Access & Authentication
- Separate portals for Admin, Staff, Family, and Student — each with role-based access enforced server-side.
- Roles live in a dedicated user_roles table (never on user profiles) and are checked through security-definer helpers to prevent privilege escalation.
- Family members can only see their own children. Staff access is scoped by assigned age band.
- Student logins are age-appropriate: 3-icon picture login for K–2, 4-digit PIN for grades 3–5, password for grades 6–8. Adult staff/family accounts use email + password with optional Google sign-in.
- Staff accounts are restricted to @rebrandtech.org and @c3camp.com email domains.