security fix and fix parent pages

app/Http/Controllers/Api/Messaging/WhatsappController.php

@@ -37,11 +37,67 @@ class WhatsappController extends BaseApiController
 
     public function index(WhatsappLinkIndexRequest $request): JsonResponse
     {
-        $links = $this->linkService->paginate($request->validated());
+        $payload = $request->validated();
+        $schoolYear = $this->context->schoolYear($payload['school_year'] ?? null);
+        $semester = array_key_exists('semester', $payload)
+            ? (string) ($payload['semester'] ?? '')
+            : $this->context->semester();
+
+        $payload['school_year'] = $schoolYear;
+        $payload['semester'] = $semester;
+        $payload['per_page'] = max((int) ($payload['per_page'] ?? 200), 200);
+
+        $links = $this->linkService->paginate($payload);
         $collection = new WhatsappGroupLinkCollection($links);
+        $linkRows = $collection->toArray($request);
+
+        $sectionsRaw = $this->contactService->listParentContactsByClass($schoolYear, $semester);
+        $sections = WhatsappClassSectionContactResource::collection($sectionsRaw)->resolve($request);
+
+        $linksBySection = [];
+        foreach ($linkRows as $link) {
+            $sid = (int) ($link['class_section_id'] ?? 0);
+            if ($sid > 0) {
+                $linksBySection[(string) $sid] = $link;
+            }
+        }
+
+        $parents = [];
+        foreach ($sections as $section) {
+            foreach (($section['parents'] ?? []) as $parent) {
+                $primaryId = (int) ($parent['primary_id'] ?? 0);
+                if ($primaryId > 0 && ! isset($parents['primary:'.$primaryId])) {
+                    [$lastname, $firstname] = $this->splitDisplayName((string) ($parent['primary_name'] ?? ''));
+                    $parents['primary:'.$primaryId] = [
+                        'id' => $primaryId,
+                        'firstname' => $firstname,
+                        'lastname' => $lastname,
+                        'email' => (string) ($parent['primary_email'] ?? ''),
+                        'source' => 'primary',
+                    ];
+                }
+
+                $secondId = (int) ($parent['second_id'] ?? 0);
+                if ($secondId > 0 && ! isset($parents['second:'.$secondId])) {
+                    [$lastname, $firstname] = $this->splitDisplayName((string) ($parent['second_name'] ?? ''));
+                    $parents['second:'.$secondId] = [
+                        'id' => $secondId,
+                        'firstname' => $firstname,
+                        'lastname' => $lastname,
+                        'email' => (string) ($parent['second_email'] ?? ''),
+                        'source' => 'parents',
+                    ];
+                }
+            }
+        }
 
         return $this->success([
-            'links' => $collection->toArray($request),
+            'schoolYear' => $schoolYear,
+            'semester' => $semester,
+            'links' => $linkRows,
+            'linksBySection' => $linksBySection,
+            'sections' => $sections,
+            'parents' => array_values($parents),
             'meta' => $collection->with($request)['meta'],
         ]);
     }
@@ -93,6 +149,8 @@ class WhatsappController extends BaseApiController
         $contacts = $this->contactService->listParentContacts($schoolYear, $semester);
 
         return $this->success([
+            'schoolYear' => $schoolYear,
+            'semester' => $semester,
             'contacts' => WhatsappParentContactResource::collection($contacts),
         ]);
     }
@@ -160,6 +218,21 @@ class WhatsappController extends BaseApiController
         ], 'Membership saved.');
     }
 
+    private function splitDisplayName(string $name): array
+    {
+        $name = trim($name);
+        if ($name === '') {
+            return ['', ''];
+        }
+
+        if (str_contains($name, ',')) {
+            [$last, $first] = array_pad(array_map('trim', explode(',', $name, 2)), 2, '');
+            return [$last, $first];
+        }
+
+        return [$name, ''];
+    }
+
     private function authenticatedUserIdOrUnauthorized(): int|JsonResponse
     {
         $userId = (int) (auth()->id() ?? 0);