first commit

internal/master/role/permission/service.go

@@ -0,0 +1,880 @@
+package permission
+
+import (
+	"context"
+	"crypto/sha256"
+	"encoding/hex"
+	"encoding/json"
+	"fmt"
+	"service/pkg/errors"
+	"service/pkg/logger"
+	"service/pkg/utils/query"
+	"strings"
+	"time"
+
+	"gorm.io/gorm"
+
+	// Import pages entity untuk referensi
+	"service/internal/infrastructure/cache"
+	rolePages "service/internal/master/role/pages"
+)
+
+type Service interface {
+	GetList(ctx context.Context, limit, offset int, sorts []string, activeFilter *bool) (map[string]interface{}, error)
+	GetDetail(ctx context.Context, id int64) (*RolPermissionResponse, error)
+	Search(ctx context.Context, filters map[string]interface{}, sorts []string, limit, offset int) (map[string]interface{}, error)
+	Create(ctx context.Context, req RolPermissionRequest) (*RolPermissionResponse, error)
+	Update(ctx context.Context, id int64, req RolPermissionRequest) (*RolPermissionResponse, error)
+	Delete(ctx context.Context, id int64) error
+	GetByRoleAndGroup(ctx context.Context, roleKeycloak string, groupKeycloak []string, fkRolPagesId int64) (*RolPermissionResponse, error)
+	GetByRoleAndPages(ctx context.Context, roleKeycloak string, fkRolPagesIds []int64) ([]*RolPermissionResponse, error)
+	GetRolePermissionTree(ctx context.Context, roleKeycloak string, groupKeycloak []string, activeOnly *bool) (*RolePermissionTreeResponse, error)
+	GetRolePermissionTreeRole(ctx context.Context, roleKeycloak string, activeOnly *bool) (*RolePermissionTreeResponse, error)
+	GetRolePagesList(ctx context.Context, roleKeycloak string, limit, offset int, activeOnly *bool) (map[string]interface{}, error)
+}
+
+type service struct {
+	cmdRepo   CommandRepository
+	queryRepo QueryRepository
+	cache     *cache.Manager
+}
+
+func NewService(cmdRepo CommandRepository, queryRepo QueryRepository, pagesRepo rolePages.QueryRepository, cacheManager *cache.Manager) Service {
+	return &service{cmdRepo: cmdRepo, queryRepo: queryRepo, cache: cacheManager}
+}
+
+func (s *service) GetList(ctx context.Context, limit, offset int, sorts []string, activeFilter *bool) (map[string]interface{}, error) {
+	filters := map[string]interface{}{}
+	if activeFilter != nil {
+		filters["active"] = *activeFilter
+	}
+
+	// Gunakan kapabilitas method Search agar filter dynamic & cache ikut ter-handle dengan efisien
+	return s.Search(ctx, filters, sorts, limit, offset)
+}
+
+func (s *service) GetDetail(ctx context.Context, id int64) (*RolPermissionResponse, error) {
+	if id <= 0 {
+		return nil, errors.NewValidationError().Message("Invalid ID").Metadata("id", id).Build()
+	}
+
+	entity, err := s.queryRepo.FindByID(ctx, id)
+	if err != nil {
+		return nil, errors.InternalError().Message("Failed to retrieve RolPermission detail").Cause(err).Build()
+	}
+	if entity == nil {
+		return nil, errors.NotFoundError().Message("RolPermission not found").Metadata("id", id).Build()
+	}
+
+	return mapEntityToResponse(entity), nil
+}
+
+func (s *service) Search(ctx context.Context, filters map[string]interface{}, sorts []string, limit, offset int) (map[string]interface{}, error) {
+	if limit == 0 {
+		limit = 10
+	} else if limit < -1 || limit > 100 {
+		limit = 10
+	}
+	if offset < 0 {
+		offset = 0
+	}
+
+	// --- 1. Implementasi Caching (Check) ---
+	filterBytes, _ := json.Marshal(filters)
+	sortBytes, _ := json.Marshal(sorts)
+	// Membuat string gabungan dari filter, sort, dan pagination, lalu di-hash dengan SHA-256
+	hashInput := fmt.Sprintf("%s|%s|%d|%d", string(filterBytes), string(sortBytes), limit, offset)
+	hash := sha256.Sum256([]byte(hashInput))
+	cacheKey := fmt.Sprintf("role_permission_search_v2:%s", hex.EncodeToString(hash[:]))
+
+	if s.cache != nil {
+		var strData string
+		if err := s.cache.Get(ctx, cacheKey, &strData); err == nil && strData != "" {
+			var cachedData struct {
+				Data   []*RolPermissionResponse `json:"data"`
+				Total  int64                    `json:"total"`
+				Limit  int                      `json:"limit"`
+				Offset int                      `json:"offset"`
+			}
+			if err := json.Unmarshal([]byte(strData), &cachedData); err == nil {
+				logger.Default().Debug("Cache hit for Role Permission Search", logger.String("key", cacheKey))
+				return map[string]interface{}{
+					"data":   cachedData.Data,
+					"total":  cachedData.Total,
+					"limit":  cachedData.Limit,
+					"offset": cachedData.Offset,
+				}, nil
+			}
+		}
+	}
+
+	// Konversi sorts string ke SortField
+	var sortFields []query.SortField
+	for _, sort := range sorts {
+		if sort == "" {
+			continue
+		}
+
+		// Default ASC, tandai dengan - untuk DESC
+		order := "ASC"
+		column := sort
+		if strings.HasPrefix(sort, "-") {
+			order = "DESC"
+			column = strings.TrimPrefix(sort, "-")
+		} else if strings.HasPrefix(sort, "+") {
+			column = strings.TrimPrefix(sort, "+")
+		}
+
+		// Validasi kolom yang diizinkan (lowercase untuk mapping)
+		allowedColumns := map[string]bool{
+			"id":               true,
+			"create":           true,
+			"read":             true,
+			"update":           true,
+			"disable":          true,
+			"delete":           true,
+			"active":           true,
+			"fk_rol_pages_id":  true,
+			"role_keycloak":    true,
+			"group_keycloak":   true,
+			"created_at":       true,
+			"role_master_name": true,
+		}
+
+		if allowedColumns[column] {
+			sortFields = append(sortFields, query.SortField{
+				Column: column,
+				Order:  order,
+			})
+		}
+	}
+
+	// Jika tidak ada sort yang valid, gunakan default
+	if len(sortFields) == 0 {
+		sortFields = []query.SortField{query.CreateAscSort("id")}
+	}
+
+	entities, total, err := s.queryRepo.Search(ctx, filters, sortFields, limit, offset)
+	if err != nil {
+		return nil, errors.InternalError().Message("Failed to search RolPermissions").Cause(err).Build()
+	}
+
+	responses := make([]*RolPermissionResponse, len(entities))
+	for i, entity := range entities {
+		responses[i] = mapEntityToResponse(&entity)
+	}
+
+	responseMap := map[string]interface{}{
+		"data": responses, "total": total, "limit": limit, "offset": offset,
+	}
+
+	// --- 2. Implementasi Caching (Set) ---
+	if s.cache != nil {
+		if bytes, err := json.Marshal(responseMap); err == nil {
+			// TTL 5 menit untuk data search
+			_ = s.cache.Set(ctx, cacheKey, string(bytes), 5*time.Minute)
+		}
+	}
+
+	return responseMap, nil
+}
+
+func (s *service) Create(ctx context.Context, req RolPermissionRequest) (*RolPermissionResponse, error) {
+	// Validasi input
+	if req.FkRolPagesId <= 0 {
+		return nil, errors.NewValidationError().Message("Page ID is required").Metadata("fk_rol_pages_id", req.FkRolPagesId).Build()
+	}
+	if req.RoleKeycloak == "" && req.GroupKeycloak == "" {
+		return nil, errors.NewValidationError().Message("Role or Group must be provided").Build()
+	}
+
+	entity := mapRequestToEntity(req)
+	if err := s.cmdRepo.Create(ctx, entity); err != nil {
+		if errors.Is(err, gorm.ErrDuplicatedKey) {
+			return nil, errors.AlreadyExistsError().Message("RolPermission with this identifier already exists").Cause(err).Build()
+		}
+		return nil, errors.InternalError().Message("Failed to create RolPermission").Cause(err).Build()
+	}
+	// Re-fetch to get the complete created entity
+	createdEntity, err := s.queryRepo.FindByID(ctx, entity.Id)
+	if err != nil {
+		return nil, errors.InternalError().Message("Failed to retrieve newly created RolPermission").Cause(err).Build()
+	}
+
+	// Invalidate cache setelah create permission baru
+	if s.cache != nil {
+		// Perhatian: Jika cache.Manager Anda tidak mendukung wildcard Delete secara native,
+		// Anda mungkin perlu memanggil metode s.cache.DeleteByPrefix atau menghapus key spesifik.
+		cacheKeyPattern := fmt.Sprintf("permission_tree:%s:*", req.RoleKeycloak)
+		_ = s.cache.Delete(ctx, cacheKeyPattern)
+		// Hapus juga cache list agar data terbaru langsung tampil
+		_ = s.cache.Delete(ctx, "role_permission_list:*")
+		// Hapus juga cache search
+		_ = s.cache.Delete(ctx, "role_permission_search_v2:*")
+	}
+
+	return mapEntityToResponse(createdEntity), nil
+}
+
+func (s *service) Update(ctx context.Context, id int64, req RolPermissionRequest) (*RolPermissionResponse, error) {
+	if id <= 0 {
+		return nil, errors.NewValidationError().Message("Invalid ID").Metadata("id", id).Build()
+	}
+
+	// Cek apakah record ada
+	existing, err := s.queryRepo.FindByID(ctx, id)
+	if err != nil {
+		return nil, errors.InternalError().Message("Failed to retrieve RolPermission").Cause(err).Build()
+	}
+	if existing == nil {
+		return nil, errors.NotFoundError().Message("RolPermission not found").Metadata("id", id).Build()
+	}
+
+	// Simpan role lama untuk invalidasi cache
+	oldRoleKeycloak := existing.RoleKeycloak
+
+	// Update entity dengan data dari request
+	// existing.Create = req.Create
+	// existing.Read = req.Read
+	// existing.Update = req.Update
+	// existing.Disable = req.Disable
+	// existing.Delete = req.Delete
+	// existing.Active = req.Active
+	// existing.FkRolPagesId = req.FkRolPagesId
+	// existing.RoleKeycloak = req.RoleKeycloak
+	// existing.GroupKeycloak = req.GroupKeycloak
+
+	if err := s.cmdRepo.Update(ctx, existing); err != nil {
+		if errors.Is(err, gorm.ErrDuplicatedKey) {
+			return nil, errors.AlreadyExistsError().Message("RolPermission with this identifier already exists").Cause(err).Build()
+		}
+		return nil, errors.InternalError().Message("Failed to update RolPermission").Cause(err).Build()
+	}
+
+	// Invalidate cache
+	if s.cache != nil {
+		// Invalidate cache untuk role lama dan baru jika berbeda
+		if oldRoleKeycloak != "" {
+			_ = s.cache.Delete(ctx, fmt.Sprintf("permission_tree:%s:*", oldRoleKeycloak))
+		}
+		if existing.RoleKeycloak != "" && existing.RoleKeycloak != oldRoleKeycloak {
+			_ = s.cache.Delete(ctx, fmt.Sprintf("permission_tree:%s:*", existing.RoleKeycloak))
+		}
+		// Invalidate cache list dan search
+		_ = s.cache.Delete(ctx, "role_permission_list:*")
+		_ = s.cache.Delete(ctx, "role_permission_search_v2:*")
+	}
+
+	return mapEntityToResponse(existing), nil
+}
+
+func (s *service) Delete(ctx context.Context, id int64) error {
+	if id <= 0 {
+		return errors.NewValidationError().Message("Invalid ID").Metadata("id", id).Build()
+	}
+
+	// Cek apakah record ada untuk mendapatkan roleKeycloak sebelum dihapus
+	existing, err := s.queryRepo.FindByID(ctx, id)
+	if err != nil {
+		return errors.InternalError().Message("Failed to retrieve RolPermission before deletion").Cause(err).Build()
+	}
+	if existing == nil {
+		// Jika sudah tidak ada, anggap operasi berhasil (idempotent)
+		return nil
+	}
+
+	if err := s.cmdRepo.Delete(ctx, id); err != nil {
+		return errors.InternalError().Message("Failed to delete RolPermission").Cause(err).Build()
+	}
+
+	// Invalidate cache
+	if s.cache != nil {
+		if existing.RoleKeycloak != "" {
+			_ = s.cache.Delete(ctx, fmt.Sprintf("permission_tree:%s:*", existing.RoleKeycloak))
+		}
+		// Invalidate cache list dan search
+		_ = s.cache.Delete(ctx, "role_permission_list:*")
+		_ = s.cache.Delete(ctx, "role_permission_search_v2:*")
+	}
+
+	return nil
+}
+
+func (s *service) GetByRoleAndGroup(ctx context.Context, roleKeycloak string, groupKeycloak []string, fkRolPagesId int64) (*RolPermissionResponse, error) {
+	if roleKeycloak == "" {
+		return nil, errors.NewValidationError().Message("Role must be provided").Build()
+	}
+	if fkRolPagesId <= 0 {
+		return nil, errors.NewValidationError().Message("Invalid page ID").Build()
+	}
+
+	entity, err := s.queryRepo.FindByRoleAndGroup(ctx, roleKeycloak, groupKeycloak)
+	if err != nil {
+		return nil, errors.InternalError().Message("Failed to retrieve permission by role and group").Cause(err).Build()
+	}
+	// Cek jika tidak ada permission yang ditemukan
+	if len(entity) == 0 {
+		return nil, errors.NotFoundError().Message("Permission not found for role and group").Build()
+	}
+
+	// Untuk saat ini, kita kembalikan data pertama yang ditemukan.
+	// Anda mungkin perlu logika tambahan jika ada lebih dari satu hasil.
+	response := mapEntityToResponse(entity[0])
+	return response, nil
+}
+
+// Helper function to build page access tree
+func buildPageAccessTree(pages []rolePages.RolPages, permissionMap map[int64]*RolPermission) []*PageAccess {
+	pageMap := make(map[int64]*PageAccess)
+	var roots []*PageAccess
+
+	// Convert all pages to PageAccess
+	for i := 0; i < len(pages); i++ {
+		page := &pages[i]
+		access := &PageAccess{
+			Id:     page.Id,
+			Name:   page.Name,
+			Icon:   page.Icon,
+			URL:    page.URL,
+			Level:  page.Level,
+			Sort:   page.Sort,
+			Active: page.Active,
+		}
+
+		// Add permission if exists
+		if perm, exists := permissionMap[page.Id]; exists {
+			access.Permission = &PermissionDetail{
+				Create:  perm.Create,
+				Read:    perm.Read,
+				Update:  perm.Update,
+				Delete:  perm.Delete,
+				Disable: perm.Disable,
+			}
+			access.Group = perm.GroupKeycloak
+		}
+
+		pageMap[page.Id] = access
+	}
+
+	// Build parent-child relationships
+	for i := range pages {
+		page := &pages[i]
+		if page.Parent == nil {
+			roots = append(roots, pageMap[page.Id])
+		} else {
+			if parent, exists := pageMap[*page.Parent]; exists {
+				parent.Children = append(parent.Children, pageMap[page.Id])
+			}
+		}
+	}
+
+	// Sort children by sort order
+	for _, access := range pageMap {
+		if len(access.Children) > 0 {
+			sortPageAccessChildren(access.Children)
+		}
+	}
+
+	// Sort roots by sort order
+	sortPageAccessChildren(roots)
+
+	return roots
+}
+
+func sortPageAccessChildren(children []*PageAccess) {
+	for i := 0; i < len(children); i++ {
+		for j := i + 1; j < len(children); j++ {
+			if children[i].Sort > children[j].Sort {
+				children[i], children[j] = children[j], children[i]
+			}
+		}
+	}
+}
+
+// convertPageAccessToAccessTree converts []*PageAccess to []*AccessTreeItem
+func convertPageAccessToAccessTree(pageAccess []*PageAccess) []*AccessTreeItem {
+	result := make([]*AccessTreeItem, len(pageAccess))
+	for i, access := range pageAccess {
+		result[i] = &AccessTreeItem{
+			ID:       access.Id,
+			Name:     access.Name,
+			Icon:     access.Icon,
+			URL:      access.URL,
+			Group:    access.Group,
+			Level:    int(access.Level),
+			Sort:     int(access.Sort),
+			Active:   access.Active,
+			Children: convertPageAccessToAccessTree(access.Children),
+		}
+
+		// Convert permission if exists
+		if access.Permission != nil {
+			result[i].Permission = &PermissionResponse{
+				Id:      access.Id,
+				Create:  access.Permission.Create,
+				Read:    access.Permission.Read,
+				Update:  access.Permission.Update,
+				Delete:  access.Permission.Delete,
+				Disable: access.Permission.Disable,
+			}
+		}
+	}
+	return result
+}
+
+// buildPermissionTreeHierarchy builds permission tree hierarchy from pages and permissions
+func buildPermissionTreeHierarchy(pages []rolePages.RolPages, permissionMap map[int64]*RolPermission) []*PermissionAccessItem {
+	pageMap := make(map[int64]*PermissionAccessItem)
+	var roots []*PermissionAccessItem
+
+	// Convert all pages to PermissionAccessItem
+	for i := 0; i < len(pages); i++ {
+		page := &pages[i]
+		access := &PermissionAccessItem{
+			Id:     page.Id,
+			Name:   page.Name,
+			Icon:   page.Icon,
+			URL:    page.URL,
+			Level:  page.Level,
+			Sort:   page.Sort,
+			Active: page.Active,
+		}
+
+		// Add permission if exists
+		if perm, exists := permissionMap[page.Id]; exists {
+			access.Permission = &PermissionDetail{
+				Create:  perm.Create,
+				Read:    perm.Read,
+				Update:  perm.Update,
+				Delete:  perm.Delete,
+				Disable: perm.Disable,
+			}
+		}
+
+		pageMap[page.Id] = access
+	}
+
+	// Build parent-child relationships
+	for i := 0; i < len(pages); i++ {
+		page := &pages[i]
+		if page.Parent == nil {
+			roots = append(roots, pageMap[page.Id])
+		} else {
+			if parent, exists := pageMap[*page.Parent]; exists {
+				parent.Children = append(parent.Children, pageMap[page.Id])
+			}
+		}
+	}
+
+	// Sort children by sort order
+	for _, access := range pageMap {
+		if len(access.Children) > 0 {
+			sortPermissionAccessChildren(access.Children)
+		}
+	}
+
+	// Sort roots by sort order
+	sortPermissionAccessChildren(roots)
+
+	return roots
+}
+
+func sortPermissionAccessChildren(children []*PermissionAccessItem) {
+	for i := 0; i < len(children); i++ {
+		for j := i + 1; j < len(children); j++ {
+			if children[i].Sort > children[j].Sort {
+				children[i], children[j] = children[j], children[i]
+			}
+		}
+	}
+}
+
+func (s *service) GetByRoleAndPages(ctx context.Context, roleKeycloak string, fkRolPagesIds []int64) ([]*RolPermissionResponse, error) {
+	if roleKeycloak == "" {
+		return nil, errors.NewValidationError().Message("Role must be provided").Build()
+	}
+	if len(fkRolPagesIds) == 0 {
+		return nil, errors.NewValidationError().Message("Page IDs must be provided").Build()
+	}
+
+	entities, err := s.queryRepo.FindByRoleAndPages(ctx, roleKeycloak, fkRolPagesIds)
+	if err != nil {
+		return nil, errors.InternalError().Message("Failed to retrieve permissions by role and pages").Cause(err).Build()
+	}
+
+	responses := make([]*RolPermissionResponse, len(entities))
+	for i, entity := range entities {
+		responses[i] = mapEntityToResponse(entity)
+	}
+
+	return responses, nil
+}
+
+func (s *service) GetRolePermissionTree(ctx context.Context, roleKeycloak string, groupKeycloak []string, activeOnly *bool) (*RolePermissionTreeResponse, error) {
+	if roleKeycloak == "" && len(groupKeycloak) == 0 {
+		return nil, errors.NewValidationError().Message("Role or group must be provided").Build()
+	}
+
+	// --- 1. Implementasi Caching (Check) ---
+	var activeStr string
+	if activeOnly != nil {
+		activeStr = fmt.Sprintf("%v", *activeOnly)
+	} else {
+		activeStr = "all"
+	}
+
+	cacheKey := fmt.Sprintf("permission_tree:%s:%s:%s", roleKeycloak, strings.Join(groupKeycloak, "_"), activeStr)
+
+	if s.cache != nil {
+		var strData string
+		if err := s.cache.Get(ctx, cacheKey, &strData); err == nil && strData != "" {
+			var cachedResponse RolePermissionTreeResponse
+			if err := json.Unmarshal([]byte(strData), &cachedResponse); err == nil {
+				logger.Default().Debug("Cache hit for Role Permission Tree", logger.String("key", cacheKey))
+				return &cachedResponse, nil
+			}
+		}
+	}
+
+	// Gunakan query JOIN yang lebih efisien
+	permissionsWithPages, err := s.queryRepo.FindPermissionsWithPages(ctx, roleKeycloak, groupKeycloak, activeOnly)
+	if err != nil {
+		return nil, errors.InternalError().Message("Failed to retrieve permissions with pages").Cause(err).Build()
+	}
+
+	// Jika tidak ada hasil, return empty
+	if len(permissionsWithPages) == 0 {
+		return &RolePermissionTreeResponse{
+			Success: true,
+			Data: RolePermissionData{
+				Role: roleKeycloak,
+				// Group:  groupKeycloak,
+				Access: []*AccessTreeItem{},
+			},
+		}, nil
+	}
+
+	// Konversi hasil JOIN ke struct pages dan permissions
+	var pages []rolePages.RolPages
+	pageMap := make(map[int64]bool)
+	permissionMap := make(map[int64]*RolPermission)
+
+	for _, permPage := range permissionsWithPages {
+		// Buat atau dapatkan page
+		if !pageMap[permPage.FkRolPagesId] {
+			page := rolePages.RolPages{
+				Id:     permPage.FkRolPagesId,
+				Name:   permPage.PageName,
+				URL:    permPage.PageUrl,
+				Level:  int16(permPage.PageLevel),
+				Sort:   int16(permPage.PageSort),
+				Active: permPage.PageActive,
+				Icon:   permPage.PageIcon,
+			}
+			if permPage.PageParentId != nil {
+				page.Parent = permPage.PageParentId
+			}
+			pages = append(pages, page)
+			pageMap[permPage.FkRolPagesId] = true
+		}
+
+		// Buat permission
+		permission := &RolPermission{
+			Id:            permPage.Id,
+			Create:        permPage.Create,
+			Read:          permPage.Read,
+			Update:        permPage.Update,
+			Disable:       permPage.Disable,
+			Delete:        permPage.Delete,
+			Active:        permPage.Active,
+			FkRolPagesId:  permPage.FkRolPagesId,
+			RoleKeycloak:  permPage.RoleKeycloak,
+			GroupKeycloak: permPage.GroupKeycloak,
+			CreatedAt:     permPage.CreatedAt,
+			UpdatedAt:     permPage.UpdatedAt,
+		}
+		permissionMap[permPage.FkRolPagesId] = permission
+	}
+
+	// Build tree dengan pages yang sudah diurutkan
+	access := buildPageAccessTree(pages, permissionMap)
+
+	// Convert to proper response format
+	accessTree := convertPageAccessToAccessTree(access)
+
+	// Ambil group_keycloak yang sebenarnya dari data permission (jika ada)
+	var actualGroup []string
+	if len(permissionsWithPages) > 0 {
+		// Kumpulkan semua group_keycloak yang unik
+		groupMap := make(map[string]bool)
+		for _, permPage := range permissionsWithPages {
+			if permPage.GroupKeycloak != "" {
+				groupMap[permPage.GroupKeycloak] = true
+			}
+		}
+		// Konversi map ke slice
+		for group := range groupMap {
+			actualGroup = append(actualGroup, group)
+		}
+	}
+
+	response := &RolePermissionTreeResponse{
+		Success: true,
+		Data: RolePermissionData{
+			Role: roleKeycloak,
+			// Group:  actualGroup,
+			Access: accessTree,
+		},
+	}
+
+	// --- 2. Implementasi Caching (Set) ---
+	if s.cache != nil {
+		if bytes, err := json.Marshal(response); err == nil {
+			// Simpan ke cache dengan TTL 1 jam (Dapat disesuaikan)
+			_ = s.cache.Set(ctx, cacheKey, string(bytes), 1*time.Hour)
+		}
+	}
+
+	return response, nil
+}
+
+func (s *service) GetRolePagesList(ctx context.Context, roleKeycloak string, limit, offset int, activeOnly *bool) (map[string]interface{}, error) {
+	// 1. Inisiasi Limit & Offset standar
+	if limit == 0 {
+		limit = 10
+	} else if limit < -1 || limit > 100 {
+		limit = 10
+	}
+	if offset < 0 {
+		offset = 0
+	}
+
+	// 2. Fetch dataAll: semua role pages aktif beserta permission mapping (query FindActivePagesWithPermission)
+	isActive := true
+	if activeOnly != nil {
+		isActive = *activeOnly
+	}
+	dataAllRecords, err := s.queryRepo.FindActivePagesWithPermission(ctx, isActive)
+	if err != nil {
+		return nil, errors.InternalError().Message("Failed to retrieve active pages for dataAll").Cause(err).Build()
+	}
+
+	var allPages []rolePages.RolPages
+	allPageMap := make(map[int64]bool)
+	allPermissionMap := make(map[int64]*RolPermission)
+	for _, permPage := range dataAllRecords {
+		if !allPageMap[permPage.FkRolPagesId] {
+			page := rolePages.RolPages{
+				Id:     permPage.FkRolPagesId,
+				Name:   permPage.PageName,
+				URL:    permPage.PageUrl,
+				Level:  int16(permPage.PageLevel),
+				Sort:   int16(permPage.PageSort),
+				Active: permPage.PageActive,
+				Icon:   permPage.PageIcon,
+			}
+			if permPage.PageParentId != nil {
+				page.Parent = permPage.PageParentId
+			}
+			allPages = append(allPages, page)
+			allPageMap[permPage.FkRolPagesId] = true
+		}
+		allPermissionMap[permPage.FkRolPagesId] = &RolPermission{
+			Id:            permPage.Id,
+			Create:        permPage.Create,
+			Read:          permPage.Read,
+			Update:        permPage.Update,
+			Delete:        permPage.Delete,
+			Disable:       permPage.Disable,
+			GroupKeycloak: permPage.GroupKeycloak,
+			RoleKeycloak:  permPage.RoleKeycloak,
+		}
+	}
+	accessAll := buildPageAccessTree(allPages, allPermissionMap)
+	accessTreeAll := convertPageAccessToAccessTree(accessAll)
+
+	// 3. Fetch seluruh role permission berserta info pages-nya (dengan filter roleKeycloak spesifik)
+	permissionsWithPages, err := s.queryRepo.FindPermissionsWithRole(ctx, roleKeycloak, activeOnly)
+	if err != nil {
+		return nil, errors.InternalError().Message("Failed to retrieve permissions with pages").Cause(err).Build()
+	}
+
+	var pages []rolePages.RolPages
+	pageMap := make(map[int64]bool)
+	permissionMap := make(map[int64]*RolPermission)
+
+	for _, permPage := range permissionsWithPages {
+		if !pageMap[permPage.FkRolPagesId] {
+			page := rolePages.RolPages{
+				Id:     permPage.FkRolPagesId,
+				Name:   permPage.PageName,
+				URL:    permPage.PageUrl,
+				Level:  int16(permPage.PageLevel),
+				Sort:   int16(permPage.PageSort),
+				Active: permPage.PageActive,
+				Icon:   permPage.PageIcon,
+			}
+			if permPage.PageParentId != nil {
+				page.Parent = permPage.PageParentId
+			}
+			pages = append(pages, page)
+			pageMap[permPage.FkRolPagesId] = true
+		}
+
+		permissionMap[permPage.FkRolPagesId] = &RolPermission{
+			Id:            permPage.Id,
+			Create:        permPage.Create,
+			Read:          permPage.Read,
+			Update:        permPage.Update,
+			Delete:        permPage.Delete,
+			Disable:       permPage.Disable,
+			GroupKeycloak: permPage.GroupKeycloak,
+			RoleKeycloak:  permPage.RoleKeycloak,
+		}
+	}
+
+	// Build tree menggunakan helper yang telah ada
+	access := buildPageAccessTree(pages, permissionMap)
+	accessTree := convertPageAccessToAccessTree(access)
+
+	data := []*RolePageAccessResponse{
+		{
+			RoleID:   roleKeycloak,
+			DataRole: accessTree,
+			DataAll:  accessTreeAll,
+		},
+	}
+
+	return map[string]interface{}{
+		"data":   data,
+		"total":  int64(1),
+		"limit":  limit,
+		"offset": offset,
+	}, nil
+}
+
+func (s *service) GetRolePermissionTreeRole(ctx context.Context, roleKeycloak string, activeOnly *bool) (*RolePermissionTreeResponse, error) {
+
+	// --- 1. Implementasi Caching (Check) ---
+	var activeStr string
+	if activeOnly != nil {
+		activeStr = fmt.Sprintf("%v", *activeOnly)
+	} else {
+		activeStr = "all"
+	}
+
+	cacheKey := fmt.Sprintf("permission_tree:%s:%s", roleKeycloak, activeStr)
+
+	if s.cache != nil {
+		var strData string
+		if err := s.cache.Get(ctx, cacheKey, &strData); err == nil && strData != "" {
+			var cachedResponse RolePermissionTreeResponse
+			if err := json.Unmarshal([]byte(strData), &cachedResponse); err == nil {
+				logger.Default().Debug("Cache hit for Role Permission Tree", logger.String("key", cacheKey))
+				return &cachedResponse, nil
+			}
+		}
+	}
+
+	// Gunakan query JOIN yang lebih efisien
+	// permissionsWithPages, err := s.queryRepo.FindPermissionsWithPages(ctx, roleKeycloak, groupKeycloak, activeOnly)
+	permissionsWithPages, err := s.queryRepo.FindPermissionsWithRole(ctx, roleKeycloak, activeOnly)
+	if err != nil {
+		return nil, errors.InternalError().Message("Failed to retrieve permissions with pages").Cause(err).Build()
+	}
+
+	// Jika tidak ada hasil, return empty
+	if len(permissionsWithPages) == 0 {
+		return &RolePermissionTreeResponse{
+			Success: true,
+			Data: RolePermissionData{
+				Role: roleKeycloak,
+				// Group:  groupKeycloak,
+				Access: []*AccessTreeItem{},
+			},
+		}, nil
+	}
+
+	// Konversi hasil JOIN ke struct pages dan permissions
+	var pages []rolePages.RolPages
+	pageMap := make(map[int64]bool)
+	permissionMap := make(map[int64]*RolPermission)
+
+	for _, permPage := range permissionsWithPages {
+		// Buat atau dapatkan page
+		if !pageMap[permPage.FkRolPagesId] {
+			page := rolePages.RolPages{
+				Id:     permPage.FkRolPagesId,
+				Name:   permPage.PageName,
+				URL:    permPage.PageUrl,
+				Level:  int16(permPage.PageLevel),
+				Sort:   int16(permPage.PageSort),
+				Active: permPage.PageActive,
+				Icon:   permPage.PageIcon,
+			}
+			if permPage.PageParentId != nil {
+				page.Parent = permPage.PageParentId
+			}
+			pages = append(pages, page)
+			pageMap[permPage.FkRolPagesId] = true
+		}
+
+		// Buat permission
+		permission := &RolPermission{
+			Id:            permPage.Id,
+			Create:        permPage.Create,
+			Read:          permPage.Read,
+			Update:        permPage.Update,
+			Disable:       permPage.Disable,
+			Delete:        permPage.Delete,
+			Active:        permPage.Active,
+			FkRolPagesId:  permPage.FkRolPagesId,
+			RoleKeycloak:  permPage.RoleKeycloak,
+			GroupKeycloak: permPage.GroupKeycloak,
+			CreatedAt:     permPage.CreatedAt,
+			UpdatedAt:     permPage.UpdatedAt,
+		}
+		permissionMap[permPage.FkRolPagesId] = permission
+	}
+
+	// Build tree dengan pages yang sudah diurutkan
+	access := buildPageAccessTree(pages, permissionMap)
+
+	// Convert to proper response format
+	accessTree := convertPageAccessToAccessTree(access)
+
+	// Ambil group_keycloak yang sebenarnya dari data permission (jika ada)
+	var actualGroup []string
+	if len(permissionsWithPages) > 0 {
+		// Kumpulkan semua group_keycloak yang unik
+		groupMap := make(map[string]bool)
+		for _, permPage := range permissionsWithPages {
+			if permPage.GroupKeycloak != "" {
+				groupMap[permPage.GroupKeycloak] = true
+			}
+		}
+		// Konversi map ke slice
+		for group := range groupMap {
+			actualGroup = append(actualGroup, group)
+		}
+	}
+
+	response := &RolePermissionTreeResponse{
+		Success: true,
+		Data: RolePermissionData{
+			Role: roleKeycloak,
+			// Group:  actualGroup,
+			Access: accessTree,
+		},
+	}
+
+	// --- 2. Implementasi Caching (Set) ---
+	if s.cache != nil {
+		if bytes, err := json.Marshal(response); err == nil {
+			// Simpan ke cache dengan TTL 1 jam (Dapat disesuaikan)
+			_ = s.cache.Set(ctx, cacheKey, string(bytes), 1*time.Hour)
+		}
+	}
+
+	return response, nil
+}