- intake_tokens table (server-only via service role)
- Server functions: createIntakeToken (admin), getIntakeToken (public validate),
submitIntake (public write + mark used, 14-day one-time tokens)
- Public /intake/$token full intake form (no login) with valid/used/expired states
- Student profile (admin): generate link, copy, and email-to-parent (mailto)
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Parents and teachers are now view-only on student data (profile, guardians,
pickups, curriculum logins). Writes restricted to admins in RLS and the UI;
read access unchanged. Portal logins for parents/students are view-only.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
- Migration: student intake fields (health, academic, dismissal, agreement),
student_guardians + student_curriculum_logins tables, extend authorized_pickups
(alt_phone, notes, kind) with RLS mirroring existing policies
- New /students/new full-page multi-section form (replaces the add dialog)
- Students list links to the full page; regenerate Supabase types
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
- Point .env + supabase/config.toml at EDU (qgmcpounpkgsjlwosjdi)
- Replace Lovable Google-OAuth shim with native supabase.auth.signInWithOAuth
- Remove src/integrations/lovable and @lovable.dev/cloud-auth-js dependency
- Drop .lovable metadata; gitignore supabase/.temp
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>