Manage Classes & Rosters

Create a class

POST /api/classes with { schoolId, name, grade, academicYear } (needs MANAGE_SCHOOLS). grade is 1–4; academicYear matches ^\d{4}-\d{4}$.

curl -X POST https://localhost:3000/api/classes \
  -H "Authorization: Bearer <accessToken>" \
  -H "Content-Type: application/json" \
  -d '{
    "schoolId": "clx4z2k0u0000xyz1234abcde",
    "name": "صف ثاني — أ",
    "grade": 2,
    "academicYear": "2026-2027"
  }'

List and read

• GET /api/classes: classes in your scope (a teacher sees their ClassTeacher classes; a manager sees their scoped schools’ classes).
• GET /api/classes/{id}: one class.

Assign a teacher (the ClassTeacher junction)

A class has no teacher FK. Teachers attach through the ClassTeacher junction, with a role:

curl -X POST https://localhost:3000/api/classes/{classId}/teachers \
  -H "Authorization: Bearer <accessToken>" \
  -H "Content-Type: application/json" \
  -d '{ "teacherUserId": 1, "role": "PRIMARY" }'

role is PRIMARY (default), SECONDARY, or SUPPORT. The call returns 201 ClassTeacherRowResponse; assigning an already-assigned teacher returns 409. Remove an assignment with DELETE /api/classes/{classId}/teachers/{teacherUserId} (a soft unassign).

List a class’s teachers and students

• GET /api/classes/{classId}/teachers → ClassTeacherListResponse.
• GET /api/classes/{classId}/students → StudentListResponse.

Enrollment model

Students are wired to classes through the ClassStudent junction. A student is in one active instance of a class at a time; historical rows are retained.

Regenerate a student’s quickCode

POST /api/students/{id}/quickcode/regen issues a new 3-digit code for the student’s class login. Codes regenerate on a 90-day window. The student-side login flow itself lives in Authentication → Student quickCode login.

Delete a class

DELETE /api/classes/{id}. A class that still has students returns 409; remove or reassign the roster first.