fix enrollment logic, add financial aid, fix class distribution

app/Controllers/View/PreferencesController.php

@@ -20,13 +20,16 @@ class PreferencesController extends BaseController
      */
     public function index($userId = null)
     {
-        // Get user ID from parameter or session
-        $userId = $userId ?? (int) session()->get('user_id');
-        
-        if (!$userId) {
+        $sessionUserId = (int) (session()->get('user_id') ?? 0);
+        if ($sessionUserId <= 0) {
             return redirect()->to('/login')->with('error', 'Please log in to view preferences');
         }
 
+        $userId = (int) ($userId ?? $sessionUserId);
+        if (! $this->canAccessUserPreferences($userId, $sessionUserId)) {
+            return redirect()->to('/access_denied');
+        }
+
         // Fetch preferences for the current user
         $preferences = $this->preferencesModel->where('user_id', $userId)->first();
 
@@ -64,13 +67,16 @@ class PreferencesController extends BaseController
      */
     public function updatePreferences($userId = null)
     {
-        // Get user ID from parameter or session
-        $userId = $userId ?? (int) session()->get('user_id');
-        
-        if (!$userId) {
+        $sessionUserId = (int) (session()->get('user_id') ?? 0);
+        if ($sessionUserId <= 0) {
             return redirect()->to('/login')->with('error', 'Please log in to update preferences');
         }
 
+        $userId = (int) ($userId ?? $sessionUserId);
+        if (! $this->canAccessUserPreferences($userId, $sessionUserId)) {
+            return redirect()->to('/access_denied');
+        }
+
         // Validation rules
         $validation = \Config\Services::validation();
 
@@ -141,4 +147,21 @@ class PreferencesController extends BaseController
         // Redirect back to preferences page with success message
         return redirect()->to('/preferences/' . $userId)->with('success', 'Preferences updated successfully');
     }
+
+    private function canAccessUserPreferences(int $requestedUserId, int $sessionUserId): bool
+    {
+        if ($requestedUserId <= 0 || $sessionUserId <= 0) {
+            return false;
+        }
+        if ($requestedUserId === $sessionUserId) {
+            return true;
+        }
+
+        $roles = array_map(
+            static fn ($role): string => strtolower(trim((string) $role)),
+            array_filter(array_merge((array) session()->get('roles'), [session()->get('role')]))
+        );
+
+        return (bool) array_intersect($roles, ['administrator', 'administrative staff', 'principal', 'admin']);
+    }
 }