feat: implement core modules for homework, timetable, payments, and staff routing with new frontend dashboard pages and initial database migrations

Author: Kuzuri247

backend/index.js

@@ -61,7 +61,8 @@ app.use("/api/payments", paymentsRouter);
 app.use("/api/marks", require("./modules/marks/marks.routes"));
 app.use("/api/attendance", require("./modules/attendance/attendance.routes"));
 app.use("/api/homework", require("./modules/homework/homework.routes"));
-app.use("/api/timetable", require("./modules/academics/timetable.route"));
+app.use("/api/v1/timetable", require("./modules/timetable/timetable.routes"));
+app.use("/api/timetable", require("./modules/timetable/timetable.routes"));
 app.use("/api/teacher", require("./modules/academics/teacher.route"));
 app.use("/api/transport", require("./modules/transport/transport.routes"));
 app.use("/api/reports", require("./modules/reports/reports.route"));

backend/migrations/010_timetable_breaks.sql

@@ -1,3 +1,2 @@
 -- 010_timetable_breaks.sql
-ALTER TABLE timetables
-  ADD COLUMN is_break TINYINT(1) DEFAULT 0 AFTER end_time;
+ALTER TABLE timetables MODIFY COLUMN subject_id INT NULL;

backend/modules/homework/homework.routes.js

@@ -138,6 +138,12 @@ router.put('/status', verifyToken, authorize(ROLES.STUDENT), async (req, res) =>
 // Teacher or Admin deletes homework
 router.delete('/:id', verifyToken, authorize(ROLES.TEACHER, ROLES.ADMIN, ROLES.SUPER_ADMIN), async (req, res) => {
   try {
+    if (req.user.role === ROLES.TEACHER) {
+      const [[hw]] = await pool.query('SELECT assigned_by FROM homework WHERE id = ?', [req.params.id]);
+      if (!hw || Number(hw.assigned_by) !== Number(req.user.id)) {
+        return res.status(403).json({ success: false, message: 'Not authorized to delete this homework assignment' });
+      }
+    }
     await svc.deleteHomework(req.params.id);
     res.json({ success: true, message: 'Homework deleted successfully' });
   } catch (err) {

backend/modules/payments/payments.route.js

@@ -33,7 +33,7 @@ router.post('/create-order',
 );
 
 // POST /api/payments/verify - Verify Razorpay payment signature
-router.post('/verify', verifyToken, async (req, res) => {
+router.post('/verify', verifyToken, authorize(...canCreateOrder), async (req, res) => {
   try {
     const result = await svc.verifyPayment(req.body);
     res.json({ success: true, data: result });

backend/modules/staff/teacherAssignment.routes.js

@@ -35,7 +35,7 @@ router.get('/my-assignments', verifyToken, authorize(ROLES.TEACHER), async (req,
 });
 
 // Admin/Super Admin view of all teachers + assignments
-router.get('/all', verifyToken, authorize(...canManage, ROLES.SUPER_ADMIN), async (req, res) => {
+router.get('/all', verifyToken, authorize(...canManage), async (req, res) => {
   const rows = await svc.listAllTeachersWithAssignments();
   res.json({ success: true, data: rows });
 });