ZX Parenting

Aplikasi parenting terpadu — ortu pantau anak (tugas, reward, screen time, lokasi).

3 komponen:

• App Ortu (Android, Kotlin + Compose) — repo ZX-Parenting-ortu, local /opt/data/zx-ortu
• App Anak (Android, Kotlin + Compose) — repo zx-agent, local /opt/data/zx-agent
• Backend (Next.js + Prisma + PostgreSQL) — repo zx_parenting, local /opt/data/zx_parenting

Versi: v3.3.0 (versiKode 52)

URL: https://zxparenting.zomet.my.id

Deploy: Coolify id9, DB container soqw27wuaccobs7z2prztkct

CI: auto-trigger push; rilis manual rilis.yml workflow_dispatch input versi

Version config: alamat.json (versiNama, versiKode, idPaket, beranda, api, googleWebId)

Ekonomi:

• Token ZX (anak) — 1 token = 1 menit main, hard cap 3 jam/hari
• ZX Coin (ortu) — marketplace, withdrawal
• Google Play Billing (subscription + IAP). App rilis di Play Store. Tidak ada Midtrans.

Anti-bypass: Device Admin API (Play Store compliant), Accessibility Service hanya untuk kuis lock.

Data privacy: Foto bukti auto-delete 30 hari (fotoExpireAt). Gender/agama optional (UU PDP).

App Ortu:

• Kotlin + Jetpack Compose
• Retrofit2 + Gson (API client)
• ViewModel + StateFlow (state management)
• DataStore (local storage)
• Google Play Billing Library (subscription + IAP)
• repo: github.com/djvpri/ZX-Parenting-ortu

App Anak:

• Kotlin + Jetpack Compose
• ZX Agent — device control, overlay, app blocker
• Device Admin API (anti-uninstall, Play Store compliant)
• Accessibility Service (kuis lock only — justified use case)
• Adaptive GPS polling (5/15/2/1/3 min based on zone+speed)
• repo: github.com/djvpri/zx-agent

Backend:

• Next.js 16 + Prisma 6 + PostgreSQL
• Gemini AI (soal kuis, insights, content generator, anti-cheat pattern detection)
• Google Play Developer API (server-side subscription verification via RTDN)
• Google OAuth (login ortu)
• bcrypt (PIN hash)
• AI moderation (forum keyword filter Bahasa Indonesia + English)
• repo: github.com/djvpri/zx_parenting

Deploy:

• Coolify VPS 103.93.129.94
• App container: pd59y3gb3k6nkqjqvm873uim-* (ID berubah tiap deploy)
• DB container: soqw27wuaccobs7z2prztkct
• psql: psql -U postgres -d postgres

25+ Prisma models:

Auth & User:

• User — PARENT/CHILD/ADMIN, email/passwordHash/googleId, username+pinHash (CHILD), locale, consent
• Anak — 1:1 dengan User (CHILD), tanggalLahir, kelas, gender (optional), agama (optional), dormant
• DeviceRegistration — daftar device per anak (multi-device), deviceName, isActive, revokedAt

Ekonomi Anak (Token ZX):

• TokenBalance — saldo per anak
• TokenLedger — KUIS/TUGAS/CHALLENGE/FAMILY_QUEST/PINJAM/BAYAR_PINJAM/PEMAKAIAN/PENYESUAIAN/OFFICIAL_KUIS/OFFICIAL_TANTANGAN
• PinjamWaktu — amount, createdAt, expireAt (24h), lunas

Ekonomi Ortu (ZX Coin):

• CoinWallet — saldo per ortu
• CoinLedger — TOPUP_IAP/PEMBELIAN/PENJUALAN/REFERRAL/BONUS/PENYESUAIAN

Langganan:

• Langganan — FREE_TRIAL/PRO/ELITE, Google Play purchaseToken, subscriptionState, autoRenewing
• PlayPurchase — productId, purchaseToken, orderId, verifiedAt (RTDN webhook verification)

Tugas & Kuis:

• Tugas — PENDING/DIKUMPULKAN/SELESAI/DITOLAK, fotoBuktiUrl, fotoExpireAt (auto-delete 30 hari), deadline
• KuisAttempt — soal JSON (Gemini-generated), jawaban, skor, levelKesulitan, durasiDetik, flagged (anti-cheat)

Bank Soal (Persistent Question Bank):

• BankSoal — mataPelajaran, kelas, levelKesulitan (1-5), tipeSoal (PILIHAN_GANDA/ESSAY), pertanyaan, pilihanGanda, jawabanBenar, penjelasan, bahasa ("en"/"id"), source (AI/ORTU/MARKETPLACE), createdBy, tags[], ratingSum, ratingCount, translateFlag
• BankSoalTerjemahan — bankSoalId, bahasa, pertanyaan, pilihanGanda, jawabanBenar, penjelasan, translatedAt (cached translation)
• BankSoalRate — bankSoalId, userId, rating (up/down), createdAt

Gamifikasi:

• Streak — current/terbaik/terakhir
• ChallengeProgress — challenge harian per anak
• FamilyQuest + FamilyQuestMember — quest keluarga
• OfficialCompletion — tracking complete official content

Device Control:

• DeviceSession — sessionLimit, cooldown, dailyLimit (hard cap 3 jam), curfew, appBlokir, GPS, geo-fence
• ActivityLog — app_open/browser/quiz_lock/geo_exit
• GpsLog — lastSpeed, lastInZone, pollInterval (adaptive: 5/15/2/1/3 min)

Marketplace:

• KontenMarketplace — PAKET_SOAL/PRESET/KUIS_HARIAN/ARTIKEL/VIDEO/TANTANGAN_MINGGUAN
• PembelianKonten — 1x beli per konten
• OfficialMeta — scheduling, targeting, metrics
• Hadiah + PesananHadiah — marketplace hadiah ortu
• Withdrawal — MINTA/DISETUJUI/DITOLAK/SELESAI (payout via bank transfer manual)

Komunikasi:

• Pesan — direct chat ortu↔anak
• ForumPost + ForumKomentar — forum keluarga (AI moderation flag)

Moderasi:

• ModerasiLog — type (keyword_filter/report_block), target, reason, timestamp

~60 API routes (Next.js App Router):

Auth:

• POST /api/auth/native-login — login ortu (email+password)
• POST /api/auth/native-daftar — daftar ortu
• POST /api/auth/native-google — Google OAuth ortu
• POST /api/auth/native-anak — login anak (username+PIN), JWT, rate limit 5/min, lockout 10→15min

Anak (CRUD):

• GET/POST /api/anak — list/create, GET flatten username+umur calc
• GET/PATCH/DELETE /api/anak/[id] — detail/edit/hapus
• PATCH /api/anak/[id]/pin — reset PIN (validasiPin, bcrypt)
• PATCH /api/anak/[id]/dormant — toggle dormant

Device:

• GET /api/device-session — list
• PATCH/DELETE /api/device-session/[id] — edit/hapus
• POST /api/device/register — daftar device anak (multi-device)
• DELETE /api/device/[id] — revoke device
• GET /api/device/gps — GPS log + adaptive polling interval

Tugas & Kuis:

• GET/POST /api/tugas — list/create
• PATCH /api/tugas/[id] — validasi (selesai/tolak)
• POST /api/tugas/ai-generate — Gemini generate soal
• POST /api/tugas/jadwal — CRUD scheduled AI tasks
• GET /api/tugas/[id]/kuis — kuis session (shuffle, lock, submit, review)

Bank Soal:

• GET /api/bank-soal — list/filter (mataPelajaran, kelas, level, bahasa)
• POST /api/bank-soal — simpan soal manual
• GET /api/bank-soal/rekomendasi?anakId=X — rule-based recommendation (avg skor per mataPelajaran, level adaptif, filter duplikat)
• POST /api/bank-soal/[id]/rate — ortu rate thumbs up/down
• POST /api/bank-soal/tugas — create Tugas dari soal bank
• POST /api/bank-soal/[id]/translate — trigger translate on-demand + cache (Gemini translate, cached permanently)

Ekonomi:

• GET/POST /api/coin — saldo + penyesuaian
• GET /api/token-ledger — riwayat token anak
• GET/POST /api/pinjam — pinjam waktu (max 30 min, 24h expiry) + hutang
• GET/POST /api/hadiah — marketplace hadiah
• POST /api/hadiah/pesanan — proses pesanan (beli/tolak)
• GET/POST /api/marketplace — konten marketplace
• POST /api/marketplace/beli — beli konten
• POST /api/marketplace/withdrawal — tarik coin (min 50k, max 500k/bln, fee 10%, delay 3 hari, payout bank transfer)

Gamifikasi:

• GET /api/leaderboard — ranking (bot label "Official" sampai >50 user)
• GET/POST /api/challenges — daily challenges + claim
• GET/POST /api/quests — family quest
• GET /api/anak/streak — streak data
• GET/POST /api/referral — kode referral + claim

Komunikasi:

• GET/POST /api/pesan — direct chat
• GET/POST/DELETE /api/forum — forum posts (AI moderation filter)
• POST /api/forum/[id]/komentar — komentar
• POST /api/forum/[id]/report — laporkan post

Langganan (Google Play Billing):

• GET /api/langganan/status — status langganan (FREE_TRIAL/PRO/ELITE)
• POST /api/langganan/verify — verify purchase token dari app (Google Play Developer API)
• POST /api/langganan/rtdn — Real-Time Developer Notifications webhook (Google Pub/Sub)
• POST /api/langganan/acknowledge — acknowledge purchase

AI:

• GET /api/insights — insights anak (Gemini/rule-based)
• POST /api/admin/generate — generate soal/preset (Gemini)
• GET /api/tugas/[id]/anti-cheat — pattern detection flag

Laporan:

• GET /api/laporan/ringkasan — agregasi tugas+kuis+streak+token (v3.3.0)
• GET /api/aktivitas — activity log anak

Official Content:

• GET /api/anak/official — feed anak
• GET /api/anak/official/[id] — detail
• POST /api/anak/official/[id]/complete — selesai + reward
• GET/POST/PATCH/DELETE /api/admin/official — admin CRUD

Admin:

• GET /api/admin/users — list users
• GET /api/admin/metrics — metrics
• GET/POST /api/admin/konten — konten management
• GET/POST /api/admin/withdrawal — withdrawal management

Lain:

• DELETE /api/akun/hapus — hapus akun

⚠ umur dihapus dari schema, diganti tanggalLahir DateTime?. Umur dihitung server-side dari tanggalLahir. App tampilkan ? jika null.

⚠ Tanggal lahir server kirim ISO 8601 (2019-04-19T00:00:00.000Z). App pakai fmtTgl() substring(0,10) → yyyy-MM-dd.

⚠ PIN blacklist (66 PINs: sequential+repeated 4/5/6 digit). 123456 = sequential naik → ditolak API. Existing PIN (1234) tidak di-retroactive reject.

⚠ Reset PIN bug (3 iterasi):

1. v2.9.5: dialog fire-and-forget → async callback

2. v2.9.6: state.error global tidak reliable → pesan langsung dari callback

3. v2.9.7: dua tombol Simpan di satu dialog → pisah DialogResetPin

⚠ App container ID berubah tiap deploy Coolify. Cari via sudo docker ps.

⚠ DB akses: SSH VPS → sudo docker exec soqw27wuaccobs7z2prztkct psql -U postgres -d postgres.

⚠ Login anak JWT: POST /api/auth/native-anak, header Authorization: Bearer <token>.

⚠ Validasi username: regex /^[a-z0-9_]{3,20}$/, reserved words set, P2002 catch → 409.

⚠ Rate limit in-memory Map (single instance Coolify). 5/min per IP+username, lockout 10 gagal→15min.

⚠ Play Store risk: Accessibility Service untuk anti-uninstall bisa kena ban. Pakai Device Admin API sebagai utama. Accessibility hanya untuk kuis lock (justified use case). Siapkan policy justification untuk Google Play review.

⚠ Token inflation: hard cap 3 jam/hari. Token = kuota dalam cap, bukan override. Pinjam waktu tidak override cap. Tanpa cap, anak rajin-soal → main 5 jam.

⚠ Data sensitif anak (UU PDP): gender/agama optional, hanya simpan kalau ortu isi. Tidak dikirim ke Gemini. Anak = subjek khusus, perlu consent ortu eksplisit.

⚠ Multi-device bypass: screen time sync per-anak (bukan per-device). Device tidak terdaftar = tidak ada enforcement. Ortu harus daftar semua device anak.

⚠ Foto bukti: fotoExpireAt di Prisma, cron job hapus harian. Auto-delete 30 hari setelah tugas selesai/divalidasi. Tidak pernah dipakai AI training.

⚠ Google Play Billing: wajib verify purchase token server-side via Google Play Developer API. Jangan trust client-side purchase data. Gunakan RTDN (Real-Time Developer Notifications) untuk subscription state changes (cancel/refund/renew). Acknowledge purchases dalam 24 jam atau auto-refund.

⚠ Google Play fee: 15% (first $1M/year) / 30% (above). Harga tier harus factoring fee ini. ZX Coin sebagai buffer — ortu beli coin via IAP, pakai coin di marketplace, fee Google sekali di top-up.

v3.3.0 (kode 52) — tab Laporan compact: 4 kartu stat + AI insight + ringkasan tugas + laporan kuis + statistik token + timeline aktivitas. Backend /api/laporan/ringkasan.

v3.2.5 — app anak v1.8.2: fix kuis + offline mode

v3.2.1-v3.2.4 — generate soal AI v2 rewrite, OkHttp timeout 60s, UI fix

v3.2.0 — generate tugas AI (backend + UI app ortu)

v3.1.0 — menu Tugas di blueprint Engine

v3.0.0 — blueprint Engine launch (wiki simpan blueprint app)

v2.9.7 — pisah dialog reset PIN dari dialog edit anak

v2.9.6 — pesan error langsung dari callback (bukan state.error global)

v2.9.5 — dialog tunggu API respond + loading + error display

v2.9.4 — edit username anak + reset PIN + brute-force + PIN blacklist + reserved username

v2.9.3 — fix tanggalLahir ISO 8601 display (fmtTgl substring)

v2.9.2 — DatePicker native + dropdown gender

v2.9.1 — edit + hapus anak, umur→tanggalLahir

v2.9.0 — referral + leaderboard + challenges

v2.8.0 — pinjam waktu + AI insights

v2.7.1 — i18n (locale field)

Roadmap berikutnya:

• Membership tiers (Free/Pro/Elite) + Google Play Billing
• Screen time control + hard cap 3 jam
• Device Admin API anti-uninstall
• Gamifikasi (streak, leaderboard, daily challenge)
• Geofencing + adaptive GPS
• Master toggle 2-layer (PIN+OTP)

{

"type": "service_account",

"project_id": "zxparenting",

"private_key_id": "212e27f4910755e2b2c2f59667291cfdf0d6fe1f",

"private_key": "-----BEGIN PRIVATE KEY-----\nMIIEvQIBADANBgkqhkiG9w0BAQEFAASCBKcwggSjAgEAAoIBAQCwPc4ZDzGnRQPL\nnb9CTUn+dc7IQSXaVgbXa4qrq6TF/ADr+phcV2OOvHTVcowf5FyJKnqptybto2oL\n8eL7phlSyJOJEWcseXLzqynax+ChBDIlds/S7Q+Qb6ct7gn8ihpEbsD3bDy03WhL\nfeZIMnQ6w1Xvd8tSCxxKjCh8V6diygdCmUmfn/A8dhZ5npWWGoUtj7FkTDlI12pN\nPIA4yBI430X2qhYRiqWxFzlKzeoB0+BxkGR9rUzvK2jFz3cj1x14dfpTWgGZGw17\nTyqfDQW+AwHXgyq7utkaDOyX/K8H4CUQZ9QjFPSOncxJNBVwqvpdRi4RhXOBTZMa\n+Ep1CUn3AgMBAAECggEAEom1u4oPGX6XaxwBKaqyjUr8ALFll2U0HAWqVOtdjhu3\nRxsZWqEwjiuBiJAfcB1XpG/s7hwfQqDNP0tmqjyq7ju91Q2ZEiMGNd47rVEX7ifg\nVHN+YbvgxrsP1TN0JnWqVKdnsb7XVdjyJvqrtc1kz2eLiwBJSSx1AdxjR8z6hNf5\nhSbtao6plOm0PTWxhmTR1WERyrDKzQGMwxpFBc/lKz42QSBf9pVJUDBxsH3Gkzc2\nrpjBve9M/zvURPnfyXp01YG0rwB5IPgmDOy5SHk5TbTOdS9p5CgUKNe34wLG0ikL\naJKUSWPd7EXEvcl0UXYP8F4NbXUcxIrDzqM9X95/QQKBgQDkWTCbvc+rCLOV2+1P\nBRNrZgYxeZ/qpCf5b5KV8ZK+K68Zj6xzkFeDOUl8xIAXd2PfQfeui3XpzMztmNx4\nN7Xm+TTPonVLeHs8KbBFPQcNma9gjxr3bpsg3dflzdz5agMZ32WoRVuZuAWj8qQw\nVr42IqB2TBvRtV2crQobZP2BQQKBgQDFlUv9Ib2yaupTWZF1pvsr5Qbr79m5slHn\nHwXN+ic8WnR3qlB22jTdhm0E4yo5hTpKY417ooUdx9r/3wzZ/uSme75iPUgob33k\njYL2MskXp55S6B32OlC/IH1EVa0v2oMiRHMqB2wsd97rp7dsOa5TR/+KORKTa0ng\nIfKQw7xFNwKBgH4jLpC5dz+5XMqJZDtkSGfpQb6OuuG4sEQ/d6/QdAkMxHrQPKjR\nsSXRvWBog4Fy9/5ZyGHos8fk08bjy9W0oIzoWF3iFf0MnraLKM32ejDvFku2gWTw\n+kxbf2l4IHq+LtxZ5SPgvErbtnHsFPqG0CfDVPRD8pITJ5TmmVCspsSBAoGAXgYM\n8jmjPwtX1TAzY0yCDEJhx9cMwiyUgyqlJX7cOwFEmUmIHvb5301ABepgRp0avxme\n023kcOaRVd/8CqUchAkw8Sj+dJeRzjh1UNmcDlCqrANfdrQLhthcJC+tSa9vZdgz\nAZYkqQimIXhfdfYA+gqyFUHRkCunLSyadL9gkYMCgYEAu2C3lvknXK0/fu51rzZR\nYr1D5nMTVeak8aCL7mXbAsAGy4PD+lo5uRICx4yOoUA7Wvp9PYztdZc/deSYUNTy\nw+3VfK44CGNw8qNmVxtbGfoJ/2kvwJ1oKh/ED3BNI9akmtMisn0D9q0pa6egmk7k\n0bDlf/h+dDFv2FT2AhnRDXA=\n-----END PRIVATE KEY-----\n",

"client_email": "zx-parenting-billing@zxparenting.iam.gserviceaccount.com",

"client_id": "107387419850321250664",

"auth_uri": "https://accounts.google.com/o/oauth2/auth",

"token_uri": "https://oauth2.googleapis.com/token",

"auth_provider_x509_cert_url": "https://www.googleapis.com/oauth2/v1/certs",

"client_x509_cert_url": "https://www.googleapis.com/robot/v1/metadata/x509/zx-parenting-billing%40zxparenting.iam.gserviceaccount.com",

"universe_domain": "googleapis.com"

}