Add 4 files, update 15 files

src/app/api/communication-rooms/[id]/route.ts

@@ -124,6 +124,9 @@ export async function PUT(
         if (role !== 'SCHOOL_ADMIN' && role !== 'VICE_PRINCIPAL' && role !== 'SUPER_ADMIN') {
           return NextResponse.json({ error: 'Forbidden' }, { status: 403 });
         }
+        if (role !== 'SUPER_ADMIN' && room.schoolId !== session.user?.schoolId) {
+          return NextResponse.json({ error: 'Forbidden' }, { status: 403 });
+        }
       }
 
       const updated = await db.communicationRoom.update({
@@ -192,10 +195,14 @@ export async function DELETE(
 
     const role = session.user?.role;
 
-    // Only admin can delete rooms
-    if (role !== 'SUPER_ADMIN' && role !== 'SCHOOL_ADMIN' && role !== 'VICE_PRINCIPAL') {
+    // Only school administrators can delete rooms. Vice principals may manage
+    // operational states but must not remove communication records.
+    if (role !== 'SUPER_ADMIN' && role !== 'SCHOOL_ADMIN') {
       return NextResponse.json({ error: 'Only admins can delete rooms' }, { status: 403 });
     }
+    if (role !== 'SUPER_ADMIN' && room.schoolId !== session.user?.schoolId) {
+      return NextResponse.json({ error: 'Forbidden' }, { status: 403 });
+    }
 
     await db.communicationMessage.deleteMany({ where: { roomId: id } });
     await db.communicationRoomMember.deleteMany({ where: { roomId: id } });

src/app/api/communication-rooms/route.ts

@@ -138,19 +138,27 @@ export async function POST(request: Request) {
       return NextResponse.json({ error: 'Teachers should use staff communication channels' }, { status: 400 });
     }
 
-    // Find the student's class and the responsible teacher
+    // Student direct messages target their own profile. Parent direct messages
+    // must explicitly name one linked child.
+    const requestedStudentId = body.studentId as string | undefined;
+    if (role === 'PARENT' && !requestedStudentId) {
+      return NextResponse.json({ error: 'studentId is required for parent conversations' }, { status: 400 });
+    }
+    const studentWhere = role === 'PARENT'
+      ? { id: requestedStudentId, parentStudentLinks: { some: { parentId: userId } } }
+      : {
+          OR: [
+            { userId },
+            {
+              userId: null,
+              firstName: session.user?.firstName,
+              lastName: session.user?.lastName,
+              schoolId: session.user?.schoolId,
+            },
+          ],
+        };
     const student = await db.student.findFirst({
-      where: {
-        OR: [
-          { userId },
-          {
-            userId: null,
-            firstName: session.user?.firstName,
-            lastName: session.user?.lastName,
-            schoolId: session.user?.schoolId,
-          },
-        ],
-      },
+      where: studentWhere,
       include: {
         enrollments: {
           where: { endDate: null },
@@ -183,7 +191,7 @@ export async function POST(request: Request) {
     // Check if there's already an active/requested room
     const existingRoom = await db.communicationRoom.findFirst({
       where: {
-        studentId: userId,
+        studentId: role === 'PARENT' ? student.userId ?? userId : userId,
         teacherId: teacher.id,
         status: { in: ['requested', 'active'] },
       },
@@ -196,7 +204,7 @@ export async function POST(request: Request) {
     const room = await db.communicationRoom.create({
       data: {
         schoolId: student.schoolId,
-        studentId: userId,
+        studentId: role === 'PARENT' ? student.userId ?? userId : userId,
         teacherId: teacher.id,
         roomType: 'chat',
         status: 'requested',