Merge pull request #10 from Kuzuri247/test

feat: implement core modules for homework, timetable, payments, and staff routing with new frontend dashboard pages and initial database migrations

Author: Kuzuri247

backend/index.js

@@ -61,7 +61,8 @@ app.use("/api/payments", paymentsRouter);
 app.use("/api/marks", require("./modules/marks/marks.routes"));
 app.use("/api/attendance", require("./modules/attendance/attendance.routes"));
 app.use("/api/homework", require("./modules/homework/homework.routes"));
-app.use("/api/timetable", require("./modules/academics/timetable.route"));
+app.use("/api/v1/timetable", require("./modules/timetable/timetable.routes"));
+app.use("/api/timetable", require("./modules/timetable/timetable.routes"));
 app.use("/api/teacher", require("./modules/academics/teacher.route"));
 app.use("/api/transport", require("./modules/transport/transport.routes"));
 app.use("/api/reports", require("./modules/reports/reports.route"));

backend/migrations/010_timetable_breaks.sql

@@ -1,3 +1,3 @@
 -- 010_timetable_breaks.sql
-ALTER TABLE timetables
-  ADD COLUMN is_break TINYINT(1) DEFAULT 0 AFTER end_time;
+ALTER TABLE timetables MODIFY COLUMN subject_id INT NULL;
+ALTER TABLE timetables ADD COLUMN IF NOT EXISTS is_break TINYINT(1) DEFAULT 0 AFTER end_time;

backend/modules/homework/homework.routes.js

@@ -138,7 +138,14 @@ router.put('/status', verifyToken, authorize(ROLES.STUDENT), async (req, res) =>
 // Teacher or Admin deletes homework
 router.delete('/:id', verifyToken, authorize(ROLES.TEACHER, ROLES.ADMIN, ROLES.SUPER_ADMIN), async (req, res) => {
   try {
-    await svc.deleteHomework(req.params.id);
+    const teacherUserId = req.user.role === ROLES.TEACHER ? req.user.id : null;
+    const affected = await svc.deleteHomework(req.params.id, teacherUserId);
+    if (affected === 0) {
+      if (req.user.role === ROLES.TEACHER) {
+        return res.status(403).json({ success: false, message: 'Not authorized to delete this homework assignment or homework not found' });
+      }
+      return res.status(404).json({ success: false, message: 'Homework not found' });
+    }
     res.json({ success: true, message: 'Homework deleted successfully' });
   } catch (err) {
     res.status(500).json({ success: false, message: err.message });

backend/modules/homework/homework.service.js

@@ -114,8 +114,15 @@ const listAllForAdmin = async () => {
   return rows;
 };
 
-const deleteHomework = async (homeworkId) => {
-  await pool.query('DELETE FROM homework WHERE id = ?', [homeworkId]);
+const deleteHomework = async (homeworkId, teacherUserId = null) => {
+  let query = 'DELETE FROM homework WHERE id = ?';
+  let params = [homeworkId];
+  if (teacherUserId) {
+    query += ' AND assigned_by = ?';
+    params.push(teacherUserId);
+  }
+  const [result] = await pool.query(query, params);
+  return result.affectedRows;
 };
 
 module.exports = {

backend/modules/payments/payments.route.js

@@ -33,9 +33,9 @@ router.post('/create-order',
 );
 
 // POST /api/payments/verify - Verify Razorpay payment signature
-router.post('/verify', verifyToken, async (req, res) => {
+router.post('/verify', verifyToken, authorize(...canCreateOrder), async (req, res) => {
   try {
-    const result = await svc.verifyPayment(req.body);
+    const result = await svc.verifyPayment(req.body, req.user);
     res.json({ success: true, data: result });
   } catch (err) {
     res.status(err.status || 500).json({ success: false, message: err.message });

backend/modules/payments/payments.service.js

@@ -61,15 +61,27 @@ const createOrder = async (feeRecordId, createdByUserId) => {
   };
 };
 
-const verifyPayment = async ({
-  razorpay_order_id,
-  razorpay_payment_id,
-  razorpay_signature,
-}) => {
+const verifyPayment = async (
+  { razorpay_order_id, razorpay_payment_id, razorpay_signature },
+  user = null
+) => {
   const secret = process.env.RAZORPAY_KEY_SECRET;
   if (!secret) {
     throw Object.assign(new Error("Razorpay Secret is not configured"), { status: 500 });
   }
+
+  if (user && user.role === "student") {
+    const [[orderInfo]] = await pool.query(
+      `SELECT ro.student_id FROM razorpay_orders ro
+       JOIN students s ON ro.student_id = s.id
+       WHERE ro.razorpay_order_id = ? AND s.user_id = ?`,
+      [razorpay_order_id, user.id]
+    );
+    if (!orderInfo) {
+      throw Object.assign(new Error("Unauthorized: Cannot verify payment for another student"), { status: 403 });
+    }
+  }
+
   const expectedSignature = crypto
     .createHmac("sha256", secret)
     .update(`${razorpay_order_id}|${razorpay_payment_id}`)

backend/modules/staff/teacherAssignment.routes.js

@@ -35,7 +35,7 @@ router.get('/my-assignments', verifyToken, authorize(ROLES.TEACHER), async (req,
 });
 
 // Admin/Super Admin view of all teachers + assignments
-router.get('/all', verifyToken, authorize(...canManage, ROLES.SUPER_ADMIN), async (req, res) => {
+router.get('/all', verifyToken, authorize(...canManage), async (req, res) => {
   const rows = await svc.listAllTeachersWithAssignments();
   res.json({ success: true, data: rows });
 });