fix unit tests as well as missing code

app/Http/Controllers/Api/AttendanceTracking/AttendanceTrackingController.php

@@ -60,6 +60,11 @@ class AttendanceTrackingController extends Controller
 
     public function record(Request $request): JsonResponse
     {
+        $guard = $this->forbidLowPrivilegeActor();
+        if ($guard instanceof JsonResponse) {
+            return $guard;
+        }
+
         $validator = Validator::make($request->all(), [
             'student_id' => ['required', 'integer', 'min:1'],
             'date' => ['required', 'date_format:Y-m-d'],
@@ -87,6 +92,11 @@ class AttendanceTrackingController extends Controller
 
     public function sendAutoEmails(Request $request): JsonResponse
     {
+        $guard = $this->forbidLowPrivilegeActor(adminOnly: true);
+        if ($guard instanceof JsonResponse) {
+            return $guard;
+        }
+
         $result = $this->service->sendAutoEmails($request->input('variant'));
 
         return response()->json($result);
@@ -124,6 +134,11 @@ class AttendanceTrackingController extends Controller
 
     public function sendManualEmail(Request $request): JsonResponse
     {
+        $guard = $this->forbidLowPrivilegeActor();
+        if ($guard instanceof JsonResponse) {
+            return $guard;
+        }
+
         $validator = Validator::make($request->all(), [
             'student_id' => ['required', 'integer', 'min:1'],
             'to' => ['required', 'email'],
@@ -173,6 +188,11 @@ class AttendanceTrackingController extends Controller
 
     public function saveNotificationNote(Request $request): JsonResponse
     {
+        $guard = $this->forbidLowPrivilegeActor();
+        if ($guard instanceof JsonResponse) {
+            return $guard;
+        }
+
         $validator = Validator::make($request->all(), [
             'student_id' => ['required', 'integer', 'min:1'],
             'code' => ['required', 'string'],
@@ -197,4 +217,33 @@ class AttendanceTrackingController extends Controller
             $result['status'] ?? 200
         );
     }
+
+    private function forbidLowPrivilegeActor(bool $adminOnly = false): ?JsonResponse
+    {
+        $user = request()->user() ?? auth()->user();
+        if (! $user || ! method_exists($user, 'roles')) {
+            return null;
+        }
+
+        $roles = $user->roles()
+            ->pluck('roles.name')
+            ->map(fn ($role) => strtolower((string) $role))
+            ->all();
+
+        if ($roles === []) {
+            return null;
+        }
+
+        $allowedRoles = $adminOnly
+            ? ['administrator', 'admin', 'principal', 'vice_principal', 'vice-principal']
+            : ['teacher', 'administrator', 'admin', 'principal', 'vice_principal', 'vice-principal'];
+
+        foreach ($allowedRoles as $allowed) {
+            if (in_array($allowed, $roles, true)) {
+                return null;
+            }
+        }
+
+        return response()->json(['message' => 'Forbidden.'], 403);
+    }
 }