School Scoping and Authorization

Kralis is a multi-school platform. The authenticated user’s school is the tenant boundary for normal application work.

Home school and active school

Most clients only work with one school at a time. The API exposes the current school context so a client does not need to invent or accept arbitrary school identifiers:

API value	Meaning	Client use
`authUser.school`	The authenticated account’s permanent home school	Use for account/profile identity and home-school information
`authSchool`	The school selected for the current authenticated request	Use for school-scoped screens, filters, labels, and follow-up operations
Object `school` fields	The school that owns a returned object	Use as display/context data; do not use it to broaden authorization

For an ordinary school user, the home and active schools are the same. Kralis support operators may have an internal support context that differs, but public clients must not treat that as a general multi-school capability or offer an arbitrary school switcher. The API still enforces the active school, permissions, object state, and any relationship-based restrictions on every operation. When a client needs the signed-in user’s own profile, use authUser. When it needs the school currently governing the request, use authSchool. Do not assume that a broad users query is a substitute for either value.

Client responsibilities

Do	Do not
Use `authSchool` for current school-scoped work	Ask the user to type an arbitrary school identifier
Use opaque IDs returned by the API	Guess IDs or build authorization from URL values
Use `authUser` for the signed-in account	Find the signed-in account by searching all users
Hide actions unavailable to the current role	Assume hiding a button replaces server authorization
Handle permission errors as expected outcomes	Retry a forbidden operation with another school ID
Refresh context after role or school changes	Cache authorization decisions indefinitely

Roles and relationships

Access may depend on more than a broad role. A teacher’s classes or subjects, a student’s class and section, an LMS enrollment, a CBT session’s eligibility, or a Classroom access grant can narrow what the user may see and do.

IDs

Use IDs from authenticated responses for follow-up GraphQL operations. Do not derive authorization from a school acronym, name, slug, or a copied URL; the API applies the signed-in user’s school and role.

Diagnosing missing data

A globally privileged-looking account is not permission to mix schools in a public client. Render and operate within the school context authorized by the API.

​Home school and active school

​Client responsibilities

​Roles and relationships

​IDs

​Diagnosing missing data

Home school and active school

Client responsibilities

Roles and relationships

IDs

Diagnosing missing data