# Feature Checklist — Sylhet Model Madrasah ERP

> Last updated: 2026-10-27 (Phase 13)
> Stack: Laravel 12.70.1 · MySQL 8.0 · Blade + Livewire 4.4 · Tailwind CSS 4 · Alpine · Pest 3
> স্কেল: ১৮২টি রুট · ১১৪টি টেবিল · ২৬১টি পারমিশন · ১০টি রোল · ১৭টি রিপোর্ট

এই চেকলিস্ট Phase 01–12-এ বিতরণ করা সব ফিচারের সারসংক্ষেপ; প্রতিটি আইটেম Phase 13-এর অডিট/টেস্টে যাচাই করা হয়েছে (নিচের Evidence দেখুন)।

## ১. ক্রস-কাটিং ভিত্তি

| বৈশিষ্ট্য | অবস্থা | Evidence |
|---|---|---|
| ইংরেজি ডিফল্ট + বাংলা switcher, সব UI স্ট্রিং EN/BN | ✅ | `LocalizationAuditTest`; ব্রাউজার QA (EN ও BN) |
| Brand: maroon `#6B1236`, gold `#D4A017`, Poppins + Hind Siliguri | ✅ | Visual QA (light/dark) |
| Responsive desktop/tablet/mobile + dark/light | ✅ | 8 pages × 3 widths (EN), 4 × 3 (BN), horizontal overflow নেই || Server-side session (encrypted), idle timeout middleware, inactive-user block | ✅ | `security:check`, feature tests |
| Login throttling, CSRF, security headers | ✅ | `security:check` (rate_limit, csrf), `SecurityHeaders` |
| Audit log (spatie/activitylog): search, detail, CSV | ✅ | `/audit`, `AuditLogTest` |
| RBAC: 10 roles, 261 permissions, route+policy enforcement, IDOR guards | ✅ | `RouteAuditTest`, role/permission tests |
| Reference seeders only — no fake students/transactions | ✅ | `DatabaseSeeder`, fresh-DB verification |
| Backup: checksum, private storage, retention, verify/download/delete, CLI restore | ✅ | `docs/BACKUP_RESTORE.md`, Phase 12 drill |
| Data transfer: student CSV template/export/preview/safe import | ✅ | `/data-transfer`, tests |
| Security posture checker (`security:check`) | ✅ | 0 blocking; 4 local warnings (production action list) |

## ২. মডিউলভিত্তিক ফিচার

### ২.১ Authentication, Users, Roles & Settings

| ফিচার | অবস্থা |
|---|---|
| Login/logout, forgot/reset password (notification mail), profile/password change | ✅ |
| User CRUD, role assignment, active/inactive, never silently upgrade account | ✅ |
| Role & permission matrix UI; DB↔config parity; super-admin sync | ✅ |
| First admin provisioning via `make:superadmin` (no default password) | ✅ |
| System settings: institution, branding/logo, contact, academic-year selector, fee settings, ID prefixes/sequences, language switcher, notifications | ✅ |
| Security policy page (password length, lockout/throttle, idle timeout, session) + security audit | ✅ |
| Dashboard with real figures (students, fees, accounts) and setup prompts | ✅ |

### ২.২ Admissions & Students

| ফিচার | অবস্থা |
|---|---|
| Admission application form (EN/BN names, guardian, documents/photo upload, validation) | ✅ |
| Approval workflow, enrollment, student profile, guardian records | ✅ |
| Student ID generation (configurable prefix/sequence), roll/section/class assignment | ✅ |
| Transfer/withdrawal lifecycle with history; active/inactive record states | ✅ |
| Search/filter/pagination; export/print; admission report | ✅ |
| Private student files with authorized download | ✅ |

### ২.৩ Academics, Timetable & Calendar

| ফিচার | অবস্থা |
|---|---|
| Academic years, divisions, classes, sections, subjects, class configuration | ✅ |
| Subject allocations, terms, year guard for transactional data | ✅ |
| Timetable entries/periods/rooms with conflict detection | ✅ |
| Academic calendar events; promotion with rules; subject progress fields | ✅ |
| Print views for timetable/calendar; permissions for each action | ✅ |

### ২.৪ Attendance, Exams, Results & Hifz

| ফিচার | অবস্থা |
|---|---|
| Student daily attendance (unique per student/date/session), staff attendance | ✅ |
| Attendance reports, export, print | ✅ |
| Exam setup, grading scales, marks entry, publication, results & merit list | ✅ |
| Report cards (PDF/print), result exports | ✅ |
| Hifz/Nazara lesson types, progress, history, print | ✅ |

### ২.৫ Fees & Collections

| ফিচার | অবস্থা |
|---|---|
| Fee heads, structures per class/year, invoice generation (monthly/exam) | ✅ |
| Full/partial payments, receipts, refunds, waivers with approval | ✅ |
| Arrears, student statement, collections, reconciliation views | ✅ |
| Payment methods incl. cash; gateway config present but live gateways disabled until credentials + sandbox + reconciliation verified | ✅ (gated) |
| Fee ↔ accounts ledger posting; reversal-safe | ✅ |
| Print/export: invoice, receipt, arrears, statement, collections | ✅ |

### ২.৬ Accounts & Ledger

| ফিচার | অবস্থা |
|---|---|
| Financial years (create/edit/close), chart of accounts, ledger | ✅ |
| Vouchers (create/edit/post/reverse), opening balances | ✅ |
| Trial balance, income/expense, cash & bank, ledger reports | ✅ |
| Payroll payments, fundraising/donations, bank reconciliation | ✅ |
| Journal invariants: balanced entries, no one-sided lines, voucher↔journal 1:1, reversal preserves balance | ✅ `AccountingIntegrityTest` |
| Print/export for vouchers and account reports | ✅ |

### ২.৭ Human Resources

| ফিচার | অবস্থা |
|---|---|
| Staff profiles, designations, salary components/structures | ✅ |
| Payroll run → approve → pay → reverse; payslip PDF | ✅ |
| Staff advances and recovery; leave records; staff attendance | ✅ |
| Payroll accounting linkage; RBAC separation (hr-manager/accountant/admin) | ✅ |

### ২.৮ Library

| ফিচার | অবস্থা |
|---|---|
| Book catalog, copies, members/membership policies | ✅ |
| Circulation: issue/return, due dates, fines per policy | ✅ |
| Search/pagination; reports/print; permissions for librarian vs admin | ✅ |

### ২.৯ Inventory & Stores

| ফিচার | অবস্থা |
|---|---|
| Suppliers, item catalog, units, stock receipts/issues/adjustments | ✅ |
| Stock levels, low-stock visibility, valuation | ✅ |
| Accounting link for purchases/issues; print/export | ✅ |

### ২.১০ Communication & Portals

| ফিচার | অবস্থা |
|---|---|
| Notices (with attachments), homework, study materials, notifications | ✅ |
| Student portal, guardian portal, teacher portal with scoped access | ✅ |
| Portal account mapping; file downloads authorized | ✅ |
| Admin communication UI; EN/BN content fields | ✅ |

### ২.১১ Reports & Document Center

| ফিচার | অবস্থা |
|---|---|
| Report Center with 17 read-only reports across Academic/Finance/HR/Operations | ✅ |
| Filters (year/class/section/date/status/party), permission-gated visibility | ✅ |
| PDF (mPDF), print, CSV, XLSX export; row limits for PDF, streaming for CSV/XLSX | ✅ |
| Document Center: certificates/templates, student document generation, print | ✅ |
| Reports never mutate data | ✅ |

### ২.১২ System Operations

| ফিচার | অবস্থা |
|---|---|
| Audit log search/detail/CSV; tracks settings, users, backups, sessions | ✅ |
| Backups: create/verify/download/delete, manifest, SHA-256, retention, CLI restore/test-restore | ✅ |
| Data transfer (student CSV) with preview and validation | ✅ |
| `security:check` CLI with blocking/warning statuses | ✅ |
| `/up` health endpoint | ✅ |

## ৩. রোল (১০টি)

| Role | উদ্দেশ্য |
|---|---|
| `super-admin` | সম্পূর্ণ অ্যাক্সেস; সব পারমিশন |
| `admin` | দৈনন্দিন প্রশাসন: users, settings ও সব অপারেশন; role/permission matrix শুধু super-admin |
| `accountant` | ফি, ভাউচার, লেজার, পে-রোল পেমেন্ট, রিপোর্ট |
| `teacher` | নিজের ক্লাস/বিষয়, attendance, marks, Hifz, portal |
| `office-staff` | ভর্তি/শিক্ষার্থী/ফি আদায় (প্রযোজ্য অংশ) |
| `librarian` | লাইব্রেরি catalog/circulation |
| `hr-manager` | স্টাফ, পে-রোল, ছুটি, advancement |
| `parent` | guardian portal (নিজের সন্তান) |
| `student` | student portal (নিজের তথ্য) |
| `read-only` | শুধু দেখা/রিপোর্ট (লেখার অনুমতি নেই) |

রোল ম্যাট্রিক্স `config/permissions.php`-এ সংজ্ঞায়িত এবং `RoleSeeder` দিয়ে sync হয়; UI থেকে সম্পাদনাযোগ্য (permission অনুযায়ী)।

## ৪. ইচ্ছাকৃতভাবে বাইরে / শর্তসাপেক্ষ

- **লাইভ পেমেন্ট গেটওয়ে** (bKash/Nagad/Rocket/Card/SSLCommerz): কোড ও কনফিগ আছে, কিন্তু বাস্তব credential, sandbox যাচাই, signed callback ও reconciliation সম্পন্ন না হওয়া পর্যন্ত disabled।
- **SMS gateway, native mobile app, biometric/RFID attendance**: এই স্কোপে নেই।
- **Multi-campus / consolidated accounting**: এক প্রতিষ্ঠানের জন্য ডিজাইন করা; একাধিক প্রতিষ্ঠান হলে আলাদা ইনস্টলেশন।
- **Payroll tax/e‑TDS**: বেতন হিসাব আছে, করযোগ্যতা/রিটার্ন নেই।
- **Public REST API**: নেই; সব অ্যাক্সেস authenticated web UI/portal।
- **CSP header**: এখনো নেই (অন্য security headers আছে); CDN/inline policy নির্ধারণ সাপেক্ষে যোগ করতে হবে।

## ৫. যাচাইয়ের সারসংক্ষেপ

| যাচাই | ফলাফল |
|---|---|
| Automated tests | Full suite: 444 passed / 4,096 assertions (864.55s, parallel 4, exit 0); Phase 13 quality suite: 17 passed / 417 assertions |
| Static analysis | PHPStan level 1 clean (`--memory-limit=1G`; level 5-এ ৬১৪ type findings — documented) |
| Style | Pint pass (688 files) |
| Localization parity | EN/BN key parity + no leakage |
| Browser QA | 3 breakpoints × 8 pages (EN) + 4 pages (BN); 1 UI overflow bug ধরা পড়ে ও ঠিক হয়েছে |
| Security | 0 blocking failures; dependency audit clean |
| Backup | checksum+gzip+114 tables; Phase 12 disposable restore drill pass |
| Production deploy | এখনো হয়নি — অনুমোদন সাপেক্ষে `docs/GO_LIVE_CHECKLIST.md` অনুসরণ করুন |