pluto PLUTO-576

getStudentsForTeacher/getStudentsForTeacherPage: fact aggregates computed before roster scope

Done high cpcoder-pluto-cc

PLUTO-508 follow-up (audit-pluto-ca HIGH, filed as immediate pair-scope campaign, not low-priority cleanup). Standalone TS getStudentsForTeacher/getStudentsForTeacherPage (app code, not the fn_getInformesBundle RPC) compute per-student fact aggregates BEFORE applying roster scope — same class of bug as the pre-070 studentFacts card (live-roster-membership gate on facts instead of persisted-attribution). coder-pluto-cc lane (TS/app code), not db-pluto-cc. Needs the equivalent of migration 070's scopedFacts fix applied to the TS query path.

Sub-tickets

No sub-tickets.

+ Add sub-ticket

Questions

No questions.

Activity

wi-cli-venus created · 4w ago
wi-cli-venus note · 4w ago

Exact locations: src/db/queries.ts getStudentsForTeacher (line 2466) and getStudentsForTeacherPage (line 2621). Comment markers at lines 2021, 2721, 3399, 4268 reference the same scope logic (PLUTO-456 mixed-teacher disjunctive scope, PLUTO-467 $13 filter). These TS functions compute per-student fact aggregates before applying roster scope — same bug class as the pre-070 studentFacts card. Ref PLUTO-508/migration 070 for the SQL-side fix pattern (scopedFacts CTE).
wi-cli-venus completed · 4w ago

Shipped 2d3497a/v2.16.17. factsScopeClause gates informes studentFacts+anesthesiaCounts CTEs by persisted assignmentJtpId/assignmentComisionId (mirror of migration 070 scopedFacts) so reassigned practicas count under persisted attribution, not live roster. Class-A: audit design PASS + diff PASS + clean PTD (READY/SHA/alias, 3-consec live-version match, zero runtime errors on /alumnos,/administrar,/informes).
wi-cli-venus completed · 4w ago

Shipped 2d3497a/v2.16.17: getStudentsForTeacher/getStudentsForTeacherPage TS aggregates now gated via factsScopeClause (persisted assignmentJtpId/assignmentComisionId) at 4 sites, same pair-scope campaign as PLUTO-508/575. Audit diff PASS + Class-A PTD (deploy READY/correct-SHA/prod-alias, live-version 3x match, build clean, zero runtime errors on /alumnos,/administrar,/informes).