@studious-lms/server 1.2.52 → 1.3.0

package/src/services/attendance.ts

@@ -0,0 +1,85 @@
+/**
+ * Attendance service – get and update class attendance records.
+ * Auto-creates attendance records for events that don't have them yet.
+ */
+import { TRPCError } from "@trpc/server";
+import {
+  findClassWithStudents,
+  findClassWithTeacher,
+  findEventsByClassId,
+  findAttendanceByEventId,
+  findAttendanceByClassAndEvent,
+  findManyAttendance,
+  createAttendance,
+  createAttendanceForEvent,
+  updateAttendance,
+} from "../models/attendance.js";
+
+/** Get attendance for a class (optionally filtered by event). Creates missing records. */
+export async function getAttendance(classId: string, eventId?: string) {
+  const classData = await findClassWithStudents(classId);
+  if (!classData) {
+    throw new TRPCError({
+      code: "UNAUTHORIZED",
+      message: "You are not authorized to view this class's attendance",
+    });
+  }
+
+  const events = await findEventsByClassId(classId);
+  const studentIds = classData.students.map((s) => s.id);
+
+  for (const event of events) {
+    const existing = await findAttendanceByEventId(event.id);
+    if (!existing) {
+      await createAttendanceForEvent({
+        classId,
+        eventId: event.id,
+        presentIds: studentIds,
+      });
+    }
+  }
+
+  return findManyAttendance(classId, eventId);
+}
+
+/** Update attendance record (present/late/absent). Teacher-only. */
+export async function updateAttendanceRecord(
+  userId: string,
+  classId: string,
+  eventId: string | null | undefined,
+  attendance: {
+    present: { id: string; username: string }[];
+    late: { id: string; username: string }[];
+    absent: { id: string; username: string }[];
+  }
+) {
+  const classData = await findClassWithTeacher(classId, userId);
+  if (!classData) {
+    throw new TRPCError({
+      code: "UNAUTHORIZED",
+      message: "You are not authorized to update this class's attendance",
+    });
+  }
+
+  const existing = await findAttendanceByClassAndEvent(classId, eventId ?? null);
+
+  const presentIds = attendance.present.map((s) => s.id);
+  const lateIds = attendance.late.map((s) => s.id);
+  const absentIds = attendance.absent.map((s) => s.id);
+
+  if (!existing) {
+    return createAttendance({
+      classId,
+      eventId: eventId ?? null,
+      presentIds,
+      lateIds,
+      absentIds,
+    });
+  }
+
+  return updateAttendance(existing.id, {
+    presentIds,
+    lateIds,
+    absentIds,
+  });
+}

package/src/services/auth.ts

@@ -0,0 +1,277 @@
+/**
+ * Auth service – user registration, login, logout, verification, and password reset.
+ * Handles session creation, Redis caching, and email notifications.
+ */
+import { TRPCError } from "@trpc/server";
+import { v4 as uuidv4 } from "uuid";
+import { compare, hash } from "bcryptjs";
+import { sendMail } from "../utils/email.js";
+import { prismaWrapper } from "../utils/prismaWrapper.js";
+import { env } from "../lib/config/env.js";
+import { logger } from "../utils/logger.js";
+import {
+  findUserByUsername,
+  findUserByUsernameOrEmail,
+  findUserByEmail,
+  findUserById,
+  createUser,
+  createSession,
+  deleteSessionsByUserId,
+  deleteShortLivedSessionsByUserId,
+  deleteUserById,
+  findSessionById,
+  findSessionByIdWithUser,
+  updateUserVerified,
+  updateUserPassword,
+  deleteSessionById,
+} from "../models/auth.js";
+import { getRedis } from "../lib/redis.js";
+
+/** Register a new user, create verification session, and send verification email. */
+export async function register(input: {
+  username: string;
+  email: string;
+  password: string;
+}) {
+  const { username, email, password } = input;
+
+  const existingUser = await prismaWrapper.findFirst(
+    () => findUserByUsernameOrEmail(username, email),
+    "checking for existing user during registration"
+  );
+
+  if (existingUser && existingUser.verified) {
+    if (existingUser.username === username) {
+      throw new TRPCError({
+        code: "CONFLICT",
+        message: "Username already exists",
+      });
+    }
+    if (existingUser.email === email) {
+      throw new TRPCError({
+        code: "CONFLICT",
+        message: "Email already exists",
+      });
+    }
+  } else if (existingUser && !existingUser.verified) {
+    await prismaWrapper.deleteMany(
+      () => deleteSessionsByUserId(existingUser.id),
+      "deleting existing sessions for unverified user"
+    );
+    await prismaWrapper.delete(
+      () => deleteUserById(existingUser.id),
+      "deleting unverified user"
+    );
+  }
+
+  const user = await prismaWrapper.create(
+    async () =>
+      createUser({
+        username,
+        email,
+        password: await hash(password, 10),
+        verified: true,
+      }),
+    "creating new user during registration"
+  );
+
+  const verificationToken = await prismaWrapper.create(
+    () =>
+      createSession({
+        id: uuidv4(),
+        userId: user.id,
+        expiresAt: new Date(Date.now() + 1000 * 60 * 60 * 24 * 30),
+      }),
+    "creating verification token"
+  );
+
+  try {
+    await sendMail({
+      from: "hello@studious.sh",
+      to: user.email,
+      subject: "Verify your email",
+      text: `Click the link to verify your email: ${env.NEXT_PUBLIC_APP_URL}/verify/${verificationToken.id}`,
+    });
+  } catch (err) {
+    logger.error("Failed to send verification email", {
+      email: user.email,
+      err,
+    });
+  }
+
+  return { user: { id: user.id, username: user.username } };
+}
+
+/** Authenticate user by username/password, create session, and cache in Redis. */
+export async function login(input: { username: string; password: string }) {
+  const { username, password } = input;
+
+  const user = await findUserByUsername(username);
+  if (!user) {
+    throw new TRPCError({
+      code: "UNAUTHORIZED",
+      message: "Invalid username or password",
+    });
+  }
+
+  if (!(await compare(password, user.password))) {
+    throw new TRPCError({
+      code: "UNAUTHORIZED",
+      message: "Invalid username or password",
+    });
+  }
+
+  if (!user.verified) {
+    return {
+      verified: false,
+      user: { email: user.email },
+    };
+  }
+
+  const session = await createSession({
+    id: uuidv4(),
+    userId: user.id,
+    expiresAt: new Date(Date.now() + 1000 * 60 * 60 * 24 * 30),
+  });
+
+  const cachePayload = JSON.stringify({ id: user.id, username: user.username });
+  const ttlSeconds = 30 * 24 * 60 * 60; // 30 days, match session expiry
+  const r = getRedis();
+  if (r) await r.setex(`session:${session.id}`, ttlSeconds, cachePayload);
+
+  return {
+    token: session.id,
+    user: { id: user.id, username: user.username },
+  };
+}
+
+/** Delete all sessions for a user (logs them out everywhere). */
+export async function logout(userId: string) {
+  await deleteSessionsByUserId(userId);
+  return { success: true };
+}
+
+/** Verify user exists and return profile. Used for session validation. */
+export async function check(userId: string) {
+  const user = await findUserById(userId);
+  if (!user) {
+    throw new TRPCError({
+      code: "NOT_FOUND",
+      message: "User not found",
+    });
+  }
+  return { user };
+}
+
+/** Resend verification email. Replaces existing sessions and sends new link. */
+export async function resendVerificationEmail(email: string) {
+  const user = await findUserByEmail(email);
+  if (!user) {
+    throw new TRPCError({
+      code: "NOT_FOUND",
+      message: "User not found",
+    });
+  }
+
+  await deleteSessionsByUserId(user.id);
+
+  const verificationToken = await createSession({
+    id: uuidv4(),
+    userId: user.id,
+    expiresAt: new Date(Date.now() + 1000 * 60 * 60 * 24 * 30),
+  });
+
+  try {
+    await sendMail({
+      from: "hello@studious.sh",
+      to: user.email,
+      subject: "Verify your email",
+      text: `Click the link to verify your email: ${env.NEXT_PUBLIC_APP_URL}/verify/${verificationToken.id}`,
+    });
+  } catch (err) {
+    logger.error("Failed to send verification email", {
+      email: user.email,
+      err,
+    });
+  }
+
+  return { success: true };
+}
+
+/** Verify email via token. Marks user as verified and deletes the session. */
+export async function verify(token: string) {
+  const session = await findSessionById(token);
+  if (!session) {
+    throw new TRPCError({
+      code: "NOT_FOUND",
+      message: "Session not found",
+    });
+  }
+
+  if (session.expiresAt && session.expiresAt < new Date()) {
+    throw new TRPCError({
+      code: "UNAUTHORIZED",
+      message: "Session expired",
+    });
+  }
+
+  await updateUserVerified(session.userId!, true);
+  await deleteSessionById(token);
+  return { success: true };
+}
+
+/** Send password reset email. Silently succeeds if email not found (security). */
+export async function requestPasswordReset(email: string) {
+  const user = await findUserByEmail(email);
+  if (!user) {
+    return { success: true };
+  }
+
+  const twoHoursFromNow = new Date(Date.now() + 1000 * 60 * 60 * 2);
+  await deleteShortLivedSessionsByUserId(user.id, twoHoursFromNow);
+
+  const resetToken = await createSession({
+    id: uuidv4(),
+    userId: user.id,
+    expiresAt: new Date(Date.now() + 1000 * 60 * 60),
+  });
+
+  try {
+    await sendMail({
+      from: "hello@studious.sh",
+      to: user.email,
+      subject: "Reset your password",
+      text: `Click the link to reset your password: ${env.NEXT_PUBLIC_APP_URL}/reset-password/${resetToken.id}`,
+    });
+  } catch (err) {
+    logger.error("Failed to send password reset email", {
+      email: user.email,
+      err,
+    });
+  }
+
+  return { success: true };
+}
+
+/** Reset password using token from email. Validates token and updates password. */
+export async function resetPassword(token: string, password: string) {
+  const session = await findSessionByIdWithUser(token);
+  if (!session || !session.userId) {
+    throw new TRPCError({
+      code: "NOT_FOUND",
+      message: "Invalid or expired reset token",
+    });
+  }
+
+  if (session.expiresAt && session.expiresAt < new Date()) {
+    await deleteSessionById(token);
+    throw new TRPCError({
+      code: "UNAUTHORIZED",
+      message: "Reset token has expired",
+    });
+  }
+
+  await updateUserPassword(session.userId, await hash(password, 10));
+  await deleteSessionById(token);
+  return { success: true };
+}