security fix and fix parent pages

app/Http/Controllers/Api/Parents/ParentController.php

@@ -13,17 +13,23 @@ use App\Http\Requests\Parents\ParentProfileUpdateRequest;
 use App\Http\Requests\Parents\ParentRegistrationRequest;
 use App\Http\Requests\Parents\ParentStudentUpdateRequest;
 use App\Http\Resources\Invoices\InvoiceResource;
+use App\Http\Resources\ClassProgress\ClassProgressShowResource;
 use App\Http\Resources\Parents\ParentAttendanceResource;
 use App\Http\Resources\Parents\ParentEmergencyContactResource;
 use App\Http\Resources\Parents\ParentStudentResource;
+use App\Models\ClassProgressReport;
 use App\Services\Parents\ParentAttendanceService;
 use App\Services\Parents\ParentEmergencyContactService;
 use App\Services\Parents\ParentEnrollmentService;
 use App\Services\Parents\ParentEventParticipationService;
+use App\Services\Parents\ParentProgressQueryService;
 use App\Services\Parents\ParentInvoiceService;
 use App\Services\Parents\ParentProfileService;
 use App\Services\Parents\ParentRegistrationService;
+use App\Services\SchoolYears\SchoolYearContextService;
 use Illuminate\Http\JsonResponse;
+use Illuminate\Http\Request;
+use Illuminate\Support\Facades\Gate;
 
 class ParentController extends BaseApiController
 {
@@ -34,7 +40,9 @@ class ParentController extends BaseApiController
         private ParentRegistrationService $registrationService,
         private ParentEmergencyContactService $emergencyContactService,
         private ParentProfileService $profileService,
-        private ParentEventParticipationService $eventService
+        private ParentEventParticipationService $eventService,
+        private ParentProgressQueryService $progressService,
+        private SchoolYearContextService $schoolYears
     ) {
         parent::__construct();
     }
@@ -92,6 +100,62 @@ class ParentController extends BaseApiController
         ]);
     }
 
+    public function progress(Request $request): JsonResponse
+    {
+        $guard = $this->parentIdOrUnauthorized();
+        if ($guard instanceof JsonResponse) {
+            return $guard;
+        }
+
+        $schoolYear = $this->schoolYears->currentSchoolYear($request->query('school_year'));
+        $semester = $request->query->has('semester')
+            ? $this->schoolYears->currentSemester($request->query('semester'))
+            : null;
+        $sectionIds = $this->progressService->parentSectionIds($guard);
+        $reports = $this->progressService->reportsForSections($sectionIds, $schoolYear, $semester);
+        $groups = array_values($this->progressService->groupReportsByWeek($reports));
+
+        return response()->json([
+            'ok' => true,
+            'data' => [
+                'items' => $groups,
+                'groups' => $groups,
+                'students' => $this->progressService->parentStudents($guard),
+                'meta' => $this->schoolYears->options($schoolYear, $semester),
+            ],
+        ]);
+    }
+
+    public function progressDetail(Request $request, ClassProgressReport $class_progress): JsonResponse
+    {
+        $guard = $this->parentIdOrUnauthorized();
+        if ($guard instanceof JsonResponse) {
+            return $guard;
+        }
+
+        if (Gate::denies('view', $class_progress)) {
+            return response()->json(['ok' => false, 'status' => false, 'message' => 'Forbidden.'], 403);
+        }
+
+        $weekStart = $class_progress->week_start?->format('Y-m-d') ?? '';
+        $weeklyReports = $this->progressService->weeklyReportsForSectionWeek(
+            (int) $class_progress->class_section_id,
+            $weekStart
+        );
+
+        $data = (new ClassProgressShowResource([
+            'report' => $class_progress,
+            'weekly_reports' => $weeklyReports,
+            'status_options' => config('progress.status_options', []),
+        ]))->toArray($request);
+
+        return response()->json([
+            'ok' => true,
+            'status' => true,
+            'data' => $data,
+        ]);
+    }
+
     public function updateEnrollments(ParentEnrollmentActionRequest $request): JsonResponse
     {
         $guard = $this->parentIdOrUnauthorized();