GenixEdu — Student Management System

Student Management

Full CRUD with batch and subject assignments, student ID code generation, index number tracking, CSV bulk import via Apache Commons CSV, and archive/unarchive without data loss. Stores profile photos, school, gender, email, and phone numbers (auto-normalised between local and international format). Per-student fee exemptions: Free Card, Half Payment, and Alarm Exemption.

Batch & Subject Management

Academic year batches (Day / Evening), subject catalog with online variant support, and batch archiving to hide from active views without deleting historical records.

Attendance System

Three marking modes: barcode / ID scan, common admin marking page (batch + subject selected), and auto-marking via QR/barcode scanner. Duplicate scan detection shows the already-marked timestamp in Sri Lanka time (UTC+5:30). A fee-gate flags students with unpaid fees at the point of marking. Sessions have date, subject, and status management with daily and date-range reports exportable as CSV.

Marks Management

Create exams with type, serial number, subject, batch, date, and total marks. Students load dynamically respecting enrollment and join date. Status transitions: DRAFT → SUBMITTED → RECORRECTED. Automatic rank list with tied-rank support, draggable and toggle-able columns. Per-exam Z-score column (Z = (mark − mean) / SD). Aggregate Z-Score tab across all submitted exams. Rank by Marks or Z-Score — table, PDF, CSV, and Excel exports all honour the sort. SMS dispatch sends score + rank to parents; marksSent flag prevents duplicates.

Fee Management

Monthly fee records per student with due dates, payment recording, and receipt tracking. Exemption types: FREE_CARD (waived), HALF_PAYMENT (50% due), ALARM_EXEMPTION (shown separately on dashboard). Dashboard cards show Fee Due count (excludes alarm-exempt) and Alarm Exempt Unpaid count.

Messaging & SMS

Absence notifications sent automatically to parents. Broadcast SMS to all parents in a batch/subject. Fee reminder SMS for unpaid records. Marks results SMS with score + rank after submission. OTP SMS for password reset and email update (content hidden from message log for security). Async dispatch with 10-minute timeout for bulk operations. All messages logged with status (SENT / FAILED), preview, and timestamp.

User Management (SUPER_ADMIN)

Three-tier role hierarchy: SUPER_ADMIN (TronicGen), ADMIN, USER. SUPER_ADMIN can add/delete users, reset passwords, send per-user SMS, and broadcast SMS/Email. ADMIN has a read-only directory. Online presence indicator (green/grey dot) updated every 60 s via heartbeat with server-side stale-entry purge every 5 min. Hold-to-peek for temporary credential reveal.

Dashboard

Live clock (Sri Lanka timezone), stat cards (Total Students, Active Batches, Today's Attendance, Marks Sent, Fee Due, Alarm Exempt), per-batch attendance doughnut charts, dark/light mode toggle persisted in localStorage, persistent in-app notifications with bell badge. Fully responsive across mobile, tablet, and desktop.

Authentication & Tokens

JWT (HMAC-SHA256) with 4-hour expiry. Every token includes iss, jti, iat, and exp. Bearer tokens validated per request in JwtAuthFilter; invalid/expired tokens return 401. Username change re-issues a fresh JWT immediately, keeping the session alive. Frontend stores the token in localStorage; axios interceptor attaches the Authorization header automatically; 401/403 responses redirect to login.

Password & PIN Security

Passwords: BCrypt, minimum 12 characters, must include uppercase, lowercase, digit, and special character. PINs: 4-digit, BCrypt-hashed at rest. All credential changes require SMS OTP (10-minute expiry, 5-attempt limit per session). OTP input masked as dots.

Rate Limiting (Bucket4j, per IP)

Forgot-password flow: additional daily cap of max 3 OTP requests per calendar day (server-side counter).

Security Headers

CORS & Session Policy

Allowed origins: http://localhost:3000 and https://genixedu.tronicgen.com. Stateless JWT bearer — SessionCreationPolicy.STATELESS, CSRF disabled. Real client IP resolved via X-Forwarded-For header behind Render's reverse proxy.