Follow-up from #59 / PR #66.
Parent-scoped routes (/dashboards/parent/*, /analytics/advanced/engagement/{user_id}) were locked to role=admin in #66 because no parent↔student relationship model exists, so 'a parent sees only their own child' could not be enforced.
Work:
- Add a
ParentStudentAssignment model (mirror TutorStudentAssignment) + migration.
- Decision needed: how does a parent↔student link get created — admin-provisioned, invite code, or self-service with verification?
- Extend
assert_can_access_student (or add a parent branch) to allow a parent access to their linked students.
- Restore
parent on those route role gates and replace the admin-only lock.
- Re-open
_ALLOWED_REGISTER_ROLES to include parent only if self-registration is desired given the linkage flow chosen in (2).
Follow-up from #59 / PR #66.
Parent-scoped routes (
/dashboards/parent/*,/analytics/advanced/engagement/{user_id}) were locked torole=adminin #66 because no parent↔student relationship model exists, so 'a parent sees only their own child' could not be enforced.Work:
ParentStudentAssignmentmodel (mirrorTutorStudentAssignment) + migration.assert_can_access_student(or add a parent branch) to allow a parent access to their linked students.parenton those route role gates and replace the admin-only lock._ALLOWED_REGISTER_ROLESto includeparentonly if self-registration is desired given the linkage flow chosen in (2).