Repository: DriveFlow-CRM/DriveFlow-CRM-API
Pull request #16: Enrollment
Author: login: GtJohnny
Created: 2025-05-03T19:37:37Z | Merged: 2025-05-03T22:35:21Z

Fixed Documentation.


Title: Enhance Request Management in RequestController
---
Summary:
This pull request introduces enhancements and fixes to the RequestController to improve the management of enrollment requests for driving schools. The changes include new features, validation improvements, and better role-based access control.
---
Changes:
1.	Create Request Endpoint (CreateRequest):
•	Added validation to ensure the RequestDto is not null.
•	Enforced role-based access control for Student, SchoolAdmin, and SuperAdmin.
•	Split FullName into FirstName and LastName to handle users with multiple surnames.
•	Added a check to ensure SchoolAdmin can only create requests for their own school.
2.	Fetch School Requests Endpoint (FetchSchoolRequests):
•	Added validation for AutoSchoolId to ensure it is a positive integer.
•	Enforced role-based access control for SchoolAdmin and SuperAdmin.
•	Ensured SchoolAdmin can only fetch requests for their own school.
•	Optimized query to return a list of RequestDto objects with relevant details.
3.	Update Request Status Endpoint (UpdateRequestStatus):
•	Added validation for requestId and RequestDto.
•	Enforced role-based access control for SchoolAdmin and SuperAdmin.
•	Restricted SchoolAdmin to update requests only for their own school.
•	Allowed updating only the Status field of a request.
4.	Delete Request Endpoint (DeleteRequest):
•	Added validation for requestId.
•	Enforced role-based access control for SchoolAdmin and SuperAdmin.
•	Restricted SchoolAdmin to delete requests only for their own school.
5.	General Improvements:
•	Enhanced error handling with appropriate HTTP status codes (400, 401, 403, 404).
•	Improved code readability and maintainability with clear comments and structured logic.
---
Testing:
•	Unit tests were added/updated to cover the new validation rules and role-based access restrictions.
•	Manual testing was performed for all endpoints to ensure proper functionality and error handling.
---
Notes:
•	This PR ensures stricter access control and better data integrity for managing requests.
•	Future improvements could include adding logging for better traceability and auditing.
---
Related Issues:
•	# - Improve request validation and access control.
•	# - Handle multi-surname users in request creation.
---


Diff:
diff --git a/DriveFlow-CRM-API/Controllers/RequestController.cs b/DriveFlow-CRM-API/Controllers/RequestController.cs
new file mode 100644
index 0000000..56f386e
--- /dev/null
+++ b/DriveFlow-CRM-API/Controllers/RequestController.cs
@@ -0,0 +1,268 @@
+﻿using Microsoft.AspNetCore.Authorization;
+using Microsoft.AspNetCore.Mvc;
+using Microsoft.EntityFrameworkCore;
+using DriveFlow_CRM_API.Models;
+using Microsoft.AspNetCore.Identity;
+using System.Security.Claims;
+
+namespace DriveFlow_CRM_API.Controllers;
+
+[ApiController]
+[Route("api/request")]
+public class RequestController : ControllerBase
+{
+
+    // ───────────────────────────── fields & actor ─────────────────────────────
+    private readonly ApplicationDbContext _db;
+    private readonly UserManager<ApplicationUser> _users;
+    private readonly RoleManager<IdentityRole> _roles;
+
+    /// <summary>Constructor invoked per request by DI.</summary>
+    public RequestController(
+        ApplicationDbContext db,
+        UserManager<ApplicationUser> users,
+        RoleManager<IdentityRole> roles)
+    {
+        _db = db;
+        _users = users;
+        _roles = roles;
+    }
+
+
+
+
+    // ────────────────────────────── CREATE REQUEST ──────────────────────────────
+
+    /// <summary>Create a new enrollment Request for someone wishing to start their courses
+    /// (Student, SchoolAdmin, SuperAdmin only).</summary>
+    /// <remarks> SchoolAdmin's SchoolId must match the AutoSchoolId given as method paramether.
+    /// <para> <strong>Sample Request body</strong> </para> 
+    /// ```json
+    ///
+    ///{
+    ///  "firstName": "Maria",
+    ///  "lastName": "Ionescu",
+    ///  "phoneNr": "0721234234",
+    ///  "drivingCategory": "A2",
+    ///}
+    /// ```
+    /// </remarks>
+    /// <response code="200">Request sent succesffully.</response>
+    /// <response code="400">Empty request</response>>
+    /// <response code="401">No valid JWT supplied.</response>
+    /// <response code="403">User is forbidden from seeing the requests of this auto school.</response>
+
+    [HttpPost("school/{schoolId}/createRequest")]
+    public async Task<IActionResult> CreateRequest(int schoolId, [FromBody] RequestDto requestDto)
+    {
+        if(schoolId <= 0)
+            return BadRequest("Invalid school ID.");
+        if (requestDto == null)
+            return BadRequest("Request data is required.");
+        var user = await _users.GetUserAsync(User);   
+        if(user == null)
+            return Unauthorized("User not found.");
+        //if (User.IsInRole("SchoolAdmin") &&  user.AutoSchoolId != requestDto.AutoSchoolId)
+        //    return Forbid("You are not authorized to create requests for this auto school.");
+
+
+        var newRequest = new Request
+        {
+            FirstName = requestDto.FirstName,
+            LastName =requestDto.LastName,
+            PhoneNumber = requestDto.PhoneNr,
+            DrivingCategory = requestDto.DrivingCategory,
+            RequestDate = DateTime.Today,
+            Status = "PENDING",
+            AutoSchoolId = schoolId,
+        };
+        await _db.Requests.AddAsync(newRequest);
+        await _db.SaveChangesAsync();
+        return Ok("Request was sent successfully!");
+    }
+
+
+
+
+
+
+
+    /// ────────────────────────────── FETCH SCHOOL REQUESTS ──────────────────────────────
+    /// <summary>Returns all student enrollment requests for the appropriate school id, (SchoolAdmin, SuperAdmin only).</summary>
+    /// <remarks>
+    /// If the user is a SchoolAdmin, then his SchoolId must match the parameter SchoolId.
+    /// 
+    /// <para> <strong>Sample output</strong> </para> 
+    /// ```json
+    ///
+    ///  [
+    ///    {
+    ///    "requestId": 91249,
+    ///    "firstName": "Maria",
+    ///    "lastName": "Ionescu",
+    ///    "phoneNr": "0721234567",
+    ///    "drivingCategory": "A2",
+    ///    "requestDate": "2025-10-12",
+    ///    "status": "PENDING"
+    ///  },
+    ///  {
+    ///    "requestId": 23523,
+    ///    "firstName": "Ion",
+    ///    "lastName": "Popescu",
+    ///    "phoneNr": "0729876543",
+    ///    "drivingCategory": "B",
+    ///    "requestDate": "2025-10-15",
+    ///    "status": "APPROVED"
+    ///  },
+    ///  {
+    ///    "requestId": 34567,
+    ///    "firstName": "Elena",
+    ///    "lastName": "Georgescu",
+    ///    "phoneNr": "0734567890",
+    ///    "drivingCategory": "C",
+    ///    "requestDate": "2025-10-20",
+    ///    "status": "REJECTED"
+    ///  }
+    ///]
+    /// ```
+    /// </remarks>
+    /// <returns>
+    /// A list of all the requested RequestDTO items.
+    /// </returns>
+    /// <response code="200">Requests Array returned successfully.</response>
+    /// <response code="400">School id was not a valid value</response>>
+    /// <response code="401">No valid JWT supplied.</response>
+    /// <response code="403">User is forbidden from seeing the requests of this auto school.</response>
+
+    [HttpGet("school/{AutoSchoolId}/fetchSchoolRequests")]
+    [Authorize(Roles = "SuperAdmin,SchoolAdmin")]
+    public async Task<IActionResult> FetchSchoolRequests(int AutoSchoolId)
+    {
+        if (AutoSchoolId <= 0)
+            return BadRequest();
+
+        var user = await _users.GetUserAsync(User);
+        if (user == null)
+            return Unauthorized("User not found.");
+
+        if (!(User.IsInRole("SchoolAdmin") && user.AutoSchoolId == AutoSchoolId))
+            return Forbid("You are not authorized to view this school's requests.");
+
+        var Requests = await _db.Requests
+            .AsNoTracking()
+            .Where(r => r.AutoSchoolId == AutoSchoolId)
+            .OrderBy(r => r.RequestId)
+            .Select(r => new RequestDto
+            {
+                RequestId = r.RequestId,
+                FirstName = r.FirstName,
+                LastName = r.LastName,
+                PhoneNr = r.PhoneNumber,
+                DrivingCategory = r.DrivingCategory,
+                RequestDate = r.RequestDate,
+                Status = r.Status
+            })
+            .ToListAsync();
+        return Ok(Requests);
+    }
+
+
+    // ────────────────────────────── UPDATE REQUEST ──────────────────────────────
+    /// <summary>Update the status of a request (SchoolAdmin, SuperAdmin only).</summary>
+    /// <remarks>
+    /// If the user is a SchoolAdmin, then his SchoolId must match the parameter SchoolId.
+    /// The only status values allowed are: APPROVED, REJECTED, PENDING.
+    /// That's the only thing that is going to be changed.
+    /// <para> <strong>Sample request body</strong> </para> 
+    /// ```json
+    ///
+    ///  {
+    ///    "firstName": "Maria",
+    ///    "lastName": "Ionescu",
+    ///    "phoneNr": "0721234234",
+    ///    "drivingCategory": "A2",
+    ///    "requestDate": "2025-10-12",
+    ///    "status": "APPROVED"
+    ///  }
+    /// 
+    /// ```
+    /// </remarks>
+    /// <response code="200">Request updated successfully.</response>
+    /// <response code="400">RequestId or the new Status was not a valid value</response>>
+    /// <response code="401">No valid JWT supplied.</response>
+    /// <response code="403">User is forbidden from seeing the requests of this auto school.</response>
+
+
+    [HttpPut("update/{requestId}/updateRequestStatus")]
+    public async Task<IActionResult> UpdateRequestStatus(int requestId,[FromBody] RequestDto requestDto)
+    {
+        if (requestId <= 0)
+            return BadRequest("Invalid request ID.");
+
+        if( requestDto== null)
+        {
+            return BadRequest("Request data is required.");
+        }
+
+        var user = await _users.GetUserAsync(User);
+        if (user == null)
+            return Unauthorized("User not found.");
+        if (!(User.IsInRole("SchoolAdmin") && user.AutoSchoolId == requestId))
+            return Forbid("You are not authorized to update this request.");
+
+        var request = await _db.Requests.FindAsync(requestId);
+        if (request == null)
+            return NotFound("Request not found.");
+
+        request.Status = requestDto.Status; // Update the status of the request, that's all we do here.
+
+        await _db.SaveChangesAsync();
+        return Ok("Request status updated successfully.");
+    }
+
+
+    // ────────────────────────────── DELETE REQUEST ──────────────────────────────
+    /// <summary>Delete a request (SchoolAdmin, SuperAdmin only).</summary>
+    ///<remarks> <para> <strong>Sample output</strong> </para> 
+    /// </remarks>
+    /// <response code="200">Requests deleted successfully.</response>
+    /// <response code="400">Request does not exist</response>
+    /// <response code="401">No valid JWT supplied.</response>
+    /// <response code="403">User is forbidden from seeing the requests of this auto school.</response>
+
+    [HttpDelete("delete/{requestId}/deleteRequest")]
+    [Authorize(Roles = "SchoolAdmin,SuperAdmin")]
+
+    public async Task<IActionResult> DeleteRequest(int requestId)
+    {
+        if (requestId <= 0)
+            return BadRequest("Invalid request ID.");
+        var user = await _users.GetUserAsync(User);
+        if (user == null)
+            return Unauthorized("User not found.");
+        if (!(User.IsInRole("SchoolAdmin") && user.AutoSchoolId == requestId))
+            return Forbid("You are not authorized to delete this request.");
+        var request = await _db.Requests.FindAsync(requestId);
+        if (request == null)
+            return NotFound("Request not found.");
+        _db.Requests.Remove(request);
+
+        await _db.SaveChangesAsync();
+
+        return Ok("Request deleted successfully.");
+    }
+}
+
+
+public sealed class RequestDto
+{
+    public int? RequestId { get; init; }
+    public string? FirstName { get; init; } = default!;
+
+    public string? LastName { get; init; } = default!;
+
+    public string PhoneNr { get; init; } = default!;    
+    public string? DrivingCategory { get; init; } = default!;
+    public DateTime? RequestDate { get; init; } = default;
+    public string? Status { get; init; } = default!;
+}
diff --git a/DriveFlow-CRM-API/Json/AppJsonContext.cs b/DriveFlow-CRM-API/Json/AppJsonContext.cs
index d43314c..0e5d26f 100644
--- a/DriveFlow-CRM-API/Json/AppJsonContext.cs
+++ b/DriveFlow-CRM-API/Json/AppJsonContext.cs
@@ -68,6 +68,10 @@ namespace DriveFlow_CRM_API.Json
     [JsonSerializable(typeof(LicenseCreateDto))]
     [JsonSerializable(typeof(LicenseUpdateDto))]
 
+
+    // ───────────────────────── REQUEST CONTROLLER ─────────────────────────
+    [JsonSerializable(typeof(RequestDto))]
+
     internal partial class AppJsonContext : JsonSerializerContext
     {
     }
diff --git a/DriveFlow-CRM-API/Models/Request.cs b/DriveFlow-CRM-API/Models/Request.cs
index a4228d3..16fa85a 100644
--- a/DriveFlow-CRM-API/Models/Request.cs
+++ b/DriveFlow-CRM-API/Models/Request.cs
@@ -36,6 +36,10 @@ public class Request
     [StringLength(10)]
     public string? DrivingCategory { get; set; }
 
+
+    [Required]
+    public string Status { get; set; } = "Pending";
+
     /// <summary>Date and time when the request was created.</summary>
     public DateTime RequestDate { get; set; } = DateTime.UtcNow;
 
@@ -51,3 +55,5 @@ public class Request
     /// <summary>Navigation to the auto-school.</summary>
     public virtual AutoSchool? AutoSchool { get; set; }
 }
+
+
diff --git a/DriveFlow-CRM-API/appsettings.json b/DriveFlow-CRM-API/appsettings.json
index 2d009e2..bea213d 100644
--- a/DriveFlow-CRM-API/appsettings.json
+++ b/DriveFlow-CRM-API/appsettings.json
@@ -11,7 +11,7 @@
   "Jwt": {
     "Issuer": "DriveFlow.Api",
     "Audience": "DriveFlow.Spa",
-    "AccessExpiresMinutes": 60, 
+    "AccessExpiresMinutes": 60,
     "RefreshExpiresDays": 7
   }
-}
+}
\ No newline at end of file


Reviews:
user: login: whos-gabi
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-05-03T20:07:51Z
user: login: whos-gabi
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-05-03T20:11:37Z
user: login: whos-gabi
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-05-03T20:24:49Z
user: login: whos-gabi
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-05-03T20:25:18Z
user: login: whos-gabi
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-05-03T20:26:16Z
user: login: whos-gabi
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-05-03T20:27:52Z
user: login: whos-gabi
body: Am comentat eventuale modificari, intru-cat nu este complet.
Mai trebuie doar un pic de refactoring dar in rest e okey 👍.
state: CHANGES_REQUESTED
author_association: CONTRIBUTOR
submitted_at: 2025-05-03T20:31:16Z
user: login: GtJohnny
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-05-03T20:35:29Z
user: login: GtJohnny
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-05-03T20:36:28Z
user: login: whos-gabi
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-05-03T20:40:15Z
user: login: GtJohnny
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-05-03T20:40:17Z
user: login: GtJohnny
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-05-03T20:42:28Z
user: login: GtJohnny
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-05-03T20:47:22Z
user: login: GtJohnny
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-05-03T20:56:36Z
user: login: GtJohnny
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-05-03T21:00:22Z
user: login: GtJohnny
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-05-03T21:02:03Z
user: login: whos-gabi
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-05-03T21:30:16Z
user: login: whos-gabi
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-05-03T21:31:18Z
user: login: whos-gabi
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-05-03T21:31:49Z
user: login: whos-gabi
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-05-03T21:32:36Z
user: login: whos-gabi
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-05-03T21:33:09Z
user: login: whos-gabi
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-05-03T21:38:39Z
user: login: whos-gabi
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-05-03T21:39:14Z
user: login: whos-gabi
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-05-03T21:40:51Z
user: login: GtJohnny
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-05-03T21:44:13Z
user: login: whos-gabi
body: ### Round Up
Ai putea te rog sa tai un refactor la comentariile care apar in swagger sa fie formatul din DTO.

De asemenea la FileController nu e clar ce se intampla, e pe file da cu ruta request, ai putea sa il pui in alt PR pentru cardul cu File Management
state: CHANGES_REQUESTED
author_association: CONTRIBUTOR
submitted_at: 2025-05-03T21:44:13Z
user: login: GtJohnny
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-05-03T21:44:28Z
user: login: whos-gabi
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-05-03T21:48:38Z
user: login: GtJohnny
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-05-03T21:51:54Z
user: login: GtJohnny
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-05-03T22:01:44Z

Review comments:
diff_hunk: @@ -0,0 +1,15 @@
+﻿using Microsoft.AspNetCore.Mvc;
+
+namespace DriveFlow_CRM_API.Controllers
+{
+ 
+    
+       
+    public class FileController : Controller
+    {
+        public IActionResult Index()
+        {
+            return View();
path: DriveFlow-CRM-API/Controllers/FileController.cs
user: login: whos-gabi
body: Se pare ca e un missunderstanding, noi aici nu lucram cu views, comunicam doar prin JSON, de asemenea nu avem nevoie de file controller.
created_at: 2025-05-03T20:07:51Z
author_association: CONTRIBUTOR
diff_hunk: @@ -0,0 +1,286 @@
+﻿using Microsoft.AspNetCore.Authorization;
+using Microsoft.AspNetCore.Mvc;
+using Microsoft.EntityFrameworkCore;
+using DriveFlow_CRM_API.Models;
+using Microsoft.AspNetCore.Identity;
+using System.Security.Claims;
+
+namespace DriveFlow_CRM_API.Controllers;
+
+[ApiController]
+[Route("api/[controller]")]
path: DriveFlow-CRM-API/Controllers/RequestController.cs
user: login: whos-gabi
body: in loc de `api/[controller]` ar trebui sa fie `api/(numele rutei efective)`, in cazul nostru `api/request`
created_at: 2025-05-03T20:11:37Z
author_association: CONTRIBUTOR
diff_hunk: @@ -0,0 +1,286 @@
+﻿using Microsoft.AspNetCore.Authorization;
+using Microsoft.AspNetCore.Mvc;
+using Microsoft.EntityFrameworkCore;
+using DriveFlow_CRM_API.Models;
+using Microsoft.AspNetCore.Identity;
+using System.Security.Claims;
+
+namespace DriveFlow_CRM_API.Controllers;
+
+[ApiController]
+[Route("api/[controller]")]
+public class RequestController : ControllerBase
+{
+
+    // ───────────────────────────── fields & ctor ─────────────────────────────
+    private readonly ApplicationDbContext _db;
+    private readonly UserManager<ApplicationUser> _users;
+    private readonly RoleManager<IdentityRole> _roles;
+
+    /// <summary>Constructor invoked per request by DI.</summary>
+    public RequestController(
+        ApplicationDbContext db,
+        UserManager<ApplicationUser> users,
+        RoleManager<IdentityRole> roles)
+    {
+        _db = db;
+        _users = users;
+        _roles = roles;
+    }
+
+
+
+
+    // ────────────────────────────── CREATE REQUEST ──────────────────────────────
+
+    /// <summary>Create a new enrollment Request for someone wishing to start their courses (Student, SchoolAdmin, SuperAdmin only).</summary>
+    /// <remarks> SchoolAdmin's SchoolId must match the AutoSchoolId given as method paramether.
+    /// <para> <strong>Sample Request body</strong> </para> 
+    /// ```json
+    ///
+    ///{
+    ///  "requestId": 23523,
+    ///  "fullName": "Maria Ionescu",
+    ///  "phoneNr": "0721234234",
+    ///  "drivingCategory": "A2",
+    ///  "requestDate": "2025-10-12T00:00:00Z",
+    ///  "status": "PENDING",
+    ///  "autoSchoolId": 1
+    ///}
+    /// ```
+    /// </remarks>
+    /// <response code="200">Request sent succesffully.</response>
+    /// <response code="400">Empty request</response>>
+    /// <response code="401">No valid JWT supplied.</response>
+    /// <response code="403">User is forbidden from seeing the requests of this auto school.</response>
+
+    [HttpPost("createRequest/{RequestDto}")]
+    [Authorize(Roles = "Student,SchoolAdmin,SuperAdmin")]
path: DriveFlow-CRM-API/Controllers/RequestController.cs
user: login: whos-gabi
body: Pentru crearea unui request, _nu este nevoie de autentificare_, pentru ca se va trimite un request de catre un potential student care vrea sa se inscrie la scoala si completeaza un formular.
Deci trebuie sa fie acceptat fara validare pe **userType**

De asemenea, scuze de neclaritate, dar am modificat acum in Trello era o greseala, ar trebui sa se trimita si **school id-ul** in ruta de **POST**, intru cat trebuie pentru inset. Nu trebuie luat din Dto.

<img width="219" alt="image" src="https://github.com/user-attachments/assets/e7663dd5-c5e9-47c5-aaaa-5a50bf13431a" />


De asemenea am modificat ca se va trimite **fisrt** si **last** **name** aparte fara sa faci split.




created_at: 2025-05-03T20:24:49Z
author_association: CONTRIBUTOR
diff_hunk: @@ -0,0 +1,286 @@
+﻿using Microsoft.AspNetCore.Authorization;
+using Microsoft.AspNetCore.Mvc;
+using Microsoft.EntityFrameworkCore;
+using DriveFlow_CRM_API.Models;
+using Microsoft.AspNetCore.Identity;
+using System.Security.Claims;
+
+namespace DriveFlow_CRM_API.Controllers;
+
+[ApiController]
+[Route("api/[controller]")]
+public class RequestController : ControllerBase
+{
+
+    // ───────────────────────────── fields & ctor ─────────────────────────────
+    private readonly ApplicationDbContext _db;
+    private readonly UserManager<ApplicationUser> _users;
+    private readonly RoleManager<IdentityRole> _roles;
+
+    /// <summary>Constructor invoked per request by DI.</summary>
+    public RequestController(
+        ApplicationDbContext db,
+        UserManager<ApplicationUser> users,
+        RoleManager<IdentityRole> roles)
+    {
+        _db = db;
+        _users = users;
+        _roles = roles;
+    }
+
+
+
+
+    // ────────────────────────────── CREATE REQUEST ──────────────────────────────
+
+    /// <summary>Create a new enrollment Request for someone wishing to start their courses (Student, SchoolAdmin, SuperAdmin only).</summary>
+    /// <remarks> SchoolAdmin's SchoolId must match the AutoSchoolId given as method paramether.
+    /// <para> <strong>Sample Request body</strong> </para> 
+    /// ```json
+    ///
+    ///{
+    ///  "requestId": 23523,
+    ///  "fullName": "Maria Ionescu",
+    ///  "phoneNr": "0721234234",
+    ///  "drivingCategory": "A2",
+    ///  "requestDate": "2025-10-12T00:00:00Z",
+    ///  "status": "PENDING",
+    ///  "autoSchoolId": 1
+    ///}
+    /// ```
+    /// </remarks>
+    /// <response code="200">Request sent succesffully.</response>
+    /// <response code="400">Empty request</response>>
+    /// <response code="401">No valid JWT supplied.</response>
+    /// <response code="403">User is forbidden from seeing the requests of this auto school.</response>
+
+    [HttpPost("createRequest/{RequestDto}")]
+    [Authorize(Roles = "Student,SchoolAdmin,SuperAdmin")]
+    public async Task<IActionResult> CreateRequest([FromBody] RequestDto requestDto)
+    {
+        if (requestDto == null)
+            return BadRequest("Request data is required.");
+        var user = await _users.GetUserAsync(User);   
+        if(user == null)
+            return Unauthorized("User not found.");
+        if (User.IsInRole("SchoolAdmin") &&  user.AutoSchoolId != requestDto.AutoSchoolId)
+            return Forbid("You are not authorized to create requests for this auto school.");
+
+        //Name must be split and assigned to FirstName and LastName
+        //User may have multiple surnames
+        string[] tokens = requestDto.FullName.Split(' ');
+        var newRequest = new Request
+        {
+            FirstName = tokens.Length==2 ? tokens.First() : string.Join(" ", tokens.Take(tokens.Length - 1)),
+            LastName = tokens.Last(),
+            PhoneNumber = requestDto.PhoneNr,
+            DrivingCategory = requestDto.DrivingCategory,
+            RequestDate = DateTime.UtcNow,
+            Status = "Pending",
+            AutoSchoolId = requestDto.AutoSchoolId,
+        };
+        await _db.Requests.AddAsync(newRequest);
+        await _db.SaveChangesAsync();
+        return Ok("Request was sent successfully!");
+    }
+
+
+
+
+
+
+
+    /// ────────────────────────────── FETCH SCHOOL REQUESTS ──────────────────────────────
+    /// <summary>Returns all student enrollment requests for the appropriate school id, (SchoolAdmin, SuperAdmin only).</summary>
+    /// <remarks>
+    /// If the user is a SchoolAdmin, then his SchoolId must match the parameter SchoolId.
+    /// 
+    /// <para> <strong>Sample output</strong> </para> 
+    /// ```json
+    ///
+    ///    [
+    ///      {
+    ///    "requestId": 91249,
+    ///    "fullName": "Maria Ionescu",
+    ///    "phoneNr": "0721234567",
+    ///    "drivingCategory": "A2",
+    ///    "requestDate": "2025-10-12T00:00:00Z",
+    ///    "status": "PENDING"
+    ///  },
+    ///  {
+    ///    "requestId": 23523,
+    ///    "fullName": "Ion Popescu",
+    ///    "phoneNr": "0729876543",
+    ///    "drivingCategory": "B",
+    ///    "requestDate": "2025-10-15T00:00:00Z",
+    ///    "status": "APPROVED"
+    ///  },
+    ///  {
+    ///    "requestId": 34567,
+    ///    "fullName": "Elena Georgescu",
+    ///    "phoneNr": "0734567890",
+    ///    "drivingCategory": "C",
+    ///    "requestDate": "2025-10-20T00:00:00Z",
+    ///    "status": "REJECTED"
+    ///  }
+    ///]
+    /// ```
+    /// </remarks>
+    /// <returns>
+    /// A list of all the requested RequestDTO items.
+    /// </returns>
+    /// <response code="200">Requests Array returned successfully.</response>
+    /// <response code="400">School id was not a valid value</response>>
+    /// <response code="401">No valid JWT supplied.</response>
+    /// <response code="403">User is forbidden from seeing the requests of this auto school.</response>
+
+    [HttpGet("get/{AutoSchoolId:int}")]
+    [Authorize(Roles = "SuperAdmin,SchoolAdmin")]
+    public async Task<IActionResult> FetchSchoolRequests(int AutoSchoolId)
+    {
+        if (AutoSchoolId <= 0)
+            return BadRequest();
+
+        var user = await _users.GetUserAsync(User);
+        if (user == null)
+            return Unauthorized("User not found.");
+
+        if (!(User.IsInRole("SchoolAdmin") && user.AutoSchoolId == AutoSchoolId))
+            return Forbid("You are not authorized to view this school's requests.");
+
+        var Requests = await _db.Requests
+            .AsNoTracking()
+            .Where(r => r.AutoSchoolId == AutoSchoolId)
+            .OrderBy(r => r.RequestId)
+            .Select(r => new RequestDto
+            {
+                RequestId = r.RequestId,
+                FullName = r.FirstName + " " + r.LastName,
path: DriveFlow-CRM-API/Controllers/RequestController.cs
user: login: whos-gabi
body: La fel ca mai sus, fara concatenare, se pot trimite aparte first si last name.
created_at: 2025-05-03T20:25:18Z
author_association: CONTRIBUTOR
diff_hunk: @@ -0,0 +1,286 @@
+﻿using Microsoft.AspNetCore.Authorization;
+using Microsoft.AspNetCore.Mvc;
+using Microsoft.EntityFrameworkCore;
+using DriveFlow_CRM_API.Models;
+using Microsoft.AspNetCore.Identity;
+using System.Security.Claims;
+
+namespace DriveFlow_CRM_API.Controllers;
+
+[ApiController]
+[Route("api/[controller]")]
+public class RequestController : ControllerBase
+{
+
+    // ───────────────────────────── fields & ctor ─────────────────────────────
+    private readonly ApplicationDbContext _db;
+    private readonly UserManager<ApplicationUser> _users;
+    private readonly RoleManager<IdentityRole> _roles;
+
+    /// <summary>Constructor invoked per request by DI.</summary>
+    public RequestController(
+        ApplicationDbContext db,
+        UserManager<ApplicationUser> users,
+        RoleManager<IdentityRole> roles)
+    {
+        _db = db;
+        _users = users;
+        _roles = roles;
+    }
+
+
+
+
+    // ────────────────────────────── CREATE REQUEST ──────────────────────────────
+
+    /// <summary>Create a new enrollment Request for someone wishing to start their courses (Student, SchoolAdmin, SuperAdmin only).</summary>
+    /// <remarks> SchoolAdmin's SchoolId must match the AutoSchoolId given as method paramether.
+    /// <para> <strong>Sample Request body</strong> </para> 
+    /// ```json
+    ///
+    ///{
+    ///  "requestId": 23523,
+    ///  "fullName": "Maria Ionescu",
+    ///  "phoneNr": "0721234234",
+    ///  "drivingCategory": "A2",
+    ///  "requestDate": "2025-10-12T00:00:00Z",
+    ///  "status": "PENDING",
+    ///  "autoSchoolId": 1
+    ///}
+    /// ```
+    /// </remarks>
+    /// <response code="200">Request sent succesffully.</response>
+    /// <response code="400">Empty request</response>>
+    /// <response code="401">No valid JWT supplied.</response>
+    /// <response code="403">User is forbidden from seeing the requests of this auto school.</response>
+
+    [HttpPost("createRequest/{RequestDto}")]
+    [Authorize(Roles = "Student,SchoolAdmin,SuperAdmin")]
+    public async Task<IActionResult> CreateRequest([FromBody] RequestDto requestDto)
+    {
+        if (requestDto == null)
+            return BadRequest("Request data is required.");
+        var user = await _users.GetUserAsync(User);   
+        if(user == null)
+            return Unauthorized("User not found.");
+        if (User.IsInRole("SchoolAdmin") &&  user.AutoSchoolId != requestDto.AutoSchoolId)
+            return Forbid("You are not authorized to create requests for this auto school.");
+
+        //Name must be split and assigned to FirstName and LastName
+        //User may have multiple surnames
+        string[] tokens = requestDto.FullName.Split(' ');
+        var newRequest = new Request
+        {
+            FirstName = tokens.Length==2 ? tokens.First() : string.Join(" ", tokens.Take(tokens.Length - 1)),
+            LastName = tokens.Last(),
+            PhoneNumber = requestDto.PhoneNr,
+            DrivingCategory = requestDto.DrivingCategory,
+            RequestDate = DateTime.UtcNow,
+            Status = "Pending",
+            AutoSchoolId = requestDto.AutoSchoolId,
+        };
+        await _db.Requests.AddAsync(newRequest);
+        await _db.SaveChangesAsync();
+        return Ok("Request was sent successfully!");
+    }
+
+
+
+
+
+
+
+    /// ────────────────────────────── FETCH SCHOOL REQUESTS ──────────────────────────────
+    /// <summary>Returns all student enrollment requests for the appropriate school id, (SchoolAdmin, SuperAdmin only).</summary>
+    /// <remarks>
+    /// If the user is a SchoolAdmin, then his SchoolId must match the parameter SchoolId.
+    /// 
+    /// <para> <strong>Sample output</strong> </para> 
+    /// ```json
+    ///
+    ///    [
+    ///      {
+    ///    "requestId": 91249,
+    ///    "fullName": "Maria Ionescu",
+    ///    "phoneNr": "0721234567",
+    ///    "drivingCategory": "A2",
+    ///    "requestDate": "2025-10-12T00:00:00Z",
+    ///    "status": "PENDING"
+    ///  },
+    ///  {
+    ///    "requestId": 23523,
+    ///    "fullName": "Ion Popescu",
+    ///    "phoneNr": "0729876543",
+    ///    "drivingCategory": "B",
+    ///    "requestDate": "2025-10-15T00:00:00Z",
+    ///    "status": "APPROVED"
+    ///  },
+    ///  {
+    ///    "requestId": 34567,
+    ///    "fullName": "Elena Georgescu",
+    ///    "phoneNr": "0734567890",
+    ///    "drivingCategory": "C",
+    ///    "requestDate": "2025-10-20T00:00:00Z",
+    ///    "status": "REJECTED"
+    ///  }
+    ///]
+    /// ```
+    /// </remarks>
+    /// <returns>
+    /// A list of all the requested RequestDTO items.
+    /// </returns>
+    /// <response code="200">Requests Array returned successfully.</response>
+    /// <response code="400">School id was not a valid value</response>>
+    /// <response code="401">No valid JWT supplied.</response>
+    /// <response code="403">User is forbidden from seeing the requests of this auto school.</response>
+
+    [HttpGet("get/{AutoSchoolId:int}")]
+    [Authorize(Roles = "SuperAdmin,SchoolAdmin")]
+    public async Task<IActionResult> FetchSchoolRequests(int AutoSchoolId)
+    {
+        if (AutoSchoolId <= 0)
+            return BadRequest();
+
+        var user = await _users.GetUserAsync(User);
+        if (user == null)
+            return Unauthorized("User not found.");
+
+        if (!(User.IsInRole("SchoolAdmin") && user.AutoSchoolId == AutoSchoolId))
+            return Forbid("You are not authorized to view this school's requests.");
+
+        var Requests = await _db.Requests
+            .AsNoTracking()
+            .Where(r => r.AutoSchoolId == AutoSchoolId)
+            .OrderBy(r => r.RequestId)
+            .Select(r => new RequestDto
+            {
+                RequestId = r.RequestId,
+                FullName = r.FirstName + " " + r.LastName,
+                PhoneNr = r.PhoneNumber,
+                DrivingCategory = r.DrivingCategory,
+                RequestDate = r.RequestDate,
+                Status = r.Status
+            })
+            .ToListAsync();
+        return Ok(Requests);
+    }
+
+
+    // ────────────────────────────── UPDATE REQUEST ──────────────────────────────
+    /// <summary>Update the status of a request (SchoolAdmin, SuperAdmin only).</summary>
+    /// <remarks>
+    /// If the user is a SchoolAdmin, then his SchoolId must match the parameter SchoolId.
+    /// The only status values allowed are: APPROVED, REJECTED, PENDING.
+    /// That's the only thing that is going to be changed.
+    /// <para> <strong>Sample request body</strong> </para> 
+    /// ```json
+    ///
+    ///  {
+    ///    "id": 23523,
+    ///    "fullName": "Maria Ionescu",
+    ///    "phoneNr": "0721234234",
+    ///    "drivingCategory": "A2",
+    ///    "requestDate": "2025-10-12",
+    ///    "status": "APPROVED"
+    ///  }
+    /// 
+    /// ```
+    /// </remarks>
+    /// <response code="200">Request updated successfully.</response>
+    /// <response code="400">RequestId or the new Status was not a valid value</response>>
+    /// <response code="401">No valid JWT supplied.</response>
+    /// <response code="403">User is forbidden from seeing the requests of this auto school.</response>
+
+
+    [HttpPut("update/{requestId}")]
+    public async Task<IActionResult> UpdateRequestStatus(int requestId, RequestDto requestDto)
path: DriveFlow-CRM-API/Controllers/RequestController.cs
user: login: whos-gabi
body: La fel ca in DB, se va trimite fisrt si last name aparte.
created_at: 2025-05-03T20:26:16Z
author_association: CONTRIBUTOR
diff_hunk: @@ -0,0 +1,286 @@
+﻿using Microsoft.AspNetCore.Authorization;
+using Microsoft.AspNetCore.Mvc;
+using Microsoft.EntityFrameworkCore;
+using DriveFlow_CRM_API.Models;
+using Microsoft.AspNetCore.Identity;
+using System.Security.Claims;
+
+namespace DriveFlow_CRM_API.Controllers;
+
+[ApiController]
+[Route("api/[controller]")]
+public class RequestController : ControllerBase
+{
+
+    // ───────────────────────────── fields & ctor ─────────────────────────────
+    private readonly ApplicationDbContext _db;
+    private readonly UserManager<ApplicationUser> _users;
+    private readonly RoleManager<IdentityRole> _roles;
+
+    /// <summary>Constructor invoked per request by DI.</summary>
+    public RequestController(
+        ApplicationDbContext db,
+        UserManager<ApplicationUser> users,
+        RoleManager<IdentityRole> roles)
+    {
+        _db = db;
+        _users = users;
+        _roles = roles;
+    }
+
+
+
+
+    // ────────────────────────────── CREATE REQUEST ──────────────────────────────
+
+    /// <summary>Create a new enrollment Request for someone wishing to start their courses (Student, SchoolAdmin, SuperAdmin only).</summary>
+    /// <remarks> SchoolAdmin's SchoolId must match the AutoSchoolId given as method paramether.
+    /// <para> <strong>Sample Request body</strong> </para> 
+    /// ```json
+    ///
+    ///{
+    ///  "requestId": 23523,
+    ///  "fullName": "Maria Ionescu",
+    ///  "phoneNr": "0721234234",
+    ///  "drivingCategory": "A2",
+    ///  "requestDate": "2025-10-12T00:00:00Z",
+    ///  "status": "PENDING",
+    ///  "autoSchoolId": 1
+    ///}
+    /// ```
+    /// </remarks>
+    /// <response code="200">Request sent succesffully.</response>
+    /// <response code="400">Empty request</response>>
+    /// <response code="401">No valid JWT supplied.</response>
+    /// <response code="403">User is forbidden from seeing the requests of this auto school.</response>
+
+    [HttpPost("createRequest/{RequestDto}")]
+    [Authorize(Roles = "Student,SchoolAdmin,SuperAdmin")]
+    public async Task<IActionResult> CreateRequest([FromBody] RequestDto requestDto)
+    {
+        if (requestDto == null)
+            return BadRequest("Request data is required.");
+        var user = await _users.GetUserAsync(User);   
+        if(user == null)
+            return Unauthorized("User not found.");
+        if (User.IsInRole("SchoolAdmin") &&  user.AutoSchoolId != requestDto.AutoSchoolId)
+            return Forbid("You are not authorized to create requests for this auto school.");
+
+        //Name must be split and assigned to FirstName and LastName
+        //User may have multiple surnames
+        string[] tokens = requestDto.FullName.Split(' ');
+        var newRequest = new Request
+        {
+            FirstName = tokens.Length==2 ? tokens.First() : string.Join(" ", tokens.Take(tokens.Length - 1)),
+            LastName = tokens.Last(),
+            PhoneNumber = requestDto.PhoneNr,
+            DrivingCategory = requestDto.DrivingCategory,
+            RequestDate = DateTime.UtcNow,
+            Status = "Pending",
+            AutoSchoolId = requestDto.AutoSchoolId,
+        };
+        await _db.Requests.AddAsync(newRequest);
+        await _db.SaveChangesAsync();
+        return Ok("Request was sent successfully!");
+    }
+
+
+
+
+
+
+
+    /// ────────────────────────────── FETCH SCHOOL REQUESTS ──────────────────────────────
+    /// <summary>Returns all student enrollment requests for the appropriate school id, (SchoolAdmin, SuperAdmin only).</summary>
+    /// <remarks>
+    /// If the user is a SchoolAdmin, then his SchoolId must match the parameter SchoolId.
+    /// 
+    /// <para> <strong>Sample output</strong> </para> 
+    /// ```json
+    ///
+    ///    [
+    ///      {
+    ///    "requestId": 91249,
+    ///    "fullName": "Maria Ionescu",
+    ///    "phoneNr": "0721234567",
+    ///    "drivingCategory": "A2",
+    ///    "requestDate": "2025-10-12T00:00:00Z",
+    ///    "status": "PENDING"
+    ///  },
+    ///  {
+    ///    "requestId": 23523,
+    ///    "fullName": "Ion Popescu",
+    ///    "phoneNr": "0729876543",
+    ///    "drivingCategory": "B",
+    ///    "requestDate": "2025-10-15T00:00:00Z",
+    ///    "status": "APPROVED"
+    ///  },
+    ///  {
+    ///    "requestId": 34567,
+    ///    "fullName": "Elena Georgescu",
+    ///    "phoneNr": "0734567890",
+    ///    "drivingCategory": "C",
+    ///    "requestDate": "2025-10-20T00:00:00Z",
+    ///    "status": "REJECTED"
+    ///  }
+    ///]
+    /// ```
+    /// </remarks>
+    /// <returns>
+    /// A list of all the requested RequestDTO items.
+    /// </returns>
+    /// <response code="200">Requests Array returned successfully.</response>
+    /// <response code="400">School id was not a valid value</response>>
+    /// <response code="401">No valid JWT supplied.</response>
+    /// <response code="403">User is forbidden from seeing the requests of this auto school.</response>
+
+    [HttpGet("get/{AutoSchoolId:int}")]
+    [Authorize(Roles = "SuperAdmin,SchoolAdmin")]
+    public async Task<IActionResult> FetchSchoolRequests(int AutoSchoolId)
+    {
+        if (AutoSchoolId <= 0)
+            return BadRequest();
+
+        var user = await _users.GetUserAsync(User);
+        if (user == null)
+            return Unauthorized("User not found.");
+
+        if (!(User.IsInRole("SchoolAdmin") && user.AutoSchoolId == AutoSchoolId))
+            return Forbid("You are not authorized to view this school's requests.");
+
+        var Requests = await _db.Requests
+            .AsNoTracking()
+            .Where(r => r.AutoSchoolId == AutoSchoolId)
+            .OrderBy(r => r.RequestId)
+            .Select(r => new RequestDto
+            {
+                RequestId = r.RequestId,
+                FullName = r.FirstName + " " + r.LastName,
+                PhoneNr = r.PhoneNumber,
+                DrivingCategory = r.DrivingCategory,
+                RequestDate = r.RequestDate,
+                Status = r.Status
+            })
+            .ToListAsync();
+        return Ok(Requests);
+    }
+
+
+    // ────────────────────────────── UPDATE REQUEST ──────────────────────────────
+    /// <summary>Update the status of a request (SchoolAdmin, SuperAdmin only).</summary>
+    /// <remarks>
+    /// If the user is a SchoolAdmin, then his SchoolId must match the parameter SchoolId.
+    /// The only status values allowed are: APPROVED, REJECTED, PENDING.
+    /// That's the only thing that is going to be changed.
+    /// <para> <strong>Sample request body</strong> </para> 
+    /// ```json
+    ///
+    ///  {
+    ///    "id": 23523,
+    ///    "fullName": "Maria Ionescu",
+    ///    "phoneNr": "0721234234",
+    ///    "drivingCategory": "A2",
+    ///    "requestDate": "2025-10-12",
+    ///    "status": "APPROVED"
+    ///  }
+    /// 
+    /// ```
+    /// </remarks>
+    /// <response code="200">Request updated successfully.</response>
+    /// <response code="400">RequestId or the new Status was not a valid value</response>>
+    /// <response code="401">No valid JWT supplied.</response>
+    /// <response code="403">User is forbidden from seeing the requests of this auto school.</response>
+
+
+    [HttpPut("update/{requestId}")]
+    public async Task<IActionResult> UpdateRequestStatus(int requestId, RequestDto requestDto)
+    {
+        if (requestId <= 0)
+            return BadRequest("Invalid request ID.");
+
+        if( requestDto== null)
+        {
+            return BadRequest("Request data is required.");
+        }
+
+        var user = await _users.GetUserAsync(User);
+        if (user == null)
+            return Unauthorized("User not found.");
+        if (!(User.IsInRole("SchoolAdmin") && user.AutoSchoolId == requestId))
+            return Forbid("You are not authorized to update this request.");
+
+        var request = await _db.Requests.FindAsync(requestId);
+        if (request == null)
+            return NotFound("Request not found.");
+
+        request.Status = requestDto.Status; // Update the status of the request, that's all we do here.
+
+        await _db.SaveChangesAsync();
+        return Ok("Request status updated successfully.");
+    }
+
+
+    // ────────────────────────────── DELETE REQUEST ──────────────────────────────
+    /// <summary>Delete a request (SchoolAdmin, SuperAdmin only).</summary>
+    ///<remarks> <para> <strong>Sample output</strong> </para> 
+    /// ```json
+    ///
+    /// [
+    ///  {
+    ///    "id": 91249,
+    ///    "fullName": "Maria Ionescu",
+    ///    "phoneNr": "0721234567",
+    ///    "drivingCategory": "A2",
+    ///    "requestDate": "2025-10-12",
+    ///    "status": "PENDING"
+    ///  },
+    ///  {
+    ///    "id": 23523,
+    ///    "fullName": "Maria Ionescu",
+    ///    "phoneNr": "0721234234",
+    ///    "drivingCategory": "A2",
+    ///    "requestDate": "2025-10-12",
+    ///    "status": "PENDING"
+    ///  }
+    /// ]
+    /// ```
+    /// </remarks>
+    /// <response code="200">Requests deleted successfully.</response>
+    /// <response code="400">Request does not exist</response>
+    /// <response code="401">No valid JWT supplied.</response>
+    /// <response code="403">User is forbidden from seeing the requests of this auto school.</response>
+
+    [HttpDelete("delete/{requestId}")]
+    [Authorize(Roles = "SchoolAdmin,SuperAdmin")]
+
+    public async Task<IActionResult> DeleteRequest(int requestId)
path: DriveFlow-CRM-API/Controllers/RequestController.cs
user: login: whos-gabi
body: Nu se va trimite Dto pentru delete, si poti te rog sa pastrezi runa in formatul asta:`api/request/delete/{requestId}/deleteRequest`

Se va trimite doar id-ul
created_at: 2025-05-03T20:27:52Z
author_association: CONTRIBUTOR
diff_hunk: @@ -0,0 +1,286 @@
+﻿using Microsoft.AspNetCore.Authorization;
+using Microsoft.AspNetCore.Mvc;
+using Microsoft.EntityFrameworkCore;
+using DriveFlow_CRM_API.Models;
+using Microsoft.AspNetCore.Identity;
+using System.Security.Claims;
+
+namespace DriveFlow_CRM_API.Controllers;
+
+[ApiController]
+[Route("api/[controller]")]
path: DriveFlow-CRM-API/Controllers/RequestController.cs
user: login: GtJohnny
body: Understood
created_at: 2025-05-03T20:35:29Z
author_association: CONTRIBUTOR
diff_hunk: @@ -0,0 +1,15 @@
+﻿using Microsoft.AspNetCore.Mvc;
+
+namespace DriveFlow_CRM_API.Controllers
+{
+ 
+    
+       
+    public class FileController : Controller
+    {
+        public IActionResult Index()
+        {
+            return View();
path: DriveFlow-CRM-API/Controllers/FileController.cs
user: login: GtJohnny
body: Se modifica.
Also, sigur nu e nevoie de FileController? Inseamna ca nu am inteles eu conventia de rutare.
![image](https://github.com/user-attachments/assets/1e72b84f-631d-43ef-93fb-6f5fac773c36)

created_at: 2025-05-03T20:36:28Z
author_association: CONTRIBUTOR
diff_hunk: @@ -0,0 +1,15 @@
+﻿using Microsoft.AspNetCore.Mvc;
+
+namespace DriveFlow_CRM_API.Controllers
+{
+ 
+    
+       
+    public class FileController : Controller
+    {
+        public IActionResult Index()
+        {
+            return View();
path: DriveFlow-CRM-API/Controllers/FileController.cs
user: login: whos-gabi
body: Pai da, e nevoie, dar asta e din alt card, nu? Din `Student Driving File Management`.
Am crezut ca e pentru enrollment requests.
created_at: 2025-05-03T20:40:15Z
author_association: CONTRIBUTOR
diff_hunk: @@ -0,0 +1,286 @@
+﻿using Microsoft.AspNetCore.Authorization;
+using Microsoft.AspNetCore.Mvc;
+using Microsoft.EntityFrameworkCore;
+using DriveFlow_CRM_API.Models;
+using Microsoft.AspNetCore.Identity;
+using System.Security.Claims;
+
+namespace DriveFlow_CRM_API.Controllers;
+
+[ApiController]
+[Route("api/[controller]")]
+public class RequestController : ControllerBase
+{
+
+    // ───────────────────────────── fields & ctor ─────────────────────────────
+    private readonly ApplicationDbContext _db;
+    private readonly UserManager<ApplicationUser> _users;
+    private readonly RoleManager<IdentityRole> _roles;
+
+    /// <summary>Constructor invoked per request by DI.</summary>
+    public RequestController(
+        ApplicationDbContext db,
+        UserManager<ApplicationUser> users,
+        RoleManager<IdentityRole> roles)
+    {
+        _db = db;
+        _users = users;
+        _roles = roles;
+    }
+
+
+
+
+    // ────────────────────────────── CREATE REQUEST ──────────────────────────────
+
+    /// <summary>Create a new enrollment Request for someone wishing to start their courses (Student, SchoolAdmin, SuperAdmin only).</summary>
+    /// <remarks> SchoolAdmin's SchoolId must match the AutoSchoolId given as method paramether.
+    /// <para> <strong>Sample Request body</strong> </para> 
+    /// ```json
+    ///
+    ///{
+    ///  "requestId": 23523,
+    ///  "fullName": "Maria Ionescu",
+    ///  "phoneNr": "0721234234",
+    ///  "drivingCategory": "A2",
+    ///  "requestDate": "2025-10-12T00:00:00Z",
+    ///  "status": "PENDING",
+    ///  "autoSchoolId": 1
+    ///}
+    /// ```
+    /// </remarks>
+    /// <response code="200">Request sent succesffully.</response>
+    /// <response code="400">Empty request</response>>
+    /// <response code="401">No valid JWT supplied.</response>
+    /// <response code="403">User is forbidden from seeing the requests of this auto school.</response>
+
+    [HttpPost("createRequest/{RequestDto}")]
+    [Authorize(Roles = "Student,SchoolAdmin,SuperAdmin")]
path: DriveFlow-CRM-API/Controllers/RequestController.cs
user: login: GtJohnny
body: > Deci trebuie sa fie acceptat fara validare pe userType

Are mai mult sens, eu m-am luat dupa ce scrie pe board cu roluri.
Atunci scot autorizarea.
created_at: 2025-05-03T20:40:17Z
author_association: CONTRIBUTOR
diff_hunk: @@ -0,0 +1,15 @@
+﻿using Microsoft.AspNetCore.Mvc;
+
+namespace DriveFlow_CRM_API.Controllers
+{
+ 
+    
+       
+    public class FileController : Controller
+    {
+        public IActionResult Index()
+        {
+            return View();
path: DriveFlow-CRM-API/Controllers/FileController.cs
user: login: GtJohnny
body: Da... practic am terminat cu enrollment si am facut celalalt task inainte sa dau git checkout, acum sunt pe task-ul cu files. O sa caut sa le separ mai cu atentie.
created_at: 2025-05-03T20:42:27Z
author_association: CONTRIBUTOR
diff_hunk: @@ -0,0 +1,286 @@
+﻿using Microsoft.AspNetCore.Authorization;
+using Microsoft.AspNetCore.Mvc;
+using Microsoft.EntityFrameworkCore;
+using DriveFlow_CRM_API.Models;
+using Microsoft.AspNetCore.Identity;
+using System.Security.Claims;
+
+namespace DriveFlow_CRM_API.Controllers;
+
+[ApiController]
+[Route("api/[controller]")]
+public class RequestController : ControllerBase
+{
+
+    // ───────────────────────────── fields & ctor ─────────────────────────────
+    private readonly ApplicationDbContext _db;
+    private readonly UserManager<ApplicationUser> _users;
+    private readonly RoleManager<IdentityRole> _roles;
+
+    /// <summary>Constructor invoked per request by DI.</summary>
+    public RequestController(
+        ApplicationDbContext db,
+        UserManager<ApplicationUser> users,
+        RoleManager<IdentityRole> roles)
+    {
+        _db = db;
+        _users = users;
+        _roles = roles;
+    }
+
+
+
+
+    // ────────────────────────────── CREATE REQUEST ──────────────────────────────
+
+    /// <summary>Create a new enrollment Request for someone wishing to start their courses (Student, SchoolAdmin, SuperAdmin only).</summary>
+    /// <remarks> SchoolAdmin's SchoolId must match the AutoSchoolId given as method paramether.
+    /// <para> <strong>Sample Request body</strong> </para> 
+    /// ```json
+    ///
+    ///{
+    ///  "requestId": 23523,
+    ///  "fullName": "Maria Ionescu",
+    ///  "phoneNr": "0721234234",
+    ///  "drivingCategory": "A2",
+    ///  "requestDate": "2025-10-12T00:00:00Z",
+    ///  "status": "PENDING",
+    ///  "autoSchoolId": 1
+    ///}
+    /// ```
+    /// </remarks>
+    /// <response code="200">Request sent succesffully.</response>
+    /// <response code="400">Empty request</response>>
+    /// <response code="401">No valid JWT supplied.</response>
+    /// <response code="403">User is forbidden from seeing the requests of this auto school.</response>
+
+    [HttpPost("createRequest/{RequestDto}")]
+    [Authorize(Roles = "Student,SchoolAdmin,SuperAdmin")]
+    public async Task<IActionResult> CreateRequest([FromBody] RequestDto requestDto)
+    {
+        if (requestDto == null)
+            return BadRequest("Request data is required.");
+        var user = await _users.GetUserAsync(User);   
+        if(user == null)
+            return Unauthorized("User not found.");
+        if (User.IsInRole("SchoolAdmin") &&  user.AutoSchoolId != requestDto.AutoSchoolId)
+            return Forbid("You are not authorized to create requests for this auto school.");
+
+        //Name must be split and assigned to FirstName and LastName
+        //User may have multiple surnames
+        string[] tokens = requestDto.FullName.Split(' ');
+        var newRequest = new Request
+        {
+            FirstName = tokens.Length==2 ? tokens.First() : string.Join(" ", tokens.Take(tokens.Length - 1)),
+            LastName = tokens.Last(),
+            PhoneNumber = requestDto.PhoneNr,
+            DrivingCategory = requestDto.DrivingCategory,
+            RequestDate = DateTime.UtcNow,
+            Status = "Pending",
+            AutoSchoolId = requestDto.AutoSchoolId,
+        };
+        await _db.Requests.AddAsync(newRequest);
+        await _db.SaveChangesAsync();
+        return Ok("Request was sent successfully!");
+    }
+
+
+
+
+
+
+
+    /// ────────────────────────────── FETCH SCHOOL REQUESTS ──────────────────────────────
+    /// <summary>Returns all student enrollment requests for the appropriate school id, (SchoolAdmin, SuperAdmin only).</summary>
+    /// <remarks>
+    /// If the user is a SchoolAdmin, then his SchoolId must match the parameter SchoolId.
+    /// 
+    /// <para> <strong>Sample output</strong> </para> 
+    /// ```json
+    ///
+    ///    [
+    ///      {
+    ///    "requestId": 91249,
+    ///    "fullName": "Maria Ionescu",
+    ///    "phoneNr": "0721234567",
+    ///    "drivingCategory": "A2",
+    ///    "requestDate": "2025-10-12T00:00:00Z",
+    ///    "status": "PENDING"
+    ///  },
+    ///  {
+    ///    "requestId": 23523,
+    ///    "fullName": "Ion Popescu",
+    ///    "phoneNr": "0729876543",
+    ///    "drivingCategory": "B",
+    ///    "requestDate": "2025-10-15T00:00:00Z",
+    ///    "status": "APPROVED"
+    ///  },
+    ///  {
+    ///    "requestId": 34567,
+    ///    "fullName": "Elena Georgescu",
+    ///    "phoneNr": "0734567890",
+    ///    "drivingCategory": "C",
+    ///    "requestDate": "2025-10-20T00:00:00Z",
+    ///    "status": "REJECTED"
+    ///  }
+    ///]
+    /// ```
+    /// </remarks>
+    /// <returns>
+    /// A list of all the requested RequestDTO items.
+    /// </returns>
+    /// <response code="200">Requests Array returned successfully.</response>
+    /// <response code="400">School id was not a valid value</response>>
+    /// <response code="401">No valid JWT supplied.</response>
+    /// <response code="403">User is forbidden from seeing the requests of this auto school.</response>
+
+    [HttpGet("get/{AutoSchoolId:int}")]
+    [Authorize(Roles = "SuperAdmin,SchoolAdmin")]
+    public async Task<IActionResult> FetchSchoolRequests(int AutoSchoolId)
+    {
+        if (AutoSchoolId <= 0)
+            return BadRequest();
+
+        var user = await _users.GetUserAsync(User);
+        if (user == null)
+            return Unauthorized("User not found.");
+
+        if (!(User.IsInRole("SchoolAdmin") && user.AutoSchoolId == AutoSchoolId))
+            return Forbid("You are not authorized to view this school's requests.");
+
+        var Requests = await _db.Requests
+            .AsNoTracking()
+            .Where(r => r.AutoSchoolId == AutoSchoolId)
+            .OrderBy(r => r.RequestId)
+            .Select(r => new RequestDto
+            {
+                RequestId = r.RequestId,
+                FullName = r.FirstName + " " + r.LastName,
path: DriveFlow-CRM-API/Controllers/RequestController.cs
user: login: GtJohnny
body: Understood.
created_at: 2025-05-03T20:47:22Z
author_association: CONTRIBUTOR
diff_hunk: @@ -0,0 +1,286 @@
+﻿using Microsoft.AspNetCore.Authorization;
+using Microsoft.AspNetCore.Mvc;
+using Microsoft.EntityFrameworkCore;
+using DriveFlow_CRM_API.Models;
+using Microsoft.AspNetCore.Identity;
+using System.Security.Claims;
+
+namespace DriveFlow_CRM_API.Controllers;
+
+[ApiController]
+[Route("api/[controller]")]
+public class RequestController : ControllerBase
+{
+
+    // ───────────────────────────── fields & ctor ─────────────────────────────
+    private readonly ApplicationDbContext _db;
+    private readonly UserManager<ApplicationUser> _users;
+    private readonly RoleManager<IdentityRole> _roles;
+
+    /// <summary>Constructor invoked per request by DI.</summary>
+    public RequestController(
+        ApplicationDbContext db,
+        UserManager<ApplicationUser> users,
+        RoleManager<IdentityRole> roles)
+    {
+        _db = db;
+        _users = users;
+        _roles = roles;
+    }
+
+
+
+
+    // ────────────────────────────── CREATE REQUEST ──────────────────────────────
+
+    /// <summary>Create a new enrollment Request for someone wishing to start their courses (Student, SchoolAdmin, SuperAdmin only).</summary>
+    /// <remarks> SchoolAdmin's SchoolId must match the AutoSchoolId given as method paramether.
+    /// <para> <strong>Sample Request body</strong> </para> 
+    /// ```json
+    ///
+    ///{
+    ///  "requestId": 23523,
+    ///  "fullName": "Maria Ionescu",
+    ///  "phoneNr": "0721234234",
+    ///  "drivingCategory": "A2",
+    ///  "requestDate": "2025-10-12T00:00:00Z",
+    ///  "status": "PENDING",
+    ///  "autoSchoolId": 1
+    ///}
+    /// ```
+    /// </remarks>
+    /// <response code="200">Request sent succesffully.</response>
+    /// <response code="400">Empty request</response>>
+    /// <response code="401">No valid JWT supplied.</response>
+    /// <response code="403">User is forbidden from seeing the requests of this auto school.</response>
+
+    [HttpPost("createRequest/{RequestDto}")]
+    [Authorize(Roles = "Student,SchoolAdmin,SuperAdmin")]
path: DriveFlow-CRM-API/Controllers/RequestController.cs
user: login: GtJohnny
body: ![image](https://github.com/user-attachments/assets/f53222ae-7c39-43e8-b719-6d37097525c9)
> ar trebui sa se trimita si school id-ul in ruta de POST, intru cat trebuie pentru inset. Nu trebuie luat din Dto.

Deci asa, e ok?
created_at: 2025-05-03T20:56:36Z
author_association: CONTRIBUTOR
diff_hunk: @@ -0,0 +1,286 @@
+﻿using Microsoft.AspNetCore.Authorization;
+using Microsoft.AspNetCore.Mvc;
+using Microsoft.EntityFrameworkCore;
+using DriveFlow_CRM_API.Models;
+using Microsoft.AspNetCore.Identity;
+using System.Security.Claims;
+
+namespace DriveFlow_CRM_API.Controllers;
+
+[ApiController]
+[Route("api/[controller]")]
+public class RequestController : ControllerBase
+{
+
+    // ───────────────────────────── fields & ctor ─────────────────────────────
+    private readonly ApplicationDbContext _db;
+    private readonly UserManager<ApplicationUser> _users;
+    private readonly RoleManager<IdentityRole> _roles;
+
+    /// <summary>Constructor invoked per request by DI.</summary>
+    public RequestController(
+        ApplicationDbContext db,
+        UserManager<ApplicationUser> users,
+        RoleManager<IdentityRole> roles)
+    {
+        _db = db;
+        _users = users;
+        _roles = roles;
+    }
+
+
+
+
+    // ────────────────────────────── CREATE REQUEST ──────────────────────────────
+
+    /// <summary>Create a new enrollment Request for someone wishing to start their courses (Student, SchoolAdmin, SuperAdmin only).</summary>
+    /// <remarks> SchoolAdmin's SchoolId must match the AutoSchoolId given as method paramether.
+    /// <para> <strong>Sample Request body</strong> </para> 
+    /// ```json
+    ///
+    ///{
+    ///  "requestId": 23523,
+    ///  "fullName": "Maria Ionescu",
+    ///  "phoneNr": "0721234234",
+    ///  "drivingCategory": "A2",
+    ///  "requestDate": "2025-10-12T00:00:00Z",
+    ///  "status": "PENDING",
+    ///  "autoSchoolId": 1
+    ///}
+    /// ```
+    /// </remarks>
+    /// <response code="200">Request sent succesffully.</response>
+    /// <response code="400">Empty request</response>>
+    /// <response code="401">No valid JWT supplied.</response>
+    /// <response code="403">User is forbidden from seeing the requests of this auto school.</response>
+
+    [HttpPost("createRequest/{RequestDto}")]
+    [Authorize(Roles = "Student,SchoolAdmin,SuperAdmin")]
+    public async Task<IActionResult> CreateRequest([FromBody] RequestDto requestDto)
+    {
+        if (requestDto == null)
+            return BadRequest("Request data is required.");
+        var user = await _users.GetUserAsync(User);   
+        if(user == null)
+            return Unauthorized("User not found.");
+        if (User.IsInRole("SchoolAdmin") &&  user.AutoSchoolId != requestDto.AutoSchoolId)
+            return Forbid("You are not authorized to create requests for this auto school.");
+
+        //Name must be split and assigned to FirstName and LastName
+        //User may have multiple surnames
+        string[] tokens = requestDto.FullName.Split(' ');
+        var newRequest = new Request
+        {
+            FirstName = tokens.Length==2 ? tokens.First() : string.Join(" ", tokens.Take(tokens.Length - 1)),
+            LastName = tokens.Last(),
+            PhoneNumber = requestDto.PhoneNr,
+            DrivingCategory = requestDto.DrivingCategory,
+            RequestDate = DateTime.UtcNow,
+            Status = "Pending",
+            AutoSchoolId = requestDto.AutoSchoolId,
+        };
+        await _db.Requests.AddAsync(newRequest);
+        await _db.SaveChangesAsync();
+        return Ok("Request was sent successfully!");
+    }
+
+
+
+
+
+
+
+    /// ────────────────────────────── FETCH SCHOOL REQUESTS ──────────────────────────────
+    /// <summary>Returns all student enrollment requests for the appropriate school id, (SchoolAdmin, SuperAdmin only).</summary>
+    /// <remarks>
+    /// If the user is a SchoolAdmin, then his SchoolId must match the parameter SchoolId.
+    /// 
+    /// <para> <strong>Sample output</strong> </para> 
+    /// ```json
+    ///
+    ///    [
+    ///      {
+    ///    "requestId": 91249,
+    ///    "fullName": "Maria Ionescu",
+    ///    "phoneNr": "0721234567",
+    ///    "drivingCategory": "A2",
+    ///    "requestDate": "2025-10-12T00:00:00Z",
+    ///    "status": "PENDING"
+    ///  },
+    ///  {
+    ///    "requestId": 23523,
+    ///    "fullName": "Ion Popescu",
+    ///    "phoneNr": "0729876543",
+    ///    "drivingCategory": "B",
+    ///    "requestDate": "2025-10-15T00:00:00Z",
+    ///    "status": "APPROVED"
+    ///  },
+    ///  {
+    ///    "requestId": 34567,
+    ///    "fullName": "Elena Georgescu",
+    ///    "phoneNr": "0734567890",
+    ///    "drivingCategory": "C",
+    ///    "requestDate": "2025-10-20T00:00:00Z",
+    ///    "status": "REJECTED"
+    ///  }
+    ///]
+    /// ```
+    /// </remarks>
+    /// <returns>
+    /// A list of all the requested RequestDTO items.
+    /// </returns>
+    /// <response code="200">Requests Array returned successfully.</response>
+    /// <response code="400">School id was not a valid value</response>>
+    /// <response code="401">No valid JWT supplied.</response>
+    /// <response code="403">User is forbidden from seeing the requests of this auto school.</response>
+
+    [HttpGet("get/{AutoSchoolId:int}")]
+    [Authorize(Roles = "SuperAdmin,SchoolAdmin")]
+    public async Task<IActionResult> FetchSchoolRequests(int AutoSchoolId)
+    {
+        if (AutoSchoolId <= 0)
+            return BadRequest();
+
+        var user = await _users.GetUserAsync(User);
+        if (user == null)
+            return Unauthorized("User not found.");
+
+        if (!(User.IsInRole("SchoolAdmin") && user.AutoSchoolId == AutoSchoolId))
+            return Forbid("You are not authorized to view this school's requests.");
+
+        var Requests = await _db.Requests
+            .AsNoTracking()
+            .Where(r => r.AutoSchoolId == AutoSchoolId)
+            .OrderBy(r => r.RequestId)
+            .Select(r => new RequestDto
+            {
+                RequestId = r.RequestId,
+                FullName = r.FirstName + " " + r.LastName,
+                PhoneNr = r.PhoneNumber,
+                DrivingCategory = r.DrivingCategory,
+                RequestDate = r.RequestDate,
+                Status = r.Status
+            })
+            .ToListAsync();
+        return Ok(Requests);
+    }
+
+
+    // ────────────────────────────── UPDATE REQUEST ──────────────────────────────
+    /// <summary>Update the status of a request (SchoolAdmin, SuperAdmin only).</summary>
+    /// <remarks>
+    /// If the user is a SchoolAdmin, then his SchoolId must match the parameter SchoolId.
+    /// The only status values allowed are: APPROVED, REJECTED, PENDING.
+    /// That's the only thing that is going to be changed.
+    /// <para> <strong>Sample request body</strong> </para> 
+    /// ```json
+    ///
+    ///  {
+    ///    "id": 23523,
+    ///    "fullName": "Maria Ionescu",
+    ///    "phoneNr": "0721234234",
+    ///    "drivingCategory": "A2",
+    ///    "requestDate": "2025-10-12",
+    ///    "status": "APPROVED"
+    ///  }
+    /// 
+    /// ```
+    /// </remarks>
+    /// <response code="200">Request updated successfully.</response>
+    /// <response code="400">RequestId or the new Status was not a valid value</response>>
+    /// <response code="401">No valid JWT supplied.</response>
+    /// <response code="403">User is forbidden from seeing the requests of this auto school.</response>
+
+
+    [HttpPut("update/{requestId}")]
+    public async Task<IActionResult> UpdateRequestStatus(int requestId, RequestDto requestDto)
+    {
+        if (requestId <= 0)
+            return BadRequest("Invalid request ID.");
+
+        if( requestDto== null)
+        {
+            return BadRequest("Request data is required.");
+        }
+
+        var user = await _users.GetUserAsync(User);
+        if (user == null)
+            return Unauthorized("User not found.");
+        if (!(User.IsInRole("SchoolAdmin") && user.AutoSchoolId == requestId))
+            return Forbid("You are not authorized to update this request.");
+
+        var request = await _db.Requests.FindAsync(requestId);
+        if (request == null)
+            return NotFound("Request not found.");
+
+        request.Status = requestDto.Status; // Update the status of the request, that's all we do here.
+
+        await _db.SaveChangesAsync();
+        return Ok("Request status updated successfully.");
+    }
+
+
+    // ────────────────────────────── DELETE REQUEST ──────────────────────────────
+    /// <summary>Delete a request (SchoolAdmin, SuperAdmin only).</summary>
+    ///<remarks> <para> <strong>Sample output</strong> </para> 
+    /// ```json
+    ///
+    /// [
+    ///  {
+    ///    "id": 91249,
+    ///    "fullName": "Maria Ionescu",
+    ///    "phoneNr": "0721234567",
+    ///    "drivingCategory": "A2",
+    ///    "requestDate": "2025-10-12",
+    ///    "status": "PENDING"
+    ///  },
+    ///  {
+    ///    "id": 23523,
+    ///    "fullName": "Maria Ionescu",
+    ///    "phoneNr": "0721234234",
+    ///    "drivingCategory": "A2",
+    ///    "requestDate": "2025-10-12",
+    ///    "status": "PENDING"
+    ///  }
+    /// ]
+    /// ```
+    /// </remarks>
+    /// <response code="200">Requests deleted successfully.</response>
+    /// <response code="400">Request does not exist</response>
+    /// <response code="401">No valid JWT supplied.</response>
+    /// <response code="403">User is forbidden from seeing the requests of this auto school.</response>
+
+    [HttpDelete("delete/{requestId}")]
+    [Authorize(Roles = "SchoolAdmin,SuperAdmin")]
+
+    public async Task<IActionResult> DeleteRequest(int requestId)
path: DriveFlow-CRM-API/Controllers/RequestController.cs
user: login: GtJohnny
body: La Delete nu am dat Dto, doar mesaj Ok 200.
![image](https://github.com/user-attachments/assets/fdae6ff6-7538-4c08-b61b-4d37117a6fc1)

Am modificat totusi formatul.
created_at: 2025-05-03T21:00:22Z
author_association: CONTRIBUTOR
diff_hunk: @@ -0,0 +1,286 @@
+﻿using Microsoft.AspNetCore.Authorization;
+using Microsoft.AspNetCore.Mvc;
+using Microsoft.EntityFrameworkCore;
+using DriveFlow_CRM_API.Models;
+using Microsoft.AspNetCore.Identity;
+using System.Security.Claims;
+
+namespace DriveFlow_CRM_API.Controllers;
+
+[ApiController]
+[Route("api/[controller]")]
+public class RequestController : ControllerBase
+{
+
+    // ───────────────────────────── fields & ctor ─────────────────────────────
+    private readonly ApplicationDbContext _db;
+    private readonly UserManager<ApplicationUser> _users;
+    private readonly RoleManager<IdentityRole> _roles;
+
+    /// <summary>Constructor invoked per request by DI.</summary>
+    public RequestController(
+        ApplicationDbContext db,
+        UserManager<ApplicationUser> users,
+        RoleManager<IdentityRole> roles)
+    {
+        _db = db;
+        _users = users;
+        _roles = roles;
+    }
+
+
+
+
+    // ────────────────────────────── CREATE REQUEST ──────────────────────────────
+
+    /// <summary>Create a new enrollment Request for someone wishing to start their courses (Student, SchoolAdmin, SuperAdmin only).</summary>
+    /// <remarks> SchoolAdmin's SchoolId must match the AutoSchoolId given as method paramether.
+    /// <para> <strong>Sample Request body</strong> </para> 
+    /// ```json
+    ///
+    ///{
+    ///  "requestId": 23523,
+    ///  "fullName": "Maria Ionescu",
+    ///  "phoneNr": "0721234234",
+    ///  "drivingCategory": "A2",
+    ///  "requestDate": "2025-10-12T00:00:00Z",
+    ///  "status": "PENDING",
+    ///  "autoSchoolId": 1
+    ///}
+    /// ```
+    /// </remarks>
+    /// <response code="200">Request sent succesffully.</response>
+    /// <response code="400">Empty request</response>>
+    /// <response code="401">No valid JWT supplied.</response>
+    /// <response code="403">User is forbidden from seeing the requests of this auto school.</response>
+
+    [HttpPost("createRequest/{RequestDto}")]
+    [Authorize(Roles = "Student,SchoolAdmin,SuperAdmin")]
+    public async Task<IActionResult> CreateRequest([FromBody] RequestDto requestDto)
+    {
+        if (requestDto == null)
+            return BadRequest("Request data is required.");
+        var user = await _users.GetUserAsync(User);   
+        if(user == null)
+            return Unauthorized("User not found.");
+        if (User.IsInRole("SchoolAdmin") &&  user.AutoSchoolId != requestDto.AutoSchoolId)
+            return Forbid("You are not authorized to create requests for this auto school.");
+
+        //Name must be split and assigned to FirstName and LastName
+        //User may have multiple surnames
+        string[] tokens = requestDto.FullName.Split(' ');
+        var newRequest = new Request
+        {
+            FirstName = tokens.Length==2 ? tokens.First() : string.Join(" ", tokens.Take(tokens.Length - 1)),
+            LastName = tokens.Last(),
+            PhoneNumber = requestDto.PhoneNr,
+            DrivingCategory = requestDto.DrivingCategory,
+            RequestDate = DateTime.UtcNow,
+            Status = "Pending",
+            AutoSchoolId = requestDto.AutoSchoolId,
+        };
+        await _db.Requests.AddAsync(newRequest);
+        await _db.SaveChangesAsync();
+        return Ok("Request was sent successfully!");
+    }
+
+
+
+
+
+
+
+    /// ────────────────────────────── FETCH SCHOOL REQUESTS ──────────────────────────────
+    /// <summary>Returns all student enrollment requests for the appropriate school id, (SchoolAdmin, SuperAdmin only).</summary>
+    /// <remarks>
+    /// If the user is a SchoolAdmin, then his SchoolId must match the parameter SchoolId.
+    /// 
+    /// <para> <strong>Sample output</strong> </para> 
+    /// ```json
+    ///
+    ///    [
+    ///      {
+    ///    "requestId": 91249,
+    ///    "fullName": "Maria Ionescu",
+    ///    "phoneNr": "0721234567",
+    ///    "drivingCategory": "A2",
+    ///    "requestDate": "2025-10-12T00:00:00Z",
+    ///    "status": "PENDING"
+    ///  },
+    ///  {
+    ///    "requestId": 23523,
+    ///    "fullName": "Ion Popescu",
+    ///    "phoneNr": "0729876543",
+    ///    "drivingCategory": "B",
+    ///    "requestDate": "2025-10-15T00:00:00Z",
+    ///    "status": "APPROVED"
+    ///  },
+    ///  {
+    ///    "requestId": 34567,
+    ///    "fullName": "Elena Georgescu",
+    ///    "phoneNr": "0734567890",
+    ///    "drivingCategory": "C",
+    ///    "requestDate": "2025-10-20T00:00:00Z",
+    ///    "status": "REJECTED"
+    ///  }
+    ///]
+    /// ```
+    /// </remarks>
+    /// <returns>
+    /// A list of all the requested RequestDTO items.
+    /// </returns>
+    /// <response code="200">Requests Array returned successfully.</response>
+    /// <response code="400">School id was not a valid value</response>>
+    /// <response code="401">No valid JWT supplied.</response>
+    /// <response code="403">User is forbidden from seeing the requests of this auto school.</response>
+
+    [HttpGet("get/{AutoSchoolId:int}")]
+    [Authorize(Roles = "SuperAdmin,SchoolAdmin")]
+    public async Task<IActionResult> FetchSchoolRequests(int AutoSchoolId)
+    {
+        if (AutoSchoolId <= 0)
+            return BadRequest();
+
+        var user = await _users.GetUserAsync(User);
+        if (user == null)
+            return Unauthorized("User not found.");
+
+        if (!(User.IsInRole("SchoolAdmin") && user.AutoSchoolId == AutoSchoolId))
+            return Forbid("You are not authorized to view this school's requests.");
+
+        var Requests = await _db.Requests
+            .AsNoTracking()
+            .Where(r => r.AutoSchoolId == AutoSchoolId)
+            .OrderBy(r => r.RequestId)
+            .Select(r => new RequestDto
+            {
+                RequestId = r.RequestId,
+                FullName = r.FirstName + " " + r.LastName,
+                PhoneNr = r.PhoneNumber,
+                DrivingCategory = r.DrivingCategory,
+                RequestDate = r.RequestDate,
+                Status = r.Status
+            })
+            .ToListAsync();
+        return Ok(Requests);
+    }
+
+
+    // ────────────────────────────── UPDATE REQUEST ──────────────────────────────
+    /// <summary>Update the status of a request (SchoolAdmin, SuperAdmin only).</summary>
+    /// <remarks>
+    /// If the user is a SchoolAdmin, then his SchoolId must match the parameter SchoolId.
+    /// The only status values allowed are: APPROVED, REJECTED, PENDING.
+    /// That's the only thing that is going to be changed.
+    /// <para> <strong>Sample request body</strong> </para> 
+    /// ```json
+    ///
+    ///  {
+    ///    "id": 23523,
+    ///    "fullName": "Maria Ionescu",
+    ///    "phoneNr": "0721234234",
+    ///    "drivingCategory": "A2",
+    ///    "requestDate": "2025-10-12",
+    ///    "status": "APPROVED"
+    ///  }
+    /// 
+    /// ```
+    /// </remarks>
+    /// <response code="200">Request updated successfully.</response>
+    /// <response code="400">RequestId or the new Status was not a valid value</response>>
+    /// <response code="401">No valid JWT supplied.</response>
+    /// <response code="403">User is forbidden from seeing the requests of this auto school.</response>
+
+
+    [HttpPut("update/{requestId}")]
+    public async Task<IActionResult> UpdateRequestStatus(int requestId, RequestDto requestDto)
path: DriveFlow-CRM-API/Controllers/RequestController.cs
user: login: GtJohnny
body: Understood, am modificat RequestDto.
created_at: 2025-05-03T21:02:02Z
author_association: CONTRIBUTOR
path: DriveFlow-CRM-API/Controllers/FileController.cs
user: login: whos-gabi
body: Are sens /requests sa fie in FileController?
created_at: 2025-05-03T21:30:16Z
author_association: CONTRIBUTOR
diff_hunk: @@ -0,0 +1,286 @@
+﻿using Microsoft.AspNetCore.Authorization;
+using Microsoft.AspNetCore.Mvc;
+using Microsoft.EntityFrameworkCore;
+using DriveFlow_CRM_API.Models;
+using Microsoft.AspNetCore.Identity;
+using System.Security.Claims;
+
+namespace DriveFlow_CRM_API.Controllers;
+
+[ApiController]
+[Route("api/[controller]")]
path: DriveFlow-CRM-API/Controllers/RequestController.cs
user: login: whos-gabi
body: tot asa ai lasat?
created_at: 2025-05-03T21:31:18Z
author_association: CONTRIBUTOR
diff_hunk: @@ -0,0 +1,286 @@
+﻿using Microsoft.AspNetCore.Authorization;
+using Microsoft.AspNetCore.Mvc;
+using Microsoft.EntityFrameworkCore;
+using DriveFlow_CRM_API.Models;
+using Microsoft.AspNetCore.Identity;
+using System.Security.Claims;
+
+namespace DriveFlow_CRM_API.Controllers;
+
+[ApiController]
+[Route("api/[controller]")]
path: DriveFlow-CRM-API/Controllers/RequestController.cs
user: login: whos-gabi
body: schimba [Route("api/[controller]")] in [Route("api/request")]
created_at: 2025-05-03T21:31:49Z
author_association: CONTRIBUTOR
diff_hunk: @@ -0,0 +1,290 @@
+﻿using Microsoft.AspNetCore.Authorization;
+using Microsoft.AspNetCore.Mvc;
+using Microsoft.EntityFrameworkCore;
+using DriveFlow_CRM_API.Models;
+using Microsoft.AspNetCore.Identity;
+using System.Security.Claims;
+
+namespace DriveFlow_CRM_API.Controllers;
+
+[ApiController]
+[Route("api/[controller]")]
+public class RequestController : ControllerBase
+{
+
+    // ───────────────────────────── fields & ctor ─────────────────────────────
+    private readonly ApplicationDbContext _db;
+    private readonly UserManager<ApplicationUser> _users;
+    private readonly RoleManager<IdentityRole> _roles;
+
+    /// <summary>Constructor invoked per request by DI.</summary>
+    public RequestController(
+        ApplicationDbContext db,
+        UserManager<ApplicationUser> users,
+        RoleManager<IdentityRole> roles)
+    {
+        _db = db;
+        _users = users;
+        _roles = roles;
+    }
+
+
+
+
+    // ────────────────────────────── CREATE REQUEST ──────────────────────────────
+
+    /// <summary>Create a new enrollment Request for someone wishing to start their courses (Student, SchoolAdmin, SuperAdmin only).</summary>
+    /// <remarks> SchoolAdmin's SchoolId must match the AutoSchoolId given as method paramether.
+    /// <para> <strong>Sample Request body</strong> </para> 
+    /// ```json
+    ///
+    ///{
+    ///  "requestId": 23523,
+    ///  "fullName": "Maria Ionescu",
path: DriveFlow-CRM-API/Controllers/RequestController.cs
user: login: whos-gabi
body: first si last name, aparte...
created_at: 2025-05-03T21:32:35Z
author_association: CONTRIBUTOR
diff_hunk: @@ -0,0 +1,290 @@
+﻿using Microsoft.AspNetCore.Authorization;
+using Microsoft.AspNetCore.Mvc;
+using Microsoft.EntityFrameworkCore;
+using DriveFlow_CRM_API.Models;
+using Microsoft.AspNetCore.Identity;
+using System.Security.Claims;
+
+namespace DriveFlow_CRM_API.Controllers;
+
+[ApiController]
+[Route("api/[controller]")]
+public class RequestController : ControllerBase
+{
+
+    // ───────────────────────────── fields & ctor ─────────────────────────────
+    private readonly ApplicationDbContext _db;
+    private readonly UserManager<ApplicationUser> _users;
+    private readonly RoleManager<IdentityRole> _roles;
+
+    /// <summary>Constructor invoked per request by DI.</summary>
+    public RequestController(
+        ApplicationDbContext db,
+        UserManager<ApplicationUser> users,
+        RoleManager<IdentityRole> roles)
+    {
+        _db = db;
+        _users = users;
+        _roles = roles;
+    }
+
+
+
+
+    // ────────────────────────────── CREATE REQUEST ──────────────────────────────
+
+    /// <summary>Create a new enrollment Request for someone wishing to start their courses (Student, SchoolAdmin, SuperAdmin only).</summary>
+    /// <remarks> SchoolAdmin's SchoolId must match the AutoSchoolId given as method paramether.
+    /// <para> <strong>Sample Request body</strong> </para> 
+    /// ```json
+    ///
+    ///{
+    ///  "requestId": 23523,
+    ///  "fullName": "Maria Ionescu",
path: DriveFlow-CRM-API/Controllers/RequestController.cs
user: login: whos-gabi
body: si nu primeste id la POST (la creare), primeste restul atributelor
created_at: 2025-05-03T21:33:09Z
author_association: CONTRIBUTOR
diff_hunk: @@ -0,0 +1,290 @@
+﻿using Microsoft.AspNetCore.Authorization;
+using Microsoft.AspNetCore.Mvc;
+using Microsoft.EntityFrameworkCore;
+using DriveFlow_CRM_API.Models;
+using Microsoft.AspNetCore.Identity;
+using System.Security.Claims;
+
+namespace DriveFlow_CRM_API.Controllers;
+
+[ApiController]
+[Route("api/[controller]")]
+public class RequestController : ControllerBase
+{
+
+    // ───────────────────────────── fields & ctor ─────────────────────────────
+    private readonly ApplicationDbContext _db;
+    private readonly UserManager<ApplicationUser> _users;
+    private readonly RoleManager<IdentityRole> _roles;
+
+    /// <summary>Constructor invoked per request by DI.</summary>
+    public RequestController(
+        ApplicationDbContext db,
+        UserManager<ApplicationUser> users,
+        RoleManager<IdentityRole> roles)
+    {
+        _db = db;
+        _users = users;
+        _roles = roles;
+    }
+
+
+
+
+    // ────────────────────────────── CREATE REQUEST ──────────────────────────────
+
+    /// <summary>Create a new enrollment Request for someone wishing to start their courses (Student, SchoolAdmin, SuperAdmin only).</summary>
+    /// <remarks> SchoolAdmin's SchoolId must match the AutoSchoolId given as method paramether.
+    /// <para> <strong>Sample Request body</strong> </para> 
+    /// ```json
+    ///
+    ///{
+    ///  "requestId": 23523,
+    ///  "fullName": "Maria Ionescu",
+    ///  "phoneNr": "0721234234",
+    ///  "drivingCategory": "A2",
+    ///  "requestDate": "2025-10-12T00:00:00Z",
+    ///  "status": "PENDING",
+    ///  "autoSchoolId": 1
+    ///}
+    /// ```
+    /// </remarks>
+    /// <response code="200">Request sent succesffully.</response>
+    /// <response code="400">Empty request</response>>
+    /// <response code="401">No valid JWT supplied.</response>
+    /// <response code="403">User is forbidden from seeing the requests of this auto school.</response>
+
+    [HttpPost("createRequest/{schoolId}/{RequestDto}/CreateRequest")]
path: DriveFlow-CRM-API/Controllers/RequestController.cs
user: login: whos-gabi
body: Ce tine de Dto, nu stiu daca e bine trimis asa in url ca parametru, sa nu fie interpretat gresit cant apelez ruta. Anyway pt clean code uite un exemplu:
`[HttpPost("create")]                   // POST api/address/create
    [Authorize(Roles = "SuperAdmin")]
    public async Task<IActionResult> CreateAddressAsync([FromBody] AddressCreateDto dto)`

Aici nu e ca param in endpoint, doar in from body.
    
    
created_at: 2025-05-03T21:38:39Z
author_association: CONTRIBUTOR
diff_hunk: @@ -0,0 +1,290 @@
+﻿using Microsoft.AspNetCore.Authorization;
+using Microsoft.AspNetCore.Mvc;
+using Microsoft.EntityFrameworkCore;
+using DriveFlow_CRM_API.Models;
+using Microsoft.AspNetCore.Identity;
+using System.Security.Claims;
+
+namespace DriveFlow_CRM_API.Controllers;
+
+[ApiController]
+[Route("api/[controller]")]
+public class RequestController : ControllerBase
+{
+
+    // ───────────────────────────── fields & ctor ─────────────────────────────
+    private readonly ApplicationDbContext _db;
+    private readonly UserManager<ApplicationUser> _users;
+    private readonly RoleManager<IdentityRole> _roles;
+
+    /// <summary>Constructor invoked per request by DI.</summary>
+    public RequestController(
+        ApplicationDbContext db,
+        UserManager<ApplicationUser> users,
+        RoleManager<IdentityRole> roles)
+    {
+        _db = db;
+        _users = users;
+        _roles = roles;
+    }
+
+
+
+
+    // ────────────────────────────── CREATE REQUEST ──────────────────────────────
+
+    /// <summary>Create a new enrollment Request for someone wishing to start their courses (Student, SchoolAdmin, SuperAdmin only).</summary>
+    /// <remarks> SchoolAdmin's SchoolId must match the AutoSchoolId given as method paramether.
+    /// <para> <strong>Sample Request body</strong> </para> 
+    /// ```json
+    ///
+    ///{
+    ///  "requestId": 23523,
+    ///  "fullName": "Maria Ionescu",
+    ///  "phoneNr": "0721234234",
+    ///  "drivingCategory": "A2",
+    ///  "requestDate": "2025-10-12T00:00:00Z",
+    ///  "status": "PENDING",
+    ///  "autoSchoolId": 1
+    ///}
+    /// ```
+    /// </remarks>
+    /// <response code="200">Request sent succesffully.</response>
+    /// <response code="400">Empty request</response>>
+    /// <response code="401">No valid JWT supplied.</response>
+    /// <response code="403">User is forbidden from seeing the requests of this auto school.</response>
+
+    [HttpPost("createRequest/{schoolId}/{RequestDto}/CreateRequest")]
+    public async Task<IActionResult> CreateRequest(int schoolId, [FromBody] RequestDto requestDto)
+    {
+        if(schoolId <= 0)
+            return BadRequest("Invalid school ID.");
+        if (requestDto == null)
+            return BadRequest("Request data is required.");
+        var user = await _users.GetUserAsync(User);   
+        if(user == null)
+            return Unauthorized("User not found.");
+        //if (User.IsInRole("SchoolAdmin") &&  user.AutoSchoolId != requestDto.AutoSchoolId)
+        //    return Forbid("You are not authorized to create requests for this auto school.");
+
+
+        var newRequest = new Request
+        {
+            FirstName = requestDto.FirstName,
+            LastName =requestDto.LastName,
+            PhoneNumber = requestDto.PhoneNr,
+            DrivingCategory = requestDto.DrivingCategory,
+            RequestDate = DateTime.UtcNow,
+            Status = "Pending",
+            AutoSchoolId = schoolId,
+        };
+        await _db.Requests.AddAsync(newRequest);
+        await _db.SaveChangesAsync();
+        return Ok("Request was sent successfully!");
+    }
+
+
+
+
+
+
+
+    /// ────────────────────────────── FETCH SCHOOL REQUESTS ──────────────────────────────
+    /// <summary>Returns all student enrollment requests for the appropriate school id, (SchoolAdmin, SuperAdmin only).</summary>
+    /// <remarks>
+    /// If the user is a SchoolAdmin, then his SchoolId must match the parameter SchoolId.
+    /// 
+    /// <para> <strong>Sample output</strong> </para> 
+    /// ```json
+    ///
+    ///    [
+    ///      {
+    ///    "requestId": 91249,
+    ///    "fullName": "Maria Ionescu",
path: DriveFlow-CRM-API/Controllers/RequestController.cs
user: login: whos-gabi
body: refactor, first last name separat...
created_at: 2025-05-03T21:39:13Z
author_association: CONTRIBUTOR
diff_hunk: @@ -0,0 +1,286 @@
+﻿using Microsoft.AspNetCore.Authorization;
+using Microsoft.AspNetCore.Mvc;
+using Microsoft.EntityFrameworkCore;
+using DriveFlow_CRM_API.Models;
+using Microsoft.AspNetCore.Identity;
+using System.Security.Claims;
+
+namespace DriveFlow_CRM_API.Controllers;
+
+[ApiController]
+[Route("api/[controller]")]
+public class RequestController : ControllerBase
+{
+
+    // ───────────────────────────── fields & ctor ─────────────────────────────
+    private readonly ApplicationDbContext _db;
+    private readonly UserManager<ApplicationUser> _users;
+    private readonly RoleManager<IdentityRole> _roles;
+
+    /// <summary>Constructor invoked per request by DI.</summary>
+    public RequestController(
+        ApplicationDbContext db,
+        UserManager<ApplicationUser> users,
+        RoleManager<IdentityRole> roles)
+    {
+        _db = db;
+        _users = users;
+        _roles = roles;
+    }
+
+
+
+
+    // ────────────────────────────── CREATE REQUEST ──────────────────────────────
+
+    /// <summary>Create a new enrollment Request for someone wishing to start their courses (Student, SchoolAdmin, SuperAdmin only).</summary>
+    /// <remarks> SchoolAdmin's SchoolId must match the AutoSchoolId given as method paramether.
+    /// <para> <strong>Sample Request body</strong> </para> 
+    /// ```json
+    ///
+    ///{
+    ///  "requestId": 23523,
+    ///  "fullName": "Maria Ionescu",
+    ///  "phoneNr": "0721234234",
+    ///  "drivingCategory": "A2",
+    ///  "requestDate": "2025-10-12T00:00:00Z",
+    ///  "status": "PENDING",
+    ///  "autoSchoolId": 1
+    ///}
+    /// ```
+    /// </remarks>
+    /// <response code="200">Request sent succesffully.</response>
+    /// <response code="400">Empty request</response>>
+    /// <response code="401">No valid JWT supplied.</response>
+    /// <response code="403">User is forbidden from seeing the requests of this auto school.</response>
+
+    [HttpPost("createRequest/{RequestDto}")]
+    [Authorize(Roles = "Student,SchoolAdmin,SuperAdmin")]
+    public async Task<IActionResult> CreateRequest([FromBody] RequestDto requestDto)
+    {
+        if (requestDto == null)
+            return BadRequest("Request data is required.");
+        var user = await _users.GetUserAsync(User);   
+        if(user == null)
+            return Unauthorized("User not found.");
+        if (User.IsInRole("SchoolAdmin") &&  user.AutoSchoolId != requestDto.AutoSchoolId)
+            return Forbid("You are not authorized to create requests for this auto school.");
+
+        //Name must be split and assigned to FirstName and LastName
+        //User may have multiple surnames
+        string[] tokens = requestDto.FullName.Split(' ');
+        var newRequest = new Request
+        {
+            FirstName = tokens.Length==2 ? tokens.First() : string.Join(" ", tokens.Take(tokens.Length - 1)),
+            LastName = tokens.Last(),
+            PhoneNumber = requestDto.PhoneNr,
+            DrivingCategory = requestDto.DrivingCategory,
+            RequestDate = DateTime.UtcNow,
+            Status = "Pending",
+            AutoSchoolId = requestDto.AutoSchoolId,
+        };
+        await _db.Requests.AddAsync(newRequest);
+        await _db.SaveChangesAsync();
+        return Ok("Request was sent successfully!");
+    }
+
+
+
+
+
+
+
+    /// ────────────────────────────── FETCH SCHOOL REQUESTS ──────────────────────────────
+    /// <summary>Returns all student enrollment requests for the appropriate school id, (SchoolAdmin, SuperAdmin only).</summary>
+    /// <remarks>
+    /// If the user is a SchoolAdmin, then his SchoolId must match the parameter SchoolId.
+    /// 
+    /// <para> <strong>Sample output</strong> </para> 
+    /// ```json
+    ///
+    ///    [
+    ///      {
+    ///    "requestId": 91249,
+    ///    "fullName": "Maria Ionescu",
+    ///    "phoneNr": "0721234567",
+    ///    "drivingCategory": "A2",
+    ///    "requestDate": "2025-10-12T00:00:00Z",
+    ///    "status": "PENDING"
+    ///  },
+    ///  {
+    ///    "requestId": 23523,
+    ///    "fullName": "Ion Popescu",
+    ///    "phoneNr": "0729876543",
+    ///    "drivingCategory": "B",
+    ///    "requestDate": "2025-10-15T00:00:00Z",
+    ///    "status": "APPROVED"
+    ///  },
+    ///  {
+    ///    "requestId": 34567,
+    ///    "fullName": "Elena Georgescu",
+    ///    "phoneNr": "0734567890",
+    ///    "drivingCategory": "C",
+    ///    "requestDate": "2025-10-20T00:00:00Z",
+    ///    "status": "REJECTED"
+    ///  }
+    ///]
+    /// ```
+    /// </remarks>
+    /// <returns>
+    /// A list of all the requested RequestDTO items.
+    /// </returns>
+    /// <response code="200">Requests Array returned successfully.</response>
+    /// <response code="400">School id was not a valid value</response>>
+    /// <response code="401">No valid JWT supplied.</response>
+    /// <response code="403">User is forbidden from seeing the requests of this auto school.</response>
+
+    [HttpGet("get/{AutoSchoolId:int}")]
+    [Authorize(Roles = "SuperAdmin,SchoolAdmin")]
+    public async Task<IActionResult> FetchSchoolRequests(int AutoSchoolId)
+    {
+        if (AutoSchoolId <= 0)
+            return BadRequest();
+
+        var user = await _users.GetUserAsync(User);
+        if (user == null)
+            return Unauthorized("User not found.");
+
+        if (!(User.IsInRole("SchoolAdmin") && user.AutoSchoolId == AutoSchoolId))
+            return Forbid("You are not authorized to view this school's requests.");
+
+        var Requests = await _db.Requests
+            .AsNoTracking()
+            .Where(r => r.AutoSchoolId == AutoSchoolId)
+            .OrderBy(r => r.RequestId)
+            .Select(r => new RequestDto
+            {
+                RequestId = r.RequestId,
+                FullName = r.FirstName + " " + r.LastName,
+                PhoneNr = r.PhoneNumber,
+                DrivingCategory = r.DrivingCategory,
+                RequestDate = r.RequestDate,
+                Status = r.Status
+            })
+            .ToListAsync();
+        return Ok(Requests);
+    }
+
+
+    // ────────────────────────────── UPDATE REQUEST ──────────────────────────────
+    /// <summary>Update the status of a request (SchoolAdmin, SuperAdmin only).</summary>
+    /// <remarks>
+    /// If the user is a SchoolAdmin, then his SchoolId must match the parameter SchoolId.
+    /// The only status values allowed are: APPROVED, REJECTED, PENDING.
+    /// That's the only thing that is going to be changed.
+    /// <para> <strong>Sample request body</strong> </para> 
+    /// ```json
+    ///
+    ///  {
+    ///    "id": 23523,
+    ///    "fullName": "Maria Ionescu",
+    ///    "phoneNr": "0721234234",
+    ///    "drivingCategory": "A2",
+    ///    "requestDate": "2025-10-12",
+    ///    "status": "APPROVED"
+    ///  }
+    /// 
+    /// ```
+    /// </remarks>
+    /// <response code="200">Request updated successfully.</response>
+    /// <response code="400">RequestId or the new Status was not a valid value</response>>
+    /// <response code="401">No valid JWT supplied.</response>
+    /// <response code="403">User is forbidden from seeing the requests of this auto school.</response>
+
+
+    [HttpPut("update/{requestId}")]
+    public async Task<IActionResult> UpdateRequestStatus(int requestId, RequestDto requestDto)
path: DriveFlow-CRM-API/Controllers/RequestController.cs
user: login: whos-gabi
body: `UpdateRequestStatus -> updateRequestStatus`
In rest e okey

created_at: 2025-05-03T21:40:51Z
author_association: CONTRIBUTOR
path: DriveFlow-CRM-API/Controllers/FileController.cs
user: login: GtJohnny
body: Corect, am facut branch checkout-ul din Enrollment nu din main, editez acum sa fie separat, deja sunt si eu confuz la atat back and forth.
created_at: 2025-05-03T21:44:13Z
author_association: CONTRIBUTOR
diff_hunk: @@ -0,0 +1,290 @@
+﻿using Microsoft.AspNetCore.Authorization;
+using Microsoft.AspNetCore.Mvc;
+using Microsoft.EntityFrameworkCore;
+using DriveFlow_CRM_API.Models;
+using Microsoft.AspNetCore.Identity;
+using System.Security.Claims;
+
+namespace DriveFlow_CRM_API.Controllers;
+
+[ApiController]
+[Route("api/[controller]")]
+public class RequestController : ControllerBase
+{
+
+    // ───────────────────────────── fields & ctor ─────────────────────────────
+    private readonly ApplicationDbContext _db;
+    private readonly UserManager<ApplicationUser> _users;
+    private readonly RoleManager<IdentityRole> _roles;
+
+    /// <summary>Constructor invoked per request by DI.</summary>
+    public RequestController(
+        ApplicationDbContext db,
+        UserManager<ApplicationUser> users,
+        RoleManager<IdentityRole> roles)
+    {
+        _db = db;
+        _users = users;
+        _roles = roles;
+    }
+
+
+
+
+    // ────────────────────────────── CREATE REQUEST ──────────────────────────────
+
+    /// <summary>Create a new enrollment Request for someone wishing to start their courses (Student, SchoolAdmin, SuperAdmin only).</summary>
+    /// <remarks> SchoolAdmin's SchoolId must match the AutoSchoolId given as method paramether.
+    /// <para> <strong>Sample Request body</strong> </para> 
+    /// ```json
+    ///
+    ///{
+    ///  "requestId": 23523,
+    ///  "fullName": "Maria Ionescu",
path: DriveFlow-CRM-API/Controllers/RequestController.cs
user: login: GtJohnny
body: Nu am editat comentariul de sample.... imediat.
created_at: 2025-05-03T21:44:28Z
author_association: CONTRIBUTOR
path: DriveFlow-CRM-API/Controllers/FileController.cs
user: login: whos-gabi
body: Indeed 😭
created_at: 2025-05-03T21:48:37Z
author_association: CONTRIBUTOR
diff_hunk: @@ -0,0 +1,290 @@
+﻿using Microsoft.AspNetCore.Authorization;
+using Microsoft.AspNetCore.Mvc;
+using Microsoft.EntityFrameworkCore;
+using DriveFlow_CRM_API.Models;
+using Microsoft.AspNetCore.Identity;
+using System.Security.Claims;
+
+namespace DriveFlow_CRM_API.Controllers;
+
+[ApiController]
+[Route("api/[controller]")]
+public class RequestController : ControllerBase
+{
+
+    // ───────────────────────────── fields & ctor ─────────────────────────────
+    private readonly ApplicationDbContext _db;
+    private readonly UserManager<ApplicationUser> _users;
+    private readonly RoleManager<IdentityRole> _roles;
+
+    /// <summary>Constructor invoked per request by DI.</summary>
+    public RequestController(
+        ApplicationDbContext db,
+        UserManager<ApplicationUser> users,
+        RoleManager<IdentityRole> roles)
+    {
+        _db = db;
+        _users = users;
+        _roles = roles;
+    }
+
+
+
+
+    // ────────────────────────────── CREATE REQUEST ──────────────────────────────
+
+    /// <summary>Create a new enrollment Request for someone wishing to start their courses (Student, SchoolAdmin, SuperAdmin only).</summary>
+    /// <remarks> SchoolAdmin's SchoolId must match the AutoSchoolId given as method paramether.
+    /// <para> <strong>Sample Request body</strong> </para> 
+    /// ```json
+    ///
+    ///{
+    ///  "requestId": 23523,
+    ///  "fullName": "Maria Ionescu",
+    ///  "phoneNr": "0721234234",
+    ///  "drivingCategory": "A2",
+    ///  "requestDate": "2025-10-12T00:00:00Z",
+    ///  "status": "PENDING",
+    ///  "autoSchoolId": 1
+    ///}
+    /// ```
+    /// </remarks>
+    /// <response code="200">Request sent succesffully.</response>
+    /// <response code="400">Empty request</response>>
+    /// <response code="401">No valid JWT supplied.</response>
+    /// <response code="403">User is forbidden from seeing the requests of this auto school.</response>
+
+    [HttpPost("createRequest/{schoolId}/{RequestDto}/CreateRequest")]
path: DriveFlow-CRM-API/Controllers/RequestController.cs
user: login: GtJohnny
body: Da.... personal mi se pare putin ciudat ca in ruta avem parametrii inaintea numelui de actiune...
![image](https://github.com/user-attachments/assets/e036b8b6-121e-4c59-bb0f-7f7ac26c280d)
Si da.. cand ai zis ca trebuie sa fie si id-ul scholii pe langa Dto, eu m-am gandit atunci sa fie ca la metoda aceea de Put.. Imi spui cum preferi.

Another question, e mai ok sa Dto-ul cu tag-ul [FromForm] ?
created_at: 2025-05-03T21:51:54Z
author_association: CONTRIBUTOR
diff_hunk: @@ -0,0 +1,290 @@
+﻿using Microsoft.AspNetCore.Authorization;
+using Microsoft.AspNetCore.Mvc;
+using Microsoft.EntityFrameworkCore;
+using DriveFlow_CRM_API.Models;
+using Microsoft.AspNetCore.Identity;
+using System.Security.Claims;
+
+namespace DriveFlow_CRM_API.Controllers;
+
+[ApiController]
+[Route("api/[controller]")]
+public class RequestController : ControllerBase
+{
+
+    // ───────────────────────────── fields & ctor ─────────────────────────────
+    private readonly ApplicationDbContext _db;
+    private readonly UserManager<ApplicationUser> _users;
+    private readonly RoleManager<IdentityRole> _roles;
+
+    /// <summary>Constructor invoked per request by DI.</summary>
+    public RequestController(
+        ApplicationDbContext db,
+        UserManager<ApplicationUser> users,
+        RoleManager<IdentityRole> roles)
+    {
+        _db = db;
+        _users = users;
+        _roles = roles;
+    }
+
+
+
+
+    // ────────────────────────────── CREATE REQUEST ──────────────────────────────
+
+    /// <summary>Create a new enrollment Request for someone wishing to start their courses (Student, SchoolAdmin, SuperAdmin only).</summary>
+    /// <remarks> SchoolAdmin's SchoolId must match the AutoSchoolId given as method paramether.
+    /// <para> <strong>Sample Request body</strong> </para> 
+    /// ```json
+    ///
+    ///{
+    ///  "requestId": 23523,
+    ///  "fullName": "Maria Ionescu",
+    ///  "phoneNr": "0721234234",
+    ///  "drivingCategory": "A2",
+    ///  "requestDate": "2025-10-12T00:00:00Z",
+    ///  "status": "PENDING",
+    ///  "autoSchoolId": 1
+    ///}
+    /// ```
+    /// </remarks>
+    /// <response code="200">Request sent succesffully.</response>
+    /// <response code="400">Empty request</response>>
+    /// <response code="401">No valid JWT supplied.</response>
+    /// <response code="403">User is forbidden from seeing the requests of this auto school.</response>
+
+    [HttpPost("createRequest/{schoolId}/{RequestDto}/CreateRequest")]
+    public async Task<IActionResult> CreateRequest(int schoolId, [FromBody] RequestDto requestDto)
+    {
+        if(schoolId <= 0)
+            return BadRequest("Invalid school ID.");
+        if (requestDto == null)
+            return BadRequest("Request data is required.");
+        var user = await _users.GetUserAsync(User);   
+        if(user == null)
+            return Unauthorized("User not found.");
+        //if (User.IsInRole("SchoolAdmin") &&  user.AutoSchoolId != requestDto.AutoSchoolId)
+        //    return Forbid("You are not authorized to create requests for this auto school.");
+
+
+        var newRequest = new Request
+        {
+            FirstName = requestDto.FirstName,
+            LastName =requestDto.LastName,
+            PhoneNumber = requestDto.PhoneNr,
+            DrivingCategory = requestDto.DrivingCategory,
+            RequestDate = DateTime.UtcNow,
+            Status = "Pending",
+            AutoSchoolId = schoolId,
+        };
+        await _db.Requests.AddAsync(newRequest);
+        await _db.SaveChangesAsync();
+        return Ok("Request was sent successfully!");
+    }
+
+
+
+
+
+
+
+    /// ────────────────────────────── FETCH SCHOOL REQUESTS ──────────────────────────────
+    /// <summary>Returns all student enrollment requests for the appropriate school id, (SchoolAdmin, SuperAdmin only).</summary>
+    /// <remarks>
+    /// If the user is a SchoolAdmin, then his SchoolId must match the parameter SchoolId.
+    /// 
+    /// <para> <strong>Sample output</strong> </para> 
+    /// ```json
+    ///
+    ///    [
+    ///      {
+    ///    "requestId": 91249,
+    ///    "fullName": "Maria Ionescu",
path: DriveFlow-CRM-API/Controllers/RequestController.cs
user: login: GtJohnny
body: Done
created_at: 2025-05-03T22:01:44Z
author_association: CONTRIBUTOR

PR comments:
user: login: GtJohnny
created_at: 2025-05-03T20:34:34Z
body: Acum vad ce ai scris
Citesc si modific. 
In mare parte m-am luat dupa ce era deja scris in alte controllere :)
author_association: CONTRIBUTOR
user: login: GtJohnny
created_at: 2025-05-03T21:00:46Z
body: Am modificat tot ce mi-ai spus. Fac acum inca un push. Sa te uiti si sa imi spui daca e ok te rog.
author_association: CONTRIBUTOR
user: login: GtJohnny
created_at: 2025-05-03T21:54:30Z
body: O sa sterg cu totul FileController din branch-ul asta, e mai multa confuzie decat orice.

Si am facut refactor pe FullName -> First&Last Name
author_association: CONTRIBUTOR
user: login: GtJohnny
created_at: 2025-05-03T21:56:28Z
body: ![image](https://github.com/user-attachments/assets/0ec5a8a1-1c5e-4177-b84e-a4a29219727b)

Totodata am comentat si partea asta cu SchoolAdmin's must match the school, daca nu mai facem cu autorizare, poti sa scoti si din trello asta.
author_association: CONTRIBUTOR
user: login: GtJohnny
created_at: 2025-05-03T21:58:36Z
body: imediat si DTO din swagger ca acum am inteles la ce te refereai

author_association: CONTRIBUTOR