Introduce Guardian Portal and enhance portal API permissions

[tuwafula]

No description provided.

[greptile-apps]

Confidence Score: 4/5

The Guardian portal paths need fixes before merging. Broad DocPerms can expose unrelated student records, and role setup can leave guardians unable to enter the portal.

• Standard Frappe endpoints can bypass the custom linked-guardian checks.
• Existing guardian users do not receive the new portal role.
• Fresh installs do not create the Guardian role during install.
• The profile modal can render stale empty data after async store loading.

education/education/doctype/*.json Guardian permissions, education/education/doctype/guardian/guardian.py, education/install.py, frontend/src/components/ProfileModal.vue

Security Review

Guardian DocPerms are broader than the portal checks. Standard Frappe read/export/report paths can expose unrelated student data unless these permissions are scoped or removed.

Important Files Changed

Filename	Overview
education/education/api.py	Adds role-aware portal endpoints and per-student checks for custom portal reads.
education/education/doctype/student/student.json	Adds broad Guardian read/export/report/share access to Student records.
education/education/doctype/guardian/guardian.py	Adds Guardian role assignment for newly created users but skips existing users.
education/install.py	Defines Guardian role setup but does not run it on fresh install.
frontend/src/components/ProfileModal.vue	Adapts the profile modal for guardian and student profiles, but reads async store state non-reactively.

Prompt To Fix All With AI

Fix the following 4 code review issues. Work through them one at a time, proposing concise fixes.

---

### Issue 1 of 4
education/education/doctype/student/student.json:387-395
**Guardian Access Is Global**

This DocPerm gives every Guardian role direct read/export/report/share access to `Student` records through standard Frappe endpoints, without the linked-ward check used by the portal APIs. A guardian can enumerate unrelated students; the same permission pattern on attendance, results, leave, and schedules exposes those records too.

### Issue 2 of 4
education/education/doctype/guardian/guardian.py:48-52
**Existing Users Miss Role**

When the guardian email already has a `User`, this branch returns before adding the `Guardian` role. That invited guardian then reaches `get_user_role()` with no portal role and gets redirected away from the portal.

```suggestion
		if guardian_as_user:
			user = frappe.get_doc("User", guardian_as_user)
			user.add_roles("Guardian")
			user.save(ignore_permissions=True)
			frappe.msgprint(
				_("User {0} already exists").format(getlink("User", guardian_as_user))
			)
			return guardian_as_user
```

### Issue 3 of 4
education/install.py:7-13
**Fresh Installs Miss Role**

`create_guardian_role()` is defined but not called during install. On a fresh site, `invite_guardian()` can try to add a role that was never created, so guardian invitation or portal access fails until a patch is run.

```suggestion
def after_install():
	setup_fixtures()
	create_student_role()
	create_guardian_role()
	create_parent_assessment_group()
	create_invoice_permissions()
	create_custom_fields(get_custom_fields())
	create_permissions(get_permissions())
```

### Issue 4 of 4
frontend/src/components/ProfileModal.vue:76-81
**Profile State Freezes Empty**

This reads portal and student refs once during setup, before the async portal context and active student data may finish loading. If the modal mounts early, `profileInfo` stays blank or uses the wrong branch after the store updates, so the profile dialog shows missing guardian/student data.

_{Reviews (1): Last reviewed commit: "Merge branch 'version-16' into version-1..." | Re-trigger Greptile}