@studious-lms/server 1.2.44 → 1.2.46

package/src/routers/auth.ts

@@ -4,8 +4,10 @@ import { TRPCError } from "@trpc/server";
 import { prisma } from "../lib/prisma.js";
 import { v4 as uuidv4 } from 'uuid';
 import { compare, hash } from "bcryptjs";
-import { transport } from "../utils/email.js";
+import { sendMail } from "../utils/email.js";
 import { prismaWrapper } from "../utils/prismaWrapper.js";
+import { env } from "../lib/config/env.js";
+import { logger } from "../utils/logger.js";
 
 const loginSchema = z.object({
   username: z.string(),
@@ -106,14 +108,18 @@ export const authRouter = createTRPCRouter({
         'creating verification token'
       );
 
-      // await transport.sendMail({
-      //   from: 'noreply@studious.sh',
-      //   to: user.email,
-      //   subject: 'Verify your email',
-      //   text: `Click the link to verify your email: ${process.env.NEXT_PUBLIC_APP_URL}/verify/${verificationToken.id}`,
-      // });
+      try {
+        await sendMail({
+        from: 'noreply@studious.sh',
+        to: user.email,
+        subject: 'Verify your email',
+          text: `Click the link to verify your email: ${env.NEXT_PUBLIC_APP_URL}/verify/${verificationToken.id}`,
+        });
+      } catch (err) {
+        logger.error('Failed to send verification email', { email: user.email, err });
+      }
 
-      console.log(`${process.env.NEXT_PUBLIC_APP_URL}/verify/${verificationToken.id}`)
+      // logger.info(`Password verification email sent to ${user.email} at ${env.NEXT_PUBLIC_APP_URL}/verify/${verificationToken.id}`);
 
       return {
         user: {
@@ -280,12 +286,18 @@ export const authRouter = createTRPCRouter({
           },
         });
         
-        // await transport.sendMail({
-        //   from: 'noreply@studious.sh',
-        //   to: user.email,
-        //   subject: 'Verify your email',
-        //   text: `Click the link to verify your email: ${process.env.NEXT_PUBLIC_APP_URL}/verify/${verificationToken.id}`,
-        // });
+        try {
+          await sendMail({
+          from: 'noreply@studious.sh',
+          to: user.email,
+            subject: 'Verify your email',
+            text: `Click the link to verify your email: ${env.NEXT_PUBLIC_APP_URL}/verify/${verificationToken.id}`,
+          });
+        } catch (err) {
+          logger.error('Failed to send verification email', { email: user.email, err });
+        }
+
+        // logger.info(`Password verification email sent to ${user.email} at ${env.NEXT_PUBLIC_APP_URL}/verify/${verificationToken.id}`);
 
         return { success: true };
       }),
@@ -326,6 +338,123 @@ export const authRouter = createTRPCRouter({
           where: { id: token },
         });
 
+        return { success: true };
+      }),
+
+    requestPasswordReset: publicProcedure
+      .input(z.object({
+        email: z.string().email(),
+      }))
+      .mutation(async ({ input }) => {
+        const { email } = input;
+
+        const user = await prisma.user.findFirst({
+          where: { email },
+          select: {
+            id: true,
+            email: true,
+            username: true,
+          },
+        });
+
+        // Don't reveal if user exists or not for security
+        if (!user) {
+          return { success: true };
+        }
+
+        // Delete any existing password reset tokens for this user
+        // Only delete tokens that expire within 2 hours (likely password reset tokens)
+        const twoHoursFromNow = new Date(Date.now() + 1000 * 60 * 60 * 2);
+        await prisma.session.deleteMany({
+          where: { 
+            userId: user.id,
+            classId: null,
+            expiresAt: {
+              lte: twoHoursFromNow, // Only delete short-lived tokens (password reset tokens)
+            },
+          },
+        });
+
+        // Create a new password reset token (expires in 1 hour)
+        const resetToken = await prisma.session.create({
+          data: {
+            id: uuidv4(),
+            userId: user.id,
+            expiresAt: new Date(Date.now() + 1000 * 60 * 60), // 1 hour
+          },
+        });
+
+        // Send password reset email
+        try {
+          await sendMail({
+            from: 'noreply@studious.sh',
+            to: user.email,
+            subject: 'Reset your password',
+            text: `Click the link to reset your password: ${env.NEXT_PUBLIC_APP_URL}/reset-password/${resetToken.id}`,
+          });
+        } catch (err) {
+          logger.error('Failed to send password reset email', { email: user.email, err });
+        }
+
+        // logger.info(`Password reset email sent to ${user.email} at ${env.NEXT_PUBLIC_APP_URL}/reset-password/${resetToken.id}`);
+
+        return { success: true };
+      }),
+
+    resetPassword: publicProcedure
+      .input(z.object({
+        token: z.string(),
+        password: z.string().min(6, "Password must be at least 6 characters"),
+        confirmPassword: z.string(),
+      }).refine((data) => data.password === data.confirmPassword, {
+        message: "Passwords don't match",
+        path: ["confirmPassword"],
+      }))
+      .mutation(async ({ input }) => {
+        const { token, password } = input;
+
+        const session = await prisma.session.findUnique({
+          where: { id: token },
+          include: {
+            user: {
+              select: {
+                id: true,
+              },
+            },
+          },
+        });
+
+        if (!session || !session.userId) {
+          throw new TRPCError({
+            code: "NOT_FOUND",
+            message: "Invalid or expired reset token",
+          });
+        }
+
+        if (session.expiresAt && session.expiresAt < new Date()) {
+          // Clean up expired token
+          await prisma.session.delete({
+            where: { id: token },
+          });
+          throw new TRPCError({
+            code: "UNAUTHORIZED",
+            message: "Reset token has expired",
+          });
+        }
+
+        // Update the user's password
+        await prisma.user.update({
+          where: { id: session.userId },
+          data: {
+            password: await hash(password, 10),
+          },
+        });
+
+        // Clean up the reset token
+        await prisma.session.delete({
+          where: { id: token },
+        });
+
         return { success: true };
       }),
 }); 

package/src/routers/class.ts

@@ -465,6 +465,51 @@ export const classRouter = createTRPCRouter({
         removedUserId: userId,
       };
     }),
+  leaveClass: protectedProcedure
+    .input(z.object({
+      classId: z.string(),
+    }))
+    .mutation(async ({ ctx, input }) => {
+      const { classId } = input;
+      const userId = ctx.user?.id;
+
+      if (!userId) {
+        throw new TRPCError({
+          code: 'UNAUTHORIZED',
+          message: 'User not authenticated',
+        });
+      }
+
+      const classData = await prisma.class.findFirst({
+        where: {
+          id: classId,
+          students: {
+            some: { id: userId },
+          },
+        },
+      });
+
+      if (!classData) {
+        throw new TRPCError({
+          code: 'NOT_FOUND',
+          message: 'Class not found or you are not a student in this class',
+        });
+      }
+
+      await prisma.class.update({
+        where: { id: classId },
+        data: {
+          students: {
+            disconnect: { id: userId },
+          },
+        },
+      });
+
+      return {
+        success: true,
+        leftClassId: classId,
+      };
+    }),
   join: protectedProcedure
     .input(z.object({
       classCode: z.string(),
@@ -472,9 +517,13 @@ export const classRouter = createTRPCRouter({
     .mutation(async ({ ctx, input }) => {
       const { classCode } = input;
 
+      // Case-insensitive search for invite code
       const session = await prisma.session.findFirst({
         where: {
-          id: classCode,
+          id: {
+            equals: classCode,
+            mode: 'insensitive',
+          },
         },
       });
 
@@ -676,7 +725,7 @@ export const classRouter = createTRPCRouter({
 
         return events;
       }),
-    listMarkSchemes: protectedTeacherProcedure
+    listMarkSchemes: protectedClassMemberProcedure
       .input(z.object({
         classId: z.string(),
       }))
@@ -755,7 +804,7 @@ export const classRouter = createTRPCRouter({
 
         return markScheme;
       }),
-    listGradingBoundaries: protectedTeacherProcedure
+    listGradingBoundaries: protectedClassMemberProcedure
       .input(z.object({
         classId: z.string(),
       }))

package/src/routers/comment.ts

@@ -75,6 +75,13 @@ export const commentRouter = createTRPCRouter({
                     select: {
                         id: true,
                         username: true,
+                        profile: {
+                            select: {
+                                displayName: true,
+                                profilePicture: true,
+                                profilePictureThumbnail: true,
+                            },
+                        },
                     },
                 },
             }

package/src/routers/conversation.ts

@@ -148,51 +148,69 @@ export const conversationRouter = createTRPCRouter({
 
       // For DMs, check if conversation already exists
       if (type === 'DM') {
-        const existingDM = await prisma.conversation.findFirst({
+        // Get the target user's ID from their username
+        const targetUser = await prisma.user.findFirst({
+          where: { username: memberIds[0] },
+          select: { id: true, username: true },
+        });
+
+        if (!targetUser) {
+          throw new TRPCError({
+            code: 'BAD_REQUEST',
+            message: `User "${memberIds[0]}" not found`,
+          });
+        }
+
+        // Find all DM conversations where current user is a member
+        const existingDMs = await prisma.conversation.findMany({
           where: {
             type: 'DM',
             members: {
-              every: {
-                userId: {
-                  in: [userId, memberIds[0]],
-                },
-              },
-            },
-            AND: {
-              members: {
-                some: {
-                  userId,
-                },
+              some: {
+                userId,
               },
             },
           },
           include: {
             members: {
-              include: {
-                user: {
-                  select: {
-                    id: true,
-                    username: true,
-                    profile: {
-                      select: {
-                        displayName: true,
-                        profilePicture: true,
-                      },
-                    },
-                  },
-                },
+              select: {
+                userId: true,
               },
             },
           },
         });
 
+        // Check if any of these conversations has exactly 2 members (current user + target user)
+        const existingDM = existingDMs.find(conv => {
+          const memberUserIds = conv.members.map(m => m.userId);
+          return memberUserIds.length === 2 &&
+                 memberUserIds.includes(userId) &&
+                 memberUserIds.includes(targetUser.id);
+        });
+
         if (existingDM) {
-          return existingDM;
+          // Conversation already exists, throw error with friendly message
+          throw new TRPCError({
+            code: 'BAD_REQUEST',
+            message: `A conversation with ${targetUser.username} already exists`,
+          });
         }
       }
 
       // Verify all members exist
-      const members = await prisma.user.findMany({
+      const membersWithIds = await prisma.user.findMany({
+        where: {
+          id: {
+            in: memberIds,
+          },
+        },
+        select: {
+          id: true,
+          username: true,
+        },
+      });
+
+      const membersWithUsernames = await prisma.user.findMany({
         where: {
           username: {
             in: memberIds,
@@ -204,6 +222,8 @@ export const conversationRouter = createTRPCRouter({
         },
       });
 
+      const members = [...membersWithIds, ...membersWithUsernames];
+
       if (members.length !== memberIds.length) {
         throw new TRPCError({
           code: 'BAD_REQUEST',
@@ -222,8 +242,8 @@ export const conversationRouter = createTRPCRouter({
                 userId,
                 role: type === 'GROUP' ? 'ADMIN' : 'MEMBER',
               },
-              ...memberIds.map((memberId) => ({
-                userId: members.find((member) => member.username === memberId)!.id,
+              ...members.map((member) => ({
+                userId: member.id,
                 role: 'MEMBER' as const,
               })),
             ],

package/src/routers/file.ts

@@ -73,6 +73,16 @@ export const fileRouter = createTRPCRouter({
                 }
               }
             }
+          },
+          announcement: {
+            include: {
+              class: {
+                include: {
+                  students: true,
+                  teachers: true
+                }
+              }
+            }
           }
         }
       });
@@ -92,18 +102,30 @@ export const fileRouter = createTRPCRouter({
       // Check if user is a teacher of the class
       if (file.assignment?.class) {
         classId = file.assignment.class.id;
-        hasAccess = file.assignment.class.teachers.some(teacher => teacher.id === userId) || false;
+        const isTeacher = file.assignment.class.teachers.some(teacher => teacher.id === userId);
+        const isStudent = file.assignment.class.students.some(student => student.id === userId);
+        logger.info(`Assignment file access check - userId: ${userId}, isTeacher: ${isTeacher}, isStudent: ${isStudent}`);
+        hasAccess = isTeacher || isStudent;
+      }
+
+      // Check if user has access to announcement files (teachers or students in the class)
+      if ((file as any).announcement?.class) {
+        classId = (file as any).announcement.class.id;
+        const isTeacher = (file as any).announcement.class.teachers.some((teacher: any) => teacher.id === userId);
+        const isStudent = (file as any).announcement.class.students.some((student: any) => student.id === userId);
+        logger.info(`Announcement file access check - userId: ${userId}, isTeacher: ${isTeacher}, isStudent: ${isStudent}`);
+        hasAccess = hasAccess || isTeacher || isStudent;
       }
 
       if (file.submission?.assignment?.classId) {
         classId = file.submission.assignment.classId;
-        hasAccess = file.submission?.studentId === userId || false;
+        hasAccess = hasAccess || file.submission?.studentId === userId || false;
         if (!hasAccess) hasAccess = file.submission.assignment.class.teachers.some(teacher => teacher.id === userId) || false;
       }
 
       if (file.annotations?.assignment?.classId) {
         classId = file.annotations?.assignment.classId;
-        hasAccess = file.annotations?.studentId === userId || false;
+        hasAccess = hasAccess || file.annotations?.studentId === userId || false;
         if (!hasAccess) hasAccess = file.annotations.assignment.class.teachers.some(teacher => teacher.id === userId) || false;
       }
 
@@ -114,8 +136,10 @@ export const fileRouter = createTRPCRouter({
 
       // Check if file is in a folder and user has access to the class
       if (file.folder?.class) {
-        hasAccess = hasAccess || file.folder.class.teachers.some(teacher => teacher.id === userId);
-        hasAccess = hasAccess || file.folder.class.students.some(student => student.id === userId);
+        const isTeacher = file.folder.class.teachers.some(teacher => teacher.id === userId);
+        const isStudent = file.folder.class.students.some(student => student.id === userId);
+        hasAccess = hasAccess || isTeacher;
+        hasAccess = hasAccess || isStudent;
       }
 
       if (!hasAccess) {

package/src/routers/labChat.ts

@@ -902,7 +902,6 @@ WHEN CREATING COURSE MATERIALS (docs field):
       if (jsonData.docs && Array.isArray(jsonData.docs)) {
         
 
-        console.log('Generating PDFs', { labChatId, docs: JSON.stringify(jsonData.docs, null, 2) });
         for (let i = 0; i < jsonData.docs.length; i++) {
           const doc = jsonData.docs[i];
           if (!doc.title || !doc.blocks || !Array.isArray(doc.blocks)) {