Access & roles

Who can reach which portal. Enforced at the route layer (requireRole) and the API layer (tRPC procedures).
A signed-in user who opens a portal they're not allowed is redirected to their own. Admin is a super-role with access to every portal. The public homepage redirects a real logged-in user to their portal.

Access matrix

PortalAdminAuthorSchoolAdminTeacherParentStudent
Public homepage
/public
Reader
/readerany signed-in
Author Studio
/author · /studio
····
School Admin
/school
····
Teacher
/teacher
····
Family
/parent
····
Student
/student
····
Admin Console
/admin
·····