fix api security issues and update pages issue

src/api/grading.ts

@@ -50,6 +50,31 @@ export type GradingSectionScorePayload = {
   missing_ok_map?: Record<string, unknown>
 }
 
+export type AllDecisionRow = {
+  student_id: number
+  school_id?: string | null
+  firstname?: string | null
+  lastname?: string | null
+  gender?: string | null
+  class_section_id?: number | string | null
+  class_section_name?: string | null
+  fall_score?: number | string | null
+  spring_score?: number | string | null
+  year_score?: number | string | null
+  decision?: string | null
+  source?: string | null
+  notes?: string | null
+  saved?: boolean
+  is_trophy?: boolean
+}
+
+export type AllDecisionsPayload = {
+  ok?: boolean
+  rows?: AllDecisionRow[]
+  generated?: boolean
+  school_year?: string
+}
+
 function q(sp: URLSearchParams): string {
   const s = sp.toString()
   return s ? `?${s}` : ''
@@ -123,6 +148,23 @@ export async function fetchBelowSixty(searchParams: URLSearchParams): Promise<un
   return apiFetch(`${BASE}/below-sixty${q(searchParams)}`)
 }
 
+export async function fetchAllDecisions(
+  searchParams: URLSearchParams,
+): Promise<AllDecisionsPayload> {
+  return apiFetch(`${BASE}/decisions${q(searchParams)}`)
+}
+
+export async function postGenerateAllDecisions(body: Record<string, unknown>): Promise<{
+  ok?: boolean
+  saved_count?: number
+}> {
+  return apiFetch(`${BASE}/decisions/generate`, {
+    method: 'POST',
+    headers: { 'Content-Type': 'application/json' },
+    body: JSON.stringify(body),
+  })
+}
+
 export async function fetchBelowSixtyDecisions(
   searchParams: URLSearchParams,
 ): Promise<unknown> {