# 🏷 CHAOSAPI Permanent Watermark

Watermark sistem yang **tidak bisa dihapus tanpa merusak aplikasi**.

## 🎯 Cara Kerja

Setiap kali aplikasi boot (di `AppServiceProvider::boot()`), `ChaosApi::enforceOrDie()` dipanggil. Method ini melakukan:

1. **Self-check** — file `ChaosApi.php` sendiri harus punya string `CHAOSAPI` & `Powered by ChaosAPI`
2. **Constant integrity** — `ChaosApi::SIGNATURE === 'CHAOSAPI'` & `ChaosApi::COPYRIGHT === 'Powered by ChaosAPI'`
3. **Protected files check** — 5 file critical wajib mengandung kedua string tersebut

Kalau **salah satu** check gagal → throw `RuntimeException` → aplikasi mati.

## 📋 File yang Dilindungi

```
app/Services/Watermark/ChaosApi.php       ← class watermark
app/Helpers/global.php                     ← helper functions
config/app.php                             ← app config
bootstrap/app.php                          ← bootstrap
app/Providers/AppServiceProvider.php       ← service provider
```

## 🛡 Skenario Pertahanan

| Skenario Attack | Hasil |
|-----------------|-------|
| Hapus comment `CHAOSAPI` di `config/app.php` | ❌ App fatal error |
| Hapus comment di `bootstrap/app.php` | ❌ App fatal error |
| Ubah `SIGNATURE = 'CHAOSAPI'` → value lain | ❌ App fatal error (constant check) |
| Hapus method `enforceOrDie()` call di Provider | ❌ Provider syntax error / class load error |
| Hapus class `ChaosApi.php` | ❌ Class not found, app fail |
| Comment seluruh isi `ChaosApi::verify()` | ❌ Class file masih harus contain CHAOSAPI |
| Ganti `'CHAOSAPI'` → `'X'` di semua 5 file | ❌ Self-check di ChaosApi.php fail |

**Satu-satunya cara legitimate**: jangan hapus apapun.

## 🧪 Test Bukti

```bash
# Test 1: Hapus dari config
sed -i 's|CHAOSAPI · Powered by ChaosAPI|REMOVED|' config/app.php
curl -I https://yourdomain.com  # → 503 / 302 / fatal error

# Test 2: Ubah SIGNATURE constant
sed -i "s|SIGNATURE = 'CHAOSAPI'|SIGNATURE = 'X'|" app/Services/Watermark/ChaosApi.php
curl -I https://yourdomain.com  # → fatal error

# Test 3: Hapus class file sepenuhnya
rm app/Services/Watermark/ChaosApi.php
curl -I https://yourdomain.com  # → Class not found error
```

## 🔧 Detail Teknis

### `enforceOrDie()` Logic
```php
public static function enforceOrDie(): void
{
    if (! self::verify()) {
        throw new \RuntimeException(
            'Application integrity check failed. Watermark verification error #' 
            . substr(self::fingerprint(), 0, 6)
        );
    }
}
```

Pesan error sengaja **tidak mengungkap** file mana yang fail — supaya attacker harus debug satu per satu.

### `verify()` Multi-Layer
```php
// Layer 1: Self-check
strpos($self, 'CHAOSAPI') !== false &&
strpos($self, 'Powered by ChaosAPI') !== false

// Layer 2: Constant check  
self::SIGNATURE === 'CHAOSAPI' &&
self::COPYRIGHT === 'Powered by ChaosAPI'

// Layer 3: Protected files (5 file)
foreach (PROTECTED_FILES as $file) {
    require strpos === both strings exist
}
```

## ⚠️ Catatan Penting

### Untuk Anda (Vendor)
- **Jangan hapus** comment CHAOSAPI di file manapun saat development
- **Saat update** project, pertahankan watermark di file baru yang Anda tambahkan
- Watermark ini **digabung dengan License Server** → double protection

### Untuk Buyer (Calon Reseller)
Kalau attacker mencoba:
1. Search/replace "CHAOSAPI" di seluruh codebase → app langsung fatal
2. Comment `enforceOrDie()` call → file Provider akan terlihat tampered
3. Bypass via override class → Composer autoload tetap pakai versi original

## 🔄 Kombinasi dengan License Server

```
Layer 1: Watermark CHAOSAPI         ← static deterrent (tidak bisa dihapus)
Layer 2: License Server Validation  ← runtime kill switch (revoke kapan saja)
Layer 3: Server Fingerprint Lock    ← hardware binding
Layer 4: Domain Lock                ← URL binding
```

Kalau attacker bypass Layer 1 (sangat sulit), dia masih kena Layer 2-4.

## 📊 Verify Watermark Active

```bash
# Cek dari CLI bahwa watermark aktif
php artisan tinker --execute='echo \App\Services\Watermark\ChaosApi::verify() ? "WATERMARK OK" : "WATERMARK FAIL";'
```

Output: `WATERMARK OK`

```bash
# Cek count signature
grep -r "CHAOSAPI" app config bootstrap | wc -l
# Output: ~10+ occurrences across protected files
```