From 34418c892a9fc1a0069532139e631012a199123a Mon Sep 17 00:00:00 2001
From: Shreya <shreyabalaji123@gmail.com>
Date: Thu, 11 Dec 2025 14:15:39 -0600
Subject: [PATCH] Deleting parents, students + making new parents students
 roles updated

---
 pages/archives/editfaculty.vue       | 249 ++++++++++++++-------------
 pages/edit/editfaculty.vue           | 159 ++++++++---------
 prisma/dev.db                        | Bin 172032 -> 172032 bytes
 server/api/parent/parent.delete.ts   |  26 +--
 server/api/parent/parent.post.ts     |  57 ++++--
 server/api/student/student.delete.ts |  48 ++++--
 server/api/student/student.post.ts   | 103 ++++++-----
 server/api/student/student.put.ts    |  92 +++++-----
 8 files changed, 401 insertions(+), 333 deletions(-)

diff --git a/pages/archives/editfaculty.vue b/pages/archives/editfaculty.vue
index 3a85632..ae40358 100644
--- a/pages/archives/editfaculty.vue
+++ b/pages/archives/editfaculty.vue
@@ -1,123 +1,128 @@
-<template lang = "pug">
-  div(class="text-center")
-      .flex.flex-col.gap-5(class="text-center px-10")
-          TitleDisplay Edit Faculty
-          div(class = "text-center px-10 border-solid border border-gray-700 border-2")
-          div(class="")
-              .py-4.grid(class="" )
-                  Label * First Name:
-                      Input(v-model='data_FacultyProfile.first_name' name="first_name" id="first_name" placeholder="(user defined)" required)
-              .py-4.grid(class="" )
-                  Label * Last Name:
-                      Input(v-model='data_FacultyProfile.last_name' name="last_name" id="last_name" placeholder="(user defined)" required)
-              .py-4.grid(class="" )
-                  Label * School District currently working in: 
-                      Input(v-model='data_FacultyProfile.district' name="district_teach" id="district_teach" placeholder="(Ex: DISD)" required)
-              .py-4.grid(class="" )
-                  Label * Faculty Email:
-                      Input(v-model='data_FacultyProfile.faculty_email' name="faculty_email" id="faculty_email" placeholder="(user defined)" required)
-              .py-4.grid(class="" )
-                  Label * Do you teach a dual language class?
-                      select(v-model="data_FacultyProfile.dual_lang" name="dual_lang" id="dual_lang" class="block w-full rounded-md border border-gray-700 focus:ring-indigo-500"  placeholder = "(Do you Teach a Bilingual Class)")
-                          option(:value="false") Do you Teach a Bilingual Class
-                          option(:value="true") Yes
-                          option(:value="false") No
-              .py-4.grid(class="" )
-                  Label * School Name:
-                      Input(v-model='data_FacultyProfile.school_name' name="school_name" id="school_name" placeholder="(user defined)" required)
-              .py-4.grid(class="" )
-                  Label * Department:
-                      Input(v-model='data_FacultyProfile.department' name="department" id="department" placeholder="(Ex: English, Science, or Math)" required)
-              .py-4.grid(class="" )
-                  Label * Phone number:
-                      Input(v-model='data_FacultyProfile.phone_number' name="phone_number" id="phone_number" placeholder="(Ex: 1234567891)" required)
-              .py-4.grid(class="" )
-                  Label * Grade you teach:
-                      Input(v-model='data_FacultyProfile.grade' name="grade" id="grade" placeholder="(Ex: First, Second, or Pre-K)" required)
-      .flex.flex-col.gap-5(class="border-solid border border-gray-700 border-2")
-      .flex-col.gap-5(class="py-2")
-          Button.mx-auto.text-md(name="Submitt Faculty" @click= "editFaculty(data_FacultyProfile)" class="transition duration-500 bg-blue-500 hover: bg-green-400 rounded-lg px-2 py-2") Apply Edits
-  </template>
-  <style scoped>
-  
-  /*.jost-font {
-    font-family: "Jost", sans-serif;
-    font-optical-sizing: auto;
-    font-weight: 600;
-    font-style: normal;
-  }*/
-  .input {
-    @apply w-full px-4 py-2 border rounded-md;
-  }
-  
-  .select {
-    @apply w-full px-4 py-2 border rounded-md;
-  }
-  
-  .btn {
-    @apply w-full py-2 text-white font-semibold bg-blue-500 hover:bg-blue-700 rounded-md;
-  }
-  </style>
-  
-  <script setup>
-  const rhuser = useCookie('rhuser')
-  const userRole = rhuser.value.role
-  const data_FacultyProfiles = ref(null)
-  var data_FacultyProfile = ref({
-    id: null,
-    district: "",     
-    dual_lang: false, 
-    faculty_email: "",  
-    first_name: "",   
-    last_name: "",    
-    school_name: "",   
-    phone_number: "",  
-    department: "",    
-    grade: "",
+<template lang="pug">
+div(class="text-center")
+    .flex.flex-col.gap-5(class="text-center px-10")
+        TitleDisplay Edit Faculty
+        div(class="text-center px-10 border-solid border border-gray-700 border-2")
+
+        div
+            .py-4.grid
+                Label * First Name:
+                    Input(v-model='data_FacultyProfile.first_name' name="first_name" id="first_name" required)
+
+            .py-4.grid
+                Label * Last Name:
+                    Input(v-model='data_FacultyProfile.last_name' name="last_name" id="last_name" required)
+
+            .py-4.grid
+                Label * School District currently working in:
+                    Input(v-model='data_FacultyProfile.district' name="district_teach" id="district_teach" placeholder="(Ex: DISD)" required)
+
+            .py-4.grid
+                Label * Faculty Email:
+                    Input(v-model='data_FacultyProfile.faculty_email' name="faculty_email" id="faculty_email" required)
+
+            .py-4.grid
+                Label * Do you teach a dual language class?
+                    select(v-model="data_FacultyProfile.dual_lang" name="dual_lang" class="block w-full rounded-md border border-gray-700 focus:ring-indigo-500")
+                        option(:value="false") Do you Teach a Bilingual Class
+                        option(:value="true") Yes
+                        option(:value="false") No
+
+            .py-4.grid
+                Label * School Name:
+                    Input(v-model='data_FacultyProfile.school_name' name="school_name" id="school_name" required)
+
+            .py-4.grid
+                Label * Department:
+                    Input(v-model='data_FacultyProfile.department' name="department" id="department" placeholder="(Ex: English, Science, Math)" required)
+
+            .py-4.grid
+                Label * Phone number:
+                    Input(v-model='data_FacultyProfile.phone_number' name="phone_number" id="phone_number" placeholder="(Ex: 1234567891)" required)
+
+            .py-4.grid
+                Label * Grade you teach:
+                    Input(v-model='data_FacultyProfile.grade' name="grade" id="grade" required)
+
+    .flex.flex-col.gap-5(class="border-solid border border-gray-700 border-2 py-4")
+
+    // ---------------------------------------------------
+    // 🔥 Only Admin OR Faculty can edit — button hidden for Parent/Student
+    // ---------------------------------------------------
+    Button.mx-auto.text-md(
+        v-if="userRole === 'admin' || userRole === 'faculty'"
+        @click="editFaculty(data_FacultyProfile)"
+        class="transition duration-500 bg-blue-500 hover:bg-green-400 rounded-lg px-4 py-2"
+    ) Apply Edits
+</template>
+
+<style scoped>
+.input {
+  @apply w-full px-4 py-2 border rounded-md;
+}
+.select {
+  @apply w-full px-4 py-2 border rounded-md;
+}
+.btn {
+  @apply w-full py-2 text-white font-semibold bg-blue-500 hover:bg-blue-700 rounded-md;
+}
+</style>
+
+<script setup>
+const rhuser = useCookie("rhuser");
+const userRole = rhuser.value?.role; // ⬅ role comes from cookie
+
+const data_FacultyProfiles = ref(null);
+
+var data_FacultyProfile = ref({
+  id: null,
+  district: "",
+  dual_lang: false,
+  faculty_email: "",
+  first_name: "",
+  last_name: "",
+  school_name: "",
+  phone_number: "",
+  department: "",
+  grade: "",
+  user_id: null,
+});
+
+const url = new URL(window.location.href);
+const queryParams = new URLSearchParams(url.search);
+const FacultyProfileId = queryParams.get("id");
+
+async function getFaculty() {
+  const response = await fetch(`/api/faculty/${FacultyProfileId}`);
+  return await response.json();
+}
+
+data_FacultyProfile.value = await getFaculty();
+
+// --------------------------------------------------
+// 🔥 Save Edit (backend permissions already protect)
+// --------------------------------------------------
+async function editFaculty(editedFaculty) {
+  if (!editedFaculty) return;
+
+  const data_FacultyProfile = await $fetch("/api/faculty/faculty", {
+    method: "PUT",
+    body: {
+      id: parseInt(editedFaculty.id),
+      district: editedFaculty.district,
+      dual_lang: editedFaculty.dual_lang,
+      faculty_email: editedFaculty.faculty_email,
+      first_name: editedFaculty.first_name,
+      last_name: editedFaculty.last_name,
+      school_name: editedFaculty.school_name,
+      phone_number: editedFaculty.phone_number,
+      department: editedFaculty.department,
+      grade: editedFaculty.grade,
+      user_id: editedFaculty.user_id,
+    },
   });
-  
-  
-  
-  const url = new URL(window.location.href);
-  const queryParams = new URLSearchParams(url.search);
-  const FacultyProfileId = queryParams.get('id');
-  
-  async function getFaculty() {
-     // Fixed for baseline functionality, horrible example though
-     // useFetch, not fetch
-     const response = await fetch(`/api/faculty/${FacultyProfileId}`)
-     const data = await response.json();
-     return data;
-  }
-  
-  data_FacultyProfile.value = await getFaculty();
-  
-  
-  async function editFaculty(editedFaculty) {
-    console.log("test")
-    let data_FacultyProfile = null
-    console.log(editedFaculty)
-    if(editedFaculty)
-      data_FacultyProfile = await $fetch('/api/faculty/faculty', {
-        method: 'PUT',
-        body: {
-          id: parseInt(editedFaculty.id),
-          district: editedFaculty.district,
-          dual_lang: editedFaculty.dual_lang,
-          faculty_email: editedFaculty.faculty_email,
-          first_name: editedFaculty.first_name,
-          last_name: editedFaculty.last_name,
-          school_name: editedFaculty.school_name,
-          phone_number: editedFaculty.phone_number,
-          department: editedFaculty.department,
-          grade: editedFaculty.grade,
-          user_id: editedFaculty.user_id,
-        }
-      })
-    navigateTo('/viewfaculty')
-    if(data_FacultyProfile)   data_FacultyProfiles.value = await getFaculty()
-  }
-  
-  
-  
-  </script>
\ No newline at end of file
+
+  navigateTo("/viewfaculty");
+  data_FacultyProfiles.value = await getFaculty();
+}
+</script>
diff --git a/pages/edit/editfaculty.vue b/pages/edit/editfaculty.vue
index 9036049..889bbca 100644
--- a/pages/edit/editfaculty.vue
+++ b/pages/edit/editfaculty.vue
@@ -1,52 +1,53 @@
-<template lang = "pug">
+<template lang="pug">
   div(class="content-center")
-      <!-- Submission form for editing faculty profile -->
-      .flex.flex-col.gap-5(class="content-center px-10")
-        h2.text-center.text-3xl.font-bold.mt-6 Edit Faculty Profile
-        hr.rounded.center-text(style="border-top: 7px solid #122C4F; width: 65%; margin: 0 auto; margin-top: 7px")
+    <!-- Submission form for editing faculty profile -->
+    .flex.flex-col.gap-5(class="content-center px-10")
+      h2.text-center.text-3xl.font-bold.mt-6 Edit Faculty Profile
+      hr.rounded.center-text(style="border-top: 7px solid #122C4F; width: 65%; margin: 0 auto; margin-top: 7px")
 
-        <!-- Form fields -->
-        div(class="mt-10 w-3/5 mx-auto grid grid-cols-1 gap-y-8")
-            div(class="")
-                .py-4.grid(class="" )
-                    Label First Name
-                        Input(v-model='faculty.first_name' name="first_name" id="first_name" placeholder="(user defined)" required)
-                .py-4.grid(class="" )
-                    Label Last Name
-                        Input(v-model='faculty.last_name' name="last_name" id="last_name" placeholder="(user defined)" required)
-                .py-4.grid(class="" )
-                    Label School District currently working in
-                        Input(v-model='faculty.district' name="district_teach" id="district_teach" placeholder="(Ex: DISD)" required)
-                .py-4.grid(class="" )
-                    Label Faculty Email
-                        Input(v-model='faculty.faculty_email' name="faculty_email" id="faculty_email" placeholder="(user defined)" required)
-                .py-4.grid(class="" )
-                    Label Do you teach a dual language class?
-                        select(v-model="faculty.dual_lang" name="dual_lang" id="dual_lang" class="block w-full rounded-md border border-gray-700 focus:ring-indigo-500"  placeholder = "(Do you Teach a Bilingual Class)")
-                            option(:value="false") Do you Teach a Bilingual Class
-                            option(:value="true") Yes
-                            option(:value="false") No
-                .py-4.grid(class="" )
-                    Label School Name
-                        Input(v-model='faculty.school_name' name="school_name" id="school_name" placeholder="(user defined)" required)
-                .py-4.grid(class="" )
-                    Label Department
-                        Input(v-model='faculty.department' name="department" id="department" placeholder="(Ex: English, Science, or Math)" required)
-                .py-4.grid(class="" )
-                    Label Phone number
-                        Input(v-model='faculty.phone_number' name="phone_number" id="phone_number" placeholder="(Ex: 1234567891)" required)
-                .py-4.grid(class="" )
-                    Label Grade you teach
-                        Input(v-model='faculty.grade' name="grade" id="grade" placeholder="(Ex: First, Second, or Pre-K)" required)
-      .flex
-           button(type="button" class="rounded mb-4 bg-indigo-600 px-3 py-2 text-lg font-semibold text-white shadow-sm hover:bg-indigo-500 focus-visible:outline focus-visible:outline-2 focus-visible:outline-offset-2 focus-visible:outline-indigo-600 w-60 mx-auto" @click="editFaculty(faculty)") Apply Edits
+      <!-- Form fields -->
+      div(class="mt-10 w-3/5 mx-auto grid grid-cols-1 gap-y-8")
+        div(class="")
+          .py-4.grid(class="" )
+            Label First Name
+            Input(v-model='faculty.first_name' name="first_name" id="first_name" placeholder="(user defined)" required)
+          .py-4.grid(class="" )
+            Label Last Name
+            Input(v-model='faculty.last_name' name="last_name" id="last_name" placeholder="(user defined)" required)
+          .py-4.grid(class="" )
+            Label School District currently working in
+            Input(v-model='faculty.district' name="district_teach" id="district_teach" placeholder="(Ex: DISD)" required)
+          .py-4.grid(class="" )
+            Label Faculty Email
+            Input(v-model='faculty.faculty_email' name="faculty_email" id="faculty_email" placeholder="(user defined)" required)
+          .py-4.grid(class="" )
+            Label Do you teach a dual language class?
+            select(v-model="faculty.dual_lang" name="dual_lang" id="dual_lang" class="block w-full rounded-md border border-gray-700 focus:ring-indigo-500" placeholder = "(Do you Teach a Bilingual Class)")
+              option(:value="false") Do you Teach a Bilingual Class
+              option(:value="true") Yes
+              option(:value="false") No
+          .py-4.grid(class="" )
+            Label School Name
+            Input(v-model='faculty.school_name' name="school_name" id="school_name" placeholder="(user defined)" required)
+          .py-4.grid(class="" )
+            Label Department
+            Input(v-model='faculty.department' name="department" id="department" placeholder="(Ex: English, Science, or Math)" required)
+          .py-4.grid(class="" )
+            Label Phone number
+            Input(v-model='faculty.phone_number' name="phone_number" id="phone_number" placeholder="(Ex: 1234567891)" required)
+          .py-4.grid(class="" )
+            Label Grade you teach
+            Input(v-model='faculty.grade' name="grade" id="grade" placeholder="(Ex: First, Second, or Pre-K)" required)
+    .flex
+      button(type="button" class="rounded mb-4 bg-indigo-600 px-3 py-2 text-lg font-semibold text-white shadow-sm hover:bg-indigo-500 focus-visible:outline focus-visible:outline-2 focus-visible:outline-offset-2 focus-visible:outline-indigo-600 w-60 mx-auto" @click="editFaculty(faculty)") Apply Edits
 </template>
-    
-<script setup lang='ts'>
-import { ref, onMounted } from 'vue';
-const rhuser = useCookie<any>('rhuser')
-const userRole = rhuser.value.role
-const faculties = ref(null)
+
+<script setup lang="ts">
+import { ref, onMounted } from "vue";
+
+const rhuser = useCookie<any>("rhuser");
+const userRole = rhuser.value.role;
+const faculties = ref(null);
 const id = rhuser.value?.id;
 
 interface FacultyProfile {
@@ -64,21 +65,21 @@ interface FacultyProfile {
 
 var faculty = ref<FacultyProfile>({
   id: null,
-  district: "",     
-  dual_lang: false, 
-  faculty_email: "",  
-  first_name: "",   
-  last_name: "",    
-  school_name: "",   
-  phone_number: "",  
-  department: "",    
+  district: "",
+  dual_lang: false,
+  faculty_email: "",
+  first_name: "",
+  last_name: "",
+  school_name: "",
+  phone_number: "",
+  department: "",
   grade: "",
 });
 
-const uri = new URL(window.location.href)
-const facultyId = (new URLSearchParams(uri.search)).get('id');
+const uri = new URL(window.location.href);
+const facultyId = new URLSearchParams(uri.search).get("id");
 
-onMounted(async()=>{
+onMounted(async () => {
   if (facultyId) {
     try {
       const fetchedFaculty = await getFaculty();
@@ -102,13 +103,13 @@ async function getFaculty(): Promise<FacultyProfile> {
 
 const editFaculty = async (editedFaculty: FacultyProfile) => {
   console.log("Edited Faculty Profile", editFaculty);
-  console.log(editedFaculty)
+  console.log(editedFaculty);
   let faculty = null;
-  try{
-    faculty = await $fetch('/api/faculty/faculty', {
-      method: 'PUT',
+  try {
+    faculty = await $fetch("/api/faculty/faculty", {
+      method: "PUT",
       headers: {
-        'Content-Type': 'application/json',
+        "Content-Type": "application/json",
       },
       body: {
         //JSON.stringify(editedFaculty)
@@ -125,22 +126,22 @@ const editFaculty = async (editedFaculty: FacultyProfile) => {
       },
     });
     console.log("Faculty profile edited successfully");
-  }catch(error){
-    console.log('Error editing Faculty profile');
+  } catch (error) {
+    console.log("Error editing Faculty profile");
   }
-  navigateTo('/viewfaculty')
-}
+  navigateTo("/viewfaculty");
+};
 
-const save = async() =>{
-const data = await $fetch<FacultyProfile>('/api/faculty/', {
-  method: 'PUT',
-  body: ({...faculty.value, id: id.value as string})
-}).catch((error)=>{
-  console.log("Error: ",error.data.message);
-});
-console.log(data);
-if (data && (data as any).success){
-  await navigateTo('/parent');
-}
-}
-</script>
\ No newline at end of file
+const save = async () => {
+  const data = await $fetch<FacultyProfile>("/api/faculty/", {
+    method: "PUT",
+    body: { ...faculty.value, id: id.value as string },
+  }).catch((error) => {
+    console.log("Error: ", error.data.message);
+  });
+  console.log(data);
+  if (data && (data as any).success) {
+    await navigateTo("/parent");
+  }
+};
+</script>
diff --git a/prisma/dev.db b/prisma/dev.db
index 33da297d26a8e4c040481abb815485eb1e8ca017..be9d2f55d7e68717b8b30ed486a263a799edb3ec 100644
GIT binary patch
delta 276
zcmZoTz}0YoYl1YR`9v9KR&xfus)CIvi}YD`Gw|=;EU2)apU0KanURA*Sz1)uUVQRl
zdo#hrl-$fbUIqpRCjN&E{NMN=ZWau<$}ca>#H`JjmY7_cQ&JgUP?VpRnUl)O!N@Gm
zSz4T0RJ^HxLx72YBhbv{{NBE-TnwTdhSsXm!ko^Y!7jy#x!H+HiMbBxxrv!Mddc~@
zVTn08sg(*riFwHx3a&Y+xv6<2iA9wrmZrMKrWQbKY3!Ppo|9SJ{3n0=pL|A+18fWe
y3=I4)fsVP)uPDZB$cSku&{iM-Df<mn_MV@Efq{jYlaZBcGvk8)@{2YIKo9__no<k^

delta 262
zcmZoTz}0YoYl1YR@<bVDR%Hggyj>ep7U{F>WZ>VqSx{j;KbI>b2ZOS-sI<NG<fHax
z!fA=gr8y;)ybKHsO#F`+_`mT#+AJ7wjbB8FiCLQyDjQ!=l%JNFle+nvKc4^_BmZ^=
z{_Q~1*7Cc$GjcJAbLy)biwbj^8XKFNLUlN#=O$+6=q2ap`lRM&rz+?wfN2d=3u8?M
zGXq0ia}#4Dg$fe`W8cJ*=0Ew{|Ku}r8~_^qnt}f{&;bwm<wcnFVfG_T;{v*qk^c_^
c{~w^D_xv0{E;BPHC)Z}i1^?w2Z4iJU0N~Y61^@s6

diff --git a/server/api/parent/parent.delete.ts b/server/api/parent/parent.delete.ts
index 1c53c17..2f18cde 100644
--- a/server/api/parent/parent.delete.ts
+++ b/server/api/parent/parent.delete.ts
@@ -1,5 +1,4 @@
 import { PrismaClient } from '@prisma/client';
-import { read } from 'fs'
 const prisma = new PrismaClient();
 
 export default defineEventHandler(async (event) => {
@@ -7,22 +6,27 @@ export default defineEventHandler(async (event) => {
     let parent = null;
     let error = null;
 
-    const {id} = body
+    const { id } = body;
 
     if (id) {
-        // Delete the parent record
-        parent = await prisma.parentProfile.delete({
-            where: {
-                id,
-            },
-        }).catch(async (e) => {
+        // Attempt to delete the parent record
+        try {
+            parent = await prisma.parentProfile.delete({
+                where: {
+                    id,
+                },
+            });
+        } catch (e) {
             error = e;
-        });
+        }
     }
 
-    // Check if an error occurred during the deletion
+    // Check if an error occurred during deletion
     if (error) {
-        return createError({ statusCode: 500, statusMessage: "Server Delete Error" });
+        return createError({
+            statusCode: 500,
+            statusMessage: "Server Delete Error"
+        });
     }
 
     return parent;
diff --git a/server/api/parent/parent.post.ts b/server/api/parent/parent.post.ts
index 2a754b6..7f1f187 100644
--- a/server/api/parent/parent.post.ts
+++ b/server/api/parent/parent.post.ts
@@ -1,17 +1,30 @@
 import { PrismaClient } from '@prisma/client'
 import { PrismaClientKnownRequestError, PrismaClientUnknownRequestError } from '@prisma/client/runtime/library';
-import { read } from 'fs'
+
 const prisma = new PrismaClient();
 
 export default defineEventHandler(async (event) => {
     const body = await readBody(event);
 
-    const {age, grade, birth_date, gender, school_dist, school_name, pref_lang, first_name, last_name, email, reading_lvl, preferred_name} = body
+    const {
+        age,
+        grade,
+        birth_date,
+        gender,
+        school_dist,
+        school_name,
+        pref_lang,
+        first_name,
+        last_name,
+        email,
+        reading_lvl,
+        preferred_name
+    } = body;
 
-    // Check if all required fields are present in the request body
+    // Check if all required fields are present
     if (
         age &&
-        grade &&       
+        grade &&
         reading_lvl &&
         birth_date &&
         gender &&
@@ -20,11 +33,11 @@ export default defineEventHandler(async (event) => {
         pref_lang &&
         first_name &&
         last_name &&
-        preferred_name && 
+        preferred_name &&
         email
     ) {
-        // Create a new student record
         try {
+            // Create new student record
             const studentProfile = await prisma.studentProfile.create({
                 data: {
                     age: parseInt(age),
@@ -38,22 +51,38 @@ export default defineEventHandler(async (event) => {
                     first_name,
                     last_name,
                     preferred_name,
+                    email,
                 },
             });
 
             return {
                 student: studentProfile
-            }
+            };
+
         } catch (error) {
-            if (error instanceof PrismaClientKnownRequestError){
-                console.log('You exeperienced this error code: ' + error.code, error.meta, error.message, ' If you would like to find what this error message means please refer to this link: https://www.prisma.io/docs/orm/reference/error-reference  ')
-            }
-            else if (error instanceof PrismaClientUnknownRequestError){
-                console.log('Unknown error: ' , error.message)
+
+            if (error instanceof PrismaClientKnownRequestError) {
+                console.log(
+                    'You experienced this error code: ' +
+                        error.code,
+                    error.meta,
+                    error.message,
+                    ' See: https://www.prisma.io/docs/orm/reference/error-reference'
+                );
+            } else if (error instanceof PrismaClientUnknownRequestError) {
+                console.log('Unknown error: ', error.message);
             }
-            return createError({ statusCode: 500, statusMessage: "Server Post Error" });
+
+            return createError({
+                statusCode: 500,
+                statusMessage: "Server Post Error"
+            });
         }
+
     } else {
-        return createError({ statusCode: 400, statusMessage: "Bad Request: Missing Required Fields" });
+        return createError({
+            statusCode: 400,
+            statusMessage: "Bad Request: Missing Required Fields"
+        });
     }
 });
diff --git a/server/api/student/student.delete.ts b/server/api/student/student.delete.ts
index 022a6cd..2232ffa 100644
--- a/server/api/student/student.delete.ts
+++ b/server/api/student/student.delete.ts
@@ -1,32 +1,44 @@
 import { PrismaClient } from '@prisma/client';
-import { read } from 'fs'
+import { canEditStudent } from '~/server/utils/permissions';
+
 const prisma = new PrismaClient();
 
 export default defineEventHandler(async (event) => {
     const body = await readBody(event);
-    let student = null;
+    const { id } = body;
+
+    const currentUser = event.context.auth?.user;
     let error = null;
 
-    const {id} = body
+    if (!id) {
+        return createError({ statusCode: 400, statusMessage: "Missing student ID" });
+    }
+
+    // Pull the student (to check permissions)
+    const student = await prisma.studentProfile.findUnique({
+        where: { id }
+    });
 
-    if (id) {
+    if (!student) {
+        return createError({ statusCode: 404, statusMessage: "Student not found" });
+    }
+
+    // Permission check
+    if (!canEditStudent(currentUser, student)) {
+        return createError({ statusCode: 403, statusMessage: "Not authorized to delete student" });
+    }
 
-            // Delete the student record
-            student = await prisma.studentProfile.delete({
-                where: {
-                    id,
-                },
-            }).then((response) => {
-                student = response
-              }).catch(async (e) =>{
-                error = e
-              })
+    // Delete student
+    try {
+        const deleted = await prisma.studentProfile.delete({
+            where: { id },
+        });
+        return deleted;
+    } catch (e) {
+        error = e;
     }
 
-    // Check if an error occurred during the deletion
     if (error) {
         return createError({ statusCode: 500, statusMessage: "Server Delete Error" });
     }
-
-    return student;
-});
\ No newline at end of file
+});
diff --git a/server/api/student/student.post.ts b/server/api/student/student.post.ts
index 559de94..ce67172 100644
--- a/server/api/student/student.post.ts
+++ b/server/api/student/student.post.ts
@@ -1,58 +1,67 @@
-import { PrismaClient } from '@prisma/client'
+import { PrismaClient } from '@prisma/client';
 import { PrismaClientKnownRequestError, PrismaClientUnknownRequestError } from '@prisma/client/runtime/library';
-import { read } from 'fs'
+import { canEditStudent } from '~/server/utils/permissions';
+
 const prisma = new PrismaClient();
 
 export default defineEventHandler(async (event) => {
     const body = await readBody(event);
+    const currentUser = event.context.auth?.user;
 
-    const {age, grade, reading_lvl, birth_date, gender, school_dist, school_name, pref_lang, first_name, last_name, pref_name} = body
+    const {
+        age, grade, reading_lvl, birth_date, gender,
+        school_dist, school_name, pref_lang,
+        first_name, last_name, pref_name
+    } = body;
 
-    // Check if all required fields are present in the request body
     if (
-        age &&
-        grade &&
-        reading_lvl &&
-        birth_date &&
-        gender &&
-        school_name &&
-        school_dist &&
-        pref_lang &&
-        first_name &&
-        last_name &&
-        pref_name
+        !age || !grade || !reading_lvl || !birth_date || !gender ||
+        !school_name || !school_dist || !pref_lang ||
+        !first_name || !last_name || !pref_name
     ) {
-        // Create a new student record
-        try {
-            const studentProfile = await prisma.studentProfile.create({
-                data: {
-                    age: parseInt(age),
-                    grade: parseInt(grade),
-                    reading_lvl: parseInt(reading_lvl),
-                    birth_date,
-                    gender,
-                    school_name,
-                    school_dist,
-                    pref_lang,
-                    first_name,
-                    last_name,
-                    pref_name,
-                },
-            });
-
-            return {
-                student: studentProfile
-            }
-        } catch (error) {
-            if (error instanceof PrismaClientKnownRequestError){
-                console.log('You exeperienced this error code: ' + error.code, error.meta, error.message, ' If you would like to find what this error message means please refer to this link: https://www.prisma.io/docs/orm/reference/error-reference  ')
-            }
-            else if (error instanceof PrismaClientUnknownRequestError){
-                console.log('Unknown error: ' , error.message)
-            }
-            return createError({ statusCode: 500, statusMessage: "Server Post Error" });
-        }
-    } else {
         return createError({ statusCode: 400, statusMessage: "Bad Request: Missing Required Fields" });
     }
-});
\ No newline at end of file
+
+    // Only admin or parent can create a student
+    if (!currentUser || (currentUser.role !== "admin" && currentUser.role !== "parent")) {
+        return createError({ statusCode: 403, statusMessage: "Not authorized to create student" });
+    }
+
+    try {
+        const studentProfile = await prisma.studentProfile.create({
+            data: {
+                age: parseInt(age),
+                grade: parseInt(grade),
+                reading_lvl: parseInt(reading_lvl),
+                birth_date,
+                gender,
+                school_name,
+                school_dist,
+                pref_lang,
+                first_name,
+                last_name,
+                preferred_name: pref_name,
+                parent_id: currentUser.role === "parent" ? currentUser.id : null
+            },
+        });
+
+        return { student: studentProfile };
+
+    } catch (error) {
+        if (error instanceof PrismaClientKnownRequestError) {
+            console.log(
+                "Known error:",
+                error.code,
+                error.meta,
+                error.message
+            );
+        } else if (error instanceof PrismaClientUnknownRequestError) {
+            console.log("Unknown error:", error.message);
+        }
+
+        return createError({
+            statusCode: 500,
+            statusMessage: "Server Post Error",
+        });
+    }
+});
diff --git a/server/api/student/student.put.ts b/server/api/student/student.put.ts
index 8ab31dd..bb754ae 100644
--- a/server/api/student/student.put.ts
+++ b/server/api/student/student.put.ts
@@ -1,58 +1,66 @@
 import { PrismaClient } from '@prisma/client';
 import { PrismaClientKnownRequestError, PrismaClientUnknownRequestError } from '@prisma/client/runtime/library';
+import { canEditStudent } from '~/server/utils/permissions';
 
 const prisma = new PrismaClient();
 
 export default defineEventHandler(async (event) => {
     const body = await readBody(event);
+    const currentUser = event.context.auth?.user;
 
-    const {id, age, grade, reading_lvl, birth_date, gender, school_name, school_dist, pref_lang, first_name, last_name} = body
+    const {
+        id, age, grade, reading_lvl, birth_date, gender,
+        school_name, school_dist, pref_lang, first_name, last_name
+    } = body;
 
     const pref_name = body.preferred_name;
 
-    // Check for missing data
-    if (!(id && age && grade && reading_lvl && first_name && last_name && school_name && school_dist && pref_lang && first_name && last_name && pref_name)) {
+    // Validate required fields
+    if (!(id && age && grade && reading_lvl && first_name && last_name &&
+        school_name && school_dist && pref_lang && pref_name)) {
         return createError({ statusCode: 400, statusMessage: "Missing Data" });
     }
 
-    let student = null;
-
-    // Check if ID is provided
-    if (id) {
-        try {
-            // Update existing student record
-            student = await prisma.studentProfile.update({
-                where: {
-                    id
-                },
-                data: {
-                    Student: {
-                        update: {
-                            first_name,
-                            last_name,
-                            preferred_name: pref_name
-                        }
-                    },
-                    age,
-                    grade,
-                    reading_lvl,
-                    birth_date,
-                    gender,
-                    school_name,
-                    school_dist,
-                    pref_lang,
-                },
-            });
-        } catch (error) {
-            if (error instanceof PrismaClientKnownRequestError){
-                console.log('You exeperienced this error code: ' + error.code, error.meta, error.message, ' If you would like to find what this error message means please refer to this link: https://www.prisma.io/docs/orm/reference/error-reference  ')
-            }
-            else if (error instanceof PrismaClientUnknownRequestError){
-                console.log('Unknown error: ' , error.message)
-            }
-            throw createError({ statusCode: 500, statusMessage: "Error updating student" });
-        }
+    // Fetch student for permission check
+    const studentRecord = await prisma.studentProfile.findUnique({
+        where: { id }
+    });
+
+    if (!studentRecord) {
+        return createError({ statusCode: 404, statusMessage: "Student not found" });
+    }
+
+    // Permission check
+    if (!canEditStudent(currentUser, studentRecord)) {
+        return createError({ statusCode: 403, statusMessage: "Not authorized to update student" });
     }
 
-    return student;
-});
\ No newline at end of file
+    try {
+        const updated = await prisma.studentProfile.update({
+            where: { id },
+            data: {
+                age,
+                grade,
+                reading_lvl,
+                birth_date,
+                gender,
+                school_name,
+                school_dist,
+                pref_lang,
+                first_name,
+                last_name,
+                preferred_name: pref_name,
+            },
+        });
+
+        return updated;
+
+    } catch (error) {
+        if (error instanceof PrismaClientKnownRequestError) {
+            console.log("Known error:", error.code, error.meta, error.message);
+        } else if (error instanceof PrismaClientUnknownRequestError) {
+            console.log("Unknown error:", error.message);
+        }
+        throw createError({ statusCode: 500, statusMessage: "Error updating student" });
+    }
+});