update api and add more features

app/Services/Parents/ParentEventParticipationService.php

@@ -5,6 +5,7 @@ namespace App\Services\Parents;
 use App\Models\Event;
 use App\Models\EventCharges;
 use App\Models\Enrollment;
+use App\Models\Student;
 use App\Services\Invoices\InvoiceGenerationService;
 
 class ParentEventParticipationService
@@ -48,15 +49,61 @@ class ParentEventParticipationService
         $schoolYear = $context['school_year'];
         $semester = $context['semester'];
 
+        // First pass: parse + validate every `student_id:event_id` key and
+        // collect the student ids that this parent actually owns. This stops
+        // a parent from creating or deleting charges on another family's
+        // students by manipulating the participation keys.
+        $parsed = [];
+        $candidateStudentIds = [];
         foreach ($participations as $key => $value) {
-            [$studentId, $eventId] = array_map('intval', explode(':', (string) $key));
+            $parts = explode(':', (string) $key, 2);
+            if (count($parts) !== 2 || ! ctype_digit($parts[0]) || ! ctype_digit($parts[1])) {
+                continue;
+            }
+
+            $studentId = (int) $parts[0];
+            $eventId = (int) $parts[1];
+            if ($studentId <= 0 || $eventId <= 0) {
+                continue;
+            }
+
+            $normalized = strtolower(trim((string) $value));
+            if (! in_array($normalized, ['yes', 'no'], true)) {
+                continue;
+            }
+
+            $parsed[] = [
+                'student_id' => $studentId,
+                'event_id' => $eventId,
+                'value' => $normalized,
+            ];
+            $candidateStudentIds[$studentId] = true;
+        }
+
+        if ($parsed === []) {
+            return;
+        }
+
+        $ownedIds = Student::query()
+            ->where('parent_id', $parentId)
+            ->whereIn('id', array_keys($candidateStudentIds))
+            ->pluck('id')
+            ->map(fn ($id) => (int) $id)
+            ->all();
+        $ownedSet = array_flip($ownedIds);
+
+        foreach ($parsed as $row) {
+            if (! isset($ownedSet[$row['student_id']])) {
+                continue;
+            }
+
             $existing = EventCharges::query()
                 ->where('parent_id', $parentId)
-                ->where('student_id', $studentId)
-                ->where('event_id', $eventId)
+                ->where('student_id', $row['student_id'])
+                ->where('event_id', $row['event_id'])
                 ->first();
 
-            if ($value === 'no') {
+            if ($row['value'] === 'no') {
                 if ($existing) {
                     $existing->delete();
                 }
@@ -64,14 +111,14 @@ class ParentEventParticipationService
             }
 
             if ($existing) {
-                $existing->update(['participation' => $value]);
+                $existing->update(['participation' => $row['value']]);
             } else {
-                $event = Event::getEvent($eventId, $schoolYear);
+                $event = Event::getEvent($row['event_id'], $schoolYear);
                 EventCharges::query()->create([
                     'parent_id' => $parentId,
-                    'student_id' => $studentId,
-                    'event_id' => $eventId,
-                    'participation' => $value,
+                    'student_id' => $row['student_id'],
+                    'event_id' => $row['event_id'],
+                    'participation' => $row['value'],
                     'charged' => $event['amount'] ?? 0,
                     'school_year' => $schoolYear,
                     'semester' => $semester,