From 10314ddd62fc027ffb969037d14c76389219b530 Mon Sep 17 00:00:00 2001 From: kcar Date: Sat, 6 Jun 2026 16:11:52 +0000 Subject: [PATCH] feat(db): exam-marker operational tables + RLS (72-exam-marker.sql) Adds the 7 Supabase tables (exam_templates, exam_questions, exam_response_areas, exam_boundaries, marking_batches, student_submissions, mark_entries) with FKs, indexes, updated_at triggers (reusing handle_updated_at), and inline RLS. Authorization owned by this layer (exam API calls as-user): per-table service_role passthrough + as-user policies scoped via user_institute_ids() (from 71); marks readable by the owning teacher's batch and by the student themselves (UI deferred). marking_batches.class_id FKs to public.classes (71). Applied + verified on dev .94: 7 tables, RLS on, class_id FK valid, teacher can insert+read a template under RLS. Stacked on feat/class-management-foundation. Co-Authored-By: Claude Opus 4.8 --- volumes/db/cc/72-exam-marker.sql | 238 +++++++++++++++++++++++++++++++ 1 file changed, 238 insertions(+) create mode 100644 volumes/db/cc/72-exam-marker.sql diff --git a/volumes/db/cc/72-exam-marker.sql b/volumes/db/cc/72-exam-marker.sql new file mode 100644 index 0000000..6905c96 --- /dev/null +++ b/volumes/db/cc/72-exam-marker.sql @@ -0,0 +1,238 @@ +-- 72-exam-marker.sql +-- Exam-marker operational tables (Supabase = source of truth for geometry/marks/submissions). +-- Neo4j cc.public.exams holds the knowledge graph; joined by shared UUIDs (see spec §2). +-- +-- Authorization is owned by this layer: the exam API calls Supabase AS THE USER, so these RLS +-- policies are enforced (service_role policies cover the Neo4j-projection / seed paths only). +-- Depends on: 71-class-management.sql (marking_batches.class_id → classes; user_institute_ids()). + +--========================================================================================== +-- 1. Tables +--========================================================================================== + +create table if not exists public.exam_templates ( + id uuid primary key default gen_random_uuid(), + exam_id uuid references public.eb_exams(id) on delete set null, -- null for ad-hoc upload + exam_code text, -- denormalised → Neo4j join + institute_id uuid not null references public.institutes(id) on delete cascade, + teacher_id uuid not null references public.profiles(id) on delete cascade, + title text not null, + subject text, + source_file_id uuid references public.files(id) on delete set null, -- uploaded PDF (R2.2) + page_count int, + status text not null default 'draft' check (status in ('draft','ready','archived')), + created_at timestamptz not null default timezone('utc', now()), + updated_at timestamptz not null default timezone('utc', now()) +); + +create table if not exists public.exam_questions ( + id uuid primary key default gen_random_uuid(), + template_id uuid not null references public.exam_templates(id) on delete cascade, + parent_id uuid references public.exam_questions(id) on delete cascade, + label text not null, + "order" int not null default 0, + max_marks numeric not null default 0, + answer_type text check (answer_type in ('written','mcq','short','diagram')), + mcq_options jsonb, + mark_scheme jsonb not null default '{}'::jsonb, -- MarkScheme union from exam-marker types.ts + is_container boolean not null default false, -- true → Neo4j Question, false → Part + spec_ref text, -- manual spec-point tag → ASSESSES (R3.5.3) + created_at timestamptz not null default timezone('utc', now()), + updated_at timestamptz not null default timezone('utc', now()) +); + +create table if not exists public.exam_response_areas ( + id uuid primary key default gen_random_uuid(), -- == Neo4j Region.uuid_string + question_id uuid not null references public.exam_questions(id) on delete cascade, + template_id uuid not null references public.exam_templates(id) on delete cascade, -- RLS denorm + page int not null, + bounds jsonb not null, -- {x,y,w,h} + kind text not null check (kind in ('response','context')), + response_form text check (response_form in + ('lines','answer-box','working','diagram','tick-boxes','table','blanks')), + source text not null default 'manual' check (source in ('manual','ai')), + confirmed boolean not null default true, + confidence numeric, + created_at timestamptz not null default timezone('utc', now()) +); + +create table if not exists public.exam_boundaries ( + id uuid primary key default gen_random_uuid(), + template_id uuid not null references public.exam_templates(id) on delete cascade, + question_id uuid references public.exam_questions(id) on delete set null, + label text, + page_index int not null, + y numeric not null, + bounds jsonb, + source text not null default 'manual' check (source in ('manual','ai')), + confirmed boolean not null default true, + created_at timestamptz not null default timezone('utc', now()) +); + +create table if not exists public.marking_batches ( + id uuid primary key default gen_random_uuid(), + template_id uuid not null references public.exam_templates(id) on delete cascade, + class_id uuid references public.classes(id) on delete set null, -- roster via class_students + institute_id uuid not null references public.institutes(id) on delete cascade, + teacher_id uuid not null references public.profiles(id) on delete cascade, -- batch owner (R2.4) + title text, + status text not null default 'open' check (status in ('open','marking','complete','archived')), + created_at timestamptz not null default timezone('utc', now()), + updated_at timestamptz not null default timezone('utc', now()) +); + +create table if not exists public.student_submissions ( + id uuid primary key default gen_random_uuid(), + batch_id uuid not null references public.marking_batches(id) on delete cascade, + student_id uuid references public.profiles(id) on delete set null, -- null until matched + student_name text, + scan_file_id uuid references public.files(id) on delete set null, + scan_url text, + qr_code text, + matching_method text check (matching_method in ('ordered','ocr_name','qr_code','manual')), + match_confidence numeric, + page_start int, + page_count int, + status text not null default 'unmatched' + check (status in ('unmatched','matched','marking','complete','absent')), + annotation_snapshot jsonb, + created_at timestamptz not null default timezone('utc', now()), + updated_at timestamptz not null default timezone('utc', now()) +); + +create table if not exists public.mark_entries ( + id uuid primary key default gen_random_uuid(), + submission_id uuid not null references public.student_submissions(id) on delete cascade, + question_id uuid not null references public.exam_questions(id) on delete cascade, + batch_id uuid not null references public.marking_batches(id) on delete cascade, -- RLS denorm + awarded_marks numeric not null default 0, + mark_scheme_detail jsonb not null default '{}'::jsonb, + annotation_shape_ids jsonb not null default '[]'::jsonb, + comment text, + marked_by text not null default 'teacher' check (marked_by in ('teacher','ai')), + ai_confidence numeric, + confirmed boolean not null default true, + marked_at timestamptz not null default timezone('utc', now()) +); + +create index if not exists idx_exam_templates_institute on public.exam_templates(institute_id); +create index if not exists idx_exam_templates_teacher on public.exam_templates(teacher_id); +create index if not exists idx_exam_questions_template on public.exam_questions(template_id); +create index if not exists idx_exam_questions_parent on public.exam_questions(parent_id); +create index if not exists idx_exam_regions_question on public.exam_response_areas(question_id); +create index if not exists idx_exam_regions_template on public.exam_response_areas(template_id); +create index if not exists idx_exam_boundaries_template on public.exam_boundaries(template_id); +create index if not exists idx_batches_template on public.marking_batches(template_id); +create index if not exists idx_batches_institute on public.marking_batches(institute_id); +create index if not exists idx_submissions_batch on public.student_submissions(batch_id); +create index if not exists idx_marks_submission on public.mark_entries(submission_id); +create index if not exists idx_marks_batch on public.mark_entries(batch_id); + +--========================================================================================== +-- 2. updated_at triggers (reuse public.handle_updated_at from 62-functions-triggers.sql) +--========================================================================================== + +drop trigger if exists handle_exam_templates_updated_at on public.exam_templates; +create trigger handle_exam_templates_updated_at before update on public.exam_templates + for each row execute function public.handle_updated_at(); + +drop trigger if exists handle_exam_questions_updated_at on public.exam_questions; +create trigger handle_exam_questions_updated_at before update on public.exam_questions + for each row execute function public.handle_updated_at(); + +drop trigger if exists handle_marking_batches_updated_at on public.marking_batches; +create trigger handle_marking_batches_updated_at before update on public.marking_batches + for each row execute function public.handle_updated_at(); + +drop trigger if exists handle_student_submissions_updated_at on public.student_submissions; +create trigger handle_student_submissions_updated_at before update on public.student_submissions + for each row execute function public.handle_updated_at(); + +--========================================================================================== +-- 3. RLS — every table: a service_role passthrough (Neo4j projection / seeds) + as-user policies +--========================================================================================== + +alter table public.exam_templates enable row level security; +alter table public.exam_questions enable row level security; +alter table public.exam_response_areas enable row level security; +alter table public.exam_boundaries enable row level security; +alter table public.marking_batches enable row level security; +alter table public.student_submissions enable row level security; +alter table public.mark_entries enable row level security; + +-- exam_templates ------------------------------------------------------------------------- +drop policy if exists exam_templates_service on public.exam_templates; +create policy exam_templates_service on public.exam_templates using (auth.role() = 'service_role'); +drop policy if exists exam_templates_read on public.exam_templates; +create policy exam_templates_read on public.exam_templates for select to authenticated + using (institute_id in (select public.user_institute_ids())); +drop policy if exists exam_templates_write on public.exam_templates; +create policy exam_templates_write on public.exam_templates for all to authenticated + using (teacher_id = auth.uid() and institute_id in (select public.user_institute_ids())) + with check (teacher_id = auth.uid() and institute_id in (select public.user_institute_ids())); + +-- exam_questions / exam_response_areas / exam_boundaries: cascade authz from owning template +drop policy if exists exam_questions_service on public.exam_questions; +create policy exam_questions_service on public.exam_questions using (auth.role() = 'service_role'); +drop policy if exists exam_questions_all on public.exam_questions; +create policy exam_questions_all on public.exam_questions for all to authenticated + using (exists (select 1 from public.exam_templates t + where t.id = exam_questions.template_id + and t.institute_id in (select public.user_institute_ids()))) + with check (exists (select 1 from public.exam_templates t + where t.id = exam_questions.template_id and t.teacher_id = auth.uid())); + +drop policy if exists exam_regions_service on public.exam_response_areas; +create policy exam_regions_service on public.exam_response_areas using (auth.role() = 'service_role'); +drop policy if exists exam_regions_all on public.exam_response_areas; +create policy exam_regions_all on public.exam_response_areas for all to authenticated + using (exists (select 1 from public.exam_templates t + where t.id = exam_response_areas.template_id + and t.institute_id in (select public.user_institute_ids()))) + with check (exists (select 1 from public.exam_templates t + where t.id = exam_response_areas.template_id and t.teacher_id = auth.uid())); + +drop policy if exists exam_boundaries_service on public.exam_boundaries; +create policy exam_boundaries_service on public.exam_boundaries using (auth.role() = 'service_role'); +drop policy if exists exam_boundaries_all on public.exam_boundaries; +create policy exam_boundaries_all on public.exam_boundaries for all to authenticated + using (exists (select 1 from public.exam_templates t + where t.id = exam_boundaries.template_id + and t.institute_id in (select public.user_institute_ids()))) + with check (exists (select 1 from public.exam_templates t + where t.id = exam_boundaries.template_id and t.teacher_id = auth.uid())); + +-- marking_batches: read = same institute (colleagues), write = owning teacher (R2.4) +drop policy if exists marking_batches_service on public.marking_batches; +create policy marking_batches_service on public.marking_batches using (auth.role() = 'service_role'); +drop policy if exists marking_batches_read on public.marking_batches; +create policy marking_batches_read on public.marking_batches for select to authenticated + using (institute_id in (select public.user_institute_ids())); +drop policy if exists marking_batches_write on public.marking_batches; +create policy marking_batches_write on public.marking_batches for all to authenticated + using (teacher_id = auth.uid() and institute_id in (select public.user_institute_ids())) + with check (teacher_id = auth.uid() and institute_id in (select public.user_institute_ids())); + +-- student_submissions: authz cascades from batch ownership +drop policy if exists submissions_service on public.student_submissions; +create policy submissions_service on public.student_submissions using (auth.role() = 'service_role'); +drop policy if exists submissions_all on public.student_submissions; +create policy submissions_all on public.student_submissions for all to authenticated + using (exists (select 1 from public.marking_batches b + where b.id = student_submissions.batch_id and b.teacher_id = auth.uid())) + with check (exists (select 1 from public.marking_batches b + where b.id = student_submissions.batch_id and b.teacher_id = auth.uid())); + +-- mark_entries: teacher (batch owner) full; student may read their own marks (R1.5, UI deferred) +drop policy if exists marks_service on public.mark_entries; +create policy marks_service on public.mark_entries using (auth.role() = 'service_role'); +drop policy if exists marks_teacher_all on public.mark_entries; +create policy marks_teacher_all on public.mark_entries for all to authenticated + using (exists (select 1 from public.marking_batches b + where b.id = mark_entries.batch_id and b.teacher_id = auth.uid())) + with check (exists (select 1 from public.marking_batches b + where b.id = mark_entries.batch_id and b.teacher_id = auth.uid())); +drop policy if exists marks_student_read on public.mark_entries; +create policy marks_student_read on public.mark_entries for select to authenticated + using (exists (select 1 from public.student_submissions s + where s.id = mark_entries.submission_id and s.student_id = auth.uid()));