Architected and built by ferdiiskandar.com

Last updated: 2026-07-26

Independent product candidate for tutoring-centre operations. Not a clinical EMR, but student, parent, and tutor records are PII and must be handled carefully.

• Do not commit, log, or paste .env values, API keys, or session tokens.
• Do not use real student/parent data in fixtures; use seed_data.py and seed_test_sessions.js.
• Do not weaken RBAC checks on parent/tutor scoping or strip-protection for internal_note.
• Auth, session cookie policy, owner bootstrap, and secret rotation are Class C — need Chief GO.

• Browser login uses local email + password (POST /api/auth/login, POST /api/auth/register).
• Passwords are stored as bcrypt hashes (password_hash on users).
• API accepts Bearer token or session_token cookie (httpOnly).
• Decision: .agent/DECISIONS.md (D-002) — Emergent OAuth removed.

Known risks (documented, not fixed here):

1. First user on empty DB becomes owner even if OWNER_EMAILS is empty.
2. Session revocation UX is incomplete.

Role checks go through require_roles(). Parents are limited to linked children; tutors to own sessions/earnings and assigned substitute coverage; finance surfaces and payroll/report paths stay owner/finance only. Audit important mutations via audit() in db.py.

• Provider-agnostic OpenAI-compatible client (ai_client.py).
• Draft endpoint must not persist evaluations; human submit is required.
• Provenance fields (ai_assisted, ai_fields, ai_model) on submit.
• Keep student identifiers out of model output.
• Treat any key shared in chat as compromised — rotate.

If you discover a credential leak or auth bypass in this app, stop, notify Chief, rotate affected secrets, and do not commit remediation that expands blast radius without approval.