Add 4 files, update 15 files

src/lib/role-access.test.ts

@@ -50,11 +50,21 @@ describe('role access', () => {
     expect(canAccessView('PARENT', 'parent-portal')).toBeTrue();
   });
 
+  test('keeps student and parent menus free of staff-only administration tools', () => {
+    for (const role of ['STUDENT', 'PARENT'] as const) {
+      expect(canAccessView(role, 'settings')).toBeFalse();
+      expect(canAccessView(role, 'analytics')).toBeFalse();
+      expect(canAccessView(role, 'student-detail')).toBeFalse();
+    }
+  });
+
   test('does not grant vice principals administrator account control', () => {
     expect(canManageUser('VICE_PRINCIPAL', 'TEACHER')).toBeFalse();
     expect(canManageUser('SCHOOL_ADMIN', 'SCHOOL_ADMIN', true)).toBeFalse();
     expect(canManageUser('SCHOOL_ADMIN', 'SUPER_ADMIN')).toBeFalse();
     expect(canManageUser('SUPER_ADMIN', 'SCHOOL_ADMIN')).toBeTrue();
+    expect(canManageUser('SCHOOL_ADMIN', 'VICE_PRINCIPAL')).toBeTrue();
+    expect(canManageUser('VICE_PRINCIPAL', 'SCHOOL_ADMIN')).toBeFalse();
   });
 
   test('allows student record mutation only to administrators and teachers', () => {

src/lib/teacher-leave-policy.test.ts

@@ -0,0 +1,15 @@
+import { describe, expect, test } from 'bun:test';
+import { canApproveTeacherLeave, canCreateTeacherLeaveCalendarEvent, canViewTeacherPrivateNotes } from './teacher-leave-policy';
+
+describe('teacher leave policy', () => {
+  test('keeps final approval and private notes with administrators', () => {
+    expect(canApproveTeacherLeave('SCHOOL_ADMIN')).toBeTrue();
+    expect(canApproveTeacherLeave('VICE_PRINCIPAL')).toBeFalse();
+    expect(canViewTeacherPrivateNotes('TEACHER')).toBeFalse();
+  });
+
+  test('creates one calendar event after approval', () => {
+    expect(canCreateTeacherLeaveCalendarEvent({ approvalStatus: 'approved', calendarEventId: null })).toBeTrue();
+    expect(canCreateTeacherLeaveCalendarEvent({ approvalStatus: 'pending', calendarEventId: null })).toBeFalse();
+  });
+});

src/lib/teacher-leave-policy.ts

@@ -0,0 +1,14 @@
+export function canApproveTeacherLeave(role: string | undefined): boolean {
+  return role === 'SCHOOL_ADMIN' || role === 'SUPER_ADMIN';
+}
+
+export function canViewTeacherPrivateNotes(role: string | undefined): boolean {
+  return role === 'SCHOOL_ADMIN' || role === 'SUPER_ADMIN';
+}
+
+export function canCreateTeacherLeaveCalendarEvent(absence: {
+  approvalStatus: string;
+  calendarEventId: string | null;
+}): boolean {
+  return absence.approvalStatus === 'approved' && !absence.calendarEventId;
+}