System Architecture & Acceptance Reference

Single Source of Truth for Multi-Tenant School ERP SaaS

A. Multi-Tenant Zero-Leakage Model

Every tenant query is strictly scoped through TenantContext::getSchoolId() derived exclusively from secure session state. The application refuses to trust client-supplied school_id inputs, ensuring complete protection against IDOR and horizontal privilege escalation.

B. LimitService & Entitlements

Centralized evaluation via LimitService::canUse($metric) and LimitService::isFeatureEnabled($key). Features follow priority: School Custom Override > Plan Feature > System Default. Limits show warnings at 80%, critical at 90%, and block creation at 100%.

C. WhatsApp Gateway Architecture

Integrated with https://wabot.jvmex.com/send-message with cURL, timeout, retry, HTTP status handling, response parsing, and background queuing via notification_jobs table.

D. cPanel Scheduled Cron Jobs

*/5 * * * * php /path/to/cron/notification_queue.php

0 0 * * * php /path/to/cron/subscription_check.php

0 2 * * * php /path/to/cron/database_backup.php

REST API Endpoints (/api/v1/...)

Method	Endpoint	Description
POST	/api/v1/auth.php	Authenticate and obtain session token
GET	/api/v1/students.php	Fetch students list (tenant scoped)
GET/POST	/api/v1/attendance.php	Daily attendance records & marking
GET/POST	/api/v1/exams.php	Exam list & CBT questions
GET	/api/v1/fees.php	Student invoices & payment status
GET/POST	/api/v1/gps.php	Bus real-time coordinates ingestion