Adds the 7 Supabase tables (exam_templates, exam_questions, exam_response_areas,
exam_boundaries, marking_batches, student_submissions, mark_entries) with FKs,
indexes, updated_at triggers (reusing handle_updated_at), and inline RLS.
Authorization owned by this layer (exam API calls as-user): per-table service_role
passthrough + as-user policies scoped via user_institute_ids() (from 71); marks
readable by the owning teacher's batch and by the student themselves (UI deferred).
marking_batches.class_id FKs to public.classes (71).
Applied + verified on dev .94: 7 tables, RLS on, class_id FK valid, teacher can
insert+read a template under RLS. Stacked on feat/class-management-foundation.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
The classes/class_teachers/class_students/enrollment_requests tables existed
only on live dev (.94) with no tracked DDL, and RLS exposed class_students /
class_teachers to service_role ONLY — so any API path calling Supabase as the
user read zero rows.
- 71-class-management.sql captures the real schema (idempotent), adds SECURITY
DEFINER membership helpers, and adds as-user RLS policies (cs_read/cs_write,
ct_read/ct_write, classes_admin_write, er_class_staff) while preserving the
existing service_role / institute_read / er_own policies.
Applied + verified on dev .94: class teacher sees roster (1), unrelated teacher
denied (0), service_role unaffected (full). FKs/uniques/checks already present
on .94 (no constraint changes needed).
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
