Security overview

Authentication, sessions, password policy, activity audit export, PWA shell, and day-school MVP boundaries.

Security & compliance guide for day and boarding schools.

Last updated August 27, 2026

Schoolyi uses credential-based sign-in with NextAuth sessions. Passwords are hashed with bcrypt. API routes validate sessions server-side; sensitive operations check role capabilities. Parents and students may also sign in with a one-time magic-link email.

Core controls

Sign-in at /signin - password for all personas; magic link for parent and student only (15 min expiry)
Session validation on API mutations - unauthorized returns 401, forbidden returns 403
Forced password change when mustChangePassword is set - redirects to /profile (enrollment and admin-created accounts)
Activity log - auditable record of sign-ins and data mutations (90 days in MySQL); CSV and SIEM NDJSON export from /activity-log
Public marketing, documentation at /docs, and admissions apply paths are explicitly allowlisted in middleware
Logged-in header Docs icon (BookOpen) opens /docs without leaving the app shell

Installable PWA shell

A minimal Progressive Web App shell supports parents and drivers on mobile: public/manifest.webmanifest (standalone, start_url /parent-dashboard), public/sw.js (network-first app routes; offline fallback), /offline page, and PwaRegister in the root layout. Live data still requires a network connection - the offline page is a reconnect prompt, not a cached app.

Common security issues

Symptom	Check	Fix
User gets 403 on a screen they need	Role capabilities	Review role template at /roles; assign correct role at /users. Teachers are scoped to assigned classes.
Session expires immediately	Clock and cookies	Check server time sync; clear browser cookies; verify NEXTAUTH_URL matches public URL.
Activity log export empty	Retention window	Log retains ~90 days in MySQL; export CSV or SIEM NDJSON from /activity-log before purge if longer retention required.
Parent sees another familys data	Portal scoping	Escalate immediately — verify parent-student links at /parents; APIs filter by linked children only.

Common questions

Quick answers in plain language.

What security controls does Schoolyi provide out of the box?+

Bcrypt password hashing, NextAuth sessions validated on every API mutation, RBAC per screen, 90-day activity log with CSV/SIEM export at /activity-log, magic-link for parent/student (15 min), and forced password change for provisioned accounts.