Selesai)
	return t, err
}

Jelaskan kenapa query db.Query("SELECT ... WHERE id = " + inputUser) berbahaya, dan bagaimana bentuk amannya.

db.Query("SELECT ... WHERE id = ?", id)

18-proyek-akhir-task-api/contoh/go.mod

module bab18-task-api

go 1.26.4

require (
	github.com/go-sql-driver/mysql v1.10.1
	github.com/gofiber/fiber/v2 v2.52.15
)

require (
	filippo.io/edwards25519 v1.2.0 // indirect
	github.com/andybalholm/brotli v1.1.0 // indirect
	github.com/google/uuid v1.6.0 // indirect
	github.com/klauspost/compress v1.17.9 // indirect
	github.com/mattn/go-colorable v0.1.13 // indirect
	github.com/mattn/go-isatty v0.0.20 // indirect
	github.com/mattn/go-runewidth v0.0.16 // indirect
	github.com/rivo/uniseg v0.2.0 // indirect
	github.com/valyala/bytebufferpool v1.0.0 // indirect
	github.com/valyala/fasthttp v1.51.0 // indirect
	github.com/valyala/tcplisten v1.0.0 // indirect
	golang.org/x/sys v0.28.0 // indirect
)

18-proyek-akhir-task-api/contoh/.env.example

# Salin file ini menjadi .env atau set lewat `export` di terminal.
# GANTI sandinya dengan milikmu. Jangan pernah commit sandi asli.

# URL koneksi MariaDB untuk server API.
DATABASE_URL=task_app:ganti-dengan-sandi-kuat@tcp(127.0.0.1:3306)/belajar_go?parseTime=true

# Database TERPISAH untuk integration test (dipakai oleh go test).
TEST_DATABASE_URL=task_app:ganti-dengan-sandi-kuat@tcp(127.0.0.1:3306)/belajar_go_test?parseTime=true&multiStatements=true

# Port server (opsional, bawaan 3000).
PORT=3000

18-proyek-akhir-task-api/contoh/config.go

package main

import (
	"os"
)

type Config struct {
	DatabaseURL string
	Port        string
}

func muatConfig() Config {
	port := os.Getenv("PORT")
	if port == "" {
		port = "3000"
	}
	url := os.Getenv("DATABASE_URL")
	if url == "" {
		url = "task_app:ganti-dengan-sandi-kuat@tcp(127.0.0.1:3306)/belajar_go?parseTime=true"
	}
	return Config{DatabaseURL: url, Port: port}
}

18-proyek-akhir-task-api/contoh/models.go

package main

import (
	"strings"
)

type Task struct {
	ID        int64  `json:"id"`
	Title     string `json:"title"`
	Completed bool   `json:"completed"`
}

type NewTask struct {
	Title string `json:"title"`
}

type UpdateTask struct {
	Title     string `json:"title"`
	Completed bool   `json:"completed"`
}

func validasiJudul(judul string) (string, bool) {
	judul = strings.TrimSpace(judul)
	if judul == "" {
		return "", false
	}
	if len([]rune(judul)) > 200 {
		return "", false
	}
	return judul, true
}

18-proyek-akhir-task-api/contoh/store.go

package main

import (
	"database/sql"
	"fmt"
)

type TaskStore struct {
	db *sql.DB
}

const skema = `
CREATE TABLE IF NOT EXISTS tasks (
    id BIGINT AUTO_INCREMENT PRIMARY KEY,
    title VARCHAR(200) NOT NULL,
    completed BOOLEAN NOT NULL DEFAULT FALSE
) CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci;`

func (s *TaskStore) BuatTabel() error {
	if _, err := s.db.Exec(skema); err != nil {
		return fmt.Errorf("buat tabel: %w", err)
	}
	return nil
}

func (s *TaskStore) Tambah(judul string) (Task, error) {
	hasil, err := s.db.Exec("INSERT INTO tasks (title) VALUES (?)", judul)
	if err != nil {
		return Task{}, err
	}
	id, err := hasil.LastInsertId()
	if err != nil {
		return Task{}, err
	}
	return Task{ID: id, Title: judul}, nil
}

func (s *TaskStore) Semua() ([]Task, error) {
	rows, err := s.db.Query("SELECT id, title, completed FROM tasks ORDER BY id")
	if err != nil {
		return nil, err
	}
	defer rows.Close()

	var daftar []Task
	for rows.Next() {
		var t Task
		if err := rows.Scan(&t.ID, &t.Title, &t.Completed); err != nil {
			return nil, err
		}
		daftar = append(daftar, t)
	}
	return daftar, rows.Err()
}

func (s *TaskStore) Cari(id int64) (Task, error) {
	var t Task
	err := s.db.QueryRow(
		"SELECT id, title, completed FROM tasks WHERE id = ?", id,
	).Scan(&t.ID, &t.Title, &t.Completed)
	return t, err
}

func (s *TaskStore) Ubah(id int64, input UpdateTask) (Task, error) {
	res, err := s.db.Exec(
		"UPDATE tasks SET title = ?, completed = ? WHERE id = ?",
		input.Title, input.Completed, id)
	if err != nil {
		return Task{}, err
	}
	if n, _ := res.RowsAffected(); n == 0 {
		return Task{}, sql.ErrNoRows
	}
	return Task{ID: id, Title: input.Title, Completed: input.Completed}, nil
}

func (s *TaskStore) Hapus(id int64) error {
	res, err := s.db.Exec("DELETE FROM tasks WHERE id = ?", id)
	if err != nil {
		return err
	}
	if n, _ := res.RowsAffected(); n == 0 {
		return sql.ErrNoRows
	}
	return nil
}

18-proyek-akhir-task-api/contoh/handlers.go

package main

import (
	"database/sql"
	"strconv"

	"github.com/gofiber/fiber/v2"
)

type Handlers struct {
	store *TaskStore
}

func idDariParams(c *fiber.Ctx) (int64, error) {
	return strconv.ParseInt(c.Params("id"), 10, 64)
}

func (h *Handlers) BuatTugas(c *fiber.Ctx) error {
	var input NewTask
	if err := c.BodyParser(&input); err != nil {
		return c.Status(fiber.StatusBadRequest).JSON(fiber.Map{
			"error": "body json tidak valid"})
	}
	judul, ok := validasiJudul(input.Title)
	if !ok {
		return c.Status(fiber.StatusBadRequest).JSON(fiber.Map{
			"error": "title wajib diisi, maksimal 200 karakter"})
	}
	tugas, err := h.store.Tambah(judul)
	if err != nil {
		return c.Status(fiber.StatusInternalServerError).JSON(fiber.Map{
			"error": "gagal menyimpan"})
	}
	return c.Status(fiber.StatusCreated).JSON(tugas)
}

func (h *Handlers) DaftarTugas(c *fiber.Ctx) error {
	daftar, err := h.store.Semua()
	if err != nil {
		return c.Status(fiber.StatusInternalServerError).JSON(fiber.Map{
			"error": "gagal membaca"})
	}
	return c.JSON(daftar)
}

func (h *Handlers) SatuTugas(c *fiber.Ctx) error {
	id, err := idDariParams(c)
	if err != nil || id < 1 {
		return c.Status(fiber.StatusBadRequest).JSON(fiber.Map{
			"error": "id tidak valid"})
	}
	tugas, err := h.store.Cari(id)
	if err == sql.ErrNoRows {
		return c.Status(fiber.StatusNotFound).JSON(fiber.Map{
			"error": "tugas tidak ditemukan"})
	}
	if err != nil {
		return c.Status(fiber.StatusInternalServerError).JSON(fiber.Map{
			"error": "gagal membaca"})
	}
	return c.JSON(tugas)
}

func (h *Handlers) UbahTugas(c *fiber.Ctx) error {
	id, err := idDariParams(c)
	if err != nil || id < 1 {
		return c.Status(fiber.StatusBadRequest).JSON(fiber.Map{
			"error": "id tidak valid"})
	}
	var input UpdateTask
	if err := c.BodyParser(&input); err != nil {
		return c.Status(fiber.StatusBadRequest).JSON(fiber.Map{
			"error": "body json tidak valid"})
	}
	judul, ok := validasiJudul(input.Title)
	if !ok {
		return c.Status(fiber.StatusBadRequest).JSON(fiber.Map{
			"error": "title wajib diisi, maksimal 200 karakter"})
	}
	input.Title = judul
	tugas, err := h.store.Ubah(id, input)
	if err == sql.ErrNoRows {
		return c.Status(fiber.StatusNotFound).JSON(fiber.Map{
			"error": "tugas tidak ditemukan"})
	}
	if err != nil {
		return c.Status(fiber.StatusInternalServerError).JSON(fiber.Map{
			"error": "gagal mengubah"})
	}
	return c.JSON(tugas)
}

func (h *Handlers) HapusTugas(c *fiber.Ctx) error {
	id, err := idDariParams(c)
	if err != nil || id < 1 {
		return c.Status(fiber.StatusBadRequest).JSON(fiber.Map{
			"error": "id tidak valid"})
	}
	err = h.store.Hapus(id)
	if err == sql.ErrNoRows {
		return c.Status(fiber.StatusNotFound).JSON(fiber.Map{
			"error": "tugas tidak ditemukan"})
	}
	if err != nil {
		return c.Status(fiber.StatusInternalServerError).JSON(fiber.Map{
			"error": "gagal menghapus"})
	}
	return c.SendStatus(fiber.StatusNoContent)
}

18-proyek-akhir-task-api/contoh/app.go

package main

import (
	"database/sql"

	"github.com/gofiber/fiber/v2"
)

func NewApp(db *sql.DB) *fiber.App {
	app := fiber.New()
	store := &TaskStore{db: db}
	h := &Handlers{store: store}

	app.Get("/health", func(c *fiber.Ctx) error {
		return c.JSON(fiber.Map{"status": "ok"})
	})
	app.Get("/tasks", h.DaftarTugas)
	app.Post("/tasks", h.BuatTugas)
	app.Get("/tasks/:id", h.SatuTugas)
	app.Put("/tasks/:id", h.UbahTugas)
	app.Delete("/tasks/:id", h.HapusTugas)
	return app
}

18-proyek-akhir-task-api/contoh/main.go

package main

import (
	"database/sql"
	"fmt"
	"log"
	"os"

	_ "github.com/go-sql-driver/mysql"
)

func bukaDB(url string) (*sql.DB, error) {
	db, err := sql.Open("mysql", url)
	if err != nil {
		return nil, fmt.Errorf("buka db: %w", err)
	}
	if err := db.Ping(); err != nil {
		db.Close()
		return nil, fmt.Errorf("ping db: %w", err)
	}
	return db, nil
}

func main() {
	cfg := muatConfig()

	db, err := bukaDB(cfg.DatabaseURL)
	if err != nil {
		fmt.Println("error:", err)
		fmt.Println("Petunjuk: nyalakan MariaDB dan set DATABASE_URL (lihat README bab 17-18).")
		os.Exit(1)
	}
	defer db.Close()

	store := &TaskStore{db: db}
	if err := store.BuatTabel(); err != nil {
		fmt.Println("error:", err)
		os.Exit(1)
	}

	app := NewApp(db)
	log.Fatal(app.Listen(":" + cfg.Port))
}

18-proyek-akhir-task-api/contoh/api_test.go

package main

import (
	"database/sql"
	"encoding/json"
	"net/http/httptest"
	"os"
	"strings"
	"testing"

	_ "github.com/go-sql-driver/mysql"
	"github.com/gofiber/fiber/v2"
)

func bukaDBTest(t *testing.T) *sql.DB {
	t.Helper()
	url := os.Getenv("TEST_DATABASE_URL")
	if url == "" {
		t.Skip("TEST_DATABASE_URL tidak diset; lewati test database (lihat bab 17 untuk setup)")
	}
	db, err := bukaDB(url)
	if err != nil {
		t.Fatalf("buka db test: %v", err)
	}
	t.Cleanup(func() { db.Close() })

	store := &TaskStore{db: db}
	if err := store.BuatTabel(); err != nil {
		t.Fatalf("buat tabel: %v", err)
	}
	if _, err := db.Exec("TRUNCATE tasks"); err != nil {
		t.Fatalf("bersihkan tabel: %v", err)
	}
	return db
}

func TestHealth(t *testing.T) {
	app := NewApp(nil)
	req := httptest.NewRequest(fiber.MethodGet, "/health", nil)
	resp, err := app.Test(req)
	if err != nil {
		t.Fatal(err)
	}
	if resp.StatusCode != fiber.StatusOK {
		t.Fatalf("ingin 200, dapat %d", resp.StatusCode)
	}
}

func TestAlurCRUD(t *testing.T) {
	db := bukaDBTest(t)
	app := NewApp(db)

	// POST: buat.
	req := httptest.NewRequest(fiber.MethodPost, "/tasks",
		strings.NewReader(`{"title":"Belajar Fiber"}`))
	req.Header.Set("Content-Type", "application/json")
	resp, err := app.Test(req)
	if err != nil {
		t.Fatal(err)
	}
	if resp.StatusCode != fiber.StatusCreated {
		t.Fatalf("POST ingin 201, dapat %d", resp.StatusCode)
	}
	var dibuat Task
	if err := json.NewDecoder(resp.Body).Decode(&dibuat); err != nil {
		t.Fatal(err)
	}

	// GET daftar.
	req = httptest.NewRequest(fiber.MethodGet, "/tasks", nil)
	resp, err = app.Test(req)
	if err != nil {
		t.Fatal(err)
	}
	if resp.StatusCode != fiber.StatusOK {
		t.Fatalf("GET ingin 200, dapat %d", resp.StatusCode)
	}
	var daftar []Task
	if err := json.NewDecoder(resp.Body).Decode(&daftar); err != nil {
		t.Fatal(err)
	}
	if len(daftar) != 1 || daftar[0].Title != "Belajar Fiber" {
		t.Fatalf("daftar tidak sesuai: %+v", daftar)
	}

	// PUT ubah.
	req = httptest.NewRequest(fiber.MethodPut, "/tasks/1",
		strings.NewReader(`{"title":"Belajar gRPC","completed":true}`))
	req.Header.Set("Content-Type", "application/json")
	resp, err = app.Test(req)
	if err != nil {
		t.Fatal(err)
	}
	if resp.StatusCode != fiber.StatusOK {
		t.Fatalf("PUT ingin 200, dapat %d", resp.StatusCode)
	}

	// DELETE hapus.
	req = httptest.NewRequest(fiber.MethodDelete, "/tasks/1", nil)
	resp, err = app.Test(req)
	if err != nil {
		t.Fatal(err)
	}
	if resp.StatusCode != fiber.StatusNoContent {
		t.Fatalf("DELETE ingin 204, dapat %d", resp.StatusCode)
	}
}

func TestJudulKosongDitolak(t *testing.T) {
	app := NewApp(nil)
	req := httptest.NewRequest(fiber.MethodPost, "/tasks",
		strings.NewReader(`{"title":"   "}`))
	req.Header.Set("Content-Type", "application/json")
	resp, err := app.Test(req)
	if err != nil {
		t.Fatal(err)
	}
	if resp.StatusCode != fiber.StatusBadRequest {
		t.Fatalf("ingin 400, dapat %d", resp.StatusCode)
	}
}

func TestTugasTidakAda(t *testing.T) {
	db := bukaDBTest(t)
	app := NewApp(db)

	for _, method := range []string{fiber.MethodGet, fiber.MethodDelete} {
		req := httptest.NewRequest(method, "/tasks/9999", nil)
		resp, err := app.Test(req)
		if err != nil {
			t.Fatal(err)
		}
		if resp.StatusCode != fiber.StatusNotFound {
			t.Fatalf("%s ingin 404, dapat %d", method, resp.StatusCode)
		}
	}
}

Tambahkan GET /tasks/ringkas yang membalas JSON {"total": n, "selesai": m}.

func (s *TaskStore) Ringkas() (total int, selesai int, err error) {
	row := s.db.QueryRow(
		"SELECT COUNT(*), COALESCE(SUM(completed), 0) FROM tasks")
	err = row.Scan(&total, &selesai)
	return
}

app.Get("/tasks/ringkas", func(c *fiber.Ctx) error {
	total, selesai, err := h.store.Ringkas()
	if err != nil {
		return c.Status(fiber.StatusInternalServerError).JSON(
			fiber.Map{"error": "gagal membaca"})
	}
	return c.JSON(fiber.Map{"total": total, "selesai": selesai})
})

Pastikan judul > 200 karakter ditolak 400; tulis test untuk kasus itu.

panjang := strings.Repeat("a", 201)
body := fmt.Sprintf(`{"title":%q}`, panjang)
req := httptest.NewRequest(fiber.MethodPost, "/tasks", strings.NewReader(body))
req.Header.Set("Content-Type", "application/json")
resp, _ := app.Test(req)
// resp.StatusCode == 400

Tulis test: GET dan DELETE ke id yang tidak ada membalas 404.

for _, method := range []string{fiber.MethodGet, fiber.MethodDelete} {
	req := httptest.NewRequest(method, "/tasks/9999", nil)
	resp, err := app.Test(req)
	if err != nil {
		t.Fatal(err)
	}
	if resp.StatusCode != fiber.StatusNotFound {
		t.Fatalf("%s ingin 404, dapat %d", method, resp.StatusCode)
	}
}

19-auth-tasks-api/contoh/go.mod

module bab19-auth-api

go 1.26.4

require (
	github.com/go-sql-driver/mysql v1.10.1
	github.com/gofiber/fiber/v2 v2.52.15
	golang.org/x/crypto v0.58.0
)

require (
	filippo.io/edwards25519 v1.2.0 // indirect
	github.com/andybalholm/brotli v1.1.0 // indirect
	github.com/google/uuid v1.6.0 // indirect
	github.com/klauspost/compress v1.17.9 // indirect
	github.com/mattn/go-colorable v0.1.13 // indirect
	github.com/mattn/go-isatty v0.0.20 // indirect
	github.com/mattn/go-runewidth v0.0.16 // indirect
	github.com/rivo/uniseg v0.2.0 // indirect
	github.com/valyala/bytebufferpool v1.0.0 // indirect
	github.com/valyala/fasthttp v1.51.0 // indirect
	github.com/valyala/tcplisten v1.0.0 // indirect
	golang.org/x/sys v0.49.0 // indirect
)

19-auth-tasks-api/contoh/.env.example

# Salin file ini menjadi .env atau set lewat `export` di terminal.
# GANTI sandinya dengan milikmu. Jangan pernah commit sandi asli.

# URL koneksi MariaDB untuk server API.
DATABASE_URL=task_app:ganti-dengan-sandi-kuat@tcp(127.0.0.1:3306)/belajar_go?parseTime=true

# Database TERPISAH untuk integration test (dipakai oleh go test).
TEST_DATABASE_URL=task_app:ganti-dengan-sandi-kuat@tcp(127.0.0.1:3306)/belajar_go_test?parseTime=true&multiStatements=true

# Port server (opsional, bawaan 3000).
PORT=3000

19-auth-tasks-api/contoh/config.go

package main

import (
	"os"
)

type Config struct {
	DatabaseURL string
	Port        string
}

func muatConfig() Config {
	port := os.Getenv("PORT")
	if port == "" {
		port = "3000"
	}
	url := os.Getenv("DATABASE_URL")
	if url == "" {
		url = "task_app:ganti-dengan-sandi-kuat@tcp(127.0.0.1:3306)/belajar_go?parseTime=true"
	}
	return Config{DatabaseURL: url, Port: port}
}

19-auth-tasks-api/contoh/models.go

package main

import (
	"strings"
)

type User struct {
	ID           int64  `json:"id"`
	Username     string `json:"username"`
	PasswordHash string `json:"-"`
}

type RegisterInput struct {
	Username string `json:"username"`
	Password string `json:"password"`
}

type LoginInput struct {
	Username string `json:"username"`
	Password string `json:"password"`
}

type Task struct {
	ID        int64  `json:"id"`
	Title     string `json:"title"`
	Completed bool   `json:"completed"`
}

type NewTask struct {
	Title string `json:"title"`
}

type UpdateTask struct {
	Title     string `json:"title"`
	Completed bool   `json:"completed"`
}

func validasiUsername(username string) (string, bool) {
	username = strings.TrimSpace(username)
	if len(username) < 3 || len(username) > 50 {
		return "", false
	}
	return username, true
}

func validasiPassword(password string) bool {
	return len(password) >= 8
}

func validasiJudul(judul string) (string, bool) {
	judul = strings.TrimSpace(judul)
	if judul == "" || len([]rune(judul)) > 200 {
		return "", false
	}
	return judul, true
}

19-auth-tasks-api/contoh/auth.go

package main

import (
	"crypto/rand"
	"encoding/hex"
	"errors"
	"time"

	"golang.org/x/crypto/bcrypt"
)

var ErrLoginSalah = errors.New("username atau password salah")

const sessionDurasi = 7 * 24 * time.Hour

func hashPassword(pw string) (string, error) {
	b, err := bcrypt.GenerateFromPassword([]byte(pw), bcrypt.DefaultCost)
	if err != nil {
		return "", err
	}
	return string(b), nil
}

func verifyPassword(pw, hash string) bool {
	return bcrypt.CompareHashAndPassword([]byte(hash), []byte(pw)) == nil
}

func buatToken() string {
	b := make([]byte, 32)
	if _, err := rand.Read(b); err != nil {
		panic("crypto/rand gagal: " + err.Error())
	}
	return hex.EncodeToString(b)
}

19-auth-tasks-api/contoh/store.go

package main

import (
	"database/sql"
	"fmt"
	"time"
)

type Store struct {
	db *sql.DB
}

const skema = `
CREATE TABLE IF NOT EXISTS users (
    id BIGINT AUTO_INCREMENT PRIMARY KEY,
    username VARCHAR(50) NOT NULL UNIQUE,
    password_hash VARCHAR(255) NOT NULL
) CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci;

CREATE TABLE IF NOT EXISTS sessions (
    token CHAR(64) PRIMARY KEY,
    user_id BIGINT NOT NULL,
    expires_at DATETIME NOT NULL
) CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci;

CREATE TABLE IF NOT EXISTS tasks (
    id BIGINT AUTO_INCREMENT PRIMARY KEY,
    user_id BIGINT NOT NULL,
    title VARCHAR(200) NOT NULL,
    completed BOOLEAN NOT NULL DEFAULT FALSE
) CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci;`

func (s *Store) BuatTabel() error {
	if _, err := s.db.Exec(skema); err != nil {
		return fmt.Errorf("buat tabel: %w", err)
	}
	return nil
}

// ---- users ----

func (s *Store) Register(username, passwordHash string) (User, error) {
	res, err := s.db.Exec(
		"INSERT INTO users (username, password_hash) VALUES (?, ?)",
		username, passwordHash)
	if err != nil {
		return User{}, err
	}
	id, err := res.LastInsertId()
	if err != nil {
		return User{}, err
	}
	return User{ID: id, Username: username}, nil
}

func (s *Store) Login(username, password string) (string, error) {
	var user User
	err := s.db.QueryRow(
		"SELECT id, password_hash FROM users WHERE username = ?", username,
	).Scan(&user.ID, &user.PasswordHash)
	if err == sql.ErrNoRows {
		return "", ErrLoginSalah
	}
	if err != nil {
		return "", err
	}
	if !verifyPassword(password, user.PasswordHash) {
		return "", ErrLoginSalah
	}
	token := buatToken()
	expires := time.Now().Add(sessionDurasi)
	_, err = s.db.Exec(
		"INSERT INTO sessions (token, user_id, expires_at) VALUES (?, ?, ?)",
		token, user.ID, expires)
	if err != nil {
		return "", err
	}
	return token, nil
}

func (s *Store) Logout(token string) error {
	_, err := s.db.Exec("DELETE FROM sessions WHERE token = ?", token)
	return err
}

func (s *Store) UserDariToken(token string) (User, error) {
	var user User
	err := s.db.QueryRow(
		`SELECT u.id, u.username, u.password_hash
		 FROM sessions se JOIN users u ON u.id = se.user_id
		 WHERE se.token = ? AND se.expires_at > NOW()`, token,
	).Scan(&user.ID, &user.Username, &user.PasswordHash)
	return user, err
}

// ---- tasks (per user) ----

func (s *Store) TambahTask(userID int64, judul string) (Task, error) {
	res, err := s.db.Exec(
		"INSERT INTO tasks (user_id, title) VALUES (?, ?)", userID, judul)
	if err != nil {
		return Task{}, err
	}
	id, err := res.LastInsertId()
	if err != nil {
		return Task{}, err
	}
	return Task{ID: id, Title: judul}, nil
}

func (s *Store) SemuaTasks(userID int64) ([]Task, error) {
	rows, err := s.db.Query(
		"SELECT id, title, completed FROM tasks WHERE user_id = ? ORDER BY id",
		userID)
	if err != nil {
		return nil, err
	}
	defer rows.Close()

	var daftar []Task
	for rows.Next() {
		var t Task
		if err := rows.Scan(&t.ID, &t.Title, &t.Completed); err != nil {
			return nil, err
		}
		daftar = append(daftar, t)
	}
	return daftar, rows.Err()
}

func (s *Store) CariTask(userID, id int64) (Task, error) {
	var t Task
	err := s.db.QueryRow(
		"SELECT id, title, completed FROM tasks WHERE user_id = ? AND id = ?",
		userID, id,
	).Scan(&t.ID, &t.Title, &t.Completed)
	return t, err
}

func (s *Store) UbahTask(userID, id int64, input UpdateTask) (Task, error) {
	res, err := s.db.Exec(
		"UPDATE tasks SET title = ?, completed = ? WHERE user_id = ? AND id = ?",
		input.Title, input.Completed, userID, id)
	if err != nil {
		return Task{}, err
	}
	if n, _ := res.RowsAffected(); n == 0 {
		return Task{}, sql.ErrNoRows
	}
	return Task{ID: id, Title: input.Title, Completed: input.Completed}, nil
}

func (s *Store) HapusTask(userID, id int64) error {
	res, err := s.db.Exec(
		"DELETE FROM tasks WHERE user_id = ? AND id = ?", userID, id)
	if err != nil {
		return err
	}
	if n, _ := res.RowsAffected(); n == 0 {
		return sql.ErrNoRows
	}
	return nil
}

19-auth-tasks-api/contoh/handlers.go

package main

import (
	"database/sql"
	"errors"
	"strconv"
	"strings"

	"github.com/gofiber/fiber/v2"
)

type Handlers struct {
	store *Store
}

func (h *Handlers) Register(c *fiber.Ctx) error {
	var input RegisterInput
	if err := c.BodyParser(&input); err != nil {
		return c.Status(fiber.StatusBadRequest).JSON(fiber.Map{
			"error": "body json tidak valid"})
	}
	username, ok := validasiUsername(input.Username)
	if !ok {
		return c.Status(fiber.StatusBadRequest).JSON(fiber.Map{
			"error": "username 3-50 karakter"})
	}
	if !validasiPassword(input.Password) {
		return c.Status(fiber.StatusBadRequest).JSON(fiber.Map{
			"error": "password minimal 8 karakter"})
	}
	hash, err := hashPassword(input.Password)
	if err != nil {
		return c.Status(fiber.StatusInternalServerError).JSON(fiber.Map{
			"error": "gagal memproses password"})
	}
	user, err := h.store.Register(username, hash)
	if err != nil {
		if strings.Contains(err.Error(), "Duplicate entry") {
			return c.Status(fiber.StatusConflict).JSON(fiber.Map{
				"error": "username sudah dipakai"})
		}
		return c.Status(fiber.StatusInternalServerError).JSON(fiber.Map{
			"error": "gagal mendaftar"})
	}
	return c.Status(fiber.StatusCreated).JSON(user)
}

func (h *Handlers) Login(c *fiber.Ctx) error {
	var input LoginInput
	if err := c.BodyParser(&input); err != nil {
		return c.Status(fiber.StatusBadRequest).JSON(fiber.Map{
			"error": "body json tidak valid"})
	}
	token, err := h.store.Login(strings.TrimSpace(input.Username), input.Password)
	if errors.Is(err, ErrLoginSalah) {
		return c.Status(fiber.StatusUnauthorized).JSON(fiber.Map{
			"error": "username atau password salah"})
	}
	if err != nil {
		return c.Status(fiber.StatusInternalServerError).JSON(fiber.Map{
			"error": "gagal login"})
	}
	return c.JSON(fiber.Map{"token": token})
}

func (h *Handlers) Logout(c *fiber.Ctx) error {
	token := tokenDariHeader(c)
	if err := h.store.Logout(token); err != nil {
		return c.Status(fiber.StatusInternalServerError).JSON(fiber.Map{
			"error": "gagal logout"})
	}
	return c.SendStatus(fiber.StatusNoContent)
}

func (h *Handlers) Me(c *fiber.Ctx) error {
	user := c.Locals("user").(User)
	return c.JSON(fiber.Map{"id": user.ID, "username": user.Username})
}

func tokenDariHeader(c *fiber.Ctx) string {
	auth := c.Get("Authorization")
	token, _ := strings.CutPrefix(auth, "Bearer ")
	return strings.TrimSpace(token)
}

func (h *Handlers) WajibLogin(c *fiber.Ctx) error {
	token := tokenDariHeader(c)
	if token == "" {
		return c.Status(fiber.StatusUnauthorized).JSON(fiber.Map{
			"error": "belum login"})
	}
	user, err := h.store.UserDariToken(token)
	if err == sql.ErrNoRows {
		return c.Status(fiber.StatusUnauthorized).JSON(fiber.Map{
			"error": "token tidak valid atau kedaluwarsa"})
	}
	if err != nil {
		return c.Status(fiber.StatusInternalServerError).JSON(fiber.Map{
			"error": "gagal memeriksa session"})
	}
	c.Locals("user", user)
	return c.Next()
}

func userDariCtx(c *fiber.Ctx) User {
	return c.Locals("user").(User)
}

func idDariParams(c *fiber.Ctx) (int64, error) {
	return strconv.ParseInt(c.Params("id"), 10, 64)
}

// ---- tasks ----

func (h *Handlers) DaftarTasks(c *fiber.Ctx) error {
	user := userDariCtx(c)
	daftar, err := h.store.SemuaTasks(user.ID)
	if err != nil {
		return c.Status(fiber.StatusInternalServerError).JSON(fiber.Map{
			"error": "gagal membaca"})
	}
	return c.JSON(daftar)
}

func (h *Handlers) BuatTask(c *fiber.Ctx) error {
	user := userDariCtx(c)
	var input NewTask
	if err := c.BodyParser(&input); err != nil {
		return c.Status(fiber.StatusBadRequest).JSON(fiber.Map{
			"error": "body json tidak valid"})
	}
	judul, ok := validasiJudul(input.Title)
	if !ok {
		return c.Status(fiber.StatusBadRequest).JSON(fiber.Map{
			"error": "title wajib diisi, maksimal 200 karakter"})
	}
	tugas, err := h.store.TambahTask(user.ID, judul)
	if err != nil {
		return c.Status(fiber.StatusInternalServerError).JSON(fiber.Map{
			"error": "gagal menyimpan"})
	}
	return c.Status(fiber.StatusCreated).JSON(tugas)
}

func (h *Handlers) SatuTask(c *fiber.Ctx) error {
	user := userDariCtx(c)
	id, err := idDariParams(c)
	if err != nil || id < 1 {
		return c.Status(fiber.StatusBadRequest).JSON(fiber.Map{
			"error": "id tidak valid"})
	}
	tugas, err := h.store.CariTask(user.ID, id)
	if err == sql.ErrNoRows {
		return c.Status(fiber.StatusNotFound).JSON(fiber.Map{
			"error": "tugas tidak ditemukan"})
	}
	if err != nil {
		return c.Status(fiber.StatusInternalServerError).JSON(fiber.Map{
			"error": "gagal membaca"})
	}
	return c.JSON(tugas)
}

func (h *Handlers) UbahTask(c *fiber.Ctx) error {
	user := userDariCtx(c)
	id, err := idDariParams(c)
	if err != nil || id < 1 {
		return c.Status(fiber.StatusBadRequest).JSON(fiber.Map{
			"error": "id tidak valid"})
	}
	var input UpdateTask
	if err := c.BodyParser(&input); err != nil {
		return c.Status(fiber.StatusBadRequest).JSON(fiber.Map{
			"error": "body json tidak valid"})
	}
	judul, ok := validasiJudul(input.Title)
	if !ok {
		return c.Status(fiber.StatusBadRequest).JSON(fiber.Map{
			"error": "title wajib diisi, maksimal 200 karakter"})
	}
	input.Title = judul
	tugas, err := h.store.UbahTask(user.ID, id, input)
	if err == sql.ErrNoRows {
		return c.Status(fiber.StatusNotFound).JSON(fiber.Map{
			"error": "tugas tidak ditemukan"})
	}
	if err != nil {
		return c.Status(fiber.StatusInternalServerError).JSON(fiber.Map{
			"error": "gagal mengubah"})
	}
	return c.JSON(tugas)
}

func (h *Handlers) HapusTask(c *fiber.Ctx) error {
	user := userDariCtx(c)
	id, err := idDariParams(c)
	if err != nil || id < 1 {
		return c.Status(fiber.StatusBadRequest).JSON(fiber.Map{
			"error": "id tidak valid"})
	}
	err = h.store.HapusTask(user.ID, id)
	if err == sql.ErrNoRows {
		return c.Status(fiber.StatusNotFound).JSON(fiber.Map{
			"error": "tugas tidak ditemukan"})
	}
	if err != nil {
		return c.Status(fiber.StatusInternalServerError).JSON(fiber.Map{
			"error": "gagal menghapus"})
	}
	return c.SendStatus(fiber.StatusNoContent)
}

19-auth-tasks-api/contoh/app.go

package main

import (
	"database/sql"

	"github.com/gofiber/fiber/v2"
)

func NewApp(db *sql.DB) *fiber.App {
	app := fiber.New()
	store := &Store{db: db}
	h := &Handlers{store: store}

	app.Get("/health", func(c *fiber.Ctx) error {
		return c.JSON(fiber.Map{"status": "ok"})
	})

	app.Post("/auth/register", h.Register)
	app.Post("/auth/login", h.Login)

	perluLogin := app.Group("", h.WajibLogin)
	perluLogin.Post("/auth/logout", h.Logout)
	perluLogin.Get("/auth/me", h.Me)

	perluLogin.Get("/tasks", h.DaftarTasks)
	perluLogin.Post("/tasks", h.BuatTask)
	perluLogin.Get("/tasks/:id", h.SatuTask)
	perluLogin.Put("/tasks/:id", h.UbahTask)
	perluLogin.Delete("/tasks/:id", h.HapusTask)
	return app
}

19-auth-tasks-api/contoh/main.go

package main

import (
	"database/sql"
	"fmt"
	"log"
	"os"

	_ "github.com/go-sql-driver/mysql"
)

func bukaDB(url string) (*sql.DB, error) {
	db, err := sql.Open("mysql", url)
	if err != nil {
		return nil, fmt.Errorf("buka db: %w", err)
	}
	if err := db.Ping(); err != nil {
		db.Close()
		return nil, fmt.Errorf("ping db: %w", err)
	}
	return db, nil
}

func main() {
	cfg := muatConfig()

	db, err := bukaDB(cfg.DatabaseURL)
	if err != nil {
		fmt.Println("error:", err)
		fmt.Println("Petunjuk: nyalakan MariaDB dan set DATABASE_URL (lihat README bab 17).")
		os.Exit(1)
	}
	defer db.Close()

	store := &Store{db: db}
	if err := store.BuatTabel(); err != nil {
		fmt.Println("error:", err)
		os.Exit(1)
	}

	app := NewApp(db)
	log.Fatal(app.Listen(":" + cfg.Port))
}

19-auth-tasks-api/contoh/api_test.go

package main

import (
	"database/sql"
	"encoding/json"
	"fmt"
	"net/http/httptest"
	"os"
	"strings"
	"testing"

	_ "github.com/go-sql-driver/mysql"
	"github.com/gofiber/fiber/v2"
)

func bukaDBTest(t *testing.T) *sql.DB {
	t.Helper()
	url := os.Getenv("TEST_DATABASE_URL")
	if url == "" {
		t.Skip("TEST_DATABASE_URL tidak diset; lewati test database (lihat bab 17 untuk setup)")
	}
	db, err := bukaDB(url)
	if err != nil {
		t.Fatalf("buka db test: %v", err)
	}
	t.Cleanup(func() { db.Close() })

	store := &Store{db: db}
	if err := store.BuatTabel(); err != nil {
		t.Fatalf("buat tabel: %v", err)
	}
	for _, tabel := range []string{"tasks", "sessions", "users"} {
		if _, err := db.Exec("TRUNCATE " + tabel); err != nil {
			t.Fatalf("bersihkan %s: %v", tabel, err)
		}
	}
	return db
}

func registerDanLogin(t *testing.T, app *fiber.App, username string) string {
	t.Helper()

	body := fmt.Sprintf(`{"username":%q,"password":"rahasia123"}`, username)
	req := httptest.NewRequest(fiber.MethodPost, "/auth/register",
		strings.NewReader(body))
	req.Header.Set("Content-Type", "application/json")
	resp, err := app.Test(req)
	if err != nil {
		t.Fatal(err)
	}
	if resp.StatusCode != fiber.StatusCreated {
		t.Fatalf("register ingin 201, dapat %d", resp.StatusCode)
	}

	req = httptest.NewRequest(fiber.MethodPost, "/auth/login",
		strings.NewReader(body))
	req.Header.Set("Content-Type", "application/json")
	resp, err = app.Test(req)
	if err != nil {
		t.Fatal(err)
	}
	if resp.StatusCode != fiber.StatusOK {
		t.Fatalf("login ingin 200, dapat %d", resp.StatusCode)
	}
	var hasil struct {
		Token string `json:"token"`
	}
	if err := json.NewDecoder(resp.Body).Decode(&hasil); err != nil {
		t.Fatal(err)
	}
	return hasil.Token
}

func TestTanpaTokenDitolak(t *testing.T) {
	db := bukaDBTest(t)
	app := NewApp(db)

	req := httptest.NewRequest(fiber.MethodGet, "/tasks", nil)
	resp, err := app.Test(req)
	if err != nil {
		t.Fatal(err)
	}
	if resp.StatusCode != fiber.StatusUnauthorized {
		t.Fatalf("ingin 401, dapat %d", resp.StatusCode)
	}
}

func TestLoginSalahDitolak(t *testing.T) {
	db := bukaDBTest(t)
	app := NewApp(db)

	req := httptest.NewRequest(fiber.MethodPost, "/auth/login",
		strings.NewReader(`{"username":"tidakada","password":"apapun"}`))
	req.Header.Set("Content-Type", "application/json")
	resp, err := app.Test(req)
	if err != nil {
		t.Fatal(err)
	}
	if resp.StatusCode != fiber.StatusUnauthorized {
		t.Fatalf("ingin 401, dapat %d", resp.StatusCode)
	}
}

func TestAlurTugasPerUser(t *testing.T) {
	db := bukaDBTest(t)
	app := NewApp(db)

	tokenRani := registerDanLogin(t, app, "rani")
	tokenBudi := registerDanLogin(t, app, "budi")

	// Rani membuat task.
	req := httptest.NewRequest(fiber.MethodPost, "/tasks",
		strings.NewReader(`{"title":"Milik Rani"}`))
	req.Header.Set("Content-Type", "application/json")
	req.Header.Set("Authorization", "Bearer "+tokenRani)
	resp, err := app.Test(req)
	if err != nil {
		t.Fatal(err)
	}
	if resp.StatusCode != fiber.StatusCreated {
		t.Fatalf("buat ingin 201, dapat %d", resp.StatusCode)
	}
	var dibuat Task
	if err := json.NewDecoder(resp.Body).Decode(&dibuat); err != nil {
		t.Fatal(err)
	}

	// Rani melihat task-nya.
	req = httptest.NewRequest(fiber.MethodGet, "/tasks", nil)
	req.Header.Set("Authorization", "Bearer "+tokenRani)
	resp, err = app.Test(req)
	if err != nil {
		t.Fatal(err)
	}
	var daftarRani []Task
	if err := json.NewDecoder(resp.Body).Decode(&daftarRani); err != nil {
		t.Fatal(err)
	}
	if len(daftarRani) != 1 || daftarRani[0].Title != "Milik Rani" {
		t.Fatalf("daftar Rani tidak sesuai: %+v", daftarRani)
	}

	// Budi tidak melihat task Rani: daftar kosong.
	req = httptest.NewRequest(fiber.MethodGet, "/tasks", nil)
	req.Header.Set("Authorization", "Bearer "+tokenBudi)
	resp, err = app.Test(req)
	if err != nil {
		t.Fatal(err)
	}
	var daftarBudi []Task
	if err := json.NewDecoder(resp.Body).Decode(&daftarBudi); err != nil {
		t.Fatal(err)
	}
	if len(daftarBudi) != 0 {
		t.Fatalf("daftar Budi seharusnya kosong: %+v", daftarBudi)
	}

	// Budi akses task Rani -> 404 (disembunyikan).
	req = httptest.NewRequest(fiber.MethodGet, fmt.Sprintf("/tasks/%d", dibuat.ID), nil)
	req.Header.Set("Authorization", "Bearer "+tokenBudi)
	resp, err = app.Test(req)
	if err != nil {
		t.Fatal(err)
	}
	if resp.StatusCode != fiber.StatusNotFound {
		t.Fatalf("ingin 404, dapat %d", resp.StatusCode)
	}

	// Logout: token mati.
	req = httptest.NewRequest(fiber.MethodPost, "/auth/logout", nil)
	req.Header.Set("Authorization", "Bearer "+tokenRani)
	resp, err = app.Test(req)
	if err != nil {
		t.Fatal(err)
	}
	if resp.StatusCode != fiber.StatusNoContent {
		t.Fatalf("logout ingin 204, dapat %d", resp.StatusCode)
	}

	req = httptest.NewRequest(fiber.MethodGet, "/auth/me", nil)
	req.Header.Set("Authorization", "Bearer "+tokenRani)
	resp, err = app.Test(req)
	if err != nil {
		t.Fatal(err)
	}
	if resp.StatusCode != fiber.StatusUnauthorized {
		t.Fatalf("setelah logout ingin 401, dapat %d", resp.StatusCode)
	}
}

Jelaskan dengan kalimatmu sendiri: kenapa kita tidak menyimpan password apa adanya di database? Apa yang terjadi kalau database bocor?

Urutkan langkah berikut dengan benar: (a) buat token, (b) verifikasi password, (c) cari user by username, (d) simpan session di DB, (e) kirim token ke klien.

Kapan server membalas 401 dan kapan 404 untuk task yang tidak bisa diakses? Mengapa task orang lain dibalas 404, bukan 403?

20-template-engine/contoh/go.mod

module bab20-template

go 1.26

require github.com/gofiber/fiber/v2 v2.52.10

require (
	github.com/andybalholm/brotli v1.1.1 // indirect
	github.com/google/uuid v1.6.0 // indirect
	github.com/klauspost/compress v1.17.11 // indirect
	github.com/mattn/go-colorable v0.1.14 // indirect
	github.com/mattn/go-isatty v0.0.20 // indirect
	github.com/mattn/go-runewidth v0.0.16 // indirect
	github.com/rivo/uniseg v0.2.0 // indirect
	github.com/valyala/bytebufferpool v1.0.0 // indirect
	github.com/valyala/fasthttp v1.51.0 // indirect
	github.com/valyala/tcplisten v1.0.0 // indirect
	golang.org/x/sys v0.29.0 // indirect
)

20-template-engine/contoh/main.go

package main

import (
	"html/template"
	"log"

	"github.com/gofiber/fiber/v2"
)

type Task struct {
	Title     string
	Completed bool
}

type Halaman struct {
	JudulHalaman string
	Tugas        []Task
}

var layout = template.Must(template.ParseFiles(
	"templates/layout.html",
	"templates/daftar.html",
	"templates/sapa.html",
))

func main() {
	app := fiber.New()

	app.Get("/", func(c *fiber.Ctx) error {
		data := Halaman{
			JudulHalaman: "Daftar tugas",
			Tugas: []Task{
				{Title: "Belajar template", Completed: true},
				{Title: "Belajar HTMX", Completed: false},
			},
		}
		c.Type("html")
		return layout.ExecuteTemplate(c.Response().BodyWriter(), "layout", data)
	})

	app.Get("/sapa/:nama", func(c *fiber.Ctx) error {
		data := struct{ Nama string }{Nama: c.Params("nama")}
		c.Type("html")
		return layout.ExecuteTemplate(c.Response().BodyWriter(), "sapa", data)
	})

	log.Fatal(app.Listen(":3000"))
}

20-template-engine/contoh/templates/layout.html

{{define "layout"}}
<!doctype html>
<html lang="id">
<head>
<meta charset="utf-8">
<title>{{.JudulHalaman}}</title>
<style>
body{font-family:system-ui,sans-serif;max-width:640px;margin:2rem auto;padding:0 1rem}
header{border-bottom:2px solid #00add8;padding-bottom:.5rem}
li{margin:.4rem 0}
</style>
</head>
<body>
<header><strong>Task Manager</strong></header>
<main>{{template "isi" .}}</main>
<footer><small>Belajar Go · bab 20</small></footer>
</body>
</html>
{{end}}

20-template-engine/contoh/templates/daftar.html

{{define "isi"}}
<h1>{{.JudulHalaman}}</h1>
{{if .Tugas}}
<ul>
{{range .Tugas}}
<li>{{.Title}} — {{if .Completed}}selesai{{else}}belum{{end}}</li>
{{end}}
</ul>
{{else}}
<p>Belum ada tugas.</p>
{{end}}
{{end}}

20-template-engine/contoh/templates/sapa.html

{{define "sapa"}}
<h1>Halo, {{.Nama}}!</h1>
<p>Ini halaman sapa — perhatikan tidak ada XSS di sini.</p>
{{end}}

Buat template sapa.html yang menampilkan Halo, {{.Nama}}!, lalu render dengan data Nama: "Rani".

<!-- templates/sapa.html -->
<h1>Halo, {{.Nama}}!</h1>

tmpl := template.Must(template.ParseFiles("templates/sapa.html"))
tmpl.Execute(w, struct{ Nama string }{"Rani"})

Buat layout.html (header+footer) dan daftar.html sebagai partial isi. Render daftar tugas melalui layout.

<!-- templates/layout.html -->
{{define "layout"}}
<!doctype html><html><body>
<header>Task Manager</header>
<main>{{template "isi" .}}</main>
</body></html>
{{end}}

<!-- templates/daftar.html -->
{{define "isi"}}
<ul>{{range .}}<li>{{.Title}}</li>{{end}}</ul>
{{end}}

t := template.Must(template.ParseFiles("templates/layout.html", "templates/daftar.html"))
t.ExecuteTemplate(w, "layout", daftarTugas)

Kirim data berisi <script> ke template dan lihat output-nya. Jelaskan kenapa output-nya aman.

tmpl.Execute(w, struct{ Nama string }{`<script>alert("x")</script>`})

21-htmx/contoh/go.mod

module bab21-htmx

go 1.26.4

require (
	github.com/a-h/templ v0.3.1070
	github.com/gofiber/fiber/v2 v2.52.15
)

require (
	github.com/andybalholm/brotli v1.2.6 // indirect
	github.com/google/uuid v1.6.0 // indirect
	github.com/klauspost/compress v1.17.9 // indirect
	github.com/mattn/go-colorable v0.1.15 // indirect
	github.com/mattn/go-isatty v0.0.24 // indirect
	github.com/mattn/go-runewidth v0.0.16 // indirect
	github.com/rivo/uniseg v0.2.0 // indirect
	github.com/valyala/bytebufferpool v1.0.0 // indirect
	github.com/valyala/fasthttp v1.51.0 // indirect
	github.com/valyala/tcplisten v1.0.0 // indirect
	golang.org/x/sys v0.48.0 // indirect
)

21-htmx/contoh/model/model.go

package model

type Task struct {
	ID        int64
	Title     string
	Completed bool
}

21-htmx/contoh/components/layout.templ

package components

import "fmt"
import "bab21-htmx/model"

templ Layout(tugas []model.Task) {
	<!doctype html>
	<html lang="id">
		<head>
			<meta charset="utf-8"/>
			<meta name="viewport" content="width=device-width,initial-scale=1"/>
			<title>Task Manager</title>
			<script src="https://unpkg.com/htmx.org@1.9.12"></script>
			<style>
				body { font-family: system-ui, sans-serif; max-width: 640px; margin: 2rem auto; padding: 0 1rem; }
				li { margin: .4rem 0; display: flex; gap: .5rem; align-items: center; }
				.selesai { text-decoration: line-through; color: #666; }
				button { cursor: pointer; }
			</style>
		</head>
		<body>
			<h1>Task Manager</h1>
			<form hx-post="/tasks" hx-target="#daftar" hx-swap="innerHTML" hx-on::after-request="this.reset()">
				<input type="text" name="title" required="true"/>
				<button type="submit">Tambah</button>
			</form>
			@Daftar(tugas)
		</body>
	</html>
}

templ Daftar(tugas []model.Task) {
	<ul id="daftar">
		for _, t := range tugas {
			@Item(t)
		}
	</ul>
}

templ Item(t model.Task) {
	<li id={ fmt.Sprintf("tugas-%d", t.ID) }>
		if t.Completed {
			<span class="selesai">{ t.Title }</span>
		} else {
			<span>{ t.Title }</span>
		}
		<button hx-post={ fmt.Sprintf("/tasks/%d/toggle", t.ID) } hx-target={ fmt.Sprintf("#tugas-%d", t.ID) } hx-swap="outerHTML">✓</button>
		<button hx-delete={ fmt.Sprintf("/tasks/%d", t.ID) } hx-target="#daftar" hx-swap="innerHTML">Hapus</button>
	</li>
}

21-htmx/contoh/main.go

package main

import (
	"log"
	"strconv"
	"strings"
	"sync"

	"bab21-htmx/components"
	"bab21-htmx/model"

	"github.com/gofiber/fiber/v2"
)

type Store struct {
	mu    sync.Mutex
	tugas []model.Task
	next  int64
}

func (s *Store) Tambah(judul string) {
	s.mu.Lock()
	defer s.mu.Unlock()
	s.next++
	s.tugas = append(s.tugas, model.Task{ID: s.next, Title: judul})
}

func (s *Store) Semua() []model.Task {
	s.mu.Lock()
	defer s.mu.Unlock()
	hasil := make([]model.Task, len(s.tugas))
	copy(hasil, s.tugas)
	return hasil
}

func (s *Store) Toggle(id int64) (model.Task, bool) {
	s.mu.Lock()
	defer s.mu.Unlock()
	for i := range s.tugas {
		if s.tugas[i].ID == id {
			s.tugas[i].Completed = !s.tugas[i].Completed
			return s.tugas[i], true
		}
	}
	return model.Task{}, false
}

func (s *Store) Hapus(id int64) bool {
	s.mu.Lock()
	defer s.mu.Unlock()
	for i := range s.tugas {
		if s.tugas[i].ID == id {
			s.tugas = append(s.tugas[:i], s.tugas[i+1:]...)
			return true
		}
	}
	return false
}

func main() {
	store := &Store{}
	store.Tambah("Belajar HTMX")

	app := fiber.New()

	app.Get("/", func(c *fiber.Ctx) error {
		c.Type("html")
		return components.Layout(store.Semua()).Render(c.Context(), c.Response().BodyWriter())
	})

	app.Post("/tasks", func(c *fiber.Ctx) error {
		judul := strings.TrimSpace(c.FormValue("title"))
		if judul == "" {
			c.Status(fiber.StatusBadRequest)
			return c.SendString("judul wajib diisi")
		}
		store.Tambah(judul)
		c.Type("html")
		return components.Daftar(store.Semua()).Render(c.Context(), c.Response().BodyWriter())
	})

	app.Post("/tasks/:id/toggle", func(c *fiber.Ctx) error {
		id, err := strconv.ParseInt(c.Params("id"), 10, 64)
		if err != nil {
			return c.SendStatus(fiber.StatusBadRequest)
		}
		t, ok := store.Toggle(id)
		if !ok {
			return c.SendStatus(fiber.StatusNotFound)
		}
		c.Type("html")
		return components.Item(t).Render(c.Context(), c.Response().BodyWriter())
	})

	app.Delete("/tasks/:id", func(c *fiber.Ctx) error {
		id, err := strconv.ParseInt(c.Params("id"), 10, 64)
		if err != nil {
			return c.SendStatus(fiber.StatusBadRequest)
		}
		if !store.Hapus(id) {
			return c.SendStatus(fiber.StatusNotFound)
		}
		c.Type("html")
		return components.Daftar(store.Semua()).Render(c.Context(), c.Response().BodyWriter())
	})

	log.Fatal(app.Listen(":3000"))
}

Ceritakan alur lengkap: user mengetik judul lalu menekan Tambah. Bagian mana yang dikirim HTMX, apa yang dibalas server, dan apa yang terjadi di browser?

Tambahkan elemen id="jumlah" yang menampilkan banyaknya tugas. Pastikan jumlah ikut diperbarui saat tambah/hapus.

templ Jumlah(tugas []model.Task) {
	<span id="jumlah">{ fmt.Sprintf("%d tugas", len(tugas)) }</span>
}

// Handler POST/DELETE membalas dua partial:
// Daftar di #daftar, Jumlah di #jumlah — atau bungkus keduanya dalam satu
// partial <div> dengan target #konten.
app.Post("/tasks", func(c *fiber.Ctx) error {
	// ...
	var sb strings.Builder
	components.Daftar(store.Semua()).Render(c.Context(), &sb)
	components.Jumlah(store.Semua()).Render(c.Context(), &sb)
	return c.SendString(sb.String())
})

Setelah submit berhasil, input judul masih berisi teks lama. Gunakan atribut HTMX yang tepat agar input ter-reset setelah respons tiba.

<form hx-post="/tasks" hx-target="#daftar" hx-swap="innerHTML"
      hx-on::after-request="this.reset()">

22-auth-web/contoh/go.mod

module bab22-auth-web

go 1.26.4

require (
	github.com/a-h/templ v0.3.1070
	github.com/gofiber/fiber/v2 v2.52.15
	golang.org/x/crypto v0.58.0
)

require (
	github.com/andybalholm/brotli v1.2.6 // indirect
	github.com/google/uuid v1.6.0 // indirect
	github.com/klauspost/compress v1.17.9 // indirect
	github.com/mattn/go-colorable v0.1.15 // indirect
	github.com/mattn/go-isatty v0.0.24 // indirect
	github.com/mattn/go-runewidth v0.0.16 // indirect
	github.com/rivo/uniseg v0.2.0 // indirect
	github.com/valyala/bytebufferpool v1.0.0 // indirect
	github.com/valyala/fasthttp v1.51.0 // indirect
	github.com/valyala/tcplisten v1.0.0 // indirect
	golang.org/x/sys v0.49.0 // indirect
)

22-auth-web/contoh/model/model.go

package model

type User struct {
	ID       int64
	Username string
}

type Task struct {
	ID        int64
	Title     string
	Completed bool
}

22-auth-web/contoh/components/layout.templ

package components

import "fmt"
import "bab22-auth-web/model"

templ HalamanLogin(gagal bool) {
	<!doctype html>
	<html lang="id">
		<head>
			<meta charset="utf-8"/>
			<meta name="viewport" content="width=device-width,initial-scale=1"/>
			<title>Login — Task Manager</title>
			<style>
				body { font-family: system-ui, sans-serif; max-width: 420px; margin: 4rem auto; padding: 0 1rem; }
				label { display: block; margin: .6rem 0 .2rem; }
				input { width: 100%; padding: .45rem; box-sizing: border-box; }
				button { margin-top: 1rem; padding: .5rem 1.2rem; cursor: pointer; }
				.gagal { color: #b00020; }
			</style>
		</head>
		<body>
			<h1>Masuk</h1>
			if gagal {
				<p class="gagal">Username atau password salah.</p>
			}
			<form method="post" action="/login">
				<label for="username">Username</label>
				<input id="username" name="username" required="true"/>
				<label for="password">Password</label>
				<input id="password" name="password" type="password" required="true"/>
				<button type="submit">Masuk</button>
			</form>
		</body>
	</html>
}

templ Halaman(tugas []model.Task, csrf string) {
	<!doctype html>
	<html lang="id">
		<head>
			<meta charset="utf-8"/>
			<meta name="viewport" content="width=device-width,initial-scale=1"/>
			<title>Task Manager</title>
			<script src="https://unpkg.com/htmx.org@1.9.12"></script>
			<style>
				body { font-family: system-ui, sans-serif; max-width: 640px; margin: 2rem auto; padding: 0 1rem; }
				.topbar { display: flex; justify-content: space-between; align-items: center; }
				li { margin: .4rem 0; display: flex; gap: .5rem; align-items: center; }
				.selesai { text-decoration: line-through; color: #666; }
				button { cursor: pointer; }
			</style>
		</head>
		<body>
			<div class="topbar">
				<h1>Task Manager</h1>
				<form method="post" action="/logout"><button type="submit">Keluar</button></form>
			</div>
			<form hx-post="/tasks" hx-target="#daftar" hx-swap="innerHTML" hx-on::after-request="this.reset()">
				<input type="hidden" name="csrf" value={ csrf }/>
				<input type="text" name="title" required="true"/>
				<button type="submit">Tambah</button>
			</form>
			@Daftar(tugas, csrf)
		</body>
	</html>
}

templ Item(t model.Task, csrf string) {
	<li id={ fmt.Sprintf("tugas-%d", t.ID) }>
		if t.Completed {
			<span class="selesai">{ t.Title }</span>
		} else {
			<span>{ t.Title }</span>
		}
		<form hx-post={ fmt.Sprintf("/tasks/%d/toggle", t.ID) } hx-target={ fmt.Sprintf("#tugas-%d", t.ID) } hx-swap="outerHTML" style="display:inline">
			<input type="hidden" name="csrf" value={ csrf }/>
			<button type="submit">✓</button>
		</form>
		<form hx-delete={ fmt.Sprintf("/tasks/%d", t.ID) } hx-target="#daftar" hx-swap="innerHTML" style="display:inline">
			<input type="hidden" name="csrf" value={ csrf }/>
			<button type="submit">Hapus</button>
		</form>
	</li>
}

templ Daftar(tugas []model.Task, csrf string) {
	<ul id="daftar">
		for _, t := range tugas {
			@Item(t, csrf)
		}
	</ul>
}

22-auth-web/contoh/store.go

package main

import (
	"crypto/rand"
	"encoding/hex"
	"errors"
	"strconv"
	"strings"
	"sync"

	"bab22-auth-web/model"

	"golang.org/x/crypto/bcrypt"
)

var ErrLoginSalah = errors.New("username atau password salah")

type Store struct {
	mu       sync.Mutex
	users    map[string]model.User
	hash     map[string]string
	sessions map[string]int64  // token -> user id
	csrf     map[string]string // token -> csrf token
	tugas    map[int64][]model.Task
	nextTask int64
}

func NewStore() *Store {
	return &Store{
		users:    make(map[string]model.User),
		hash:     make(map[string]string),
		sessions: make(map[string]int64),
		csrf:     make(map[string]string),
		tugas:    make(map[int64][]model.Task),
	}
}

func (s *Store) Register(username, password string) error {
	s.mu.Lock()
	defer s.mu.Unlock()
	if _, ada := s.users[username]; ada {
		return errors.New("username sudah dipakai")
	}
	h, err := bcrypt.GenerateFromPassword([]byte(password), bcrypt.DefaultCost)
	if err != nil {
		return err
	}
	s.users[username] = model.User{ID: int64(len(s.users) + 1), Username: username}
	s.hash[username] = string(h)
	return nil
}

func (s *Store) Login(username, password string) (string, error) {
	s.mu.Lock()
	defer s.mu.Unlock()
	user, ada := s.users[username]
	if !ada {
		return "", ErrLoginSalah
	}
	if bcrypt.CompareHashAndPassword([]byte(s.hash[username]), []byte(password)) != nil {
		return "", ErrLoginSalah
	}
	token := buatToken()
	csrf := buatToken()
	s.sessions[token] = user.ID
	s.csrf[token] = csrf
	return token, nil
}

func (s *Store) Logout(token string) {
	s.mu.Lock()
	defer s.mu.Unlock()
	delete(s.sessions, token)
	delete(s.csrf, token)
}

func (s *Store) UserDariToken(token string) (model.User, error) {
	s.mu.Lock()
	defer s.mu.Unlock()
	id, ada := s.sessions[token]
	if !ada {
		return model.User{}, errors.New("session tidak valid")
	}
	for _, u := range s.users {
		if u.ID == id {
			return u, nil
		}
	}
	return model.User{}, errors.New("user tidak ada")
}

func (s *Store) CSRFUntuk(token string) string {
	s.mu.Lock()
	defer s.mu.Unlock()
	return s.csrf[token]
}

func (s *Store) TambahTask(userID int64, judul string) {
	s.mu.Lock()
	defer s.mu.Unlock()
	s.nextTask++
	s.tugas[userID] = append(s.tugas[userID], model.Task{ID: s.nextTask, Title: judul})
}

func (s *Store) SemuaTasks(userID int64) []model.Task {
	s.mu.Lock()
	defer s.mu.Unlock()
	hasil := make([]model.Task, len(s.tugas[userID]))
	copy(hasil, s.tugas[userID])
	return hasil
}

func (s *Store) ToggleTask(userID, id int64) (model.Task, bool) {
	s.mu.Lock()
	defer s.mu.Unlock()
	for i := range s.tugas[userID] {
		if s.tugas[userID][i].ID == id {
			s.tugas[userID][i].Completed = !s.tugas[userID][i].Completed
			return s.tugas[userID][i], true
		}
	}
	return model.Task{}, false
}

func (s *Store) HapusTask(userID, id int64) bool {
	s.mu.Lock()
	defer s.mu.Unlock()
	list := s.tugas[userID]
	for i := range list {
		if list[i].ID == id {
			s.tugas[userID] = append(list[:i], list[i+1:]...)
			return true
		}
	}
	return false
}

func buatToken() string {
	b := make([]byte, 32)
	rand.Read(b)
	return hex.EncodeToString(b)
}

func parseID(s string) (int64, error) {
	return strconv.ParseInt(strings.TrimSpace(s), 10, 64)
}

22-auth-web/contoh/main.go

package main

import (
	"log"
	"strings"

	"bab22-auth-web/components"
	"bab22-auth-web/model"

	"github.com/gofiber/fiber/v2"
)

type Handlers struct {
	store *Store
}

func (h *Handlers) HalamanLogin(c *fiber.Ctx) error {
	gagal := c.Query("gagal") == "1"
	c.Type("html")
	return components.HalamanLogin(gagal).Render(c.Context(), c.Response().BodyWriter())
}

func (h *Handlers) ProsesLogin(c *fiber.Ctx) error {
	username := strings.TrimSpace(c.FormValue("username"))
	password := c.FormValue("password")
	token, err := h.store.Login(username, password)
	if err != nil {
		return c.Redirect("/login?gagal=1")
	}
	c.Cookie(&fiber.Cookie{
		Name:     "session",
		Value:    token,
		HTTPOnly: true,
		SameSite: "Lax",
		Path:     "/",
	})
	return c.Redirect("/")
}

func (h *Handlers) WajibLogin(c *fiber.Ctx) error {
	token := c.Cookies("session")
	if token == "" {
		return c.Redirect("/login")
	}
	user, err := h.store.UserDariToken(token)
	if err != nil {
		c.ClearCookie("session")
		return c.Redirect("/login")
	}
	c.Locals("user", user)
	c.Locals("csrf", h.store.CSRFUntuk(token))
	return c.Next()
}

func (h *Handlers) CekCSRF(c *fiber.Ctx) error {
	kirim := c.FormValue("csrf")
	asli := c.Locals("csrf").(string)
	if kirim == "" || kirim != asli {
		return c.Status(fiber.StatusForbidden).SendString("CSRF tidak valid")
	}
	return c.Next()
}

func userDariCtx(c *fiber.Ctx) model.User {
	return c.Locals("user").(model.User)
}

func (h *Handlers) Halaman(c *fiber.Ctx) error {
	user := userDariCtx(c)
	csrf := c.Locals("csrf").(string)
	c.Type("html")
	return components.Halaman(h.store.SemuaTasks(user.ID), csrf).
		Render(c.Context(), c.Response().BodyWriter())
}

func (h *Handlers) TambahTask(c *fiber.Ctx) error {
	user := userDariCtx(c)
	csrf := c.Locals("csrf").(string)
	judul := strings.TrimSpace(c.FormValue("title"))
	if judul == "" {
		c.Status(fiber.StatusBadRequest)
		return c.SendString("judul wajib diisi")
	}
	h.store.TambahTask(user.ID, judul)
	c.Type("html")
	return components.Daftar(h.store.SemuaTasks(user.ID), csrf).
		Render(c.Context(), c.Response().BodyWriter())
}

func (h *Handlers) ToggleTask(c *fiber.Ctx) error {
	user := userDariCtx(c)
	csrf := c.Locals("csrf").(string)
	id, err := parseID(c.Params("id"))
	if err != nil {
		return c.SendStatus(fiber.StatusBadRequest)
	}
	t, ok := h.store.ToggleTask(user.ID, id)
	if !ok {
		return c.SendStatus(fiber.StatusNotFound)
	}
	c.Type("html")
	return components.Item(t, csrf).Render(c.Context(), c.Response().BodyWriter())
}

func (h *Handlers) HapusTask(c *fiber.Ctx) error {
	user := userDariCtx(c)
	csrf := c.Locals("csrf").(string)
	id, err := parseID(c.Params("id"))
	if err != nil {
		return c.SendStatus(fiber.StatusBadRequest)
	}
	if !h.store.HapusTask(user.ID, id) {
		return c.SendStatus(fiber.StatusNotFound)
	}
	c.Type("html")
	return components.Daftar(h.store.SemuaTasks(user.ID), csrf).
		Render(c.Context(), c.Response().BodyWriter())
}

func (h *Handlers) Logout(c *fiber.Ctx) error {
	if token := c.Cookies("session"); token != "" {
		h.store.Logout(token)
	}
	c.ClearCookie("session")
	return c.Redirect("/login")
}

func main() {
	store := NewStore()
	store.Register("rani", "rahasia123")
	store.TambahTask(1, "Tugas pertama Rani")

	h := &Handlers{store: store}
	app := fiber.New()

	app.Get("/login", h.HalamanLogin)
	app.Post("/login", h.ProsesLogin)

	berlogin := app.Group("", h.WajibLogin)
	berlogin.Get("/", h.Halaman)
	berlogin.Post("/logout", h.Logout)
	berlogin.Post("/tasks", h.CekCSRF, h.TambahTask)
	berlogin.Post("/tasks/:id/toggle", h.CekCSRF, h.ToggleTask)
	berlogin.Delete("/tasks/:id", h.CekCSRF, h.HapusTask)

	log.Fatal(app.Listen(":3000"))
}

Dengan kalimatmu sendiri: apa itu serangan CSRF? Kenapa cookie session saja tidak cukup melindungi request pengubah data?

Kenapa cookie session disetel HTTPOnly: true? Serangan apa yang dicegahnya?

User login, lalu menutup tab. Besoknya dia buka / lagi — apa yang terjadi? Kapan dia diminta login ulang?

23-websocket/contoh/go.mod

module bab23-websocket

go 1.26

require (
	github.com/gofiber/contrib/websocket v1.3.4
	github.com/gofiber/fiber/v2 v2.52.15
)

require (
	github.com/andybalholm/brotli v1.1.0 // indirect
	github.com/fasthttp/websocket v1.5.8 // indirect
	github.com/google/uuid v1.6.0 // indirect
	github.com/klauspost/compress v1.17.9 // indirect
	github.com/mattn/go-colorable v0.1.13 // indirect
	github.com/mattn/go-isatty v0.0.20 // indirect
	github.com/mattn/go-runewidth v0.0.16 // indirect
	github.com/rivo/uniseg v0.2.0 // indirect
	github.com/savsgio/gotils v0.0.0-20240303185622-093b76447511 // indirect
	github.com/valyala/bytebufferpool v1.0.0 // indirect
	github.com/valyala/fasthttp v1.52.0 // indirect
	github.com/valyala/tcplisten v1.0.0 // indirect
	golang.org/x/net v0.33.0 // indirect
	golang.org/x/sys v0.28.0 // indirect
)

23-websocket/contoh/hub.go

package main

import (
	"sync"

	"github.com/gofiber/contrib/websocket"
)

type Pesan struct {
	Pengirim string `json:"pengirim"`
	Teks     string `json:"teks"`
}

type Client struct {
	conn  *websocket.Conn
	kirim chan Pesan
}

type Hub struct {
	mu     sync.Mutex
	klien  map[*Client]bool
	siaran chan Pesan
}

func HubBaru() *Hub {
	return &Hub{
		klien:  make(map[*Client]bool),
		siaran: make(chan Pesan, 64),
	}
}

func (h *Hub) Jalan() {
	for p := range h.siaran {
		h.mu.Lock()
		for k := range h.klien {
			select {
			case k.kirim <- p:
			default:
			}
		}
		h.mu.Unlock()
	}
}

func (h *Hub) Kirim(p Pesan) {
	h.siaran <- p
}

func (h *Hub) Gabung(c *Client) {
	h.mu.Lock()
	defer h.mu.Unlock()
	h.klien[c] = true
}

func (h *Hub) Lepas(c *Client) {
	h.mu.Lock()
	defer h.mu.Unlock()
	if h.klien[c] {
		delete(h.klien, c)
		close(c.kirim)
	}
}

func (c *Client) tulis() {
	defer c.conn.Close()
	for p := range c.kirim {
		if err := c.conn.WriteJSON(p); err != nil {
			return
		}
	}
}

func (c *Client) baca(hub *Hub) {
	defer c.conn.Close()
	for {
		var p Pesan
		if err := c.conn.ReadJSON(&p); err != nil {
			hub.Lepas(c)
			return
		}
		hub.Kirim(p)
	}
}

23-websocket/contoh/main.go

package main

import (
	"log"

	"github.com/gofiber/contrib/websocket"
	"github.com/gofiber/fiber/v2"
)

func main() {
	hub := HubBaru()
	go hub.Jalan()

	app := fiber.New()

	app.Get("/", func(c *fiber.Ctx) error {
		return c.SendFile("./static/index.html")
	})

	app.Get("/ws", websocket.New(func(c *websocket.Conn) {
		klien := &Client{conn: c, kirim: make(chan Pesan, 16)}
		hub.Gabung(klien)
		defer hub.Lepas(klien)

		hub.Kirim(Pesan{Pengirim: "server", Teks: "seseorang bergabung"})

		go klien.tulis()
		klien.baca(hub)
	}))

	app.Post("/notifikasi", func(c *fiber.Ctx) error {
		var p Pesan
		if err := c.BodyParser(&p); err != nil {
			return c.Status(fiber.StatusBadRequest).JSON(fiber.Map{
				"error": "body json tidak valid"})
		}
		if p.Pengirim == "" {
			p.Pengirim = "anonim"
		}
		hub.Kirim(p)
		return c.JSON(fiber.Map{"status": "terkirim"})
	})

	log.Fatal(app.Listen(":3000"))
}

23-websocket/contoh/static/index.html

<!doctype html>
<html lang="id">
<head>
<meta charset="utf-8">
<meta name="viewport" content="width=device-width,initial-scale=1">
<title>Notifikasi Real-time</title>
<style>
body{font-family:system-ui,sans-serif;max-width:640px;margin:2rem auto;padding:0 1rem}
#notif{border:1px solid #00add8;border-radius:8px;padding:.8rem;min-height:2.5rem;background:#eefcff}
li{margin:.4rem 0}
</style>
</head>
<body>
<h1>Notifikasi Real-time</h1>
<p id="notif">belum ada pesan</p>
<hr>
<form id="kirim">
  <input id="pengirim" placeholder="namamu" value="rani">
  <input id="teks" placeholder="pesan">
  <button type="submit">Kirim</button>
</form>
<ul id="riwayat"></ul>

<script>
const ws = new WebSocket("ws://" + location.host + "/ws");

ws.onopen = () => { document.getElementById("notif").textContent = "terhubung ✓"; };
ws.onclose = () => { document.getElementById("notif").textContent = "terputus"; };
ws.onmessage = (e) => {
  const p = JSON.parse(e.data);
  document.getElementById("notif").textContent = p.pengirim + ": " + p.teks;
  const li = document.createElement("li");
  li.textContent = p.pengirim + ": " + p.teks;
  document.getElementById("riwayat").appendChild(li);
};

document.getElementById("kirim").addEventListener("submit", (e) => {
  e.preventDefault();
  const p = {
    pengirim: document.getElementById("pengirim").value,
    teks: document.getElementById("teks").value,
  };
  ws.send(JSON.stringify(p));
  document.getElementById("teks").value = "";
});
</script>
</body>
</html>

Apa peran Hub? Kenapa pengiriman ke klien lewat channel, bukan langsung conn.WriteJSON dari handler HTTP?

Dalam contoh, pesan yang dikirim satu klien disiarkan ke semua klien. Modifikasi apa yang diperlukan agar pesan punya field pengirim dan tampil di browser dengan nama pengirimnya?

type Pesan struct {
	Pengirim string `json:"pengirim"`
	Teks     string `json:"teks"`
}

ws.onmessage = (e) => {
  const p = JSON.parse(e.data);
  el.textContent = p.pengirim + ": " + p.teks;
};

Jelaskan arti select ... default: pada pengiriman ke k.kirim. Apa yang terjadi tanpa default?

24-observability-dan-profiling/contoh/go.mod

module bab24-observability

go 1.26.4

require github.com/gofiber/fiber/v2 v2.52.15

require (
	github.com/andybalholm/brotli v1.1.0 // indirect
	github.com/google/uuid v1.6.0 // indirect
	github.com/klauspost/compress v1.17.9 // indirect
	github.com/mattn/go-colorable v0.1.13 // indirect
	github.com/mattn/go-isatty v0.0.20 // indirect
	github.com/mattn/go-runewidth v0.0.16 // indirect
	github.com/rivo/uniseg v0.2.0 // indirect
	github.com/valyala/bytebufferpool v1.0.0 // indirect
	github.com/valyala/fasthttp v1.51.0 // indirect
	github.com/valyala/tcplisten v1.0.0 // indirect
	golang.org/x/sys v0.28.0 // indirect
)

24-observability-dan-profiling/contoh/main.go

package main

import (
	"log/slog"
	"net"
	"os"
	"sync"
	"time"

	"github.com/gofiber/fiber/v2"
)

type RateLimiter struct {
	mu    sync.Mutex
	peta  map[string][]time.Time
	batas int
	per   time.Duration
}

func RateLimiterBaru(batas int, per time.Duration) *RateLimiter {
	return &RateLimiter{
		peta:  make(map[string][]time.Time),
		batas: batas,
		per:   per,
	}
}

func (r *RateLimiter) Izinkan(alamat string) bool {
	r.mu.Lock()
	defer r.mu.Unlock()
	sekarang := time.Now()
	awal := sekarang.Add(-r.per)
	recent := r.peta[alamat][:0]
	for _, t := range r.peta[alamat] {
		if t.After(awal) {
			recent = append(recent, t)
		}
	}
	if len(recent) >= r.batas {
		r.peta[alamat] = recent
		return false
	}
	r.peta[alamat] = append(recent, sekarang)
	return true
}

func middlewareLog(logger *slog.Logger) fiber.Handler {
	return func(c *fiber.Ctx) error {
		mulai := time.Now()
		err := c.Next()
		logger.Info("request",
			"method", c.Method(),
			"path", c.Path(),
			"status", c.Response().StatusCode(),
			"durasi", time.Since(mulai).String(),
		)
		return err
	}
}

func middlewareRateLimit(rl *RateLimiter, logger *slog.Logger) fiber.Handler {
	return func(c *fiber.Ctx) error {
		host, _, _ := net.SplitHostPort(c.Context().RemoteAddr().String())
		if !rl.Izinkan(host) {
			logger.Warn("rate limit terlampaui", "alamat", host)
			return c.Status(fiber.StatusTooManyRequests).JSON(fiber.Map{
				"error": "terlalu banyak request"})
		}
		return c.Next()
	}
}

func main() {
	logger := slog.New(slog.NewTextHandler(os.Stdout, nil))
	slog.SetDefault(logger)

	rl := RateLimiterBaru(60, time.Minute)

	app := fiber.New()
	app.Use(middlewareLog(logger))
	app.Use(middlewareRateLimit(rl, logger))

	app.Get("/health", func(c *fiber.Ctx) error {
		return c.JSON(fiber.Map{"status": "ok"})
	})

	app.Get("/kerja", func(c *fiber.Ctx) error {
		// simulasi pekerjaan
		time.Sleep(20 * time.Millisecond)
		return c.JSON(fiber.Map{"selesai": true})
	})

	go func() {
		if err := app.Listen(":3000"); err != nil {
			logger.Error("server berhenti", "error", err)
			os.Exit(1)
		}
	}()

	logger.Info("server berjalan", "port", 3000)
	berhenti := make(chan os.Signal, 1)
	signalNotify(berhenti)
	<-berhenti

	logger.Info("menutup server dengan tenang...")
	if err := app.ShutdownWithTimeout(10 * time.Second); err != nil {
		logger.Error("shutdown paksa", "error", err)
	}
	logger.Info("server berhenti")
}

24-observability-dan-profiling/contoh/signal.go

package main

import (
	"os"
	"os/signal"
	"syscall"
)

func signalNotify(ch chan os.Signal) {
	signal.Notify(ch, os.Interrupt, syscall.SIGTERM)
}

Ubah satu fmt.Println menjadi slog.Info dengan atribut. Apa perbedaan yang kamu amati di output?

slog.Info("tugas dibuat", "id", t.ID, "judul", t.Title)

Jalankan go tool pprof -http :8080 http://localhost:6060/debug/pprof/profile?seconds=10 saat server sibuk. Bagian apa yang terlihat menghabiskan waktu paling banyak?

Tambahkan penanganan SIGINT/SIGTERM ke program bab 18. Uji: jalankan server, kirim Ctrl+C, amati pesan penutupannya.

berhenti := make(chan os.Signal, 1)
signal.Notify(berhenti, os.Interrupt, syscall.SIGTERM)
<-berhenti
fmt.Println("menutup server dengan tenang...")
if err := app.ShutdownWithTimeout(10 * time.Second); err != nil {
	slog.Error("shutdown paksa", "error", err)
}

25-redis/contoh/go.mod

module bab25-redis

go 1.26.4

require (
	github.com/alicebob/miniredis/v2 v2.40.0
	github.com/gofiber/fiber/v2 v2.52.15
	github.com/redis/go-redis/v9 v9.23.0
)

require (
	github.com/andybalholm/brotli v1.1.0 // indirect
	github.com/cespare/xxhash/v2 v2.3.0 // indirect
	github.com/google/uuid v1.6.0 // indirect
	github.com/klauspost/compress v1.17.9 // indirect
	github.com/mattn/go-colorable v0.1.13 // indirect
	github.com/mattn/go-isatty v0.0.20 // indirect
	github.com/mattn/go-runewidth v0.0.16 // indirect
	github.com/rivo/uniseg v0.2.0 // indirect
	github.com/valyala/bytebufferpool v1.0.0 // indirect
	github.com/valyala/fasthttp v1.51.0 // indirect
	github.com/valyala/tcplisten v1.0.0 // indirect
	github.com/yuin/gopher-lua v1.1.1 // indirect
	go.uber.org/atomic v1.12.0 // indirect
	golang.org/x/sys v0.48.0 // indirect
)

25-redis/contoh/task.go

package main

import (
	"fmt"
	"sync"
)

type Task struct {
	ID        int64  `json:"id"`
	Title     string `json:"title"`
	Completed bool   `json:"completed"`
}

type TaskDB struct {
	mu    sync.Mutex
	tugas map[int64][]Task
	next  int64
}

func TaskDBBaru() *TaskDB {
	return &TaskDB{tugas: make(map[int64][]Task)}
}

func (d *TaskDB) Tambah(userID int64, judul string) (Task, error) {
	d.mu.Lock()
	defer d.mu.Unlock()
	d.next++
	t := Task{ID: d.next, Title: judul}
	d.tugas[userID] = append(d.tugas[userID], t)
	return t, nil
}

func (d *TaskDB) Semua(userID int64) ([]Task, error) {
	d.mu.Lock()
	defer d.mu.Unlock()
	hasil := make([]Task, len(d.tugas[userID]))
	copy(hasil, d.tugas[userID])
	return hasil, nil
}

func (d *TaskDB) Ubah(userID, id int64, judul string, selesai bool) (Task, error) {
	d.mu.Lock()
	defer d.mu.Unlock()
	for i := range d.tugas[userID] {
		if d.tugas[userID][i].ID == id {
			d.tugas[userID][i].Title = judul
			d.tugas[userID][i].Completed = selesai
			return d.tugas[userID][i], nil
		}
	}
	return Task{}, fmt.Errorf("tugas tidak ditemukan")
}

func (d *TaskDB) Hapus(userID, id int64) error {
	d.mu.Lock()
	defer d.mu.Unlock()
	list := d.tugas[userID]
	for i := range list {
		if list[i].ID == id {
			d.tugas[userID] = append(list[:i], list[i+1:]...)
			return nil
		}
	}
	return fmt.Errorf("tugas tidak ditemukan")
}

25-redis/contoh/cache.go

package main

import (
	"context"
	"encoding/json"
	"fmt"
	"time"

	"github.com/redis/go-redis/v9"
)

type CacheStore struct {
	db    *TaskDB
	redis *redis.Client
}

func (s *CacheStore) DaftarTasks(ctx context.Context, userID int64) ([]Task, error) {
	kunci := fmt.Sprintf("tasks:%d", userID)

	data, err := s.redis.Get(ctx, kunci).Bytes()
	if err == nil {
		var daftar []Task
		if json.Unmarshal(data, &daftar) == nil {
			return daftar, nil
		}
	}

	daftar, err := s.db.Semua(userID)
	if err != nil {
		return nil, err
	}

	data, _ = json.Marshal(daftar)
	s.redis.Set(ctx, kunci, data, time.Minute)

	return daftar, nil
}

func (s *CacheStore) TambahTask(ctx context.Context, userID int64, judul string) (Task, error) {
	t, err := s.db.Tambah(userID, judul)
	if err != nil {
		return Task{}, err
	}
	s.redis.Del(ctx, fmt.Sprintf("tasks:%d", userID))
	return t, nil
}

func (s *CacheStore) UbahTask(ctx context.Context, userID, id int64, judul string, selesai bool) (Task, error) {
	t, err := s.db.Ubah(userID, id, judul, selesai)
	if err != nil {
		return Task{}, err
	}
	s.redis.Del(ctx, fmt.Sprintf("tasks:%d", userID))
	return t, nil
}

func (s *CacheStore) HapusTask(ctx context.Context, userID, id int64) error {
	if err := s.db.Hapus(userID, id); err != nil {
		return err
	}
	s.redis.Del(ctx, fmt.Sprintf("tasks:%d", userID))
	return nil
}

25-redis/contoh/limiter.go

package main

import (
	"context"
	"fmt"
	"time"

	"github.com/redis/go-redis/v9"
)

type RedisLimiter struct {
	redis *redis.Client
	batas int
}

func (r *RedisLimiter) Izinkan(ctx context.Context, alamat string) (bool, error) {
	kunci := fmt.Sprintf("rate:%s:%d", alamat, time.Now().Unix()/60)
	n, err := r.redis.Incr(ctx, kunci).Result()
	if err != nil {
		return false, err
	}
	if n == 1 {
		r.redis.Expire(ctx, kunci, time.Minute)
	}
	return n <= int64(r.batas), nil
}

25-redis/contoh/main.go

package main

import (
	"log"
	"net"
	"os"
	"strconv"
	"strings"

	"github.com/gofiber/fiber/v2"
	"github.com/redis/go-redis/v9"
)

func redisBaru(alamat string) *redis.Client {
	return redis.NewClient(&redis.Options{Addr: alamat})
}

func main() {
	alamat := os.Getenv("REDIS_ADDR")
	if alamat == "" {
		alamat = "127.0.0.1:6379"
	}

	rdb := redisBaru(alamat)
	store := &CacheStore{db: TaskDBBaru(), redis: rdb}
	limiter := &RedisLimiter{redis: rdb, batas: 60}

	app := fiber.New()

	app.Get("/tasks", func(c *fiber.Ctx) error {
		userID, _ := strconv.ParseInt(c.Query("user", "1"), 10, 64)
		daftar, err := store.DaftarTasks(c.Context(), userID)
		if err != nil {
			return c.Status(fiber.StatusInternalServerError).JSON(fiber.Map{
				"error": "gagal membaca"})
		}
		return c.JSON(daftar)
	})

	app.Post("/tasks", func(c *fiber.Ctx) error {
		host, _, _ := net.SplitHostPort(c.Context().RemoteAddr().String())
		ok, err := limiter.Izinkan(c.Context(), host)
		if err != nil {
			return c.Status(fiber.StatusInternalServerError).JSON(fiber.Map{
				"error": "limiter gagal"})
		}
		if !ok {
			return c.Status(fiber.StatusTooManyRequests).JSON(fiber.Map{
				"error": "terlalu banyak request"})
		}
		var input struct {
			UserID int64  `json:"userId"`
			Title  string `json:"title"`
		}
		if err := c.BodyParser(&input); err != nil {
			return c.Status(fiber.StatusBadRequest).JSON(fiber.Map{
				"error": "body json tidak valid"})
		}
		judul := strings.TrimSpace(input.Title)
		if judul == "" {
			return c.Status(fiber.StatusBadRequest).JSON(fiber.Map{
				"error": "title tidak boleh kosong"})
		}
		t, err := store.TambahTask(c.Context(), input.UserID, judul)
		if err != nil {
			return c.Status(fiber.StatusInternalServerError).JSON(fiber.Map{
				"error": "gagal menyimpan"})
		}
		return c.Status(fiber.StatusCreated).JSON(t)
	})

	log.Fatal(app.Listen(":3000"))
}

25-redis/contoh/cache_test.go

package main

import (
	"context"
	"testing"

	"github.com/alicebob/miniredis/v2"
	"github.com/redis/go-redis/v9"
)

func redisTest(t *testing.T) *redis.Client {
	t.Helper()
	mr, err := miniredis.Run()
	if err != nil {
		t.Fatal(err)
	}
	t.Cleanup(mr.Close)
	return redis.NewClient(&redis.Options{Addr: mr.Addr()})
}

func TestCacheBacaMelaluiDanInvalidasi(t *testing.T) {
	rdb := redisTest(t)
	ctx := context.Background()

	db := TaskDBBaru()
	db.Tambah(1, "pertama")

	store := &CacheStore{db: db, redis: rdb}

	// Panggilan pertama: miss -> dari DB -> isi cache.
	daftar, err := store.DaftarTasks(ctx, 1)
	if err != nil {
		t.Fatal(err)
	}
	if len(daftar) != 1 || daftar[0].Title != "pertama" {
		t.Fatalf("daftar pertama tidak sesuai: %+v", daftar)
	}

	// Data berubah lewat jalur yang meng-invalidasi cache.
	if _, err := store.TambahTask(ctx, 1, "kedua"); err != nil {
		t.Fatal(err)
	}

	// Cache sudah dihapus -> pembacaan berikutnya memuat data segar.
	daftar, err = store.DaftarTasks(ctx, 1)
	if err != nil {
		t.Fatal(err)
	}
	if len(daftar) != 2 {
		t.Fatalf("ingin 2 tugas, dapat %d", len(daftar))
	}

	// Tanpa invalidasi (langsung db) cache masih lama -> bukti jalur benar.
	db.Tambah(1, "ketiga")
	daftar, err = store.DaftarTasks(ctx, 1) // masih hit cache lama: 2 item
	if err != nil {
		t.Fatal(err)
	}
	if len(daftar) != 2 {
		t.Fatalf("cache hit seharusnya masih 2 item, dapat %d", len(daftar))
	}
}

func TestRedisLimiter(t *testing.T) {
	rdb := redisTest(t)
	ctx := context.Background()

	limiter := &RedisLimiter{redis: rdb, batas: 3}
	for i := 0; i < 3; i++ {
		ok, err := limiter.Izinkan(ctx, "192.168.1.10")
		if err != nil {
			t.Fatal(err)
		}
		if !ok {
			t.Fatalf("request %d seharusnya diizinkan", i)
		}
	}
	ok, err := limiter.Izinkan(ctx, "192.168.1.10")
	if err != nil {
		t.Fatal(err)
	}
	if ok {
		t.Fatal("request ke-4 seharusnya ditolak")
	}
}

Ceritakan apa yang terjadi saat DaftarTugas dipanggil dua kali berturut-turut dengan Redis menyala: request kedua lebih cepat kenapa? Istilah cache apa yang cocok untuk masing-masing panggilan?

Daftar kapan saja cache harus dihapus dalam contoh bab ini. Apa akibatnya kalau kita lupa menghapus setelah mengubah tugas?

Ubah RedisLimiter agar kunci memakai detik (bukan menit) dan batas 3 per detik. Tulis test dengan miniredis yang membuktikan request ke-4 ditolak.

func (r *RedisLimiter) Izinkan(ctx context.Context, alamat string) (bool, error) {
	kunci := fmt.Sprintf("rate:%s:%d", alamat, time.Now().Unix())
	n, err := r.redis.Incr(ctx, kunci).Result()
	if err != nil {
		return false, err
	}
	if n == 1 {
		r.redis.Expire(ctx, kunci, time.Second)
	}
	return n <= r.batas, nil
}

26-graphql/contoh/go.mod

module bab26-graphql

go 1.26.4

require (
	github.com/99designs/gqlgen v0.17.95
	github.com/gofiber/fiber/v2 v2.52.15
	github.com/vektah/gqlparser/v2 v2.5.62
)

require (
	github.com/agnivade/levenshtein v1.2.1 // indirect
	github.com/andybalholm/brotli v1.1.0 // indirect
	github.com/coder/websocket v1.8.15 // indirect
	github.com/go-viper/mapstructure/v2 v2.5.0 // indirect
	github.com/google/uuid v1.6.0 // indirect
	github.com/hashicorp/golang-lru/v2 v2.0.7 // indirect
	github.com/klauspost/compress v1.17.9 // indirect
	github.com/mattn/go-colorable v0.1.15 // indirect
	github.com/mattn/go-isatty v0.0.24 // indirect
	github.com/mattn/go-runewidth v0.0.16 // indirect
	github.com/rivo/uniseg v0.2.0 // indirect
	github.com/sosodev/duration v1.4.0 // indirect
	github.com/valyala/bytebufferpool v1.0.0 // indirect
	github.com/valyala/fasthttp v1.51.0 // indirect
	github.com/valyala/tcplisten v1.0.0 // indirect
	golang.org/x/sync v0.22.0 // indirect
	golang.org/x/sys v0.47.0 // indirect
)

26-graphql/contoh/gqlgen.yml

# Where are all the schema files located? globs are supported eg  src/**/*.graphqls
schema:
  - graph/*.graphqls

# Where should the generated server code go?
exec:
  package: graph
  layout: single-file # Only other option is "follow-schema," ie multi-file.

  # Only for single-file layout:
  filename: graph/generated.go

  # Only for follow-schema layout:
  # dir: graph
  # filename_template: "{name}.generated.go"

  # Optional: Maximum number of goroutines in concurrency to use per child resolvers(default: unlimited)
  # worker_limit: 1000

# Uncomment to enable federation
# federation:
#   filename: graph/federation.go
#   package: graph
#   version: 2
#   options:
#     # Generate a function to populate @requires fields (cannot be used with computed_requires)
#     explicit_requires: false
#     # Generate resolver functions to compute @requires field values (requires version 2 and call_argument_directives_with_null: true)
#     computed_requires: false
#     # Default engine for entityResolver generation, can be overridden per entity with @entityResolver(multi: Boolean)
#     entity_resolver_multi: false

# Where should any generated models go?
model:
  filename: graph/model/models_gen.go
  package: model

  # Optional: Pass in a path to a new gotpl template to use for generating the models
  # model_template: [your/path/model.gotpl]

# Where should the resolver implementations go?
resolver:
  package: graph
  layout: follow-schema # Only other option is "single-file."

  # Only for single-file layout:
  # filename: graph/resolver.go

  # Only for follow-schema layout:
  dir: graph
  filename_template: "{name}.resolvers.go"

  # Optional: turn on to not generate template comments above resolvers
  # omit_template_comment: false
  # Optional: Pass in a path to a new gotpl template to use for generating resolvers
  # resolver_template: [your/path/resolver.gotpl]
  # Optional: turn on to avoid rewriting existing resolver(s) when generating
  # preserve_resolver: false
  # Optional: turn on to hold the root resolver in a named "r" field instead of embedding it.
  # Speeds up compilation on large schemas. Turning this on is source-breaking for existing
  # resolver bodies: dependencies are reached as r.r.myService instead of r.myService.
  # omit_resolver_embedding: false
  # Optional: the name of the resolver struct type (default: Resolver)
  # type: Resolver

# Optional: turn on use ` + "`" + `gqlgen:"fieldName"` + "`" + ` tags in your models
# struct_tag: json

# Optional: prefix for embedded structs (default: "Base")
# embedded_structs_prefix: Base

# Optional: custom directive configuration
# directives:
#   hasRole:
#     skip_runtime: false

# Optional: local package prefix for import sorting
# local_prefix: ""

# Optional: turn on to use []Thing instead of []*Thing
# omit_slice_element_pointers: false

# Optional: turn on to omit getter methods on models
# omit_getters: false

# Optional: turn on to omit Is<Name>() methods to interface and unions
# omit_interface_checks: true

# Optional: turn on to skip generation of ComplexityRoot struct content and Complexity function
# omit_complexity: false

# Optional: turn on to not generate any file notice comments in generated files
# omit_gqlgen_file_notice: false

# Optional: turn on to exclude the gqlgen version in the generated file notice. No effect if `omit_gqlgen_file_notice` is true.
# omit_gqlgen_version_in_file_notice: false

# Optional: turn on to exclude root models such as Query and Mutation from the generated models file.
# omit_root_models: false

# Optional: turn on to exclude resolver fields from the generated models file.
# omit_resolver_fields: false

# Optional: turn on to omit panic handler in the generated server
# omit_panic_handler: false

# Optional: turn on to omit JSON marshaler/unmarshaler generation for enums
# omit_enum_json_marshalers: false

# Optional: turn off to make struct-type struct fields not use pointers
# e.g. type Thing struct { FieldA OtherThing } instead of { FieldA *OtherThing }
# struct_fields_always_pointers: true

# Optional: turn off to make resolvers return values instead of pointers for structs
# resolvers_always_return_pointers: true

# Optional: turn on to return pointers instead of values in unmarshalInput
# return_pointers_in_unmarshalinput: false

# Optional: wrap nullable input fields with Omittable
# nullable_input_omittable: true

# Optional: enable adding omitempty to the json tag of generated model fields
# enable_model_json_omitempty_tag: false

# Optional: enable adding omitzero to the json tag of generated model fields
# enable_model_json_omitzero_tag: false

# Optional: set to speed up generation time by not performing a final validation pass.
# skip_validation: true

# Optional: set to skip running `go mod tidy` when generating server code
# skip_mod_tidy: true

# Optional: if this is set to true, argument directives that
# decorate a field with a null value will still be called.
#
# This enables argumment directives to not just mutate
# argument values but to set them even if they're null.
call_argument_directives_with_null: true

# This enables gql server to use function syntax for execution context
# instead of generating receiver methods of the execution context.
# use_function_syntax_for_execution_context: false

# Optional: set build tags that will be used to load packages
# go_build_tags:
#  - private
#  - enterprise

# Optional: set to modify the initialisms regarded for Go names
# go_initialisms:
#   replace_defaults: false # if true, the default initialisms will get dropped in favor of the new ones instead of being added
#   initialisms: # List of initialisms to for Go names
#     - 'CC'
#     - 'BCC'

# Optional: enable getter/haser methods for autobind
# autobind_getter_haser: false

# gqlgen will search for any type names in the schema in these go packages
# if they match it will use them, otherwise it will generate them.
autobind:
#  - "bab26-graphql/graph/model"

# This section declares type mapping between the GraphQL and go type systems
#
# The first line in each type will be used as defaults for resolver arguments and
# modelgen, the others will be allowed when binding to fields. Configure them to
# your liking
models:
  ID:
    model:
      - github.com/99designs/gqlgen/graphql.ID
      - github.com/99designs/gqlgen/graphql.Int
      - github.com/99designs/gqlgen/graphql.Int64
      - github.com/99designs/gqlgen/graphql.Int32
  # gqlgen provides a default GraphQL UUID convenience wrapper for github.com/google/uuid 
  # but you can override this to provide your own GraphQL UUID implementation
  UUID:
    model:
      - github.com/99designs/gqlgen/graphql.UUID

  # The GraphQL spec explicitly states that the Int type is a signed 32-bit
  # integer. Using Go int or int64 to represent it can lead to unexpected
  # behavior, and some GraphQL tools like Apollo Router will fail when
  # communicating numbers that overflow 32-bits.
  #
  # You may choose to use the custom, built-in Int64 scalar to represent 64-bit
  # integers, or ignore the spec and bind Int to graphql.Int / graphql.Int64
  # (the default behavior of gqlgen). This is fine in simple use cases when you
  # do not need to worry about interoperability and only expect small numbers.
  Int:
    model:
      - github.com/99designs/gqlgen/graphql.Int32
  Int64:
    model:
      - github.com/99designs/gqlgen/graphql.Int
      - github.com/99designs/gqlgen/graphql.Int64

26-graphql/contoh/graph/schema.graphqls

type Task {
  id: ID!
  title: String!
  completed: Boolean!
}

type Query {
  tasks: [Task!]!
  task(id: ID!): Task
}

type Mutation {
  createTask(title: String!): Task!
}

26-graphql/contoh/graph/resolver.go

package graph

// This file will not be regenerated automatically.
//
// It serves as dependency injection for your app, add any dependencies you require
// here.

import (
	"sync"
)

type TaskStore struct {
	mu    sync.Mutex
	tugas []TaskItem
	next  int64
}

type TaskItem struct {
	ID        int64
	Title     string
	Completed bool
}

func NewTaskStore() *TaskStore {
	return &TaskStore{}
}

func (s *TaskStore) Tambah(judul string) TaskItem {
	s.mu.Lock()
	defer s.mu.Unlock()
	s.next++
	t := TaskItem{ID: s.next, Title: judul}
	s.tugas = append(s.tugas, t)
	return t
}

func (s *TaskStore) Semua() []TaskItem {
	s.mu.Lock()
	defer s.mu.Unlock()
	hasil := make([]TaskItem, len(s.tugas))
	copy(hasil, s.tugas)
	return hasil
}

func (s *TaskStore) Cari(id int64) (TaskItem, bool) {
	s.mu.Lock()
	defer s.mu.Unlock()
	for _, t := range s.tugas {
		if t.ID == id {
			return t, true
		}
	}
	return TaskItem{}, false
}

type Resolver struct {
	Store *TaskStore
}

26-graphql/contoh/graph/schema.resolvers.go

package graph

// This file will be automatically regenerated based on the schema, any resolver
// implementations
// will be copied through when generating and any unknown code will be moved to the end.
// Code generated by github.com/99designs/gqlgen version v0.17.95

import (
	"bab26-graphql/graph/model"
	"context"
	"fmt"
	"strconv"
	"strings"
)

// CreateTask is the resolver for the createTask field.
func (r *mutationResolver) CreateTask(ctx context.Context, title string) (*model.Task, error) {
	judul := strings.TrimSpace(title)
	if judul == "" {
		return nil, fmt.Errorf("title tidak boleh kosong")
	}
	t := r.Store.Tambah(judul)
	return &model.Task{
		ID:        strconv.FormatInt(t.ID, 10),
		Title:     t.Title,
		Completed: t.Completed,
	}, nil
}

// Tasks is the resolver for the tasks field.
func (r *queryResolver) Tasks(ctx context.Context) ([]*model.Task, error) {
	daftar := r.Store.Semua()
	hasil := make([]*model.Task, 0, len(daftar))
	for _, t := range daftar {
		hasil = append(hasil, &model.Task{
			ID:        strconv.FormatInt(t.ID, 10),
			Title:     t.Title,
			Completed: t.Completed,
		})
	}
	return hasil, nil
}

// Task is the resolver for the task field.
func (r *queryResolver) Task(ctx context.Context, id string) (*model.Task, error) {
	angka, err := strconv.ParseInt(id, 10, 64)
	if err != nil {
		return nil, nil
	}
	t, ok := r.Store.Cari(angka)
	if !ok {
		return nil, nil
	}
	return &model.Task{
		ID:        id,
		Title:     t.Title,
		Completed: t.Completed,
	}, nil
}

// Mutation returns MutationResolver implementation.
func (r *Resolver) Mutation() MutationResolver { return &mutationResolver{r} }

// Query returns QueryResolver implementation.
func (r *Resolver) Query() QueryResolver { return &queryResolver{r} }

type (
	mutationResolver struct{ *Resolver }
	queryResolver    struct{ *Resolver }
)

26-graphql/contoh/server.go

package main

import (
	"log"

	"bab26-graphql/graph"

	"github.com/99designs/gqlgen/graphql/handler"
	"github.com/99designs/gqlgen/graphql/playground"
	"github.com/gofiber/fiber/v2"
	"github.com/gofiber/fiber/v2/middleware/adaptor"
)

func main() {
	store := graph.NewTaskStore()
	store.Tambah("Belajar GraphQL")

	srv := handler.NewDefaultServer(graph.NewExecutableSchema(graph.Config{
		Resolvers: &graph.Resolver{Store: store},
	}))

	app := fiber.New()

	app.Get("/", adaptor.HTTPHandler(playground.Handler("GraphQL", "/query")))

	app.All("/query", adaptor.HTTPHandler(srv))

	log.Fatal(app.Listen(":3000"))
}

26-graphql/contoh/server_test.go

package main

import (
	"bytes"
	"encoding/json"
	"net/http/httptest"
	"strings"
	"testing"

	"bab26-graphql/graph"

	"github.com/99designs/gqlgen/graphql/handler"
	"github.com/gofiber/fiber/v2"
	"github.com/gofiber/fiber/v2/middleware/adaptor"
)

func appTest() *fiber.App {
	store := graph.NewTaskStore()
	store.Tambah("Belajar GraphQL")

	srv := handler.NewDefaultServer(graph.NewExecutableSchema(graph.Config{
		Resolvers: &graph.Resolver{Store: store},
	}))

	app := fiber.New()
	app.All("/query", adaptor.HTTPHandler(srv))
	return app
}

func kirimQuery(t *testing.T, app *fiber.App, query string) map[string]any {
	t.Helper()
	body, _ := json.Marshal(map[string]string{"query": query})
	req := httptest.NewRequest(fiber.MethodPost, "/query", bytes.NewReader(body))
	req.Header.Set("Content-Type", "application/json")
	resp, err := app.Test(req)
	if err != nil {
		t.Fatal(err)
	}
	if resp.StatusCode != fiber.StatusOK {
		t.Fatalf("ingin 200, dapat %d", resp.StatusCode)
	}
	var hasil map[string]any
	if err := json.NewDecoder(resp.Body).Decode(&hasil); err != nil {
		t.Fatal(err)
	}
	return hasil
}

func TestQueryTasks(t *testing.T) {
	app := appTest()
	hasil := kirimQuery(t, app, "{ tasks { id title completed } }")

	data := hasil["data"].(map[string]any)
	tasks := data["tasks"].([]any)
	if len(tasks) != 1 {
		t.Fatalf("ingin 1 task, dapat %d", len(tasks))
	}
	pertama := tasks[0].(map[string]any)
	if pertama["title"] != "Belajar GraphQL" {
		t.Fatalf("judul tidak sesuai: %v", pertama)
	}
}

func TestQuerySatuTask(t *testing.T) {
	app := appTest()
	hasil := kirimQuery(t, app, `{ task(id: "1") { title } }`)

	data := hasil["data"].(map[string]any)
	if data["task"] == nil {
		t.Fatal("task seharusnya ada")
	}
	task := data["task"].(map[string]any)
	if task["title"] != "Belajar GraphQL" {
		t.Fatalf("judul tidak sesuai: %v", task)
	}

	// ID tidak ada -> null.
	hasil = kirimQuery(t, app, `{ task(id: "999") { title } }`)
	data = hasil["data"].(map[string]any)
	if data["task"] != nil {
		t.Fatal("task 999 seharusnya null")
	}
}

func TestMutationCreateTask(t *testing.T) {
	app := appTest()
	hasil := kirimQuery(t, app, `mutation { createTask(title: "Tugas baru") { id title } }`)

	data := hasil["data"].(map[string]any)
	dibuat := data["createTask"].(map[string]any)
	if dibuat["title"] != "Tugas baru" {
		t.Fatalf("judul tidak sesuai: %v", dibuat)
	}

	// Verifikasi total jadi 2.
	hasil = kirimQuery(t, app, "{ tasks { id } }")
	data = hasil["data"].(map[string]any)
	if n := len(data["tasks"].([]any)); n != 2 {
		t.Fatalf("ingin 2 task, dapat %d", n)
	}
}

func TestMutationJudulKosongError(t *testing.T) {
	app := appTest()
	hasil := kirimQuery(t, app, `mutation { createTask(title: "   ") { id } }`)

	if hasil["errors"] == nil {
		t.Fatalf("seharusnya ada error untuk judul kosong: %v", hasil)
	}
	errText := hasil["errors"].([]any)[0].(map[string]any)["message"].(string)
	if !strings.Contains(errText, "title") {
		t.Fatalf("pesan error tidak sesuai: %s", errText)
	}
}

Sebutkan dua kelebihan GraphQL dibanding REST untuk aplikasi dengan banyak klien, dan satu kelemahannya.

Tulis query GraphQL yang hanya meminta title dari semua tasks. Bandingkan dengan respons REST GET /tasks — apa perbedaannya?

query { tasks { title } }

Tambahkan field updatedAt: String ke Task, dan isi resolver-nya. Apa langkah yang harus dijalankan setelah schema berubah?

27-docker-cicd-dan-capstone/capstone/go.mod

module capstone

go 1.26.4

require (
	github.com/a-h/templ v0.3.1070
	github.com/alicebob/miniredis/v2 v2.40.0
	github.com/go-sql-driver/mysql v1.10.1
	github.com/gofiber/contrib/websocket v1.3.4
	github.com/gofiber/fiber/v2 v2.52.15
	github.com/redis/go-redis/v9 v9.23.0
	golang.org/x/crypto v0.58.0
)

require (
	filippo.io/edwards25519 v1.2.0 // indirect
	github.com/andybalholm/brotli v1.2.6 // indirect
	github.com/cespare/xxhash/v2 v2.3.0 // indirect
	github.com/fasthttp/websocket v1.5.8 // indirect
	github.com/google/uuid v1.6.0 // indirect
	github.com/klauspost/compress v1.17.9 // indirect
	github.com/mattn/go-colorable v0.1.15 // indirect
	github.com/mattn/go-isatty v0.0.24 // indirect
	github.com/mattn/go-runewidth v0.0.16 // indirect
	github.com/rivo/uniseg v0.2.0 // indirect
	github.com/savsgio/gotils v0.0.0-20240303185622-093b76447511 // indirect
	github.com/valyala/bytebufferpool v1.0.0 // indirect
	github.com/valyala/fasthttp v1.52.0 // indirect
	github.com/valyala/tcplisten v1.0.0 // indirect
	github.com/yuin/gopher-lua v1.1.1 // indirect
	go.uber.org/atomic v1.12.0 // indirect
	golang.org/x/net v0.60.0 // indirect
	golang.org/x/sys v0.49.0 // indirect
)

27-docker-cicd-dan-capstone/capstone/Dockerfile

# Tahap 1: build
FROM golang:1.26-alpine AS builder
WORKDIR /app
COPY go.mod go.sum ./
RUN go mod download
COPY . .
RUN CGO_ENABLED=0 go build -o /app/server .

# Tahap 2: jalankan
FROM alpine:3.20
RUN adduser -D app
WORKDIR /app
COPY --from=builder /app/server /usr/local/bin/server
COPY --from=builder /app/static /app/static
USER app
EXPOSE 3000
ENTRYPOINT ["/usr/local/bin/server"]

27-docker-cicd-dan-capstone/capstone/compose.yaml

services:
  app:
    build: .
    ports:
      - "3000:3000"
    environment:
      DATABASE_URL: "task_app:rahasia@tcp(db:3306)/belajar_go?parseTime=true"
      REDIS_ADDR: "redis:6379"
      PORT: "3000"
    depends_on:
      db:
        condition: service_healthy
      redis:
        condition: service_started

  db:
    image: mariadb:11
    environment:
      MARIADB_ROOT_PASSWORD: rahasia
      MARIADB_DATABASE: belajar_go
      MARIADB_USER: task_app
      MARIADB_PASSWORD: rahasia
    volumes:
      - dbdata:/var/lib/mysql
    healthcheck:
      test: ["CMD", "healthcheck.sh", "--connect", "--innodb_initialized"]
      interval: 5s
      timeout: 5s
      retries: 10

  redis:
    image: redis:7-alpine

volumes:
  dbdata:

27-docker-cicd-dan-capstone/capstone/.env.example

# Salin menjadi .env atau set lewat export.
DATABASE_URL=task_app:rahasia@tcp(127.0.0.1:3306)/belajar_go?parseTime=true
TEST_DATABASE_URL=task_app:rahasia@tcp(127.0.0.1:3306)/belajar_go_test?parseTime=true&multiStatements=true
REDIS_ADDR=127.0.0.1:6379
PORT=3000

27-docker-cicd-dan-capstone/capstone/.github/workflows/ci.yml

name: CI
on: [push, pull_request]

jobs:
  test:
    runs-on: ubuntu-latest
    services:
      mariadb:
        image: mariadb:11
        env:
          MARIADB_DATABASE: belajar_go_test
          MARIADB_USER: task_app
          MARIADB_PASSWORD: rahasia
          MARIADB_ROOT_PASSWORD: rahasia
        ports:
          - "3306:3306"
        options: >-
          --health-cmd="healthcheck.sh --connect --innodb_initialized"
          --health-interval=5s
          --health-timeout=5s
          --health-retries=10
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-go@v5
        with:
          go-version: "1.26"
      - name: Generate templ
        run: go run github.com/a-h/templ/cmd/templ@latest generate
      - name: Test
        run: go test -race ./...
        env:
          TEST_DATABASE_URL: "task_app:rahasia@tcp(127.0.0.1:3306)/belajar_go_test?parseTime=true&multiStatements=true"
          REDIS_ADDR: "127.0.0.1:6379"

  build:
    runs-on: ubuntu-latest
    needs: test
    steps:
      - uses: actions/checkout@v4
      - name: Build image
        run: docker build -t task-manager .

27-docker-cicd-dan-capstone/capstone/config.go

package main

import (
	"os"
)

type Config struct {
	DatabaseURL string
	RedisAddr   string
	Port        string
}

func muatConfig() Config {
	port := os.Getenv("PORT")
	if port == "" {
		port = "3000"
	}
	url := os.Getenv("DATABASE_URL")
	if url == "" {
		url = "task_app:rahasia@tcp(127.0.0.1:3306)/belajar_go?parseTime=true"
	}
	redis := os.Getenv("REDIS_ADDR")
	if redis == "" {
		redis = "127.0.0.1:6379"
	}
	return Config{DatabaseURL: url, RedisAddr: redis, Port: port}
}

27-docker-cicd-dan-capstone/capstone/model/models.go

package model

import (
	"strings"
)

type User struct {
	ID           int64  `json:"id"`
	Username     string `json:"username"`
	PasswordHash string `json:"-"`
}

type Task struct {
	ID        int64  `json:"id"`
	UserID    int64  `json:"userId"`
	Title     string `json:"title"`
	Completed bool   `json:"completed"`
}

func ValidasiUsername(username string) (string, bool) {
	username = strings.TrimSpace(username)
	if len(username) < 3 || len(username) > 50 {
		return "", false
	}
	return username, true
}

func ValidasiPassword(password string) bool {
	return len(password) >= 8
}

func ValidasiJudul(judul string) (string, bool) {
	judul = strings.TrimSpace(judul)
	if judul == "" || len([]rune(judul)) > 200 {
		return "", false
	}
	return judul, true
}

27-docker-cicd-dan-capstone/capstone/auth.go

package main

import (
	"crypto/rand"
	"encoding/hex"
	"errors"

	"golang.org/x/crypto/bcrypt"
)

var ErrLoginSalah = errors.New("username atau password salah")

func hashPassword(pw string) (string, error) {
	b, err := bcrypt.GenerateFromPassword([]byte(pw), bcrypt.DefaultCost)
	if err != nil {
		return "", err
	}
	return string(b), nil
}

func verifyPassword(pw, hash string) bool {
	return bcrypt.CompareHashAndPassword([]byte(hash), []byte(pw)) == nil
}

func buatToken() string {
	b := make([]byte, 32)
	rand.Read(b)
	return hex.EncodeToString(b)
}

27-docker-cicd-dan-capstone/capstone/store.go

package main

import (
	"capstone/model"
	"database/sql"
	"fmt"
	"time"
)

type Store struct {
	db *sql.DB
}

const skema = `
CREATE TABLE IF NOT EXISTS users (
    id BIGINT AUTO_INCREMENT PRIMARY KEY,
    username VARCHAR(50) NOT NULL UNIQUE,
    password_hash VARCHAR(255) NOT NULL
) CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci;

CREATE TABLE IF NOT EXISTS sessions (
    token CHAR(64) PRIMARY KEY,
    user_id BIGINT NOT NULL,
    csrf CHAR(64) NOT NULL,
    expires_at DATETIME NOT NULL
) CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci;

CREATE TABLE IF NOT EXISTS tasks (
    id BIGINT AUTO_INCREMENT PRIMARY KEY,
    user_id BIGINT NOT NULL,
    title VARCHAR(200) NOT NULL,
    completed BOOLEAN NOT NULL DEFAULT FALSE
) CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci;`

func (s *Store) BuatTabel() error {
	if _, err := s.db.Exec(skema); err != nil {
		return fmt.Errorf("buat tabel: %w", err)
	}
	return nil
}

// ---- auth ----

func (s *Store) Register(username, passwordHash string) (model.User, error) {
	res, err := s.db.Exec(
		"INSERT INTO users (username, password_hash) VALUES (?, ?)",
		username, passwordHash)
	if err != nil {
		return model.User{}, err
	}
	id, err := res.LastInsertId()
	if err != nil {
		return model.User{}, err
	}
	return model.User{ID: id, Username: username}, nil
}

func (s *Store) Login(username, password string) (string, string, error) {
	var user model.User
	err := s.db.QueryRow(
		"SELECT id, password_hash FROM users WHERE username = ?", username,
	).Scan(&user.ID, &user.PasswordHash)
	if err == sql.ErrNoRows {
		return "", "", ErrLoginSalah
	}
	if err != nil {
		return "", "", err
	}
	if !verifyPassword(password, user.PasswordHash) {
		return "", "", ErrLoginSalah
	}
	token := buatToken()
	csrf := buatToken()
	expires := time.Now().Add(7 * 24 * time.Hour)
	_, err = s.db.Exec(
		"INSERT INTO sessions (token, user_id, csrf, expires_at) VALUES (?, ?, ?, ?)",
		token, user.ID, csrf, expires)
	if err != nil {
		return "", "", err
	}
	return token, csrf, nil
}

func (s *Store) Logout(token string) {
	s.db.Exec("DELETE FROM sessions WHERE token = ?", token)
}

type Session struct {
	UserID int64
	CSRF   string
}

func (s *Store) SessionDariToken(token string) (Session, error) {
	var ses Session
	err := s.db.QueryRow(
		`SELECT user_id, csrf FROM sessions
		 WHERE token = ? AND expires_at > NOW()`, token,
	).Scan(&ses.UserID, &ses.CSRF)
	return ses, err
}

func (s *Store) UserDariID(id int64) (model.User, error) {
	var u model.User
	err := s.db.QueryRow(
		"SELECT id, username, password_hash FROM users WHERE id = ?", id,
	).Scan(&u.ID, &u.Username, &u.PasswordHash)
	return u, err
}

// ---- tasks ----

func (s *Store) TambahTask(userID int64, judul string) (model.Task, error) {
	res, err := s.db.Exec(
		"INSERT INTO tasks (user_id, title) VALUES (?, ?)", userID, judul)
	if err != nil {
		return model.Task{}, err
	}
	id, err := res.LastInsertId()
	if err != nil {
		return model.Task{}, err
	}
	return model.Task{ID: id, UserID: userID, Title: judul}, nil
}

func (s *Store) SemuaTasks(userID int64) ([]model.Task, error) {
	rows, err := s.db.Query(
		"SELECT id, user_id, title, completed FROM tasks WHERE user_id = ? ORDER BY id",
		userID)
	if err != nil {
		return nil, err
	}
	defer rows.Close()

	var daftar []model.Task
	for rows.Next() {
		var t model.Task
		if err := rows.Scan(&t.ID, &t.UserID, &t.Title, &t.Completed); err != nil {
			return nil, err
		}
		daftar = append(daftar, t)
	}
	return daftar, rows.Err()
}

func (s *Store) ToggleTask(userID, id int64) (model.Task, error) {
	res, err := s.db.Exec(
		`UPDATE tasks SET completed = NOT completed
		 WHERE user_id = ? AND id = ?`, userID, id)
	if err != nil {
		return model.Task{}, err
	}
	if n, _ := res.RowsAffected(); n == 0 {
		return model.Task{}, sql.ErrNoRows
	}
	var t model.Task
	err = s.db.QueryRow(
		"SELECT id, user_id, title, completed FROM tasks WHERE id = ?", id,
	).Scan(&t.ID, &t.UserID, &t.Title, &t.Completed)
	return t, err
}

func (s *Store) HapusTask(userID, id int64) error {
	res, err := s.db.Exec(
		"DELETE FROM tasks WHERE user_id = ? AND id = ?", userID, id)
	if err != nil {
		return err
	}
	if n, _ := res.RowsAffected(); n == 0 {
		return sql.ErrNoRows
	}
	return nil
}

27-docker-cicd-dan-capstone/capstone/cache.go

package main

import (
	"capstone/model"
	"context"
	"encoding/json"
	"fmt"
	"time"

	"github.com/redis/go-redis/v9"
)

type CacheStore struct {
	db    *Store
	redis *redis.Client
}

func (c *CacheStore) DaftarTasks(ctx context.Context, userID int64) ([]model.Task, error) {
	kunci := fmt.Sprintf("tasks:%d", userID)

	data, err := c.redis.Get(ctx, kunci).Bytes()
	if err == nil {
		var daftar []model.Task
		if json.Unmarshal(data, &daftar) == nil {
			return daftar, nil
		}
	}

	daftar, err := c.db.SemuaTasks(userID)
	if err != nil {
		return nil, err
	}
	if data, err := json.Marshal(daftar); err == nil {
		c.redis.Set(ctx, kunci, data, time.Minute)
	}
	return daftar, nil
}

func (c *CacheStore) Invalidasi(ctx context.Context, userID int64) {
	c.redis.Del(ctx, fmt.Sprintf("tasks:%d", userID))
}

27-docker-cicd-dan-capstone/capstone/limiter.go

package main

import (
	"context"
	"fmt"
	"time"

	"github.com/redis/go-redis/v9"
)

type RedisLimiter struct {
	redis *redis.Client
	batas int
}

func (r *RedisLimiter) Izinkan(ctx context.Context, alamat string) (bool, error) {
	kunci := fmt.Sprintf("rate:%s:%d", alamat, time.Now().Unix()/60)
	n, err := r.redis.Incr(ctx, kunci).Result()
	if err != nil {
		return false, err
	}
	if n == 1 {
		r.redis.Expire(ctx, kunci, time.Minute)
	}
	return n <= int64(r.batas), nil
}

27-docker-cicd-dan-capstone/capstone/hub.go

package main

import (
	"sync"

	"github.com/gofiber/contrib/websocket"
)

type Notif struct {
	Pengirim string `json:"pengirim"`
	Teks     string `json:"teks"`
}

type Client struct {
	conn  *websocket.Conn
	kirim chan Notif
}

type Hub struct {
	mu     sync.Mutex
	klien  map[*Client]bool
	siaran chan Notif
}

func HubBaru() *Hub {
	return &Hub{
		klien:  make(map[*Client]bool),
		siaran: make(chan Notif, 64),
	}
}

func (h *Hub) Jalan() {
	for n := range h.siaran {
		h.mu.Lock()
		for k := range h.klien {
			select {
			case k.kirim <- n:
			default:
			}
		}
		h.mu.Unlock()
	}
}

func (h *Hub) Kirim(n Notif) {
	h.siaran <- n
}

func (h *Hub) Gabung(c *Client) {
	h.mu.Lock()
	defer h.mu.Unlock()
	h.klien[c] = true
}

func (h *Hub) Lepas(c *Client) {
	h.mu.Lock()
	defer h.mu.Unlock()
	if h.klien[c] {
		delete(h.klien, c)
		close(c.kirim)
	}
}

func (c *Client) tulis() {
	defer c.conn.Close()
	for n := range c.kirim {
		if err := c.conn.WriteJSON(n); err != nil {
			return
		}
	}
}

func (c *Client) baca(hub *Hub) {
	defer c.conn.Close()
	for {
		var n Notif
		if err := c.conn.ReadJSON(&n); err != nil {
			hub.Lepas(c)
			return
		}
		hub.Kirim(n)
	}
}

27-docker-cicd-dan-capstone/capstone/handlers.go

package main

import (
	"database/sql"
	"errors"
	"fmt"
	"log/slog"
	"strconv"
	"strings"

	"capstone/components"
	"capstone/model"

	"github.com/gofiber/contrib/websocket"
	"github.com/gofiber/fiber/v2"
)

type Handlers struct {
	store  *Store
	cache  *CacheStore
	hub    *Hub
	logger *slog.Logger
}

func (h *Handlers) HalamanLogin(c *fiber.Ctx) error {
	gagal := c.Query("gagal") == "1"
	c.Type("html")
	return components.HalamanLogin(gagal).Render(c.Context(), c.Response().BodyWriter())
}

func (h *Handlers) ProsesLogin(c *fiber.Ctx) error {
	username := strings.TrimSpace(c.FormValue("username"))
	password := c.FormValue("password")
	token, _, err := h.store.Login(username, password)
	if err != nil {
		return c.Redirect("/login?gagal=1")
	}
	c.Cookie(&fiber.Cookie{
		Name: "session", Value: token,
		HTTPOnly: true, SameSite: "Lax", Path: "/",
	})
	return c.Redirect("/")
}

func (h *Handlers) Register(c *fiber.Ctx) error {
	username, ok := model.ValidasiUsername(c.FormValue("username"))
	if !ok {
		return c.Redirect("/login?gagal=2")
	}
	if !model.ValidasiPassword(c.FormValue("password")) {
		return c.Redirect("/login?gagal=2")
	}
	hash, err := hashPassword(c.FormValue("password"))
	if err != nil {
		return c.Redirect("/login?gagal=2")
	}
	if _, err := h.store.Register(username, hash); err != nil {
		return c.Redirect("/login?gagal=2")
	}
	return c.Redirect("/login?daftar=1")
}

func (h *Handlers) WajibLogin(c *fiber.Ctx) error {
	token := c.Cookies("session")
	if token == "" {
		return c.Redirect("/login")
	}
	ses, err := h.store.SessionDariToken(token)
	if err != nil {
		c.ClearCookie("session")
		return c.Redirect("/login")
	}
	user, err := h.store.UserDariID(ses.UserID)
	if err != nil {
		c.ClearCookie("session")
		return c.Redirect("/login")
	}
	c.Locals("user", user)
	c.Locals("csrf", ses.CSRF)
	return c.Next()
}

func (h *Handlers) CekCSRF(c *fiber.Ctx) error {
	kirim := c.FormValue("csrf")
	asli := c.Locals("csrf").(string)
	if kirim == "" || kirim != asli {
		h.logger.Warn("csrf tidak valid")
		return c.Status(fiber.StatusForbidden).SendString("CSRF tidak valid")
	}
	return c.Next()
}

func userDariCtx(c *fiber.Ctx) model.User {
	return c.Locals("user").(model.User)
}

func (h *Handlers) Halaman(c *fiber.Ctx) error {
	user := userDariCtx(c)
	csrf := c.Locals("csrf").(string)
	daftar, err := h.cache.DaftarTasks(c.Context(), user.ID)
	if err != nil {
		h.logger.Error("gagal membaca tugas", "error", err)
		daftar = []model.Task{}
	}
	c.Type("html")
	return components.Halaman(user.Username, daftar, csrf).
		Render(c.Context(), c.Response().BodyWriter())
}

func (h *Handlers) TambahTask(c *fiber.Ctx) error {
	user := userDariCtx(c)
	csrf := c.Locals("csrf").(string)
	judul, ok := model.ValidasiJudul(c.FormValue("title"))
	if !ok {
		c.Status(fiber.StatusBadRequest)
		return c.SendString("judul wajib diisi, maksimal 200 karakter")
	}
	t, err := h.store.TambahTask(user.ID, judul)
	if err != nil {
		h.logger.Error("gagal menambah tugas", "error", err)
		return c.SendStatus(fiber.StatusInternalServerError)
	}
	h.cache.Invalidasi(c.Context(), user.ID)
	h.hub.Kirim(Notif{Pengirim: user.Username, Teks: "menambah tugas: " + t.Title})
	return h.renderDaftar(c, user, csrf)
}

func (h *Handlers) ToggleTask(c *fiber.Ctx) error {
	user := userDariCtx(c)
	csrf := c.Locals("csrf").(string)
	id, err := strconv.ParseInt(c.Params("id"), 10, 64)
	if err != nil {
		return c.SendStatus(fiber.StatusBadRequest)
	}
	t, err := h.store.ToggleTask(user.ID, id)
	if err == sql.ErrNoRows {
		return c.SendStatus(fiber.StatusNotFound)
	}
	if err != nil {
		return c.SendStatus(fiber.StatusInternalServerError)
	}
	h.cache.Invalidasi(c.Context(), user.ID)
	c.Type("html")
	return components.Item(t, csrf).Render(c.Context(), c.Response().BodyWriter())
}

func (h *Handlers) HapusTask(c *fiber.Ctx) error {
	user := userDariCtx(c)
	csrf := c.Locals("csrf").(string)
	id, err := strconv.ParseInt(c.Params("id"), 10, 64)
	if err != nil {
		return c.SendStatus(fiber.StatusBadRequest)
	}
	if err := h.store.HapusTask(user.ID, id); err == sql.ErrNoRows {
		return c.SendStatus(fiber.StatusNotFound)
	} else if err != nil {
		return c.SendStatus(fiber.StatusInternalServerError)
	}
	h.cache.Invalidasi(c.Context(), user.ID)
	return h.renderDaftar(c, user, csrf)
}

func (h *Handlers) renderDaftar(c *fiber.Ctx, user model.User, csrf string) error {
	daftar, err := h.cache.DaftarTasks(c.Context(), user.ID)
	if err != nil {
		daftar = []model.Task{}
	}
	c.Type("html")
	return components.Daftar(daftar, csrf).Render(c.Context(), c.Response().BodyWriter())
}

func (h *Handlers) Logout(c *fiber.Ctx) error {
	if token := c.Cookies("session"); token != "" {
		h.store.Logout(token)
	}
	c.ClearCookie("session")
	return c.Redirect("/login")
}

func (h *Handlers) WebSocket(c *websocket.Conn) {
	klien := &Client{conn: c, kirim: make(chan Notif, 16)}
	h.hub.Gabung(klien)
	defer h.hub.Lepas(klien)

	go klien.tulis()
	klien.baca(h.hub)
}

func (h *Handlers) Health(c *fiber.Ctx) error {
	return c.JSON(fiber.Map{"status": "ok"})
}

var _ = errors.Is
var _ = fmt.Sprintf

27-docker-cicd-dan-capstone/capstone/components/layout.templ

package components

import "fmt"
import "capstone/model"

templ HalamanLogin(gagal bool) {
	<!doctype html>
	<html lang="id">
		<head>
			<meta charset="utf-8"/>
			<meta name="viewport" content="width=device-width,initial-scale=1"/>
			<title>Masuk — Task Manager</title>
			<style>
				body { font-family: system-ui, sans-serif; max-width: 420px; margin: 4rem auto; padding: 0 1rem; }
				label { display: block; margin: .6rem 0 .2rem; }
				input { width: 100%; padding: .45rem; box-sizing: border-box; }
				button { margin-top: 1rem; padding: .5rem 1.2rem; cursor: pointer; }
				.gagal { color: #b00020; }
				.sukses { color: #00796b; }
			</style>
		</head>
		<body>
			<h1>Masuk</h1>
			if gagal {
				<p class="gagal">Username atau password salah / data tidak valid.</p>
			}
			<form method="post" action="/login">
				<label for="username">Username</label>
				<input id="username" name="username" required="true"/>
				<label for="password">Password</label>
				<input id="password" name="password" type="password" required="true"/>
				<button type="submit">Masuk</button>
			</form>
			<hr/>
			<p>Belum punya akun?</p>
			<form method="post" action="/register">
				<label for="r-username">Username</label>
				<input id="r-username" name="username" required="true"/>
				<label for="r-password">Password (min 8)</label>
				<input id="r-password" name="password" type="password" required="true"/>
				<button type="submit">Daftar</button>
			</form>
		</body>
	</html>
}

templ Halaman(username string, tugas []model.Task, csrf string) {
	<!doctype html>
	<html lang="id">
		<head>
			<meta charset="utf-8"/>
			<meta name="viewport" content="width=device-width,initial-scale=1"/>
			<title>Task Manager</title>
			<script src="https://unpkg.com/htmx.org@1.9.12"></script>
			<style>
				body { font-family: system-ui, sans-serif; max-width: 640px; margin: 2rem auto; padding: 0 1rem; }
				.topbar { display: flex; justify-content: space-between; align-items: center; }
				li { margin: .4rem 0; display: flex; gap: .5rem; align-items: center; }
				.selesai { text-decoration: line-through; color: #666; }
				button { cursor: pointer; }
				#notif { border: 1px solid #00add8; border-radius: 8px; padding: .5rem .8rem; background: #eefcff; }
			</style>
		</head>
		<body>
			<div class="topbar">
				<h1>Halo, { username }</h1>
				<form method="post" action="/logout"><button type="submit">Keluar</button></form>
			</div>
			<p id="notif">belum ada notifikasi</p>
			<form hx-post="/tasks" hx-target="#daftar" hx-swap="innerHTML" hx-on::after-request="this.reset()">
				<input type="hidden" name="csrf" value={ csrf }/>
				<input type="text" name="title" required="true"/>
				<button type="submit">Tambah</button>
			</form>
			@Daftar(tugas, csrf)
			<script>
				const ws = new WebSocket("ws://" + location.host + "/ws");
				ws.onmessage = (e) => {
					const n = JSON.parse(e.data);
					document.getElementById("notif").textContent = n.pengirim + ": " + n.teks;
				};
			</script>
		</body>
	</html>
}

templ Daftar(tugas []model.Task, csrf string) {
	<ul id="daftar">
		for _, t := range tugas {
			@Item(t, csrf)
		}
	</ul>
}

templ Item(t model.Task, csrf string) {
	<li id={ fmt.Sprintf("tugas-%d", t.ID) }>
		if t.Completed {
			<span class="selesai">{ t.Title }</span>
		} else {
			<span>{ t.Title }</span>
		}
		<form hx-post={ fmt.Sprintf("/tasks/%d/toggle", t.ID) } hx-target={ fmt.Sprintf("#tugas-%d", t.ID) } hx-swap="outerHTML" style="display:inline">
			<input type="hidden" name="csrf" value={ csrf }/>
			<button type="submit">✓</button>
		</form>
		<form hx-delete={ fmt.Sprintf("/tasks/%d", t.ID) } hx-target="#daftar" hx-swap="innerHTML" style="display:inline">
			<input type="hidden" name="csrf" value={ csrf }/>
			<button type="submit">Hapus</button>
		</form>
	</li>
}

27-docker-cicd-dan-capstone/capstone/main.go

package main

import (
	"database/sql"
	"fmt"
	"log/slog"
	"os"
	"os/signal"
	"syscall"
	"time"

	_ "github.com/go-sql-driver/mysql"
	"github.com/gofiber/contrib/websocket"
	"github.com/gofiber/fiber/v2"
	"github.com/gofiber/fiber/v2/middleware/recover"
	"github.com/redis/go-redis/v9"
)

func bukaDB(url string) (*sql.DB, error) {
	db, err := sql.Open("mysql", url)
	if err != nil {
		return nil, fmt.Errorf("buka db: %w", err)
	}
	if err := db.Ping(); err != nil {
		db.Close()
		return nil, fmt.Errorf("ping db: %w", err)
	}
	return db, nil
}

func NewApp(db *sql.DB, rdb *redis.Client, hub *Hub, logger *slog.Logger) *fiber.App {
	store := &Store{db: db}
	cache := &CacheStore{db: store, redis: rdb}
	limiter := &RedisLimiter{redis: rdb, batas: 60}
	h := &Handlers{store: store, cache: cache, hub: hub, logger: logger}

	app := fiber.New(fiber.Config{ErrorHandler: func(c *fiber.Ctx, err error) error {
		logger.Error("error handler", "error", err, "path", c.Path())
		return c.Status(fiber.StatusInternalServerError).JSON(fiber.Map{"error": "terjadi kesalahan"})
	}})
	app.Use(recover.New())

	app.Get("/health", h.Health)
	app.Get("/login", h.HalamanLogin)
	app.Post("/login", h.ProsesLogin)
	app.Post("/register", h.Register)

	app.Get("/ws", websocket.New(h.WebSocket))

	berlogin := app.Group("", h.WajibLogin)
	berlogin.Get("/", h.Halaman)
	berlogin.Post("/logout", h.Logout)
	berlogin.Post("/tasks", h.CekCSRF, h.TambahTask)
	berlogin.Post("/tasks/:id/toggle", h.CekCSRF, h.ToggleTask)
	berlogin.Delete("/tasks/:id", h.CekCSRF, h.HapusTask)

	_ = limiter
	return app
}

func main() {
	logger := slog.New(slog.NewTextHandler(os.Stdout, nil))
	slog.SetDefault(logger)

	cfg := muatConfig()

	db, err := bukaDB(cfg.DatabaseURL)
	if err != nil {
		logger.Error("database tidak tersedia", "error", err)
		logger.Info("jalankan: docker compose up -d db  atau nyalakan MariaDB lokal (lihat README bab 17)")
		os.Exit(1)
	}
	defer db.Close()

	store := &Store{db: db}
	if err := store.BuatTabel(); err != nil {
		logger.Error("gagal membuat tabel", "error", err)
		os.Exit(1)
	}

	rdb := redis.NewClient(&redis.Options{Addr: cfg.RedisAddr})

	hub := HubBaru()
	go hub.Jalan()

	app := NewApp(db, rdb, hub, logger)

	go func() {
		logger.Info("server berjalan", "port", cfg.Port)
		if err := app.Listen(":" + cfg.Port); err != nil {
			logger.Error("server berhenti", "error", err)
			os.Exit(1)
		}
	}()

	berhenti := make(chan os.Signal, 1)
	signal.Notify(berhenti, os.Interrupt, syscall.SIGTERM)
	<-berhenti

	logger.Info("menutup server dengan tenang...")
	if err := app.ShutdownWithTimeout(10 * time.Second); err != nil {
		logger.Error("shutdown paksa", "error", err)
	}
	logger.Info("server berhenti")
}

27-docker-cicd-dan-capstone/capstone/main_test.go

package main

import (
	"database/sql"
	"encoding/json"
	"io"
	"log/slog"
	"net/http"
	"net/http/httptest"
	"net/url"
	"os"
	"strings"
	"testing"

	"github.com/alicebob/miniredis/v2"
	_ "github.com/go-sql-driver/mysql"
	"github.com/gofiber/fiber/v2"
	"github.com/redis/go-redis/v9"
)

func bukaDBTest(t *testing.T) *sql.DB {
	t.Helper()
	url := os.Getenv("TEST_DATABASE_URL")
	if url == "" {
		t.Skip("TEST_DATABASE_URL tidak diset; lewati test database")
	}
	db, err := bukaDB(url)
	if err != nil {
		t.Fatalf("buka db test: %v", err)
	}
	t.Cleanup(func() { db.Close() })
	store := &Store{db: db}
	if err := store.BuatTabel(); err != nil {
		t.Fatalf("buat tabel: %v", err)
	}
	for _, tabel := range []string{"tasks", "sessions", "users"} {
		db.Exec("TRUNCATE " + tabel)
	}
	return db
}

func redisTest(t *testing.T) *redis.Client {
	t.Helper()
	mr, err := miniredis.Run()
	if err != nil {
		t.Fatal(err)
	}
	t.Cleanup(mr.Close)
	return redis.NewClient(&redis.Options{Addr: mr.Addr()})
}

func appTest(t *testing.T) (*fiber.App, *Hub) {
	t.Helper()
	db := bukaDBTest(t)
	rdb := redisTest(t)
	hub := HubBaru()
	go hub.Jalan()
	logger := slog.New(slog.NewTextHandler(io.Discard, nil))
	app := NewApp(db, rdb, hub, logger)
	return app, hub
}

func registerDanLogin(t *testing.T, app *fiber.App) (string, string) {
	t.Helper()

	form := url.Values{"username": {"rani"}, "password": {"rahasia123"}}
	req := httptest.NewRequest(fiber.MethodPost, "/register", strings.NewReader(form.Encode()))
	req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
	resp, err := app.Test(req)
	if err != nil {
		t.Fatal(err)
	}
	if resp.StatusCode != fiber.StatusFound {
		t.Fatalf("register ingin redirect, dapat %d", resp.StatusCode)
	}

	req = httptest.NewRequest(fiber.MethodPost, "/login", strings.NewReader(form.Encode()))
	req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
	resp, err = app.Test(req)
	if err != nil {
		t.Fatal(err)
	}
	session := ""
	for _, ck := range resp.Cookies() {
		if ck.Name == "session" {
			session = ck.Value
		}
	}
	if session == "" {
		t.Fatal("cookie session tidak ada")
	}

	// Ambil CSRF dari halaman.
	req = httptest.NewRequest(fiber.MethodGet, "/", nil)
	req.AddCookie(&http.Cookie{Name: "session", Value: session})
	resp, err = app.Test(req)
	if err != nil {
		t.Fatal(err)
	}
	body, _ := io.ReadAll(resp.Body)
	i := strings.Index(string(body), `name="csrf" value="`)
	if i < 0 {
		t.Fatalf("csrf tidak ada: %s", body)
	}
	rest := string(body)[i+len(`name="csrf" value="`):]
	j := strings.Index(rest, `"`)
	return session, rest[:j]
}

func TestAlurWebLengkap(t *testing.T) {
	app, _ := appTest(t)
	session, csrf := registerDanLogin(t, app)

	// Tambah tugas (dengan CSRF).
	form := url.Values{"title": {"Belajar capstone"}, "csrf": {csrf}}
	req := httptest.NewRequest(fiber.MethodPost, "/tasks", strings.NewReader(form.Encode()))
	req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
	req.AddCookie(&http.Cookie{Name: "session", Value: session})
	resp, err := app.Test(req)
	if err != nil {
		t.Fatal(err)
	}
	if resp.StatusCode != fiber.StatusOK {
		t.Fatalf("tambah ingin 200, dapat %d", resp.StatusCode)
	}
	body, _ := io.ReadAll(resp.Body)
	if !strings.Contains(string(body), "Belajar capstone") {
		t.Fatalf("tugas tidak tampil: %s", body)
	}

	// Tanpa CSRF -> ditolak.
	form = url.Values{"title": {"tanpa csrf"}}
	req = httptest.NewRequest(fiber.MethodPost, "/tasks", strings.NewReader(form.Encode()))
	req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
	req.AddCookie(&http.Cookie{Name: "session", Value: session})
	resp, err = app.Test(req)
	if err != nil {
		t.Fatal(err)
	}
	if resp.StatusCode != fiber.StatusForbidden {
		t.Fatalf("tanpa csrf ingin 403, dapat %d", resp.StatusCode)
	}

	// Hapus tugas.
	req = httptest.NewRequest(fiber.MethodDelete, "/tasks/1", strings.NewReader("csrf="+csrf))
	req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
	req.AddCookie(&http.Cookie{Name: "session", Value: session})
	resp, err = app.Test(req)
	if err != nil {
		t.Fatal(err)
	}
	if resp.StatusCode != fiber.StatusOK {
		t.Fatalf("hapus ingin 200, dapat %d", resp.StatusCode)
	}
}

func TestHealth(t *testing.T) {
	app, _ := appTest(t)
	req := httptest.NewRequest(fiber.MethodGet, "/health", nil)
	resp, err := app.Test(req)
	if err != nil {
		t.Fatal(err)
	}
	if resp.StatusCode != fiber.StatusOK {
		t.Fatalf("ingin 200, dapat %d", resp.StatusCode)
	}
	var hasil map[string]string
	json.NewDecoder(resp.Body).Decode(&hasil)
	if hasil["status"] != "ok" {
		t.Fatalf("status tidak sesuai: %v", hasil)
	}
}

func TestNotifikasiTerpusat(t *testing.T) {
	_, hub := appTest(t)
	terima := make(chan Notif, 1)
	klien := &Client{conn: nil, kirim: make(chan Notif, 4)}
	hub.Gabung(klien)
	go func() {
		for n := range klien.kirim {
			terima <- n
			return
		}
	}()
	hub.Kirim(Notif{Pengirim: "rani", Teks: "menambah tugas"})
	n := <-terima
	if n.Pengirim != "rani" {
		t.Fatalf("notifikasi tidak sampai: %+v", n)
	}
	hub.Lepas(klien)
}

Jelaskan dua tahap pada Dockerfile multi-stage dan manfaatnya (ukuran image dan keamanan).

Kenapa di dalam compose.yaml, DATABASE_URL memakai host db bukan 127.0.0.1? Apa yang terjadi kalau kita salah menulis host?

Dalam workflow GitHub Actions, kenapa MariaDB didefinisikan sebagai services, bukan di-install di dalam job? Apa keuntungannya untuk test database?