@studious-lms/server 1.1.26 → 1.2.6

package/src/middleware/auth.ts

@@ -1,45 +1,33 @@
-import { TRPCError } from '@trpc/server';
-import { prisma } from '../lib/prisma.js';
-import type { MiddlewareContext } from '../types/trpc.js';
+import { TRPCError } from "@trpc/server";
+import * as Sentry from "@sentry/node";
+import type { MiddlewareContext } from "../types/trpc.js";
+import {
+  findUserBySessionToken,
+  findTeacherClassesByUserId,
+  findClassWithMember,
+  findClassWithTeacher,
+} from "../models/auth.js";
 
 export const createAuthMiddleware = (t: any) => {
-
-  // Auth middleware
   const isAuthed = t.middleware(async ({ next, ctx }: MiddlewareContext) => {
-    const startTime = Date.now();
-    // Get user from request headers
-    const userHeader = ctx.req.headers['x-user'];
+    const userHeader = ctx.req.headers["x-user"];
 
     if (!userHeader) {
       throw new TRPCError({
-        code: 'UNAUTHORIZED',
-        message: 'Not authenticated - no token found',
+        code: "UNAUTHORIZED",
+        message: "Not authenticated - no token found",
       });
     }
 
     try {
-      const token = typeof userHeader === 'string' ? userHeader : userHeader[0];
-
-      // Find user by session token
-      const user = await prisma.user.findFirst({
-        where: {
-          sessions: {
-            some: {
-              id: token
-            }
-          }
-        },
-        select: {
-          id: true,
-          username: true,
-          // institutionId: true,
-        }
-      });
+      const token =
+        typeof userHeader === "string" ? userHeader : userHeader[0];
+      const user = await findUserBySessionToken(token);
 
       if (!user) {
         throw new TRPCError({
-          code: 'UNAUTHORIZED',
-          message: 'Invalid or expired session',
+          code: "UNAUTHORIZED",
+          message: "Invalid or expired session",
         });
       }
 
@@ -50,135 +38,96 @@ export const createAuthMiddleware = (t: any) => {
         },
       });
     } catch (error) {
-      console.log(error)
+      if (error instanceof TRPCError) {
+        throw error;
+      }
+      Sentry.captureException(error);
+      console.error(error);
       throw new TRPCError({
-        code: 'UNAUTHORIZED',
-        message: 'Invalid user data',
+        code: "INTERNAL_SERVER_ERROR",
+        message: "Internal server error",
       });
     }
   });
 
-  // Add computed flags middleware
-  const addComputedFlags = t.middleware(async ({ next, ctx }: MiddlewareContext) => {
-    if (!ctx.user) {
-      throw new TRPCError({
-        code: 'UNAUTHORIZED',
-        message: 'Not authenticated',
-      });
-    }
-
-    // Get all classes where user is a teacher
-    const teacherClasses = await prisma.class.findMany({
-      where: {
-        teachers: {
-          some: {
-            id: ctx.user.id
-          }
-        }
-      },
-      select: {
-        id: true
-      }
-    });
-
-    return next({
-      ctx: {
-        ...ctx,
-        isTeacher: teacherClasses.length > 0,
-        teacherClassIds: teacherClasses.map((c: { id: string }) => c.id)
+  const addComputedFlags = t.middleware(
+    async ({ next, ctx }: MiddlewareContext) => {
+      if (!ctx.user) {
+        throw new TRPCError({
+          code: "UNAUTHORIZED",
+          message: "Not authenticated",
+        });
       }
-    });
-  });
 
-  // Student middleware
-  const isMemberInClass = t.middleware(async ({ next, ctx, input }: MiddlewareContext) => {
-    if (!ctx.user) {
-      throw new TRPCError({
-        code: 'UNAUTHORIZED',
-        message: 'Not authenticated',
-      });
-    }
-
-    const classId = (input as { classId: string })?.classId;
+      const teacherClasses = await findTeacherClassesByUserId(ctx.user.id);
 
-    if (!classId) {
-      throw new TRPCError({
-        code: 'BAD_REQUEST',
-        message: 'classId is required',
+      return next({
+        ctx: {
+          ...ctx,
+          isTeacher: teacherClasses.length > 0,
+          teacherClassIds: teacherClasses.map((c) => c.id),
+        },
       });
     }
+  );
 
-    const isMember = await prisma.class.findFirst({
-      where: {
-        id: classId,
-        OR: [
-          {
-            students: {
-              some: {
-                id: ctx.user.id
-              }
-            }
-          },
-          {
-            teachers: {
-              some: {
-                id: ctx.user.id
-              }
-            }
-          }
-        ]
+  const isMemberInClass = t.middleware(
+    async ({ next, ctx, input }: MiddlewareContext) => {
+      if (!ctx.user) {
+        throw new TRPCError({
+          code: "UNAUTHORIZED",
+          message: "Not authenticated",
+        });
       }
-    });
-
-    if (!isMember) {
-      throw new TRPCError({
-        code: 'FORBIDDEN',
-        message: 'Not a member in this class',
-      });
-    }
 
-    return next();
-  });
+      const classId = (input as { classId: string })?.classId;
+      if (!classId) {
+        throw new TRPCError({
+          code: "BAD_REQUEST",
+          message: "classId is required",
+        });
+      }
 
-  // Teacher middleware
-  const isTeacherInClass = t.middleware(async ({ next, ctx, input }: MiddlewareContext) => {
-    if (!ctx.user) {
-      throw new TRPCError({
-        code: 'UNAUTHORIZED',
-        message: 'Not authenticated',
-      });
-    }
+      const isMember = await findClassWithMember(classId, ctx.user.id);
+      if (!isMember) {
+        throw new TRPCError({
+          code: "FORBIDDEN",
+          message: "Not a member in this class",
+        });
+      }
 
-    const classId = input.classId;
-    if (!classId) {
-      throw new TRPCError({
-        code: 'BAD_REQUEST',
-        message: 'classId is required',
-      });
+      return next();
     }
+  );
 
-    const isTeacher = await prisma.class.findFirst({
-      where: {
-        id: classId,
-        teachers: {
-          some: {
-            id: ctx.user.id
-          }
-        }
+  const isTeacherInClass = t.middleware(
+    async ({ next, ctx, input }: MiddlewareContext) => {
+      if (!ctx.user) {
+        throw new TRPCError({
+          code: "UNAUTHORIZED",
+          message: "Not authenticated",
+        });
       }
-    });
 
+      const classId = (input as { classId: string })?.classId;
+      if (!classId) {
+        throw new TRPCError({
+          code: "BAD_REQUEST",
+          message: "classId is required",
+        });
+      }
 
+      const isTeacher = await findClassWithTeacher(classId, ctx.user.id);
+      if (!isTeacher) {
+        throw new TRPCError({
+          code: "FORBIDDEN",
+          message: "Not a teacher in this class",
+        });
+      }
 
-    if (!isTeacher) {
-      throw new TRPCError({
-        code: 'FORBIDDEN',
-        message: 'Not a teacher in this class',
-      });
+      return next();
     }
-
-    return next();
-  });
+  );
 
   return {
     isAuthed,
@@ -186,4 +135,4 @@ export const createAuthMiddleware = (t: any) => {
     isMemberInClass,
     isTeacherInClass,
   };
-}; 
+};

package/src/middleware/security.ts

@@ -0,0 +1,80 @@
+import helmet from 'helmet';
+import rateLimit from 'express-rate-limit';
+import type { Request, Response } from 'express';
+
+const isDevelopment = process.env.NODE_ENV === 'development';
+
+// Custom handler for rate limit errors that returns JSON
+// This format can be intercepted on the frontend with:
+// error.data?.code === 'TOO_MANY_REQUESTS' || error.data?.httpStatus === 429
+const rateLimitHandler = (req: Request, res: Response) => {
+  // Return JSON structure that can be intercepted on frontend with:
+  // error.data?.code === 'TOO_MANY_REQUESTS' || error.data?.httpStatus === 429
+  // When tRPC wraps this, the response body becomes error.data, so we put code/httpStatus at top level
+  res.status(429).json({
+    code: 'TOO_MANY_REQUESTS',
+    message: 'Too many requests, please try again later.',
+  });
+};
+
+// General API rate limiter - applies to all routes
+export const generalLimiter = rateLimit({
+  windowMs: 10 * 60, // 10 minutes
+  max: 100, // Limit each IP to 100 requests per windowMs
+  message: 'Too many requests from this IP, please try again later.',
+  standardHeaders: true, // Return rate limit info in the `RateLimit-*` headers
+  legacyHeaders: false, // Disable the `X-RateLimit-*` headers
+  handler: rateLimitHandler,
+  skip: (req) => {
+    // Skip rate limiting for health checks
+    return req.path === '/health' || req.method === 'OPTIONS';
+  },
+});
+
+// Stricter rate limiter for authentication endpoints
+export const authLimiter = rateLimit({
+  windowMs: 5 * 60 * 1000, // 5 minutes
+  max: 5, // Limit each IP to 5 login attempts per windowMs
+  message: 'Too many authentication attempts, please try again later.',
+  standardHeaders: true,
+  legacyHeaders: false,
+  skipSuccessfulRequests: true, // Don't count successful requests
+  handler: rateLimitHandler,
+});
+
+// File upload rate limiter
+export const uploadLimiter = rateLimit({
+  windowMs: 30 * 60 * 1000, // 30 minutes
+  max: 50, // Limit each IP to 50 uploads per hour
+  message: 'Too many file uploads, please try again later.',
+  standardHeaders: true,
+  legacyHeaders: false,
+  handler: rateLimitHandler,
+});
+
+// Helmet configuration
+export const helmetConfig = helmet({
+  contentSecurityPolicy: {
+    directives: {
+      defaultSrc: ["'self'"],
+      styleSrc: ["'self'", "'unsafe-inline'"], // Allow inline styles for tRPC panel
+      // Allow inline scripts only in development (for tRPC panel)
+      // In production, keep strict CSP without unsafe-inline
+      scriptSrc: isDevelopment 
+        ? ["'self'", "'unsafe-inline'"] 
+        : ["'self'"],
+      imgSrc: ["'self'", "data:", "https:"], // Allow images from any HTTPS source
+      connectSrc: ["'self'", "https://*.sentry.io"], // Allow Sentry connections
+      fontSrc: ["'self'", "data:"],
+      objectSrc: ["'none'"],
+      mediaSrc: ["'self'"],
+      frameSrc: ["'none'"],
+    },
+  },
+  crossOriginEmbedderPolicy: false, // Disable if you need to embed resources
+  hsts: {
+    maxAge: 31536000, // 1 year
+    includeSubDomains: true,
+    preload: true,
+  },
+});

package/src/models/agenda.ts

@@ -0,0 +1,46 @@
+/**
+ * Agenda model – personal and class events for a date range.
+ */
+import { prisma } from "../lib/prisma.js";
+
+/** @returns Personal events (no class) for user in date range. */
+export function findPersonalEvents(
+  userId: string,
+  rangeStart: Date,
+  rangeEnd: Date,
+) {
+  return prisma.event.findMany({
+    where: {
+      userId,
+      startTime: { gte: rangeStart, lte: rangeEnd },
+      class: { is: null },
+    },
+    include: {
+      assignmentsAttached: true,
+      class: true,
+    },
+  });
+}
+
+/** @returns Class events for user's classes in date range. */
+export function findClassEvents(
+  userId: string,
+  rangeStart: Date,
+  rangeEnd: Date,
+) {
+  return prisma.event.findMany({
+    where: {
+      class: {
+        OR: [
+          { teachers: { some: { id: userId } } },
+          { students: { some: { id: userId } } },
+        ],
+      },
+      startTime: { gte: rangeStart, lte: rangeEnd },
+    },
+    include: {
+      assignmentsAttached: true,
+      class: true,
+    },
+  });
+}

package/src/models/announcement.ts

@@ -0,0 +1,134 @@
+/**
+ * Announcement model – announcements, attachments, comments.
+ */
+import { prisma } from "../lib/prisma.js";
+
+export const announcementSelect = {
+  id: true,
+  teacher: {
+    select: {
+      id: true,
+      username: true,
+      profile: {
+        select: {
+          displayName: true,
+          profilePicture: true,
+          profilePictureThumbnail: true,
+        },
+      },
+    },
+  },
+  remarks: true,
+  createdAt: true,
+  modifiedAt: true,
+  attachments: {
+    select: {
+      id: true,
+      name: true,
+      type: true,
+      size: true,
+      path: true,
+      uploadedAt: true,
+      thumbnailId: true,
+    },
+  },
+};
+
+/** @returns Announcements for a class. */
+export function findAnnouncementsByClassId(classId: string) {
+  return prisma.announcement.findMany({
+    where: { classId },
+    select: {
+      ...announcementSelect,
+      _count: {
+        select: { comments: true },
+      },
+    },
+    orderBy: { createdAt: "desc" },
+  });
+}
+
+/** @returns Announcement by ID and class. */
+export function findAnnouncementByIdAndClass(id: string, classId: string) {
+  return prisma.announcement.findFirst({
+    where: { id, classId },
+    select: announcementSelect,
+  });
+}
+
+/** @returns Announcement by ID with class and teachers. */
+export function findAnnouncementWithClass(id: string) {
+  return prisma.announcement.findUnique({
+    where: { id },
+    include: {
+      class: {
+        include: { teachers: true },
+      },
+      attachments: {
+        select: {
+          id: true,
+          name: true,
+          type: true,
+          path: true,
+          size: true,
+          uploadStatus: true,
+          thumbnail: { select: { path: true } },
+        },
+      },
+    },
+  });
+}
+
+/** Create an announcement. */
+export function createAnnouncement(data: {
+  remarks: string;
+  teacherId: string;
+  classId: string;
+}) {
+  return prisma.announcement.create({
+    data: {
+      remarks: data.remarks,
+      teacher: { connect: { id: data.teacherId } },
+      class: { connect: { id: data.classId } },
+    },
+    select: announcementSelect,
+  });
+}
+
+/** Update announcement attachments. */
+export function updateAnnouncementAttachments(
+  id: string,
+  data: {
+    connect?: { id: string }[];
+    deleteMany?: { id: { in: string[] } };
+  }
+) {
+  return prisma.announcement.update({
+    where: { id },
+    data: {
+      ...(data.connect?.length && {
+        attachments: { connect: data.connect },
+      }),
+      ...(data.deleteMany && {
+        attachments: { deleteMany: data.deleteMany },
+      }),
+    },
+    select: announcementSelect,
+  });
+}
+
+/** Update announcement remarks. */
+export function updateAnnouncement(id: string, data: { remarks?: string }) {
+  return prisma.announcement.update({
+    where: { id },
+    data,
+    select: announcementSelect,
+  });
+}
+
+/** Delete an announcement. */
+export function deleteAnnouncement(id: string) {
+  return prisma.announcement.delete({
+    where: { id },
+  });
+}