fix: resolve 7 bugs across API routes (security, logic, edge cases)#9

Open

Programmer-Develops wants to merge 7 commits intoJavaScript-Mastery-Pro:mainfrom

Programmer-Develops:fix/programmerdevelops

Commits on Apr 18, 2026

fix: add await to Grade.findOneAndUpdate in POST /api/grades
Programmer-Develops
committed
fix: default maxMarks to 100 when undefined in calcGrade
Programmer-Develops
committed
fix: validate and use parsed result in POST /api/students
Programmer-Develops
committed
fix: prevent IDOR by ignoring queryUserId in GET /api/profile
Programmer-Develops
committed
fix: scope grade/student/assignment mutations to authenticated teacherId
Programmer-Develops
committed
fix: replace error.stack with generic message in error responses
Programmer-Develops
committed
fix: return 400 not 404 for invalid ObjectId in PUT /api/grades/[id]
Programmer-Develops
committed