Student/Parent Portal (Education)

Paid pluginsize Mplanned, not built

Indicative price, not an offer: €29/mo; real-time grades, attendance, parent notifications

Generated from docs/plan/paid/student-parent-portal/PLAN.md in the AstroBaaS repository. Nothing described below is implemented — it is the written plan for it.

Parent account linked to one or more students. Parents view real-time grades, attendance, and academic progress. Teachers enter grades once; parents and students see immediately. Academic alerts (low grade, absences trending up) notify parents. Role-based access ensures teachers see own class, admins see all, and students see their own data (GDPR: cannot be hidden from student).

The problem

Parents want to see their child’s grades and attendance, but manual reporting is slow (end-of-term reports only). Teachers must answer repeated parent emails asking ‘how is my child doing?’ and ‘why is attendance low?’. Schools need real-time visibility for parents and a way to flag academic concerns early.

What it does

• Parent account linked to one or more students (with parent verification step)
• Real-time grade viewing by subject, assignment, term
• Attendance tracking (present/absent/late) by date, with aggregate %
• Academic alerts (low grade, absence trending up) with configurable thresholds
• Parent notification on grade entry (email/SMS within 5 min)
• Teacher notes (private messages to parents on student progress)
• Role-based access (teacher sees own class, admin sees all, student sees own data)
• GDPR compliance: students can see their own data, cannot be hidden
• Audit log of all data access (who viewed which student record, when)

What it deliberately does NOT do

Each boundary carries its reason. A boundary without a reason gets crossed by the next person who reads this.

• Official transcript generation — transcripts are legal documents signed by registrar. Reason: compliance; we provide data portal, not official records.
• Homework submission — different scope; homeworks are assignments, not grades. Reason: scope boundary.
• Third-party grading software integration (Powerschool, Infinite Campus) — no standard API; each vendor has custom integration. Reason: support burden per vendor.

Data model

New tables: parent_links (parentId, studentId, verified_at, relationship). grades (gradeId, studentId, subjectId, assignment, score, possible, entered_by, created_at). attendance (attendanceId, studentId, date, status (present/absent/late), note). teacher_notes (noteId, studentId, parentId, teacherId, content, created_at, read_at). academic_alerts (alertId, studentId, parentId, type (low_grade/absence_trend), threshold, triggered_at, dismissed_at). Migration: add tables to relational storage; blob storage nests arrays.

API

• POST /api/parents/{parentId}/link-student
• GET /api/parents/{parentId}/students
• GET /api/students/{studentId}/grades
• GET /api/students/{studentId}/attendance
• POST /api/grades
• POST /api/attendance
• GET /api/students/{studentId}/teacher-notes
• POST /api/admin/academic-alerts
• GET /api/admin/alerts/triggered

Every route added here must also appear in src/pages/openapi.json.ts — a test fails the build if it does not.

Admin

Parent verification UI (teacher verifies parent identity before granting access). Grade entry form (per-student or bulk import CSV). Attendance form (per class, per date). Academic alert rule dashboard (define thresholds: if grade < 60%, if absences > 20% in 30 days). Student roster by teacher. Privacy audit view (log of all access: user, student, timestamp).

The seam — why this is paid

Core owns: grade + attendance schema, role-based access control, parent linking, audit logging. Paid pack owns: alert rules engine, teacher notes UI, GDPR student privacy compliance layer.

Support commitment: GDPR student data privacy, parent auth, emergency-contact SLA

Dependencies

• User/role system (teacher, parent, student roles)
• Email/notification system
• Audit log
• Access control / permissions system

Acceptance checks

Each of these must be able to fail. Before claiming this is done, break the code deliberately and watch each one go red.

• Parent links student with email + verification code; can see grades immediately after
• Teacher enters grade for Math assignment; parent notified via email within 5 minutes
• Parent portal shows grade history by subject (Biology: A, A-, B+, B, C)
• Attendance shows student: Sept 1 present, Sept 2 absent, Sept 3 late; aggregate 80% present
• Academic alert fires when grade < 60%; parent + teacher notified
• Student logging in sees all their grades and attendance (cannot be hidden)
• Parent cannot access another family’s student data (403 on unauthorized student)
• Teacher notes appear only to linked parents + student + teachers in that subject
• Audit log entry: [parentId] viewed [studentId] grades on [timestamp]
• Alert rule ‘absence rate > 20% in 30 days’ fires and silences after 7 days (no spam)

Risks

Not verifying parent identity: anyone with student name + email can view academic records (FERPA violation, compliance liability). Plaintext grades in audit log: data exfiltration via log query. Notifying parent before student sees grade: breaks teacher-student trust, student surprised by parent. Timezone handling: marking absent Sept 2 UTC shows Sept 1 to parent in a different timezone. Alert rule misconfiguration: triggering too often (all B grades = low?) floods inbox.

Commercial context

The anchor is what the nearest equivalent charges on Shopify or Magento today. It is context for a pricing decision, not the decision.

---

Generated from the commerce plan. See docs/COMMERCE-PLAN.md for the full catalogue and ../../AI-GUIDE.md for how to work on this repository.