An individual project: a mobile-friendly portal where elementary students see their released term grades together on one report-card page. Teachers enter, publish and correct grades for their assigned subjects, and one administrator manages accounts, sections and assignments.
The problem
Students and parents usually see grades only on the printed report card. The portal puts released grades online as a supplement to that card, while keeping each grade visible only to the people who should see it.
What it does
Students sign in with their LRN and see every subject on one report card; unreleased subjects read "Not yet available".
Teachers save draft grades, review, publish, and correct a published grade with a required reason.
The administrator sets up school years and sections, creates teacher and student accounts, and assigns teachers to sections and subjects.
Student import from a CSV template, and printable sign-in slips for each section.
Temporary passwords that must be replaced at first sign-in, and an authenticator code for the administrator.
An append-only audit log and a revision history for every grade.
Profile pictures for students and staff.
Engineering decisions
The database is the authority
Every table has Row Level Security with read-only policies, and every write goes through a database function that re-checks role, account status, session and assignment. A bug in the web layer cannot widen access.
Sessions can be revoked
A password reset or deactivation invalidates every older session on the next request, and sessions expire after 8 hours for teachers.
Sign-in reveals nothing
An unknown LRN, a malformed LRN and a wrong password get the same response, with sign-ins rate-limited, so the login page can't be used to check whether a student exists.
No Supabase client in the browser
All data access happens in Server Components and Server Actions, auth cookies are httpOnly, and responses are never cached.
