Serves Demo Scene 5 in full, including the specific requirement to
demonstrate a refused access attempt live on the call. Every route
that takes a student id resolves it through _get_authorized_student(),
which does no manual comparison of its own - it relies on mc.student's
own record rules (a real mc.student.guardian link for guardians,
partner_id for students, never group membership alone, per CLAUDE.md
sec 3's "Guardian access is by relationship, not by role") to filter
a plain search(), and turns an empty result into an explicit
AccessError. The child switcher - "the single most convincing single
feature in the demo" per the spec - is just that same search with no
id filter, returning exactly the caller's own children.
Verified with real HTTP requests (HttpCase), not with_user()
shortcuts alone: authenticated as a real guardian, opened their own
child's dashboard and all four sub-pages (fees/attendance/timetable/
results) and got 200 on every one, then requested another family's
child by id and got 403 with the exact refusal message, on every one
of those same five routes. That is "editing the student identifier in
the URL and showing that it is refused" performed for real inside the
test, not asserted from a domain expression.
That same real-request testing earned its keep twice over, catching
two gaps a with_user()-only test would have missed entirely:
- mc.batch had never been portal-reachable before this module and
had no access row at all for guardian/student - a legitimate
own-child dashboard load failed with a raw ACL error, not even a
record-rule denial. Added mc.batch rules scoped the same way as
everything else (via mc.batch.enrollment_ids, a new reverse field
this module adds).
- Rendering the timetable page touches mc.subject, mc.room, mc.exam,
mc.academic.year/term and hr.employee through related-field reads,
each of which triggers its own ACL check independent of whatever
rule scopes mc.timetable.slot itself. Granted broad (unrestricted)
guardian/student read on the non-sensitive reference models
(subject/room/exam/year/term names - catalog data, not per-student
data, same reasoning already applied to Teacher/Staff/Accountant
in earlier modules); used sudo() instead for hr.employee
specifically, since employee records carry real HR data no
blanket portal grant should touch, with a comment noting the
student was already authorized by that point in the request.
Fees needs no new rule at all: mc_education_fees deliberately bills
the primary guardian's own partner_id (a design decision made back in
O3, for exactly this reason), so stock account+portal's own
partner_id-scoped visibility already covers it, and group_guardian/
group_student already imply base.group_portal from O1.
mc.notice is a new model - shared/DOMAIN_MODEL.md lists it as an
entity Track O needs but no module spec in CLAUDE.md sec 5 ever gave
it a field table; added here since it is specifically an O7 view
requirement, scoped by the same batch-or-school-wide pattern as
everything else.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
metatroncubeswdev