fix unit tests as well as missing code

app/Http/Controllers/Api/ClassProgress/ClassProgressController.php

@@ -19,6 +19,7 @@ use App\Services\ClassProgress\ClassProgressMetaService;
 use App\Services\ClassProgress\ClassProgressMutationService;
 use App\Services\ClassProgress\ClassProgressQueryService;
 use Illuminate\Http\JsonResponse;
+use Illuminate\Support\Facades\DB;
 use Illuminate\Support\Facades\Log;
 use Symfony\Component\HttpFoundation\BinaryFileResponse;
 use Symfony\Component\HttpFoundation\Response;
@@ -88,6 +89,10 @@ class ClassProgressController extends BaseApiController
             return $auth;
         }
 
+        if ($this->isLegacyTeacherProgressListRoute($request) && ! $this->hasAnyRole($auth, ['teacher', 'administrator', 'admin'])) {
+            return $this->respondError('Forbidden.', Response::HTTP_FORBIDDEN);
+        }
+
         $filters = $request->validated();
         $meta = $this->queryService->meta($filters['school_year'] ?? null, $filters['semester'] ?? null);
         $filters['school_year'] = $filters['school_year'] ?? ($meta['school_year'] ?? null);
@@ -251,6 +256,27 @@ class ClassProgressController extends BaseApiController
         return $user;
     }
 
+    private function isLegacyTeacherProgressListRoute(ClassProgressIndexRequest $request): bool
+    {
+        return $request->is('api/v1/teacher/class-progress-history')
+            || $request->is('api/v1/teacher/class-progress-view');
+    }
+
+    /**
+     * @param  list<string>  $roles
+     */
+    private function hasAnyRole(User $user, array $roles): bool
+    {
+        $roles = array_map('strtolower', $roles);
+
+        return $user->roles()
+            ->where(function ($query) use ($roles) {
+                $query->whereIn(DB::raw('LOWER(name)'), $roles)
+                    ->orWhereIn(DB::raw('LOWER(slug)'), $roles);
+            })
+            ->exists();
+    }
+
     private function buildMetaPayload(?int $classId, int $sundayCount, ?string $schoolYear = null, ?string $semester = null): array
     {
         $meta = $this->queryService->meta($schoolYear, $semester);