diff --git a/application/controllers/mockup/purchase/order/PurchaseOrder.http b/application/controllers/mockup/purchase/order/PurchaseOrder.http
index 40f7898..3487860 100644
--- a/application/controllers/mockup/purchase/order/PurchaseOrder.http
+++ b/application/controllers/mockup/purchase/order/PurchaseOrder.http
@@ -172,6 +172,45 @@ Content-Type: application/json
     "ID": ""
 }
 
+###
+// upload attachment — requires multipart/form-data with file(s)
+// Gunakan REST Client atau Postman. Contoh format:
+// POST https://{{host}}/mockup/purchase/order/PurchaseOrderAset/uploadAttachment/
+// Content-Type: multipart/form-data; boundary=----boundary
+// 
+// ------boundary
+// Content-Disposition: form-data; name="token"
+// 
+// eyJ...
+// ------boundary
+// Content-Disposition: form-data; name="ponumber"
+// 
+// PO24070001
+// ------boundary
+// Content-Disposition: form-data; name="poID"
+// 
+// 1
+// ------boundary
+// Content-Disposition: form-data; name="contractID"
+// 
+// 1
+// ------boundary
+// Content-Disposition: form-data; name="files"; filename="foto1.jpg"
+// Content-Type: image/jpeg
+// 
+// < /path/to/foto1.jpg
+// ------boundary
+// Content-Disposition: form-data; name="files"; filename="foto2.jpg"
+// Content-Type: image/jpeg
+// 
+// < /path/to/foto2.jpg
+// ------boundary--
+Content-Type: application/json
+
+{
+    "token": {{token}}
+}
+
 ###
 // listing po asset
 POST https://{{host}}/mockup/purchase/order/PurchaseOrderAset/getDaftarPoAset/
diff --git a/application/controllers/mockup/purchase/order/PurchaseOrderAset.php b/application/controllers/mockup/purchase/order/PurchaseOrderAset.php
index b9bd935..5111f5b 100644
--- a/application/controllers/mockup/purchase/order/PurchaseOrderAset.php
+++ b/application/controllers/mockup/purchase/order/PurchaseOrderAset.php
@@ -994,6 +994,80 @@ class PurchaseOrderAset extends MY_Controller {
         }
     }
 
+    // upload file
+    public function uploadAttachment() {
+        try {
+            if (!$this->isLogin) {
+                $this->sys_error("invalid token");
+                exit;
+            }
+
+            $this->db->trans_begin();
+            $para = $this->sys_input;
+            $user = $this->sys_user;
+
+            $basepath = "/home/one/project/accone/one-media/order-asset/";
+            $year = date("Y");
+            $targetpath = $basepath . $year . "/";
+
+            if (!is_dir($targetpath)) {
+                mkdir($targetpath, 0755, true);
+            }
+
+            $config['upload_path'] = $targetpath;
+            $config['allowed_types'] = 'jpg|jpeg|png';
+            $config['max_size'] = '10000';
+            $count = count($_FILES['files']['name']);
+            $this->load->library('upload', $config);
+
+            for ($i=0; $i < $count; $i++) {
+                if (!empty($_FILES['files']['name'][$i])) {
+                    $_FILES['file']['name']     = $_FILES['files']['name'][$i];
+                    $_FILES['file']['type']     = $_FILES['files']['type'][$i];
+                    $_FILES['file']['tmp_name'] = $_FILES['files']['tmp_name'][$i];
+                    $_FILES['file']['error']    = $_FILES['files']['error'][$i];
+                    $_FILES['file']['size']     = $_FILES['files']['size'][$i];
+
+                    $ext = pathinfo($_FILES['file']['name'], PATHINFO_EXTENSION);
+                    $new_filename = "PO" . date("YmdHis") . "_" . $para['ponumber'] . "." . $ext;
+                    $config['file_name'] = $new_filename;
+                    $this->upload->initialize($config);
+
+                    if ($this->upload->do_upload('file')) {
+                        $upload_data = $this->upload->data();
+                        $filename = $upload_data['file_name'];
+
+                        $sql_insert = "INSERT INTO purchase_order_asset_attachment (
+                            PurchaseOrderAssetAttachmentContractID,
+                            PurchaseOrderAssetAttachmentPurchaseOrderID,
+                            PurchaseOrderAssetAttachmentName,
+                            PurchaseOrderAssetAttachmentType,
+                            PurchaseOrderAssetAttachmentCreated
+                        ) VALUES (?,?,?,?,NOW())";
+                        $que_insert = $this->db->query($sql_insert, [
+                            $para['contractID'], $para['poID'], $filename, 'order'
+                        ]);
+                        if (!$que_insert) {
+                            $this->db->trans_rollback();
+                            $this->sys_error_db("[Error] failed insert attachment table purchase order asset attachment");
+                            exit;
+                        }
+                    } else {
+                        $error = $this->upload->display_errors();
+                        $this->db->trans_rollback();
+                        $this->sys_error("[Error] " . $error);
+                    }
+                }
+            }
+
+            $this->db->trans_commit();
+            $this->sys_ok("[Success] upload attachment order asset");
+        } catch (Exception $exc) {
+            $msg = $exc->getMessage();
+            $this->sys_error($msg);
+        }
+    }
+
     public function getUserApproveLevel() {
         try {
             if (!$this->isLogin) {