supabase

Go to file

kcar fcab68f57a feat(db): track class-management schema + add as-user RLS

The classes/class_teachers/class_students/enrollment_requests tables existed
only on live dev (.94) with no tracked DDL, and RLS exposed class_students /
class_teachers to service_role ONLY — so any API path calling Supabase as the
user read zero rows.

- 71-class-management.sql captures the real schema (idempotent), adds SECURITY
  DEFINER membership helpers, and adds as-user RLS policies (cs_read/cs_write,
  ct_read/ct_write, classes_admin_write, er_class_staff) while preserving the
  existing service_role / institute_read / er_own policies.

Applied + verified on dev .94: class teacher sees roster (1), unrelated teacher
denied (0), service_role unaffected (full). FKs/uniques/checks already present
on .94 (no constraint changes needed).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

2026-06-06 14:43:29 +00:00

.archive

cc changes back

2026-02-22 21:54:19 +00:00

.branches

latest

2025-11-14 14:46:49 +00:00

.gitea/workflows

ci: add supabase validation workflow

2026-05-27 23:21:48 +01:00

migrations

feat(supabase): add 9 application functions to migrations