security fix and fix parent pages

src/api/printables.ts

@@ -25,15 +25,23 @@ export async function fetchStickerFormOptions(params?: {
   if (params?.school_year) qs.set('school_year', params.school_year)
   if (params?.semester) qs.set('semester', params.semester)
   const suffix = qs.toString() ? `?${qs}` : ''
-  return apiFetch(`/api/v1/administrator/printables/stickers/form-options${suffix}`)
+  const body = await apiFetch<{
+    ok?: boolean
+    data?: { classes?: ClassOption[]; students?: StudentOption[] }
+    classes?: ClassOption[]
+    students?: StudentOption[]
+  }>(`/api/v1/reports/stickers/form-data${suffix}`)
+  return body.data ?? body
 }
 
 export async function fetchStudentsByClass(classId: number | string): Promise<StudentOption[]> {
-  const body = await apiFetch<{ students?: StudentOption[] } | StudentOption[]>(
-    `/api/v1/administrator/students/by-class/${encodeURIComponent(String(classId))}`,
-  )
-  if (Array.isArray(body)) return body
-  return body.students ?? []
+  const qs = new URLSearchParams({ class_section_id: String(classId) })
+  const body = await apiFetch<{
+    ok?: boolean
+    data?: { students?: StudentOption[] }
+    students?: StudentOption[]
+  }>(`/api/v1/reports/stickers/students?${qs}`)
+  return body.data?.students ?? body.students ?? []
 }
 
 export async function postStickerGenerate(formData: FormData): Promise<Blob> {
@@ -41,7 +49,7 @@ export async function postStickerGenerate(formData: FormData): Promise<Blob> {
   const token = getStoredToken()
   if (token) headers.set('Authorization', `Bearer ${token}`)
   applyStoredSchoolYearHeaders(headers)
-  const res = await fetch(apiUrl('/api/v1/administrator/printables/stickers/generate'), {
+  const res = await fetch(apiUrl('/api/v1/reports/stickers/print'), {
     method: 'POST',
     headers,
     body: formData,
@@ -91,7 +99,7 @@ export async function fetchStickerPreviewCounts(classId?: number | string | null
   const suffix = qs.toString() ? `?${qs}` : ''
   const body = await apiFetch<
     StickerPreviewCounts & { status?: string; data?: StickerPreviewCounts }
-  >(`/api/v1/administrator/printables/stickers/preview${suffix}`)
+  >(`/api/v1/reports/stickers/preview${suffix}`)
   if (body.data) return body.data
   return body
 }
@@ -172,7 +180,8 @@ export async function fetchReportCardMeta(params?: {
   if (params?.school_year) qs.set('school_year', params.school_year)
   if (params?.semester) qs.set('semester', params.semester)
   const suffix = qs.toString() ? `?${qs}` : ''
-  return apiFetch(`/api/v1/administrator/printables/report-card/meta${suffix}`)
+  const body = await apiFetch<ReportCardMeta & { data?: ReportCardMeta }>(`/api/v1/administrator/printables/report-card/meta${suffix}`)
+  return body.data ?? body
 }
 
 export async function fetchReportCardAck(params: {
@@ -184,9 +193,11 @@ export async function fetchReportCardAck(params: {
   qs.set('student_id', String(params.student_id))
   if (params.school_year) qs.set('school_year', params.school_year)
   if (params.semester) qs.set('semester', params.semester ?? '')
-  return apiFetch(`/api/v1/administrator/printables/report-card/ack?${qs}`)
+  const body = await apiFetch<{ data?: { viewed_at?: string; signed_at?: string; signed_name?: string }; viewed_at?: string; signed_at?: string; signed_name?: string }>(`/api/v1/administrator/printables/report-card/ack?${qs}`)
+  return body.data ?? body
 }
 
+
 export async function fetchReportCardCompleteness(params: {
   class_section_id: number | string
   school_year?: string
@@ -201,9 +212,16 @@ export async function fetchReportCardCompleteness(params: {
   qs.set('class_section_id', String(params.class_section_id))
   if (params.school_year) qs.set('school_year', params.school_year ?? '')
   if (params.semester) qs.set('semester', params.semester ?? '')
-  return apiFetch(`/api/v1/administrator/printables/report-card/completeness?${qs}`)
+  const body = await apiFetch<{
+    data?: { students?: Array<Record<string, unknown>>; summary?: Record<string, unknown>; used_fallback?: boolean }
+    students?: Array<Record<string, unknown>>
+    summary?: Record<string, unknown>
+    used_fallback?: boolean
+  }>(`/api/v1/administrator/printables/report-card/completeness?${qs}`)
+  return body.data ?? body
 }
 
+
 /** Build absolute API URL for iframe / window.open (report PDF HTML). */
 export function reportCardStudentUrl(
   studentId: number | string,