Apply role-based data scoping to PeerMentorStatsScreen
epic-activity-statistics-dashboard-user-interface-task-010 — Ensure the PeerMentorStatsScreen enforces strict role-based data scoping by reading only the authenticated peer mentor's own userId from the session and passing it to the stats notifier. Add a role guard that redirects non-peer-mentor users to the no-access screen. Write Riverpod provider overrides to scope queries to the current user without exposing other users' data.
Acceptance Criteria
Technical Requirements
Execution Context
Tier 5 - 253 tasks
Can start after Tier 4 completes
Implementation Notes
Implement requireRole as a GoRouter redirect callback on the route definition, not as a runtime check inside the widget — this prevents any flash of content for unauthorised users. Example: redirect: (context, state) { final role = ref.read(currentRoleProvider); return role == AppRole.peerMentor ? null : '/no-access'; }. For userId isolation, use peerMentorStatsProvider(userId) family where userId = ref.watch(authStateProvider).requireValue.userId.
The .requireValue call will throw if session is null, which AsyncNotifier will catch and surface as AsyncError — wire the error state to show the session-expired widget. Never call ref.read(authStateProvider).userId in a button callback to pass to a provider; always use ref.watch in the provider itself.
Testing Requirements
Unit tests for requireRole() guard: (1) peer-mentor role returns allowed; (2) coordinator role returns redirect; (3) admin role returns redirect; (4) null session returns redirect to login. Widget tests: (5) non-peer-mentor auth override redirects via GoRouter — verify tester finds NoAccessScreen; (6) valid peer-mentor session renders PeerMentorStatsScreen; (7) expired session triggers session-expired UI. Use ProviderScope overrides for authStateProvider; do not call real Supabase auth.
fl_chart renders chart elements on a Canvas, making individual bars and data points invisible to the Flutter Semantics tree by default. Without explicit Semantics wrappers, VoiceOver and TalkBack users receive no chart information, violating the WCAG 2.2 AA requirement mandated by all three partner organizations.
Mitigation & Contingency
Mitigation: Wrap the fl_chart widget in a Semantics node with a dynamically generated textual description of the chart data (e.g., 'Bar chart: January 12, February 8, March 15 sessions'). Implement a collapsible data table alternative beneath the chart that screen readers can navigate row by row. Validate with VoiceOver on iOS and TalkBack on Android before the epic is marked complete.
Contingency: If fl_chart's Canvas rendering cannot be made accessible within the epic timeline, ship the chart hidden from the Semantics tree with ExcludeSemantics and promote the data table alternative to first-class UI so screen reader users have full access to the information. Log a tech-debt item to revisit native chart accessibility in a future sprint.
Coordinators managing up to 5 chapters (NHF requirement) require the PeerMentorStatsList to display chapter affiliation labels for each row. With large chapter lists and many peer mentors, the list could become overwhelming and cause layout overflow or scrolling performance issues on lower-end Android devices.
Mitigation & Contingency
Mitigation: Implement chapter filtering as a segmented control above the list so coordinators can scope the list to one chapter at a time. Use ListView.builder (lazy rendering) rather than a Column of all rows. Profile scroll performance on a low-end Android device (Pixel 4a equivalent) with 50 peer mentors in scope during development.
Contingency: If multi-chapter display causes unacceptable performance, ship with single-chapter scope as the default view and a chapter switcher dropdown, deferring the combined cross-chapter list to a follow-up sprint.
Summary cards and the chart widget rebuilding simultaneously on provider state change could cause a visible jank frame on slower devices, degrading perceived quality especially since this screen is intended to feel motivating and polished for gamification purposes.
Mitigation & Contingency
Mitigation: Use AnimatedSwitcher with a short fade transition (150ms) on the stats cards and chart so that data replacement feels intentional rather than jarring. Profile with Flutter DevTools on a mid-range device and ensure no frame exceeds 16ms during a time-window switch.
Contingency: If animation introduces complexity that delays delivery, ship without animation and use a loading skeleton (shimmer effect) during re-fetch instead, which is simpler and equally effective at masking the data swap.
If the role-based screen dispatch is misconfigured, a peer mentor could navigate to the coordinator stats screen and see aggregated chapter data for all peer mentors, which is a data privacy violation and a compliance risk for all three organizations.
Mitigation & Contingency
Mitigation: Implement role guard at the router level using an existing role-route-guard component so the coordinator screen route is unreachable for peer mentor roles. Add a widget test that mounts the coordinator screen with a peer mentor session token and asserts that the guard redirects to the no-access screen.
Contingency: If a bypass is found in QA, add a secondary in-screen role assertion in the coordinator screen's initState that throws an AuthorizationException and navigates to the error screen, ensuring defence in depth regardless of router configuration.