Dokumentasi SIMAPI

import requests
from datetime import datetime, timedelta


class SIMAPIClient:
    """Client SIMAPI dengan auto-refresh token."""

    def __init__(self, client_id, client_secret, base_url):
        self.client_id = client_id
        self.client_secret = client_secret
        self.base_url = base_url.rstrip('/')
        self.access_token = None
        self.refresh_token = None
        self.expires_at = None

    def _login(self):
        resp = requests.post(f"{self.base_url}/oauth/token", json={
            "client_id": self.client_id,
            "client_secret": self.client_secret,
            "grant_type": "client_credentials",
        })
        data = resp.json()
        self.access_token = data["access_token"]
        self.refresh_token = data["refresh_token"]
        self.expires_at = datetime.now() + timedelta(seconds=data["expires_in"] - 60)

    def _refresh(self):
        if not self.refresh_token:
            return self._login()
        resp = requests.post(f"{self.base_url}/oauth/token", json={
            "refresh_token": self.refresh_token,
            "grant_type": "refresh_token",
        })
        if resp.status_code != 200:
            return self._login()
        data = resp.json()
        self.access_token = data["access_token"]
        self.refresh_token = data["refresh_token"]  # rotation
        self.expires_at = datetime.now() + timedelta(seconds=data["expires_in"] - 60)

    def _ensure_token(self):
        if not self.access_token or datetime.now() >= self.expires_at:
            self._refresh()
        return self.access_token

    def get(self, path, **params):
        headers = {"Authorization": f"Bearer {self._ensure_token()}"}
        resp = requests.get(f"{self.base_url}{path}", headers=headers, params=params)
        if resp.status_code == 401:
            self._refresh()
            headers = {"Authorization": f"Bearer {self._ensure_token()}"}
            resp = requests.get(f"{self.base_url}{path}", headers=headers, params=params)
        return resp.json()


# Pemakaian
api = SIMAPIClient(
    client_id="app_absensi_abc123",
    client_secret="sk_live_xxxxxxxxxxxxx",
    base_url="https://api.anda.com",
)
data = api.get("/api/v1/pegawai", page=1, limit=10)
print(data)

class SIMAPIClient {
  constructor(clientId, clientSecret, baseUrl) {
    this.clientId = clientId;
    this.clientSecret = clientSecret;
    this.baseUrl = baseUrl.replace(/\/$/, '');
    this.accessToken = null;
    this.refreshToken = null;
    this.expiresAt = null;
  }

  async _login() {
    const resp = await fetch(`${this.baseUrl}/oauth/token`, {
      method: 'POST',
      headers: { 'Content-Type': 'application/json' },
      body: JSON.stringify({
        client_id: this.clientId,
        client_secret: this.clientSecret,
        grant_type: 'client_credentials',
      }),
    });
    const data = await resp.json();
    this.accessToken = data.access_token;
    this.refreshToken = data.refresh_token;
    this.expiresAt = Date.now() + (data.expires_in - 60) * 1000;
  }

  async _refresh() {
    if (!this.refreshToken) return this._login();
    const resp = await fetch(`${this.baseUrl}/oauth/token`, {
      method: 'POST',
      headers: { 'Content-Type': 'application/json' },
      body: JSON.stringify({
        refresh_token: this.refreshToken,
        grant_type: 'refresh_token',
      }),
    });
    if (!resp.ok) return this._login();
    const data = await resp.json();
    this.accessToken = data.access_token;
    this.refreshToken = data.refresh_token;
    this.expiresAt = Date.now() + (data.expires_in - 60) * 1000;
  }

  async _ensureToken() {
    if (!this.accessToken || Date.now() >= this.expiresAt) {
      await this._refresh();
    }
    return this.accessToken;
  }

  async get(path, params = {}) {
    const token = await this._ensureToken();
    const qs = new URLSearchParams(params).toString();
    const url = `${this.baseUrl}${path}${qs ? '?' + qs : ''}`;
    let resp = await fetch(url, { headers: { Authorization: `Bearer ${token}` } });
    if (resp.status === 401) {
      await this._refresh();
      resp = await fetch(url, {
        headers: { Authorization: `Bearer ${await this._ensureToken()}` },
      });
    }
    return resp.json();
  }
}

// Pemakaian
(async () => {
  const api = new SIMAPIClient(
    'app_absensi_abc123',
    'sk_live_xxxxxxxxxxxxx',
    'https://api.anda.com'
  );
  const data = await api.get('/api/v1/pegawai', { page: 1, limit: 10 });
  console.log(data);
})();

<?php
class SIMAPIClient {
    private $clientId, $clientSecret, $baseUrl;
    private $accessToken = null, $refreshToken = null, $expiresAt = 0;

    public function __construct($clientId, $clientSecret, $baseUrl) {
        $this->clientId = $clientId;
        $this->clientSecret = $clientSecret;
        $this->baseUrl = rtrim($baseUrl, '/');
    }

    private function login() {
        $ch = curl_init("{$this->baseUrl}/oauth/token");
        curl_setopt_array($ch, [
            CURLOPT_POST => true,
            CURLOPT_RETURNTRANSFER => true,
            CURLOPT_HTTPHEADER => ['Content-Type: application/json'],
            CURLOPT_POSTFIELDS => json_encode([
                'client_id' => $this->clientId,
                'client_secret' => $this->clientSecret,
                'grant_type' => 'client_credentials',
            ]),
        ]);
        $data = json_decode(curl_exec($ch), true);
        $this->accessToken = $data['access_token'];
        $this->refreshToken = $data['refresh_token'];
        $this->expiresAt = time() + $data['expires_in'] - 60;
    }

    private function refresh() {
        if (!$this->refreshToken) return $this->login();
        $ch = curl_init("{$this->baseUrl}/oauth/token");
        curl_setopt_array($ch, [
            CURLOPT_POST => true,
            CURLOPT_RETURNTRANSFER => true,
            CURLOPT_HTTPHEADER => ['Content-Type: application/json'],
            CURLOPT_POSTFIELDS => json_encode([
                'refresh_token' => $this->refreshToken,
                'grant_type' => 'refresh_token',
            ]),
        ]);
        $data = json_decode(curl_exec($ch), true);
        if (!isset($data['access_token'])) return $this->login();
        $this->accessToken = $data['access_token'];
        $this->refreshToken = $data['refresh_token'];
        $this->expiresAt = time() + $data['expires_in'] - 60;
    }

    private function ensureToken() {
        if (!$this->accessToken || time() >= $this->expiresAt) {
            $this->refresh();
        }
        return $this->accessToken;
    }

    public function get($path, $params = []) {
        $url = "{$this->baseUrl}{$path}";
        if ($params) $url .= '?' . http_build_query($params);
        $ch = curl_init($url);
        curl_setopt_array($ch, [
            CURLOPT_RETURNTRANSFER => true,
            CURLOPT_HTTPHEADER => ["Authorization: Bearer {$this->ensureToken()}"],
        ]);
        return json_decode(curl_exec($ch), true);
    }
}

$api = new SIMAPIClient(
    'app_absensi_abc123',
    'sk_live_xxxxxxxxxxxxx',
    'https://api.anda.com'
);
$data = $api->get('/api/v1/pegawai', ['page' => 1, 'limit' => 10]);
print_r($data);

package simapi

import (
    "bytes"
    "encoding/json"
    "fmt"
    "net/http"
    "sync"
    "time"
)

type SIMAPIClient struct {
    ClientID     string
    ClientSecret string
    BaseURL      string

    mu           sync.Mutex
    accessToken  string
    refreshToken string
    expiresAt    time.Time

    httpClient *http.Client
}

func NewSIMAPIClient(clientID, clientSecret, baseURL string) *SIMAPIClient {
    return &SIMAPIClient{
        ClientID:     clientID,
        ClientSecret: clientSecret,
        BaseURL:      baseURL,
        httpClient:   &http.Client{Timeout: 30 * time.Second},
    }
}

type tokenResp struct {
    AccessToken      string `json:"access_token"`
    RefreshToken     string `json:"refresh_token"`
    ExpiresIn        int    `json:"expires_in"`
    RefreshExpiresIn int    `json:"refresh_expires_in"`
}

func (c *SIMAPIClient) login() error {
    body, _ := json.Marshal(map[string]string{
        "client_id":     c.ClientID,
        "client_secret": c.ClientSecret,
        "grant_type":    "client_credentials",
    })
    resp, err := c.httpClient.Post(c.BaseURL+"/oauth/token", "application/json", bytes.NewBuffer(body))
    if err != nil {
        return err
    }
    defer resp.Body.Close()
    var data tokenResp
    if err := json.NewDecoder(resp.Body).Decode(&data); err != nil {
        return err
    }
    c.accessToken = data.AccessToken
    c.refreshToken = data.RefreshToken
    c.expiresAt = time.Now().Add(time.Duration(data.ExpiresIn-60) * time.Second)
    return nil
}

func (c *SIMAPIClient) refresh() error {
    if c.refreshToken == "" {
        return c.login()
    }
    body, _ := json.Marshal(map[string]string{
        "refresh_token": c.refreshToken,
        "grant_type":    "refresh_token",
    })
    resp, err := c.httpClient.Post(c.BaseURL+"/oauth/token", "application/json", bytes.NewBuffer(body))
    if err != nil {
        return c.login()
    }
    defer resp.Body.Close()
    if resp.StatusCode != 200 {
        return c.login()
    }
    var data tokenResp
    json.NewDecoder(resp.Body).Decode(&data)
    c.accessToken = data.AccessToken
    c.refreshToken = data.RefreshToken
    c.expiresAt = time.Now().Add(time.Duration(data.ExpiresIn-60) * time.Second)
    return nil
}

func (c *SIMAPIClient) ensureToken() error {
    c.mu.Lock()
    defer c.mu.Unlock()
    if c.accessToken == "" || time.Now().After(c.expiresAt) {
        return c.refresh()
    }
    return nil
}

func (c *SIMAPIClient) Get(path string) (map[string]interface{}, error) {
    if err := c.ensureToken(); err != nil {
        return nil, err
    }
    req, _ := http.NewRequest("GET", c.BaseURL+path, nil)
    req.Header.Set("Authorization", "Bearer "+c.accessToken)
    resp, err := c.httpClient.Do(req)
    if err != nil {
        return nil, err
    }
    defer resp.Body.Close()
    if resp.StatusCode == 401 {
        c.mu.Lock()
        c.refresh()
        c.mu.Unlock()
        req.Header.Set("Authorization", "Bearer "+c.accessToken)
        resp, _ = c.httpClient.Do(req)
        defer resp.Body.Close()
    }
    var result map[string]interface{}
    json.NewDecoder(resp.Body).Decode(&result)
    return result, nil
}

func main() {
    api := NewSIMAPIClient("app_absensi_abc123", "sk_live_xxxxxxxxxxxxx", "https://api.anda.com")
    data, err := api.Get("/api/v1/pegawai?page=1&limit=10")
    if err != nil {
        fmt.Println("Error:", err)
        return
    }
    fmt.Println(data)
}

import java.net.URI;
import java.net.http.*;
import java.time.Instant;
import java.util.Map;
import com.fasterxml.jackson.databind.ObjectMapper;

public class SIMAPIClient {
    private final String clientId, clientSecret, baseUrl;
    private final HttpClient http;
    private final ObjectMapper mapper = new ObjectMapper();

    private String accessToken;
    private String refreshToken;
    private Instant expiresAt;

    public SIMAPIClient(String clientId, String clientSecret, String baseUrl) {
        this.clientId = clientId;
        this.clientSecret = clientSecret;
        this.baseUrl = baseUrl;
        this.http = HttpClient.newHttpClient();
    }

    private void login() throws Exception {
        String body = mapper.writeValueAsString(Map.of(
            "client_id", clientId,
            "client_secret", clientSecret,
            "grant_type", "client_credentials"
        ));
        var req = HttpRequest.newBuilder()
            .uri(URI.create(baseUrl + "/oauth/token"))
            .header("Content-Type", "application/json")
            .POST(HttpRequest.BodyPublishers.ofString(body))
            .build();
        var resp = http.send(req, HttpResponse.BodyHandlers.ofString());
        var data = mapper.readTree(resp.body());
        accessToken = data.get("access_token").asText();
        refreshToken = data.get("refresh_token").asText();
        expiresAt = Instant.now().plusSeconds(data.get("expires_in").asLong() - 60);
    }

    private void refresh() throws Exception {
        if (refreshToken == null) { login(); return; }
        String body = mapper.writeValueAsString(Map.of(
            "refresh_token", refreshToken,
            "grant_type", "refresh_token"
        ));
        var req = HttpRequest.newBuilder()
            .uri(URI.create(baseUrl + "/oauth/token"))
            .header("Content-Type", "application/json")
            .POST(HttpRequest.BodyPublishers.ofString(body))
            .build();
        var resp = http.send(req, HttpResponse.BodyHandlers.ofString());
        if (resp.statusCode() != 200) { login(); return; }
        var data = mapper.readTree(resp.body());
        accessToken = data.get("access_token").asText();
        refreshToken = data.get("refresh_token").asText();
        expiresAt = Instant.now().plusSeconds(data.get("expires_in").asLong() - 60);
    }

    private String ensureToken() throws Exception {
        if (accessToken == null || Instant.now().isAfter(expiresAt)) refresh();
        return accessToken;
    }

    public String get(String path) throws Exception {
        var req = HttpRequest.newBuilder()
            .uri(URI.create(baseUrl + path))
            .header("Authorization", "Bearer " + ensureToken())
            .GET()
            .build();
        var resp = http.send(req, HttpResponse.BodyHandlers.ofString());
        if (resp.statusCode() == 401) {
            refresh();
            req = HttpRequest.newBuilder()
                .uri(URI.create(baseUrl + path))
                .header("Authorization", "Bearer " + accessToken)
                .GET()
                .build();
            resp = http.send(req, HttpResponse.BodyHandlers.ofString());
        }
        return resp.body();
    }

    public static void main(String[] args) throws Exception {
        var api = new SIMAPIClient("app_absensi_abc123", "sk_live_xxxxxxxxxxxxx", "https://api.anda.com");
        System.out.println(api.get("/api/v1/pegawai?page=1&limit=10"));
    }
}

using System;
using System.Net.Http;
using System.Net.Http.Json;
using System.Text.Json;
using System.Threading.Tasks;

public class SIMAPIClient
{
    private readonly string _clientId;
    private readonly string _clientSecret;
    private readonly string _baseUrl;
    private readonly HttpClient _http;

    private string _accessToken;
    private string _refreshToken;
    private DateTime _expiresAt;

    public SIMAPIClient(string clientId, string clientSecret, string baseUrl)
    {
        _clientId = clientId;
        _clientSecret = clientSecret;
        _baseUrl = baseUrl.TrimEnd('/');
        _http = new HttpClient();
    }

    private async Task LoginAsync()
    {
        var resp = await _http.PostAsJsonAsync($"{_baseUrl}/oauth/token", new
        {
            client_id = _clientId,
            client_secret = _clientSecret,
            grant_type = "client_credentials"
        });
        var data = await resp.Content.ReadFromJsonAsync();
        _accessToken = data.GetProperty("access_token").GetString();
        _refreshToken = data.GetProperty("refresh_token").GetString();
        var expiresIn = data.GetProperty("expires_in").GetInt32();
        _expiresAt = DateTime.UtcNow.AddSeconds(expiresIn - 60);
    }

    private async Task RefreshAsync()
    {
        if (string.IsNullOrEmpty(_refreshToken))
        {
            await LoginAsync();
            return;
        }
        var resp = await _http.PostAsJsonAsync($"{_baseUrl}/oauth/token", new
        {
            refresh_token = _refreshToken,
            grant_type = "refresh_token"
        });
        if (!resp.IsSuccessStatusCode)
        {
            await LoginAsync();
            return;
        }
        var data = await resp.Content.ReadFromJsonAsync();
        _accessToken = data.GetProperty("access_token").GetString();
        _refreshToken = data.GetProperty("refresh_token").GetString();
        var expiresIn = data.GetProperty("expires_in").GetInt32();
        _expiresAt = DateTime.UtcNow.AddSeconds(expiresIn - 60);
    }

    private async Task EnsureTokenAsync()
    {
        if (string.IsNullOrEmpty(_accessToken) || DateTime.UtcNow >= _expiresAt)
            await RefreshAsync();
        return _accessToken;
    }

    public async Task GetAsync(string path)
    {
        var token = await EnsureTokenAsync();
        var req = new HttpRequestMessage(HttpMethod.Get, $"{_baseUrl}{path}");
        req.Headers.Authorization = new System.Net.Http.Headers.AuthenticationHeaderValue("Bearer", token);
        var resp = await _http.SendAsync(req);

        if (resp.StatusCode == System.Net.HttpStatusCode.Unauthorized)
        {
            await RefreshAsync();
            req = new HttpRequestMessage(HttpMethod.Get, $"{_baseUrl}{path}");
            req.Headers.Authorization = new System.Net.Http.Headers.AuthenticationHeaderValue("Bearer", _accessToken);
            resp = await _http.SendAsync(req);
        }
        return await resp.Content.ReadAsStringAsync();
    }

    public static async Task Main()
    {
        var api = new SIMAPIClient("app_absensi_abc123", "sk_live_xxxxxxxxxxxxx", "https://api.anda.com");
        Console.WriteLine(await api.GetAsync("/api/v1/pegawai?page=1&limit=10"));
    }
}

<script setup>
import { ref, onMounted } from 'vue';

// VUE 3 — panggil backend proxy Anda sendiri (BUKAN SIMAPI langsung)
const pegawai = ref([]);
const loading = ref(true);
const error = ref(null);

onMounted(async () => {
  try {
    const resp = await fetch('/api/proxy/pegawai?page=1&limit=10');  // backend proxy
    if (!resp.ok) throw new Error('Gagal fetch');
    const result = await resp.json();
    pegawai.value = result.data;
  } catch (err) {
    error.value = err.message;
  } finally {
    loading.value = false;
  }
});
</script>

<template>
  
Memuat...
  
Error: {{ error }}
  

    

      {{ p.nama }} - {{ p.jabatan }}
    
  
</template>

import { Injectable } from '@angular/core';
import { HttpClient } from '@angular/common/http';
import { Observable } from 'rxjs';

// ANGULAR — panggil backend proxy Anda sendiri (BUKAN SIMAPI langsung)

@Injectable({ providedIn: 'root' })
export class PegawaiService {
  private proxyUrl = '/api/proxy/pegawai';   // backend proxy Anda

  constructor(private http: HttpClient) {}

  listPegawai(page = 1, limit = 10): Observable {
    return this.http.get(`${this.proxyUrl}?page=${page}&limit=${limit}`);
  }
}

// Component
import { Component, OnInit } from '@angular/core';

@Component({
  selector: 'app-pegawai-list',
  template: `
    
Memuat...
    
Error: {{ error }}
    

      

        {{ p.nama }} - {{ p.jabatan }}
      
    
  `
})
export class PegawaiListComponent implements OnInit {
  pegawai: any[] = [];
  loading = true;
  error: string | null = null;

  constructor(private service: PegawaiService) {}

  ngOnInit() {
    this.service.listPegawai().subscribe({
      next: (res) => { this.pegawai = res.data; this.loading = false; },
      error: (err) => { this.error = err.message; this.loading = false; }
    });
  }
}

# backend_proxy.py — WAJIB untuk web SPA & mobile
# Menyimpan client_secret, mem-proxy request ke SIMAPI.
# Frontend (React/Vue/Angular) hanya bicara dengan proxy ini.

import os
from datetime import datetime, timedelta
import requests
from flask import Flask, jsonify, request

app = Flask(__name__)

SIMAPI_BASE = os.getenv("SIMAPI_BASE", "https://api.anda.com")
CLIENT_ID = os.getenv("SIMAPI_CLIENT_ID")
CLIENT_SECRET = os.getenv("SIMAPI_CLIENT_SECRET")

# Cache token di memory
_token_cache = {"access_token": None, "refresh_token": None, "expires_at": None}


def _ensure_token():
    if _token_cache["access_token"] and datetime.now() < _token_cache["expires_at"]:
        return _token_cache["access_token"]

    # Coba refresh dulu
    if _token_cache["refresh_token"]:
        resp = requests.post(f"{SIMAPI_BASE}/oauth/token", json={
            "refresh_token": _token_cache["refresh_token"],
            "grant_type": "refresh_token",
        })
        if resp.status_code == 200:
            data = resp.json()
            _token_cache["access_token"] = data["access_token"]
            _token_cache["refresh_token"] = data["refresh_token"]
            _token_cache["expires_at"] = datetime.now() + timedelta(seconds=data["expires_in"] - 60)
            return _token_cache["access_token"]

    # Login ulang
    resp = requests.post(f"{SIMAPI_BASE}/oauth/token", json={
        "client_id": CLIENT_ID,
        "client_secret": CLIENT_SECRET,
        "grant_type": "client_credentials",
    })
    data = resp.json()
    _token_cache["access_token"] = data["access_token"]
    _token_cache["refresh_token"] = data["refresh_token"]
    _token_cache["expires_at"] = datetime.now() + timedelta(seconds=data["expires_in"] - 60)
    return _token_cache["access_token"]


@app.route("/api/proxy/", methods=["GET", "POST", "PUT", "DELETE"])
def proxy(subpath):
    token = _ensure_token()
    headers = {"Authorization": f"Bearer {token}"}

    url = f"{SIMAPI_BASE}/api/v1/{subpath}"
    resp = requests.request(
        method=request.method,
        url=url,
        headers=headers,
        params=request.args,
        json=request.get_json(silent=True) if request.method != "GET" else None,
    )

    # Kalau 401, force refresh & retry
    if resp.status_code == 401:
        _token_cache["refresh_token"] = None
        token = _ensure_token()
        headers["Authorization"] = f"Bearer {token}"
        resp = requests.request(
            method=request.method,
            url=url,
            headers=headers,
            params=request.args,
            json=request.get_json(silent=True) if request.method != "GET" else None,
        )

    return (resp.content, resp.status_code, {"Content-Type": "application/json"})


# ============ Endpoint khusus IoT device ============
# Device pakai X-Device-Key (bukan client_secret) untuk autentikasi.
DEVICE_KEYS = {
    "device-abc123": "esp32-gudang-01",
    "device-def456": "esp8266-suhu-02",
}

@app.route("/api/device/", methods=["GET"])
def device_proxy(subpath):
    """Endpoint khusus IoT device — auth pakai X-Device-Key."""
    device_key = request.headers.get("X-Device-Key", "").strip()

    if device_key not in DEVICE_KEYS:
        return jsonify({"success": False, "error": "invalid_device_key"}), 401

    token = _ensure_token()
    url = f"{SIMAPI_BASE}/api/v1/{subpath}"

    resp = requests.get(
        url,
        headers={"Authorization": f"Bearer {token}"},
        params=request.args,
        timeout=10,
    )

    if resp.status_code == 401:
        _token_cache["refresh_token"] = None
        token = _ensure_token()
        resp = requests.get(
            url,
            headers={"Authorization": f"Bearer {token}"},
            params=request.args,
            timeout=10,
        )

    return (resp.content, resp.status_code, {"Content-Type": "application/json"})


if __name__ == "__main__":
    app.run(port=8000)

// iOS — panggil backend proxy Anda sendiri (BUKAN SIMAPI langsung)
// Karena IPA bisa dibongkar, client_secret TIDAK AMAN disimpan di iOS app.

import Foundation

// === Model ===
struct Pegawai: Codable {
    let id: Int
    let nama: String
    let jabatan: String?
}

struct Pagination: Codable {
    let page: Int
    let limit: Int
    let total: Int
    let totalPages: Int

    enum CodingKeys: String, CodingKey {
        case page, limit, total
        case totalPages = "total_pages"
    }
}

struct ApiMeta: Codable {
    let pagination: Pagination
}

struct ApiResponse: Codable {
    let success: Bool
    let data: [Pegawai]
    let meta: ApiMeta?
}

// === Client ===
class SIMAPIProxyClient {
    private let baseURL = "https://backend-anda.com"  // backend proxy Anda
    private let session = URLSession.shared

    func listPegawai(page: Int = 1, limit: Int = 10) async throws -> [Pegawai] {
        var components = URLComponents(string: "\(baseURL)/api/proxy/pegawai")!
        components.queryItems = [
            URLQueryItem(name: "page", value: "\(page)"),
            URLQueryItem(name: "limit", value: "\(limit)"),
        ]

        let (data, resp) = try await session.data(from: components.url!)
        guard let http = resp as? HTTPURLResponse, http.statusCode == 200 else {
            throw NSError(domain: "SIMAPI", code: -1,
                          userInfo: [NSLocalizedDescriptionKey: "Gagal fetch"])
        }
        let result = try JSONDecoder().decode(ApiResponse.self, from: data)
        return result.data
    }
}

// === Usage di SwiftUI ===
import SwiftUI

@MainActor
class PegawaiViewModel: ObservableObject {
    @Published var pegawai: [Pegawai] = []
    @Published var isLoading = false
    @Published var errorMessage: String?

    private let client = SIMAPIProxyClient()

    func load() async {
        isLoading = true
        errorMessage = nil
        do {
            pegawai = try await client.listPegawai()
        } catch {
            errorMessage = error.localizedDescription
        }
        isLoading = false
    }
}

struct PegawaiListView: View {
    @StateObject private var viewModel = PegawaiViewModel()

    var body: some View {
        NavigationView {
            Group {
                if viewModel.isLoading {
                    ProgressView("Memuat...")
                } else if let err = viewModel.errorMessage {
                    Text("Error: \(err)")
                } else {
                    List(viewModel.pegawai, id: \.id) { p in
                        VStack(alignment: .leading) {
                            Text(p.nama).font(.headline)
                            Text(p.jabatan ?? "-").font(.subheadline)
                                .foregroundColor(.secondary)
                        }
                    }
                }
            }
            .navigationTitle("Pegawai")
        }
        .task { await viewModel.load() }
    }
}

// Flutter — panggil backend proxy Anda sendiri (BUKAN SIMAPI langsung)
// Flutter app bisa di-decompile, client_secret TIDAK AMAN.

import 'dart:convert';
import 'package:http/http.dart' as http;
import 'package:flutter/material.dart';

// === Model ===
class Pegawai {
  final int id;
  final String nama;
  final String? jabatan;

  Pegawai({required this.id, required this.nama, this.jabatan});

  factory Pegawai.fromJson(Map json) {
    return Pegawai(
      id: json['id'],
      nama: json['nama'],
      jabatan: json['jabatan'],
    );
  }
}

// === Client ===
class SIMAPIProxyClient {
  static const String baseURL = 'https://backend-anda.com';  // backend proxy Anda

  Future> listPegawai({int page = 1, int limit = 10}) async {
    final uri = Uri.parse('$baseURL/api/proxy/pegawai')
        .replace(queryParameters: {
      'page': '$page',
      'limit': '$limit',
    });

    final resp = await http.get(uri);
    if (resp.statusCode != 200) {
      throw Exception('Gagal fetch: ${resp.statusCode}');
    }

    final json = jsonDecode(resp.body) as Map;
    final data = json['data'] as List;
    return data.map((e) => Pegawai.fromJson(e)).toList();
  }
}

// === Widget ===
class PegawaiListPage extends StatefulWidget {
  @override
  _PegawaiListPageState createState() => _PegawaiListPageState();
}

class _PegawaiListPageState extends State {
  final _client = SIMAPIProxyClient();
  late Future> _future;

  @override
  void initState() {
    super.initState();
    _future = _client.listPegawai();
  }

  @override
  Widget build(BuildContext context) {
    return Scaffold(
      appBar: AppBar(title: Text('Pegawai')),
      body: FutureBuilder>(
        future: _future,
        builder: (context, snapshot) {
          if (snapshot.connectionState == ConnectionState.waiting) {
            return Center(child: CircularProgressIndicator());
          }
          if (snapshot.hasError) {
            return Center(child: Text('Error: ${snapshot.error}'));
          }
          final list = snapshot.data ?? [];
          return ListView.builder(
            itemCount: list.length,
            itemBuilder: (context, i) {
              final p = list[i];
              return ListTile(
                title: Text(p.nama),
                subtitle: Text(p.jabatan ?? '-'),
              );
            },
          );
        },
      ),
    );
  }
}

// React Native — panggil backend proxy Anda sendiri (BUKAN SIMAPI langsung)
// Bundle JS bisa dibongkar, client_secret TIDAK AMAN.

import React, { useEffect, useState } from 'react';
import { View, Text, FlatList, ActivityIndicator, StyleSheet } from 'react-native';

const PROXY_BASE = 'https://backend-anda.com';  // backend proxy Anda

export default function PegawaiListScreen() {
  const [pegawai, setPegawai] = useState([]);
  const [loading, setLoading] = useState(true);
  const [error, setError] = useState(null);

  useEffect(() => {
    (async () => {
      try {
        const resp = await fetch(`${PROXY_BASE}/api/proxy/pegawai?page=1&limit=10`);
        if (!resp.ok) throw new Error(`HTTP ${resp.status}`);
        const json = await resp.json();
        setPegawai(json.data);
      } catch (e) {
        setError(e.message);
      } finally {
        setLoading(false);
      }
    })();
  }, []);

  if (loading) {
    return (
      
        
        Memuat...
      
    );
  }

  if (error) {
    return (
      
        Error: {error}
      
    );
  }

  return (
     String(item.id)}
      renderItem={({ item }) => (
        
          {item.nama}
          {item.jabatan ?? '-'}
        
      )}
    />
  );
}

const styles = StyleSheet.create({
  center: { flex: 1, justifyContent: 'center', alignItems: 'center' },
  error: { color: 'red' },
  item: { padding: 16, borderBottomWidth: 1, borderBottomColor: '#eee' },
  title: { fontSize: 16, fontWeight: 'bold' },
  subtitle: { fontSize: 14, color: '#666' },
});

# Python Desktop (Tkinter / PyQt) — client_secret aman di app
# Karena app desktop tidak dikirim ke user (hanya executable), secret relatif aman.

import tkinter as tk
from tkinter import ttk
import threading
from datetime import datetime, timedelta
import requests

SIMAPI_BASE = "https://api.anda.com"
CLIENT_ID = "app_absensi_abc123"
CLIENT_SECRET = "sk_live_xxxxxxxxxxxxx"


class SIMAPIClient:
    def __init__(self):
        self.access_token = None
        self.refresh_token = None
        self.expires_at = None

    def _login(self):
        resp = requests.post(f"{SIMAPI_BASE}/oauth/token", json={
            "client_id": CLIENT_ID,
            "client_secret": CLIENT_SECRET,
            "grant_type": "client_credentials",
        })
        data = resp.json()
        self.access_token = data["access_token"]
        self.refresh_token = data["refresh_token"]
        self.expires_at = datetime.now() + timedelta(seconds=data["expires_in"] - 60)

    def _refresh(self):
        if not self.refresh_token:
            return self._login()
        resp = requests.post(f"{SIMAPI_BASE}/oauth/token", json={
            "refresh_token": self.refresh_token,
            "grant_type": "refresh_token",
        })
        if resp.status_code != 200:
            return self._login()
        data = resp.json()
        self.access_token = data["access_token"]
        self.refresh_token = data["refresh_token"]
        self.expires_at = datetime.now() + timedelta(seconds=data["expires_in"] - 60)

    def _ensure_token(self):
        if not self.access_token or datetime.now() >= self.expires_at:
            self._refresh()
        return self.access_token

    def get_pegawai(self):
        headers = {"Authorization": f"Bearer {self._ensure_token()}"}
        resp = requests.get(f"{SIMAPI_BASE}/api/v1/pegawai", headers=headers,
                            params={"page": 1, "limit": 10})
        if resp.status_code == 401:
            self._refresh()
            headers["Authorization"] = f"Bearer {self._ensure_token()}"
            resp = requests.get(f"{SIMAPI_BASE}/api/v1/pegawai", headers=headers,
                                params={"page": 1, "limit": 10})
        return resp.json()


class App(tk.Tk):
    def __init__(self):
        super().__init__()
        self.title("SIMAPI — Daftar Pegawai")
        self.geometry("600x400")

        self.api = SIMAPIClient()

        self.tree = ttk.Treeview(self, columns=("id", "nama", "jabatan"),
                                 show="headings")
        self.tree.heading("id", text="ID")
        self.tree.heading("nama", text="Nama")
        self.tree.heading("jabatan", text="Jabatan")
        self.tree.pack(fill="both", expand=True, padx=10, pady=10)

        btn = ttk.Button(self, text="Muat Data", command=self.load_data)
        btn.pack(pady=5)

    def load_data(self):
        threading.Thread(target=self._load, daemon=True).start()

    def _load(self):
        try:
            data = self.api.get_pegawai()
            self.tree.delete(*self.tree.get_children())
            for p in data["data"]:
                self.tree.insert("", "end",
                                 values=(p["id"], p["nama"], p.get("jabatan", "-")))
        except Exception as e:
            print(f"Error: {e}")


if __name__ == "__main__":
    App().mainloop()