geocrop-platform./apps/nextgen/.harness/changelogs/2026-07-12-file-attachments-parent-typo.md

Fix — Parent RBAC typo across attachments flow

Plan reference: .harness/plans/file-attachments.md. Bug surfaced by PR 3 (40be803 + 5277539) once the parent flow was first wired up — parent→child RBAC queries referenced parent_student (singular) instead of the real table parent_students (plural).

Status: ✅ branch fix/file-attachments-parent-typo based on dev (5277539). Ready to merge.

Scope (vs base 5277539)

Four single-character fixes (singular → plural) on the parent_student table reference, found in:

File	Lines	What
server/src/controllers/assignments.controller.js	957	RBAC check inside /api/assignments/my/submissions?student_id= (parent path)
server/src/controllers/subjects.controller.js	216	Parent scope inside GET /api/subjects
server/src/controllers/homework.controller.js	103, 190	Parent scope inside GET /api/homework (PR 2 lineage)
server/src/controllers/tests.controller.js	103, 190	Parent scope inside GET /api/tests (PR 2 lineage)

The real table is parent_students (plural) per server/src/database/init.js:1907. The four controllers were referencing the wrong name — likely a copy-paste error from early scaffolding. The queries never failed before PR 3 because no parent-side flow exercised the broken branch.

PR 3 wired up the parent flow (parent Resources, parent AcademicProgress marked-scripts section, parent /api/assignments/my/submissions?student_id=…) and the smoke tests surfaced the typo immediately.

Diff

 server/src/controllers/assignments.controller.js | 2 +-
 server/src/controllers/homework.controller.js    | 4 ++--
 server/src/controllers/subjects.controller.js    | 2 +-
 server/src/controllers/tests.controller.js       | 4 ++--
 4 files changed, 6 insertions(+), 6 deletions(-)

Verification

• cd client && npm run build — green (no client-side changes).
• cd server && npm run db:init — idempotent (no schema changes).
• Live node src/index.js smoke (teacher@school.com / student@school.com / parent@school.com):
  • GET /api/subjects (parent) — now returns the parent's children's enrolled subjects instead of {"error":"no such table: parent_student"}.
  • GET /api/subjects (student) — unchanged, was already using enrollments only.
  • GET /api/homework (parent) — no longer 500s when the parent has linked children with homework.
  • GET /api/tests (parent) — same.
  • GET /api/assignments/my/submissions?student_id=X (parent) — RBAC parent_students lookup now resolves for linked children.

Out of scope

• The PR 3 client UI work (Homework / Tests / Resources pages, marked-script modal, dashboard callout) already landed via 40be803 — this branch only ships the server typo fix.
• All other hardening items from PR 1 + PR 2 changelogs (HMAC, magic-byte MIME sniff, offline-write protection, soft-delete cleanup) remain deferred.