admin/info-share-spot
0
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Lock student profile editing to admins only

Browse Source 
Parents and teachers are now view-only on student data (profile, guardians,
pickups, curriculum logins). Writes restricted to admins in RLS and the UI;
read access unchanged. Portal logins for parents/students are view-only.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
This commit is contained in:
admin
2026-07-19 17:32:45 -04:00
co-authored by Claude Opus 4.8
parent 9020b214f3
commit 8880d7a805
2 changed files with 17 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
supabase/migrations/20260719213115_lock_student_data_admin_only.sql
+15
View File
@@ -0,0 +1,15 @@
-- Student profile data (guardians, pickups, curriculum logins) is admin-edit-only.
-- Reads are unchanged (parents/teachers/students keep their "... read" policies);
-- the students table itself is already admin-write via "admins manage students".
DROP POLICY IF EXISTS "guardians write parent or admin" ON public.student_guardians;
CREATE POLICY "guardians write admin" ON public.student_guardians FOR ALL TO authenticated
USING (public.current_user_has_role('admin')) WITH CHECK (public.current_user_has_role('admin'));
DROP POLICY IF EXISTS "pickups write parent or admin" ON public.authorized_pickups;
CREATE POLICY "pickups write admin" ON public.authorized_pickups FOR ALL TO authenticated
USING (public.current_user_has_role('admin')) WITH CHECK (public.current_user_has_role('admin'));
DROP POLICY IF EXISTS "curriculum write parent or admin" ON public.student_curriculum_logins;
CREATE POLICY "curriculum write admin" ON public.student_curriculum_logins FOR ALL TO authenticated
USING (public.current_user_has_role('admin')) WITH CHECK (public.current_user_has_role('admin'));