refactor observers, fix policy, add feature tests

app/Observers/CashRecordObserver.php

@@ -23,12 +23,10 @@ class CashRecordObserver
 
         // Threshold: 500rb–2jt → buat approval ketua + notif
         if ($record->amount >= 500_000 && $record->amount <= 2_000_000) {
-            Approval::create([
-                'model_type'         => CashRecord::class,
-                'model_id'           => $record->id,
-                'required_approvals' => 1,
-                'status'             => 'pending',
-            ]);
+            Approval::firstOrCreate(
+                ['model_type' => CashRecord::class, 'model_id' => $record->id],
+                ['required_approvals' => 1, 'status' => 'pending']
+            );
 
             NotificationService::toRole('ketua',
                 'Transaksi Kas Butuh Persetujuan',
@@ -38,7 +36,7 @@ class CashRecordObserver
             );
         }
 
-        // Threshold: > 2jt → buat voting + notif semua anggota
+        // Threshold: > 2jt → buat voting (VoteObserver akan notif semua user)
         if ($record->amount > 2_000_000) {
             Vote::create([
                 'title'        => "Persetujuan Transaksi: {$record->description}",
@@ -50,13 +48,6 @@ class CashRecordObserver
                 'deadline'     => now()->addDays(3),
                 'created_by'   => Auth::id() ?? $record->created_by,
             ]);
-
-            NotificationService::toRole('ketua',
-                'Voting Transaksi Besar Dibuat',
-                "Transaksi \"{$record->description}\" senilai Rp " . number_format($record->amount, 0, ',', '.') . " memerlukan voting.",
-                'warning',
-                route('filament.admin.resources.votes.index')
-            );
         }
     }
 
@@ -76,13 +67,9 @@ class CashRecordObserver
     public function deleting(CashRecord $record): void
     {
         if ($record->verified_at !== null) {
-            \Filament\Notifications\Notification::make()
-                ->title('Tidak dapat dihapus')
-                ->body('Transaksi yang sudah diverifikasi tidak dapat dihapus.')
-                ->danger()
-                ->send();
-
-            abort(403);
+            throw new \Illuminate\Auth\Access\AuthorizationException(
+                'Transaksi yang sudah diverifikasi tidak dapat dihapus.'
+            );
         }
     }
 }