update api and add more features

app/Services/Parents/ParentEnrollmentService.php

@@ -107,10 +107,34 @@ class ParentEnrollmentService
         $schoolYear = $context['school_year'];
         $semester = $context['semester'];
 
+        // Authorize every submitted student id against this parent up-front to
+        // prevent IDOR — a parent must not be able to enroll or withdraw
+        // another family's students by passing arbitrary ids.
+        $requestedIds = array_values(array_unique(array_map(
+            'intval',
+            array_merge($enrollIds, $withdrawIds)
+        )));
+        $requestedIds = array_values(array_filter($requestedIds, static fn ($id) => $id > 0));
+
+        $ownedIds = $requestedIds === []
+            ? []
+            : Student::query()
+                ->where('parent_id', $parentId)
+                ->whereIn('id', $requestedIds)
+                ->pluck('id')
+                ->map(fn ($id) => (int) $id)
+                ->all();
+        $ownedSet = array_flip($ownedIds);
+
         $enrolled = [];
         $withdrawn = [];
 
         foreach ($enrollIds as $studentId) {
+            $studentId = (int) $studentId;
+            if (! isset($ownedSet[$studentId])) {
+                continue;
+            }
+
             $existing = Enrollment::query()
                 ->where('student_id', $studentId)
                 ->where('school_year', $schoolYear)
@@ -140,12 +164,18 @@ class ParentEnrollmentService
                 ]);
             }
 
-            $enrolled[] = (int) $studentId;
+            $enrolled[] = $studentId;
         }
 
         foreach ($withdrawIds as $studentId) {
+            $studentId = (int) $studentId;
+            if (! isset($ownedSet[$studentId])) {
+                continue;
+            }
+
             $enrollment = Enrollment::query()
                 ->where('student_id', $studentId)
+                ->where('parent_id', $parentId)
                 ->where('school_year', $schoolYear)
                 ->where('semester', $semester)
                 ->where('is_withdrawn', 0)
@@ -195,7 +225,7 @@ class ParentEnrollmentService
                 }
             }
 
-            $withdrawn[] = (int) $studentId;
+            $withdrawn[] = $studentId;
         }
 
         return [