Features

This chapter introduces CSMS's core features and how to use them, organized by module.

Score Management

The core of CSMS is real-time management of student conduct scores (comprehensive evaluation).

Adjustments: class admins can add/deduct scores for students, with a reason field.
Templates: preset common score items (e.g. "Excellent homework +2", "Late -1") applied with one click for consistent criteria.
Revoke / Correct: mistaken score records can be revoked; all changes are traced.
Audit: every score change records operator, time, before/after values and reason, viewable in statistics.

Score logs and templates are stored in the per-school DB (score_logs, score_templates tables). Admin endpoints: .

Drag-and-drop class seating layout editor with customizable rows/columns.
One-click generation of the current seating chart with students bound to seats.
Layout config and seat data are stored in seat_layout_config and seat_data for easy restore and migration.

Multi-dimensional score and ranking statistics:

Class: in-class student ranking (TOP 10, A–Z / Chinese localeCompare sorting).
Grade: cross-class comparison within a grade.
School: super admin can aggregate across grades and classes.
Multi-level filtering: super admin filters by school / grade / class; grade admin by grade / class.

Charts are rendered with Chart.js, supporting trend/fit curves.

Super admin can publish school-wide announcements with rich text and XSS filtering (sanitizeHtml).
Announcements are shown school-wide / to specified scopes; visible on the student home page.

Admins use Session + BCrypt; login rate-limiting (M1 fixed) prevents brute force.
Super admin can passwordlessly log in to any admin account for ops/troubleshooting.
Sensitive actions (e.g. API token issue / revoke) require re-authentication.
Students use an independent Token auth (/api/student/**), physically isolated from admin Session.

Triggers: school onboarding review results (approved / rejected) are auto-sent to the applicant email.
Templates: editable online with variable placeholders (applicant name, school name, account, password, school ID).
Providers: SMTP and Resend backends.
Security: template content is XSS-filtered to prevent injection.

Installable on desktop / home screen as a full-screen standalone app (Android maskable icon + iOS full-screen).
Workbox precaches static assets + runtime caching; API requests /api/* always go over the network, never cached, keeping score / student data real-time.
Auto-update (registerType: autoUpdate).
Brand icons: browser tab / in-app logo is the "CS letter mark + star" (CS = ClassScoreManageSystem, the star means rising / score star); PWA home-screen icon is a rocket (growth & transcendence).
Requires HTTPS to prompt "Install to home screen" (npm run dev locally does not prompt).

CSMS exposes an Open API for third-party systems (campus card, academic platform, auto-seating scripts):

Physical isolation: /api/v1/** external endpoints are separated from /api/** internal; third parties cannot touch system-level data.
Credential auth: Authorization: Bearer or X-API-Token, sha256 stored, plaintext visible only once at issuance.
Scope + permission control: 3 scopes (school / grade / class) + 12 fine-grained permissions (students:delete / structure:delete dangerous perms off by default).
Three iron rules: ① system data not operable; ② writes limited to school-level and below; ③ must carry api_token.
Rate limit: 600/min total + 120/min writes, returns 429 + Retry-After when exceeded.
Idempotency: supports Idempotency-Key header.
Audit: every call (including auth failures / rate limits) is logged, retained 30 days.

Full endpoints, error codes and curl examples: .