fix enrollment logic, add financial aid, fix class distribution

app/Controllers/View/FilesController.php

@@ -152,6 +152,10 @@ class FilesController extends Controller
             throw PageNotFoundException::forPageNotFound();
         }
 
+        if (! $this->canViewEarlyDismissalSignature($name)) {
+            return $this->response->setStatusCode(403, 'You are not allowed to access this file.');
+        }
+
         // 3) Build path under writable (EARLY DISMISSAL SIGNATURES)
         $path = WRITEPATH . 'uploads/early_dismissal_signatures/' . $name;
         if (!is_file($path)) {
@@ -200,7 +204,7 @@ class FilesController extends Controller
             ->setHeader('Content-Length', (string) $size)
             ->setHeader('ETag', $etag)
             ->setHeader('Last-Modified', gmdate('D, d M Y H:i:s', $mtime) . ' GMT')
-            ->setHeader('Cache-Control', 'public, max-age=86400')
+            ->setHeader('Cache-Control', 'private, no-store')
             ->setBody(file_get_contents($path));
     }
 
@@ -433,6 +437,35 @@ class FilesController extends Controller
         return $draftSemester === '' || $currentSemester === '' || $draftSemester === $currentSemester;
     }
 
+    private function canViewEarlyDismissalSignature(string $name): bool
+    {
+        $userId = (int) (session()->get('user_id') ?? 0);
+        if ($userId <= 0) {
+            return false;
+        }
+
+        $roles = array_map('strtolower', (array) (session()->get('roles') ?? []));
+        $activeRole = strtolower((string) (session()->get('role') ?? ''));
+        if ($activeRole !== '' && ! in_array($activeRole, $roles, true)) {
+            $roles[] = $activeRole;
+        }
+
+        foreach (['administrator', 'administrative staff', 'principal', 'admin', 'teacher', 'teacher_assistant'] as $role) {
+            if (in_array($role, $roles, true)) {
+                return true;
+            }
+        }
+
+        $row = \Config\Database::connect()
+            ->table('early_dismissal_signatures')
+            ->select('uploaded_by')
+            ->where('filename', $name)
+            ->get()
+            ->getRowArray();
+
+        return $row !== null && (int) ($row['uploaded_by'] ?? 0) === $userId;
+    }
+
     private function expenseRecordForFile(string $name): ?array
     {
         return \Config\Database::connect()