adminandClaude Opus 4.8
8880d7a805
Parents and teachers are now view-only on student data (profile, guardians, pickups, curriculum logins). Writes restricted to admins in RLS and the UI; read access unchanged. Portal logins for parents/students are view-only. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
16 lines
1.1 KiB
SQL
16 lines
1.1 KiB
SQL
-- Student profile data (guardians, pickups, curriculum logins) is admin-edit-only.
|
|
-- Reads are unchanged (parents/teachers/students keep their "... read" policies);
|
|
-- the students table itself is already admin-write via "admins manage students".
|
|
|
|
DROP POLICY IF EXISTS "guardians write parent or admin" ON public.student_guardians;
|
|
CREATE POLICY "guardians write admin" ON public.student_guardians FOR ALL TO authenticated
|
|
USING (public.current_user_has_role('admin')) WITH CHECK (public.current_user_has_role('admin'));
|
|
|
|
DROP POLICY IF EXISTS "pickups write parent or admin" ON public.authorized_pickups;
|
|
CREATE POLICY "pickups write admin" ON public.authorized_pickups FOR ALL TO authenticated
|
|
USING (public.current_user_has_role('admin')) WITH CHECK (public.current_user_has_role('admin'));
|
|
|
|
DROP POLICY IF EXISTS "curriculum write parent or admin" ON public.student_curriculum_logins;
|
|
CREATE POLICY "curriculum write admin" ON public.student_curriculum_logins FOR ALL TO authenticated
|
|
USING (public.current_user_has_role('admin')) WITH CHECK (public.current_user_has_role('admin'));
|