update ignore

internal/infrastructure/transport/http/handlers/main/auth/auth_handler.go

@@ -0,0 +1,181 @@
+package auth
+
+import (
+	"net/http"
+
+	authService "service/internal/auth"
+	"service/pkg/errors"
+	"service/pkg/response"
+
+	"github.com/gin-gonic/gin"
+)
+
+type AuthHandler struct {
+	service authService.Service
+}
+
+func NewAuthHandler(service authService.Service) *AuthHandler {
+	return &AuthHandler{
+		service: service,
+	}
+}
+
+func (h *AuthHandler) RegisterRoutes(router *gin.RouterGroup) {
+	auth := router.Group("/auth")
+	{
+		auth.POST("/login", h.Login)
+		auth.POST("/register", h.Register)
+		auth.POST("/refresh", h.RefreshToken)
+	}
+}
+
+// RegisterProtectedRoutes mendaftarkan endpoint auth yang membutuhkan token
+func (h *AuthHandler) RegisterProtectedRoutes(router *gin.RouterGroup) {
+	auth := router.Group("/auth")
+	{
+		auth.POST("/logout", h.Logout)
+		auth.GET("/info", h.TokenInfo)
+	}
+}
+
+// Login godoc
+//
+//	@Summary		Login user
+//	@Description	Authenticate user and return JWT & Refresh tokens
+//	@Tags			auth
+//	@Accept			json
+//	@Produce		json
+//	@Param			request	body		authService.LoginRequest	true	"Login credentials"
+//	@Success		200		{object}	response.Response
+//	@Router			/auth/login [post]
+func (h *AuthHandler) Login(c *gin.Context) {
+	var req authService.LoginRequest
+	if err := c.ShouldBindJSON(&req); err != nil {
+		response.Error(c, http.StatusBadRequest, "Invalid request body", err.Error())
+		return
+	}
+
+	// Pemanggilan service secara by-value
+	resp, err := h.service.Login(c.Request.Context(), req)
+	if err != nil {
+		appErr := errors.FromError(err)
+		response.Error(c, appErr.HTTPStatus(), appErr.Error(), appErr.Metadata())
+		return
+	}
+
+	response.Success(c, http.StatusOK, "Login successful", resp)
+}
+
+// Register godoc
+//
+//	@Summary		Register user
+//	@Description	Register a new user
+//	@Tags			auth
+//	@Accept			json
+//	@Produce		json
+//	@Param			request	body		authService.RegisterRequest	true	"Registration details"
+//	@Success		201		{object}	response.Response
+//	@Router			/auth/register [post]
+func (h *AuthHandler) Register(c *gin.Context) {
+	var req authService.RegisterRequest
+	if err := c.ShouldBindJSON(&req); err != nil {
+		response.Error(c, http.StatusBadRequest, "Invalid request body", err.Error())
+		return
+	}
+
+	resp, err := h.service.Register(c.Request.Context(), req)
+	if err != nil {
+		appErr := errors.FromError(err)
+		response.Error(c, appErr.HTTPStatus(), appErr.Error(), appErr.Metadata())
+		return
+	}
+
+	response.Success(c, http.StatusCreated, "User registered successfully", resp)
+}
+
+// RefreshToken godoc
+//
+//	@Summary		Refresh Token
+//	@Description	Refresh expired access token using refresh token
+//	@Tags			auth
+//	@Accept			json
+//	@Produce		json
+//	@Param			request	body		authService.RefreshTokenRequest	true	"Refresh token payload"
+//	@Success		200		{object}	response.Response
+//	@Router			/auth/refresh [post]
+func (h *AuthHandler) RefreshToken(c *gin.Context) {
+	var req authService.RefreshTokenRequest
+	if err := c.ShouldBindJSON(&req); err != nil {
+		response.Error(c, http.StatusBadRequest, "Invalid request payload", err.Error())
+		return
+	}
+
+	resp, err := h.service.RefreshToken(c.Request.Context(), req)
+	if err != nil {
+		appErr := errors.FromError(err)
+		response.Error(c, appErr.HTTPStatus(), appErr.Error(), appErr.Metadata())
+		return
+	}
+
+	response.Success(c, http.StatusOK, "Token refreshed successfully", resp)
+}
+
+// Logout godoc
+//
+//	@Summary		Logout user
+//	@Description	Logout current user and blacklist the token
+//	@Tags			auth
+//	@Produce		json
+//	@Success		200	{object}	response.Response
+//	@Security		BearerAuth
+//	@Router			/auth/logout [post]
+func (h *AuthHandler) Logout(c *gin.Context) {
+	token := c.GetHeader("Authorization")
+	if token == "" {
+		response.Error(c, http.StatusBadRequest, "Token required", nil)
+		return
+	}
+
+	if len(token) > 7 && token[:7] == "Bearer " {
+		token = token[7:]
+	}
+
+	err := h.service.Logout(c.Request.Context(), token)
+	if err != nil {
+		appErr := errors.FromError(err)
+		response.Error(c, appErr.HTTPStatus(), appErr.Error(), appErr.Metadata())
+		return
+	}
+
+	response.Success(c, http.StatusOK, "Logged out successfully", nil)
+}
+
+// TokenInfo godoc
+//
+//	@Summary		Get Token Info
+//	@Description	Retrieve information about the currently active token/user
+//	@Tags			auth
+//	@Produce		json
+//	@Success		200	{object}	response.Response
+//	@Security		BearerAuth
+//	@Router			/auth/info [get]
+func (h *AuthHandler) TokenInfo(c *gin.Context) {
+	// Data ini otomatis di-set oleh provider.go (UnifiedAuthMiddleware)
+	authProvider := c.GetString("auth_provider")
+	userID := c.GetString("user_id")
+	username := c.GetString("username")
+	email := c.GetString("email")
+	role := c.GetString("role")
+	name := c.GetString("name")
+
+	data := gin.H{
+		"auth_provider": authProvider, // Akan bernilai: "jwt", "keycloak", atau "static"
+		"user_id":       userID,
+		"username":      username,
+		"email":         email,
+		"name":          name,
+		"role":          role,
+	}
+
+	response.Success(c, http.StatusOK, "Current active token information", data)
+}

internal/infrastructure/transport/http/handlers/main/health/health_handler.go

@@ -0,0 +1,470 @@
+package health
+
+import (
+	"context"
+	"fmt"
+	"net/http"
+	"time"
+
+	"service/internal/infrastructure/cache"
+	"service/internal/infrastructure/config"
+	"service/internal/infrastructure/database"
+	"service/internal/interfaces/minio"
+
+	"github.com/gin-gonic/gin"
+	miniogo "github.com/minio/minio-go/v7"
+	"github.com/redis/go-redis/v9"
+	"gorm.io/gorm"
+)
+
+// HealthHandler handles health check endpoints
+type HealthHandler struct {
+	db           *gorm.DB
+	redisClient  *redis.Client
+	config       *config.Config
+	cacheManager *cache.Manager // Alternatif untuk Redis client
+	dbManager    database.Service
+}
+
+// NewHealthHandlerWithCache creates a new health handler with cache manager
+func NewHealthHandlerWithCache(db *gorm.DB, cacheManager *cache.Manager, config *config.Config, dbManager database.Service) *HealthHandler {
+	handler := &HealthHandler{
+		db:           db,
+		config:       config,
+		cacheManager: cacheManager,
+		dbManager:    dbManager,
+	}
+
+	// Coba dapatkan Redis client dari cache manager
+	if cacheManager != nil {
+		if redisClientInterface := cacheManager.GetRedisClient(); redisClientInterface != nil {
+			if client, ok := redisClientInterface.(*redis.Client); ok {
+				handler.redisClient = client
+			}
+		}
+	}
+
+	return handler
+}
+
+// HealthCheckComplete performs comprehensive health check
+func (h *HealthHandler) HealthCheckComplete(c *gin.Context) {
+	startTime := time.Now()
+
+	health := gin.H{
+		"status":    "healthy",
+		"timestamp": time.Now().UTC(),
+		"uptime":    time.Since(startTime).Milliseconds(),
+		"version":   "1.0.0",
+		"service":   "service",
+	}
+
+	// Check database
+	dbStatus := h.checkDatabase()
+	health["database"] = dbStatus
+
+	// Check cache
+	cacheStatus := h.checkCache()
+	health["cache"] = cacheStatus
+
+	// Check external services
+	externalStatus := h.checkExternalServices()
+	health["external_services"] = externalStatus
+
+	// Check Minio
+	minioStatus := h.checkMinio()
+	health["minio"] = minioStatus
+
+	// Determine overall status
+	if dbStatus["status"] != "UP" || cacheStatus["status"] != "UP" || (minioStatus["status"] != "UP" && minioStatus["status"] != "DISABLED") {
+		health["status"] = "DOWN"
+		c.JSON(http.StatusServiceUnavailable, health)
+		return
+	}
+
+	c.JSON(http.StatusOK, health)
+}
+
+// HealthCheckDatabase checks database connectivity
+func (h *HealthHandler) HealthCheckDatabase(c *gin.Context) {
+	status := h.checkDatabase()
+
+	if status["status"] != "UP" {
+		c.JSON(http.StatusServiceUnavailable, status)
+		return
+	}
+
+	c.JSON(http.StatusOK, status)
+}
+
+// HealthCheckCache checks cache connectivity
+func (h *HealthHandler) HealthCheckCache(c *gin.Context) {
+	status := h.checkCache()
+
+	if status["status"] != "UP" {
+		c.JSON(http.StatusServiceUnavailable, status)
+		return
+	}
+
+	c.JSON(http.StatusOK, status)
+}
+
+// HealthCheckExternal checks external service connectivity
+func (h *HealthHandler) HealthCheckExternal(c *gin.Context) {
+	status := h.checkExternalServices()
+
+	// Hanya return 503 (Unavailable) jika status benar-benar DOWN, bukan saat sekadar DEGRADED.
+	if status["status"] == "DOWN" {
+		c.JSON(http.StatusServiceUnavailable, status)
+		return
+	}
+
+	c.JSON(http.StatusOK, status)
+}
+
+// HealthCheckMinio checks Minio Object Storage connectivity
+func (h *HealthHandler) HealthCheckMinio(c *gin.Context) {
+	status := h.checkMinio()
+
+	if status["status"] == "DOWN" {
+		c.JSON(http.StatusServiceUnavailable, status)
+		return
+	}
+
+	c.JSON(http.StatusOK, status)
+}
+
+// TestUploadMinio is a testing endpoint to upload a file to Minio
+func (h *HealthHandler) TestUploadMinio(c *gin.Context) {
+	if minio.I == nil {
+		c.JSON(http.StatusInternalServerError, gin.H{"error": "Minio client is not initialized or disconnected"})
+		return
+	}
+
+	file, err := c.FormFile("file")
+	if err != nil {
+		c.JSON(http.StatusBadRequest, gin.H{"error": "File is required (form-data key: 'file')"})
+		return
+	}
+
+	// Gunakan bucket dari request body (jika ada), atau default ke config/nama statis
+	bucketName := c.DefaultPostForm("bucket", "dev-test")
+	ctx := c.Request.Context()
+
+	// Ensure bucket exists
+	exists, err := minio.I.BucketExists(ctx, bucketName)
+	if err == nil && !exists {
+		err = minio.I.MakeBucket(ctx, bucketName, miniogo.MakeBucketOptions{Region: h.config.Minio.Region})
+		if err != nil {
+			c.JSON(http.StatusInternalServerError, gin.H{"error": "Failed to create bucket: " + err.Error()})
+			return
+		}
+	} else if err != nil {
+		c.JSON(http.StatusInternalServerError, gin.H{"error": "Failed to check bucket status: " + err.Error()})
+		return
+	}
+
+	src, err := file.Open()
+	if err != nil {
+		c.JSON(http.StatusInternalServerError, gin.H{"error": "Failed to open file: " + err.Error()})
+		return
+	}
+	defer src.Close()
+
+	objectName := fmt.Sprintf("%d-%s", time.Now().Unix(), file.Filename)
+	info, err := minio.I.PutObject(ctx, bucketName, objectName, src, file.Size, miniogo.PutObjectOptions{
+		ContentType: file.Header.Get("Content-Type"),
+	})
+	if err != nil {
+		c.JSON(http.StatusInternalServerError, gin.H{"error": "Failed to upload to Minio: " + err.Error()})
+		return
+	}
+
+	c.JSON(http.StatusOK, gin.H{
+		"message": "File uploaded successfully",
+		"data":    info,
+	})
+}
+
+// checkDatabase checks database health
+func (h *HealthHandler) checkDatabase() gin.H {
+	if h.dbManager == nil {
+		return gin.H{
+			"status": "UNKNOWN",
+			"error":  "Database manager not initialized",
+		}
+	}
+
+	allDbInfo := h.dbManager.GetAllDatabasesInfo()
+	overallStatus := "UP"
+
+	// Iterate through the map and check each database
+	for name, info := range allDbInfo {
+		dbInfo, ok := info.(gin.H)
+		if !ok {
+			continue
+		}
+
+		// Standardize the status to "UP" if it's "connected" or "healthy"
+		if status, ok := dbInfo["status"].(string); ok {
+			if status == "connected" || status == "healthy" || status == "UP" {
+				dbInfo["status"] = "UP"
+			} else {
+				overallStatus = "DOWN"
+			}
+		}
+		allDbInfo[name] = dbInfo // Update the map with the checked info
+	}
+
+	return gin.H{
+		"status":     overallStatus,
+		"components": allDbInfo,
+	}
+}
+
+// checkCache checks Redis/cache health
+func (h *HealthHandler) checkCache() gin.H {
+	if h.cacheManager == nil {
+		return gin.H{"status": "UNKNOWN", "error": "Cache manager not initialized"}
+	}
+
+	if !h.config.Cache.Enabled {
+		return gin.H{"status": "UP", "details": gin.H{"provider": "noop", "message": "Cache is disabled"}}
+	}
+
+	ctx, cancel := context.WithTimeout(context.Background(), 2*time.Second)
+	defer cancel()
+
+	start := time.Now()
+	err := h.cacheManager.Health(ctx)
+	latency := time.Since(start)
+
+	details := gin.H{
+		"provider":   "redis",
+		"latency":    latency.String(),
+		"latency_ms": latency.Milliseconds(),
+	}
+
+	if err != nil {
+		details["error"] = err.Error()
+		return gin.H{"status": "DOWN", "details": details}
+	}
+
+	return gin.H{
+		"status":  "UP",
+		"details": details,
+	}
+}
+
+// checkMinio checks Minio Object Storage health
+func (h *HealthHandler) checkMinio() gin.H {
+	if h.config == nil || h.config.Minio.Endpoint == "" {
+		return gin.H{"status": "DISABLED", "message": "Minio is not configured in .env"}
+	}
+
+	if minio.I == nil {
+		return gin.H{"status": "DOWN", "message": "Minio global client is nil"}
+	}
+
+	ctx, cancel := context.WithTimeout(context.Background(), 3*time.Second)
+	defer cancel()
+
+	start := time.Now()
+	// Panggilan ringan API minio untuk memastikan server hidup & kredensial benar
+	_, err := minio.I.ListBuckets(ctx)
+	latency := time.Since(start)
+
+	details := gin.H{
+		"endpoint":   h.config.Minio.Endpoint,
+		"latency_ms": latency.Milliseconds(),
+	}
+
+	if err != nil {
+		details["error"] = err.Error()
+		return gin.H{"status": "DOWN", "details": details}
+	}
+
+	return gin.H{"status": "UP", "details": details}
+}
+
+// checkExternalServices checks external service health
+func (h *HealthHandler) checkExternalServices() gin.H {
+	status := gin.H{
+		"status":  "UP",
+		"message": "All configured external services are reachable",
+	}
+
+	hasDegraded := false
+	hasDown := false
+	downServices := []string{}
+	degradedServices := []string{}
+	activeServices := 0
+
+	// Check BPJS service if configured
+	if h.config != nil {
+		bpjsStatus := h.checkBPJSService()
+		status["bpjs"] = bpjsStatus
+
+		if s, ok := bpjsStatus["status"].(string); ok && s != "DISABLED" {
+			activeServices++
+			if s == "DOWN" {
+				hasDown = true
+				downServices = append(downServices, "BPJS")
+			} else if s == "DEGRADED" {
+				hasDegraded = true
+				degradedServices = append(degradedServices, "BPJS")
+			}
+		}
+	}
+
+	// Check SatuSehat service if configured
+	if h.config != nil {
+		satuSehatStatus := h.checkSatuSehatService()
+		status["satu_sehat"] = satuSehatStatus
+
+		if s, ok := satuSehatStatus["status"].(string); ok && s != "DISABLED" {
+			activeServices++
+			if s == "DOWN" {
+				hasDown = true
+				downServices = append(downServices, "SatuSehat")
+			} else if s == "DEGRADED" {
+				hasDegraded = true
+				degradedServices = append(degradedServices, "SatuSehat")
+			}
+		}
+	}
+
+	if activeServices == 0 {
+		status["status"] = "UP"
+		status["message"] = "All external services are disabled"
+	} else if hasDown {
+		status["status"] = "DOWN"
+		status["message"] = fmt.Sprintf("Some external services are unreachable: %v", downServices)
+	} else if hasDegraded {
+		status["status"] = "DEGRADED"
+		status["message"] = fmt.Sprintf("Some external services are degraded: %v", degradedServices)
+	}
+
+	return status
+}
+
+// checkBPJSService checks BPJS VClaim service
+func (h *HealthHandler) checkBPJSService() gin.H {
+	if !h.config.Bpjs.Enabled {
+		return gin.H{
+			"status":  "DISABLED",
+			"message": "BPJS integration is disabled in configuration",
+		}
+	}
+
+	client := &http.Client{
+		Timeout: 5 * time.Second,
+	}
+
+	req, err := http.NewRequest("GET", h.config.Bpjs.BaseURL, nil)
+	if err != nil {
+		return gin.H{
+			"status":  "DOWN",
+			"message": "Failed to create BPJS request: " + err.Error(),
+		}
+	}
+
+	resp, err := client.Do(req)
+	if err != nil {
+		return gin.H{
+			"status":  "DOWN",
+			"message": "BPJS service unreachable: " + err.Error(),
+		}
+	}
+	defer resp.Body.Close()
+
+	status := "UP"
+	message := "BPJS service is reachable"
+
+	switch resp.StatusCode {
+	case http.StatusOK:
+		message = "BPJS service is reachable and responding normally"
+	case http.StatusUnauthorized:
+		message = "BPJS service is reachable (Authentication required/Invalid Signature)"
+	case http.StatusForbidden:
+		status = "DEGRADED"
+		message = "BPJS service is reachable, but access is forbidden (Check IP Whitelisting or Credentials)"
+	case http.StatusNotFound:
+		message = "BPJS service is reachable (Base URL responded with 404, server is UP)"
+	default:
+		if resp.StatusCode >= 500 {
+			status = "DOWN"
+			message = fmt.Sprintf("BPJS service returned server error: %s", resp.Status)
+		} else {
+			message = fmt.Sprintf("BPJS service is reachable (Status: %s)", resp.Status)
+		}
+	}
+
+	return gin.H{
+		"status":      status,
+		"message":     message,
+		"status_code": resp.StatusCode,
+	}
+}
+
+// checkSatuSehatService checks SatuSehat FHIR service
+func (h *HealthHandler) checkSatuSehatService() gin.H {
+	if !h.config.SatuSehat.Enabled {
+		return gin.H{
+			"status":  "DISABLED",
+			"message": "SatuSehat integration is disabled in configuration",
+		}
+	}
+
+	client := &http.Client{
+		Timeout: 2 * time.Second, // Dipercepat agar health check tidak blocking terlalu lama
+	}
+
+	checkURL := func(url string) (string, string, int) {
+		if url == "" {
+			return "DISABLED", "URL not configured", 0
+		}
+		req, err := http.NewRequest("GET", url, nil)
+		if err != nil {
+			return "DOWN", "Request creation failed: " + err.Error(), 0
+		}
+		resp, err := client.Do(req)
+		if err != nil {
+			return "DOWN", "Unreachable: " + err.Error(), 0
+		}
+		defer resp.Body.Close()
+		return "UP", fmt.Sprintf("Reachable (Status: %s)", resp.Status), resp.StatusCode
+	}
+
+	authStatus, authMsg, authCode := checkURL(h.config.SatuSehat.AuthURL)
+	baseStatus, baseMsg, baseCode := checkURL(h.config.SatuSehat.BaseURL)
+	consentStatus, consentMsg, _ := checkURL(h.config.SatuSehat.ConsentURL)
+	kfaStatus, kfaMsg, _ := checkURL(h.config.SatuSehat.KFAURL)
+
+	overallStatus := "UP"
+	overallMessage := "SatuSehat services are reachable"
+
+	// Evaluasi status keseluruhan berdasarkan Base URL & Auth URL
+	if baseStatus == "DOWN" || authStatus == "DOWN" {
+		overallStatus = "DOWN"
+		overallMessage = "One or more critical SatuSehat services are unreachable"
+	} else if baseCode == http.StatusForbidden || authCode == http.StatusForbidden {
+		overallStatus = "DEGRADED"
+		overallMessage = "Services are reachable, but access is forbidden (Check IP/Permissions)"
+	}
+
+	return gin.H{
+		"status":  overallStatus,
+		"message": overallMessage,
+		"details": gin.H{
+			"org_id":       h.config.SatuSehat.OrgID,
+			"fasyankes_id": h.config.SatuSehat.FasyakesID,
+			"endpoints": gin.H{
+				"auth":      gin.H{"url": h.config.SatuSehat.AuthURL, "status": authStatus, "message": authMsg, "status_code": authCode},
+				"fhir_base": gin.H{"url": h.config.SatuSehat.BaseURL, "status": baseStatus, "message": baseMsg, "status_code": baseCode},
+				"consent":   gin.H{"url": h.config.SatuSehat.ConsentURL, "status": consentStatus, "message": consentMsg},
+				"kfa":       gin.H{"url": h.config.SatuSehat.KFAURL, "status": kfaStatus, "message": kfaMsg},
+			},
+		},
+	}
+}

internal/infrastructure/transport/http/handlers/main/master/roles/master_handler.go

@@ -0,0 +1,318 @@
+package role
+
+import (
+	"fmt"
+	"math"
+	"net/http"
+	"strconv"
+	"strings"
+
+	masterService "service/internal/master/role/master"
+	"service/pkg/errors"
+	"service/pkg/logger"
+	"service/pkg/response"
+
+	"github.com/gin-gonic/gin"
+)
+
+type RoleMasterHandler struct {
+	service masterService.Service
+}
+
+func NewRoleMasterHandler(service masterService.Service) *RoleMasterHandler {
+	return &RoleMasterHandler{service: service}
+}
+
+func (h *RoleMasterHandler) RegisterRoutes(router *gin.RouterGroup) {
+	group := router.Group("/roles/master")
+	{
+		group.GET("", h.GetList)
+		group.GET("/search", h.Search)
+		group.GET("/:id", h.GetDetail)
+		group.POST("", h.Create)
+		group.PUT("/:id", h.Update)
+		group.DELETE("/:id", h.Delete)
+	}
+}
+
+// GetList godoc
+//
+//	@Summary		Get list of Role
+//	@Description	Retrieve a paginated list of RoleMaster
+//	@Tags			roles
+//	@Produce		json
+//	@Param			limit	query		int		false	"Number of items per page"	default(10)
+//	@Param			offset	query		int		false	"Offset for pagination"		default(0)
+//	@Param			sort	query		string	false	"Sort fields (e.g. +name,-created_at)"
+//	@Param			active	query		boolean	false	"Filter by active status"
+//	@Success		200		{object}	response.Response
+//	@Security		BearerAuth
+//	@Router			/roles/master [get]
+func (h *RoleMasterHandler) GetList(c *gin.Context) {
+	limit, _ := strconv.Atoi(c.DefaultQuery("limit", "10"))
+	if limitStr := c.Query("limit"); limitStr != "" {
+		limit, _ = strconv.Atoi(limitStr)
+	}
+
+	offset, _ := strconv.Atoi(c.DefaultQuery("offset", "0"))
+	if offsetStr := c.Query("offset"); offsetStr != "" {
+		if offset, err := strconv.Atoi(offsetStr); err == nil && offset > 0 && limit > 0 {
+			offset = (offset - 1) * limit
+		}
+	}
+
+	activeParam := c.Query("active")
+	var activeFilter *bool // default nil (no filter / ambil semua)
+	if activeParam != "" {
+		isActive := activeParam == "true" || activeParam == "1"
+		activeFilter = &isActive
+	}
+
+	// Parse parameter sort (format: sort=column1,-column2,+column3)
+	// -column untuk DESC, +column atau column untuk ASC
+	var sorts []string
+	if sortParam := c.Query("sort"); sortParam != "" {
+		sorts = strings.Split(sortParam, ",")
+		// Validasi dan bersihkan sort parameters
+		for i, sort := range sorts {
+			sorts[i] = strings.TrimSpace(sort)
+		}
+	}
+
+	ctx := c.Request.Context()
+	result, err := h.service.GetList(ctx, limit, offset, sorts, activeFilter)
+	if err != nil {
+		appErr := errors.FromError(err)
+		response.Error(c, appErr.HTTPStatus(), appErr.Error(), appErr.Metadata())
+		return
+	}
+
+	data := result["data"]
+	total := result["total"].(int64)
+	limitVal := result["limit"].(int)
+	offsetVal := result["offset"].(int)
+
+	page := 1
+	if limitVal > 0 {
+		page = (offsetVal / limitVal) + 1
+	}
+	totalPages := 0
+	if limitVal > 0 {
+		totalPages = int(math.Ceil(float64(total) / float64(limitVal)))
+	}
+
+	meta := response.Meta{Page: page, Limit: limitVal, Total: int(total), TotalPages: totalPages}
+	response.Paginated(c, http.StatusOK, "Successfully retrieved RolPages list", data, meta)
+}
+
+// GetDetail godoc
+//
+//	@Summary		Get RoleMaster detail
+//	@Description	Retrieve detailed information about a specific RoleMaster
+//	@Tags			roles
+//	@Produce		json
+//	@Param			id	path		int	true	"RoleMaster ID"
+//	@Success		200	{object}	response.Response
+//	@Security		BearerAuth
+//	@Router			/roles/master/{id} [get]
+func (h *RoleMasterHandler) GetDetail(c *gin.Context) {
+	id, err := strconv.ParseInt(c.Param("id"), 10, 64)
+	if err != nil {
+		response.Error(c, http.StatusBadRequest, "Invalid ID format", nil)
+		return
+	}
+
+	ctx := c.Request.Context()
+	result, err := h.service.GetDetail(ctx, id)
+	if err != nil {
+		appErr := errors.FromError(err)
+		response.Error(c, appErr.HTTPStatus(), appErr.Error(), appErr.Metadata())
+		return
+	}
+
+	response.Success(c, http.StatusOK, "Successfully retrieved RoleMaster detail", result)
+}
+
+// Search godoc
+//
+//	@Summary		Search Role
+//	@Description	Search RoleMaster records using dynamic filters
+//	@Tags			roles
+//	@Produce		json
+//	@Param			limit	query		int		false	"Limit per page"		default(10)
+//	@Param			offset	query		int		false	"Offset for pagination"	default(0)
+//	@Param			sort	query		string	false	"Sort fields (e.g. +name,-created_at)"
+//	@Success		200		{object}	response.Response
+//	@Security		BearerAuth
+//	@Router			/roles/master/search [get]
+func (h *RoleMasterHandler) Search(c *gin.Context) {
+	// Parse Limit & Offset dengan fallback ke page & page_size
+	limit, _ := strconv.Atoi(c.DefaultQuery("limit", "10"))
+	if limitStr := c.Query("limit"); limitStr != "" {
+		limit, _ = strconv.Atoi(limitStr)
+	}
+
+	offset, _ := strconv.Atoi(c.DefaultQuery("offset", "0"))
+	if offsetStr := c.Query("offset"); offsetStr != "" {
+		if offset, err := strconv.Atoi(offsetStr); err == nil && offset > 0 && limit > 0 {
+			offset = (offset - 1) * limit
+		}
+	}
+
+	// Ambil parameter filter
+	// Ambil parameter filter secara dinamis
+	filters := make(map[string]interface{})
+
+	for key, values := range c.Request.URL.Query() {
+		if key == "page" || key == "limit" || key == "page_size" || key == "offset" || key == "sort" {
+			continue
+		}
+		if len(values) > 0 && values[0] != "" {
+			filters[key] = values[0]
+		}
+	}
+
+	// Parse parameter sort (format: sort=column1,-column2,+column3)
+	// -column untuk DESC, +column atau column untuk ASC
+	var sorts []string
+	if sortParam := c.Query("sort"); sortParam != "" {
+		sorts = strings.Split(sortParam, ",")
+		// Validasi dan bersihkan sort parameters
+		for i, sort := range sorts {
+			sorts[i] = strings.TrimSpace(sort)
+		}
+	}
+
+	ctx := c.Request.Context()
+
+	logger.Default().WithContext(ctx).Info("Search request",
+		logger.String("filters", fmt.Sprintf("%v", filters)),
+		logger.String("sorts", fmt.Sprintf("%v", sorts)),
+		logger.Int("offset", offset),
+		logger.Int("limit", limit))
+
+	// Panggil service dengan parameter sort tambahan
+	result, err := h.service.Search(ctx, filters, sorts, limit, offset)
+	if err != nil {
+		appErr := errors.FromError(err)
+		response.Error(c, appErr.HTTPStatus(), appErr.Error(), appErr.Metadata())
+		return
+	}
+
+	// Extract data dari map service untuk response format
+	data := result["data"]
+	total := result["total"].(int64)
+	limitVal := result["limit"].(int)
+	offsetVal := result["offset"].(int)
+
+	page := 1
+	if limitVal > 0 {
+		page = (offsetVal / limitVal) + 1
+	}
+	// Hitung total pages
+	totalPages := 0
+	if limitVal > 0 {
+		totalPages = int(math.Ceil(float64(total) / float64(limitVal)))
+	}
+
+	meta := response.Meta{
+		Page:       page,
+		Limit:      limitVal,
+		Total:      int(total),
+		TotalPages: totalPages,
+	}
+
+	response.Paginated(c, http.StatusOK, "Successfully retrieved RoleMaster search results", data, meta)
+}
+
+// Create godoc
+//
+//	@Summary		Create new RoleMaster
+//	@Description	Create a new RoleMaster record
+//	@Tags			roles
+//	@Accept			json
+//	@Produce		json
+//	@Param			request	body		masterService.RoleMasterRequest	true	"Payload"
+//	@Success		201		{object}	response.Response
+//	@Security		BearerAuth
+//	@Router			/roles/master [post]
+func (h *RoleMasterHandler) Create(c *gin.Context) {
+	var req masterService.RoleMasterRequest
+	if err := c.ShouldBindJSON(&req); err != nil {
+		response.Error(c, http.StatusBadRequest, "Invalid request body", err.Error())
+		return
+	}
+
+	ctx := c.Request.Context()
+	created, err := h.service.Create(ctx, req)
+	if err != nil {
+		appErr := errors.FromError(err)
+		response.Error(c, appErr.HTTPStatus(), appErr.Error(), appErr.Metadata())
+		return
+	}
+
+	response.Success(c, http.StatusCreated, "Successfully created RoleMaster", created)
+}
+
+// Update godoc
+//
+//	@Summary		Update an existing RoleMaster
+//	@Description	Update details of an existing RoleMaster record by ID
+//	@Tags			roles
+//	@Accept			json
+//	@Produce		json
+//	@Param			id		path		int								true	"RoleMaster ID"
+//	@Param			request	body		masterService.RoleMasterRequest	true	"Payload"
+//	@Success		200		{object}	response.Response
+//	@Security		BearerAuth
+//	@Router			/roles/master/{id} [put]
+func (h *RoleMasterHandler) Update(c *gin.Context) {
+	id, err := strconv.ParseInt(c.Param("id"), 10, 64)
+	if err != nil {
+		response.Error(c, http.StatusBadRequest, "Invalid ID format", nil)
+		return
+	}
+
+	var req masterService.RoleMasterRequest
+	if err := c.ShouldBindJSON(&req); err != nil {
+		response.Error(c, http.StatusBadRequest, "Invalid request body", err.Error())
+		return
+	}
+
+	ctx := c.Request.Context()
+	updated, err := h.service.Update(ctx, id, req)
+	if err != nil {
+		appErr := errors.FromError(err)
+		response.Error(c, appErr.HTTPStatus(), appErr.Error(), appErr.Metadata())
+		return
+	}
+
+	response.Success(c, http.StatusOK, "Successfully updated RoleMaster", updated)
+}
+
+// Delete godoc
+//
+//	@Summary		Delete a RoleMaster
+//	@Description	Delete a RoleMaster record by ID (soft delete)
+//	@Tags			roles
+//	@Produce		json
+//	@Param			id	path		int	true	"RoleMaster ID"
+//	@Success		200	{object}	response.Response
+//	@Security		BearerAuth
+//	@Router			/roles/master/{id} [delete]
+func (h *RoleMasterHandler) Delete(c *gin.Context) {
+	id, err := strconv.ParseInt(c.Param("id"), 10, 64)
+	if err != nil {
+		response.Error(c, http.StatusBadRequest, "Invalid ID format", nil)
+		return
+	}
+
+	ctx := c.Request.Context()
+	if err := h.service.Delete(ctx, id); err != nil {
+		appErr := errors.FromError(err)
+		response.Error(c, appErr.HTTPStatus(), appErr.Error(), appErr.Metadata())
+		return
+	}
+
+	response.Success(c, http.StatusOK, "Successfully deleted RoleMaster", nil)
+}

internal/infrastructure/transport/http/handlers/main/master/roles/pages_handler.go

@@ -0,0 +1,384 @@
+package role
+
+import (
+	"fmt"
+	"math"
+	"net/http"
+	"strconv"
+	"strings"
+
+	roleService "service/internal/master/role/pages"
+	"service/pkg/errors"
+	"service/pkg/logger"
+	"service/pkg/response"
+
+	"github.com/gin-gonic/gin"
+)
+
+type RolPagesHandler struct {
+	service roleService.Service
+}
+
+func NewRolPagesHandler(service roleService.Service) *RolPagesHandler {
+	return &RolPagesHandler{service: service}
+}
+
+func (h *RolPagesHandler) RegisterRoutes(router *gin.RouterGroup) {
+	group := router.Group("/roles/pages")
+	{
+		group.GET("", h.GetList)
+		group.GET("/tree", h.GetTree)
+		group.GET("/tree/level/:level", h.GetTreeByLevel)
+		group.GET("/search", h.Search)
+		group.GET("/:id", h.GetDetail)
+		group.POST("", h.Create)
+		group.PUT("/:id", h.Update)
+		group.DELETE("/:id", h.Delete)
+	}
+}
+
+// GetList godoc
+//
+//	@Summary		Get list of Role Pages
+//	@Description	Retrieve a paginated list of Role Pages
+//	@Tags			roles-pages
+//	@Produce		json
+//	@Param			limit	query		int		false	"Number of items per page"	default(10)
+//	@Param			offset	query		int		false	"Offset for pagination"		default(0)
+//	@Param			sort	query		string	false	"Sort fields (e.g. +name,-created_at)"
+//	@Param			active	query		boolean	false	"Filter by active status"
+//	@Success		200		{object}	response.Response
+//	@Security		BearerAuth
+//	@Router			/roles/pages [get]
+func (h *RolPagesHandler) GetList(c *gin.Context) {
+	// Parse Limit & Offset dengan fallback ke page & page_size
+	limit, _ := strconv.Atoi(c.DefaultQuery("limit", "10"))
+	if limitStr := c.Query("limit"); limitStr != "" {
+		limit, _ = strconv.Atoi(limitStr)
+	}
+
+	offset, _ := strconv.Atoi(c.DefaultQuery("offset", "0"))
+	if offsetStr := c.Query("offset"); offsetStr != "" {
+		if offset, err := strconv.Atoi(offsetStr); err == nil && offset > 0 && limit > 0 {
+			offset = (offset - 1) * limit
+		}
+	}
+
+	activeParam := c.Query("active")
+	var activeFilter *bool // default nil (no filter / ambil semua)
+	if activeParam != "" {
+		isActive := activeParam == "true" || activeParam == "1"
+		activeFilter = &isActive
+	}
+
+	// Parse parameter sort (format: sort=column1,-column2,+column3)
+	// -column untuk DESC, +column atau column untuk ASC
+	var sorts []string
+	if sortParam := c.Query("sort"); sortParam != "" {
+		sorts = strings.Split(sortParam, ",")
+		// Validasi dan bersihkan sort parameters
+		for i, sort := range sorts {
+			sorts[i] = strings.TrimSpace(sort)
+		}
+	}
+
+	ctx := c.Request.Context()
+	result, err := h.service.GetList(ctx, limit, offset, sorts, activeFilter)
+	if err != nil {
+		appErr := errors.FromError(err)
+		response.Error(c, appErr.HTTPStatus(), appErr.Error(), appErr.Metadata())
+		return
+	}
+
+	data := result["data"]
+	total := result["total"].(int64)
+	limitVal := result["limit"].(int)
+	offsetVal := result["offset"].(int)
+
+	page := 1
+	if limitVal > 0 {
+		page = (offsetVal / limitVal) + 1
+	}
+	totalPages := 0
+	if limitVal > 0 {
+		totalPages = int(math.Ceil(float64(total) / float64(limitVal)))
+	}
+
+	meta := response.Meta{Page: page, Limit: limitVal, Total: int(total), TotalPages: totalPages}
+	response.Paginated(c, http.StatusOK, "Successfully retrieved RolPages list", data, meta)
+}
+
+// GetDetail godoc
+//
+//	@Summary		Get Role Pages detail
+//	@Description	Retrieve detailed information about a specific Role Pages
+//	@Tags			roles-pages
+//	@Produce		json
+//	@Param			id	path		int	true	"Role Pages ID"
+//	@Success		200	{object}	response.Response
+//	@Security		BearerAuth
+//	@Router			/roles/pages/{id} [get]
+func (h *RolPagesHandler) GetDetail(c *gin.Context) {
+	id, err := strconv.ParseInt(c.Param("id"), 10, 64)
+	if err != nil {
+		response.Error(c, http.StatusBadRequest, "Invalid ID format", nil)
+		return
+	}
+
+	ctx := c.Request.Context()
+	result, err := h.service.GetDetail(ctx, id)
+	if err != nil {
+		appErr := errors.FromError(err)
+		response.Error(c, appErr.HTTPStatus(), appErr.Error(), appErr.Metadata())
+		return
+	}
+
+	response.Success(c, http.StatusOK, "Successfully retrieved RolPages detail", result)
+}
+
+// Search godoc
+//
+//	@Summary		Search Role Pages
+//	@Description	Search Role Pages records using dynamic filters
+//	@Tags			roles-pages
+//	@Produce		json
+//	@Param			limit	query		int		false	"Limit per page"		default(10)
+//	@Param			offset	query		int		false	"Offset for pagination"	default(0)
+//	@Param			sort	query		string	false	"Sort fields"
+//	@Success		200		{object}	response.Response
+//	@Security		BearerAuth
+//	@Router			/roles/pages/search [get]
+func (h *RolPagesHandler) Search(c *gin.Context) {
+	// Parse Limit & Offset dengan fallback ke page & page_size
+	limit, _ := strconv.Atoi(c.DefaultQuery("limit", "10"))
+	if limitStr := c.Query("limit"); limitStr != "" {
+		limit, _ = strconv.Atoi(limitStr)
+	}
+
+	offset, _ := strconv.Atoi(c.DefaultQuery("offset", "0"))
+	if offsetStr := c.Query("offset"); offsetStr != "" {
+		if offset, err := strconv.Atoi(offsetStr); err == nil && offset > 0 && limit > 0 {
+			offset = (offset - 1) * limit
+		}
+	}
+
+	// Ambil parameter filter secara dinamis
+	filters := make(map[string]interface{})
+
+	for key, values := range c.Request.URL.Query() {
+		if key == "page" || key == "limit" || key == "page_size" || key == "offset" || key == "sort" {
+			continue
+		}
+		if len(values) > 0 && values[0] != "" {
+			filters[key] = values[0]
+		}
+	}
+
+	// Parse parameter sort (format: sort=column1,-column2,+column3)
+	// -column untuk DESC, +column atau column untuk ASC
+	var sorts []string
+	if sortParam := c.Query("sort"); sortParam != "" {
+		sorts = strings.Split(sortParam, ",")
+		// Validasi dan bersihkan sort parameters
+		for i, sort := range sorts {
+			sorts[i] = strings.TrimSpace(sort)
+		}
+	}
+
+	ctx := c.Request.Context()
+
+	logger.Default().WithContext(ctx).Info("Search request",
+		logger.String("filters", fmt.Sprintf("%v", filters)),
+		logger.String("sorts", fmt.Sprintf("%v", sorts)),
+		logger.Int("offset", offset),
+		logger.Int("limit", limit))
+
+	// Panggil service dengan parameter sort tambahan
+	result, err := h.service.Search(ctx, filters, sorts, limit, offset)
+	if err != nil {
+		appErr := errors.FromError(err)
+		response.Error(c, appErr.HTTPStatus(), appErr.Error(), appErr.Metadata())
+		return
+	}
+
+	// Extract data dari map service untuk response format
+	data := result["data"]
+	total := result["total"].(int64)
+	limitVal := result["limit"].(int)
+	offsetVal := result["offset"].(int)
+
+	page := 1
+	if limitVal > 0 {
+		page = (offsetVal / limitVal) + 1
+	}
+	totalPages := 0
+	if limitVal > 0 {
+		totalPages = int(math.Ceil(float64(total) / float64(limitVal)))
+	}
+
+	meta := response.Meta{
+		Page:       page,
+		Limit:      limitVal,
+		Total:      int(total),
+		TotalPages: totalPages,
+	}
+
+	response.Paginated(c, http.StatusOK, "Successfully retrieved RolPages search results", data, meta)
+}
+
+// Create godoc
+//
+//	@Summary		Create new Role Pages
+//	@Description	Create a new Role Pages record
+//	@Tags			roles-pages
+//	@Accept			json
+//	@Produce		json
+//	@Param			request	body		roleService.RolPagesRequest	true	"Payload"
+//	@Success		201		{object}	response.Response
+//	@Security		BearerAuth
+//	@Router			/roles/pages [post]
+func (h *RolPagesHandler) Create(c *gin.Context) {
+	var req roleService.RolPagesRequest
+	if err := c.ShouldBindJSON(&req); err != nil {
+		response.Error(c, http.StatusBadRequest, "Invalid request body", err.Error())
+		return
+	}
+
+	ctx := c.Request.Context()
+	created, err := h.service.Create(ctx, req)
+	if err != nil {
+		appErr := errors.FromError(err)
+		response.Error(c, appErr.HTTPStatus(), appErr.Error(), appErr.Metadata())
+		return
+	}
+
+	response.Success(c, http.StatusCreated, "Successfully created RolPages", created)
+}
+
+// Update godoc
+//
+//	@Summary		Update an existing Role Pages
+//	@Description	Update details of an existing Role Pages record by ID
+//	@Tags			roles-pages
+//	@Accept			json
+//	@Produce		json
+//	@Param			id		path		int							true	"Role Pages ID"
+//	@Param			request	body		roleService.RolPagesRequest	true	"Payload"
+//	@Success		200		{object}	response.Response
+//	@Security		BearerAuth
+//	@Router			/roles/pages/{id} [put]
+func (h *RolPagesHandler) Update(c *gin.Context) {
+	id, err := strconv.ParseInt(c.Param("id"), 10, 64)
+	if err != nil {
+		response.Error(c, http.StatusBadRequest, "Invalid ID format", nil)
+		return
+	}
+
+	var req roleService.RolPagesRequest
+	if err := c.ShouldBindJSON(&req); err != nil {
+		response.Error(c, http.StatusBadRequest, "Invalid request body", err.Error())
+		return
+	}
+
+	ctx := c.Request.Context()
+	updated, err := h.service.Update(ctx, id, req)
+	if err != nil {
+		appErr := errors.FromError(err)
+		response.Error(c, appErr.HTTPStatus(), appErr.Error(), appErr.Metadata())
+		return
+	}
+
+	response.Success(c, http.StatusOK, "Successfully updated RolPages", updated)
+}
+
+// Delete godoc
+//
+//	@Summary		Delete a Role Pages
+//	@Description	Delete a Role Pages record by ID
+//	@Tags			roles-pages
+//	@Produce		json
+//	@Param			id	path		int	true	"Role Pages ID"
+//	@Success		200	{object}	response.Response
+//	@Security		BearerAuth
+//	@Router			/roles/pages/{id} [delete]
+func (h *RolPagesHandler) Delete(c *gin.Context) {
+	id, err := strconv.ParseInt(c.Param("id"), 10, 64)
+	if err != nil {
+		response.Error(c, http.StatusBadRequest, "Invalid ID format", nil)
+		return
+	}
+
+	ctx := c.Request.Context()
+	if err := h.service.Delete(ctx, id); err != nil {
+		appErr := errors.FromError(err)
+		response.Error(c, appErr.HTTPStatus(), appErr.Error(), appErr.Metadata())
+		return
+	}
+
+	response.Success(c, http.StatusOK, "Successfully deleted RolPages", nil)
+}
+
+// GetTree godoc
+//
+//	@Summary		Get tree of Role Pages
+//	@Description	Retrieve a hierarchical tree of Role Pages
+//	@Tags			roles-pages
+//	@Produce		json
+//	@Param			active	query		boolean	false	"Filter by active status"
+//	@Success		200		{object}	response.Response
+//	@Security		BearerAuth
+//	@Router			/roles/pages/tree [get]
+func (h *RolPagesHandler) GetTree(c *gin.Context) {
+	activeParam := c.Query("active")
+	var activeFilter *bool // default nil (no filter / ambil semua)
+	if activeParam != "" {
+		isActive := activeParam == "true" || activeParam == "1"
+		activeFilter = &isActive
+	}
+
+	ctx := c.Request.Context()
+	tree, err := h.service.GetTree(ctx, activeFilter)
+	if err != nil {
+		appErr := errors.FromError(err)
+		response.Error(c, appErr.HTTPStatus(), appErr.Error(), appErr.Metadata())
+		return
+	}
+
+	response.Success(c, http.StatusOK, "Successfully retrieved RolPages", tree)
+}
+
+// GetTreeByLevel godoc
+//
+//	@Summary		Get tree of Role Pages by level
+//	@Description	Retrieve a hierarchical tree of Role Pages up to a specific level
+//	@Tags			roles-pages
+//	@Produce		json
+//	@Param			level	path		int		true	"Hierarchy Level"
+//	@Param			active	query		boolean	false	"Filter by active status"
+//	@Success		200		{object}	response.Response
+//	@Security		BearerAuth
+//	@Router			/roles/pages/tree/level/{level} [get]
+func (h *RolPagesHandler) GetTreeByLevel(c *gin.Context) {
+	level, err := strconv.ParseInt(c.Param("level"), 10, 16)
+	if err != nil {
+		response.Error(c, http.StatusBadRequest, "Invalid level format", nil)
+		return
+	}
+
+	activeParam := c.Query("active")
+	var activeFilter *bool // default nil (no filter / ambil semua)
+	if activeParam != "" {
+		isActive := activeParam == "true" || activeParam == "1"
+		activeFilter = &isActive
+	}
+
+	ctx := c.Request.Context()
+	tree, err := h.service.GetTreeByLevel(ctx, int16(level), activeFilter)
+	if err != nil {
+		appErr := errors.FromError(err)
+		response.Error(c, appErr.HTTPStatus(), appErr.Error(), appErr.Metadata())
+		return
+	}
+
+	response.Success(c, http.StatusOK, "Successfully retrieved RolPages", tree)
+}

internal/infrastructure/transport/http/handlers/main/master/roles/permission_handler.go

@@ -0,0 +1,502 @@
+package role
+
+import (
+	"fmt"
+	"math"
+	"net/http"
+	"strconv"
+	"strings"
+
+	roleService "service/internal/master/role/permission"
+	"service/pkg/errors"
+	"service/pkg/logger"
+	"service/pkg/response"
+
+	"github.com/gin-gonic/gin"
+)
+
+type RolPermissionHandler struct {
+	service roleService.Service
+}
+
+func NewRolPermissionHandler(service roleService.Service) *RolPermissionHandler {
+	return &RolPermissionHandler{service: service}
+}
+
+func (h *RolPermissionHandler) RegisterRoutes(router *gin.RouterGroup) {
+	group := router.Group("/roles/permissions") //  get by role
+	{
+		group.GET("", h.GetList)
+		group.GET("/search", h.Search)
+		group.GET("/:id", h.GetDetail)                    // using role id
+		group.GET("/role/:role", h.GetPermissionTreeRole) // get permission tree by role keycloak
+		group.POST("", h.Create)
+		group.PUT("/:id", h.Update)
+		group.DELETE("/:id", h.Delete)
+		group.GET("/rolemaster/:id", h.GetRolePagesList)
+	}
+}
+
+// GetList godoc
+//
+//	@Summary		Get list of Role Permissions
+//	@Description	Retrieve a paginated list of Role Permissions
+//	@Tags			roles-permissions
+//	@Produce		json
+//	@Param			limit	query		int		false	"Number of items per page"	default(10)
+//	@Param			offset	query		int		false	"Offset for pagination"		default(0)
+//	@Param			sort	query		string	false	"Sort fields (e.g. +name,-created_at)"
+//	@Param			active	query		boolean	false	"Filter by active status"
+//	@Success		200		{object}	response.Response
+//	@Security		BearerAuth
+//	@Router			/roles/permissions [get]
+func (h *RolPermissionHandler) GetList(c *gin.Context) {
+	// Parse Limit & Offset dengan fallback ke page & page_size
+	limit, _ := strconv.Atoi(c.DefaultQuery("limit", "10"))
+	if pageSizeStr := c.Query("limit"); pageSizeStr != "" {
+		limit, _ = strconv.Atoi(pageSizeStr)
+	}
+
+	offset, _ := strconv.Atoi(c.DefaultQuery("offset", "0"))
+	if pageStr := c.Query("offset"); pageStr != "" {
+		if page, err := strconv.Atoi(pageStr); err == nil && page > 0 && limit > 0 {
+			offset = (page - 1) * limit
+		}
+	}
+
+	activeParam := c.Query("active")
+	var activeFilter *bool // default nil (no filter / ambil semua)
+	if activeParam != "" {
+		isActive := activeParam == "true" || activeParam == "1"
+		activeFilter = &isActive
+	}
+
+	// Parse parameter sort (format: sort=column1,-column2,+column3)
+	// -column untuk DESC, +column atau column untuk ASC
+	var sorts []string
+	if sortParam := c.Query("sort"); sortParam != "" {
+		sorts = strings.Split(sortParam, ",")
+		// Validasi dan bersihkan sort parameters
+		for i, sort := range sorts {
+			sorts[i] = strings.TrimSpace(sort)
+		}
+	}
+
+	ctx := c.Request.Context()
+	result, err := h.service.GetList(ctx, limit, offset, sorts, activeFilter)
+	if err != nil {
+		appErr := errors.FromError(err)
+		response.Error(c, appErr.HTTPStatus(), appErr.Error(), appErr.Metadata())
+		return
+	}
+
+	data := result["data"]
+	total := result["total"].(int64)
+	limitVal := result["limit"].(int)
+	offsetVal := result["offset"].(int)
+
+	page := 1
+	if limitVal > 0 {
+		page = (offsetVal / limitVal) + 1
+	}
+	totalPages := 0
+	if limitVal > 0 {
+		totalPages = int(math.Ceil(float64(total) / float64(limitVal)))
+	}
+
+	meta := response.Meta{Page: page, Limit: limitVal, Total: int(total), TotalPages: totalPages}
+	response.Paginated(c, http.StatusOK, "Successfully retrieved RolPermission list", data, meta)
+}
+
+// GetDetail godoc
+//
+//	@Summary		Get Role Permission detail
+//	@Description	Retrieve detailed information about a specific Role Permission
+//	@Tags			roles-permissions
+//	@Produce		json
+//	@Param			id	path		int	true	"Role Permission ID"
+//	@Success		200	{object}	response.Response
+//	@Security		BearerAuth
+//	@Router			/roles/permissions/{id} [get]
+func (h *RolPermissionHandler) GetDetail(c *gin.Context) {
+	id, err := strconv.ParseInt(c.Param("id"), 10, 64)
+	if err != nil {
+		response.Error(c, http.StatusBadRequest, "Invalid ID format", nil)
+		return
+	}
+
+	ctx := c.Request.Context()
+	result, err := h.service.GetDetail(ctx, id)
+	if err != nil {
+		appErr := errors.FromError(err)
+		response.Error(c, appErr.HTTPStatus(), appErr.Error(), appErr.Metadata())
+		return
+	}
+
+	response.Success(c, http.StatusOK, "Successfully retrieved RolPermission detail", result)
+}
+
+// Search godoc
+//
+//	@Summary		Search Role Permissions
+//	@Description	Search Role Permissions records using dynamic filters
+//	@Tags			roles-permissions
+//	@Produce		json
+//	@Param			limit	query		int		false	"Limit per page"		default(10)
+//	@Param			offset	query		int		false	"Offset for pagination"	default(0)
+//	@Param			sort	query		string	false	"Sort fields"
+//	@Success		200		{object}	response.Response
+//	@Security		BearerAuth
+//	@Router			/roles/permissions/search [get]
+func (h *RolPermissionHandler) Search(c *gin.Context) {
+	// Parse Limit & Offset dengan fallback ke page & page_size
+	limit, _ := strconv.Atoi(c.DefaultQuery("limit", "10"))
+	if pageSizeStr := c.Query("limit"); pageSizeStr != "" {
+		limit, _ = strconv.Atoi(pageSizeStr)
+	}
+
+	offset, _ := strconv.Atoi(c.DefaultQuery("offset", "0"))
+	if pageStr := c.Query("offset"); pageStr != "" {
+		if page, err := strconv.Atoi(pageStr); err == nil && page > 0 && limit > 0 {
+			offset = (page - 1) * limit
+		}
+	}
+
+	// Ambil parameter filter secara dinamis
+	filters := make(map[string]interface{})
+
+	for key, values := range c.Request.URL.Query() {
+		if key == "page" || key == "limit" || key == "page_size" || key == "offset" || key == "sort" {
+			continue
+		}
+		if len(values) > 0 && values[0] != "" {
+			filters[key] = values[0]
+		}
+	}
+
+	// Parse parameter sort (format: sort=column1,-column2,+column3)
+	// -column untuk DESC, +column atau column untuk ASC
+	var sorts []string
+	if sortParam := c.Query("sort"); sortParam != "" {
+		sorts = strings.Split(sortParam, ",")
+		// Validasi dan bersihkan sort parameters
+		for i, sort := range sorts {
+			sorts[i] = strings.TrimSpace(sort)
+		}
+	}
+
+	ctx := c.Request.Context()
+
+	logger.Default().WithContext(ctx).Info("Search request",
+		logger.String("filters", fmt.Sprintf("%v", filters)),
+		logger.String("sorts", fmt.Sprintf("%v", sorts)),
+		logger.Int("offset", offset),
+		logger.Int("limit", limit))
+
+	// Panggil service dengan parameter sort tambahan
+	result, err := h.service.Search(ctx, filters, sorts, limit, offset)
+	if err != nil {
+		appErr := errors.FromError(err)
+		response.Error(c, appErr.HTTPStatus(), appErr.Error(), appErr.Metadata())
+		return
+	}
+
+	// Extract data dari map service untuk response format
+	data := result["data"]
+	total := result["total"].(int64)
+	limitVal := result["limit"].(int)
+	offsetVal := result["offset"].(int)
+
+	page := 1
+	if limitVal > 0 {
+		page = (offsetVal / limitVal) + 1
+	}
+	totalPages := 0
+	if limitVal > 0 {
+		totalPages = int(math.Ceil(float64(total) / float64(limitVal)))
+	}
+
+	meta := response.Meta{
+		Page:       page,
+		Limit:      limitVal,
+		Total:      int(total),
+		TotalPages: totalPages,
+	}
+
+	response.Paginated(c, http.StatusOK, "Successfully retrieved RolPermission search results", data, meta)
+}
+
+// GetPermissionTree godoc
+//
+//	@Summary		Get Permission Tree
+//	@Description	Retrieve a permission tree
+//	@Tags			roles-permissions
+//	@Produce		json
+//	@Param			role	path		string	true	"Role Keycloak"
+//	@Param			groups	query		string	false	"Comma-separated groups"
+//	@Param			active	query		boolean	false	"Filter by active status"
+//	@Success		200		{object}	response.Response
+//	@Security		BearerAuth
+//	@Router			/roles/permissions/tree/{role} [get]
+func (h *RolPermissionHandler) GetPermissionTree(c *gin.Context) {
+	roleKeycloak := c.Param("role")
+
+	// Get groups from query parameter (comma-separated)
+	groupsParam := c.Query("groups")
+	var groups []string
+	if groupsParam != "" {
+		groups = strings.Split(groupsParam, ",")
+		// Trim spaces from each group
+		for i, group := range groups {
+			groups[i] = strings.TrimSpace(group)
+		}
+	}
+
+	// Parse active parameter - handle "true", "false", "1", "0"
+	activeParam := c.Query("active")
+	var activeOnly *bool // default nil (no filter)
+	if activeParam != "" {
+		isActive := activeParam == "true" || activeParam == "1"
+		activeOnly = &isActive
+	}
+
+	ctx := c.Request.Context()
+	result, err := h.service.GetRolePermissionTree(ctx, roleKeycloak, groups, activeOnly)
+	if err != nil {
+		appErr := errors.FromError(err)
+		response.Error(c, appErr.HTTPStatus(), appErr.Error(), appErr.Metadata())
+		return
+	}
+
+	// Jika role disediakan tapi tidak ada data, return empty result
+	if roleKeycloak != "" && (result == nil || len(result.Data.Access) == 0) {
+		c.JSON(http.StatusOK, gin.H{
+			"status":  "success",
+			"message": "No permissions found for the specified role",
+			"data":    []interface{}{},
+		})
+		return
+	}
+
+	// Return the result in the desired format
+	c.JSON(http.StatusOK, gin.H{
+		"status":  "success",
+		"message": "Successfully retrieved RolPages",
+		"data":    result.Data,
+	})
+}
+
+// GetPermissionTreeRole godoc
+//
+//	@Summary		Get Permission Tree by Role
+//	@Description	Retrieve a permission tree by Keycloak role
+//	@Tags			roles-permissions
+//	@Produce		json
+//	@Param			role	path		string	true	"Role Keycloak"
+//	@Param			active	query		boolean	false	"Filter by active status"
+//	@Success		200		{object}	response.Response
+//	@Security		BearerAuth
+//	@Router			/roles/permissions/role/{role} [get]
+func (h *RolPermissionHandler) GetPermissionTreeRole(c *gin.Context) {
+	roleKeycloak := c.Param("role")
+
+	// Parse active parameter - handle "true", "false", "1", "0"
+	activeParam := c.Query("active")
+	var activeOnly *bool // default nil (no filter)
+	if activeParam != "" {
+		isActive := activeParam == "true" || activeParam == "1"
+		activeOnly = &isActive
+	}
+
+	ctx := c.Request.Context()
+	result, err := h.service.GetRolePermissionTreeRole(ctx, roleKeycloak, activeOnly)
+	if err != nil {
+		appErr := errors.FromError(err)
+		response.Error(c, appErr.HTTPStatus(), appErr.Error(), appErr.Metadata())
+		return
+	}
+
+	// Jika role disediakan tapi tidak ada data, return empty result
+	if roleKeycloak != "" && (result == nil || len(result.Data.Access) == 0) {
+		c.JSON(http.StatusOK, gin.H{
+			"status":  "success",
+			"message": "No permissions found for the specified role",
+			"data":    []interface{}{},
+		})
+		return
+	}
+
+	// Return the result in the desired format
+	c.JSON(http.StatusOK, gin.H{
+		"status":  "success",
+		"message": "Successfully retrieved RolPages",
+		"data":    result.Data,
+	})
+}
+
+// Create godoc
+//
+//	@Summary		Create new Role Permission
+//	@Description	Create a new Role Permission record
+//	@Tags			roles-permissions
+//	@Accept			json
+//	@Produce		json
+//	@Param			request	body		roleService.RolPermissionRequest	true	"Payload"
+//	@Success		201		{object}	response.Response
+//	@Security		BearerAuth
+//	@Router			/roles/permissions [post]
+func (h *RolPermissionHandler) Create(c *gin.Context) {
+	var req roleService.RolPermissionRequest
+	if err := c.ShouldBindJSON(&req); err != nil {
+		response.Error(c, http.StatusBadRequest, "Invalid request body", err.Error())
+		return
+	}
+
+	ctx := c.Request.Context()
+	created, err := h.service.Create(ctx, req)
+	if err != nil {
+		appErr := errors.FromError(err)
+		response.Error(c, appErr.HTTPStatus(), appErr.Error(), appErr.Metadata())
+		return
+	}
+
+	response.Success(c, http.StatusCreated, "Successfully created RolPermission", created)
+}
+
+// Update godoc
+//
+//	@Summary		Update an existing Role Permission
+//	@Description	Update details of an existing Role Permission record by ID
+//	@Tags			roles-permissions
+//	@Accept			json
+//	@Produce		json
+//	@Param			id		path		int									true	"Role Permission ID"
+//	@Param			request	body		roleService.RolPermissionRequest	true	"Payload"
+//	@Success		200		{object}	response.Response
+//	@Security		BearerAuth
+//	@Router			/roles/permissions/{id} [put]
+func (h *RolPermissionHandler) Update(c *gin.Context) {
+	id, err := strconv.ParseInt(c.Param("id"), 10, 64)
+	if err != nil {
+		response.Error(c, http.StatusBadRequest, "Invalid ID format", nil)
+		return
+	}
+
+	var req roleService.RolPermissionRequest
+	if err := c.ShouldBindJSON(&req); err != nil {
+		response.Error(c, http.StatusBadRequest, "Invalid request body", err.Error())
+		return
+	}
+
+	ctx := c.Request.Context()
+	updated, err := h.service.Update(ctx, id, req)
+	if err != nil {
+		appErr := errors.FromError(err)
+		response.Error(c, appErr.HTTPStatus(), appErr.Error(), appErr.Metadata())
+		return
+	}
+
+	response.Success(c, http.StatusOK, "Successfully updated RolPermission", updated)
+}
+
+// Delete godoc
+//
+//	@Summary		Delete a Role Permission
+//	@Description	Delete a Role Permission record by ID
+//	@Tags			roles-permissions
+//	@Produce		json
+//	@Param			id	path		int	true	"Role Permission ID"
+//	@Success		200	{object}	response.Response
+//	@Security		BearerAuth
+//	@Router			/roles/permissions/{id} [delete]
+func (h *RolPermissionHandler) Delete(c *gin.Context) {
+	id, err := strconv.ParseInt(c.Param("id"), 10, 64)
+	if err != nil {
+		response.Error(c, http.StatusBadRequest, "Invalid ID format", nil)
+		return
+	}
+
+	ctx := c.Request.Context()
+	if err := h.service.Delete(ctx, id); err != nil {
+		appErr := errors.FromError(err)
+		response.Error(c, appErr.HTTPStatus(), appErr.Error(), appErr.Metadata())
+		return
+	}
+
+	response.Success(c, http.StatusOK, "Successfully deleted RolPermission", nil)
+}
+
+// GetRolePagesList mengambil daftar role beserta page dan permission-nya
+// @Summary Get Role Pages Access List
+// @Description Retrieve a paginated list of RolePages grouped by Role with Tree Hierarchy
+// @Tags roles-permissions
+// @Produce json
+// @Param id path string true "Role Master ID"
+// @Param page query integer false "Page number" default(1)
+// @Param limit query integer false "Items per page" default(10)
+// @Param active query boolean false "Filter by active status"
+// @Security BearerAuth
+// @Success 200 {object} response.Response
+// @Router /roles/permissions/rolemaster/{id} [get]
+func (h *RolPermissionHandler) GetRolePagesList(c *gin.Context) {
+	ctx := c.Request.Context()
+	roleID := c.Param("id")
+
+	// 1. Ambil Parameter Pagination
+	pageStr := c.DefaultQuery("page", "1")
+	limitStr := c.DefaultQuery("limit", "10")
+
+	page, err := strconv.Atoi(pageStr)
+	if err != nil || page < 1 {
+		page = 1
+	}
+	limit, err := strconv.Atoi(limitStr)
+	if err != nil || limit < -1 {
+		limit = 10
+	}
+
+	offset := (page - 1) * limit
+	if limit == -1 {
+		offset = 0 // Jika limit -1, fetch all data
+	}
+
+	// 2. Ambil Parameter Filter Active
+	defaultActive := true
+	activeFilter := &defaultActive
+	if activeStr := c.Query("active"); activeStr != "" {
+		parsedActive, err := strconv.ParseBool(activeStr)
+		if err == nil {
+			activeFilter = &parsedActive
+		}
+	}
+
+	// 3. Panggil Service layer
+	res, err := h.service.GetRolePagesList(ctx, roleID, limit, offset, activeFilter)
+	if err != nil {
+		c.JSON(http.StatusInternalServerError, gin.H{
+			"status":  "error",
+			"message": err.Error(),
+		})
+		return
+	}
+
+	// 4. Kalkulasi Metadata & Response Sesuai Format
+	total := res["total"].(int64)
+	totalPages := 1
+	if limit > 0 {
+		totalPages = int((total + int64(limit) - 1) / int64(limit))
+	}
+
+	// Format JSON Response
+	c.JSON(http.StatusOK, gin.H{
+		"status":  "success",
+		"message": "Successfully retrieved RolPages list",
+		"data":    res["data"],
+		"meta": gin.H{
+			"page":        page,
+			"limit":       limit,
+			"total":       total,
+			"total_pages": totalPages,
+		},
+	})
+}