@studious-lms/server 1.11.0 → 1.12.0

package/prisma/schema.prisma

@@ -84,6 +84,12 @@ enum ReactionType {
   HAPPY
 }
 
+enum DiscussionType {
+  DISCUSSION
+  QUESTION
+  ANNOUNCEMENT
+}
+
 enum SubmissionRecommendationState {
   NONE
   OPEN
@@ -227,6 +233,9 @@ model User {
   createdLabChats         LabChat[]            @relation("CreatedLabChats")
   comments                Comment[]
   reactions               Reaction[]
+  discussions             Discussion[]
+  discussionReplies       DiscussionReply[]
+  discussionReads         DiscussionRead[]
 }
 
 model SchoolMembership {
@@ -311,6 +320,12 @@ model Class {
   departmentId      String?
   tags              Tag[]             @relation("ClassTags")
   permissions       Permission[]      @relation("ClassPermissions")
+  discussions       Discussion[]
+  discussionTags    DiscussionTag[]
+
+  discussionsEnabled              Boolean @default(true)
+  studentsCanCreateDiscussions    Boolean @default(true)
+  studentsCanReply                Boolean @default(true)
 
   @@index([schoolId])
   @@index([departmentId])
@@ -422,6 +437,12 @@ model File {
   announcement   Announcement? @relation("AnnouncementAttachments", fields: [announcementId], references: [id], onDelete: Cascade)
   announcementId String?
 
+  discussion   Discussion? @relation("DiscussionFiles", fields: [discussionId], references: [id], onDelete: Cascade)
+  discussionId String?
+
+  discussionReply   DiscussionReply? @relation("DiscussionReplyFiles", fields: [discussionReplyId], references: [id], onDelete: Cascade)
+  discussionReplyId String?
+
   schools School[] @relation("SchoolLogo")
 
   schoolDevelopementProgram   SchoolDevelopementProgram? @relation("SchoolDevelopementProgramSupportingDocumentation", fields: [schoolDevelopementProgramId], references: [id], onDelete: Cascade)
@@ -507,6 +528,74 @@ model Comment {
   @@index([submissionId])
 }
 
+model Discussion {
+  id             String            @id @default(uuid())
+  class          Class             @relation(fields: [classId], references: [id], onDelete: Cascade)
+  classId        String
+  author         User              @relation(fields: [authorId], references: [id], onDelete: Cascade)
+  authorId       String
+  title          String
+  body           String
+  type           DiscussionType    @default(DISCUSSION)
+  isPinned       Boolean           @default(false)
+  isLocked       Boolean           @default(false)
+  allowReplies   Boolean           @default(true)
+  attachments    File[]            @relation("DiscussionFiles")
+  tags           DiscussionTag[]   @relation("DiscussionToTag")
+  replies        DiscussionReply[]
+  reactions      Reaction[]
+  reads          DiscussionRead[]
+  createdAt      DateTime          @default(now())
+  updatedAt      DateTime          @updatedAt
+  lastActivityAt DateTime          @default(now())
+
+  @@index([classId, isPinned, lastActivityAt])
+  @@index([classId, createdAt])
+}
+
+model DiscussionReply {
+  id               String            @id @default(uuid())
+  discussion       Discussion        @relation(fields: [discussionId], references: [id], onDelete: Cascade)
+  discussionId     String
+  author           User              @relation(fields: [authorId], references: [id], onDelete: Cascade)
+  authorId         String
+  parent           DiscussionReply?  @relation("ReplyTree", fields: [parentId], references: [id], onDelete: Cascade)
+  parentId         String?
+  children         DiscussionReply[] @relation("ReplyTree")
+  body             String
+  attachments      File[]            @relation("DiscussionReplyFiles")
+  reactions        Reaction[]
+  isAcceptedAnswer Boolean           @default(false)
+  createdAt        DateTime          @default(now())
+  modifiedAt       DateTime?         @updatedAt
+  deletedAt        DateTime?
+
+  @@index([discussionId, createdAt])
+  @@index([parentId])
+}
+
+model DiscussionTag {
+  id          String       @id @default(uuid())
+  class       Class        @relation(fields: [classId], references: [id], onDelete: Cascade)
+  classId     String
+  name        String
+  color       String       @default("#3B82F6")
+  discussions Discussion[] @relation("DiscussionToTag")
+
+  @@unique([classId, name])
+}
+
+model DiscussionRead {
+  user         User       @relation(fields: [userId], references: [id], onDelete: Cascade)
+  userId       String
+  discussion   Discussion @relation(fields: [discussionId], references: [id], onDelete: Cascade)
+  discussionId String
+  lastReadAt   DateTime   @default(now())
+
+  @@id([userId, discussionId])
+  @@index([userId])
+}
+
 model Reaction {
   id             String        @id @default(uuid())
   type           ReactionType
@@ -516,12 +605,20 @@ model Reaction {
   announcementId String?
   comment        Comment?      @relation(fields: [commentId], references: [id], onDelete: Cascade)
   commentId      String?
+  discussion        Discussion?      @relation(fields: [discussionId], references: [id], onDelete: Cascade)
+  discussionId      String?
+  discussionReply   DiscussionReply? @relation(fields: [discussionReplyId], references: [id], onDelete: Cascade)
+  discussionReplyId String?
   createdAt      DateTime      @default(now())
 
   @@unique([userId, announcementId])
   @@unique([userId, commentId])
+  @@unique([userId, discussionId])
+  @@unique([userId, discussionReplyId])
   @@index([announcementId])
   @@index([commentId])
+  @@index([discussionId])
+  @@index([discussionReplyId])
 }
 
 model Submission {

package/src/index.ts

@@ -58,7 +58,8 @@ app.use(cors({
   },
   credentials: true,
   methods: ['GET', 'POST', 'PUT', 'DELETE', 'OPTIONS'],
-  allowedHeaders: ['Content-Type', 'Authorization', 'X-Requested-With', 'x-user'],
+  // Omit allowedHeaders so `cors` echoes `Access-Control-Request-Headers` on preflight.
+  // A fixed list breaks browsers that add headers (e.g. Sentry `baggage`, `sentry-trace`).
   preflightContinue: false,
   optionsSuccessStatus: 204,
 }));
@@ -221,6 +222,38 @@ app.post('/api/pusher/auth', async (req, res) => {
       }
     }
 
+    if (channel_name.startsWith('private-class-') && channel_name.endsWith('-discussions')) {
+      const classId = channel_name
+        .replace('private-class-', '')
+        .replace('-discussions', '');
+      const isMember = await prisma.class.findFirst({
+        where: {
+          id: classId,
+          discussionsEnabled: true,
+          OR: [
+            { students: { some: { id: user.id } } },
+            { teachers: { some: { id: user.id } } },
+            {
+              school: {
+                is: {
+                  memberships: {
+                    some: {
+                      userId: user.id,
+                      role: 'ADMIN',
+                      status: 'ACTIVE',
+                    },
+                  },
+                },
+              },
+            },
+          ],
+        },
+      });
+      if (!isMember) {
+        return res.status(403).json({ error: 'Not a member of this class discussion channel' });
+      }
+    }
+
     // Verify channel access for private-class-* channels
     // if (channel_name.startsWith('private-class-')) {
     //   const classId = channel_name.replace('private-class-', '');
@@ -586,7 +619,11 @@ app.options('/trpc/*', (req, res) => {
     res.setHeader('Access-Control-Allow-Origin', origin);
     res.setHeader('Access-Control-Allow-Credentials', 'true');
     res.setHeader('Access-Control-Allow-Methods', 'GET, POST, PUT, DELETE, OPTIONS');
-    res.setHeader('Access-Control-Allow-Headers', 'Content-Type, Authorization, X-Requested-With, x-user');
+    const requestedHeaders = req.headers['access-control-request-headers'];
+    if (requestedHeaders) {
+      res.setHeader('Access-Control-Allow-Headers', requestedHeaders);
+      res.setHeader('Vary', 'Origin, Access-Control-Request-Headers');
+    }
   }
   res.sendStatus(204);
 });

package/src/lib/config/cors.ts

@@ -9,6 +9,11 @@ const productionOrigins = [
   'https://www.studious.sh',
   'https://studious.sh',
   'https://dev.studious.sh',
+  // @todo: remove in actual prod
+'http://localhost:3000',
+  'http://localhost:3001',
+  'http://127.0.0.1:3000',
+  'http://127.0.0.1:3001',
 ];
 
 const nonProductionOrigins = [

package/src/lib/config/env.ts

@@ -63,6 +63,8 @@ const fullSchema = baseSchema.extend({
   INFERENCE_API_BASE_URL: z.string().url().optional(),
   OPENAI_API_KEY: z.string().optional(),
   LOG_MODE: z.enum(['normal', 'verbose', 'quiet']).default('normal'),
+  /** Comma/whitespace-separated user UUIDs allowed to call `admin.*` tRPC (required in production). */
+  ADMIN_PANEL_USER_IDS: z.string().optional(),
 });
 
 // Test schema - only require what's needed for tests
@@ -91,6 +93,7 @@ const testSchema = baseSchema.extend({
   OPENAI_API_KEY: z.string().optional(),
   INFERENCE_API_BASE_URL: z.string().url().optional(),
   LOG_MODE: z.enum(['normal', 'verbose', 'quiet']).default('quiet'),
+  ADMIN_PANEL_USER_IDS: z.string().optional(),
 });
 
 // Use test schema in test mode, full schema otherwise

package/src/lib/pusher.ts

@@ -12,6 +12,7 @@ const pusher = new Pusher({
 const chatChannel = (conversationId: string) => `private-conversation-${conversationId}`;
 const worksheetChannel = (worksheetResponseId: string) => `private-worksheet-${worksheetResponseId}`;
 const teacherChannel = (classId: string) => `private-teacher-${classId}`;
+const discussionChannel = (classId: string) => `private-class-${classId}-discussions`;
 /**
  * Per-worksheet job channel used for asynchronous worksheet creation
  * (e.g. PDF → worksheet conversion). Distinct prefix from the student
@@ -19,4 +20,4 @@ const teacherChannel = (classId: string) => `private-teacher-${classId}`;
  */
 const worksheetJobChannel = (worksheetId: string) => `private-worksheet-job-${worksheetId}`;
 
-export { pusher, chatChannel, worksheetChannel, teacherChannel, worksheetJobChannel };
+export { pusher, chatChannel, worksheetChannel, teacherChannel, discussionChannel, worksheetJobChannel };

package/src/models/class.ts

@@ -180,6 +180,9 @@ const classIncludeForGet = {
       },
     },
   },
+  discussionsEnabled: true,
+  studentsCanCreateDiscussions: true,
+  studentsCanReply: true,
 } as const;
 
 const assignmentSelect = {

package/src/models/worksheet.ts

@@ -456,6 +456,34 @@ export function findStudentQuestionProgressByIdForTeacherAndResponse(
   });
 }
 
+/**
+ * @returns Student question progress if requester is the answering student (class member) or a
+ *   class teacher / school admin for that worksheet.
+ */
+export function findStudentQuestionProgressByIdForStudentOrTeacher(
+  id: string,
+  userId: string
+) {
+  return prisma.studentQuestionProgress.findFirst({
+    where: {
+      id,
+      OR: [
+        {
+          studentId: userId,
+          question: { worksheet: worksheetClassMemberWhere(userId) },
+        },
+        {
+          question: { worksheet: worksheetTeacherWhere(userId) },
+        },
+      ],
+    },
+    include: {
+      question: true,
+      studentWorksheetResponse: true,
+    },
+  });
+}
+
 /** Update student's question progress. */
 export function updateStudentQuestionProgress(
   id: string,

package/src/routers/_app.ts

@@ -26,6 +26,8 @@ import { schoolRouter } from "./school.js";
 import { departmentRouter } from "./department.js";
 import { tagRouter } from "./tag.js";
 import { permissionsRouter } from "./permissions.js";
+import { discussionRouter } from "./discussion.js";
+import { adminRouter } from "./admin.js";
 
 export const appRouter = createTRPCRouter({
   class: classRouter,
@@ -53,6 +55,8 @@ export const appRouter = createTRPCRouter({
   department: departmentRouter,
   tag: tagRouter,
   permissions: permissionsRouter,
+  discussion: discussionRouter,
+  admin: adminRouter,
 });
 
 // Export type router type definition

package/src/routers/admin.ts

@@ -0,0 +1,70 @@
+import { z } from 'zod';
+import { RunJobStatus, RunJobType } from '@prisma/client';
+import { createTRPCRouter, adminProcedure } from '../trpc.js';
+import {
+  getRunJobForAdmin,
+  listRunJobsForAdmin,
+} from '../services/adminRunJob.js';
+import {
+  listDepartmentsForAdmin,
+  listEarlyAccessRequestsForAdmin,
+  listSchoolDevelopmentProgramsForAdmin,
+  listSchoolsForAdmin,
+} from '../services/adminInstitution.js';
+
+export const adminRouter = createTRPCRouter({
+  listRunJobs: adminProcedure
+    .input(
+      z.object({
+        page: z.number().int().min(0).default(0),
+        pageSize: z.number().int().min(1).max(100).default(25),
+        status: z.nativeEnum(RunJobStatus).optional(),
+        type: z.nativeEnum(RunJobType).optional(),
+      }),
+    )
+    .query(({ input }) => listRunJobsForAdmin(input)),
+
+  getRunJob: adminProcedure
+    .input(z.object({ id: z.string().uuid() }))
+    .query(({ input }) => getRunJobForAdmin(input.id)),
+
+  listSchools: adminProcedure
+    .input(
+      z.object({
+        page: z.number().int().min(0).default(0),
+        pageSize: z.number().int().min(1).max(100).default(25),
+        query: z.string().optional(),
+      }),
+    )
+    .query(({ input }) => listSchoolsForAdmin(input)),
+
+  listDepartments: adminProcedure
+    .input(
+      z.object({
+        page: z.number().int().min(0).default(0),
+        pageSize: z.number().int().min(1).max(100).default(25),
+        schoolId: z.string().uuid().optional(),
+      }),
+    )
+    .query(({ input }) => listDepartmentsForAdmin(input)),
+
+  listSchoolDevelopmentPrograms: adminProcedure
+      .input(
+        z.object({
+          page: z.number().int().min(0).default(0),
+          pageSize: z.number().int().min(1).max(100).default(25),
+          status: z.string().optional(),
+          query: z.string().optional(),
+        }),
+      )
+      .query(({ input }) => listSchoolDevelopmentProgramsForAdmin(input)),
+
+  listEarlyAccessRequests: adminProcedure
+    .input(
+      z.object({
+        page: z.number().int().min(0).default(0),
+        pageSize: z.number().int().min(1).max(100).default(25),
+      }),
+    )
+    .query(({ input }) => listEarlyAccessRequestsForAdmin(input)),
+});

package/src/routers/class.ts

@@ -60,6 +60,9 @@ export const classRouter = createTRPCRouter({
         subject: z.string().optional(),
         color: z.string().optional(),
         departmentId: z.string().nullable().optional(),
+        discussionsEnabled: z.boolean().optional(),
+        studentsCanCreateDiscussions: z.boolean().optional(),
+        studentsCanReply: z.boolean().optional(),
       })
     )
     .mutation(({ input }) => {

package/src/routers/discussion.ts

@@ -0,0 +1,205 @@
+import { z } from "zod";
+import { createTRPCRouter, protectedProcedure } from "../trpc.js";
+import {
+  createDiscussion,
+  createDiscussionTag,
+  deleteDiscussion,
+  deleteDiscussionReply,
+  deleteDiscussionTag,
+  getDiscussionClassAccess,
+  getDiscussion,
+  getUnreadCounts,
+  listDiscussionTags,
+  listDiscussions,
+  lockDiscussion,
+  markAcceptedAnswer,
+  markDiscussionRead,
+  pinDiscussion,
+  replyToDiscussion,
+  toggleDiscussionReaction,
+  updateDiscussion,
+  updateDiscussionReply,
+  updateDiscussionTag,
+} from "../services/discussion.js";
+import { confirmDirectUpload, createDirectUploadFiles } from "../lib/fileUpload.js";
+import { prisma } from "../lib/prisma.js";
+import { TRPCError } from "@trpc/server";
+
+const discussionTypeSchema = z.enum(["DISCUSSION", "QUESTION", "ANNOUNCEMENT"]);
+const reactionTypeSchema = z.enum(["THUMBSUP", "CELEBRATE", "CARE", "HEART", "IDEA", "HAPPY"]);
+const hexColorSchema = z.string().regex(/^#[0-9A-Fa-f]{6}$/);
+const MAX_DISCUSSION_UPLOAD_FILES = 20;
+const MAX_DISCUSSION_FILE_BYTES = 25 * 1024 * 1024;
+const reactionToggleInputSchema = z
+  .object({
+    discussionId: z.string().optional(),
+    discussionReplyId: z.string().optional(),
+    type: reactionTypeSchema,
+  })
+  .refine(
+    ({ discussionId, discussionReplyId }) => Boolean(discussionId) !== Boolean(discussionReplyId),
+    { message: "must provide exactly one of discussionId or discussionReplyId" }
+  );
+const directFileSchema = z.object({
+  name: z.string().trim().min(1).max(255),
+  type: z.string().trim().min(1).max(127),
+  size: z.number().int().nonnegative().max(MAX_DISCUSSION_FILE_BYTES),
+});
+
+export const discussionRouter = createTRPCRouter({
+  list: protectedProcedure
+    .input(
+      z.object({
+        classId: z.string(),
+        tagId: z.string().optional(),
+        type: discussionTypeSchema.optional(),
+        search: z.string().optional(),
+        sort: z.enum(["recent", "activity", "top"]).default("activity"),
+        cursor: z.string().optional(),
+        limit: z.number().min(1).max(50).default(20),
+      })
+    )
+    .query(({ ctx, input }) => listDiscussions(ctx.user!.id, input)),
+
+  get: protectedProcedure
+    .input(z.object({ discussionId: z.string() }))
+    .query(({ ctx, input }) => getDiscussion(ctx.user!.id, input.discussionId)),
+
+  create: protectedProcedure
+    .input(
+      z.object({
+        classId: z.string(),
+        title: z.string().trim().min(1).max(160),
+        body: z.string().trim().min(1),
+        type: discussionTypeSchema.default("DISCUSSION"),
+        tagIds: z.array(z.string()).optional(),
+        attachmentIds: z.array(z.string()).optional(),
+      })
+    )
+    .mutation(({ ctx, input }) => createDiscussion(ctx.user!.id, input)),
+
+  getUploadUrls: protectedProcedure
+    .input(
+      z.object({
+        classId: z.string(),
+        files: z.array(directFileSchema).min(1).max(MAX_DISCUSSION_UPLOAD_FILES),
+      })
+    )
+    .mutation(async ({ ctx, input }) => {
+      await getDiscussionClassAccess(input.classId, ctx.user!.id);
+      return {
+        uploadFiles: await createDirectUploadFiles(input.files, ctx.user!.id),
+      };
+    }),
+
+  confirmUpload: protectedProcedure
+    .input(
+      z.object({
+        fileId: z.string(),
+        uploadSuccess: z.boolean(),
+        errorMessage: z.string().optional(),
+      })
+    )
+    .mutation(async ({ ctx, input }) => {
+      const file = await prisma.file.findFirst({
+        where: {
+          id: input.fileId,
+          userId: ctx.user!.id,
+          discussionId: null,
+          discussionReplyId: null,
+        },
+        select: { id: true },
+      });
+      if (!file) {
+        throw new TRPCError({ code: "NOT_FOUND", message: "File not found or you do not have permission" });
+      }
+      await confirmDirectUpload(input.fileId, input.uploadSuccess, input.errorMessage);
+      return { success: true };
+    }),
+
+  update: protectedProcedure
+    .input(
+      z.object({
+        discussionId: z.string(),
+        title: z.string().trim().min(1).max(160).optional(),
+        body: z.string().trim().min(1).optional(),
+        type: discussionTypeSchema.optional(),
+        tagIds: z.array(z.string()).optional(),
+        allowReplies: z.boolean().optional(),
+      })
+    )
+    .mutation(({ ctx, input }) => updateDiscussion(ctx.user!.id, input)),
+
+  delete: protectedProcedure
+    .input(z.object({ discussionId: z.string() }))
+    .mutation(({ ctx, input }) => deleteDiscussion(ctx.user!.id, input.discussionId)),
+
+  reply: protectedProcedure
+    .input(
+      z.object({
+        discussionId: z.string(),
+        parentReplyId: z.string().optional(),
+        body: z.string().trim().min(1),
+        attachmentIds: z.array(z.string()).optional(),
+      })
+    )
+    .mutation(({ ctx, input }) => replyToDiscussion(ctx.user!.id, input)),
+
+  updateReply: protectedProcedure
+    .input(
+      z.object({
+        replyId: z.string(),
+        body: z.string().trim().min(1),
+        attachmentIds: z.array(z.string()).optional(),
+      })
+    )
+    .mutation(({ ctx, input }) => updateDiscussionReply(ctx.user!.id, input)),
+
+  deleteReply: protectedProcedure
+    .input(z.object({ replyId: z.string() }))
+    .mutation(({ ctx, input }) => deleteDiscussionReply(ctx.user!.id, input.replyId)),
+
+  pin: protectedProcedure
+    .input(z.object({ discussionId: z.string(), isPinned: z.boolean() }))
+    .mutation(({ ctx, input }) => pinDiscussion(ctx.user!.id, input.discussionId, input.isPinned)),
+
+  lock: protectedProcedure
+    .input(z.object({ discussionId: z.string(), isLocked: z.boolean() }))
+    .mutation(({ ctx, input }) => lockDiscussion(ctx.user!.id, input.discussionId, input.isLocked)),
+
+  markAcceptedAnswer: protectedProcedure
+    .input(z.object({ replyId: z.string(), accepted: z.boolean() }))
+    .mutation(({ ctx, input }) => markAcceptedAnswer(ctx.user!.id, input.replyId, input.accepted)),
+
+  markRead: protectedProcedure
+    .input(z.object({ discussionId: z.string() }))
+    .mutation(({ ctx, input }) => markDiscussionRead(ctx.user!.id, input.discussionId)),
+
+  getUnreadCounts: protectedProcedure
+    .input(z.object({ classIds: z.array(z.string()).max(100) }))
+    .query(({ ctx, input }) => getUnreadCounts(ctx.user!.id, input.classIds)),
+
+  reactions: createTRPCRouter({
+    toggle: protectedProcedure
+      .input(reactionToggleInputSchema)
+      .mutation(({ ctx, input }) => toggleDiscussionReaction(ctx.user!.id, input)),
+  }),
+
+  tags: createTRPCRouter({
+    list: protectedProcedure
+      .input(z.object({ classId: z.string() }))
+      .query(({ ctx, input }) => listDiscussionTags(ctx.user!.id, input.classId)),
+
+    create: protectedProcedure
+      .input(z.object({ classId: z.string(), name: z.string().trim().min(1).max(32), color: hexColorSchema }))
+      .mutation(({ ctx, input }) => createDiscussionTag(ctx.user!.id, input)),
+
+    update: protectedProcedure
+      .input(z.object({ tagId: z.string(), name: z.string().trim().min(1).max(32).optional(), color: hexColorSchema.optional() }))
+      .mutation(({ ctx, input }) => updateDiscussionTag(ctx.user!.id, input)),
+
+    delete: protectedProcedure
+      .input(z.object({ tagId: z.string() }))
+      .mutation(({ ctx, input }) => deleteDiscussionTag(ctx.user!.id, input.tagId)),
+  }),
+});