Changelog

This documentation corresponds to CSMS v0.3.2.

v0.3.2 (Current)

External Open API (v1): added /api/v1/** endpoints physically isolated from internal APIs, letting third parties CRUD school / grade / class business data via api_token.
Credential system: added api_tokens / api_audit_logs to the main DB and api_idempotency to per-school DBs; tokens stored as sha256 hashes, plaintext visible only once at issuance.
Scope + permission control: credentials bind a "school / grade / class" scope + 12 fine-grained permissions (2 dangerous perms off by default); writes strictly limited to scope; issuance scope forced to not exceed the issuer's own scope.
Three iron rules: system data not operable externally; writes limited to school-level and below; every request must carry api_token.
Write idempotency: Idempotency-Key header prevents duplicate score adds / account creation on retry (concurrent conflict returns 409).
Token rate limiting: 600/min total + 120/min writes, returns 429 + Retry-After when exceeded.
Full call audit: every v1 call (including auth failures / rate limits) written to api_audit_logs with X-Request-Id, retained 30 days.
Credential management UI: /admin/api-tokens to issue / edit / disable / revoke credentials and view call logs; issue and revoke both require re-authentication.
Added the external Open API integration doc (see ).

Admin auth enhancements: email + password login, email code login, forgot password (email code) recovery.
New super-admin "User Management" module: centrally manage all admin accounts and the cross-school student list.
Admin affiliation (school / grade / class) is editable, options constrained by management level (super_admin none; school_admin school only; grade_admin school+grade; class_admin school+grade+class).
Student side supports email binding and email code password recovery.
DB files live under data/ (main DB data/csms.db); .gitignore ignores *.db / *.sqlite and other runtime files.
School list shows school ID; onboarding application has real-time school-name validation (debounced duplicate check, red hint, disabled submit / code button, re-validated on submit).
Duplicate-school check relaxed: deleted / rejected schools don't count as duplicates, re-application allowed.
Approved-then-deleted schools are marked with a yellow "deleted" tag on the application page; deleted schools still show the original school ID (new deleted_school_id snapshot column).
Approval email includes school ID (added schoolId variable to mail template).
Application "Contact" column shows two lines: phone on top, email below (missing shows -).
Email notification system: onboarding result emails, editable mail templates (variable placeholders), mail service config (SMTP / Resend).

A complete rebuild of CSMS, moving from the legacy PHP + jQuery stack to a modern Nuxt full-stack framework: