xiongyuxing/ruoyi-vue-pro
1
0
Fork 0
forked from wangziqi/ruoyi-vue-pro
Code Pull Requests Activity

docs(education): record migration closure evidence

Browse Source
This commit is contained in:
wangziqi
2026-07-31 16:26:39 +08:00
parent 184452404d
commit c8a221acbc
13 changed files with 77 additions and 49 deletions
Download Patch File Download Diff File Expand all files Collapse all files

7
docs/education/migration/issues/EDU-012-classes-relationships.md
View File

@@ -27,6 +27,13 @@ Tenant administrators manage classes, student education relationships, invitatio
- Invitation creation is idempotent per tenant, actor, and key with request-hash conflict detection. Acceptance locks the invitation, checks invitee and expiry, and writes relationship plus audit in one transaction.
- This bounded slice intentionally excludes account creation, password handling, platform tenant-ignore operations, education profile duplication, and supervision relationships.
## Role and permission semantics
- `STUDENT` and `TEACHER` are Education relationship labels only; they do not grant System RBAC permissions or authorize administrative endpoints.
- Tenant administrators act through explicit System permissions (`education:class:*` and `education:class-invitation:*`).
- A Member principal may only accept an invitation addressed to their own member user ID; accepting a `STUDENT` or `TEACHER` invitation creates that relationship but no additional API authority in this bounded slice.
- Future teacher actions require a separate permission matrix and endpoints; no implicit role-based elevation is implemented.
## Acceptance criteria
- [x] Generic account, password, token, tenant, and role tables are not duplicated.