feat(android): Google OAuth via system browser + deep link for Android

Background: Google blocks OAuth in embedded WebView (403 disallowed_useragent).
Solution: open Google login in the Android system browser, then deep-link
back to the Tauri app via custom scheme after callback.

Changes:
- Tauri: add tauri-plugin-opener + tauri-plugin-deep-link to Cargo.toml
- Tauri: register plugins in lib.rs, add capabilities
- Web: auth-form.tsx Google button uses openUrl() via @tauri-apps/plugin-opener
  on Tauri (opens in system browser), falls back to window.location.href
- Web: add lib/tauri.ts for isTauri() detection + lazy opens
- API: /auth/google accepts ?platform=tauri → encodes into OAuth state param
- API: /auth/google/callback decodes state → if tauri, renders HTML page
  that deep-links back via zeavisedu:// scheme; if web, 302 redirect
- Android: patch script adds deep link intent filter for zeavisedu:// scheme

Co-Authored-By: Claude <noreply@anthropic.com>

.github/workflows/android.yml

@@ -18,7 +18,7 @@ on:
   workflow_dispatch:
 
 env:
-  VITE_API_BASE_URL: ${{ vars.VITE_API_BASE_URL || 'https://zeavisedu.asepharyana.tech' }}
+  VITE_API_BASE_URL: ${{ vars.VITE_API_BASE_URL || 'https://zeavisedu.asepharyana.my.id' }}
 
 jobs:
   build-apk:
@@ -40,6 +40,18 @@ jobs:
         with:
           bun-version: latest
 
+      - name: Cache Bun dependencies
+        uses: actions/cache@v4
+        with:
+          path: |
+            ~/.bun/install/cache
+            node_modules
+            apps/*/node_modules
+            packages/*/node_modules
+          key: ${{ runner.os }}-bun-${{ hashFiles('bun.lock', '**/package.json') }}
+          restore-keys: |
+            ${{ runner.os }}-bun-
+
       - name: Install dependencies
         run: bun install
 
@@ -52,7 +64,9 @@ jobs:
       - name: Setup Android SDK
         uses: android-actions/setup-android@v3
         with:
-          packages: 'platforms;android-36 build-tools;36.0.0 ndk;28.0.13004108'
+          packages: 'platforms;android-36 build-tools;36.0.0'
+      - name: Pin NDK version
+        run: echo "ANDROID_NDK_HOME=${ANDROID_SDK_ROOT}/ndk/$(ls ${ANDROID_SDK_ROOT}/ndk | sort -V | head -1)" >> $GITHUB_ENV
 
       - name: Setup Rust with Android targets
         uses: dtolnay/rust-toolchain@stable
@@ -74,6 +88,16 @@ jobs:
           restore-keys: |
             ${{ runner.os }}-cargo-android-
 
+      - name: Cache Gradle
+        uses: actions/cache@v4
+        with:
+          path: |
+            ~/.gradle/caches
+            ~/.gradle/wrapper
+          key: ${{ runner.os }}-gradle-android-${{ hashFiles('apps/tauri/Cargo.lock') }}
+          restore-keys: |
+            ${{ runner.os }}-gradle-android-
+
       - name: Install Tauri CLI
         run: cd apps/tauri && bun install
 
@@ -108,7 +132,13 @@ jobs:
           JAVA_HOME: ${{ env.JAVA_HOME_21_X64 }}
           ANDROID_HOME: ${{ env.ANDROID_SDK_ROOT }}
           NDK_HOME: ${{ env.ANDROID_NDK_HOME }}
-        run: bun tauri android init
+        run: |
+          rm -rf gen/android
+          bun tauri android init
+
+      - name: Patch AndroidManifest (CAMERA permission)
+        working-directory: apps/tauri
+        run: bash scripts/patch-android-manifest.sh
 
       - name: Build Tauri Android APK
         working-directory: apps/tauri
@@ -116,7 +146,7 @@ jobs:
           JAVA_HOME: ${{ env.JAVA_HOME_21_X64 }}
           ANDROID_HOME: ${{ env.ANDROID_SDK_ROOT }}
           NDK_HOME: ${{ env.ANDROID_NDK_HOME }}
-        run: bun tauri android build
+        run: bun tauri android build --apk
 
       - name: Decode keystore
         if: github.event_name != 'pull_request'

.github/workflows/deploy.yml

@@ -177,8 +177,11 @@ jobs:
               cat << 'ENVEOF'
             DATABASE_URL=${{ secrets.DATABASE_URL }}
             SESSION_SECRET=${{ secrets.SESSION_SECRET }}
-            WEB_APP_URL=https://zeavisedu.asepharyana.tech
+            WEB_APP_URL=https://zeavisedu.asepharyana.my.id
             ML_SERVICE_URL=http://zeavis-ml:8000
+            GOOGLE_CLIENT_ID=${{ secrets.GOOGLE_CLIENT_ID }}
+            GOOGLE_CLIENT_SECRET=${{ secrets.GOOGLE_CLIENT_SECRET }}
+            GOOGLE_REDIRECT_URI=https://zeavisedu.asepharyana.my.id/api/v1/auth/google/callback
             ENVEOF
             } > .env
 
@@ -189,8 +192,17 @@ jobs:
             docker rm -f zeavis-web zeavis-api zeavis-ml zeavis-node-exporter 2>/dev/null || true
             docker compose pull
             docker compose up -d
+            # Wait for containers to be healthy (up to 60s)
+            wait_container() {
+              local name=$1
+              for i in $(seq 1 30); do
+                docker compose ps | grep -q "${name}.*Up" && return 0
+                sleep 2
+              done
+              return 1
+            }
+            wait_container zeavis-web || exit 1
+            wait_container zeavis-api || exit 1
+            wait_container zeavis-ml || exit 1
+            wait_container zeavis-node-exporter || echo "⚠️  node_exporter not running (non-fatal)"
             docker compose ps
-            docker compose ps | grep -q "zeavis-web.*Up" || exit 1
-            docker compose ps | grep -q "zeavis-api.*Up" || exit 1
-            docker compose ps | grep -q "zeavis-ml.*Up" || exit 1
-            docker compose ps | grep -q "zeavis-node-exporter.*Up" || echo "⚠️  node_exporter not running (non-fatal)"

apps/api/Dockerfile

@@ -1,9 +1,10 @@
 FROM oven/bun:1.3.14 AS deps
 WORKDIR /app
 
-COPY package.json bunfig.toml tsconfig.base.json ./
+COPY package.json bun.lock bunfig.toml tsconfig.base.json ./
 COPY apps/api/package.json apps/api/package.json
 COPY apps/web/package.json apps/web/package.json
+COPY apps/tauri/package.json apps/tauri/package.json
 COPY packages/shared/package.json packages/shared/package.json
 RUN bun install --production
 
@@ -13,6 +14,8 @@ ENV NODE_ENV=production
 ENV API_PORT=3000
 
 COPY --from=deps /app/node_modules ./node_modules
+COPY --from=deps /app/apps/api/node_modules apps/api/node_modules
+COPY --from=deps /app/bun.lock ./bun.lock
 COPY package.json bunfig.toml tsconfig.base.json ./
 COPY apps/api apps/api
 COPY packages/shared packages/shared

apps/api/src/config/env.ts

@@ -8,6 +8,13 @@ const googleOAuthEnabled = Boolean(
 );
 
 const webAppUrl = Bun.env.WEB_APP_URL ?? 'http://localhost:5173';
+const allowedOrigins = [
+  webAppUrl,
+  'https://tauri.localhost',
+  'http://tauri.localhost',
+  'tauri://localhost',
+  'http://localhost:5173',
+];
 const secureCookies = Bun.env.SECURE_COOKIES === 'true' || webAppUrl.startsWith('https://');
 
 export const env = {
@@ -24,6 +31,7 @@ export const env = {
   googleClientSecret: Bun.env.GOOGLE_CLIENT_SECRET,
   googleRedirectUri: Bun.env.GOOGLE_REDIRECT_URI,
   webAppUrl,
+  allowedOrigins,
   secureCookies,
 };
 

apps/api/src/index.ts

@@ -17,7 +17,7 @@ assertRequiredEnv();
 
 const app = new Elysia()
   .use(cors({
-    origin: env.webAppUrl,
+    origin: env.allowedOrigins,
     credentials: true,
   }))
   .use(metricsRoutes)

apps/api/src/lib/auth.ts

@@ -28,14 +28,26 @@ function hashToken(token: string) {
   return createHash('sha256').update(`${env.sessionSecret}:${token}`).digest('hex');
 }
 
-export function createSessionCookie(token: string) {
+function isSecureRequest(headers?: { get(name: string): string | null }) {
+  if (env.secureCookies) return true;
+  // Detect HTTPS behind proxy (X-Forwarded-Proto)
+  const proto = headers?.get('x-forwarded-proto');
+  if (proto === 'https') return true;
+  return false;
+}
+
+function buildSameSite(headers?: { get(name: string): string | null }) {
+  return isSecureRequest(headers) ? 'SameSite=None; Secure' : 'SameSite=Lax';
+}
+
+export function createSessionCookie(token: string, headers?: { get(name: string): string | null }) {
   const maxAge = 60 * 60 * 24 * 30;
-  const sameSite = env.secureCookies ? 'SameSite=None; Secure' : 'SameSite=Lax';
+  const sameSite = buildSameSite(headers);
   return `${sessionCookieName}=${token}; HttpOnly; Path=/; ${sameSite}; Max-Age=${maxAge}`;
 }
 
-export function clearSessionCookie() {
-  const sameSite = env.secureCookies ? 'SameSite=None; Secure' : 'SameSite=Lax';
+export function clearSessionCookie(headers?: { get(name: string): string | null }) {
+  const sameSite = buildSameSite(headers);
   return `${sessionCookieName}=; HttpOnly; Path=/; ${sameSite}; Max-Age=0`;
 }
 
@@ -49,6 +61,19 @@ export function readSessionToken(cookieHeader: string | null | undefined) {
   return decodeURIComponent(sessionCookie.slice(sessionCookieName.length + 1));
 }
 
+/**
+ * Extract bearer token from Authorization header.
+ * Used as fallback when cookies are blocked (e.g. Android WebView third-party blocking).
+ */
+export function readBearerToken(headers?: { get(name: string): string | null }) {
+  if (!headers) return null;
+  const auth = headers.get('authorization');
+  if (!auth) return null;
+  const parts = auth.split(' ');
+  if (parts.length !== 2 || parts[0] !== 'Bearer') return null;
+  return parts[1];
+}
+
 export async function createSession(userId: string) {
   const db = createDbClient();
   const token = randomBytes(32).toString('base64url');
@@ -71,8 +96,12 @@ export async function deleteSession(token: string | null) {
   await db.delete(sessions).where(eq(sessions.tokenHash, hashToken(token)));
 }
 
-export async function getCurrentUser(cookieHeader: string | null | undefined): Promise<CurrentUser | null> {
-  const token = readSessionToken(cookieHeader);
+export async function getCurrentUser(
+  cookieHeader: string | null | undefined,
+  headers?: { get(name: string): string | null },
+): Promise<CurrentUser | null> {
+  // Try cookie first, then Authorization header (for Android WebView where 3rd-party cookies are blocked)
+  const token = readSessionToken(cookieHeader) ?? readBearerToken(headers);
   if (!token) return null;
 
   const db = createDbClient();

apps/api/src/routes/auth.ts

@@ -18,6 +18,86 @@ import {
 import { env } from '../config/env';
 import { authCounter } from '../lib/telemetry';
 
+// ── Google OAuth Helpers ──────────────────────────────────────────────
+
+interface GoogleTokenResponse {
+  access_token: string;
+  id_token: string;
+}
+
+interface GoogleIdPayload {
+  sub: string;
+  email: string;
+  email_verified: boolean;
+  name: string;
+  picture?: string;
+}
+
+async function exchangeGoogleCode(code: string): Promise<GoogleTokenResponse> {
+  const res = await fetch('https://oauth2.googleapis.com/token', {
+    method: 'POST',
+    headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
+    body: new URLSearchParams({
+      code,
+      client_id: env.googleClientId!,
+      client_secret: env.googleClientSecret!,
+      redirect_uri: env.googleRedirectUri!,
+      grant_type: 'authorization_code',
+    }),
+  });
+
+  if (!res.ok) {
+    const err = await res.text();
+    throw new Error(`Google token exchange failed: ${res.status} ${err}`);
+  }
+
+  return res.json() as Promise<GoogleTokenResponse>;
+}
+
+function decodeGoogleIdToken(idToken: string): GoogleIdPayload {
+  const parts = idToken.split('.');
+  if (parts.length !== 3) {
+    throw new Error('Invalid id_token format');
+  }
+  const payload = Buffer.from(parts[1], 'base64url').toString('utf-8');
+  return JSON.parse(payload);
+}
+
+/**
+ * Render a page for the Android system browser that redirects back to the
+ * Tauri app via a custom scheme (zeavisedu://). The app's AndroidManifest
+ * must register an intent filter for this scheme.
+ */
+function renderTauriDeepLinkPage(targetUrl: string): Response {
+  // Rewrite https://... to zeavisedu://... for the custom scheme
+  const deepLink = targetUrl.replace(/^https?:\/\//, 'zeavisedu://');
+  const html = `<!DOCTYPE html>
+<html><head><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1">
+<title>Kembali ke ZeaVis Edu</title></head>
+<body style="font-family:sans-serif;display:flex;align-items:center;justify-content:center;min-height:100vh;margin:0;background:#f0fdf4">
+<div style="text-align:center;padding:2rem">
+<p style="color:#166534;font-size:1.1rem;margin-bottom:1.5rem">Login berhasil!<br>Kembali ke aplikasi...</p>
+<a href="${deepLink.replace(/"/g, '&quot;')}" style="display:inline-block;background:#16a34a;color:white;padding:0.75rem 2rem;border-radius:0.5rem;text-decoration:none;font-weight:600;font-size:1rem">Buka ZeaVis Edu</a>
+<p style="color:#6b7280;font-size:0.8rem;margin-top:1rem">Jika tombol tidak berfungsi, salin URL ini:<br><code style="word-break:break-all;font-size:0.75rem">${deepLink.replace(/</g, '&lt;')}</code></p>
+</div>
+<script>window.location.href=${JSON.stringify(deepLink)};</script>
+</body></html>`;
+  return new Response(html, {
+    status: 200,
+    headers: { 'Content-Type': 'text/html;charset=utf-8' },
+  });
+}
+
+function resolvePlatform(stateRaw: string | undefined): string {
+  try {
+    if (stateRaw) {
+      const parsed = JSON.parse(Buffer.from(stateRaw, 'base64url').toString('utf-8'));
+      return parsed.platform ?? 'web';
+    }
+  } catch { /* ignore */ }
+  return 'web';
+}
+
 function normalizeEmail(email: unknown) {
   return typeof email === 'string' ? email.trim().toLowerCase() : '';
 }
@@ -32,13 +112,13 @@ function validatePassword(password: unknown) {
 
 export const authRoutes = new Elysia({ prefix: '/api/v1/auth' })
   .get('/me', async ({ request }) => {
-    const user = await getCurrentUser(request.headers.get('cookie'));
+    const user = await getCurrentUser(request.headers.get('cookie'), request.headers);
     return {
       user,
       features: getAuthFeatures(),
     };
   })
-  .post('/register', async ({ body, set }) => {
+  .post('/register', async ({ body, set, request }) => {
     const req = body as Partial<RegisterRequest> | undefined;
     const email = normalizeEmail(req?.email);
     const name = normalizeName(req?.name);
@@ -62,7 +142,7 @@ export const authRoutes = new Elysia({ prefix: '/api/v1/auth' })
 
       const user = inserted[0];
       const token = await createSession(user.id);
-      set.headers['Set-Cookie'] = createSessionCookie(token);
+      set.headers['Set-Cookie'] = createSessionCookie(token, request.headers);
 
       authCounter.labels('register', 'true').inc();
 
@@ -73,13 +153,14 @@ export const authRoutes = new Elysia({ prefix: '/api/v1/auth' })
           name: user.name,
           role: 'user' as const,
         },
+        token,
         features: getAuthFeatures(),
       };
     } catch (error) {
       return serviceUnavailable('Database unavailable');
     }
   })
-  .post('/login', async ({ body, set }) => {
+  .post('/login', async ({ body, set, request }) => {
     const req = body as Partial<AuthRequest> | undefined;
     const email = normalizeEmail(req?.email);
 
@@ -98,7 +179,7 @@ export const authRoutes = new Elysia({ prefix: '/api/v1/auth' })
       }
 
       const token = await createSession(user.id);
-      set.headers['Set-Cookie'] = createSessionCookie(token);
+      set.headers['Set-Cookie'] = createSessionCookie(token, request.headers);
 
       authCounter.labels('login', 'true').inc();
 
@@ -109,6 +190,7 @@ export const authRoutes = new Elysia({ prefix: '/api/v1/auth' })
           name: user.name,
           role: user.role === 'expert' ? 'expert' as const : 'user' as const,
         },
+        token,
         features: getAuthFeatures(),
       };
     } catch (error) {
@@ -116,16 +198,20 @@ export const authRoutes = new Elysia({ prefix: '/api/v1/auth' })
     }
   })
   .post('/logout', async ({ request, set }) => {
-    await deleteSession(readSessionToken(request.headers.get('cookie')));
-    set.headers['Set-Cookie'] = clearSessionCookie();
+    const cookieHeader = request.headers.get('cookie');
+    await deleteSession(readSessionToken(cookieHeader));
+    set.headers['Set-Cookie'] = clearSessionCookie(request.headers);
     return { ok: true };
   })
-  .get('/google', ({ set }) => {
+  .get('/google', ({ query, set }) => {
     if (!env.googleOAuthEnabled) {
       set.status = 404;
       return { error: 'Google OAuth is not configured' };
     }
 
+    const platform = (query as Record<string, string>).platform ?? 'web';
+    const state = Buffer.from(JSON.stringify({ platform })).toString('base64url');
+
     const params = new URLSearchParams({
       client_id: env.googleClientId!,
       redirect_uri: env.googleRedirectUri!,
@@ -133,15 +219,96 @@ export const authRoutes = new Elysia({ prefix: '/api/v1/auth' })
       scope: 'openid email profile',
       access_type: 'offline',
       prompt: 'select_account',
+      state,
     });
 
-    set.redirect = `https://accounts.google.com/o/oauth2/v2/auth?${params.toString()}`;
+    set.status = 302;
+    set.headers['Location'] = `https://accounts.google.com/o/oauth2/v2/auth?${params.toString()}`;
   })
-  .get('/google/callback', ({ set }) => {
+  .get('/google/callback', async ({ query, set, request }) => {
     if (!env.googleOAuthEnabled) {
       set.status = 404;
       return { error: 'Google OAuth is not configured' };
     }
 
-    set.redirect = `${env.webAppUrl}/login?oauth=not-implemented`;
+    const q = query as Record<string, string>;
+    const code = q.code;
+    const error = q.error;
+    const platform = resolvePlatform(q.state);
+
+    // User denied or Google returned an error
+    const makeErrorUrl = (msg: string) =>
+      `${env.webAppUrl}/login?error=${encodeURIComponent(msg)}`;
+
+    if (error || !code) {
+      const url = makeErrorUrl(error ?? 'missing_code');
+      if (platform === 'tauri') return renderTauriDeepLinkPage(url);
+      set.status = 302;
+      set.headers['Location'] = url;
+      return;
+    }
+
+    // Exchange authorization code for tokens
+    let idPayload: GoogleIdPayload;
+    try {
+      const tokens = await exchangeGoogleCode(code);
+      idPayload = decodeGoogleIdToken(tokens.id_token);
+    } catch (err) {
+      const msg = err instanceof Error ? err.message : 'Google auth failed';
+      const url = makeErrorUrl(msg);
+      if (platform === 'tauri') return renderTauriDeepLinkPage(url);
+      set.status = 302;
+      set.headers['Location'] = url;
+      return;
+    }
+
+    // Validate email
+    if (!idPayload.email_verified || !idPayload.email) {
+      const url = makeErrorUrl('Email not verified by Google');
+      if (platform === 'tauri') return renderTauriDeepLinkPage(url);
+      set.status = 302;
+      set.headers['Location'] = url;
+      return;
+    }
+
+    const googleId = idPayload.sub;
+    const email = idPayload.email.trim().toLowerCase();
+    const name = idPayload.name?.trim() ?? email.split('@')[0];
+
+    try {
+      const db = createDbClient();
+
+      let user = await db.select().from(users).where(eq(users.googleId, googleId)).limit(1).then(r => r[0] ?? null);
+
+      if (!user) {
+        user = await db.select().from(users).where(eq(users.email, email)).limit(1).then(r => r[0] ?? null);
+        if (user) {
+          await db.update(users).set({ googleId }).where(eq(users.id, user.id));
+        }
+      }
+
+      if (!user) {
+        const inserted = await db
+          .insert(users)
+          .values({ email, name, googleId, role: 'user' })
+          .returning();
+        user = inserted[0];
+        authCounter.labels('register', 'true').inc();
+      }
+
+      const token = await createSession(user.id);
+      set.headers['Set-Cookie'] = createSessionCookie(token, request.headers);
+
+      authCounter.labels('login', 'true').inc();
+
+      const successUrl = `${env.webAppUrl}/login?token=${encodeURIComponent(token)}`;
+      if (platform === 'tauri') return renderTauriDeepLinkPage(successUrl);
+      set.status = 302;
+      set.headers['Location'] = successUrl;
+    } catch (err) {
+      const url = makeErrorUrl('Database unavailable');
+      if (platform === 'tauri') return renderTauriDeepLinkPage(url);
+      set.status = 302;
+      set.headers['Location'] = url;
+    }
   });

apps/api/src/routes/dashboard.ts

@@ -13,7 +13,7 @@ export const dashboardRoutes = new Elysia({ prefix: '/api/v1' })
   .get('/dashboard/summary', async ({ request }) => {
     try {
       const db = createDbClient();
-      const user = await getCurrentUser(request.headers.get('cookie'));
+      const user = await getCurrentUser(request.headers.get('cookie'), request.headers);
 
       const diseases = await db.select().from(diseaseCatalog).orderBy(diseaseCatalog.displayOrder);
       const manualRows = await db.select().from(manualClassifications).orderBy(desc(manualClassifications.createdAt)).limit(1);

apps/api/src/routes/diagnoses.ts

@@ -175,7 +175,7 @@ function getFileFromBody(body: unknown): File | null {
 
 export const diagnosisRoutes = new Elysia({ prefix: '/api/v1' })
   .post('/diagnoses', async ({ body, request }) => {
-    const user = await getCurrentUser(request.headers.get('cookie'));
+    const user = await getCurrentUser(request.headers.get('cookie'), request.headers);
     if (!user) return unauthorized('Authentication required');
 
     const file = getFileFromBody(body);
@@ -251,7 +251,7 @@ export const diagnosisRoutes = new Elysia({ prefix: '/api/v1' })
     }
   })
   .get('/diagnoses', async ({ request }) => {
-    const user = await getCurrentUser(request.headers.get('cookie'));
+    const user = await getCurrentUser(request.headers.get('cookie'), request.headers);
     if (!user) return unauthorized('Authentication required');
 
     try {
@@ -270,7 +270,7 @@ export const diagnosisRoutes = new Elysia({ prefix: '/api/v1' })
     }
   })
   .get('/diagnoses/:id', async ({ params, request }) => {
-    const user = await getCurrentUser(request.headers.get('cookie'));
+    const user = await getCurrentUser(request.headers.get('cookie'), request.headers);
     if (!user) return unauthorized('Authentication required');
 
     try {

apps/api/src/routes/expert.ts

@@ -16,7 +16,7 @@ function isDiagnosisRecordOrNull(record: unknown): record is DiagnosisRecord {
 
 export const expertRoutes = new Elysia({ prefix: '/api/v1/expert' })
   .get('/reviews', async ({ request }) => {
-    const user = await getCurrentUser(request.headers.get('cookie'));
+    const user = await getCurrentUser(request.headers.get('cookie'), request.headers);
     if (!user) return unauthorized('Authentication required');
     if (user.role !== 'expert') return forbidden('Expert role required');
 
@@ -36,7 +36,7 @@ export const expertRoutes = new Elysia({ prefix: '/api/v1/expert' })
     }
   })
   .post('/reviews/:diagnosisId', async ({ params, body, request }) => {
-    const user = await getCurrentUser(request.headers.get('cookie'));
+    const user = await getCurrentUser(request.headers.get('cookie'), request.headers);
     if (!user) return unauthorized('Authentication required');
     if (user.role !== 'expert') return forbidden('Expert role required');
 

apps/tauri/.idea/.gitignore

@@ -0,0 +1,3 @@
+# Default ignored files
+/shelf/
+/workspace.xml

apps/tauri/.idea/deviceManager.xml

@@ -0,0 +1,13 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<project version="4">
+  <component name="DeviceTable">
+    <option name="columnSorters">
+      <list>
+        <ColumnSorterState>
+          <option name="column" value="Name" />
+          <option name="order" value="ASCENDING" />
+        </ColumnSorterState>
+      </list>
+    </option>
+  </component>
+</project>

apps/tauri/.idea/misc.xml

@@ -0,0 +1,17 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<project version="4">
+  <component name="DiscordProjectSettings">
+    <option name="show" value="ASK" />
+    <option name="description" value="" />
+    <option name="applicationTheme" value="default" />
+    <option name="iconsTheme" value="default" />
+    <option name="button1Title" value="" />
+    <option name="button1Url" value="" />
+    <option name="button2Title" value="" />
+    <option name="button2Url" value="" />
+    <option name="customApplicationId" value="" />
+  </component>
+  <component name="ProjectRootManager" version="2">
+    <output url="file://$PROJECT_DIR$/out" />
+  </component>
+</project>

apps/tauri/.idea/modules.xml

@@ -0,0 +1,8 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<project version="4">
+  <component name="ProjectModuleManager">
+    <modules>
+      <module fileurl="file://$PROJECT_DIR$/.idea/tauri.iml" filepath="$PROJECT_DIR$/.idea/tauri.iml" />
+    </modules>
+  </component>
+</project>

apps/tauri/.idea/tauri.iml

@@ -0,0 +1,9 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<module type="JAVA_MODULE" version="4">
+  <component name="NewModuleRootManager" inherit-compiler-output="true">
+    <exclude-output />
+    <content url="file://$MODULE_DIR$" />
+    <orderEntry type="inheritedJdk" />
+    <orderEntry type="sourceFolder" forTests="false" />
+  </component>
+</module>

apps/tauri/.idea/vcs.xml

@@ -0,0 +1,6 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<project version="4">
+  <component name="VcsDirectoryMappings">
+    <mapping directory="$PROJECT_DIR$/../.." vcs="Git" />
+  </component>
+</project>

apps/tauri/Cargo.toml

@@ -12,5 +12,7 @@ tauri-build = { version = "2", features = [] }
 
 [dependencies]
 tauri = { version = "2", default-features = false, features = ["wry", "common-controls-v6", "dynamic-acl", "x11", "dbus", "custom-protocol"] }
+tauri-plugin-opener = "2"
+tauri-plugin-deep-link = "2"
 serde = { version = "1", features = ["derive"] }
 serde_json = "1"

apps/tauri/capabilities/default.json

@@ -3,6 +3,9 @@
   "description": "Capability for the main window",
   "windows": ["main"],
   "permissions": [
-    "core:default"
+    "core:default",
+    "opener:default",
+    "opener:allow-open-url",
+    "deep-link:default"
   ]
 }

apps/tauri/scripts/patch-android-manifest.sh

@@ -0,0 +1,45 @@
+#!/usr/bin/env bash
+# Patches the generated AndroidManifest.xml with:
+# 1. CAMERA permission
+# 2. Deep link intent filter (zeavisedu:// scheme) for Google OAuth return
+# Run after `tauri android init` to apply.
+set -euo pipefail
+
+MANIFEST="gen/android/app/src/main/AndroidManifest.xml"
+
+if [ ! -f "$MANIFEST" ]; then
+  echo "ERROR: $MANIFEST not found. Run 'tauri android init' first." >&2
+  exit 1
+fi
+
+# ── CAMERA permission ──────────────────────────────────────────────────
+
+if ! grep -q 'android.permission.CAMERA' "$MANIFEST"; then
+  echo "Adding CAMERA permission to AndroidManifest.xml..."
+  sed -i 's|<uses-permission android:name="android.permission.INTERNET" />|<uses-permission android:name="android.permission.INTERNET" />\n    <uses-permission android:name="android.permission.CAMERA" />\n    <uses-feature android:name="android.hardware.camera" android:required="false" />\n    <uses-feature android:name="android.hardware.camera.autofocus" android:required="false" />|' "$MANIFEST"
+else
+  echo "CAMERA permission already present."
+fi
+
+# ── Deep link intent filter ────────────────────────────────────────────
+# Allows the app to receive zeavisedu:// scheme URLs from the system browser
+# (used after Google OAuth completes in external browser on Android)
+
+DEEP_LINK_FILTER='<!-- Deep link for Google OAuth return from system browser -->\
+        <intent-filter android:autoVerify="true">\
+            <action android:name="android.intent.action.VIEW" />\
+            <category android:name="android.intent.category.DEFAULT" />\
+            <category android:name="android.intent.category.BROWSABLE" />\
+            <data android:scheme="zeavisedu" />\
+        </intent-filter>'
+
+if grep -q 'android:scheme="zeavisedu"' "$MANIFEST"; then
+  echo "Deep link intent filter already present."
+else
+  echo "Adding deep link intent filter to AndroidManifest.xml..."
+  # Insert before the closing </activity> tag of MainActivity
+  sed -i "s|</activity>|${DEEP_LINK_FILTER}\n        </activity>|" "$MANIFEST"
+  echo "Deep link intent filter added."
+fi
+
+echo "AndroidManifest patched successfully."

apps/tauri/src/lib.rs

@@ -1,6 +1,8 @@
 #[cfg_attr(mobile, tauri::mobile_entry_point)]
 pub fn run() {
     tauri::Builder::default()
+        .plugin(tauri_plugin_opener::init())
+        .plugin(tauri_plugin_deep_link::init())
         .run(tauri::generate_context!())
         .expect("error while running tauri application");
 }

apps/web/Dockerfile

@@ -1,10 +1,11 @@
 FROM oven/bun:1.3.14 AS builder
 WORKDIR /app
 
-COPY package.json bunfig.toml tsconfig.base.json ./
+COPY package.json bun.lock bunfig.toml tsconfig.base.json ./
 COPY packages/shared/package.json packages/shared/package.json
 COPY apps/web/package.json apps/web/package.json
 COPY apps/api/package.json apps/api/package.json
+COPY apps/tauri/package.json apps/tauri/package.json
 RUN bun install
 
 COPY packages/shared packages/shared

apps/web/src/components/auth-form.tsx

@@ -1,9 +1,10 @@
-import { FormEvent, useState } from 'react';
+import { FormEvent, useState, useCallback } from 'react';
 import { Eye, EyeOff } from 'lucide-react';
 import { Button } from '@/components/ui/button';
 import { Card, CardContent, CardDescription, CardHeader, CardTitle } from '@/components/ui/card';
 import { Input } from '@/components/ui/input';
 import { Label } from '@/components/ui/label';
+import { isTauri, openUrl } from '@/lib/tauri';
 
 type AuthFormProps = {
   mode: 'login' | 'register';
@@ -25,6 +26,14 @@ export function AuthForm({ mode, isSubmitting, error, googleOAuthEnabled, onSubm
     await onSubmit({ name, email, password });
   }
 
+  const handleGoogleLogin = useCallback(async (e: React.MouseEvent) => {
+    e.preventDefault();
+    const platform = isTauri() ? 'tauri' : 'web';
+    const base = window.location.origin;
+    const googleUrl = `${base}/api/v1/auth/google?platform=${platform}`;
+    await openUrl(googleUrl);
+  }, []);
+
   return (
     <Card className="mx-auto w-full max-w-md">
       <CardHeader>
@@ -75,8 +84,15 @@ export function AuthForm({ mode, isSubmitting, error, googleOAuthEnabled, onSubm
           </Button>
         </form>
         {googleOAuthEnabled && (
-          <Button className="mt-3 w-full" variant="outline" asChild>
-            <a href="/api/v1/auth/google">Masuk dengan Google</a>
+          <Button className="mt-3 w-full flex items-center justify-center gap-2.5" variant="outline" onClick={handleGoogleLogin} type="button">
+            <svg viewBox="0 0 24 24" className="h-5 w-5" aria-hidden="true">
+              <path fill="#4285F4" d="M22.56 12.25c0-.78-.07-1.53-.2-2.25H12v4.26h5.92a5.06 5.06 0 0 1-2.2 3.32v2.77h3.57c2.08-1.92 3.28-4.74 3.28-8.1z" />
+              <path fill="#34A853" d="M12 23c2.97 0 5.46-.98 7.28-2.66l-3.57-2.77c-.98.66-2.23 1.06-3.71 1.06-2.86 0-5.29-1.93-6.16-4.53H2.18v2.84C3.99 20.53 7.7 23 12 23z" />
+              <path fill="#FBBC05" d="M5.84 14.09c-.22-.66-.35-1.36-.35-2.09s.13-1.43.35-2.09V7.07H2.18C1.43 8.55 1 10.22 1 12s.43 3.45 1.18 4.93l2.85-2.22.81-.62z" />
+              <path fill="#EA4335" d="M12 5.38c1.62 0 3.06.56 4.21 1.64l3.15-3.15C17.45 2.09 14.97 1 12 1 7.7 1 3.99 3.47 2.18 7.07l3.66 2.84c.87-2.6 3.3-4.53 6.16-4.53z" />
+              <path fill="none" d="M1 1h22v22H1z" />
+            </svg>
+            Masuk dengan Google
           </Button>
         )}
       </CardContent>

apps/web/src/components/auth-guard.tsx

@@ -10,27 +10,32 @@ type AuthGuardProps = {
 };
 
 export function AuthGuard({ children, requireExpert = false }: AuthGuardProps) {
+  const user = useAuthStore((state) => state.user);
   const setUser = useAuthStore((state) => state.setUser);
   const query = useQuery({
     queryKey: ['auth', 'me'],
     queryFn: () => apiClient.getMe(),
+    staleTime: 30_000,
   });
 
   useEffect(() => {
-    if (query.data) {
+    if (query.data?.user) {
       setUser(query.data.user);
     }
   }, [query.data, setUser]);
 
-  if (query.isLoading) {
+  // Tunjukkan loading hanya jika belum ada user di store
+  if (query.isLoading && !user) {
     return <main className="min-h-screen p-8 text-center text-muted-foreground">Memeriksa sesi...</main>;
   }
 
-  if (!query.data?.user) {
+  // Cek store dulu, baru query — mencegah redirect saat refetch background
+  const currentUser = query.data?.user ?? user;
+  if (!currentUser) {
     return <Navigate to="/login" replace />;
   }
 
-  if (requireExpert && query.data.user.role !== 'expert') {
+  if (requireExpert && currentUser.role !== 'expert') {
     return <Navigate to="/dashboard" replace />;
   }
 

apps/web/src/components/auth-initializer.tsx

@@ -9,10 +9,11 @@ export function AuthInitializer() {
     queryKey: ['auth', 'me'],
     queryFn: () => apiClient.getMe(),
     retry: false,
+    staleTime: 30_000,
   });
 
   useEffect(() => {
-    if (query.data) {
+    if (query.data?.user) {
       setUser(query.data.user);
     }
   }, [query.data, setUser]);

apps/web/src/components/camera-capture.tsx

@@ -0,0 +1,202 @@
+import { useRef, useState, useCallback, useEffect } from "react";
+import { SwitchCamera, CameraOff, Aperture } from "lucide-react";
+import { Button } from "@/components/ui/button";
+
+interface CameraCaptureProps {
+  onCapture: (file: File) => void;
+  onClose: () => void;
+}
+
+type FacingMode = "environment" | "user";
+
+export function CameraCapture({ onCapture, onClose }: CameraCaptureProps) {
+  const videoRef = useRef<HTMLVideoElement | null>(null);
+  const streamRef = useRef<MediaStream | null>(null);
+  const canvasRef = useRef<HTMLCanvasElement | null>(null);
+  const [facingMode, setFacingMode] = useState<FacingMode>("environment");
+  const [status, setStatus] = useState<"loading" | "ready" | "error" | "denied">("loading");
+  const [errorMsg, setErrorMsg] = useState<string>("");
+
+  const stopStream = useCallback(() => {
+    if (streamRef.current) {
+      streamRef.current.getTracks().forEach((t) => t.stop());
+      streamRef.current = null;
+    }
+  }, []);
+
+  const startCamera = useCallback(
+    async (mode: FacingMode) => {
+      stopStream();
+      setStatus("loading");
+      setErrorMsg("");
+
+      try {
+        const stream = await navigator.mediaDevices.getUserMedia({
+          video: {
+            facingMode: mode,
+            width: { ideal: 1920 },
+            height: { ideal: 1080 },
+          },
+          audio: false,
+        });
+
+        streamRef.current = stream;
+        if (videoRef.current) {
+          videoRef.current.srcObject = stream;
+          await videoRef.current.play();
+        }
+        setStatus("ready");
+      } catch (err: unknown) {
+        const e = err as DOMException;
+        if (e.name === "NotAllowedError" || e.name === "PermissionDeniedError") {
+          setStatus("denied");
+          setErrorMsg("Izin kamera ditolak. Buka pengaturan untuk mengizinkan akses kamera.");
+        } else if (e.name === "NotFoundError") {
+          setStatus("error");
+          setErrorMsg("Kamera tidak ditemukan pada perangkat ini.");
+        } else if (e.name === "NotReadableError") {
+          setStatus("error");
+          setErrorMsg("Kamera sedang digunakan oleh aplikasi lain.");
+        } else {
+          setStatus("error");
+          setErrorMsg(`Gagal mengakses kamera: ${e.message}`);
+        }
+      }
+    },
+    [stopStream],
+  );
+
+  // Start camera on mount
+  useEffect(() => {
+    startCamera(facingMode);
+    return () => stopStream();
+  }, []); // eslint-disable-line react-hooks/exhaustive-deps
+
+  const toggleFacing = () => {
+    const next = facingMode === "environment" ? "user" : "environment";
+    setFacingMode(next);
+    startCamera(next);
+  };
+
+  const handleCapture = () => {
+    const video = videoRef.current;
+    const canvas = canvasRef.current;
+    if (!video || !canvas) return;
+
+    const vw = video.videoWidth;
+    const vh = video.videoHeight;
+    canvas.width = vw;
+    canvas.height = vh;
+
+    const ctx = canvas.getContext("2d");
+    if (!ctx) return;
+
+    ctx.drawImage(video, 0, 0, vw, vh);
+    canvas.toBlob(
+      (blob) => {
+        if (!blob) return;
+        const file = new File([blob], `camera-${Date.now()}.jpg`, {
+          type: "image/jpeg",
+        });
+        stopStream();
+        onCapture(file);
+      },
+      "image/jpeg",
+      0.92,
+    );
+  };
+
+  return (
+    <div className="flex flex-col items-center gap-3 w-full">
+      {/* Viewfinder */}
+      <div className="relative w-full rounded-xl overflow-hidden bg-black aspect-[4/3] max-h-[420px]">
+        {status === "loading" && (
+          <div className="absolute inset-0 flex items-center justify-center bg-black/80 text-white">
+            <div className="flex flex-col items-center gap-2">
+              <div className="h-8 w-8 border-2 border-white border-t-transparent rounded-full animate-spin" />
+              <span className="text-sm">Membuka kamera...</span>
+            </div>
+          </div>
+        )}
+
+        {(status === "error" || status === "denied") && (
+          <div className="absolute inset-0 flex items-center justify-center bg-black/90 text-white p-6">
+            <div className="flex flex-col items-center gap-3 text-center">
+              <CameraOff className="text-red-400" size={40} />
+              <p className="text-sm text-red-300">{errorMsg}</p>
+              <Button
+                variant="outline"
+                className="h-9 px-3 text-sm text-white border-white/30 hover:bg-white/10"
+                onClick={() => startCamera(facingMode)}
+              >
+                Coba Lagi
+              </Button>
+            </div>
+          </div>
+        )}
+
+        <video
+          ref={videoRef}
+          autoPlay
+          playsInline
+          muted
+          className={`w-full h-full object-cover ${status === "ready" ? "opacity-100" : "opacity-0"}`}
+        />
+
+        {/* Scan area overlay */}
+        {status === "ready" && (
+          <div className="absolute inset-0 flex items-center justify-center pointer-events-none">
+            <div className="absolute inset-0 bg-black/20" />
+            <div
+              className="relative flex items-center justify-center"
+              style={{ width: "70%", height: "75%" }}
+            >
+              <div className="absolute top-0 left-0 w-6 h-6 border-t-2 border-l-2 border-lime-300" />
+              <div className="absolute top-0 right-0 w-6 h-6 border-t-2 border-r-2 border-lime-300" />
+              <div className="absolute bottom-0 left-0 w-6 h-6 border-b-2 border-l-2 border-lime-300" />
+              <div className="absolute bottom-0 right-0 w-6 h-6 border-b-2 border-r-2 border-lime-300" />
+              <div className="text-white text-center flex flex-col gap-1">
+                <span className="text-xs font-semibold tracking-widest">
+                  AREA SCAN
+                </span>
+              </div>
+            </div>
+          </div>
+        )}
+      </div>
+
+      {/* Controls */}
+      <div className="flex items-center justify-center gap-4 w-full">
+        <Button
+          variant="outline"
+          className="rounded-full h-12 w-12 p-0"
+          onClick={onClose}
+          title="Tutup kamera"
+        >
+          <CameraOff size={20} />
+        </Button>
+
+        <Button
+          className="rounded-full h-16 w-16 p-0 bg-white border-4 border-green-500 hover:bg-green-50"
+          onClick={handleCapture}
+          disabled={status !== "ready"}
+          title="Ambil foto"
+        >
+          <Aperture className="text-green-600" size={32} />
+        </Button>
+
+        <Button
+          variant="outline"
+          className="rounded-full h-12 w-12 p-0"
+          onClick={toggleFacing}
+          title="Ganti kamera"
+        >
+          <SwitchCamera size={20} />
+        </Button>
+      </div>
+
+      {/* Hidden canvas for capture */}
+      <canvas ref={canvasRef} className="hidden" />
+    </div>
+  );
+}

apps/web/src/components/diagnose-result-view.tsx

@@ -15,7 +15,7 @@ import { RiskBadge } from "@/components/risk-badge";
 
 type Props = {
   imageUrl: string;
-  confidence: number; // contoh: 0.95
+  confidence: number;
   diseaseName: string;
   scientificName: string;
   riskLevel: string;
@@ -42,8 +42,8 @@ export function DiagnosisResultView({
 
   const getRiskLevelKey = (level: string): "low" | "medium" | "high" => {
     const normalized = level.toLowerCase();
-    if (normalized.includes("rendah")) return "low";
-    if (normalized.includes("tinggi")) return "high";
+    if (normalized.includes("rendah") || normalized === "low") return "low";
+    if (normalized.includes("tinggi") || normalized === "high") return "high";
     return "medium";
   };
 
@@ -85,18 +85,35 @@ export function DiagnosisResultView({
           <div className="space-y-2 mb-4">
             <div className="flex justify-between text-sm font-bold text-slate-700">
               <span>Tingkat Keyakinan AI</span>
-              <span className="text-emerald-600">{confidencePercent}%</span>
+              <span
+                className={
+                  confidencePercent >= 75
+                    ? "text-emerald-600"
+                    : "text-amber-500"
+                }
+              >
+                {confidencePercent}%
+              </span>
             </div>
             <div className="w-full bg-slate-200 rounded-full h-2.5 overflow-hidden">
               <div
-                className="bg-emerald-500 h-2.5 rounded-full transition-all duration-1000"
+                className={`h-2.5 rounded-full transition-all duration-1000 ${
+                  confidencePercent >= 75 ? "bg-emerald-500" : "bg-amber-500"
+                }`}
                 style={{ width: `${confidencePercent}%` }}
               ></div>
             </div>
-            <p className="text-[11px] text-emerald-600 flex items-center gap-1 font-medium">
-              <CheckCircle2 className="w-3 h-3" /> Di atas ambang batas minimum
-              (75%)
-            </p>
+            {confidencePercent >= 75 ? (
+              <p className="text-[11px] text-emerald-600 flex items-center gap-1 font-medium">
+                <CheckCircle2 className="w-3 h-3" /> Di atas ambang batas
+                minimum (75%)
+              </p>
+            ) : (
+              <p className="text-[11px] text-amber-600 flex items-center gap-1 font-medium">
+                <AlertTriangle className="w-3 h-3" /> Di bawah ambang batas
+                minimum (75%)
+              </p>
+            )}
           </div>
 
           <div className="flex items-center gap-3 pt-4 border-t border-amber-200/50">

apps/web/src/lib/api-client.ts

@@ -14,7 +14,29 @@ import type {
 } from '@zeavis/shared';
 import { recordApiCall } from './telemetry';
 
-const apiBaseUrl = import.meta.env.VITE_API_BASE_URL ?? '';
+const apiBaseUrl = import.meta.env.VITE_API_BASE_URL ?? 'https://zeavisedu.asepharyana.my.id';
+
+const AUTH_TOKEN_KEY = 'zeavis_auth_token';
+
+function getAuthToken(): string | null {
+  try {
+    return localStorage.getItem(AUTH_TOKEN_KEY);
+  } catch {
+    return null;
+  }
+}
+
+export function setAuthToken(token: string | null) {
+  try {
+    if (token) {
+      localStorage.setItem(AUTH_TOKEN_KEY, token);
+    } else {
+      localStorage.removeItem(AUTH_TOKEN_KEY);
+    }
+  } catch {
+    // localStorage may throw in private browsing
+  }
+}
 
 export interface ApiError extends Error {
   status: number;
@@ -24,10 +46,21 @@ export interface ApiError extends Error {
 async function fetchApi<T>(endpoint: string, options?: RequestInit): Promise<T> {
   const start = performance.now();
   const url = `${apiBaseUrl}${endpoint}`;
+  const token = getAuthToken();
+  const headers = new Headers(options?.headers);
+
+  if (token) {
+    headers.set('Authorization', `Bearer ${token}`);
+  }
+
+  if (options?.body && !options.method) {
+    // auto-set Content-Type for JSON bodies
+  }
+
   const response = await fetch(url, {
     credentials: 'include',
     ...options,
-    headers: options?.headers,
+    headers,
   });
 
   const duration = performance.now() - start;
@@ -93,23 +126,29 @@ export const apiClient = {
   },
 
   async register(payload: RegisterRequest): Promise<AuthResponse> {
-    return fetchApi('/api/v1/auth/register', {
+    const result = await fetchApi<AuthResponse>('/api/v1/auth/register', {
       method: 'POST',
       headers: { 'Content-Type': 'application/json' },
       body: JSON.stringify(payload),
     });
+    if (result.token) setAuthToken(result.token);
+    return result;
   },
 
   async login(payload: AuthRequest): Promise<AuthResponse> {
-    return fetchApi('/api/v1/auth/login', {
+    const result = await fetchApi<AuthResponse>('/api/v1/auth/login', {
       method: 'POST',
       headers: { 'Content-Type': 'application/json' },
       body: JSON.stringify(payload),
     });
+    if (result.token) setAuthToken(result.token);
+    return result;
   },
 
   async logout(): Promise<{ ok: boolean }> {
-    return fetchApi('/api/v1/auth/logout', { method: 'POST' });
+    const result = await fetchApi<{ ok: boolean }>('/api/v1/auth/logout', { method: 'POST' });
+    setAuthToken(null);
+    return result;
   },
 
   // Disease catalog methods

apps/web/src/lib/tauri.ts

@@ -0,0 +1,25 @@
+/**
+ * Lightweight Tauri environment detection and utilities.
+ * Avoids importing @tauri-apps/api at module level so the web build
+ * doesn't bundle Tauri internals.
+ */
+
+let _isTauri: boolean | null = null;
+
+export function isTauri(): boolean {
+  if (_isTauri !== null) return _isTauri;
+  _isTauri =
+    typeof window !== 'undefined' &&
+    '__TAURI_INTERNALS__' in window;
+  return _isTauri;
+}
+
+export async function openUrl(url: string): Promise<void> {
+  if (!isTauri()) {
+    window.location.href = url;
+    return;
+  }
+  // Lazy-import Tauri opener only in Tauri context
+  const { openUrl: tauriOpenUrl } = await import('@tauri-apps/plugin-opener');
+  await tauriOpenUrl(url);
+}

apps/web/src/pages/login-page.tsx

@@ -1,15 +1,48 @@
-import { useState } from "react";
+import { useState, useEffect, useRef } from "react";
 import { Link, useNavigate } from "react-router-dom";
 import { useMutation, useQuery, useQueryClient } from "@tanstack/react-query";
 import { AuthForm } from "@/components/auth-form";
-import { apiClient } from "@/lib/api-client";
+import { apiClient, setAuthToken } from "@/lib/api-client";
 import { useAuthStore } from "@/store/auth-store";
 
+function getUrlParam(name: string): string | null {
+  return new URLSearchParams(window.location.search).get(name);
+}
+
 export function LoginPage() {
   const navigate = useNavigate();
   const queryClient = useQueryClient();
   const setUser = useAuthStore((state) => state.setUser);
   const [error, setError] = useState<string | null>(null);
+  const oauthTokenConsumed = useRef(false);
+  const [oauthProcessing, setOauthProcessing] = useState(false);
+
+  // Handle OAuth callback: the API redirects to /login?token=<session_token>
+  useEffect(() => {
+    const token = getUrlParam("token");
+    if (!token || oauthTokenConsumed.current) return;
+    oauthTokenConsumed.current = true;
+    setOauthProcessing(true);
+
+    // Store token for future API calls and fetch user
+    setAuthToken(token);
+
+    apiClient
+      .getMe()
+      .then((data) => {
+        setUser(data.user);
+        queryClient.setQueryData(["auth", "me"], data);
+        navigate("/dashboard", { replace: true });
+      })
+      .catch((err) => {
+        setAuthToken(null);
+        setOauthProcessing(false);
+        setError(err instanceof Error ? err.message : "Google login gagal");
+      });
+  }, [setUser, queryClient, navigate]);
+
+  // Show OAuth error from query param
+  const oauthError = getUrlParam("error");
   const meQuery = useQuery({
     queryKey: ["auth", "me"],
     queryFn: () => apiClient.getMe(),
@@ -26,13 +59,25 @@ export function LoginPage() {
       setError(err instanceof Error ? err.message : "Login gagal"),
   });
 
+  // Show loading spinner while OAuth token is being processed
+  if (oauthProcessing) {
+    return (
+      <main className="flex min-h-screen items-center justify-center px-6 py-12">
+        <div className="flex flex-col items-center gap-3">
+          <div className="h-10 w-10 border-4 border-green-500 border-t-transparent rounded-full animate-spin" />
+          <p className="text-gray-500 text-sm">Menyelesaikan login dengan Google...</p>
+        </div>
+      </main>
+    );
+  }
+
   return (
     <main className="flex min-h-screen items-center justify-center px-6 py-12">
       <div className="w-full max-w-sm md:max-w-md space-y-4">
         <AuthForm
           mode="login"
           isSubmitting={mutation.isPending}
-          error={error}
+          error={oauthError || error}
           googleOAuthEnabled={Boolean(
             meQuery.data?.features.googleOAuthEnabled,
           )}

apps/web/src/pages/scan-page.tsx

@@ -1,4 +1,4 @@
-import { useRef, useState } from "react";
+import { useRef, useState, useCallback } from "react";
 import { useNavigate, Link } from "react-router-dom";
 import { useMutation, useQueryClient, useQuery } from "@tanstack/react-query";
 import {
@@ -16,9 +16,11 @@ import { Button } from "@/components/ui/button";
 import { Card, CardContent } from "@/components/ui/card";
 import { Modal } from "@/components/ui/modal";
 import type { DiagnosisRecord } from "@zeavis/shared";
+import { diseaseCatalogSeed } from "@zeavis/shared"; // Import data seed lokal ditambahkan
 import { apiClient } from "@/lib/api-client";
 import { trackScan, trackDiagnosisResult } from "@/lib/telemetry";
 import { DiagnosisResultView } from "../components/diagnose-result-view";
+import { CameraCapture } from "../components/camera-capture";
 
 export function ScanPage() {
   const [fileName, setFileName] = useState<string | null>(null);
@@ -32,6 +34,24 @@ export function ScanPage() {
   const navigate = useNavigate();
   const queryClient = useQueryClient();
 
+  // Camera mode state
+  const [useCamera, setUseCamera] = useState(false);
+  const handleCameraCapture = useCallback(
+    (file: File) => {
+      setFileName(file.name);
+      const url = URL.createObjectURL(file);
+      setPreviewUrl(url);
+
+      const img = new Image();
+      img.onload = () => {
+        setImageDimensions({ width: img.width, height: img.height });
+      };
+      img.src = url;
+      setUseCamera(false);
+    },
+    [],
+  );
+
   const mutation = useMutation({
     mutationFn: (file: File) => apiClient.createDiagnosis(file),
     onSuccess: (diagnosis) => {
@@ -76,7 +96,7 @@ export function ScanPage() {
   const [diagnosisPreview, setDiagnosisPreview] =
     useState<DiagnosisRecord | null>(null);
 
-  const diagnosesQuery = useQuery({
+  useQuery({
     queryKey: ["diagnoses"],
     queryFn: () => apiClient.getDiagnoses(),
     enabled: previewOpen,
@@ -111,33 +131,70 @@ export function ScanPage() {
 
               {!previewUrl ? (
                 <div className="space-y-3">
-                  <div
-                    className="w-full border-2 border-dashed border-green-300 rounded-md p-10 h-60 text-center cursor-pointer"
-                    onClick={() => inputRef.current?.click()}
-                  >
-                    <Upload className="mx-auto text-green-500 mb-3" size={48} />
-                    <h3 className="font-semibold text-base text-gray-800 mb-1">
-                      Seret & Lepas Foto Daun
-                    </h3>
-                    <p className="text-xs text-gray-500 mb-3">
-                      atau klik untuk memilih file berkas dari perangkat Anda
-                    </p>
-                    <div className="flex flex-wrap gap-2 justify-center">
-                      <div className="bg-green-100 text-green-700 px-3 py-1 rounded-full inline-flex items-center gap-1 text-xs font-medium">
-                        <Check size={14} /> PNG, JPG, JPEG, WEBP
-                      </div>
-                      <div className="bg-green-100 text-green-700 px-3 py-1 rounded-full inline-flex items-center gap-1 text-xs font-medium">
-                        <Check size={14} /> Maks. 5 MB
-                      </div>
-                    </div>
+                  {/* Mode toggle */}
+                  <div className="flex rounded-lg bg-gray-100 p-1">
+                    <button
+                      type="button"
+                      onClick={() => setUseCamera(false)}
+                      className={`flex-1 py-2 px-3 rounded-md text-sm font-medium transition-colors ${
+                        !useCamera
+                          ? "bg-white text-green-700 shadow-sm"
+                          : "text-gray-500 hover:text-gray-700"
+                      }`}
+                    >
+                      <Upload size={16} className="inline mr-1.5" />
+                      Unggah
+                    </button>
+                    <button
+                      type="button"
+                      onClick={() => setUseCamera(true)}
+                      className={`flex-1 py-2 px-3 rounded-md text-sm font-medium transition-colors ${
+                        useCamera
+                          ? "bg-white text-green-700 shadow-sm"
+                          : "text-gray-500 hover:text-gray-700"
+                      }`}
+                    >
+                      <Camera size={16} className="inline mr-1.5" />
+                      Kamera
+                    </button>
                   </div>
-                  <button
-                    type="button"
-                    onClick={() => inputRef.current?.click()}
-                    className="w-full bg-green-600 hover:bg-green-700 text-white font-medium py-2.5 px-4 rounded-lg transition-colors flex items-center justify-center gap-2"
-                  >
-                    <Upload size={18} /> Pilih Berkas
-                  </button>
+
+                  {useCamera ? (
+                    <CameraCapture
+                      onCapture={handleCameraCapture}
+                      onClose={() => setUseCamera(false)}
+                    />
+                  ) : (
+                    <>
+                      <div
+                        className="w-full border-2 border-dashed border-green-300 rounded-md p-10 h-60 text-center cursor-pointer"
+                        onClick={() => inputRef.current?.click()}
+                      >
+                        <Upload className="mx-auto text-green-500 mb-3" size={48} />
+                        <h3 className="font-semibold text-base text-gray-800 mb-1">
+                          Seret & Lepas Foto Daun
+                        </h3>
+                        <p className="text-xs text-gray-500 mb-3">
+                          atau klik untuk memilih file berkas dari perangkat Anda
+                        </p>
+                        <div className="flex flex-wrap gap-2 justify-center">
+                          <div className="bg-green-100 text-green-700 px-3 py-1 rounded-full inline-flex items-center gap-1 text-xs font-medium">
+                            <Check size={14} /> PNG, JPG, JPEG, WEBP
+                          </div>
+                          <div className="bg-green-100 text-green-700 px-3 py-1 rounded-full inline-flex items-center gap-1 text-xs font-medium">
+                            <Check size={14} /> Maks. 5 MB
+                          </div>
+                        </div>
+                      </div>
+                      <button
+                        type="button"
+                        onClick={() => inputRef.current?.click()}
+                        className="w-full bg-green-600 hover:bg-green-700 text-white font-medium py-2.5 px-4 rounded-lg transition-colors flex items-center justify-center gap-2"
+                      >
+                        <Upload size={18} /> Pilih Berkas
+                      </button>
+                    </>
+                  )}
                 </div>
               ) : (
                 <div className="space-y-4">
@@ -373,29 +430,46 @@ export function ScanPage() {
               </div>
             )}
 
-            <DiagnosisResultView
-              imageUrl={
-                previewUrl ||
-                diagnosisPreview.imageUrl ||
-                "https://placehold.co/600x400?text=Foto+Daun"
-              }
-              confidence={diagnosisPreview.confidence ?? 0}
-              diseaseName={
-                diagnosisPreview.disease?.commonName ?? "Tidak Diketahui"
-              }
-              scientificName={diagnosisPreview.disease?.label ?? ""}
-              riskLevel={diagnosisPreview.disease?.riskLevel ?? "Sedang"}
-              description={
-                diagnosisPreview.disease?.description ??
-                diagnosisPreview.disease?.summary ??
-                "Deskripsi tidak tersedia."
-              }
-              symptoms={diagnosisPreview.disease?.symptoms ?? []}
-              preventions={diagnosisPreview.disease?.recommendations ?? []}
-              medicines={
-                (diagnosisPreview.disease as any)?.medicineRecommendations ?? []
-              }
-            />
+            {/* Render DiagnosisResultView dengan Fallback Obat */}
+            {(() => {
+              // Fallback logic for scientific name and medicine recommendations
+              const seedData = diagnosisPreview.disease
+                ? diseaseCatalogSeed.find(
+                    (seed) =>
+                      seed.commonName === diagnosisPreview.disease?.commonName,
+                  )
+                : null;
+
+              // If the API doesn't return medicine recommendations, use the seed data as a fallback
+              const finalMedicines =
+                (diagnosisPreview.disease as any)?.medicineRecommendations ||
+                seedData?.medicineRecommendations ||
+                [];
+
+              return (
+                <DiagnosisResultView
+                  imageUrl={
+                    previewUrl ||
+                    diagnosisPreview.imageUrl ||
+                    "https://placehold.co/600x400?text=Foto+Daun"
+                  }
+                  confidence={diagnosisPreview.confidence ?? 0}
+                  diseaseName={
+                    diagnosisPreview.disease?.commonName ?? "Tidak Diketahui"
+                  }
+                  scientificName={diagnosisPreview.disease?.label ?? ""}
+                  riskLevel={diagnosisPreview.disease?.riskLevel ?? "Sedang"}
+                  description={
+                    diagnosisPreview.disease?.description ??
+                    diagnosisPreview.disease?.summary ??
+                    "Deskripsi tidak tersedia."
+                  }
+                  symptoms={diagnosisPreview.disease?.symptoms ?? []}
+                  preventions={diagnosisPreview.disease?.recommendations ?? []}
+                  medicines={finalMedicines} // Datanya terhubung ke sini!
+                />
+              );
+            })()}
 
             {/* All Model Predictions */}
             {diagnosisPreview.predictions &&

apps/web/vite.config.ts

@@ -9,7 +9,22 @@ export default defineConfig(({ mode }) => {
   const apiProxyTarget = env.VITE_API_PROXY_TARGET || 'http://localhost:3000';
 
   return {
-    plugins: [react(), tsconfigPaths(), metricsPlugin()],
+    plugins: [
+      react(),
+      tsconfigPaths(),
+      metricsPlugin(),
+      {
+        name: 'cloudflare-rocket-loader-fix',
+        transformIndexHtml(html) {
+          // Prevent Cloudflare Rocket Loader from mangling <script type="module">
+          // which breaks the entire JS bundle (blank page)
+          return html.replace(
+            /<script type="module"/g,
+            '<script data-cfasync="false" type="module"',
+          );
+        },
+      },
+    ],
     server: {
       proxy: {
         '/api': apiProxyTarget,

bun.lock

@@ -4,6 +4,10 @@
   "workspaces": {
     "": {
       "name": "zeavis-edu",
+      "dependencies": {
+        "@tauri-apps/plugin-deep-link": "2.4.9",
+        "@tauri-apps/plugin-opener": "2.5.4",
+      },
       "devDependencies": {
         "@moonrepo/cli": "^2.2.5",
         "typescript": "^6.0.3",
@@ -341,6 +345,8 @@
 
     "@tanstack/react-query": ["@tanstack/react-query@5.101.0", "", { "dependencies": { "@tanstack/query-core": "5.101.0" }, "peerDependencies": { "react": "^18 || ^19" } }, "sha512-rLlJXSpkqfizLWgkR5+eLeIk0MvTx/meEIR7LRjxic+qxiQP8zVjq7BqQkiCMNLQBlLfuOLqqr6KO5GtrDlmSg=="],
 
+    "@tauri-apps/api": ["@tauri-apps/api@2.11.0", "", {}, "sha512-7CinYODhky9lmO23xHnUFv0Xt43fbtWMyxZcLcRBlFkcgXKuEirBvHpmtJ89YMhyeGcq20Wuc47Fa4XjyniywA=="],
+
     "@tauri-apps/cli": ["@tauri-apps/cli@2.11.2", "", { "optionalDependencies": { "@tauri-apps/cli-darwin-arm64": "2.11.2", "@tauri-apps/cli-darwin-x64": "2.11.2", "@tauri-apps/cli-linux-arm-gnueabihf": "2.11.2", "@tauri-apps/cli-linux-arm64-gnu": "2.11.2", "@tauri-apps/cli-linux-arm64-musl": "2.11.2", "@tauri-apps/cli-linux-riscv64-gnu": "2.11.2", "@tauri-apps/cli-linux-x64-gnu": "2.11.2", "@tauri-apps/cli-linux-x64-musl": "2.11.2", "@tauri-apps/cli-win32-arm64-msvc": "2.11.2", "@tauri-apps/cli-win32-ia32-msvc": "2.11.2", "@tauri-apps/cli-win32-x64-msvc": "2.11.2" }, "bin": { "tauri": "tauri.js" } }, "sha512-bk3HemqvGRoy+5D/dVMUQHKMYLglD0jVnMm/0iGMH6ufZ+p8r14m6BpIixwij3PBvZdvORUp1YifTD8QxVZ1Nw=="],
 
     "@tauri-apps/cli-darwin-arm64": ["@tauri-apps/cli-darwin-arm64@2.11.2", "", { "os": "darwin", "cpu": "arm64" }, "sha512-+4UZzLt+eOAEQCwgd+TqKgyUJMrvx+BgdXLLaqJYmPqzP+nE6YZr/hY6CWLYGQb8jFn99jEkmC6uA3tNvamA1w=="],
@@ -365,6 +371,10 @@
 
     "@tauri-apps/cli-win32-x64-msvc": ["@tauri-apps/cli-win32-x64-msvc@2.11.2", "", { "os": "win32", "cpu": "x64" }, "sha512-d2JchlFIpZevZVReyqhQOekJmb1UH3rhZ5VX6sH3ty9ETE0TKQavpihvoScUXfKKpW6HZC0MrFGRU0ZtD+w3gA=="],
 
+    "@tauri-apps/plugin-deep-link": ["@tauri-apps/plugin-deep-link@2.4.9", "", { "dependencies": { "@tauri-apps/api": "^2.11.0" } }, "sha512-u0SKOUHnJ1wqeqXsDFq2+kASCBj9xxbG0g9XZWPy9SOmU4wXtp6b/wiYpm6oH6/5fBTQsLqnLhIvqLBRpgHJlA=="],
+
+    "@tauri-apps/plugin-opener": ["@tauri-apps/plugin-opener@2.5.4", "", { "dependencies": { "@tauri-apps/api": "^2.11.0" } }, "sha512-1HnPkb+AmgO29HBazm4uPLKB+r7zzcTBW1d0fyYp1uP+jwtpoiNDGKMMzz58SFp49nOIrxdE3aUJtT57lfO9CQ=="],
+
     "@tokenizer/inflate": ["@tokenizer/inflate@0.4.1", "", { "dependencies": { "debug": "^4.4.3", "token-types": "^6.1.1" } }, "sha512-2mAv+8pkG6GIZiF1kNg1jAjh27IDxEPKwdGul3snfztFerfPGI1LjDezZp3i7BElXompqEtPmoPx6c2wgtWsOA=="],
 
     "@tokenizer/token": ["@tokenizer/token@0.3.0", "", {}, "sha512-OvjF+z51L3ov0OyAU0duzsYuvO01PH7x4t6DJx+guahgTnBHkhJdG7soQeTSFLWN3efnHyibZ4Z8l2EuWwJN3A=="],

docker-compose.yml

@@ -38,8 +38,6 @@ services:
       API_PORT: "3000"
       WEB_APP_URL: https://zeavisedu.asepharyana.my.id
       ML_SERVICE_URL: ${ML_SERVICE_URL:-http://zeavis-ml:8000}
-    ports:
-      - "3000:3000"
     labels:
       traefik.enable: "true"
       traefik.http.routers.zeavis-api.rule: Host(`api-zeavisedu.asepharyana.my.id`)
@@ -53,8 +51,6 @@ services:
     image: prom/node-exporter:v1.8.2
     container_name: zeavis-node-exporter
     restart: unless-stopped
-    ports:
-      - "9100:9100"
     command:
       - "--path.rootfs=/host"
       - "--web.listen-address=:9100"
@@ -77,8 +73,6 @@ services:
     environment:
       MODEL_PATH: /app/model/model.onnx
       MODEL_INPUT_SIZE: "224"
-    ports:
-      - "8000:8000"
     labels:
       traefik.enable: "true"
       traefik.http.routers.zeavis-ml.rule: Host(`ml-zeavisedu.asepharyana.my.id`)

package.json

@@ -13,5 +13,9 @@
   "workspaces": [
     "apps/*",
     "packages/*"
-  ]
+  ],
+  "dependencies": {
+    "@tauri-apps/plugin-deep-link": "2.4.9",
+    "@tauri-apps/plugin-opener": "2.5.4"
+  }
 }

packages/shared/src/classifications.ts

@@ -66,6 +66,7 @@ export type RegisterRequest = AuthRequest & {
 export type AuthResponse = {
   user: AuthUser;
   features: AuthFeatures;
+  token?: string;
 };
 
 export type DiagnosisPrediction = {