Add teacher management panel functionality and related configurations

.env.example

@@ -16,3 +16,11 @@ SUPABASE_PUBLISHABLE_KEY=
 
 # Optional: the only Google accounts let in, separated by commas or spaces. Empty = any Google account.
 ALLOWED_EMAILS=
+
+# Optional: the teacher's account (or several). It must also be in ALLOWED_EMAILS. After sign-in a teacher chooses
+# between "תרגול" (the same as a student) and "ניהול" (the management panel: every student's progress).
+TEACHER_EMAILS=
+
+# Needed by the management panel only: the project's secret key (Project Settings -> API Keys -> secret, or the
+# legacy service_role key). It reads every student's rows, so it is NOT public: on Hugging Face set it as a *secret*.
+SUPABASE_SECRET_KEY=

README.md

@@ -96,7 +96,13 @@ create policy "students read their own attempts" on public.attempts
 
 The page's "ההתקדמות שלי" button reads these rows back through `GET /api/progress` (best score and tries per phrase, recordings, days practised) and shows them per topic; the best scores then follow the student between devices.
 
-The teacher's view, also in the SQL editor (it runs as the owner, so it sees every student):
+### The teacher
+
+`TEACHER_EMAILS` names the teacher's Google account (several are separated like `ALLOWED_EMAILS`, and each must also be on that list). After sign-in a teacher chooses between **תרגול**, the same practice a student gets, and **ניהול**, the management panel. The panel lists every student with their usage (recordings, those of the last 7 days, days practised, last practice), progress (sentences practised) and grade (the average of the best scores), and a student opens on the same figures per topic. The students are the accounts in `ALLOWED_EMAILS`, including those who have not signed in yet; without a list, every account that signed in.
+
+The panel reads through `GET /api/class`, which answers teachers only. Row-level security hides other students' rows from the teacher's own token, so the server reads them with `SUPABASE_SECRET_KEY` (Supabase → Project Settings → API Keys → secret key). Unlike the publishable key it must stay private: set it as a Space **secret**. Without it the panel opens and says the data is not available.
+
+The same figures as a query, in the SQL editor (it runs as the owner, so it sees every student):
 
 ```sql
 select u.email, a.cat, count(distinct a.phrase) as phrases, count(*) as tries,

app/auth.py

@@ -6,9 +6,15 @@ kept here and a session revoked in Supabase stops working within CACHE_TTL.
 Progress: each scored recording is added to the Supabase table `attempts` with the student's own
 token, so row-level security ties the row to them (the table's SQL is in the README).
 
+Teachers: the accounts in TEACHER_EMAILS also get the management panel, which shows every student's
+progress. Those rows are read with the project's secret key, which passes row-level security and
+never leaves the server.
+
 Env:  SUPABASE_URL              (https://<project-ref>.supabase.co)
       SUPABASE_PUBLISHABLE_KEY  (the publishable/anon key; it is public and also goes to the page)
       ALLOWED_EMAILS            (optional: the only accounts let in, separated by commas or spaces)
+      TEACHER_EMAILS            (optional: the accounts with the management panel; each is also in ALLOWED_EMAILS)
+      SUPABASE_SECRET_KEY       (the secret/service-role key, needed by the management panel only; never public)
 Without them the service is open, as before.
 """
 from __future__ import annotations
@@ -29,6 +35,7 @@ CACHE_TTL = 300  # seconds a checked token is trusted without asking again
 CACHE_MAX = 2000
 PAGE = 1000  # rows per request: Supabase's default ceiling
 MAX_ATTEMPTS = 20_000  # of one student, read for their progress
+MAX_CLASS_ATTEMPTS = 200_000  # of all students, read for the teacher's panel
 
 
 class AuthUnavailable(RuntimeError):
@@ -36,9 +43,12 @@ class AuthUnavailable(RuntimeError):
 
 
 class SupabaseAuth:
-    def __init__(self, url: str, key: str, allowed: frozenset[str] = frozenset()):
+    def __init__(self, url: str, key: str, allowed: frozenset[str] = frozenset(),
+                 teachers: frozenset[str] = frozenset(), secret: str = ""):
         self.url, self.key = url.rstrip("/"), key
         self.allowed = allowed  # lower-case emails; empty = every signed-in account
+        self.teachers = teachers  # lower-case emails of the accounts with the management panel
+        self.secret = secret  # reads every student's rows; empty = the panel has no data
         self._cache: dict[str, tuple[float, dict]] = {}
         self._lock = threading.Lock()
 
@@ -90,13 +100,8 @@ class SupabaseAuth:
         while len(rows) < MAX_ATTEMPTS:
             query = urllib.parse.urlencode({"select": "cat,phrase,score,created_at", "unrelated": "is.false",
                                             "order": "created_at.desc", "limit": PAGE, "offset": len(rows)})
-            req = urllib.request.Request(
-                f"{self.url}/rest/v1/attempts?{query}",
-                headers={"Authorization": f"Bearer {token}", "apikey": self.key, "User-Agent": "ihki/1.0"},
-            )
             try:
-                with urllib.request.urlopen(req, timeout=TIMEOUT) as res:
-                    batch = json.load(res)
+                batch = self._get(f"/rest/v1/attempts?{query}", token, self.key)
             except (urllib.error.URLError, TimeoutError, ValueError) as e:
                 log.warning("attempts not read: %s", e)
                 break
@@ -105,6 +110,44 @@ class SupabaseAuth:
                 break
         return rows
 
+    def _get(self, path: str, token: str, key: str):
+        req = urllib.request.Request(
+            self.url + path, headers={"Authorization": f"Bearer {token}", "apikey": key, "User-Agent": "ihki/1.0"})
+        with urllib.request.urlopen(req, timeout=TIMEOUT) as res:
+            return json.load(res)
+
+    def _admin(self, path: str):
+        """A read with the secret key, for the teacher's panel. Unlike a student's own progress, a failure is raised."""
+        if not self.secret:
+            raise AuthUnavailable("SUPABASE_SECRET_KEY is not set")
+        try:
+            return self._get(path, self.secret, self.secret)
+        except (urllib.error.URLError, TimeoutError, ValueError) as e:
+            raise AuthUnavailable(str(e)) from e
+
+    def users(self) -> list[dict]:
+        """Every account that has signed in: id, email, name (as Google gave it)."""
+        users: list[dict] = []
+        for page in range(1, 51):
+            batch = self._admin(f"/auth/v1/admin/users?page={page}&per_page={PAGE}").get("users", [])
+            users += [{"id": u["id"], "email": u.get("email") or "",
+                       "name": (u.get("user_metadata") or {}).get("full_name") or ""} for u in batch]
+            if len(batch) < PAGE:
+                break
+        return users
+
+    def all_attempts(self) -> list[dict]:
+        """Every student's attempts, as `attempts` gives one student's, each with its user_id."""
+        rows: list[dict] = []
+        while len(rows) < MAX_CLASS_ATTEMPTS:
+            query = urllib.parse.urlencode({"select": "user_id,cat,phrase,score,created_at", "unrelated": "is.false",
+                                            "order": "id.desc", "limit": PAGE, "offset": len(rows)})
+            batch = self._admin(f"/rest/v1/attempts?{query}")
+            rows += batch
+            if len(batch) < PAGE:
+                break
+        return rows
+
 
 def load_auth() -> SupabaseAuth | None:
     url = os.environ.get("SUPABASE_URL", "").strip()
@@ -115,6 +158,12 @@ def load_auth() -> SupabaseAuth | None:
         log.info("no sign-in, the service is open: %s missing or empty (similar names in the environment: %s)",
                  " and ".join(missing), seen or "none")
         return None
-    allowed = frozenset(re.split(r"[\s,;]+", os.environ.get("ALLOWED_EMAILS", "").strip().lower())) - {""}
+    emails = lambda name: frozenset(re.split(r"[\s,;]+", os.environ.get(name, "").strip().lower())) - {""}
+    allowed, teachers = emails("ALLOWED_EMAILS"), emails("TEACHER_EMAILS")
+    secret = os.environ.get("SUPABASE_SECRET_KEY", "").strip()
     log.info("sign-in on: %s", f"{len(allowed)} allowed accounts" if allowed else "any Google account")
-    return SupabaseAuth(url, key, allowed)
+    if allowed and teachers - allowed:   # counts only: the addresses stay out of the log
+        log.warning("%d of TEACHER_EMAILS are not in ALLOWED_EMAILS and will not be let in", len(teachers - allowed))
+    if teachers and not secret:
+        log.warning("TEACHER_EMAILS is set without SUPABASE_SECRET_KEY: the management panel has no data to show")
+    return SupabaseAuth(url, key, allowed, teachers, secret)

app/main.py

@@ -4,6 +4,7 @@ Run:  uvicorn app.main:app --host 0.0.0.0 --port 7860
 Env:  MODEL_ID  (default facebook/wav2vec2-xlsr-53-espeak-cv-ft, or a path to a fine-tuned checkpoint)
       SAWTAK_API_KEY, SAWTAK_VOICE_ID  (model-answer playback, see app/tts.py)
       SUPABASE_URL, SUPABASE_PUBLISHABLE_KEY, ALLOWED_EMAILS  (Google sign-in, see app/auth.py)
+      TEACHER_EMAILS, SUPABASE_SECRET_KEY  (the teacher's management panel, see app/auth.py)
 A local .env file is loaded if present; real environment variables win over it.
 """
 from __future__ import annotations
@@ -15,7 +16,7 @@ import re
 import time
 import urllib.parse
 from contextlib import asynccontextmanager
-from datetime import datetime, timezone
+from datetime import datetime, timedelta, timezone
 from pathlib import Path
 from zoneinfo import ZoneInfo
 
@@ -49,6 +50,29 @@ def build_version() -> str:
     return f"{h.hexdigest()[:7]} · {time.strftime('%Y-%m-%d %H:%M', time.gmtime(newest))} UTC"
 
 
+def summary(rows: list[dict]) -> dict:
+    """One student's attempts summed up: best score and tries per phrase id, recordings (all, and of the last
+    7 days), days practised, time of the last one."""
+    shown = {c["id"] for c in CATEGORIES}
+    ids = {(p["cat"], p["he"]): i for i, p in enumerate(PHRASES) if p["cat"] in shown}
+    best: dict[int, int] = {}
+    tries: dict[int, int] = {}
+    days, week, last = set(), 0, None
+    since = datetime.now(timezone.utc) - timedelta(days=7)
+    for r in rows:
+        # the seconds part only: the fraction's length varies, which Python 3.10 does not parse
+        at = datetime.strptime(r["created_at"][:19], "%Y-%m-%dT%H:%M:%S").replace(tzinfo=timezone.utc)
+        days.add(at.astimezone(LOCAL_TZ).date())
+        week += at >= since
+        last = max(last, at) if last else at
+        i = ids.get((r["cat"], r["phrase"]))
+        if i is not None:   # a sentence the page no longer lists still counts as a recording
+            best[i] = max(best.get(i, 0), r["score"])
+            tries[i] = tries.get(i, 0) + 1
+    return {"best": best, "tries": tries, "recordings": len(rows), "days": len(days), "week": week,
+            "last": last.isoformat() if last else None}
+
+
 def create_app(scorer: Scorer | None = None, tts: SawtakTTS | None = None,
                auth: SupabaseAuth | None = None) -> FastAPI:
     @asynccontextmanager
@@ -77,7 +101,7 @@ def create_app(scorer: Scorer | None = None, tts: SawtakTTS | None = None,
             raise HTTPException(401, "sign in required")
         if a.allowed and user["email"].lower() not in a.allowed:
             raise HTTPException(403, "this account is not on the list")
-        return {**user, "token": token.strip()}
+        return {**user, "token": token.strip(), "teacher": user["email"].lower() in a.teachers}
 
     members = [Depends(signed_in)]
 
@@ -93,26 +117,33 @@ def create_app(scorer: Scorer | None = None, tts: SawtakTTS | None = None,
     @app.get("/api/me")
     def me(user: dict | None = Depends(signed_in)):
         """Who is signed in; the page asks this right after sign-in to learn whether the account is let in."""
-        return {"email": user["email"] if user else ""}
+        return {"email": user["email"] if user else "", "teacher": bool(user and user["teacher"])}
 
     @app.get("/api/progress")
     def progress(user: dict | None = Depends(signed_in)):
         """The signed-in student's progress: best score and tries per phrase id, recordings, days practised."""
-        best: dict[int, int] = {}
-        tries: dict[int, int] = {}
-        days = set()
-        rows = app.state.auth.attempts(user["token"]) if user else []
-        shown = {c["id"] for c in CATEGORIES}
-        ids = {(p["cat"], p["he"]): i for i, p in enumerate(PHRASES) if p["cat"] in shown}
+        s = summary(app.state.auth.attempts(user["token"]) if user else [])
+        return {k: s[k] for k in ("best", "tries", "recordings", "days")}
+
+    @app.get("/api/class")
+    def class_progress(user: dict | None = Depends(signed_in)):
+        """The teacher's panel: every student's summary (see `summary`). The students are the allowed accounts,
+        or every account that signed in when there is no list; one that never signed in has joined = false."""
+        if not user or not user["teacher"]:
+            raise HTTPException(403, "teachers only")
+        a: SupabaseAuth = app.state.auth
+        try:
+            users, rows = a.users(), a.all_attempts()
+        except AuthUnavailable as e:
+            raise HTTPException(503, str(e))
+        by: dict[str, list[dict]] = {}
         for r in rows:
-            # the seconds part only: the fraction's length varies, which Python 3.10 does not parse
-            at = datetime.strptime(r["created_at"][:19], "%Y-%m-%dT%H:%M:%S").replace(tzinfo=timezone.utc)
-            days.add(at.astimezone(LOCAL_TZ).date())
-            i = ids.get((r["cat"], r["phrase"]))
-            if i is not None:   # a sentence the page no longer lists still counts as a recording
-                best[i] = max(best.get(i, 0), r["score"])
-                tries[i] = tries.get(i, 0) + 1
-        return {"best": best, "tries": tries, "recordings": len(rows), "days": len(days)}
+            by.setdefault(r["user_id"], []).append(r)
+        students = [{"email": u["email"], "name": u["name"], "joined": True, **summary(by.get(u["id"], []))}
+                    for u in users if not a.allowed or u["email"].lower() in a.allowed]
+        missing = a.allowed - {s["email"].lower() for s in students}
+        students += [{"email": e, "name": "", "joined": False, **summary([])} for e in sorted(missing)]
+        return {"students": students}
 
     @app.get("/api/phrases")
     def phrases():

static/index.html

@@ -141,6 +141,28 @@ header .sub.maphint{flex:0 0 100%;color:var(--ink)}
 .tips .what .ar{font-family:var(--f-ar);font-size:14px;font-weight:400;color:var(--muted)}
 #denied{text-align:center;font:600 18px/1.5 var(--f-body);color:#1C241D;padding:0 20px}
 #denied button{display:block;margin:12px auto 0;font:600 16px/1 var(--f-body);padding:10px 22px;border-radius:10px;border:1px solid #4B6A2C;background:#fff;color:#4B6A2C;cursor:pointer}
+/* The teacher's panel: a card per student (name, grade, how much was practised and when) that opens on its topics. */
+body:not(.manage) #manage,body.manage #wrap>header,body.manage #path,body.manage #toNow,body.manage #practice,body:not(.home) #toManage{display:none}
+.mtitle{font:400 24px/1 var(--f-display);margin:0}
+#mList{display:flex;flex-direction:column;gap:10px}
+.stu{display:block;padding:0}
+.stu summary{display:grid;grid-template-columns:1fr auto;gap:6px 10px;align-items:center;padding:12px 16px;cursor:pointer;list-style:none}
+.stu summary::-webkit-details-marker{display:none}
+.stu .who{display:flex;flex-direction:column;align-items:flex-start;min-width:0}
+.stu .who b{font-weight:700;overflow-wrap:anywhere}
+.stu .who small,.stu .stats{color:var(--muted);font-size:14px}
+.stu .none{color:var(--muted);font-size:13px}
+.stu .stats,.stu .progress{grid-column:1/-1;margin:0}
+.stu h3{margin:0;padding:8px 16px 2px;border-top:1px solid var(--line);font:700 13px/1.4 var(--f-body);color:var(--muted)}
+.trow{display:grid;grid-template-columns:1fr auto auto 3em;gap:10px;align-items:center;padding:5px 16px;font-size:15px}
+.trow small{color:var(--muted);font-size:13px;white-space:nowrap;font-variant-numeric:tabular-nums}
+.trow .pill,.trow .none{justify-self:end}
+.trow.untouched{color:var(--muted)}
+.hard{gap:0;padding:12px 0 6px}
+.hard h2{margin:0;padding:0 16px 6px;font:400 19px/1.2 var(--f-display)}
+.hard h2 small{display:block;margin-top:2px;font:600 13px/1.3 var(--f-body);color:var(--muted)}
+.hard .trow{grid-template-columns:1fr auto auto 3em;border-top:1px solid var(--line);padding-block:7px}
+.hard .trow span:first-child{display:flex;flex-direction:column;font-weight:600}
 #logoutBtn{position:fixed;bottom:4px;right:6px;z-index:9;font:500 11px/1 var(--f-body);padding:3px 8px;border-radius:6px;border:1px solid var(--line);background:var(--surface);color:var(--muted);cursor:pointer}
 .drive{margin-inline-start:auto;font:700 15px var(--f-body);border-radius:999px;padding:6px 14px;cursor:pointer;border:1px solid var(--olive);background:transparent;color:var(--olive)}
 body.driving .drive{background:var(--sumac);border-color:var(--sumac);color:#fff}
@@ -208,9 +230,11 @@ body.driving .card.storymode .prompt{display:block}
 #logo-splash{position:fixed;inset:0;z-index:9999;display:flex;flex-direction:column;align-items:center;justify-content:center;gap:28px;background:white;transition:opacity .35s ease,visibility .35s ease}
 #logo-splash.done{opacity:0;visibility:hidden;pointer-events:none}
 #logo-splash img{width:min(82vw,620px);height:auto}
-#startBtn,#loginBtn{font:400 24px/1 var(--f-display);padding:14px 34px;border-radius:14px;border:0;cursor:pointer;background:#4B6A2C;color:#fff;opacity:0;animation:start-in .45s ease-out 2.1s forwards}
+#startBtn,#loginBtn,#roles button{font:400 24px/1 var(--f-display);padding:14px 34px;border-radius:14px;border:0;cursor:pointer;background:#4B6A2C;color:#fff;opacity:0;animation:start-in .45s ease-out 2.1s forwards}
+#roles{display:flex;gap:14px;flex-wrap:wrap;justify-content:center}
+#roles #manageBtn{background:#fff;color:#4B6A2C;box-shadow:inset 0 0 0 2px #4B6A2C}
 @keyframes start-in{from{opacity:0;transform:translateY(8px)}to{opacity:1;transform:none}}
-@media (prefers-reduced-motion:reduce){#startBtn,#loginBtn{animation:none;opacity:1}#logo-splash{transition:none}}
+@media (prefers-reduced-motion:reduce){#startBtn,#loginBtn,#roles button{animation:none;opacity:1}#logo-splash{transition:none}}
 </style>
 </head>
 <body class="home">
@@ -226,12 +250,13 @@ body.driving .card.storymode .prompt{display:block}
   <symbol id="i-mic" viewBox="0 0 24 24"><rect x="9" y="2" width="6" height="12" rx="3"/><path d="M5 11a7 7 0 0 0 14 0M12 18v4M8 22h8"/></symbol>
   <symbol id="i-car" viewBox="0 0 24 24"><path d="M19 17h2c.6 0 1-.4 1-1v-3c0-.9-.7-1.7-1.5-1.9C18.7 10.6 16 10 16 10s-1.3-1.4-2.2-2.3c-.5-.4-1.1-.7-1.8-.7H5c-.6 0-1.1.4-1.4.9l-1.4 2.9A3.7 3.7 0 0 0 2 12v4c0 .6.4 1 1 1h2M9 17h6"/><circle cx="7" cy="17" r="2"/><circle cx="17" cy="17" r="2"/></symbol>
 </defs></svg>
-<div id="logo-splash"><img src="static/logo-intro.svg" alt="אהלא וסהלא, בית הספר ללימוד השפה הערבית" width="489" height="225"><button id="startBtn">יאללה נבלש</button><button id="loginBtn" hidden>כניסה עם Google</button><div id="denied" hidden>החשבון הזה אינו ברשימת התלמידים.<button id="switchBtn">כניסה עם חשבון אחר</button></div></div>
+<div id="logo-splash"><img src="static/logo-intro.svg" alt="אהלא וסהלא, בית הספר ללימוד השפה הערבית" width="489" height="225"><button id="startBtn">יאללה נבלש</button><div id="roles" hidden><button id="practiceBtn">תרגול</button><button id="manageBtn">ניהול</button></div><button id="loginBtn" hidden>כניסה עם Google</button><div id="denied" hidden>החשבון הזה אינו ברשימת התלמידים.<button id="switchBtn">כניסה עם חשבון אחר</button></div></div>
 <div class="wrap" id="wrap" inert>
   <header>
     <div class="brand">אהלא וסהלא</div>
     <div class="where"><small id="lessonName"></small><span id="catName"></span></div>
     <div class="sub maphint">בחרו נושא במסלול ותרגלו אותו בקול</div>
+    <button class="drive" id="toManage" hidden>ניהול</button>
     <button class="drive" id="driveBtn" title="מצב נסיעה: האפליקציה מקריאה, מקשיבה ואומרת את ההערכה בקול"><svg class="ic" aria-hidden="true"><use href="#i-car"/></svg> מצב נסיעה</button>
   </header>
 
@@ -288,6 +313,13 @@ body.driving .card.storymode .prompt{display:block}
   </main>
 
   </div>
+
+  <section class="wrap" id="manage" aria-labelledby="mTitle">
+    <div class="roundbar"><h1 class="mtitle" id="mTitle">ניהול</h1><span class="sep"></span><button class="btn" id="mRefresh">רענון</button><button class="btn primary" id="mPractice">לתרגול</button></div>
+    <div class="sub" id="mState" aria-live="polite"></div>
+    <div class="card hard" id="mHard" hidden></div>
+    <div id="mList"></div>
+  </section>
 </div>
 <dialog id="listDlg" aria-labelledby="listTitle">
   <div class="dlg-head"><h2 id="listTitle"></h2><button class="btn" id="listClose">סגירה</button></div>
@@ -1003,7 +1035,73 @@ $("driveBtn").onclick=async()=>{
   drive();
 };
 
-fetch("/api/phrases").then(r=>r.json()).then(d=>{
+/* ---------- the teacher's panel ----------
+   Every student's usage (recordings, days, the last time), progress (sentences practised) and grades (the average
+   of the best scores), as the server sums them up; the topics are tallied here, from the same lists the path uses. */
+function showManage(){
+  if(!home) showPath();
+  document.body.classList.add("manage"); scrollTo(0,0); loadManage();
+}
+$("toManage").onclick=$("mRefresh").onclick=showManage;
+$("mPractice").onclick=()=>{ document.body.classList.remove("manage"); drawPath(); };   // the path was not laid out while hidden
+const grade=n=>mark("pill "+(n>=EXCELLENT?"good":n>=60?"mid":"bad"),n);
+const mean=a=>a.length?Math.round(a.reduce((x,y)=>x+y,0)/a.length):null;
+async function loadManage(){
+  const state=$("mState"), box=$("mList"), hard=$("mHard");
+  state.textContent="טוען…"; box.innerHTML=""; hard.hidden=true;
+  let d;
+  try{
+    const res=await api("/api/class"); await ready;
+    if(!res.ok){
+      const detail=(await res.json().catch(()=>({}))).detail||res.status;
+      state.textContent=res.status===403?"הפאנל פתוח למורים בלבד.":`נתוני התלמידים לא זמינים כרגע (${detail}).`; return;
+    }
+    d=await res.json();
+  }catch{ state.textContent="השרת לא זמין."; return; }
+  const listed=PHRASES.filter(p=>p.listed!==false);
+  const tally=(s,list)=>{ const got=list.filter(p=>s.best[p.id]!=null); return {done:got.length, n:list.length, avg:mean(got.map(p=>s.best[p.id])), tries:list.reduce((t,p)=>t+(s.tries[p.id]||0),0)}; };
+  const all=d.students.map(s=>({...s,...tally(s,listed)}))   // the latest to practise first; those who never signed in last
+    .sort((a,b)=>(b.last||"").localeCompare(a.last||"")||b.joined-a.joined||a.email.localeCompare(b.email));
+  state.textContent=`${all.length} תלמידים · ${all.filter(s=>s.week).length} תרגלו בשבוע האחרון · ${all.reduce((t,s)=>t+s.week,0)} הקלטות בשבוע האחרון`;
+  /* The sentences the class finds hardest: the lowest average of the students' best scores. A sentence counts once
+     enough students tried it (3, or all of those who practised when they are fewer), so one student's bad try does not lead. */
+  const tried=p=>all.filter(s=>s.best[p.id]!=null), need=Math.min(3,all.filter(s=>s.done).length);
+  const worst=listed.map(p=>{ const by=tried(p); return {p,k:by.length,avg:mean(by.map(s=>s.best[p.id]))}; })
+    .filter(x=>x.k&&x.k>=need).sort((a,b)=>a.avg-b.avg||b.k-a.k).slice(0,5);
+  hard.innerHTML=""; hard.hidden=!worst.length;
+  if(worst.length){
+    const h=mark("","המשפטים הקשים ביותר","h2"); h.append(mark("","הממוצע הנמוך ביותר של הציון הטוב של כל תלמיד","small")); hard.append(h);
+    for(const x of worst){
+      const row=mark("trow",""), text=document.createElement("span"), name=document.createElement("b"), c=CATS.find(c=>c.id===x.p.cat);
+      name.style.fontWeight="inherit"; setTr(name,x.p.read?x.p.tr:x.p.he); text.append(name,mark("",c?c.name:"","small"));
+      const l=c&&LESSONS.find(l=>l.id===c.lesson);
+      row.append(text,mark("",l?l.name:"","small"),mark("",`${x.k} תלמידים`,"small"),grade(x.avg)); hard.append(row);
+    }
+  }
+  for(const s of all){
+    const det=document.createElement("details"), sum=document.createElement("summary"), who=mark("who",""), bar=mark("progress",""), fill=document.createElement("i");
+    det.className="card stu";
+    who.append(mark("",s.name||s.email,"b")); if(s.name){ const m=mark("",s.email,"small"); m.dir="ltr"; who.append(m); }
+    const when=s.last?new Date(s.last).toLocaleString("he-IL",{day:"numeric",month:"numeric",hour:"2-digit",minute:"2-digit"}):"";
+    fill.style.width=`${s.n?s.done/s.n*100:0}%`; bar.append(fill);
+    sum.append(who, s.avg!=null?grade(s.avg):mark("none",s.joined?"עוד לא תרגל/ה":"עוד לא נכנס/ה"));
+    if(s.avg!=null) sum.lastChild.title="ממוצע הציונים הטובים ביותר";
+    sum.append(mark("stats",`תורגלו ${s.done} מתוך ${s.n} משפטים · ${s.recordings} הקלטות, ${s.week} מהן בשבוע האחרון · ${s.days} ימי תרגול`+(when?` · לאחרונה ${when}`:"")),bar);
+    det.append(sum);
+    for(const l of LESSONS){
+      det.append(mark("",l.name,"h3"));
+      for(const c of CATS.filter(c=>c.lesson===l.id)){
+        const t=tally(s,listed.filter(p=>p.cat===c.id)), row=mark("trow"+(t.done?"":" untouched"),""), n=document.createElement("bdi");
+        n.dir="ltr"; n.textContent=`${t.done}/${t.n}`;
+        row.append(mark("",c.name),mark("",t.tries?`${t.tries} ניסיונות`:"","small"),mark("","","small"),t.avg!=null?grade(t.avg):mark("none","–"));
+        row.children[2].append(n); det.append(row);
+      }
+    }
+    box.append(det);
+  }
+}
+
+const ready=fetch("/api/phrases").then(r=>r.json()).then(d=>{
   LESSONS=d.lessons; CATS=d.categories; PHRASES=d.phrases;
   for(const c of CATS) c.name=c.name.replace(/ ← /g,"\u00a0←\u00a0");   // the arrow never ends a line
   for(const v of d.voices||[]) $("voiceId").add(new Option(v.name,v.id));
@@ -1014,14 +1112,17 @@ fetch("/api/phrases").then(r=>r.json()).then(d=>{
 </script>
 <script>
 /* The opening screen stays until the start button is pressed. */
-$("startBtn").onclick=()=>{
+function enter(){
   const splash=$("logo-splash");
   $("wrap").inert=false; splash.classList.add("done"); setTimeout(()=>splash.remove(),400);
-};
+}
+$("startBtn").onclick=$("practiceBtn").onclick=enter;
+$("manageBtn").onclick=()=>{ enter(); showManage(); };
 $("startBtn").focus({preventScroll:true});
-/* With sign-in configured, the start button waits behind the Google button. */
+/* With sign-in configured, the start button waits behind the Google button. A teacher gets two buttons in its
+   place: practice, as a student does, or the management panel. */
 if(AUTH_URL){
-  const start=$("startBtn"), login=$("loginBtn"), logout=$("logoutBtn");
+  const start=$("startBtn"), login=$("loginBtn"), logout=$("logoutBtn"), roles=$("roles");
   start.hidden=true; login.hidden=false;
   if(!sb){ login.disabled=true; login.textContent="הכניסה לא זמינה כרגע"; }
   else{
@@ -1034,14 +1135,15 @@ if(AUTH_URL){
     sb.auth.onAuthStateChange((_e,session)=>{
       login.hidden=!!session; logout.hidden=!session;
       logout.title=session?session.user.email||"":"";
-      if(!session){ asked=""; start.hidden=true; denied.hidden=true; login.focus({preventScroll:true}); return; }
+      if(!session){ asked=""; start.hidden=roles.hidden=true; denied.hidden=true; login.focus({preventScroll:true}); return; }
       if(asked===session.user.id) return;
       asked=session.user.id;
       setTimeout(async()=>{   // outside this callback: api() asks supabase for the session
         const res=await api("/api/me").catch(()=>null);
         const ok=!res||res.status!==403;   // a server that cannot be reached is not a refusal
-        start.hidden=!ok; denied.hidden=ok;
-        if(ok){ start.focus({preventScroll:true}); loadProgress().then(()=>{ if(PHRASES.length&&$("wrap").inert) startCat(); }); }
+        const teacher=!!(res&&res.ok&&(await res.json().catch(()=>({}))).teacher);
+        start.hidden=!ok||teacher; roles.hidden=$("toManage").hidden=!teacher; denied.hidden=ok;
+        if(ok){ (teacher?$("practiceBtn"):start).focus({preventScroll:true}); loadProgress().then(()=>{ if(PHRASES.length&&$("wrap").inert) startCat(); }); }
       },0);
     });
   }

tests/test_scoring.py

@@ -416,7 +416,7 @@ def test_sign_in_guards_the_practice_endpoints():
     VERB = next(p for p in PHRASES if p["cat"] == "l1-verbs")
 
     class FakeAuth:
-        url, key, allowed = "https://proj.supabase.co", "sb_publishable_x", frozenset()
+        url, key, allowed, teachers = "https://proj.supabase.co", "sb_publishable_x", frozenset(), frozenset()
 
         def __init__(self):
             self.rows = []
@@ -432,6 +432,13 @@ def test_sign_in_guards_the_practice_endpoints():
                     {"cat": VERB["cat"], "phrase": VERB["he"], "score": 88, "created_at": "2026-10-09T10:00:00+00:00"},
                     {"cat": TOILET["cat"], "phrase": TOILET["he"], "score": 90, "created_at": "2026-10-01T10:00:00.123456+00:00"}]
 
+        def users(self):   # the teacher, a student, and an account that is not on the list
+            return [{"id": "u1", "email": "A@b.c", "name": "Alef"}, {"id": "u2", "email": "s@b.c", "name": ""},
+                    {"id": "u3", "email": "out@b.c", "name": ""}]
+
+        def all_attempts(self):
+            return [{**r, "user_id": "u2"} for r in self.attempts("")[:2]]
+
     with TestClient(create_app(scorer_for(emissions(["w"])), auth=FakeAuth())) as c:
         page = c.get("/").text
         assert 'AUTH_URL="https://proj.supabase.co"' in page and 'AUTH_KEY="sb_publishable_x"' in page
@@ -440,11 +447,20 @@ def test_sign_in_guards_the_practice_endpoints():
         assert c.get("/api/tts/0", headers={"Authorization": "Bearer bad"}).status_code == 401
         assert c.get("/api/tts/0", headers={"Authorization": "Bearer good"}).status_code == 503   # in, but no TTS key
         good = {"Authorization": "Bearer good"}
-        assert c.get("/api/me", headers=good).json() == {"email": "A@b.c"}
+        assert c.get("/api/me", headers=good).json() == {"email": "A@b.c", "teacher": False}
+        assert c.get("/api/class").status_code == 401 and c.get("/api/class", headers=good).status_code == 403
         c.app.state.auth.allowed = frozenset({"other@b.c"})   # a list without this account
         assert c.get("/api/me", headers=good).status_code == 403 and c.get("/api/tts/0", headers=good).status_code == 403
         c.app.state.auth.allowed = frozenset({"a@b.c"})   # case does not matter
         assert c.get("/api/me", headers=good).status_code == 200
+        # a teacher is an allowed account that TEACHER_EMAILS names: the panel lists the allowed accounts
+        c.app.state.auth.allowed, c.app.state.auth.teachers = frozenset({"a@b.c", "s@b.c", "new@b.c"}), frozenset({"a@b.c"})
+        assert c.get("/api/me", headers=good).json() == {"email": "A@b.c", "teacher": True}
+        teacher, student, new = c.get("/api/class", headers=good).json()["students"]
+        assert (teacher["email"], teacher["name"], teacher["recordings"], teacher["last"]) == ("A@b.c", "Alef", 0, None)
+        assert student["best"] == {str(PHRASES.index(VERB)): 88} and student["tries"] == {str(PHRASES.index(VERB)): 2}
+        assert (student["recordings"], student["days"], student["last"]) == (2, 1, "2026-10-09T10:00:00+00:00")
+        assert (new["email"], new["joined"], new["recordings"]) == ("new@b.c", False, 0) and student["joined"]
     # a scored recording is recorded as the student's attempt
     auth, pid = FakeAuth(), PHRASES.index(TOILET)
     buf = io.BytesIO()