This update fixes how the backend handles school_id in multi-school exam scenarios. Previously, some score and answersheet APIs accepted school_id from the client and used it during score lookup or teacher account selection. In multi-school exams, that could allow a SCHOOL-level user to query data outside their own school if the request parameters were crafted manually.

The score and answer sheet APIs now resolve the effective student and school context on the server first. SELF users are always limited to their own bound student account, and any client-provided student_id, student_name, or school_id is ignored. SCHOOL users are always limited to their own school, even if another school_id is provided. GLOBAL users can still use school_id as an optional filter.

Student name based lookup no longer requires school_id. The backend searches within the current user’s accessible scope. If multiple students match the same name, the error message now includes both school and class information for disambiguation.

Score sheet export was also tightened. SCHOOL users always export their own school’s data, and any provided school_id is ignored. GLOBAL users can still export all schools or a specific school.

Since this is just a backend fix related to permissions, I can only provide screenshots of the code I modified.