@studious-lms/server 1.23.0 → 1.25.0

package/src/services/school.ts

@@ -85,6 +85,9 @@ export async function getCurrentSchool(userId: string, schoolId?: string) {
         // signed URL through trpc.file.getSignedUrl when needed.
         logoPath: activeMembership.school.logo?.path ?? null,
         logoType: activeMembership.school.logo?.type ?? null,
+        letterheadFileId: activeMembership.school.letterheadFileId ?? null,
+        letterheadPath: activeMembership.school.letterhead?.path ?? null,
+        letterheadType: activeMembership.school.letterhead?.type ?? null,
       }
     : null;
 
@@ -126,14 +129,38 @@ export async function updateSchoolDetails(
     description?: string | null;
     subdomain?: string | null;
     logoId?: string | null;
+    letterheadFileId?: string | null;
   }
 ) {
   await requireSchoolAdmin(input.schoolId, userId);
+  const brandingFileIds = [input.logoId, input.letterheadFileId].filter(
+    (id): id is string => typeof id === "string"
+  );
+  if (brandingFileIds.length) {
+    const accessible = await prisma.file.findMany({
+      where: {
+        id: { in: brandingFileIds },
+        OR: [
+          { userId },
+          { folder: { schoolStorageId: input.schoolId } },
+        ],
+      },
+      select: { id: true },
+    });
+    const accessibleIds = new Set(accessible.map((f) => f.id));
+    if (brandingFileIds.some((id) => !accessibleIds.has(id))) {
+      throw new TRPCError({
+        code: "FORBIDDEN",
+        message: "File does not belong to this school",
+      });
+    }
+  }
   const updated = await updateSchoolRecord(input.schoolId, {
     name: input.name,
     description: input.description,
     subdomain: input.subdomain,
     logoId: input.logoId,
+    letterheadFileId: input.letterheadFileId,
   });
   return { school: updated };
 }
@@ -153,7 +180,13 @@ export async function getAdminOverview(userId: string, schoolId: string) {
       counts[membership.role] += 1;
       return counts;
     },
-    { ADMIN: 0, TEACHER: 0, STUDENT: 0 } satisfies Record<SchoolMembershipRole, number>
+    {
+      ADMIN: 0,
+      TEACHER: 0,
+      STUDENT: 0,
+      ACCOUNTANT: 0,
+      PARENT: 0,
+    } satisfies Record<SchoolMembershipRole, number>
   );
 
   return {
@@ -523,7 +556,7 @@ export async function searchMembers(
   schoolId: string,
   query: string,
   limit = 10,
-  role?: "ADMIN" | "TEACHER" | "STUDENT"
+  role?: SchoolMembershipRole
 ) {
   await requireSchoolMember(schoolId, userId);
   const trimmed = query.trim();
@@ -617,17 +650,18 @@ export async function getStudentTimeline(
     });
   }
 
+  // Default to the last 12 months when no range is given, to bound reads.
+  const defaultFrom = new Date();
+  defaultFrom.setFullYear(defaultFrom.getFullYear() - 1);
   const range = {
-    ...(input.from ? { gte: input.from } : {}),
+    gte: input.from ?? defaultFrom,
     ...(input.to ? { lte: input.to } : {}),
   };
-  const hasRange = Object.keys(range).length > 0;
-
   const [events, assignments, attendance] = await Promise.all([
     prisma.event.findMany({
       where: {
         userId: input.studentId,
-        ...(hasRange ? { startTime: range } : {}),
+        startTime: range,
       },
       select: {
         id: true,
@@ -647,7 +681,7 @@ export async function getStudentTimeline(
           students: { some: { id: input.studentId } },
         },
         template: false,
-        ...(hasRange ? { dueDate: range } : {}),
+        dueDate: range,
       },
       select: {
         id: true,
@@ -679,36 +713,41 @@ export async function getStudentTimeline(
       },
       orderBy: { dueDate: "asc" },
     }),
-    prisma.attendance.findMany({
+    prisma.attendanceRecord.findMany({
       where: {
-        OR: [
-          { present: { some: { id: input.studentId } } },
-          { late: { some: { id: input.studentId } } },
-          { absent: { some: { id: input.studentId } } },
-        ],
-        ...(hasRange ? { date: range } : {}),
+        studentId: input.studentId,
+        attendance: {
+          class: { schoolId: input.schoolId },
+          date: range,
+        },
       },
       select: {
         id: true,
-        date: true,
-        class: { select: { id: true, name: true, color: true } },
-        present: { where: { id: input.studentId }, select: { id: true } },
-        late: { where: { id: input.studentId }, select: { id: true } },
-        absent: { where: { id: input.studentId }, select: { id: true } },
+        status: true,
+        note: true,
+        excusedByExcusalId: true,
+        attendance: {
+          select: {
+            id: true,
+            date: true,
+            class: { select: { id: true, name: true, color: true } },
+          },
+        },
+        excusedByExcusal: { select: { id: true, reason: true } },
       },
-      orderBy: { date: "asc" },
+      orderBy: { attendance: { date: "asc" } },
     }),
   ]);
 
   const attendanceShaped = attendance.map((record) => ({
-    id: record.id,
-    date: record.date,
-    class: record.class,
-    status: record.present.length
-      ? ("PRESENT" as const)
-      : record.late.length
-        ? ("LATE" as const)
-        : ("ABSENT" as const),
+    id: record.attendance.id,
+    recordId: record.id,
+    date: record.attendance.date,
+    class: record.attendance.class,
+    status: record.status,
+    note: record.note,
+    lockedFromExcusal: Boolean(record.excusedByExcusalId),
+    reason: record.excusedByExcusal?.reason ?? null,
   }));
 
   return {
@@ -770,11 +809,13 @@ export async function getMemberTimeline(
     });
   }
 
+  // Default to the last 12 months when no range is given, to bound reads.
+  const defaultFrom = new Date();
+  defaultFrom.setFullYear(defaultFrom.getFullYear() - 1);
   const range = {
-    ...(input.from ? { gte: input.from } : {}),
+    gte: input.from ?? defaultFrom,
     ...(input.to ? { lte: input.to } : {}),
   };
-  const hasRange = Object.keys(range).length > 0;
 
   if (membership.role === "STUDENT") {
     if (!callerIsAdmin) {
@@ -798,7 +839,7 @@ export async function getMemberTimeline(
       prisma.event.findMany({
         where: {
           userId: input.memberId,
-          ...(hasRange ? { startTime: range } : {}),
+          startTime: range,
         },
         select: {
           id: true,
@@ -816,7 +857,7 @@ export async function getMemberTimeline(
         where: {
           class: { students: { some: { id: input.memberId } } },
           template: false,
-          ...(hasRange ? { dueDate: range } : {}),
+          dueDate: range,
         },
         select: {
           id: true,
@@ -848,36 +889,41 @@ export async function getMemberTimeline(
         },
         orderBy: { dueDate: "asc" },
       }),
-      prisma.attendance.findMany({
+      prisma.attendanceRecord.findMany({
         where: {
-          OR: [
-            { present: { some: { id: input.memberId } } },
-            { late: { some: { id: input.memberId } } },
-            { absent: { some: { id: input.memberId } } },
-          ],
-          ...(hasRange ? { date: range } : {}),
+          studentId: input.memberId,
+          attendance: {
+            class: { schoolId: input.schoolId },
+            date: range,
+          },
         },
         select: {
           id: true,
-          date: true,
-          class: { select: { id: true, name: true, color: true } },
-          present: { where: { id: input.memberId }, select: { id: true } },
-          late: { where: { id: input.memberId }, select: { id: true } },
-          absent: { where: { id: input.memberId }, select: { id: true } },
+          status: true,
+          note: true,
+          excusedByExcusalId: true,
+          attendance: {
+            select: {
+              id: true,
+              date: true,
+              class: { select: { id: true, name: true, color: true } },
+            },
+          },
+          excusedByExcusal: { select: { id: true, reason: true } },
         },
-        orderBy: { date: "asc" },
+        orderBy: { attendance: { date: "asc" } },
       }),
     ]);
 
     const attendanceShaped = attendance.map((record) => ({
-      id: record.id,
-      date: record.date,
-      class: record.class,
-      status: record.present.length
-        ? ("PRESENT" as const)
-        : record.late.length
-          ? ("LATE" as const)
-          : ("ABSENT" as const),
+      id: record.attendance.id,
+      recordId: record.id,
+      date: record.attendance.date,
+      class: record.attendance.class,
+      status: record.status,
+      note: record.note,
+      lockedFromExcusal: Boolean(record.excusedByExcusalId),
+      reason: record.excusedByExcusal?.reason ?? null,
     }));
 
     return {
@@ -904,7 +950,7 @@ export async function getMemberTimeline(
           { userId: input.memberId },
           { class: { teachers: { some: { id: input.memberId } } } },
         ],
-        ...(hasRange ? { startTime: range } : {}),
+        startTime: range,
       },
       select: {
         id: true,

package/src/services/studentImport.ts

@@ -0,0 +1,285 @@
+/**
+ * C3: Bulk student CSV onboarding under school admin.
+ *
+ * CSV columns (header row required):
+ *   displayName, username?, email?, password?, classId?
+ *
+ * Username/password are generated when omitted. Email is optional — a
+ * placeholder local-part is used so the User.email uniqueness constraint holds.
+ */
+import { randomBytes } from "crypto";
+import { hash } from "bcryptjs";
+import { TRPCError } from "@trpc/server";
+import { prisma } from "../lib/prisma.js";
+import { findUserByEmail, findUserByUsername } from "../models/auth.js";
+import { findActiveSchoolAdminMembership } from "../models/school.js";
+import { generateUniqueUsername } from "../utils/generateUsername.js";
+
+export type StudentCsvRowResult =
+  | {
+      ok: true;
+      row: number;
+      userId: string;
+      username: string;
+      email: string;
+      password: string;
+      displayName: string | null;
+      classId: string | null;
+      generatedUsername: boolean;
+      generatedPassword: boolean;
+      placeholderEmail: boolean;
+    }
+  | {
+      ok: false;
+      row: number;
+      error: string;
+      raw?: string;
+    };
+
+function parseCsvLine(line: string): string[] {
+  const cells: string[] = [];
+  let current = "";
+  let inQuotes = false;
+  for (let i = 0; i < line.length; i += 1) {
+    const ch = line[i];
+    if (inQuotes) {
+      if (ch === '"') {
+        if (line[i + 1] === '"') {
+          current += '"';
+          i += 1;
+        } else {
+          inQuotes = false;
+        }
+      } else {
+        current += ch;
+      }
+    } else if (ch === '"') {
+      inQuotes = true;
+    } else if (ch === ",") {
+      cells.push(current.trim());
+      current = "";
+    } else {
+      current += ch;
+    }
+  }
+  cells.push(current.trim());
+  return cells;
+}
+
+function normalizeHeader(h: string) {
+  return h.trim().toLowerCase().replace(/[\s_]+/g, "");
+}
+
+function generatePassword(length = 12) {
+  const alphabet = "ABCDEFGHJKLMNPQRSTUVWXYZabcdefghijkmnopqrstuvwxyz23456789";
+  const bytes = randomBytes(length);
+  let out = "";
+  for (let i = 0; i < length; i += 1) {
+    out += alphabet[bytes[i]! % alphabet.length];
+  }
+  return out;
+}
+
+function placeholderEmail(username: string) {
+  const safe = username.toLowerCase().replace(/[^a-z0-9._-]/g, "");
+  return `${safe || "student"}.${randomBytes(3).toString("hex")}@noemail.studious.local`;
+}
+
+export function parseStudentCsv(csvText: string): {
+  headers: string[];
+  rows: Record<string, string>[];
+} {
+  const lines = csvText
+    .replace(/^\uFEFF/, "")
+    .split(/\r?\n/)
+    .map((l) => l.trim())
+    .filter((l) => l.length > 0);
+  if (lines.length < 2) {
+    throw new TRPCError({
+      code: "BAD_REQUEST",
+      message: "CSV must include a header row and at least one data row",
+    });
+  }
+  const headers = parseCsvLine(lines[0]!).map(normalizeHeader);
+  const rows = lines.slice(1).map((line) => {
+    const cells = parseCsvLine(line);
+    const row: Record<string, string> = {};
+    headers.forEach((h, i) => {
+      row[h] = cells[i] ?? "";
+    });
+    return row;
+  });
+  return { headers, rows };
+}
+
+export async function importStudentsCsv(
+  userId: string,
+  input: { schoolId: string; csvText: string; dryRun?: boolean }
+) {
+  const membership = await findActiveSchoolAdminMembership(input.schoolId, userId);
+  if (!membership) {
+    throw new TRPCError({
+      code: "FORBIDDEN",
+      message: "Only school admins can perform this action",
+    });
+  }
+
+  const { rows } = parseStudentCsv(input.csvText);
+  if (rows.length > 500) {
+    throw new TRPCError({
+      code: "BAD_REQUEST",
+      message: "CSV import is limited to 500 rows per request",
+    });
+  }
+
+  const results: StudentCsvRowResult[] = [];
+  let created = 0;
+  let failed = 0;
+
+  for (let i = 0; i < rows.length; i += 1) {
+    const rowNum = i + 2; // 1-indexed + header
+    const row = rows[i]!;
+    const displayName = row.displayname || row.name || row.fullname || "";
+    const requestedUsername = row.username || "";
+    const requestedEmail = (row.email || "").toLowerCase();
+    const requestedPassword = row.password || "";
+    const classId = row.classid || row.class || "";
+
+    try {
+      if (!displayName && !requestedUsername && !requestedEmail) {
+        throw new Error("Row needs displayName, username, or email");
+      }
+
+      let username = requestedUsername;
+      let generatedUsername = false;
+      if (!username) {
+        username = await generateUniqueUsername(async (candidate) => {
+          const existing = await findUserByUsername(candidate);
+          return Boolean(existing);
+        });
+        generatedUsername = true;
+      } else {
+        const taken = await findUserByUsername(username);
+        if (taken) {
+          throw new Error(`Username "${username}" already taken`);
+        }
+      }
+
+      let email = requestedEmail;
+      let placeholderEmailUsed = false;
+      if (!email) {
+        email = placeholderEmail(username);
+        placeholderEmailUsed = true;
+      } else {
+        const existing = await findUserByEmail(email);
+        if (existing) {
+          throw new Error(`Email "${email}" already in use`);
+        }
+      }
+
+      let password = requestedPassword;
+      let generatedPassword = false;
+      if (!password) {
+        password = generatePassword();
+        generatedPassword = true;
+      }
+
+      if (classId) {
+        const cls = await prisma.class.findFirst({
+          where: { id: classId, schoolId: input.schoolId },
+          select: { id: true },
+        });
+        if (!cls) {
+          throw new Error(`classId "${classId}" not found in this school`);
+        }
+      }
+
+      if (input.dryRun) {
+        results.push({
+          ok: true,
+          row: rowNum,
+          userId: "dry-run",
+          username,
+          email,
+          password,
+          displayName: displayName || null,
+          classId: classId || null,
+          generatedUsername,
+          generatedPassword,
+          placeholderEmail: placeholderEmailUsed,
+        });
+        created += 1;
+        continue;
+      }
+
+      const hashed = await hash(password, 10);
+      const user = await prisma.$transaction(async (tx) => {
+        const createdUser = await tx.user.create({
+          data: {
+            username,
+            email,
+            password: hashed,
+            verified: true,
+            profile: { create: displayName ? { displayName } : {} },
+          },
+          select: { id: true, username: true, email: true },
+        });
+
+        await tx.schoolMembership.upsert({
+          where: {
+            schoolId_userId: {
+              schoolId: input.schoolId,
+              userId: createdUser.id,
+            },
+          },
+          update: { role: "STUDENT", status: "ACTIVE" },
+          create: {
+            schoolId: input.schoolId,
+            userId: createdUser.id,
+            role: "STUDENT",
+            status: "ACTIVE",
+          },
+        });
+
+        if (classId) {
+          await tx.class.update({
+            where: { id: classId },
+            data: { students: { connect: { id: createdUser.id } } },
+          });
+        }
+
+        return createdUser;
+      });
+
+      results.push({
+        ok: true,
+        row: rowNum,
+        userId: user.id,
+        username: user.username,
+        email: user.email,
+        password,
+        displayName: displayName || null,
+        classId: classId || null,
+        generatedUsername,
+        generatedPassword,
+        placeholderEmail: placeholderEmailUsed,
+      });
+      created += 1;
+    } catch (err) {
+      failed += 1;
+      results.push({
+        ok: false,
+        row: rowNum,
+        error: err instanceof Error ? err.message : "Unknown error",
+      });
+    }
+  }
+
+  return {
+    dryRun: Boolean(input.dryRun),
+    created,
+    failed,
+    total: rows.length,
+    results,
+  };
+}