Security P0 — Access-policy & role-registration decisions (blocker)

[franciszver]

Part of #59.

Part of the broken-access-control remediation epic. Blocks Phases 1–5 — these are product/policy decisions the technical fixes depend on.

Decisions required

1. Intended access model — confirm the target policy so Phase 1's helper encodes the right rules:
   • Student → own data only
   • Tutor → only assigned students (TutorStudentAssignment)
   • Parent → only linked children
   • Admin → all
2. Role self-registration — /auth/register currently allows {"student","tutor","parent"} (src/api/handlers/auth.py:22). Decide whether tutor/parent should be self-assignable. Recommendation: restrict to {"student"} and provision elevated roles admin-side. This alone shrinks the blast radius of findings Potential fix for code scanning alert no. 2: Information exposure through an exception #6/Potential fix for code scanning alert no. 16: Information exposure through an exception #8/Phase 1: OpenRouter free-tier AI provider + CI lint fix #10.
3. Parent↔student model — there is no parent-student relationship model in src/models. Decide: build a ParentStudentAssignment table, or restrict all parent endpoints to admin until one exists.

Definition of Done

• Access model written down (short doc or comment in the epic).
• Decision recorded on tutor/parent self-registration.
• Decision recorded on parent↔student modeling (build vs restrict).

Notes

No code changes required in this ticket — output is decisions that Phases 1, 2, 3 consume.

[franciszver]

Decisions (owner, 2026-07-24):

1. Registration restricted to role=student only; tutor/parent provisioned admin-side (separate future ticket). _ALLOWED_REGISTER_ROLES = {"student"}.
2. Parent-scoped routes (dashboards, engagement) locked to role=admin until a parent↔student relationship model exists. Re-open to parents when linkage ships (separate future ticket).

Access model for the Phase 1 helper: student→own, tutor→assigned students (TutorStudentAssignment), parent→admin-only for now, admin→all. Unblocks #61.

[franciszver]

Done and merged to main in PR #66 (part of epic #59).