Roles & permissions

The system has three real roles plus a scoped guest. Every account has exactly one role, and access is enforced on the server for every request — the UI hides things too, but the backend is the source of truth.

The three roles

Role	Vietnamese	Home	In one line
Admin	Ban điều hành	/admin/school	Runs the whole center; sees everything.
Teacher	Giáo viên	/teacher	Teaches and grades their own classes/students only.
Student	Học viên	/dashboard	Does assigned homework; sees only their own data.

There is also a guest identity: a shared access code unlocks only the public read-aloud pronunciation tool, nothing else. Guests can't reach tests, the tutor, or any management data.

What each role can do

Admin (Manager)TeacherStudent

The manager works in two full-screen workspaces:

• Quản lý trung tâm (/admin/school) — operations: overview, classes, students, teachers, schedule, attendance, tuition, cashflow, users, reports.
• Quản lý học thuật (/admin/academic) — knowledge: question bank, class↔teacher assignment + syllabus, homework assignments, materials, "Tạo đề" (test creation), AI settings.

Can: create/edit classes, enroll students, generate schedules, take attendance, record tuition payments, create tuition charges, log cashflow, author tests (all 4 skills), assign homework, manage materials, toggle AI features, watch AI usage vs. budget, change any user's role, block/unblock accounts, and see every student's and teacher's data.

Unrestricted by the teacher-scoping rules — an admin sees all classes, all students, all money.

Works in a dark-sidebar teaching workspace (/teacher).

Can: see and manage only their own classes and students; grade Writing and Speaking queues for their students; author and publish question-bank items; create and assign homework to their own classes/students; view student profiles and attempt reports for their students.

Cannot: see other teachers' classes, students, rosters, or assignment progress; touch tuition/cashflow (admin-only); change roles or block users; assign homework to students outside their classes.

Teacher-scoping is enforced everywhere

A helper checks class ownership on every teacher-facing endpoint (student lists, profiles, grading queues, attendance, sessions, assignments, notifications). A teacher cannot read or write another teacher's data even by guessing IDs.

Works in a light student shell with a mobile bottom-nav.

Can: see their dashboard (band radar, recent activity), do assigned homework across the 4 skills, use the AI Tutor when the manager has enabled it, read their own history and attempt reports, and use the public read-aloud tool.

Cannot: freely browse or take unassigned tests (homework-only, enforced server-side); see any other student's data; reach any teacher or admin screen; see AI bands presented as final before a teacher approves them.

Homework-only, but history stays readable

Students may only take/submit assigned content, but they can always read a test they were assigned or already completed — so their history and reports render correctly. A brand-new, never-assigned test returns nothing to a student.

Access model in plain terms

graph TD
  R[Any request] --> A{Logged in?}
  A -- No --> G{Valid access code?}
  G -- Yes --> GU[Guest: read-aloud only]
  G -- No --> X[401 Unauthorized]
  A -- Yes --> C{Account still active?}
  C -- No --> X
  C -- Yes --> D{Role check for this action}
  D -- Student --> S[Own data + assigned work only]
  D -- Teacher --> T[Own classes/students only]
  D -- Admin --> ADM[Everything]

Two guarantees added in the 2026 security hardening:

1. Deactivation is immediate. Blocking or demoting an account takes effect on the next request — the login token is re-checked against the live account every time, not trusted for its full 7-day life.
2. The manager's account controls are real. Changing a role and blocking/unblocking a user are working, admin-only operations (they used to be dead buttons).

See Security for the full posture.