@goscribe/server 1.5.0 → 1.7.0

package/dist/src/lib/storage.js

@@ -0,0 +1,71 @@
+// src/server/lib/storage.ts
+import { createClient } from '@supabase/supabase-js';
+import { v4 as uuidv4 } from 'uuid';
+// Initialize Supabase Storage
+const supabaseUrl = process.env.SUPABASE_URL;
+const supabaseServiceKey = process.env.SUPABASE_SERVICE_ROLE_KEY;
+if (!supabaseUrl || !supabaseServiceKey) {
+    throw new Error('Missing required Supabase environment variables: SUPABASE_URL and SUPABASE_SERVICE_ROLE_KEY');
+}
+const supabase = createClient(supabaseUrl, supabaseServiceKey);
+const bucketName = process.env.SUPABASE_BUCKET || 'media';
+export async function uploadToSupabase(fileBuffer, fileName, contentType, makePublic = false) {
+    const objectKey = `podcasts/${uuidv4()}_${fileName}`;
+    // Upload the file to Supabase Storage
+    const { data, error } = await supabase.storage
+        .from(bucketName)
+        .upload(objectKey, fileBuffer, {
+        contentType,
+        upsert: false,
+    });
+    if (error) {
+        throw new Error(`Failed to upload file to Supabase: ${error.message}`);
+    }
+    const url = `${supabaseUrl}/storage/v1/object/public/${bucketName}/${objectKey}`;
+    // Generate signed URL for private files
+    let signedUrl;
+    if (!makePublic) {
+        const { data: signedUrlData, error: signedUrlError } = await supabase.storage
+            .from(bucketName)
+            .createSignedUrl(objectKey, 24 * 60 * 60); // 24 hours
+        if (signedUrlError) {
+            throw new Error(`Failed to generate signed URL: ${signedUrlError.message}`);
+        }
+        signedUrl = signedUrlData.signedUrl;
+    }
+    return {
+        url,
+        signedUrl,
+        objectKey,
+    };
+}
+export async function generateSignedUrl(objectKey, expiresInHours = 24) {
+    const { data, error } = await supabase.storage
+        .from(bucketName)
+        .createSignedUrl(objectKey, expiresInHours * 60 * 60);
+    if (error) {
+        throw new Error(`Failed to generate signed URL: ${error.message}`);
+    }
+    return data.signedUrl;
+}
+export async function deleteFromSupabase(objectKey) {
+    const { error } = await supabase.storage
+        .from(bucketName)
+        .remove([objectKey]);
+    if (error) {
+        throw new Error(`Failed to delete file from Supabase: ${error.message}`);
+    }
+}
+export async function makeFilePublic(objectKey) {
+    // In Supabase, files are public by default when uploaded to public buckets
+    // For private buckets, you would need to update the bucket policy
+    // This function is kept for compatibility but may not be needed
+    // File is already public in Supabase Storage
+}
+export async function makeFilePrivate(objectKey) {
+    // In Supabase, you would need to update the bucket policy to make files private
+    // This function is kept for compatibility but may not be needed
+    // File privacy is controlled by bucket policy in Supabase Storage
+}
+// Export supabase client for direct access if needed
+export const supabaseClient = supabase;

package/dist/src/lib/stripe.d.ts

@@ -0,0 +1,10 @@
+import Stripe from 'stripe';
+export declare const stripe: Stripe | null;
+/**
+ * Creates a Stripe customer for a user.
+ *
+ * @param email - User's email
+ * @param name - User's name
+ * @returns The Stripe customer ID
+ */
+export declare function createStripeCustomer(email: string, name?: string): Promise<string | null>;

package/dist/src/lib/stripe.js

@@ -0,0 +1,36 @@
+import Stripe from 'stripe';
+import { env } from './env.js';
+import { logger } from './logger.js';
+if (!env.STRIPE_SECRET_KEY) {
+    logger.warn('STRIPE_SECRET_KEY is not set. Stripe functionality will be disabled.', 'STRIPE');
+}
+export const stripe = env.STRIPE_SECRET_KEY
+    ? new Stripe(env.STRIPE_SECRET_KEY, {
+        apiVersion: '2026-02-25.clover',
+    })
+    : null;
+/**
+ * Creates a Stripe customer for a user.
+ *
+ * @param email - User's email
+ * @param name - User's name
+ * @returns The Stripe customer ID
+ */
+export async function createStripeCustomer(email, name) {
+    if (!stripe) {
+        logger.error('Stripe is not initialized. Cannot create customer.', 'STRIPE');
+        return null;
+    }
+    try {
+        const customer = await stripe.customers.create({
+            email,
+            name,
+        });
+        logger.info(`Stripe customer created for ${email}: ${customer.id}`, 'STRIPE');
+        return customer.id;
+    }
+    catch (error) {
+        logger.error(`Failed to create Stripe customer for ${email}: ${error.message}`, 'STRIPE');
+        return null;
+    }
+}

package/dist/src/lib/validation.d.ts

@@ -0,0 +1,51 @@
+import { z } from 'zod';
+/**
+ * Common validation schemas
+ */
+export declare const commonSchemas: {
+    id: z.ZodString;
+    email: z.ZodString;
+    url: z.ZodString;
+    pagination: z.ZodObject<{
+        page: z.ZodDefault<z.ZodNumber>;
+        limit: z.ZodDefault<z.ZodNumber>;
+    }, z.core.$strip>;
+    search: z.ZodObject<{
+        query: z.ZodString;
+    }, z.core.$strip>;
+};
+/**
+ * Enums for type safety
+ */
+export declare const ArtifactType: z.ZodEnum<{
+    WORKSHEET: "WORKSHEET";
+    STUDY_GUIDE: "STUDY_GUIDE";
+    FLASHCARD_SET: "FLASHCARD_SET";
+    MEETING_SUMMARY: "MEETING_SUMMARY";
+    PODCAST_EPISODE: "PODCAST_EPISODE";
+}>;
+export declare const Difficulty: z.ZodEnum<{
+    EASY: "EASY";
+    MEDIUM: "MEDIUM";
+    HARD: "HARD";
+}>;
+export declare const QuestionType: z.ZodEnum<{
+    MULTIPLE_CHOICE: "MULTIPLE_CHOICE";
+    TEXT: "TEXT";
+    NUMERIC: "NUMERIC";
+    TRUE_FALSE: "TRUE_FALSE";
+    MATCHING: "MATCHING";
+    FILL_IN_THE_BLANK: "FILL_IN_THE_BLANK";
+}>;
+/**
+ * Validation helper that throws ValidationError
+ */
+export declare function validateSchema<T extends z.ZodType>(schema: T, data: unknown): z.infer<T>;
+/**
+ * Sanitize string inputs
+ */
+export declare function sanitizeString(input: string, maxLength?: number): string;
+/**
+ * Validate ownership
+ */
+export declare function validateOwnership(ownerId: string, userId: string): void;

package/dist/src/lib/validation.js

@@ -0,0 +1,64 @@
+import { z } from 'zod';
+import { ValidationError } from './errors.js';
+/**
+ * Common validation schemas
+ */
+export const commonSchemas = {
+    id: z.string().cuid(),
+    email: z.string().email(),
+    url: z.string().url(),
+    pagination: z.object({
+        page: z.number().int().positive().default(1),
+        limit: z.number().int().positive().max(100).default(20),
+    }),
+    search: z.object({
+        query: z.string().min(1).max(200),
+    }),
+};
+/**
+ * Enums for type safety
+ */
+export const ArtifactType = z.enum([
+    'STUDY_GUIDE',
+    'FLASHCARD_SET',
+    'WORKSHEET',
+    'MEETING_SUMMARY',
+    'PODCAST_EPISODE',
+]);
+export const Difficulty = z.enum(['EASY', 'MEDIUM', 'HARD']);
+export const QuestionType = z.enum([
+    'MULTIPLE_CHOICE',
+    'TEXT',
+    'NUMERIC',
+    'TRUE_FALSE',
+    'MATCHING',
+    'FILL_IN_THE_BLANK',
+]);
+/**
+ * Validation helper that throws ValidationError
+ */
+export function validateSchema(schema, data) {
+    const result = schema.safeParse(data);
+    if (!result.success) {
+        const errors = result.error.message;
+        throw new ValidationError(`Validation failed: ${errors}`);
+    }
+    return result.data;
+}
+/**
+ * Sanitize string inputs
+ */
+export function sanitizeString(input, maxLength = 10000) {
+    return input
+        .trim()
+        .slice(0, maxLength)
+        .replace(/[<>]/g, ''); // Basic XSS prevention
+}
+/**
+ * Validate ownership
+ */
+export function validateOwnership(ownerId, userId) {
+    if (ownerId !== userId) {
+        throw new ValidationError('You do not have permission to access this resource');
+    }
+}

package/dist/src/lib/workspace-kb.d.ts

@@ -0,0 +1,5 @@
+/** Meta.kind value for the private, auto-managed KB attached to each workspace. */
+export declare const WORKSPACE_KB_KIND = "workspace";
+export declare function isWorkspaceManagedKb(kb: {
+    meta: unknown;
+}): boolean;

package/dist/src/lib/workspace-kb.js

@@ -0,0 +1,7 @@
+/** Meta.kind value for the private, auto-managed KB attached to each workspace. */
+export const WORKSPACE_KB_KIND = 'workspace';
+export function isWorkspaceManagedKb(kb) {
+    if (!kb.meta || typeof kb.meta !== 'object')
+        return false;
+    return kb.meta.kind === WORKSPACE_KB_KIND;
+}

package/dist/src/repositories/artifact.repository.d.ts

@@ -0,0 +1,64 @@
+import type { ArtifactType, Prisma, PrismaClient } from '@prisma/client';
+import { BaseRepository } from './base.repository.js';
+export declare class ArtifactRepository extends BaseRepository {
+    constructor(db: PrismaClient);
+    /**
+     * Fetch an artifact if the user can access the containing workspace
+     * (owner or member).
+     */
+    findByIdAccessible(artifactId: string, userId: string, include?: Prisma.ArtifactInclude): Prisma.Prisma__ArtifactClient<{
+        id: string;
+        createdAt: Date;
+        updatedAt: Date;
+        title: string;
+        description: string | null;
+        createdById: string | null;
+        type: ArtifactType;
+        workspaceId: string;
+        difficulty: import("@prisma/client").Difficulty | null;
+        estimatedTime: string | null;
+        isArchived: boolean;
+        generating: boolean;
+        generatingMetadata: import("@prisma/client/runtime/client").JsonValue | null;
+        worksheetConfig: import("@prisma/client/runtime/client").JsonValue | null;
+        imageObjectKey: string | null;
+    } | null, null, import("@prisma/client/runtime/client").DefaultArgs, {
+        omit: Prisma.GlobalOmitConfig | undefined;
+    }>;
+    findByIdAndTypeAccessible(artifactId: string, type: ArtifactType, userId: string, include?: Prisma.ArtifactInclude): Prisma.Prisma__ArtifactClient<{
+        id: string;
+        createdAt: Date;
+        updatedAt: Date;
+        title: string;
+        description: string | null;
+        createdById: string | null;
+        type: ArtifactType;
+        workspaceId: string;
+        difficulty: import("@prisma/client").Difficulty | null;
+        estimatedTime: string | null;
+        isArchived: boolean;
+        generating: boolean;
+        generatingMetadata: import("@prisma/client/runtime/client").JsonValue | null;
+        worksheetConfig: import("@prisma/client/runtime/client").JsonValue | null;
+        imageObjectKey: string | null;
+    } | null, null, import("@prisma/client/runtime/client").DefaultArgs, {
+        omit: Prisma.GlobalOmitConfig | undefined;
+    }>;
+    listByWorkspaceAndType(workspaceId: string, type: ArtifactType, userId: string, args?: Omit<Prisma.ArtifactFindManyArgs, 'where'>): Prisma.PrismaPromise<{
+        id: string;
+        createdAt: Date;
+        updatedAt: Date;
+        title: string;
+        description: string | null;
+        createdById: string | null;
+        type: ArtifactType;
+        workspaceId: string;
+        difficulty: import("@prisma/client").Difficulty | null;
+        estimatedTime: string | null;
+        isArchived: boolean;
+        generating: boolean;
+        generatingMetadata: import("@prisma/client/runtime/client").JsonValue | null;
+        worksheetConfig: import("@prisma/client/runtime/client").JsonValue | null;
+        imageObjectKey: string | null;
+    }[]>;
+}

package/dist/src/repositories/artifact.repository.js

@@ -0,0 +1,40 @@
+import { BaseRepository } from './base.repository.js';
+import { workspaceAccessWhere } from './workspace.repository.js';
+export class ArtifactRepository extends BaseRepository {
+    constructor(db) {
+        super(db);
+    }
+    /**
+     * Fetch an artifact if the user can access the containing workspace
+     * (owner or member).
+     */
+    findByIdAccessible(artifactId, userId, include) {
+        return this.db.artifact.findFirst({
+            where: {
+                id: artifactId,
+                workspace: workspaceAccessWhere(userId),
+            },
+            include,
+        });
+    }
+    findByIdAndTypeAccessible(artifactId, type, userId, include) {
+        return this.db.artifact.findFirst({
+            where: {
+                id: artifactId,
+                type,
+                workspace: workspaceAccessWhere(userId),
+            },
+            include,
+        });
+    }
+    listByWorkspaceAndType(workspaceId, type, userId, args) {
+        return this.db.artifact.findMany({
+            ...args,
+            where: {
+                workspaceId,
+                type,
+                workspace: workspaceAccessWhere(userId),
+            },
+        });
+    }
+}

package/dist/src/repositories/base.repository.d.ts

@@ -0,0 +1,14 @@
+import type { PrismaClient } from '@prisma/client';
+import { logger } from '../lib/logger.js';
+/**
+ * Shared base class for repositories.
+ *
+ * Repositories own data access. They wrap a Prisma client and expose
+ * intent-revealing methods (e.g. `findAccessibleById(workspaceId, userId)`)
+ * so that the shape of `where` clauses doesn't leak into services/routers.
+ */
+export declare abstract class BaseRepository {
+    protected readonly db: PrismaClient;
+    protected readonly logger: typeof logger;
+    constructor(db: PrismaClient);
+}

package/dist/src/repositories/base.repository.js

@@ -0,0 +1,14 @@
+import { logger } from '../lib/logger.js';
+/**
+ * Shared base class for repositories.
+ *
+ * Repositories own data access. They wrap a Prisma client and expose
+ * intent-revealing methods (e.g. `findAccessibleById(workspaceId, userId)`)
+ * so that the shape of `where` clauses doesn't leak into services/routers.
+ */
+export class BaseRepository {
+    constructor(db) {
+        this.db = db;
+        this.logger = logger;
+    }
+}

package/dist/src/repositories/invitation.repository.d.ts

@@ -0,0 +1,104 @@
+import type { Prisma, PrismaClient } from '@prisma/client';
+import { BaseRepository } from './base.repository.js';
+/**
+ * Data access for `WorkspaceInvitation`. Members router currently performs
+ * invitation CRUD + token validation directly against Prisma — this
+ * repository is the target of that extraction during Phase 4.
+ */
+export declare class InvitationRepository extends BaseRepository {
+    constructor(db: PrismaClient);
+    findById(id: string, include?: Prisma.WorkspaceInvitationInclude): Prisma.Prisma__WorkspaceInvitationClient<{
+        id: string;
+        email: string;
+        createdAt: Date;
+        updatedAt: Date;
+        role: string;
+        token: string;
+        workspaceId: string;
+        invitedById: string;
+        acceptedAt: Date | null;
+        expiresAt: Date;
+    } | null, null, import("@prisma/client/runtime/client").DefaultArgs, {
+        omit: Prisma.GlobalOmitConfig | undefined;
+    }>;
+    findFirst(args: Prisma.WorkspaceInvitationFindFirstArgs): Prisma.Prisma__WorkspaceInvitationClient<{
+        id: string;
+        email: string;
+        createdAt: Date;
+        updatedAt: Date;
+        role: string;
+        token: string;
+        workspaceId: string;
+        invitedById: string;
+        acceptedAt: Date | null;
+        expiresAt: Date;
+    } | null, null, import("@prisma/client/runtime/client").DefaultArgs, {
+        omit: Prisma.GlobalOmitConfig | undefined;
+    }>;
+    listByWorkspace(workspaceId: string, args?: Omit<Prisma.WorkspaceInvitationFindManyArgs, 'where'>): Prisma.PrismaPromise<{
+        id: string;
+        email: string;
+        createdAt: Date;
+        updatedAt: Date;
+        role: string;
+        token: string;
+        workspaceId: string;
+        invitedById: string;
+        acceptedAt: Date | null;
+        expiresAt: Date;
+    }[]>;
+    listForUserEmail(email: string, args?: Omit<Prisma.WorkspaceInvitationFindManyArgs, 'where'>): Prisma.PrismaPromise<{
+        id: string;
+        email: string;
+        createdAt: Date;
+        updatedAt: Date;
+        role: string;
+        token: string;
+        workspaceId: string;
+        invitedById: string;
+        acceptedAt: Date | null;
+        expiresAt: Date;
+    }[]>;
+    create(data: Prisma.WorkspaceInvitationCreateInput): Prisma.Prisma__WorkspaceInvitationClient<{
+        id: string;
+        email: string;
+        createdAt: Date;
+        updatedAt: Date;
+        role: string;
+        token: string;
+        workspaceId: string;
+        invitedById: string;
+        acceptedAt: Date | null;
+        expiresAt: Date;
+    }, never, import("@prisma/client/runtime/client").DefaultArgs, {
+        omit: Prisma.GlobalOmitConfig | undefined;
+    }>;
+    update(id: string, data: Prisma.WorkspaceInvitationUpdateInput): Prisma.Prisma__WorkspaceInvitationClient<{
+        id: string;
+        email: string;
+        createdAt: Date;
+        updatedAt: Date;
+        role: string;
+        token: string;
+        workspaceId: string;
+        invitedById: string;
+        acceptedAt: Date | null;
+        expiresAt: Date;
+    }, never, import("@prisma/client/runtime/client").DefaultArgs, {
+        omit: Prisma.GlobalOmitConfig | undefined;
+    }>;
+    delete(id: string): Prisma.Prisma__WorkspaceInvitationClient<{
+        id: string;
+        email: string;
+        createdAt: Date;
+        updatedAt: Date;
+        role: string;
+        token: string;
+        workspaceId: string;
+        invitedById: string;
+        acceptedAt: Date | null;
+        expiresAt: Date;
+    }, never, import("@prisma/client/runtime/client").DefaultArgs, {
+        omit: Prisma.GlobalOmitConfig | undefined;
+    }>;
+}

package/dist/src/repositories/invitation.repository.js

@@ -0,0 +1,44 @@
+import { BaseRepository } from './base.repository.js';
+/**
+ * Data access for `WorkspaceInvitation`. Members router currently performs
+ * invitation CRUD + token validation directly against Prisma — this
+ * repository is the target of that extraction during Phase 4.
+ */
+export class InvitationRepository extends BaseRepository {
+    constructor(db) {
+        super(db);
+    }
+    findById(id, include) {
+        return this.db.workspaceInvitation.findFirst({
+            where: { id },
+            include,
+        });
+    }
+    findFirst(args) {
+        return this.db.workspaceInvitation.findFirst(args);
+    }
+    listByWorkspace(workspaceId, args) {
+        return this.db.workspaceInvitation.findMany({
+            ...args,
+            where: { workspaceId },
+        });
+    }
+    listForUserEmail(email, args) {
+        return this.db.workspaceInvitation.findMany({
+            ...args,
+            where: { email },
+        });
+    }
+    create(data) {
+        return this.db.workspaceInvitation.create({ data });
+    }
+    update(id, data) {
+        return this.db.workspaceInvitation.update({
+            where: { id },
+            data,
+        });
+    }
+    delete(id) {
+        return this.db.workspaceInvitation.delete({ where: { id } });
+    }
+}

package/dist/src/repositories/notification.repository.d.ts

@@ -0,0 +1,76 @@
+import type { Prisma, PrismaClient } from '@prisma/client';
+import { BaseRepository } from './base.repository.js';
+/**
+ * Thin data-access wrapper around `Notification`. `NotificationService`
+ * currently calls `ctx.db.notification.*` directly; Phase 4 will migrate it
+ * to use this repository so services don't need Prisma-specific types at
+ * their API boundary.
+ */
+export declare class NotificationRepository extends BaseRepository {
+    constructor(db: PrismaClient);
+    findFirst(args: Prisma.NotificationFindFirstArgs): Prisma.Prisma__NotificationClient<{
+        userId: string;
+        id: string;
+        createdAt: Date;
+        updatedAt: Date;
+        title: string;
+        type: string;
+        workspaceId: string | null;
+        metadata: import("@prisma/client/runtime/client").JsonValue | null;
+        actorUserId: string | null;
+        body: string;
+        actionUrl: string | null;
+        priority: import("@prisma/client").NotificationPriority;
+        sourceId: string | null;
+        content: string | null;
+        read: boolean;
+        readAt: Date | null;
+        deliveredAt: Date | null;
+    } | null, null, import("@prisma/client/runtime/client").DefaultArgs, {
+        omit: Prisma.GlobalOmitConfig | undefined;
+    }>;
+    listByUser(userId: string, args?: Omit<Prisma.NotificationFindManyArgs, 'where'>): Prisma.PrismaPromise<{
+        userId: string;
+        id: string;
+        createdAt: Date;
+        updatedAt: Date;
+        title: string;
+        type: string;
+        workspaceId: string | null;
+        metadata: import("@prisma/client/runtime/client").JsonValue | null;
+        actorUserId: string | null;
+        body: string;
+        actionUrl: string | null;
+        priority: import("@prisma/client").NotificationPriority;
+        sourceId: string | null;
+        content: string | null;
+        read: boolean;
+        readAt: Date | null;
+        deliveredAt: Date | null;
+    }[]>;
+    count(args: Prisma.NotificationCountArgs): Prisma.PrismaPromise<number>;
+    create(data: Prisma.NotificationCreateInput): Prisma.Prisma__NotificationClient<{
+        userId: string;
+        id: string;
+        createdAt: Date;
+        updatedAt: Date;
+        title: string;
+        type: string;
+        workspaceId: string | null;
+        metadata: import("@prisma/client/runtime/client").JsonValue | null;
+        actorUserId: string | null;
+        body: string;
+        actionUrl: string | null;
+        priority: import("@prisma/client").NotificationPriority;
+        sourceId: string | null;
+        content: string | null;
+        read: boolean;
+        readAt: Date | null;
+        deliveredAt: Date | null;
+    }, never, import("@prisma/client/runtime/client").DefaultArgs, {
+        omit: Prisma.GlobalOmitConfig | undefined;
+    }>;
+    markRead(id: string, userId: string): Prisma.PrismaPromise<Prisma.BatchPayload>;
+    markAllRead(userId: string): Prisma.PrismaPromise<Prisma.BatchPayload>;
+    delete(id: string, userId: string): Prisma.PrismaPromise<Prisma.BatchPayload>;
+}

package/dist/src/repositories/notification.repository.js

@@ -0,0 +1,44 @@
+import { BaseRepository } from './base.repository.js';
+/**
+ * Thin data-access wrapper around `Notification`. `NotificationService`
+ * currently calls `ctx.db.notification.*` directly; Phase 4 will migrate it
+ * to use this repository so services don't need Prisma-specific types at
+ * their API boundary.
+ */
+export class NotificationRepository extends BaseRepository {
+    constructor(db) {
+        super(db);
+    }
+    findFirst(args) {
+        return this.db.notification.findFirst(args);
+    }
+    listByUser(userId, args) {
+        return this.db.notification.findMany({
+            ...args,
+            where: { userId },
+        });
+    }
+    count(args) {
+        return this.db.notification.count(args);
+    }
+    create(data) {
+        return this.db.notification.create({ data });
+    }
+    markRead(id, userId) {
+        return this.db.notification.updateMany({
+            where: { id, userId },
+            data: { read: true },
+        });
+    }
+    markAllRead(userId) {
+        return this.db.notification.updateMany({
+            where: { userId, read: false },
+            data: { read: true },
+        });
+    }
+    delete(id, userId) {
+        return this.db.notification.deleteMany({
+            where: { id, userId },
+        });
+    }
+}