merge prod to main

.env

@@ -0,0 +1,180 @@
+#--------------------------------------------------------------------
+# Example Environment Configuration file
+#
+# This file can be used as a starting point for your own
+# custom .env files, and contains most of the possible settings
+# available in a default install.
+#
+# By default, all of the settings are commented out. If you want
+# to override the setting, you must un-comment it by removing the '#'
+# at the beginning of the line.
+#--------------------------------------------------------------------
+
+#--------------------------------------------------------------------
+# ENVIRONMENT
+#--------------------------------------------------------------------
+
+CI_ENVIRONMENT = development
+
+# Which profile to use if none is supplied to sendEmail()
+# Options: default, communication, payment, ...
+MAIL_PROFILE_DEFAULT=default
+
+# ===== DEFAULT (system) =====
+# ---- Legacy fallbacks (kept for compatibility) ----
+SMTP_HOST = smtp.gmail.com
+SMTP_USER = alrahma.sunday.school@gmail.com
+SMTP_PASS = "psnp emdq dykw ypul"
+SMTP_PORT = 587
+SMTP_ENCRYPTION = tls  # was SSL; set to ssl to match 587
+
+# Reply-To for all mail profiles
+MAIL_DEFAULT_REPLY_TO=alrahma.isgl@gmail.com
+MAIL_DEFAULT_REPLY_TO_NAME="Al Rahma Sunday School"
+MAIL_COMMUNICATION_REPLY_TO=alrahma.isgl@gmail.com
+MAIL_COMMUNICATION_REPLY_TO_NAME="School Communications"
+MAIL_PAYMENT_REPLY_TO=alrahma.isgl@gmail.com
+MAIL_PAYMENT_REPLY_TO_NAME="School Payments"
+MAIL_DEFAULT_REPLY_TO="alrahma.isgl@gmail.com"
+
+# Optional sender directory you already use elsewhere
+MAIL_SENDERS="{\"general\":{\"email\":\"alrahma.isgl@gmail.com\",\"name\":\"Al Rahma No-Reply\"},\
+\"registration\":{\"email\":\"alrahma.isgl@gmail.com\",\"name\":\"Al Rahma Register Office\"},\
+\"notifications\":{\"email\":\"alrahma.isgl@gmail.com\",\"name\":\"Al Rahma Notifications\"},\
+\"finance\":{\"email\":\"alrahma.isgl@gmail.com\",\"name\":\"Al Rahma Finance Office\"}}"
+
+# Principal notification recipient for TimeOff requests (comma-separated allowed)
+PRINCIPAL_EMAIL="principal@alrahmaisgl.org"
+
+#--------------------------------------------------------------------
+# APP
+#--------------------------------------------------------------------
+
+# If you have trouble with `.`, you could also use `_`.
+ app_baseURL = 'http://localhost:8080/'
+# app.forceGlobalSecureRequests = true
+# app.CSPEnabled = false
+
+#--------------------------------------------------------------------
+# DATABASE
+#--------------------------------------------------------------------
+database.default.hostname = 127.0.0.1
+database.default.database = school
+database.default.username = root
+database.default.password = root
+database.default.DBDriver = MySQLi
+database.default.DBPrefix =
+database.default.port = 3306
+
+
+#--------------------------------------------------------------------
+# CONTENT SECURITY POLICY
+#--------------------------------------------------------------------
+
+# contentsecuritypolicy.reportOnly = false
+# contentsecuritypolicy.defaultSrc = 'none'
+# contentsecuritypolicy.scriptSrc = 'self'
+# contentsecuritypolicy.styleSrc = 'self'
+# contentsecuritypolicy.imageSrc = 'self'
+# contentsecuritypolicy.baseURI = null
+# contentsecuritypolicy.childSrc = null
+# contentsecuritypolicy.connectSrc = 'self'
+# contentsecuritypolicy.fontSrc = null
+# contentsecuritypolicy.formAction = null
+# contentsecuritypolicy.frameAncestors = null
+# contentsecuritypolicy.frameSrc = null
+# contentsecuritypolicy.mediaSrc = null
+# contentsecuritypolicy.objectSrc = null
+# contentsecuritypolicy.pluginTypes = null
+# contentsecuritypolicy.reportURI = null
+# contentsecuritypolicy.sandbox = false
+# contentsecuritypolicy.upgradeInsecureRequests = false
+# contentsecuritypolicy.styleNonceTag = '{csp-style-nonce}'
+# contentsecuritypolicy.scriptNonceTag = '{csp-script-nonce}'
+# contentsecuritypolicy.autoNonce = true
+
+#--------------------------------------------------------------------
+# COOKIE
+#--------------------------------------------------------------------
+
+# cookie.prefix = ''
+# cookie.expires = 0
+# cookie.path = '/'
+# cookie.domain = ''
+# cookie.secure = false
+# cookie.httponly = false
+# cookie.samesite = 'Lax'
+# cookie.raw = false
+
+#--------------------------------------------------------------------
+# ENCRYPTION
+#--------------------------------------------------------------------
+
+# encryption.key =
+# encryption.driver = OpenSSL
+# encryption.blockSize = 16
+# encryption.digest = SHA512
+
+#--------------------------------------------------------------------
+# HONEYPOT
+#--------------------------------------------------------------------
+
+# honeypot.hidden = 'true'
+# honeypot.label = 'Fill This Field'
+# honeypot.name = 'honeypot'
+# honeypot.template = '<label>{label}</label><input type="text" name="{name}" value=""/>'
+# honeypot.container = '<div style="display:none">{template}</div>'
+
+#--------------------------------------------------------------------
+# SECURITY
+#--------------------------------------------------------------------
+
+# security.csrfProtection = 'cookie'
+# security.tokenRandomize = false
+# security.tokenName = 'csrf_token_name'
+# security.headerName = 'X-CSRF-TOKEN'
+# security.cookieName = 'csrf_cookie_name'
+# security.expires = 7200
+# security.regenerate = true
+# security.redirect = false
+# security.samesite = 'Lax'
+
+#--------------------------------------------------------------------
+# SESSION
+#--------------------------------------------------------------------
+
+# session.driver = 'CodeIgniter\Session\Handlers\FileHandler'
+# session.cookieName = 'ci_session'
+# session.expiration = 7200
+# session.savePath = null
+# session.matchIP = false
+# session.timeToUpdate = 300
+# session.regenerateDestroy = false
+
+#--------------------------------------------------------------------
+# LOGGER
+#--------------------------------------------------------------------
+
+# logger.threshold = 4
+
+#--------------------------------------------------------------------
+# CURLRequest
+#--------------------------------------------------------------------
+
+# curlrequest.shareOptions = false
+
+
+
+
+
+mail.protocol  = smtp
+mail.SMTPHost  = ${SMTP_HOST}
+mail.SMTPUser  = ${SMTP_USER}
+mail.SMTPPass  = ${SMTP_PASS}
+mail.SMTPPort  = ${SMTP_PORT}
+mail.SMTPCrypto = tls
+
+mail.fromEmail = ${SMTP_USER}
+mail.fromName  = "Al Rahma Sunday School"
+mail.mailType  = text
+mail.charset   = UTF-8

.gitignore

@@ -1,54 +0,0 @@
-.env
-.env.*
-!.env.example
-
-/vendor/
-/node_modules/
-
-/writable/cache/*
-/writable/debugbar/*
-/writable/logs/*
-/writable/session/*
-/writable/uploads/*
-/writable/tmp/*
-/writable/*.log
-
-!/writable/.gitkeep
-!/writable/cache/.gitkeep
-!/writable/debugbar/.gitkeep
-!/writable/logs/.gitkeep
-!/writable/session/.gitkeep
-!/writable/uploads/.gitkeep
-!/writable/tmp/.gitkeep
-
-/public/build/
-/public/hot/
-/public/uploads/**
-!/public/uploads/**/index.html
-!/public/uploads/.gitkeep
-
-/uploads/**
-!/uploads/**/index.html
-!/uploads/.gitkeep
-
-docker-compose.override.yml
-docker-compose.local.yml
-
-*.log
-.swp
-.swo
-*~
-.tmp
-.DS_Store
-Thumbs.db
-.idea/
-.vscode/
-.codex/
-
-/coverage/
-/build/
-/builds
-/phpunit.xml.cache
-/.phpunit.result.cache
-/writable/reports/*
-/writable/test.txt

app/Commands/RecalculateInvoices.php

@@ -1,171 +0,0 @@
-<?php
-
-namespace App\Commands;
-
-use App\Libraries\InvoiceLedgerService;
-use App\Models\InvoiceModel;
-use CodeIgniter\CLI\BaseCommand;
-use CodeIgniter\CLI\CLI;
-
-class RecalculateInvoices extends BaseCommand
-{
-    protected $group = 'Financial';
-    protected $name = 'financial:recalculate-invoices';
-    protected $description = 'Audits invoice totals against the centralized ledger and optionally writes the corrected values.';
-    protected $usage = 'financial:recalculate-invoices [--commit] [--invoice-id=123] [--parent-id=456] [--school-year=2025-2026] [--semester=Fall]';
-    protected $options = [
-        '--commit' => 'Persist recalculated totals. Without this flag the command runs in dry-run mode.',
-        '--invoice-id' => 'Only process a single invoice ID.',
-        '--parent-id' => 'Only process invoices for one parent.',
-        '--school-year' => 'Only process invoices for the specified school year.',
-        '--semester' => 'Only process invoices for the specified semester.',
-    ];
-
-    public function run(array $params)
-    {
-        $options = $this->parseOptions($params);
-        $invoiceModel = new InvoiceModel();
-        $ledgerService = new InvoiceLedgerService();
-        $invoiceIds = $this->loadInvoiceIds($invoiceModel, $options);
-
-        if ($invoiceIds === []) {
-            CLI::write('No invoices matched the provided filters.', 'yellow');
-            return;
-        }
-
-        $commit = !empty($options['commit']);
-        CLI::write(($commit ? 'Applying' : 'Dry-run auditing') . ' ' . count($invoiceIds) . ' invoice(s)...', 'yellow');
-
-        $changed = 0;
-        $unchanged = 0;
-        $errors = 0;
-
-        foreach ($invoiceIds as $invoiceId) {
-            $invoice = $invoiceModel->find($invoiceId);
-            if (!$invoice) {
-                continue;
-            }
-
-            try {
-                $calculation = $ledgerService->calculateInvoice($invoiceId);
-                $diffs = $this->diffInvoice($invoice, $calculation);
-
-                if ($diffs === []) {
-                    $unchanged++;
-                    CLI::write('Invoice #' . $invoiceId . ' unchanged.', 'green');
-                    continue;
-                }
-
-                $changed++;
-                CLI::write('Invoice #' . $invoiceId . ' requires recalculation:', 'light_yellow');
-                foreach ($diffs as $label => $values) {
-                    CLI::write(sprintf(
-                        '  %s: %s -> %s',
-                        $label,
-                        (string) $values['from'],
-                        (string) $values['to']
-                    ));
-                }
-
-                if ($commit) {
-                    $ledgerService->recalculateInvoice($invoiceId);
-                    CLI::write('  saved', 'blue');
-                }
-            } catch (\Throwable $e) {
-                $errors++;
-                CLI::error('Invoice #' . $invoiceId . ' failed: ' . $e->getMessage());
-            }
-        }
-
-        CLI::newLine();
-        CLI::write('Processed: ' . count($invoiceIds), 'white');
-        CLI::write('Changed: ' . $changed, $changed > 0 ? 'yellow' : 'white');
-        CLI::write('Unchanged: ' . $unchanged, 'green');
-        CLI::write('Errors: ' . $errors, $errors > 0 ? 'red' : 'white');
-
-        if (!$commit) {
-            CLI::write('Dry-run complete. Re-run with --commit to persist corrections.', 'light_blue');
-        }
-    }
-
-    protected function parseOptions(array $params): array
-    {
-        $options = [
-            'commit' => false,
-            'invoice-id' => null,
-            'parent-id' => null,
-            'school-year' => null,
-            'semester' => null,
-        ];
-
-        foreach ($params as $param) {
-            $value = trim((string) $param);
-            if ($value === '--commit') {
-                $options['commit'] = true;
-                continue;
-            }
-
-            if (!str_starts_with($value, '--') || !str_contains($value, '=')) {
-                continue;
-            }
-
-            [$key, $raw] = explode('=', substr($value, 2), 2);
-            if (array_key_exists($key, $options)) {
-                $options[$key] = $raw;
-            }
-        }
-
-        return $options;
-    }
-
-    protected function loadInvoiceIds(InvoiceModel $invoiceModel, array $options): array
-    {
-        $builder = $invoiceModel->select('id')->orderBy('id', 'ASC');
-
-        if (!empty($options['invoice-id'])) {
-            $builder->where('id', (int) $options['invoice-id']);
-        }
-
-        if (!empty($options['parent-id'])) {
-            $builder->where('parent_id', (int) $options['parent-id']);
-        }
-
-        if (!empty($options['school-year'])) {
-            $builder->where('school_year', (string) $options['school-year']);
-        }
-
-        if (!empty($options['semester'])) {
-            $builder->where('semester', (string) $options['semester']);
-        }
-
-        return array_map(
-            static fn (array $row): int => (int) ($row['id'] ?? 0),
-            $builder->findAll()
-        );
-    }
-
-    protected function diffInvoice(array $invoice, array $calculation): array
-    {
-        $fields = [
-            'total_amount' => 'total_amount',
-            'paid_amount' => 'paid_amount',
-            'balance' => 'balance',
-            'status' => 'status',
-            'has_discount' => 'has_discount',
-        ];
-        $diffs = [];
-
-        foreach ($fields as $invoiceKey => $calcKey) {
-            $current = (string) ($invoice[$invoiceKey] ?? '');
-            $recalculated = (string) ($calculation[$calcKey] ?? '');
-            if ($current !== $recalculated) {
-                $diffs[$invoiceKey] = [
-                    'from' => $current,
-                    'to' => $recalculated,
-                ];
-            }
-        }
-
-        return $diffs;
-    }
-}

app/Commands/SyncPaypalPayments.php

@@ -0,0 +1,232 @@
+<?php
+
+namespace App\Commands;
+
+use CodeIgniter\CLI\BaseCommand;
+use CodeIgniter\CLI\CLI;
+use App\Models\PayPalPaymentModel;
+use App\Models\PaymentModel;
+use App\Models\UserModel;
+use App\Models\ConfigurationModel;
+use App\Models\InvoiceModel;
+use App\Models\StudentModel;
+use App\Models\EnrollmentModel;
+
+class SyncPaypalPayments extends BaseCommand
+{
+    protected $group       = 'Payments';
+    protected $name        = 'payments:sync-paypal';
+    protected $description = 'Sync PayPal payments to internal payments table from paypal_payments';
+    protected $configModel;
+    protected $semester;
+    protected $schoolYear;
+    protected $paypalModel;
+    protected $paymentModel;
+    protected $userModel;
+    protected $invoiceModel;
+    protected $studentModel;
+    protected $enrollmentModel;
+
+    public function __construct()
+    {
+        $this->configModel = new ConfigurationModel();
+        $this->paypalModel    = new PayPalPaymentModel();
+        $this->paymentModel   = new PaymentModel();
+        $this->userModel      = new UserModel();
+        $this->invoiceModel   = new InvoiceModel();
+        $this->studentModel = new StudentModel();
+        $this->enrollmentModel = new EnrollmentModel();
+
+        $this->semester = $this->configModel->getConfig('semester');
+        $this->schoolYear = $this->configModel->getConfig('school_year');
+    }
+
+    public function run(array $params)
+    {
+        $dryRun     = CLI::getOption('dry-run');
+        $reportOnly = CLI::getOption('report-only');
+        $mode       = $reportOnly ? 'REPORT-ONLY' : ($dryRun ? 'DRY-RUN' : 'LIVE');
+
+        $paypalEntries = $this->paypalModel
+            ->where('status', 'COMPLETED')
+            ->where('synced', 0)
+            ->where('sync_attempts <', 3)
+            ->where('transaction_id IS NOT NULL')
+            ->findAll();
+
+        $syncedCount = 0;
+        $failed = [];
+
+        foreach ($paypalEntries as $entry) {
+            $parentId = null;
+            $invoiceId = 0;
+
+            $users = $this->userModel->getUsersBySchoolId($entry['parent_school_id']);
+            $user = $users[0] ?? null;
+
+            // Always increment sync_attempts unless report-only
+            if (!$reportOnly) {
+                $this->paypalModel->update($entry['id'], [
+                    'sync_attempts' => $entry['sync_attempts'] + 1
+                ]);
+            }
+
+            if ($user) {
+                $parentId = $user['id'];
+
+                $invoice = $this->invoiceModel->getInvoicesByParentId($parentId, $this->schoolYear);
+
+                if (!$reportOnly && !$dryRun) {
+                    if ($invoice) {
+                        $invoiceId = $invoice['id'];
+
+                        $success = $this->processPayment(
+                            $invoiceId,
+                            $entry['amount'],
+                            'PayPal',
+                            null,
+                            $entry['transaction_id'],
+                            date('Y-m-d', strtotime($entry['created_at'])),
+                            $this->schoolYear,
+                            $this->semester
+                        );
+
+                        if (!$success) {
+                            $failed[] = $entry['transaction_id'];
+                            continue;
+                        }
+                    } else {
+                        $this->paymentModel->insert([
+                            'parent_id'              => $parentId,
+                            'invoice_id'             => 0,
+                            'total_amount'           => $entry['amount'],
+                            'paid_amount'            => $entry['amount'],
+                            'balance'                => 0.00,
+                            'number_of_installments' => 1,
+                            'transaction_id'         => $entry['transaction_id'],
+                            'payment_method'         => 'PayPal',
+                            'payment_date'           => date('Y-m-d', strtotime($entry['created_at'])),
+                            'school_year'            => $this->schoolYear,
+                            'semester'               => $this->semester,
+                            'status'                 => 'Completed',
+                            'updated_by'             => null,
+                        ]);
+                    }
+
+                    // Mark as synced only in LIVE mode
+                    $this->paypalModel->update($entry['id'], ['synced' => 1]);
+                }
+
+                $syncedCount++;
+            } else {
+                log_message('error', "[PAYPAL SYNC FAILED] No user found for parent_school_id: {$entry['parent_school_id']}");
+                $failed[] = $entry['transaction_id'];
+            }
+        }
+
+        // === Logging ===
+        log_message('info', "[$mode] PAYPAL SYNC: $syncedCount processed.");
+        if (!empty($failed)) {
+            log_message('error', "[$mode] PAYPAL SYNC Failed: " . implode(', ', $failed));
+        }
+
+        // === CLI Output ===
+        CLI::write("[$mode] $syncedCount PayPal payments processed.", 'green');
+        if (!empty($failed)) {
+            CLI::error("[$mode] Failed transactions: " . implode(', ', $failed));
+        }
+
+        // === Email Report: Only if there's any update ===
+        if ($syncedCount > 0 || !empty($failed)) {
+            helper('email');
+            $email = \Config\Services::email();
+            $email->setTo('support@alrahmaisgl.org');
+            $email->setFrom('no-parentsreply@alrahmaisgl.org', 'PayPal Sync Report');
+            $email->setSubject("[$mode] PayPal Sync Report - " . date('Y-m-d H:i'));
+
+            $body = "PayPal Sync Mode: $mode\n\n";
+            $body .= "$syncedCount PayPal payments processed.\n\n";
+
+            if (!empty($failed)) {
+                $body .= count($failed) . " failed transactions:\n";
+                $body .= implode("\n", $failed);
+            } else {
+                $body .= "No failed transactions.\n";
+            }
+
+            $email->setMessage(nl2br($body));
+
+            if ($email->send()) {
+                CLI::write("[$mode] Email report sent successfully.", 'yellow');
+            } else {
+                CLI::error("[$mode] Failed to send email report.");
+                log_message('error', 'Email send error: ' . $email->printDebugger(['headers']));
+            }
+        } else {
+            log_message('info', "[$mode] No PayPal sync updates. Email not sent.");
+            CLI::write("[$mode] No changes to report. Email not sent.", 'blue');
+        }
+    }
+
+    private function processPayment($invoiceId, $amount, $paymentMethod, $checkFile = null, $transactionId = null, $paymentDate = null, $schoolYear = null, $semester = null)
+    {
+        $invoice = $this->invoiceModel->find($invoiceId);
+        if (!$invoice) {
+            return false;
+        }
+
+        $transactionId = $transactionId ?? 'INV-' . $invoiceId . '-' . time();
+        $paymentDate   = $paymentDate ?? date('Y-m-d');
+
+        $newPaid    = $invoice['paid_amount'] + $amount;
+        $newBalance = $invoice['balance'] - $amount;
+
+        $invoiceUpdateData = [
+            'paid_amount' => $newPaid,
+            'balance'     => $newBalance,
+            'status'      => ($newBalance <= 0) ? 'Paid' : $invoice['status'],
+        ];
+
+        if (!$this->invoiceModel->update($invoiceId, $invoiceUpdateData)) {
+            return false;
+        }
+
+        $this->paymentModel->insert([
+            'parent_id'              => $invoice['parent_id'],
+            'invoice_id'             => $invoiceId,
+            'total_amount'           => $invoice['total_amount'],
+            'paid_amount'            => $amount,
+            'balance'                => $newBalance,
+            'number_of_installments' => 1,
+            'transaction_id'         => $transactionId,
+            'payment_method'         => $paymentMethod,
+            'payment_date'           => $paymentDate,
+            'status'                 => ($newBalance <= 0) ? 'Full' : 'Partial',
+            'check_file'             => $checkFile,
+            'updated_by'             => null, // Avoid using session()->get() in CLI
+            'school_year'            => $schoolYear,
+            'semester'               => $semester
+        ]);
+
+        $this->updateEnrollmentStatusIfPaid($invoiceId, $schoolYear);
+        return true;
+    }
+
+    private function updateEnrollmentStatusIfPaid($invoiceId, $schoolYear)
+    {
+        $invoice = $this->invoiceModel->find($invoiceId);
+        if (!$invoice || $invoice['balance'] > 0) {
+            return;
+        }
+
+        $students = $this->studentModel->where('parent_id', $invoice['parent_id'])
+            ->where('school_year', $schoolYear)
+            ->findAll();
+
+        foreach ($students as $student) {
+            $this->enrollmentModel->set(['enrollment_status' => 'enrolled'])
+                ->where('student_id', $student['id'])
+                ->update();
+        }
+    }
+}

app/Config/Commands.php

@@ -16,11 +16,11 @@ class Commands extends BaseService
             \App\Commands\CleanupPasswordResets::class,
             \App\Commands\ConfigUpdate::class,
             \App\Commands\DeleteInactiveUsers::class,
-            \App\Commands\RecalculateInvoices::class,
             \App\Commands\SendAbsenteesSummary::class,
             \App\Commands\SendLatesSummary::class,
             \App\Commands\SendMonthlyPaymentNotifications::class,
             \App\Commands\SendTestPaymentNotification::class,
+            \App\Commands\SyncPaypalPayments::class,
             \App\Commands\RecalculateAttendance::class,
         ];
 
@@ -30,4 +30,4 @@ class Commands extends BaseService
             }
         }
     }
-}
+}

app/Config/Events.php

@@ -9,7 +9,6 @@ use App\Listeners\SchoolEventListener;
 use App\Listeners\AttendanceConsequenceListener;
 use App\Listeners\WhatsappInviteListener;
 use App\Listeners\BelowSixtyEmailListener;
-use App\Listeners\DecisionEmailListener;
 
 // Create an instance so we can use $this->emailService like your other handlers
 $waListener = new WhatsappInviteListener(service('emailService'));
@@ -119,7 +118,6 @@ Events::on('attendance.follow_up',   [AttendanceConsequenceListener::class, 'fol
 Events::on('attendance.final_warning', [AttendanceConsequenceListener::class, 'finalWarning']);
 Events::on('attendance.dismissal',   [AttendanceConsequenceListener::class, 'dismissal']);
 Events::on('below60.email', [BelowSixtyEmailListener::class, 'handle']);
-Events::on('below60.decision_email', [DecisionEmailListener::class, 'handle']);
 
 //Whatsapp Event listener
 Events::on('whatsapp_invites.send', [$waListener, 'handle']);

app/Config/Filters.php

@@ -24,8 +24,6 @@ class Filters extends BaseConfig
         'honeypot'          => Honeypot::class,
         'invalidchars'      => InvalidChars::class,
         'secureheaders'     => SecureHeaders::class,
-        'sanitizeinput'     => \App\Filters\SanitizeInputFilter::class,
-        'apiratelimit'      => \App\Filters\ApiRateLimitFilter::class,
         'auth'              => \App\Filters\AuthFilter::class, // Define the alias for your auth filter
         'apiAuth'           => \App\Filters\ApiAuthFilter::class, // JWT-based API authentication
         'cleanupScheduler'  => \App\Filters\CleanupScheduler::class,
@@ -44,9 +42,11 @@ class Filters extends BaseConfig
     public array $globals = [
     'before' => [
         'timezone',
-        'sanitizeinput',
-        'invalidchars',
         'csrf' => ['except' => [
+            // Webhooks / integrations
+            'api/paypal-webhook',
+            'index.php/api/paypal-webhook',
+
             // WhatsApp membership management (legacy allowances retained)
             'whatsapp/update-membership',
             'index.php/whatsapp/update-membership',
@@ -80,7 +80,6 @@ class Filters extends BaseConfig
         ]],
     ],
     'after' => [
-        'secureheaders',
         'toolbar',
         'cleanupScheduler' => ['except' => ['cleanup/*']],
     ],
@@ -113,7 +112,7 @@ class Filters extends BaseConfig
      * @var array<string, array<string, list<string>>>
      */
     public array $filters = [
-        'apiratelimit' => ['before' => ['api/*', 'index.php/api/*']],
+        
     ];
 
 }

app/Config/Format.php

@@ -9,7 +9,6 @@ use CodeIgniter\Format\XMLFormatter;
 
 class Format extends BaseConfig
 {
-    public int $jsonEncodeDepth = 512;
     /**
      * --------------------------------------------------------------------------
      * Available Response Formats

app/Config/PaypalConfig.php

@@ -0,0 +1,13 @@
+<?php
+
+namespace Config;
+
+use CodeIgniter\Config\BaseConfig;
+
+class PaypalConfig extends BaseConfig
+{
+    // PayPal API Credentials
+    public $paypalClientId = 'YOUR_PAYPAL_CLIENT_ID';
+    public $paypalSecret = 'YOUR_PAYPAL_SECRET';
+    public $paypalMode = 'sandbox'; // Change to 'live' when moving to production
+}

app/Config/Routes.php

@@ -174,18 +174,6 @@ $routes->group('administrator/subject-curriculum', ['filter' => 'auth:update_cur
     $routes->post('delete/(:num)', 'View\SubjectCurriculumController::delete/$1');
 });
 
-$routes->get('administrator/trophy',              'View\TrophyController::index',   ['filter' => 'auth:admin']);
-$routes->get('administrator/trophy/winners',      'View\TrophyController::winners', ['filter' => 'auth:admin']);
-$routes->get('administrator/trophy/final',        'View\TrophyController::final',   ['filter' => 'auth:admin']);
-
-// Certificates
-$routes->get('administrator/certificates',           'View\CertificateController::index',    ['filter' => 'auth:admin']);
-$routes->get('administrator/certificates/csrf-token', 'View\CertificateController::csrfToken', ['filter' => 'auth:admin']);
-$routes->post('administrator/certificates/generate', 'View\CertificateController::generate', ['filter' => 'auth:admin']);
-$routes->get('administrator/certificates/log',       'View\CertificateController::auditLog',  ['filter' => 'auth:admin']);
-$routes->get('administrator/certificates/reprint/(:any)', 'View\CertificateController::reprint/$1', ['filter' => 'auth:read']);
-$routes->get('verify/(:segment)',                    'View\CertificateController::verify/$1');
-
 
 
 /*
@@ -257,17 +245,15 @@ $routes->post('administrator/sections/auto-distribute', 'View\StudentController:
 $routes->get('administrator/sections/promotion-totals', 'View\StudentController::promotionTotalsApi');
 
 
-$routes->get('refunds/list', 'View\RefundController::listRefunds', ['filter' => 'auth:view_invoice|view_financial_reports|administrator|administrative staff|principal']);
+$routes->get('refunds/list', 'View\RefundController::listRefunds');
-$routes->post('refunds/request', 'View\RefundController::requestRefund', ['filter' => 'auth:create_invoice|view_financial_reports|administrator|administrative staff|principal,create']);
+$routes->post('refunds/request', 'View\RefundController::requestRefund');
-$routes->post('refunds/approve/(:num)', 'View\RefundController::approveRefund/$1', ['filter' => 'auth:update_invoice|view_financial_reports|administrator|administrative staff|principal,update']);
+$routes->post('refunds/approve/(:num)', 'View\RefundController::approveRefund/$1');
-$routes->post('refunds/pay/(:num)', 'View\RefundController::payRefund/$1', ['filter' => 'auth:update_invoice|view_financial_reports|administrator|administrative staff|principal,update']);
+$routes->post('refunds/pay/(:num)', 'View\RefundController::payRefund/$1');
-$routes->post('refunds/updateStatus/(:num)', 'View\RefundController::updateStatus/$1', ['filter' => 'auth:update_invoice|view_financial_reports|administrator|administrative staff|principal,update']);
+$routes->post('refunds/updateStatus/(:num)', 'View\RefundController::updateStatus/$1');
-$routes->post('refunds/processRefunds', 'View\RefundController::processRefunds', ['filter' => 'auth:update_invoice|view_financial_reports|administrator|administrative staff|principal,update']);
+$routes->post('refunds/processRefunds', 'View\RefundController::processRefunds');
-$routes->post('refunds/updateStatus', 'View\RefundController::updateStatus', ['filter' => 'auth:update_invoice|view_financial_reports|administrator|administrative staff|principal,update']);
+$routes->post('refunds/updateStatus', 'View\RefundController::updateStatus');
-$routes->post('refunds/updatePayment', 'View\RefundController::updatePayment', ['filter' => 'auth:update_invoice|view_financial_reports|administrator|administrative staff|principal,update']);
+$routes->post('refunds/updatePayment', 'View\RefundController::updatePayment');
-$routes->post('refunds/recalculateOverpayments', 'View\RefundController::recalculateOverpayments', ['filter' => 'auth:update_invoice|view_financial_reports|administrator|administrative staff|principal,update']);
+$routes->post('refunds/recalculateOverpayments', 'View\RefundController::recalculateOverpayments');
-$routes->get('refunds/file/(:num)', 'View\RefundController::serveRefundFile/$1', ['filter' => 'auth:view_invoice|view_financial_reports|administrator|administrative staff|principal']);
-$routes->get('refunds/file/(:num)/(:segment)', 'View\RefundController::serveRefundFile/$1/$2', ['filter' => 'auth:view_invoice|view_financial_reports|administrator|administrative staff|principal']);
 
 
 
@@ -525,31 +511,13 @@ $routes->post('grading/below-60/email', 'View\GradingController::sendBelowSixtyE
 $routes->post('grading/below-60/status', 'View\GradingController::updateBelowSixtyStatus', ['filter' => 'auth:read']);
 $routes->get('grading/below-60/schedule', 'View\GradingController::scheduleBelowSixty', ['filter' => 'auth:read']);
 $routes->post('grading/below-60/schedule', 'View\GradingController::saveBelowSixtyMeeting', ['filter' => 'auth:read']);
-$routes->get('grading/decisions', 'View\GradingController::allDecisions', ['filter' => 'auth:read']);
-$routes->post('grading/decisions/generate', 'View\GradingController::generateAllDecisions', ['filter' => 'auth:read']);
-$routes->get('grading/below-60/decisions', 'View\GradingController::belowSixtyDecisions', ['filter' => 'auth:read']);
-$routes->post('grading/below-60/decisions/save', 'View\GradingController::saveBelowSixtyDecision', ['filter' => 'auth:read']);
-$routes->get('grading/below-60/decisions/student-details', 'View\GradingController::studentDecisionDetails', ['filter' => 'auth:read']);
-$routes->get(
-    'grading/below-60/decisions/email/preview',
-    'View\GradingController::previewBelowSixtyDecisionEmail',
-    ['filter' => 'auth:read']
-);
 
-$routes->post(
-    'grading/below-60/decisions/email',
-    'View\GradingController::sendBelowSixtyDecisionEmail',
-    ['filter' => 'auth:read']
-);
 
 // Final part
 $routes->get('grading/(:segment)/(:num)/(:num)', 'View\GradingController::show/$1/$2/$3');
 $routes->post('grading/update', 'View\GradingController::update');
 $routes->get('grading', 'View\GradingController::grading');
 $routes->post('grading/toggle-score-lock', 'View\GradingController::toggleScoreLock', ['filter' => 'auth:read']);
-$routes->get('grading/toggle-score-lock', static function () {
-    return 'GET route hit. Something is calling this route incorrectly.';
-});
 $routes->post('grading/lock-all-scores', 'View\GradingController::lockAllScores', ['filter' => 'auth:read']);
 $routes->post('grading/release-scores', 'View\GradingController::toggleParentScoresRelease', ['filter' => 'auth:read']);
 $routes->post('grading/refresh-semester-scores', 'View\GradingController::refreshSemesterScores', ['filter' => 'auth:read']);
@@ -567,7 +535,6 @@ $routes->post('payment/event_charges', 'View\EventController::eventUpdate');
 
 // Parent event participation
 $routes->get('administrator/event-charges', 'View\EventController::eventShow');
-$routes->get('administrator/event-charges/pdf', 'View\EventController::eventChargesPdf');
 $routes->post('administrator/event-charges/remove/(:num)', 'View\EventController::removeCharge/$1');
 $routes->post('administrator/event-charges/payment/(:num)', 'View\EventController::toggleEventPayment/$1');
 $routes->post('administrator/event-charges/waiver/(:num)', 'View\EventController::toggleWaiverStatus/$1');
@@ -588,19 +555,19 @@ $routes->post('invoices/updateStatus/(:num)', 'View\InvoiceController::updateSta
 // app/Config/Routes.php
 $routes->group('payment', ['filter' => 'auth'], static function ($routes) {
     // Read
-    $routes->get('manual_pay', 'View\PaymentController::manualPaySearch', ['filter' => 'auth:view_invoice|view_payment|view_financial_reports|administrator|administrative staff|principal']);
+    $routes->get('manual_pay', 'View\PaymentController::manualPaySearch', ['filter' => 'auth:read']);
-    $routes->get('manual_pay_suggest', 'View\PaymentController::manualPaySuggest', ['filter' => 'auth:view_invoice|view_payment|view_financial_reports|administrator|administrative staff|principal']);
+    $routes->get('manual_pay_suggest', 'View\PaymentController::manualPaySuggest', ['filter' => 'auth:read']);
 
     // Create
-    $routes->post('manual_pay', 'View\PaymentController::manualPayUpdate', ['filter' => 'auth:create_payment|create_invoice|view_financial_reports|administrator|administrative staff|principal,create']);
+    $routes->post('manual_pay', 'View\PaymentController::manualPayUpdate', ['filter' => 'auth:create']);
 
     // Update
-    $routes->post('manual_pay_edit', 'View\PaymentController::manualPayEdit', ['filter' => 'auth:update_payment|update_invoice|view_financial_reports|administrator|administrative staff|principal,update']);
+    $routes->post('manual_pay_edit', 'View\PaymentController::manualPayEdit', ['filter' => 'auth:update']);
-    $routes->post('manual_pay_update', 'View\PaymentController::manualPayUpdate', ['filter' => 'auth:create_payment|create_invoice|view_financial_reports|administrator|administrative staff|principal,create']);
+    $routes->post('manual_pay_update', 'View\PaymentController::manualPayUpdate', ['filter' => 'auth:update']);
 
     // Read (serve files)
-    $routes->get('file/(:num)/(:segment)', 'View\PaymentController::servePaymentFile/$1/$2', ['filter' => 'auth:view_invoice|view_payment|view_financial_reports|administrator|administrative staff|principal']);
+    $routes->get('serveCheckFile/(:any)/(:any)', 'View\PaymentController::serveCheckFile/$1/$2', ['filter' => 'auth:read']);
-    $routes->get('file/(:num)', 'View\PaymentController::servePaymentFile/$1', ['filter' => 'auth:view_invoice|view_payment|view_financial_reports|administrator|administrative staff|principal']);
+    $routes->get('serveCheckFile/(:any)', 'View\PaymentController::serveCheckFile/$1', ['filter' => 'auth:read']);
 });
 
 
@@ -643,14 +610,9 @@ $routes->group('admin', ['filter' => 'auth'], static function ($routes) {
 $routes->post('admin/broadcast-email/upload-image', 'View\BroadcastEmailController::uploadImage');
 
 
-$routes->get('payment/financial_report', 'View\FinancialController::financialReport', ['filter' => 'auth:view_financial_reports|view_invoice|administrator|administrative staff|principal']);
+$routes->get('payment/financial_report', 'View\FinancialController::financialReport');
-$routes->get('financial-report/financialReportSummary', 'View\FinancialController::financialReportSummary', ['filter' => 'auth:view_financial_reports|view_invoice|administrator|administrative staff|principal']);
+$routes->get('financial-report/financialReportSummary', 'View\FinancialController::financialReportSummary');
-$routes->get('financial-report/downloadSummaryCsv', 'View\FinancialController::downloadSummaryCsv', ['filter' => 'auth:view_financial_reports|view_invoice|administrator|administrative staff|principal']);
+$routes->get('payment/download_csv', 'View\FinancialController::downloadCsv');
-$routes->get('financial-report/downloadSummaryAllDetailsCsv', 'View\FinancialController::downloadSummaryAllDetailsCsv', ['filter' => 'auth:view_financial_reports|view_invoice|administrator|administrative staff|principal']);
-$routes->get('payment/download_csv', 'View\FinancialController::downloadCsv', ['filter' => 'auth:view_financial_reports|view_invoice|administrator|administrative staff|principal']);
-$routes->get('administrator/tuition-forecast', 'View\TuitionForecastController::index', ['filter' => 'auth:view_financial_reports|view_invoice|administrator|administrative staff|principal']);
-$routes->post('administrator/tuition-forecast/calculate', 'View\TuitionForecastController::calculate', ['filter' => 'auth:view_financial_reports|view_invoice|administrator|administrative staff|principal']);
-$routes->get('administrator/tuition-forecast/export', 'View\TuitionForecastController::exportCsv', ['filter' => 'auth:view_financial_reports|view_invoice|administrator|administrative staff|principal']);
 $routes->get('reports/downloadFinancialReport', 'View\FinancialController::downloadFinancialReport');
 // Financial APIs (JSON)
 $routes->get('api/financial/report', 'View\FinancialController::financialReportData', ['filter' => 'auth']);
@@ -661,27 +623,27 @@ $routes->get('payment/unpaid-parents', 'View\FinancialController::unpaidParents'
 $routes->get('api/financial/unpaid-parents', 'View\FinancialController::unpaidParents', ['filter' => 'auth:view_invoice']);
 
 
-$routes->get('expenses/index', 'View\ExpenseController::index', ['filter' => 'auth:view_financial_reports|administrator|administrative staff|principal']);
+$routes->get('expenses/index', 'View\ExpenseController::index');
-$routes->get('expenses/create', 'View\ExpenseController::create', ['filter' => 'auth:view_financial_reports|administrator|administrative staff|principal']);
+$routes->get('expenses/create', 'View\ExpenseController::create');
-$routes->post('expenses/store', 'View\ExpenseController::store', ['filter' => 'auth:view_financial_reports|administrator|administrative staff|principal,create']);
+$routes->post('expenses/store', 'View\ExpenseController::store');
-$routes->post('expenses/updateStatus', 'View\ExpenseController::updateStatus', ['filter' => 'auth:view_financial_reports|administrator|administrative staff|principal,update']);
+$routes->post('expenses/updateStatus', 'View\ExpenseController::updateStatus');
 
-$routes->get('reimbursements/index', 'View\ReimbursementController::index', ['filter' => 'auth:view_financial_reports|administrator|administrative staff|principal']);
+$routes->get('reimbursements/index', 'View\ReimbursementController::index');
-$routes->get('reimbursements/create', 'View\ReimbursementController::create', ['filter' => 'auth:view_financial_reports|administrator|administrative staff|principal']);
+$routes->get('reimbursements/create', 'View\ReimbursementController::create');
-$routes->post('reimbursements/store', 'View\ReimbursementController::store', ['filter' => 'auth:view_financial_reports|administrator|administrative staff|principal,create']);
+$routes->post('reimbursements/store', 'View\ReimbursementController::store');
-$routes->get('reimbursements/under-processing', 'View\ReimbursementController::underProcessing', ['filter' => 'auth:view_financial_reports|administrator|administrative staff|principal']);
+$routes->get('reimbursements/under-processing', 'View\ReimbursementController::underProcessing');
-$routes->post('reimbursements/mark-donation', 'View\ReimbursementController::markDonation', ['filter' => 'auth:view_financial_reports|administrator|administrative staff|principal,update']);
+$routes->post('reimbursements/mark-donation', 'View\ReimbursementController::markDonation');
-$routes->post('reimbursements/batch/create', 'View\ReimbursementController::createBatch', ['filter' => 'auth:view_financial_reports|administrator|administrative staff|principal,create']);
+$routes->post('reimbursements/batch/create', 'View\ReimbursementController::createBatch');
-$routes->post('reimbursements/batch/update', 'View\ReimbursementController::updateBatchAssignment', ['filter' => 'auth:view_financial_reports|administrator|administrative staff|principal,update']);
+$routes->post('reimbursements/batch/update', 'View\ReimbursementController::updateBatchAssignment');
-$routes->post('reimbursements/batch/lock', 'View\ReimbursementController::lockBatch', ['filter' => 'auth:view_financial_reports|administrator|administrative staff|principal,update']);
+$routes->post('reimbursements/batch/lock', 'View\ReimbursementController::lockBatch');
-$routes->post('reimbursements/batch/admin-file/upload', 'View\ReimbursementController::uploadBatchAdminFile', ['filter' => 'auth:view_financial_reports|administrator|administrative staff|principal,update']);
+$routes->post('reimbursements/batch/admin-file/upload', 'View\ReimbursementController::uploadBatchAdminFile');
-$routes->get('reimbursements/batch/admin-file/(:segment)', 'View\ReimbursementController::serveAdminCheckFile/$1', ['filter' => 'auth:view_financial_reports|administrator|administrative staff|principal']);
+$routes->get('reimbursements/batch/admin-file/(:segment)', 'View\ReimbursementController::serveAdminCheckFile/$1');
-$routes->get('reimbursements/batch/admin-file/(:segment)/(:segment)', 'View\ReimbursementController::serveAdminCheckFile/$1/$2', ['filter' => 'auth:view_financial_reports|administrator|administrative staff|principal']);
+$routes->get('reimbursements/batch/admin-file/(:segment)/(:segment)', 'View\ReimbursementController::serveAdminCheckFile/$1/$2');
-$routes->post('reimbursements/batch/send', 'View\ReimbursementController::sendBatchEmail', ['filter' => 'auth:view_financial_reports|administrator|administrative staff|principal,update']);
+$routes->post('reimbursements/batch/send', 'View\ReimbursementController::sendBatchEmail');
-$routes->get('reimbursements/batch/export', 'View\ReimbursementController::exportBatch', ['filter' => 'auth:view_financial_reports|administrator|administrative staff|principal']);
+$routes->get('reimbursements/batch/export', 'View\ReimbursementController::exportBatch');
-$routes->post('reimbursements/process', 'View\ReimbursementController::process', ['filter' => 'auth:view_financial_reports|administrator|administrative staff|principal,update']);
+$routes->post('reimbursements/process', 'View\ReimbursementController::process');
-$routes->get('reimbursements/export', 'View\ReimbursementController::export', ['filter' => 'auth:view_financial_reports|administrator|administrative staff|principal']);
+$routes->get('reimbursements/export', 'View\ReimbursementController::export');
-$routes->get('reimbursements', 'View\ReimbursementController::index', ['filter' => 'auth:view_financial_reports|administrator|administrative staff|principal']);
+$routes->get('reimbursements', 'View\ReimbursementController::index');
 
 // Health check (upload dirs + DB timezone columns)
 $routes->get('admin/health', 'View\HealthController::index');
@@ -748,9 +710,14 @@ $routes->get('payment_transactions/getByPayment/(:num)', 'View\PaymentTransactio
 $routes->get('payment_transactions/create', 'View\PaymentTransactionController::create');
 $routes->post('payment_transactions/updateStatus/(:num)', 'View\PaymentTransactionController::updateStatus/$1');
 
-// Routes for payment pages
+// Routes for PayPal integration
+$routes->get('payments/createPaypalPayment/(:num)', 'View\PaymentController::createPaypalPayment/$1');
+$routes->get('payments/executePaypalPayment', 'View\PaymentController::executePaypalPayment');
+$routes->get('payments/cancelPaypalPayment', 'View\PaymentController::cancelPaypalPayment');
+
 $routes->get('payments/view/(:num)', 'View\PaymentController::viewPayment/$1');
-$routes->get('payment/get_enrolled_students/(:num)', 'View\PaymentController::getEnrolledStudents/$1', ['filter' => 'auth:view_invoice|view_payment|view_financial_reports|administrator|administrative staff|principal']);
+$routes->post('payments/createPaypalPayment/(:num)', 'View\PaymentController::createPaypalPayment/$1');
+$routes->get('payment/get_enrolled_students/(:num)', 'View\PaymentController::getEnrolledStudents/$1');
 
 // Payment Notification Management
 $routes->get('payment/notification_management', 'View\PaymentNotificationController::index', ['filter' => 'auth:view_invoice']);
@@ -970,6 +937,15 @@ $routes->group('inventory', ['filter' => 'csrf'], static function ($routes) {
 $routes->get('admin/enrollment/new-students', 'View\AdministratorController::showNewStudents', ['filter' => 'auth:view_new_students']);
 
 
+//Paypal transactions
+$routes->post('api/paypal-webhook', 'Api\PaypalWebhook::handle');
+$routes->get('administrator/paypal_transactions', 'View\PaypalTransactionsController::index');
+$routes->get('administrator/paypal_transactions/export', 'View\PaypalTransactionsController::exportCsv');
+$routes->get('admin/paypal-transactions', 'View\PaypalTransactionsController::index');
+$routes->get('admin/paypal-transactions/export', 'View\PaypalTransactionsController::exportCsv');
+
+
+
 //Emergency Contact
 $routes->get('administrator/emergency_contact', 'View\EmergencyContactController::index');
 $routes->get('administrator/emergency_contact/edit/(:num)', 'View\EmergencyContactController::edit/$1');
@@ -1048,16 +1024,16 @@ $routes->get('family', 'View\FamilyAdminController::index');
 //////////////////////////////////////////////////////////
 
 //upload files
-$routes->get('receipts/(:any)', 'View\FilesController::receipt/$1', ['filter' => 'auth']);
+$routes->get('receipts/(:any)', 'View\FilesController::receipt/$1');
-$routes->get('reimbreceipts/(:any)', 'View\FilesController::reimb/$1', ['filter' => 'auth']); // serves from writable/uploads/reimbursements
+$routes->get('reimbreceipts/(:any)', 'View\FilesController::reimb/$1'); // serves from writable/uploads/reimbursements
 $routes->get('early-dismissal-signatures/(:any)', 'View\FilesController::earlyDismissalSignature/$1');
 // Expenses
-$routes->get('expenses/edit/(:num)',   'View\ExpenseController::edit/$1', ['filter' => 'auth:view_financial_reports|administrator|administrative staff|principal']);
+$routes->get('expenses/edit/(:num)',   'View\ExpenseController::edit/$1');
-$routes->post('expenses/update/(:num)', 'View\ExpenseController::update/$1', ['filter' => 'auth:view_financial_reports|administrator|administrative staff|principal,update']);
+$routes->post('expenses/update/(:num)', 'View\ExpenseController::update/$1');
 
 // Reimbursements
-$routes->get('reimbursements/edit/(:num)',    'View\ReimbursementController::edit/$1', ['filter' => 'auth:view_financial_reports|administrator|administrative staff|principal']);
+$routes->get('reimbursements/edit/(:num)',    'View\ReimbursementController::edit/$1');
-$routes->post('reimbursements/update/(:num)', 'View\ReimbursementController::update/$1', ['filter' => 'auth:view_financial_reports|administrator|administrative staff|principal,update']);
+$routes->post('reimbursements/update/(:num)', 'View\ReimbursementController::update/$1');
 
 
 
@@ -1202,15 +1178,16 @@ $routes->get('/terms_of_service', 'View\PageController::termsOfService');
 $routes->get('/help_center', 'View\PageController::helpCenter');
 
 //payment
-$routes->get('/payment', 'View\PaymentController::redirectPage', ['filter' => 'auth:parent']);
+$routes->get('/payment', 'View\PaymentController::redirectPage');
+$routes->get('/payment/paypal', 'View\PaymentController::paypal');
 $routes->get('/payment/manual', 'View\PaymentController::manual');
 $routes->post('/payment/manual', 'View\PaymentController::manual');
 
 // Voucher management
-$routes->get('discounts/list', 'View\DiscountController::listVouchers', ['filter' => 'auth:view_invoice|view_financial_reports|administrator|administrative staff|principal']);
+$routes->get('discounts/list', 'View\DiscountController::listVouchers');
-$routes->match(['get', 'post'], 'discount/create', 'View\DiscountController::createVoucher', ['filter' => 'auth:create_invoice|view_financial_reports|administrator|administrative staff|principal,create']);
+$routes->match(['get', 'post'], 'discount/create', 'View\DiscountController::createVoucher');
-$routes->match(['get', 'post'], 'discount/editVoucher/(:num)', 'View\DiscountController::editVoucher/$1', ['filter' => 'auth:update_invoice|view_financial_reports|administrator|administrative staff|principal,update']);
+$routes->match(['get', 'post'], 'discount/editVoucher/(:num)', 'View\DiscountController::editVoucher/$1');
-$routes->match(['get', 'post'], 'discount/apply', 'View\DiscountController::applyVoucher', ['filter' => 'auth:update_invoice|view_financial_reports|administrator|administrative staff|principal,update']);
+$routes->match(['get', 'post'], 'discount/apply', 'View\DiscountController::applyVoucher');
 
 
 
@@ -1554,6 +1531,11 @@ $routes->group('api/v1', ['filter' => 'apiAuth', 'namespace' => 'App\Controllers
     $routes->get('class-preparation/(:num)', 'View\SupportController::show/$1');
     $routes->post('class-preparation/(:num)/mark-printed', 'View\SupportController::markPrinted/$1');
 
+    // PayPal Transactions
+    $routes->get('paypal-transactions', 'View\UserController::index');
+    $routes->get('paypal-transactions/(:num)', 'View\SupportController::show/$1');
+    $routes->get('paypal-transactions/transaction/(:segment)', 'View\SupportController::getByTransactionId/$1');
+
     // Stats
     $routes->get('stats', 'View\UserController::index');
 

app/Config/Services.php

@@ -36,7 +36,7 @@ class Services extends BaseService
     /**
      * Override CI Email service to enforce a global Reply-To.
      */
-    public static function email(?array $config = null, bool $getShared = true)
+    public static function email(array $config = null, bool $getShared = true)
     {
         if ($getShared) {
             return static::getSharedInstance('email', $config);

app/Controllers/AuthController.php

@@ -5,6 +5,7 @@ namespace App\Controllers;
 use App\Models\LoginActivityModel;
 use App\Models\UserModel;
 use App\Models\UserRoleModel;
+use CodeIgniter\Controller;
 use CodeIgniter\Events\Events;
 use App\Models\IpAttemptModel;
 use App\Models\PasswordResetModel;
@@ -18,7 +19,7 @@ require_once APPPATH . 'Helpers/pbkdf2_helper.php';
 require_once APPPATH . 'Helpers/jwt_helper.php';
 
 
-class AuthController extends BaseController
+class AuthController extends Controller
 {
     protected $configModel;
     protected $userModel;
@@ -82,23 +83,9 @@ class AuthController extends BaseController
         log_message('info', 'Processing login form submission.');
         $redirectTo = $this->sanitizeRedirectTarget((string) ($this->request->getPost('redirect_to') ?? $this->request->getGet('redirect_to') ?? ''));
 
-        $validator = \Config\Services::validation();
-        $requestData = sanitize_request_value($this->request->getPost(['email', 'password']));
-        $validator->setRules([
-            'email' => 'required|valid_email|max_length[254]',
-            'password' => 'required|max_length[255]',
-        ]);
-
-        if (! $validator->run($requestData)) {
-            return redirect()
-                ->back()
-                ->with('error', 'Please enter a valid email and password.')
-                ->withInput();
-        }
-
         // Step 1: Get email, password, and IP from the request
-        $email = strtolower((string) $requestData['email']);
+        $email = $this->request->getPost('email');
-        $password = (string) $requestData['password'];
+        $password = $this->request->getPost('password');
         $ip = $this->request->getIPAddress();
 
         log_message('info', 'Login attempt from IP: ' . $ip . ' for email: ' . $email);
@@ -152,29 +139,26 @@ class AuthController extends BaseController
     // JSON API: POST /api/login
     public function apiLogin()
     {
-        $requestData = sanitize_request_value($this->request->getJSON(true) ?: [
+        $requestData = $this->request->getJSON(true);
-            'email' => $this->request->getPost('email'),
+        if (!$requestData) {
-            'password' => $this->request->getPost('password'),
+            // fallback to form vars
-        ]);
+            $requestData = [
-
+                'email' => $this->request->getPost('email'),
-        $validation = \Config\Services::validation();
+                'password' => $this->request->getPost('password'),
-        $validation->setRules([
+            ];
-            'email' => 'required|valid_email|max_length[254]',
-            'password' => 'required|max_length[255]',
-        ]);
-
-        if (! $validation->run($requestData)) {
-            return $this->response->setStatusCode(422)->setJSON([
-                'status' => false,
-                'message' => 'Validation failed.',
-                'errors' => $validation->getErrors(),
-            ]);
         }
 
-        $email = strtolower((string) ($requestData['email'] ?? ''));
+        $email = $requestData['email'] ?? '';
-        $password = (string) ($requestData['password'] ?? '');
+        $password = $requestData['password'] ?? '';
         $ip = $this->request->getIPAddress();
 
+        if (!$email || !$password) {
+            return $this->response->setStatusCode(400)->setJSON([
+                'status' => false,
+                'message' => 'Email and password are required.'
+            ]);
+        }
+
         if ($this->isIpBlocked($ip)) {
             return $this->response->setStatusCode(429)->setJSON([
                 'status' => false,
@@ -236,15 +220,7 @@ class AuthController extends BaseController
             'exp' => $exp,
         ];
 
-        try {
+        $secret = env('JWT_SECRET', 'change-me-in-env');
-            $secret = require_env('JWT_SECRET');
-        } catch (\RuntimeException $e) {
-            return $this->response->setStatusCode(500)->setJSON([
-                'status' => false,
-                'message' => 'JWT configuration is missing.',
-            ]);
-        }
-
         $token = jwt_encode($payload, $secret, 'HS256');
 
         return $this->response->setJSON([
@@ -264,14 +240,18 @@ class AuthController extends BaseController
      */
     public function apiRegister()
     {
-        $requestData = sanitize_request_value($this->request->getJSON(true) ?: $this->request->getPost());
+        $requestData = $this->request->getJSON(true);
+        if (!$requestData) {
+            // fallback to form vars
+            $requestData = $this->request->getPost();
+        }
 
         // Basic validation
         $rules = [
-            'firstname' => "required|regex_match[/^[\\p{L}\\s'\\-]+$/u]|min_length[2]|max_length[30]",
+            'firstname' => 'required|min_length[2]|max_length[30]',
-            'lastname' => "required|regex_match[/^[\\p{L}\\s'\\-]+$/u]|min_length[2]|max_length[30]",
+            'lastname' => 'required|min_length[2]|max_length[30]',
-            'email' => 'required|valid_email|max_length[254]|is_unique[users.email]',
+            'email' => 'required|valid_email|is_unique[users.email]',
-            'password' => 'required|min_length[8]|max_length[255]',
+            'password' => 'required|min_length[8]',
             'cellphone' => 'required|min_length[10]|max_length[20]',
         ];
 
@@ -352,7 +332,7 @@ class AuthController extends BaseController
                 'exp' => $exp,
             ];
 
-            $secret = require_env('JWT_SECRET');
+            $secret = env('JWT_SECRET', 'change-me-in-env');
             $token = jwt_encode($payload, $secret, 'HS256');
 
             return $this->response->setStatusCode(201)->setJSON([

app/Controllers/BaseController.php

@@ -36,7 +36,7 @@ abstract class BaseController extends Controller
      *
      * @var list<string>
      */
-    protected $helpers = ['security'];
+    protected $helpers = [];
 
     /** @var ApiClient */
     protected ApiClient $api;
@@ -73,21 +73,6 @@ abstract class BaseController extends Controller
         // Assuming the user role is stored in the session
         return session()->get('role');
     }
-
-    protected function validated(array $rules, ?array $data = null): array
-    {
-        $validation = service('validation');
-        $payload = $data ?? ($this->request->getJSON(true) ?: $this->request->getPost());
-        $payload = sanitize_request_value($payload);
-
-        $validation->setRules($rules);
-
-        if (! $validation->run($payload)) {
-            throw new \InvalidArgumentException(json_encode($validation->getErrors(), JSON_UNESCAPED_UNICODE | JSON_UNESCAPED_SLASHES) ?: 'Validation failed');
-        }
-
-        return $payload;
-    }
 }
 
-?>
+?>

app/Controllers/ProofreadController.php

@@ -10,13 +10,8 @@ class ProofreadController extends ResourceController
     {
         // Basic per-IP throttling: 10 requests per minute
         $throttler = service('throttler');
-
+        $key = 'proofread-' . $this->request->getIPAddress();
-        // Cache/throttler keys cannot contain reserved characters.
+        if (!$throttler->check($key, 10, MINUTE)) {
-        // Raw IPv6 addresses contain ":", so hash the IP first.
-        $ip = $this->request->getIPAddress();
-        $key = 'proofread-' . hash('sha256', $ip);
-
-        if (! $throttler->check($key, 10, MINUTE)) {
             return $this->respond([
                 'ok' => false,
                 'error' => 'Too many requests. Try again in a minute.',
@@ -25,51 +20,29 @@ class ProofreadController extends ResourceController
         }
 
         // Accept form-urlencoded payload to play nicely with CSRF protection
-        $payload = sanitize_request_value($this->request->getPost(['text']));
+        $text = (string) ($this->request->getPost('text') ?? '');
-
+        if ($text === '' || mb_strlen($text) > 20000) {
-        $validation = service('validation');
-        $validation->setRules([
-            'text' => 'required|min_length[1]|max_length[20000]',
-        ]);
-
-        if (! $validation->run($payload)) {
             return $this->respond([
                 'ok' => false,
-                'error' => 'Invalid text payload.',
+                'error' => 'Invalid text (empty or too long).',
                 'csrfHash' => csrf_hash(),
             ], 422);
         }
 
-        $text = (string) $payload['text'];
+        $client = \Config\Services::curlrequest(['timeout' => 10]);
-
-        $client = \Config\Services::curlrequest([
-            'timeout' => 10,
-        ]);
 
         try {
             $resp = $client->post('https://api.languagetool.org/v2/check', [
-                'headers' => [
+                'headers' => ['Content-Type' => 'application/x-www-form-urlencoded'],
-                    'Content-Type' => 'application/x-www-form-urlencoded',
-                ],
                 'form_params' => [
                     'text'     => $text,
                     'language' => 'en-US',
                 ],
             ]);
 
-            $result = json_decode($resp->getBody(), true);
-
-            if (json_last_error() !== JSON_ERROR_NONE) {
-                return $this->respond([
-                    'ok' => false,
-                    'error' => 'Invalid response from proofread service.',
-                    'csrfHash' => csrf_hash(),
-                ], 502);
-            }
-
             return $this->respond([
                 'ok' => true,
-                'result' => $result,
+                'result' => json_decode($resp->getBody(), true),
                 'csrfHash' => csrf_hash(),
             ]);
         } catch (\Throwable $e) {
@@ -80,4 +53,4 @@ class ProofreadController extends ResourceController
             ], 502);
         }
     }
-}
+}

app/Controllers/View/CertificateController.php

@@ -1,664 +0,0 @@
-<?php
-
-namespace App\Controllers\View;
-
-use App\Controllers\BaseController;
-use App\Models\ClassSectionModel;
-use App\Models\ConfigurationModel;
-use App\Models\CertificateRecordModel;
-
-class CertificateController extends BaseController
-{
-    protected $classSectionModel;
-    protected $configModel;
-    protected $certRecordModel;
-    protected $schoolYear;
-
-    public function __construct()
-    {
-        $this->classSectionModel = new ClassSectionModel();
-        $this->configModel       = new ConfigurationModel();
-        $this->certRecordModel   = new CertificateRecordModel();
-        $this->schoolYear        = $this->configModel->getConfig('school_year');
-    }
-
-    // ─── Admin UI ──────────────────────────────────────────────────────────────
-
-    public function index()
-    {
-        $db           = \Config\Database::connect();
-        $selectedCsid = $this->request->getGet('class_section_id');
-        $schoolYear   = $this->request->getGet('school_year') ?? $this->schoolYear;
-
-        // ── All enrolled students across every class section ───────────────────
-        $allEnrolled = $db->table('student_class sc')
-            ->select('s.id AS student_id, s.firstname, s.lastname, sc.class_section_id, cs.class_section_name')
-            ->join('students s', 's.id = sc.student_id')
-            ->join('classSection cs', 'cs.class_section_id = sc.class_section_id')
-            ->where('s.is_active', 1)
-            ->where('sc.school_year', $schoolYear)
-            ->orderBy('s.firstname', 'ASC')
-            ->orderBy('s.lastname', 'ASC')
-            ->get()
-            ->getResultArray();
-
-        $allIds = array_values(array_unique(array_map('intval', array_column($allEnrolled, 'student_id'))));
-
-        // ── Saved generated YEAR decisions from student_decisions ──────────────
-        //
-        // Source of truth:
-        // student_decisions.year_score
-        // student_decisions.decision
-        //
-        // Do NOT recalculate certificate decisions here from semester_scores.
-        $decisionsByStudent = [];
-
-        if (!empty($allIds)) {
-            $decisionRows = $db->table('student_decisions')
-                ->whereIn('student_id', $allIds)
-                ->where('school_year', $schoolYear)
-                ->get()
-                ->getResultArray();
-
-            foreach ($decisionRows as $d) {
-                $sid = (int)($d['student_id'] ?? 0);
-
-                if ($sid <= 0) {
-                    continue;
-                }
-
-                $decision = trim((string)($d['decision'] ?? ''));
-                $source   = trim((string)($d['source'] ?? ''));
-
-                if ($source === '') {
-                    $source = $decision === '' ? 'pending' : 'manual';
-                }
-
-                $decisionsByStudent[$sid]['Year'] = [
-                    'decision'   => $decision,
-                    'source'     => $source,
-                    'notes'      => (string)($d['notes'] ?? ''),
-                    'year_score' => $d['year_score'] ?? null,
-                ];
-            }
-        }
-
-        // ── Certificate records: most recent per student ───────────────────────
-        $certsByStudent = [];
-
-        if (!empty($allIds)) {
-            foreach ($db->table('certificate_records')
-                ->select('student_id, certificate_number, issued_at')
-                ->whereIn('student_id', $allIds)
-                ->where('school_year', $schoolYear)
-                ->orderBy('issued_at', 'DESC')
-                ->get()
-                ->getResultArray() as $c) {
-                $sid = (int)$c['student_id'];
-
-                if (!isset($certsByStudent[$sid])) {
-                    $certsByStudent[$sid] = $c['certificate_number'];
-                }
-            }
-        }
-
-        // ── Build per-class buckets and stats ──────────────────────────────────
-        $studentsByClass = [];
-        $statsPerClass   = [];
-
-        foreach ($allEnrolled as $row) {
-            $sid  = (int)$row['student_id'];
-            $csid = (int)$row['class_section_id'];
-
-            if (!isset($statsPerClass[$csid])) {
-                $statsPerClass[$csid] = [
-                    'name'  => $row['class_section_name'],
-                    'total' => 0,
-                    'pass'  => 0,
-                    'cert'  => 0,
-                ];
-            }
-
-            $statsPerClass[$csid]['total']++;
-
-            // If no generated decision exists yet, explicitly mark pending.
-            if (!isset($decisionsByStudent[$sid])) {
-                $decisionsByStudent[$sid]['Decision'] = [
-                    'decision'   => '',
-                    'source'     => 'pending',
-                    'notes'      => '',
-                    'year_score' => null,
-                ];
-            }
-
-            // Certificate eligibility:
-            // A student is eligible only if the saved final generated decision is Pass.
-            $studentDecisions = $decisionsByStudent[$sid] ?? [];
-            $isPass           = !empty($studentDecisions);
-
-            foreach ($studentDecisions as $decisionRow) {
-                $decision = trim((string)($decisionRow['decision'] ?? ''));
-
-                if (strcasecmp($decision, 'Pass') !== 0) {
-                    $isPass = false;
-                    break;
-                }
-            }
-
-            if ($isPass) {
-                $statsPerClass[$csid]['pass']++;
-            }
-
-            if (isset($certsByStudent[$sid])) {
-                $statsPerClass[$csid]['cert']++;
-            }
-
-            $studentsByClass[$csid][] = $row;
-        }
-
-        // ── Determine default active tab ───────────────────────────────────────
-        $firstCsid = !empty($allEnrolled) ? (int)$allEnrolled[0]['class_section_id'] : null;
-
-        if ($selectedCsid === null && $firstCsid !== null) {
-            $selectedCsid = (string)$firstCsid;
-        }
-
-        return view('admin/certificates/index', [
-            'studentsByClass'    => $studentsByClass,
-            'selectedClassId'    => $selectedCsid,
-            'schoolYear'         => $schoolYear,
-            'certDate'           => date('m/d/Y'),
-            'decisionsByStudent' => $decisionsByStudent,
-            'certsByStudent'     => $certsByStudent,
-            'statsPerClass'      => $statsPerClass,
-        ]);
-    }
-
-    public function auditLog()
-    {
-        $schoolYear  = $this->request->getGet('school_year') ?? $this->schoolYear;
-        $records     = $this->certRecordModel->getAuditLog($schoolYear);
-        $yearSummary = $this->certRecordModel->yearSummary();
-
-        return view('admin/certificates/audit_log', [
-            'records'     => $records,
-            'schoolYear'  => $schoolYear,
-            'yearSummary' => $yearSummary,
-        ]);
-    }
-
-    public function csrfToken()
-    {
-        return $this->response
-            ->setHeader('Cache-Control', 'no-store, no-cache, must-revalidate, max-age=0')
-            ->setHeader('Pragma', 'no-cache')
-            ->setJSON([
-                'csrf_token' => csrf_token(),
-                'csrf_hash'  => csrf_hash(),
-            ]);
-    }
-
-    // ─── Public verification page ──────────────────────────────────────────────
-
-    public function verify(string $certNumber)
-    {
-        $record = \Config\Database::connect()
-            ->table('certificate_records cr')
-            ->select('cr.*, u.firstname AS admin_firstname, u.lastname AS admin_lastname')
-            ->join('users u', 'u.id = cr.issued_by', 'left')
-            ->groupStart()
-                ->where('cr.verification_token', $certNumber)
-                ->orWhere('cr.certificate_number', strtoupper($certNumber))
-            ->groupEnd()
-            ->get()
-            ->getRowArray();
-
-        return view('certificates/verify', [
-            'record' => $record ?: null,
-        ]);
-    }
-
-    // ─── Reprint an existing certificate ──────────────────────────────────────
-
-    public function reprint(string $certNumber)
-    {
-        $record = \Config\Database::connect()
-            ->table('certificate_records')
-            ->where('certificate_number', strtoupper($certNumber))
-            ->get()
-            ->getRowArray();
-
-        if (!$record) {
-            return redirect()->to('administrator/certificates/log')
-                ->with('error', 'Certificate not found: ' . $certNumber);
-        }
-
-        $certDateFormatted = '';
-
-        if (!empty($record['cert_date'])) {
-            $ts = strtotime((string)$record['cert_date']);
-
-            if ($ts) {
-                $certDateFormatted = date('m/d/Y', $ts);
-            }
-        }
-
-        $student = [
-            'firstname'    => (string)($record['student_name'] ?? ''),
-            'lastname'     => '',
-            'grade'        => (string)($record['grade'] ?? ''),
-            'cert_number'  => (string)($record['certificate_number'] ?? ''),
-            'verify_token' => $this->ensureVerificationTokenForRecord($record),
-        ];
-
-        // student_name is stored as "Firstname Lastname" — split for the PDF builder.
-        $parts = explode(' ', trim($student['firstname']), 2);
-
-        if (count($parts) === 2) {
-            $student['firstname'] = $parts[0];
-            $student['lastname']  = $parts[1];
-        }
-
-        $pdfData  = $this->buildPdf([$student], $certDateFormatted ?: date('m/d/Y'));
-        $filename = 'Certificate_' . strtoupper($certNumber) . '.pdf';
-
-        return $this->response
-            ->setHeader('Content-Type', 'application/pdf')
-            ->setHeader('Content-Disposition', 'inline; filename="' . $filename . '"')
-            ->setBody($pdfData);
-    }
-
-    // ─── PDF generation ────────────────────────────────────────────────────────
-
-    public function generate()
-    {
-        $studentIds     = $this->request->getPost('student_ids') ?? [];
-        $certDate       = trim($this->request->getPost('cert_date') ?? date('m/d/Y'));
-        $classSectionId = $this->request->getPost('class_section_id');
-        $schoolYear     = $this->request->getPost('school_year') ?? $this->schoolYear;
-
-        if (empty($studentIds)) {
-            if ($this->request->isAJAX()) {
-                return $this->response
-                    ->setStatusCode(422)
-                    ->setJSON([
-                        'ok'         => false,
-                        'error'      => 'Please select at least one student.',
-                        'csrf_token' => csrf_token(),
-                        'csrf_hash'  => csrf_hash(),
-                    ]);
-            }
-
-            return redirect()->to('administrator/certificates')
-                ->with('error', 'Please select at least one student.');
-        }
-
-        $studentIds = array_filter(array_map('intval', $studentIds));
-        $certDate   = preg_replace('/[^0-9\/\-]/', '', $certDate);
-
-        if (empty($studentIds)) {
-            if ($this->request->isAJAX()) {
-                return $this->response
-                    ->setStatusCode(422)
-                    ->setJSON([
-                        'ok'         => false,
-                        'error'      => 'Invalid student selection.',
-                        'csrf_token' => csrf_token(),
-                        'csrf_hash'  => csrf_hash(),
-                    ]);
-            }
-
-            return redirect()->to('administrator/certificates')
-                ->with('error', 'Invalid student selection.');
-        }
-
-        $db       = \Config\Database::connect();
-        $students = [];
-
-        foreach ($studentIds as $id) {
-            $row = null;
-
-            if ($classSectionId) {
-                $row = $db->table('student_class sc')
-                    ->select('s.id, s.firstname, s.lastname, cs.class_section_name AS grade')
-                    ->join('students s', 's.id = sc.student_id')
-                    ->join('classSection cs', 'cs.class_section_id = sc.class_section_id')
-                    ->where('sc.class_section_id', (int)$classSectionId)
-                    ->where('sc.school_year', $schoolYear)
-                    ->where('s.id', $id)
-                    ->get()
-                    ->getRowArray();
-            }
-
-            if (!$row) {
-                $s = $db->table('students')
-                    ->select('id, firstname, lastname, registration_grade AS grade')
-                    ->where('id', $id)
-                    ->get()
-                    ->getRowArray();
-
-                $row = $s ?: null;
-            }
-
-            if ($row) {
-                $students[] = $row;
-            }
-        }
-
-        if (empty($students)) {
-            if ($this->request->isAJAX()) {
-                return $this->response
-                    ->setStatusCode(422)
-                    ->setJSON([
-                        'ok'         => false,
-                        'error'      => 'No valid students found.',
-                        'csrf_token' => csrf_token(),
-                        'csrf_hash'  => csrf_hash(),
-                    ]);
-            }
-
-            return redirect()->to('administrator/certificates')
-                ->with('error', 'No valid students found.');
-        }
-
-        $issuedAt = date('Y-m-d H:i:s');
-
-        // Load existing certificates for these students this school year.
-        $existingCerts = $db->table('certificate_records')
-            ->select('id, student_id, certificate_number, verification_token')
-            ->whereIn('student_id', array_column($students, 'id'))
-            ->where('school_year', $schoolYear)
-            ->get()
-            ->getResultArray();
-
-        $existingCertMap = [];
-
-        foreach ($existingCerts as $ec) {
-            $existingCertMap[(int)$ec['student_id']] = $ec;
-        }
-
-        foreach ($students as &$student) {
-            $sid = (int)$student['id'];
-
-            if (isset($existingCertMap[$sid])) {
-                // Reuse existing certificate number — do not create a new record.
-                $existing = $existingCertMap[$sid];
-
-                $student['cert_number']  = (string)($existing['certificate_number'] ?? '');
-                $student['verify_token'] = $this->ensureVerificationTokenForRecord($existing);
-            } else {
-                $certNumber  = $this->certRecordModel->nextNumber($schoolYear);
-                $verifyToken = $this->certRecordModel->generateVerificationToken();
-
-                $this->certRecordModel->insert([
-                    'certificate_number' => $certNumber,
-                    'verification_token' => $verifyToken,
-                    'student_id'         => $sid,
-                    'student_name'       => $student['firstname'] . ' ' . $student['lastname'],
-                    'grade'              => $this->formatGrade($student['grade'] ?? ''),
-                    'school_year'        => $schoolYear,
-                    'class_section_id'   => $classSectionId ?: null,
-                    'issued_at'          => $issuedAt,
-                ]);
-
-                $student['cert_number']  = $certNumber;
-                $student['verify_token'] = $verifyToken;
-            }
-        }
-
-        unset($student);
-
-        $pdfData  = $this->buildPdf($students, $certDate);
-        $filename = 'Certificates_' . date('Ymd_His') . '.pdf';
-
-        return $this->response
-            ->setHeader('Content-Type', 'application/pdf')
-            ->setHeader('Content-Disposition', 'inline; filename="' . $filename . '"')
-            ->setHeader('X-CSRF-TOKEN-NAME', csrf_token())
-            ->setHeader('X-CSRF-TOKEN', csrf_hash())
-            ->setBody($pdfData);
-    }
-
-    // ─── Helpers ───────────────────────────────────────────────────────────────
-
-    private function parseCertDate(string $certDate): ?string
-    {
-        if (preg_match('#^(\d{2})/(\d{2})/(\d{4})$#', $certDate, $m)) {
-            return $m[3] . '-' . $m[1] . '-' . $m[2];
-        }
-
-        if (preg_match('#^\d{4}-\d{2}-\d{2}$#', $certDate)) {
-            return $certDate;
-        }
-
-        return null;
-    }
-
-    private function formatGrade(string $raw): string
-    {
-        $clean = trim($raw);
-        $lower = strtolower($clean);
-
-        // Strip section suffix: "Grade 1-A" → "Grade 1", "Grade 2-B" → "Grade 2".
-        if (preg_match('/^grade\s*(\d+)/i', $clean, $m)) {
-            return 'Grade ' . (int)$m[1];
-        }
-
-        if ($lower === 'youth') {
-            return 'Youth';
-        }
-
-        if ($lower === 'kg' || $lower === 'kindergarten') {
-            return 'Kindergarten';
-        }
-
-        // Raw number or number-section: "1", "1-A", "2-B" → keep number only.
-        if (preg_match('/^(\d+)([- ][A-Za-z0-9]+)?$/', $clean, $m)) {
-            return 'Grade ' . (int)$m[1];
-        }
-
-        return $clean;
-    }
-
-    private function ensureVerificationTokenForRecord(array $record): string
-    {
-        $token = trim((string)($record['verification_token'] ?? ''));
-
-        if ($token !== '') {
-            return $token;
-        }
-
-        $recordId = (int)($record['id'] ?? 0);
-
-        if ($recordId <= 0) {
-            return '';
-        }
-
-        $token = $this->certRecordModel->generateVerificationToken();
-
-        $this->certRecordModel->update($recordId, [
-            'verification_token' => $token,
-        ]);
-
-        return $token;
-    }
-
-    // ─── PDF rendering ─────────────────────────────────────────────────────────
-
-    private function buildPdf(array $students, string $certDate): string
-    {
-        $fontDir = FCPATH . 'assets' . DIRECTORY_SEPARATOR . 'certificates' . DIRECTORY_SEPARATOR . 'fonts' . DIRECTORY_SEPARATOR;
-        $imgDir  = FCPATH . 'assets' . DIRECTORY_SEPARATOR . 'certificates' . DIRECTORY_SEPARATOR . 'images' . DIRECTORY_SEPARATOR;
-
-        $edwardianFont = \TCPDF_FONTS::addTTFfont($fontDir . 'Edwardian Script ITC Regular.ttf', 'TrueTypeUnicode', '', 32);
-        $garamondBold  = \TCPDF_FONTS::addTTFfont($fontDir . 'Garamond Bold.ttf', 'TrueTypeUnicode', '', 32);
-        $ebGaramond    = \TCPDF_FONTS::addTTFfont($fontDir . 'EBGaramond-Regular.ttf', 'TrueTypeUnicode', '', 32);
-
-        $pdf = new \TCPDF('L', 'pt', 'A4', true, 'UTF-8', false);
-
-        $pdf->SetCreator('Al Rahma Sunday School');
-        $pdf->SetTitle('Student Certificates');
-        $pdf->SetMargins(0, 0, 0, true);
-        $pdf->SetAutoPageBreak(false, 0);
-        $pdf->setPrintHeader(false);
-        $pdf->setPrintFooter(false);
-        $pdf->SetHeaderMargin(0);
-        $pdf->SetFooterMargin(0);
-
-        $W = $pdf->getPageWidth();
-        $H = $pdf->getPageHeight();
-
-        foreach ($students as $student) {
-            $pdf->AddPage();
-
-            $name        = trim((string)($student['firstname'] ?? '') . ' ' . (string)($student['lastname'] ?? ''));
-            $grade       = $this->formatGrade($student['grade'] ?? '');
-            $certNumber  = $student['cert_number'] ?? '';
-            $verifyToken = $student['verify_token'] ?? '';
-
-            $verifyUrl = $verifyToken !== ''
-                ? site_url('verify/' . rawurlencode($verifyToken))
-                : null;
-
-            $this->drawCertificate(
-                $pdf,
-                $W,
-                $H,
-                $name,
-                $grade,
-                $certDate,
-                $certNumber,
-                $verifyUrl,
-                $imgDir,
-                $edwardianFont,
-                $garamondBold,
-                $ebGaramond
-            );
-        }
-
-        return $pdf->Output('', 'S');
-    }
-
-    /**
-     * Coordinate mapping: iTextSharp origin bottom-left → TCPDF origin top-left.
-     * y_tcpdf ≈ H − y_iTextSharp
-     */
-    private function drawCertificate(
-        \TCPDF $pdf,
-        float $W,
-        float $H,
-        string $name,
-        string $grade,
-        string $certDate,
-        string $certNumber,
-        ?string $verifyUrl,
-        string $imgDir,
-        string $edwardianFont,
-        string $garamondBold,
-        string $ebGaramond
-    ): void {
-        // ── Images
-        $pdf->Image($imgDir . 'title.png', 126, 0, 600);
-        $pdf->Image($imgDir . 'background.png', 280, 176, 291, 340);
-        $pdf->Image($imgDir . 'signature.png', 140, 410, 90, 80);
-
-        // ── "Presented to:"
-        $pdf->SetFont('times', 'B', 24);
-        $pdf->SetTextColor(0, 0, 0);
-        $pdf->SetXY(0, 151);
-        $pdf->Cell($W, 24, 'Presented to:', 0, 0, 'C');
-
-        // ── QR code — left-aligned with "Presented to:", vertically centred on that line.
-        $qrSize = 42;
-
-        if (!empty($verifyUrl)) {
-            $qrX = 120;
-            $qrY = 171 + (24 - $qrSize) / 2;
-
-            $style = [
-                'border'  => false,
-                'padding' => 0,
-                'fgcolor' => [0, 0, 0],
-                'bgcolor' => false,
-            ];
-
-            $pdf->write2DBarcode($verifyUrl, 'QRCODE,L', $qrX, $qrY, $qrSize, $qrSize, $style, 'N');
-        }
-
-        // ── Student name — center based on actual string width.
-        $pdf->SetFont($edwardianFont, '', 38);
-        $nameX = ($W - $pdf->GetStringWidth($name)) / 2;
-        $this->drawGradientText($pdf, $edwardianFont, 38, $name, $nameX, 221.5);
-
-        // ── Line under name
-        $pdf->SetFont('times', '', 20);
-        $pdf->SetXY(0, 236);
-        $pdf->Cell(600, 20, '___________________________________', 0, 0, 'R');
-
-        // ── Description
-        $pdf->SetFont($ebGaramond, '', 20);
-        $pdf->SetXY(0, 273);
-        $pdf->Cell($W, 20, 'for successfully completing the requirements of', 0, 0, 'C');
-
-        // ── Grade
-        $pdf->SetFont($garamondBold, '', 20);
-        $pdf->SetXY(0, 310);
-        $pdf->Cell($W, 20, $grade, 0, 0, 'C');
-
-        // ── "at"
-        $pdf->SetFont('times', '', 20);
-        $pdf->SetXY(0, 343);
-        $pdf->Cell($W, 20, 'at', 0, 0, 'C');
-
-        // ── School name
-        $pdf->SetFont($garamondBold, '', 20);
-        $pdf->SetXY(0, 375);
-        $pdf->Cell($W, 20, 'Al Rahma Sunday School', 0, 0, 'C');
-
-        // ── Date
-        $this->drawGradientText($pdf, $edwardianFont, 26, $certDate, 586, 456);
-
-        // ── Date underline + label
-        $pdf->SetFont('times', '', 20);
-        $pdf->SetXY(0, 463);
-        $pdf->Cell(742, 20, '_________________', 0, 0, 'R');
-        $pdf->SetXY(650, 492);
-        $pdf->Cell(80, 20, 'Date', 0, 0, 'C');
-
-        // ── Signature underline + label
-        $pdf->SetXY(106, 463);
-        $pdf->Cell(200, 20, '_________________', 0, 0, 'L');
-        $pdf->SetXY(106, 492);
-        $pdf->Cell(168, 20, 'Signature', 0, 0, 'C');
-
-        // ── Certificate number — 1.4 cm from bottom, 2.5 cm from left.
-        if ($certNumber !== '') {
-            $pdf->SetFont('helvetica', '', 8);
-            $pdf->SetTextColor(150, 150, 150);
-            $pdf->SetXY(70.86, $H - 39.68);
-            $pdf->Cell(200, 12, 'Certificate No. ' . $certNumber, 0, 0, 'L');
-            $pdf->SetTextColor(0, 0, 0);
-        }
-    }
-
-    private function drawGradientText(
-        \TCPDF $pdf,
-        string $fontName,
-        float $fontSize,
-        string $text,
-        float $x,
-        float $y
-    ): void {
-        $pdf->SetFont($fontName, '', $fontSize);
-
-        for ($i = 0; $i < 6; $i++) {
-            $pdf->setAlpha(($i + 1) * 25 / 255);
-            $pdf->SetTextColor(0, 0, 0);
-            $pdf->Text($x + $i / 4, $y + $i / 4, $text);
-        }
-
-        $pdf->setAlpha(1);
-        $pdf->SetTextColor(0, 0, 0);
-        $pdf->Text($x, $y, $text);
-    }
-}

app/Controllers/View/ContactController.php

@@ -24,10 +24,10 @@ class ContactController extends BaseController
 
         // Define validation rules
         $validation->setRules([
-            'name' => "required|regex_match[/^[\\p{L}\\s'\\-]+$/u]|min_length[3]|max_length[100]",
+            'name' => 'required|min_length[3]',
-            'email' => 'required|valid_email|max_length[254]',
+            'email' => 'required|valid_email',
-            'subject' => 'required|min_length[3]|max_length[150]',
+            'subject' => 'required|min_length[3]',
-            'message' => 'required|min_length[10]|max_length[5000]'
+            'message' => 'required|min_length[10]'
         ]);
 
         if (!$validation->withRequest($this->request)->run()) {
@@ -37,10 +37,10 @@ class ContactController extends BaseController
         }
 
         // Process form data
-        $name = esc((string) $this->request->getPost('name'));
+        $name = $this->request->getPost('name');
-        $email = esc(strtolower((string) $this->request->getPost('email')));
+        $email = strtolower($this->request->getPost('email'));
-        $subject = esc((string) $this->request->getPost('subject'));
+        $subject = $this->request->getPost('subject');
-        $message = nl2br(esc((string) $this->request->getPost('message')));
+        $message = $this->request->getPost('message');
 
         // Initialize the EmailController
         $emailController = new \App\Controllers\View\EmailController();
@@ -63,4 +63,4 @@ class ContactController extends BaseController
 
         return redirect()->to('/parent/contact');
     }
-}
+}