@studious-lms/server 1.1.26 → 1.2.6

package/src/services/conversation.ts

@@ -0,0 +1,213 @@
+/**
+ * Conversation service – list, create, and manage DM/group conversations.
+ * Handles member management and unread counts.
+ */
+import { TRPCError } from "@trpc/server";
+import {
+  findConversationsByUserId,
+  countUnreadMessages,
+  countUnreadMentions,
+  findUserByUsername,
+  findDmConversationsByUserId,
+  findUsersByIdsOrUsernames,
+  createConversation,
+  findConversationByIdAndMember,
+  createConversationMember,
+  deleteConversationMember,
+} from "../models/conversation.js";
+
+/** List user's conversations with unread and mention counts. */
+export async function listConversations(userId: string) {
+  const conversations = await findConversationsByUserId(userId);
+
+  const conversationsWithUnread = await Promise.all(
+    conversations.map(async (conversation) => {
+      const userMembership = conversation.members.find(
+        (m) => m.userId === userId
+      );
+      const lastViewedAt = userMembership?.lastViewedAt;
+      const lastViewedMentionAt = userMembership?.lastViewedMentionAt;
+
+      const unreadCount = await countUnreadMessages(
+        conversation.id,
+        userId,
+        lastViewedAt ?? undefined
+      );
+
+      const mentionCutoffTime =
+        lastViewedMentionAt && lastViewedAt
+          ? lastViewedMentionAt > lastViewedAt
+            ? lastViewedMentionAt
+            : lastViewedAt
+          : lastViewedMentionAt || lastViewedAt;
+
+      const unreadMentionCount = await countUnreadMentions(
+        conversation.id,
+        userId,
+        mentionCutoffTime ?? undefined
+      );
+
+      return {
+        id: conversation.id,
+        type: conversation.type,
+        name: conversation.name,
+        createdAt: conversation.createdAt,
+        updatedAt: conversation.updatedAt,
+        labChat: conversation.labChat,
+        members: conversation.members,
+        lastMessage: conversation.messages[0] || null,
+        unreadCount,
+        unreadMentionCount,
+      };
+    })
+  );
+
+  return conversationsWithUnread;
+}
+
+/** Create a DM or group conversation with the given members. */
+export async function createConversationRecord(
+  userId: string,
+  type: "DM" | "GROUP",
+  name: string | undefined,
+  memberIds: string[]
+) {
+  if (type === "GROUP" && !name) {
+    throw new TRPCError({
+      code: "BAD_REQUEST",
+      message: "Group conversations must have a name",
+    });
+  }
+
+  if (type === "DM" && memberIds.length !== 1) {
+    throw new TRPCError({
+      code: "BAD_REQUEST",
+      message: "DM conversations must have exactly one other member",
+    });
+  }
+
+  if (type === "DM") {
+    const targetUser = await findUserByUsername(memberIds[0]);
+    if (!targetUser) {
+      throw new TRPCError({
+        code: "BAD_REQUEST",
+        message: `User "${memberIds[0]}" not found`,
+      });
+    }
+
+    const existingDMs = await findDmConversationsByUserId(userId);
+    const existingDM = existingDMs.find((conv) => {
+      const memberUserIds = conv.members.map((m) => m.userId);
+      return (
+        memberUserIds.length === 2 &&
+        memberUserIds.includes(userId) &&
+        memberUserIds.includes(targetUser.id)
+      );
+    });
+
+    if (existingDM) {
+      throw new TRPCError({
+        code: "BAD_REQUEST",
+        message: `A conversation with ${targetUser.username} already exists`,
+      });
+    }
+  }
+
+  const members = await findUsersByIdsOrUsernames(memberIds);
+  type Member = (typeof members)[number];
+  const uniqueMembers = Array.from(
+    new Map(members.map((m) => [m.id, m] as [string, Member])).values()
+  );
+
+  if (uniqueMembers.length !== memberIds.length) {
+    throw new TRPCError({
+      code: "BAD_REQUEST",
+      message: "One or more members not found",
+    });
+  }
+
+  const toAddIds = memberIds
+    .map((id) =>
+      uniqueMembers.find((m) => m.id === id || m.username === id)?.id
+    )
+    .filter(Boolean) as string[];
+
+  return createConversation({
+    type,
+    name,
+    members: [
+      { userId, role: type === "GROUP" ? "ADMIN" : "MEMBER" },
+      ...toAddIds.map((uid) => ({ userId: uid, role: "MEMBER" })),
+    ],
+  });
+}
+
+export async function getConversation(
+  userId: string,
+  conversationId: string
+) {
+  const conversation = await findConversationByIdAndMember(
+    conversationId,
+    userId
+  );
+  if (!conversation) {
+    throw new TRPCError({
+      code: "NOT_FOUND",
+      message: "Conversation not found or access denied",
+    });
+  }
+  return conversation;
+}
+
+export async function addMemberToConversation(
+  userId: string,
+  conversationId: string,
+  memberUsername: string
+) {
+  const conversation = await findConversationByIdAndMember(
+    conversationId,
+    userId
+  );
+  if (!conversation) {
+    throw new TRPCError({
+      code: "NOT_FOUND",
+      message: "Conversation not found or access denied",
+    });
+  }
+
+  const member = await findUserByUsername(memberUsername);
+  if (!member) {
+    throw new TRPCError({
+      code: "NOT_FOUND",
+      message: "Member not found",
+    });
+  }
+
+  await createConversationMember({
+    userId: member.id,
+    conversationId,
+    role: "MEMBER",
+  });
+
+  return conversation;
+}
+
+export async function removeMemberFromConversation(
+  userId: string,
+  conversationId: string,
+  memberId: string
+) {
+  const conversation = await findConversationByIdAndMember(
+    conversationId,
+    userId
+  );
+  if (!conversation) {
+    throw new TRPCError({
+      code: "NOT_FOUND",
+      message: "Conversation not found or access denied",
+    });
+  }
+
+  await deleteConversationMember(memberId, conversationId);
+  return conversation;
+}

package/src/services/event.ts

@@ -0,0 +1,231 @@
+/**
+ * Event service – CRUD for calendar events. Supports personal and class events.
+ * Handles assignment attachment/detachment.
+ */
+import { TRPCError } from "@trpc/server";
+import { parseISO } from "date-fns";
+import {
+  findEventById,
+  findClassWithTeachers,
+  createEvent,
+  updateEvent,
+  deleteEventById,
+  findEventWithClass,
+  findAssignmentWithClass,
+  attachAssignmentToEvent,
+  detachAssignmentFromEvent,
+  findAvailableAssignmentsForClass,
+} from "../models/event.js";
+
+/** Get a single event. Personal events require ownership. */
+export async function getEvent(userId: string, id: string) {
+  const event = await findEventById(id);
+  if (!event) {
+    throw new TRPCError({
+      code: "NOT_FOUND",
+      message: "Event not found",
+    });
+  }
+  if (event.userId !== userId) {
+    throw new TRPCError({
+      code: "UNAUTHORIZED",
+      message: "You are not authorized to view this event",
+    });
+  }
+  return { event };
+}
+
+/** Create a personal or class event. */
+export async function createEventRecord(
+  userId: string,
+  input: {
+    name?: string;
+    location?: string;
+    remarks?: string;
+    startTime: string;
+    endTime: string;
+    classId?: string;
+    color?: string;
+  }
+) {
+  if (input.classId) {
+    const classData = await findClassWithTeachers(input.classId, userId);
+    if (!classData) {
+      throw new TRPCError({
+        code: "UNAUTHORIZED",
+        message: "You are not authorized to create events for this class",
+      });
+    }
+  }
+
+  const event = await createEvent({
+    name: input.name,
+    location: input.location,
+    remarks: input.remarks,
+    startTime: parseISO(input.startTime),
+    endTime: parseISO(input.endTime),
+    userId,
+    color: input.color,
+    classId: input.classId,
+  });
+
+  return { event };
+}
+
+export async function updateEventRecord(
+  userId: string,
+  id: string,
+  data: {
+    name?: string;
+    location?: string;
+    remarks?: string;
+    startTime?: string;
+    endTime?: string;
+    color?: string;
+    classId?: string;
+  }
+) {
+  const event = await findEventById(id);
+  if (!event) {
+    throw new TRPCError({
+      code: "NOT_FOUND",
+      message: "Event not found",
+    });
+  }
+  if (event.userId !== userId) {
+    throw new TRPCError({
+      code: "UNAUTHORIZED",
+      message: "You are not authorized to update this event",
+    });
+  }
+
+  const updatedEvent = await updateEvent(id, {
+    name: data.name,
+    location: data.location,
+    remarks: data.remarks,
+    startTime: data.startTime ? parseISO(data.startTime) : undefined,
+    endTime: data.endTime ? parseISO(data.endTime) : undefined,
+    color: data.color,
+    classId: data.classId,
+  });
+
+  return { event: updatedEvent };
+}
+
+export async function deleteEventRecord(userId: string, id: string) {
+  const event = await findEventById(id);
+  if (!event) {
+    throw new TRPCError({
+      code: "NOT_FOUND",
+      message: "Event not found",
+    });
+  }
+  if (event.userId !== userId) {
+    throw new TRPCError({
+      code: "UNAUTHORIZED",
+      message: "You are not authorized to delete this event",
+    });
+  }
+
+  await deleteEventById(id);
+  return { success: true };
+}
+
+function canModifyEvent(
+  event: { userId: string | null; class?: { teachers: { id: string }[] } | null },
+  userId: string
+) {
+  if (event.userId === userId) return true;
+  return event.class?.teachers.some((t) => t.id === userId) ?? false;
+}
+
+export async function attachAssignment(
+  userId: string,
+  eventId: string,
+  assignmentId: string
+) {
+  const event = await findEventWithClass(eventId);
+  if (!event) {
+    throw new TRPCError({
+      code: "NOT_FOUND",
+      message: "Event not found",
+    });
+  }
+  if (!canModifyEvent(event, userId)) {
+    throw new TRPCError({
+      code: "UNAUTHORIZED",
+      message: "You are not authorized to modify this event",
+    });
+  }
+
+  const assignment = await findAssignmentWithClass(assignmentId);
+  if (!assignment) {
+    throw new TRPCError({
+      code: "NOT_FOUND",
+      message: "Assignment not found",
+    });
+  }
+  if (!assignment.class.teachers.some((t) => t.id === userId)) {
+    throw new TRPCError({
+      code: "UNAUTHORIZED",
+      message: "You are not authorized to modify this assignment",
+    });
+  }
+  if (event.classId !== assignment.classId) {
+    throw new TRPCError({
+      code: "BAD_REQUEST",
+      message: "Event and assignment must belong to the same class",
+    });
+  }
+
+  const updatedAssignment = await attachAssignmentToEvent(
+    assignmentId,
+    eventId
+  );
+  return { assignment: updatedAssignment };
+}
+
+export async function detachAssignment(
+  userId: string,
+  eventId: string,
+  assignmentId: string
+) {
+  const event = await findEventWithClass(eventId);
+  if (!event) {
+    throw new TRPCError({
+      code: "NOT_FOUND",
+      message: "Event not found",
+    });
+  }
+  if (!canModifyEvent(event, userId)) {
+    throw new TRPCError({
+      code: "UNAUTHORIZED",
+      message: "You are not authorized to modify this event",
+    });
+  }
+
+  const updatedAssignment = await detachAssignmentFromEvent(assignmentId);
+  return { assignment: updatedAssignment };
+}
+
+export async function getAvailableAssignments(
+  userId: string,
+  eventId: string
+) {
+  const event = await findEventWithClass(eventId);
+  if (!event || !event.classId) {
+    throw new TRPCError({
+      code: "NOT_FOUND",
+      message: "Event not found",
+    });
+  }
+  if (!canModifyEvent(event, userId)) {
+    throw new TRPCError({
+      code: "UNAUTHORIZED",
+      message: "You are not authorized to access this event",
+    });
+  }
+
+  const assignments = await findAvailableAssignmentsForClass(event.classId);
+  return { assignments };
+}

package/src/services/file.ts

@@ -0,0 +1,167 @@
+/**
+ * File service – signed URLs, move, rename, delete. Handles permission checks
+ * for assignment, submission, announcement, folder, and user-owned files.
+ */
+import { TRPCError } from "@trpc/server";
+import { getSignedUrl, deleteFile } from "../lib/googleCloudStorage.js";
+import { logger } from "../utils/logger.js";
+import {
+  findFileById,
+  findFileWithFolder,
+  findFileWithFolderAndThumbnail,
+  findFolderById,
+  updateFileFolder,
+  updateFileName,
+  deleteFileById,
+} from "../models/file.js";
+
+/** Generate a signed URL for file download. Validates user has access. */
+export async function getFileSignedUrl(userId: string, fileId: string) {
+  const file = await findFileById(fileId);
+  if (!file) {
+    throw new TRPCError({
+      code: "NOT_FOUND",
+      message: "File does not exist",
+    });
+  }
+
+  let hasAccess = false;
+
+  if (file.assignment?.class) {
+    const isTeacher = file.assignment.class.teachers.some(
+      (t) => t.id === userId
+    );
+    const isStudent = file.assignment.class.students.some(
+      (s) => s.id === userId
+    );
+    logger.info(
+      `Assignment file access check - userId: ${userId}, isTeacher: ${isTeacher}, isStudent: ${isStudent}`
+    );
+    hasAccess = isTeacher || isStudent;
+  }
+
+  if ((file as any).announcement?.class) {
+    const ann = (file as any).announcement;
+    const isTeacher = ann.class.teachers.some((t: any) => t.id === userId);
+    const isStudent = ann.class.students.some((s: any) => s.id === userId);
+    hasAccess = hasAccess || isTeacher || isStudent;
+  }
+
+  if (file.submission?.assignment?.classId) {
+    hasAccess =
+      hasAccess ||
+      file.submission.studentId === userId ||
+      file.submission.assignment.class.teachers.some((t) => t.id === userId);
+  }
+
+  if (file.annotations?.assignment?.classId) {
+    hasAccess =
+      hasAccess ||
+      file.annotations.studentId === userId ||
+      file.annotations.assignment.class.teachers.some((t) => t.id === userId);
+  }
+
+  if (file.userId === userId) {
+    hasAccess = true;
+  }
+
+  if (file.folder?.class) {
+    const isTeacher = file.folder.class.teachers.some((t) => t.id === userId);
+    const isStudent = file.folder.class.students.some((s) => s.id === userId);
+    hasAccess = hasAccess || isTeacher || isStudent;
+  }
+
+  if (!hasAccess) {
+    throw new TRPCError({
+      code: "FORBIDDEN",
+      message: "You do not have access to this file",
+    });
+  }
+
+  try {
+    const signedUrl = await getSignedUrl(file.path);
+    return { url: signedUrl };
+  } catch (error) {
+    logger.error("Error generating signed URL:", error as Record<string, unknown>);
+    throw new TRPCError({
+      code: "INTERNAL_SERVER_ERROR",
+      message: "Failed to generate download URL",
+    });
+  }
+}
+
+export async function moveFile(
+  fileId: string,
+  targetFolderId: string
+) {
+  const file = await findFileWithFolder(fileId);
+  if (!file) {
+    throw new TRPCError({
+      code: "NOT_FOUND",
+      message: "File not found",
+    });
+  }
+
+  const targetFolder = await findFolderById(targetFolderId);
+  if (!targetFolder) {
+    throw new TRPCError({
+      code: "NOT_FOUND",
+      message: "Target folder not found",
+    });
+  }
+
+  return updateFileFolder(fileId, targetFolderId);
+}
+
+export async function renameFile(
+  fileId: string,
+  newName: string
+) {
+  const file = await findFileWithFolder(fileId);
+  if (!file) {
+    throw new TRPCError({
+      code: "NOT_FOUND",
+      message: "File not found",
+    });
+  }
+
+  if (!newName.trim()) {
+    throw new TRPCError({
+      code: "BAD_REQUEST",
+      message: "File name cannot be empty",
+    });
+  }
+
+  return updateFileName(fileId, newName.trim());
+}
+
+export async function deleteFileRecord(fileId: string, classId: string) {
+  const file = await findFileWithFolderAndThumbnail(fileId);
+  if (!file) {
+    throw new TRPCError({
+      code: "NOT_FOUND",
+      message: "File not found",
+    });
+  }
+
+  if (file.folder?.classId !== classId) {
+    throw new TRPCError({
+      code: "FORBIDDEN",
+      message: "File does not belong to this class",
+    });
+  }
+
+  try {
+    if (file.uploadStatus === "COMPLETED") {
+      await deleteFile(file.path);
+      if (file.thumbnail) {
+        await deleteFile(file.thumbnail.path);
+      }
+    }
+  } catch (error) {
+    logger.warn(`Failed to delete file ${file.path}:`, error as Record<string, unknown>);
+  }
+
+  await deleteFileById(fileId);
+  return { success: true };
+}