security fix and fix parent pages

2026-07-06 02:14:16 -04:00
parent 39228168c8
commit 90f9857b06
43 changed files with 4323 additions and 132 deletions
@@ -151,6 +151,61 @@ class SchoolYearClosureService
        ];
    }

+    public function closingReport(int $id): array
+    {
+        $year = $this->findOrFail($id);
+        $audit = $this->latestClosureAudit((int) $year->id);
+        $metadata = is_array($audit?->metadata) ? $audit->metadata : [];
+
+        $newYearName = trim((string) ($metadata['new_school_year'] ?? ''));
+        if ($newYearName === '') {
+            $newYearName = $this->resolveClosedTargetYearName($year->name);
+        }
+
+        $newYear = $newYearName !== ''
+            ? SchoolYear::query()->where('name', $newYearName)->first()
+            : null;
+
+        $promotionCounts = is_array($metadata['promotion_counts'] ?? null)
+            ? $metadata['promotion_counts']
+            : [];
+        $balanceCounts = is_array($metadata['balance_counts'] ?? null)
+            ? $metadata['balance_counts']
+            : [];
+        $transferTotals = $this->transferTotalsForClosedYear($year->name, $newYearName !== '' ? $newYearName : null);
+
+        $warnings = [];
+        if (! $audit) {
+            $warnings[] = 'No closure audit log was found for this school year. Totals were reconstructed from current records where possible.';
+        }
+        if ($year->status !== SchoolYear::STATUS_CLOSED) {
+            $warnings[] = sprintf('School year %s is currently %s, so this is a live preview rather than a final closure report.', $year->name, $year->status);
+        }
+        if ($newYearName !== '' && ! $newYear) {
+            $warnings[] = sprintf('The closure target school year %s was referenced but no matching school_years row was found.', $newYearName);
+        }
+
+        return [
+            'old_school_year' => $this->presentSchoolYear($year),
+            'new_school_year' => $this->presentSchoolYear($newYear),
+            'closed_by' => $this->resolveUserName((int) ($year->closed_by ?? $audit?->user_id ?? 0)),
+            'closed_at' => optional($year->closed_at ?? $audit?->created_at)->toDateTimeString(),
+            'audit_reference' => $audit ? sprintf('audit_logs:%d', (int) $audit->id) : null,
+            'totals' => [
+                'students_promoted' => (int) ($promotionCounts['promote'] ?? 0),
+                'students_repeated' => (int) ($promotionCounts['repeat'] ?? 0),
+                'students_graduated' => (int) ($promotionCounts['graduate'] ?? 0),
+                'students_transferred' => (int) ($promotionCounts['transfer'] ?? 0),
+                'students_withdrawn' => (int) ($promotionCounts['withdraw'] ?? 0),
+                'parents_with_unpaid_balances' => (int) ($balanceCounts['transferred_parents'] ?? $transferTotals['parents_with_unpaid_balances']),
+                'total_unpaid_balance_transferred' => round((float) ($balanceCounts['transferred_amount'] ?? $transferTotals['total_unpaid_balance_transferred']), 2),
+                'parents_with_credit_balances' => (int) ($balanceCounts['credit_parents'] ?? $transferTotals['parents_with_credit_balances']),
+                'total_credit_transferred' => round((float) ($balanceCounts['credit_amount'] ?? $transferTotals['total_credit_transferred']), 2),
+            ],
+            'warnings' => $warnings,
+        ];
+    }
+
    public function validateClose(int $id, array $payload): array
    {
        $year = $this->findOrFail($id);
@@ -1016,6 +1071,103 @@ class SchoolYearClosureService
            ->all();
    }

+    private function latestClosureAudit(int $schoolYearId): ?AuditLog
+    {
+        if (! Schema::hasTable('audit_logs')) {
+            return null;
+        }
+
+        return AuditLog::query()
+            ->where('action', 'school_year_closed')
+            ->where(function ($query) use ($schoolYearId) {
+                $query->where('record_id', $schoolYearId)
+                    ->orWhere(function ($nested) use ($schoolYearId) {
+                        $nested->where('table_name', 'school_years')
+                            ->where('record_id', $schoolYearId);
+                    });
+            })
+            ->orderByDesc('created_at')
+            ->orderByDesc('id')
+            ->first();
+    }
+
+    private function resolveClosedTargetYearName(string $fromSchoolYear): string
+    {
+        if (Schema::hasTable('parent_balance_transfers')) {
+            $target = DB::table('parent_balance_transfers')
+                ->where('from_school_year', $fromSchoolYear)
+                ->whereNotNull('to_school_year')
+                ->orderByDesc('created_at')
+                ->value('to_school_year');
+
+            if (is_string($target) && trim($target) !== '') {
+                return trim($target);
+            }
+        }
+
+        return $this->resolver->suggestNextName($fromSchoolYear) ?? '';
+    }
+
+    private function transferTotalsForClosedYear(string $fromSchoolYear, ?string $toSchoolYear = null): array
+    {
+        $totals = [
+            'parents_with_unpaid_balances' => 0,
+            'total_unpaid_balance_transferred' => 0.0,
+            'parents_with_credit_balances' => 0,
+            'total_credit_transferred' => 0.0,
+        ];
+
+        if (! Schema::hasTable('parent_balance_transfers')) {
+            return $totals;
+        }
+
+        $rows = DB::table('parent_balance_transfers')
+            ->where('from_school_year', $fromSchoolYear)
+            ->when($toSchoolYear !== null && trim($toSchoolYear) !== '', fn ($query) => $query->where('to_school_year', $toSchoolYear))
+            ->get(['amount']);
+
+        foreach ($rows as $row) {
+            $amount = round((float) ($row->amount ?? 0), 2);
+            if ($amount > 0.01) {
+                $totals['parents_with_unpaid_balances']++;
+                $totals['total_unpaid_balance_transferred'] += $amount;
+            } elseif ($amount < -0.01) {
+                $totals['parents_with_credit_balances']++;
+                $totals['total_credit_transferred'] += abs($amount);
+            }
+        }
+
+        $totals['total_unpaid_balance_transferred'] = round($totals['total_unpaid_balance_transferred'], 2);
+        $totals['total_credit_transferred'] = round($totals['total_credit_transferred'], 2);
+
+        return $totals;
+    }
+
+    private function resolveUserName(int $userId): string|int|null
+    {
+        if ($userId <= 0) {
+            return null;
+        }
+
+        if (! Schema::hasTable('users')) {
+            return $userId;
+        }
+
+        $user = DB::table('users')->where('id', $userId)->first();
+        if (! $user) {
+            return $userId;
+        }
+
+        $name = trim((string) ($user->firstname ?? '').' '.(string) ($user->lastname ?? ''));
+        if ($name !== '') {
+            return $name;
+        }
+
+        $email = trim((string) ($user->email ?? ''));
+
+        return $email !== '' ? $email : $userId;
+    }
+
    private function presentSchoolYear(?SchoolYear $year): ?array
    {
        if (! $year) {