fix: tighten API P0 auth and route handling

routers/database/tools/classes_router.py

@@ -230,6 +230,36 @@ async def my_student_classes(
     )
     return {"classes": res}
 
+@router.get("/school/students")
+async def list_school_students(
+    credentials: dict = Depends(SupabaseBearer()),
+) -> Dict[str, Any]:
+    """List all students in the caller's school. Used by admin to add students to a class."""
+    user_id = credentials.get("sub", "")
+    institute_id = _require_institute(user_id)
+    sb = _sb()
+    members = (
+        sb.supabase.table("institute_memberships")
+        .select("profile_id")
+        .eq("institute_id", institute_id)
+        .eq("role", "student")
+        .execute()
+        .data or []
+    )
+    student_ids = [m["profile_id"] for m in members]
+    if not student_ids:
+        return {"students": []}
+    profiles = (
+        sb.supabase.table("profiles")
+        .select("id, full_name, display_name, email, user_type")
+        .in_("id", student_ids)
+        .order("full_name")
+        .execute()
+        .data or []
+    )
+    return {"students": profiles}
+
+
 
 @router.get("/{class_id}")
 async def get_class(
@@ -459,35 +489,6 @@ async def remove_teacher(
     return {"status": "ok"}
 
 
-@router.get("/school/students")
-async def list_school_students(
-    credentials: dict = Depends(SupabaseBearer()),
-) -> Dict[str, Any]:
-    """List all students in the caller's school. Used by admin to add students to a class."""
-    user_id = credentials.get("sub", "")
-    institute_id = _require_institute(user_id)
-    sb = _sb()
-    members = (
-        sb.supabase.table("institute_memberships")
-        .select("profile_id")
-        .eq("institute_id", institute_id)
-        .eq("role", "student")
-        .execute()
-        .data or []
-    )
-    student_ids = [m["profile_id"] for m in members]
-    if not student_ids:
-        return {"students": []}
-    profiles = (
-        sb.supabase.table("profiles")
-        .select("id, full_name, display_name, email, user_type")
-        .in_("id", student_ids)
-        .order("full_name")
-        .execute()
-        .data or []
-    )
-    return {"students": profiles}
-
 
 @router.post("/{class_id}/students")
 async def add_student(