@studious-lms/server 1.24.0 → 1.26.0

package/src/services/moduleItem.ts

@@ -7,6 +7,7 @@ import { prisma } from "../lib/prisma.js";
 import {
   attachFilesToModuleItem,
   createModuleItem,
+  findAccessibleFilesByIds,
   deleteModuleItem,
   findModuleItemByIdForMember,
   findModuleItemByIdForTeacher,
@@ -33,6 +34,21 @@ function assertVideoFiles(
   }
 }
 
+async function resolveExistingFiles(
+  type: ModuleItemType,
+  existingFileIds: string[],
+  userId: string
+) {
+  const accessible = await findAccessibleFilesByIds(existingFileIds, userId);
+  if (accessible.length !== new Set(existingFileIds).size) {
+    throw new TRPCError({
+      code: "FORBIDDEN",
+      message: "One or more files are not accessible",
+    });
+  }
+  assertVideoFiles(type, accessible);
+}
+
 async function assertTeacherOwnsSection(sectionId: string, userId: string) {
   const section = await prisma.section.findFirst({
     where: {
@@ -142,6 +158,9 @@ export async function createModuleItemRecord(
   }
 
   assertVideoFiles(input.type, input.files);
+  if (input.existingFileIds?.length) {
+    await resolveExistingFiles(input.type, input.existingFileIds, userId);
+  }
 
   const maxOrder = await prisma.moduleItem.aggregate({
     where: { sectionId: input.sectionId },
@@ -159,7 +178,7 @@ export async function createModuleItemRecord(
   });
 
   if (input.existingFileIds?.length) {
-    await attachFilesToModuleItem(created.id, input.existingFileIds);
+    await attachFilesToModuleItem(created.id, input.existingFileIds, userId);
   }
 
   let uploadFiles: Awaited<ReturnType<typeof createDirectUploadFiles>> = [];
@@ -173,7 +192,8 @@ export async function createModuleItemRecord(
     );
     await attachFilesToModuleItem(
       created.id,
-      uploadFiles.map((f) => f.id)
+      uploadFiles.map((f) => f.id),
+      userId
     );
   }
 
@@ -205,6 +225,9 @@ export async function updateModuleItemRecord(
 
   const nextType = input.type ?? existing.type;
   assertVideoFiles(nextType, input.files);
+  if (input.existingFileIds?.length) {
+    await resolveExistingFiles(nextType, input.existingFileIds, userId);
+  }
 
   if (input.sectionId && input.sectionId !== existing.sectionId) {
     await assertTeacherOwnsSection(input.sectionId, userId);
@@ -220,7 +243,7 @@ export async function updateModuleItemRecord(
   });
 
   if (input.existingFileIds?.length) {
-    await attachFilesToModuleItem(input.id, input.existingFileIds);
+    await attachFilesToModuleItem(input.id, input.existingFileIds, userId);
   }
 
   let uploadFiles: Awaited<ReturnType<typeof createDirectUploadFiles>> = [];
@@ -234,7 +257,8 @@ export async function updateModuleItemRecord(
     );
     await attachFilesToModuleItem(
       input.id,
-      uploadFiles.map((f) => f.id)
+      uploadFiles.map((f) => f.id),
+      userId
     );
   }
 

package/src/services/parentPortal.ts

@@ -208,10 +208,7 @@ async function assertParentOfStudent(
   return link;
 }
 
-/**
- * Read-only attendance stub for a linked child (aggregates class attendance M2M).
- * Does not touch A1 AttendanceRecord refactor.
- */
+/** Read-only attendance view for a linked child (reads AttendanceRecord). */
 export async function getChildAttendance(
   userId: string,
   input: {
@@ -234,58 +231,48 @@ export async function getChildAttendance(
   });
   const classIds = classes.map((c) => c.id);
 
-  const attendance = await prisma.attendance.findMany({
+  const attendanceRecords = await prisma.attendanceRecord.findMany({
     where: {
-      classId: { in: classIds },
-      ...(input.from || input.to
-        ? {
-            date: {
-              ...(input.from ? { gte: input.from } : {}),
-              ...(input.to ? { lte: input.to } : {}),
-            },
-          }
-        : {}),
-      OR: [
-        { present: { some: { id: input.studentUserId } } },
-        { late: { some: { id: input.studentUserId } } },
-        { absent: { some: { id: input.studentUserId } } },
-      ],
+      studentId: input.studentUserId,
+      attendance: {
+        classId: { in: classIds },
+        ...(input.from || input.to
+          ? {
+              date: {
+                ...(input.from ? { gte: input.from } : {}),
+                ...(input.to ? { lte: input.to } : {}),
+              },
+            }
+          : {}),
+      },
     },
     select: {
-      id: true,
-      date: true,
-      classId: true,
-      present: { where: { id: input.studentUserId }, select: { id: true } },
-      late: { where: { id: input.studentUserId }, select: { id: true } },
-      absent: { where: { id: input.studentUserId }, select: { id: true } },
+      status: true,
+      attendance: { select: { id: true, date: true, classId: true } },
     },
-    orderBy: { date: "desc" },
+    orderBy: { attendance: { date: "desc" } },
     take: 200,
   });
 
   const classMap = new Map(classes.map((c) => [c.id, c]));
-  const records = attendance.map((row) => {
-    let status: "PRESENT" | "LATE" | "ABSENT" = "PRESENT";
-    if (row.absent.length > 0) status = "ABSENT";
-    else if (row.late.length > 0) status = "LATE";
-    return {
-      attendanceId: row.id,
-      date: row.date,
-      classId: row.classId,
-      class: classMap.get(row.classId) ?? null,
-      status,
-    };
-  });
+  const records = attendanceRecords.map((row) => ({
+    attendanceId: row.attendance.id,
+    date: row.attendance.date,
+    classId: row.attendance.classId,
+    class: classMap.get(row.attendance.classId) ?? null,
+    status: row.status,
+  }));
 
   const summary = records.reduce(
     (acc, r) => {
       acc.total += 1;
       if (r.status === "PRESENT") acc.present += 1;
       else if (r.status === "LATE") acc.late += 1;
+      else if (r.status === "EXCUSED") acc.excused += 1;
       else acc.absent += 1;
       return acc;
     },
-    { present: 0, late: 0, absent: 0, total: 0 }
+    { present: 0, late: 0, absent: 0, excused: 0, total: 0 }
   );
 
   return { summary, records };

package/src/services/school.ts

@@ -133,6 +133,28 @@ export async function updateSchoolDetails(
   }
 ) {
   await requireSchoolAdmin(input.schoolId, userId);
+  const brandingFileIds = [input.logoId, input.letterheadFileId].filter(
+    (id): id is string => typeof id === "string"
+  );
+  if (brandingFileIds.length) {
+    const accessible = await prisma.file.findMany({
+      where: {
+        id: { in: brandingFileIds },
+        OR: [
+          { userId },
+          { folder: { schoolStorageId: input.schoolId } },
+        ],
+      },
+      select: { id: true },
+    });
+    const accessibleIds = new Set(accessible.map((f) => f.id));
+    if (brandingFileIds.some((id) => !accessibleIds.has(id))) {
+      throw new TRPCError({
+        code: "FORBIDDEN",
+        message: "File does not belong to this school",
+      });
+    }
+  }
   const updated = await updateSchoolRecord(input.schoolId, {
     name: input.name,
     description: input.description,
@@ -628,17 +650,19 @@ export async function getStudentTimeline(
     });
   }
 
+  // Default to the last 12 months when no range is given, to bound reads.
+  const defaultFrom = new Date();
+  defaultFrom.setFullYear(defaultFrom.getFullYear() - 1);
   const range = {
-    ...(input.from ? { gte: input.from } : {}),
+    gte: input.from ?? defaultFrom,
     ...(input.to ? { lte: input.to } : {}),
   };
-  const hasRange = Object.keys(range).length > 0;
-
   const [events, assignments, attendance] = await Promise.all([
     prisma.event.findMany({
       where: {
         userId: input.studentId,
-        ...(hasRange ? { startTime: range } : {}),
+        startTime: range,
+        OR: [{ classId: null }, { class: { schoolId: input.schoolId } }],
       },
       select: {
         id: true,
@@ -655,10 +679,11 @@ export async function getStudentTimeline(
     prisma.assignment.findMany({
       where: {
         class: {
+          schoolId: input.schoolId,
           students: { some: { id: input.studentId } },
         },
         template: false,
-        ...(hasRange ? { dueDate: range } : {}),
+        dueDate: range,
       },
       select: {
         id: true,
@@ -695,7 +720,7 @@ export async function getStudentTimeline(
         studentId: input.studentId,
         attendance: {
           class: { schoolId: input.schoolId },
-          ...(hasRange ? { date: range } : {}),
+          date: range,
         },
       },
       select: {
@@ -786,11 +811,13 @@ export async function getMemberTimeline(
     });
   }
 
+  // Default to the last 12 months when no range is given, to bound reads.
+  const defaultFrom = new Date();
+  defaultFrom.setFullYear(defaultFrom.getFullYear() - 1);
   const range = {
-    ...(input.from ? { gte: input.from } : {}),
+    gte: input.from ?? defaultFrom,
     ...(input.to ? { lte: input.to } : {}),
   };
-  const hasRange = Object.keys(range).length > 0;
 
   if (membership.role === "STUDENT") {
     if (!callerIsAdmin) {
@@ -814,7 +841,8 @@ export async function getMemberTimeline(
       prisma.event.findMany({
         where: {
           userId: input.memberId,
-          ...(hasRange ? { startTime: range } : {}),
+          startTime: range,
+          OR: [{ classId: null }, { class: { schoolId: input.schoolId } }],
         },
         select: {
           id: true,
@@ -830,9 +858,12 @@ export async function getMemberTimeline(
       }),
       prisma.assignment.findMany({
         where: {
-          class: { students: { some: { id: input.memberId } } },
+          class: {
+            schoolId: input.schoolId,
+            students: { some: { id: input.memberId } },
+          },
           template: false,
-          ...(hasRange ? { dueDate: range } : {}),
+          dueDate: range,
         },
         select: {
           id: true,
@@ -869,7 +900,7 @@ export async function getMemberTimeline(
           studentId: input.memberId,
           attendance: {
             class: { schoolId: input.schoolId },
-            ...(hasRange ? { date: range } : {}),
+            date: range,
           },
         },
         select: {
@@ -922,10 +953,16 @@ export async function getMemberTimeline(
     prisma.event.findMany({
       where: {
         OR: [
-          { userId: input.memberId },
-          { class: { teachers: { some: { id: input.memberId } } } },
+          { userId: input.memberId, classId: null },
+          { userId: input.memberId, class: { schoolId: input.schoolId } },
+          {
+            class: {
+              schoolId: input.schoolId,
+              teachers: { some: { id: input.memberId } },
+            },
+          },
         ],
-        ...(hasRange ? { startTime: range } : {}),
+        startTime: range,
       },
       select: {
         id: true,

package/src/services/studentImport.ts

@@ -11,9 +11,8 @@ import { randomBytes } from "crypto";
 import { hash } from "bcryptjs";
 import { TRPCError } from "@trpc/server";
 import { prisma } from "../lib/prisma.js";
-import { createUser, findUserByEmail, findUserByUsername } from "../models/auth.js";
-import { findActiveSchoolAdminMembership, upsertSchoolMembership } from "../models/school.js";
-import { upsertUserProfile } from "../models/user.js";
+import { findUserByEmail, findUserByUsername } from "../models/auth.js";
+import { findActiveSchoolAdminMembership } from "../models/school.js";
 import { generateUniqueUsername } from "../utils/generateUsername.js";
 
 export type StudentCsvRowResult =
@@ -140,8 +139,7 @@ export async function importStudentsCsv(
   for (let i = 0; i < rows.length; i += 1) {
     const rowNum = i + 2; // 1-indexed + header
     const row = rows[i]!;
-    const displayName =
-      row.displayname || row.name || row.fullname || row.fullname || "";
+    const displayName = row.displayname || row.name || row.fullname || "";
     const requestedUsername = row.username || "";
     const requestedEmail = (row.email || "").toLowerCase();
     const requestedPassword = row.password || "";
@@ -215,29 +213,43 @@ export async function importStudentsCsv(
       }
 
       const hashed = await hash(password, 10);
-      const user = await createUser({
-        username,
-        email,
-        password: hashed,
-        verified: true,
-      });
+      const user = await prisma.$transaction(async (tx) => {
+        const createdUser = await tx.user.create({
+          data: {
+            username,
+            email,
+            password: hashed,
+            verified: true,
+            profile: { create: displayName ? { displayName } : {} },
+          },
+          select: { id: true, username: true, email: true },
+        });
 
-      if (displayName) {
-        await upsertUserProfile(user.id, { displayName });
-      }
+        await tx.schoolMembership.upsert({
+          where: {
+            schoolId_userId: {
+              schoolId: input.schoolId,
+              userId: createdUser.id,
+            },
+          },
+          update: { role: "STUDENT", status: "ACTIVE" },
+          create: {
+            schoolId: input.schoolId,
+            userId: createdUser.id,
+            role: "STUDENT",
+            status: "ACTIVE",
+          },
+        });
 
-      await upsertSchoolMembership({
-        schoolId: input.schoolId,
-        userId: user.id,
-        role: "STUDENT",
-      });
+        if (classId) {
+          await tx.class.update({
+            where: { id: classId },
+            data: { students: { connect: { id: createdUser.id } } },
+          });
+        }
 
-      if (classId) {
-        await prisma.class.update({
-          where: { id: classId },
-          data: { students: { connect: { id: user.id } } },
-        });
-      }
+        return createdUser;
+      });
 
       results.push({
         ok: true,

package/src/services/transcript.ts

@@ -8,9 +8,8 @@
  * AcademicTerm (C1) is not modelled yet — accept `from`/`to` date range and/or
  * a free-text `schoolYear` string for the report header.
  *
- * Attendance is read via the existing present/late/absent M2M lists only
- * (same shaping as getStudentTimeline). Do not conflict with A1 Attendance
- * refactor — rate math lives in attendanceRate.ts.
+ * Attendance is read from AttendanceRecord (EXCUSED excluded from the rate
+ * denominator) — rate math lives in attendanceRate.ts.
  */
 
 import { TRPCError } from "@trpc/server";
@@ -93,30 +92,19 @@ async function fetchStudentAttendance(
   };
   const hasRange = Object.keys(range).length > 0;
 
-  // Same M2M present/late/absent read path as getStudentTimeline (A1-safe).
-  const attendance = await prisma.attendance.findMany({
+  // Read AttendanceRecord so EXCUSED records are excluded from the rate
+  // denominator (computeAttendanceRate ignores non-PRESENT/LATE/ABSENT).
+  const records = await prisma.attendanceRecord.findMany({
     where: {
-      OR: [
-        { present: { some: { id: studentId } } },
-        { late: { some: { id: studentId } } },
-        { absent: { some: { id: studentId } } },
-      ],
-      ...(hasRange ? { date: range } : {}),
-    },
-    select: {
-      id: true,
-      present: { where: { id: studentId }, select: { id: true } },
-      late: { where: { id: studentId }, select: { id: true } },
-      absent: { where: { id: studentId }, select: { id: true } },
+      studentId,
+      status: { in: ["PRESENT", "LATE", "ABSENT"] },
+      ...(hasRange ? { attendance: { date: range } } : {}),
     },
+    select: { status: true },
   });
 
-  return attendance.map((record) => ({
-    status: record.present.length
-      ? ("PRESENT" as const)
-      : record.late.length
-        ? ("LATE" as const)
-        : ("ABSENT" as const),
+  return records.map((record) => ({
+    status: record.status as "PRESENT" | "LATE" | "ABSENT",
   }));
 }