72 lines
4.1 KiB
Markdown
72 lines
4.1 KiB
Markdown
# PR 3 — File Attachments Student + Parent Side — Final Review
|
|
|
|
**VERDICT: PASS**
|
|
|
|
## Branch
|
|
|
|
`feature/file-attachments-views` branched from `f02f0a1` (dev at the time of PR 2 merge). One feature commit lands the entire PR 3.
|
|
|
|
## Scope
|
|
|
|
### New files (4)
|
|
|
|
| File | Purpose |
|
|
|---|---|
|
|
| `client/src/pages/student/Resources.tsx` | Student course resources — read-only mirror of teacher Resources, 4 tabs (Syllabus / Test Papers / Homework Sheets / Past Exam Papers) with download + inline preview |
|
|
| `client/src/pages/student/Homework.tsx` | Student homework — read-only list with Submit / View Detail / Marked Script surfacing; status tabs (To Do / Submitted / Graded / Overdue) |
|
|
| `client/src/pages/student/Tests.tsx` | Student tests — same shape with `test_date` + `duration_minutes` fields and marked-script surfacing |
|
|
| `client/src/pages/parent/Resources.tsx` | Per-child resources viewer with child switcher; reads /users/children then mirrors student Resources |
|
|
|
|
### Modified (6)
|
|
|
|
| File | Purpose |
|
|
|---|---|
|
|
| `client/src/App.tsx` | Routes for /homework, /tests, /resources (student) and /parent-resources |
|
|
| `client/src/components/Nav.tsx` | Nav entries: student gets Homework / Tests / Course Resources; parent gets Course Resources |
|
|
| `client/src/pages/dashboard/StudentDashboard.tsx` | Plan §6.4 callout: "N marked scripts available" when student has any returned submission, links to /assignments |
|
|
| `client/src/pages/student/Assignments.tsx` | "View Marked Script" button on completed tab when `submission.status === 'returned'`; inline modal with iframe (PDF) / img (image) / Open + Download actions; `status` field added to `AssignmentSubmission` type |
|
|
| `client/src/pages/parent/AcademicProgress.tsx` | Plan §7.1: "Marked Scripts" section above the bento stats; lists the teacher's returned marked scripts for the selected child with Preview + Download |
|
|
| `client/src/store/assignments.ts` | `AssignmentSubmission.status` + `attachments[]` types added so the marked-script modal can match by submission id |
|
|
| `server/src/controllers/attachments.controller.js` | Plan §7.3 RBAC widening: privileged readers (admin / principal / systems_admin) see all marked scripts; parents see marked scripts and submissions for their own children via a JOIN on `parent_students`; `parent` role added to `UPLOAD_ROLES` per PR 1 code-review follow-up |
|
|
|
|
## Verification (orchestrator)
|
|
|
|
- `npm install` on both server and client (fresh worktree)
|
|
- `cd server && npm run db:init` clean (PR 1 + PR 2 schema already in place, idempotent)
|
|
- `cd client && npm run build` — production build green:
|
|
```
|
|
✓ built in 14.95s
|
|
PWA v0.19.8
|
|
precache 19 entries (5057.21 KiB)
|
|
files generated
|
|
dist/sw.js
|
|
dist/workbox-*.js
|
|
```
|
|
5,057 KiB precache (+49 KiB vs PR 2).
|
|
- Server boot detached via `Start-Process node`; `/api/health` → 200.
|
|
- Smoke (PowerShell `Invoke-RestMethod`):
|
|
- `POST /api/auth/login` (teacher + student) → JWT
|
|
- `GET /api/attachments?parent_kind=subject` as teacher → 200, `[]`
|
|
- `GET /api/attachments?parent_kind=marked_script` as teacher → 200, `[]`
|
|
- `GET /api/assignments/my/submissions` as student → 200, `[]`
|
|
|
|
Server is healthy on `http://localhost:3001`.
|
|
|
|
## Out of scope (deferred)
|
|
|
|
These are tracked from PR 1 / PR 2 code-review notes and aren't blocking:
|
|
|
|
- HMAC-signed `/api/uploads` (replaces the open static mount — security)
|
|
- Magic-byte MIME sniff on upload (defense in depth)
|
|
- Soft-delete cleanup service for orphaned files on disk
|
|
- Offline-write protection in `client/src/store/api.ts` to skip `/attachments` on the network-down POST path
|
|
- `attachments.uploaded_at` vs the `created_at` column convention (sync engine merge code falls back to `created_at`; consider renaming or adding `updated_at`)
|
|
- Bulk ZIP download of all course materials
|
|
- "Download my submission" round-trip (still uses base64 in Zustand state; v1 follows the marked-script pattern but the data path needs server-side join work that's a hardening pass)
|
|
|
|
## Next step
|
|
|
|
The orchestrator takes this back to the user with: "PR 3 is green on `feature/file-attachments-views`. Ready to merge to `dev` and push."
|
|
|
|
VERDICT: PASS
|