Approving docente_ayudante_primera access requests never inserts jtpAyudantes row
Root cause confirmed by audit-pluto-ca (Cecilia Tebes case, systemic not one-off): admin-actions.ts:2118-2238 approves docente_ayudante_primera requests (creates users/userRoles/studentAssignments) but never inserts the corresponding jtpAyudantes row. jtpAyudantes is a fraud-sensitive assignment table (pluto-commons Soft Deletes And Fraud Tables) -> Class-A, needs pre-impl audit-pluto-ca design-ping before implementation. Fix = insert jtpAyudantes inside the same approval transaction (with app.user_id/app.archive_reason sentinel context, archive-triggered table). Backfill for already-approved-but-missing rows is a separate paired data-repair step once the source fix lands, per No-Proactive-DB-Edits (source fix first, then backfill with setArchiveContext). db-pluto-cc offered a read-only count of affected historical rows. Report: shared/reports/2026-07-16-0632-access-request-jtpayudante-gap.md (db-pluto-cc's local path, not yet pushed).
Questions
Activity
-
Affected-row count (db-pluto-cc): 1 row only — Cecilia Tebes (requestId 2402db99-6cd6-4b96-ad35-b446e7e6b4b1, userId deb79921-cf9d-4eb3-a281-7222dc3f23ea, reviewedAt 2026-06-16). Low volume, not a backlog of broken users. db holding the 1-row backfill insert (archive-context) until coder lands the approval-transaction source fix, per PM sequencing call.
-
Root cause broader than missing insert (coder-pluto-cc): approveAccessRequest never branches on requesterRole, hardcodes alumno role + writes a bogus studentAssignment for EVERY request type incl docente_ayudante_primera. So Cecilia Tebes has: wrong alumno role + bogus studentAssignment + missing jtpAyudantes - backfill must flip role + soft-delete the bad studentAssignment, not just insert the fraud row. Same latent defect exists for docente_jtp/docente_adjunto (not yet fired) - coder proposes scoping the immediate fix to ayudante + a follow-up WI for jtp/adjunto, pending audit-pluto-ca's design ruling. All code held for audit design PASS.
-
Fixed 0b7a32b/v2.16.2: approveAccessRequest now branches on requesterRole, inserts jtpAyudantes in-txn w/ archive context, assigns ayudante not alumno. Audit PASS + Class-A PTD confirmed live (2.16.2). Backfill for Cecilia Tebes pending (db-pluto-cc), held per fleet pause. jtp/adjunto follow-up tracked as PLUTO-567.