Skip to content

chore(deps): Bump actions/setup-node from 4 to 6 - #3

Open
dependabot[bot] wants to merge 25 commits into
mainfrom
dependabot/github_actions/actions/setup-node-6
Open

dependabot[bot] wants to merge 25 commits into
mainfrom
dependabot/github_actions/actions/setup-node-6

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Nov 8, 2025

Copy link
Copy Markdown

Bumps actions/setup-node from 4 to 6.

Release notes

Sourced from actions/setup-node's releases.

v6.0.0

What's Changed

Breaking Changes

Dependency Upgrades

Full Changelog: actions/setup-node@v5...v6.0.0

v5.0.0

What's Changed

Breaking Changes

This update, introduces automatic caching when a valid packageManager field is present in your package.json. This aims to improve workflow performance and make dependency management more seamless. To disable this automatic caching, set package-manager-cache: false

steps:
- uses: actions/checkout@v5
- uses: actions/setup-node@v5
  with:
    package-manager-cache: false

Make sure your runner is on version v2.327.1 or later to ensure compatibility with this release. See Release Notes

Dependency Upgrades

New Contributors

Full Changelog: actions/setup-node@v4...v5.0.0

v4.4.0

... (truncated)

Commits

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot merge will merge this PR after your CI passes on it
  • @dependabot squash and merge will squash and merge this PR after your CI passes on it
  • @dependabot cancel merge will cancel a previously requested merge and block automerging
  • @dependabot reopen will reopen this PR if it is closed
  • @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

claude and others added 25 commits November 7, 2025 00:38
Add three core specification documents that form the project spine:

1. REQ.md — Requirements Specification (v2.1.0)
   - What the system must do and why
   - Goals (MoSCoW), stakeholders, user stories (REQ-T-*, REQ-A-*, REQ-S-*)
   - Functional/non-functional requirements by module
   - Data requirements, retention policies
   - GDPR compliance, ISO 27001 alignment
   - Performance SLAs (p95 latencies, availability targets)
   - WCAG 2.2 AA accessibility
   - Acceptance criteria (GIVEN-WHEN-THEN format)
   - Traceability matrix (REQ → DESIGN → TASKS)

2. DESIGN.md — Design Specification (v2.1.0)
   - How the system fulfils requirements
   - MCP architecture (Host + Admin/Teacher/Student MCP servers)
   - Tech stack (Next.js 15, React 19, Supabase, Drizzle)
   - Domain model & ERD (15+ core entities)
   - API design (REST over HTTP with typed envelopes)
   - AuthN/Z (Supabase Auth, JWT, RLS policies)
   - Lesson planning flow (AI-assisted with LLM)
   - Hash-chained attendance register (tamper-evident)
   - Student profile (PII split tables, verification)
   - Forum (rate limiting, moderation queue)
   - Observability (OpenTelemetry with PII scrubbing)
   - Performance optimisations (indexes, caching, CDN)
   - Threat model (STRIDE analysis)

3. TASKS.md — Task Specification (v2.1.0)
   - How work is executed to implement design
   - Work breakdown structure (11 epics, 42 tasks)
   - Definition of Ready/Done (DoR/DoD)
   - Task template with acceptance criteria
   - Epics: Foundation, Auth, MCP, Planner, Timetable, Register,
     Profile, Forum, Observability, Compliance, Deploy
   - Testing strategy (unit/integration/e2e/RLS/performance)
   - CI/CD pipeline tasks
   - 4 milestones with exit criteria
   - Traceability (every task links to REQ + DESIGN)

Changes to existing files:
- README.md: Updated to feature new spec spine structure
  - Quick start guides for Product/Engineering/Implementation
  - Traceability section with example chain
  - Version history updated to v2.1.0

Key features:
✅ Full traceability: REQ ↔ DESIGN ↔ TASKS
✅ User stories mapped to tasks (REQ-T-001 → T-031/032/033)
✅ MCP architecture reconciled with traditional requirements
✅ GIVEN-WHEN-THEN acceptance criteria throughout
✅ Performance budgets defined (p95 < 5s lesson gen, < 200ms timetable)
✅ RLS policies specified with test requirements
✅ Compliance (GDPR, ISO 27001) integrated
✅ 42 actionable tasks ready for implementation

These documents are now the authoritative spine and will be updated
with each commit to maintain alignment with implementation.

Refs: All existing MCP specs (spec/01-09) remain and are referenced
Add comprehensive optimization plan to address constraint of ≤10 tools
per MCP while maintaining efficiency and minimizing agent count.

Current State (v2.0):
- Admin MCP: 50 tools ❌ (5x over limit)
- Teacher MCP: 12 tools ⚠️ (slightly over)
- Student MCP: 14 tools ⚠️ (slightly over)

Proposed Architecture (v3.0):
Split into 8 focused MCPs with ≤10 tools each:

1. Identity & Access MCP (6 tools)
   - User auth, roles, permissions, sessions
   - Security-critical operations

2. Academic Operations MCP (10 tools)
   - Programmes, courses, scheduling, lessons
   - High cohesion: academic delivery

3. Attendance & Compliance MCP (8 tools)
   - Attendance tracking, visa compliance, exports
   - Legally coupled operations

4. Finance MCP (9 tools)
   - Invoicing, payments, reconciliation
   - PCI compliance, strictest audit

5. Student Services MCP (9 tools)
   - Accommodation, letters, certificates
   - Student welfare and lifecycle

6. Operations & Quality MCP (8 tools)
   - Backups, quality assurance, CPD, comms
   - System operations and QA

7. Teacher MCP (10 tools) - Optimized
   - Reduced from 12 → 10 by merging similar tools

8. Student MCP (10 tools) - Optimized
   - Reduced from 14 → 10 by merging AI tutor tools

Benefits:
✅ All MCPs ≤10 tools (compliance with constraint)
✅ Logical domain boundaries (high cohesion)
✅ 8 total MCPs (minimized, not over-fragmented)
✅ Efficient operation (domain-specific caching)
✅ Security improvements (least privilege, smaller attack surface)
✅ Performance gains (distributed load, simpler RLS)

Migration Strategy:
- Phase 1: Identity & Finance (high priority, security-critical)
- Phase 2: Academic & Attendance (medium priority)
- Phase 3: Student Services & Ops (low priority)
- Phase 4: Teacher & Student optimization (final)

Next Steps:
1. Review and approve optimization plan
2. Update REQ/DESIGN/TASKS with new architecture
3. Create detailed specs for 6 new admin MCPs
4. Begin Phase 1 implementation (Identity & Finance)

Estimated: 8-12 weeks phased implementation
Priority: High (technical debt, security)
Overall Score: 9.5/10 - APPROVED FOR IMPLEMENTATION (pending MCP decision)
BREAKING CHANGE: Architecture migrates from 3-MCP to 8-MCP design

Updated all core specification documents to v3.0.0 with 8-MCP architecture:

REQ.md (v3.0.0):
- Updated \u00a76.7 with detailed 8-MCP architecture
- 6 admin domain MCPs: Identity (6), Academic (10), Attendance (8), Finance (9), Student Services (9), Ops (8)
- 2 optimized role MCPs: Teacher (10), Student (10)
- All MCPs ≤10 tools (hard limit: 15, target: ~10 for optimization)
- Fine-grained authorization scopes (identity:*, finance:*, academic:*, etc.)
- Cross-cutting concerns: scope-based routing, domain isolation, distributed load

DESIGN.md (v3.0.0):
- Updated \u00a71 with v3.0 C4 architecture diagrams (context + containers)
- ASCII diagram shows 8 MCPs with tool counts and scopes
- Mermaid diagram shows scope-based routing from Host to 8 MCPs
- Key benefits documented: security, performance, maintainability

TASKS.md (v3.0.0):
- Added \u00a74.3.1: MCP Architecture Migration (v3.0)
- 34 new migration tasks (T-110 to T-143)
- 4-phase rollout plan (8-12 weeks):
  - Phase 1: Identity & Finance MCPs (T-110 to T-114)
  - Phase 2: Academic & Attendance MCPs (T-120 to T-124)
  - Phase 3: Student Services & Ops MCPs (T-130 to T-133)
  - Phase 4: Teacher/Student optimization (T-140 to T-143)
- Each phase includes: MCP creation, Host routing, RLS migration, E2E tests
- Total tasks: 76 (42 core + 34 migration)

README.md (v3.0.0):
- Updated version history with v3.0.0 changelog
- 8-MCP architecture highlights
- 76 total tasks (42 core + 34 migration)

Architecture Summary:
- 8 focused MCPs vs 3 bloated MCPs (v2.0)
- All MCPs ≤10 tools (v2.0 had Admin MCP with 50 tools)
- Domain-driven design for clear boundaries
- Scope-based authorization for fine-grained access control
- Distributed load for better performance
- Smaller attack surface per MCP for security

Migration Strategy:
- 4 phases over 8-12 weeks
- Backward compatibility during rollout
- Canary deployment (run old + new in parallel)
- Comprehensive E2E testing per phase

Compliance:
✅ Hard limit: 15 tools per MCP
✅ Target: ~10 tools per MCP (optimization)
✅ Achieved: All 8 MCPs between 6-10 tools

Refs: MCP-ARCHITECTURE-OPTIMIZATION.md, SPECIFICATION-REVIEW.md
…-011CUsa6G9CoyrJhPsbQfHVs

Claude/review mycastle specs 011 c usa6 g9 coyr jh psb qf h vs
Sprint 0, Day 1 deliverable:
- Next.js 16.0.1 with React 19.2.0
- TypeScript 5 configured
- ESLint 9 with Prettier integration
- Tailwind CSS 4 installed
- Environment template created
- Build verified successful

Changes:
- Created /app directory with Next.js app
- Added Prettier config (.prettierrc.json, .prettierignore)
- Updated root .gitignore for Next.js patterns
- Replaced Google Fonts with system fonts (network constraints)
- Created .env.local.example template

Ref: REQ.md, DESIGN.md, TASKS.md T-001, MVP-SPRINT-PLAN.md
Sprint 0, Days 2-3 deliverable:
- Drizzle ORM configured with PostgreSQL/Supabase
- Complete schema implementation across 4 modules:
  * Core: tenants, users (with RLS indexes)
  * Academic: classes, enrollments, sessions, attendance, assignments, submissions, grades
  * Curriculum: CEFR descriptors, lesson plans, materials
  * System: audit logs, invoices, payments, conversations, exports

Schema features:
- Multi-tenancy ready (tenant_id on all tables)
- Soft deletes (deleted_at timestamps)
- Audit trail (created_at, updated_at)
- Type-safe with TypeScript
- Indexed for performance
- Foreign key relationships

Files:
- src/db/schema/core.ts - 2 tables
- src/db/schema/academic.ts - 8 tables
- src/db/schema/curriculum.ts - 4 tables
- src/db/schema/system.ts - 5 tables
- src/db/index.ts - Database client
- drizzle.config.ts - Migration configuration
- package.json - Added Drizzle scripts

Ref: spec/08-database.md, DESIGN.md §3, TASKS.md T-002
Sprint 0, Day 4 deliverable:
- GitHub Actions workflows for CI/CD
- Jest test framework with 19 passing tests
- Dependabot for dependency updates

GitHub Actions workflows:
- ci.yml: Lint, type-check, build, test on all pushes
- deploy.yml: Auto-deploy to Vercel on main branch
- Parallel job execution for faster CI

Test infrastructure:
- Jest 30 + React Testing Library
- Database schema unit tests (19 tests, all passing)
- Coverage reporting configured
- Test scripts: test, test:watch, test:coverage

Dependabot configuration:
- Weekly updates for npm packages
- Grouped updates for related packages (Next, ESLint, Drizzle)
- GitHub Actions version updates

Files:
- .github/workflows/ci.yml - CI pipeline
- .github/workflows/deploy.yml - Deployment pipeline
- .github/dependabot.yml - Dependency updates
- app/jest.config.js - Jest configuration
- app/src/__tests__/db-schema.test.ts - Schema tests
- Removed accidental root package.json

Ref: TASKS.md T-003, MVP-SPRINT-PLAN.md Sprint 0
Sprint 0, Day 5 deliverable:
- Complete Supabase authentication integration
- Server and client auth utilities
- Protected routes with middleware
- Login and dashboard pages
- 7 auth utility unit tests (all passing)

Authentication features:
- Supabase SSR integration for Next.js 15
- Browser client (client.ts) for Client Components
- Server client (server.ts) for Server Components/Route Handlers
- Middleware for automatic session refresh
- Protected route handling (/dashboard requires auth)

Auth utilities:
- getCurrentUser() - Get authenticated user (cached per request)
- getSession() - Get current session
- requireAuth() - Throws if not authenticated
- hasRole() / requireRole() - Role-based access control
- getTenantId() / requireTenant() - Multi-tenancy support

Client hooks:
- useAuth() - Auth state with auto-subscribe
- useUser() - Get current user
- useRole() - Check user role

Pages:
- /login - Email/password login form
- /dashboard - Protected route example

Tests:
- 7 auth utility tests (all passing)
- Total: 26 tests passing (19 schema + 7 auth)

Files:
- src/lib/supabase/client.ts - Browser Supabase client
- src/lib/supabase/server.ts - Server Supabase client
- src/lib/auth/utils.ts - Server auth utilities
- src/lib/auth/hooks.ts - Client auth hooks
- src/lib/auth/types.ts - Type definitions
- src/middleware.ts - Next.js middleware
- src/app/login/page.tsx - Login page
- src/app/dashboard/page.tsx - Protected dashboard
- src/__tests__/auth-utils.test.ts - Auth tests

Ref: spec/07-authentication.md, REQ.md §6.1, TASKS.md T-010
Sprint 2, Days 10-12 deliverable:
- OpenAI GPT-4o-mini integration for lesson generation
- Zod schemas for lesson plan validation
- Deterministic caching with SHA256 keys
- Complete API route with auth & tenant isolation
- 14 unit tests (all passing)

Lesson Plan Features:
- CEFR-aligned lesson generation (A1-C2)
- Structured JSON output with validation
- Activities, objectives, materials, assessment
- Configurable duration (30-240 minutes)
- Teacher/class context support

API: POST /api/lessons/generate
- Request: { cefr_level, topic, duration_minutes, descriptor_id?, class_id?, additional_context? }
- Response: { id, plan, cache_key, is_cached, generation_time_ms, created_at }
- Auth: Requires teacher or admin role
- Performance: Tracks p95 latency (target < 5s)
- Caching: SHA256(level+topic+duration+descriptor) for deduplication

Schemas (Zod):
- LessonPlanSchema: Complete plan structure with objectives, activities, materials, assessment
- ActivitySchema: Individual activities with duration, materials, interaction patterns
- LessonPlanRequestSchema: API request validation
- LessonPlanResponseSchema: API response validation

Generator Features:
- Lazy-loaded OpenAI client (test-friendly)
- Expert ESL teacher system prompt
- JSON mode for structured output
- CEFR level descriptions
- Error handling with detailed logging
- Performance SLA monitoring (warns if > 5s)

Tests (14 passing):
- Cache key generation (consistency, uniqueness)
- CEFR level descriptions
- Request schema validation
- Default values and constraints
- Total: 40 tests passing (19 schema + 7 auth + 14 lesson)

Files:
- src/lib/lessons/schemas.ts - Zod schemas
- src/lib/lessons/generator.ts - OpenAI integration
- src/app/api/lessons/generate/route.ts - API endpoint
- src/__tests__/lesson-generator.test.ts - Tests

Ref: DESIGN.md §6.3, REQ.md §6.6, TASKS.md T-031/T-032/T-033
Teacher lesson planner interface:
- Complete lesson planner form with CEFR level selection
- Topic, duration, and context inputs
- Real-time lesson plan generation via API
- Rich plan display with objectives, activities, materials, assessment
- Loading states and error handling
- Performance metrics display (generation time)

UI Components:
- LessonPlannerForm: Full-featured lesson generation interface
- Teacher lesson planner page with auth protection
- Responsive design with Tailwind CSS
- Clean, professional UI for education context

Next.js 16 Compatibility Fixes:
- Updated Supabase server client for async cookies() API
- Fixed all createClient() calls to await in server components
- Updated auth utils to handle async Supabase client
- Dashboard page sign-out action updated
- Tenant ID support in lesson plan API

API Updates:
- Added tenant isolation to lesson plan creation
- getTenantId() integration for multi-tenancy
- Proper error handling for missing tenant context

Build Verification:
- All 40 tests passing
- Next.js build succeeds
- No TypeScript errors
- Routes: /teacher/lesson-planner (protected)

Files:
- src/components/lessons/LessonPlannerForm.tsx - Lesson planner UI
- src/app/teacher/lesson-planner/page.tsx - Protected route
- src/lib/supabase/server.ts - Async cookies() support
- src/lib/auth/utils.ts - Async client support
- src/app/api/lessons/generate/route.ts - Tenant ID support

Ref: MVP-SPRINT-PLAN.md Sprint 2
Session Summary:
- 6 major feature commits
- Sprint 0 complete (4/4 tasks)
- Sprint 2 lesson features complete (3/3 tasks)
- 40 unit tests (100% passing)
- Production build succeeds
- Ready for user review

Completed:
✅ T-001: Next.js initialization
✅ T-002: Database schema (19 tables)
✅ T-003: CI/CD pipeline
✅ T-010: Supabase Auth
✅ T-031: Lesson generation API
✅ T-032: Lesson plan schemas
✅ T-033: Caching implementation
✅ Lesson planner UI

Metrics:
- 42 story points completed
- 50+ files created
- ~5000 lines of code
- 100% test pass rate

Status: Ready for continuation
- Created reusable Navigation component with mobile menu support
  - Role-based navigation link filtering
  - Mobile-responsive hamburger menu
  - User profile display with email and role badge
  - Sign out functionality

- Created FeatureCard component for dashboard
  - Multiple color variants (blue, green, purple, orange)
  - Icon and badge support
  - Hover animations and transitions

- Enhanced Dashboard page
  - Role-based feature cards (teacher, student, admin views)
  - Quick access to AI Lesson Planner, Timetable, Attendance
  - Improved visual design with card grid layout
  - Personalized welcome message

- Updated Lesson Planner page to use Navigation component

- Added comprehensive component tests (26 passing tests)
  - Navigation component tests for role filtering, mobile menu, rendering
  - FeatureCard component tests for colors, icons, badges, accessibility

All tests passing. Ready for teacher portal development.
- Created TimetableWeekView component with weekly grid layout
  - Displays classes by day and time slot
  - Shows class name, room, time, and enrollment count
  - Week navigation controls (Previous/This/Next week)
  - Color-coded session blocks with hover effects
  - Responsive design with horizontal scroll for small screens

- Created /teacher/timetable page route
  - Role-based access (teacher/admin only)
  - Integration with Navigation component
  - Mock data for demonstration

- Added comprehensive tests (12 passing tests)
  - Tests for day/time rendering, session display
  - Navigation controls and legend verification
  - Grid structure validation

Implements spec/02-teacher-mcp.md §2.2.1 (My Timetable).
All tests passing with no warnings.
- Created AttendanceRegister component with comprehensive features
  - Class and session selection (date/time)
  - Interactive student roster table
  - Quick-mark buttons (P/A/L/E) with keyboard shortcuts
  - Real-time statistics (present, absent, late, excused, unmarked)
  - Visa student flagging with absence warnings
  - Color-coded status indicators
  - Save and clear functionality

- Created /teacher/attendance page route
  - Role-based access (teacher/admin only)
  - Integration with Navigation component
  - Mock data for demonstration

- Added comprehensive tests (22 passing tests)
  - Session selection and validation
  - Student display and visa badges
  - Attendance marking for all statuses
  - Statistics calculation and updates
  - Visa absence warning functionality
  - Save/clear button states
  - Accessibility compliance (aria-labels)

Implements spec/02-teacher-mcp.md §2.2.7 (Attendance Registers) and §2.3.3 (Attendance Tools).
All tests passing with full accessibility support.
- Created SETUP.md with comprehensive environment configuration guide
  - Supabase credential setup instructions
  - OpenAI API key configuration
  - Database connection string format
  - Troubleshooting tips and security notes

- Added database connection test script
  - Tests PostgreSQL connection
  - Verifies credentials and network access
  - Lists existing tables
  - Checks RLS status
  - Provides detailed error messages

- Added test:db npm script for easy connection testing
- Installed tsx for running TypeScript scripts

Prepares for T-011 (RLS Policies) and T-034 (CEFR Seeds).
Ready for Option A: Complete Foundation (Database-First).
- Created 001_initial_schema.sql with all tables
- Workaround for drizzle-kit Windows compatibility issue
- Can be run directly in Supabase Studio SQL Editor
- Creates: tenants, users, classes, enrollments, sessions, attendance, assignments, CEFR descriptors, lesson plans, audit log
- Created spec/10-identity-access-mcp.md with 6 tools
- Tools: create_user, update_user_role, set_permissions, revoke_session, rotate_api_key, audit_access
- 4 resources: user_directory, active_sessions, access_audit_log, permission_scopes
- 3 prompts: identity_persona, security_audit, access_review
- Complete authorization matrix and security controls
- Performance budgets: <500ms for CRUD, <2s for audit queries
- Migration plan from Admin MCP (Phase 1)
- GDPR and ISO 27001 compliance alignment

Part of T-110 (Phase 1 migration to 8-MCP architecture)
…11CUwDSy3xbfSd6x7kiQ7Ph

Plan Next Steps for Project
Bumps [actions/setup-node](https://github.com/actions/setup-node) from 4 to 6.
- [Release notes](https://github.com/actions/setup-node/releases)
- [Commits](actions/setup-node@v4...v6)

---
updated-dependencies:
- dependency-name: actions/setup-node
  dependency-version: '6'
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code labels Nov 8, 2025
jojopeligroso added a commit that referenced this pull request Mar 2, 2026
…ents

## Database Schema
- Add FRESH_0027_student_profile_feature.sql migration with:
  - student_profile_sensitive table for PII (contact, visa info)
  - student_notes table with visibility controls
  - level_promotions table for promotion workflow
  - diagnostic_sessions table for placement tracking
  - competency_assessments table for CEFR assessments
  - competency_progress table (denormalized for performance)
- Add comprehensive RLS policies for multi-tenant isolation
- Add profile.ts Drizzle schema with all new tables

## API Routes (8 new routes)
- GET/POST /api/admin/students/[id]/assessments - CRUD for assessments
- GET/PUT/DELETE /api/admin/students/[id]/assessments/[assessmentId]
- GET /api/admin/students/[id]/progress - Aggregated skill progress
- GET/POST /api/admin/students/[id]/notes - Student notes CRUD
- PUT /api/admin/students/[id]/notes/[noteId]/share - Share note with student
- GET /api/admin/students/[id]/level-history - Level promotion history
- GET /api/admin/students/[id]/diagnostics - Diagnostic session history
- GET /api/admin/students/[id]/audit - Full audit trail with filtering

## Components
- LevelHistoryTab: Current level status, promotion history, diagnostics
- CompetencyProgressTab: CEFR skill progress with gaps by category
- EnhancedNotesTab: Notes with type/visibility, create form, share feature
- AuditTrailTab: Timeline of all profile changes with filtering
- AssessmentForm: Form for recording CEFR assessments

## Hooks
- useCompetencyAssessments: SWR hook for assessment CRUD operations

## Tests
- Unit tests for all 4 tab components
- Schema validation tests for profile.ts

Tasks completed: #1, #2, #3, #7, #11, #12, #14, #15, #16, #17

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
jojopeligroso added a commit that referenced this pull request Jul 26, 2026
…ents

## Database Schema
- Add FRESH_0027_student_profile_feature.sql migration with:
  - student_profile_sensitive table for PII (contact, visa info)
  - student_notes table with visibility controls
  - level_promotions table for promotion workflow
  - diagnostic_sessions table for placement tracking
  - competency_assessments table for CEFR assessments
  - competency_progress table (denormalized for performance)
- Add comprehensive RLS policies for multi-tenant isolation
- Add profile.ts Drizzle schema with all new tables

## API Routes (8 new routes)
- GET/POST /api/admin/students/[id]/assessments - CRUD for assessments
- GET/PUT/DELETE /api/admin/students/[id]/assessments/[assessmentId]
- GET /api/admin/students/[id]/progress - Aggregated skill progress
- GET/POST /api/admin/students/[id]/notes - Student notes CRUD
- PUT /api/admin/students/[id]/notes/[noteId]/share - Share note with student
- GET /api/admin/students/[id]/level-history - Level promotion history
- GET /api/admin/students/[id]/diagnostics - Diagnostic session history
- GET /api/admin/students/[id]/audit - Full audit trail with filtering

## Components
- LevelHistoryTab: Current level status, promotion history, diagnostics
- CompetencyProgressTab: CEFR skill progress with gaps by category
- EnhancedNotesTab: Notes with type/visibility, create form, share feature
- AuditTrailTab: Timeline of all profile changes with filtering
- AssessmentForm: Form for recording CEFR assessments

## Hooks
- useCompetencyAssessments: SWR hook for assessment CRUD operations

## Tests
- Unit tests for all 4 tab components
- Schema validation tests for profile.ts

Tasks completed: #1, #2, #3, #7, #11, #12, #14, #15, #16, #17

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
@dependabot @github

dependabot Bot commented on behalf of github Jul 27, 2026

Copy link
Copy Markdown
Author

A newer version of actions/setup-node exists, but since this PR has been edited by someone other than Dependabot I haven't updated it. You'll get a PR for the updated version as normal once this PR is merged.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants