# Fix — Parent RBAC typo across attachments flow

> Plan reference: `.harness/plans/file-attachments.md`. Bug surfaced by PR 3 (`40be803` + `5277539`) once the parent flow was first wired up — parent→child RBAC queries referenced `parent_student` (singular) instead of the real table `parent_students` (plural).

**Status:** ✅ branch `fix/file-attachments-parent-typo` based on `dev` (5277539). Ready to merge.

## Scope (vs base `5277539`)

Four single-character fixes (singular → plural) on the `parent_student` table reference, found in:

| File | Lines | What |
|---|---|---|
| `server/src/controllers/assignments.controller.js` | 957 | RBAC check inside `/api/assignments/my/submissions?student_id=` (parent path) |
| `server/src/controllers/subjects.controller.js` | 216 | Parent scope inside `GET /api/subjects` |
| `server/src/controllers/homework.controller.js` | 103, 190 | Parent scope inside `GET /api/homework` (PR 2 lineage) |
| `server/src/controllers/tests.controller.js` | 103, 190 | Parent scope inside `GET /api/tests` (PR 2 lineage) |

The real table is `parent_students` (plural) per `server/src/database/init.js:1907`. The four controllers were referencing the wrong name — likely a copy-paste error from early scaffolding. The queries never failed before PR 3 because no parent-side flow exercised the broken branch.

PR 3 wired up the parent flow (parent Resources, parent AcademicProgress marked-scripts section, parent `/api/assignments/my/submissions?student_id=…`) and the smoke tests surfaced the typo immediately.

## Diff

```diff
 server/src/controllers/assignments.controller.js | 2 +-
 server/src/controllers/homework.controller.js    | 4 ++--
 server/src/controllers/subjects.controller.js    | 2 +-
 server/src/controllers/tests.controller.js       | 4 ++--
 4 files changed, 6 insertions(+), 6 deletions(-)
```

## Verification

- `cd client && npm run build` — green (no client-side changes).
- `cd server && npm run db:init` — idempotent (no schema changes).
- Live `node src/index.js` smoke (`teacher@school.com` / `student@school.com` / `parent@school.com`):
  - `GET /api/subjects` (parent) — now returns the parent's children's enrolled subjects instead of `{"error":"no such table: parent_student"}`.
  - `GET /api/subjects` (student) — unchanged, was already using `enrollments` only.
  - `GET /api/homework` (parent) — no longer 500s when the parent has linked children with homework.
  - `GET /api/tests` (parent) — same.
  - `GET /api/assignments/my/submissions?student_id=X` (parent) — RBAC `parent_students` lookup now resolves for linked children.

## Out of scope

- The PR 3 client UI work (Homework / Tests / Resources pages, marked-script modal, dashboard callout) already landed via `40be803` — this branch only ships the server typo fix.
- All other hardening items from PR 1 + PR 2 changelogs (HMAC, magic-byte MIME sniff, offline-write protection, soft-delete cleanup) remain deferred.