Notas — Libro de Clases

Most school-management demos start with the grading screen because it's the part people want to see. But a platform meant to serve more than one school has a harder constraint underneath: no school should ever be able to see another school's students, grades or staff — not by a bug, not by an edge case.

A pnpm monorepo: a NestJS + Prisma + PostgreSQL API, and a Next.js admin panel. Authentication runs on JWT with role-based access control across three roles — admin, docente, apoderado — and every single query is scoped by the authenticated user's schoolId at the application layer.

That application-level filter is real isolation today, but it's not the last word: Row-Level Security in Postgres is the next hardening layer, planned before this goes anywhere near production. Naming that gap explicitly is part of doing the architecture right.

1. 01
   Phase 1 — MVP scaffold

   Multi-school tenancy, identity, and CRUD for base entities: schools, school years, courses, subjects, staff.
2. 02
   Stabilization

   Fixed build-time and runtime bugs found during the first full end-to-end run.
3. 03
   Phase 2 — Academic core

   Grading engine, attendance, behavior notes, and year-end closing.
4. 04
   Phase 3 — Guardian access

   Guardian portal and RBAC data scoping for the apoderado role.