# e-MaaS module implementation notes

This release adds tenant-database schemas, Eloquent models, authenticated CRUD endpoints and basic list pages for examinations, results, fee invoices, timetable, assignments/submissions, guardians and transport. It also adds transactional payment allocation logic, signed webhook endpoints, and an Artisan tenant provisioning command.

## Important production integration work
- The webhook handlers use a configurable HMAC-SHA256 envelope (`X-PayFast-Signature` / `X-Peach-Signature`) as a secure integration boundary. Confirm the exact signature algorithm, canonical payload, event names, retry semantics and IP allow-list from your merchant account/provider documentation before enabling live callbacks. These handlers are not a claim of plug-and-play gateway certification.
- Payment initiation/checkout is intentionally not fabricated. Obtain live merchant credentials and implement the provider's current checkout/session API, return URLs, idempotency keys and reconciliation process.
- Guardian records are data records only; a secure parent portal still needs verified user-to-guardian linking, password reset, MFA policy and student-level authorization.
- Assignment file uploads use private storage; add authorized download controllers and malware scanning before production.
- Timetable conflict detection, class-level authorization, teacher workload rules, report-card PDF generation, message delivery adapters (email/SMS/WhatsApp) and complete CRUD forms remain deployment-specific work.
- Run tenant migrations separately for each tenant. Verify the host permits database creation and that the database prefix is allowed.

## New routes
Authenticated routes: `/exams`, `/fee-invoices`, `/timetable`, `/assignments`, `/transport`, `/guardians`; result and assignment-submission actions are also registered. Public webhook routes: `/webhooks/payfast` and `/webhooks/peach`. Protect webhook endpoints with provider-specific signature verification and network restrictions matching the real provider contract.

## Tenant creation
`php artisan emaas:school-create school001 school001.example.com --name="Example School"` creates tenant metadata and a domain. It does not bypass hosting restrictions or automatically prove database provisioning works.