@studious-lms/server 1.1.24 → 1.2.6

package/src/index.ts

@@ -11,52 +11,64 @@ import { logger } from './utils/logger.js';
 import { setupSocketHandlers } from './socket/handlers.js';
 import { bucket } from './lib/googleCloudStorage.js';
 import { prisma } from './lib/prisma.js';
+import { pusher } from './lib/pusher.js';
+import { connectRedis, disconnectRedis } from './lib/redis.js';
 
-dotenv.config();
+import { authLimiter, generalLimiter, helmetConfig, uploadLimiter } from './middleware/security.js';
+
+import * as Sentry from "@sentry/node";
+import { env } from './lib/config/env.js';
+import compression from 'compression';
+import { v4 as uuidv4 } from 'uuid';
+
+
+import "./instrument.js";
+import { openAIClient } from './utils/inference.js';
 
 const app = express();
 
+app.use(helmetConfig);
+app.use(compression());
+app.use(express.json());
+app.use(express.urlencoded({ extended: true }));
+
+app.use((req, res, next) => {
+  const requestId = uuidv4();
+  res.setHeader('X-Request-ID', requestId);
+  next();
+});
+
+const allowedOrigins = env.NODE_ENV === 'production'
+? [
+    'https://www.studious.sh',
+    'https://studious.sh',
+    'https://dev.studious.sh',
+    'https://www.dev.studious.sh',
+    env.NEXT_PUBLIC_APP_URL,
+    'http://localhost:3000',
+
+  ].filter(Boolean)
+: [
+    'http://localhost:3000',
+    'http://localhost:3001',
+    'http://127.0.0.1:3000',
+    'http://127.0.0.1:3001',
+
+    env.NEXT_PUBLIC_APP_URL || 'http://localhost:3000'
+  ];
+
 // CORS middleware
 app.use(cors({
-  origin: [
-    'http://localhost:3000',  // Frontend development server
-    'http://localhost:3001',  // Server port
-    'http://127.0.0.1:3000',  // Alternative localhost
-    'http://127.0.0.1:3001',  // Alternative localhost
-    'https://www.studious.sh',  // Production frontend
-    'https://studious.sh',     // Production frontend (without www)
-    process.env.NEXT_PUBLIC_APP_URL || 'http://localhost:3000'
-  ],
+  origin: allowedOrigins,
   credentials: true,
   methods: ['GET', 'POST', 'PUT', 'DELETE', 'OPTIONS'],
   allowedHeaders: ['Content-Type', 'Authorization', 'X-Requested-With', 'x-user'],
-  optionsSuccessStatus: 200
+  preflightContinue: false, // Important: stop further handling of OPTIONS
+  optionsSuccessStatus: 204, // Recommended for modern browsers
+
 }));
 
-// Handle preflight OPTIONS requests
-app.options('*', (req, res) => {
-  const allowedOrigins = [
-    'http://localhost:3000',
-    'http://localhost:3001', 
-    'http://127.0.0.1:3000',
-    'http://127.0.0.1:3001',
-    'https://www.studious.sh',  // Production frontend
-    'https://studious.sh',     // Production frontend (without www)
-    process.env.NEXT_PUBLIC_APP_URL || 'http://localhost:3000'
-  ];
-  
-  const origin = req.headers.origin;
-  if (origin && allowedOrigins.includes(origin)) {
-    res.header('Access-Control-Allow-Origin', origin);
-  } else {
-    res.header('Access-Control-Allow-Origin', 'http://localhost:3000');
-  }
-  
-  res.header('Access-Control-Allow-Methods', 'GET, POST, PUT, DELETE, OPTIONS');
-  res.header('Access-Control-Allow-Headers', 'Content-Type, Authorization, X-Requested-With, x-user');
-  res.header('Access-Control-Allow-Credentials', 'true');
-  res.sendStatus(200);
-});
+app.use(generalLimiter);
 
 // CORS debugging middleware
 app.use((req, res, next) => {
@@ -86,11 +98,146 @@ app.use((req, res, next) => {
   next();
 });
 
+// app.use("/panel", async (_, res) => {
+//   if (env.NODE_ENV !== "development") {
+//     return res.status(404).send("Not Found");
+//   }
+
+//   // Dynamically import renderTrpcPanel only in development
+//   const { renderTrpcPanel } = await import("trpc-ui");
+
+//   return res.send(
+//     renderTrpcPanel(appRouter, {
+//       url: "/trpc", // Base url of your trpc server
+//       meta: {
+//         title: "Studious Backend",
+//         description:
+//           "This is the backend for the Studious application.",
+//       },
+//     })
+//   );
+// });
+
+
 // Create HTTP server
 const httpServer = createServer(app);
 
-app.get('/health', (req, res) => {
-  res.status(200).json({ message: 'OK' });
+app.get('/health', async (req, res) => {
+
+  try {
+    // Check database connectivity
+    await prisma.$queryRaw`SELECT 1`;
+    
+    res.status(200).json({ 
+      status: 'OK',
+      timestamp: new Date().toISOString(),
+      uptime: process.uptime(),
+      database: 'connected'
+    });
+  } catch (error) {
+    res.status(503).json({ 
+      status: 'ERROR',
+      database: 'disconnected',
+      error: error instanceof Error ? error.message : 'Unknown error'
+    });
+  }
+});
+
+// Pusher channel auth (for private-* and presence-* channels)
+// Token from: x-user header, or cookie (same-origin requests send cookies automatically)
+app.post('/api/pusher/auth', async (req, res) => {
+  try {
+    let token = req.headers['x-user'] as string | undefined;
+    if (!token && req.headers.cookie) {
+      const cookieName = env.PUSHER_AUTH_COOKIE_NAME || 'token';
+      const match = req.headers.cookie.match(new RegExp(`${cookieName}=([^;]+)`));
+      token = match?.[1]?.trim();
+    }
+    const { socket_id, channel_name } = req.body as { socket_id?: string; channel_name?: string };
+
+    if (!socket_id || !channel_name) {
+      return res.status(400).json({ error: 'socket_id and channel_name required' });
+    }
+
+    if (!token) {
+      return res.status(401).json({ error: 'Authentication required' });
+    }
+
+    const user = await prisma.user.findFirst({
+      where: { sessions: { some: { id: token } } },
+      select: { id: true, username: true },
+    });
+
+    if (!user) {
+      return res.status(401).json({ error: 'Invalid or expired session' });
+    }
+
+    // Verify channel access for private-conversation-* channels
+    if (channel_name.startsWith('private-conversation-')) {
+      const conversationId = channel_name.replace('private-conversation-', '');
+      const member = await prisma.conversationMember.findFirst({
+        where: { conversationId, userId: user.id },
+      });
+      
+      if (!member) {
+        return res.status(403).json({ error: 'Not a member of this conversation' });
+      }
+    }
+
+    if (channel_name.startsWith('private-worksheet-')) {
+      const worksheetId = channel_name.replace('private-worksheet-', '');
+      const worksheet = await prisma.studentWorksheetResponse.findFirst({
+        where: { id: worksheetId, OR: [
+          { studentId: user.id },
+          { submission: { assignment: { class: { teachers: { some: { id: user.id } } } } } },
+        ] },
+      });
+      if (!worksheet) {
+        return res.status(403).json({ error: 'No access to this worksheet' });
+      }
+    }
+
+    if (channel_name.startsWith('private-teacher-')) {
+      const classId = channel_name.replace('private-teacher-', '');
+      const isTeacher = await prisma.class.findFirst({
+        where: { id: classId, teachers: { some: { id: user.id } } },
+      });
+      if (!isTeacher) {
+        return res.status(403).json({ error: 'Not a teacher of this class' });
+      }
+    }
+
+    // Verify channel access for private-class-* channels
+    // if (channel_name.startsWith('private-class-')) {
+    //   const classId = channel_name.replace('private-class-', '');
+    //   const isMember = await prisma.class.findFirst({
+    //     where: {
+    //       id: classId,
+    //       OR: [
+    //         { students: { some: { id: user.id } } },
+    //         { teachers: { some: { id: user.id } } },
+    //       ],
+    //     },
+    //   });
+    //   if (!isMember) {
+    //     return res.status(403).json({ error: 'Not a member of this class' });
+    //   }
+    // }
+
+    if (channel_name.startsWith('presence-')) {
+      const authResponse = pusher.authorizeChannel(socket_id, channel_name, {
+        user_id: user.id,
+        user_info: { username: user.username },
+      });
+      return res.json(authResponse);
+    }
+
+    const authResponse = pusher.authorizeChannel(socket_id, channel_name);
+    return res.json(authResponse);
+  } catch (error) {
+    logger.error('Pusher auth error', { error });
+    return res.status(500).json({ error: 'Authentication failed' });
+  }
 });
 
 // Setup Socket.IO
@@ -103,7 +250,7 @@ const io = new Server(httpServer, {
       'http://127.0.0.1:3001',  // Alternative localhost
       'https://www.studious.sh',  // Production frontend
       'https://studious.sh',     // Production frontend (without www)
-      process.env.NEXT_PUBLIC_APP_URL || 'http://localhost:3000'
+      env.NEXT_PUBLIC_APP_URL || 'http://localhost:3000'
     ],
     methods: ['GET', 'POST', 'PUT', 'DELETE', 'OPTIONS'],
     credentials: true,
@@ -326,12 +473,15 @@ app.get('/api/files/:fileId', async (req, res) => {
   }
 });
 
+app.use('/trpc/auth.login', authLimiter);
+app.use('/trpc/auth.register', authLimiter);
+
 // File upload endpoint for secure file uploads (supports both POST and PUT)
-app.post('/api/upload/:filePath', async (req, res) => {
+app.post('/api/upload/:filePath', uploadLimiter, async (req, res) => {
   handleFileUpload(req, res);
 });
 
-app.put('/api/upload/:filePath', async (req, res) => {
+app.put('/api/upload/:filePath', uploadLimiter, async (req, res) => {
   handleFileUpload(req, res);
 });
 
@@ -348,7 +498,7 @@ function handleFileUpload(req: any, res: any) {
       'http://127.0.0.1:3001',
       'https://www.studious.sh',  // Production frontend
       'https://studious.sh',     // Production frontend (without www)
-      process.env.NEXT_PUBLIC_APP_URL || 'http://localhost:3000'
+      env.NEXT_PUBLIC_APP_URL || 'http://localhost:3000'
     ];
     
     if (origin && allowedOrigins.includes(origin)) {
@@ -411,21 +561,35 @@ app.use(
   })
 );
 
-const PORT = process.env.PORT || 3001;
+// IMPORTANT: Sentry error handler must be added AFTER all other middleware and routes
+// but BEFORE any other error handlers
+Sentry.setupExpressErrorHandler(app);
+
+// app.use(function onError(err, req, res, next) {
+//   // The error id is attached to `res.sentry` to be returned
+//   // and optionally displayed to the user for support.
+//   res.statusCode = 500;
+//   res.end(res.sentry + "\n");
+// });
 
-httpServer.listen(PORT, () => {
-  logger.info(`Server running on port ${PORT}`, { 
-    port: PORT,
-    services: ['tRPC', 'Socket.IO']
+
+const PORT = env.PORT || 3001;
+
+connectRedis().then(() => {
+  httpServer.listen(PORT, () => {
+    logger.info(`Server running on port ${PORT}`, {
+      port: PORT,
+      services: ['tRPC', 'Socket.IO', env.REDIS_URL ? 'Redis' : null].filter(Boolean),
+    });
   });
 }); 
 
 // log all env variables
 logger.info('Configurations', {
-  NODE_ENV: process.env.NODE_ENV,
-  PORT: process.env.PORT,
-  NEXT_PUBLIC_APP_URL: process.env.NEXT_PUBLIC_APP_URL,
-  LOG_MODE: process.env.LOG_MODE,
+  NODE_ENV: env.NODE_ENV,
+  PORT: env.PORT,
+  NEXT_PUBLIC_APP_URL: env.NEXT_PUBLIC_APP_URL,
+  LOG_MODE: env.LOG_MODE,
 });
 
 // Log CORS configuration
@@ -435,6 +599,37 @@ logger.info('CORS Configuration', {
     'http://localhost:3001', 
     'http://127.0.0.1:3000',
     'http://127.0.0.1:3001',
-    process.env.NEXT_PUBLIC_APP_URL || 'http://localhost:3000'
+    env.NEXT_PUBLIC_APP_URL || 'http://localhost:3000'
   ]
-});
+});
+
+const gracefulShutdown = (signal: string) => {
+  logger.info(`Received ${signal}, shutting down gracefully`);
+  
+  httpServer.close(() => {
+    logger.info('HTTP server closed');
+    
+    io.close(() => {
+      logger.info('Socket.IO server closed');
+
+      disconnectRedis().then(() =>
+        prisma.$disconnect().then(() => {
+          logger.info('Database connections closed');
+          process.exit(0);
+        }).catch((err) => {
+          logger.error('Error disconnecting from database', { error: err });
+          process.exit(1);
+        })
+      );
+    });
+  });
+  
+  // Force shutdown after 10 seconds
+  setTimeout(() => {
+    logger.error('Forced shutdown after timeout');
+    process.exit(1);
+  }, 10000);
+};
+
+process.on('SIGTERM', () => gracefulShutdown('SIGTERM'));
+process.on('SIGINT', () => gracefulShutdown('SIGINT'));

package/src/instrument.ts

@@ -0,0 +1,15 @@
+import * as Sentry from "@sentry/node";
+import { env } from "./lib/config/env.js";
+
+// Only initialize Sentry in non-test environments
+if (env.NODE_ENV !== 'test') {
+  Sentry.init({
+    dsn: env.SENTRY_DSN,
+    environment: env.NODE_ENV || 'development',
+    // Setting this option to true will send default PII data to Sentry.
+    // For example, automatic IP address collection on events
+    sendDefaultPii: true,
+    // @todo: disable in test environment
+    enabled: true, // Explicitly disable in test environment
+  });
+}

package/src/lib/config/env.ts

@@ -0,0 +1,132 @@
+import { z } from 'zod';
+import dotenv from 'dotenv';
+import { resolve } from 'path';
+import { logger } from '../../utils/logger.js';
+
+// Determine which env file to load based on NODE_ENV
+const nodeEnv = process.env.NODE_ENV || 'development';
+const envFileMap: Record<string, string> = {
+  test: '.env.test',
+  development: '.env.development',
+  production: '.env.production',
+};
+
+// Load the appropriate env file
+const envFile = envFileMap[nodeEnv] || '.env';
+const envPath = resolve(process.cwd(), envFile);
+
+// Load environment variables from the correct file
+// First load .env (base), then override with environment-specific file
+dotenv.config(); // Load .env first (base config)
+dotenv.config({ path: envPath, override: true }); // Override with env-specific
+
+const isTest = nodeEnv === 'test';
+const isProduction = nodeEnv === 'production';
+
+// Base schema with required vars for all environments
+const baseSchema = z.object({
+  NODE_ENV: z.enum(['development', 'production', 'test']).default('development'),
+  PORT: z.string().transform(Number).default('3001'),
+  DATABASE_URL: z.string().url('DATABASE_URL must be a valid URL'),
+});
+
+// Production/development schema with all required vars
+const fullSchema = baseSchema.extend({
+  NEXT_PUBLIC_APP_URL: z.string().url().default('http://localhost:3000'),
+  BACKEND_URL: z.string().url().default('http://localhost:3001'),
+  SENTRY_DSN: z.string().url().optional(),
+  EMAIL_HOST: z.string().min(1, 'EMAIL_HOST is required'),
+  EMAIL_PORT: z.string().transform(Number).default('587'),
+  EMAIL_USER: z.string().email('EMAIL_USER must be a valid email'),
+  EMAIL_PASS: z.string().min(1, 'EMAIL_PASS is required'),
+  EMAIL_DRY_RUN: z.string().optional().default('false'),
+  GOOGLE_CLOUD_PROJECT_ID: z.string().min(1, 'GOOGLE_CLOUD_PROJECT_ID is required'),
+  GOOGLE_CLOUD_CLIENT_EMAIL: z.string().email('GOOGLE_CLOUD_CLIENT_EMAIL must be a valid email'),
+  GOOGLE_CLOUD_PRIVATE_KEY: z.string().min(1, 'GOOGLE_CLOUD_PRIVATE_KEY is required'),
+  GOOGLE_CLOUD_BUCKET_NAME: z.string().min(1, 'GOOGLE_CLOUD_BUCKET_NAME is required'),
+  PUSHER_APP_ID: z.string().min(1, 'PUSHER_APP_ID is required'),
+  PUSHER_KEY: z.string().min(1, 'PUSHER_KEY is required'),
+  PUSHER_SECRET: z.string().min(1, 'PUSHER_SECRET is required'),
+  PUSHER_CLUSTER: z.string().min(1, 'PUSHER_CLUSTER is required'),
+  PUSHER_AUTH_COOKIE_NAME: z.string().optional(), // Cookie name for session token (default: 'token')
+  REDIS_URL: z.string().url().optional(), // Redis connection URL (e.g. redis://localhost:6379)
+  INFERENCE_API_KEY: z.string().optional(),
+  INFERENCE_API_BASE_URL: z.string().url().optional(),
+  OPENAI_API_KEY: z.string().optional(),
+  LOG_MODE: z.enum(['normal', 'verbose', 'quiet']).default('normal'),
+});
+
+// Test schema - only require what's needed for tests
+const testSchema = baseSchema.extend({
+  NEXT_PUBLIC_APP_URL: z.string().url().optional().default('http://localhost:3000'),
+  BACKEND_URL: z.string().url().optional().default('http://localhost:3001'),
+  SENTRY_DSN: z.string().url().optional(),
+  EMAIL_HOST: z.string().optional().default('smtp.test.com'),
+  EMAIL_PORT: z.string().transform(Number).default('587'),
+  EMAIL_USER: z.string().email().optional().default('test@test.com'),
+  EMAIL_PASS: z.string().optional().default('test'),
+  EMAIL_DRY_RUN: z.string().optional().default('false'),
+  GOOGLE_CLOUD_PROJECT_ID: z.string().optional().default('test-project'),
+  GOOGLE_CLOUD_CLIENT_EMAIL: z.string().email().optional().default('test@test.iam.gserviceaccount.com'),
+  GOOGLE_CLOUD_PRIVATE_KEY: z.string().optional().default('test-key'),
+  GOOGLE_CLOUD_BUCKET_NAME: z.string().optional().default('test-bucket'),
+  PUSHER_APP_ID: z.string().optional().default('test-app-id'),
+  PUSHER_KEY: z.string().optional().default('test-key'),
+  PUSHER_SECRET: z.string().optional().default('test-secret'),
+  PUSHER_CLUSTER: z.string().optional().default('us2'),
+  PUSHER_AUTH_COOKIE_NAME: z.string().optional(),
+  REDIS_URL: z.string().url().optional(),
+  INFERENCE_API_KEY: z.string().optional(),
+  OPENAI_API_KEY: z.string().optional(),
+  INFERENCE_API_BASE_URL: z.string().url().optional(),
+  LOG_MODE: z.enum(['normal', 'verbose', 'quiet']).default('quiet'),
+});
+
+// Use test schema in test mode, full schema otherwise
+const envSchema = isTest ? testSchema : fullSchema;
+
+// Validate environment variables
+function validateEnv() {
+  try {
+    const parsed = envSchema.parse(process.env);
+    
+    // Only exit on validation failure in production
+    if (isProduction && !parsed.DATABASE_URL) {
+      logger.error('DATABASE_URL is required in production');
+      process.exit(1);
+    }
+    
+    return parsed;
+  } catch (error) {
+    if (error instanceof z.ZodError) {
+      const missingVars = error.errors.map(err => ({
+        path: err.path.join('.'),
+        message: err.message,
+      }));
+      
+      logger.error('Environment variable validation failed', {
+        envFile,
+        missingVars,
+      });
+      
+      // Only exit in production - in test/dev, log warning but continue
+      if (isProduction) {
+        logger.error(`Please check your ${envFile} file and ensure all required variables are set.`);
+        process.exit(1);
+      } else {
+        logger.warn('Continuing with defaults - some features may not work correctly', {
+          envFile,
+        });
+        // Return parsed with defaults for non-production
+        return envSchema.parse({ ...process.env });
+      }
+    }
+    throw error;
+  }
+}
+
+// Export validated environment variables
+export const env = validateEnv();
+
+// Type-safe environment access
+export type Env = z.infer<typeof envSchema>;

package/src/lib/fileUpload.ts

@@ -1,9 +1,9 @@
 import { TRPCError } from "@trpc/server";
 import { v4 as uuidv4 } from "uuid";
-import { getSignedUrl } from "./googleCloudStorage.js";
-import { generateMediaThumbnail } from "./thumbnailGenerator.js";
+import { getSignedUrl, objectExists } from "./googleCloudStorage.js";
 import { prisma } from "./prisma.js";
 import { logger } from "../utils/logger.js";
+import { env } from "./config/env.js";
 
 export interface FileData {
   name: string;
@@ -102,7 +102,8 @@ export async function createDirectUploadFile(
   userId: string,
   directory?: string,
   assignmentId?: string,
-  submissionId?: string
+  submissionId?: string,
+  announcementId?: string
 ): Promise<DirectUploadFile> {
   try {
     // Validate file extension matches MIME type
@@ -135,7 +136,7 @@ export async function createDirectUploadFile(
     const uploadSessionId = uuidv4();
     
     // Generate backend proxy upload URL (not direct GCS)
-    const baseUrl = process.env.BACKEND_URL || 'http://localhost:3001';
+    const baseUrl = env.BACKEND_URL || 'http://localhost:3001';
     const uploadUrl = `${baseUrl}/api/upload/${encodeURIComponent(filePath)}`;
     const uploadExpiresAt = new Date(Date.now() + 15 * 60 * 1000); // 15 minutes from now
     
@@ -167,6 +168,11 @@ export async function createDirectUploadFile(
           submission: {
             connect: { id: submissionId }
           }
+        }),
+        ...(announcementId && {
+          announcement: {
+            connect: { id: announcementId }
+          }
         })
       },
     });
@@ -182,7 +188,11 @@ export async function createDirectUploadFile(
       uploadSessionId
     };
   } catch (error) {
-    console.error('Error creating direct upload file:', error);
+    logger.error('Error creating direct upload file:', {error: error instanceof Error ? {
+      name: error.name,
+      message: error.message,
+      stack: error.stack,
+    } : error});
     throw new TRPCError({
       code: 'INTERNAL_SERVER_ERROR',
       message: 'Failed to create direct upload file',
@@ -202,17 +212,53 @@ export async function confirmDirectUpload(
   errorMessage?: string
 ): Promise<void> {
   try {
+    // First fetch the file record to get the object path
+    const fileRecord = await prisma.file.findUnique({
+      where: { id: fileId },
+      select: { path: true }
+    });
+
+    if (!fileRecord) {
+      throw new TRPCError({
+        code: 'NOT_FOUND',
+        message: 'File record not found',
+      });
+    }
+
+    let actualUploadSuccess = uploadSuccess;
+    let actualErrorMessage = errorMessage;
+
+    // If uploadSuccess is true, verify the object actually exists in GCS
+    if (uploadSuccess) {
+      try {
+        const exists = await objectExists(env.GOOGLE_CLOUD_BUCKET_NAME!, fileRecord.path);
+        if (!exists) {
+          actualUploadSuccess = false;
+          actualErrorMessage = 'File upload reported as successful but object not found in Google Cloud Storage';
+          logger.error(`File upload verification failed for ${fileId}: object ${fileRecord.path} not found in GCS`);
+        }
+      } catch (error) {
+        logger.error(`Error verifying file existence in GCS for ${fileId}:`, {error: error instanceof Error ? {
+          name: error.name,
+          message: error.message,
+          stack: error.stack,
+        } : error});
+        actualUploadSuccess = false;
+        actualErrorMessage = 'Failed to verify file existence in Google Cloud Storage';
+      }
+    }
+
     const updateData: any = {
-      uploadStatus: uploadSuccess ? 'COMPLETED' : 'FAILED',
-      uploadProgress: uploadSuccess ? 100 : 0,
+      uploadStatus: actualUploadSuccess ? 'COMPLETED' : 'FAILED',
+      uploadProgress: actualUploadSuccess ? 100 : 0,
     };
     
-    if (!uploadSuccess && errorMessage) {
-      updateData.uploadError = errorMessage;
+    if (!actualUploadSuccess && actualErrorMessage) {
+      updateData.uploadError = actualErrorMessage;
       updateData.uploadRetryCount = { increment: 1 };
     }
     
-    if (uploadSuccess) {
+    if (actualUploadSuccess) {
       updateData.uploadedAt = new Date();
     }
     
@@ -221,7 +267,7 @@ export async function confirmDirectUpload(
       data: updateData
     });
   } catch (error) {
-    console.error('Error confirming direct upload:', error);
+    logger.error('Error confirming direct upload:', {error});
     throw new TRPCError({
       code: 'INTERNAL_SERVER_ERROR',
       message: 'Failed to confirm upload',
@@ -239,15 +285,29 @@ export async function updateUploadProgress(
   progress: number
 ): Promise<void> {
   try {
+    // await prisma.file.update({
+    //   where: { id: fileId },
+    //   data: {
+    //     uploadStatus: 'UPLOADING',
+    //     uploadProgress: Math.min(100, Math.max(0, progress))
+    //   }
+    // });
+    const current = await prisma.file.findUnique({ where: { id: fileId }, select: { uploadStatus: true } });
+    if (!current || ['COMPLETED','FAILED','CANCELLED'].includes(current.uploadStatus as string)) return;
+    const clamped = Math.min(100, Math.max(0, progress));
     await prisma.file.update({
       where: { id: fileId },
       data: {
         uploadStatus: 'UPLOADING',
-        uploadProgress: Math.min(100, Math.max(0, progress))
+        uploadProgress: clamped
       }
     });
   } catch (error) {
-    console.error('Error updating upload progress:', error);
+    logger.error('Error updating upload progress:', {error: error instanceof Error ? {
+      name: error.name,
+      message: error.message,
+      stack: error.stack,
+    } : error});  
     throw new TRPCError({
       code: 'INTERNAL_SERVER_ERROR',
       message: 'Failed to update upload progress',
@@ -269,15 +329,20 @@ export async function createDirectUploadFiles(
   userId: string,
   directory?: string,
   assignmentId?: string,
-  submissionId?: string
+  submissionId?: string,
+  announcementId?: string
 ): Promise<DirectUploadFile[]> {
   try {
     const uploadPromises = files.map(file => 
-      createDirectUploadFile(file, userId, directory, assignmentId, submissionId)
+      createDirectUploadFile(file, userId, directory, assignmentId, submissionId, announcementId)
     );
     return await Promise.all(uploadPromises);
   } catch (error) {
-    console.error('Error creating direct upload files:', error);
+    logger.error('Error creating direct upload files:', {error: error instanceof Error ? {
+      name: error.name,
+      message: error.message,
+      stack: error.stack,
+    } : error});
     throw new TRPCError({
       code: 'INTERNAL_SERVER_ERROR',
       message: 'Failed to create direct upload files',