security fix and fix parent pages

app/Services/Parents/ParentProgressQueryService.php

@@ -9,6 +9,7 @@ use App\Services\ClassProgress\ClassProgressQueryService;
 use Carbon\CarbonInterface;
 use Illuminate\Support\Collection;
 use Illuminate\Support\Facades\DB;
+use Illuminate\Support\Facades\Schema;
 
 /**
  * legacy {@see ParentProgressController} read-side logic.
@@ -101,24 +102,104 @@ class ParentProgressQueryService
      *
      * @param  list<int>  $sectionIds
      */
-    public function reportsForSections(array $sectionIds): Collection
+    public function reportsForSections(array $sectionIds, ?string $schoolYear = null, ?string $semester = null): Collection
     {
         $sectionIds = array_values(array_filter(array_map('intval', $sectionIds)));
         if ($sectionIds === []) {
             return collect();
         }
 
-        return ClassProgressReport::query()
+        $attachmentMap = [];
+        $query = ClassProgressReport::query()
             ->select('class_progress_reports.*')
             ->addSelect([
                 'cs.class_section_name',
-                DB::raw('CONCAT(IFNULL(u.firstname, ""), " ", IFNULL(u.lastname, "")) AS teacher_name'),
+                'u.firstname as teacher_firstname',
+                'u.lastname as teacher_lastname',
             ])
             ->leftJoin('classSection as cs', 'cs.class_section_id', '=', 'class_progress_reports.class_section_id')
             ->leftJoin('users as u', 'u.id', '=', 'class_progress_reports.teacher_id')
-            ->whereIn('class_progress_reports.class_section_id', $sectionIds)
-            ->orderByDesc('class_progress_reports.week_start')
-            ->get();
+            ->whereIn('class_progress_reports.class_section_id', $sectionIds);
+
+        $schoolYear = trim((string) $schoolYear);
+        if ($schoolYear !== '' && Schema::hasColumn('class_progress_reports', 'school_year')) {
+            $schoolYearRange = $this->schoolYearDateRange($schoolYear);
+            $query->where(function ($yearQuery) use ($schoolYear, $schoolYearRange) {
+                $yearQuery->where('class_progress_reports.school_year', $schoolYear)
+                    ->orWhere(function ($legacyQuery) use ($schoolYear, $schoolYearRange) {
+                        $legacyQuery->where(function ($blankQuery) {
+                            $blankQuery->whereNull('class_progress_reports.school_year')
+                                ->orWhere('class_progress_reports.school_year', '');
+                        });
+
+                        if ($schoolYearRange !== null) {
+                            $legacyQuery->whereBetween('class_progress_reports.week_start', [
+                                $schoolYearRange['start'],
+                                $schoolYearRange['end'],
+                            ]);
+                        } else {
+                            $legacyQuery->where('cs.school_year', $schoolYear);
+                        }
+                    });
+            });
+        }
+
+        $semester = trim((string) $semester);
+        if ($semester !== '' && Schema::hasColumn('class_progress_reports', 'semester')) {
+            $query->where(function ($semesterQuery) use ($semester) {
+                $semesterQuery->where('class_progress_reports.semester', $semester)
+                    ->orWhere(function ($legacyQuery) use ($semester) {
+                        $legacyQuery->where(function ($blankQuery) {
+                            $blankQuery->whereNull('class_progress_reports.semester')
+                                ->orWhere('class_progress_reports.semester', '');
+                        })->where('cs.semester', $semester);
+                    });
+            });
+        }
+
+        $rows = $query->orderByDesc('class_progress_reports.week_start')->get();
+        $attachmentMap = $this->classProgressQuery->attachmentMap($rows->pluck('id')->all());
+
+        return $rows
+            ->each(function (ClassProgressReport $row) use ($attachmentMap) {
+                $row->setAttribute('teacher_name', trim((string) ($row->teacher_firstname ?? '').' '.(string) ($row->teacher_lastname ?? '')));
+                $row->setAttribute('attachments', $attachmentMap[$row->id] ?? []);
+            });
+    }
+
+    /**
+     * @return array{start:string,end:string}|null
+     */
+    private function schoolYearDateRange(string $schoolYear): ?array
+    {
+        $schoolYear = trim($schoolYear);
+        if ($schoolYear === '') {
+            return null;
+        }
+
+        if (Schema::hasTable('school_years')) {
+            try {
+                $row = DB::table('school_years')
+                    ->where('name', $schoolYear)
+                    ->first(['start_date', 'end_date']);
+                if ($row && $row->start_date && $row->end_date) {
+                    return [
+                        'start' => substr((string) $row->start_date, 0, 10),
+                        'end' => substr((string) $row->end_date, 0, 10),
+                    ];
+                }
+            } catch (\Throwable) {
+            }
+        }
+
+        if (preg_match('/^(\d{4})-(\d{4})$/', $schoolYear, $matches) === 1) {
+            return [
+                'start' => $matches[1].'-08-01',
+                'end' => $matches[2].'-07-31',
+            ];
+        }
+
+        return null;
     }
 
     /**
@@ -146,7 +227,12 @@ class ParentProgressQueryService
 
             $key = $weekStart.':'.$sectionId;
             if (! isset($reportGroups[$key])) {
+                $reportId = (int) $row->id;
                 $reportGroups[$key] = [
+                    'id' => $reportId,
+                    'report_id' => $reportId,
+                    'view_url' => url('/api/v1/class-progress/'.$reportId),
+                    'parent_view_url' => url('/api/v1/parents/progress/'.$reportId),
                     'week_start' => $weekStart,
                     'week_end' => $row->week_end instanceof CarbonInterface
                         ? $row->week_end->format('Y-m-d')
@@ -154,6 +240,10 @@ class ParentProgressQueryService
                     'class_section_name' => $row->class_section_name ?? '',
                     'class_section_id' => $sectionId,
                     'reports' => [],
+                    'weekly_reports' => [],
+                    'reports_array' => [],
+                    'report_list' => [],
+                    'subjects' => [],
                 ];
             }
 
@@ -162,7 +252,12 @@ class ParentProgressQueryService
                 continue;
             }
 
-            $reportGroups[$key]['reports'][$subject] = (new ClassProgressReportResource($row))->toArray(request());
+            $report = (new ClassProgressReportResource($row))->toArray(request());
+            $reportGroups[$key]['reports'][$subject] = $report;
+            $reportGroups[$key]['weekly_reports'][] = $report;
+            $reportGroups[$key]['reports_array'][] = $report;
+            $reportGroups[$key]['report_list'][] = $report;
+            $reportGroups[$key]['subjects'][] = $subject;
         }
 
         return $reportGroups;
@@ -175,13 +270,21 @@ class ParentProgressQueryService
      */
     public function weeklyReportsForSectionWeek(int $classSectionId, string $weekStartYmd): array
     {
-        return ClassProgressReport::query()
+        $rows = ClassProgressReport::query()
             ->with(['classSection', 'teacher'])
             ->where('class_section_id', $classSectionId)
             ->whereDate('week_start', $weekStartYmd)
             ->orderBy('subject')
             ->get()
             ->all();
+
+        $attachments = $this->attachmentMapForReportIds(array_map(fn (ClassProgressReport $row) => (int) $row->id, $rows));
+
+        foreach ($rows as $row) {
+            $row->setAttribute('attachments', $attachments[$row->id] ?? []);
+        }
+
+        return $rows;
     }
 
     /**