VidyaSetu ERP — Changes Log

Date: 24 August 2026
Scope: Stability, auth, attendance, student panel, demo credentials

This file lists every meaningful change made while reviewing and hardening the school ERP.

1. Critical bugs fixed

Issue	What was wrong	Fix
Student portal missing	Routes pointed to `StudentDashboardController`, but the class and views did not exist. Student login always crashed.	Built a full student panel (login, dashboard, monthly attendance, logout).
Super Admin was open	`/admin/dashboard` and all admin pages had no login middleware. Anyone with the URL could open HQ.	Added `admin.auth` middleware. Unauthenticated users now redirect to `/admin/login`.
Teacher attendance URL broken	Route was registered as `/admin/admin/attendance/teachers` (double prefix). Sidebar highlighted the wrong path.	Correct path is now `/admin/attendance/teachers`.
`/school/login` crashed	Route called `showLoginForm()`, which did not exist.	Added `showLoginForm()` alias to the school auth controller.
Duplicate auth controller	Extra `app/Http/Controllers/SchoolAuthController.php` used the wrong namespace.	Removed the dead file. Live controller is `app/Http/Controllers/School/SchoolAuthController.php`.
Unmarked = Present	Student/teacher registers treated empty rows as Present. Saving the page marked everyone Present.	Unmarked stays Unmarked. Present is saved only when explicitly selected.
Attendance save mismatches	`updateOrInsert` with `subject_id = null` could create duplicate rows and skip school/class checks.	Shared `AttendanceRecorder` helper now verifies student + class + school, then updates or inserts cleanly.
Global school-status middleware	`CheckSchoolStatus` ran on every request and could flush Super Admin sessions.	Replaced with role-specific middleware: `admin.auth`, `school.auth`, `teacher.auth`, `student.auth`.
School logout wiped HQ	`session()->flush()` also logged Super Admin out after “Login as school”.	School logout now clears only school keys. Impersonation returns to the admin dashboard.
Login tab ignored	Unified login always opened the School tab, even with `?tab=teacher` or `?tab=student`.	Alpine now respects the `tab` query string.
Future dates allowed	Attendance date pickers allowed tomorrow.	Date fields are capped at today; save also rejects future dates.

2. Attendance improvements

Teacher and School Admin now write to the same attendances table, so registers stay in sync.
Students see the same day’s status and a monthly P/A/L calendar on their portal.
Teacher self punch still works: Present is auto-approved; Leave / Half-Day / Absent go to Principal for approval.
School Admin can still override staff status; every override is written to Staff Change Logs.
Admin HQ teacher attendance link actually opens (it did not before).
Admin student/teacher registers show Unmarked instead of a fake Present badge.
Subject/period dropdown now auto-reloads the register.
New students/admissions get demo password 123456 unless a custom password is supplied.

3. Auth & access control

New middleware:

app/Http/Middleware/EnsureAdmin.php
app/Http/Middleware/EnsureSchool.php
app/Http/Middleware/EnsureTeacher.php
app/Http/Middleware/EnsureStudent.php

Registered in bootstrap/app.php.

Protected now:

All Super Admin pages except /admin/login
All School Admin pages except /school/login
Teacher dashboard / punch / class attendance
Student dashboard

Inactive school, inactive teacher, or inactive student is blocked at login and on every request.

4. Student panel (new)

Created:

app/Http/Controllers/Student/StudentDashboardController.php
resources/views/student/layouts/app.blade.php
resources/views/student/layouts/sidebar.blade.php
resources/views/student/layouts/header.blade.php
resources/views/student/dashboard.blade.php

5. Other module hardening

Teacher email must be unique on create/update.
Subjects views now receive school_logo so the school sidebar does not break.
Class and subject inserts write timestamps.
Admin login form posts to admin.login.submit.
SVG stroke-width typo on admin CSV export icon fixed.
School sidebar now has Staff Change Logs.

6. Demo credentials reset

Hashed passwords in the database were unknown (no readable copy for most users). For the meeting demo they were reset to known values:

Role	Password
Super Admin	`admin123`
Every school admin	`School@123`
Every teacher	`123456`
Every student	`123456`

School plain_password column was updated to School@123 so HQ “School Passwords & Logins” shows the live demo password.

Full URL + credential list: open http://127.0.0.1:8000/demo-guide (or /demo).

Changes log in the browser: http://127.0.0.1:8000/changes (or /changelog).

Partner hub: http://127.0.0.1:8000/review.

7. Files added / updated

Added

app/Http/Middleware/EnsureAdmin.php
app/Http/Middleware/EnsureSchool.php
app/Http/Middleware/EnsureTeacher.php
app/Http/Middleware/EnsureStudent.php
app/Helpers/AttendanceRecorder.php
app/Http/Controllers/Student/StudentDashboardController.php
resources/views/student/**
app/Http/Controllers/ReviewController.php
resources/views/frontend/review/**
Public pages: /review, /changes, /demo-guide
CHANGES.md
DEMO_GUIDE.md

Updated

routes/web.php
bootstrap/app.php
School / Teacher / Admin attendance controllers and views
School auth, teacher panel, student/admission store
School sidebar, unified login, admin login

Removed

app/Http/Controllers/SchoolAuthController.php (duplicate / dead file)

What We Fixed